Fault Tree Analysis component designers

Instrumentation and Control (I C) systems are very often subject of probabilistic examination either within separate structural reliability analysis or Probabilistic Safety Assessment of a whole technological complex (e.g. Nuclear Power Plant). Use of programmable components in the design of these systems represents a challenge and utilizes the methods, which have been developed for components with a different behaviour. The typical method used for above mentioned examination is Fault Tree Analysis (FTA) (Vesely et al., 1981). The way of software faults modelling within Fault Trees vary a lot between particular models and there is no generally accepted modelling technique. 

This paper is organised as follows. Section II describes the transceiver architecture of the BTM, on the one hand the functional blocks and on the other one the BIST topology. Section III includes a summary of a Fault Tree Analysis (FTA) and a Failure Mode and Effect Analysis (FMEA) of the design. The components reliabihty data and the results of the analysis are shown in section IV Finally, conclusions are drawn in section V... 

The SSHA evaluates hazardous conditions, on the subsystem level, which may affect the safe operation of the entire system. In the performance of the SSHA, it is prudent to examine previous analyses that may have been performed such as the preliminary hazard analysis (PHA) and the failure mode and effect analysis (FMEA). Ideally, the SSHA is conducted during the design phase and/or the production phase, as shown in Chapter 3, Figure 3.4. However, as discussed in the example above, an SSHA can also be done during the operation phase, as required, to assist in the identification of hazardous conditions and the analysis of specific subsystems and/or components. In the event of an actual accident or incident investigation, the completed SSHA can be used to assist in the development of a fault tree analysis by providing data on possible contributing fault factors located at the subsystem or component level. 

Analysis of a fault tree can be no better than the events identified for it. A major limitation of fault tree analysis is failure to identify all the events that may lead to a top event. Failure to include an event may simply be oversight. However, it may also be a lack of experience and knowledge of the system and its behavior or potential behavior. Early in the design and development of a system it is difficult to anticipate failures and undesired events. Team members may not have insight into the possible failures in the future. Team members may have limited knowledge and experience with materials and components that make up a system. 

Those are also typical questions for deductive methods such as HAZOP or the fault tree analysis (FTA). The malfunctions (or error modes) also show in the tables of ISO 26262, part 5, Appendix D, which represent the foundation for the diagnostic coverage. Which of those error modes are relevant depends on the requirements and their context which are imposed on the functions. This is why at this in-depth level not only the architecture is analyzed but also the design and the realization. Therefore, such analyses are often on lower component level and performed by means of a Design-FMEA and define the basis for the design verification and validation (DV). 

This approach is based on a safety analysis, often used for safety critical systems. The safety analysis performed at each stage of the system development is intended to identify all possible hazards with their relevant causes. Traditional safety analysis methods include, e.g. Functional Hazard Analysis (FHA) [1], Failure Mode and Effect Analysis (FMEA) [2] and Fault Tree Analysis (FTA). FMEA is a bottom-up method since it starts with the failure of a component or subsystem and then looks at its effect on the overall system. First, it lists all the components comprising a system and their associated failure modes. Then, the effects on other components or subsystems are evaluated and listed along with the consequence on the system for each component s failure modes. FTA, in particular, is a deductive method to analyze system design and robustness. Within this approach we can determine how a system failure can occur. It also allows us to propose countermeasures with a higher coverage or having wider dimension. 

In this figure, the seleeted initial event can be selected from the design environment, or ean be extracted by applying automated HAZOP, which highlight list of top events that may eause hazard. In this case, product flow rate (F ) is low has been selected as the initial event. The result of the fault tree analysis as generated by CARA shows total of six cut sets up to order four. The results of the fault tree are fed back to HE Results database as associated with each plant physical object. The relationships among proeess variable, fault, component, and failure are used in the automation of generating the fault tree results. The minimum eut sets represents the different seenarios for the occurrence of the top event (output product flow rate is low). 

The next step in the risk assessment process is to identify accident scenarios and develop the initiating events for those scenarios. A hazard analysis was performed and various hazards were identified. Of the hazards identified, the most significant were related to the uncontrolled release of cryogenic fluid or gas. With that information, a fault tree was constructed for the system with the top event designated as uncontrolled cryogenic release. An FMEA was performed on those components that were determined to be critical to the fault tree. 

The aim of this brick is to support local FMEA (Failure Mode and Effects Analysis) on the model elementary components and to generate automatically Fault Trees. Using a system functional design or its physical architecture model by any interoperability mean (lOS), the user performs a local analysis inside Safety Architect, by linking failure modes of the outputs of the components to the failure modes identified on the component inputs. During the local analysis, the user also analyses the effects of internal failures of the component on its outputs. 

This involves assessing the design, by means of reliability analysis techniques, to determine whether the targets can be met. Techniques include fault tree and logic block diagram and FMEA analysis, redundancy modeling, assessments of common cause failure, human error modeling, and the choice of appropriate component failure rate data. Reliability assessment may also be used to evaluate potential financial loss. The process is described in Work Instruc-tion/001 (Random hardware failures). 

In the following section, design structuring matrices are used in combination with a sequencing algorithm to prevent such loops or cyclic dependencies in component-based safety analysis models such as component fault trees. 

Common cause failures are described in Section 2.2.3.4 as simultaneous failures of multiple components due to some underlying common cause, such as design errors or environmental factors. Common cause events can be placed directly on fault trees for analysis. Engineering judgment is used to determine which common cause events are important enough to include. It is not possible to include all conceivable combinations of common cause events due to the number of components involved. For example, the number of combinations of motor-operated valves in a plant that could fail from a common cause is almost endless. Standard practice is to consider common cause combinations across multiple trains of single systems, but with a few exceptions not across multiple systems. 

Qualitative reliability analysis are used to identify possible ways in which a system can fail. The calculation can result in all combinations of components and human failures that lead to safety (protection) system failure, which prevents the safety system to shut-down the reactor upon request. For this analysis a top-down logic model, known as a Master Logic Diagram (MLD), similar to a fault-tree, could advantageously be used with a top event of a safety system failure upon request. The results of this analysis can be used to prove the fulfillment of the important single failure design criteria. 

Usually the HAZOP study is used to generate the top events for the analysis tree especially in the initial plant design stage. In order to construct the FTA for the possible fault scenarios the plant structural class model has been constructed, which explains the inheritance from the top structural element (metaclass) Plant Structural Entity up to the smallest physical structural components (i.e. valve), indicating the association of the possible failures or faults with each model element, as shown in figure 3-14. 

---