See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/262198322

Automatic Fault Tree Generation from SysML System Models

Conference Paper · July 2014

DOI: 10.1109/AIM.2014.6878163

CITATIONS READS

65 3,648

3 authors:

Faïda Mhenni Nga Nguyen

Supméca - Institut supérieur de mécanique de Paris Leonardo da Vinci Engineering School
69 PUBLICATIONS 577 CITATIONS 54 PUBLICATIONS 489 CITATIONS

SEE PROFILE SEE PROFILE

Jean-Yves Choley
ISAE-Supméca - Institut supérieur de mécanique de Paris
184 PUBLICATIONS 1,182 CITATIONS

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Topological modeling of mechatronic system View project

PhD works View project

All content following this page was uploaded by Faïda Mhenni on 02 October 2014.

The user has requested enhancement of the downloaded file.

 Automatic Fault Tree Generation From SysML System Models
Faida Mhenni1 and Nga Nguyen 2
and Jean-Yves Choley1

Abstract— Safety critical systems must satisfy in- at providing estimations about probabilities, rates and
creasingly rigorous safety requirements with shor- severity of consequences. To perform safety analyses, the
tening time to market. In order to validate these two most traditionally used fault modeling techniques are
requirements, different safety analysis techniques can
be carried out. However, traditionally, these safety Failure Modes and Effects Analysis (FMEA)and Fault
analyses are performed manually with separate tools. Tree Analysis (FTA) [1], [2]. Other techniques such as
Consequently, they are time consuming and error FFA, HAZOP, etc. are also used [3].
prone and are not automatically updated when the The safety analyses mentioned above are usually per-
system models are. formed manually and separately with independent tools,
In this paper, a methodology is proposed to in-
tegrate safety analysis within a systems engineering based on informal design documents [4]. Consequently,
approach. This methodology is based on SysML mo- they occur late in the design process when the design
dels and aims at generating (semi-) automatically is already finalized and thus, miss the opportunity to
safety analysis artifacts, mainly FMEA and FTA, influence design choices and decisions. Furthermore, va-
from system models. Preliminary functional and com- rious safety studies are performed with different tools and
ponent FMEA are automatically generated from the
functional and structural models respectively, then at different stages of the design process and the consis-
completed by safety experts. By representing SysML tency between these studies is not ensured [3]. Safety
structural diagram as a directed multi-graph, through analysis results may also be inconsistent with the system
a graph traversal algorithm and some identified pat- models since there is usually a gap between the design
terns, generic fault trees are automatically generated process and safety analyses that are not automatically
with corresponding logic gates and events.
The proposed methodology provides the safety ex- updated according to design changes.
pert with assistance during safety analysis. It helps re- Model-Based Systems Engineering (MBSE) approach
ducing time and error proneness of the safety analysis is required to manage the complexity, enhance consis-
process. It also helps ensuring consistency since the tency and allow modeling and simulation of the whole
safety analysis artifacts are automatically generated system. In this approach, SysML [5], [6], an OMG stan-
from the latest system model version. The metho-
dology is applied to a real case study, the electro- dard is becoming more and more supported by industry
mechanical actuator EMA. because it provides a consistent, well-defined, and well-
understood language to communicate the requirements
I. INTRODUCTION and corresponding designs among engineers. That ’s why
Today’s technical systems are integrating more func- SysML is choosen as the support modeling language in
tionalities to offer more assistance and comfort to users. our work.
As a result, engineers are facing challenges to successfully Joining the safety analysis together with the design
design systems with high complexity while industrial process through SysML models will enhance consistency
competitiveness requires them to shorten time to market in the whole system, enable earlier error detection, avoid
and reduce costs. The increasing complexity of manu- expensive redesign and reduce time to market delays.
factured systems makes their development more difficult Some works about the integration of safety analysis in
since huge efforts are required to manage the complexity, the early design stage, based on the functional models
maintain consistency through the development, and deal have been carried out both in industrial and academic
with numerous requirements relevant to multiple do- domains [7], [8], [9], [10].
mains. The aim of this paper is to propose a new metho-
Technical systems may potentially be harmful to hu- dology that integrates systems engineering with safety
mans or facilities. Several safety analysis techniques have assessment. It allows the automatic generation of safety
been developed in order to assess the potential risks of analysis artifacts, namely FMEA and FTA. FMEAs are
industrial systems. These techniques can be split into generated firstly, in the functional then the structural
two categories : qualitative and quantitative approaches. design phases. Fault trees are generated next based on
Qualitative methods try to find the causal dependen- the structural model and the component FMEA results.
cies between a hazard on system level and failures of Block patterns and graph traversal algorithms are used
individual components, while quantitative methods aim to generate automatically fault trees, based on the to-
1 ISMEP, Saint-Ouen, France, [email protected], pology of the system. Then specific fault trees regarding
[email protected] to specific undesired top events are derived from auto-
2 EISTI, Cergy, France, [email protected] generated one.
 This paper is organized as follows. In section II, a brief In [15], fault trees are constructed from MATLAB
overview of the related work is given. Then the integrated Simulink models. The nominal model is built in Simulink
methodology is presented in section III. A focus is given and then is manually extended with failure behavioral
in section III-B to the automatic fault tree generation information of the system. Based on this extended model
which is the main contribution of this paper. A case study and the classification of components, fault tree for a
is given in section IV. Finally, the paper is concluded in specific top event is automatically constructed.
section V. An automatic generation of fault trees from AADL
(Architecture Analysis and Design Language) models is
II. State of the Art
proposed in [4]. In this work, the system architectural
A. Integration of Safety Analysis and SysML model is built with the AADL language and then is
The integration of safety analysis and MBSE has been annotated with fault and failure information using the
carried out in different researches [9], [7], [11], [12]. Error Annex, a sub-language of AADL. Based on the
Dubois [9] proposed to directly include safety requi- annotated model, fault trees are automatically generated
rements in the design process with SysML. For this in a commercial tool : CAFTA. However, as far as we
purpose, a SysML profile respecting safety standards know, there is no related work concerning the fault tree
called RPM (Requirement Profile for MeMVaTEX) was generation from SysML models as in our study.
developed. The requirement stereotype of SysML is
III. Integrated SE/SA methodology
replaced by the MeMVaTEX requirement, by adding
various properties such as verifiable, verification type, The proposed methodology aims at integrating safety
derived from, satisfied by, refined by, traced to, etc. In analysis within the systems engineering approach. It
this work, only the integration of safety requirements is consists in performing the appropriate safety analysis at
considered and these requirements are traced to the other the appropriate design stage based on the available sys-
elements of the model but safety analyses techniques are tem models. It allows starting safety analysis very early
performed separately. in the design process, since only an abstract functional
P. David attempted to integrate reliability analysis in representation of the system is available. It is then kept
the design process based on an MBSE approach with updated as long as the design evolves. A safety profile
SysML [7], [13]. In this work, a preliminary FMEA with different safety stereotypes is associated to SysML
report is generated by extracting the needed information models in order to store these updates in the database.
on the dysfunctional behavior from functional SysML Consistency is maintained throughout the whole process.
models. Dysfunctional models are then constructed using Two well known safety techniques, FMEA and FTA,
the AltaRica language in order to compute reliability are used in this methodology. The FMEA generation
indicators. Then the final FMEA report is obtained with will be described in section III-A. Then the fault tree
help from experts in the safety domain. To facilitate generation is detailed in section III-B.
such a deductive and iterative method, a database of
A. Overview of the integrated methodology -FMEA gene-
dysfunctional behaviors is kept updated in order to
ration
rapidly identify failure modes in different analysis phases.
R. Guillerm in [11] and [14] proposes a method for In the scope of this paper, only the requirements defini-
safety management in complex systems engineering. The tion and analysis as well as architectural design processes
proposed method is based on the elicitation and declina- of the systems engineering approach are relevant to our
tion of safety requirements. It combines three of the well work. The requirement definition and analysis process
knows safety analysis techniques, FMECA, fault trees aims at providing a comprehensive and consistent set
and event trees to define all safety requirements at the of requirements that will be the basis for the following
system level and then, based on the system decomposi- design steps. In the second phase, system functions are
tion, declines these requirements at the component level. identified from functional requirements and one or more
The information model that supports this approach is functional architectures are defined and compared. In
built in SysML. SysML, functions are represented by activity elements.
Each activity can be detailed in an activity diagram to
B. Automatic Fault Tree Generation show how its input flows are transformed into output
Fault trees are widely used for safety assessment and flows through sub-functions. This results in a hierarchical
reliability of systems for over 40 years [15]. Manual breakdown of the system functions with different levels
construction of fault trees is time consuming and error of abstraction. At this level, safety analysis can already
prone, especially for complex systems. To cope with this start. A preliminary functional FMEA is automatically
complexity, automatic generation of fault tree has been generated from the SysML functional models and then
subject of many research works. The main difference completed by the safety expert. Derived safety requi-
concerns the type of the starting model based on which rements are integrated in the SysML model and, if
the generation is performed. In the following, a brief necessary, a new design iteration is performed in order to
overview of some recent works is given. take into account the resulting changes. For each design
iteration, the safety analysis is also updated according to port, or when the node has been already visited.
the updated system model. Then components are alloca- To facilitate the fault tree generation, we also use
ted to functions to define the physical structure of the the ”divide and conquer” principle by identifying some
system. In the same way, several physical structures are interesting patterns in an IBD. They are entry, exit and
considered and compared according to different criteria feedback patterns. Another kind of pattern, named re-
like performance, cost and safety among others. For each dundant pattern, related to safety design criteria where a
physical structure, two complementary safety analysis ar- part block can have input ports coming from components
tifacts (FMEA, FTA) are automatically generated from assuring redundancy for higher reliability is also studied.
SysML models. First a preliminary component FMEA Each pattern gives rise to a sub-fault tree and the whole
is automatically generated then completed by safety fault tree will be assembled automatically by using the
expert. To maintain consistency with the functional mentioned graph traversal algorithm.
FMEA, the component FMEA contains the functions The following subsections describe the recognized pat-
allocated to each component and their respective failure terns as well as their generated fault trees. In order to
modes. These are translated into the corresponding com- gain space, all the patterns are grouped in an illustrating
ponent failure modes by the safety expert. The derived IBD in Fig. 1 and the comments written in a note show
safety requirements from this step are also integrated us the corresponding pattern.
and accounted for in the system models. The design and
safety analysis are iterated as long as necessary. The
final step is the generation of the fault trees to assess
the fault propagation inside the system and check if
the system satisfies the safety requirements, notably the
failure rates.

B. Automatic Fault Tree Generation from SysML IBD

In this section, we will describe our method to generate
fault trees automatically from structural diagrams, i.e
SysML Internal Block Diagrams (IBD). IBD gives the
internal structure of the system and the interactions
among components. The interfaces through which the
components interact are represented via standard and
flow ports and the interactions are represented via paths
between the corresponding ports called ”connectors”. If
a failure occurs in one component, it will be propagated
throughout the system via these paths. The idea of this
work is to automatically generate fault trees based on
the system IBD, using two concepts : directed graph tra-
versal and block design patterns. Each concept is detailed
hereafter.
An IBD can be represented as a directed graph G = Fig. 1. IBD Block Design Patterns
(V, E) where V is the set of vertices that composes of
parts and some special ports called external interfaces, 1) Entry pattern: An entry part in an IBD is a block
and E is the set of directed edges. The external interfaces part that has at least one input port receiving item
are ports that are situated on the border of the IBD, flow from outside the actual system/subsystem. In the
which can be input or output port. In order to simplify generated sub fault tree (Fig. 2), this special input port
the graph, we do not need to represent internal ports be- will be transformed into a basic event representing a
cause they can be abstracted by edges directly connecting failure or error of a system component that is outside
parts. It is also noted that the graph G accepts multi- the actual block. We will have an OR logic gate whose
edges that symbolize different kinds of items flowing operands are : the basic event representing the external
between the two parts. So to build a fault tree for a failure, the internal failure of the part and all other
given undesired top event, a graph traversal algorithm eventual input ports.
can be used to find out components relating to each 2) Exit pattern: An exit part in an IBD is a block part
other by using the directed edges. It follows the principle that has at least one output port sending item flow out of
of backtracking from the hazard to the leaf events. The the actual system/subsystem. In the corresponding fault
traversal starts at an external output port, traces back to tree (Fig. 3), this special output port gives rise to a top
nodes that are his predecessors and continue to visit the event undesired state of the actual block. We will have
other nodes. Since a node can have several predecessors, an OR gate whose operands are : the internal failure of
a branch is finished when we reach an external input the exit part and all other eventual intermediate events
 Fig. 2. Fault Tree for Entry Pattern in Fig. 1
Fig. 5. Fault Tree for Redundant Pattern in Fig. 1

that characterize failures coming from other input ports.

When the whole fault tree is generated automatically
from an IBD by using the identified patterns and a graph
traversal algorithm, we will have a generic fault tree for
the corresponding system. In order to have a specific
fault tree for an undesired top event failure, information
from previous FMEA analysis can be used to refine this
generic fault tree. Knowledge of safety experts is also
very important in order to detail some branches with
different failure modes or to cut out some unreachable
Fig. 3. Fault Tree for Exit Pattern in Fig. 1 branches, regarding the undesired top event failure. This
proposal will be explained via the case study given in
3) Feedback pattern: By traversing the directed graph Section IV.
representing an IBD, if we encounter a node that has
IV. Case study
already been visited, we say that we have a loop or a
feedback in the current graph. In Fig. 1, when generating The case study considered in this paper is an electro-
the logic diagram for the output port o4-2 of the part mechanical actuator (EMA) used to actuate ailerons.
B4, we need to take into account the input port i4 which The use of EMAs in flight control is increasing since they
comes from the output port o3 of the part B3. In its have many advantages [16] :
turn, the logic diagram of o3 must consider errors that – Better environmental respect with suppression of
may come from i3-2, propagated from B4. A cut can be hydraulic power and oil leak risks ;
realized here in order to not take into consideration the – Weight saving on aircraft ;
input ports such as i4 as an operand of the OR gate. The – Maintenance cost reduction ;
corresponding fault tree of the feedback pattern of Fig. – Performance increase and speed accuracy due to
1 is illustrated in Fig. 4. electric actuators.
Functional breakdown as well as the functional FMEA
of the EMA are already presented in [12]. A logical archi-
tecture was also proposed in [12] and an improved version
is given in Fig. 6. The three parts constituting the EMA
are named respectively Geared Motor with Encoder
for the electric motor, Mechanical Transmission for
the mechanical transmission and Embedded MCU
with Power Bridge for the electronic and the code that
control the system.

A. Introduction
Fig. 4. Fault Tree for Feedback Pattern in Fig. 1 A preliminary FMEA is automatically generated from
the IBD in Fig. 6 containing the list of components. To
4) Redundant pattern: When a part in an IBD receives ensure the consistency of the component FMEA with
item flows coming from redundant blocks that carry respect to the functional FMEA, the functions allocated
out the same system function, we say that we have a to each component and their failure modes are also
redundant pattern (B2, B11 and B12 in Fig. 1). In this added in the preliminary component FMEA. The safety
case, an AND gate is used for different faults coming expert then associates the functional failure modes into
from different inputs to model the fact that if there is no the corresponding component failure to obtain the final
internal failure in the component B2, the component will FMEA. Table I shows an extract of the final component
not work only if all the redundant item flows fail. The FMEA for the EMA containing the failure modes leading
fault tree for our example of redundant pattern is given to the “Aileron locked” undesired event, which will be
in Fig. 5. used for the fault tree generation.
 TABLE I
Extract of the component FMEA of the EMA

Component Function Failure Mode ... Local Effects System Effects

Embedded Adapt Supply Electronic hard- ... Motor stops or Motor ro- Alileron locked or Aileron
MCU with Energy ware defect tates continuously continuously moving
Power Bridge
Translate Pilot Software error ... Aileron locked
Instructions
Hardware defect ... Aileron locked
Synchronization ... Aileron locked
error
Memory defect ... Aileron locked
or loss
Geared Motor Adapt Mechani- Jam ... Locked output Aileron locked
with Encoder cal Energy
Transform Jam ... Aileron locked
Energy
Loss of structu- ... Aileron locked or Free move-
ral integrity ment of the aileron
Short-circuit ... Aileron locked
between two
windings
Measure Hardware defect ... Erroneous current measure Aileron locked
Current
Mechanical Transmit Jam ... Motor overloaded and out- Aileron locked
Transmission Energy put locked

Fig. 7. EMA Generic Fault Tree

Fig. 6. IBD : EMA architecture

each specific undesired top event, we can extract from the

B. Fault Tree Generation FMEA results the corresponding failure modes of each
Based on the system model given in Fig. 6, a generic component that lead to the top event in question. The
fault tree for a top event at a specific output of the system specific fault tree for the “Aileron locked” top event is
is automatically generated. This fault tree is built from given in Fig.8. In this fault tree, a branch is eliminated
partial fault trees generated according to the patterns because no failure mode of the Geared Motor with
and the graph traversal algorithm given in section III-B. Encoder leads to the “Aileron locked” event. Internal
The generic fault tree for the “Mechanical Power” output failure of some components such as Geared Motor
is given in Fig. 7. with Encoder and Embedded MCU with Power
Several undesired events can occur at each output. For Bridge is completed by their specific failure modes.
 [8] R. Laleau, F. Semmak, A. Matoussi, D. Petit, A. Hammad,
and B. Tatibouet, “A first attempt to combine SysML require-
ments diagrams and B,” Innovations in Systems and Software
Engineering, vol. 6, pp. 47–54, 2010.
[9] H. Dubois, “Gestion des exigences de sûreté de fonctionnement
dans une approche IDM,” in Journées Neptune Nř5, Paris,
France, 08 avril 2008.
[10] F. Thomas and F. Belmonte, “Performing safety analyses and
SysML designs conjointly : a viewpoint matter,” in Complex
Systems Design & Management, 2011.
[11] R. Guillerm, H. Demmou, and N. Sadou, “Global safety mana-
gement method in complex system engineering,” in Complex
Systems Design and Management Proceedings of the Fourth
Inernational Conference on Complex Systems Design and
Fig. 8. EMA Specific Fault Tree for “Aileron locked” top event Management, CSDM 2013, 2013.
[12] F. Mhenni, J.-Y. Choley, A. Rivière, N. Nguyen, and H. Ka-
dima, “SysML and safety analysis for mechatronic systems,”
in Mechatronics (MECATRONICS), 2012 9th France-Japan
V. CONCLUSIONS & 7th Europe-Asia Congress on and Research and Educa-
tion in Mechatronics (REM), 2012 13th Int’l Workshop on
In this article, a methodology to integrate safety Research and Education in Mechatronics, IEEE MECATRO-
NICS REM, Paris, 2012, iSBN 978-1-4673-4772-3.
analysis within a SysML-based systems engineering ap-
[13] P. David, “Contribution à l’analyse de sûreté de fonctionne-
proach is presented. This methodology concerns some ment des systèmes complexes en phase de conception : appli-
well known safety analysis artifacts, i.e. FMEA and FTA. cation à l’évaluation des missions d’un réseau de capteurs de
The automatic generation of these artifacts will help présence humaine,” Ph.D. dissertation, Université d’Orléans,
Novembre 2009.
reducing time and errors. Consistency between safety [14] R. Guillerm, “Intégration de la sûreté de fonctionnement
analyses and design is maintained throughout this inte- dans les processus de l’ingénierie système,” Ph.D. dissertation,
grated process since FMEAs and fault trees are directly Université de Toulouse, 2011.
generated from the latest system model versions. Cohe- [15] F. Tajarrod and G. Latif-Shabgahi, “A novel methodology
for synthesis of fault trees from MATLAB-Simulink model,”
rence between different safety analyses is also maintained World Academy of Science, Engineering and Technology,
since each step is based on the previous analysis results. vol. 17, no. 5, pp. 1256–1262, 2008.
Our FMEA generation has already been implemented [16] D. Mami, “Définition, Conception et Expérimentation de
structures d’actionneurs électromécaniques innovants incluant
by using a program written in Python language. This par conception des fonctionnalités de sûreté et de sécurité de
program parses an XMI file representing the SysML fonctionnement,” Ph.D. dissertation, Université de Toulouse,
models and generates an Excel file corresponding to Institut National de Politechnique de Toulouse, 2010.
the functional or the component FMEA worksheet. This
Excel file can be then completed by safety analysists, and
parsed again by another Python script in order to insert
new information into the safety stereotypes intergrated
in the XMI file, via the safety profile extension. The next
step of our work is to carry out the automatic fault tree
generation by extending the existing software framework.

References
[1] C. A. Ericson, Hazard Analysis Techniques for System Safety.
John Wiley & sons, 2005.
[2] N. Xiao, H.-Z. Huang, Y. L. L. He, and T. Jin, “Multiple
failure modes analysis and weighted risk priority number
evaluation in FMEA,” Engineering Failure Analysis, vol. 18,
pp. 1162–1170, 2011.
[3] Y. Papadopoulos, J. A. McDermid, R. Sasse, and G. Heiner,
“Analysis and synthesis of the behaviour of complex program-
mable electronix systems in conditions of failure,” Reliability
Engineering & System Safety, vol. 71, pp. 229–247, 2001.
[4] A. Joshi, P. Binns, and S. Vestal, “Automatic generation
of static fault trees from AADL models,” in Proceedings
of the IEEE/IFIP Conference on Dependable Systems and
NetworksŠ Workshop on Dependable Systems, DSN07-WADS,
Edinburgh, Scotland-UK, June, 2007.
[5] (2013) www.omgsysml.org.
[6] OMG Systems Modeling Language (OMG SysML), OMG Std.,
June 2012.
[7] P. David, V. Idasiak, and F. Kratz, “Reliability study of com-
plex physical systems using SysML,” Reliability Engineering
and System Safety, vol. 95, no. 4, pp. 431 – 450, 2010.

View publication stats