From 7a842de97f5ad31c522109f788829d858777b4cb Mon Sep 17 00:00:00 2001
From: Robin Clark <r.clark@energytechnologycontrol.com>
Date: Thu, 1 Dec 2011 18:55:36 +0000
Subject: [PATCH] Double simultaneous solved by dub sim higher inhierarchy

ALSO
---
 opamp_circuits_C_GARRETT/Makefile    |   2 +-
 opamp_circuits_C_GARRETT/dubsim1.dia | Bin 0 -> 2630 bytes
 opamp_circuits_C_GARRETT/opamps.tex  | 101 +++++++++++++++++++++++++++
 3 files changed, 102 insertions(+), 1 deletion(-)
 create mode 100644 opamp_circuits_C_GARRETT/dubsim1.dia

diff --git a/opamp_circuits_C_GARRETT/Makefile b/opamp_circuits_C_GARRETT/Makefile
index b7b1f86..922bb51 100644
--- a/opamp_circuits_C_GARRETT/Makefile
+++ b/opamp_circuits_C_GARRETT/Makefile
@@ -1,6 +1,6 @@
 
 
-PNG_DIA = circuit1_dag.png mvampcircuit.png pd.png invamp.png shared_component.png tree_abstraction_levels.png three_tree.png blockdiagramcircuit2.png circuit2h.png bubba_oscillator_block_diagram.png
+PNG_DIA = circuit1_dag.png mvampcircuit.png pd.png invamp.png shared_component.png tree_abstraction_levels.png three_tree.png blockdiagramcircuit2.png circuit2h.png bubba_oscillator_block_diagram.png dubsim1.png
 
 
 
diff --git a/opamp_circuits_C_GARRETT/dubsim1.dia b/opamp_circuits_C_GARRETT/dubsim1.dia
new file mode 100644
index 0000000000000000000000000000000000000000..20163df20d63ce24a665ec2b59792448c168e4aa
GIT binary patch
literal 2630
zcmV-M3c2+kiwFP!000021MQt#Z{s!=$KU5u7@oI9%J6=vn-tr@&hEnk`_S&QA=?^9
zTSW?FC7HbJXD=^u9NSW2TcQ)T^dJM+VfYv6bACD`52>Gi{(hT}9@1)+mBrN<0XQC|
z#k^c(#qw(W-`~FeAjdynfBI>WB|qw)WtH5H^j{P!^X_VVQ`dJtUS2*vK7#ydmDFVg
z^6Vb0(#!uRd7fPALYL#~PovSx3KmJ7n9rI|le(_5*?pakisUxE8qbpX@5`#ZFBW50
zswp=w^RgN}B>C0&^Edk%UpCcTZq@Tj-FL|{omFY_dw11Pzmz(q>btbst@ie=TxGgQ
z{dBiiq@y15|BEtBsg*8NEU!QRoql$g)O@h1tL;KNMe5t6T4u$*j_#Y>bp!?yW2`%a
zDXE~K0<HVxc)8hm<?{2&Rp*t<R@1w(s;eZc_a$d#nWstNRO{+KJzZxtPjYQyuQjVj
zE52oQUA}Ss-;#WFNCVu*&)#;d=Ps*k@w($~mFTGDF<aC()9;?T%hmqmsrH9#mCf?B
z?dr3l9<2JOVXEK#b}YR&f8Ns?Ty34VhlNa8%8tK1Ebp^Lx_ZORw##(Xbkh{Oe5==Y
z%N^P=?xUTXwUx+|r?hIS|7CNV9yMQZL!41Eud|2syBB>@&i<Fq>!z{4)=9BQs>SGs
z(J$rq@g@e*5lFVU8vh4wch+w6bY+@@d%bm6KARK+>_P#>c6(r-A6@m&X1mo_x&cYC
z%+s|5wHgy7fx18n;M2s?JiVRH%c|Iq4+d+H)vz4dZ`3nG2p|l;c%dFzH)*!Ksk_B=
zZ^13C6UAm_wMeV!w&S+AE=tV5(==8$<>Ry^GJX5D+m49KjX#|1AgHf{U<A0bCWSrv
zh*7a#BE^I-0JWla6eN6lO7E6MX9?C>eoMdCFT4dc-h%sj3%|e&NS}8TtAH6s#!na%
z>H>2BF`=hv)}|xgh@E!IbbX<Au(?%kXI%Paibi{{FL>nR^<_%BenIy>>liM-5@U7^
zSjwVq>jCrm=v#7|<xje!l43O;t?DNe3~5fgKmAvlKcsawPhQ4s$6vu7B3dv3frQ&H
z+D~-bCl2z9Q)G5|bP$tH5z=GYWpSIff0t=-f7|rqfhw&r^>J?cU@vLcQ8$-DhQ;H*
zvm$K?CP-gAiVI9V;}Ix=rLfThgk+-c?ocvibQKaO-Vf(xQB2cfVOw%k`}T|I5Qj*P
z>^K0z6C)4(z0dD<ucK|4d`zXe{?h&4^K}<ald38oyA2ulta+NJ#qza)3<B0y;*F5+
zU<G4V+IqE%t@b*6{hQH^c1m-j&>>1)+7a()^V_Sj+#kB{R6307)4r~cbhjXE9Yi2S
zJt9CWQO1bzFeoLTARXs3Y!M&?m!1*O+0K@t2vEc<3eaXXA(9}H;3JcO^`24S+8-%0
z9zvB=K4%p;V2V2uFhwU==*X8)qs$oRo=MQz&X%GAFah112Uk3zAfn(X6rlG(0q=_f
zf^@X39n{<`A@>;+U}aWU?YIDPOeR`cAtkLcKlSE&FbX=`*@6N+V&PCa6i5_N5K-`<
zQ1FjD&+b-jG!VTfPk}ajtZ$lL=LZC{A`=8J5bw88_T~~p&lVlBz(4@nT3^6E7Z@nO
z>;o(*3}&*jugOZF!%6)O3*pgbCD5Z+BZAFX*4VEA(CgAz-)0?VxP++}FQz`S;l9aq
zv|e+g3L?Z2{&Ot7?W9-vbw|~Ek_k74D}Bx{;k7@q31Vx1q(1$zZ@Z53N6Da)k_xZ>
zh}27e!8Cg3NB2(DJJ|~9uiZvpQuvJVjEq&m+Cha0!303UYoOP^Wrw*a-_Gx#@s|0Q
zaLSH!71TSsO91M|L)fQ7HYx~kF_A!WBS=p6lyj!6%%>=c*&)8OLt3pcW{7;`43RD(
z_0FJEHYw8p!XuCx5!4K+p`E3nBn%?qStOEgBDGmz1X74VA_L4RC}#`Q@1%lqNRkkv
zi5^c7CG0E%6CvdG>Od)C$vc)>Z835wL@xDDsAB*N|6FQRG?#R!!~wU1Hx^2$6bEnq
znbc;7kx3ykiS=K>S6G_@)j^BrB!44A%*}8j0aV8Rn8~{hfJ%S+^z~O1vE+TnQL8CN
zE``V?-ak!)DQgVeYnnzQVv=ws3JA$4wOk5f1ZTK}BbR)0sm&B4l|rPF7+^~j#Ksh)
z*Yii7We8%E<_!aogb*x69(f<WwHje0(piagO2Rj6627J9gzql=$pP?(sk;?=#vjH4
z*}%*kn_+idx&b4{F))iDeAOHy2ty3bhDaoq%FZ5Ozl(lGg#d-!nje(Vju@#51xz%8
z=?sg0`?eUl6d;!{9AMGU%pNemD}HW*f?|_BjWD*ck_uwU&mf6MB%NW+Z^sNHkAfL6
zBKSTdMvMm7KSCXwgx~EWjS8}<SbCf&nGMT$FcbMKGSE8%+l(<{FvPG74*(`<qa@;a
zUz;S@&SVMZ28>RX1u>5mk#q(m?VDjl(nm&8_jX&{J98ald#F0X!0Uif%P^Oej3(xk
zUn9u@^}64-f79aGD!%QvcZM_85x8{w0)58&Mus>UY>o)D#>@fp`|yF@ZHs5D#0}%8
zxMlzIJLTGReQwb-Dveh%b6VfpE4`kx(z|K#pq1#N{av(ozN<Mzvf01tH4)$FxG;<u
zFC{K0<AD1;ZDoMw#p70@YaTsM)H~x7YxZM%?toXXT&o~6OJvTR#pb{=1QZTqD=~@N
z_Poy(wVGm_D++P?x_2ffX22|PA+N_KK8s+ps)o6a92zPGa=-zN2ORjPQi~-<D1`_m
zHNZ53w5Fi^&N4U=VxUA!3a~rd6$Sz&5~1WDN-dTcp%fsL2pr&nB?$Y5(zA$z5(W&1
z1tl8CZ{DHQW{D9>Awmfau+A@p-QOlWuk#xjV$$9wn3(aKO*Vn?*p-N-*KIL^DMT>g
z0TMXO2`CgGzv&xBgy<;Aq#tqAP$`)GDsgYGe=4;YVq{W?Od<o!bxUs3_KDY1SJpZN
zNW>-^RTj@(iAd_U!$_rI_R(SbKKtkh9pDMv(C#Srn-}g>bYLb-S}o>HU?yW=7Ag3e
zB}N8@7?}-`S1gD-Kok32^0P8T4+$nFlMo6ks#qvoif68zW67_@79*HK1QQ=%(NDOY
z-puc+pH(rZL77EA#oZxwG#<PXx%8?jMl6LhX5{ZQX6&81PN01RH3dFnvqppfj_sbW
zW-cEEgTQ$1ihl&Q7-A$~h=G|LfJxll4JGqSrA7ve$>xm;Vj?R7=?p+>vBHR?5Rs$?
zNO>S8E06ijc)-$}0|kMCZigRnPgjq}Kt&+6+F+znfHb18|MU2u89_m>>FUoS1W(K|
zpL<+r82MLU{~2>a&+sU|eJhMW3K2*{q^g^z4M8A;-%NF<f|N;AcbNy!uJna~q?mVb
ojx_asJB&<vS0=gldGeH2*Pq-Q{j;o++v`t%01VJx#e=*6034tF_W%F@

literal 0
HcmV?d00001

diff --git a/opamp_circuits_C_GARRETT/opamps.tex b/opamp_circuits_C_GARRETT/opamps.tex
index 1c618e9..cfc2d87 100644
--- a/opamp_circuits_C_GARRETT/opamps.tex
+++ b/opamp_circuits_C_GARRETT/opamps.tex
@@ -1382,6 +1382,107 @@ $$
 % \subsection{Exponential squared to Exponential}
 % 
 % can I say that ?
+
+
+
+\section{Double Simultaneous Failures}
+
+The probability for independent double simultaneous component failures (because we would multiply the probabilities of failure) is very low.
+However, some critical systems have to consider these type of eventualities.
+The burner control industry has to consider these, and these are written into the 
+the gas burner standard EN298~\cite{en298}. EN298 does not specifically state that
+double simultaneous failures must be considered. What it does say is that
+in the event of a lockout -- a condition where an error has been detected and 
+the equipment moves to a safe non-functioning state -- no secondary failure may cause a dangerous condition.
+This is slightly vague: there are so many possible component failures that could
+cause a secondary failure, that it is very difficult not to interpret this
+as meaning we have to cater for double simultaneous failures for the most critical sections
+of a system. In practise -- in the field of EN298: burner controllers --  this means triple safeguards to ensure the fuel
+is not allowed to flow under an error condition. This would of course leave the possibility of
+other more complex double failures tricking the controller into thinking the 
+combustion was actually safe when it was not.
+
+It has been shown that, for all but trivial small systems, double failure mode checking
+is impossible from a practical perspective.
+FMMD can reduce the number of checks to make to achieve double simultaneous failure checking -- but by the very nature 
+of choosing {\fgs} we will not (in the initial stages) be cross checking all possible
+combinations of double failures in all the components.
+
+The diagram in figure~\ref{fig:dubsim1}, uses Euler diagrams to model failure modes (as closed contours) and asterisks 
+to model failure mode scenarios. The failure scenario is defined by the contours that enclose it.
+Consider a system which has four components $c_1 \ldots c_4$.
+Consider that each of these components may fail in two ways: $a$ and $b$, i.e $fm(c_1) = fm(c_2) = \{a,b\}$.
+Now consider two {\fgs}, $fg1 = \{ c_1, c_2 \}$ and $fg2 = \{ c_3, c_4 \}$.
+
+We list all the possible failure scenarios as $FS1 \ldots FS6$ for each functional group.
+For instance $FS5$ is the result of component $c_2$ failing with failure mode $a$ and component $c_1$ failing
+with failure mode $b$. We can express this as $c_2 a \cup c_1 b$.
+
+
+\begin{figure}[h]
+ \centering
+ \includegraphics[width=300pt,keepaspectratio=true]{./dubsim1.png}
+ % dubsim1.png: 612x330 pixel, 72dpi, 21.59x11.64 cm, bb=0 0 612 330
+ \caption{Simultaneous Failure Mode Scenarios}
+ \label{fig:dubsim1}
+\end{figure}
+
+
+
+From figure~\ref{fig:dubsim1} we can see that the double failure modes within the {\fgs} have been examined.
+How do we model the double failures that occur across the {\fgs}, for instance
+$c_4 a \cup c_1 a$.
+It could be argued that because functional groups are chosen for their functionality, and re-usability
+that component failures in one should not affect a different {\fg}, but this is a weak argument.
+Merely double checking within {\fgs} would be marginally better than
+only applying it to the most obvious critical elements of a system.
+
+What is really required is a way that all double simultaneous failures
+are checked.
+
+One way of doing this is to apply double failure mode
+checking to all {\fgs} higher up in the hierarchy.
+
+This guarantees to check the symptoms caused by the 
+failure modes in the other {\fgs} with the symptoms
+derived from the other {\fgs} modelling for double failures.
+This guarantees
+double failure move coverage.
+
+To extend the example in figure~\ref{fig:dubsim1} we can map the failure 
+scenarios.
+For Functional Group 1 (FG1), let us map:
+\begin{eqnarray*}
+  FS1 & \mapsto & S1   \\
+  FS2 & \mapsto & S3    \\
+   FS3 & \mapsto & S1     \\
+  FS4 & \mapsto & S2     \\
+  FS5 & \mapsto & S2     \\
+  FS6 & \mapsto & S3    
+\end{eqnarray*}
+
+Thus a derived component, DC1, has the failure modes defined by $fm(DC1) = \{ S1, S2, S3 \}$.
+
+
+For Functional Group 2 (FG2), let us map:
+\begin{eqnarray*}
+  FS1 & \mapsto & S4   \\
+  FS2 & \mapsto & S5    \\
+   FS3 & \mapsto & S5     \\
+  FS4 & \mapsto & S4     \\
+  FS5 & \mapsto & S6     \\
+  FS6 & \mapsto & S5    
+\end{eqnarray*}
+
+This 
+% does not cover what weird side effect may occur though, but then the {\fg} was not modelled correctly in the first place...
+
+
+
+
+
+
+
 \bibliographystyle{plain}
 \bibliography{../vmgbibliography,../mybib}