\section{Copy dot tex} \ifthenelse {\boolean{paper}} { \abstract{ This paper defines %what is meant by the terms components, derived~components, functional~groups, component fault modes and `unitary~state' component fault modes. %The application of Bayes theorem in current methodologies, and %the suitability of the `null hypothesis' or `P' value statistical approach %are discussed. The general concept of the cardinality constrained powerset is introduced and calculations for it described, and then for calculations under `unitary state' fault mode conditions. Data types and their relationships are described using UML. Mathematical constraints and definitions are made using set theory.} } { \section{Overview} This chapter defines the FMMD process and related concepts and calculations. Firstly, %what is meant by the terms components, failure~modes, derived~components, functional~groups, component fault modes and `unitary~state' component fault modes are defined. The general concept of the cardinality constrained powerset is introduced and calculations for it described, and then performance calculations under `unitary state' fault mode conditions. Data types and their relationships are described using UML. Mathematical constraints and definitions are made using set theory. } \section{Introduction} This \ifthenelse {\boolean{paper}} { paper } { chapter } describes the data types and concepts for the Failure Mode Modular De-composition (FMMD) method. When analysing a safety critical system using this methodology, we need clearly defined failure modes for all the components that are used to model the system. In our model, we have a constraint that the component failure modes must be mutually exclusive. When this constraint is complied with, we can use the FMMD method to build hierarchical bottom-up models of failure mode behaviour. %This and the definition of a component are %described in this chapter. %When building a system from components, %we should be able to find all known failure modes for each component. %For most common electrical and mechanical components, the failure modes %for a given type of part can be obtained from standard literature~\cite{mil1991} %\cite{mech}. %The failure modes for a given component $K$ form a set $F$. \label{defs} %% %% Paragraph component and its relationship to its failure modes %% \section{ Defining the term Component } \begin{figure}[h] \centering \includegraphics[width=300pt,bb=0 0 437 141,keepaspectratio=true]{CH4_FMMD/component.png} % component.png: 437x141 pixel, 72dpi, 15.42x4.97 cm, bb=0 0 437 141 \caption{A Component and its Failure Modes} \label{fig:component} \end{figure} Let us first define a component. %This is anything with which we use to build a product or system. This is anything we use to build a product or system. It could be something quite complicated like an integrated micro controller, or quite simple like the humble resistor. We can define a component by its name, a manufacturers' part number and perhaps a vendors' reference number. Geffory Hall, writing in Spacecraft systems engineering\cite{scse}[p.619] defines a `part' thus ``{{Part(definition)}---The lowest level of assembly, beyond which further disassembly irrevocably destroys the item'' The term component, in American English, can mean a building block or a part. In British-English a component generally is given to mean the definition for part above. For this study, we will use {\bc} to mean a `part', and component to mean a part or a sub-assembly. What components all have in common is that they can fail, and fail in a number of well defined ways. For common base-components there is established literature for the failure modes for the system designer to consider (often with accompanying statistical failure rates)~\cite{mil1991}. For instance, a simple resistor is generally considered to fail in two ways, it can go open circuit or it can short. Thus we can associate a set of faults to this component $ResistorFaultModes=\{OPEN, SHORT\}$. The UML diagram in figure \ref{fig:component} shows a component as a data structure with its associated failure modes. From this diagram we see that each component must have at least one failure mode. To clearly show that the failure modes are mutually exclusive states, or unitary states associated with one component, each failure mode is referenced back to only one component. %%-%% MTTF STATS CHAPTER MAYBE ?? %%-%% %%-%% This modelling constraint is due to the fact that even generic components with the same %%-%% failure mode types, may have different statistical MTTF properties within the same %%-%% circuitry\footnote{For example, consider resistors one of high resistance and one low. %%-%% The generic failure modes for a resistor will be the same for both. %%-%% The lower resistance part will draw more current and therefore have a statistically higher chance of failure.}. A products are built using of many base-components and these are traditionally kept in a `parts~list'. For a safety critical product this is usually a formal document and is used by quality inspectors to ensure the correct parts are being fitted. The parts list is shown for completeness here, as people involved with Printed Circuit Board (PCB) and electronics production, verification and testing would want to know where it lies in the model. The parts list is not actively used in the FMMD method. For the UML diagram in figure \ref{fig:componentpl} the parts list is simply a collection of components. \begin{figure}[h] \centering \includegraphics[width=400pt,bb=0 0 712 68,keepaspectratio=true]{CH4_FMMD/componentpl.png} % componentpl.png: 712x68 pixel, 72dpi, 25.12x2.40 cm, bb=0 0 712 68 \caption{Parts List of Components} \label{fig:componentpl} \end{figure} Components in the parts list % (bought in parts) will be termed `base~components'. Components derived from base~components will not always require parts~numbers\footnote{It is common practise for sub assemblies, PCB's, mechanical parts, software modules and some collections of components to have part numbers. This is a production/configuration~control issue and linked to Bill of Material (BOM) database structures etc. Parts numbers for derived components are not directly related to the analysis process we are concerned with here.}, and will not require a vendor reference, but must be named locally in the FMMD model. We can term `modularising a system', to mean recursively breaking it into smaller sections for analysis. When modularising a system from the top~down, as in Fault Tree Analysis~\cite{nasafta}\cite{nucfta} (FTA), it is common to term the modules identified as sub-systems. When building from the bottom up, it is more meaningful to call them `derived~components'. \section{Failure Modes in depth} For FMEA appraisals of systems we begin with components. %These will have a set of failure modes assigned to them. In order to perform FMEA we require a set of failure modes for each component in the system under investigation. These are failure modes from the perspective of the user of the component. We are not usually concerned with how the component has failed internally. What we need to know are the symptoms of failure. With these symptoms, we can trace their effects through the system under investigation and determine outcomes. Different approval agenices may list different failure mode sets for the same generic components. %% %% DETAILED LOOK AT TWO COMPONENTS AND THEIR FAILURE MODES %% %% FROM TWO LITERATURE SOURCES, FMD-91 and EN298 %% %%% THIS HAS BEEN TAKEN OUT AND PLACED IN THE C_GARRET OPAMPS DOCUMENT \section{Fault Mode Analysis, top down or bottom up?} Traditional static fault analysis methods work from the top down. They identify faults that can occur in a system, and then work down to see how they could be caused. Some apply statistical techniques to determine the likelihood of component failures causing specific system level errors. For example, Bayes theorem \ref{bayes}, the relation between a conditional probability and its reverse, can be applied to specific failure modes in components and the probability of them causing given system level errors. Another top down methodology is to apply cost benefit analysis to determine which faults are the highest priority to fix~\cite{bfmea}. The aim of FMMD analysis is to produce complete failure models of safety critical systems from the bottom-up, starting, where possible with known base~component failure~modes. An advantage of working from the bottom up is that we can ensure that all component failure modes must be considered. A top down approach can miss individual failure modes of components~\cite{faa}[Ch.~9], especially where they are non obvious top-level faults. In order to analyse from the bottom-up, we need to take small groups of components from the parts~list that naturally work together to perform a simple function. The components to include in a {\fg} are chosen by a human, the analyst. %We can represent the `Functional~Group' as a class. When we have a `{\fg}' we can look at the components it contains, and from this determine the failure modes of all the components that belong to it. % % and determine a failure mode model for that group. % % expand 21sep2010 %The `{\fg}' as used by the analyst is a collection of component failures modes. The analysts interest is the ways in which the components within the {\fg} can fail. All the failure modes of all the components within an {\fg} are collected. As each component mode holds a set of failure modes, these set of sets of failure modes is converted into into a flat set of failure modes (i.e. a set containing just failure modes not sets of failure modes). % Each of these failure modes, and optionally combinations of them, are formed into `test cases' which are analysed for their effect on the failure mode behaviour of the `{\fg}'. % Once we have the failure mode behaviour of the {\fg}, we can determine a new set of failure modes, the derived failure modes of the `{\fg}'. % Or in other words we can determine how the `{\fg}' can fail. We can now consider the {\fg} as a sort of super component with its own set of failure modes. \subsection{From functional group to newly derived component} \label{fg} The process for taking a {\fg}, considering all the failure modes of all the components in the group, and analysing it is called `symptom abstraction'. \ifthenelse {\boolean{paper}} { } { This is dealt with in detail in chapter \ref{symptom_abstraction}. } % define difference between a \fg and a \dc A {\fg} is a collection of components, a {\dc} is a new `theorectical' component which has a set of failure modes, which correspond to the failure modes of the {\fg} it was derived from. We could consider a {\fg} as a black box, or component to use, and in this case it would have a set of failure modes. Looking at the {\fg} in this way is seeing it as a {\dc}. In terms of our UML model, the symptom abstraction process takes a {\fg} and creates a new {\dc} from it. %To do this it first creates %a new set of failure modes, representing the fault behaviour %of the functional group. This is a human process and to do this the analyst %must consider all the failure modes of the components in the functional %group. The newly created {\dc} requires a set of failure modes of its own. These failure modes are the failure mode behaviour of the {\fg} from which it was derived. % Because these new failure modes were derived from a {\fg}, we can call these `derived~failure~modes'. %It then creates a new derived~component object, and associates it to this new set of derived~failure~modes. We thus have a `new' component, or system building block, but with a known and traceable fault behaviour. The UML representation (in figure \ref{fig:cfg}) shows a `functional group' having a one to one relationship with a derived~component. The symbol $\bowtie$ is used to indicate the analysis process that takes a functional group and converts it into a new component. with $\mathcal{FG}$ represeting the set of all functional groups, and $\mathcal{DC}$ the set of all derived components, this can be expresed as $ \bowtie : \mathcal{FG} \rightarrow \mathcal{DC} $ . \begin{figure}[h] \centering \includegraphics[width=400pt,bb=0 0 712 286,keepaspectratio=true]{./CH4_FMMD/cfg.png} % cfg.png: 712x286 pixel, 72dpi, 25.12x10.09 cm, bb=0 0 712 286 \caption{UML Meta model for FMMD hierarchy} \label{fig:cfg} \end{figure} \subsection{Keeping track of the derived components position in the hierarchy} \label{alpha} The UML meta model in figure \ref{fig:cfg}, shows the relationships between the classes and sub-classes. Note that because we can use derived components to build functional groups, this model intrinsically supports building a hierarchy. % In use we will build a hierarchy of objects, with derived~components forming functional~groups, and creating derived components higher up in the structure. % To keep track of the level in the hierarchy (i.e. how many stages of component derivation `$\bowtie$' have lead to the current derived component) we can add an attribute to the component data type. This can be a natural number called the level variable $\alpha \in \mathbb{N}$. % J. Howse says zero is a given in comp sci. This can be a natural number called the level variable $\alpha \in \mathbb{N}_0$. The $\alpha$ level variable in each component, indicates the position in the hierarchy. Base or parts~list components have a `level' of $\alpha=0$. % I do not know how to make this simpler Derived~components take a level based on the highest level component used to build the functional group it was derived from plus 1. So a derived component built from base level or parts list components would have an $\alpha$ value of 1. %\clearpage % \section{Set Theory Description} % % $$ System \stackrel{has}{\longrightarrow} PartsList $$ % % $$ PartsList \stackrel{has}{\longrightarrow} Components $$ % % $$ Component \stackrel{has}{\longrightarrow} FailureModes $$ % % $$ FunctionalGroup \stackrel{has}{\longrightarrow} Components $$ % % Using the symbol $\bowtie$ to indicate an analysis process that takes a % functional group and converts it into a new component. % % $$ \bowtie ( FG ) \rightarrow DerivedComponent $$ % \subsection{Relationships between functional~groups and failure modes} Let the set of all possible components be $\mathcal{C}$ and let the set of all possible failure modes be $\mathcal{F}$ and $\mathcal{PF}$ is the powerset of all $\mathcal{F}$. We can define a function $fm$ as equation \ref{eqn:fmset}. \label{fmdef} \begin{equation} fm : \mathcal{C} \rightarrow \mathcal{P}\mathcal{F} \label{eqn:fmset} \end{equation} %% % Above def gives below anyway % %The is defined by equation \ref{eqn:fminstance}, where C is a component and F is a set of failure modes. % %\begin{equation} % fm ( C ) = F % \label{eqn:fminstance} %\end{equation} \paragraph{Finding all failure modes within the functional group} For FMMD failure mode analysis we need to consider the failure modes from all the components in a functional~group. In a functional group we have a collection of Components that hold failure mode sets. We need to collect these failure mode sets and place all the failure modes into a single set; this can be termed flattening the set of sets. %%Consider the components in a functional group to be $C_1...C_N$. The flat set of failure modes $FSF$ we are after can be found by applying function $fm$ to all the components in the functional~group and taking the union of them thus: %%$$ FSF = \bigcup_{j=1}^{N} fm(C_j) $$ $$ FSF = \bigcup_{c \in FG} fm(c) $$ We can actually overload the notation for the function $fm$ % FM and define it for the set components within a functional group $\mathcal{FG}$ (i.e. where $\mathcal{FG} \subset \mathcal{C} $) in equation \ref{eqn:fmoverload}. \begin{equation} fm : \mathcal{FG} \rightarrow \mathcal{F} \label{eqn:fmoverload} \end{equation} \section{Unitary State Component Failure Mode sets} \label{sec:unitarystate} \paragraph{Design Descision/Constraint} An important factor in defining a set of failure modes is that they should represent the failure modes as simply and minimally as possible. It should not be possible, for instance, for a component to have two or more failure modes active at once. Were this to be the case, we would have to consider additional combinations of failure modes within the component. Having a set of failure modes where $N$ modes could be active simultaneously would mean having to consider an additional $2^N-1$ failure mode scenarios. Should a component be analysed and simultaneous failure mode cases exist, the combinations could be represented by new failure modes, or the component should be considered from a fresh perspective, perhaps considering it as several smaller components within one package. This property, failure modes being mutually exclusive, is termed `unitary state failure modes' in this study. This corresponds to the `mutually exclusive' definition in probability theory~\cite{probstat}. \begin{definition} A set of failure modes where only one failure mode can be active at one time is termed a {\textbf{unitary~state}} failure mode set. \end{definition} Let the set of all possible components be $ \mathcal{C}$ and let the set of all possible failure modes be $ \mathcal{F}$. The set of failure modes of a particular component are of interest here. What is required is to define a property for a set of failure modes where only one failure mode can be active at a time; or borrowing from the terms of statistics, the failure mode being an event that is mutually exclusive with a set $F$. We can define a set of failure mode sets called $\mathcal{U}$ to represent this property for a set of failure modes.. \begin{definition} We can define a set $\mathcal{U}$ which is a set of sets of failure modes, where the component failure modes in each of its members are unitary~state. Thus if the failure modes of a component $F$ are unitary~state, we can say $F \in \mathcal{U}$ is true. \end{definition} \section{Component failure modes: Unitary State example} An example of a component with an obvious set of ``unitary~state'' failure modes is the electrical resistor. Electrical resistors can fail by going OPEN or SHORTED. For a given resistor R we can apply the function $fm$ to find its set of failure modes thus $ fm(R) = \{R_{SHORTED}, R_{OPEN}\} $. A resistor cannot fail with the conditions open and short active at the same time! The conditions OPEN and SHORT are thus mutually exclusive. Because of this, the failure mode set $F=fm(R)$ is `unitary~state'. Thus because both fault modes cannot be active at the same time, the intersection of $ R_{SHORTED} $ and $ R_{OPEN} $ cannot exist. The intersection of these is therefore the empty set, $ R_{SHORTED} \cap R_{OPEN} = \emptyset $, therefore $ fm(R) \in \mathcal{U} $. We can make this a general case by taking a set $F$ (with $f_1, f_2 \in F$) representing a collection of component failure modes. We can define a boolean function {\ensuremath{\mathcal{ACTIVE}}} that returns whether a fault mode is active (true) or dormant (false). We can say that if any pair of fault modes is active at the same time, then the failure mode set is not unitary state: we state this formally \begin{equation} \exists f_1,f_2 \in F \dot ( f_1 \neq f_2 \wedge \mathcal{ACTIVE}({f_1}) \wedge \mathcal{ACTIVE}({f_2}) ) \implies F \not\in \mathcal{U} \end{equation} % % \begin{equation} % c1 \cap c2 \neq \emptyset | c1 \neq c2 \wedge c1,c2 \in C \wedge C \not\in U % \end{equation} That is to say that it is impossible that any pair of failure modes can be active at the same time for the failure mode set $F$ to exist in the family of sets $\mathcal{U}$. Note where there are more than two failure~modes, by banning any pairs from being active at the same time, we have banned larger combinations as well. \subsection{Design Rule: Unitary State} All components must have unitary state failure modes to be used with the FMMD methodology, for base~components, this is usually the case. Most simple components fail in one clearly defined way and generally stay in that state. However, where a complex component is used, for instance a microcontroller with several modules that could all fail simultaneously, a process of reduction into smaller theoretical components will have to be made. This is sometimes termed `heuristic~de-composition'. A modern microcontroller will typically have several modules, which are configured to operate on pre-assigned pins on the device. Typically voltage inputs (\adcten / \adctw), digital input and outputs, PWM (pulse width modulation), UARTs and other modules will be found on simple cheap microcontrollers~\cite{pic18f2523}. For instance the voltage reading functions which consist of an ADC multiplexer and ADC can be considered to be components inside the microcontroller package. The microcontroller thus becomes a collection of smaller components that can be analysed separately~\footnote{It is common for the signal paths in a safety critical product to be traced, and when entering a complex component like a microcontroller, the process of heuristic de-compostion applied to it}. \paragraph{Reason for Constraint} Were this constraint to not be applied each component could not have $N$ failure modes to consider but potentially $2^N$. This would make the job of analysing the failure modes in a {\fg} impractical due to the sheer size of the task. %%- Need some refs here because that is the way gastec treat the ADC on microcontroller on the servos \section{Handling Simultaneous Component Faults} For some integrity levels of static analysis, there is a need to consider not only single failure modes in isolation, but cases where more then one failure mode may occur simultaneously. Note that the `unitary state' conditions apply to failure modes within a component. The scenarios presented here are where two or more components fail simultaneously. It is an implied requirement of EN298~\cite{en298} for instance to consider double simultaneous faults\footnote{This is under the conditions of LOCKOUT in an industrial burner controller that has detected one fault already. However, from the perspective of static failure mode analysis, this amounts to dealing with double simultaneous failure modes.}. To generalise, we may need to consider $N$ simultaneous failure modes when analysing a functional group. This involves finding all combinations of failures modes of size $N$ and less. %The Powerset concept from Set theory is useful to model this. The powerset, when applied to a set S is the set of all subsets of S, including the empty set \footnote{The empty set ( $\emptyset$ ) is a special case for FMMD analysis, it simply means there is no fault active in the functional~group under analysis.} and S itself. In order to consider combinations for the set S where the number of elements in each subset of S is $N$ or less, a concept of the `cardinality constrained powerset' is proposed and described in the next section. %\pagebreak[1] \subsection{Cardinality Constrained Powerset } \label{ccp} A Cardinality Constrained powerset is one where subsets of a cardinality greater than a threshold are not included. This threshold is called the cardinality constraint. To indicate this, the cardinality constraint $cc$ is subscripted to the powerset symbol thus $\mathcal{P}_{cc}$. Consider the set $S = \{a,b,c\}$. The powerset of S: $$ \mathcal{P} S = \{ \emptyset, \{a,b,c\}, \{a,b\},\{b,c\},\{c,a\},\{a\},\{b\},\{c\} \} .$$ $\mathcal{P}_{\le 2} S $ means all non-empty subsets of S where the cardinality of the subsets is less than or equal to 2 or less. $$ \mathcal{P}_{\le 2} S = \{ \{a,b\},\{b,c\},\{c,a\},\{a\},\{b\},\{c\} \} . $$ Note that $\mathcal{P}_{1} S $ (non-empty subsets where cardinality $\leq 1$) for this example is: $$ \mathcal{P}_{1} S = \{ \{a\},\{b\},\{c\} \} $$. \paragraph{Calculating the number of elements in a cardinality constrained powerset} A $k$ combination is a subset with $k$ elements. The number of $k$ combinations (each of size $k$) from a set $S$ with $n$ elements (size $n$) is the binomial coefficient~\cite{probstat} shown in equation \ref{bico}. \begin{equation} C^n_k = {n \choose k} = \frac{n!}{k!(n-k)!} . \label{bico} \end{equation} To find the number of elements in a cardinality constrained subset S with up to $cc$ elements in each combination sub-set, we need to sum the combinations, %subtracting $cc$ from the final result %(repeated empty set counts) from $1$ to $cc$ thus % % $$ {\sum}_{k = 1..cc} {\#S \choose k} = \frac{\#S!}{k!(\#S-k)!} $$ % \begin{equation} |{\mathcal{P}_{cc}S}| = \sum^{cc}_{k=1} \frac{|{S}|!}{ k! ( |{S}| - k)!} . \label{eqn:ccps} \end{equation} \subsection{Actual Number of combinations to check with Unitary State Fault mode sets} If all of the fault modes in $S$ were independent, the cardinality constrained powerset calculation (in equation \ref {eqn:ccps}) would give the correct number of test case combinations to check. Because sets of failure modes in FMMD analysis are constrained to be unitary state, the actual number of test cases to check will usually be less than this. This is because combinations of faults within a components failure mode set, are impossible under the conditions of unitary state failure mode. To modify equation \ref{eqn:ccps} for unitary state conditions, we must subtract the number of component `internal combinations' for each component in the functional group under analysis. Note we must sequentially subtract using combinations above 1 up to the cardinality constraint. For example, say the cardinality constraint was 3, we would need to subtract both $|{n \choose 2}|$ and $|{n \choose 3}|$ for each component in the functional~group. \subsubsection{Example: Two Component functional group cardinality Constraint of 2} For example: suppose we have a simple functional group with two components R and T, of which $$fm(R) = \{R_o, R_s\}$$ and $$fm(T) = \{T_o, T_s, T_h\}.$$ This means that the functional~group $FG=\{R,T\}$ will have a component failure mode set of $fm(FG) = \{R_o, R_s, T_o, T_s, T_h\}$ For a cardinality constrained powerset of 2, because there are 5 error modes ( $|fm(FG)|=5$), applying equation \ref{eqn:ccps} gives :- $$ | P_2 (fm(FG)) | = \frac{5!}{1!(5-1)!} + \frac{5!}{2!(5-2)!} = 15.$$ This is composed of ${5 \choose 1}$ five single fault modes, and ${5 \choose 2}$ ten double fault modes. However we know that the faults are mutually exclusive within a component. We must then subtract the number of `internal' component fault combinations for each component in the functional~group. For component R there is only one internal component fault that cannot exist $R_o \wedge R_s$. As a combination ${2 \choose 2} = 1$. For the component $T$ which has three fault modes ${3 \choose 2} = 3$. Thus for $cc == 2$, under the conditions of unitary state failure modes in the components $R$ and $T$, we must subtract $(3+1)$. The number of combinations to check is thus 11, $|\mathcal{P}_{2}(fm(FG))| = 11$, for this example and this can be verified by listing all the required combinations: $$ \mathcal{P}_{2}(fm(FG)) = \{ \{R_o T_o\}, \{R_o T_s\}, \{R_o T_h\}, \{R_s T_o\}, \{R_s T_s\}, \{R_s T_h\}, \{R_o \}, \{R_s \}, \{T_o \}, \{T_s \}, \{T_h \} \} $$ and whose cardinality is 11. % by inspection %$$ %| %\{ % \{R_o T_o\}, \{R_o T_s\}, \{R_o T_h\}, \{R_s T_o\}, \{R_s T_s\}, \{R_s T_h\}, \{R_o \}, \{R_s \}, \{T_o \}, \{T_s \}, \{T_h \} %\} %| = 11 %$$ \pagebreak[1] \subsubsection{Establishing Formulae for unitary state failure mode cardinality calculation} The cardinality constrained powerset in equation \ref{eqn:ccps}, can be modified for % corrected for unitary state failure modes. %This is written as a general formula in equation \ref{eqn:correctedccps}. %\indent{ %To define terms : %\begin{itemize} %\item Let $C$ be a set of components (indexed by $j \in J$) that are members of the functional group $FG$ i.e. $ \forall j \in J | C_j \in FG $. %\item Let $|fm({C}_{j})|$ indicate the number of mutually exclusive fault modes of component $C_j$. %\item Let $fm(FG)$ be the collection of all failure modes from all the components in the functional group. %\item Let $SU$ be the set of failure modes from the {\fg} where all $FG$ is such that components $C_j$ are in `unitary state' i.e. $(SU = fm(FG)) \wedge (\forall j \in J | fm(C_j) \in \mathcal{U}) $, then %\end{itemize} %} \begin{equation} |{\mathcal{P}_{cc}SU}| = {\sum^{cc}_{k=1} \frac{|{SU}|!}{k!(|{SU}| - k)!}} - {\sum_{j \in J} {|FM({C_{j})}| \choose 2}} . \label{eqn:correctedccps} \end{equation} Expanding the combination in equation \ref{eqn:correctedccps} \begin{equation} |{\mathcal{P}_{cc}SU}| = {\sum^{cc}_{k=1} \frac{|{SU}|!}{k!(|{SU}| - k)!}} - {{\sum_{j \in J} \frac{|FM({C_j})|!}{2!(|FM({C_j})| - 2)!}} } . \label{eqn:correctedccps2} \end{equation} \paragraph{Use of Equation \ref{eqn:correctedccps2} } Equation \ref{eqn:correctedccps2} is useful for an automated tool that would verify that a single or double simultaneous failures model has complete failure mode coverage. By knowing how many test cases should be covered, and checking the cardinality associated with the test cases, complete coverage would be verified. %\paragraph{Multiple simultaneous failure modes disallowed combinations} %The general case of equation \ref{eqn:correctedccps2}, involves not just dis-allowing pairs %of failure modes within components, but also ensuring that combinations across components %do not involve any pairs of failure modes within the same component. %%%%- NOT SURE ABOUT THAT !!!!! %%%- A recursive algorithm and proof is described in appendix \ref{chap:vennccps}. %%\paragraph{Practicality} %%Functional Group may consist, typically of four or five components, which typically %%have two or three failure modes each. Taking a worst case of mutiplying these %%by a factor of five (the number of failure modes and components) would give %%$25 \times 15 = 375$ %% %% %% %%\begin{verbatim} %% %%# define a factorial function %%# gives 1 for negative values as well %%define f(x) { %% if (x>1) { %% return (x * f (x-1)) %% } %% return (1) %% %%} %%define u1(c,x) { %% return f(c*x)/(f(1)*f(c*x-1)) %%} %%define u2(c,x) { %% return f(c*x)/(f(2)*f(c*x-2)) %%} %% %%define uc(c,x) { %% return c * f(x)/(f(2)*f(x-2)) %%} %% %%# where c is number of components, and x is number of failure modes %%# define function u to calculate combinations to check for double sim failure modes %%define u(c,x) { %%f(c*x)/(f(1)*f(c*x-1)) + f(c*x)/(f(2)*f(c*x-2)) - c * f(c)/(f(2)*f(c-2)) %%} %% %% %%\end{verbatim} %% \pagebreak[1] \section{Component Failure Modes and Statistical Sample Space} %\paragraph{NOT WRITTEN YET PLEASE IGNORE} A sample space is defined as the set of all possible outcomes. For a component in FMMD analysis, this set of all possible outcomes is its normal correct operating state and all its failure modes. We are thus considering the failure modes as events in the sample space. % When dealing with failure modes, we are not interested in the state where the component is working perfectly or `OK' (i.e. operating with no error). % We are interested only in ways in which it can fail. By definition while all components in a system are `working perfectly' that system will not exhibit faulty behaviour. We can say that the OK state corresponds to the empty set. Thus the statistical sample space $\Omega$ for a component or derived~component $C$ is %$$ \Omega = {OK, failure\_mode_{1},failure\_mode_{2},failure\_mode_{3} ... failure\_mode_{N} $$ $$ \Omega(C) = \{OK, failure\_mode_{1},failure\_mode_{2},failure\_mode_{3}, \ldots ,failure\_mode_{N}\} . $$ The failure mode set $F$ for a given component or derived~component $C$ is therefore $ fm(C) = \Omega(C) \backslash \{OK\} $ (or expressed as $ \Omega(C) = fm(C) \cup \{OK\} $). The $OK$ statistical case is the largest in probability, and is therefore of interest when analysing systems from a statistical perspective. This is of interest for the application of conditional probability calculations such as Bayes theorem~\cite{probstat}; The current failure modelling methodologies (FMEA, FMECA, FTA, FMEDA) all use Bayesian statistics to justify their methodologies~\cite{nucfta}\cite{nasafta}. That is to say, a base component or a sub-system failure has a probability of causing given system level failures. Another way to view this is to consider the failure modes of component, with the $OK$ state, as a universal set $\Omega$, where all sets within $\Omega$ are partitioned. Figure \ref{fig:partitioncfm} shows a partitioned set representing component failure modes $\{ B_1 ... B_8, OK \}$ : partitioned sets where the OK or empty set condition is included, obey unitary state conditions. Because the subsets of $\Omega$ are partitionned we can say these failure modes are unitary state. \begin{figure}[h] \centering \includegraphics[width=350pt,keepaspectratio=true]{./CH4_FMMD/partitioncfm.png} % partition.png: 510x264 pixel, 72dpi, 17.99x9.31 cm, bb=0 0 510 264 \caption{Base Component Failure Modes with OK mode as partitioned set} \label{fig:partitioncfm} \end{figure} \section{Components with Independent failure modes} Suppose that we have a component that can fail simultaneously with more than one failure mode. This would make it seemingly impossible to model as `unitary state'. \paragraph{De-composition of complex component.} There are two ways in which we can deal with this. We could consider the component a composite of two simpler components, and model their interaction to create a derived component. \ifthenelse {\boolean{paper}} { This technique is outside the scope of this paper. } { This technique is dealt in chapter \ref{fmmd_complex_comp} which shows how derived components may be assembled. } \begin{figure}[h] \centering \includegraphics[width=200pt,bb=0 0 353 247,keepaspectratio=true]{./CH4_FMMD/compco.png} % compco.png: 353x247 pixel, 72dpi, 12.45x8.71 cm, bb=0 0 353 247 \caption{Component with three failure modes as partitioned sets} \label{fig:combco} \end{figure} \paragraph{Combinations become new failure modes.} Alternatively, we could consider the combinations of the failure modes as new failure modes. We can model this using an Euler diagram representation of an example component with three failure modes\footnote{OK is really the empty set, but the term OK is more meaningful in the context of component failure modes} $\{ B_1, B_2, B_3, OK \}$ see figure \ref{fig:combco}. For the purpose of example let us consider $\{ B_2, B_3 \}$ to be intrinsically mutually exclusive, but $B_1$ to be independent. This means the we have the possibility of two new combinations $ B_1 \cap B_2$ and $ B_1 \cap B_3$. We can represent these as shaded sections of figure \ref{fig:combco2}. \begin{figure}[h] \centering \includegraphics[width=200pt,bb=0 0 353 247,keepaspectratio=true]{./CH4_FMMD/compco2.png} % compco.png: 353x247 pixel, 72dpi, 12.45x8.71 cm, bb=0 0 353 247 \caption{Component with three failure modes where $B_1$ is independent} \label{fig:combco2} \end{figure} We can calculate the probabilities for the shaded areas assuming the failure modes are statistically independent by multiplying the probabilities of the members of the intersection. We can use the function $P$ to return the probability of a failure mode, or combination thereof. Thus for $P(B_1 \cap B_2) = P(B_1)P(B_2)$ and $P(B_1 \cap B_3) = P(B_1)P(B_3)$. \begin{figure}[h] \centering \includegraphics[width=200pt,bb=0 0 353 247,keepaspectratio=true]{./CH4_FMMD/compco3.png} % compco.png: 353x247 pixel, 72dpi, 12.45x8.71 cm, bb=0 0 353 247 \caption{Component with two new failure modes} \label{fig:combco3} \end{figure} We can now consider the shaded areas as new failure modes of the component (see figure \ref{fig:combco3}). Because of the combinations, the probabilities for the failure modes $B_1, B_2$ and $B_3$ will now reduce. We can use the prime character ($\; \prime \;$), to represent the altered value for a failure mode, i.e. $B_1^\prime$ represents the altered value for $B_1$. Thus $$ P(B_1^\prime) = B_1 - P(B_1 \cap B_2) - P(B_1 \cap B_3)\; , $$ $$ P(B_2^\prime) = B_2 - P(B_1 \cap B_2) \; and $$ $$ P(B_3^\prime) = B_3 - P(B_1 \cap B_3) \; . $$ We now have two new component failure mode $B_4$ and $B_5$, shown in figure \ref{fig:combco3}. We can express their probabilities as $P(B_4) = P(B_1 \cap B_3)$ and $P(B_5) = P(B_1 \cap B_2)$. %%- %%- Need a complete and more complicated UML diagram here %%- the other parts were just fragments to illustrate points %%- %%- \section{Complete UML Diagram} For a complete UML data model we need to consider the System as an object. This holds a parts list, and is the key reference point in the data structure. A real life system will be expected to perform in a given environment. Environment in the context of this study means external influences the System could be expected to work under. A typical data sheet for an electrical component will give a working temperature range for instance. Mechanical components will be specified for stress and loading limits. \paragraph{Environmental Modelling.} The external influences/environment could typically be temperature ranges, levels of electrical interference, high voltage contamination on supply lines, radiation levels etc. Environmental influences will affect specific components in specific ways. Environmental analysis is thus applicable to components. Environmental influences, such as over stress due to voltage can be eliminated by down-rating of components as discussed in section~\ref{downrate}. With given environmental constraints, we can therefore eliminate some failure modes from the model. \paragraph{Operational states.} Within the field of safety critical engineering we often encounter sub-system that include test facilities. We also encounter degraded performance (such as only performing functions in an emergency) and lockout conditions. These can be broadly termed operational states, and apply to the functional groups. Consider for instance an electrical circuit that has a TEST line. When the TEST line is activated, it supplies a test signal which will validate the circuit. This circuit will have two operational states, NORMAL and TEST mode. It is natural to apply the operational states to functional groups. Functional groups by definition implement functionality, or purpose of particular sub-systems, and therefore are the best objects to model operational states. \paragraph{Inhibit Conditions} Some failure modes may only be active given specific environmental conditions or when other failures are already active. To model this, an `inhibit' class has been added. This is an optional attribute of a failure mode. This inhibit class can be triggered on a combination of environmental or failure modes. \paragraph{UML Diagram Additional Objects.} The additional objects System, Environment and Operational States are added to UML diagram in figure \ref{fig:cfg} and represented in figure \ref{fig:cfg2}. \label{completeuml} \begin{figure}[h] \centering \includegraphics[width=400pt,keepaspectratio=true]{./CH4_FMMD/master_uml.png} % cfg2.png: 702x464 pixel, 72dpi, 24.76x16.37 cm, bb=0 0 702 464 \caption{Complete UML diagram} \label{fig:cfg2} \end{figure} \subsection{Ontological work on FMEA} Ontological work on FMEA reviewed so far, has concentrated on formalising the natural language process of FMEA and thus defining relationships between components, failure modes and top level outcomes an overview of this work may found here~\cite{ontfmea}. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \subsection{An algebraic notation for identifying FMMD enitities} Consider all `components' to exist as members of a set $\mathcal{C}$. % Each component $c$ has an associated set of failure modes. We can define a function $fm$ that returns a set of failure modes $F$, for the component $c$. Let the set of all possible components be $\mathcal{C}$ and let the set of all possible failure modes be $\mathcal{F}$. We now define the function $fm$ as \begin{equation} \label{eqn:fm} fm : \mathcal{C} \rightarrow \mathcal{P}\mathcal{F}. \end{equation} This is defined by, where $c$ is a component and $F$ is a set of failure modes, $ fm ( c ) = F. $ We can use the variable name $\FG$ to represent a {\fg}. A {\fg} is a collection of components. %We thus define $FG$ as a set of chosen components defining %a {\fg}; all functional groups We can state that {\FG} is a member of the power set of all components, $ \FG \in \mathcal{P} \mathcal{C}. $ We can overload the $fm$ function for a functional group {\FG} where it will return all the failure modes of the components in {\FG} given by $$ fm ({\FG}) = F. $$ Generally, where $\mathcal{{\FG}}$ is the set of all functional groups, \begin{equation} fm : \mathcal{{\FG}} \rightarrow \mathcal{P}\mathcal{F}. \end{equation} %$$ \mathcal{fm}(C) \rightarrow S $$ %$$ {fm}(C) \rightarrow S $$ \paragraph{Abstraction Levels of {\fgs} and {\dcs}} \label{sec:indexsub} We can indicate the abstraction level of a component by using a superscript. Thus for the component $c$, where it is a `base component' we can assign it the abstraction level zero, $c^0$. Should we wish to index the components (for example as in a product parts-list) we can use a sub-script. Our base component (if first in the parts-list) could now be uniquely identified as $c^0_1$. We can further define the abstraction level of a {\fg}. We can say that it is the maximum abstraction level of any of its components. Thus a functional group containing only base components would have an abstraction level zero and could be represented with a superscript of zero thus `${\FG}^0$'. % The functional group set may also be indexed. We can apply symptom abstraction to a {\fg} to find its symptoms. %We are interested in the failure modes %of all the components in the {\fg}. An analysis process We define the symptom abstraction process with the symbol `$\bowtie$'.% is applied to the {\fg}. % The $\bowtie$ function takes a {\fg} as an argument and returns a newly created {\dc}. % %The $\bowtie$ analysis, a symptom extraction process, is described in chapter \ref{chap:sympex}. The symptom abstraction process must always raise the abstraction level for the newly created {\dc}. Using $\abslevel$ to symbolise the fault abstraction level, we can now state: $$ \bowtie({\FG}^{\abslevel}) \rightarrow c^{{\abslevel}+N} | N \ge 1. $$ \paragraph{Functional Groups may be indexed} We will typically have more than one {\fg} on each level of FMMD hierarchy ( expect the top level where there will only be one) we could index the {\fgs} with a sub-script, and can then uniquely identify them using their level and their index. For example ${\FG}^{3}_{2}$ would be the second {\fg} at the third level of abstraction in an FMMD hierarchy. \paragraph{The symptom abstraction process in outline.} The $\bowtie$ function processes each component in the {\fg} and extracts all the component failure modes. With all the failure modes, an analyst can determine how each failure mode will affect the {\fg}, and then collect common symptoms. A new {\dc} is created where its failure modes, are the symptoms from {\fg}. Note that the component must have a higher abstraction level than the {\fg} it was derived from. \paragraph{Surjective constraint applied to symptom collection.} We can stipulate that symptom collection process is surjective. % i.e. $ \forall f in F $ By stipulating surjection for symptom collection, we ensure that each component failure mode maps to at least one symptom. We also ensure that all symptoms have at least one component failure mode (i.e. one or more failure modes that caused it). % \subsection{FMMD Hierarchy} By applying stages of analysis to higher and higher abstraction levels, we can converge to a complete failure mode model of the system under analysis. Because the symptom abstraction process is defined as surjective (from component failure modes to symptoms) the number of symptoms is guaranteed to be less than or equal to the number of component failure modes. In practise however, the number of symptoms greatly reduces as we traverse up the hierarchy. This is a natural process. When we have complicated systems they always have a small number of system failure modes in comparison to the number of failure modes in its sub-systems/components.. \section{Examples of Derived Component like concepts in safety literature} Idea stage on this section, integrated circuits and some compond parts (like digital resistors) are treated like base components. i.e. this sets a precedent for {\dcs}. \begin{itemize} \item Look at OPAMP circuits, pick one (say $\mu$741) \item Digital transistor perhaps, inside two resistors and a transistor. \item outline a proposed FMMD analysis \item Show FMD-91 OPAMP failure modes -- compare with FMMD \end{itemize} The gas burner standard (EN298~\cite{en298}), only considers OPEN and SHORT for resistors (and for some types of resistors OPEN only). FMD-91~\cite{fmd91}(the US military failure modes guide) also includes `parameter change' in its description of resistor failure modes. Now a resistor will generally only suffer parameter change when over stressed. EN298 stipulates down rating by 60\% to maximum stress possible in a circuit. So even if you have a resistor that preliminary tells you would never be subjected to say more than 5V, but there is say, a 24V rail on the circuit, you have to choose resistors able to cope with the 24V stress/load and then down rate by 60\%. That is to say the resitor should be rated for a maximum voltage of $ > 38.4V$ and should be rated 60\% higher for its power consumption at $38.4V$. Because of down-rating, it is reasonable to not have to consider parameter change under EN298 approvals. \clearpage Two areas that cannot be automated. Choosing {\fgs} and the analysis/symptom collection process itself. \subsection{{\fgs} Sharing components and Hierarchy} With electronics we need to follow the signal path to make sense of failure modes effects on other parts of the circuit further down that path. %{\fgs} will naturally have to be in the position of starter A power-supply is naturally first in a signal path (or failure reasoning path). That is to say, if the power-supply is faulty, its failure modes are likely to affect the {\fgs} that have to use it. This means that most electronic components should be placed higher in an FMMD hierarchy than the power-supply. A shorted de-coupling capactitor caused a `symptom' of the power-supply, and an open de-coupling capactitor should be considered a `failure~mode' relevant to the logic chip. % to consider. If components can be shared between functional groups, this means that components must be shareable between {\fgs} at different levels in the FMMD hierarchy. This hierarchy and an optionally shared de-coupling capacitor (with line highlighted in red and dashed) are shown in figure~\ref{fig:shared_component}. \begin{figure} \centering \includegraphics[width=250pt,keepaspectratio=true]{CH5_Examples/shared_component.png} % shared_component.png: 729x670 pixel, 72dpi, 25.72x23.64 cm, bb=0 0 729 670 \caption{Optionally shared Component} \label{fig:shared_component} \end{figure} \subsection{Hierarchy and structure} By having this structure, the logic circuit element, can accept failure modes from the power-supply (for instance these might, for the sake of example include: $NO\_POWER$, $LOW\_VOLTAGE$, $HIGH\_VOLTAGE$, $NOISE\_HF$, $NOISE\_LF$. Our logic circuit may be able to cope with $LOW\_VOLTAGE$ and $NOISE\_LF$, but react with a serious symptom to $NOISE\_HF$ say. But in order to process these failure modes it must be at a higher stage in the FMMD hierarchy. \pagebreak[4] \section{Defining the concept of `comparison~complexity' in FMEA} % % DOMAIN == INPUTS % RANGE == OUTPUTS % When performing FMEA we have a system under investigation, which will comprise of a collection of components which have associated failure modes. The object of FMEA is to determine cause and effect: from the failure modes (the causes) to the effects (or symptoms of failure). % To perform FMEA rigorously we could stipulate that every failure mode must be checked for effects against all the components in the system. We could term this `rigorous~FMEA'~(RFMEA). The number of checks we have to make to achieve this gives an indication of the complexity of the task. % We could term this `comparison~complexity', as it is the number of paths between failure modes and components, necessary to achieve RFMEA, for a given system/functional~group. % (except its self of course, that component is already considered to be in a failed state!). % Obviously, for a small number of components and failure modes we have a smaller number of checks to make than for a complicated larger system. % We can consider the system as a large {\fg} of components. We represent the number of components in the {\fg} $G$, by $ | G | $ (an indexing and sub-scripting notation to identify particular {\fgs} within an FMMD hierarchy is given in section~\ref{sec:indexsub}). The function $fm$ has a component as its domain and the components failure modes as its range (see equation~\ref{eqn:fm}). We can represent the number of potential failure modes of a component $c$, to be $ | fm(c) | .$ If we index all the components in the system under investigation $ c_1, c_2 \ldots c_{|\FG|} $ we can express the number of checks required to rigorously examine every failure mode against all the other components in the system. We can define this as a function, Comparison Complexity, $CC$, with its domain as the system or {\fg}, $\FG$, and its range as the number of checks to perform to satisfy a rigorous FMEA inspection. Where $\mathcal{\FG}$ represents the set of all {\fgs}, and $ \mathbb{N} $ any natural integer, $CC$ is defined by, \begin{equation} %$$ CC:\mathcal{\FG} \rightarrow \mathbb{N}, %$$ \end{equation} and, where n is the number of components in the system/{\fg}, $|fm(c_i)|$ is the number of failure modes in component ${c_i}$, is given by \begin{equation} \label{eqn:CC} %$$ %%% when it was called reasoning distance -- 19NOV2011 -- RD(fg) = \sum_{n=1}^{|fg|} |fm(c_n)|.(|fg|-1) CC(\FG) = (n-1) \sum_{1 \le i \le n} fm(c_i). %$$ \end{equation} This can be simplified if we can determine the total number of failure modes in the system $K$, (i.e. $ K = \sum_{n=1}^{|G|} {|fm(c_n)|}$); equation~\ref{eqn:CC} becomes %$$ \begin{equation} \label{eqn:rd2} CC(\FG) = K.(|\FG|-1). \end{equation} %$$ %Equation~\ref{eqn:rd} can also be expressed as % % \begin{equation} % \label{eqn:rd2} % %$$ % CC(G) = {|G|}.{|fm(c_n)|}.{(|fg|-1)} . % %$$ % \end{equation} \subsection{A general formula for counting Comparison Complexity in an FMMD hierarchy} An FMMD Hierarchy will have reducing numbers of functional groups as we progress up the hierarchy. In order to calculate its comparison~complexity we need to apply equation~\ref{eqn:CC} to all {\fgs} on each level. We define a helper function $g$ with a domain of the level $i$ in an FMMD hierarchy $H$, and a co-domain of a set of {\fgs} (specifically all the {\fgs} on the given level), defined by \begin{equation} %$$ g(H, i) \rightarrow \forall {\FG}^{\xi} \;where\; ({\xi} = {i}) \wedge ({\FG}^{\xi} \in H) . %$$ \end{equation} Where $L$ represents the number of levels in the FMMD hierarchy, $|g(\xi)|$ represents the number of functional groups on the level and $H$ represents an FMMD hierarchy, we overload the comparison complexity thus: %$$ \begin{equation} \label{eqn:gf} CC(H) = \sum_{\xi=0}^{L} \sum_{j=1}^{|g(H,\xi)|} CC({\FG}_{j}^{\xi}). %$$ \end{equation} \pagebreak[4] \subsection{Complexity Comparison Examples} The potential divider discussed in section~\ref{potdivfmmd} has four failure modes and two components and therefore has $CC$ of 4. $$CC(potdiv) = \sum_{n=1}^{2} |2|.(|1|) = 4 $$ Even considering a $fictitious$ system with just 81 components (with these components having 3 failure modes each) we would have an $CC$ of $$CC(fictitious) = \sum_{n=1}^{81} |3|.(|80|) = 19440 .$$ Ensuring all component failure modes are checked against all other components in a system -- applying FMEA rigorously -- could be termed Rigorous FMEA (RFMEA). The computational order for RFMEA would be polynomial ($O(N^2.K)$) (where $K$ is the variable number of failure modes). This order may be acceptable in a computational environment: However, the choosing of {\fgs} and the analysis process are by-hand/human activities. It can be seen that it is practically impossible to achieve RFMEA for anything but trivial systems. % % Next statement needs alot of justification % It is the authors belief that FMMD reduces the comparison complexity enough to make rigorous checking feasible. \pagebreak[4] %\subsection{Using the concept of Complexity Comparison to compare RFMEA with FMMD} \begin{figure} \centering \includegraphics[width=400pt,keepaspectratio=true]{CH5_Examples/three_tree.png} % three_tree.png: 851x385 pixel, 72dpi, 30.02x13.58 cm, bb=0 0 851 385 \caption{FMMD Hierarchy with number of components in {\fg} fixed to 3 $(|G| = 3)$ } % \wedge (|fm(c)| = 3)$} \label{fig:three_tree} \end{figure} \subsection{Comparing FMMD and RFMEA comparison complexity} Because components have variable numbers of failure modes, and {\fgs} have variable numbers of components it is difficult to use the general formula for comparing the number of checks to make for RFMEA and FMMD. If we were to create an example by fixing the number of components in a {\fg} and the number of failure modes per component, we can derive formulae to compare the number of checks to make from an FMMD hierarchy to RFMEA applied to all components in a system. Consider $k$ to be the number of components in a {\fg} (i.e. $k=|{\FG}|$), $f$ is the number of failure modes per component (i.e. $f=|fm(c)|$), and $L$ to be the number of levels in the hierarchy of an FMMD analysis. We can represent the number of failure scenarios to check in a (fixed parameter for $|{\FG}|$ and $|fm(c_i)|$) FMMD hierarchy with equation~\ref{eqn:anscen}. \begin{equation} \label{eqn:anscen} \sum_{n=0}^{L} {k}^{n}.k.f.(k-1) \end{equation} The thinking behind equation~\ref{eqn:anscen}, is that for each level of analysis -- counting down from the top -- there are ${k}^{n}$ {\fgs} within each level; we need to apply RFMEA to each {\fg} on the level. The number of checks to make for RFMEA is number of components $k$ multiplied by the number of failure modes $f$ checked against the remaining components in the {\fg} $(k-1)$. If, for the sake of example we fix the number of components in a {\fg} to three and the number of failure modes per component to three, an FMMD hierarchy would look like figure~\ref{fig:three_tree}. \subsection{Worked Example} Using the diagram in figure~\ref{fig:three_tree}, we have three levels of analysis. Starting at the top, we have a {\fg} with three derived components, each of which has three failure modes. Thus the number of checks to make in the top level is $3^0.3.2.3=18$. On the level below that, we have three {\fgs} each with a an identical number of checks, $3^1.3.2.3=56$.%{\fg} On the level below that we have nine {\fgs}, $3^2.3.2.3=168$. Adding these together gives $242$ checks to make to perform FMMD (i.e. RFMEA {\em{within the}} {\fgs}). If we were to take the system represented in figure~\ref{fig:three_tree}, and apply RFMEA on it as a whole system, we can use equation~\ref{eqn:CC}, $CC(G) = \sum_{n=1}^{|G|} |fm(c_n)|.(|G|-1)$, where $|G|$ is 27, $fm(c_n)$ is 3 and $(|G|-1)$ is 26. This gives: $CC(G) = \sum_{n=1}^{27} |3|.(|27|-1) = 2106$. In order to get general equations with which to compare RFMEA with FMMD we can re-write equation~\ref{eqn:CC} in terms of the number of levels in an FMMD hierarchy. % The number of components in the system, is number of components in a {\fg} raised to the power of the level plus one. Thus we re-write equation~\ref{eqn:CC} as: \begin{equation} \label{eqn:fmea_state_exp21} \sum_{n=1}^{k^{L+1}}.(k^{L+1}-1).f \; , % \\ %(N^2 - N).f \end{equation} or \begin{equation} \label{eqn:fmea_state_exp22} k^{L+1}.(k^{L+1}-1).f \;. % \\ %(N^2 - N).f \end{equation} We can now use equation~\ref{eqn:anscen} and \ref{eqn:fmea_state_exp22} to compare (for fixed sizes of $|G|$ and $|fm(c)|$) the two approaches, for the work required to perform rigorous checking. For instance, having four levels of FMMD analysis, with these fixed numbers, %(in addition to the top zeroth level) will require 81 base level components. $$ %\begin{equation} \label{eqn:fmea_state_exp22} 3^4.(3^4-1).3 = 81.(81-1).3 = 19440 % \\ %(N^2 - N).f %\end{equation} $$ $$ %\begin{equation} % \label{eqn:anscen} \sum_{n=0}^{3} {3}^{n}.3.3.(2) = 720 %\end{equation} $$ % \subsection{Exponential squared to Exponential} % % can I say that ? \section{Problems in choosing membership of functional groups} \subsection{Side Effects: A Problem for FMMD analysis} A problem with modularising according to functionality is that we can have component failures that would intuitively be associated with one {\fg} that may cause unintended side effects in other {\fgs}. For instance were we to have a component that on failing $SHORT$ could bring down a voltage supply rail, this could have drastic consequences for other functional groups in the system we are examining. \pagebreak[3] \subsubsection{Example de-coupling capacitors in logic circuits} A good example of this, are de-coupling capacitors, often used over the power supply pins of all chips in a digital logic circuit. Were any of these capacitors to fail $SHORT$ they could bring down the supply voltage to the other logic chips. To a power-supply, shorted capacitors on the supply rails are a potential source of the symptom, $SUPPLY\_SHORT$. In a logic chip/digital circuit {\fg} open capacitors are a potential source of symptoms caused by the failure mode $INTERFERENCE$. So we have a `symptom' of the power-supply, and a `failure~mode' of the logic chip to consider. A possible solution to this is to include the de-coupling capacitors in the power-supply {\fg}. % decision, could they be included in both places ???? % I think so Because the capacitor has two potential failure modes (EN298) this raises another issue for FMMD. A de-coupling capacitor going $OPEN$ might not be considered relevant to a power-supply module (but there might be additional noise on its output rails). But in {\fg} terms the power supply, now has a new symptom that of $INTERFERENCE$. Some logic chips are more susceptible to $INTERFERENCE$ than others. A logic chip with de-coupling capacitor failing, may operate correctly but interfere with other chips in the circuit. There is no reason why the de-coupling capacitors could not be included {\em in the {\fg} they would intuitively be associated with as well}. This allows for the general principle of a component failure affecting more than one {\fg} in a circuit. This allows functional groups to share components where necessary. This does not break the modularity of the FMMD technique, because, as {\irl} one component failure may affect more than one sub-system. It does uncover a weakness in the FMMD methodology though. It could be very easy to miss the side effect and include the component causing the side effect into the wrong {\fg}, or only one germane {\fg}. \section{Double Simultaneous Failures} The probability for independent double simultaneous component failures (because we would multiply the probabilities of failure) is very low. However, some critical systems have to consider these type of eventualities. The burner control industry has to consider double failures, as specified in European Norm EN298~\cite{en298}. EN298 does not specifically state that double simultaneous failures must be considered. What it does say is that in the event of a lockout---a condition where an error has been detected and the equipment moves to a safe non-functioning state---no secondary failure may cause a dangerous condition. % This is slightly vague: there are so many possible component failures that could cause a secondary failure, that it is very difficult not to interpret this as meaning we have to cater for double simultaneous failures for the most critical sections of a burner control system. % In practise---in the field of EN298: burner controllers---this means triple safeguards to ensure the fuel is not allowed to flow under an error condition. This would of course leave the possibility of other more complex double failures tricking the controller into thinking the combustion was actually safe when it was not. % It would be impractical to perform the number of checks (as the checking is time-consuming human process) required of RFMEA on a system as complex as a burner controller. It has been shown that, for all but trivial small systems, double failure mode checking is impossible from a practical perspective. FMMD can reduce the number of checks to make to achieve double simultaneous failure checking -- but by the very nature of choosing {\fgs} we will not (in the initial stages) be cross checking all possible combinations of double failures in all the components. The diagram in figure~\ref{fig:dubsim1}, uses Euler diagrams to model failure modes (as closed contours) and asterisks to model failure mode scenarios. The failure scenario is defined by the contours that enclose it. Consider a system which has four components $c_1 \ldots c_4$. Consider that each of these components may fail in two ways: $a$ and $b$, i.e $fm(c_1) = fm(c_2) = \{a,b\}$. Now consider two {\fgs}, $fg1 = \{ c_1, c_2 \}$ and $fg2 = \{ c_3, c_4 \}$. We list all the possible failure scenarios as $FS1 \ldots FS6$ for each functional group. For instance $FS5$ is the result of component $c_2$ failing with failure mode $a$ and component $c_1$ failing with failure mode $b$. We can express this as $c_2 a \cup c_1 b$. \begin{figure}[h] \centering \includegraphics[width=300pt,keepaspectratio=true]{CH5_Examples/dubsim1.png} % dubsim1.png: 612x330 pixel, 72dpi, 21.59x11.64 cm, bb=0 0 612 330 \caption{Simultaneous Failure Mode Scenarios} \label{fig:dubsim1} \end{figure} From figure~\ref{fig:dubsim1} we can see that the double failure modes within the {\fgs} have been examined. How do we model the double failures that occur across the {\fgs}, for instance $c_4 a \cup c_1 a$. It could be argued that because functional groups are chosen for their functionality, and re-usability that component failures in one should not affect a different {\fg}, but this is a weak argument. Merely double checking within {\fgs} would be marginally better than only applying it to the most obvious critical elements of a system. What is really required is a way that all double simultaneous failures are checked. One way of doing this is to apply double failure mode checking to all {\fgs} higher up in the hierarchy. This guarantees to check the symptoms caused by the failure modes in the other {\fgs} with the symptoms derived from the other {\fgs} modelling for double failures. % By traversing down the tree we can automatically determine which double simultaneous combinations have not been resolved. % By applying double simultaneous checking until no single failures canlead to a top level event, we double failure move coverage. To extend the example in figure~\ref{fig:dubsim1} we can map the failure scenarios. For Functional Group 1 (FG1), let us map: \begin{eqnarray*} FS1 & \mapsto & S1 \\ FS2 & \mapsto & S3 \\ FS3 & \mapsto & S1 \\ FS4 & \mapsto & S2 \\ FS5 & \mapsto & S2 \\ FS6 & \mapsto & S3 \end{eqnarray*} Thus a derived component, DC1, has the failure modes defined by $fm(DC1) = \{ S1, S2, S3 \}$. For Functional Group 2 (FG2), let us map: \begin{eqnarray*} FS1 & \mapsto & S4 \\ FS2 & \mapsto & S5 \\ FS3 & \mapsto & S5 \\ FS4 & \mapsto & S4 \\ FS5 & \mapsto & S6 \\ FS6 & \mapsto & S5 \end{eqnarray*} %This AUTOMATIC check can reveal WHEN double checking no longer necessary %in the hierarchy to cover dub sum !!!!! YESSSS