The development of safety-critical systems requires the dasiasafepsila development of a dasiasafepsila system. Not only should the realized system fulfill specific safety goals, but for certification purposes the development process itself has to comply with safety standards. Both of these tasks are complex and cause a lot of effort and costs that cannot be sufficiently reduced by existing safety engineering methods. To facilitate these tasks, we developed the SICMA method. SICMA guides the engineer in following safety standards in the development of a system, in developing a system design that fulfills its safety goals and in documenting that the developed system is sufficiently safe. SICMA introduces Safety Concept Trees (SCTs) as a backbone to achieve vertical and horizontal traceability between all safety information, as needed for certification purposes. SCTs represent and fully preserve the component-oriented perspective assumed by state-of-the-art development methods, facilitating the handling and maintenance of complex systems. Using SCTs, a system design and its artifacts can be rigorously analyzed on every refinement level and it can be shown that they adhere to safety and certification criteria. This will lead to significantly reduced effort and costs in the standard-compliant development of safety-critical systems.
In this thesis, an approach is presented that turns the currently unstructured process of automotive hazard analysis and risk assessments (HRA), which relies on creativity techniques, into a structured, model-based approach that makes the HRA results less dependent on experts' experience, more consistent, and gives them higher quality. The challenge can be subdivided into two steps. The first step is to improve the HRA as it is performed in current practice. The second step is to go beyond the current practice and consider not only single service failures as relevant hazards, but also multiple service failures. For the first step, the most important aspect is to formalize the operational situation of the system and to determine its likelihood. Current approaches use natural-language textual descriptions, which makes it hard to ensure consistency and increase efficiency through reuse. Furthermore, due to ambiguity in natural language, it is difficult to ensure consistent likelihood estimates for situations.
The main aspect of the second step is that considering multiple service failures as hazards implies that one needs to analyze an exponential number of hazards. Due to the fact that hazard assessments are currently done purely manually, considering multiple service failures is not possible. The only way to approach this challenge is to formalize the HRA and make extensive use of automation support.
In SAHARA we handle these challenges by first introducing a model-based representation of an HRA with GOBI. Based on this, we formalized the representation of operational situations and their likelihood assessment in OASIS and HEAT, respectively. We show that more consistent situation assessments are possible and that situations (including their likelihood) can be efficiently reused. The second aspect, coping with multiple service failures, is addressed in ARID. We show that using our tool-supported HRA approach, 100% coverage of all possible hazards (including multiple service failures) can be achieved by relying on very limited manual effort. We furthermore show that not considering multiple service failures results in insufficient safety goals.
Numerous techniques for modeling reliability aspects are applicable in research and industry. However, reliability models are often specialized artifacts; they are created once by specialists and then tend to remain unmaintained, yielding outdated and inaccurate models after short periods of time. This degradation of reliability models can be prevented by integrating them with design models, which improves their visibility to developers and keeps them consistent with other artifacts. Our UML-based approach presented in this paper supports this by enabling integrated modeling of reliability aspects and other, e.g. functional and physical aspects of systems under development. This is achieved by extending the UML through profiles that support the modeling of reliability aspects. We present a notation for the modeling of functions and function networks in combination with Dynamic Reliability Block Diagrams (DRBDs). DRBDs extend standard reliability block diagrams with the possibility of modeling dynamic behaviors and dependencies. Integration of these aspects into a model-driven approach improves model traceability and consistency, and enables integrated reliability modeling.