Architecture Fault Modeling with the AADL Error-Model Annex

Abstract

Safety-Critical systems, as used in the automotive, avionics, or aerospace domains, are becoming increasingly software-reliant to the extent that the system cannot function without the software. On one hand the software system provides an integrated set of functionality to operate the system and manage failure and unsafe conditions. Current best safety engineering practices, such as DO178B/C or SAE ARP4761, are labor intensive and are only performed as part of the system engineering process. At the same time increased interaction complexity of the embedded software with the hardware platform and mechanical system has resulted in the software to be a major source of defects with potentially fatal consequences.To address these issues, the SAE Architecture Analysis & Design Language (AADL) standard has been extended with an Error Model Annex to support architecture fault modeling and automated safety analysis. In this paper we introduce the concepts of the revised Error Model (EMV2) Annex and a fault propagation ontology to support such architecture fault models at three levels of abstraction focusing on fault propagation, failure behavior of individual components, and composite failure behavior of a system in terms of its components. Such specifications reflect fault tolerance strategies assumptions made by fault impact, fault tree and reliability analysis about the safety system component. We illustrate their use on a dual redundant flight guidance system and discuss the automation of different safety analysis methods in use by the SAE ARP4761, emphasizing on automation benefits.

Variability Management in Safety-Critical Software Product Line Engineering

“…Two different TFC product variants in different usage contexts were considered through this paper. Although Tiriba was originally designed in MATLAB/Simulink, to illustrate the integration of variability management and compositional dependability analysis techniques, TFC architectural and dependability models were specified in AADL and AADL Error Annex [6]. Base Variability Resolution (BVR) toolset [34] and the developed AADL/Error Annex adapter were used to support variability management in both architecture and dependability models.…”

“…The adoption of an SPLE approach for developing safety-critical systems demands the integration of safety engineering into SPLE processes [14,28]. Compositional dependability analysis techniques [6,27,30] provide the automated support for safety engineering, and seamless integration between system design and dependability analysis. Thus, system design and dependability analysis can be performed in a single model, contributing to reduce the complexity of the product line dependability analysis.…”

“…Existing variability management techniques [1,15,17,32,33,34] provide support for managing variation at requirements, architecture, components, source code, and test cases. However, these techniques were not originally designed/or used to support variability management in dependability models developed with the support of compositional analysis techniques, e.g., OSATE AADL [6], HiP-HOPS [30], and CHESS [27].…”

Performing Safety Analyses with AADL and AltaRica

“…[6]). It is worth noting that each type of translation takes advantage of different features of the AADL model according to the targeted safety models.…”

“…It proposes several annexes to describe embedded systems behavior. The AADL Error Model V2 (EMV2) [6] is an error annex focused on Safety Analyses. It offers a terminology and an ontology to capture key features of failure/error propagations.…”