TY - CHAP A1 - Möhrle, Felix A1 - Bizik, Kai A1 - Zeller, Marc A1 - Höfig, Kai A1 - Rothfelder, Martin A1 - Liggesmeyer, Peter T1 - A Formal Approach for Automating Compositional Safety Analysis Using Flow Type Annotations In Component Fault Trees T2 - Proceedings of the 27th European Safety and Reliability Conference (ESREL): Safety and Reliability – Theory and Applications., Portorož, Slovenia: Taylor & Francis (CRC Press). N2 - Safety assurance is a major challenge in the design of modern embedded systems that has become increasingly difficult in recent years. Growing system sizes and the rise of Cyber-Physical systems confront safety engineers with large sets of configurations to be analyzed. Current approaches are usually carried out at design time and do not address the need for automated assessments in the field. With Component Fault Trees (CFTs) there exists a component-based methodology that enables an efficient modular composition of safety artifacts. The combined model is a system-level CFT that can be analyzed by means of popular Fault Tree Analysis techniques that are widely accepted in the industry. However, when composing models, their interfacing elements must be connected manually which impedes the automation of the procedure. In this work, we introduce the notion of flow types that represent a particular kind of component interaction and define a taxonomy of related failure behavior. By annotating CFTs with types, a machine-readable vocabulary is provided that allows for an automated interconnection of their interfaces. This way, the automatic composition of models according to system architecture is enabled, allowing for automated safety assessments on system-level. We demonstrate the feasibility of our approach using an example ethylene vaporization unit. KW - Compositional safety analysis KW - Flow type annotations KW - CFT Y1 - 2017 ER - TY - CHAP A1 - Höfig, Kai A1 - Zeller, Marc A1 - Heilmann, Reiner T1 - ALFRED: a methodology to enable component fault trees for layered architectures T2 - 2015 41st Euromicro Conference on Software Engineering and Advanced Applications (SEAA), August 2015,Funchal, Portugal. IEEE. N2 - Identifying drawbacks or insufficiencies in terms of safety is important also in early development stages of safety critical systems. In industry, development artefacts such as components or units, are often reused from existing artefacts to save time and costs. When development artefacts are reused, their existing safety analysis models are an important input for an early safety assessment for the new system, since they already provide a valid model. Component fault trees support such reuse strategies by a compositional horizontal approach. But current development strategies do not only divide systems horizontally, e.g., By encapsulating different functionality into separate components and hierarchies of components, but also vertically, e.g. Into software and hardware architecture layers. Current safety analysis methodologies, such as component fault trees, do not support such vertical layers. Therefore, we present here a methodology that is able to divide safety analysis models into different layers of a systems architecture. We use so called Architecture Layer Failure Dependencies to enable component fault trees on different layers of an architecture. These dependencies are then used to generate safety evidence for the entire system and over all different architecture layers. A case study applies the approach to hardware and software layers. KW - Fault trees KW - Layered architecture Y1 - 2015 SP - 167 EP - 176 ER - TY - CHAP A1 - Höfig, Kai A1 - Zeller, Marc A1 - Schorp, Konstantin T1 - Automated failure propagation using inner port dependency traces T2 - 2015 11th International ACM SIGSOFT Conference on Quality of Software Architectures (QoSA), Mai 2015, Montreal, QC, Canada. N2 - Safety assurance is a major challenge in the design of complex embedded and Cyber-physical Systems. Especially, changes and adoptions during the design or run-time of an embedded system invalidate former safety analyses and require an adaptation of the system's safety analysis models. In this paper, we present a methodology to fill up empty safety analysis artifacts in component fault trees using so-called inner port dependency traces to describe failure propagation. Thus, enabling a imprecise but rapid safety analysis of an entire system at early development stages or during system run-time for the automated certification of Cyber-physical Systems. We evaluate our approach using case study from the automotive domain. KW - Failure propagation KW - Port dependency traces KW - Cyber-physical Systems KW - Software safety Y1 - 2015 SP - 123 EP - 128 ER - TY - CHAP A1 - Jung, Jessica A1 - Höfig, Kai A1 - Domis, Dominik A1 - Jedlitschka, Andreas A1 - Hiller, Martin T1 - Experimental comparison of two safety analysis methods and its replication T2 - 2013 ACM / IEEE International Symposium on Empirical Software Engineering and Measurement, December 2013, Baltimore, MD, USA. N2 - (Background) Empirical Software Engineering (SE) strives to provide empirical evidence about the pros and cons of SE approaches. This kind of knowledge becomes relevant when the issue is whether to change from a currently employed approach to a new one or not. An informed decision is required and is particularly important in the development of safety-critical systems. For example, for the safety analysis of safety-critical embedded systems, methods such as Failure Mode and Effect Analysis (FMEA) and Fault Tree Analysis (FTA) are used. With the advent of model-based systems and software development, the question arises whether safety engineering methods should also be adopted. New technologies such as Component Integrated Fault Trees (CFT) come into play. Industry demands to know the benefits of these new methods over established ones such as Fault Trees (FT). (Methods) For the purpose of comparing CFT and FT with regard to the capabilities of the safety analysis methods (such as quality of the results) and to the participants' rating of the consistency, clarity, and maintainability of the methods, we designed a comparative study as a controlled experiment using a within-subject design. The experiment was run with seven academic staff members working towards their PhD. The study was replicated with eleven domain experts from industry. (Results) Although the analysis of the tasks' solutions showed that the use of CFT did not yield a significantly different number of correct or incorrect solutions, the participants rated the modeling capacities of CFT higher in terms of model consistency, clarity, and maintainability. (Conclusion) From this first evidence, we conclude that CFT have the potential of being beneficial for companies looking for a safety analysis approachfor projects using model-based development. KW - Safety Analysis KW - CFT KW - FMEA Y1 - 2013 SN - 978-0-7695-5056-5 SP - 223 EP - 232 ER - TY - CHAP A1 - Jung, Jessica A1 - Jedlitschka, Andreas A1 - Höfig, Kai A1 - Domis, Dominik A1 - Hiller, Martin T1 - A controlled experiment on component fault trees T2 - International Conference on Computer Safety, Reliability, and Security (SAFECOMP 2013) N2 - In safety analysis for safety-critical embedded systems, methods such as FMEA and fault trees (FT) are strongly established in practice. However, the current shift towards model-based development has resulted in various new safety analysis methods, such as Component Integrated Fault Trees (CFT). Industry demands to know the benefits of these new methods. To compare CFT to FT, we conducted a controlled experiment in which 18 participants from industry and academia had to apply each method to safety modeling tasks from the avionics domain. Although the analysis of the solutions showed that the use of CFT did not yield a significantly different number of correct or incorrect solutions, the participants subjectively rated the modeling capacities of CFT significantly higher in terms of model consistency, clarity, and maintainability. The results are promising for the potential of CFT as a model-based approach. KW - Safety-critical embedded systems KW - FMEA KW - CFT Y1 - 2013 SP - 285 EP - 292 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Möhrle, Felix A1 - Zeller, Marc A1 - Höfig, Kai A1 - Rothfelder, Martin A1 - Liggesmeyer, Peter T1 - Automating compositional safety analysis using a failure type taxonomy for component fault trees T2 - Risk, Reliability and Safety: Innovating Theory and Practice: Proc. of ESREL N2 - Safety assurance is a major challenge in the design of today’s complex embedded systems and future Cyber-physical systems. Changes in a system’s architectural design invalidate former safety analyses and require a manual adaptation of related safety analysis models in order to restore consistency. In this work, we present an approach for automating the compositional assembly of Component Fault Trees by automatically generating mappings between their input and output failure modes. Therefore, we propose a taxonomy of failure types for annotating model elements and deriving a model of the failure propagation. This way, automatic and system-wide safety analyses can be executed and easily repeated after making modifications to the system’s architecture. We demonstrate the feasibility of our approach using an example ethylene vaporization unit from an industrial domain. KW - Compositional safety analysis KW - CFT Y1 - 2016 SP - 1380 EP - 1387 ER - TY - CHAP A1 - Möhrle, Felix A1 - Zeller, Marc A1 - Höfig, Kai A1 - Rothfelder, Martin A1 - Liggesmeyer, Peter T1 - Automated compositional safety analysis using component fault trees T2 - Proceedings of the IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW 2015), November 2015, Gaithersburg, MD. N2 - Safety assurance is a major challenge in the design of today's complex embedded systems and future Cyber-physical systems. Especially changes in a system's architectural design invalidate former safety analyses and require an adaptation of related safety analysis models in order to restore consistency. In this work, we present an approach for automatically generating mappings between failure ports in compositional safety analysis models. This way, automatic and system-wide safety analyses are enabled that can be easily repeated after making modifications to the system's architecture. We demonstrate the feasibility of our approach using a case study from the automotive domain. KW - Safety KW - Fault trees KW - Adaption models KW - Automotive Engineering Y1 - 2015 SP - 152 EP - 159 ER - TY - CHAP A1 - Zeller, Marc A1 - Höfig, Kai T1 - INSiDER: Incorporation of system and safety analysis models using a dedicated reference model T2 - 2016 Annual Reliability and Maintainability Symposium (RAMS) N2 - In order to enable model-based, iterative design of safety-relevant systems, an efficient incorporation of safety and system engineering is a pressing need. Our approach interconnects system design and safety analysis models efficiently using a dedicated reference model. Since all information are available in a structured way, traceability between the model elements and consistency checks enable automated synchronization to guarantee that information within both kind of models are consistent during the development life-cycle. KW - Safety KW - CFT Y1 - 2016 SP - 1 EP - 6 ER - TY - CHAP A1 - Zeller, Marc A1 - Höfig, Kai A1 - Schwinn, Jean-Pascal T1 - ArChes—Automatic generation of component fault trees from continuous function charts T2 - 2017 IEEE 15th International Conference on Industrial Informatics (INDIN), July 2017, Emden, Germany. N2 - The growing size and complexity of software in embedded systems poses new challenges to the safety assessment of embedded control systems. In industrial practice, the control software is mostly treated as a black box during the system's safety analysis. The appropriate representation of the failure propagation of the software is a pressing need in order to increase the accuracy of safety analyses. However, it also increase the effort for creating and maintaining the safety analysis models (such as fault trees) significantly. In this work, we present a method to automatically generate Component Fault Trees from Continuous Function Charts. This method aims at generating the failure propagation model of the detailed software specification. Hence, control software can be included into safety analyses without additional manual effort required to construct the safety analysis models of the software. Moreover, safety analyses created during early system specification phases can be verified by comparing it with the automatically generated one in the detailed specification phased. KW - Industrial Informatics KW - CFT KW - Function charts Y1 - 2017 ER - TY - CHAP A1 - Armengaud, Erik A1 - Macher, Georg A1 - Massoner, Alexander A1 - Frager, Sebastian A1 - Adler, Rasmus A1 - Schneider, Daniel A1 - Longo, Simone A1 - Melis, Massimiliano A1 - Groppo, Riccardo A1 - Villa, Federica A1 - O’Leary, Padraig A1 - Bambury, Kevin A1 - Anita, Finnegan A1 - Zeller, Marc A1 - Höfig, Kai A1 - Papadopoulos, Yiannis A1 - Hawkins, Richard A1 - Kelly, Tim T1 - DEIS: Dependability Engineering Innovation for Industrial CPS T2 - Advanced Microsystems for Automotive Applications 2017 N2 - The open and cooperative nature of Cyber-Physical Systems (CPS) poses new challenges in assuring dependability. The DEIS project (Dependability Engineering Innovation for automotive CPS. This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 732242, see http://www.deis-project.eu) addresses these challenges by developing technologies that form a science of dependable system integration. In the core of these technologies lies the concept of a Digital Dependability Identity (DDI) of a component or system. DDIs are modular, composable, and executable in the field facilitating (a) efficient synthesis of component and system dependability information over the supply chain and (b) effective evaluation of this information in-the-field for safe and secure composition of highly distributed and autonomous CPS. The paper outlines the DDI concept and opportunities for application in four industrial use cases. KW - Industrial CPS KW - Dependability Engineering KW - Automotive Applications Y1 - 2018 SP - 151 EP - 163 PB - Springer CY - Cham ER - TY - CHAP A1 - Domis, Dominik A1 - Höfig, Kai A1 - Trapp, Mario T1 - A consistency check algorithm for component-based refinements of fault trees T2 - 2010 IEEE 21st International Symposium on Software Reliability Engineering (ISSRE), November 2010, San Jose, CA, USA. N2 - The number of embedded systems in our daily lives that are distributed, hidden, and ubiquitous continues to increase. Many of them are safety-critical. To provide additional or better functionalities, they are becoming more and more complex, which makes it difficult to guarantee safety. It is undisputed that safety must be considered before the start of development, continue until decommissioning, and is particularly important during the design of the system and software architecture. An architecture must be able to avoid, detect, or mitigate all dangerous failures to a sufficient degree. For this purpose, the architectural design must be guided and verified by safety analyses. However, state-of-the-art component-oriented or model-based architectural design approaches use different levels of abstraction to handle complexity. So, safety analyses must also be applied on different levels of abstraction, and it must be checked and guaranteed that they are consistent with each other, which is not supported by standard safety analyses. In this paper, we present a consistency check for CFTs that automatically detects commonalities and inconsistencies between fault trees of different levels of abstraction. This facilitates the application of safety analyses in top-down architectural designs and reduces effort. KW - embedded systems KW - Fault trees Y1 - 2010 SP - 171 EP - 180 ER - TY - GEN A1 - Guo, Zhensheng A1 - Höfig, Kai T1 - Integrated Model-Based Safety Analysis N2 - A method for integrated model-based safety analysis includes integrating a safety analysis model into a system development model of a safety-critical system. The system development model includes model components. The safety analysis model models a failure logic separately for each of the model components. The method includes representing dependencies among the model components with a design structure matrix. The design structure matrix represents each of the model components with a row and a column and shows dependencies between model components with corresponding entries. The method also includes sequencing the design structure matrix, and identifying at least one dependency loop and loop components in the sequenced design structure matrix. The loop components are part of the at least one dependency loop. KW - Integrated model-based safety analysis KW - Safety-critical systems Y1 - 2015 N1 - US Patent App. 14/066,403 ER - TY - GEN A1 - Höfig, Kai T1 - Automated Recertification of a Safety Critical System N2 - A method for automated recertification of a safety critical system with at least one altered functionality is provided. The method includes providing a failure propagation model of the safety critical system. The method also includes updating the failure propagation model of the safety critical system according to the at least one altered functionality using inner port dependency traces between inports and outports of a failure propagation model element representing the at least one altered functionality. The method includes calculating top events of the updated failure propagation model, and comparing the calculated top events with predetermined system requirements to recertify the safety critical system. KW - Automated recertification KW - Safety-critical systems Y1 - 2016 N1 - US Patent App. 14/586,818 ER - TY - GEN A1 - Höfig, Kai T1 - Analyzing the availability of a system N2 - An apparatus and method for analyzing availability of a system including subsystems each having at least one failure mode with a corresponding failure effect on the system are provided. The apparatus includes a degraded mode tree generation unit configured to automatically generate a degraded mode tree. The degraded mode tree includes at least one degraded mode element representing a degraded system state of the system that deviates from a normal operation state of the system based on a predetermined generic system meta model stored in a database including Failure Mode and Effects Analysis elements representing subsystems, failure modes, failure effects, and diagnostic measures. The apparatus also includes a processor configured to evaluate the generated degraded mode tree for calculation of the availability of the system. KW - System availability KW - Mode trees KW - Failure Mode Y1 - 2016 N1 - US Patent App. 15/048,644 ER - TY - CHAP A1 - Höfig, Kai T1 - Failure-dependent timing analysis-a new methodology for probabilistic worst-case execution time analysis T2 - International GI/ITG Conference on Measurement, Modelling, and Evaluation of Computing Systems and Dependability and Fault Tolerance. N2 - Embedded real-time systems are growing in complexity, which goes far beyond simplistic closed-loop functionality. Current approaches for worst-case execution time (WCET) analysis are used to verify the deadlines of such systems. These approaches calculate or measure the WCET as a single value that is expected as an upper bound for a system’s execution time. Overestimations are taken into account to make this upper bound a safe bound, but modern processor architectures expand those overestimations into unrealistic areas. Therefore, we present in this paper how of safety analysis model probabilities can be combined with elements of system development models to calculate a probabilistic WCET. This approach can be applied to systems that use mechanisms belonging to the area of fault tolerance, since such mechanisms are usually quantified using safety analyses to certify the system as being highly reliable or safe. A tool prototype implementing this approach is also presented which provides reliable safe upper bounds by performing a static WCET analysis and which overcomes the frequently encountered problem of dependence structures by using a fault injection approach. KW - Fault tolerance KW - Embedded real-time systems KW - Software safety KW - WCET Y1 - 2012 SP - 61 EP - 75 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Höfig, Kai T1 - FDTA–A Tool Chain for Failure-Dependent Timing Analysis T2 - Proc. of the 11th International Workshop on Worst-Case Execution Time Analysis N2 - Embedded real-time systems are growing in complexity, which goes far beyond simplistic closedloop functionality. Current approaches of worst-case execution time (WCET) analysis are used to verify deadlines of such systems, especially when they are safety critical. These approaches calculate or measure WCET as a single value that is expected as an upper bound for a system's execution time. Overestimations are taken into account to make this upper bound a safe bound, but modern processor architectures with caches, multi-threading, and instruction pipelines often expand those overestimations for safe upper bounds into unrealistic areas. Some approaches try to overcome this problem by calculating multiple upper bounds and argue that each single upper bound will hold for a certain probability (probabilistic worst-case execution time). Even though some of them tackle the problem of obtaining reliable probabilistic values for such upper bounds, more effort is required. Therefore, we present in this paper how probabilities of safety analysis models can be combined with elements of system development models to calculate a probabilistic worst-case execution time. This approach can be applied to systems that use mechanisms belonging to the area of fault tolerance, since such mechanisms are usually quantified in safety analyses to certify the system as being highly reliable or safe. KW - FDTA-A KW - Failure-Dependent Timing Analysis KW - Tool chains Y1 - 2011 ER - TY - CHAP A1 - Höfig, Kai A1 - Armbruster, Michael A1 - Schmidt, Reiner T1 - A vehicle control platform as safety element out of context. T2 - HiPEAC Computing Systems Week, Barcelona, Spain, May 2014. KW - Vehicle control platform KW - Software safety Y1 - 2014 ER - TY - CHAP A1 - Höfig, Kai A1 - Domis, Dominik T1 - Failure-Dependent execution time analysis T2 - Proceedings of the Joint ACM SIGSOFT Conference–QoSA and ACM SIGSOFT Symposium–ISARCS on Quality of Software Architectures–QoSA and Architecting Critical Systems–ISARCS, Boulder, Colorado, USA, June 2011. N2 - The growing complexity of safety-critical embedded systems is leading to an increased complexity of safety analysis models. Often used fault tolerance mechanisms have complex failure behavior and produce overhead compared to systems without such mechanisms. The question arises whether the overhead for fault tolerance is acceptable for the increased safety of a system. Manually modeling the timing behavior is cost intensive and error prone. Current approaches of safety analysis and execution time analysis are not able to reflect the timing behavior of complex mechanisms according to failures. In this paper, we describe an approach that combines safety analysis models with execution times to extract different execution times for different failure conditions. This provides a detailed view on the safety behavior in combination with the produced overhead and allows to find and certify appropriate fault tolerance mechanisms. KW - Software architecture KW - Safety-critical systems KW - Analysis models Y1 - 2011 SP - 115 EP - 122 PB - ACM CY - New York, NY, USA ER - TY - GEN A1 - Höfig, Kai A1 - Zeller, Marc T1 - Automated Qualification of a Safety Critical System N2 - A method for automated qualification of a safety critical system including a plurality of components is provided. A functional safety behavior of each component is represented by an associated component fault tree element. The method includes automatically performing a failure port mapping of output failure modes to input failure modes of component fault tree elements based on a predetermined generic fault type data model stored in a database. KW - Automated qualification KW - Safety-critical systems KW - Fault trees Y1 - 2016 N1 - US Patent App. 14/644,119 ER - TY - CHAP A1 - Adler, Rasmus A1 - Domis, Dominik A1 - Höfig, Kai A1 - Kemmann, Sören A1 - Kuhn, Thomas A1 - Schwinn, Jean- Pascal A1 - Trapp, Mario T1 - Integration of component fault trees into the UML T2 - International Conference on Model Driven Engineering Languages and Systems. N2 - Efficient safety analyses of complex software intensive embedded systems are still a challenging task. This article illustrates how model-driven development principles can be used in safety engineering to reduce cost and effort. To this end, the article shows how well accepted safety engineering approaches can be shifted to the level of model-driven development by integrating safety models into functional development models. Namely, we illustrate how UML profiles, model transformations, and techniques for multi language development can be used to seamlessly integrate component fault trees into the UML. KW - Safety Analysis KW - fault trees KW - Model driven engineering languages Y1 - 2010 SP - 312 EP - 327 PB - Springer-Verlag CY - Berlin, Heidelberg ER -