Prior works on model-based Failure Modes and Effects Analysis (FMEA) automatically generate a FMEA table given the system model, a set of failure modes, and a set of possible effects. The last requirement is critical as bias may occur: since the considered failure effects are restricted to the anticipated ones, unexpected effects - the most interesting ones - are disregarded in the FMEA.
In this paper, we propose and investigate formal concepts that aim to overcome this bias. They support the construction of FMEA tables solely based on the system model and the failure modes, i.e., without requiring the set of effects as input. More concretely, given a system specification in the Architecture Analysis and Design Language (AADL), we show how to derive relations that characterize the effects of failures based on the state transition system of that specification. We also demonstrate the benefits and limitations of these concepts on a satellite case study.
[1]
Volker Diekert,et al.
The Book of Traces
,
1995
.
[2]
Patrice Godefroid,et al.
Dynamic partial-order reduction for model checking software
,
2005,
POPL '05.
[3]
Shin Nakajima,et al.
The SPIN Model Checker : Primer and Reference Manual
,
2004
.
[4]
Armin Biere,et al.
Symbolic Model Checking without BDDs
,
1999,
TACAS.
[5]
Glynn Winskel,et al.
Events, Causality and Symmetry
,
2008,
Comput. J..
[6]
Joost-Pieter Katoen,et al.
Safety, Dependability and Performance Analysis of Extended AADL Models
,
2011,
Comput. J..
[7]
Maximilian Reinhard Odenbrett,et al.
Explicit-State Model Checking of an Architectural Design Language using Spin
,
2010
.
[8]
Joost-Pieter Katoen,et al.
Formal correctness, safety, dependability, and performance analysis of a satellite
,
2012,
2012 34th International Conference on Software Engineering (ICSE).