System safety failure modes

An analysis of a system s failure modes may determine that some could trigger a hazard - these failure modes are safety-related and are likely to represent causes. In contrast those which would not typically lead to harm will be not safety-related . Depending on the relative degree of risk it may be necessary to justify the reason for a failure mode not being safety-related. 

Two types of analytical methods are used to evaluate hazards 1) preliminary hazards analysis (PHA), and 2) failure modes and effects analysis (FMEA). PHA is an accident scenario-based form of analysis. The FMEA is a complementary type of evaluation that utilizes a system failure-based form of analysis. Generally, FMEAs were only accomplished for equipment which was perceived to have a significant safety role, i.e. SSCs which were anticipated to be designated as safety significant in accordance with DOE-STD-3009. Unlike PHA, the first objective of FMEA is to subdivide the facility into several different (and, to the maximum extent possible, independent) system elements. Failure modes of each system element are then postulated and a structured esramination of the consequences of each failure mode follows. However, similar to PHA, FMEA. documents preventive and mitigative features (failure mechanisms and compensation) and anticipated accident consequences (failure effects). This appendix documents the FMEA for the HCF. 

Keywords safety and security analysis, vulnerability and effect analysis, FMEA, FMVEA, cyber-physical system (CPS), failure mode, threat mode, intelligent vehicle. 

In system safety, parts and components are of prime interest because it is often their unique failure modes, within unique system architectures, that provide the IM for certain hazards within a system design. Failure mode and effects analysis (FMEA) and FTA typically deal with the system at the part or component level in order to determine the risk presented by a particular hazard. When an FTA is performed to determine the causal factors for a particular hazard or UE, the FTA is generally conducted to the part level. Failure rates can be obtained for parts, which can be used in the FTA to generate a quantitative result. 

Process Hazards Analysis. Analysis of processes for unrecogni2ed or inadequately controUed ha2ards (see Hazard analysis and risk assessment) is required by OSHA (36). The principal methods of analysis, in an approximate ascending order of intensity, are what-if checklist failure modes and effects ha2ard and operabiHty (HAZOP) and fault-tree analysis. Other complementary methods include human error prediction and cost/benefit analysis. The HAZOP method is the most popular as of 1995 because it can be used to identify ha2ards, pinpoint their causes and consequences, and disclose the need for protective systems. Fault-tree analysis is the method to be used if a quantitative evaluation of operational safety is needed to justify the implementation of process improvements. 

Eault tree analysis (ETA) is a widely used computer-aided tool for plant and process safety analysis (69). One of the primary strengths of the method is the systematic, logical development of the many contributing factors that might result ia an accident. This type of analysis requires that the analyst have a complete understanding of the system and plant operations and the various equipment failure modes. 

Eailure Mode and Effects Analysis (EMEA) A failure identification methodology where the failure modes of a component sub-system are identified. An analysis of these failure modes on the safety of the entire system is performed. 

Common-mode failure Avoid common-mode failure possibilities with services, control systems, safety systems etc. 

Effects. For each identified failure mode, the PrHA team should describe the anticipated effects of the failure on the overall system or process. The key to performing a consistent FMEA is to assure that all equipment failures are analyzed using a common basis. Typically, analysts evaluate effects on a worst-case basis, assuming that existing safety levels do not work. However, more optimistic assumptions may be satisfactory as long as all equipment failure modes are analyzed on the same basis. 

Now all the minimum pieces are theoretically in place to confirm or refute a hypothesis. For many simple and straightforward failures, general knowledge of the component failure mode behavior, used in conjunction with the specific information gathered for a particular incident, may be sufficient to diagnose the causes. However, most process safety incidents are complex in nature and have multiple underlying system causes. Therefore, a systematic deductive approach is usually appropriate. 

The Failure Mode and Effect Analysis (FMEA) is based on the systematic analysis of failure modes for each element of a system, by defining the failure mode and the consequences of this failure on the integrity of that system. It was first used in the 1960s in the field of aeronautics for the analysis of the safety of aircraft [15]. It is required by regulations in the USA and France for aircraft safety. It allows assessing the effects of each failure mode of a system s components and identifying the failure modes that may have a critical impact on the operability safety and maintenance of the system. It proceeds in four steps ... 

DeRosier J, Stalhandske E, Bagian JP, et al. 2002. Using health care failure mode and effect analysis The VANa-tional Center for Patient Safety s prospective risk analysis system. Joint Comm J Qual Improv 28 248. 

Failure Modes and Effects Analysis (FMEA) and its variants have been widely used in safety analyses for more than thirty years. With the increase of application domain of software intensive systems there was a natural tendency to extend the use of (originally developed for hardware systems) safety analysis methods to software based systems. 

FMEA is focused on safety consequences of component failures. Identified failure modes of a component are analyzed case by case. The analysis process results in an explicit and documented decisions that take into account the risk associated with a given failure mode. The decision can be just the acceptance (supported by a convincing justification) of the consequences of the failure or it can suggest necessary design changes to remove (or mitigate) the consequences or causes of the failures. Documentation is an important output of FMEA. This documentation can be then referred to by a safety case for the considered system. 

We chose Level 2 as the reference level during our analysis that means that by safe we understand that the system is compliant with the railway safety regulations. And we chose Level 6 as the lowest component level (we did not consider further decomposition levels). Our goal was to analyse how possible failure modes of the components can affect the safety properties expressed with respect to Level 2. 

The list of selected failure modes is an input to the failure mode injection campaign. The objective of this step is to analyze the consequences of each particular failure mode on the system safety properties. Each failure mode is modeled by altering the CSP specification of the system. 

After injecting a failure mode into the system specification we check, using the FDR tool, for its safety consequences. 

If the verification confirms that the analyzed failure mode has no negative effects on system safety, the failure mode can be accepted. In the opposite case however we know that the failure mode, if actually occurs, can affect the system safety properties. In such case FDR can provide example event scenarios that lead to a contradiction of safety. Those scenarios can then be very helpful while considering possible redesign of the component objects. The results of the failure mode injection campaign are collected in the OF-FMEA tables (see Table 1). 

Cichocki, T. and J. Gorski, Failure Mode and Effect Analysis for Safety-Critical Systems with Software Components, in Floor Koomneef, Meine van der Meulen (eds.) Computer Safety, Reliability and Security, Proceedings of 19th International Conference SAFECOMP 2000, Rotterdam (The Netherlands), October 24—27, 2000, Springer Lecture Notes in Computer Science 1943, p. 382-394. 

The process hazards analysis is conducted by an experienced, multidisciplinary team that examines the process design, plant equipment, operating procedures, and so on, using techniques such as hazard and operability studies (HAZOP), failure mode and effect analysis (FMEA), and others. The process hazards analysis recommends appropriate measures to reduce the risk, including (but not limited to) the safety interlocks to be implemented in the safety interlock system. 

---