Model-Based Safety Analysis for Vehicle Guidance Systems

Ghadhab, Majdi; Junges, Sebastian; Katoen, Joost-Pieter; Kuntz, M.; Volk, Matthias

doi:10.1007/978-3-319-66266-4_1

Cited by 11 publications

(6 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Probabilistic model checkers, such as STORM [4], have been used for the analysis of DFTs. The main idea behind this approach is to automatically convert the DFT of a given system into its corresponding Markovian model and then analyze the safety characteristics quantitatively of the given system using the model checker [14]. The STORM model checker accepts the DFT to be analyzed in the Galileo format [12] and generates a failure automata of the tree.…”

Section: Related Workmentioning

confidence: 99%

Formal Dynamic Fault Trees Analysis Using an Integration of Theorem Proving and Model Checking

Elderhalli¹,

Hasan²,

Ahmad³

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Dynamic fault trees (DFTs) have emerged as an important tool for capturing the dynamic behavior of system failure. These DFTs are then analyzed qualitatively and quantitatively using stochastic or algebraic methods to judge the failure characteristics of the given system in terms of the failures of its subcomponents. Model checking has been recently proposed to conduct the failure analysis of systems using DFTs with the motivation to provide a rigorous failure analysis of safety-critical systems. However, model checking has not been used for the DFT qualitative analysis and the reduction algorithms used in model checking are usually not formally verified. Moreover, the analysis time grows exponentially with the increase of the number of states. These issues limit the usefulness of model checking for analyzing complex systems used in safety-critical domains, where the accuracy and completeness of analysis matters the most. To overcome these limitations, we propose a comprehensive methodology to perform the qualitative and quantitative analysis of DFTs using an integration of theorem proving and model checking based approaches. For this purpose, we formalized all the basic dynamic fault tree gates using higher-order logic based on the algebraic approach and formally verified some of the simplification properties. This formalization allows us to formally verify the equivalence between the original and reduced DFTs using a theorem prover, and conduct the qualitative analysis. We then use model checking to perform the quantitative analysis of the formally verified reduced DFT. We applied our methodology to five benchmarks and the results show that the formally verified reduced DFT was analyzed using model checking with up to six times less states and up to 133000 times faster.

show abstract

Section: Related Workmentioning

confidence: 99%

Formal Dynamic Fault Trees Analysis Using an Integration of Theorem Proving and Model Checking

Elderhalli¹,

Hasan²,

Ahmad³

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…A short version of this paper was presented in [12]. The three major extensions to the earlier paper are: (1) A more detailed step-by-step description of the methodology.…”

Section: Introductionmentioning

confidence: 99%

Safety analysis for vehicle guidance systems with dynamic fault trees

Ghadhab

Junges

Katoen

et al. 2019

Reliability Engineering & System Safety

Self Cite

View full text Add to dashboard Cite

This paper considers the design-phase safety analysis of vehicle guidance systems. The proposed approach constructs dynamic fault trees (DFTs) to model a variety of safety concepts and E/E architectures for drive automation. The fault trees can be used to evaluate various quantitative measures by means of model checking. The approach is accompanied by a large-scale evaluation: The resulting DFTs with up to 300 elements constitute larger-than-before DFTs, yet the concepts and architectures can be evaluated in a matter of minutes. Figure 1: Overview of the model-based safety approachfunctions with a sufficiently low probability of undetected dangerous hardware failures. This paper considers the design-phase safety analysis of the vehicle guidance system, a key functional block of a vehicle with a high safety integrity level (ASIL D, i.e., allowing not more than 10 −8 residual hardware failures per hour). The key point of our approach is to: (1) manually construct dynamic fault trees [2] (DFTs) from industrial system descriptions and combine them (in an automated manner) with hardware failure models for several partitionings of functions on hardware, and (2) analyse the resulting overall DFTs by means of probabilistic model checking [3,4,5].A model-based approach. Fig. 1 summarises the approach, in relation to the structure of this paper. The failure behaviour of the functional architecture, given as a functional block diagram (FBD), is expressed as a two-level DFT: the upper level models a system failure in terms of block failures B i while the lower level models the causes of block failures B i . The use of fault trees is natural: They are a well-known model in reliability engineering. No familiarity with additional formalisms is required. Fault trees for hardware components are typically provided by manufacturers. Failures in function blocks can easily be described by fault trees. The use of DFTs rather than static fault trees allows to model warm and cold redundancies, spare components, and state-dependent faults; cf. [6]. Each functional block is assigned to a hardware platform for which (by assumption) a provided DFT H i models its failure behaviour. Depending on the partitioning, the communication goes via different fallible buses that are also modelled by DFTs Bus i . From the partitioning, and the DFTs of the hardware and the functional level, an overall DFT is constructed (in an automated manner) consisting of three layers: (1) the system layer; (2) the block layer; and (3) the hardware layer. Details are discussed in Sect. 4.Analysis. We exploit probabilistic model checking (PMC) [3,4,5] to analyse the DFT of the overall vehicle guidance system. PMC can be used as a black-box algorithm-no expertise in PMC is needed to understand its outcomes-and supports various metrics that go beyond reliability and MTTF [7]. While they are all expressible by a combination of PMC queries, the number of queries is prohibitively large for some measures relevant for the safety analysis of highly automated cars. Therefore, w...

show abstract

“…Current approaches to assuring safety-critical systems include using model-based techniques [5], formal methods [11,13], architecture-based safety analysis [15], and techniques based on real world types and type checking [16]. The majority of these approaches, however, are subject to a common limitation: they are intended to ensure safety in a single system, but fail to be cognizant of the commonality and variability in the system, i.e., ensuring the dependability of a highly configurable safety-critical cyber-physical system.…”

Section: Introductionmentioning

confidence: 99%

Modeling and testing a family of surgical robots: an experience report

Mansoor

Saddler

Silva

et al. 2018

Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of

View full text Add to dashboard Cite

Safety-critical applications often use dependability cases to validate that specified properties are invariant, or to demonstrate a counter example showing how that property might be violated. However, most dependability cases are written with a single product in mind. At the same time, software product lines (families of related software products) have been studied with the goal of modeling variability and commonality, and building family based techniques for both analysis and testing. However, there has been little work on building an end to end dependability case for a software product line (where a property is modeled, a counter example is found and then validated as a true positive via testing), and none that we know of in an emerging safety-critical domain, that of robotic surgery. In this paper, we study a family of surgical robots, that combine hardware and software, and are highly configurable, representing over 1300 unique robots. At the same time, they are considered safety-critical and should have associated dependability cases. We perform a case study to understand how we can bring together lightweight formal analysis, feature modeling, and testing to provide an end to end pipeline to find potential violations of important safety properties. In the process, we learned that there are some interesting and open challenges for the research community, which if solved will lead towards more dependable safety-critical cyber-physical systems. CCS CONCEPTS • Software and its engineering → Software defect analysis; Formal software verification; Model-driven software engineering;

show abstract

Model-Based Safety Analysis for Vehicle Guidance Systems

Cited by 11 publications

References 21 publications

Formal Dynamic Fault Trees Analysis Using an Integration of Theorem Proving and Model Checking

Formal Dynamic Fault Trees Analysis Using an Integration of Theorem Proving and Model Checking

Safety analysis for vehicle guidance systems with dynamic fault trees

Modeling and testing a family of surgical robots: an experience report

Contact Info

Product

Resources

About