Content uploaded by Andrey Morozov
Author content
All content in this area was uploaded by Andrey Morozov on Jan 17, 2024
Content may be subject to copyright.
SysML-based Profile for Dependable UAV
Design
Mikael Steurer ∗Andrey Morozov ∗Klaus Janschek ∗
Klaus-Peter Neitzke ∗∗
∗Institute of Automation, Technische Universit¨at Dresden, Dresden,
Germany, (e-mail: [mikael.steurer, andrey.morozov,
klaus.janschek]@tu-dresden.de).
∗∗ Institute for Informatics, Automation and Electronics, Hochschule
Nordhausen, Nordhausen, Germany, (e-mail:
klaus-peter.neitzke@hs-nordhausen.de
Abstract: Model-based systems engineering approaches are commonly used for the develop-
ment of various heterogeneous mechatronic systems including nowadays popular Unmanned
Aerial Vehicles (UAV). As a rule, the dependability analysis is carried out during the system
integration phase of the UAV development. Therefore fundamental design drawbacks might be
uncovered too late leading to serious and costly rework. This paper presents a new methodology
for the early dependability analysis of a UAV system applicable during the design phase. The
proposed dependability analysis is based on the Dual-graph Error Propagation Model (DEPM),
a stochastic model of system design aspects that influence error propagation processes: control
flow, data flow, and component-level reliability properties. A new domain-specific Systems
Modeling Language (SysML) profile and the transformation algorithm from the SysML model
to the DEPM are two key parts of this methodology as well as the main research results of
this paper. The relevant technical details are demonstrated with a case study UAV modeling
workflow that explains how to design a UAV using the introduced SysML profile, transform the
SysML model into the DEPM, and evaluate dependability properties.
Keywords: Modeling, Systems Engineering, Robotics, Fault Tolerance, MBSE, SysML, UML,
Dependability, Profile, Error Propagation, Stochastic Models
1. INTRODUCTION
The sales of UAVs have grown over the past years and
will continue to rise in the next few years according to
DroneFlyers (2017), SESAR (2016), and Tractica (2016).
With the growing commercial sales, the number of air-
borne UAVs also rises. Moreover, not all UAV designers or
developers do consider the dependability of their construc-
tions. This results in an increased hazard risk for living
beings and infrastructure. Aviˇzienis et al. (2004) define
safety as the absence of catastrophic consequences on the
user(s) and the environment. A failure of the UAV system
can cause a catastrophic consequence. Therefore, UAVs are
treated as safety-critical systems and expected to satisfy
high dependability requirements.
The complexity of safety-critical UAV systems grows con-
tinuously, especially of the ones with a high level of au-
tonomy. More precisely, the software part becomes more
and more complex. Complex software algorithms are in-
tegrated not only into onboard computers but in smart
sensors, and some parts of the actuator chains such as
electronic speed controllers.
Fault Tree Analysis (FTA) (IEC (2006b)) or Failure Mode
and Effects Analysis (FMEA) (IEC (2006a)) are two com-
mon methods for reliability evaluation of hardware com-
ponents that are recommended in safety standards such
as IEC 61508 and ISO 26262. FTA is a top-down quan-
titative approach that makes possible to derive reliability
metrics based on the composition of system components.
In contrast, FMEA is a qualitative bottom-up approach
that allows deriving of safety metrics. However, techniques
like FTA and FMEA are not suitable for complex cyber-
physical systems with heterogeneous components and their
nontrivial interactions.
It is necessary to investigate structural and behavioral
aspects of a system to understand error propagation mech-
anisms directly in the early modeling stages of the sys-
tem development. Thus, a new methodology is needed for
meaningful dependability evaluation.
In the industrial environment, the typical development
workflow is the V-model that describes a macro-cycle with
integrated problem-solving micro cycles (Gausemeier and
Moehringer (2002)). According to the V-model, the archi-
tectural design of the system belongs to the system design
phase and the evaluation of dependability aspects belongs
to the system integration phase that is chronologically
located after the design phase. In cases where reliability
is a requirement from the outset, the consideration of
reliability should be part of the architectural design.
The use of models in industrial practice is often limited to
a particular engineering domain like mechanical or electri-
cal engineering, information technology, or dependability
analysis, as clarified in Prosvirnova et al. (2017). SysML
provides the means for the generalized design of the three
domains: mechanical engineering, electrical engineering,
and information technology.
The proposed methodology for generating realistic and
meaningful dependability metrics contains both novel and
existing methods. The goal of this methodology is to close
the gap between system design and dependability analysis
domains in early stages of the system design in order
to avoid unnecessary effort for the elimination of design
shortcomings during the system integration stage.
The rest of the article is organized as follows. Section 2
discusses the related work in the domains of Model-Based
Safety Analysis (MBSA), Model-Based Systems Engineer-
ing (MBSE), and clarifies the paper contribution. Section 3
describes the proposed methodology. A general overview
is given in Subsection 3.1. Subsection 3.2 describes a new
domain-specific SysML profile that supports the proposed
methodology. Subsection 3.3 gives a modeling formalism
for generating a structural model using this SysML profile.
The conversion of the generated data from the systems en-
gineering domain to the error propagation analysis domain
is represented in Subsection 3.4. Section 4 introduces a
case study UAV system and demonstrates the application
of the proposed methodology.
2. STATE OF THE ART
2.1 Model-based systems engineering for the mechatronic
system design
The MBSE approach makes it possible to cope with high
system complexity, shorten development time and avoid
shortcomings in integration and consistency of different
domains. OMG SysML (OMG (2015)) is a commonly used
general-purpose graphical modeling languages for design,
analysis and verification of complex mechatronic systems.
SysML becomes a standard for modeling hardware/ soft-
ware co-design of mechatronic systems both in industrial
and research and development domains. A SysML-based
methodology for the architectural design of mechatronic
systems is proposed in Mhenni et al. (2014a). This method-
ology consists of two main steps. Step one, a black box
analysis amongst other things using Block Definition Dia-
grams (BDD), leads to a comprehensive and consistent set
of requirements. Step two, a white box analysis amongst
other things using Internal Block Diagrams (IBD), leads to
the system architecture. In Rahman and Mizukawa (2013),
SysML is used for the system-level design and a subsequent
preparation for the dynamic simulation of the modeled
system with the special focus on the performance charac-
teristics. Several alternative design paradigms are used for
the mechatronic system design. For example Architecture
Analysis and Design Language (AADL) (Feiler and Gluch
(2012)) or Simulink/Stateflow (Ong (1998)). The method-
ology introduced in this paper is based on SysML because
of extensive modeling capabilities, inherent extensibility
mechanisms (profiles), available modeling tools such as
Papyrus Neon, MagicDraw, or Enterprise Architect, and
xml-based storage format that allows relatively simple
model-to-model transformation.
System: Example
Number of steps: 1000
e1
e3
0.5 e2
0.5 d1
N_err = 40.85
1
0.1
0.9 d2
N_err = 38.77
(a) DEPM example (b) Conditions
Fig. 1. Dual graph error propagation model example with
element conditions
2.2 Dual-graph error propagation model
The DEPM is a mathematical abstraction of system design
aspects that influence error propagation processes such
as control flow, data flow, and component-level reliability
properties as presented in Morozov (2012). A DEPM
model is described by the following mathematical notation:
DE P M := (E, D , CF, DF, C)
Ea set of executable system elements;
Da set of data storages;
CF a set of directed control flow arcs;
DF a set of directed data flow arcs;
Ca set of conditions of the elements.
Figure 1 shows an example of a DEPM model that contains
the elements “e1”, “e2”, and “e3”, data storages “d1”
and “d2”, control flows (black arrows), data flows (purple
arrows), transitions and conditions that describe individ-
ual reliability properties of the elements. ErrorProTM, a
tool for stochastic error propagation analysis, allows a
user to create, modify and compute DEPM models using
underlying model checking techniques based on discrete-
time Markov chain models (Morozov et al. (2015)). The
DEPM elements represent executable parts of the system
and that determine error propagation through these parts.
For example, element “e2” contains two conditions. If “d1”
contains an erroneous value and “e2” is executed, then the
output “d2” will also contain an erroneous value. The error
propagates over the data flow edges from “d1” to “d2”. If
no error occurs in input “d1” and “e2” is executed, then
“d2” is will be correct with a probability of 0.9 and “d2”
is erroneous with the probability 0.1. In other words, the
element “e2” is the initial point of the erroneous output
data “d2”. This small example shows that the DEPM is
capable to fault activation and error propagation. Our
tool, ErrorPro computes the mean number of errors in
selected data storages, such as “d1” and “d2” that are
highlighted in yellow in the DEPM model of Figure 1 (a),
using the probabilistic conditions of the elements (Figure 1
(b)) and the probabilities of control flow transitions.
2.3 Model-based system analysis
This paper is focused on the two main aspects: (1) UAV
design and (2) dependability analysis. These two aspects
can be combined using two different approaches.
The first approach is to generate a single model that
describes both architectural and dependability properties.
For the dependability assessment in the early phases of
software development life cycle, Bernardi et al. (2011)
introduced a profile for Dependability Analysis and Mod-
eling (DAM) to the Unified Modeling Language (UML R
)
profile for Modeling and Analysis of Real-Time and Em-
bedded systems (MARTE). MARTE for UML extends
UML with the modeling capabilities for real-time and
embedded systems. The DAM profile allows the derivation
of stochastic Petri net models for dependability assessment
of software systems. In Delange and Feiler (2014) a fault
propagation ontology that supports software architecture
fault modeling with the help of fault propagation, compo-
nent failure behavior, and the effects on system behavior
is introduced. The approach supports automatic safety
analysis by annotating the AADL with error behavior
specifications.
The second approach is to use two different domain-
specific modeling techniques. Mhenni et al. (2014b) pro-
pose a methodology for automatic fault tree generation
from SysML IBDs. The generation of safety analysis arti-
facts is done automatically through the definition of four
structural design patterns with their fault tree counter-
parts. A similar approach comes from Ding et al. (2016),
where the fully automatic method for the transformation
of annotated Activity Diagrams (AD) to a DEPM model
is presented and demonstrated with a mechatronic case
study.
In this paper, we follow the second approach. At first, a
structural SysML model is built. Subsequently, the DEPM
model is generated. The advantage is, that the modeling
process is carried out using annotated structural SysML
diagrams and dependability analysis metrics are obtained
without additionally effort in this domain. Also, we have
discovered only a few contributions about dependability
analysis of UAV systems. Two examples of the application
of formal methods and statistical simulation for UAV
safety assessment are presented in Kapp´e et al. (2017) and
Mason et al. (2017).
2.4 Paper contribution
This paper introduces a new methodology for the de-
tailed evaluation of dependability metrics based on an
UAV system model in early stages of the development.
Two key parts of this methodology which are also main
research results of this paper are: (1) user-specific SysML
profile, called UAV Dependability Profile (UDP), (2) the
model-to-model transformation algorithm that enables the
DEPM-based analysis.
3. PROPOSED METHODOLOGY
3.1 Overview
“Methodology is generally a guideline for solving a prob-
lem, with specific components such as phases, tasks, meth-
Fig. 2. Methodology guideline
ods, techniques and tools.” (Ishak and Alias (2005)) The
UML AD in Figure 2 shows three actions which have to
be performed. The UDP contains the basis for the internal
activities. The first action “create specific UDP model”
that has to be performed according to the instructions
of Section 3.3. The object ”Specific UDP model” plays
the role of the output of the first action and the input
of the second action. The conversion workflow of the
second action “convert UDP to DEPM” is explained in
detail in Section 3.4. When the “specific DEPM model” is
available, the third action “analyze specific DEPM model”
is executed with the help of ErrorPro and produces the
”DEPM analysis results”, the numerical evaluation of sys-
tem reliability. The advantage of this methodology is, that
the systems engineer only has to perform the first action
“create specific UDP model” manually. The other steps
can be automated.
3.2 UAV dependability profile
The UDP supports modeling of different UAV configura-
tions, like multi rotors, fixed-wings, or combinations. The
UML-based SysML (OMG (2011)) is a commonly used
modeling language for mechatronic systems, such as UAVs.
As illustrated in Figure 4, UML represents the metamodel
of all subordinated profiles and models. UML was devel-
oped for modeling of software systems and comes with
a powerful extension mechanism based on the underlying
OMG Meta Object Facility (OMG (2013)). The OMG
Meta Object Facility represents the the top-level of the
metaization. Hence UML-based SysML, has opened the
door to the systems engineering domain for modeling of
complex hardware/software systems. The UDP, a SysML-
based end-user specific profile delivers the possibility of
a subsequent dependability analysis. The system struc-
ture in UDP models is represented by SysML BDDs and
IBDs. The UDP extends the standard SysML profile and
the UML metamodel, especially the three stereotypes:
“Block”, “FullPort”, and “ItemFlow“. Thus, the UDP
<<Block, UAV>>
uav
+control:Control [*]
+ sensors:Sensors [*]
+ airframe:Airframe [1]
+ actuators:Actuators [*]
+powersystem:PoewerSytem [*]
measured sensor data
actuator valuescommand
generalized coordinates
generalized forces
power
flight state
disturbances
Fig. 3. Top-level structural internal block diagram tem-
plate of a UAV system
Fig. 4. Placement of the UAV dependability profile within
the OMG Meta Object Facility
includes a library of commonly used UAV components
with freedom in modeling of their internal structure. The
proposed top-level UAV structure template is illustrated
in Figure 3. The “PowerSystem” delivers the required
power to the electrical loads “Control”, “Actuators”, and
“Sensors”. The “Sensors” component delivers depending
on the types of sensors measured values to the “control”.
The control can be a simple one, which only controls the
attitude, or a complex autonomous flight control system,
but in every case the outputs are manipulated actuator
values. These values are transformed to generalized forces
by the “Actuators” which are effecting the measured val-
ues of the “Sensors” over the mechanical connection to
the “Airframe”. The SysML stereotype “Block” builds the
generalization of all library components, which are illus-
trated in Figure 5, to match top-level UAV to the SysML
modeling framework of BDDs. A division between com-
ponents with continuous and discrete outputs is reached
through the division of a general “UDPBlock” into “UDP-
BlockCont” and “UDPBlockDis”. Components that are
used to generate IBDs for UDP models are illustrated
in Figure 6. These components are necessary to ensure a
correct translation of the created UDP model to a DEPM
model.
Fig. 5. Heredity structure of UDP components for block
definition diagrams
Fig. 6. UDP components for internal block diagrams
3.3 Creation of a UAV SysML model with the UAV
dependability profile
From the high-level design point of view a UAV is a
classical mechatronic system that consists of software,
hardware, and physical parts (Janschek (2011)). The UDP
was developed with the aspiration to provide building
blocks for dependable UAV design with maximum possible
freedom, according to the top-level structural template
in Figure 3. In the first step of the intended workflow
the user creates a new SysML model. After that the
user applies the UDP profile in order to get an access
to the UDP components. The modelling process starts
with a top-level BDD. The user should use the ”UDP
Nodes” of the Papyrus Neon BDD palette that can be
linked using the common SysML edges. An IBD has to be
created in order to model the context of the associated and
subordinate UDP blocks inside the superordinate UDP
block. Similar to the BDD, the ”UDP Nodes” palette
should be used for the IBDs. However, in contrast to the
BDD the components of the IBD should be linked with
the edges of the specific ”UDP Edges” palette.
UDP blocks and UDP flows are annotated with the values
“Frequ” and “UpdateFrequ” in order to specify the exe-
cution frequencies. Attaching specified frequencies also to
UDP flows is neccessary, because UDP blocks can con-
tain UDP ports with different update rates. This issue
is explained in detail in the following Section. The UDP
Fig. 7. Workflow for UDP-to DEPM-conversion
blocks are also annotated with failure probability values
called “FailureProb”. For the dependability analysis with
the DEPM, all attached values of the lowest-level compo-
nents have to be specified. These values are used for the
definition of DEPM element conditions, what is explained
in the next Subsection. If realistic results are expected,
the approach is sensitive to available component relia-
bility information. Commonly used component reliability
prediction guidelines like FIDES (FIDES (2009)), NRPD
(Denson et al. (1994)) or MIL-HDBK-217F (MIL-HDBK-
217F (1991)) are recommended for the identification of the
particular “FailureProb” values.
3.4 Transformation from SysML to DEPM
After the modeling of the system structure and annotating
the component frequencies and the reliability attributes,
the SysML model has to be transformed into a DEPM
model. Figure 7 shows the transformation workflow, ex-
plaining Step [2] of Figure 2.
Step 2.1: Based on the annotated frequency values of
“UDPBlocks” and “UDP Flows”, frequency classes are de-
fined. The number of frequency classes is equal to the num-
ber of different frequencies of all modeled “UDPBlocks”
and “UDP Flows”. Figure 8 sketches a DEPM example
with three different frequency classes: fast (blue), medium
(orange), and slow (green). Thereby the fast class includes
“m” elements, the medium class includes “n” elements,
and the slow class includes “l” elements. The associated
activation times of the frequency classes are shown on the
timeline above.
Step 2.2: A single “UDPBlock” may be represented in
several frequency classes by several DEPM elements. More
precisely, the number of created DEPM elements of one
“UDPBlock” is equal to the number of correspondent
frequency classes. In the reference DEPM (Figure 8) the
elements “e1fast”, “e1medium”, and “e1slow” represent
the modeled “UDPBlock” “e1”. A real-world example of
slow
medium
fast
18 19 2013
time [time units]
14 15 16 177 8 9 10 11 120 1 2 3 4 5 6
Fig. 8. Dual-graph error propagation model of a multi-
frequency system with the frequency class activation
timeline
a component divided into several frequency classes could
be a Micro Controller Unit (MCU). The processor of this
MCU works with a fast frequency while one output is
updated with a medium and another output with a slow
frequency. In this case the DEPM control flow graph will
contain three nested loops with one MCU element in each
loop.
Step 2.3: Data storages are created and connected via
DEPM data flow arcs with the correspondent DEPM
elements, based on the “UDP Flow” attributes such as
“informationSource”, “informationTarget”, and “name”.
For all divided DEPM elements, a state variable is created
to get them connected to one state, because divided DEPM
elements represent one structural SysML block. In the
reference DEPM, “d1” represents the state variable of
element “e1” and “d2” the output data of element “el
slow”, which is requested by the element “emfast”.
Step 2.4: A set of probabilistic conditions should be
defined for each DEPM element. These conditions describe
fault activation and error propagation processes between
inputs and outputs of the DEPM elements. The conditions
are generated using the annotated reliability values of each
“UDPBlock” stereotype and all subordinated stereotypes.
These Failure Rates (FR) are taken from the reliability
prediction guidelines and commonly defined in “Failure
in Time (FIT)”, which means the number of failures in
109hours. We transform these values into the component
Error Propabailities (EPc) which are used as condition
probabilities:
EP c=F Rc[F I T ]
fc[Hz]·3600 [ s
h]·109(1)
FRcThe failure rate from the reliability annotation
of the component;
fcThe frequency from the frequency annotation
of the component;
Step 2.5: DEPM control flow arcs are created based on
the attributes “informationSource” and “informationTar-
get” of the “UDP Flows”. Further control flow arcs are
created using the information about the defiend frequency
classes. The control flow transition probability from the
last element of a frequency class to the first element of the
next lower frequency class is calculated as follows:
pij =fj
fi
(2)
pij The probability of the transition from eito ej;
fiThe frequency of the higher frequency class;
fjThe frequency of the lower frequency class.
The control flow transition probability from the last el-
ement of any frequency class to the first element of the
highest frequency class is computed as follows:
pi1 = 1 −pij
pi1 The probability of the transition from eito e1.
Step 2.6: The steps 2.1 - 2.5 are repeated for each “UDP-
Block” that has sub-components. For example, a “UDP-
Block” of the stereotype “Powertrain” includes an elec-
tronic speed controller, a brushless motor, and a propeller.
The sub-components of this block will be transformed into
a nested DEPM model.
Step 2.7: A number of steps should be defined in the
DEPM in order to compute system dependability proper-
ties. One step corresponds to the execution of one DEPM
element. The necessary number of steps to compute one
hyper period is calculated as follows:
NS=
NFC
X
i=1
(fi·NEi)·HP
NFC The number of frequency classes;
fiThe frequency of the ith frequency class;
NEiThe number of elements in the ith frequency class;
HP Hyper period, the smallest interval of time after
which the periodic control flow pattern of all
frequency classes is repeated.
The HP is computed as the ratio of the least common
multiple of all frequency classes to the frequency of the
highest frequency class.
4. CASE STUDY
This section demonstrates the application of the described
methodology to a quadrocopter UAV system. The first
step is the creation of the UDP model. Figures 9 and 10
depict the correspondent top-level BDD and IBD of the
Fig. 9. A top-level BDD of the case study quadrocopter
quadrocopter. Additional BDDs and IBDs are created for
sub-components of the top-level element “Quadcopter” in
order to demonstrate the hierarchical design. For example,
the sub-components of the “Powertrain” are shown in
Figure 11.
The heredity structure of the UDP allows the annotation
of the error probabilities to components, which are sub-
stereotypes of the “UDPBlock”. Failure rates of the com-
ponents of the case study UAV quadrocopter are defined
using the FIDES and the NRPD guideline. For example
the FR of a digital integrated circuit of electronic speed
controllers is 12.5918 FIT. The working frequency equals
to 500 Hz. The EP is computed based on the Equation (1).
EP =12.5918 F I T
500 Hz ·3600 s
h
·109= 6.995 ·10-15
After that the frequencies are defined for each UDP
component. For the components, which have per definition
continuous time outputs, a discretized frequency of 1000
Hz is used. In our case three frequency classes have been
defined, see Table 1.
Table 1. Frequency classes
Frequency class Frequency value Number of DEPM
number [Hz] elements
1 1000 5
2 500 8
3 100 8
The number of steps is computed according to the Step 2.7.
We evaluate 9800 steps that corresponds to one second of
operation or a single hyper period. Based on Equation (2)
the control flow probability for the transition from the
frequency class one (1000 Hz) to the frequency class two
(500 Hz) is
Fig. 10. A top-level IBD of the case study quadcopter
Fig. 11. A sub-level IBD of the powertrain frontleft
p12 =500 Hz
1000 Hz = 0.5,
and from the frequency class two (500 Hz) to the frequency
class three (100 Hz):
p23 =100Hz
500Hz = 0.2.
In sake of transparency, the case study DEPM has been
reduced. We model only one out of four actuators. The
block “MPU6050” is generalized into the element “Sen-
sor”. In spite of the simplifications, the DEPM covers all
relevant aspects of the proposed methodology. The DEPM
generated from the UDP model is shown in Figure 12. The
DEPM contains 21 elements, 16 data storages, 23 control
flow and 82 data flow arcs.
An example of the computed numerical results is the
number of errors in the DEPM “StateFrame” data stroage.
This is the probabilistic number of errors of the whole
system, because all the other components are mechanically
connected to the frame. The computed number of errors
during one hyper period is equal to 0.0003832.
This is also a good example for the propagation of errors
along the control and data flow structure. In this case
study the element “Frame” was defined as completely reli-
able without the possibility to cause a fault. Nevertheless,
its state has a probability to be erroneous during one
hyper period. Hence, the number of errors can only be
extinguished by error propagation.
5. CONCLUSION
This article presents a methodology that integrates de-
pendability analysis within a Model-Based Systems Engi-
neering approach in early phases the system development.
The methodology contains both state of the art methods
like the Dual-graph Error Propagation Model (DEPM)
and SysML-based structural modeling of mechatronic sys-
tems as well as new aspects such as the UAV Dependability
Profile (UDP) and the conversion algorithm from SysML
into the DEPM. Technical details of the main research
results were presented in a formal way and demonstrated
with a case study UAV model. Currently, the UDP to
DEPM conversion should be done systematically but man-
ually according to the workflow in Figure 7. Therefore,
one of the future goals is the complete automation of the
whole transformation step that will require more technical
effort than methodical. However, this will increase the
consistency between the system design and dependability
analysis domains. Fault tolerance and redundancy aspects
of individual or combined sub-components have to be
modeled and integrated into the DEPM model manually.
By further investigation of these aspects, it will be possible
to integrate them into the set of predefined UDP blocks
that are already annotated with the reliability properties
and use this information for the generation of the DEPM
model.
REFERENCES
Aviˇzienis, A., Laprie, J.C., and Randell, B. (2004). De-
pendability and its threats: a taxonomy. Building the
Information Society, 91–120.
Bernardi, S., Merseguer, J., and Petriu, D.C. (2011). A
dependability profile within MARTE. Software and
Systems Modeling, 10(3), 313–336.
Delange, J. and Feiler, P. (2014). Architecture fault mod-
eling with the AADL error-model annex. In Software
ame1000
1
Sens1000
0.5
Bat500
1
Ctrl500
1
ESC500
StateESC
ESC100
1 1
1
0.5
System: New Model
Number of steps: 9800
Mot1000
1
Prop1000
1
Fr
MotCurrent
Mot100
StateMot
Mot500
AngVel 1 1
Prop500
StateProp
Prop100 1
Thrust
1 Frame500
StateFrame
N_err = 0.0003832
Frame100 1
1
Value
1 Sens500
StateSens
Sens100 1
MeasValue
MCU500
0.2
StateMCU
Bat100
1 0.8
StateBat
Bat1000
1 1 Power
MCU100
Data
Ctrl100
ActVal
StateCtrl
Fig. 12. A DEPM that was generated from the UDP model
of the case study quadrocopter
Engineering and Advanced Applications (SEAA), 2014
40th EUROMICRO Conference on, 361–368. IEEE.
Denson, W., Chandler, G., Crowell, W., Clark, A., and
Jaworski, P. (1994). Nonelectronic Parts Reliability
Data 1995. Technical report, RELIABILITY ANAL-
YSIS CENTER GRIFFISS AFB NY.
Ding, K., Mutzke, T., Morozov, A., and Janschek, K.
(2016). Automatic Transformation of UML System
Models for Model-based Error Propagation Analysis
of Mechatronic Systems. IFAC-PapersOnLine, 49(21),
439–446.
DroneFlyers (2017). Anzahl der verkauften kommerziellen
Drohnen weltweit in den Jahren 2013 bis 2017. Statista.
Feiler, P.H. and Gluch, D.P. (2012). Model-based engineer-
ing with AADL: an introduction to the SAE architecture
analysis & design language. Addison-Wesley.
FIDES (2009). Reliability methodology for electronic
systems. FIDES group.
Gausemeier, J. and Moehringer, S. (2002). VDI 2206-A
new guideline for the design of mechatronic systems.
IFAC Proceedings Volumes, 35(2), 785–790.
IEC (2006a). Analysis Techniques for System Reliability-
Procedure for Failure Mode and Effects Analysis
(FMEA). IEC 60812.
IEC (2006b). Fault Tree Analysis (FTA). IEC 61025.
Ishak, I.S. and Alias, R.A. (2005). Designing a Strate-
gic Information System Planning Methodology for
Malaysian Institutes of Higher Learning (ISP-IPTA).
Universiti Teknologi Malaysia.
Janschek, K. (2011). Mechatronic systems design: meth-
ods, models, concepts. Springer Science & Business
Media.
Kapp´e, T., Arbab, F., and Talcott, C. (2017). A
Component-oriented Framework for Autonomous
Agents. In International Conference on Formal Aspects
of Component Software, 20–38. Springer.
Mason, I.A., Nigam, V., Talcott, C., and Brito, A. (2017).
A Framework for Analyzing Adaptive Autonomous
Aerial Vehicles. In CoSim-CPS 1st Workshop on Formal
Co-Simulation of Cyber-Physical Systems.
Mhenni, F., Choley, J.Y., Penas, O., Plateaux, R., and
Hammadi, M. (2014a). A SysML-Based Methodology
for Mechatronic Systems Architectural Design. Ad-
vanced Engineering Informatics, 28(3), 218–231.
Mhenni, F., Nguyen, N., and Choley, J.Y. (2014b). Auto-
matic fault tree generation from SysML system models.
In 2014 IEEE. In ASME International Conference on
Advanced Intelligent Mechatronics (AIM)(July 2014),
715–720.
MIL-HDBK-217F (1991). Military Handbook: Reliability
Prediction of Electronic Equipment. United States of
America: Department of defense.
Morozov, A., Tuk, R., and Janschek, K. (2015). ErrorPro:
Software tool for stochastic error propagation analysis.
In 1st International Workshop on Resiliency in Embed-
ded Electronic Systems, Amsterdam, The Netherlands,
59–60.
Morozov, A. (2012). Dual-graph model for error propaga-
tion analysis of mechatronic systems. Dresden Univer-
sity of Technology.
OMG (2011). OMG Unified Modeling Language
(OMG UML), Infrastructure, Version 2.4.1. URL
http://www.omg.org/spec/UML/2.4.1.
OMG (2013). OMG Meta Object Facility
(MOF) Core Specification, Version 2.4.1. URL
http://www.omg.org/spec/MOF/2.4.1.
OMG (2015). OMG Systems Modeling Lan-
guage (OMG SysML), Version 1.4. URL
http://www.omg.org/spec/SysML/1.4/.
Ong, C.M. (1998). Dynamic simulation of electric machin-
ery using Matlab/Simulink. Prentice-Hall PTR,.
Prosvirnova, T., Saez, E., Seguin, C., and Virelizier, P.
(2017). Handling Consistency Between Safety and
System Models. In International Symposium on Model-
Based Safety and Assessment, 19–34. Springer.
Rahman, M.A.A. and Mizukawa, M. (2013). Modeling and
design of mechatronics system with SysML, Simscape
and Simulink. In Advanced Intelligent Mechatronics
(AIM), 2013 IEEE/ASME International Conference on,
1767–1773. IEEE.
SESAR (2016). European Drones Outlook Study. Unlock-
ing the value for Europe.
Tractica (2016). Consumer Drone Sales to Increase Tenfold
to 67.7 Million Units Annually by 2021.
