Method and apparatus for generating a fault tree for a failure mode of a complex system

The invention relates to a method and apparatus for generat ^¬ ing a fault tree for a failure mode of a complex system com ^¬ prising a plurality of components, in particular a safety critical complex system.

A safety critical system is a system whose failure or mal ^¬ function may result in damages of equipment or whose failure or malfunction may result in injuring people. The use of safety analysis models is important during the development of safety critical systems. Safety analysis models can be used to identify drawbacks or insufficiencies in terms of safety. During development, the existing components or units are of ^¬ ten reused in identical or slightly changed form to save de ^¬ velopment time. Changes are made to these components to match the requirements of the designed system. When components are reused during development, the existing safety analysis mod ^¬ els are a relevant input for an early safety assessment of the new system, since they already provide a valid data model. Nevertheless, changes and adoptions during the devel- opment process of the system can invalidate former analysis models and require adaption of the safety analysis model of the system to the performed changes.

A design of a safety critical system can comprise a probabil- istic risk assessment, wherein failure mode and effects analysis can be performed using fault tree analysis. Fault tree analysis offers the decomposition of the system into modules. Fault tree analysis is a deductive procedure used to determine various combinations of hardware and software fail- ures as well as human errors that can cause undesired events referred to as top events at the system level. Complex tech ^¬ nical systems can comprise a plurality of hardware and/or software components. An area where the development of safety analysis models is essential are safety critical cyberphysi ^¬ cal systems. These cyberphysical systems can consist of more or less loosely coupled embedded systems. The alignment of the embedded systems is unclear at design time and possible configurations at design time are almost infinite. Each em- bedded system forming part of a cyberphysical system may be reused in many different configurations. For such complex systems, it can be necessary for a safety critical function to be certified at runtime to assure a safe operation of the safety critical system.

However, conventional safety analysis methods do not provide a possibility to divide safety analysis models into different layers and/or domains. Conventional safety analysis methods allow for example not to perform decomposition of the system into a functional layer and a physical layer.

Accordingly, it is an object of the present invention to pro ^¬ vide a method and apparatus for generating a fault tree for a failure mode of a complex system allowing to perform a safety analysis for different layers and/or domains of a complex system.

This object is achieved according to a first aspect by a method for generating a fault tree for a failure mode of a complex system comprising the features of claim 1.

The invention provides according to a first aspect a method for generating a fault tree for a failure mode of a complex system comprising a plurality of components, said method comprising the steps of:

providing component fault tree elements of the components; linking the components according to their failure dependencies within said complex system and

generating said fault tree by incorporating for each dependency link from a first component to a second component the output failure modes of the component fault tree element of the second component into the component fault tree element of the first component to trigger the output failure modes of the first component.

In a possible embodiment of the method according to the first aspect of the present invention, the output failure modes of the component fault tree element of the second component are connected automatically to the output failure modes of the component fault tree element of the first component via OR- gates .

In a further possible embodiment of the method according to the first aspect of the present invention, the method further comprises selecting an output failure mode of the component fault tree element of a component of interest within the gen ^¬ erated fault tree. In a further possible embodiment of the method according to the first aspect of the present invention, the selected out ^¬ put failure mode is a top event of the generated fault tree.

In a still further possible embodiment of the method accord- ing to the first aspect of the present invention, the gener ^¬ ated fault tree is reduced by a Boolean logic to create a re ^¬ duced fault tree for the selected output failure mode. In a further possible embodiment of the method according to the first aspect of the present invention, the method is per ^¬ formed in a normal operation mode of the complex system dur ^¬ ing runtime of the complex system.

In a further alternative embodiment of the method according to the first aspect of the present invention, the method is performed in a separate operation mode of said complex sys ^¬ tem, in particular during deployment of components, during configuration or reconfiguration of said complex system and/or during maintenance or repair of said complex system.

In a further possible embodiment of the method according to the first aspect of the present invention, the components of the complex system comprise hardware components and/or soft ^¬ ware components.

In a further possible embodiment of the method according to the first aspect of the present invention, the component fault tree elements of the components of said complex system are loaded from a library stored in a database and/or are de ^¬ signed for the components.

In a further possible embodiment of the method according to the first aspect of the present invention, the linking of the components according to their failure dependencies is per ^¬ formed automatically using failure dependency indications as ^¬ signed to the components. The invention further provides according to a second aspect an apparatus for generating a fault tree for a failure mode of a complex system comprising the features of claim 11. The invention provides according to the second aspect of the present invention an apparatus for generating a fault tree for a failure mode of a complex system,

said apparatus comprising:

an input interface adapted to input component fault tree ele ^¬ ments of components of said complex system,

a linking unit adapted to link the components according to their failure dependencies within said complex system and a calculation unit adapted to generate said fault tree by in- corporating for each dependency link from a first component to a second component the output failure modes of the compo ^¬ nent fault tree element of the second component into the com ^¬ ponent fault tree element of the first component to trigger the output failure modes of the first component.

In a possible embodiment of the apparatus according to the second aspect of the present invention, the output failure modes of the component fault tree element of the second com ^¬ ponent are connected automatically by said calculation unit to the output failure modes of the component fault tree ele ^¬ ment of the first component via incorporated OR-gates.

In a further possible embodiment of the apparatus according to the second aspect of the present invention, the apparatus further comprises a user interface adapted to select an out ^¬ put failure mode of a component fault tree element of a com ^¬ ponent of interest within the generated fault tree.

In a further possible embodiment of the apparatus according to the second aspect of the present invention, the calcula ^¬ tion unit is adapted to reduce the generated fault tree by a Boolean logic to create a reduced fault tree for the selected output failure mode. In a further possible embodiment of the apparatus according to the second aspect of the present invention, the apparatus is integrated in the complex system. In a further possible alternative embodiment of the apparatus according to the second aspect of the present invention, the apparatus is connectable to the complex system by means of a communication interface. In the following, possible embodiments of the different as ^¬ pects of the present invention are described in more detail with reference to the enclosed figures.

Fig. 1 shows a flowchart of a possible exemplary em- bodiment of the method for generating a fault tree according to the first aspect of the present invention;

Fig. 2 shows a further flowchart for illustrating a further possible exemplary embodiment of the method for generating a fault tree according to the first aspect of the present invention;

Fig. 3 shows a block diagram for illustrating a pos- sible exemplary embodiment of the apparatus for generating a fault tree according to the second aspect of the present invention;

Figs. 4 and 5 illustrate a conventional fault tree and a component fault tree as employed by the method and apparatus according to the present invention ; illustrates an exemplary complex system with two different layers having components repre ^¬ sented by corresponding component fault tree elements and linked by failure dependencies; illustrates a fault tree data model generated by the method and apparatus according to the present invention for the exemplary complex system illustrated in Fig. 6; illustrates the reduced fault tree derived from the generated fault tree model illus ^¬ trated in Fig. 7 ; Fig. 9 shows a diagram for illustrating an exemplary cyberphysical system for which a fault tree model can be generated by the method and ap ^¬ paratus according to the present invention. As can be seen in Fig. 1, the method for generating a fault tree for a failure mode of a complex system comprising a plu ^¬ rality of components c can comprise several steps. The com ^¬ plex system can be a safety critical system SCS, in particu ^¬ lar a cyberphysical complex system as illustrated in Fig. 9. The components c can comprise hardware and/or software compo ^¬ nents. Each component can be represented by a corresponding component fault tree element. The functional safety behaviour of each component c of the system SCS can be represented by an associated component fault tree, CFT, element. A component fault tree CFT is a Boolean data model associated to system development elements such as components. A separate component fault tree element can be related to each component c of the system SCS. Failures that are visible at the outport of a component are modelled using so-called output failure modes, OFM, which are related to this specific outport of the compo ^¬ nent c. For modelling how specific failures propagate from an inport of a component to the outport, input failure modes, IFMs, are used. The inner failure behaviour within the compo- nent c that also influences the output failure modes is mod ^¬ elled using a gate such as NOT, AND, OR Gates and Basic

Events BE. Fig. 4 shows a conventional classic fault tree and Fig. 5 shows a corresponding component fault tree CET. In both trees, the top events or output events TE1 and TE2 are modelled. The component fault tree model illustrated in Fig. 5 allows, additionally to the Boolean formulae that are also modelled within the conventional classic fault tree illus ^¬ trated in Fig. 4, to associate the specific top events to the corresponding ports where these failures can appear. Top event TE1, for example, appears at port 01. Using this meth ^¬ odology of components also within fault tree models, benefits during the development of the complex system can be observed, for example an increased maintainability of the safety analy ^¬ sis model.

In a first step SI of the method according to an embodiment of the present invention as illustrated in Fig. 1, the compo ^¬ nent fault tree elements CFTe of the different components within the complex system SCS are provided.

In a further step S2, the components c are linked according to their failure dependencies d within the complex system SCS. Fig. 6 illustrates an exemplary system with two different layers. In the given example, the safety critical complex system SCS comprises a functional layer comprising functions fl, f2 and a hardware layer comprising two hardware compo ^¬ nents, i.e. a RAM memory component and a CPU component. In Fig. 6 on the top, the component fault tree elements of the two functions fl and f2 are depicted. In the given example, function fl in the upper layer receives two sensor values at its ports pi, p2. If both values are unavailable, the result of the function fl is unavailable (loss of function) modelled by an AND-gate within the component fault tree element CETe of the first function fl as shown in Fig. 6. In the same layer, if function f2 receives no signal from function fl, function f2 is not available modelled by the top event TE' ' loss of ' ' as illustrated in Fig. 6. Both functions fl, f2 build one layer L of the system architecture, i.e. the soft- ware or functional layer.

The second illustrated layer consists of two hardware or physical components. The components c represent the memory (RAM) and a computational resource (CPU) of the complex sys- tern. The system is in a failure mode (loss of) if either in the CPU a basic event a occurs or if a basic event b occurs in the memory component RAM.

In step S2, the components c are linked according to their failure dependencies d within the complex system. Since the functional failure behaviour is also dependent from failures that occur in the hardware layer, failure dependencies rela ^¬ tions can be used to combine both models of the two different layers L. In the given example, first function fl in the functional layer can only be executed if both components c of the hardware layer, i.e. the memory component RAM and the CPU component are available. This is reflected in Fig. 6 by the dependency relations dl, d2 from the component fault tree element CFTe for function fl to both component fault tree elements CFTe of the two components in the physical layer, i.e. the CPU component and the RAM component. Further, in the given example, function f2 is only dependent from the correct function of the memory resource RAM and consequently, the failure dependency d3 is only related to the component fault tree element CFTe of the memory component RAM in the physical layer of the complex system. In a possible embodiment, the linking of the components according to their failure depend ^¬ encies d within the complex system can be done by a domain expert. In an alternative embodiment, the linking of the com ^¬ ponents is performed automatically using failure dependency indications assigned to the different components c of the complex system. In a further step S3 of the method as illustrated in the em ^¬ bodiment of Fig. 1, a fault tree is generated by incorporat ^¬ ing for each dependency link d from a first component C\ to a second component C2 the output failure modes OFM of the com ^¬ ponent fault tree element CFTe of the second component C2 into the component fault tree element CFTe of the first com ^¬ ponent Ci to trigger the output failure modes OFM of the first component C\. In a preferred embodiment, the output failure modes OFMs of the component fault tree elements CFTe of the second component C2 are connected automatically to the output failure modes OFMs of the component fault tree element CFTe of the first component C\ by means of incorporated OR- gates. The resulting generated fault tree model derived from the component fault trees of Fig. 6 is shown in Fig. 7. As can be seen in Fig. 7, the generated fault tree represents the whole complex system including both layers, i.e. the functional layer and the hardware layer.

The set of components of the complex system SCS is: C = c _l ,...,c _n and CFT = cft _x ,...,cft _m 0 is the set of component fault trees

CFT(c) = eft with c <≡C and eft e CFT . Further IN(c) = ϊη^.,.,ϊη^ and OUT(c) = out _x ,...,out _j is the in- and outports of a component c CON = {(out, in)\out e OUT(c _x ) ...OUT(c _n ), in e 7N( _Cl ) u ... u IN(c _n )} is the set of all possible port connections and

CON c CON is the set of actual port connections modelling the data flow from the outport of a component c to the inport of another component . Further

ALFRED(c) = {x\x = CFT(d),d e CFT) defines the set of all failure dependencies of component c to other components. For the example system illustrated in Fig. 6, the previously defined sets are as follows:

IINN((RRAAMM)) == {{}} (4)

OOUUTT((CCPPUU)) == {{}} (9)

CON N = (p ₃ , p ₄ ), (p ₅ , Pe) (10)

ALFRED(fi) = {CPU, RAM} (11)

ALFRED(f ₂ ) = {RAM} (12) ALFRED(CPU) = ALFRED(RAM) = {} (13)

Using these sets and relationships, a fault tree model can be generated from the component fault tree elements CFTe and the failure dependencies that reflects the failure behaviour of both architecture layers in a conservative way. For every failure dependency relation, all basic events BE that are in ^¬ cluded in the component fault tree CFT of the dependency ele ^¬ ment are added to all failure modes of the dependent compo- nent .

If c has a component fault tree, then it is

If c has input and output failure modes, it is

IFM(in)≠{} and OFM(out)≠ {} for an inport in e IN(c) and an outport out ^ OUT(c) . In the exam ^¬ ple system as depicted in Fig. 6, the input and output fail ^¬ ure modes related to the ports are

OFM(p = loss of (14) OFM(p ₂ ) = loss of (15)

OFM(p ₃ ) = loss of (16)

IFM(p ₄ ) = loss of (17)

IFM(p ₅ ) = loss of (18)

IFM(p ₆ ) = loss of (19)

If a component f ₂ is dependent of the correct function of an ^¬ other component RAM, the failure modes of RAM trigger all failure modes of f ₂ . This is a conservative assumption, which is an overestimation, but simplifies the modelling of depend- encies, since there is no need to map single failure modes from RAM to f2. Instead, the failure modes of RAM are added to all failure modes of f ₂ using an OR-gate. If multiple de ^¬ pendency relations are present, e.g. fi is dependent from RAM and CPU, all failure modes are included from RAM and CPU into the failure behaviour of fi. This is depicted using elements in Fig. 7. The triangle at the AND-gate mark failure behav ^¬ iour that is outside the model. The generated fault tree for the given exemplary complex sys ^¬ tem is illustrated in Fig. 7.

In a further possible embodiment of the method according to the first aspect of the present invention, an output failure mode OFM of a component fault tree element CFTe of a compo ^¬ nent c of interest within the generated fault tree, such as illustrated in the example of Fig. 7, can be selected.

Fig. 2 shows a flowchart of a possible exemplary embodiment of the method according to the present invention, where a se ^¬ lection takes place in step S4. In step S4, an output failure mode OFM of a component fault tree element CFTe of a compo ^¬ nent c of interest within the generated fault tree is se ^¬ lected by a user. The selected output failure mode OFM can be for example a top event TE of the generated fault tree. In the exemplary generated fault tree data model as illustrated in Fig. 7, the basic events a and b have been included in the generated fault tree and represent the failure behaviour of the hardware components. Furthermore, the AND-gate illus- trated in Fig. 7 represents the failure behaviour of the two redundant sensor values which form part of the software layer. By the method according to the present invention, the original safety analysis models for different layers, i.e. a logical or functional layer and a physical layer, are com- bined for providing a common safety analysis model as illus ^¬ trated in Fig. 7. After having selected an output failure mode OFM, for example top event "loss of" the generated fault tree can be reduced in step S5 by applying a Boolean logic to create a reduced fault tree for the selected output failure mode as illustrated in Fig. 8.

A component c is dependent from the correct function of other components c _l ,...,c _n with ALFRED(c) = c _l ,...,c _n and O (c _t ) being the output failure modes of C _i with

OFM(c _i ) = o[,...,o _m ⁱ .

All output failure modes OFM(c) are supplemented with the failure modes of the components in ALFRED{c) to model the failure dependency in a conservative way. The output failure modes OFM(c) = o _l ,...,o _m are replaced by

OFM(c) = ^,..., _m with

°j = °j ^=l °i ^v - ^v °L ·

Fig. 3 illustrates a block diagram of an exemplary embodiment of an apparatus according to the second aspect of the present invention .

The apparatus 1 as illustrated in Fig. 3 is adapted to gener ^¬ ate a fault tree for at least one failure mode of a complex system, in particular a safety critical system SCS such as the cyberphysical system illustrated in Fig. 9. The apparatus 1 comprises in the illustrated embodiment an input interface

2 adapted to input component fault elements of components of the investigated complex system. The apparatus 1 further com ^¬ prises a linking unit adapted to link the components c ac- cording to their failure dependencies d within said complex system. In a possible embodiment, the linking of the compo ^¬ nents c are performed by the linking unit 3 automatically ac ^¬ cording to failure dependencies using failure dependency in ^¬ dications assigned to the different components c of the com- plex system.

The apparatus 1 further comprises a calculation unit 4 adapted to generate the fault tree by incorporating for each dependency link d from a first component C _\ to a second com- ponent C2 the output failure modes OFMs of the component fault tree element CFTe of the second component C2 into the component fault tree element CFTe of the first component C _\ to trigger the output failure modes OFMs of the first compo ^¬ nent C _\ . In a possible embodiment, the output failure modes OFMs of the component fault tree element CFTe of the second component C2 are connected automatically to the output fail ^¬ ure modes OFMs of the component fault tree element CFTe of the first component C _\ by means of incorporated OR-gates. In a further possible embodiment, the apparatus 1 further comprises a user interface which allows a user to select an output failure mode OFMs of a component fault tree element CFTe of a component c of interest within the generated fault tree. For instance, a user can select via the user interface a top event TE of the generated fault tree as an output fail ^¬ ure mode OFM. The calculation unit 4 is adapted in a possible embodiment to reduce the generated fault tree by applying a Boolean logic to create a reduced fault tree for the selected output failure mode OFM. The generated fault tree and/or the reduced fault tree can be output to a user by means of a dis ^¬ play of the user interface of the apparatus 1. The apparatus 1 as illustrated in Fig. 3 can in a possible embodiment form part of the complex system. In a possible embodiment, the ap- paratus 1 can be even integrated in the complex system to be investigated. In a further possible embodiment, the apparatus 1 is connectable to the complex system by means of a communi ^¬ cation interface of the complex system. The apparatus 1 is adapted to perform a method for generating a fault tree for a failure mode of a complex system as illus ^¬ trated in the flowcharts of Figs. 1 and 2. In a possible em ^¬ bodiment, the method is performed in a normal operation mode of the complex system during runtime of the complex system. In an alternative embodiment, the method is performed in a separate operation mode of said complex system. For example, the method can be performed during deployment of components c or during configuration or reconfiguration of the complex system and/or during maintenance or repair of the complex system. The configuration of the complex system includes the addition of components, the replacement of components or re ^¬ moval of the components. Further, configuration or reconfigu ^¬ ration comprises the change of dependencies between different components of the complex system. By evaluating the generated fault tree, it is possible to verify, whether a configuration or reconfiguration of the system is admissible or system critical .

Fig. 9 illustrates an exemplary cyberphysical system compris- ing different subsystems and/or components c. All subsystems can possibly interact with each other, for example via a ca ^¬ ble or wireless connection and can execute the same function on different hardware platforms. If one of these functions migrates to another subsystem, e.g. subsystem B uses autono- mous driving from subsystem D, this might require a recerti- fication of the safety analysis model on the different hard ^¬ ware. If the information is present which part of the func ^¬ tion of system D runs on which parts of the hardware of sys- tern B, the safety analysis models from system B and system D can be combined using the method or apparatus according to the present invention to certify whether the resulting system is performing its functions with the required quality in terms of functional safety.

Another example for using the method and apparatus 1 accord ^¬ ing to the present invention is the deployment of components, in particular software components, on an existing hardware platform comprising a plurality of different hardware compo- nents. For instance, the method and apparatus 1 can be used during deployment of software components in a complex system such as a vehicle or car comprising a plurality of components communicating with each other, for instance via a data or control bus. A further use case is a safety analysis after two physical subsystems have been coupled with each other.

For example, if two train sections are coupled to each other to form a train, the method and apparatus 1 can perform a safety analysis of the created complex system, i.e. train. For instance, the apparatus 1 as illustrated in Fig. 3 can be connected to a system bus of the train. In a possible embodi ^¬ ment, the method is performed in the background during run ^¬ time of the investigated complex system. In a possible em ^¬ bodiment, the generated safety analysis results can be output to a user or a central control unit. Depending on the safety analysis results, it can be decided, whether the investigated system is safe or safety critical. If the safety analysis is performed during runtime of the safety critical system, in a possible embodiment the system may be shutdown or deactivated automatically if the safety analysis indicates that the in ^¬ vestigated system cannot be operated safely.