robin/Robin_PHD
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OK re-organised CH4. Put sys safe example in with a couple of extra hierarchy diagrams

Browse Source 
and put the formal defininitions into the appendix, along with the algorithm descriptions.
Needs red penning. Alot probably.
Going to dump a full back up on ubuntu one just in case I forgot
to `git add' any graphics file.
find out at work on tuesday.
This commit is contained in:
Robin Clark 2012-05-05 15:24:09 +01:00
parent 8066055b12
commit c138464dbf
13 changed files with 2803 additions and 2352 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
presentations/System_safety_2011/submission.tex
View File

@ -576,26 +576,8 @@ and determine how they affect the operation of the potential divider.
%which is represented on the diagram, with an asterisk marking
%which failure modes is modelling (see figure \ref{fig:fg1a}).
\ifthenelse {\boolean{pld}}
{
Each labelled asterisk in the diagram represents a failure mode scenario.
The failure mode scenarios are given {\fc} numbers, and an example to clarify this follows
in table~\ref{pdfmea}.
\begin{figure}[h+]
\centering
\includegraphics[width=200pt,keepaspectratio=true]{./noninvopamp/fg1a.png}
% fg1a.jpg: 430x271 pixel, 72dpi, 15.17x9.56 cm, bb=0 0 430 271
\caption{potential divider with {\fcs}}
\label{fig:fg1a}
\end{figure}
}
{
}
\ifthenelse {\boolean{dag}}
{
For this example we look at single failure modes only.
For each failure mode in our {\fg} `potential~divider'
we can assign a {\fc} number (see table \ref{pdfmea}).
@ -655,9 +637,6 @@ This is represented in the DAG in figure \ref{fig:fg1adag}.
\caption{Failure symptoms of the `Potential Divider'}
\label{fig:fg1adag}
\end{figure}
}
{
}
{ \small
\begin{table}[ht]
@ -680,39 +659,6 @@ This is represented in the DAG in figure \ref{fig:fg1adag}.
\end{table}
}
\ifthenelse {\boolean{pld}}
{
We can now collect the symptoms of failure. From the four base component failure modes, we now
have two symptoms, where the potential divider will give an incorrect low voltage (which we can term $LowPD$)
or an incorrect high voltage (which we can term $HighPD$).
We can represent the collection of these symptoms by drawing connecting lines between
the {\fcs} and naming them (see figure \ref{fig:fg1b}).
\begin{figure}[h+]
\centering
\includegraphics[width=200pt,keepaspectratio=true]{./noninvopamp/fg1b.png}
% fg1b.jpg: 430x271 pixel, 72dpi, 15.17x9.56 cm, bb=0 0 430 271
\caption{Collection of potential divider failure mode symptoms}
\label{fig:fg1b}
\end{figure}
%\page
We can now make a `derived component' to represent this potential divider.
This can be named \textbf{PD}.
This {\dc} will have two failure modes.
We can use the symbol $\bowtie$ to represent taking the analysed
{\fg} and creating from it, a {\dc}.
%We could represent it algebraically thus: $ \bowtie(PotDiv) =
\begin{figure}[h+]
\centering
\includegraphics[width=200pt,keepaspectratio=true]{./noninvopamp/dc1.png}
% dc1.jpg: 430x619 pixel, 72dpi, 15.17x21.84 cm, bb=0 0 430 619
\caption{From functional group to derived component}
\label{fig:dc1}
\end{figure}
}
{
}
\ifthenelse {\boolean{dag}}
{
@ -759,21 +705,8 @@ Let use now consider the op-amp. According to
FMD-91~\cite{fmd91}[3-116] an op amp may have the following failure modes:
latchup(12.5\%), latchdown(6\%), nooperation(31.3\%), lowslewrate(50\%).
\nocite{mil1991}
\ifthenelse {\boolean{pld}}
{
We can represent these failure modes on a diagram (see figure~\ref{fig:op1}).
\begin{figure}[h+]
\centering
\includegraphics[width=200pt,keepaspectratio=true]{./noninvopamp/op1.png}
% op1.jpg: 406x221 pixel, 72dpi, 14.32x7.80 cm, bb=0 0 406 221
\caption{Op Amp failure modes}
\label{fig:op1}
\end{figure}
}
{
}
\ifthenelse {\boolean{dag}}
{
We can represent these failure modes on a DAG (see figure~\ref{fig:op1dag}).
\begin{figure}
\centering
@ -803,9 +736,6 @@ We can represent these failure modes on a DAG (see figure~\ref{fig:op1dag}).
\label{fig:op1dag}
\end{figure}
}
{
}
%\clearpage
%\paragraph{Modelling the OP amp with the potential divider.}
We can now consider merging the OP amp and the potential divider, to
@ -841,16 +771,13 @@ regions) see figure~\ref{fig:fgampa}.
{
}
\ifthenelse {\boolean{dag}}
{
We can now create a {\fg} for the non-inverting amplifier
by bringing together the failure modes from \textbf{opamp} and \textbf{PD}.
Each of these failure modes will be given a {\fc} for analysis,
and this is represented in table \ref{ampfmea}.
}
{
}
%\clearpage
{\footnotesize

2
submission_thesis/CH4_FMMD/Makefile
View File

@ -1,6 +1,6 @@
PNG_DIA = cfg2.png cfg.png compco2.png compco3.png compco.png component.png componentpl.png fmmd_uml2.png fmmd_uml.png partitioncfm.png master_uml.png top_down_de_comp.png
PNG_DIA = cfg2.png cfg.png compco2.png compco3.png compco.png component.png componentpl.png fmmd_uml2.png fmmd_uml.png partitioncfm.png master_uml.png top_down_de_comp.png dc1.png dc2.png
%.png:%.dia

2684
submission_thesis/CH4_FMMD/copy.tex
View File

File diff suppressed because it is too large Load Diff

BIN
submission_thesis/CH4_FMMD/dc1.dia Normal file
View File

Binary file not shown.

BIN
submission_thesis/CH4_FMMD/dc2.dia Normal file
View File

Binary file not shown.

BIN
submission_thesis/CH4_FMMD/master_uml.dia
View File

Binary file not shown.

BIN
submission_thesis/CH4_FMMD/noninv.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 4.4 KiB

230
submission_thesis/CH5_Examples/copy.tex
View File

@ -417,7 +417,7 @@ A {\fg} is a collection of components that perform some simple task or function.
In order to determine how a {\fg} can fail,
we need to consider all the failure modes of all its components.
%
By analysing the fault behavior of a `{\fg}' with respect to all its components failure modes,
By analysing the fault behaviour of a `{\fg}' with respect to all its components failure modes,
we can determine its symptoms of failure.
%In fact we can call these
%the symptoms of failure for the {\fg}.
@ -479,123 +479,123 @@ is shown as a `$\derivec$' symbol.
\section{Example Analysis: Non-Inverting OPAMP}
Consider a non inverting op-amp designed to amplify
a small positive voltage (typical use would be a thermocouple amplifier
taking a range from 0 to 25mV and amplifying it to the useful range of an ADC, approx 0 to 4 volts).
\begin{figure}[h+]
\centering
\includegraphics[width=100pt]{CH5_Examples/mvampcircuit.png}
% mvampcircuit.png: 243x143 pixel, 72dpi, 8.57x5.04 cm, bb=0 0 243 143
\label{fig:mvampcircuit}
\caption{positive mV amplifier circuit}
\end{figure}
We can begin by looking for functional groups.
The resistors $ R1, R2 $ perform a fairly common function in electronics, that of the potential divider.
So we can examine $\{ R1, R2 \}$ as a {\fg}.
\subsection{The Resistor in terms of failure modes}
We can now determine how the resistors can fail.
We consider the {\fms} for resistors to be OPEN and SHORT (see section~\ref{ros}).
%, i.e.
%$ fm(R) = \{ OPEN, SHORT \} . $
We can express the failure modes of a component using the function $fm$, thus for the resistor, $ fm(R) = \{ OPEN, SHORT \}$.
We have two resistors in this circuit and therefore four component failure modes to consider for the potential divider.
We can now examine what effect each of these failures will have on the {\fg} (see table~\ref{tbl:pd}).
\subsection{Analysing a potential divider in terms of failure modes}
\label{potdivfmmd}
\begin{figure}[h+]
\centering
\includegraphics[width=100pt,keepaspectratio=true]{CH5_Examples/pd.png}
% pd.png: 361x241 pixel, 72dpi, 12.74x8.50 cm, bb=0 0 361 241
\label{fig:pdcircuit}
\caption{Potential Divider Circuit}
\end{figure}
\begin{table}[h+]
\caption{Potential Divider: Single failure analysis}
\begin{tabular}{|| l | l | c | c | l ||} \hline
\textbf{Failure Scenario} & & \textbf{Pot Div Effect} & & \textbf{Symptom} \\
\hline
FS1: R1 SHORT & & $LOW$ & & $PDLow$ \\
FS2: R1 OPEN & & $HIGH$ & & $PDHigh$ \\ \hline
FS3: R2 SHORT & & $HIGH$ & & $PDHigh$ \\
FS4: R2 OPEN & & $LOW$ & & $PDLow$ \\ \hline
\hline
\end{tabular}
\label{tbl:pd}
\end{table}
We can now create a {\dc} for the potential divider, $PD$.
$$ fm(PD) = \{ PDLow, PDHigh \}$$
%Let us now consider the op-amp. According to
%FMD-91~\cite{fmd91}[3-116] an op-amp may have the following failure modes:
%latchup(12.5\%), latchdown(6\%), nooperation(31.3\%), lowslewrate(50\%).
\subsection{Analysing the non-inverting amplifier in terms of failure modes}
From section~\ref{sec:opamp_fms}
$$ fm(OPAMP) = \{L\_{up}, L\_{dn}, Noop, L\_slew \} $$
We can now form a {\fg} with $PD$ and $OPAMP$.
\begin{figure}
\centering
\includegraphics[width=300pt]{CH5_Examples/non_inv_amp_fmea.png}
% non_inv_amp_fmea.png: 964x492 pixel, 96dpi, 25.50x13.02 cm, bb=0 0 723 369
\label{fig:invampanalysis}
\end{figure}
\begin{table}[h+]
\caption{NIAMP: Single failure analysis}
\begin{tabular}{|| l | l | c | c | l ||} \hline
\textbf{Failure Scenario} & & \textbf{Non In Amp Effect} & & \textbf{Symptom} \\
\hline
FS1: PD HIGH & & $LOW$ & & $Low$ \\
FS2: PD LOW & & $HIGH$ & & $High$ \\ \hline
FS3: OPAMP $L_{UP}$ & & $HIGH$ & & $High$ \\
FS4: OPAMP $L_{DOWN}$ & & $LOW$ & & $Low$ \\
FS5: OPAMP $Noop$ & & $LOW$ & & $Low$ \\
FS5: OPAMP $Low slew$ & & $LOW$ & & $Lowpass$ \\ \hline
\hline
\end{tabular}
\label{tbl:pd}
\end{table}
We can collect symptoms from the analysis and create a derived component
to represent the non-inverting amplifier $NI\_AMP$.
We can now express the failure mode behaviour of this type of amplifier thus:
$$ fm(NIAMP) = \{ {lowpass}, {high}, {low} \}.$$
% \section{Example Analysis: Non-Inverting OPAMP}
% Consider a non inverting op-amp designed to amplify
% a small positive voltage (typical use would be a thermocouple amplifier
% taking a range from 0 to 25mV and amplifying it to the useful range of an ADC, approx 0 to 4 volts).
%
%
% \begin{figure}[h+]
% \centering
% \includegraphics[width=100pt]{CH5_Examples/mvampcircuit.png}
% % mvampcircuit.png: 243x143 pixel, 72dpi, 8.57x5.04 cm, bb=0 0 243 143
% \label{fig:mvampcircuit}
% \caption{positive mV amplifier circuit}
% \end{figure}
%
% We can begin by looking for functional groups.
% The resistors $ R1, R2 $ perform a fairly common function in electronics, that of the potential divider.
% So we can examine $\{ R1, R2 \}$ as a {\fg}.
%
%
% \subsection{The Resistor in terms of failure modes}
%
% We can now determine how the resistors can fail.
% We consider the {\fms} for resistors to be OPEN and SHORT (see section~\ref{ros}).
% %, i.e.
% %$ fm(R) = \{ OPEN, SHORT \} . $
%
% We can express the failure modes of a component using the function $fm$, thus for the resistor, $ fm(R) = \{ OPEN, SHORT \}$.
%
%
% We have two resistors in this circuit and therefore four component failure modes to consider for the potential divider.
% We can now examine what effect each of these failures will have on the {\fg} (see table~\ref{tbl:pd}).
%
%
% \subsection{Analysing a potential divider in terms of failure modes}
%
% \label{potdivfmmd}
%
%
%
% \begin{figure}[h+]
% \centering
% \includegraphics[width=100pt,keepaspectratio=true]{CH5_Examples/pd.png}
% % pd.png: 361x241 pixel, 72dpi, 12.74x8.50 cm, bb=0 0 361 241
% \label{fig:pdcircuit}
% \caption{Potential Divider Circuit}
% \end{figure}
%
%
% \begin{table}[h+]
% \caption{Potential Divider: Single failure analysis}
% \begin{tabular}{|| l | l | c | c | l ||} \hline
% \textbf{Failure Scenario} & & \textbf{Pot Div Effect} & & \textbf{Symptom} \\
% \hline
% FS1: R1 SHORT & & $LOW$ & & $PDLow$ \\
% FS2: R1 OPEN & & $HIGH$ & & $PDHigh$ \\ \hline
% FS3: R2 SHORT & & $HIGH$ & & $PDHigh$ \\
% FS4: R2 OPEN & & $LOW$ & & $PDLow$ \\ \hline
% \hline
% \end{tabular}
% \label{tbl:pd}
% \end{table}
%
% We can now create a {\dc} for the potential divider, $PD$.
%
% $$ fm(PD) = \{ PDLow, PDHigh \}$$
%
% %Let us now consider the op-amp. According to
% %FMD-91~\cite{fmd91}[3-116] an op-amp may have the following failure modes:
% %latchup(12.5\%), latchdown(6\%), nooperation(31.3\%), lowslewrate(50\%).
%
%
% \subsection{Analysing the non-inverting amplifier in terms of failure modes}
%
% From section~\ref{sec:opamp_fms}
% $$ fm(OPAMP) = \{L\_{up}, L\_{dn}, Noop, L\_slew \} $$
%
%
% We can now form a {\fg} with $PD$ and $OPAMP$.
%
% \begin{figure}
% \centering
% \includegraphics[width=300pt]{CH5_Examples/non_inv_amp_fmea.png}
% % non_inv_amp_fmea.png: 964x492 pixel, 96dpi, 25.50x13.02 cm, bb=0 0 723 369
% \label{fig:invampanalysis}
% \end{figure}
%
%
%
%
% \begin{table}[h+]
% \caption{NIAMP: Single failure analysis}
% \begin{tabular}{|| l | l | c | c | l ||} \hline
% \textbf{Failure Scenario} & & \textbf{Non In Amp Effect} & & \textbf{Symptom} \\
% \hline
% FS1: PD HIGH & & $LOW$ & & $Low$ \\
% FS2: PD LOW & & $HIGH$ & & $High$ \\ \hline
% FS3: OPAMP $L_{UP}$ & & $HIGH$ & & $High$ \\
% FS4: OPAMP $L_{DOWN}$ & & $LOW$ & & $Low$ \\
% FS5: OPAMP $Noop$ & & $LOW$ & & $Low$ \\
% FS5: OPAMP $Low slew$ & & $LOW$ & & $Lowpass$ \\ \hline
%
% \hline
% \end{tabular}
% \label{tbl:pd}
% \end{table}
%
% We can collect symptoms from the analysis and create a derived component
% to represent the non-inverting amplifier $NI\_AMP$.
% We can now express the failure mode behaviour of this type of amplifier thus:
%
% $$ fm(NIAMP) = \{ {lowpass}, {high}, {low} \}.$$
%
%
\clearpage
\section{Inverting OPAMP}
\section{Example Analysis: Inverting OPAMP}
\label{sec:invamp}

328
submission_thesis/CH6_Evaluation/copy.tex
View File

@ -1,26 +1,304 @@
\section{Copy dot tex}
\section*{Metrics}
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
sample text
\section{Defining the concept of `comparison~complexity' in FMEA}
%
% DOMAIN == INPUTS
% RANGE == OUTPUTS
%
When performing FMEA, we have a system under investigation, which will be
comprised of a collection of components which have associated failure modes.
The object of FMEA is to determine cause and effect:
from the failure modes (the causes, {\fms} of {\bcs}) to the effects (or symptoms of failure) at the top level.
%
To perform FMEA rigorously
we could stipulate that every failure mode must be checked for effects
against all the components in the system.
We could term this `rigorous~FMEA'~(RFMEA).
The number of checks we have to make to achieve this, gives an indication of the complexity of the task.
%
We could term this `comparison~complexity', as the number of
paths between failure modes and components necessary to achieve RFMEA for a given system/functional~group.
% (except its self of course, that component is already considered to be in a failed state!).
%
Obviously, for a small number of components and failure modes, we have a smaller number
of checks to make than for a complicated larger system.
%
We can consider the system as a large {\fg} of components.
We represent the number of components in the {\fg} $G$, by
$ | G | $,
(an indexing and sub-scripting notation to identify particular {\fgs}
within an FMMD hierarchy is given in section~\ref{sec:indexsub}).
The function $fm$ has a component as its domain and the components failure modes as its range (see equation~\ref{eqn:fm}).
We can represent the number of potential failure modes of a component $c$, to be $ | fm(c) | .$
If we index all the components in the system under investigation $ c_1, c_2 \ldots c_{|\FG|} $ we can express
the number of checks required to rigorously examine every
failure mode against all the other components in the system.
We can define this as a function, Comparison Complexity, $CC$, with its domain as the system
or {\fg}, $\FG$, and
its range as the number of checks to perform to satisfy a rigorous FMEA inspection.
Where $\mathcal{\FG}$ represents the set of all {\fgs}, and $ \mathbb{N} $ any natural integer, $CC$ is defined by,
\begin{equation}
%$$
CC:\mathcal{\FG} \rightarrow \mathbb{N},
%$$
\end{equation}
and, where n is the number of components in the system/{\fg}, $|fm(c_i)|$ is the number of failure modes
in component ${c_i}$, is given by
\begin{equation}
\label{eqn:CC}
%$$
%%% when it was called reasoning distance -- 19NOV2011 -- RD(fg) = \sum_{n=1}^{|fg|} |fm(c_n)|.(|fg|-1)
CC(\FG) = (n-1) \sum_{1 \le i \le n} fm(c_i).
%$$
\end{equation}
This can be simplified if we can determine the total number of failure modes in the system $K$, (i.e. $ K = \sum_{n=1}^{|G|} {|fm(c_n)|}$);
equation~\ref{eqn:CC} becomes
%$$
\begin{equation}
\label{eqn:rd2}
CC(\FG) = K.(|\FG|-1).
\end{equation}
%$$
%Equation~\ref{eqn:rd} can also be expressed as
%
% \begin{equation}
% \label{eqn:rd2}
% %$$
% CC(G) = {|G|}.{|fm(c_n)|}.{(|fg|-1)} .
% %$$
% \end{equation}
\subsection{A general formula for counting Comparison Complexity in an FMMD hierarchy}
An FMMD Hierarchy will have reducing numbers of functional groups as we progress up the hierarchy.
In order to calculate its comparison~complexity we need to apply equation~\ref{eqn:CC} to
all {\fgs} on each level.
We define a helper function $g$ with a domain of the level $i$ in an FMMD hierarchy $H$, and a co-domain of a set of {\fgs} (specifically all the {\fgs} on the given level),
defined by
\begin{equation}
%$$
g(H, i) \rightarrow \forall {\FG}^{\xi} \;where\; ({\xi} = {i}) \wedge ({\FG}^{\xi} \in H) .
%$$
\end{equation}
Where $L$ represents the number of levels in the FMMD hierarchy,
$|g(\xi)|$ represents the number of functional groups on the level
and $H$ represents an FMMD hierarchy,
we overload the comparison complexity thus:
%$$
\begin{equation}
\label{eqn:gf}
CC(H) = \sum_{\xi=0}^{L} \sum_{j=1}^{|g(H,\xi)|} CC({\FG}_{j}^{\xi}).
%$$
\end{equation}
\pagebreak[4]
\subsection{Complexity Comparison Examples}
The potential divider discussed in section~\ref{potdivfmmd} has four failure modes and two components and therefore has $CC$ of 4.
$$CC(potdiv) = \sum_{n=1}^{2} |2|.(|1|) = 4 $$
Even considering a $example$ system with just 81 components (with these components
having 3 failure modes each) we would have an $CC$ of
$$CC(example) = \sum_{n=1}^{81} |3|.(|80|) = 19440 .$$
Ensuring all component failure modes are checked against all other components in a system
-- applying FMEA rigorously -- could be termed
Rigorous FMEA (RFMEA).
The computational order for RFMEA would be polynomial ($O(N^2.K)$) (where $K$ is the variable number of failure modes).
This order may be acceptable in a computational environment: However, the choosing of {\fgs} and the analysis
process are by-hand/human activities. It can be seen that it is practically impossible to achieve
RFMEA for anything but trivial systems.
%
% Next statement needs alot of justification
%
It is the authors belief that FMMD reduces the comparison complexity enough to make
rigorous checking feasible.
\pagebreak[4]
%\subsection{Using the concept of Complexity Comparison to compare RFMEA with FMMD}
\begin{figure}
\centering
\includegraphics[width=400pt,keepaspectratio=true]{CH5_Examples/three_tree.png}
% three_tree.png: 851x385 pixel, 72dpi, 30.02x13.58 cm, bb=0 0 851 385
\caption{FMMD Hierarchy with number of components in {\fg} fixed to 3 $(|G| = 3)$ } % \wedge (|fm(c)| = 3)$}
\label{fig:three_tree}
\end{figure}
\subsection{Comparing FMMD and RFMEA comparison complexity}
Because components have variable numbers of failure modes,
and {\fgs} have variable numbers of components, it is difficult to
use the general formula for comparing the number of checks to make for
RFMEA and FMMD.
%
If we were to create an example by fixing the number of components in a {\fg}
and the number of failure modes per component, we can derive formulae
to compare the number of checks to make from an FMMD hierarchy to RFMEA applied to
all components in a system.
Consider $k$ to be the number of components in a {\fg} (i.e. $k=|{\FG}|$),
$f$ is the number of failure modes per component (i.e. $f=|fm(c)|$), and
$L$ to be the number of levels in the hierarchy of an FMMD analysis.
We can represent the number of failure scenarios to check in a (fixed parameter for $|{\FG}|$ and $|fm(c_i)|$) FMMD hierarchy
with equation~\ref{eqn:anscen}.
\begin{equation}
\label{eqn:anscen}
\sum_{n=0}^{L} {k}^{n}.k.f.(k-1)
\end{equation}
The thinking behind equation~\ref{eqn:anscen}, is that for each level of analysis -- counting down from the top --
there are ${k}^{n}$ {\fgs} within each level; we need to apply RFMEA to each {\fg} on the level.
The number of checks to make for RFMEA is number of components $k$ multiplied by the number of failure modes $f$
checked against the remaining components in the {\fg} $(k-1)$.
If, for the sake of example, we fix the number of components in a {\fg} to three and
the number of failure modes per component to three, an FMMD hierarchy
would look like figure~\ref{fig:three_tree}.
\subsection{RFMEA FMMD Comparison Example}
Using the diagram in figure~\ref{fig:three_tree}, we have three levels of analysis.
Starting at the top, we have a {\fg} with three derived components, each of which has
three failure modes.
Thus the number of checks to make in the top level is $3^0.3.2.3=18$.
On the level below that, we have three {\fgs} each with a
an identical number of checks, $3^1.3.2.3=56$.%{\fg}
On the level below that we have nine {\fgs}, $3^2.3.2.3=168$.
Adding these together gives $242$ checks to make to perform FMMD (i.e. RFMEA {\em{within the}}
{\fgs}).
If we were to take the system represented in figure~\ref{fig:three_tree}, and
apply RFMEA on it as a whole system, we can use equation~\ref{eqn:CC},
$CC(G) = \sum_{n=1}^{|G|} |fm(c_n)|.(|G|-1)$, where $|G|$ is 27, $fm(c_n)$ is 3
and $(|G|-1)$ is 26.
This gives:
$CC(G) = \sum_{n=1}^{27} |3|.(|27|-1) = 2106$.
In order to get general equations with which to compare RFMEA with FMMD,
we can re-write equation~\ref{eqn:CC} in terms of the number of levels
in an FMMD hierarchy.
%
The number of components in the system, is number of components
in a {\fg} raised to the power of the level plus one.
Thus we re-write equation~\ref{eqn:CC} as:
\begin{equation}
\label{eqn:fmea_state_exp21}
\sum_{n=1}^{k^{L+1}}.(k^{L+1}-1).f \; , % \\
%(N^2 - N).f
\end{equation}
or
\begin{equation}
\label{eqn:fmea_state_exp22}
k^{L+1}.(k^{L+1}-1).f \;. % \\
%(N^2 - N).f
\end{equation}
We can now use equation~\ref{eqn:anscen} and \ref{eqn:fmea_state_exp22} to compare (for fixed sizes of $|G|$ and $|fm(c)|$)
the two approaches, for the work required to perform rigorous checking.
For instance, having four levels
of FMMD analysis, with these fixed numbers,
%(in addition to the top zeroth level)
will require 81 base level components.
$$
%\begin{equation}
\label{eqn:fmea_state_exp22}
3^4.(3^4-1).3 = 81.(81-1).3 = 19440 % \\
%(N^2 - N).f
%\end{equation}
$$
$$
%\begin{equation}
% \label{eqn:anscen}
\sum_{n=0}^{3} {3}^{n}.3.3.(2) = 720
%\end{equation}
$$
% \subsection{Exponential squared to Exponential}
%
% can I say that ?
\section{Problems in choosing membership of functional groups}
\subsection{Side Effects: A Problem for FMMD analysis}
A problem with modularising according to functionality is that we can have component failures that would
intuitively be associated with one {\fg} that may cause unintended side effects in other
{\fgs}.
For instance were we to have a component that on failing $SHORT$ could bring down
a voltage supply rail, this could have drastic consequences for other
functional groups in the system we are examining.
\pagebreak[3]
\subsubsection{Example de-coupling capacitors in logic circuits}
A good example of this, are de-coupling capacitors, often used
over the power supply pins of all chips in a digital logic circuit.
Were any of these capacitors to fail $SHORT$, they could bring down
the supply voltage to the other logic chips.
To a power-supply, shorted capacitors on the supply rails
are a potential source of the symptom, $SUPPLY\_SHORT$.
In a logic chip/digital circuit {\fg} open capacitors are a potential
source of symptoms caused by the failure mode $INTERFERENCE$.
So we have a `symptom' of the power-supply, and a `failure~mode' of
the logic chip to consider.
A possible solution to this is to include the de-coupling capacitors
in the power-supply {\fg}.
% decision, could they be included in both places ????
% I think so
Because the capacitor has two potential failure modes (EN298),
this raises another issue for FMMD. A de-coupling capacitor going $OPEN$ might not be considered relevant to
a power-supply module (but there might be additional noise on its output rails).
But in {\fg} terms the power supply, now has a new symptom that of $INTERFERENCE$.
Some logic chips are more susceptible to $INTERFERENCE$ than others.
A logic chip with de-coupling capacitor failing, may operate correctly
but interfere with other chips in the circuit.
There is no reason why the de-coupling capacitors could not be included {\em in the {\fg} they would intuitively be associated with as well}.
This allows for the general principle of a component failure affecting more than one {\fg} in a circuit.
This allows functional groups to share components where necessary.
This does not break the modularity of the FMMD technique, because, as {\irl},
one component failure may affect more than one sub-system.
It does uncover a weakness in the FMMD methodology though.
It could be very easy to miss the side effect and include
the component causing the side effect into the wrong {\fg}, or only one germane {\fg}.
\section{Critiques}
\section{Evaluation}

1179
submission_thesis/appendixes/algorithmic.tex Normal file
View File

File diff suppressed because it is too large Load Diff

609
submission_thesis/appendixes/formal.tex Normal file
View File

@ -0,0 +1,609 @@
%%%% FORMAL DEFINITIONS %%%% THESE MIGHT BE MOVED TO AN APPENDIX
\chapter{Formal Definitions}
\label{formalfmmd}
\subsection{An algebraic notation for identifying FMMD enitities}
Consider all `components' to exist as
members of a set $\mathcal{C}$.
%
Each component $c$ has an associated set of failure modes.
We can define a function $fm$ that returns a
set of failure modes $F$, for the component $c$.
Let the set of all possible components be $\mathcal{C}$
and let the set of all possible failure modes be $\mathcal{F}$.
We now define the function $fm$
as
\begin{equation}
\label{eqn:fm}
fm : \mathcal{C} \rightarrow \mathcal{P}\mathcal{F}.
\end{equation}
This is defined by, where $c$ is a component and $F$ is a set of failure modes,
$ fm ( c ) = F. $
We can use the variable name $\FG$ to represent a {\fg}. A {\fg} is a collection
of components.
%We thus define $FG$ as a set of chosen components defining
%a {\fg}; all functional groups
We can state that
{\FG} is a member of the power set of all components, $ \FG \in \mathcal{P} \mathcal{C}. $
We can overload the $fm$ function for a functional group {\FG}
where it will return all the failure modes of the components in {\FG}
given by
$$ fm ({\FG}) = F. $$
Generally, where $\mathcal{{\FG}}$ is the set of all functional groups,
\begin{equation}
fm : \mathcal{{\FG}} \rightarrow \mathcal{P}\mathcal{F}.
\end{equation}
\subsection{Relationships between functional~groups and failure modes}
Let the set of all possible components be $\mathcal{C}$
and let the set of all possible failure modes be $\mathcal{F}$, and $\mathcal{PF}$
is the power-set of $\mathcal{F}$.
In order to analyse failure mode effects we need to be able to determine the
failure modes of a component. We define a function $fm$ to perform this (see equation~\ref{eqn:fmset}).
\label{fmdef}
\begin{equation}
fm : \mathcal{C} \rightarrow \mathcal{P}\mathcal{F}
\label{eqn:fmset}
\end{equation}
%%
% Above def gives below anyway
%
%The is defined by equation \ref{eqn:fminstance}, where C is a component and F is a set of failure modes.
%
%\begin{equation}
% fm ( C ) = F
% \label{eqn:fminstance}
%\end{equation}
\paragraph{Finding all failure modes within the functional group.}
For FMMD failure mode analysis %we need to consider the failure modes
from all the components in a functional~group.
In a functional group we have a collection of Components
which have associated failure mode sets.
we need to collect failure mode sets from the components and place them all
%modes
into a single set; this can be termed flattening the set of sets.
%%Consider the components in a functional group to be $C_1...C_N$.
The flat set of failure modes $FSF$ we are after can be found by applying function $fm$ to all the components
in the functional~group and taking the union of them thus:
%%$$ FSF = \bigcup_{j=1}^{N} fm(C_j) $$
$$ FSF = \bigcup_{c \in FG} fm(c) \; .$$
We can actually overload the notation for the function $fm$ % FM
and define it for the set components within a functional group $\mathcal{FG}$ (i.e. where $\mathcal{FG} \subset \mathcal{C} $)
in equation \ref{eqn:fmoverload}.
\begin{equation}
fm : \mathcal{FG} \rightarrow \mathcal{F}
\label{eqn:fmoverload}
\end{equation}
\section{Unitary State Component Failure Mode sets}
\label{sec:unitarystate}
\paragraph{Design Descision/Constraint}
An important factor in defining a set of failure modes is that they
should represent the failure modes as simply and minimally as possible.
It should not be possible, for instance, for
a component to have two or more failure modes active at once.
Were this to be the case, we would have to consider additional combinations of
failure modes within the component.
Having a set of failure modes where $N$ modes could be active simultaneously
would mean having to consider an additional $2^N-1$ failure mode scenarios.
Should a component be analysed and simultaneous failure mode cases exist,
the combinations could be represented by new failure modes, or
the component should be considered from a fresh perspective,
perhaps considering it as several smaller components
within one package.
This property, failure modes being mutually exclusive, is termed `unitary state failure modes'
in this study.
This corresponds to the `mutually exclusive' definition in
probability theory~\cite{probstat}.
\begin{definition}
A set of failure modes where only one failure mode
can be active at one time is termed a {\textbf{unitary~state}} failure mode set.
\end{definition}
Let the set of all possible components be $ \mathcal{C}$
and let the set of all possible failure modes be $ \mathcal{F}$.
The set of failure modes of a particular component are of interest
here.
What is required is to define a property for
a set of failure modes where only one failure mode can be active at a time;
or borrowing from the terms of statistics, the failure mode being an event that is mutually exclusive
with a set $F$.
We can define a set of failure mode sets called $\mathcal{U}$ to represent this
property for a set of failure modes.
\begin{definition}
We can define a set $\mathcal{U}$ which is a set of sets of failure modes, where
the component failure modes in each of its members are unitary~state.
Thus if the failure modes of a component $F$ are unitary~state, we can say $F \in \mathcal{U}$ is true.
\end{definition}
\section{Component failure modes: Unitary State example}
An example of a component with an obvious set of ``unitary~state'' failure modes is the electrical resistor.
Electrical resistors can fail by going OPEN or SHORTED.
For a given resistor R we can apply the
function $fm$ to find its set of failure modes thus $ fm(R) = \{R_{SHORTED}, R_{OPEN}\} $.
A resistor cannot fail with the conditions open and short active at the same time,
that would be physically impossible! The conditions
OPEN and SHORT are thus mutually exclusive.
Because of this, the failure mode set $F=fm(R)$ is `unitary~state'.
%
%
%Thus because both fault modes cannot be active at the same time, the intersection of $ R_{SHORTED} $ and $ R_{OPEN} $ cannot exist.
%
The intersection of these is therefore the empty set, $ R_{SHORTED} \cap R_{OPEN} = \emptyset $,
therefore
$ fm(R) \in \mathcal{U} $.
We can make this a general case by taking a set $F$ (with $f_1, f_2 \in F$) representing a collection
of component failure modes.
We can define a boolean function {\ensuremath{\mathcal{ACTIVE}}} that returns
whether a fault mode is active (true) or dormant (false).
We can say that if any pair of fault modes is active at the same time, then the failure mode set is not
unitary state:
we state this formally
\begin{equation}
\exists f_1,f_2 \in F \dot ( f_1 \neq f_2 \wedge \mathcal{ACTIVE}({f_1}) \wedge \mathcal{ACTIVE}({f_2}) ) \implies F \not\in \mathcal{U}
\end{equation}
%
% \begin{equation}
% c1 \cap c2 \neq \emptyset | c1 \neq c2 \wedge c1,c2 \in C \wedge C \not\in U
% \end{equation}
That is to say that it is impossible that any pair of failure modes can be active at the same time
for the failure mode set $F$ to exist in the family of sets $\mathcal{U}$.
Note where there are more than two failure~modes,
by banning any pairs from being active at the same time,
we have banned larger combinations as well.
\subsection{Design Rule: Unitary State}
All components must have unitary state failure modes to be used with the FMMD methodology and
for base~components this is usually the case. Most simple components fail in one
clearly defined way and generally stay in that state.
However, where a complex component is used, for instance a microcontroller
with several modules that could all fail simultaneously, a process
of reduction into smaller theoretical components will have to be made.
We can term this `heuristic~de-composition'.
A modern micro-controller will typically have several modules, which are configured to operate on
pre-assigned pins on the device. Typically voltage inputs (\adcten / \adctw), digital input and outputs,
PWM (pulse width modulation), UARTs and other modules will be found on simple cheap microcontrollers~\cite{pic18f2523}.
For instance the voltage reading functions which consist
of an ADC multiplexer and ADC can be considered to be components
inside the micro-controller package.
The micro-controller thus becomes a collection of smaller components
that can be analysed separately~\footnote{It is common for the signal paths
in a safety critical product to be traced, and when entering a complex
component like a micro-controller, the process of heuristic de-compostion
is then applied to it.}.
\paragraph{Reason for Constraint.} Were this constraint to not be applied
each component would not contribute $N$ failure modes to consider but potentially
$2^N$.
%
This would make the job of analysing the failure modes
in a {\fg} impractical due to the sheer size of the task.
%Note that the `unitary state' conditions apply to failure modes within a component.
%%- Need some refs here because that is the way gastec treat the ADC on microcontroller on the servos
\section{Handling Simultaneous Component Faults}
For some integrity levels of static analysis, there is a need to consider not only single
failure modes in isolation, but cases where more then one failure mode may occur
simultaneously.
%
Note that the `unitary state' conditions apply to failure modes within a component.
This does not preclude the possibility of two or more components failing simultaneously.
%
%The scenarios presented deal with possibility of two or more components failing simultaneously.
%
It is an implied requirement of EN298~\cite{en298} for instance to
consider double simultaneous faults\footnote{Under the conditions
of LOCKOUT~\cite{en298} in an industrial burner controller that has detected one fault already.
However, from the perspective of static failure mode analysis, this amounts
to dealing with double simultaneous failure modes.}.
%
To generalise, we may need to consider $N$ simultaneous
failure modes when analysing a functional group.
%
This involves finding
all combinations of failures modes of size $N$ and less.
%The Powerset concept from Set theory is useful to model this.
%
The power-set, when applied to a set S is the set of all subsets of S, including the empty set
\footnote{The empty set ( $\emptyset$ ) is a special case for FMMD analysis, it simply means there
is no fault active in the functional~group under analysis.}
and S itself.
%
We augment the power-set concept here to deal with counting the number of
combinations of failures to consider, under the conditions of simultaneous failures.
%
In order to consider combinations for the set S where the number of elements in
each subset of S is $N$ or less, a concept of the `cardinality constrained power-set'
is proposed and described in the next section.
%\pagebreak[1]
\subsection{Cardinality Constrained Powerset }
\label{ccp}
A Cardinality Constrained power-set is one where subsets of a cardinality greater than a threshold
are not included. This threshold is called the cardinality constraint.
To indicate this, the cardinality constraint $cc$ is subscripted to the powerset symbol thus $\mathcal{P}_{cc}$.
Consider the set $S = \{a,b,c\}$.
The power-set of S:
$$ \mathcal{P} S = \{ \emptyset, \{a,b,c\}, \{a,b\},\{b,c\},\{c,a\},\{a\},\{b\},\{c\} \} .$$
$\mathcal{P}_{\le 2} S $ means all non-empty subsets of S where the cardinality of the subsets is
less than or equal to 2.
$$ \mathcal{P}_{\le 2} S = \{ \{a,b\},\{b,c\},\{c,a\},\{a\},\{b\},\{c\} \} . $$
Note that $\mathcal{P}_{1} S $ (non-empty subsets where cardinality $\leq 1$) for this example is:
$$ \mathcal{P}_{1} S = \{ \{a\},\{b\},\{c\} \} $$.
\paragraph{Calculating the number of elements in a cardinality constrained powerset}
A $k$ combination is a subset with $k$ elements.
The number of $k$ combinations (each of size $k$) from a set $S$
with $n$ elements (size $n$) is the binomial coefficient~\cite{probstat} shown in equation \ref{bico}.
\begin{equation}
C^n_k = {n \choose k} = \frac{n!}{k!(n-k)!} .
\label{bico}
\end{equation}
To find the number of elements in a cardinality constrained subset S with up to $cc$ elements
in each combination sub-set,
we need to sum the combinations,
%subtracting $cc$ from the final result
%(repeated empty set counts)
from $1$ to $cc$ thus
%
% $$ {\sum}_{k = 1..cc} {\#S \choose k} = \frac{\#S!}{k!(\#S-k)!} $$
%
\begin{equation}
|{\mathcal{P}_{cc}S}| = \sum^{cc}_{k=1} \frac{|{S}|!}{ cc! ( |{S}| - cc)!} . % was k in the frac part now cc
\label{eqn:ccps}
\end{equation}
\subsection{Actual Number of combinations to check with Unitary State Fault mode sets}
If all of the fault modes in $S$ were independent,
the cardinality constrained powerset
calculation (in equation \ref {eqn:ccps}) would give the correct number of test case combinations to check.
Because sets of failure modes in FMMD analysis are constrained to be unitary state,
the actual number of test cases to check will usually
be less than this.
This is because combinations of faults within a components failure mode set
are impossible under the conditions of unitary state failure mode.
To modify equation \ref{eqn:ccps} for unitary state conditions, we must subtract the number of component `internal combinations'
for each component in the functional group under analysis.
Note we must sequentially subtract using combinations above 1 up to the cardinality constraint.
For example, say
the cardinality constraint was 3, we would need to subtract both
$|{n \choose 2}|$ and $|{n \choose 3}|$ for each component in the functional~group.
\subsubsection{Example: Two Component functional group cardinality Constraint of 2}
For example: suppose we have a simple functional group with two components R and T, of which
$$fm(R) = \{R_o, R_s\}$$ and $$fm(T) = \{T_o, T_s, T_h\}.$$
This means that the functional~group $FG=\{R,T\}$ will have a component failure mode set
of $fm(FG) = \{R_o, R_s, T_o, T_s, T_h\}$
For a cardinality constrained powerset of 2, because there are 5 error modes ( $|fm(FG)|=5$),
applying equation \ref{eqn:ccps} gives :-
$$ | P_2 (fm(FG)) | = \frac{5!}{1!(5-1)!} + \frac{5!}{2!(5-2)!} = 15.$$
This is composed of ${5 \choose 1}$
five single fault modes, and ${5 \choose 2}$ ten double fault modes.
However we know that the faults are mutually exclusive within a component.
We must then subtract the number of `internal' component fault combinations
for each component in the functional~group.
For component R there is only one internal component fault that cannot exist
$R_o \wedge R_s$. As a combination ${2 \choose 2} = 1$. For the component $T$ which has
three fault modes ${3 \choose 2} = 3$.
Thus for $cc = 2$, under the conditions of unitary state failure modes in the components $R$ and $T$, we must subtract $(3+1)$.
The number of combinations to check is thus 11, $|\mathcal{P}_{2}(fm(FG))| = 11$, for this example and this can be verified
by listing all the required combinations:
$$ \mathcal{P}_{2}(fm(FG)) = \{
\{R_o T_o\}, \{R_o T_s\}, \{R_o T_h\}, \{R_s T_o\}, \{R_s T_s\}, \{R_s T_h\}, \{R_o \}, \{R_s \}, \{T_o \}, \{T_s \}, \{T_h \}
\}
$$
and whose cardinality is 11. % by inspection
%$$
%|
%\{
% \{R_o T_o\}, \{R_o T_s\}, \{R_o T_h\}, \{R_s T_o\}, \{R_s T_s\}, \{R_s T_h\}, \{R_o \}, \{R_s \}, \{T_o \}, \{T_s \}, \{T_h \}
%\}
%| = 11
%$$
\pagebreak[1]
\subsubsection{Establishing Formulae for unitary state failure mode
cardinality calculation}
The cardinality constrained powerset in equation \ref{eqn:ccps}, can be modified for % corrected for
unitary state failure modes.
%This is written as a general formula in equation \ref{eqn:correctedccps}.
%\indent{
%To define terms :
%\begin{itemize}
%\item
Let $C$ be a set of components (indexed by $j \in J$)
that are members of the functional group $FG$
i.e. $ \forall j \in J | C_j \in FG $.
%\item
Let $|fm({C}_{j})|$
indicate the number of mutually exclusive fault modes of component $C_j$.
%\item
Let $fm(FG)$ be the collection of all failure modes
from all the components in the functional group.
%\item
Let $SU$ be the set of failure modes from the {\fg} where all $FG$ is such that
components $C_j$ are in
`unitary state' i.e. $(SU = fm(FG)) \wedge (\forall j \in J | fm(C_j) \in \mathcal{U}) $, then
%\end{itemize}
%}
\begin{equation}
|{\mathcal{P}_{cc}SU}| = {\sum^{cc}_{k=1} \frac{|{SU}|!}{k!(|{SU}| - k)!}}
- {\sum_{j \in J} {|FM({C_{j})}| \choose 2}} .
\label{eqn:correctedccps}
\end{equation}
Expanding the combination in equation \ref{eqn:correctedccps}
\begin{equation}
|{\mathcal{P}_{cc}SU}| = {\sum^{cc}_{k=1} \frac{|{SU}|!}{k!(|{SU}| - k)!}}
- {{\sum_{j \in J} \frac{|FM({C_j})|!}{2!(|FM({C_j})| - 2)!}} } .
\label{eqn:correctedccps2}
\end{equation}
\paragraph{Use of Equation \ref{eqn:correctedccps2} }
Equation \ref{eqn:correctedccps2} is useful for an automated tool that
would verify that a single or double simultaneous failures model has complete failure mode coverage.
By knowing how many test cases should be covered, and checking the cardinality
associated with the test cases, complete coverage would be verified.
%\paragraph{Multiple simultaneous failure modes disallowed combinations}
%The general case of equation \ref{eqn:correctedccps2}, involves not just dis-allowing pairs
%of failure modes within components, but also ensuring that combinations across components
%do not involve any pairs of failure modes within the same component.
%%%%- NOT SURE ABOUT THAT !!!!!
%%%- A recursive algorithm and proof is described in appendix \ref{chap:vennccps}.
%%\paragraph{Practicality}
%%Functional Group may consist, typically of four or five components, which typically
%%have two or three failure modes each. Taking a worst case of mutiplying these
%%by a factor of five (the number of failure modes and components) would give
%%$25 \times 15 = 375$
%%
%%
%%
%%\begin{verbatim}
%%
%%# define a factorial function
%%# gives 1 for negative values as well
%%define f(x) {
%% if (x>1) {
%% return (x * f (x-1))
%% }
%% return (1)
%%
%%}
%%define u1(c,x) {
%% return f(c*x)/(f(1)*f(c*x-1))
%%}
%%define u2(c,x) {
%% return f(c*x)/(f(2)*f(c*x-2))
%%}
%%
%%define uc(c,x) {
%% return c * f(x)/(f(2)*f(x-2))
%%}
%%
%%# where c is number of components, and x is number of failure modes
%%# define function u to calculate combinations to check for double sim failure modes
%%define u(c,x) {
%%f(c*x)/(f(1)*f(c*x-1)) + f(c*x)/(f(2)*f(c*x-2)) - c * f(c)/(f(2)*f(c-2))
%%}
%%
%%
%%\end{verbatim}
%%
\pagebreak[1]
\section{Component Failure Modes and Statistical Sample Space}
%\paragraph{NOT WRITTEN YET PLEASE IGNORE}
A sample space is defined as the set of all possible outcomes.
For a component in FMMD analysis, this set of all possible outcomes is its normal (or `correct')
operating state and all its failure modes.
We can consider failure modes as events in the sample space.
%
When dealing with failure modes, we are not interested in
the state where the component is working correctly or `OK' (i.e. operating with no error).
%
We are interested only in ways in which it can fail.
By definition, while all components in a system are `working~correctly',
that system will not exhibit faulty behaviour.
%
We can say that the OK state corresponds to the empty set.
%
Thus the statistical sample space $\Omega$ for a component or derived~component $C$ is
%$$ \Omega = {OK, failure\_mode_{1},failure\_mode_{2},failure\_mode_{3} ... failure\_mode_{N} $$
$$ \Omega(C) = \{OK, failure\_mode_{1},failure\_mode_{2},failure\_mode_{3}, \ldots ,failure\_mode_{N}\} . $$
The failure mode set $F$ for a given component or derived~component $C$
is therefore
$ fm(C) = \Omega(C) \backslash \{OK\} $
(or expressed as
$ \Omega(C) = fm(C) \cup \{OK\} $).
The $OK$ statistical case is the (usually) largest in probability, and is therefore
of interest when analysing systems from a statistical perspective.
This is of interest for the application of conditional probability calculations
such as Bayes theorem~\cite{probstat}.
The current failure modelling methodologies (FMEA, FMECA, FTA, FMEDA) all use Bayesian
statistics to justify their methodologies~\cite{nucfta}\cite{nasafta}.
That is to say, a base component or a sub-system failure
has a probability of causing given system level failures\footnote{FMECA has a $\beta$ value that directly corresponds
to the probability that a given part failure mode will cause a given system level failure/event.}.
Another way to view this is to consider the failure modes of a
component, with the $OK$ state, as a universal set $\Omega$, where
all sets within $\Omega$ are partitioned.
Figure \ref{fig:partitioncfm} shows a partitioned set representing
component failure modes $\{ B_1 ... B_8, OK \}$ : partitioned sets
where the OK or empty set condition is included, obey unitary state conditions.
Because the subsets of $\Omega$ are partitioned, we can say these
failure modes are unitary state.
\begin{figure}[h]
\centering
\includegraphics[width=350pt,keepaspectratio=true]{./CH4_FMMD/partitioncfm.png}
% partition.png: 510x264 pixel, 72dpi, 17.99x9.31 cm, bb=0 0 510 264
\caption{Base Component Failure Modes with OK mode as partitioned set}
\label{fig:partitioncfm}
\end{figure}
\section{Components with Independent failure modes}
Suppose that we have a component that can fail simultaneously
with more than one failure mode.
This would make it seemingly impossible to model as `unitary state'.
\paragraph{De-composition of complex component.}
There are two ways in which we can deal with this.
We could consider the component a composite
of two simpler components, and model their interaction to
create a derived component.
\ifthenelse {\boolean{paper}}
{
This technique is outside the scope of this paper.
}
{
%This technique is dealt in section \ref{sec:symtomabstraction} which shows how derived components may be assembled.
}
\begin{figure}[h]
\centering
\includegraphics[width=200pt,bb=0 0 353 247,keepaspectratio=true]{./CH4_FMMD/compco.png}
% compco.png: 353x247 pixel, 72dpi, 12.45x8.71 cm, bb=0 0 353 247
\caption{Component with three failure modes as partitioned sets}
\label{fig:combco}
\end{figure}
\paragraph{Combinations become new failure modes.}
Alternatively, we could consider the combinations
of the failure modes as new failure modes.
We can model this using an Euler diagram representation of
an example component with three failure modes\footnote{OK is really the empty set, but the term OK is more meaningful in
the context of component failure modes} $\{ B_1, B_2, B_3, OK \}$ see figure \ref{fig:combco}.
For the purpose of example let us consider $\{ B_2, B_3 \}$
to be intrinsically mutually exclusive, but $B_1$ to be independent.
This means the we have the possibility of two new combinations
$ B_1 \cap B_2$ and $ B_1 \cap B_3$.
We can represent these
as shaded sections of figure \ref{fig:combco2}.
\begin{figure}[h]
\centering
\includegraphics[width=200pt,bb=0 0 353 247,keepaspectratio=true]{./CH4_FMMD/compco2.png}
% compco.png: 353x247 pixel, 72dpi, 12.45x8.71 cm, bb=0 0 353 247
\caption{Component with three failure modes where $B_1$ is independent}
\label{fig:combco2}
\end{figure}
We can calculate the probabilities for the shaded areas
assuming the failure modes are statistically independent
by multiplying the probabilities of the members of the intersection.
We can use the function $P$ to return the probability of a
failure mode, or combination thereof.
Thus for $P(B_1 \cap B_2) = P(B_1)P(B_2)$ and $P(B_1 \cap B_3) = P(B_1)P(B_3)$.
\begin{figure}[h]
\centering
\includegraphics[width=200pt,bb=0 0 353 247,keepaspectratio=true]{./CH4_FMMD/compco3.png}
% compco.png: 353x247 pixel, 72dpi, 12.45x8.71 cm, bb=0 0 353 247
\caption{Component with two new failure modes}
\label{fig:combco3}
\end{figure}
We can now consider the shaded areas as new failure modes of the component (see figure \ref{fig:combco3}).
Because of the combinations, the probabilities for the failure modes
$B_1, B_2$ and $B_3$ will now reduce.
We can use the prime character ($\; \prime \;$), to represent the altered value for a failure mode, i.e.
$B_1^\prime$ represents the altered value for $B_1$.
Thus
$$ P(B_1^\prime) = B_1 - P(B_1 \cap B_2) - P(B_1 \cap B_3)\; , $$
$$ P(B_2^\prime) = B_2 - P(B_1 \cap B_2) \; and $$
$$ P(B_3^\prime) = B_3 - P(B_1 \cap B_3) \; . $$
We now have two new component failure mode $B_4$ and $B_5$, shown in figure \ref{fig:combco3}.
We can express their probabilities as $P(B_4) = P(B_1 \cap B_3)$ and $P(B_5) = P(B_1 \cap B_2)$.

35
submission_thesis/style.tex
View File

@ -7,7 +7,19 @@
\DeclareMathSymbol{\C}{\mathbin}{AMSb}{"43}
\newcommand{\ft}{\ensuremath{4\!\!\rightarrow\!\!20mA} }
\usepackage{graphicx}
\usepackage{fancyhdr}
\usepackage{tikz}
\usepackage{amsfonts,amsmath,amsthm}
\usetikzlibrary{shapes.gates.logic.US,trees,positioning,arrows}
\def\layersep{1.8cm}
%\input{../style}\def\layersep{1.8cm}
\usepackage{ifthen}
\usepackage{lastpage}
\usetikzlibrary{shapes,snakes}
\newcommand{\tickYES}{\checkmark}
\newcommand{\fc}{fault~scenario}
\newcommand{\fcs}{fault~scenarios}
% Page layout definitions to suit A4 paper
\setcounter{secnumdepth}{3} \setcounter{tocdepth}{4}
@ -16,28 +28,29 @@
\setlength{\oddsidemargin}{0mm} \setlength{\evensidemargin}{0mm}
%
\newcommand{\permil}{\ensuremath{0/{\!}_{00}}}
\newcommand{\emp}{} %% do nothing, all the italics are unnecessary
\newcommand{\derivec}{{D}}
\newcommand{\abslev}{\ensuremath{\alpha}}
\newcommand{\oc}{\ensuremath{^{o}{C}}}
\newcommand{\adctw}{{${\mathcal{ADC}}_{12}$}}
\newcommand{\adcten}{{${\mathcal{ADC}}_{10}$}}
\newcommand{\ohms}[1]{\ensuremath{#1\Omega}}
\newcommand{\fm}{\em failure~mode}
\newcommand{\fms}{\em failure~modes}
\newcommand{\fm}{\emp failure~mode}
\newcommand{\fms}{\emp failure~modes}
\newcommand{\FG}{\ensuremath{{G}}}
\newcommand{\DC}{\ensuremath{{DC}}}
\newcommand{\fg}{\em functional~group}
\newcommand{\fgs}{\em functional~groups}
\newcommand{\dc}{\em derived~component}
\newcommand{\dcs}{\em derived~components}
\newcommand{\bc}{\em base~component}
\newcommand{\bcs}{\em base~components}
\newcommand{\fg}{\emp functional~group}
\newcommand{\fgs}{\emp functional~groups}
\newcommand{\dc}{\emp derived~component}
\newcommand{\dcs}{\emp derived~components}
\newcommand{\bc}{\emp base~component}
\newcommand{\bcs}{\emp base~components}
\newcommand{\irl}{in~real~life}
\newcommand{\enc}{\ensuremath{\stackrel{enc}{\longrightarrow}}}
\newcommand{\pin}{\ensuremath{\stackrel{pi}{\longleftrightarrow}}}
%\newcommand{\pic}{\em pure~intersection~chain}
\newcommand{\pic}{\em pair-wise~intersection~chain}
\newcommand{\wrt}{\em with~respect~to}
\newcommand{\pic}{\emp pair-wise~intersection~chain}
\newcommand{\wrt}{\emp with~respect~to}
\newcommand{\swf}{software~function}
% DO NOT USE THIS ONE USE \abslev \newcommand{\abslevel}{\ensuremath{\Psi}}
\newcommand{\fmmdgloss}{\glossary{name={FMMD},description={Failure Mode Modular De-Composition, a bottom-up methodolgy for incrementally building failure mode models, using a procedure taking functional groups of components and creating derived components representing them, and in turn using the derived components to create higher level functional groups, and so on, that are used to build a failure mode model of a SYSTEM}}}

7
submission_thesis/thesis.tex
View File

@ -86,12 +86,17 @@
\chapter{Examples of FMMD applied to electronic circuits}
\input{CH5_Examples/copy}
\chapter {FMMD Metrics and Evaluation}
\chapter {FMMD Metrics Critiques Exceptions and Evaluation}
\input{CH6_Evaluation/copy}
\chapter{Conclusion}
\input{CH7_Conculsion/copy}
\appendix
\input{appendixes/formal}
\input{appendixes/algorithmic}
\nocite{alggraph}
\nocite{ince}