This paper considers the design-phase safety analysis of vehicle guidance systems. The proposed approach constructs dynamic fault trees (DFTs) to model a variety of safety concepts and E/E architectures for drive automation. The fault trees can be used to evaluate various quantitative measures by means of model checking. The approach is accompanied by a large-scale evaluation: The resulting DFTs with up to 300 elements constitute larger-than-before DFTs, yet the concepts and architectures can be evaluated in a matter of minutes. Figure 1: Overview of the model-based safety approachfunctions with a sufficiently low probability of undetected dangerous hardware failures. This paper considers the design-phase safety analysis of the vehicle guidance system, a key functional block of a vehicle with a high safety integrity level (ASIL D, i.e., allowing not more than 10 −8 residual hardware failures per hour). The key point of our approach is to: (1) manually construct dynamic fault trees [2] (DFTs) from industrial system descriptions and combine them (in an automated manner) with hardware failure models for several partitionings of functions on hardware, and (2) analyse the resulting overall DFTs by means of probabilistic model checking [3,4,5].A model-based approach. Fig. 1 summarises the approach, in relation to the structure of this paper. The failure behaviour of the functional architecture, given as a functional block diagram (FBD), is expressed as a two-level DFT: the upper level models a system failure in terms of block failures B i while the lower level models the causes of block failures B i . The use of fault trees is natural: They are a well-known model in reliability engineering. No familiarity with additional formalisms is required. Fault trees for hardware components are typically provided by manufacturers. Failures in function blocks can easily be described by fault trees. The use of DFTs rather than static fault trees allows to model warm and cold redundancies, spare components, and state-dependent faults; cf. [6]. Each functional block is assigned to a hardware platform for which (by assumption) a provided DFT H i models its failure behaviour. Depending on the partitioning, the communication goes via different fallible buses that are also modelled by DFTs Bus i . From the partitioning, and the DFTs of the hardware and the functional level, an overall DFT is constructed (in an automated manner) consisting of three layers: (1) the system layer; (2) the block layer; and (3) the hardware layer. Details are discussed in Sect. 4.Analysis. We exploit probabilistic model checking (PMC) [3,4,5] to analyse the DFT of the overall vehicle guidance system. PMC can be used as a black-box algorithm-no expertise in PMC is needed to understand its outcomes-and supports various metrics that go beyond reliability and MTTF [7]. While they are all expressible by a combination of PMC queries, the number of queries is prohibitively large for some measures relevant for the safety analysis of highly automated cars. Therefore, w...

No abstract

No abstract

No abstract