METHOD AND APPARATUS FOR GENERATING A FAULT TREE

Abstract

A method and apparatus for generating a fault tree for a failure mode of a multi-mode system which includes a plurality of system components, the method includes the steps of providing component fault tree elements of the system components, wherein each component fault tree element includes at least one component fault tree mode element, representing a failure-relevant operation mode of the respective system component; selecting at least one component fault tree mode element representing a system state of the system; and generating the fault tree by incorporating the selected component fault tree mode elements the generated fault tree representing a failure behaviour of a system state of the system.

Claims

1. A method for generating a fault tree for a failure mode of a multi-mode system comprising a plurality of system components, said method comprising the steps of: (a) providing component fault tree elements of the system components, wherein each component fault tree element comprises at least one component fault tree mode element representing a failure-relevant operation mode of the respective system component; (b) selecting at least one component fault tree mode element representing a system state of said system; and (c) generating the fault tree by incorporating the selected component fault tree mode elements said generated fault tree representing a failure behaviour of a system state of said system.

2. The method according to claim 1, wherein the generated fault tree is reduced by applying a Boolean logic to create a reduced fault tree for a selected output failure mode of the fault tree.

3. The method according to claim 1, wherein the method is performed in a normal operation mode of said system during runtime.

4. The method according to claim 1, wherein the method is performed in a separate operation mode of said system, during deployment of components, during configuration or reconfiguration of a component of said system and/or during maintenance or repair of a component of said system.

5. The method according claim 1, wherein the failure-relevant operation mode of the system comprises a start-up operation mode, a calibration operation mode, a degraded operation mode and/or an emergency operation mode.

6. The method according to claim 1, wherein the system components comprise hardware components and/or software components.

7. The method according to claim 1, wherein the component fault tree elements and the component fault tree mode elements of the system components are loaded from a library stored in a database.

8. The method according to claim 2, wherein the reduced fault tree is evaluated to quantify and/or qualify the failure behaviour of the respective system state.

9. An apparatus for generating a fault tree for a failure mode of a multi-mode system, said apparatus comprising (a) an input interface adapted to input component fault tree elements of system components, each component fault tree element comprising at least one component fault tree mode element representing a failure-relevant operation mode of the respective system component; (b) a selection unit adapted to select at least one component fault tree mode element representing a system state of said system; and (c) a calculation unit adapted to generate the fault tree by incorporating the selected component fault tree mode elements wherein the generated fault tree represents a failure behaviour of a system state of said system.

10. The apparatus according to claim 9, wherein the calculation unit is adapted to reduce by application of a Boolean logic the generated fault tree to provide a reduced fault tree.

11. The apparatus according to claim 10, wherein the calculation unit is adapted to evaluate the reduced fault tree to provide a quantification and/or qualification result of the failure behaviour of the respective system state of said system.

12. The apparatus according claim 9, wherein the system components comprise hardware components and/or software components of a safety-critical system.

13. The apparatus according to claim 1, wherein the component fault tree elements and the component fault tree mode elements of the system components are loaded from a library stored in a database.

14. The apparatus according to claim 9, wherein the apparatus is connectable to at least one component of said system by means of a communication interface of said apparatus.

15. A complex technical system comprising a plurality of hardware components and/or software components said complex technical system having at least one component having a communication interface configured to connect an apparatus according to claim 9 adapted to generate and evaluate a fault tree for a failure mode of said complex technical system.

Description

BRIEF DESCRIPTION

[0030] Some of the embodiments will be described in detail, with reference to the following figures, wherein like designations denote like members, wherein:

[0031] FIG. 1 shows a flowchart of a possible exemplary embodiment of a method for generating a fault tree for a failure mode of a multi-mode system;

[0032] FIG. 2 shows a block diagram of a possible exemplary embodiment of an apparatus for generating a fault tree for a failure mode of a multi-mode system;

[0033] FIG. 3 shows a component fault tree data model of components of an exemplary complex system for illustrating the operation of a method and apparatus;

[0034] FIG. 4 shows a diagram for illustrating a generated fault tree for a system state in an operation mode of a system component of a complex system represented by the component fault tree model as shown in FIG. 3;

[0035] FIG. 5 shows a diagram of a reduced fault tree derived from the generated fault tree illustrated in FIG. 4;

[0036] FIG. 6 shows a diagram for a generated fault tree for a system state of a complex system where a specific component is in a second operation mode;

[0037] FIG. 7 shows a diagram of a reduced fault tree derived from the generated fault tree shown in FIG. 6;

[0038] FIG. 8 shows a diagram for a system state of a complex system where both modes of a specific component of the system are active;

[0039] FIG. 9 shows a diagram for illustrating a reduced fault tree derived from the fault tree illustrated in FIG. 8;

[0040] FIG. 10 shows an exemplary complex system investigated by a method or apparatus;

[0041] FIG. 11 shows a conventional fault tree; and

[0042] FIG. 12 shows a component fault tree as used by the method and apparatus.

DETAILED DESCRIPTION

[0043] As can be seen in FIG. 1, a method for generating a fault tree for a failure mode of a multi-mode system comprising a plurality of system components according to embodiments of the first aspect of the present invention can comprise several steps.

[0044] The complex technical system can be a safety-critical system SCS, in particular a cyberphysical complex system SYS as illustrated in FIG. 10. The components c such as the components C1 to C7 illustrated in FIG. 10 can comprise hardware and/or software components. Each component c can be represented by a corresponding component fault tree element CFTE. The functional safety behaviour of each component c of the system SYS can be represented by an associated component fault tree element. The component fault tree element CFTE is a Boolean data model associated with system development elements such as components c. Each different component fault tree element CFTE can be related to each component c of the complex technical system SYS. Failures that are visible at the outport of a component are modelled using output failure modes, OFMs, which are related to the specific outport of the component c. For modelling how specific failures propagate from an inport of a component to an outport, input failure modes, IFMs, are used. The inner failure behaviour within the component c that also influences the output failure modes, OFMs, is modelled in a preferred embodiment using gates such as NOT, AND, OR gates, and basic events. FIG. 11 shows a conventional classic fault tree and FIG. 12 shows a corresponding component fault tree CFT. In both trees, the top events or output events TE1 and TE2 can be modelled. The component fault tree model illustrated in FIG. 12 allows, additionally to the Boolean formulae that are also modelled within the conventional classic fault tree illustrated in FIG. 11, to associate the specific top events TE to the corresponding ports where these failures can appear. Top event TE1, for example, appears at port O1. Input Failure Mode In is associated with import i1 of the component c. The inner failure behaviour is modelled by basic event A as input to an OR gate and an AND gate. Using this methodology of components also within fault tree models, benefits during the development of the complex system SYS can be observed, for example an increased maintainability of the safety analysis model. A complex technical system SYS comprises a plurality of software and/or hardware components c. In a possible embodiment, the complex technical system SYS comprises at least one component c having a communication interface configured to connect an apparatus adapted to generate a fault tree for a failure mode of the multi-mode complex system SYS and to evaluate the generated fault tree.

[0045] With the method for generating a fault tree for a failure mode of the multi-mode system as illustrated in FIG. 1, in a first step S1, component fault tree elements of the system components c are provided. For example in FIG. 3, three component fault tree elements CFTE1, CFTE2, CFTE3 of three corresponding components are shown. Each component fault tree element CFTE1, CFTE2, CFTE3 comprises at least one component fault tree mode element representing a failure-relevant operation mode of the respective system component c. In the exemplary system data model SYS-DM illustrated in FIG. 3, the second component fault tree element CFTE2 has two component fault tree mode elements CFTME.sub.A, CFTME.sub.B representing two different operation modes of the respective system component. The first and third component fault tree elements CFTE1, CFTE3 represent corresponding components operating in a single operation mode so that the component fault tree element CFTE1 is identical with it component fault tree mode element CFTME1 and the component fault tree element CFTE3 is identical with the component fault tree mode element CFTME3.

[0046] In a further step S2, at least one component fault tree mode element CFTME representing a system state of the system is selected.

[0047] In a further step S3, the fault tree is generated by incorporating the selected component fault tree mode elements CFTMEs, wherein the generated fault tree represents a failure behaviour of a system state of the respective technical system.

[0048] In a possible embodiment, the generated fault tree is reduced by applying a Boolean logic to create a reduced fault tree for a selected output failure mode of the fault tree.

[0049] In a possible embodiment, the method as illustrated in FIG. 1, can be performed in a normal operation mode of the system during runtime. In an alternative embodiment, the method can be performed in a separate operation mode of the investigated technical system, in particular during deployment of components, during configuration or reconfiguration of a component of the system and/or during maintenance or repair of a component of the system. The failure-relevant operation modes of the system SYS can comprise a start-up operation mode, a calibration operation mode, a degraded operation mode and/or an emergency operation mode of the technical system SYS. In a possible embodiment of the method as illustrated in FIG. 1, the component fault tree elements and the component fault tree mode elements of the system components c are loaded from a library stored in a database. In a further possible embodiment, the reduced fault tree is further evaluated to quantify and/or qualify the failure behaviour of the respective system state of the system SYS.

[0050] FIG. 2 illustrates a block diagram of a possible exemplary embodiment of an apparatus 1 for generating a fault tree for a failure mode of a multi-mode system. The apparatus 1 comprises in the shown embodiment an input interface 2 adapted to input component fault tree elements of system components c, wherein each component fault tree element comprises at least one component fault tree mode element representing a failure-relevant operation mode OM of the respective system component c. In a possible embodiment, the input interface 1 is connected to a database. In this embodiment, the component fault tree elements and the component fault tree mode elements of the system components c of the system SYS are loaded from a library stored in a database. The apparatus 1 can be further connectable to at least one component c of the system SYS itself by means of an additional communication interface.

[0051] The apparatus 1 further comprises a selection unit 3 adapted to select at least one component fault tree mode element representing a system state of the investigated technical system SYS. The apparatus 1 further comprises a calculation or processing unit 4 adapted to generate the fault tree by incorporating the selected component fault tree mode elements. The generated fault tree represents a failure behaviour of a system state of the investigated system SYS. In a possible embodiment, the calculation unit 4 of the apparatus 1 is further adapted to reduce by application of a Boolean logic the generated fault tree to provide a reduced fault tree. In a further possible embodiment, the calculation unit 4 of the apparatus 1 is adapted to evaluate the reduced fault tree to provide a quantification and/or a qualification result of the failure behaviour of the respective system state of the investigated system SYS.

[0052] In a possible embodiment, the apparatus 1 can be connected to an investigated system SYS during its normal operation mode and the analysis can be performed in the normal operation mode of the system SYS during runtime of the system SYS.

[0053] In an alternative embodiment, the connected apparatus 1 is configured to generate the fault tree for a failure mode of the investigated multi-mode system SYS in a separate operation mode of the investigated system SYS. For instance, the apparatus 1 can generate and analyse the fault tree in a possible embodiment during deployment of specific components c of the system SYS, during configuration or reconfiguration of one or several system components c of the system SYS or during maintenance or repair of one or more system components c of the system SYS. In a possible embodiment, the apparatus 1 as shown in FIG. 2 is activated during a failure-relevant operation mode of a specific system component c of the investigated system SYS. This failure-relevant operation mode of the system SYS or system component c can comprise a start-up operation mode, a calibration operation mode, a degraded operation mode and/or an emergency operation mode of a specific component c and/or the whole system SYS.

[0054] In a possible embodiment, the apparatus 1 as shown in FIG. 2 forms a separate device which can be connected to at least one component c of the system SYS by means of a communication interface. In a possible embodiment, the input interface 2 of the apparatus 1 is connected to a corresponding interface of a system component c.

[0055] In a still further possible embodiment, the apparatus 1 as shown in FIG. 2 can be integrated in the complex technical system SYS, for instance in a complex technical embedded system. In this embodiment, the input interface 2 of the apparatus 1 can be connected to a system bus of the respective complex technical system SYS.

[0056] FIG. 3 shows a component fault tree data model SYS-DM of a system SYS comprising three system components, wherein one component can operate in two different operation modes, i.e. mode A and mode B. In the illustrated exemplary data model of FIG. 3, the complex system SYS comprises a sensor SEN, a processing unit PU and an actor ACT. The component fault tree data model SYS-DM shown in FIG. 3 comprises a corresponding number of component fault tree elements CFTE1, CFTE2, CFTE3 for each system component c of the investigated exemplary system. In internal failure propagation behaviour of the component c is modelled by gates such as OR Gates and basic events a, b, c, d. The output of the third component actor ACT is associated to the top event loss of LO as illustrated in FIG. 3. Also in FIGS. 4 to 9 LO represents the top event loss of.

[0057] In the shown example, a component fault tree element of the second system component processing unit PU comprises two component fault tree mode elements CFTME.sub.A, CFTME.sub.B each representing a failure-relevant operation mode of the system component processing unit. These component fault tree mode elements CFTME.sub.A, CFTME.sub.B model the failure behaviour of the component processing unit PU for two different modes A, B. If the component c processing unit PU of the system SYS operates in mode A, a failure of type b will result in a failure at the outport P3 of the component. In contrast, if the component processing unit PU operates in operation mode B, a failure of type b cannot occur, but a failure of type c will result in a failure visible at the outport P3 of the component processing unit PU. Accordingly, if the system SYS operates in a state where the component processing unit PU operates in mode A, the failure behaviour of the system SYS can be described by a fault tree as depicted in FIG. 4. By application of a Boolean logic, a reduced fault tree for this mode A can be generated as shown in FIG. 5.

[0058] If the system SYS operates in a state where the component processing unit PU operates in mode B, a failure behaviour of the system SYS can be described by a fault tree as depicted in FIG. 6. This generated fault tree can be reduced by application of a Boolean logic through a reduced fault tree as shown in FIG. 7.

[0059] If it is unclear in which state the technical system SYS is currently operating, a worst case can be assumed. As a result, both modes may be active and the failure behaviour of the investigated technical system SYS can be expressed by using a fault tree as depicted in FIG. 8. This generated fault tree can be reduced by application of a Boolean logic to provide a reduced fault tree as shown in FIG. 9.

[0060] With the method according to the first aspect of embodiments of the present invention, it is possible to divide safety analysis models into different states or modes of a component for a State AwaRe fault Tree Analysis (SPARTA) of the respective system SYS. Each component c of the system can have multiple states with different failure behaviour. The reaction of the complex investigated system SYS can be analysed by identifying active states of particular components c of the system in a certain situation.

C=c.sub.1, . . . , c.sub.n represents the set of components c of an investigated technical system SYS, CFT=cft.sub.1, . . . , cft.sub.m represents the set of component fault trees:

C{tilde over (F)}T(c)=cft with cC and cftCFT.

Further

IN(c)=in.sub.1, . . . ,in.sub.i, and OUT(c)=out.sub.1, . . . ,out.sub.j

[0061] represents the in- and outports of a component c and

CON={(out,in)|outOUT(c.sub.1) . . . OUT(c.sub.n),inIN(c.sub.1) . . . IN(c.sub.n)}

[0062] is the set of all possible port connections and

CONCON

[0063] being the set of actual port connections modelling the data flow from the outport of a component to the inport of another component.

Further

[0064]
SPARTA(c)=m.sub.1, . . . ,m.sub.n

[0065] is the set of all modes m of a component c.

[0066] For the exemplary system data model SYS-DM of a system SYS shown in FIG. 3, the previously defined sets are as follows:

C=sensor, processing, actor(1)

IN(sensor)={ }(2)

IN(processing)=p.sub.2(3)

IN(actor)=p.sub.4(4)

OUT(sensor)=p.sub.1(5)

OUT(processing)=p.sub.3(6)

OUT(actor)={ }(7)

CONN=(p.sub.1,p.sub.2),(p.sub.3,p.sub.4)(8)

SPARTA(sensor)={ }(9)

SPARTA(processing)={1,2}(10)

SPARTA(actor)==(11)

[0067] These sets are used for an analysis of a specific state of the system SYS, where each active mode can be addressed. If there is no mode available for a component c, the mode is addressed using *. Also, if all modes of a component c need to be included in the analysis, the symbol * is used.

For the set C=c.sub.1, . . . , c.sub.n, the set

STATE(C)={(m.sub.1, . . . ,m.sub.n}|m.sub.iSPARTA(c.sub.i)*,i=1, . . . ,n}

[0068] describes all possible states of the system that are expressed using SPARTA. For the examplary system, this set is as follows:

STATE(C)=(*,1,*),(*,2,*),(*,*,*)(12)

[0069] The method and apparatus can be used to analyse different kinds of technical systems SYS. FIG. 10 shows an exemplary cyberphysical system SYS comprising different subsystems and/or components c1 to c7. All subsystems c can possibly interact with each other, for example via a cable or a wireless connection and can execute a same function on different hardware platforms. If one of these functions migrates to another subsystem, e.g. subsystem C2 uses autonomous driving from subsystem CS, this might require a recertification of the safety analysis model of the different hardware.

[0070] Another example for using the method and apparatus according to embodiments of the present invention is the deployment of components, in particular software components, on an existing hardware platform comprising a plurality of different hardware components. For instance, the method and apparatus can be used during deployment of software components in a complex system SYS such as a vehicle or car comprising a plurality of components communicating with each other, for instance via a data or a control bus. A further use case is a safety analysis after two physical subsystems have been coupled with each other. For example, if two train sections are coupled with each other to form a train, the method and apparatus can perform a safety analysis of the created new complex system, i.e. train. For instance, the apparatus 1 according to embodiments of the present invention can be connected to a system bus of the train.

[0071] In a possible embodiment, the method is performed in the background during runtime of the investigated complex system SYS. In a possible embodiment, the generated safety analysis results can be output to a user or a central control unit. Depending on the safety analysis results, it can be decided, whether the investigated system SYS is safe or safety-critical. If the safety analysis is performed during the runtime of the safety-critical system SYS, in a possible embodiment, the system may be shut down or deactivated automatically, if the safety analysis performed by the apparatus 1 connected to the complex system SYS or integrated in the complex system SYS indicates that the investigated system SYS cannot be operated safely.

[0072] Although the present invention has been disclosed in the form of preferred embodiments and variations thereon, it will be understood that numerous additional modifications and variations could be made thereto without departing from the scope of the invention.

[0073] For the sake of clarity, it is to be understood that the use of a or an throughout this application does not exclude a plurality, and comprising does not exclude other steps or elements.