all day marathon edit...

tack till mycket viktig  personer
for endag av arbete....
message for your changes. Lines starting

mybib.bib

@@ -1107,6 +1107,26 @@ OPTissn = {},
 } 
 
 
+@Manual{pic18f25k80erratta,
+ title = {Datasheet Erratta: PIC18F66K80 Family Silicon Errata and Data Sheet Clarification DS805119D},
+ OPTkey = {},
+ author = {Microchip inc},
+ OPTorganization = {},
+ address = {http://ww1.microchip.com/downloads/en/DeviceDoc/80519d.pdf},
+ OPTedition = {},
+ OPTmonth = {},
+ year = {2011},
+ OPTnote = {},
+ OPTannote = {},
+ OPTurl = {},
+ OPTdoi = {},
+ OPTissn = {},
+ OPTlocalfile = {},
+ OPTabstract = {},
+}
+
+
+
 @Manual{pic18f2523,
  title = {PIC18F2523 Datasheet},
  OPTkey = {},

submission_thesis/CH1_introduction/copy.tex

@@ -110,14 +110,15 @@ failure mode analysis.
 \paragraph{European Safety Requirements increase in scope and complexity.}
 At work---which consisted of designing, testing, building and writing embedded `C' and assembly language code for safety critical
 industrial burners---we were faced with a new and daunting requirement.
-Conformance to the latest European standard, EN298. 
+Conformance to the latest European standard, EN298~\cite{en298}. 
 %
 It appeared to ask for the impossible:
 not only did it require the usual safety measures (self checking of ROM and RAM, watchdog processors with separate clock sources,  EMC and the
 triple fail safe control of valves), it had one new clause in it that had far reaching consequences.
 %
 It stated that in the event of a failure, where the controller had gone into a `lockout~state'--- a state where the controller
-applies all possible safety measures to stop fuel entering the burner---it could not become dangerous should another fault occur.
+applies all possible safety measures to stop fuel entering the burner---it was not permitted to % could not 
+become dangerous should another fault occur.
 %
 In short this meant we had to be able to deal with double failures.
 %
@@ -175,9 +176,13 @@ failures would be analysed, but because failure modes are traceable from the bas
 these relationships can be  held in a traversable data structure.
 %
 If held in a traversable data structure we can apply automated methods to search for all the combinations of multiple failure modes
-within the model that have been analysed. Because of this, it may not be necessary to apply double checking
+within the model that have been analysed. Because of this, it will not always %it may not 
+be necessary to apply double checking
 at all higher levels in the analysis hierarchy, to achieve complete double failure coverage.
 %
+The point at which it is possible to relax double failure checking can be verified automatically by traversing the 
+the failure mode model.
+%
 \subsection{Initial direction: Application of Spider diagrams to FMEA.}
 
 Because, Euler/Spider Diagrams~\cite{howse:spider}

submission_thesis/CH2_FMEA/copy.tex

@@ -21,7 +21,7 @@ how we determine the failure modes associated with components.
 Two common electrical components, the resistor and the operational amplifier
 are examined in the context of two sources of information that define failure modes.
 %
-A simple example of an FMEA is  given, using a hypothetical {\ft} milli-amp reader.
+To introduce the concept  of FMEA, a simple example is  given, using a hypothetical {\ft} milli-amp reader.
 %
 The four main current FMEA variants are described and we  develop %conclude by describing concepts
 the concepts
@@ -52,7 +52,7 @@ for a large proportion of safety critical products sold in the European Union.
 The acronym FMEA can be expanded as follows:
 \begin{itemize} 
    \item \textbf{F - Failures of given component,} Consider a particular component in a system;
-    \item \textbf{M - Failure Mode,} Choose a component `failure~mode';
+    \item \textbf{M - Failure Mode,} Choose a particular failure mode of this component; %  `failure~mode';
     \item \textbf{E - Effects,} Determine the effects this failure mode will cause to the system we are examining;
    \item \textbf{A - Analysis,} Analyse how much impact this symptom will have on the environment/operators/the system itself.
 \end{itemize}
@@ -81,6 +81,9 @@ but for fixed frequencies the same circuit could be used as a phase changer~\cit
 The failure modes of the latter, could be `no~signal' and `all~pass',
 but when used as a phase changer, would be `no~signal' and `no~phase' change.
 %
+The actual failure modes of a group of components, are therefore defined by the 
+function that they perform.
+% 
 % This chapter describes basic concepts of FMEA, uses a simple example to
 % demonstrate a single  FMEA analysis stage, describes the four main variants of FMEA in use today
 % and explores some concepts with which we can discuss and evaluate
@@ -266,7 +269,7 @@ modes do not include drift.
 %
 If we can ensure that our resistors will not be exposed to overload conditions, the 
 probability of drift (sometimes called parameter change) occurring
-is significantly reduced, enough for some standards to exclude it~\cite{en298}~\cite{en230}.
+is significantly reduced, enough for some standards to exclude it~\cite{en298,en230}.
 
 
 \paragraph{Resistor failure modes according to EN298.}
@@ -371,7 +374,9 @@ For Op-Amp failures modes, FMD-91\cite{fmd91}{3-116] states,
 Again these are mostly internal causes of failure, more of interest to the component manufacturer
 than a test engineer % designer 
 looking for the symptoms of failure.
+%
 We need to translate these failure causes within the Op-Amp into {\fms}.
+%
 We can look at each failure cause in turn, and map it to potential {\fms} suitable for use in FMEA
 investigations.
 
@@ -417,7 +422,8 @@ This demands that all open connections, and shorts between adjacent pins be cons
 We examine these failure scenarios on the dual packaged  $LM358$~\cite{lm358} %\mu741$  
 and determine its {\fms} in table ~\ref{tbl:lm358}.
 Collecting the op-amp failure modes from table ~\ref{tbl:lm358} we obtain the same {\fms}
-that we got from FMD-91, listed in equation~\ref{eqn:opampfms}.
+that we got from FMD-91, listed in equation~\ref{eqn:opampfms}, except for
+$LOW_{slew}$.
 
 
 
@@ -506,7 +512,9 @@ $$ fm(OPAMP) = \{ LOW, HIGH, NOOP, LOW_{slew} \} $$
 \subsection{Comparing the component failure mode sources}
 
 
-The EN298 pinouts failure mode technique cannot reveal failure modes due to internal failures.
+The EN298 pinouts failure mode technique cannot reveal failure modes due to internal failures,
+and that is why is misses the $LOW_{slew}$.
+%
 The FMD-91 entries for op-amps are not directly usable as 
 component {\fms} in FMEA or FMMD and require interpretation.
 %
@@ -644,7 +652,9 @@ We have not looked in detail at any side effects of this {\fm}.
 To put this in more general terms,  have not examined this failure mode
 against every other component in the system. 
 Perhaps we should: this would be a more rigorous and complete
-approach in looking for system failures.
+approach in looking for system failures. We could term FMEA where 
+each failure mode is compared against all other components
+as exhaustive FMEA (XFMEA).
 
 
 \section{Theoretical Concepts in FMEA}
@@ -670,7 +680,8 @@ Most electronic systems are used to process a signal: with signal processing
 there is usually a clear path from the signal coming into the system, it being processed in some way, and a resultant effect on
 an output or control signal. % afferent to transform to efferent path.
 %
-That is, there is an input, some processing and an output.
+That is, there is an input, some processing and an output. In electronics we might term this a sensor, processing and actuator
+model. In software we would term this afferent, transform and efferent data flow.
 %
 For the purpose of FMEA, we define the signal path as the components used to process the signal.
 %
@@ -733,7 +744,7 @@ In practise, a compromise is made between the amount of time/money  that can be
 on analysis relative to the criticality of the project.
 Metrics from measuring the amount of work to undertake for FMEA are examined in section~\ref{sec:xfmea}.
 
-\paragraph{Failure Modes and the signal path}
+\paragraph{Failure Modes and the signal path.}
 
 In general a component failure mode in an electronic circuit will
 change the circuit topology. For a single failure
@@ -816,7 +827,7 @@ Subjective appraisal of the outcome of a system failure mode can also
 be subject to management and/or political pressure.
 %
 The two most recent variants of FMEA, 
-FMEDA and FMECA have dipped a metaphorical toe into the subjective realm, FMECA with itself `criticality~factor' and 
+FMEDA and FMECA have dipped a metaphorical toe into the subjective realm, FMECA with its `criticality~factor' and 
 FMEDA with its definition of `dangerous'. 
 %
 However, while starting to address the subjective side 
@@ -839,7 +850,7 @@ Detailed work on subjective analysis is beyond the scope of this study.
 FMEA is less useful for determining events for multiple 
 simultaneous 
 failures\footnote{Multiple simultaneous failures are taken to mean failures that occur within the same detection period.
-Detection periods are typically determined for the process under control. For a flame in an industrial burner this
+Detection periods are typically determined for the process under control. For instance, for a flame detector in an industrial burner this
 could typically be one second.~\cite{en298}}. 
 %
 Work has been performed using component failure statistics to
@@ -1124,7 +1135,7 @@ billion ($10^9$) hours of operation~\cite{mil1991}.
 
 \textbf{FMECA $\alpha$ value.}
 The failure mode probability, usually denoted by $\alpha$ is the  probability of 
-a particular failure~mode occurring within a component.  reference FMD-91.  
+a particular failure~mode occurring within a component~\cite{fmd91}.  
 %, should it fail.
 %A component with N failure modes will thus have
 %have an $\alpha$ value associated with each of those modes.
@@ -1200,12 +1211,12 @@ It allows diagnostic mitigation for self checking circuitry.
 %
 FMEDA requires %does force 
 the analyst to consider all hardware components in a system
-by requiring that a MTTF value is assigned for each base component failure~mode; 
+by requiring that an MTTF value is assigned for each base component failure~mode; 
 the MTTF may be statistically mitigated (improved)
 if it can be shown that self-checking will detect failure modes.
-The MTTF value for each component {\fm} is denoted as $\lambda$'.
+The MTTF value for each component {\fm} is denoted using the symbol `$\lambda$'.
 %
-EN61508 in relation to software provides procedural quality guidelines and constraints (such as forbidding certain
+EN61508 regulation in relation to software provides procedural quality guidelines and constraints (such as forbidding certain
 programming languages and/or features): it does not provide a means to trace failure mode effects in software
 or across the software/hardware interface.
 
@@ -1286,6 +1297,7 @@ by statistically determining how frequently it can fail dangerously.
 %\subsection{ FMEDA - Failure Modes Effects and Diagnostic Analysis}
 
 \begin{table}[ht]
+\centering
 \caption{FMEA Calculations} % title of Table
 %\centering % used for centering table
 \begin{tabular}{|| l | l | c | c | l ||} \hline
@@ -1398,11 +1410,12 @@ However, as with the components that we should check against a {\fm}, there are
 the reasoning stages for an FMEA entry.
 %FMEA does not stipulat which
 Ideally each FMEA entry would contain a reasoning description
-for each component the {\fm} is checked against, so that the entry can be reviewed or revisited/audited.
+for each component the {\fm} is checked against, 
+so that the entry can be more easily reviewed or revisited/audited than a traditional FMEA report.
 %
 Because FMEA is traditionally performed with one entry per component {\fm}, full reasoning descriptions
 are rare.
-This means that re-use, review and checking of traditional analysis must be started from `cold'.
+This means that re-use, review and checking of traditional analysis must often be started from `cold'.
 
 % MOVED TO CH3: 15MAR2013
 % 

submission_thesis/CH3_FMEA_criticism/copy.tex

@@ -15,7 +15,7 @@ engineers have to discuss a system at a level of detail starting
 at {\bc} {\fms}.
 %
 This undoubtedly reveals dangers inherent in designs and makes
-our lives safer. This chapter aims to look for the deficiencies in the FMEA process, to probe for weaknesses
+our lives safer. This chapter aims to look for the deficiencies in current  FMEA processes, to probe for weaknesses
 and look for ways in which it could be done better and more efficiently.
 
 A major problem is with the scope of examination---or required reasoning distance---to apply 
@@ -31,6 +31,12 @@ cheap micro-controllers and processors mean that most of today’s  systems are
 now software/hardware hybrids.
 %
 
+Even analogue electronics, with the advent of surface mount and miniature components,
+means that a modern electronic circuits are typically far more complex and have
+far higher component counts, than those
+of the era when FMEA methodologies were invented.
+%
+
 With FMEA it is very difficult to perform %impossibility of performing 
 meaningful
 multiple failure analysis.
@@ -150,6 +156,7 @@ We could term such a group a `{\fg}'. Potentially here we have a way of de-compo
 the problem and reducing the $O(N^2)$ state explosion effect
 associated with XFMEA. An order $N^2$ could be seen as desirable in an automated process such as a search algorithm, but here
 its is a time consuming manual process which demands experienced and highly qualified personnel.
+It is therefore desirable to reduce this order further.
 
 
 
@@ -248,7 +255,7 @@ functionally tested~\cite{bishopsmartinstruments}.
 \subsection{Distributed real time systems}
 \label{sec:distributed}
 Distributed real time systems are control systems where 
-smart sensors communicate over a communications bus to
+smart sensors/actuators communicate over a communications bus to
 a master controller. 
 %
 Most modern cars follow this information technology pattern and use CANbus~\cite{canspec,can}.
@@ -409,8 +416,8 @@ getting to complicated for meaningful analysis using FMEA.
 %
 
 \subsection{FMEA Criticism: Conclusions.}
-FMEA useful tool for basic safety --- provides statistics on safety where field data impractical ---
+FMEA is a useful tool for basic safety --- it provides statistics on safety where field data impractical ---
-very good with single failure modes linked to top level events. 
+and is good with single failure modes linked to top level events. 
 FMEA has become part of the safety critical and safety certification industries.
 %
 SFMEA is in its infancy, and there are corresponding gaps in  
@@ -443,7 +450,7 @@ in an improved FMEA methodology,
     \item Must be able to analyse hybrid software/hardware systems, 
     \item no state explosion (which has rendered exhaustive analysis impractical),  
     \item exhaustive checking at a modular level, %(total failure coverage within {\fgs} all interacting component and failure modes checked),
-    \item traceable reasoning system models,% to aid repeatability and checking,  
+    \item traceable reasoning inherent in system failure models,% to aid repeatability and checking,  
     \item re-usable i.e. it should be possible to re-use analysis,
     \item possibility to analyse simultaneous/multiple failures, 
     \item modular --- i.e. usable in a distributed system.

submission_thesis/CH4_FMMD/copy.tex

@@ -1173,7 +1173,7 @@ A component can be viewed as a sub-system that is a part of some larger system.
 %
 A modular system common to many homes is the sound separates audio system or stereo hi-fi.
 %
-This is used as an example to describe terms used in FMMD.
+This is used as an example to describe the concepts {\fg} and {\dc} found  in FMMD.
 %
 For instance a stereo amplifier separate/slave is a component.
 %The 
@@ -1296,10 +1296,17 @@ to fail in two ways, it can go open circuit or it can short.
 Electrical components have data-sheets associated with them. The data sheets
 supply detailed information on the component as supplied by the manufacturer.
 %
-Because they are design related they rarely show %clearly detail the
+Because they are written for system designers, and to an extent advertise the product, 
-failure modes of the component, with environmental factors and MTTF~\cite{sccs}[p.165] statistics.
+they rarely give %show %clearly detail the
-Given the growing usage of FMEA/FMEDA in industry this may change.
+failure modes of the component.
+%
+For FMEA purposes, ideally failure modes along with
+with environmental factors and MTTF~\cite{sccs}[p.165] statistics would be presented.
+%
+Given the growing usage of FMEA/FMEDA and the emergence of SIL as a safety benchmark in industry, this may change.
+%
 Currently, failure mode information is generally only  available for generic component types~\cite{mil1991, fmd91}.
+%
 Thus we can associate a set of failure modes to types of component, 
 for example  $ResistorFaultModes=\{OPEN, SHORT\}$\footnote{The failure modes of the resistor 
 are discussed in section~\ref{sec:resistorfm}.}.
@@ -1516,7 +1523,7 @@ The UML representation  (in figure \ref{fig:cfg}) shows a `{\fg}' having a one t
 %% Here we need how this meta model translates into the FMMD Hierarchy
 
 \subsection{How the UML Meta Model maps to an FMMD Hierarchy}
-
+\label{sec:fmmd_uml}
 The UML meta model above (see figure~\ref{fig:cfg}) describes a hierarchical structure. %% Might be a UML pattern that is well known ..... 05MAY2012
 This is because, as {\dcs} inherit the properties of 
 components, {\dcs} may be used to form {\fgs}.
@@ -1584,7 +1591,8 @@ between the entities used in FMMD.
 % derived components yet higher up in the structure.
 % %
 To keep track of the level in the hierarchy (i.e. how many stages of component 
-derivation `$\derivec$' have led to the current derived component)
+derivation %`$\derivec$' 
+have led to the current derived component)
 we can add an attribute to the component data type. 
 This can be a natural number called the level variable $\abslev \in \mathbb{N}$.
 % J. Howse says zero is a given in comp sci. This can be a natural number called the level variable $\alpha \in \mathbb{N}_0$.

submission_thesis/CH5_Examples/copy.tex

@@ -21,7 +21,9 @@
 \label{sec:chap5}
 
 This chapter demonstrates FMMD applied to 
-a variety of typical embedded system components including analogue/digital and electronics/software hybrids.
+a variety of typical electronic circuits including analogue and digital 
+%and electronics/software 
+hybrids.
 %In order to implement FMMD in practise, we review the basic concepts and processes of the methodology.%
 %Each example has been chosen to demonstrate 
 %FMMD applied to 
@@ -900,12 +902,12 @@ when it becomes a V2 follower).
 \end{figure}
 
 The {\fm} $DiffAMPIncorrect$ may seem like a vague {\fm}---however, this {\fm} is  impossible to detect in this circuit---
-in fault finding terminology~\cite{garrett}~\cite{maikowski} this {\fm} is said to be unobservable, and in EN61508~\cite{en61508}
+in fault finding terminology~\cite{garrett,maikowski} this {\fm} is said to be unobservable, and in EN61508~\cite{en61508}
 terminology is an `undetectable~fault'.
 %
 Were this failure to have safety implications, this FMMD analysis will have revealed
-this un-observability condition; this would likely prompt re-design of this 
+this undetectable condition; this would likely prompt re-design of this 
-circuit. A typical way to solve an un-observability such as this is 
+circuit. A typical way to solve an undetectable fault such as this is 
 to periodically switch in test signals in place of the input signal.
 %\footnote{A typical way to solve an un-observability such as this is 
 %to periodically switch in test signals in place of the input signal.}.
@@ -915,7 +917,8 @@ to periodically switch in test signals in place of the input signal.
 This example shows a three stages hierarchy, and a graph tracing the base~component failure modes to the 
 top level event. It also re-visits the decisions about membership of {\fgs}, due to the context
 of the circuit raised in section~\ref{subsec:invamp2}.
-
+%
+This FMMD analysis also revealed an undetectable failure mode,  $DiffAMPIncorrect$.
 
 
 %16MAR2013 COULD Put an euler diagram here
@@ -1405,13 +1408,14 @@ We should be able to determine smaller {\fgs} and refine the model further.
  \label{fig:bubbaeuler2}
 \end{figure}
 
-\paragraph{Outline of finer grained FMMD analysis of the Bubba oscillator}
+\paragraph{Outline of finer grained FMMD analysis of the Bubba oscillator.}
 %
 We use the pre-analysed $NIBUFF$ and $PHS45$
 {\dcs} to form a {\fg}, analysed in table~\ref{tbl:buff45}, giving the
 {\dc} $BUFF45$.
 %
-Thus, $BUFF45$ is a {\dc} representing an actively buffered $45^{\circ}$ phase shifter.
+%Thus, 
+$BUFF45$ is a {\dc} representing an actively buffered $45^{\circ}$ phase shifter.
 %
 From the block circuit diagram (figure~\ref{fig:circuit3}), we see that there are three 
 $45^{\circ}$ phase shifter circuits in series. Together these apply a $135^{\circ}$ phase shift to the signal.
@@ -1425,7 +1429,7 @@ $PHS135BUFFERED$ which represents an actively buffered $135^{\circ}$ phase shift
 %
 
 
-\paragraph{Analysis details  of the finer grained FMMD analysis of the Bubba oscillator}
+\paragraph{Analysis details  of the finer grained FMMD analysis of the Bubba oscillator.}
 
 A PHS45 {\dc} and an  inverting amplifier\footnote{Inverting amplifiers apply a $180^{\circ}$ phase shift to a signal regardless of its frequency.}, 
 form a {\fg}
@@ -1516,10 +1520,15 @@ be re-used in other projects.
 %is higher, by an order of $O(N^2)$.
 Smaller {\fgs} signify less by-hand checks and 
 a more finely grained model. 
+%
 This means that
-there would be more {\dcs} and therefore increases the potential for re-use of pre-analysed {\dcs}.
+there will %would 
-A finer grained model---with potentially more hierarchy stages---conveys that more
+be more {\dcs} and this %therefore 
-work, or reasoning has been used in the analysis.
+increases the potential for re-use of pre-analysed {\dcs}.
+%
+A finer grained model---with potentially more hierarchy stages---conveys that 
+%more work, or 
+more reasoning stages have been used in the analysis.
 % HTR The more we can modularise, the more we decimate the $O(N^2)$ effect
 % HTR of complexity comparison.
 %
@@ -1534,7 +1543,7 @@ A finer grained approach produces more potentially re-usable {\dcs} and
 involves several stages with lower reasoning distances.
 The lower reasoning distances, or complexity comparision figures are given in the metrics chapter~\ref{sec:chap7}
 at section~\ref{sec:bubbaCC}.
-
+This show that the finer grained models also benefit from lower reasoning distances for the failure mode model.
 
 
 \clearpage
@@ -1606,7 +1615,7 @@ of the input voltage (i.e. the value of the sum of 1's and 0's is proportional t
 %
 %$$\{ IC1, IC2, IC3, IC4, R1, R2, R3, R4, C1 \} $$.
 %
-The parts for the \sd are a mixture of analogue (resistors, capacitors, OpAmps) and digital
+The parts for the {\sd} are a mixture of analogue (resistors, capacitors, OpAmps) and digital
 (D type flip flop, and a digital clock). We examine the failure modes of all components in this circuit below.
 %
 IC1,IC2 and IC3 are all OpAmps and we have failure modes for this component type 
@@ -1643,7 +1652,7 @@ The feedback voltage for the ADC is supplied via $R1$, we term this voltage as $
 %The input voltage   is supplied via $R2$ and we term this voltage as $V_{in}$.
 $R2$ and $R1$ form a summing junction to IC1: they balance the integrator provided
 by the capacitor C1 and the opamp IC1.
-This can be our first {\fg} and we analyse it in table~\ref{tbl:sumjint}. 
+This can be our first {\fg} and we analyse it in table~\ref{detail:SUMJINT}%{tbl:sumjint}. 
 %For the symptoms, we have to think in terms of the effect
 %on its performance as a summing junction and not be
 %distracted by the integrator formed by $C_1$ and $IC1$.
@@ -1810,7 +1819,7 @@ value, and outputs it at analogue voltage levels for the summing junction.
 
 $ FG = \{ DIGBUF, DL2AL  \} $
 
-We analyse the buffered flip flop circuitry 
+We analyse the buffered flip flop circuitry (see table~\ref{detail:FFB})
 and create a {\dc} $FFB$,
 where $$fm (FFB) = \{OUTPUT STUCK, LOW\_SLEW\}$$.
 %\clearpage
@@ -1936,7 +1945,7 @@ possibility of double faults. % (cardinality constrained powerset of 2).
 
 
 \subsection{General Description of Pt100 four wire circuit}
-
+\label{Pt100range}
 The Pt100 four wire circuit uses two wires to supply a small electrical current,
 and returns two sense voltages by the other two.
 By measuring voltages
@@ -1964,7 +1973,7 @@ Note that the low reading goes down as temperature increases, and the higher rea
 For this reason the low reading will be referred to as {\em sense-}
 and the higher as {\em sense+}.
 
-\paragraph{Accuracy despite variable resistance in cables}
+\paragraph{Accuracy despite variable resistance in cables.}
 
 For electronic and accuracy reasons, a four wire circuit is preferred
 because of resistance in the cables. Resistance from the supply
@@ -2072,6 +2081,7 @@ $R_2$ SHORT     &  -         &  Low Fault   &  Value Out of Range Value \\
 
 From table \ref{ptfmea} it can be seen that any component failure in the circuit
 should cause a common symptom, that of one or more of the values being `out of range'.
+%
 Temperature range calculations and detailed calculations
 on the effects of each test case are found in section \ref{Pt100range}
 and \ref{Pt100temp}. 

submission_thesis/CH8_Conclusion/copy.tex

@@ -24,12 +24,12 @@ traditional FMEA.
 In all cases there was a performance gain, 
 that is to say that for all but trivial cases, 
 the number of manual analysis operations to perform
-was reduced. 
+was significantly reduced. 
 %
 Not only this, but the analysis naturally provided modules which could be re-used, 
 re-used not only in the circuit under analysis but potentially in different and future projects as well.
 
-Traditional FMEA methods have been applied to software, but analysis has always to be separate from 
+Traditional FMEA methods have been applied to software, but analysis has always been performed separately from 
 the electronic FMEA~\cite{sfmeaa,sfmea}. %, and while modular kept strictly to a bottom-up approach.
 %
 Using established concepts from contract programming~\cite{dbcbe}  FMMD was extended to analyse software,
@@ -94,6 +94,24 @@ These are explained below.
 
 \section{Further Work}
 %This section describes areas that the study has revealed where the FMMD methodology may be extended or improved.
+ \section{How traditional FMEA reports can be derived from an FMMD model.}
+%
+An FMMD model has a data structure (described by UML diagrams, see figure~\ref{fig:cfg}), and by traversing this
+we can map system level failures back to {\bc} {\fms} (or combinations thereof).
+%
+Because we can determine these mappings we can produce reports in the traditional FMEA format ({\bc}~{\fm}~$\mapsto$~{system failure}).
+%
+With the addition of {\bc} {\fm} statistics~\cite{mil1991} we can provide reliability predictions for system level failures.
+The Pt100 example is revisited for this purpose and analysed for single and double failures, with statistics for {\bcs}
+taken from MIL1991 %~\cite{mil1991}, 
+in section~\ref{sec:bcstats}.
+%
+With an FMMD failure mode model a top down perspective is possible.
+We could for instance take each system level failure and produce a causation tree for it, tracing back
+to all {\bc} {\fms}.
+This is very closely related to the structure of FTA (top down) failure causation graphs.
+The possibility of automatically producing FTA diagrams from FMMD models 
+is examined in section~\ref{sec:fta}.
 
 
 \section{Statistics: From base component failure modes to System level events/failures.}
@@ -101,18 +119,23 @@ These are explained below.
 Knowing the statistical likelihood of a component failing can give a good indication
 of the reliability of a system, or in the case of dangerous failures, the Safety Integrity Level 
 of a system.
+%
 EN61508~\cite{en61508} requires that statistical data is available and used for all component failure modes
-analysed in a system assigned a SIL level.
+analysed by FMEDA.
+%
 FMMD, as a bottom up methodology can use component failure mode statistical data, and incorporate it
 into its hierarchical model.
-By way of example, the Pt100 analysis %example 
+%By way of example, the Pt100 analysis %example 
-from section~\{sec:pt100} has been used to demonstrate this.
+%from section~\{sec:pt100} has been used to demonstrate this.
+Because we can use an FMMD model to generate an FMEA report, with additional {\bc} failure mode statistics
+we can therefore used FMMD to produce an FMEDA report.
+
 
 \subsection{Pt100 Example: Single Failures and statistical data}. %Mean Time to Failure}
 
-Now that we have a model for the failure mode behaviour of the Pt100 circuit
+From an earlier example, the model for the failure mode behaviour of the Pt100 circuit,
-we can look at the statistics associated with each of the failure modes.
+we can add {\bc} {\fm} statistics and determine the probability of symptoms of failure.
-
+%
 The DOD electronic reliability of components
 document  MIL-HDBK-217F\cite{mil1991} gives formulae for calculating
 the
@@ -124,7 +147,7 @@ can give conservative reliability figures when applied to
 modern components}. 
 %
 Using the MIL-HDBK-217F\cite{mil1991}  specifications for resistor and thermistor
-failure statistics, we calculate the reliability of this circuit.
+failure statistics, we calculate the reliability of the Pt100 example ( see section~\ref{sec:pt100}).
 
 
 \paragraph{Resistor FIT Calculations}
@@ -171,11 +194,14 @@ give the following failures in ${10}^6$ hours:
 \end{equation}
 
 While MIL-HDBK-217F gives MTTF for a wide range of common components,
-it does not specify how the components will fail (in this case OPEN or SHORT). {Some standards, notably EN298 only consider resistors failing in OPEN mode}.
+it does not specify how the components will fail (in this case OPEN or SHORT). 
+%
+Some standards, notably EN298 only consider most types of resistor as failing in OPEN mode.
 %FMD-97 gives 27\% OPEN and 3\% SHORTED, for resistors under certain electrical and environmental stresses. 
 % FMD-91 gives parameter change as a third failure mode, luvvverly 08FEB2011
 This example 
-compromises and uses a 90:10 ratio, for resistor failure. 
+compromises and uses a 9:1 OPEN:SHORT ratio, for resistor failure. 
+%
 Thus for this example resistors are expected to fail OPEN in 90\% of cases and SHORTED 
 in the other 10\%.
 A standard fixed film resistor, for use in a benign environment, non military spec at
@@ -347,7 +373,7 @@ A typical data sheet for an electrical component will give
 a working temperature range: %, for instance.
 mechanical components could  be specified for stress and loading limits.
 It is unusual to have failure modes  described in product literature, although
-for complicated components with firmware errata documents are sometimes produced.
+for complicated components with firmware, errata documents~\cite{pic18f25k80erratta} are sometimes produced.
 
 Systems may have distinct operational states. For instance, a safety critical controller
 may have a LOCKOUT state where it has detected a serious problem and will not continue to operate until 
@@ -355,7 +381,7 @@ authorised human intervention takes place.
 A safety critical circuit may have a self test mode which could be operated externally:
 a micro-processor may have a SLEEP mode etc.
 %
-Operational states and environmental conditions can %must 
+To make FMMD compatible with FTA perational states and environmental conditions should %can %must 
 be factored into the UML model.
 %
 We may encounter a condition where we would want to inhibit some action of the system.
@@ -363,6 +389,9 @@ This is rather like a logical guard criterion. For instance in the gas burner st
 states that a flame detector must confirm that a pilot flame has been established before the main burner fuel can be applied.
 In FTA terms this would be an inhibit condition on the main fuel, i.e. PILOT\_NOT\_CONFIRMED.
 
+We now look at the nature of these three attributes and decide how they should fit into the UML
+model for FMMD developed in section~\ref{sec:fmmd_uml}.
+
 \paragraph{Environmental Modelling.} The external influences/environment could typically be temperature ranges,
 levels of electrical interference, high voltage contamination on supply
 lines, radiation levels etc.
@@ -380,7 +409,7 @@ Within the field of safety critical engineering, we often encounter
 elements that include test or self-test facilities. 
 %
 We also encounter degraded performance
-(such as only performing functions in an emergency) and lockout/emergency conditions.
+(such as only performing certain functions in an emergency) and lockout/emergency conditions.
 These can be broadly termed operational states. %, and apply to the 
 %functional groups.
 %
@@ -448,18 +477,18 @@ its `bottom-up~work~flow' it
 can reveal previously undetected system failure modes.
 %
 This is because the analyst 
-is  forced to deal with all component failure modes by the FMMD process, and
+is  forced to deal with all component failure modes when applying the FMMD process, and
-all failure modes of {\dcs}.
+all failure modes of the resultant {\dcs} as we progress up a hierarchy.
 %
 FMMD requires that all failure modes of components in a {\fg} are resolved to
 a symptom in the resulting {\dc}.
 %
-FMMD can find failure modes that are not
+FMMD thus finds failure modes that are not
 dealt with as a symptom, i.e. were ignored
-or forgotten. This means that the  FMMD process will expose un-handled 
+or forgotten, meaning that the  FMMD process will expose un-handled 
 failure modes.
 %come to light.
-%
+
 We can apply retrospective FMMD to electronic and software hybrid systems as well.
 %
 The electronic components {\fms} are established in the literature~\cite{fmd91,mil1991,en298,en230}.
@@ -474,7 +503,7 @@ contract clauses will be treated as failure modes in FMMD).
 % By treating hardware interfaces to software as {\dcs}, we automatically have a list of the failure modes
 % of the electronics.
 %%
-With the contracts in place for the software, we can then integrate them into the FMMD model.
+With the contracts in place for the software functions, we can then integrate them into the FMMD model.
 %
 FMMD models both software and hardware;
 we can thus verify that all
@@ -488,31 +517,15 @@ If not they are an un-handled error condition relating to the software hardware
 % of the electronics.
 %
 By performing FMMD on a software electronic hybrid system,
-we thus reveal design deficiencies in both the software and the software/electronics interface.
+we thus reveal design deficiencies in both the software, the electronics and the software/electronics interface.
 %in the hardware/software interface.
+%
 FMEDA does not handle software ---or---the software hardware interface.
 It thus potentially misses many undetected failures (in EN61508 terms undetected-dangerous and undetected safe failures).
 In Safety Integrity Level (SIL)~\cite{en61508} terms, by identifying undetectable faults and fixing them, we raise 
 the safe failure fraction (SFF).
 
-\section{How traditional FMEA reports can be derived from an FMMD model.}
+
-%
-An FMMD model has a data structure (described by UML diagrams, see figure~\ref{fig:cfg}), and by traversing this
-we can map system level failures back to {\bc} {\fms} (or combinations thereof).
-%
-Because we can determine these mappings we can produce reports in the traditional FMEA format ({\bc}~{\fm}~$\mapsto$~{system failure}).
-%
-With the addition of {\bc} {\fm} statistics~\cite{mil1991} we can provide reliability predictions for system level failures.
-The Pt100 example is revisited for this purpose and analysed for single and double failures, with statistics for {\bcs}
-taken from MIL1991 %~\cite{mil1991}, 
-in section~\ref{sec:bcstats}.
-%
-With an FMMD failure mode model a top down perspective is possible.
-We could for instance take each system level failure and produce a causation tree for it, tracing back
-to all {\bc} {\fms}.
-This is very closely related to the structure of FTA (top down) failure causation graphs.
-The possibility of automatically producing FTA diagrams from FMMD models 
-is examined in section~\ref{sec:fta}.
 %
 
 \section{Objective and Subjective Reasoning stages}

submission_thesis/appendixes/detailed_analysis.tex

@@ -7,7 +7,7 @@ in chapter 5 have been moved here for reference.
 
 \subsection{PHS45 Detailed Analysis}
 
-FMEA study of a resistor and capacitor configured as a phase changer.
+FMEA study of a resistor and capacitor in use as a phase changer.
 
 \label{detail:PHS45}
 \center