Reliability in Design FMEA Derived from UMLSys ML

Reliability in Design: FMEA Derived from UML/Sys. ML models P. David, V. Idasiak & F. Kratz PRISME Institute Team-project MCDS Wednesday, 24 September 2008

Outline 1. 2. 3. 4. 2 5. 6. 7. Background UML and Sys. ML for reliability analysis Method for reliability study in design process Automatic synthesis of FMEA 1. Previous works on FMEA synthesis 2. Crucial points for FMEA automatic synthesis 3. Exploiting UML/Sys. ML Sequence diagrams Case study Next step with Sys. ML Conclusion

Background • Difficult to conduct Reliability studies during design: ü Time consuming process ü Complex formal methods ü Communication difficulties ü Mastering the complexity of multi-technological systems 3 • Unifying the processes around one modelling language

Background • Improving reliability study during Design: ü Creating tools and methods to support safety-critical system design: • Integrating formal methods to the design process (GSPN, Markov Process) • Developing tools and methods to efficiently conduct widespread industrial practices (FMEA, Requirements allocation) 4 • ü Proposing algorithms and analysis to be integrated in commercial tools (UML, Sys. ML tools). Guiding the design towards reliable solutions: ü Insuring the traceability of Requirements (performance, reliability, safety)

Using UML and Sys. ML • • • 5 • Object-oriented languages: ü Complex and multi technologic Systems ü Hierarchical, modular and incremental approach Graphical and accessible languages Modelling constructs for Architecture and Behaviour ü Functional behaviour and architecture analysis ü Dysfunctional behaviour modelling Various works on merging UML with formal methods (Markov Process, GSPN, Fault Trees)

Method for reliability study Functional Hazard Analysis FHA Preliminary Hazard Identification PHI Automatic FMEA synthesis Full FMEA Formal languages Functional Model 6 GSPN, Markov Process, Alta. Rica, Figaro Architecture Failure mode repository Behaviour

Automatic synthesis of FMEA • 7 • Importance of FMEA process: ü Performed at an early stage ü Systematic identification of risks ü Classify the risks ü Underline weak points of the system Weak points of FMEA ü Time consuming ü Error prone analysis ü Huge amount of information to produce ü Ambiguity of the quoted values

• Previous works on FMEA synthesis Numerous existing works: ü Organisational practises (Bassetto 2005) ü Mastering simultaneous failures (Price and Taylor 2002) ü Computing the effects at overall system scale (Price and Taylor 2002), (Papadopoulos et al. 2004 b) 8 • ü Enhancing classification and promoting the use of natural vocabulary (Bowles and Pelaez 1995) Weak points of previous works: ü Domain specific approach (electronic) ü No help for FMEA initialisation (component identification) ü No real use of lesson learnt databases ü Computation of failure effects only from a dysfunctional model

Crucial points for FMEA automatic synthesis • Essential points for automatic FMEA synthesis: üThe exploited model: 9 • Hierarchy between blocks • Architecture of the system and its functionalities • Data and flow transmissions üA Dysfunctional Behaviour Database • Contains lesson learnt on components failures • References Failure modes name • References Failure modes behaviour

Automatic synthesis of FMEA • Our ambitions: 10 üStudying functional models at early stages of design process üInsuring exhaustiveness of component identification üUse and construction of a lesson learnt database üIdentifying the primary Failure Modes

Sequence Diagram exploitation component. A : A component. B : B message: Message. Type m 2: m 2 type 11 Sequence Diagram (SD) FMEA Table Dysfunctional behaviour database Class. A Failure. Mode : Failure. Mode [ *] Class. B Failure. Mode : Failure. Mode [ *]

Case Study: Level Control System (LCS) 12

LCS Sequence Diagram 13

Preliminary FMEA report Component Failure Mode Possible Causes Possible Effects S 1 Internal Cause Internal Effect No detection From S 1 by Activation On Ev 1 by Command. Ev On S 1 by Activation False Detection Internal Cause Internal Effect From S 1 by Activation On Ev 1 by Command. Ev On S 1 by Activation 14 • • This table is a good help to build the final FMEA. Relation to consider are indicated. Known Failure Mode are already mentioned. The heavy phase of FMEA is automatically performed (Component census, Search in database).

Next step with Sys. ML 15 15 Component Identification Control signals Flow transmission Requirements Traceability Failure Mode Repository

LCS in Sys. ML 16

New preliminary FMEA report Component Failure Mode Possible Causes Possible Effects S 1 No detection Internal Cause Internal Effect From S 1 by Activation On Ev 1 by Command. Ev From Ps through Pop. S-Pi. S 1 [Power. Input] On S 1 by Activation On Ev 1 through Ci. S 1 -Ci. Ev 1 [Command. Interface] 17 False Detection Internal Cause Internal Effect From S 1 by Activation On Ev 1 by Command. Ev From Ps through Pop. S-Pi. S 1 [Power. Input] On S 1 by Activation On Ev 1 through Ci. S 1 -Ci. Ev 1 [Command. Interface]

Conclusion • • • 18 • • A precious part of FMEA is automatically built. The preliminary report is a great guideline for analysts. It helps saving a lot of time while respecting the exhaustivity of the study. Sys. ML shows huge possibilities to enhance this first solution. Effective solution to start the deployment of the presented method.

Acknowledgements 19 We specially want to thank all our partners involved in the CAPTHOM project. This work was realized with the financial help of the French Industry Ministry and local collectivities, within the framework of the CAPTHOM project of the Competitiveness Pole S 2 E 2, www. s 2 e 2. fr.