4th Int. Workshop on Formal Techniques for Safety-Critical Systems (FTSCS),
Januar 2016 · Paris, France · DOI: 10.1007/978-3-319-29510-7_8
Fault-tolerant systems have to react on errors resulting from faults properly to avoid error propagation and finally a harmful failure of the entire system. Beside the detection of failing system elements, also the actions to handle failures are essential to cover the safety requirements. Actions reach from enabling fail-silent, fail-safe or fail-operational behavior of system elements, or also hybrids of this in a mixed-critical system design. Graceful degradation may be applied when system resources become insufficient, reducing the set of provided functional features. In this paper we address mixed critical systems, which partially comprise fail-operational functional features. We consider degradations of functional features in failure scenarios. We describe a formal model that contains i.a. the features of a system, possible feature degradations, the software components that realize these features, as well as the deployment of these components to execution units. We calculate valid deployments of software components to execution units and analyze them according to the level of graceful degradation on feature level and system level, as a consequence of failures of execution units or software components. We show an example from the automotive domain to illustrate our approach.
Stichworte: Graceful-degradation, Fault-tolerance Redundancy, Fail-operational, Mixed-critical, Diversity, Deployment, Dependability, Model-based Systems Engineering, MbSE