Generic Reliability Analysis for Safety-Critical FlexRay Drive-By-Wire Systems

Leu, Kuen-Long; Chen, Jwu-E; Wey, Chin‐Long; Chen, Yung-Yuan

doi:10.1109/iccve.2012.48

Cited by 7 publications

(1 citation statement)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The evaluation of various options from the design space by a translation to fault trees, and applying fault tree analysis has also been considered for air traffic control [28]. The effect of different topologies of a FlexRay bus has been assessed using FTA in [29]; and identified the need for modelling dynamic aspects. The analysis of architecture decisions under safety aspects has been considered in e.g.…”

Section: Related Workmentioning

confidence: 99%

Safety analysis for vehicle guidance systems with dynamic fault trees

Ghadhab

Junges

Katoen

et al. 2019

Reliability Engineering & System Safety

View full text Add to dashboard Cite

This paper considers the design-phase safety analysis of vehicle guidance systems. The proposed approach constructs dynamic fault trees (DFTs) to model a variety of safety concepts and E/E architectures for drive automation. The fault trees can be used to evaluate various quantitative measures by means of model checking. The approach is accompanied by a large-scale evaluation: The resulting DFTs with up to 300 elements constitute larger-than-before DFTs, yet the concepts and architectures can be evaluated in a matter of minutes. Figure 1: Overview of the model-based safety approachfunctions with a sufficiently low probability of undetected dangerous hardware failures. This paper considers the design-phase safety analysis of the vehicle guidance system, a key functional block of a vehicle with a high safety integrity level (ASIL D, i.e., allowing not more than 10 −8 residual hardware failures per hour). The key point of our approach is to: (1) manually construct dynamic fault trees [2] (DFTs) from industrial system descriptions and combine them (in an automated manner) with hardware failure models for several partitionings of functions on hardware, and (2) analyse the resulting overall DFTs by means of probabilistic model checking [3,4,5].A model-based approach. Fig. 1 summarises the approach, in relation to the structure of this paper. The failure behaviour of the functional architecture, given as a functional block diagram (FBD), is expressed as a two-level DFT: the upper level models a system failure in terms of block failures B i while the lower level models the causes of block failures B i . The use of fault trees is natural: They are a well-known model in reliability engineering. No familiarity with additional formalisms is required. Fault trees for hardware components are typically provided by manufacturers. Failures in function blocks can easily be described by fault trees. The use of DFTs rather than static fault trees allows to model warm and cold redundancies, spare components, and state-dependent faults; cf. [6]. Each functional block is assigned to a hardware platform for which (by assumption) a provided DFT H i models its failure behaviour. Depending on the partitioning, the communication goes via different fallible buses that are also modelled by DFTs Bus i . From the partitioning, and the DFTs of the hardware and the functional level, an overall DFT is constructed (in an automated manner) consisting of three layers: (1) the system layer; (2) the block layer; and (3) the hardware layer. Details are discussed in Sect. 4.Analysis. We exploit probabilistic model checking (PMC) [3,4,5] to analyse the DFT of the overall vehicle guidance system. PMC can be used as a black-box algorithm-no expertise in PMC is needed to understand its outcomes-and supports various metrics that go beyond reliability and MTTF [7]. While they are all expressible by a combination of PMC queries, the number of queries is prohibitively large for some measures relevant for the safety analysis of highly automated cars. Therefore, w...

show abstract

Section: Related Workmentioning

confidence: 99%