Integrating safety analysis techniques, supporting identification of common cause failures

When we apply safety analysis techniques on a new design, our primary objective is to anticipate potential scenarios of failure in the system under examination. If we assume that the system has a complex hierarchical structure, this task can be interpreted as one of identifying how failures originate at the low-levels of the design and how combinations or sequences of such low-level failures propagate to higher levels and give rise to system malfunctions. The ultimate aim is to identify weak areas of the design and stimulate design iterations that improve the safety of the system under examination. Unfortunately, the current industrial practise shows that this aim is seriously hindered by the lack of appropriate techniques for the analysis of complex hierarchical designs. Classical safety analysis techniques, such as Functional Failure Analysis, Hazard and Operability Studies, Failure Mode and Effects Analysis and Fault Tree Analysis, are performed at different stages of the design lifecycle on the basis of models that reflect different levels of abstraction in the design. The selective and fragmented application of different methods, however, has a number of negative implications for the quality of the results gained from the assessment. Firstly, the results of the various safety studies are often inconsistent. Secondly, as hardware safety analysis and software hazard analysis typically form two separate parts of the assessment, the relationship between hardware and software failure often remains vague and unresolved. Finally there is an inherent difficulty in relating the results from low-level safety studies back to the high-level functional failure analysis. In the first part of this thesis we propose a new method for safety analysis that enables integrated safety assessment of complex hierarchical designs. It helps analysts to identify potential functional failures at the application level and then to systematically determine the causes of those failures in progressively lower levels of the design decomposition. The result of the assessment is a collection of safety analyses that provides a consistent and meaningful picture of how low-failures are stopped at intermediate levels of the design, or propagate and give rise to hazardous malfunctions. In the second part of this thesis we show how features of the new method support also effective common cause failure analysis. That is both the qualitative identification of components vulnerable to common cause failures and the quantitative estimation of the contribution of these events to critical failures of the system. This page is intentionally left blank