Multiple-point fault

Fig. 4.47 FMEA for multiple system levels for control of multiple-point faults. (Translated Source Marcus Abele [2], Modeling and assessment of highly reliable eneigy and vehicle electric system architecture for safety relevant consumers in vehicles, 2008)...

NOTE Hardware elements whose faults are multiple-point faults with a higher order than two can be omitted from the calculations unless they can be shown to be relevant in the technical safety concept. 

NOTE 3 If the above estimations are considered too conservative, then a detailed analysis of the failure modes of the hardware element can classify each failure mode into one of the fault classes (single-point faults, residual faults, latent, detected or perceived multiple-point faults or safe faults) wifli respect to the specified safety goal and determine the failure rates apportioned to the failure modes. Annex B describes a flow diagram that can be used to make the fault classification. 

Identification within the boundary analyzed before all safe elements or parts, that mean, elements that could fail however, could not violate safety goals even in combination at least in second order (Multiple-Point-Faults). 

For all residual elements or parts, which have somehow the potential to violate given safety goals, it should be identified, if their fault-modes could propagate direct to a safety goal violation, than these fault-modes have to be considered as single-point faults, if only indirect or by order higher than 2 they are multiple-point fault. 

Fault Tree Analysis (FTA) is a well known and widely used safety tool, implementing a deductive, top down approach. It starts with a top level hazard, which has to be known in advance and "works the way down" through all causal factors of this hazard, combined with Boolean Logic (mainly AND and OR gates). It can consider hardware, software and human errors and identifies both single and multiple points of failure. Both a quantitative and qualitative analysis is possible. 

Fault-tree analysis (FTA) focuses on the identification of multiple point failures by using a deductive top-down method to analyze effects of initiating faults and events occurring in complex systems. FTA works very well, showing how complex systems can overcome single or... 

Design, when allowed, to minimize or eliminate single-point failures that have an undesired consequence. Make at least 2-fault tolerant, that is tolerant of multiple faults or system breakdown that would have adverse safety consequence. 

The importance of this case study is three-fold (1) to explain simple concepts, (2) comparison with the results discussed in the literature and, (3) to emphasize the ability to perform multiple fault diagnosis. The controlled tank and its SDG under the perfect control scenario are given in Figure 2 (a) and (b), respectively. fi and / are the inlet and outlet flowrates, respectively. L is the level of the liquid in the tank, kc is negative. The measurements are f , and CS. Diagnosis for two fault scenarios is discussed below. Positive sensor bias The observed pattern is [/<, Xm G5] = [0 0 +). Any fault in /< or set point is ruled out. The candidate faults are VPuas = (= X= 0 ) or Xm,bias = + (= X = - ). Further resolution cannot be achieved. 

Here we cannot go closely into the matter of the problematic of time intervals determination, that is the question of how to define the discrete points of time for a new calculation of the circuit states. Account has to be taken of components with different high speeds and occasionally even with rather slow speeds. Intermediate points of time are for example necessary to record completely the possible effects of single and multiple faults during the fault simulation. 

---