Functional Failure Path Analysis

RTC A/DO-254 defines Functional Failure Path (FFP) as the specific set of interdependent circuits that could cause a particular anomalous behaviour in the hardware that implements the function or in the hardware that is dependent upon the function. FFP Analysis (FFPA) is used to iteratively decompose the hardware functions into a hierarchy of subfunction to determine if it will be possible to fulfil completely the objectives of RTCA/DO-254 for each subfunction. If the assurance lifecycle data available or expected to be available is complete, correct and acceptable per the RTCA/DO-254 objectives and guidance, then no further decomposition is necessary. If it is not, then decomposition continues until such a stage as the FFP feasibly maps to one of the Development Assurance methods (and associated data set) as described in the previous section. For FFPs that are not Levels A or B, their interrelationships with the Level A or B FFPs should be evaluated using an F-FMEA, common mode analysis or dependency diagram to ensure that the Level A and B FFPs cannot be adversely impacted by the FFPs which are not Level A or B. 

FHA is a powerful, efficient, and comprehensive system safety analysis technique for the discovery of hazards. It is especially powerful for the safety assessment of software. Since software does not have discrete failure modes as hardware does, the best way to identify software-related hazards is by evaluating the effect of potential software functions failing. Software is built upon performing functions therefore, FHA is a very natural and vital tool. After a functional hazard is identified, further analysis of that hazard may be required to determine if the causal factors of the functional failure are possible. Since the FHA focuses on functions, it might overlook other types of hazards, such as those dealing with hazardous energy sources, sneak circuit paths, and hazardous material (HAZMAT). For this reason, the FHA should not be the sole HA performed, but should be done in support of other types of HA, such as PHA and SSHA. 

An evaluation of the confinement functions in the HCF must consider the state of the confinement structures, and the potential flow and/or leakage paths that would result in dose consequences to either on-site or off-site personnel. Two outside evaluations of the seismic performance of HCF SSCs form the basis for this DBE analysis. The first, performed by Walla Engineering Ltd in December 1998, was an evaluation of the east shield wall of Zone 2A. This wall has the greatest potential for failure in a seismic event of ail of the basement concrete structural elements, since it is unrestrained at the top. The second evaluation is a qualitative assessment of several SSCs performed by Chavez-Grieves based on an on-sHe inspection, reported in memorandum format dated May 18,1999. 

A fault propagation method used to analyze failure rate or probability for safety instrumented functions. A diagram is constructed to represent the system under consideration including the logical relationships between its components. In Markov analysis there are a group of circles, each of which represents a system state. The different states are connected with transitions, which are shown as arrows and indicate paths to move from one state to another. The transitions are quantified using either failure rates when the transition is from an acceptable state to a failed state or... 

At runtime, the nominal model is injected with the faults. Additionally, an observer automaton for the analj d requirement is generated and injected in the model. The resulting overall model is finally translated to the VIS format and passed to the model checker. The analysis identifies all state sequences leading from the set of initial system states over the activation of faults to the observation of the violation of the functional requirement. These paths are the basis for computing the set of minimal cut-sets leading to the failure. 

Sneak circuit analysis (SCA) is used for evaluating electrical circuits, with the intention of identifying latent (sneak) circuits and conditions that inhibit desired functions without component failure having occurred. Sneak circuits can occur in all types of electrical and electronic systems, so SCA is required for high-reliability systems. Sneak circuits can create sneak paths (which allow current to flow along an unexpected route) or sneak timing (which causes functions to be inhibited or to occur unexpectedly). 

A structured, top-down, iterative analysis which identifies functional paths and associated failures. 

---