Dependent failures are a critical concern in safety engineering. If such dependencies remain undetected, crucial assumptions underlying safety concepts and safety argumentation may become invalid. Dependent Failure Analysis (DFA) is a method used to identify these dependencies. However, existing methods and techniques to perform DFA systematically and efficiently are lacking in modern model-based tool support. In this paper, we introduce a model-based DFA approach that comprises the associated process, modeling concepts, and interfaces with other model-based safety engineering techniques.

The increasing importance of software and rising level of connectivity of safety-critical products such as vehicles enable continuously improving and adding the functionality. DevOps development principles support such kind of continuous deployment. However, safety-critical products shall fulfill safety standards. In addition, it is impossible to show that a new or updated functionality is safe without considering the entire system. We introduce the SafeOps approach that leverages the DevOps principles automation, feature-driven development, and monitoring during operations to fulfill the requirements of the ISO 26262 when iteratively extending and improving safety-critical products. We present concepts and existing approaches to increase the level of automation of safety engineering tasks like safety analysis and generation of safety artifacts and we show how the management of these artifacts can be supported. Furthermore, we outline future research questions and propose a first concept to obtain quick and systematic feedback of the quality of the safety concept from the deployed products, enabling to enter the DevOps cycle from a safety point of view.

Failures in cyber-physical systems, such as trains and cars, are caused either by faults or attacks. The former are addressed by safety engineering, the latter by security analysis. Both disciplines use separate terminology, processes, and tools. However, both rely on a common system architecture and use models such as component fault trees and attack trees, respectively, for their analyses. We posit that the two disciplines should be aligned without entangling their processes or teams, mutually supporting their considerations. For that purpose, assuming a joint system model, we introduce tool support that heuristically suggests correspondences between analysis elements of the two disciplines and, upon user confirmation, derives additional suggestions for analysis. Our tool allows both disciplines to benefit from the analyses of the other, increasing consistency, exhaustiveness, and alignment of the disciplines. Our paper introduces the approach, describes our prototypical tool, and illustrates the concept with a realistic automotive use case.

The verification of safety requirements is fundamental in many safety-critical domains. In order to reach the highest level of required safety assurance, system engineers design components with a variety of safety mechanisms. The resulting potential combination and sequence of operational modes may become very complex and requires automated analysis support. In this paper, we propose new formal methods, based on minimal cut sets, to generate explanations for operational mode transitions, in terms of causes defined as combinations of basic events, namely faults and recovery actions. The problem is quite subtle, as it requires to consider events occurring before, and in between, the source and target operational modes, identifying those that are necessary to bring the system into the source mode. We implemented the approach on top of the xSAP safety analysis platform, and evaluated it on an industrial design, namely an electronic control unit of a power steering system with redundancy and multiple safety mechanisms.

Mastering the complexity of safety assurance for modern, software-intensive systems is challenging in several domains, such as automotive, robotics, and avionics. Model-based safety analysis techniques show promising results to handle this challenge by automating the generation of required artifacts for an assurance case. In this work, we adapt prominent approaches and propose facilitation of SysML models with component fault trees (CFTs) to support the fault tree analysis (FTA). While most existing approaches based on CFTs are only targeting the system topology, e. g., UML Class Diagrams, we propose an integration of CFTs with SysML Internal Block Diagrams as well as SysML Activity Diagrams. We conclude with best practices and lessons learned that emerged from applying our approach to automotive use-cases.

In the paper Compositionality of Component Fault Trees, we present a discussion of the compositionality of correctness of component fault trees. In this technical report, we present the formal proof of the central theorem of the aforementioned publication.

To deal with the rising system complexity, Model-Based System Development (MBSD) approaches are becoming popular due to their promise to improve consistency between different views of the system model. For dependable systems, safety analysis is one of the important views. Model-Based Safety Analysis (MBSA) can partially automate the generation of safety artifacts and provide traceability between the system model and the generated safety artifacts. Thus, MBSA not only supports the safety analysis of the system, it also eases an impact analysis of model changes and hence supports an iterative and agile development of safety-critical systems. This paper presents an MBSA approach for the (HAZOP) studies using a Domain-Specific Language (DSL) for guidance and establishing strong links to the system model and requirements for consistency and traceability. The combination with the DSL and features like auto-completion and consistency checks that we implement in our tool help to detect flaws in the safety analysis at early design stages, when elimination of such flaws is typically cheap as opposed to later development stages. Our approach is evaluated based on a SysML model of Bosch's Boost Recuperation System (BRS).

In order to deal with the rising complexity of safety-critical systems, model-based systems engineering (MBSE) approaches are becoming popular due to their promise to improve consistency between different views of the system model. Component Fault Trees (CFTs) are one particular technique to integrate the well-known Fault Tree Analysis (FTA) with a model of the system. CFTs decompose the specification of fault propagation on component level, which results in smaller, easier to manage models and leads to a safety analysis view that is consistent with the system model. However, although CFTs gain more and more popularity, their semantics is not well defined and the compositionality of CFTs is not formally proven to the best of our knowledge. In this paper, we provide a formal basis for CFTs, formalize semantics of CFTs and formally prove compositionality of CFTs by mapping them to information flow semantics, which is well-researched in the security analysis domain. Our results allow insights in the compositionality of CFTs, showing a high potential for validation techniques of CFTs and discuss these consequences in detail. We claim that this proof is crucial for the use of CFTs in assurance cases for safety-critical systems and one fundamental approach to integrate safety and security engineering.

The importance of mission or safety critical software systems in many application domains of embedded systems is continuously growing, and so is the effort and complexity for reliability and safety analysis.Model driven development is currently one of the key approaches to cope with increasing development complexity, in general.Applying similar concepts to reliability, availability, maintainability and safety (RAMS) analysis activities is a promising approach to extend the advantages of model driven development to safety engineering activities aiming at a reduction of development costs, a higher product quality and a shorter time-to-market.Nevertheless, many model-based safety or reliability engineering approaches aim at reducing the analysis complexity but applications or case studies are rare.Therefore we present here a large scale industrial case study which shows the benefits of the application of component fault trees when it comes to complex safety mechanisms.We compare the methodology of component fault trees against classic fault trees and summarize benefits and drawbacks of both modeling methodologies.

Identifying and mitigating possible failure propagation from one safety-critical application to another through common infrastructural components is a challenging task. Examples of such dependencies across software-stack layers (e.g., between application and middleware layer) are common causes and failure propagation scenarios in which a failure of one software component propagates to another software component through shared services and/or common computational resources. To account for this, safety standards demand freedom from interference in order to control failure propagation between mixed-critical software components. Safety analysis is typically focused on one abstraction layer, while robustness tests try to find failure propagation paths across abstraction layers. To this end, this paper presents a model-based failure propagation analysis combining failure propagation within and across abstraction layers. A classification of dependencies in combination with fault trees is used to perform a model-based dependency analysis. In addition, a novel modeling technique for integrating failure propagation aspects resulting from shared services and resources is presented. The analysis was used to carry out an early safety assessment of a real-world automotive redundancy mechanism within an integrated architecture. The results show that the method improved reusability and modularity, and made it easier to estimate failure propagation issues, including possible violations of freedom from interference within an integrated system.

The validation of highly automated driving vehicles is an important challenge to the automotive industry, since even if the system is free from internal faults, its behaviour might still vary from the original intent. Reasons for these deviations from the intended functionality can be found in the unpredictability of environmental conditions as well the intrinsic uncertainties of the Machine Learning (ML) functions used to make sense of this complex input space. In this paper, we propose a safety assurance case for a pedestrian detection function, a safety-relevant baseline functionality for an automated driving system. Our safety assurance case is presented in the graphical structuring notation (GSN) and combines our arguments against the problems of underspecification [9], the semantic gap [3], and the deductive gap [16].

Central Processing Units (CPUs) that satisfy the throughput demands of highly automated driving trade reliability off for performance. Such CPUs often do not include extensive hardware-implemented reliability measures e. g., lockstep CPU cores. At the same time, POSIX-compliant (including Linux-like) operating systems (OSs) become increasingly popular for such complex automotive systems, e. g., the upcoming AUTOSAR Adaptive standard is based on POSIX [1]. In such systems, the fault analysis of critical software components such as the OS becomes an important dependability asset. We determine the robustness of a given OS by injecting random hardware faults into the CPU and measure the extent to which these faults propagate through the OS in order to manifest as application level side effects. In this paper, we present our QEMU-based fault injection framework that simulates bit flips in x86 registers during the execution of the system calls of Linux 4.10 and classifies their effects at the application level. Our results show that for the clone, futex, mmap, mprotect, and pipe syscalls in average 76.3% of the 4.48 million injected faults are benign.Our experiments also show that the program counter and stack pointer (in case of memory operations) are the most susceptible registers. Our measurements help to guide the appropriate deployment of software-implemented hardware fault-tolerance (SIHFT) measures. Re-evaluation of the implemented SIHFT measures can be potentially used as an argument for safety.

The complexity of safety-critical E/E-systems within the automotive domain are continuously increasing. At the same time, functional safety standards such as the ISO 26262 prescribe analysis methods like the Fault Tree Analysis (FTA) and Failure Mode and Effects Analysis (FMEA). Currently, these analysis methods are mainly performed manually and are often not consistent with an evolving system model. To tackle these challenges, we present our semi-automatic safety analysis and optimization (SASAO) process. The SASAO process extends model-based safety analysis (MBSA) approaches, which require a system model extended with component-internal error propagation information. By extracting necessary artifacts from such an extended system model, we show how safety experts can be supported when performing FTA and design FMEA that are consistent with the model. The resulting FTA and design FMEA represent mandatory arguments in the system's safety case. Furthermore, we propose a method to optimize the cost of the system with respect to the required safety level automatically.

Fault injection testing approaches assess the reliability of execution environments for critical software. They support the early testing of safety concepts that mitigate the impact of hardware failures on software behavior. The growing use of platform software for embedded systems raises the need to verify safety concepts that execute on top of operating systems and middleware platforms. Current fault injection techniques consider the resulting software stack as one black box and attempt to test the reaction of all components in the context of faults. This leads to very high software complexity and consequently requires a very high number of fault injection experiments. Testing the software components, such as control functions, operating systems, and middleware, individually would lead to a significant reduction of the number of experiments required. In this paper, we illustrate our novel approach for fault injection testing, which considers the components of a software stack, enables re-use of previously collected evidences, allows focusing testing on highly critical parts of the control software, and significantly lowers the number of experiments required.

Automotive products increase in complexity as they evolve from driver assistance towards highly automated and autonomous driving. We propose model-driven engineering (MDE) as a basis for developing these complex systems. Our contribution to this topic is twofold: First, we identify and discuss challenges in adopting MDE to the specific needs of the automotive industry with a special focus on dependability. Second, we sketch challenges that still require interdisciplinary research activities.

The number of cores per processor continues to increase due to higher integration rates and smaller feature sizes. This development of many-core processors leads to a higher susceptibility to soft errors, which are caused by high-energy particle strikes. At the same time, the complexity and computational demand of automotive applications is rising steadily, following the vision of highly automated driving. Due to their computational performance and their comparatively low costs, commercial off-the-shelf many-core processors become attractive in cost-driven mass markets such as the automotive domain. In order to execute safety-critical automotive applications on such processors and fulfill the obligatory safety standards, fault-tolerance mechanisms have to be installed. However, hardware-implemented fault-tolerance mechanisms increase the unit costs and are uncommon in consumer-grade many-core processors, which are designed for applications without safety requirements. In this thesis, we present an adaptive software-implemented fault-tolerance mechanism that is based on the N modular redundancy principle, leveraging the spatial redundancy of many-core processors. In order to eliminate the voter as a single point of failure, our mechanism employs two fail-silent voters that check and repair each other. The fail-silent behavior is achieved by an encoded voting procedure. Our fault-tolerance mechanism includes a state-conserving repair procedure to recover from replica and voter failures. In contrast to related work, we consider failures in all software components, including the OS kernel. In order to meet the real-time requirement of automotive applications, our faulttolerance mechanism utilizes well-known scheduling policies. However, consumer-grade many-core processors do not commonly provide an inter-core communication with latency and bandwidth guarantees. Therefore, we propose a software-based approach that guarantees a bounded latency for dynamic communication. The main principle of our approach is to limit the packet injection rate for all sources. Furthermore, we present a framework that eases the development of safety-critical real-time applications on consumer-grade many-core processors. The framework adapts our fault-tolerance mechanism for each task of a mixed-critical task set such that the task’s reliability and availability requirements are satisfied with minimum resource usage. A discrete Markov chain model of our mechanism is used to determine the resulting reliability and availability of each task. Measurements on a cycle-accurate and bit-accurate many-core processor simulator with realistic fault injections show the advantage of our adaptive software fault-tolerance mechanism and demonstrate the trade-off between resource usage and fault-tolerance level.

Commercial-off-the-shelf (COTS) many-core processors offer the performance needed for computational-intensive safety-critical real-time applications such as autonomous driving. However, these consumer-grade many-core processors are increasingly susceptible to faults because of their highly integrated design.In this paper, we present a fault-tolerance framework that eases the usage of COTS many-core processors for safety-critical applications. Our framework employs an adaptable software-based fault-tolerance mechanism that combines N Modular Redundancy (NMR) with a repair process and a rejuvenating round robin voting scheme. A Stochastic Activity Network (SAN) model of the fault-tolerance mechanism allows the framework to adapt the parameters of the mechanism such that a specified target availability is achieved with minimum overhead. Experiments on a cycle-accurate simulator empirically prove the correctness of the SAN model and evaluate the overhead of the framework.