https://www.mdu.se/

Safety requirements describe risk mitigations against failures that may cause catastrophic consequences on human life, environment and facilities. To be able to implement the correct risk mitigations, it is fundamental that safety requirements are de- fined based on the results issued from the safety analysis. In this paper, we introduce a heuristic approach to elicit safety requirements based on the knowledge about hazard’s causes, hazard’s sources and hazard’s consequences (i.e. hazard’s components) acquired during the safety analysis. The proposed approach is based on a Hazard Ontology that is used to structure the knowledge about the hazards identified during the safety analysis in order to make it available and accessible for requirements elicitation. We describe how this information can be used to elicit safety requirements, and provide a guidance to derive the safety requirements which are appropriate to deal with the hazards they mitigate.

The schedulability analysis for fixed-priority pre-emptive scheduling (FPPS) plays a significant role in the real-time systems domain. The so-called Hyperplanes Exact Test (HET) is an example of an exact schedulability test for FPPS. In this paper, we aim at improving the efficiency of HET by combining it with initial values for exact response time analysis (RTA). We call the resulting improved test HETI and show by means of simulations that HETI is more efficient than HET.

With the growing complexity of embedded real-time systems, requirements validation becomes an ever-more critical activity for developing such systems. Studies have revealed that most of the anomalies, discovered in the development of complex systems, belong to requirement and specification phases. To ease the situation, many efforts have been investigated into the area. Model-based techniques, enabling formal semantics and requirements traceability, are emerging as promising solutions to cost-effective requirements validation. In these techniques, the functional behaviors derived from lower-level requirements are specified in terms of analyzable models at a certain level of abstraction. Further, upper-level requirements are formalized into verifiable queries and/or formulas. Meanwhile, trace links between requirements at various levels of abstraction as well as between requirements and subsequent artifacts (such as verifiable queries and/or formulas, and analyzable models) are built, through which the queries and/or formulas can be fed into the corresponding models. However, such model-based techniques suffer from some limitations, such as how to support semi- or fully-automatic trace links creation between diverse development artifacts, how to ease the demand of heavy mathematics background knowledge to specify queries and/or formulas, and how to analyze models without encountering the state explosion problem. 

In this thesis, we cover two aspects centering around requirements validation to ease the aforementioned limitations, which are mainly about requirements traceability and model-based requirements validation. In particular, the technical contributions are four-fold: 1) we have introduced an improved VSM-based requirements traceability creation/recovery approach using a novel context analysis and, 2) we have proposed a lightweight model-based approach to requirements validation by using the Timed Abstract State Machine (TASM) language with newly defined Observer and Event constructs and, 3) we have combined our model-based approach with a restricted use case modeling approach for feature-oriented requirements validation and, 4) we have improved the Observer construct of TASM via proposing a new observer specification logic to facilitate the observer specification, as well as defining the corresponding observer execution process. Finally, we have demonstrated the applicability of our contributions in real world usage through various applications.

Safety-critical systems (SCSs) have become an intrinsic part of human dailylife in multiple domains, such as automotive, avionics, and rail industries. Such systems are not only required to implement the functionality they should provide, but also have to satisfy a set of safety requirements in order to ensure the mitigation of hazardous consequences.

It is fundamental that safety requirements are defined based on the results issued from safety analysis. Various studies have asserted that most significant flaws in the safety requirements are related to the omission of hazards and causes associated with the identified hazards in early stages of SCSs development. The main drawbacks of the current practice applied in safety analysis,lie in that:

• due to the lack of a common understanding of the hazard concept, the hazards and their causes are typically identified in accordance to the intuition and experience of the analysts and,

• analysts are inclined to identify generic causes for a certain hazard description, for example, “Design flaw, Coding error, and Human error”and,

• there is an essential need to formalize the experience of the analysts in a structured way, in order to save effort and,

• since traditional safety analysis techniques are usually based on well known system behaviors represented by models, such as automata and sequence diagrams, a new approach is needed when such behavioral models are not available.

These considerations motivate us to formulate the following general research question: How can safety analysis, within the context of safety-critical systems, be conducted to reduce the omission of potential hazards and their causes in early stages of the system development life-cycle?

In this thesis, we propose an ontological approach to safety analysis for safety-critical systems, which mainly consists of four pieces of work:

• we propose an ontological interpretation of the hazard concept, calledthe Hazard Ontology (HO), to define an explicit representation of theknowledge of hazards and their relations with the system under analysisand existing environment and,

• we propose an approach to identify hazards in early stages of thesafety-critical systems development, based on the HO and,

• we propose an approach to identify the causes associated with a certain hazard description for safety-critical systems, based on the HO and,

• we propose a heuristic approach to safety requirements elicitation,based on the HO.

It is well recognized that most of the anomalies, discovered in the development of embedded real-time systems, belong to requirement and specification phases. To ease the situation, many efforts have been investigated into the area. For requirements development, especially requirements validation and verification, model-driven architecture techniques can be considered as a cost-efficient solution. In order to utilize such advantages, the design of the proposed system is often specified in terms of analyzable models at the certain level of abstraction. Further, different levels of requirements are translated into verifiable queries and fed into the models to be either validated or verified. For requirements management, requirements traceability provides critical support for performing change impact analysis, risk analysis, regression testing, etc. In this thesis, we cover several topics about requirements validation, requirements verification, and requirements traceability. In particular, the technical contributions are three-fold: 1) we propose an approach to requirements validation by using the extended Timed Abstract State Machine (TASM) language with newly defined TASM constructs and, 2) we present a simulation-based method which is powered up by statistical techniques to conduct requirements verification, working with industrial applications and, 3) we introduce an improved VSM-based requirements traceability recovery approach using a novel context analysis. Further, we have demonstrated the applicability of our contributions in real world usage through various case studies.

Adequately mixing of reactants is an important factor for efficient deNOx process in power station NOx emission control system. In this study, an experimental validated CFD simulation is conducted to investigate the effect of spray operation conditions on the mixing uniformity of reactant ammonia vapor in deNOx process occurring in a power station's furnace. According to the CFD simulation results, it is found that spray momentum ratio, initial droplet size and initial ammonia concentration all affect the mixing uniformity of ammonia vapor. Overall, a larger spray momentum ratio, larger initial droplet size and lower ammonia concentration contributes positively to the mixing uniformity. By comparing the same spray momentum ratio but different nozzle inlet velocity and furnace inlet velocity, it is found that the impact of spray momentum ratio mainly comes from furnace inlet velocity not nozzle inlet velocity. In addition, gravity should not be neglected. In the end, the method described in this study could provide a systematic way to study the effects of nozzle operation conditions on deNOx process.

Preliminary hazard analysis (PHA) is a key safety-concerned activity, applied during the early stages of safety-critical systems development process, aiming to provide stakeholders with a general understanding of potential hazards. The identified hazards will be described and serve as a basis to further identify mitigation mechanisms in the subsequent development process. However, since various stakeholders will be involved in the identification process, a common understanding of the nature of hazards among stakeholders, such as what a hazard consists of and how to describe it without ambiguities, is of crucial importance to achieve the goal of PHA. In this work, we propose a hazard modeling language (HML) based on a hazard domain ontology, i.e., the Hazard Ontology, in order to facilitate the specification of identified hazards. In addition, we present an approach to the transformation from natural language hazard descriptions into the HML specification. Finally, an industrial PHA example is used to illustrate the usefulness of our work.

The environment, where a safety critical system (SCS) operates, is an important source from which safety requirements of the SCS can originate. By treating the system under construction as a black box, the environment is typically documented as a number of assumptions, based on which a set of environmental safety requirements will be elicited. However, it is not a trivial task in practice to capture the environmental assumptions to elicit safety requirements. The lack of certain assumptions or too strict assumptions will either result in incomplete environmental safety requirements or waste many efforts on eliciting incorrect requirements. Moreover, the variety of operating environment for an SCS will further complicate the task, since the captured assumptions are at risk of invalidity, and consequently the elicited requirements need to be revisited to ensure safety has not been compromised by the change. This short paper presents an on-going work aiming to 1) systematically organize the knowledge of system operating environment and, 2) facilitate the elicitation of environmental safety requirements. We propose an ontological approach to achieve the objectives. In particular, we utilize conceptual ontologies to organize the environment knowledge in terms of relevant environment concepts, relations among them and axioms. Environmental assumptions are captured by instantiating the environment ontology. An ontological reasoning mechanism is also provided to support elicitation of safety requirements from the captured assumptions.

Hazard identification is an essential but very de- manding task for the development of safety-critical systems (SCSs). Current practices suffer from one or several drawbacks listed below: 1) a common hazard conceptualization is missing and thereby ambiguities may arise and, 2) there is still a need to formalize the experience of analysts and lessons learned from previous system development in a structured way to facilitate future reuse. and, 3) some hazard identification techniques require well-known system behaviors represented by models, such as automata and sequence diagrams, to identify hazards, and however such models are typically susceptible to changes or even not available in early stages. In this paper, we propose an ontological approach to support hazard identification in the early stages of the development of SCSs. The approach aims to improve hazard identification results in terms of completeness and unambiguity. A robotic strolling assistant system is used to evaluate the proposed approach.

Preliminary hazard analysis (PHA) is a key safety-concerned technique, applied in early stages of safety critical systems development, aiming to provide stakeholders with a general understanding of potential hazards together with their causes. Various studies have asserted that most significant flaws in hazard analysis techniques are related to the omission of causes associated with the identified hazards. In addition, identified causes are sometimes described in too generic terms to provide useful guidance for subsequent activities. In this paper, we propose an approach to explore and identify the causes associated with the hazards from a PHA, aiming to improve the results of hazard causes identification in terms of completeness and usefulness. To achieve the goal, the proposed approach utilizes the hazard-related concepts and relations defined in a hazard domain ontology presented in our previous work. Furthermore, an application scenario of a train control system is used to evaluate our approach.

The hazard concept has been extensively used in the literature and defined in an informal way, which serves as a guidance on identifying the potential hazards during the development of safety-critical systems. Intuitively, the definitions seem to be consistent and easy to understand. However, when we take a closer look at these definitions, ambiguities may arise, and real-world semantics need to be defined. In this work, we propose a hazard domain ontology, i.e., the Hazard Ontology (HO), to provide an ontological interpretation of hazard. To tackle the aforementioned issues, the HO is grounded in the Unified Foundational Ontology (UFO) to utilize the benefits provided by taking foundational concepts into account. Finally, we show some useful findings when we use the proposed ontology to analyze the hazard descriptions from an industrial passenger train project.

The Architecture Analysis and Design Language (AADL) has been widely accepted to support the development process of Distributed Real-time and Embedded (DRE) systems and ease the tension of analyzing the systems’ non-functional properties. The AADL standard prescribes the dispatching and scheduling semantics for the thread components in the system using natural language. The lack of formal semantics limits the possibility to perform formal verification of AADL specifications. The main contribution of this paper is a mapping from a substantial asynchronous subset of AADL into the TASM language, allowing us to perform resource consumption and schedulability analysis of AADL models. A small case study is presented as a validation of the usefulness of this work.

Post-requirements traceability is the ability to relate requirements (e.g., use cases) forward to corresponding design documents, source code and test cases by establishing trace links. This ability is becoming ever more crucial within embedded systems development, as a critical activity of testing, verification, validation and certification. However, semi-automatically or fullyautomatically generating accurate trace links remains an open research challenge, especially for legacy systems. Vector Space Model (VSM), a notably known Information Retrieval (IR) technique aims to remedy this situation. However, VSMÂ’s lowaccuracy level in practice is a limitation. The contribution of this paper is an improved VSM-based post-requirements traceability recovery approach using a novel context analysis. Specifically, the analysis method can better utilize context information extracted from use cases to discover relevant source code files. Our approach is evaluated by using three different embedded applications in the domains of industrial automation, automotive and mobile. The evaluation shows that our new approach can achieve better accuracy than VSM, in terms of higher values of three main IR metrics, i.e., recall, precision, and mean average precision, when it handles embedded software applications.

Requirements validation is an essential activity to carry out in the system development life cycle, and it confirms the completeness and consistency of requirements through various levels. Model-based formal methods can provide a cost-effective solution to requirements validation in a wide range of domains such as safety-critical applications. In this paper, we extend a formal language Timed Abstract State Machine (TASM) with two newly defined constructs Event and Observer, and propose a novel requirements validation approach based on the extended TASM. Specifically, our approach can: 1) model both functional and non-functional (e.g. timing and resource consumption) requirements of the system at different levels and, 2) perform requirements validation by utilizing our developed toolset and a model checker. Finally, we demonstrate the applicability of our approach in real world usage through an industrial case study of a Brake-by-Wire system.

Automatically generating traceability links between software development artifacts existing throughout systems development life cycle, is becoming ever more important for requirements traceability. It remains an open software engineering challenge, especially for legacy systems, when the demand for minimizing human intervention is considered. The Vector Space Model (VSM), a notably known information retrieval technique, attempts to remedy the situation by reducing the required manual effort. One limitation of VSM is its low-level performance in practice, which can be improved by involving human intervention in the requirements traceability process earlier. The contribution of this paper is to present an improved VSM-based post/requirements traceability recovery approach by using a novel context analysis. This is done by firstly removing redundant information in the search space of the artifacts wrt a requirement, and then using both requirement and context queries to refine the results given by the standard VSM. In this way, the subsequent artifacts from the source requirement are more likely to be retrieved in the recovery process. Our approach is evaluated by using two chosen datasets (i.e., eTour and iTrust), of which results show that the proposed approach can achieve better performance in terms of discovering more true trace links and obtaining higher quality lists of traceability links than the standard VSM.

Model-based requirements validation is an increasingly attractive approach to discovering hidden flaws in requirements in the early phases of systems development life cycle. The application of using traditional methods such as model checking for the validation purpose is limited by the growing complexity of embedded real-time systems (ERTS). The observer-based technique is a lightweight validation technique, which has shown its potential as a means of validating the correctness of model behaviors. In this paper, the novelty of our contributions is three-fold: 1) we formally define the observer constructs for our formal specification language namely the Timed Abstract State Machine (TASM) language and, 2) we propose the Events Monitoring Logic (EvML) to facilitate the observer specification and, 3) we show how to execute observers to validate the requirements describing the functional behaviors and non-functional properties (such as timing) of ERTS. We also illustrate the applicability of the extended TASM language through an industrial application of a Vehicle Locking-Unlocking system.

In the modern automotive industry, feature models have been widely used as a domain-specific requirements model, which can capture commonality and variability of a software product line through a set of features. Product variants can thus be configured by selecting different sets of features from the feature model. For feature-oriented requirements validation, the variability of feature sets often makes the hidden flaws such as behavioral inconsistencies of features, hardly to avoid. In this paper, we present an approach to feature-oriented requirements validation for automotive systems w.r.t both functional behaviors and non-functional properties. Our approach first starts with the behavioral specification of features and the associated requirements by following a restricted use case modeling approach, and then formalizes such specifications by using a formal yet literate language for analysis. We demonstrate the applicability of our approach through an industrial application of a Vehicle Locking-Unlocking system