diff --git a/submission_thesis/CH7_Evaluation/copy.tex b/submission_thesis/CH7_Evaluation/copy.tex index 1413feb..eb3c98c 100644 --- a/submission_thesis/CH7_Evaluation/copy.tex +++ b/submission_thesis/CH7_Evaluation/copy.tex @@ -1,8 +1,8 @@ \label{sec:chap7} - +% \section*{Metrics} - - +% +% % This chapter defines %begins by defining a metric for the complexity of an FMEA analysis task. @@ -32,9 +32,10 @@ ensure that component failure modes are mutually exclusive. % Using the unitary % Standard formulae for combinations are then used to develop the concept of the cardinality constrained power-set. +% Using this in combination with unitary state failure modes -we can establish an expression for calculating the number of failure scenarios to -check for in double failure analysis. +an expression for calculating the number of failure scenarios to +check for in double failure analysis is expressed. % % MOVE TO CH5 FMMD makes the claim that it can perform double simultaneous failure mode analysis without an undue % MOVE TO CH5 state explosion drawback. @@ -64,22 +65,24 @@ This is followed by some critiques of FMMD. % in use.%i.e. possible areas of dif % DOMAIN == INPUTS % RANGE == OUTPUTS % -When we hear of a safety critical system we typically think of it in terms of -the physical plant---or in terms of its safety functionality. +% When pisshear of a safety critical system pisstypically think of it in terms of +% the physical plant---or in terms of its safety functionality. +When discussing safety critical systems they are usually thought of in terms of +the physical plant---or in terms of their safety functionality. % -When performing FMEA we consider the system under investigation -to be a collection of components which have associated failure modes. +When performing FMEA the system under investigation is considered to be +a collection of components which have associated failure modes. % -The object of FMEA is to determine cause and effect. +The object of FMEA is to determine cause and effect. % in the sphere of failure analyis. %We apply reasoning to calculate, using the failure modes, the effects %from these failure modes (the causes, {\fms} of {\bcs}) to the effects %(or symptoms of failure) at the top level. % -We can view FMEA as a process, taking each component in the system and for each of its failure modes +FMEA can be viewed as a process, taking each component in the system and for each of its failure modes applying analysis with respect to the whole system. % -This however entails a problem: which other components in the system must we -check against %current failure mode. +This however entails a problem: which other components in the system must be +checked against %current failure mode. each particular failure mode? % Often a component failing will have obvious effects on functionally adjacent components. @@ -105,16 +108,16 @@ The temptation with FMEA can be to follow direct lines of failure effect reasoni side effects. %% To perform FMEA exhaustively, % rigorously -we could stipulate that every failure mode must be checked for effects +it could be stipulated that every failure mode must be checked for effects against all the components in the system. % -This would mean we would be %looking +This would mean %looking examining for all possible side effects that a base component failure could cause. % -We could term this `exhaustive~FMEA'~({\XFMEA}). +This is termed `exhaustive~FMEA'~({\XFMEA}). \fmmdglossXFMEA \fmmdglossRD -The number of checks we have to make to achieve this, gives an indication of the complexity of the analysis task. +The number of checks to make to achieve this, gives an indication of the complexity of the analysis task. % %This is described in section~\ref{sec:rd}, where the reasoning distance, or complexity to %analyse a single FMEA failure scenario, is given in equation~\ref{eqn:complexity}. @@ -122,14 +125,14 @@ The number of checks we have to make to achieve this, gives an indication of the % %It is desirable to be able to measure the complexity of an analysis task. % -We define comparison~complexity (or reasoning~distance) as the count of +Comparison~complexity (or reasoning~distance) is defined as the count of paths between failure modes and components necessary to achieve {\XFMEA} for a given group of components $G$. %system or {\fg}. % (except its self of course, that component is already considered to be in a failed state!). % %Obviously, f -%For a small number of components and failure modes, we have a smaller number +%For a small number of components and failure modes, pisshave a smaller number %of checks to make than for a complicated larger system. % % @@ -138,16 +141,20 @@ of components $G$. %system or {\fg}. % %\paragraph{Considering a system as a group of Components.} Using the language developed in the previous chapters, -we consider a system for analysis as a collection %{\fg} +a system for analysis is considered as a collection %{\fg} of components. -We can represent this set of components as $G$, and the number of components in it by +% +This is a set of components as $G$, and the number of components in it $ | G | $. %, %(an indexing and sub-scripting notation to identify particular {\fgs} %within an FMMD hierarchy is given in section~\ref{sec:indexsub}). % %\paragraph{Defining Components} $G$ is simply a sub-set of all possible components. -We define the set of all components as $\mathcal{C}$ and can state $G \subset \mathcal{C}$. Individual components are denoted as $c$ +% +The set of all components is $\mathcal{C}$; it can be can stated that is $G \subset \mathcal{C}$. +% +Individual components are denoted as $c$ with additional indexing where appropriate. %\paragraph{Defining a function to return the failure modes of a component.} @@ -155,11 +162,11 @@ The function $fm$ returns the failure modes of a component, its signature is %has a component as its domain and the components failure modes % , $fms$, %as its range. % (see equation~\ref{eqn:fm}). $ fm: \mathcal{C} \rightarrow \mathcal{F},$ where $\mathcal{F}$ is the set of all failures. -We can represent the number of potential failure modes of a component, $c$, to be $ | fm(c) | .$ +The number of potential failure modes of a component, $c$, is $ | fm(c) | .$ %\paragraph{Indexing components with the group $G$.} -%If we index all -Indexing the components in the system under investigation $ c_1, c_2 \ldots c_{|G|} $ allows us to express +%If pissindex all +Indexing the components in the system under investigation $ c_1, c_2 \ldots c_{|G|} $ allows expression of the number of checks required to exhaustively % rigorously examine every failure mode against all the other components in a system in equation~\ref{eqn:CC}. @@ -190,12 +197,15 @@ Comparison complexity, $CC$, for a group of $n$ components $G$, is given by % % J Howse requires justification for the CC equation above 10MAR2013. % -Equation~\ref{eqn:CC} says that for every failure mode in the group $G$, we must check it against all other -components in the group (except itself). This gives us a count of the number of reasoning paths to perform {\XFMEA}. +Equation~\ref{eqn:CC} says that for every failure mode in the group $G$, it must be checked against all other +components in the group (except itself). +% +This gives a count of the number of reasoning paths to perform {\XFMEA}. +% These reasoning distance concepts are discussed in section~\ref{sec:reasoningdistance}. % from CH3 % -Equation~\ref{eqn:CC} can be simplified if we can determine the total number of -failure modes in the system $K$, (i.e. $ K = \sum_{n=1}^{|G|} {|fm(c_n)|}$); +Equation~\ref{eqn:CC} can be simplified if the total number of +failure modes in the system $K$ can be determined, (i.e. $ K = \sum_{n=1}^{|G|} {|fm(c_n)|}$); %equation~\ref{eqn:CC} the equation becomes %$$ @@ -209,24 +219,26 @@ An FMMD hierarchy consists of many {\fgs} which are subsets of $G$. %We define the set of all {\fgs} as $\mathcal{FG}$. %Using $FG$ to represent individual {\fgs} %i.e. FG \subset G. -%we %can therefore +%piss%can therefore %state %$$ \forall FG \in \mathcal{FG} | FG \subset \mathcal{G} .$$ % FMMD analysis creates a hierarchy $\hh$ of {\fgs}. % where $\hh \subset \mathcal{FG}$. \fmmdgloss % -We can define individual {\fgs} using $FG^{\alpha}_{i}$ with an index -$i$ for identification and a superscript for the $\alpha$~level (see section~\ref{sec:alpha}). +Individual {\fgs} can be defined using with an index +$i$ for identification and a superscript for the $\alpha$~level i.e. $FG^{\alpha}_{i}$ (see section~\ref{sec:alpha}). % %--- %o identify the hierarchy. For example the first {\fg} in a hierarchy containing base components only -i.e. at the zeroth level of an FMMD hierarchy where $\alpha=0$, would have the superscript 0 and a subscript of 1: $FG^{0}_{1}$. +i.e. at the zeroth level of an FMMD hierarchy where $\alpha=0$, +would have the superscript 0 and a subscript of 1: $FG^{0}_{1}$. % The {\fg} representing the potential divider in section~\ref{subsec:potdiv} -has an $\alpha$ level of 0 (as it contains base components). The {\fg} -with the potential divider and the operational amplifier has an $\alpha$ level of 1. +has an $\alpha$ level of 0 (as it contains base components). +% +The {\fg} with the potential divider and the operational amplifier has an $\alpha$ level of 1. %$$ %Equation~\ref{eqn:rd} can also be expressed as % @@ -238,16 +250,18 @@ with the potential divider and the operational amplifier has an $\alpha$ level o % \end{equation} -An FMMD hierarchy will have reducing numbers of {\fgs} as we progress up the hierarchy. -In order to calculate its comparison~complexity, we need to apply equation~\ref{eqn:CC} to +An FMMD hierarchy will have reducing numbers of {\fgs} the hierarchy is traversed upwards. +% +In order to calculate its comparison~complexity, equation~\ref{eqn:CC} must be applied to all {\fgs} on each level. -We can define an FMMD hierarchy as a set of {\fgs}, $\hh$. +% +An FMMD hierarchy defined as a set of {\fgs}, $\hh$. % We define a helper function $g$ with a domain of the level $Level$ in an FMMD hierarchy $\hh$, and a % co-domain of a set of {\fgs} (specifically all the {\fgs} on the given level), % that returns % the sum of all complexity comparison % applied to {\fgs} at a particular hierarchy level in \hh, -We define a helper function, $g$, +A helper function, $g$, is used that applies $CC$ to all {\fgs} at a particular level, $\xi$, in an FMMD hierarchy, {\hh}, and returns the sum of the comparison complexities, \begin{equation} @@ -263,7 +277,7 @@ g: \hh \times \mathbb{N} \rightarrow \mathbb{N} . Let $L$ represent the number of levels in the FMMD hierarchy {\hh} and $g(\hh,\xi)$ represent the comparison complexity of {\fgs} on the level $\xi$. %and $\hh$ represents an FMMD hierarchy, -We overload the comparison complexity function $CC$, to obtain the comparison complexity of an entire hierarchy thus: +The comparison complexity function $CC$ is overloaded, to obtain the comparison complexity of an entire hierarchy thus: %$$ \begin{equation} \label{eqn:gf} @@ -276,28 +290,33 @@ We overload the comparison complexity function $CC$, to obtain the comparison co \label{sec:theoreticalperfmodel} \fmmdglossRD %\pagebreak[4] -We initially work through the amplifier example from chapter~\ref{sec:chap4}, which has two -stages, the potential divider and then the amplifier. We add the complexities from +The amplifier example from chapter~\ref{sec:chap4}, which has two +stages, the potential divider and then the amplifier is chosen as an example for comparison complexity. +% +The complexities are added from both these stages to determine how many reasoning paths there were to perform FMMD analysis on the non-inverting amplifier. The potential divider discussed in section~\ref{subsec:potdiv} has four failure modes and two components and therefore has $CC$ of 4. -We calculate this using equation~\ref{eqn:CC} thus, +This using equation~\ref{eqn:CC} is calculated thus, $$CC(potdiv) = \sum_{n=1}^{2} \big( |2| \times (|1|) \big) = 4. $$ % -We next combine the potential divider with an op-amp which has four failure modes -to form a {\fg} with two components, one with four failure modes and the other (the potential divider) with two, +The potential divider {\dc} is formed into a {\fg} with an op-amp which has four failure modes +i.e. a {\fg} with two components, one with four failure modes and the other (the potential divider) with two, $$CC(invamp) = 2 \times 1 + 4 \times 1 = 6 . $$ % -We now add the two calculated complexities to determine the +The two calculated complexities are added to determine the amount of reasoning paths to analyse the amplifier using FMMD. % The potential divider has a $CC$ of four and the amplifier section a $CC$ of six. -To analyse the inverting amplifier with FMMD we required 10 reasoning stages. +% +To analyse the inverting amplifier with FMMD it required 10 reasoning stages. +% Using traditional FMEA employing exhaustive checking ({\XFMEA}) -we obtain $ 2 \times (3-1) + 2 \times (3-1) + 4 \times (3-1)$ = 16. -Even with this very trivial example, we begin to see benefits of taking a modular approach to FMEA. +$ 2 \times (3-1) + 2 \times (3-1) + 4 \times (3-1) = 16$ was obtained. +% +Even with this very trivial example, benefits of taking a modular approach to FMEA are seen. \paragraph{Complexity Comparison for a hypothetical 81 component system.} @@ -315,9 +334,11 @@ $$CC(example) = \sum_{n=1}^{81} |3|.(|80|) = 19440 .$$ The computational order for {\XFMEA} would be polynomial ($O((N)(N-1)f) \approx O(N^2.f)$) (where $f$ is the variable number of failure modes) as discussed in section~\ref{eqn:fmea_single}. % -This order may be acceptable in a computational environment. However, the choosing of {\fgs} and the analysis -process are by-hand/human activities. It can be seen that it is practically impossible to achieve -{\XFMEA} for anything but trivial systems. +This order may be acceptable in a computational environment. +% +However, the choosing of {\fgs} and the analysis process are by-hand/human activities. +% +It can be seen that it is practically impossible to achieve {\XFMEA} for anything but trivial systems. % % Next statement needs alot of justification % @@ -353,8 +374,8 @@ and {\fgs} have variable numbers of components, it is difficult to use the general formula for comparing the number of checks to make for {\XFMEA} and FMMD. % -If we were to create an example by fixing the number of components in a {\fg} -and the number of failure modes per component, we can derive formulae +If an example is created by fixing the number of components in a {\fg} +and the number of failure modes per component, formulae can be determined to compare the number of checks to make from an FMMD hierarchy to {\XFMEA}. % %% HEALTH WARNING @@ -369,8 +390,8 @@ a fixed model provides indicative estimates of complexity performance. Consider $k$ to be the number of components in a {\fg} (i.e. $k=|{\FG}|$), $f$ is the number of failure modes per component (i.e. $f=|fm(c)|$), and $L$ to be the number of levels in the hierarchy of an FMMD analysis. -We can represent the number of failure scenarios to check in a (fixed parameter for $|{\FG}|$ and $|fm(c_i)|$) FMMD hierarchy -with equation~\ref{eqn:anscen}. +The number of failure scenarios to check in a (fixed parameter for $|{\FG}|$ and $|fm(c_i)|$) FMMD hierarchy +is represented with equation~\ref{eqn:anscen}. \begin{equation} \label{eqn:anscen} @@ -378,45 +399,45 @@ with equation~\ref{eqn:anscen}. \end{equation} The thinking behind equation~\ref{eqn:anscen}, is that for each level of analysis -- counting down from the top -- -there are ${k}^{n}$ {\fgs} within each level; we need to apply {\XFMEA} to each {\fg} on the level. +there are ${k}^{n}$ {\fgs} within each level; {\XFMEA} is applied to each {\fg} on the level. % The number of checks to make for {\XFMEA}, is the number of components $k$ multiplied by the number of failure modes $f$ checked against the remaining components in the {\fg} $(k-1)$. % -If, for the sake of example, we fix the number of components in a {\fg} to three and +If, for the sake of example, the number of components in a {\fg} is fixed to three and the number of failure modes per component to three, an FMMD hierarchy would look like figure~\ref{fig:three_tree}. \subsection{Comparing {\XFMEA} and FMMD: an Example} \fmmdglossXFMEA -Using the diagram in figure~\ref{fig:three_tree}, we have three levels of analysis. +Using the diagram in figure~\ref{fig:three_tree}, there are three levels of analysis. % -Starting at the top, we have a {\fg} with three derived components, each of which has +Starting at the top, there is a {\fg} with three derived components, each of which has three failure modes. % Thus the number of checks to make in the top level is $3^0\times3\times2\times3 = 18$. % -On the level below that, we have three {\fgs} each with +On the level below that, there are three {\fgs} each with an identical number of checks, $3^1 \times 3 \times 2 \times 3 = 56$. %{\fg} % -On the level below that we have nine {\fgs}, $3^2 \times 3\times2\times3=168$. +On the level below that there are nine {\fgs}, $3^2 \times 3\times2\times3=168$. Adding these together gives $242$ checks to make to perform FMMD (i.e. {\XFMEA} {\em{within the}} {\fgs}). -If we were to take the system represented in figure~\ref{fig:three_tree}, and -apply {\XFMEA} on it as a whole system, we can use equation~\ref{eqn:CC}, +To take the system represented in figure~\ref{fig:three_tree}, and +apply {\XFMEA} on it as a whole system, using equation~\ref{eqn:CC}, $CC(G) = \sum_{n=1}^{|G|} |fm(c_n)|.(|G|-1)$, where $|G|$ is 27, $fm(c_n)$ is 3 -and $(|G|-1)$ is 26. -This gives: +and $(|G|-1)$ is 26, +this gives: $CC(G) = \sum_{n=1}^{27} |3|.(|27|-1) = 2106$. In order to get general equations with which to compare {\XFMEA} with FMMD, -we can re-write equation~\ref{eqn:CC} in terms of the number of levels +equation~\ref{eqn:CC} can be re-written in terms of the number of levels in an FMMD hierarchy. % The number of components in the system, is the number of components in a {\fg} raised to the power of the level plus one. -Thus we re-write equation~\ref{eqn:CC} as: +The equation~\ref{eqn:CC} is re-written as: \begin{equation} @@ -433,7 +454,8 @@ or %(N^2 - N).f \end{equation} -We can now use equation~\ref{eqn:anscen} (FMMD) and \ref{eqn:CC} ({\XFMEA}) to compare (for fixed sizes of $|G|$ and $|fm(c)|$) +Equation~\ref{eqn:anscen} (FMMD) and \ref{eqn:CC} can be used +to compare (for fixed sizes of $|G|$ and $|fm(c)|$) the two approaches, for the work required to perform exhaustive checking. @@ -443,7 +465,7 @@ of FMMD analysis, with these fixed numbers, will require 81 base level components. % %$$ -Applying equation~\ref{eqn:fmea_state_exp22}, we have +Applying equation~\ref{eqn:fmea_state_exp22}, gives \begin{equation} \label{eqn:fmea_state_exp22_example} 3^4.(3^4-1).3 = 81.(81-1).3 = 19440 .% \\ @@ -453,15 +475,15 @@ Applying equation~\ref{eqn:fmea_state_exp22}, we have Equation \ref{eqn:fmea_state_exp22} shows that applying XFMEA where components all have three failure modes and there are 81 components, would involve 19,440 reasoning paths. -Applying equation~\ref{eqn:fmea_state_exp21}, we have +Applying equation~\ref{eqn:fmea_state_exp21}, $$ %\begin{equation} % \label{eqn:anscen} \sum_{n=0}^{3} {3}^{n}.3.3.(2) = 720 . %\end{equation} $$ - -For FMMD (where within {\fgs} the analysis \textbf{is exhaustive}) we only require +% +For FMMD (where within {\fgs} the analysis \textbf{is exhaustive}) it only requires 720 reasoning paths. @@ -469,8 +491,10 @@ For FMMD (where within {\fgs} the analysis \textbf{is exhaustive}) we only requi \subsubsection{Plotting XFMEA and FMMD reasoning distance} Using the gnuplot utility~\cite{gnuplot,Janert:2009:GAU:1631269} and implementing equation~\ref{eqn:fmea_state_exp22} for -XFMEA and equation~\ref{eqn:anscen} for FMMD reasoning distances, we can (using a logarithmic axis for reasoning distance) -compare them graphically. The gnuplot script used to +XFMEA and equation~\ref{eqn:anscen} for FMMD reasoning distances and using a logarithmic axis for reasoning distance +comparison is performed graphically. +% +The gnuplot script used to produce figure~\ref{fig:xfmeafmmdcomp} may be found in section~\ref{sec:gnuplotxfmeafmmdcomp}. \begin{figure}[h] @@ -481,18 +505,18 @@ produce figure~\ref{fig:xfmeafmmdcomp} may be found in section~\ref{sec:gnuplotx \label{fig:xfmeafmmdcomp} \end{figure} -Looking at the graph in figure~\ref{fig:xfmeafmmdcomp} we see that the reasoning distance +Looking at the graph in figure~\ref{fig:xfmeafmmdcomp} it is seen that the reasoning distance for large numbers of components becomes extremely difficult to achieve for traditional FMEA. % It can be seen that the reasoning distance has gone from a polynomial to a logarithmic order. % -By applying FMMD we have effectively decimated the large group for analysis into -a hierarchy of much smaller groups and applied FMEA {\em within} those. +By applying FMMD large group for analysis has be decimated into +a hierarchy of much smaller groups and applied XFMEA {\em within} these. % -In mathematical terms this means we have converted the polynomial order -to logarithmic by being able to convert exponentiation -to constants of integration. +In mathematical terms this means the polynomial order has been converted +to logarithmic by being able to take exponentiation values out +to become instead constants of integration. %% YEEEEEE HARRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR % This process can be viewed as similar to the order of processing that occurs in the decimation in time FFT~\cite{fftoriginal} when @@ -569,7 +593,7 @@ are presented in table~\ref{tbl:firstcc}. % & & & \\ \hline \hline -% \footnote{if we discount the comparison complexity for the pre-analysed INVAMP.}\hline +% \footnote{if pissdiscount the comparison complexity for the pre-analysed INVAMP.}\hline \multicolumn{3}{ |c| } {Five Pole Sallen Key Low Pass Filter: Three stage FMMD Hierarchy: section~\ref{sec:fivepolelp}} \\ \hline %\multirow{4}{*} {Differencing Amplifier FMMD Hierarchy: section~\ref{sec:diffamp}} & & \\ @@ -588,8 +612,8 @@ are presented in table~\ref{tbl:firstcc}. \end{table} % end table The complexity comparison figures for the example circuits in chapter~\ref{sec:chap5} show -that for the non trival examples, as we -use more levels in the FMMD hierarchy, the performance +that for the non trival examples, as +more levels in the FMMD hierarchy are used, the performance gain over {\XFMEA} becomes apparent. %for increasing complexity the performance benefits from FMMD are apparent. @@ -601,7 +625,8 @@ The Bubba oscillator example (see section~\ref{sec:bubba}) was chosen because it signal path. It was also analysed twice, once by {na\"{\i}vely} using the first {\fgs} identified, and secondly by de-composing the circuit further. -We use these two analyses to compare the effect on comparison complexity (see table~\ref{tbl:bubbacc}) with that of {\XFMEA}. +% +These two analyses are used to compare the effect on comparison complexity (see table~\ref{tbl:bubbacc}) with that of {\XFMEA}. % \begin{table} \label{tbl:bubbacc} @@ -723,9 +748,12 @@ by more than a factor of ten. \end{table} % The complexity figures for this mixed analogue to digital circuit are not adversely affected by the digital to -analogue level interfacing circuitry. This is where the modular approach aids understanding and analysis. -When following this circuit through in a traditional way, we have to follow signal paths that -are level shifted, adding to the complication of analysing it for failures. +analogue level interfacing circuitry. +% +This is where the modular approach aids understanding and analysis. +% +When following this circuit through in a traditional way, following signal paths that +are level shifted, adds to the complication of analysing it for failures. % % \subsection{Exponential squared to Exponential} % @@ -736,6 +764,7 @@ are level shifted, adding to the complication of analysing it for failures. %\label{ch7:mutex} \label{ch7:mutex} \paragraph{Design Decision/Constraint} +% An important factor in defining a set of failure modes is that they should represent the failure modes as simply and minimally as possible. % @@ -743,17 +772,22 @@ should represent the failure modes as simply and minimally as possible. % It should not be possible, for instance, for a component to have two or more failure modes active at once. -Were this to be the case, we would have to consider additional combinations of -failure modes within the component. +% +Were this to be the case, additional combinations of +failure modes would have to be considered within the component. +% Having a set of failure modes where $N$ modes could be active simultaneously would mean having to consider an additional $2^N-1$ failure mode scenarios. +% Should a component be analysed and simultaneous failure mode cases exist, the combinations could be represented by new failure modes, or the component should be considered from a fresh perspective, perhaps considering it as several smaller components within one package. +% This property, failure modes being mutually exclusive, is termed `unitary state failure modes' in this study. +% This corresponds to the `mutually exclusive' definition in probability theory~\cite{probstat}. @@ -772,26 +806,31 @@ What is required is to define a property for a set of failure modes $F$ where only one failure mode can be active at a time; or borrowing from the terms of statistics, the failure mode being an event that is mutually exclusive within the set $F$. -We can define a set of failure mode sets called $\mathcal{U}$ to represent this +% +A set of failure mode sets called $\mathcal{U}$ is defined to represent this property. % for a set of failure modes. % % \begin{definition} % We can define a set $\mathcal{U}$ which is a set of sets of failure modes, where % the component failure modes in each of its members are unitary~state. -% Thus if the failure modes of a component $F$ are unitary~state, we can say $F \in \mathcal{U}$ is true. +% Thus if the failure modes of a component $F$ are unitary~state, pisscan say $F \in \mathcal{U}$ is true. % \end{definition} \subsection{Example of unitary state component failure modes} An example of a component with an obvious set of ``unitary~state'' failure modes is the electrical resistor. % -We use the EN298~\cite{en298}[Ann.A] failure mode definition for resistors: OPEN or SHORTED. +The EN298~\cite{en298}[Ann.A] failure mode definition for resistors: OPEN or SHORTED, is used. % -For a given resistor R we could apply the -function $fm$ to find its set of failure modes thus $ fm(R) = \{R_{SHORTED}, R_{OPEN}\} $. +For a given resistor R the +function $fm$ can be applied to find its set of failure modes thus $ fm(R) = \{R_{SHORTED}, R_{OPEN}\} $. +% A resistor cannot fail with the conditions open and short active at the same time, -that would be physically impossible! The conditions +that would be physically impossible! +% +The conditions OPEN and SHORT are thus mutually exclusive. +% Because of this, the failure mode set $F=fm(R)$ is `unitary~state'. % % @@ -804,33 +843,33 @@ These concepts are expanded in section~\ref{sec:usprob}. \fmmdglossMUTEX -We can make this a general case by taking a set $F$ (with $f_1, f_2 \in F$) representing a collection +A general case can be made by taking a set $F$ (with $f_1, f_2 \in F$) representing a collection of component failure modes. % -We can define a Boolean function {\ensuremath{\mathcal{ACTIVE}}} that returns +A Boolean function {\ensuremath{\mathcal{ACTIVE}}} is defined that returns whether a fault mode is active (true) or dormant (false). % -We can say that if any pair of fault modes is active at the same time, then the failure mode set is not +It can be said that if any pair of fault modes is active at the same time, then the failure mode set is not unitary state: -we state this formally; - - +formally; +% +% \begin{equation} \exists f_1,f_2 \in F \dot ( f_1 \neq f_2 \wedge \mathcal{ACTIVE}({f_1}) \wedge \mathcal{ACTIVE}({f_2}) ) \implies F \not\in \mathcal{U} . \end{equation} - - +% +% % % \begin{equation} % c1 \cap c2 \neq \emptyset | c1 \neq c2 \wedge c1,c2 \in C \wedge C \not\in U % \end{equation} - +% That is to say that it is impossible that any pair of failure modes can be active at the same time for the failure mode set $F$ to exist in the family of sets $\mathcal{U}$. % Note where there are more than two failure~modes, by banning any pairs from being active at the same time, -we have banned larger combinations as well. +larger combinations are banned as well. %\subsection{Design Rule: Unitary State} @@ -838,19 +877,25 @@ we have banned larger combinations as well. \paragraph{Design Rule: Unitary State} All components must have unitary state failure modes to be used with the FMMD methodology and -for base~components this is usually the case. Most simple components fail in one +for base~components this is usually the case. +% +Most simple components fail in one clearly defined way and generally stay in that state. +% Traditional FMEA has problems dealing with non unitary state failure modes. +% This is mainly because combinations of failure modes could cause effects very difficult to predict (as they are in effect new failure modes of the component). % However, where a complex component is used, for instance a micro-controller with several modules that could all fail simultaneously, a process of reduction into smaller theoretical components will have to be made. -We can term this `heuristic~de-composition'. +This can be termed `heuristic~de-composition'. % A modern micro-controller will typically have several modules which are configured to operate on -pre-assigned pins on the device. Typically voltage inputs (\adcten / \adctw), digital input and outputs, +pre-assigned pins on the device. +% +Typically voltage inputs (\adcten / \adctw), digital input and outputs, PWM (pulse width modulation), UARTs and other modules will be found on simple cheap micro-controllers~\cite{pic18f2523}. % For instance, the voltage reading functions which consist @@ -884,6 +929,7 @@ failure modes in isolation, but cases where more than one failure mode may occur simultaneously. % Note that the `unitary state' conditions apply to failure modes within a component. +% This does not preclude the possibility of two or more components failing simultaneously. % %The scenarios presented deal with possibility of two or more components failing simultaneously. @@ -894,7 +940,7 @@ of LOCKOUT~\cite{en298} in an industrial burner controller that has detected one However, from the perspective of static failure mode analysis, this amounts to dealing with double simultaneous failure modes.}. % -To generalise, we may need to consider $N$ simultaneous +To generalise, it may be necessary to consider $N$ simultaneous failure modes when analysing a functional group. % This involves finding @@ -906,7 +952,7 @@ The power-set, when applied to a set S is the set of all subsets of S, including is no fault active in the functional~group under analysis.} and S itself. % -We augment the power-set concept here to deal with counting the number of +The power-set concept is augmented here to deal with counting the number of combinations of failures to consider, under the conditions of simultaneous failures. % In order to consider combinations for the set S where the number of elements in @@ -918,8 +964,11 @@ is proposed and described in the next section. \label{ccp} A Cardinality Constrained power-set is one where subsets of a cardinality greater than a threshold -are not included. This threshold is called the cardinality constraint. -To indicate this, the cardinality constraint $cc$ is subscripted to the powerset symbol thus $\mathcal{P}_{cc}$. +are not included. +% +This threshold is called the cardinality constraint. +% +To indicate this, the cardinality constraint $\le cc$ is subscripted to the powerset symbol thus $\mathcal{P}_{\le cc}$. Consider the set $S = \{a,b,c\}$. The power-set of S: @@ -939,57 +988,65 @@ $$ \mathcal{P}_{\le 1} S = \{ \{a\},\{b\},\{c\} \} .$$ \paragraph{Calculating the number of elements in a Cardinality Constrained power-set} A $k$ combination is a subset with $k$ elements. +% The number of $k$ combinations (each of size $k$) from a set $S$ with $n$ elements (size $n$) is the binomial coefficient~\cite{probstat} shown in equation \ref{bico}. - +% \begin{equation} C^n_k = {n \choose k} = \frac{n!}{k!(n-k)!} . \label{bico} \end{equation} - +% To find the number of elements in a cardinality constrained subset S with up to $cc$ elements in each combination sub-set, -we need to sum the combinations, +sum the combinations must be added, %subtracting $cc$ from the final result %(repeated empty set counts) from $1$ to $cc$ thus - +% % % $$ {\sum}_{k = 1..cc} {\#S \choose k} = \frac{\#S!}{k!(\#S-k)!} $$ % - +% \begin{equation} |{\mathcal{P}_{cc}S}| = \sum^{cc}_{k=1} \frac{|{S}|!}{ cc! ( |{S}| - cc)!} . % was k in the frac part now cc \label{eqn:ccps} \end{equation} - - - +% +% +% \subsection{Actual Number of combinations to check with Unitary State Fault mode sets} - +% If all of the fault modes in $S$ were independent, the cardinality constrained power-set calculation (in equation \ref {eqn:ccps}) would give the correct number of test case combinations to check. +% Because sets of failure modes in FMMD analysis are constrained to be unitary state, the actual number of test cases to check will usually -be less than this. +be less than this. +% This is because certain combinations of faults within a components failure mode set are impossible under the conditions of unitary state failure mode. -To modify equation \ref{eqn:ccps} for unitary state conditions, we must subtract the number of component `internal combinations' -for each component in the {\fg} under analysis. -Note we must sequentially subtract using combinations above 1 up to the cardinality constraint. +% +To modify equation \ref{eqn:ccps} for unitary state conditions, the number of component `internal combinations' +for each component must be subtracted from the total for the {\fg} under analysis. +% +Note it is necessary to sequentially subtract using combinations above 1 up to the cardinality constraint. +% For example, say -the cardinality constraint was 3, we would need to subtract both +the cardinality constraint was 3, it would be necessary to subtract both $|{n \choose 2}|$ and $|{n \choose 3}|$ for each component in the {\fg}. \subsubsection{Example: Two Component {\fg} Cardinality Constraint of 2} -For example: suppose we have a simple {\fg} with two components R and T, of which +For example: given a simple {\fg} with two components R and T, of which $$fm(R) = \{R_o, R_s\}$$ and $$fm(T) = \{T_o, T_s, T_h\}.$$ This means that the {\fg} $FG=\{R,T\}$ will have a component failure mode set -of $fm(FG) = \{R_o, R_s, T_o, T_s, T_h\}$. Note this set of failure modes -is as we would use them for single failure analysis. +of $fm(FG) = \{R_o, R_s, T_o, T_s, T_h\}$. +% +Note this set of failure modes +is as would be used for single failure analysis. % Did J Howse actually read this? 06APR2013 % This set does not contain % mutually exclusive failure modes, because both $R$ and $T$ could fail. @@ -999,33 +1056,35 @@ is as we would use them for single failure analysis. % For a cardinality constrained powerset of 2, because there are 5 error modes ( $|fm(FG)|=5$), applying equation \ref{eqn:ccps} gives: - +% $$ | P_{\le 2} (fm(FG)) | = \frac{5!}{1!(5-1)!} + \frac{5!}{2!(5-2)!} = 15.$$ - +% This is composed of ${5 \choose 1}$ five single fault modes, and ${5 \choose 2}$ ten double fault modes. % -However we know that the {\fms} are mutually exclusive within a component. +However the {\fms} are mutually exclusive within a component. % -We must then subtract the number of `internal' component fault combinations +It is necessary then, to subtract the number of `internal' component fault combinations for each component in the {\fg}. % For component R there is only one internal component fault that cannot exist -$R_o \wedge R_s$. As a combination ${2 \choose 2} = 1$. For the component $T$ which has - three fault modes ${3 \choose 2} = 3$. +$R_o \wedge R_s$. As a combination ${2 \choose 2} = 1$. +% +For the component $T$ which has three fault modes ${3 \choose 2} = 3$. % -Thus for $cc = 2$, under the conditions of unitary state failure modes in the components $R$ and $T$, we must subtract $(3+1)$. -The number of combinations to check is thus 11, $|\mathcal{P}_{\le 2}(fm(FG))| = 11$, for this example and this can be verified +Thus for $cc = 2$, under the conditions of unitary state failure modes in the components $R$ and $T$, it is necessary to subtract $(3+1)$. +% +The number of combinations to check is thus 11, $|\mathcal{P}_{\le 2}(fm(FG))| = 11$, for this example, and this can be verified by listing all the required combinations: - +% % Because there are only two components, this is simply the cross product % of fm(R) and fm(T) but this does not hold for larger {\fgs}... - +% $$ \mathcal{P}_{\le 2}(fm(FG)) = \{ \{R_o T_o\}, \{R_o T_s\}, \{R_o T_h\}, \{R_s T_o\}, \{R_s T_s\}, \{R_s T_h\}, \{R_o \}, \{R_s \}, \{T_o \}, \{T_s \}, \{T_h \} \} $$ - +% whose cardinality is indeed, 11. % by inspection %$$ %| @@ -1037,13 +1096,12 @@ whose cardinality is indeed, 11. % by inspection \pagebreak[1] -\subsubsection{Establishing Formulae for unitary state failure mode -cardinality calculation} - +\subsubsection{Establishing Formulae for unitary state failure mode cardinality calculation} +% The cardinality constrained power-set in equation \ref{eqn:ccps}, can be modified for % corrected for unitary state failure modes. %This is written as a general formula in equation \ref{eqn:correctedccps}. - +% %\indent{ %To define terms : %\begin{itemize} @@ -1085,6 +1143,7 @@ Expanding the combination in equation \ref{eqn:correctedccps} %\paragraph{Use of Equation \ref{eqn:correctedccps2} } Equation \ref{eqn:correctedccps2} is useful for an automated tool that would verify that a single or double simultaneous failures model has complete failure mode coverage. +% By knowing how many test cases should be covered, and checking the cardinality associated with the test cases, complete coverage would be verified. @@ -1092,10 +1151,12 @@ associated with the test cases, complete coverage would be verified. \fmodegloss -We use the Pt100 example in~\ref{sec:Pt100} which performs double failure mode FMMD analysis. -It is important to check that we have covered all possible double fault combinations. -We can use the equation \ref{eqn:correctedccps2} to determine the number of failure scenarios, or checks, -we should have made for complete failure coverage. +The Pt100 example in~\ref{sec:Pt100} which performs double failure mode FMMD analysis is used as an example. +% +It is important to check that all possible double fault combinations have been covered. +% +Using the equation \ref{eqn:correctedccps2} to determine the number of failure scenarios, or checks, +necessary for complete failure coverage. \ifthenelse {\boolean{paper}} { from the definitions paper @@ -1106,10 +1167,10 @@ reproduced below to verify this. \indent{ where: \begin{itemize} - \item The set $SU$ represents the components in the functional~group, where all components are guaranteed to have unitary state failure modes. - \item The indexed set $C_j$ represents all components in set $SU$. - \item The function $FM$ takes a component as an argument and returns its set of failure modes. - \item $cc$ is the cardinality constraint, here 2 as we are interested in double and single faults. + \item The set $SU$ represents the components in the functional~group, where all components are guaranteed to have unitary state failure modes, + \item The indexed set $C_j$ represents all components in set $SU$, + \item The function $FM$ takes a component as an argument and returns its set of failure modes, + \item $cc$ is the cardinality constraint, here 2 (for double and single faults). \end{itemize} } \begin{equation} @@ -1154,8 +1215,8 @@ $$ NoOfTestCasesToCheck = \frac{6!}{1!(6-1)!} + \frac{6!}{2!(6-2)!} - $$ NoOfTestCasesToCheck = 6 + 15 - ( 1 + 1 + 1 ) = 18 .$$ % As the test cases are all different and are of the correct cardinalities (6 single faults and (15-3) double) -we can be confident that we have looked at all `double combinations' of the possible faults -in the Pt100 circuit. +there is confidence that all `double combinations' of the possible faults +have been checked in the Pt100 circuit. %The next task is to investigate %these test cases in more detail to prove the failure mode hypothesis set out in table \ref{tab:ptfmea2}. @@ -1213,14 +1274,17 @@ in the Pt100 circuit. \label{sec:usprob} %\paragraph{NOT WRITTEN YET PLEASE IGNORE} A sample space is defined as the set of all possible outcomes. +% For a component in FMMD analysis, this set of all possible outcomes is its normal (or `correct') operating state and all its failure modes. -We can consider failure modes as events in the sample space. % -When dealing with failure modes, we are not interested in -the state where the component is working correctly or `OK' (i.e. operating with no error). +Failure modes can be considered as events in the sample space. +% +When dealing with failure modes, +the state where the component is working correctly or `OK' (i.e. operating with no error) is not useful. +% +For FMEA the analyst is interested only in ways in which it can fail. % -We are interested only in ways in which it can fail. By definition, while all components in a system are `working~correctly', that system will not exhibit faulty behaviour. % @@ -1260,7 +1324,8 @@ all sets within $\Omega$ are partitioned. Figure \ref{fig:combco} shows a partitioned set representing component failure modes $\{ B_1 ... B_3, OK \}$: partitioned sets where the OK or empty set condition is included, obey unitary state conditions. -Because the subsets of $\Omega$ are partitioned, we can say these +% +Because the subsets of $\Omega$ are partitioned, it can be stated that these failure modes are unitary state. % % \begin{figure}[h] @@ -1273,15 +1338,19 @@ failure modes are unitary state. \section{Components with Independent failure modes} \label{ch7:indfm} -Suppose that we have a component that can fail simultaneously -with more than one failure mode. +% +Suppose that a component that can fail simultaneously +with more than one failure mode is included in an analysis. +% This would make it seemingly impossible to model as `unitary state'. - - +% +% \paragraph{De-composition of complex component.} -There are two ways in which we can deal with this. -We could consider the component a composite -of two simpler components, and model their interaction to +% +There are two ways in which this can be dealt with. +% +The component could be considered a composite +of two simpler components, and their interaction modelled to create a derived component (i.e. use FMMD). % The second way to do this would be to consider the combinations of non-mutually @@ -1304,18 +1373,21 @@ This technique is outside the scope of this paper. \end{figure} \paragraph{Combinations become new failure modes.} -We could consider the combinations -of the non-mutually exclusive failure modes as new failure modes. -We can model this using an Euler diagram representation of -an example component with three failure modes\footnote{OK is really the empty set, but the term OK is more meaningful in -the context of component failure modes} $\{ B_1, B_2, B_3, OK \}$ see figure \ref{fig:combco}. +% FUCK OFF + the combinations +of the non-mutually exclusive failure modes could be considered as new failure modes. % -For the purpose of example let us consider $\{ B_2, B_3 \}$ +An Euler diagram representation of +an example component with three failure modes\footnote{OK is really the empty set, but the term OK is more meaningful in +the context of component failure modes} $\{ B_1, B_2, B_3, OK \}$ is presented in figure \ref{fig:combco}. +% +For the purpose of example consider $\{ B_2, B_3 \}$ to be intrinsically mutually exclusive, but $B_1$ to be independent. -This means that we have the possibility of two new combinations +% +This means there is the possibility of two new combinations $ B_1 \cap B_2$ and $ B_1 \cap B_3$. -We can represent these -as shaded sections of figure \ref{fig:combco2}. +% +These are represented as shaded sections of figure \ref{fig:combco2}. \begin{figure}[h] \centering @@ -1327,10 +1399,11 @@ as shaded sections of figure \ref{fig:combco2}. -We can calculate the probabilities for the shaded areas, +The probabilities for the shaded areas can be calculated, assuming the failure modes are statistically independent, by multiplying the probabilities of the members of the intersection. -We can use the function $P$ to return the probability of a +% +The function $P$ is used to return the probability of a failure mode, or combination thereof. Thus for $P(B_1 \cap B_2) = P(B_1)P(B_2)$ and $P(B_1 \cap B_3) = P(B_1)P(B_3)$. @@ -1343,19 +1416,20 @@ Thus for $P(B_1 \cap B_2) = P(B_1)P(B_2)$ and $P(B_1 \cap B_3) = P(B_1)P(B_3)$. \label{fig:combco3} \end{figure} - -We can now consider the shaded areas as new failure modes of the component (see figure \ref{fig:combco3}). +%OH FUCCCCKKKKKKKKKKKKKKKKK OFFFFFFFFFFFFFFFFFFFFFFFFFFFFF +Consider the shaded areas as new failure modes of the component (see figure \ref{fig:combco3}). Because of the combinations, the probabilities for the failure modes $B_1, B_2$ and $B_3$ will now reduce. -We can use the prime character ($\; \prime \;$), to represent the altered value for a failure mode, i.e. +% +The prime character ($\; \prime \;$), to represent the altered value for a failure mode, i.e. $B_1^\prime$ represents the altered value for $B_1$. Thus $$ P(B_1^\prime) = P(B_1) - P(B_1 \cap B_2) - P(B_1 \cap B_3)\; , $$ $$ P(B_2^\prime) = P(B_2) - P(B_1 \cap B_2) \; and $$ $$ P(B_3^\prime) = P(B_3) - P(B_1 \cap B_3) \; . $$ -We now have two new component failure mode $B_4$ and $B_5$, shown in figure \ref{fig:combco3}. -We can express their probabilities as $P(B_4) = P(B_1 \cap B_3)$ and $P(B_5) = P(B_1 \cap B_2)$. +Two new component failure modes $B_4$ and $B_5$ have been created as shown in figure \ref{fig:combco3}. +Their probabilities expressed as $P(B_4) = P(B_1 \cap B_3)$ and $P(B_5) = P(B_1 \cap B_2)$. @@ -1366,24 +1440,26 @@ We can express their probabilities as $P(B_4) = P(B_1 \cap B_3)$ and $P(B_5) = P \subsection{Problems in choosing membership of {\fgs}} The choice of components for {\fgs} is one to be made by the analyst. +% The guiding principle it to choose components that are functionally adjacent and try to create the smallest groups possible. +% There are some mistakes that an analyst could make when choosing the members of functional groups. These are: \begin{itemize} \item Choosing components that are not functionally adjacent --- i.e. components that do not work together to perform a specific function, \item Not including components that may have side effects on the {\fg}, but are not obviously connected. \end{itemize} - -If we were to deliberately choose a `bad' {\fg} we would find that, -on analysing it, the component failure modes would not converge to common +% +If a deliberately `bad' {\fg} were chosen it would be found that, +on analysis, the component failure modes would not converge to common symptoms. % This would be because, with functionally adjacent -components, their failures often cause common failure symptoms for the {\fg}. +components, their failures often cause non-common failure symptoms for the {\fg}. % -With components that are not interacting, we are unlikely to see -this convergence of symptoms. +With components that are not interacting, it is unlikely to see +convergence of symptoms. % % This property could be of use in future automated FMMD tools @@ -1392,12 +1468,15 @@ to warn of potentially poorly chosen {\fgs}. \subsubsection{Side Effects: A Problem for FMMD analysis} \label{sec:sideeffects} -A problem with modularising according to functionality is that we can have component failures that would % poss split infinitive -intuitively be associated with one {\fg} that may cause unintended side effects in other +A problem with modularising according to functionality is that it could +have cause failures that would % poss split infinitive +intuitively be associated with one {\fg} +that could cause unintended side effects in other {\fgs}. -For instance were we to have a component that on failing $SHORT$ could bring down -a voltage supply rail, this could have drastic consequences for other -functional groups in the system we are examining. +% +For instance to have a component that on failing $SHORT$ could bring down +a voltage supply rail, could have drastic consequences for other +functional groups in the system. % pissare examining. \pagebreak[3] \subsubsection{Example de-coupling capacitors in logic circuits} @@ -1405,14 +1484,17 @@ functional groups in the system we are examining. A good example of a component failure that can induce side effects in other components, are de-coupling capacitors, often used over the power supply pins of all chips in a digital logic circuit. +% Were any of these capacitors to fail $SHORT$, they could bring down the supply voltage to the other logic chips. % To a power-supply, shorted capacitors on the supply rails are a potential source of the symptom, $SUPPLY\_SHORT$. +% In a logic chip/digital circuit {\fg} open capacitors are a potential source of symptoms caused by the failure mode $INTERFERENCE$. -So we have a `symptom' of the power-supply, and a `failure~mode' of +% +So a `symptom' of the power-supply, and a `failure~mode' of the logic chip to consider. % A possible solution to this is to include the de-coupling capacitors @@ -1422,12 +1504,15 @@ in the power-supply {\fg}. Because the capacitor has two potential failure modes (EN298), -this raises another issue for FMMD. A de-coupling capacitor going $OPEN$ might not be considered relevant to +this raises another issue for FMMD. +% +A de-coupling capacitor going $OPEN$ might not be considered relevant to a power-supply module (but there might be additional noise on its output rails). % But in {\fg} terms, the power supply now has a new symptom that of $INTERFERENCE$. % Some logic chips are more susceptible to $INTERFERENCE$ than others. +% A logic chip with de-coupling capacitor failing, may operate correctly but interfere with other chips in the circuit. % @@ -1435,15 +1520,19 @@ but interfere with other chips in the circuit. %%% could not be included % {\em in the {\fg} they would intuitively be associated with as well}.% poss split infinitive %%% in {\fgs} that they would not intuitively be associated with. % -There is no reason why we cannot include the de-coupling capacitors in each {\fg} +There is no reason why de-coupling capacitors cannot be included in each {\fg} that could be affected by $INTERFERENCE$, meaning that the same de-coupling capacitors can be members of different {\fgs}. % This allows for the general principle of a component failure affecting more than one {\fg} in a circuit. +% This allows functional groups to share components where necessary. +% This does not break the modularity of the FMMD technique, because, as {\irl}, one component failure may affect more than one sub-system. +% It does uncover a weakness in the FMMD methodology though. +% It could be very easy to miss the side effect and include the component causing the side effect into the wrong {\fg}, or only one germane {\fg}.