User Manual

Content

User Manual

With recent changes in ESF, it is no longer recommended to create a new ESF project and then import an existing model. Instead, the safety analysis should be done within the existing model to assure that analysis and architecture remain synchronized.

A safety analysis can be started from an existing model by switching to a safety modelling view-point. There are two options: in case of standard UML, you need to switch to the Safety modeling context, as shown on the left in the following figure. This context contains a safety viewpoint in addition to the standard UML one. Some Papyrus customizations, such as Papyrus for Robotics, define a safety viewpoint within the domain specific modeling context, as shown on the right of the figure below. In this case, you only need to activate the viewpoint without switching the context (while you can deactivate other viewpoints, as shown in the figure, there is no need to do that, you can keep several viewpoints active).

Switch architecture context    Keep robotics context

The safety tool offers four different activities

  1. Modeling of safety requirements
  2. Execute an analysis at component (i.e. local) level
  3. Execute an analysis at system level
  4. Execute a failure mode and effect analysis (FMEA)
  5. Execute a fault-tree analysis (FTA), not yet implementation
The safety tooling has a context menu that can be opened with a right-click either on diagram elements or on the model explorer. The following figure shows the contents of this menu:
Safety analysis context mnenu
We will now sketch these activities, more information is available in the specific subsections.

Modeling of safety requirements

Safety requirements are a specialization of standard requirements. The system modeling language (SysML) offers the ability to create requirements, either in specific diagrams or preferably in form of requirement tables. The context menu offers the following options

Safety requirements context mnenu

The first action is typically to create a new safety requirements table. The command can be executed in the context of package. This step will first make sure that the required profiles (SafetyRequirements and SysML) will be applied to the user model. It then creates the model.

Once the table is created, it is possible to add new safety requirements to the table or tag existing SysML requirements as safety requirements

Component fault analysis

The different options of the component fault analysis menu are shown in the following figure.

component analysis context mnenu

The first action is to start a new component analysis for an existing class or component. For convenience, it is also possible to execute this class on a package. In this case, a dialog pops up and shows available classes within that package.

Start analysis on package menu
Once a class has been selected, a new diagram (component analysis diagram) is created. It automatically shows the ports of your components. Ports have an additional direction information that is mandatory for certain safety analyses. This information is automatically computed from provision or requirement of packages and can be refined by Papyrus customizations such as Papyrus for Robotics. It can be manually overwritten via the "Property view". The automatic calculation is restored, if the manual attribute is removed or set to "undefined".

System analysis

The safety analysis tool provides a diagram named "System fault analysis". This diagram is a specialization of "Structure Composite Diagram" from UML. With this diagram, you can create the elements with the "ESF Architecture Concepts" stereotypes applied.

For creating a new system fault diagram, right click on a class and then click "Create ESF Architecture Diagram". Before, you should assure that the architecture annotations are applied to the existing miodel.

FMEA analysis context mnenu

The diagram offers a palette with the elements of ESF Architecture Concepts profile. However, it's not recommended to create new elements with the diagram, if you use a Papyrus customization such as the one for the robotics domain. The reason is that the new elements have the specific stereotype from the architecture concepts profile, but not those of the customization. In this case, the user should create new elements with the diagrams supported by the customization and then drag and drop these from the modelexplorer into the fault-analysis diagram when needed.

Palette of ESF Architecture Diagram

Note:When a SPart is added a dialog is opened for setting a type to SPart. By the dialog, there are two ways to define a type: the first is to create a new SBlock element; the second is to select a SBlock element present in the model.

SPart Type Dialog

Example of Recovery System with ESF Architecture Diagram:

Recovery System with ESF Architecture Diagram

Failure Mode and Effect Analysis (FMEA)

FMEA analysis context mnenu
The FMEA tables are explained in the FMEA documentation.