Hazard-based Selection of Test Cases Functional Safety of - PowerPoint PPT Presentation

Hazard-based Selection of Test Cases Functional Safety of Mechatronic Systems Mario Gleirscher Software & Systems Engineering Institut f¨ ur Informatik Technische Universit¨ at M¨ unchen May 24, 2011

Motivation Functional Safety Hazards Conclusion Safety Case 1 : Assurance of an Airbag Control Machine I : An airbag system . . . 1 Cf. Safety case management [Kel98] 2 Cf. [Wik11] 2/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Safety Case 1 : Assurance of an Airbag Control Machine I : An airbag system . . . Safety Case G : Does the airbag release iff it’s intended? 1 Cf. Safety case management [Kel98] 2 Cf. [Wik11] 2/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Safety Case 1 : Assurance of an Airbag Control “. . . functional safety methods have to extend to non-E/E/PS parts of the system . . . ” 2 Machine I : An airbag system . . . “. . . functional safety can[not] Context E : . . . in a car operated be determined without consid- ering the environment . . . ” 2 out in a street by a human driver. 1 Cf. Safety case management [Kel98] 2 Cf. [Wik11] 2/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion 1 Functional Safety System Modelling Property Analysis and Specification 2 Hazards Property Analysis and Specification Test Case Selection 3 Conclusion 3/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion 1 Functional Safety System Modelling Property Analysis and Specification 2 Hazards Property Analysis and Specification Test Case Selection 3 Conclusion 4/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion A System Model M W of the Airbag World W Functional 1 model M W : E I E Safety Analyst M I describing the mechatronic system I and M E describing its operational environment E . 1 Cf. [Bro10]. 5/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion A System Model M W of the Airbag World W A system boundary allows interaction across shared phenomena 1 : M E M I M E ◮ M I � repaired(Airbag), refilled(Gas), signal(activate,Airbag), on(crashSensor), . . . M E ◭ M I � released(Airbag), . . . where A ◮ B = ctrV ar ( A ) ∩ monV ar ( B ) . 1 Cf. [Jac01, PM95] 5/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion A System Model M W of the Airbag World W Supportive phenomena for safety modelling and measurement: M E M I M E \ M I � crashed(Car), shocked(Car), deformed(Car), pro- tected(Person), driving(Car), irritated(Passenger), . . . M I \ M E � empty(Airbag), . . . 5/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion A System Model M W of the Airbag World W Interface behaviour � histories of shared phenomena states: M E M I Intervals . . . n . . . . . . n + j . . . m − → shocked(Car) F T T F F F F . . . deformed(Car) 0 2 10 10 10 10 10 . . . crashed(Car) F F F T T T T . . . signal(crash) F F F T T T T . . . released(Airbag) F F F F T T T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion M W as a Test Model M E M I off off maintain enter leave boot maintain Independent con- trol states, transi- driving activate release activated maintain tions with action preconditions and collide release effects 1 . crashed release released Where to get the information? System use cases → M I , M E Domain and context analysis → M E 1 Details in Golog script, cf. [Rei01]. 6/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion M W as a Test Model M E M I off off maintain enter leave boot maintain Independent con- trol states, transi- driving activate release activated maintain tions with action preconditions and collide release effects 1 . crashed release released Problem: Which of M W ’s possible or mutated transitions may obstruct safety in M E ? 1 Details in Golog script, cf. [Rei01]. 6/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Functional Safety in M W M E M I Functional Behavioral property to globally maintain (or avoid) safety goal 3 in E , formally: � φ � protected ( Body ) G � G ′ � � [ crashed ( Car ) → � < 400 ms absorbed ( Body ) ∧ � ¬ crashed ( Car ) → � ¬ released ( Airbag )] 3 Cf. [MP95]. 7/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Functional Safety in M W M E M I A/G safety G split into Assumptions for E and Guarantees for I , formally: � i As i → Gr i | = G specification As 1 � � [ crashed ( Car ) ↔ • signal ( crash )] . . . “reliable crash sensing expected from E ” Gr 1 � � [ signal ( crash ) ↔ � < 200 ms released ( Airbag )] . . . “reliable bag disengaging required from I ” 7/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion 1 Functional Safety System Modelling Property Analysis and Specification 2 Hazards Property Analysis and Specification Test Case Selection 3 Conclusion 8/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Obstacles 2 to Functional Safety in M W What obstructs a functional safety goal G in W ? M E M I H Hazard H Risk of human or environmental harm in E H 1 � G ′ � � [ crashed ( Car ) ∧ • harmed ( Person )] � � [ � ¬ crashed ( Car ) ∧ • harmed ( Person )] H 2 � G ′ 2 Automated inference possible, e.g. [Let01]. 9/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Obstacles 2 to Functional Safety in M W How can such obstructions happen in W ? M E M I H Hazardous state σ State of M E (or M E ∩ M I ) leading to H � signal ( crash ) → ¬ released ( Airbag ) σ H 1 G � ¬ signal ( crash ) → released ( Airbag ) σ H 2 G � crashed ( Car ) → ¬ signal ( crash ) σ H 3 A � ¬ crashed ( Car ) → signal ( crash ) σ H 4 A 2 Automated inference possible, e.g. [Let01]. 9/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Obstacles 2 to Functional Safety in M W How can such obstructions be generated from M W ? M E M I H Hazardous state σ State of M E (or M E ∩ M I ) leading to H � signal ( crash ) → ¬ released ( Airbag ) σ H 1 G � ¬ signal ( crash ) → released ( Airbag ) σ H 2 G � crashed ( Car ) → ¬ signal ( crash ) σ H 3 A � ¬ crashed ( Car ) → signal ( crash ) σ H 4 A 2 Automated inference possible, e.g. [Let01]. 9/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Defects concerning Functional Safety Causes of (hazardous) system failures: M W (as specified) M E M I a W (as built & run) b E I a) Potential bug c M W (as intended) or runtime error . Assurance by M E M I system testing too weak and (Im)mature Specs Realization incomplete. 10/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Defects concerning Functional Safety Causes of (hazardous) system failures: M W (as specified) M E M I a b) Requirements W (as built & run) error , e.g. wrong b assumption or E I guarantee; wrong, c M W (as intended) incomplete or missing transition. M E M I Assurance by requirements (Im)mature Specs Realization validation. 10/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Defects concerning Functional Safety Causes of (hazardous) system failures: M W (as specified) M E M I a W (as built & run) b c) Bug or E I runtime error . c M W (as intended) Assurance by automated system M E M I testing strengthened by (Im)mature Specs Realization validation. 10/20 Hazard-based Selection of Test Cases Mario Gleirscher

Motivation Functional Safety Hazards Conclusion Assure Functional Safety G of a Machine I in a Context E Constructive Safety Assurance (Requirements Engineer) 1 Safety risks: Does the airbag’s behaviour cause hazards? 2 Hazardous exceptions: Is it completely specified? 3 Automation: How to systematically explore such situations? 4 How can they be avoided or kept at minimum risk? Analytic Safety Assurance (Test Engineer) 1 Selection: How to test beyond the airbag’s specification? 2 Coverage: Have all relevant situations be explored, i.e. does an airbag’s realization exhibit hazardous behaviour? 3 How to mutate M W to get interesting test cases? 4 How to automatically generate and execute them? 11/20 Hazard-based Selection of Test Cases Mario Gleirscher