Computer-implemented method and apparatus for resolving closed loops in automated fault tree analysis of multi-component systems
By identifying and handling closed loops in the fault tree, the problem of inaccurate analysis caused by loops in multi-component systems is solved, achieving efficient and reliable fault tree analysis and supporting automated optimization of safety-critical systems.
Patent Information
- Application Number
- CN202280011168.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Priority Date
- 2021-01-22
- Filing Date
- 2022-01-13
- Publication Date
- 2026-11-06
- Estimated Expiration
- 2042-01-13
AI Technical Summary
Existing technologies struggle to effectively handle closed loops in multi-component systems, leading to inaccurate and potentially optimistic fault tree analysis results, and making it impossible to fully automate the handling of multi-dimensional or multi-entry/exit loops.
By identifying closed loops in the fault tree, setting the loop interconnects to Boolean "true", and cutting off Boolean AND gates independent of input values, the fault tree is iteratively corrected to remove loops, and Boolean logic expressions are used for iterative processing.
It achieves high efficiency and reliability in fault tree analysis, ensuring accurate results with a linear complexity of O(n), and supports automated optimization of safety-critical systems.
Smart Images
Figure CN116802578B_ABST
Abstract
Description
[0001] This invention relates to a computer-implemented method for resolving closed loops in automated fault tree analysis of multi-component systems. The invention further relates to a device including a processor configured to perform this method. Technical Field
[0002] This invention relates to a corresponding computing unit and a corresponding computer program product. Background Technology
[0003] The importance of safety-critical systems continues to grow in many application areas of embedded systems, such as aerospace, rail, healthcare, automotive, and industrial automation. Therefore, with increasing system complexity, the need for safety assurance and its effectiveness is increasing to guarantee the high-quality requirements of these application areas. The purpose of safety assurance is to ensure that the system does not lead to dangerous situations that could harm people or damage the environment. In the application areas of safety-critical systems, safety assurance is defined by standards, such as International Electrotechnical Commission (IEC) 61508, "Functional Safety of Electrical / Electronic / Programmable Electronic Safety-related Systems", 1998.
[0004] Traditionally, safety-related system assessments have been based on bottom-up safety analysis methods, such as Failure Mode and Effects Analysis (FMEA), see IEC 60812, “Analysis Techniques for System Reliability – Procedure for Failure Mode and Effects Analysis (FMEA)”, 1991. Alternatively, system assessments based on reference implementations have been based on top-down methods, such as Fault Tree Analysis (FTA), see, for example, Vesely et al., “Fault Tree Handbook”, US Nuclear Regulatory Commission, 1981. This technique makes it possible to identify system failure states, their causes, and their impact on system safety.
[0005] System architectures typically include loops. An example of a loop is a closed-loop controller (RID). Closed-loop control refers to a process in which a physical variable (e.g., ambient temperature) is brought to a specific value while being stabilized against disturbances. Feedback obtained based on observable indications of the measured physical variable is used to set the operation of actuators affecting that physical variable. The controller is the component that acquires the actual value and derives a control signal based on the difference between the setpoint and the actual value. The controller then activates the final control element, such as a heater, to compensate for this control deviation.
[0006] Because fault propagation models typically use Boolean logic, such as to drive fault trees (FT), (closed) loops or circular closures are problematic. Since Boolean logic generally cannot contain loops, techniques exist to prevent loops in such models, such as... The technique is described in "Streamlining Architectures for Integrated Safety Analysis Using Design Structure Matrices (DSMS)" by [Authors' Name], Safety and Reliability: Methodology and Applications, 2014. This preventative technique is ineffective for applications where fault propagation models are automatically constructed, for example, when the architecture is generated. Such loops are generally not preventable because they develop merely during the process of assembling the system from existing parts and components of the fault propagation model. Therefore, a technique is needed to address loops in fault propagation models that use Boolean logic.
[0007] In Yang et al.'s "Analytic Method to Break Logical Loops Automatically in PSA," Reliability Engineering & System Safety, 56(2): 101-105, 1997, the authors used an analytical method to automatically break loops. They used a top-down expansion of the Boolean equation until they detected a loop twice through the same structural element in the address conjunction. Then, they removed the term from the equation, assuming that the larger multiplication of the basic events resulted in a smaller portion of the overall reliability. The results could become inaccurate and optimistic, and the failure rate increased with the number of loops detected.
[0008] In Cuenot et al.'s "Proposal for extension of meta-model for error failure and propagation analysis," Safe Automotive Software Architecture (SAFE), anITEA2 project, 2013, loops were removed from the fault propagation model. However, this work only addressed one-dimensional loops with only one entry and one exit point. Therefore, it is impossible to interrupt, or only possible to interrupt, arbitrary multi-dimensional loops with multiple entry and exit points leading to other loops to a limited extent.
[0009] In Vaurio et al.'s "A Recursive Method for Breaking Complex Logic Loops in Boolean System Models," Reliability Engineering & System Safety, 92(10): 1473-1475, 2007, the authors used a top-down approach to recursively expand the Boolean formula through all existing loops. They stopped the recursion after a loop that was further unrolled no longer changed the cut sets of the Boolean equation. This is assumed to be a valid criterion for terminating the algorithm, since the number of cut sets is finite. There is no evidence that the expansion will not alternate between two solutions. Moreover, the number of cut sets grows exponentially, and so does the algorithm, which should have a time complexity of O(n^2). n And growth.
[0010] Another approach can be found in Lim et al., “Systematic Treatment of Circular Logics in a Fault Tree Analysis,” Nuclear Engineering and Design, 245 (Supplement C): 172-179, 2012, where the initial conditions of the system are investigated to handle circular logic. The initial conditions of the circular logic are the points where the loop is closed. The circular logic is treated differently if the next gate has a “run failed” or “start failed” type. These conditions indicate whether the supporting system is in standby and needs to be started to perform its function, or whether the system is running but has failed to perform its operation. This knowledge is needed for all gates of the fault tree logic that closes the loop in order to use an algorithm to automatically handle the circular logic. This limits the ability to fully automate the process of removing circular logic from an automatically generated fault tree.
[0011] Given this context, there is a need for advanced technologies for analyzing safety-critical systems. In particular, there is a need for advanced technologies for identifying and resolving loops in fault trees.
[0012] Therefore, the object of the present invention is to provide a computer-implemented method for resolving closed loops in automatic fault tree analysis of multi-component systems in an efficient and reliable manner. Summary of the Invention
[0013] This problem is solved according to one aspect of the invention by a computer-implemented method for solving closed loops in automatic fault tree analysis of multi-component systems, the method comprising the following steps:
[0014] a. Model the multi-component system using a fault tree, the fault tree including elements associated with components of the multi-component system and interconnections between the elements associated with functional dependencies between the components;
[0015] b. Back-trace the fault propagation path from the output element of the fault tree via the interconnect toward one or more input elements of the fault tree;
[0016] c. For all fault propagation paths, check whether the corresponding fault propagation path contains a closed loop by identifying the downstream element of the corresponding fault propagation path—the downstream element has the dependence of its output value on the output value of the upstream element (4c) of the fault propagation path.
[0017] d. Set the input value corresponding to the loop interconnect for each of these downstream components to Boolean "true";
[0018] e. A Boolean AND gate that identifies any specific value independent of the input element and does not have a Boolean "true" as the output value;
[0019] Cut off any Boolean "true" inputs to the identified Boolean AND gates between the corresponding downstream and upstream components; and
[0020] f. Set the input value corresponding to the loop interconnect for each relevant downstream element to Boolean "false".
[0021] One idea of this invention is to provide a method for solving closed loops by following a method inspired by fixed-point iteration, i.e., by computing solutions to equations that can be written in the form x = f(x). Given such a function defined on real numbers with real values, and given a starting point x0 in the domain of f, a sequence x can be shown. n+1 =f(x) nThe expression, n = 0, 1, 2…, converges under specific conditions for the solution x of x = f(x). In the current case, taking into account basic Boolean logic, only two values are possible for the variable: Boolean "true" and "false". A fault tree, or a fault propagation path within a fault tree, can be viewed as some form of equation or system of coupled equations. This invention now considers Boolean "true" as the starting value for all fault propagation paths in which closed loops have been found, discovered by iteratively traversing the fault tree from the output to one or more inputs. Based on this, certain properties of the fault tree are evaluated, and the fault tree is modified in a specific way to remove any closed loops present in the fault tree. Subsequently, Boolean "false" is inserted as a second starting value to make the remaining fault tree analyzable.
[0022] Referring to the exemplary embodiments depicted in the accompanying drawings, the specific details of the method according to the invention will become clearer below. In short, a simple fault tree may have been solved by simply setting any loop interconnection to Boolean "true".
[0023] In the case of a tautology—which means that the output element of the fault tree gives a Boolean "true" value independent of the input element value—the loop interconnects must be set to Boolean "false" in a subsequent step, which then makes the fault tree analyzable, i.e., without any remaining loops.
[0024] However, for certain complex fault trees, problems may arise that necessitate identifying any Boolean AND gates that are independent of the specific values of the input elements and do not have a Boolean "true" output value. These inputs—that is, the Boolean "true" inputs going to any Boolean AND gate—are cut off. In the next step, any loop interconnects are set to Boolean "false," thus making any fault tree analyzable. This means that the remaining fault tree no longer contains loops and can therefore be expressed and / or extended into deterministic Boolean expressions.
[0025] The method according to the present invention yields a lower bound for fault tree analysis. This means that the result of fault tree analysis is either equal to or greater than the exact result of the fault tree.
[0026] The advantage is that defining the lower limit and the combination of the upper and lower limits makes it possible to clearly determine whether the security requirements are met in most cases.
[0027] Compared to conventional methods, the solution according to the present invention is highly efficient. The method of the present invention is particularly characterized by a linear complexity of O(n), and is therefore much faster than any method known to date. The method enables automated optimization of technical products and / or systems regarding reliability, availability, maintainability, and / or security (RAMS requirements). Furthermore, these RAMS requirements can be taken into account for optimization of further technical system properties, such as efficiency. The present invention particularly provides an advanced technique for analyzing security-critical systems.
[0028] According to another approach, the fault tree is expressed in Boolean algebra by iteratively expanding it into Boolean expressions at the element level.
[0029] According to another aspect, the closed loop of the fault tree is associated with the closed-loop control circuit of the multi-component system.
[0030] A further aspect of the invention is an apparatus comprising a processor configured to perform the methods described above. Attached Figure Description
[0031] In the following detailed description, presently preferred embodiments of the invention are further described with reference to the following figures:
[0032] Figure 1 A device having a processor that performs the method according to the invention is shown, and a lower limit for fault tree analysis is obtained.
[0033] Figure 2-4 It shows the use of Figure 1 The equipment is used to analyze the fault tree.
[0034] Figure 5 and 6 A fault tree according to an alternative embodiment is shown, and an upper limit for fault tree analysis is obtained.
[0035] Figure 7 and 8 A fault tree according to one embodiment is shown, and a lower limit for fault tree analysis is obtained.
[0036] Figure 9 and 10 A fault tree according to an alternative embodiment is shown, and an upper limit for fault tree analysis is obtained.
[0037] Figure 11 and 12 A fault tree according to one embodiment is shown, and a lower limit for fault tree analysis is obtained. Detailed Implementation
[0038] Although specific embodiments are illustrated and described herein, those skilled in the art will appreciate that various alternatives and / or equivalent implementations can be used instead of the specific embodiments shown and described without departing from the scope of the invention. Generally, this application is intended to cover any adaptations or variations of the specific embodiments discussed herein.
[0039] This paper describes a technique for reliably and computationally inexpensively detecting closed loops and / or ring closures in a fault tree (FT). To this end, multiple fault propagation paths are traced back from the output of the FT toward one or more inputs of the FT. Then, for each fault propagation path, a check can be performed to determine whether the corresponding fault propagation path forms a closed loop. If a closed loop is identified, it becomes possible to take appropriate countermeasures to mitigate the negative impact of the closed loop on the analyzability of the FT.
[0040] Generally, the techniques described herein can be applied in a wide variety of safety-critical systems of all kinds and types. For example, the techniques described herein can be applied in multi-component systems, such as control or actuator systems. Such control or actuator systems can provide control or activation functionality for certain machines. Some components of a multi-component safety-critical system can be implemented as hardware, while others can be implemented alternatively or additionally using software. It is possible that safety-critical systems employing these techniques may include providing outputs of actuation or control signals for actuating or controlling one or more machines. Specific examples of safety-critical systems that can benefit from the techniques described herein include, but are not limited to: electronic circuits including active and / or passive electronic components such as transistors, coils, capacitors, resistors, etc.; drive systems for vehicles such as trains, passenger cars, or airplanes; assembly lines including conveyors, robots, movable parts, control sections, test sections for inspecting finished products (back-end testing); medical systems such as imaging systems including magnetic resonance imaging or computed tomography, particle therapy systems; power plants; and so on.
[0041] As a general rule, different kinds and types of Fourier transforms (FTs) may be used in the various examples described herein. Example implementations of FTs that can be relied upon in the techniques described herein include component-based Fourier transforms (CFTs). For simplicity, the various examples described below are in the context of CFTs, although FTs may also be used in general.
[0042] For example, Computational Safety Factors (CFTs) are described in Kaiser et al.'s "A new component concept for FTs," Proceedings of the 8th Australian Workshop on Safety Critical Systems and Software, Volume 33, pp. 37-46, 2003. CFTs provide a model- and component-based approach to safety analysis, supporting modular and compositional safety analysis strategies. A CFT comprises multiple elements, which are associated with components of the system. A CFT also includes multiple interconnections between elements, which are associated with functional dependencies between components of the system. These functional dependencies can be modeled as force flows or input / output of control signals. A CFT can model the erroneous behavior of the system. The erroneous behavior of the system can be modeled using a hierarchical decomposition approach in a CFT. Here, the overall behavior of the system can be predicted based on the individual behaviors of components. In other words, the causal chain leading to the overall system behavior can be modeled by the causal chain of component errors. A CFT can include Boolean interconnections between adjacent elements to model the propagation of errors throughout the system. A CFT can model the system using graphs; here, nodes in the graph can correspond to elements, and edges in the graph can correspond to interconnections.
[0043] The various techniques described in this paper are based on the finding that CFTs modeling a system using Boolean logic expressions may malfunction if they include closed loops and / or toroidal closures. Closed loops are generally likely to exist if the input values of the CFT elements are derived from the output of an associated Boolean logic expression that includes those input values.
[0044] Figure 1 A device 10 with a processor 6 is shown, which executes a method M according to the invention for solving closed loops in automatic fault tree analysis of a multi-component system (not depicted). The multi-component system may be, for example, a safety-critical system, which may include a closed-loop control circuit of a closed-loop controller (PID). The PID may, for example, be configured to control the components of the multi-component system on a closed-loop control basis. The PID may, for example, control physical variables such as temperature, pressure, force, etc.
[0045] A specific example will be referenced for fault tree 1. Figures 2 to 4Let's explain method M in detail. Fault tree 1 models a multi-component system and includes multiple elements 4 associated with components of the multi-component system and interconnections 2 between said elements 4 associated with functional dependencies between said components. Therefore, method M includes: under M1, modeling the multi-component system using fault tree 1. Fault tree 1 includes one output element 4a and four input elements 4b. Each element 4 (labeled X...) i (where i = 1...9) is associated with any one of gate 3 or event 5. In this particular example, there are three Boolean OR gates 3b and two Boolean AND gates 3a. Furthermore, there are distinct basic events b1, b2, g1, g2. (As in...) Figure 2 As can be seen, both gates X5 and X6 have inputs originating from gates upstream in the fault tree, namely X3 and X2, respectively. Therefore, these two gates X5 and X6 cause a loop within fault tree 1, which makes automatic analysis of fault tree 1 problematic because, due to this loop, no meaningful Boolean expression can be easily assigned to fault tree 1.
[0046] Method M further includes: under M2, tracing back the fault propagation path 11 from the output element 4a of fault tree 1 via interconnect 2 towards the input element 4b of fault tree 1. This tracing back... Figure 3 The diagram shows that fault tree 1 is essentially decomposed into two fault propagation paths 11, each characterized by a closed loop 7. In other words, fault tree 1 is "unfolded". In the following text, the interconnections from each loop 7 to the corresponding fault propagation path 11 are labeled ψ. i .therefore, Figure 3 The fault propagation path 11 on the left side has a closed loop 7, which connects an input of component X6 to the output of component X2 at loop interconnect ψ1. Correspondingly, Figure 3 The fault propagation path 11 on the right side has a closed loop 7, which connects an input of element X5 to the output of element X3 at loop interconnect ψ2.
[0047] By examining all fault propagation paths 11 to determine whether each fault propagation path 11 contains a downstream element 4d whose output value depends on the output value of the upstream element 4c of that fault propagation path 11, a gate causing a loop can be identified in a general manner. Therefore, method M includes, in M3, examining all fault propagation paths 11 to determine whether each fault propagation path 11 contains a closed loop 7 by identifying the downstream element 4d of that fault propagation path 11—which has an output value dependent on the output value of the upstream element 4c of that fault propagation path 11.
[0048] Next, method M removes the two closed loops 7 in fault tree 1. To this end, method M includes: under M4, disconnecting the loop interconnects ψ of each such downstream element 4d. i The input value is set to Boolean "true". In other words, the problematic element that appears (turns up) in the corresponding Boolean expression is determined by the expression ψ. i Replaced. Further, the method includes: under M5, identifying any specific value independent of the input element 4b by a Boolean AND gate 3a without having a Boolean "true" as the output. Reference Figure 4 As can be seen, two AND gates 4da that satisfy these criteria can be found, and therefore, two Boolean AND gates 4da are identified.
[0049] Method M further includes: under M5, cutting off any remaining Boolean "true" inputs to the identified Boolean AND gate 3a between the corresponding downstream element 4d and upstream element 4c. For example... Figure 4 As can be seen, for both X6 and X5, a corresponding input is cut off, namely the loop interconnects ψ1 and ψ2 (in Figure 4 The interconnect 8 is marked as being cut off. Finally, method M includes: under M6, disconnecting the loop interconnect ψ of each corresponding downstream element 4d. i The input value is set to Boolean "false". In this particular example, the loop interconnect ψ i It is cut off regardless, therefore the method steps have no result (however, see...). Figures 5 to 8 (Example in the text). Figure 4 As can be seen, closed loop 7 has been removed; that is, it has been cut off from fault propagation path 11. Only the explicitly defined Boolean gate 3 and basic event b... i g i It remains in fault tree 1. Therefore, Figure 2 Fault tree 1 can now be evaluated, that is, it can be iteratively expanded at element 4 into a deterministic Boolean expression that travels from output element 4a through interconnect 2 toward input element 4b, or vice versa. Therefore, fault tree 1 can be expressed as:
[0050] (b1∨(g1∧(g2∨b2)))∨(b2∨(g2∧(b1∨g1)))
[0051] The method according to the present invention can be summarized in pseudocode as follows:
[0052] 1. Identify all loops within the fault tree (using depth-first search or depth-first search).
[0053] 2. Break each loop by removing the connection between the gate causing the loop and its predecessor, and add a replacement basic event X. Set X = true.
[0054] 3. For all loops:
[0055] For each AND gate in the loop, check if the AND gate equals true (tautology).
[0056] i. If the AND gate equals true, then do nothing.
[0057] ii. If the AND gate is not true, remove all connections to its children that are true.
[0058] iii. Set all alternative basic events to false.
[0059] This method can be used to determine the lower limit for fault tree analysis.
[0060] Therefore, method step M5 can be modified as follows:
[0061] - The step of checking any Boolean AND gate 3a that has a Boolean "true" output value independent of the specific value of input element 4b is unnecessary.
[0062] - Replace any Boolean AND gate 3a of M5 that has a Boolean "true" output value, independent of the specific value of input element 4b, with a Boolean OR gate 3b between the corresponding downstream element 4d and the corresponding upstream element 4c.
[0063] This alternative approach yields an upper limit for the steps used in fault tree analysis, as explained in detail in document EP 579 074 A1.
[0064] Upper and lower limits—correspondingly, two boundaries—can be used to judge the results of fault tree analysis.
[0065] This can lead to the following exemplary use cases:
[0066] 1. According to Figure 6 and 8 The upper and lower bounds used for fault tree analysis are equal and are denoted as minimal cut sets = A vB1 v B2 v C. Thus, a cut set is a unique combination of component failures that may cause system failure. Specifically, a cut set is called a minimal cut set if, when any basic event is removed from it, the remaining events collectively no longer form a cut set. Therefore, in this case, according to... Figure 5 and 7The loop interruption step resulted in the same and accurate result. This result can be compared with the tolerance risk rate (THR) to determine whether the requirement has been met.
[0067] 2. The upper and lower bounds used for fault tree analysis are different. In other words, in this case, according to... Figure 9 and 11 The interruption of the loop leads to different results or boundaries, denoted by different minimal cut sets. These minimal cut sets are respectively located in... Figure 10 and 12 As shown in the image.
[0068] In this case, different sub-cases are possible.
[0069] a. If the upper limit is lower than THR, the requirement is met.
[0070] b. If the lower limit is below THR, the requirement is not met.
[0071] c. The THR (Threat Rate) lies between the lower and upper limits. This means that whether the requirement is met is uncertain. Therefore, the fault tree can be post-processed. For example, if a loop can be removed by modifying the fault tree through rework, the fault tree can be reviewed and / or inspected by experts or automatically. Loop removal can be performed manually or automatically. Afterward, fault tree analysis must be performed again, and the lower and upper limits must be compared with the THR.
Claims
1. A computer-implemented method (M) for resolving closed loops (7) in automatic fault tree analysis of a multi-component system, the method (M) comprising the following steps: The multi-component system is modeled (M1) using a fault tree (1), which includes elements (4) associated with components of the multi-component system and interconnections (2) between the elements (4) associated with functional dependencies between the components. The fault propagation path (11) is traced back (M2) from the output element (4a) of the fault tree (1) via the interconnect (2) toward one or more input elements (4b) of the fault tree (1). For all fault propagation paths (11), check (M3) whether the corresponding fault propagation path (11) contains a closed loop (7) by identifying the downstream element (4d) of the corresponding fault propagation path (11) - the output value of the downstream element (4d) has a dependency on the output value of the upstream element (4c) of the fault propagation path (11). Each of these downstream elements (4d) corresponds to a loop interconnect (ψ). i The input value (M4) is set to Boolean "true"; Identify (M5) any specific value independent of the input element (4b) without having a Boolean AND gate (3a) with Boolean "true" as the output value; Disconnect any Boolean "true" input of any identified Boolean AND gate (3a) between the corresponding downstream element (4d) and the corresponding upstream element (4c) of (M5); as well as The corresponding loop interconnect (ψ) of each downstream element (4d) i The input value setting (M6) is set to Boolean "false" to determine the lower limit used for automatic fault tree analysis.
2. The method (M) according to claim 1, wherein the fault tree (1) is expressed in Boolean algebra by iteratively expanding the fault tree (1) into a Boolean expression at the element (4).
3. The method (M) according to claim 1 or 2, wherein the closed loop (7) of the fault tree (1) is associated with the closed-loop control circuit of the multi-component system.
4. An apparatus (10) comprising a processor (6) configured to perform the method (M) according to any one of claims 1 to 3.
Citation Information
Patent Citations
Baking oven with a cooling air fan and / or with a hot-air fan
EP0579074A1
Computer-implemented method and device for resolving closed loops in automatic fault tree analysis of a multi-component system
CN112204485A