A formal method for finding failure modes

We present a relational technique to write formal specifications which not only say what the system is intended to do but also in which ways it might misbehave because of damage or other failure. For this kind of specifications we use the term failure-sensitive. Specifications are given by sets of rules out of which a complete list of failure modes for the system can be constructed. Most classical specification techniques concentrate on the intended behavior only. Knowing a complete set of failure modes of a component is of major importance for many safety analysis techniques such as Fault Tree Analysis, Failure Modes and Effects Analysis etc. that are widely used in engineering sciences for the development of high assurance safety critical systems. The contribution of this paper is a method for systematically constructing the failure modes of a system hand-in-hand with its specification. Furthermore, if the intended behavior is given by a (non failure-sensitive) formal specification, we can even formally verify the completeness of the list of failure modes. We illustrate the method with three simple examples.