US4870575A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System integrated fault-tree analysis methods (SIFTAN)
Assignee: ITT Inc
•
Filing: 1987-10-01
•
Granted: 1989-09-26
•
Expires: 2007-10-01
Abstract
Abstract The subject invention employs a system integrated fault-tree analysis (SIFTAN) which has the unique ability to detect all latent hardware and software design defects that could cause unanticipated critical failure of a complex software controlled electronic system. This new approach modifies and then integrates two existing system analysis techniques-namely, hardware fault-tree analysis (HFTA) and software fault-tree analysis (SFTA). The resultant integrated technique is identified as SIFTAN for system integrated fault-tree analysis. Through its integrated hardware/software scope and its critical failure focus, SIFTAN has unique potential to solve the essential analytical limitation behind the software reliability problem. The system exceeds the scope of all current system analysis techniques by providing a system free from all potential critical specification hardware or software design errors. The system accomplishes the above-noted objects by performing fault tree analysis with respect to the contents of a dynamic "stack of contradiction parameters" and then superimposing the modified hardware and software fault trees onto each other. The super position is accomplished by automatically branching from the software to a specified fault tree hardware whenever hardware could result in a critical system output. It is important to indicate that the SIFTAN system is applied with great advantages to early conceptual levels of system design in addition to its certification of the final design implementation.
Inventors
- 👤 Mark R. Rutenberg
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-26 21:59
CPC Classifications
G; G06; G06F; G06F11/00; G06F30/00; G06F30/20; G06F2117/00; G06F2117/02; G06F2119/00; G06F2119/02
Claims Analysis
Total Claims: 29
Claim 1
Independent Claim
85 words
A method of performing integrated fault-tree analysis on a software controlled system, said software controlled system employing a specific hardware configuration which hardware configuration is selectively operated by means of programmed software comprising the steps performed by a computer of: predicting a critical system output condition manifesting a top-level-event, determining from that predicted condition a set of prior system conditions which caused said event, modifying the system response upon detection of an unblocked patch to said event according to said set of prior system conditions.
Claim 2
Independent Claim
85 words
A method of performing integrated fault-tree analysis on a software controlled system, said software controlled system employing a specific hardware configuration which hardware configuration is selectively operated by means of programmed software comprising the steps performed by a computer of: predicting a critical system output condition manifesting a top-level-event, determining from that predicted condition a set of prior system conditions which caused said event, modifying the system response upon detection of an unblocked patch to said event according to said set of prior system conditions.
Claim 3
Dependent Claim
50 words
The method according to claim 1, wherein the step of determining includes tracking backward operation from said top-level-event to a first condition prior to said event and then to a second condition prior to said first condition and so on until all conditions in a descending order have been determined.
Claim 4
Dependent Claim
65 words
The method according to claim 2, wherein the step of determining in descending order includes the step of superimposing hardware and software fault trees onto each other by branching from software to a specified hardware fault tree analysis wherever a specific hardware output could assume said prior condition, and initializing said hardware fault tree analysis with the specific parameters of said hardware output prior condition.
Claim 5
Dependent Claim
41 words
The method according to claim 1, wherein the step of predicting said top-level-event includes: forming a system design flow chart employing a program design language and using said design flow chart to predict said top-level-event by providing a software fault tree.
Claim 6
Dependent Claim
43 words
The method according to claim 4, wherein said step of predicting said top-level-event further includes forming an upper level block diagram of the hardware configuration to provide a hardware fault tree and predicting said top-level-event by employing both said hardware and software trees.
Claim 7
Dependent Claim
13 words
The method according to claim 4, wherein said program design language is ADA.
Claim 8
Dependent Claim
49 words
The method according to claim 1, wherein the step of determining said set of prior system conditions includes the step of: algorithmically parsing a code indicative of final system design and searching said parsed code for a specified set of program formats according to a given contradiction search algorithm.
Claim 9
Dependent Claim
116 words
The method according to claim 2, wherein the step of predicting said critical system output condition includes: initializing a critical system output to be searched, obtaining a Stack of Contradiction Parameters indicative of conditions necessary to make said critical output a fault condition, and then the step of determining the said set of prior conditions by comparing said conditions to said stack of contradiction parameters to determine if any contradictions exist between said prior conditions and any elements in said stack, and then the further step of determining said set of prior conditions through examination of each prior condition itself for logical contradictions internal to said set of prior conditions without respect to said contradiction parameters.
Claim 10
Dependent Claim
25 words
The method according to claim 2, further including the step of certifying said modification through reapplication of the analysis according to claim 1 and 2.
Claim 11
Independent Claim
175 words
A method of performing an integrated fault-tree analysis on a digital software controlled system said software controlled system employing a specific hardware configuration which hardware configuration is selected to operate under control of programmed software comprising the steps performed by a computer of: defining a critical system output condition specifying a top-level-system event, forming a set of contradiction parameters indicative of the other top-level-system conditions, parsing the system software for a program statement which sets the defined top level system event, retrieving a generic fault-tree template for said program statement to identify which inputs to said program statement sets said top-level-event, examining said fault tree for contradictions according to said set of formed contradiction parameters to determine which inputs do not lead to said top-level-event, and which inputs do lead to said top-level-event, eliminating all inputs found which do not lead to said event, replacing all inputs which lead to said event for defining a new top-level-event and continuing said steps commencing with said step of parsing the system software until all inputs are eliminated.
Claim 12
Independent Claim
175 words
A method of performing an integrated fault-tree analysis on a digital software controlled system said software controlled system employing a specific hardware configuration which hardware configuration is selected to operate under control of programmed software comprising the steps performed by a computer of: defining a critical system output condition specifying a top-level-system event, forming a set of contradiction parameters indicative of the other top-level-system conditions, parsing the system software for a program statement which sets the defined top level system event, retrieving a generic fault-tree template for said program statement to identify which inputs to said program statement sets said top-level-event, examining said fault tree for contradictions according to said set of formed contradiction parameters to determine which inputs do not lead to said top-level-event, and which inputs do lead to said top-level-event, eliminating all inputs found which do not lead to said event, replacing all inputs which lead to said event for defining a new top-level-event and continuing said steps commencing with said step of parsing the system software until all inputs are eliminated.
Claim 13
Dependent Claim
71 words
The method according to claim 10, wherein the step of examining said fault tree includes the steps of determining two types of contradictions with a first type being internal contradictions indicative of paths within said fault tree which do not lead to said program statement and with the second time being external contradictions indicative of a discrepancy between a fault tree statement and an element in said set of contradiction parameters.
Claim 14
Dependent Claim
31 words
The method according to claim 10, wherein the step of defining said critical output condition includes ANDing a combination of system events with a system output condition indicative of said top-level-event.
Claim 15
Dependent Claim
41 words
The method according to claim 10, further including the steps of revising said system by modifying said hardware configuration as controlled by said software when all paths are not eliminated and then implementing the steps of claim 10 after said revision.
Claim 16
Dependent Claim
42 words
The method according to claim 10, further including the step of initiating a hardware fault-tree analysis each time said retrieved generic fault tree is examined for contradictions which depend on hardware inputs and employing said new top-level-event for said hardware fault-tree analysis.
Claim 17
Dependent Claim
24 words
The method according to claim 14, including the step of terminating said hardware fault-tree analysis when all inputs are prime events of known probability.
Claim 18
Dependent Claim
18 words
The method according to claim 15, wherein said known probability is calculated based on an assigned reliability threshold.
Claim 19
Dependent Claim
40 words
The method according to claim 10, wherein the step of retrieving said generic fault-tree template includes storing a plurality of said generic fault-tree templates in memory and accessing said memory for retrieving one of said stored plurality generic fault-tree templates.
Claim 20
Dependent Claim
31 words
The method according to claim 10, wherein the step of examining includes ANDing together combinations of simultaneously occurring events in said set of contradiction parameters, and analyzing said AND'ed combinations together,
Claim 21
Dependent Claim
12 words
ORing other parameters in said set with other simultaneously occurring events, and
Claim 22
Dependent Claim
12 words
ORing other parameters in said set with other simultaneously occurring events, and
Claim 23
Dependent Claim
10 words
separately analyzing said OR'ed combinations apart from said AND'ed combinations.
Claim 24
Dependent Claim
10 words
separately analyzing said OR'ed combinations apart from said AND'ed combinations.
Claim 25
Dependent Claim
18 words
The method according to claim 10, wherein said digital software controlled system is a digital defense electronic system.
Claim 26
Dependent Claim
19 words
The method according to claim 10, wherein said digital software controlled system is a digital automatic flight control system.
Claim 27
Dependent Claim
30 words
The method according to claim 8 further including the step of terminating the steps of determining of prior conditions upon detection of either of the two types of said contradictions.
Claim 28
Dependent Claim
32 words
The method according to claim 11 further including the steps of adding said prior conditions to the set of contradiction parameters upon detection of neither of the two types of said contradictions.
Claim 29
Dependent Claim
74 words
The method according to claim 11 wherein, upon indication that a path to said top-level-event exists completely through the software without being blocked by one of the two types of said contradictions, an output is generated indicating that the top-level-event can occur, and the further step of outputting an indication of the location in the software where the said one blocked path residue in order to facilitate corrective modification of the system under analysis.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1992-09-25 | 1993-03-27 | 1993-09-26 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 1996-09-25 | 1997-03-27 | 1997-09-26 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2000-09-25 | 2001-03-27 | 2001-09-26 | $7700.00 | Window Closed / Lapsed |