diff --git a/fmmdset/fmmdset.tex b/fmmdset/fmmdset.tex index cdd134c..2d55ac7 100644 --- a/fmmdset/fmmdset.tex +++ b/fmmdset/fmmdset.tex @@ -96,7 +96,7 @@ From the point of view of fault analysis, we are not interested in the component For this study a {\fg} will mean a collection of components. In order to determine the symptoms or failure modes of a {\fg} we need to consider all failure modes of its components. -By analysing the fault behaviour of a `functional group' with respect these failure modes +By analysing the fault behaviour of a `{\fg}' with respect these failure modes we can derive a new set of possible failure modes. % This new set of faults is the set of derived faults from the perspective of the {\fg}, and is thus at a higher level of @@ -105,10 +105,10 @@ fault~mode abstraction. Thus we can say that the {\fg} as an entity, can fail in In other words we have taken a {\fg}, and analysed how it can fail according to the failure modes of its parts. These new failure~modes are derived failure modes. %The ways in which the module can fail now becomes a new set of fault modes, the fault~modes -%being derived from the functional~group. +%being derived from the {\fg}. We can now create a new `{\dc}' which has -the failure symptoms of the functional~group as its set of failure modes. -This new derived~component is at a higher failure mode abstraction +the failure symptoms of the {\fg} as its set of failure modes. +This new {\dc} is at a higher failure mode abstraction level than the {\bcs}. %What this means is the `fault~symptoms' of the module have been derived. % @@ -390,7 +390,7 @@ via the RS232 serial line. This has a number of obvious {\fgs}, the PCB power supply, the milli-volt amplifiers, the analog to digital conversion circuitry, the micro processor and the UART (serial link - RS232 transceiver). -It would make sense when analysing this system to take each one of these functional~groups in turn and examine them closely. +It would make sense when analysing this system to take each one of these {\fgs} in turn and examine them closely. It would be sensible if the system could detect the most obvious fault~modes by self testing. When these have been examined and diagnostic safeguard strategies have been thought up, diff --git a/introduction/introduction.tex b/introduction/introduction.tex index 3c3454d..d7a2f15 100644 --- a/introduction/introduction.tex +++ b/introduction/introduction.tex @@ -491,8 +491,16 @@ This element of FTA is discussed in \ref{surveysc} \section{Therac 25} +The therac-25 was a computer controlled radiation therapy machine, which +overdosed 6 people between 1985 and 1987. +An earlier computerised version of the therac-25 (the therac-20) used the same software but kept the +hardware interlocks from the previous manual operation machines. The hardware interlocks +on the therac-20 functioned correctly and the faulty software in it caused no accidents. +A safety study for the device, using Fault Tree Analysis% \cite{nucfta} +carried out in 1983 +excluded the software \cite{safeware}[App. A]. + -\cite{safeware}[App. A] %% Here need more detail of what therac 25 was and roughly how it failed %% with refs to nancy