Architecture Modeling - SPES 2020

Architecture Modeling
sults from the FTA will then be used to show that the contracts C3 and C4 are satisfied. As a
Top-Level Event (TLE) in the FTA we will use the formalisation of the failure condition Loss of
wheel braking.
Figure 5.15: Auto generated fault-tree
The algorithms we are using to perform an FTA are based on formal verification and automatically
compute a set of all failure-combinations that are necessary to reach the TLE. As these
combinations are minimal by construction, they correspond to the minimal cut-sets that are often
used in traditional safety-analysis. The minimal cut-sets are the used as inputs to construct
a fault-tree.
When the fault-tree generation is applied to the braking system using the safety requirement
(Loss of wheel braking) and a subset of the failure-modes described above, the fault-tree shown
in Figure 5.15 is computed.
Sub-tree b) is directly related to the one depicted in the ARP 4761 (page 200), except that
we did not include failure-modes for the electrical power or the failures of the hydraulic system
(except for the pumps). The sub-tree shows that the safety requirement is violated, when all
three modes fail to operate. The reason for the failure of the normal mode is further broken
down to be caused by the failure of the green hydraulic pump or failure of the BSCU units
to command braking. Note that this also occurs, when the BSCU monitors fail to correctly
compute the reference signal, which is covered by the events 5 and 2 in the fault-tree.
86/ 156