# Improved Safety Analysis Integration in a Systems Engineering Approach
## 5 Improved System Behavior Based on DFT Recommendation
### Step 3: Automatic Generation of DFT from SysML Diagrams and Redundancy Profile
#### 5.1.4 Description of the DFT Generation Method  
In this part, the description of the generation of DFT from system model enriched with redundancy information is given. After updating the architecture of the system by analyzing FMEA information, the specification of the system behavior became a necessity. Considering that the solution adopted in this work is the redundancy, the generated DFT will consider, especially, the behavior of the redundant components. The method that describes this step is given. The input of this step is the internal structure of the system that provides the system components and the interaction between each other. This information will be provided by the IBD. An IBD is composed of three different parts which are the external ports, the internal ports, and the components of the system part. The external ports represent the external interfaces of the system with its environment. The internal ports are ports through which the system components interact with each other. Also, the external inputs and outputs are distinguished depending on the port direction. In this method, the IBD is viewed as an oriented graph with a set of vertices and a set of edges. The set of vertices is composed of the system components and the external ports, which are situated on the border of the system. The second input of this step is the information about redundancy that is provided by the redundancy profile and modeled using the BDD. Another input of the method is the external output of the system that represents the top level event of the DFT. The output of the algorithm is the DFT. When the system contains more than one output, a DFT will be generated for each output. This method begins with an in-depth first search in the IBD in order to detect all the components and all the external inputs of the system that have an impact on the output. After that, the failure will be propagated through the system via the internal ports of the components. In a second phase, all of the obtained information will be classified into three sets. The first set is the External Input (EI), which contains all external inputs of the system that are connected with \"o\". The second set is the Non Redundant Component (NRC), which includes all non redundant components of the system that lead to the top level event. The third set is the Redundant Component (RC), which includes groups of redundant components; a group of redundant components is formed of redundant components and switches components which are related to each other to perform the same function. The failure of a non redundant component or an external input port leads to the failure in the top level event and it is represented in the DFT by a leaf event. Thus, a subtree is generated for each element in NRC and EI. A subtree is also generated for each redundancy group in RC. As a result, information like RedundancyType (standby, active, or mixed), RedComponentType (primary, secondary), and SparingType (cold, warm, hot) is needed. When the redundancy type is active and at least \"K\" out of \"N\" components are needed to ensure the functioning of the system, the logical gate \"Voting (K/N)\" is used. In this case, the system fails if more than \"K\" components fail. If the redundancy type is standby, two possible cases are previewed: First, if the switch between redundant components does not need a switch component, the logical gate \"SPARE\" is used (it returns true only if all components fail). To specify the rank of redundant component (primary, secondary), the RedComponentType is requested. Second, if the switch between redundant components is done by a switch component, the logical gate \"PAND\" and \"SPARE\" are used. Then, a subtree is generatedas shown in Figure 4. This subtree returns true if all redundant components fail or if the switch component fails before the primary component. If the redundancy type is mixed, then the RedComponentType is requested to specify the rank of the different components.