Abstract: A method of modelling the effect of a fault on the behaviour of a system. The method comprises modifying a functional model of a system to specify a fault in the system; running the model in accordance with a test, the test having an input and an expected output, the input defining the value of a least one input variable over a period of time and the expected output defining the expected value of at least one output variable over the period of time; the functional model calculating, in dependence on the value of the input variable defined by the input, a modelled output comprising the modelled value of the output variable over the period of time; and comparing the modelled output with the expected output to determine a severity score for the fault based on the difference between the modelled output and the expected output.