Automatic fault tree synthesis and real-time tree trimming, based on computer models

Kocza, G.; Bossche, A.

doi:10.1109/rams.1997.571667

Cited by 6 publications

(2 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…3 Variables used in the timed automata follow convention used in four variable approach, and prefixes m_, c_, and k_ represent monitored variables, controlled variables, and constant values, respectively. For example, functional requirement "If f LOG , 0:3%FP 2 50 mV, condition out the immediate trip" is captured by the rightmost transition labeled "If m_PDLCond ¼ ¼k_CondSwLo and f_Flog , 2689, then f_PDLCond U k_CondOut.".…”

Section: Safety Analysis On Wolsong Sds2mentioning

confidence: 99%

“…One must possess, in addition to general understanding of safety analysis techniques, detailed and domain-specific knowledge to perform fault tree analysis. Although widely used in industry, fault tree analysis has fundamental limitation that it is informal in nature [3]. Graphical notations help analyst organize thought process systematically, but the technique itself offers no help in investigating causal events and the relationship among them.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Systematic evaluation of fault trees using real-time model checker UPPAAL

Deok¹,

Son²,

Yoo³

et al. 2003

Reliability Engineering & System Safety

View full text Add to dashboard Cite

Fault tree analysis, the most widely used safety analysis technique in industry, is often applied manually. Although techniques such as cutset analysis or probabilistic analysis can be applied on the fault tree to derive further insights, they are inadequate in locating flaws when failure modes in fault tree nodes are incorrectly identified or when causal relationships among failure modes are inaccurately specified. In this paper, we demonstrate that model checking technique is a powerful tool that can formally validate the accuracy of fault trees. We used a realtime model checker UPPAAL because the system we used as the case study, nuclear power emergency shutdown software named Wolsong SDS2, has real-time requirements. By translating functional requirements written in SCR-style tabular notation into timed automata, two types of properties were verified: (1) if failure mode described in a fault tree node is consistent with the system's behavioral model; and (2) whether or not a fault tree node has been accurately decomposed. A group of domain engineers with detailed technical knowledge of Wolsong SDS2 and safety analysis techniques developed fault tree used in the case study. However, model checking technique detected subtle ambiguities present in the fault tree. q

show abstract

Section: Safety Analysis On Wolsong Sds2mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%