Fault Tree Analysis of Software Reliability Allocation

Fault Tree Analysis of Software Reliability Allocation

Jianwen XIANG, Kokichi FUTATSUGI

School of Information Science, Japan Advanced Institute of Science and Technology

1-1 Asahidai, Tatsunokuchi, Ishikawa, 923-1292 Japan

and

Yanxiang HE

Computer School, Wuhan University

Wuhan, Hubei, 430072 China

ABSTRACT

Traditional methods for Software Reliability Allocation (SRA) often suffer from lagging behind system design stage, quite complexity, considerable subjectivity, or badly rely on the experiential data, so the accuracy and effectiveness of the result is doubtful.

Our goal is to develop a set of methods that address these weaknesses. In this paper, we propose a novel method to guide software reliability allocation by using software fault tree analysis (SFTA). With respect to the multi-user oriented software, we introduce a new algorithm to figure out each component’s importance, and establish a new reliability allocation model based on software utility and total development cost.

Keywords: Software Reliability Allocation, Software Fault

Tree Analysis, Minimal Cut Set, Software Utility.

1. INTRODUCTION

Software Reliability Allocation (SRA) is an important process in software reliability engineering, it deals with the setting of reliability goals for individual components such that a specified system reliability goal is met and the component goals are well balanced among themselves [1].

But most of the existing software reliability models estimate the reliability of software in the testing and operational stages, after the completion of the initial stage of product development. These models answer the question: “how reliable is the system?” They could not answer the question: “how reliable should system components be?” They provide no guidance on how much time and effort should be spend on different components of the product in the planning, design, and early coding and development stages, the stages are crucial to subsequent reliability of the system. Hence they could have hardly any impact on the planning and design stages of software project.

A number of reliability allocation models have been developed. Fatemeh Zahedi and Noushin Ashrafi contributed a SRA model based on system structure, utility, price and cost, by using the method of Analytic Hierarchy Process (AHP) [2, 3], and the reliability of each module is derived from the hierarchy of user utility, function, program and module, not by the inherent reliability relationships among the system

modules and the actual reliability demand of each module; Oded Berman and Noushin Ashrafi proposed four optimization models for reliability of modular software systems [4], but it only draws the attention on how to make an optimal selection out of an available pool of modules with known reliability and cost, give no guidance on how to allocate reliability to system modules in the planning and design stage of the system; Michael R.lyu discussed optimization methods of reliability allocation and testing schedule for software systems with single or multiple applications [5], but it also does not figure out internal relationships among system modules, which is very important to guild the reliability allocation.

Software Fault Tree Analysis (SFTA) is a method for identifying and documenting the combinations of lower-level software events that allow a top-level event (or root node) to occur. When the root node is a hazard, the SFTA assists in the requirements process by describing the ways in which the system can reach that unsafe state [6]. The safety requirements for the system can then be derived from the software fault tree, either indirectly [7][8] or directly via a shared model [9].

In the work described here, we use SFTA to assist in analyzing and verifying the logic relationship of the system modules and their respective reliability requirements. Based on these analyses, we present a novel algorithm to allocate the software reliability, and can solve the problem among the system reliability object, total development cost, and the utility of multi-user oriented software.

The rest of the paper is organized as follows. Section 2 provides some background knowledge of SFTA. Section 3 elaborates a fast reliability allocation model based on SFTA. Section 4 discusses how to define each module’s importance of multi-user oriented software. Section 5 presents an efficient reliability allocation algorithm, which is based on the software utility and total development cost. Section 6 contains concluding remarks.

2. BACKGROUND OF SFTA

Fault Trees Analysis (FTA) have been widely used for reliability analysis for years. They were first developed in the 1960s to facilitate analysis of the Minuteman missile system [10] and have been supported by a rich body of research since their inception.

T G2 G1 G3 m1 m2 m3 G4 G5 m4 m5 m3 m6 (Root Event) (Middle Event) (AND Gate) (OR Gate)

Software Fault Tree Analysis (SFTA) is a method for identifying and documenting the combinations of lower-level software events that allow a top-level event (or root node) to occur. When the root node is hazard, the FTA assists in the requirements process by describing the ways in which the system can reach that unsafe state [6].

To analyze the software reliability by using the SFTA technology, first we should define the most undesirable event as the root event. All the root events make up a root events table, or call it a key fault events table. For each root event in the table, is corresponding to a Fault Tree. By the logic relationships among the components of the program, we can analyze what modules or sentences (middle events) may cause the root event to occur. Continue to analyze the middle events until we reach a single sentence or a stop condition, namely reach the basic event. Then, based on these analyses above, we can draw the Fault Tree of the software.

A cut set is a set of basic events whose occurrence causes the system to fail [11]. A cut set is called a minimum cut set if it cannot be reduced and can still cause the system to fail [11]. A minimum cut set of a fault tree gives a minimum set of successful events necessary to satisfy the root. To get the minimum cut set, we introduce a top-down algorithm, Fuseell-vesely algorithm [12].

1) From the root event downwards gradually, list events according to different logic relationships.

2) If a gate below the root event is an OR gate, then list the input events into different rows. If it is a AND gate, then list the input events into one row.

3) With respect to the middle event, Gi, regard it as a root event in step 1, and repeat the step 2, until reach the basic event.

4) Finally we get some sets of events, they are the whole cut sets of the fault tree.

5) To get the minimum cut sets from the whole cut sets in step (4), first we arrange all the cut sets according to the number of their elements, and let each cut set be a product of basic events. Then to use the relationships of the events below to absorb the redundant cut sets. At last, we get the minimum cut sets.

A+A=A A+AB=A AA=A

Leveson and Harvey have also shown that SFTA can be performed at various levels and stages of software development. The highest level of analysis is the functional description. At the lowest level of investigation SFTA analysis the program code. In this paper, we use SFTA at the level of function module, to analyze and investigate the inherent reliability relationships and requirements of system modules. In our current work, with respect to software system, we regard its function module/component as the basic event, and let the event of system failure as the root event. Then, resorting to SFTA, we can find which modules are more important, and should be allocated higher reliability & safety, because they are easier to make the system to fail if they are unreliable.

3. FAULT TREE ANALYSIS OF SOFTWARE RELIABILITY ALLOCATION

Presume that the maximum acceptable Failure Rate (FR) is F, and the system consists of n modules, let them be:

1, 2, , n

m m m . By using SFTA, we get x minimum cut sets.

Then we present an algorithm below [13].

Algorithm 1 If one minimum cut set contains i modules, then

the maximum FR of each module in this minimum cut set is 1 j i m F F x   ≤  _{ } （j=1,2,…,n） (1) If there exist intersections in the minimum cut sets, that is to say, the result of

j

m

F

may have k different values, let them be

y

₁

,

y

₂

,

,

y

_k. Then we define

(

1, , , ,2 3 k

)

j

m

F =Min y y y y (2) It should be mentioned that our algorithm is a geometric mean algorithm in some sense, which is the reverse process of the traditional analysis of software failure rate by using SFTA [14]. The traditional method can solve this problem: given pre-specified or known failure rate of each module (these data can get from software testing stage), can analyze the failure rate of software system in quality and quantity. Our idea is just the inverse method, given the reliability requirement of software system in the software planning or design stage, try to determine and investigate each module’s reliability and their inherent relationships. To our knowledge, we are the first to propose a reliability allocation algorithm by using SFTA. In our algorithm, the results of F are gotten by geometric m_j

mean algorithm, and may have little deviation. But in the process of analyzing software fault tree, we can give software engineer (SE) a comprehensive understanding of the structure of software system and reliability requirement of each module, help them to know which modules are most/more important modules (key module) and allocate higher reliability to these modules. Compared to the traditional methods, such as AHP only get relative weights from users, our method is more reasonable and reliable, the deviation is trifling and acceptable.

To explain the algorithm in detail, let’s first examine an example.

Figure 1: A fault tree as running example

Example 1: If a software system consists of six modules, let

them be: m m m m m m₁, ₂, ₃, ₄, ₅, ₆. The system demands that the maximum FR, F≤0.03. How should we allocate the

Reliability to each module? The fault tree of the software system is given above in figure 1.

By using Fuseell-vesely algorithm, first we derive the whole cut sets of the fault tree in figure 1,

1 { },3 2 { ,1 2}, 3 { ,3 4, },5 4 { ,4 5, 6}

K = m K = m m K = m m m K = m m m . But

3 3 3 4 5

m =m +m m m , or in another word, K₁ is a subset of 3

K , so finally we get three minimum cut sets,

3 1 2 4 5 6

{ },{ ,m m m},{ ,m m m, }.

Then by using Eq. (1), we get the results:

3 1 1 0.01 3 m F F ≤ _{ } =   1 2 1 2 0.1 3 m m F F =F ≤ _{ } =   4 5 6 1 3 0.215 3 m m m F F =F =F ≤ _{ } =  

That is to say, the maximum FR of each module is (0.1，0.1， 0.01，0.215，0.215，0.215), so their reliability must be (0.9， 0.9，0.99，0.785，0.785，0.785).

Analysis:

SFAT of software reliability allocation is very visual, simple and effective. Not only it can be used in the level of system analysis, but also in the level of subsystem and module analysis. Because the process of constructing software fault tree itself is a thorough comprehensive understanding process to the system, it requires that the SE must grasp the inherent relationships among system modules, make clear the influence of each potential unsafe factor, so the result data of reliability is more rational. In addition, SFAT is a graphic deductive method, shows the system inherent relationship clearly, which make it very easy to find the key modules and allocate reliability visually.

Based on the definition of minimum cut set and the analysis above, we can get an important inference, if the number of the module in the minimum cut set is fewer, then the module in the minimum cut set should be allocated higher reliability. In example 1, because the number of the module K1<K2<K4, we can quickly get the conclusion: m3 is the key module or the most important module of the system, and should be allocated highest reliability, while m m m4, 5, 6 could be allocated lower reliability corresponding to m3.

4. DEFINE THE MODULE IMPORTANCE

From the viewpoint of the user, they are more concerned about the software utility. Especially in multi-user oriented software, because the importance of each module may different from different user’s (user group’s) viewpoint, so we must find a way to affirm the relative importance of each module.

Definition: Utility is a concept from the point of view of

users. It refers to the dependability which user uses the software to achieve different functions. When the utility is high, it shows that the software quality is also good. Given a software contains n function modules, { ,m m1 2, ,… mn}, its

utility is:

1 1 2 2

( , ) _{n n}

U r w =w R +w R +…+w R (3) Where w_i is the importance of module i, the relative importance from the users’ view in the total assessment of the software, their value can be derived by requirement analysis.

i

R is the reliability of module i. For generality, define 0<wi< and 1 1 1 n i i w = =

∑

.

To get the value of wi more objectively, we adopt the

method below [15].

Suppose software orients k users and contains n modules, doing a survey to each module importance by users. Then arrange the result list by descending sequence of the module importance. The result list of user i is like

1 2 1

{ ,i i, , i, , i , i}

j n n

m m …m …m− m , where mij denotes any one

module of { ,m m_{1 2}, ,…m_n}. So, we can get k result lists below. 1 1 1 1 1 1 2 1 { ,m m, ,…mj, ,…mn−,mn} 2 2 2 2 2 1 2 1 {m m, , ,…mj, ,…mn−,mn} …… { ₁k, ₂k, , k, , k₁, k} j n n m m …m …m₋ m

Then, by defining the importance value of the ordered modules as { , , , ,1 1 1 1₁, 1₁}

2 4 8… 2n− 2n− , we can get the importance value of module j, where i

j

ϕ is the importance value of module j given by user i.

1 1 j k i j m j i w w k = ϕ = =

∑

(4) In addition, the results maybe show that different modules may have the same importance value, but it is an acceptable normal instance.

Let us demonstrate this algorithm with a simple example.

Example 2: Suppose a software system contains six modules: 1 2 3 4 5 6

{ ,m m m m m m , investigate their relative importance , , , , } from three different users (user groups), and get their respective result of importance order as follows:

1 3 2 4 5 6 { ,m m m m m m, , , , }; 2 3 4 1 6 5 { ,m m m m m m, , , , }; 3 1 2 6 5 4 { ,m m m m m m, , , , }. So, we can figure out:

1 1 1 1 1 1 13 26 ( ) 0.271 3 2 16 4 48 96 m w =w = ⋅ + + = = =

2 2 1 1 1 1_{( )} 1 24 _0.250 3 8 2 8 4 96 m w =w = ⋅ + + = = = 3 3 1 1 1 1 1 32 ( ) 0.333 3 4 4 2 3 96 m w =w = ⋅ + + = = = 4 4 1 ₍1 1 1₎ 7 _0.073 3 16 8 32 96 m w =w = ⋅ + + = = 5 5 1 1 1 1 1 3 ( ) 0.031 3 32 32 32 32 96 m w =w = ⋅ + + = = = 6 6 1 1 1 1 4 ( ) 0.042 3 32 32 16 96 m w =w = ⋅ + + = =

And we can validate that the constraint 6 1 1 i i w = =

∑

is true.

5. RELIABILITY ALLOCATION MODEL OF MULTI-USER ORIENTED SOFTWARE BASED ON

SOFTWARE UTILITY & COST

General speaking, the software developing cost could not overruns the budget, _{C , While it should ensures that the} * software utility as higher as possible. If software contains n function modules, { ,m m1 2, ,… mn}, by using SFTA get x

minimum cut sets, K (j=1，2，…，x). Let _j F_i be the FR of module i, (i=1，2，……，n), Ri be the Reliability of module

i, where Ri = − , and F be the FR of the whole system. 1 Fi

By using the method introduced in above section, got the importance value of each module, ( ,w w_{1 2}, ,w_n), then, we have the software reliability allocation algorithm below [15]:

Algorithm 2 (Software Reliability Allocation Model)

Object function: 1 max[ n _{i i}] i U w R = =

∑

(5) Constraints: R_i≤ u_i R_i≥ l_i a_i+ ⋅c R_{i i}≤ ⋅ α v_i * 1 ( ) n i i i i a c R C = + ⋅ ≤

∑

(6) In Eq. (6), ui is the upper limit reliability of module i, and

i

l is the lower limit; ai denotes the commonly cost given to

module i by the constraint R_i, c_i is the adjustable cost; α

is equal to the value of 1 minus the profit rate, which the vendor expected; vi is the selling price, so α⋅ is the vi

estimated developing cost of module i, and its actual cost should not exceed it.

How to decide the selling price of module i? Let V be the price that the user would like to pay for the software, and in the survey process of software evaluating by the user, we have got the relative global significance of module i, w_i, so the implicit price of module i is:

i i

v =w V⋅ (7) When the software is developed and distributed in batches or for mass market, the V in Eq. (7) is replaced by yV , where y is the estimate number of copies of the software will be sold.

The fourth constraint in Eq. (6) is the resource control condition of the whole project, where _{C is the available} * developing resource, the whole cost of reliability must less than it.

There are one linear object function and 3n+1 linear constraints in algorithm 2. It is a linear constrained optimization problem. Many software products for optimization can solve this linear optimization problem, and most mainframe computers have linear algorithms in their optimization packages. One also can find PC software packages for solving this problem. For instance, GAMS [16] is an example of a product available on both PC and Mainframe, or try

http://gams.nist.gov/

for Guide to Available Mathematical Software. In this paper, we suggest adopting Genetic Algorithms [17, 18, 19, 20, 21] to solve this problem. By the inherent advantages of global optimization and implicit parallelism of Genetic Algorithms, we can solve the constrained optimization problem effectively while other algorithms may be hard to this problem, which help us to use SFTA in quantitative analysis more conveniently and effectively.

Let us demonstrate the application of the reliability allocation model with a simple example.

Example 3: Suppose a software system contains six function modules, designed or developed for three main user groups. Its analysis of software fault tree and calculation of module importance are figured out as in example 1 and example 2 above.

Assume the cash resource for the project development is estimated to be $235,000. The profit mark up for this project is 50%, so we get α=0.5 and _C*_=235,000.

Assume the software system demands that the maximum FR, 0.03

F≤ , how do we allocate reliability to each module, while maximally satisfied the users’ demand of software utility?

Based on the result of example 1 and the equation Ri = −1 Fi,

we can get the lower limit of each module’s reliability: 1 2 3 4 5 6

(l l l l l l ) (0.9 0.9 0.99 0.785 0.785 0.785)=

In this example, we let the unit be $1000 and set: 1 2 3 4 5 6 (a a a a a a) (50 20 10 1 1 1)= ; 1 2 3 4 5 6 (c c c c c c ) (25 99 18 5 5 1)= ; 1 i u = .

While based on example 2, we know: 1 2 3 4 5 6 ( ) (0.271 0.25 0.333 0.073 0.031 0.042) w w w w w w =

Estimate the software price is $1,000,000, then by Eq. (7), we can get:

(

v1 v2 v3 v4 v5 v6

) (

= 271 250 333 73 31 42

)

Now, we are ready to formulate the reliability allocation model as: 6 1 max[ _{i i}] i U w R = =

∑

(

)

1 2 3 4 5 6 1 2 3 4 5 6 1 2 3 4 5 6 1 1,2, ,6 0.9 0.9 0.99 0.785 0.785 0.785 50 25 0.5(271) 20 99 0.5(250) 10 18 0.5(333) 1 5 0.5(73) 1 5 0.5(31) 1 0.5(42) 83 25 99 18 5 5 235 i R i R R R R R R R R R R R R R R R R R R ≤ =   ≥   ≥  _≥   _≥  ≥   _≥   + ≤   + ≤  + ≤   + ≤  + ≤   + ≤   + + + + + + ≤ 

By using Genetic Algorithm, we get an optimal result:

(

1 2 3 4 5 6

)

( )

0.99529 0.98366 0.99994 0.99894 0.99724 0.99958 .

R R R R R R

=

And 0.99477U= , the attainable maximal software utility. It should be mentioned out that in this example, our results of reliability allocation and software utility meet well with the resource and other constraints in Eq. (6), but in some practical projects, maybe there have no feasible solution because of some special financial constraints. To resolve these infeasibilities, the SE group and management should decide to accept that no profit would be obtained from some modules or broaden/amend some restraints. This provides an important insight to the relationship of technical and financial feasibilities of reliability goals at the module level, and equips the management with the analytical tools for deciding on software quality well in advance of any implementation.

6. CONCLUSIONS AND DISCUSSIONS

From the analysis above, when the system reliability and cost budget have been given, the model of software reliability allocation that we presented in this paper can solve the problem: get the maximal utility while meet with the constraints of technical considerations, costs, resources and prices.

The model in this paper is an amalgamation of qualitative and quantitative information reflecting the subjective views and objective facts about the software system. We used SFTA to analyze software structure and get the reliability requirement

(lower limit of reliability) of each function module. We investigated the user’s views about the software function modules and gave an algorithm to figure out module importance with respect to multi-user oriented software. Finally, we proposed a model to allocate software reliability while maximizing software utility and meeting with its constraints. We showed three examples to demonstrate our algorithms.

Compared to traditional algorithm of AHP, our method has two advantages.

First, SFTA method can not only figure out the lower limit

reliability of each module, but also show the inherent relationship of the system structure and the actual reliability demand of each module, thus the allocation result is more reasonable. Whereas AHP only simply indicates that the lower limit reliability should be greater than zero and decided by the SE subjectively.

Second, the method to set user importance of multi-user software is very simple and effective, and the value can be gained in the process of system design, which make it more effectively to guide the reliability allocation. But this process in AHP is more complicate, and it didn’t give the solution to multi-user oriented software (Michael R. Lyu etc described another method that how to solve the multiple application problem using non-linear programming techniques in [5]). All these advantages contribute to the operability and effectiveness of our SFTA method.

In this paper, we only discussed our methods at the level of function module, though SFTA can be performed at various levels and stages of software development, even to the level of program code. This is because that we used a simple and effective method to determine the user importance, which can only be performed at the functional level. Obviously, one is unable to ask directly from the user to express his preference for each program and module because his view of the software is an external one that ends at the functional level of the software hierarchy [2]. On this hand, AHP is an effective method to get user’s relative preference for software function, program or module (the notion of “module” in this sentence is different from the notion of “function module” in our model. It means code module of program, whereas the notion of “function module” in our model equals to the “function” of the software in this sentence), which using the “eigenvalue” method (or other available computation methods [22]) for computing the relative weights at each level. So, from this point of view, merging these two approaches will further improve software reliability allocation in practical applications and projects.

7. REFERENCES

[1] J. Musa, D. Iannino, and K. Okumoto, Software

Reliability: Measurement, Prediction. Anolication, New York: McGraw-Hill. 1987, pp. 197.

[2] F.Zahedi, N.Ashrafi, “Software Reliability Allocation Based on Structure, Utility, Price and Cost”, IEEE

Transaction on Software Engineering, Vol. 17, No. 4, 1991, pp. 345-356.

[3] F.Zahedi, “The Analytic Hierarchy Process — A Survey of The Method and Its Applications”, Interfaces, Vol. 16, No. 4, 1986, pp. 96-108.

Models for Reliability of Modular Software Systems”,

IEEE Transactions on Software Engineering, Vol. 19, No. 11, 1993, pp. 1119-1123.

[5] Michael R. Lyu, Sampath Rangarajan and Aad P. A. van Moorsel, “Optimization of Reliability Allocation and Testing Schedule for Software Systems”, Bell

Laboratories and Lucent Technologies. Available from: http://citeseer.nj.nec.com/197728.html.

[6] Leveson, N. G., Safeware: System Safety and

Computers, Addison-Wesley, Reading, MA, USA, 1995.

[7] De Lemos, R., Saeed, A., and Anderson, T., “Analyzing Safety Requirements for Process-control Systems”,

IEEE Software, Vol. 12, No. 3, 1995, pp. 42-53. [8] Lutz, R., and Woodhouse, R. M., “Requirements

Analysis Using Forward and Backward Search”,

Annals of Software Engineering, 3 (1997), pp. 459-475.

[9] Hansen, K. M., Ravn, A. P., and Stavridou, V., “From Safety Analysis to Software Requirement”, IEEE

Transactions on Software Engineering, Vol. 24, No. 7, 1998, pp. 573-584.

[10] H.A. Watson and Bell Telephone Laboratories, “Launch Control Safety Study”, Bell Telephone Laboratories, Murray Hill, NJ USA, 1961.

[11] Raheja, D. G., “Assurance Technologies: Principles and Practices”, McGraw-Hill Engineering and Technology Management Series, McGraw-Hill, New York, 1991.

[12] Chen Kai, Lu Shulan, and Li Fengling, Mathematics of

Reliability & Application, The Jinlin Education Press, 1989.

[13] Xiang Jianwen, Xu Renzuo and Xiao Yingbai, “Fault Tree Analysis of Software Reliability Allocation”,

Journal of Wuhan University (Natural Science Edition), Vol. 45, No. 5(B), 1999, pp. 684-686.

[14] Michael R. Lyu (ed.), Handbook of Software

Reliability Engineering, McGraw-Hill, 1995, pp. 619-627.

[15] Xu Renzuo, Xiang Jianwen and Xiao Yingbai, “Fault Tree Analysis of Multi-User Oriented Software Reliability Allocation”, Mini-Micro Systems, Vol. 22, No. 3, 2001, pp. 329-332.

[16] A. Brooke, D. Kendrick, and A. Meeraus, GAMS: A

User Guide, Redwood City, CA: Scientific Press, 1988. [17] J. Holland, Genetic Algorithms, Sci. Amer., July 1992,

pp. 44-50.

[18] Michalewicz Z., Genetic Algorithms + Data

Structures = Evolution Program, Springer-Verlag, Berlin. 1992.

[19] Liu Yong, Kang Lishan and Chen Yuping,

Non-Numerical Parallel Algorithm (second volume) —Genetic Algorithms, [M] Beijing, the Science Press, 1997.

[20] J.H. Holland, Adaptation in Natural and Artificial

System, The University of Michigan Press, 1975. [21] Srinivas M and Patnailk L M., “Genetic Algorithms: A

Survey”, Computer, June 1994, pp. 17-26.

[22] Zahedi, F., “A Simulation Study of Estimation Methods in The Analytic Hierarchy Process”, Socio-Economic