CIS 890: High-Assurance Systems

Transcription

1 CIS 890: High-Assurance Systems Hazard Analysis Lecture: Failure Modes, Effects, and Criticality Analysis Copyright 2016, John Hatcliff, Kim Fowler. The syllabus and all lectures for this course are copyrighted materials and may not be used in other course settings outside of Kansas State University in their current form or modified form without the express written permission of one of the copyright holders. During this course, students are prohibited from selling notes to or being paid for taking notes by any person or commercial firm without the express written permission of one of the copyright holders.

2 FMEA Overview What? What are the main questions that FMEA tries to answer? Consider each component in the system (e.g., the temperature sensor) What are the ways (modes) in which a component can fail? For each failure mode, what are the observable effects of each failure at the component boundary? Isolette Nurse Operator Interface For each failure mode, how do the effects of the failure propagate through the system? Incorrect Temperature Reading No Temperature Reading Temperature Sensor Current Temperature Heat Operator Settings Infant Operator Feedback Incorrect Heat control Heat Thermostat Control Air Harm air too hot or too cold for baby Heat Heat Source Undesirable Air Temperature Note: FMEA most naturally focuses on hardware failures (as opposed to software) and impact on component and system reliability (as opposed to safety) What is the potential consequence at the system boundary that could lead to harm?

3 FMEA Overview How? How is the analysis information recorded? What are the ways (modes) in which a component can fail? For each failure mode, what are the observable effects of each failure at the component boundary? What is the potential consequence at the system boundary that could lead to harm?

4 FMEA Overview When? When in the development lifecycle is the analysis performed?! Part of detailed design hazard analysis type (DD-HAT in Erikson s classification);! Performed once the system design is completed and you have schematics or detailed functional descriptions of components/modules

5 FMEA Overview When? When in the development lifecycle is the analysis performed? ARP 4761 (avionics) has FMEA coming after implementation, during the verification phases. CIS Homework 1

6 FMEA Overview Who? Developer Risk Management Team! FMEA is typically perform by a safety engineer or risk management team! Someone distinct from architects or developers! Someone with significant experience in the domain, i.e., has a good understanding of failures and their effects in similar systems! Independence between developers and safety analysts helps avoid implicit bias! i.e., a developer overlooking a potential problem because they come to the analysis with a belief that they have already done the right thing up to this point

7 FMEA Overview Summary of questions answered! What components can fail?! How can each component fail?! What are the immediate effects of each failure (e.g., at the boundary of the failing component)?! What are the consequences of each failure (e.g., what harms may be caused in the environment due to hazardous control actions at the system boundary)?! (If reliability data are available: )! How frequently can it fail?! How does it affect system reliability?

8 FMEA Overview Why? The Big Picture Why Perform an FMEA?! All components (hardware) have inherent failure modes.! FMEA evaluates the overall impact of each component failure mode! Primary FMEA goal is to determine the effects on system reliability of component failures! The technique can be extended to determine the effect on safety! Also may record specific recommendations/mitigations to improve:! Reliability! Safety! Operation From Hazard Analysis Techniques for System Safety, Clifton A Ericson II, page 247

9 Outline for Rest of Lecture! History of FEMA! Inputs and Outputs of FMEA! Process / Recipe for doing a FEMA and recording the results! Exercises! Adding criticality information to obtain Failure Modes, Effects, and Criticality Analysis (FMECA)! Exercises

10 History of FMEA! Developed for U.S. military in late 1940s! Embodied in MIL-STD-1629A! Used by! NASA in 1960s for moon program! Ford Motor Co. in late 1970s after Pinto gas tank problems! Automotive Industry Action Group (AIAG) and American Society for Quality Control (ASQC)! 1993! SAE J-1739

11 FMEA Inputs / Tasks / Outputs From Hazard Analysis Techniques for System Safety, Clifton A Ericson II, page 247

12 Two Approaches Functional vs Structural FMEA Inputs System Design / Architecture Information From Hazard Analysis Techniques for System Safety, Clifton A Ericson II

13 FMEA Inputs Part 1 FMEA Inputs System Design / Architecture Information! Hardware / Functional System design! Identifies the subsystems! Granularity determines extent of analysis! Operational constraints! Logical dependencies between components! Data flow / control flow between components! Indirect components / interactions due to physical properties of components and their position within system! Success and failure boundaries! Defines fault/failure/problem propagation! How faults/failures/problems are contained

14 FMECA Inputs Part 2 FMEA Inputs Information about components! Possible failure types, e.g. short together two electrical signal pins! Possible operational modes, e.g. expected mechanical actions from control operations! Ways of connecting to or impacting other components! Information that can help determine immediate effects of failure! (For reliability calculations: probability of failure or occurrence)

15 Example FMEA Worksheet From Hazard Analysis Techniques for System Safety, Clifton A Ericson II, page 250

16 Worksheet Contents! Item component, item, or function being analyzed! Part number, etc.! Description of the item s purpose! Failure Mode! All credible failure modes that are possible for the item! Requires significant domain knowledge! Some information can be obtained from manufacturer or other sources that rate reliability of item

17 Step 1! List components to be analyzed

18 Step 1 Examples

19 Step 2! Collect and list failure modes for each component! Example: (note line 3 requires domain expertise, in this case, a heater element might experience corrosion in its connectors that increases electrical resistance and lowers heat dissipation)

20 Step 3! Collect and list effects for each component:! Immediate effect! (failure effect as observed by rest of system at component/module boundary)! Systemic effect! (effect of failure on overall system behavior)! Please note: effects can expand number of lines in analysis to give clarify failure modes

21 Step 3 Examples

22 Reference! Clifton A. Ericson II, Hazard Analysis Techniques for System Safety, Wiley- Interscience, A John Wiley & Sons, Inc., Publication, 2005, pp ! Based on MIL. STD. 882