Bridging the gap between systems and dynamic fault tree models

Fault tolerant systems are composed of subsystems that interact with each other, often in complex ways. Analyzing the reliability of these systems calls for sophisticated modeling techniques. One such technique is dynamic fault tree analysis. Because the semantics of dynamic fault trees are themselves complex, there is a question of whether such models are faithful representations of the modeled systems, and whether the underlying analysis technique is correct. Previous definitions of the modeling constructs employed in dynamic fault trees were not precise or consistent enough, leading to ambiguities in their interpretation. We present our effort at making precise the dynamic fault tree modeling and evaluation process. Our aim was to improve our confidence in the validity of dynamic fault tree models of system failure behavior. By rigorously specifying fault trees and their constituent gates and basic events, we were able to reason more effectively about the correctness of fault trees, the underlying analytical Markov models, and the numerical solution to these analytical models.