Architecture Modeling - SPES 2020

Architecture Modeling
The consideration of monitoring failures is also the reason for the generated fault-tree to be
more comprehensive than the one depicted in the ARP, where the occurrence of monitoring
failures seems not to be considered. Sub-tree a) of Figure 5.15 is one of the additional sub-tree
stemming from this fact. The first remarkable observation of this sub-tree is the circumstance
that it only features failures occurring inside the BSCU, i. e. the TLE is reachable without any
failure of the alternate and emergency mode. This is due to the fact that the failure of the monitoring
unit inside the BSCU can inhibit its shutoff, thus preventing the system from changing
to alternate mode.
Results Satisfaction of contract C3 can easily be derived from the list of minimal cut-sets and
it is also shown in the fault-tree. At least two independent failures are required, therefore the
model satisfies C3.
For contract C4 some additional steps are required which we will only briefly sketch here.
First it is necessary to determine the probability for the occurrence of the basic failures. Typically
these are listed on data sheets provided by suppliers of the relevant sub-systems or they
can be derived from empirical data gained from in-service records of similar systems. Once
these values are assembled the probability for the TLE can be computed using the instructions
given in the fault-tree handbook [47].
5.1.3.5 Checking Real-Time Contracts using Scheduling Analysis
In this section, we will show an example of how to check real-time contracts using the OFFIStool
for Scheduling analysis named Orca. For this purpose, we introduce a fourth level of
abstraction: the Unit Level. On this level, there only exist the logical and the technical perspectives
refining the models of the previous abstraction level.
Figure 5.16: Logical Perspective – Unit Level
87/ 156