Developing and certifying safety-critical and highly reliable systems almost always includes significant emphasis on hazard analysis and risk assessment. There have been substantial improvements in automation and formalization of other aspects of critical system engineering including model-driven development, analysis of source code and models, and verification techniques. However, hazard analysis and risk assessment are still largely manual and informal activities, tool support is limited (which for both development and auditing, increases time and effort and reduces accuracy and correctness), and artifacts are not integrated with architectural descriptions, system interfaces, high-level behavioral descriptions or code.
The Error Model annex of the Architecture Analysis and Design Language (AADL) provides formal and automated support for a variety of forms of hazard analysis and risk assessment activities. Specifically, it enables engineers to formally specify errors, error propagation, error mitigation -- using annotations that are integrated with formal architecture and behavioral descriptions written in AADL. Plug-ins to the Open-Source AADL Tool Environment (OSATE) process these annotations to provide various forms of (semi)-automated support for reliability predication and tasks necessary to support common hazard analysis and risk assessment techniques such as Failure Modes and Effects Analysis (FMEA), Fault Tree Analysis (FTA), and Functional Hazard Analysis (FHA).
In this paper, we illustrate basic aspects of Error Modeling in AADL using a simple safety-critical medical system -- an infant incubator called "Isolette". We summarize standard tasks involved in FMEA and FTA, we illustrate the principal steps involved in AADL Error Modeling for the Isolette, and we describe how those steps relate to FMEA and FTA. We give a brief survey of emerging automated analysis tools implemented as plug-ins to the AADL OSATE environment that process error modeling annotations. We believe this introduction to Error Modeling in AADL can expose engineers of high-integrity systems to techniques and tools that can provide a more rigorous, automated, and integrated approach to important risk management activities.
[1]
Insup Lee,et al.
Rationale and Architecture Principles for Medical Application Platforms
,
2012,
2012 IEEE/ACM Third International Conference on Cyber-Physical Systems.
[2]
Julien Delange,et al.
AADL Fault Modeling and Analysis Within an ARP4761 Safety Assessment
,
2014
.
[3]
John A. McDermid,et al.
An integrated tool set for software safety analysis
,
1993,
J. Syst. Softw..
[4]
Patrice Chalin,et al.
Open source Patient-Controlled Analgesic pump requirements documentation
,
2013,
2013 5th International Workshop on Software Engineering in Health Care (SEHC).
[5]
Nancy G. Leveson,et al.
Engineering a Safer World: Systems Thinking Applied to Safety
,
2012
.
[6]
Jörgen Hansson,et al.
System Architecture Virtual Integration: An Industrial Case Study
,
2009
.
[7]
Nancy G. Leveson,et al.
Safeware: System Safety and Computers
,
1995
.
[8]
Clifton A. Ericson,et al.
Hazard Analysis Techniques for System Safety
,
2005
.
[9]
Malcolm Wallace,et al.
Modular Architectural Representation and Analysis of Fault Propagation and Transformation
,
2005,
FESCA@ETAPS.