Safety

1/h

The rate of natural death is about 1 E-4 per year (=1E-8/h)

Severity - How bad are the consequences?

Frequency - How likely/often does this happen

—> Risk: Combination of Frequency and Severity

—> Safety: Acceptable Risk

State of an item consisting of the non-performance of specified requirements by a characteristic of an item.

Inability of an item to perfrom its intended function

1. An occurence arising as a result of an incorrect action or decision by personnel operating or maintaining a system

2. A mistake in requirements, design or impplementation

Number of failures per given timespan

Probability of observing a certain failure in a given timespan.

Safety: Degree of protection against non-malicious danger

Security: Degree of protection against malicious danger, damage and crime

Structured approach to safety:

• Evidence for certification

• Predict likelihood of failures

• Prevent risk

• Develop safe systems

When evidence shows that the boundary probability is met.

Single-Point failures

Comprehensive list of Failure modes and Effects of System Level

Severity Classification

Check if the system architecture complies with the regulations

Quantitative:

• failure prob.

• integrity

• Monitoring performance

Qualitative:

• no single point failures

• Protective features (brakes on axels)

• DAL

• Operational Limitations

Acceptable prob. for loss of A/C: 10^-6

100 systems in each A/C

ca. 10% of all accidents due to technical issue

Condition with an effect on the aircraft and its occupants, both direct and consequential, caused or contributed to by one or more failures.

Example: A/C enters uncontrolled flight

The way in which the failure of an tiem occurs

Example:

• Resistor burnout

• Linkage broke

Description of the operation of an item as the result of a failure.

Example:

• Integrity lost

• No force on control surface

Validation: Determines if the requirements are correct, complete and consitent

—> Are we building the right system?

(FHAs and Preliminary Assessments)

Verification: Determines if the requirements are met

—> Are we building the system right?

(Safety Assessments)

• Failure rate is assumed constant (Bathtub curve)

• Failure rate is very small —> No Integral

• Initial correctnes: 1

• Initial failure: 0

N - Degree of redundancy

Tp - Passivation time

tm - Mission time

Classification in detected and undetected failures

Graphical representations of the chain of events

+ Single Point failures are obvious

- Interdependencies are unclear and hard to see

- No repairability

Serial events: sum

Parallel events: product

Set of events neccessary to cause the top event, where every removed event leads to the top event not occuring.

Graphic visualization of all possible causes for the top event.

+ Shows all paths to top event

+ Single points of failure are obvious

- Interdependecies are hard to see

- No repairability

Gates:

Events:

And Gate: product

Or Gate: sum

Failure Modes Effects (and Criticality) Analysis

• Failure Modes —> Failure effects on next level

• Determination of Probabilities for each Effect

• Verification of design and requirements

Failure Mode and Effects Summary

• Summarize failure modes with the same effect

• Overview of FMEA results

• Functional Block (Filter, …)

• Board

• Component

• Device

A single failure, error or event that can produce undesirable effects on two or more systems, equipment, items or functions.

Confirms independence or acceptable dependance of events

Questionaire

• Common ressources?

  • Power

  • Hydraulic

  • Network, Interface

  • Processing

  • Data, Storage, Databases

  • Sensors

• Development and design

  • Specification

  • Tools, Processes

  • Teams

• Implementation

• Manufacturing and installation

• Operation and maintenance

CMA on Fault Tree:

• Replace AND with OR gates and check if Top event is compromized

• Determine independence of inputs

Specific studies of events to examine their simulanious and cascading effects (lightning, bird strike)

Examine relations of failures in adjacent systems (e.g. avionics bay)

Common modes include:

• HW or SW development

• Installation, manufacturing

• Maintenance and repair

• Cascading faults (overload due to loss of component)

• Shared ressources (power, hydraulics)

Analysis into failures, errors or events that can produce undesirable effects on two or more systems, equipment, items or functions.

Consists of:

• Common Mode Analysis (CMA)

• Particular Risk Analysis (PRA)

• Zonal Safety Analysis (ZSA)

Equipment:

• Fire, Thermal runaway

• Leak

• Burst of pressure vessel

External

• Bird strike

• Hail, Ice, Snow, Lightning

Structure

• Rapid decompression

System Theoretic Accident Model and Processes:

• Modeling of complex systems

• Representation as hierarchical control structure

Safety = System constraints

Accident = Violation of constraints

Examines System as a whole incl. Interactions

1. Identify Losses and Hazards: Unacceptable outcomes (=FC) and hazards that can lead to those (=FMs)

2. Model the hierarchical control structure

3. Identify unsafe control actions (UCA)

   • Not providing neccessary CA

   • Providing CA that creates a hazard

   • Provide CA at the wrong time or sequence

   • Providing CA too long or stopping too soon

4. Identify Loss Scenarios: Examine how UCA can occur