Analysis of dependent failure

Analysis of Dependent Failure Events and Failure Events Caused by Harsh Environment Conditions Nuclear 700 events representing common cause failures and failures caused by harsh environments Licensee Event Reports on failures of 26 component and subcomponent types listed below 94. 

TITLE Analysis of Dependent Failure Events and Failure Events Caused by... 

Fleming, K. N., A. Mosleh, and A. P. Kelley (1983). On the analysis of dependent failures in risk assessment and reliability evaluation. Nu-clear Safety 24 5), 637-657. 

Requirements decomposition with respect to ASIL taHorlng 9-7 Analysis of dependent failures... 

ISO 26262 allows different ASIL for software in one microcontroller, and also having legacy software, software which have not been developed according a safety-standard or software from foreign sources in a sufficient separated environment. But except, to perform an adequate Analysis of dependent failure the standards provide no guidance. How to design fault-tolerant or even fail-operational architectures and designs and how to deal with such horizontal barriers are not considered in ISO 26262. 

Identification of cascading failure addresses ISO 26262 as part of the Analysis of Dependent Failure, but even it is only required for ASIL C and D, cascading failure could also lead in ASIL A and ASIL B applications to violations of safety goals. 

According to ISO 26262, part 9, Chap. 7, the target of the analysis of dependent failure (ADF) is to identify individual events or causes, which could lead to failure, override safety mechanism or undesired safety relevant behavior-. Following the requirements for analysis of dependent failure described in ISO 26262 would... 

ISO 26262 addresses the following objectives for the analysis of dependent failure ... 

The analysis of dependent failures aims to identify the single events or single causes that could bypass or invalidate a required independence or freedom from interference between given elements and violate a safety requirement or a safety goal. 

The analysis of dependent failures considers architectural features such as ... 

This addresses elements in general and does not somehow restrict as in flie list directly related to the analysis of dependent failure. It could be that it asks for the definition of internal and external interfaces of safety relevant elements in order to avoid adverse safety relevant effects on other safety relevant elements. However, without an analysis, this requirement cannot be met. This requirement can be found in part 4, which addresses the system development. However, there is no limitation for which elements this requirement should be applied. Positively seen, this requirement refers to previous example with the capacitor and transistor, since electronic components are also elements according to ISO 26262. On the other hand, this would mean that all electronic components, even the smallest software units, would need to be checked for troublesome, harming influences of other elements. The intended function and their safety mechanism need dependencies in case of failure of the intended function, but if the safety mechanism negatively affects the intended function, the safety mechanism weakens the system. But this is again a matter of design and realization, therefore a general question, why is the analysis of dependent failure only required for ASIL C and ASIL D functions or elements ... 

A quantitative analysis of the failure process was made by Duxbury et al (1987) by modelling the system by a lattice and we shall present their results. The simplest lattices were taken a square lattice in two dimensions and a simple cubic lattice in three dimensions, in which the bonds are all equal resistors to begin with. Each resistor can stand a current up to io. If i > io, the resistor is fused and becomes a perfect insulator. It is believed that the results are not dependent on the type of the lattice as it was proven in the case of percolation. The size of the lattice is L in two dimensions it... 

Another direction is to build models which will be more realistic. In all these models described above, the exact microscopic mechanism of the failure was not considered. But it seems very likely that the exact nature of the process will influence what happens after the first failure. Yagil et al (1992, 1993) observed that after the first failure (fuse), the resistance of the sample can get decreased or increased depending on the failure process. If increase is what one expects, then the decrease means that the first failure improves the contact between the parts which melt. Thus, only by a detailed analysis of the failure process can one understand it. To come back to the dynamic problem, it is also very likely that the velocity of the failure propagation will depend on the failure mechanism. 

In order to adequately treat dependent failures in a reliability analysis, secondary failures (1) and failures of components due to functional dependencies (2) are accounted for as far as possible by a detailed fault tree model. Common cause failures (3) require a separate treatment. The procedure for aU three failure types is explained below. Yet, before that possible causes of dependent failures are classified. 

A classification of dependent failures is helpful for their analysis. According to [49] we distinguish the following causes ... 

Julius, J., Grobbelaar, J., Rahn, F. 2005. Analysis of Dependent Human Failure Events Using the EPRI HRA Calculator. Proc. of the ANS Topical Meeting on Probabilistic Safety Assessment (PSA 05), San Francisco, CA, USA, II-I5 Sept 2005. 

Within HRA, the analysis of dependence between HFEs addresses the influence of the failure on one task on the performance of the subsequent task if two tasks are closely related in some fashion, the failure of the second task is more likely if the operators have failed in their performance of the first task, than if they have succeeded (Swain Guttman, 1983). 

The assessment of dependence has a significant impact on the overall results of a PSA, since the dependent failure probability may be an order of magnitude or more larger than the independent one. An appropriate assessment of dependence is thus mandatory to avoid underestimation of the risk and to ensure a realistic risk profile from the PSA results. Indeed, the ASME PRA Standard (ASME, 2002 and 2003) includes the analysis of dependence as a requirement. Dependence analysis is identified as a good practice inNUREG-1792 (USNRC, 2005). 

In a number of PSA studies worldwide, THERE is stiU used as an important tool of HRA nowadays. In NRI, THERE has been adapted to help in solution of some specific aspects of plant crew failures (maintenance failures with latent effects) and for detailed task-related probabilistic treatment of more complex scenarios (heavy load drops). An important area of THERE guidance is analysis of dependence among human failures within the same PSA accident sequence. The ASEP clone is currently used in NRI as one of the tools for quantification of manipulation failures in the tasks highly supported with procedures. 

The suspicious sources of dependent failures are both in reliability analysis and PSA screened out in the case of low probabdity. In some cases, however, the low probabihty - high consequence concept needs to be taken into accoimt and it would not allow leaving the... 

For each hardware assessment of PFDavg, there should be some consideration of dependent failure (ie common cause or common mode types of dependent failure) with other layers. For each of the human error probability assessments there should again be some consideration of dependent failure. Further guidance on this may be found in Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications NUREG/CR-1278. ... 

In the next step, criticality of each failure was assessed. Methodology applied for the assessment was FMECA. FMECA is a tool used to help on setting priorities for the definition of maintenance tasks based on the analysis of the failure modes of components and their respective effects in a system. The effects of a failure depend on ... 

In other words, if there isn t a sufficient independency between parts or function groups within hardware components, which aren t a part of the realization for the considered function group or considered element of the safety relevant functions, have to be considered for the design verification as well. It seems to be a similar analysis as later required as Analyses of Dependent Failure , but the requirement is relevant for all ASIL. 

The analysis of the failure types is very essential (error or failure modes, possible error behavior of characteristics of elements etc.). ISO 26262 mentions indications in the correlating appendices of parts 5 (attachment D) and 6 (attachment D) for the safety mechanisms, which need to be implemented. For a deductive analysis we can only determine the possible failure modes from the function, the characteristics of the function (parameter) as well as their relation to the environment. Error modes like no function, an incorrect function afimction too low or too high or drifts can be evaluated in the context of their Diagnostic Coverage for electronic parts (DC). Furthermore, sporadic (intermittent or transient) failure, oscillations or other dynamic failure are derived from the specified intended functions and their characteristics. How and in what way these errors propagate, depends on environmental conditions. Thus, in a... 

Safety and Reliability follows similar principles for the failure analysis. Especially dependent failure and their analysis did show that the typical sequences of fault, error, failure or failure cause, failure mode and failure effect are not always applicable. Similar challenges are affecting security analysis. Measures to control the different security threads like Integrity, Confidentiality and Availability show different relations to their possible effects and effectiveness. 

This consortium brings together the extensive experience of AEA Technology SRD in the use of software dependability analysis and dependent failures, the industrial experience of GEC Avionics in the development of high integrity and safety critical avionics systems and the experience of the Royal Holloway and Bedford New College in the state of the art formal methods research. 

---