In engineering practice, multiple repair actions are considered carefully by designers, and their success or failure defines further control actions and the evolution of the system state. Such treatment is not fully supported by the current state-of-the-art in dependability analysis. We propose a novel approach for explicit modelling and analysis of repairable systems, and describe an implementation, which builds on HiP-HOPS, a method and tool for model-based synthesis of dependability evaluation models. HiP-HOPS is augmented with Pandora, a temporal logic for the qualitative analysis of Temporal Fault Trees (TFTs), and capabilities for quantitative dependability analysis via Stochastic Activity Networks (SAN). Dependability prediction is achieved via explicit modelling of local failure and repair events in a system model and then by: (i) propagation of local effects through the model and synthesis of repair-aware TFTs for the system, (ii) qualitative analysis of TFTs that respects both failure and repair logic and (iii) quantification of dependability via translation of repair-aware TFTs into SAN. The approach provides insight into the effects of multiple and alternative failure and repair scenarios, and can thus be useful in reconfigurable systems that typically employ software to utilise functional redundancies in a variety of ways.

This paper focuses on a sub-class of Dynamic Fault Trees (DFTs), called Priority Dynamic Fault Trees (PDFTs), containing only static gates, and Priority Dynamic Gates (Priority-AND, and Functional Dependency) for which a priority relation among the input nodes completely determines the output behavior. We define events as temporal variables, and we show that, by adding to the usual Boolean operators new temporal operators denoted BEFORE and SIMULTANEOUS, it is possible to derive the structure function of the Top Event with any cascade of Priority Dynamic Gates, and repetition of basic events. A set of theorems are provided to express the structure function in a sum-of-product canonical form, where each product represents a set of cut sequences for the system. We finally show through some examples that the canonical form can be exploited to determine directly and algebraically the failure probability of the Top Event of the PDFT without resorting to the corresponding Markov model. The advantage of the approach is that it provides a complete qualitative description of the system, and that any failure distribution can be accommodated.