Dependability and error modelling in EAST-ADL Sample Clauses

Dependability and error modelling in EAST-ADL. As part of its support for dependability engineering, EAST-ADL allows the modelling of system error behaviours for safety analysis (e.g. FTA) and allows safety constraints to reference the faults/failures under consideration. Figure 13 shows the related key language concepts, which are explained below. An ErrorModel is a constrained model providing the analytical information about the error logic of a target component/system, i.e., which faults may occur and how they propagate. Associations to the nominal architecture identify the target components/systems and the modelling contexts. While the fault ports (FaultInPort) declare which incoming faults the target can receive from its environment, the failure ports (FailureOutPort) declare which local failures may occur and propagate to the environment. A PropagationLink connects an output port with an input port for error propagation across different target components/systems. Such analytical ports and links can have references to the corresponding nominal ports and connectors (e.g. the data flow ports and connectors) when a fine-grained traceability is needed. An InternalFault represents an internal condition of the target component/system, which can cause errors when become activated. A ProcessFault refers to a systematic fault introduced due to design or implementation flaws (e.g. incorrect requirements or buffer size configuration). Because any of the output failures of an error model may be caused by process flaws, a process fault affects all failures that the component may exhibit. By means of the FaultFailure construct, the actual value of an anomaly can be declared (i.e. one of the possible values of an incoming fault, an internal fault, a process fault, or an outgoing failure) based on an enumeration type, such as {omission, commission} or {brake-loss, brake-fade, brake- too-much}. Within an error model, the syntax and/or semantics of existing external formalisms can be adopted for a precise description of the FailureLogic, capturing which output failures are caused by which input and internal faults within the target component/system. This, together with the error propagation links, makes it possible to perform safety analyses and derive the related safety constraints. A safety constraint defines the qualitative bounds on the fault and failure values in terms of the safety integrity level (ASIL) for avoiding its occurrence (as defined in ISO 26262). For an incoming fault or an internal fault, a safet...