Software Fault Tree Research Articles

A formal approach to support the identification of unsafe control actions of STPA for nuclear protection systems

STPA (System-Theoretic Process Analysis) is a widely used safety analysis technique to identify UCAs (Unsafe Control Actions) resulting in potential losses. It is totally dependent on the experience and ability of analysts to construct an information model called Control Structures, upon which analysts try to identify unsafe controls between system components. This paper proposes a formal approach to support the manual identification of UCAs, effectively and systematically. It allows analysts to mechanically extract Process Model, an important element that makes up the Control Structures, from a formal requirements specification for a software controller. It then concisely constructs the contents of Context Tables, from which analysts can identify all relevant UCAs effectively, using a software fault tree analysis technique. The case study with a preliminary version of a Korean nuclear reactor protections system shows the proposed approach's effectiveness and applicability.

A Safety Analysis Method of Airborne Software Based on ARP4761

Most of the functions of civil aircraft are achieved through software at present. Therefore, the safety of airborne software has become an important part of safety analysis. However, to achieve complex functions, the onboard software becomes very complicated, and it is usually difficult to guarantee safety. ARP4761(Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment) is an important safety assessment guideline for civil aircraft, but it believes that software development can satisfy safety as long as the software development process complies with the software development standards, instead of incorporating the software into the safety analysis process. To improve airborne software safety, this paper proposes a safety analysis method based on the ARP4761 process which is tailored to adapt to the software. In the software requirements and design, the method uses FHA(Functional Hazard Assessment) to analyze the hazards of the software and define the hazard levels, then use FTA(Fault Tree Analysis) to build a software fault tree, and carry out CCA(Common Cause Analysis) analysis based on the fault tree; after the software development is completed, the method uses FMEA(Failure Modes and Effects Analysis) and FMES(Failure Modes and Effects Summary) to summarize the failures of the software and return these failures to the fault tree to determine whether the software can meet the defined requirements. At the end of the article, an anti-icing software is used as an example to explain the process and effectiveness of the method.

A Software Fault Tree Analysis Technique for Formal Requirement Specifications of Nuclear Reactor Protection Systems

Rigorous safety demonstration of software, as well as systems, is required when developing digital reactor protection systems in nuclear power plants. Various safety analysis techniques try to identify, analyze, and find remedies for potential hazards at each stage of software development life-cycle. This paper proposes a software fault tree analysis technique for software requirements written in the NuSCR formal specification language. The proposed method can mechanically construct software fault trees and calculate minimal cut-sets, encompassing timing constraints of multi-cycles, from NuSCR formal specifications. We also improved the fault tree construction and analysis tool into “NuFTA 2.0” to cope with multi-cycled executions. The case study with a preliminary version of requirements specification for a Korean nuclear power plant in operation shows the proposed technique’s effectiveness and applicability to other V&Vs such as simulation.

SFTA-Based Approach for Safety/Reliability Analysis of Operational Use-Cases in Cyber-Physical Systems

The software is often responsible for controlling the behavior of mechanical and electrical components, as well as interactions among these components in cyber-physical systems (CPS). The risks in CPS systems could result in losing tools, features, performance and even life. Therefore, safety analysis for software in these systems is a highly critical and serious issue. In general, safety and reliability approaches play a major role in a risk management process in CPS. In this paper, after reviewing the major techniques of software reliability and safety in CPS, an software fault tree analysis (SFTA)-based approach is presented for analysis of operational use-cases (UC) in a CPS system. In our approach, the events related to use-cases are extracted, and the related SFTA is then obtained using the proposed algorithm. Moreover, a semi-automatic method is presented in this paper to produce software failure mode and effects analysis (SFMEA) from SFTA. The results of our approach are applicable for software safety analysis in a real CPS system, including the control system of Iranian National Observatory telescope. Assessment of the suggested method is performed through numerous safety/reliability criteria and the qualitative/quantitative analysis based on these criteria.

Analysis of software safety and reliability methods in cyber physical systems

The software-based systems, alone do not cause any risk; but the risk is posed when the software-based systems are considered in the context of general systems where potential risks or hazards exist. Cyber-physical systems are cited as instances of software-based systems. Nowadays, safety and reliability of cyber-physical systems are considerably important due to the increasing complexity of these systems. Risk management techniques are required to reduce the risk to an acceptable level. Generally, safety and reliability methods are important in a risk management process among them software fault tree analysis (SFTA) and software failure modes and effects analysis (SFMEA) methods can be utilised. The main purpose of this article is to provide a comprehensive survey and evaluation of the currently available approaches for software safety and reliability methods in cyber-physical systems in order to reflect the state of the art of this active area.

The applications of SFTA and SFMEA approaches during software development process: an analytical review

Software fault tree analysis SFTA and software failure modes and effects analysis SFMEA are two well known recommended approaches for the analysis of software induced hazards in the system and are adapted in the software domain by employing the concepts of standard hardware safety approaches namely fault tree analysis FTA and failure modes and effects analysis FMEA respectively. Both SFTA and SFMEA approaches, since their inception in the software domain, have been explored, either individually or jointly, by researchers at different stages of software development. This paper presents the critical review of the published work about the applications of both these approaches in three phases, namely requirements analysis, design and implementation/coding phases of software life cycle. After presenting the analytical review, the paper identifies the problems that are currently faced during the applications of these approaches and guides the directions for carrying out further research.

The Test Case Design of the Failure Mode Judgment Software

Failure mode judgment software is widely used in the security control system, it always has higher safety critical level than other softwares. Therefore the testing standards for such software must also be improved. In order to solve the problem of the black box testing for such software, this paper establishment the software fault tree based on the software fault analysis, and use the software fault tree as a test case design tree, then design the test case after obtained the minimal cut sets. Meanwhile, this paper establish the test case design tree for the failure mode misjudgment, and use it as the basis in designing the failure mode misjudgment test cases. We developed the test case assisted design tool based on these methods, and successfully use it in the software testing of the escape software.

Risk analysis: a guiding force in the improvement of testing

The authors propose a state-based risk assessment methodology at the analysis and design stage of Software Development Life Cycle. First, a method is proposed to estimate the risk for various states of a component within a scenario and then, the risk for the whole scenario is estimated. The key data needed for risk assessment are complexity and severity. An Inter-Component State-Dependence Graph is introduced to estimate the complexity for a state of a component within a system. The severity for a component within a scenario is decided based on three hazard techniques: Functional Failure Analysis, Software Failure Mode and Effect Analysis and Software Fault Tree Analysis. The risk for a scenario is estimated based on the risk of interacting components in various states within the scenario and State COllaboration TEst Model of the scenario. Finally, the system risk is estimated based on two inputs: scenarios risks and Interaction Overview Diagram of the system. The methodology is applied on a Library Management System case study. An experimental comparative analysis is performed and observed that the testing team guided by our state-based risk assessment approach achieves high test efficiency compared with it with an existing component-based risk assessment approach.

Hazard analysis of Unified Modelling Language sequence and state charts using software fault tree analysis

Software fault tree analysis (SFTA) is a well known software safety analysis technique for identifying those software related erroneous events which can force the system into a hazardous state. Over the years, the effective strengths of SFTA approach have been demonstrated by applying it practically at every phase of software development such as coding, design and requirement analysis. The focus of SFTA application research efforts at the software design phase is the automatic or semi-automatic construction of a software fault tree for the selected hazardous state of the system directly from the given Unified Modelling Language (UML) models such as sequence and state charts. But programmed application of SFTA has been successfully carried out so far only in the coding phase whereas at other phases especially at design and requirement analysis its application remains a manual process so far. This paper presents a semi-automated approach to construct a software fault tree from the UML sequence and state charts drawn for a particular functional scenario. The effective strength(s) of the proposed approach have been demonstrated by applying it on two use-case scenarios selected from an elevator controller application.

Bi-directional fault analysis of evaporator inspection system

In this paper, we have performed a safety analysis on an automotive evaporator inspection system. We performed the bi-directional analysis on the manufacturing line. Software Fault Tree Analysis (SFTA) as backward analysis and Software Failure Modes, Effects, & Criticality Analysis (SFMECA) as forward analysis are performed alternately to detect potential cause-to-effect relations. The analysis results indicate the possibility of searching and summarizing fault patterns for future reusability.

A safety-focused verification using software fault trees

When developing safety-critical software such as reactor protection systems (RPS) in nuclear power plants, a demonstration of software trust (e.g., safety) is not only absolutely essential but also usually mandated by government authorities. While automated generation of fault trees has become possible with increased use of formal specifications, industrial use of fault trees has been limited primarily to safety demonstrations that the system is free from behavior captured in the root node. In this paper, we propose to extend the use of automated fault tree for verification purposes. As a fault tree represents an abstract and partial behavioral model of software on credible causes leading to a hazard, it must still satisfy various properties (e.g., fairness, correctness). Verification of a fault tree is useful when developing safety-critical software because (1) it strengthens a safety-focused software development process; (2) it provides an opportunity to detect potentially critical errors early; and (3) it is less likely to experience a state explosion problem. This paper demonstrates how to convert a fault tree into a semantically equivalent logic formula so that they can be subject to formal verification using tools like Verification Interacting with Synthesis (VIS). We evaluated the feasibility of FTA’s applicability as a verification tool on a prototype model of a nuclear power reactor protection system (RPS) software to be deployed in plants under construction in Korea.

FAULT TREE ANALYSIS OF KNICS RPS SOFTWARE

This paper describes the application of a software fault tree analysis (FTA) as one of the analysis techniques for a software safety analysis (SSA) at the design phase and its analysis results for the safety-critical software of a digital reactor protection system, which is called the KNICS RPS, being developed in the KNICS (Korea Nuclear Instrumentation & Control Systems) project. The software modules in the design description were represented by function blocks (FBs), and the software FTA was performed based on the well-defined fault tree templates for the FBs. The SSA, which is part of the verification and validation (V&V) activities, was activated at each phase of the software lifecycle for the KNICS RPS. At the design phase, the software HAZOP (Hazard and Operability) and the software FTA were employed in the SSA in such a way that the software HAZOP was performed first and then the software FTA was applied. The software FTA was applied to some critical modules selected from the software HAZOP analysis.

Integrated software safety analysis method for digital I&C systems

The digitalized Instrumentation and Control (I&C) system of Nuclear power plants can provide more powerful overall operation capability, and user friendly man-machine interface. The operator can obtain more information through digital I&C system. However, while I&C system being digitalized, three issues are encountered: (1) software common-cause failure, (2) the interaction failure between operator and digital instrumentation and control system interface, and (3) the non-detectability of software failure. These failures might defeat defense echelons, and make the Diversity and Defense-in-Depth (D3) analysis be more difficult. This work developed an integrated methodology to evaluate nuclear power plant safety effect by interactions between operator and digital I&C system, and then propose improvement recommendations. This integrated methodology includes component-level software fault tree, system-level sequence-tree method and nuclear power plant computer simulation analysis. Software fault tree can clarify the software failure structure in digital I&C systems. Sequence-tree method can identify the interaction process and relationship among operator and I&C systems in each D3 echelon in a design basis event. Nuclear power plant computer simulation analysis method can further analyze the available backup facilities and allowable manual action duration for the operator when the digital I&C fail to function. Applying this methodology to evaluate the performance of digital nuclear power plant D3 design, could promote the nuclear power plant operation safety. The operator can then trust the nuclear power plant than before, when operating the highly automatic digital I&C facilities.

A software fault tree key node metric

Analysis of software fault trees exposes failure events that can impact safety within safety-critical software product lines. This paper presents a software fault tree key node safety metric for measuring software safety within product lines. Fault tree structures impacting the metric’s composition are provided, and the mathematical basis for the metric is defined. The metric is applied to an embedded control system as well as to a series of experiments expected to either improve or degrade system safety. The effectiveness of the metric is analyzed, and lessons learned during the application of the metric are discussed.

Software fault tree and coloured Petri net based specification, design and implementation of agent-based intrusion detection systems

The integration of Software Fault Tree (SFT), which describes intrusions and Coloured Petri Nets (CPNs) that specifies design, is examined for an Intrusion Detection System (IDS). The IDS under development is a collection of mobile agents that detect, classify, and correlate the system and network activities. SFTs, augmented with nodes that describe trust, temporal and contextual relationships, are used to describe intrusions. CPNs for intrusion detection are built using CPN templates created from the augmented SFTs. Hierarchical CPNs are created to detect critical stages of intrusions. The agentbased implementation of the IDS is then constructed from the CPNs. Examples of intrusions and descriptions of the prototype implementation are used to demonstrate how the CPN approach has been used in the development of the IDS. The main contribution of this paper is an approach to systematic specification, design and implementation of an IDS; Innovations include (1) using stages of intrusions to structure the specification and design of the IDS; (2) augmentation of SFT with trust, temporal and contextual nodes to model intrusions; (3) algorithmic construction of CPNs from augmented SFT; and (4) generation of mobile agents from CPNs.

PLFaultCAT: A Product-Line Software Fault Tree Analysis Tool

Industry currently employs a product line approach to software development and deployment as a means to enhance quality while reducing development cost and time. This effort has created a climate where safety-critical software product lines are being developed without the full range of accompanying safety analysis tools available to software engineers. Software Fault Tree Analysis (SFTA) is a technique that has been used successfully to investigate contributing causes to potential hazards in safety-critical applications. This paper further extends the adaptation of SFTA to product lines of systems by describing a software safety analysis tool called PLFaultCAT. PLFaultCAT is an interactive, partially-automated support tool to aid software engineers in the application of product-line software SFTA. The paper describes the integration of product-line SFTA and PLFaultCAT with the software development life cycle. The description includes the initial construction of the product-line SFTA as well as the automated derivation of software fault trees for product line members. The technique and tool are illustrated with a small case study throughout the paper.

Testing digital safety system software with a testability measure based on a software fault tree

Using predeveloped software, a digital safety system is designed that meets the quality standards of a safety system. To demonstrate the quality, the design process and operating history of the product are reviewed along with configuration management practices. The application software of the safety system is developed in accordance with the planned life cycle. Testing, which is a major phase that takes a significant time in the overall life cycle, can be optimized if the testability of the software can be evaluated. The proposed testability measure of the software is based on the entropy of the importance of basic statements and the failure probability from a software fault tree. To calculate testability, a fault tree is used in the analysis of a source code. With a quantitative measure of testability, testing can be optimized. The proposed testability can also be used to demonstrate whether the test cases based on uniform partitions, such as branch coverage criteria, result in homogeneous partitions that is known to be more effective than random testing. In this paper, the testability measure is calculated for the modules of a nuclear power plant's safety software. The module testing with branch coverage criteria required fewer test cases if the module has higher testability. The result shows that the testability measure can be used to evaluate whether partitions have homogeneous characteristics.

Towards the automatic generation of mobile agents for distributed intrusion detection system

The Mobile Agent Intrusion Detection System (MAIDS) is an agent based distributed Intrusion Detection System (IDS). A disciplined requirement engineering process is developed to build MAIDS. The starting point is a high level description of intrusions expressed as Software Fault Trees (SFTs). Then the SFTs are translated to Colored Petri Nets (CPNs) that specify the IDS design. Subsequently, the CPNs are implemented as software intrusion detection agents in the MAIDS agent system. By using SFT and CPN as the theoretical underpinnings, the design and implementation of MAIDS can be verified and the design and implementation errors can be substantially reduced. This paper presents a tool that automatically translates CPNs that specify IDS design into software intrusion detection agents in MAIDS. Together with the translator we have developed to convert SFTs that model intrusions into the CPN for IDS design, this tool can automatically generate intrusion detection software agents from a high level description of intrusions.

Quantitative evaluation of safety critical software testability based on fault tree analysis and entropy

One of the definitions for testability is the probability whether tests will detect a fault, given that a fault in the program exists. The testability can be estimated from the probability of each statement fault leading to output failure. The probability of the test detecting a fault depends on the probability of individual statement faults appearing as an output failure when a fault exists at a statement. The testability measure of the software has been introduced based on output failure probability and the entropy of the importance of basic statements to the output failure from the software fault tree analysis. The output failure probability and the importance of statements are calculated from software fault tree analysis. The suggested testability measure has been applied to the two modules of the safety system in a nuclear power plant. The proposed testability measure can be used for the selection of output variables or to determine the modules that are more vulnerable to undetected faults.

A Software Fault Tree Approach to Requirements Analysis of an Intrusion Detection System

Requirements analysis for an intrusion detection system (IDS) involves deriving requirements for the IDS from analysis of the intrusion domain. When the IDS is, as here, a collection of mobile agents that detect, classify, and correlate system and network activities, the derived requirements include what activities the agent software should monitor, what intrusion characteristics the agents should correlate, where the IDS agents should be placed to feasibly detect the intrusions, and what countermeasures the software should initiate. This paper describes the use of software fault trees for requirements identification and analysis in an IDS. Intrusions are divided into seven stages (following Ruiu), and a fault subtree is developed to model each of the seven stages (reconnaissance, penetration, etc.). Two examples are provided. This approach was found to support requirements evolution (as new intrusions were identified), incremental development of the IDS, and prioritisation of countermeasures.