A SysML Profile for Fault Trees—Linking Safety Models to System Design

Abstract

Model Based Systems Engineering (MBSE) has encouraged the use of a single systems model in languages such as SysML that fully specify the system and which form the basis of all development effort. However, using SysML models for safety analysis has been restricted by the lack of defined modelling standards for analytical techniques like Fault Tree Analysis (FTA). In lieu of such standards, the ENCASE project has formulated a simple SysML profile that captures the information required to represent fault trees and which enables the linkage of failure modes to other parts of the SysML model. Unlike traditional fault trees that can be difficult to validate against a system design, associating failure modes with system functions and hardware components means that consistency checks between the two models are possible, and changes to the SysML design are easier to identify against the corresponding fault tree model. Common definitions of the system specification improves the quality of both safety analysis and assurance, and the alignment of the two models enables us to make the first steps towards the automatic translation of parts of the system design into fault trees.

Integrating Existing Safety Analyses into SysML

“…Similar to SysML extensions in UML, the proposed Fault Tree Profile reuses a subset of UML 2.5 and provides a bespoke diagram type (an extension of structured diagram) and additional gate definitions to aid specific types of Fault Tree and dispatch analysis for Rolls-Royce. The initial version of our profile is detailed in [4] and the profile's entities and linkages are described in detail there. However, we have since released a new version with substantive changes, in particular the removal of 'failure modes' as a first class entity, due to issues with the user interface and ease of export to analytical tools (see §3).…”

“…Version 1 of our profile is shown in [4] which describes in detail the profile's entities. However, due to user experience studies, we have had to make some fundamental changes to the profile and have further extended it with transfer gates, null gates and dispatch events (see Fig.…”

“…§4 gives a summary of engine dispatch analysis. 4 The issue of gradually introducing MBSE through integration with the existing analytical toolchain is covered in §5. In §6 we discuss some of the problems and solutions to reconcile different modelling viewpoints with respect to the functional specification and derived safety requirements.…”

“…Part of Innovate UK's ENCASE (Enabling Novel Controls and Advanced Sensors for Engines) project 4. Dispatch refers to the engine's ability to carry a fault for given time before maintenance action is taken 5.…”

Model-Based Safety Analysis for the Fly-by-Wire System by Using Monte Carlo Simulation

“…These tools can be classified into three categories [5], which are graphical modeling tools, system modeling languages and failure logic modeling techniques. Graphical modeling tools include Matlab-Simulink [6][7][8], Modelica [9,10], Petri Net [11][12][13] and SCADE [3,14]; system modeling languages include SysML [15,16], AADL [17][18][19], AltaRica [20][21][22], and NuSMV [23,24]; and failure logic modeling techniques include HiP-HOPS [25,26] and failure propagation approaches [27].…”