1 Overview

According to [Wikipedia],

Functional Safety is the part of the overall safety of a system or piece of equipment that depends on the system or equipment operating correctly in response to its inputs, including the safe management of likely operator errors, hardware failures and environmental changes.

Functional Safety Suite is intended for modeling and calculus in the field of functional safety. It supports the following methods:

Event tree analysis:
A flexible and therefore widely used method for quantitative risk analysis.
Fault tree analysis:
A universal method for qualitative and quantitative hazard analysis. In particular suitable for calculation of failure rates and unavailabilities of systems, that are characterized by complex homogeneous or in-homogeneous multi-channel architectures. This software also supports correct calculation of failure rates of elements, that may fail multiple times during system life time. The unreliability can be calculated as well.
Reliability block diagrams:
An alternative visualization of multi-channel structures, based on the same algorithms as used for fault trees.
Markov models:
Flexible method for quantitative hazard analysis of some time-variant systems, that cannot be described by fault trees. Each fault tree can be represented by a Markov model, but the Markov model is typically much more complicated, since its complexity increases exponentially with the number of basic events.
Complex component models:
Specific tool to calculate safety parameters of components with multiple time-variant failure modes, of whose some are safe, some dangerous. E. g. the typical “bath tub” curve of failure rates can be modeled.

Functional Safety Suite offers:

Functional Safety Suite aims to provide the maximum possible symmetry between fault trees and Markov models. Thus most fault trees can be converted automatically to a Markov model, correctly considering common cause failures and condition events.

Functional Safety Suite further aims to support the user in correct modeling. This is achieved by

1.1 Terms and abbreviations

Table 1: Terms and abbreviations


Term

Meaning





Basic event

An event related to an element. The basic events of a Markov model form the edges, the basic events of a reliability block diagram are the blocks, the basic events of an event tree are the cases (of a condition).



β

The common cause factor of an occurrence rate or probability.



Branch

In a fault tree: The part of the tree that is below the event including the event itself (including the special case that the event is a basic event and therefore the branch is just the basic event).



Block

The representation of a basic event or a reference in a reliability block diagram.



Case

The representation of a basic event in an event tree. This is one out of one or multiple values that a condition can take. Each case can be true or false, defined by a probability (typically an unavailability).



Component

A technical unit that can have several failure modes.



Condition

In an event tree: A constraint that can take at least two cases.



Condition event

A basic event that is characterized by a probability (typically an unavailability), but no occurrence rate.



D

duty cycle



Damage

In an event tree: The final state that can be reached in case of a hazard, characterized by its severity.



Edge

The representation of a basic event in a Markov model.



Element

Any component, human behavior or environmental condition that influences the behavior of the system with respect to the top event.



EUC

Equipment under Control, see definition in [EN 61508].



Event

A situation or a state that can occur related to an element, system or sub-system.



F(t)

The unreliability.



FT

Fault tree



FTA

Fault tree analysis



Generic basic event

The probabilistic model that describes the occurrence or existence of a basic event. It is stored in a library and thus can be used in multiple models.



Generic damage

A possible damage, defined within one event tree, saved in the .etf file.



h

The occurrence rate (also: occurrence frequency) with unit 1h. If h belongs to an event describing a failure, it is called (conditional) ‘failure frequency’ or (conditional) ‘failure intensity’ (CFI).



MRT

Mean repair time. If the overall system (i. e. the “EUC” in terms of [EN 61508]) is taken out of service immediately after detection of a failure, it is zero. If the overall system is still operated for a certain time (e. g. with only one channel instead of two) or if the overall system isn’t shut down at all, it is to be considered.



MTTD

Mean time to detect. Necessary for all kinds of dormant failures.



MTTF

Mean time to failure, and also the mean operation time between two failures.



MTTR

Mean time to restoration. Includes the MTTD and the MRT.



PFD

Probability of Failure on Demand, see definition in [EN 61508]. It is identical to the (mean) unavailability Q.



PFH

Probability of Failure per Hour, see definition in [EN 61508]. It is identical to the (mean) failure frequency, and thus the (mean) occurrence rate h.



PI

Short for ‘Prime Implicant’, the equivalent of a minimal cut-set for incoherent fault trees. For coherent fault trees, the prime implicants are identical to the minimal cut-sets. Please see relevant literature for more information.



Q

The unavailability.



RBD

Reliability block diagram



State

In a Markov model: A state that a system can take.



Sub-tree

A fault tree or a branch of a fault tree that is referred by a transfer-in gate in a (higher-level) fault tree. A sub-tree may contain references to lower-level sub-trees. Dividing a fault tree in several fault trees is useful, when a fault tree is too large to be displayed on one page, or if a branch of a tree is needed more than once.



System lifetime

The (mean) lifetime of the system in scope. Needed to calculate some values of complex components (see 10), for some basic event models (see 4), and as stop time for transient evaluation.



TFFR

Tolerable Function Failure Rate, the result of a THR apportionment and thus the safety requirement for a high demand or continuous mode safety (sub-)function of a (sub-)system. Also called “Tolerable Probability of Failure per Hour” (TPFH).



THR

Tolerable Hazard Rate, the result of a risk analysis for each identified hazard. If given in 1h, it is mathematically the same as the TPFH, but not each failure is a hazard.



Top event

The topmost gate of a fault tree, describing the (undesired) state that the system can enter due to the occurrence of one or several basic events.



TPFD

Tolerable Probability of Failure on Demand, the result of a THR apportionment and thus the safety requirement for a low demand mode safety (sub-)function of a (sub-)system.



TPFH

Tolerable Probability of Failure per Hour, the result of a THR apportionment and thus the safety requirement for a high demand or continuous mode safety (sub-)function of a (sub-)system. Also called “Tolerable Function Failure Rate” (TFFR).



Unavailability

The probability Q(t) that an element or system wouldn’t perform as intended, when it would be needed at time t (“on demand”). For non-repairable systems, the unavailability Q(t) is identical to the unreliability F(t), and both are called “failure probability”. For repairable systems (modeled e. g. by basic events of type ‘testable and repairable’ or ‘cyclic’), unavailability Q(t) and unreliability F(t) are completely different values, since the unavailability becomes zero with each (complete) test or repair, whereas the unreliability increases monotonously.



Unreliability

The probability F(t1,t2) that an element or system doesn’t perform as intended over a certain time interval t1t2. Usually t1 = 0 is assumed, thus F(t1,t2) is shortened to F(t) with t being t2 - t1 = t2.



w

The (unconditional) occurrence density considering restoration. In contrary to h it is unconditional with respect to whether the component is still available at time t. However it is not a ‘probability density’ (such as f(t)), since its integral over infinite time is greater than 1 in general. Its unit is 1h.
Note: Up to version 3.3 of this program, the symbol w has been used for the conditional occurrence frequency, which is now named h in coherence with most literature.





1.2 Conventions