# Presentation: 237427

##   Software Fault Tree AnalysisDolores R. Wallace SRS Information ServicesSoftware Assurance Technology Centerhttp://satc.gsfc.nasa.gov/dwallac@pop300.gsfc.nasa.gov  Dr. Massood TownidnejadEmbry-Riddle Universitytowhid@erau.edu

* *

**   **

**NASA OSMA SAS '02**

## The Premise 

- FTA applies to software (SFTA)1
- SFTA uses same tools as FTA
- SFTA can apply FTA algorithms computing risk based on probability
*1  Several researchers have explored SFTA to some extent, e.g., Leveson, Lutz, Dugan, Heimdahl  *

**Notes:**
Measurement uses (as one of several  data points):
When to release system
Test Scheduling
Quality measurement
Ability to estimate latent faults

Who uses this:
Managers
Developers
IV&Vers
QEs

## Tasks 

- Understand the methodology, including symbology
- Develop tool evaluation criteria
- Identify commercial tools
- Get demonstration copies
- Apply tools to software

**Notes:**
Measurement uses (as one of several  data points):
When to release system
Test Scheduling
Quality measurement
Ability to estimate latent faults

Who uses this:
Managers
Developers
IV&Vers
QEs

## FTA Methodology

- Hierarchical, graphical representation of events
- Notation to represent Boolean expression  recording relationships between states/ events
- Qualitative: ID of design weaknesses,e.g., single point of failure and safety critical failure combinations
- Quantitative: event’s probability of occurrence to identify paths most likely to occur
- Starting point (top of tree):  system failure or hazard
- Backward progression id’ing parallel and sequence combinations of events causing top event to occur

## Probability Issue

- Hardware
- Large collections of historic data
- Classification of failure types
- Degradation
- Software
- Limited availability of software failure data
- Classification of cause more relevant
- Degradation not same for software
- Probability values not available, though subject of research efforts

## FTA Symbology

- BASIC

- CONDITIONING

- UNDEVELOPED

- EXTERNAL

- INTERMEDIATE

**EVENTS**

**GATES**

**TRANSFERS**

- OUT

- IN

- AND

- OR

- EXCLUSIVE OR

- PRIORITY AND

- INHIBIT

## Tool Evaluation Criteria Categories

- User Interface
- Functionality
- Output
- SFTA Model
- Security
- Operational Issues
- Adaptability ***
- Cost of Tool (consider functionality not usable by SFTA)
- Return on Investment

## Commercial Tools

- Approximately 33
- Most embody two or more analyses (e.g., FMEA)
- All compute risk with algorithms applying values of  probability of failure
- Many claim adaptability for SFTA
- Two claimed specific use for SFTA, but ...
* **Lack of specific SFTA tools caused our redirection!*

## New Focus: Life Cycle Approach

- Requirements
- Identify weaknesses and modify, eliminate them
- Identify those with direct impact on safety of system
- Design
- Apply to design, smaller than related code
- Identify components/modules, subcomponents with direct impact on safety of system
- Code
- Apply only to those subcomponents already identified as having direct impact on safety of system

##  Application of SFTA to Software Design

- The Challenge
- Focus SFTA on OODs
- Develop a relationship between OOD charts and diagrams to symbology of FTA
- Initial Issues
- Attempt to fit activity diagram to general template
- Recognize loops as a feature of activity diagram
- Allow for concurrency found in many real-time systems
- Applied commercial tool- identified probable cause of failure successfully in each case
- Next Steps
- Generate fault trees directly from several activity diagrams

##  Activity Diagram

- Drink not available

- Drink available

##  Software Fault Tree  

## Resulting Fault Tree  Analysis

## FUTURE

- Identify the general features of activity, state, and sequence diagrams as related to FTA symbology
- Apply this approach to real, larger designs
- Have commercial tool vendor work with us to build the interface between these OOD types and the FTA symbology
*Hoped for result: practical means of applying FTA to software across the life cycle!*

**Notes:**
Make sure I mention that after all this, we would like to do a comparison study, or shadow project, to measure how well SFTA ranks against other known methods