Integration of systems design and risk management through model‐based systems development

SARISTU morphing wing is mainly based on three devices: enhanced adaptive droop nose (EADN), adaptive trailing edge device (ATED) and winglet active trailing edge (WATE). All these devices are used together to improve the overall wing efficiency and to reduce the aerodynamic noise. The safety activities described in this paper were performed to verify whether this concept can comply with the standard civil flight safety regulations and airworthiness requirements. The safety analysis was performed in two steps: a functional hazard assessment (FHA) and a system safety assessment (SSA). Both analyses were performed at wing integration level (IS12) and at single morphing wing devices level. A complete mapping between these two levels of analysis was structured from the beginning of the process, starting from the aircraft functional definition, to integrate and harmonize both FHA and fault trees results. FHA was used to assess the severity of the identified Failure Conditions and then allocate safety requirements. Fault tree modelling technique was used to verify the compliance of the system architectures to the quantitative safety requirements resulting from the FHAs. The paper sets out the hypotheses and common data used by the fault trees. A complete but simple example illustrates the safety approach all through the different steps of the safety methodology. Other safety activities commonly performed in the aeronautical field such as the particular risk analysis (PRA), common mode analysis (CMA) and zonal safety analysis (ZSA) were identified in the frame of SARISTU project. This paper concludes with a summary highlighting the main results of these safety activities with some lessons learned from the safety approach adapted to SARISTU context.

Most of the functions of civil aircraft are achieved through software at present. Therefore, the safety of airborne software has become an important part of safety analysis. However, to achieve complex functions, the onboard software becomes very complicated, and it is usually difficult to guarantee safety. ARP4761(Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment) is an important safety assessment guideline for civil aircraft, but it believes that software development can satisfy safety as long as the software development process complies with the software development standards, instead of incorporating the software into the safety analysis process. To improve airborne software safety, this paper proposes a safety analysis method based on the ARP4761 process which is tailored to adapt to the software. In the software requirements and design, the method uses FHA(Functional Hazard Assessment) to analyze the hazards of the software and define the hazard levels, then use FTA(Fault Tree Analysis) to build a software fault tree, and carry out CCA(Common Cause Analysis) analysis based on the fault tree; after the software development is completed, the method uses FMEA(Failure Modes and Effects Analysis) and FMES(Failure Modes and Effects Summary) to summarize the failures of the software and return these failures to the fault tree to determine whether the software can meet the defined requirements. At the end of the article, an anti-icing software is used as an example to explain the process and effectiveness of the method.

This chapter provides an introduction to the steps involved in creating dependable systems. This starts with a description of functional hazard assessment (FHA). The steps involved in preliminary system safety assessment (PSSA) and system safety assessment (SSA) are reviewed. The chapter introduces fault tree analysis (FTA) and failure modes and effects analysis (FMEA) as important tools in the safety assessment process. This chapter also introduces the basics of probability theory which can guide quantitative assessment. The concepts behind common cause analysis are introduced. To make the book self-contained, more detailed mathematical concepts are presented in the appendices which can be skipped by less mathematically inclined readers.

In mountain areas, long linear transport infrastructures (roads, motorways, railways, etc.) are exposed to numerous natural hazards, especially hydrological and gravity-driven events such as slope instabilities, rockfalls, or torrential hazards. These phenomena can damage infrastructure, or even lead to the destruction of large sections, causing a risk for users and a deterioration of service. Infrastructure managers face several difficulties in handling these risks. One of them is identifying and representing them, due to the scale of the infrastructure, which is composed of numerous structures and exposed to multiple hazards. In this context, a model is proposed to represent all potential failure scenarios for such infrastructures. This model is based on system reliability analysis methods: functional analysis, failure mode and effect analysis (FMEA), and fault tree analysis (FTA). It is intended to be applied to a linear infrastructure, several kilometres long, exposed to various hazards. The proposed approach allows for the identification of all possible failure modes, including damage to structures and its functional consequences. Its applicability is being tested on a simple case study.

The advanced vertical lift aircraft demonstrator has been designed and analyzed to meet the requirements of the 2013-2014 American Helicopter Society International Design Competition request for proposal for a vertical take-off and landing experimental aircraft. Although the subject aircraft is a demonstrator aircraft, it is important to consider the effects of reliability in design due to the implications it has on possible future production versions of the aircraft. While there is little need for large life-times at this stage, a low maintenance footprint will eventually be desirable, and hover lift and drive systems would not have to be re-designed. Design recommendations for a reliable system are proposed. A preliminary systems safety assessment was used to set safety goals, which contributed to the analyses of three design options for the hover lift and drive systems. Operational and functional architectures are presented along with the function descriptions of the demonstrator. To classify functional importance, potential failure modes, and the criticality of their impact on the system, a functional hazard assessment was created. The analysis was performed based on reliability models including a Weibull distribution, mean time to failure, and failure time modeling, which were determined for each component of the system. A fault tree analysis and reliability block diagrams were created for the proposed transmission lift systems, and their results were compared. In addition, a stochastic petri analysis was performed to model one year of projected operations of a production version of the demonstrator aircraft, where the dynamic changes allowed understanding of how the redundancy inherent in the aircraft would affect mission failure rates. These analyses were followed by an operational availability assessment and calculations for maintenance free operation periods of the proposed lift and drive systems.

This paper addresses the problem of assessing the severity based on UML artifacts and uses the cost of failures of software components and connectors as well as failures of system execution scenarios. It proposes a severity assessment methodology that is performed combining three different hazard analysis techniques: functional failure analysis (FFA), failure mode and effect analysis (FMEA), and fault tree analysis (FTA). This process of estimating severity can be automated in development environments supporting UML by annotating the hazard analysis results and the cost of failure information in the UML diagrams. This methodology is useful for reliability-based risk assessment, performance-based risk assessment and requirement-based risk assessment of software systems.

Objective To investigate IMRT planning process using the combined application of failure modes and effects analysis (FMEA) and fault tree analysis (FTA) by reference to the report of Task Group 100 of the AAPM, and stablish and optimize the quality. Methods A multidisciplinary team detailed the process mapping of IMRT planning using Eclipse TPS. The team evaluated the potential failure modes (FMs) of every process step. The evaluation was divided into two groups according to whether quality management (QM) was considered. For every FM, occurrence (O), severity (S) and detectability (D) by consensus were evaluated, and the product of O, S and D yielded the risk priority number (RPN), which permitted the ranking of the FMs. Finally, FTA was used to determine the root factors contributing to the riskiest failure modes. Results The IMRT plan process consisted of 10 major sub-processes and 33 steps, which amounted to 47 failure modes. For the group without quality management, the RPN of FMs was between 13.2-271.8, 27 of which had RPN≥80, and 18 FMs had S≥8. For the group with quality management, the RPN of FMs was between 11.2-158.4, 11 of which had RPN≥80. The difference of RPN between the two groups was statistically significant (RPN of the group without QM=101.17±66.34, RPN of the group with QM=59.54±35.64, t=8.501, P<0.05). Finally, FTA was used to determine the root factors contributing to the FMs, i. e., prescription dose definition and importing images. Conclusions The FMEA and FTA methods are operable and practical, which can systematically and comprehensively analyze the potential failures and risks existing in the process of IMRT plan. And the FMEA and FTA can contribute to establish and optimize the quality management program in radiotherapy. Key words: Intensity modulated radiotherapy; Failure modes and effects analysis; Failure tree analysis; Quality management

&lt;div class="htmlview paragraph"&gt;Fault tree analysis (FTA) evolved from the aerospace industry in the 1960’s. A fault tree is deductive logic model that is generated with a top undesired event in mind. FTA answers the question, “how can something occur?” as opposed to failure modes and effects analysis (FMEA) that is inductive and answers the question, “what if?” FTA is used in risk, reliability and safety assessments. FTA is currently being used by several industries such as nuclear power and chemical processing. Typically the automotive industries uses failure modes and effects analysis (FMEA) such as design FMEAs and process FMEAs. The use of FTA has spread to the automotive industry. This paper discusses the use of FTA for automotive applications. With the addition automotive electronics for various applications in systems such as engine/power control, cruise control and braking/traction, FTA is well suited to address failure modes within these systems. FTA can determine the importance of these failure modes from various perspectives such as cost, reliability and safety. A fault tree analysis of a car starting system is presented as an example.&lt;/div&gt;

The paper studies the methods applied in risk management and estimation. The brainstorming techniques, Delphi, the method of event tree analysis (ETA) and fault tree analysis (FTA), failure modes and effect analysis (FMEA), hazard and operability study are wide used. The pros and cons of risk management methods applied in world practice by leading companies were analysed. As a technique based on the study of logical connection between the hazardous events, “Tree event” method has its advantages. At the same time, the failure modes and effect analysis differs with simplicity and accessibility. It was defined that this technique is used as one of the most important tools in risk management almost in all spheres including petrochemistry and power economy. It is recommended to use HAZOP method in the analysis of project solutions and for risk estimation in later design stages. It is pointed out that in the context of improvement of risk management system, more qualitative risk estimation, the employment of advanced methods plays a significant role for goal achievement in the company and project decision-making as well.

Using safety assessments to assure system functions during development reduces risks and prevents the loss of resources and lives during operation. In the EU-project ACTUATION 2015, a survey was conducted regarding the safety assessment methods applied during the development processes in aviation. One result of the survey is that safety assessment methods are applied late, although topdown methods such as fault tree analysis could be used quite early in the development process. But, safety knowledge of systems engineers is limited in most cases. Therefore the cooperation with safety experts is required. The solution of the addressed problem requires an early data exchange between system and safety engineering. A part of an electronic flight control system is used as an example to show the proposed process.

In this paper, we introduce the overview of the requirements and the complementary information on the evaluation of containment functional failure frequency (CFF) in the revised version of “A Standard for Procedures of Probabilistic Risk Assessment of Nuclear Power Plants during Power Operation (Level 2 PRA) “[1] in Japan, which was developed and revised at the Level 2 PRA Subcommittee under the Atomic Energy Society of Japan (AESJ). Although the Level 2 PRA standard includes the evaluation of CFF and radiological source terms, we explain only the evaluation of CFF in this paper. In the evaluation of CFF, the physical response analysis and the probabilistic analysis are included as follows. The accident progression analysis is performed for each of the plant damage states, considering the operation status of mitigation systems, thermal-hydraulic behavior and core damage progression, and occurrences of some key events such as reactor pressure vessel failure. The containment event tree (CET) is developed classifying the accident progress in tree diagram. In the CET, some headings are arranged sequentially considering the accident progression. The headings correspond to the phenomena occurrence and the systems operation status, and a branch probability is assigned at each branch of heading. The branch probabilities of the phenomena are evaluated by either the Risk Oriented Accident Analysis Methodology (ROAAM) or the Decomposition Event Tree (DET) analysis considering the containment threats. The branch probabilities on the phenomena are set as the probability distributions, because the phenomena and the analysis have uncertainties. The branch probabilities on the systems operation are evaluated using the fault tree analysis and human error analysis. The containment functional failure modes are assigned at the end state of the CET considering the type of load against containment integrity. For the evaluation of the non-energetic load, the integral codes such as MELCOR [2], THALES-2 [3], and MAAP4 [4] etc. are used. On the other hand, various mechanistic codes are used for the evaluation of energetic phenomena such as steam explosion. The containment functional failure is judged by comparing the ultimate strength or the fragility of containment structure and the generated loads. After all, the CFF can be obtained by summing the frequency of containment functional failure mode. In the Level 2 PRA standard in Japan, the requirements in each evaluation process above are described. In addition, the technical background and the examples as the complementary information on each requirement are described in the Annex of the standard to help the application of the standard. In this revision, the body is revised to clarify the requirements on the quantification of the CET. The Annex is revised to incorporate the up-to-date information on severe accident research and severe accident management (SAM) measures. The updated information includes the melt stratification (OECD/MASCA project [5]), the steam explosion (SERENA project [6] and PULiMS/SES experiments [7]), the ex-vessel debris coolability (OECD/MCCI project [8]), debris jet breakup, the melt spreading, the coolability of the particulate bed, and the containment vessel (CV) fragility evaluation. Some future challenges are extracted from the lessons learned from the Fukushima Daiichi accident, such as development of the Level 2 PRA for the external hazard as earthquake and tsunami, quantification of impact on the containment integrity of hydrogen detonation in the adjacent buildings, and human error evaluation in the external hazard.

The Italian construction sector suffered more than the other industrial sector the negative effects of the world economic crisis. A consequence has been a change in its organization concerning labour and managent on the health and safety issues. Evidence of this can be found in an increase of fatal accidents and occupational diseases. In particular occupational diseases became a health concern in construction. The aim of the presented research work is to assess the hazard of asbestos fibres inhalation due to decommissing of old industrial promises with roofing of asbestos. The developed approach starts from a probabilistic assessment of the risk, using the Risk Analysis tools, the Fault Tree Analysis (FTA) and the Failure Mode and Effect Analysis (FMEA). Risk assessment through the FTA is based on a backward approach: it starts from the malfunction of the system, called Top Event, in order to look for the triggering causes (events); on the contrary, the FMEA analysis is based on a forward approach: they start from a set of events and go on in order to analyse what kind of malfunctioning these can generate in the system. Both the FTA and the FMEA are applied to three approved decontamination techniques (encapsulation, confinement and removal), and for each of them operational phases, equipment, building products and PPE (Personal Protective Equipment) are evaluated highlighting the procedures needed to operate in complete safety. With this approach the main factors that contribute to the increase of the risk of asbestos fibres inhalation are detected: preliminary analysis and assessment of the state of building decay, the use and maintence of PPE and machinery, and the supervision during main working phases.

Quality assurance is a critical aspect in the production systems, affecting product quality and safety. Defects and failures of manufactured components will diminish overall product quality, which could vulnerably risk consumer safety. This study focuses on quality assurance analysis of train component manufacturing systems. According to the quality control data, the number of defects recorded was about 10-12, on average, for each wagon produced. The defect mainly occurred while making the underframes, car body, and even the small components. This led to the tardiness of product delivery for 1-2 months. This study aims to analyze non-conformance report data and identify the potential failure modes, potential effects, and root causes. To do so, we integrated systematically FMEA (Failure Mode and Effect Analysis) and FTA (Fault Tree Analysis). First, RPN (Risk Priority Number) score was calculated to determine risk priority. Second, Pareto analysis was performed to select defects that most contributing to overall failures, which were then analyzed using FTA to obtain root causes. The results show that 8 defects exceed the critical RPN score of 209. Materials and personnel are identified as two major contributor failure events from three selected defects. The recommendation for further improvements is provided based on various defect categories to prevent similar defects. The findings demonstrate that the combined use of FMEA and FTA is effective in identifying failures and root causes within complex and long production cycle systems.

Wind turbines are complex and expensive equipment, requiring high reliability and low maintenance costs. However, most of the existing fault tree analysis (FTA) methods for reliability analysis of wind turbines assume that the repair of wind turbines can restore them to as good as new condition, which is called perfect repair. This assumption may not be realistic in practice, as the repair may not fully recover the original performance or functionality of the equipment or may introduce new defects or errors. This phenomenon is called imperfect repair, which can reduce the reliability of wind turbines over time. To consider the imperfect repair effect in reliability analysis, we present a new FTA approach in this study. In order to predict and assess the failure intensity and dependability of wind turbines under imperfect repair, the proposed FTA technique uses a log-linear proportional intensity model (LPIM). Failure probability, failure rate, and mean time to failure can all be improved with the suggested FTA technique for wind turbines operating with poor repair. The proposed FTA method can also identify the critical components or failure modes most affected by the imperfect repair effect and suggest preventive maintenance actions to improve the reliability of wind turbines. We demonstrate the applicability and effectiveness of the proposed FTA method through a case study on a real or hypothetical wind turbine system under imperfect repair. The findings indicate that the proposed FTA method offers a more precise and authentic assessment of the reliability of wind turbines in the presence of imperfect repair, in contrast to existing FTA methods that assume perfect repair. The findings also demonstrate that the electrical system, hydraulic system, gearbox, generator, and blade are the most critical components or failure modes affecting the system's reliability.

Nowadays risk management is a carefully planned process. The task of risk management is organically woven into the general problem of increasing the efficiency of business. Passive attitude to risk and awareness of its existence are replaced by active management techniques. Risk assessment is one of the most important stages of risk management, since for risk management it is necessary first to analyze and evaluate risk. There are many definitions of this notion but in general case risk assessment refers to the systematic process of identifying the factors and types of risk and their quantitative assessment, i.e. risk analysis methodology combines mutually complementary quantitative and qualitative approaches. Purpose of the work: In this paper we will consider as risk assessment technique Fault Tree analysis (FTA). The objectives are: understand purpose of FTA, understand and apply rules of Boolean algebra, analyse a simple system using FTA, FTA advantages and disadvantages. Research and methodology: The main purpose is to help identify potential causes of system failures before the failures actually occur. We can evaluate the probability of the Top event.The steps of this analize are: the system's examination from Top to Down, the use of symbols to represent events, the use of mathematical tools for critical areas, the use of Fault tree logic diagrams to identify the cause of the Top event. Results: In the finally of study it will be obtained: critical areas, Fault tree logical diagrams and the probability of the Top event. These results can be used for the risk assessment analyses.