Systems Algebra approach for safety analysis of safetycritical systems

1
Systems Algebra approach for safety analysis of
safety-critical systems
2
Motivation safety analysis of critical systems
Example Aircraft stall warning system
Failure could lead to catastrophic effects need
to predict achievable level of safety throughout
system life cycle evaluate hazards risks
3
Motivation comparison of hazard analysis
techniques
Safety analysis techniques
Traditional methods
New approach

• Reliability Block Diagrams (RBD)?
• Fault Tree Analysis (FTA)?
• Failure Modes Effects Analysis (FMEA)?
• Preliminary Hazard Analysis (PHA)?
• Failure Modes Effects and Criticality Analysis
  (FMECA)?
• Common Cause Analysis (CCA)?

• Systems algebra

A Systems Algebra and Its Applications, Shrisha
Rao, IEEE SysCon 2008 2nd Annual IEEE
International Systems Conference, 2008
How do these compare?
4
Comparison of Systems Algebra, RBD FTA
5
Evaluation compare different safety analysis
techniques for aerospace safety critical systems

• Flight Control System for Jaguar
• FCS for Boeing 747
• FCS for Airbus 380

Key steps

• Demonstrate application of system algebra
  approach
• Model the system
• Analyze the systems
• Gap analysis
• Repeat 1 for RBD FTA
• Compare system algebra, RBD FTA
• Advantages disadvantages of different
  techniques
• Possible enhancements in system algebra

Demonstrate application of systems algebra
approach for safety analysis compare it with
RBD FTA approaches
6
Application of Systems Algebra approach for
Hazard Analysis of FCS of Jaguar fighter aircraft
7
Flight Control System for Jaguar Aircraft
8
Sub-system failure rates redundancy
9
System Algebra representation of Jaguar FCS
System State Input stage state Computational
stage state Actuator stage state S Input
signals with their redundancy computational
system with their redundancy actuators
with their redundancy S I13I2 3 I3 2 I4
2 I5 2 I6 I7 I8 I9 C14 Cv2A6LA
A6RA A6LS A6RS A6RD S1 I13I2 3 I3 2
I4 2 I5 2 I6 I7 I8 I9 C14
Cv2A6LA A6RA S2 I13I2 3 I3 2 I4 2 I5
2 I6 I7 I8 I9 C14 Cv2 A6LS
A6RS S3 I13I2 3 I3 2 I4 2 I5 2 I6 I7
I8 I9 C14 Cv2A6RD
Where A6LA Left aileron, A6RA Right Aileron,
A6LS Left spoiler, A6RS Right
spoiler, A6RD Rudder Pedal
10
Hazard Analysis using Systems Algebra

• The system algebra helps in determining the
  system state. The system can be in either of the
  states
• System state System functionality
  available Safety Impact
• Safe state Available
  No safety impact
• Hazardous state Available with degraded
  performance Partially safety affected
• Unsafe state Not available
  No safety guaranteed

We can analyze the system state and its
availability Qualitatively and Quantitatively
11

• The failure of the component can be random and at
  any stage ? input stage and/or computational
  stage and/or actuator stage
• Number Failure component
  Input state
  Computational state actuator state
  system state
• No failure I13I2 3
  I3 2 I4 2 I5 2 I6 I7 I8 I9
  C14 Cv2 A6LA A6RA A6LS A6RS
  A6RD
• 0 No failure
  Safe
  Safe
  Safe Safe
• 1 input stage
  Hazardous
  Safe Safe
  Hazardous
• 2 input stage
  Unsafe
  Safe Safe
  Unsafe
• 3 computational
  Safe
  Hazardous Safe
  Hazardous
• 4 computational
  Safe
  Unsafe Safe
  Unsafe
• 5 Actuator
  Safe
  Safe
  Hazardous Hazardous
• 6 Actuator
  Safe
  Safe Unsafe
  Unsafe
• 7 input/comp.
  Hazardous
  Unsafe Safe
  Unsafe
• 8 input/comp.
  Unsafe
  Hazardous Safe
  Hazardous
• 9 input/actuator
  Hazardous
  Safe Unsafe
  Unsafe
• 10 input/actuator
  Unsafe
  Safe
  Hazardous Unsafe
• 11 input/act/comp
  Hazardous
  Hazardous Hazardous
  Hazardous
• 12 input/act/comp
  Hazardous
  Unsafe Hazardous
  Unsafe
• 13 input/act/comp
  Unsafe
  Hazardous Hazardous
  Unsafe
• 14 input/act/comp
  Hazardous
  Hazardous Unsafe
  Unsafe
  

12
Input stage
Input stage can either be in the safe state,
unsafe state or the hazardous state I13I2 3 I3
2 I4 2 I5 2 I6 I7 I8 I9 I13
I2 3 I3 2 I4 2 I5 2
I6 I7 I8 I9
State Safe Safe Safe Safe Safe
Safe Safe Safe Safe Safe Safe Safe
Safe Safe Safe Safe Safe Safe Haz
Haz Safe Safe Safe Safe Safe Safe
Safe Haz Safe Haz Safe Safe Safe
Safe Safe Safe Unsaf Safe Safe
Unsafe Et cetera
13
Computational stage
C14
Cv2
State Safe
Safe Safe Haz
Safe
Haz Haz
Haz
Haz Safe Haz
Haz Unsafe
Safe/Haz/Unsafe
Unsafe Safe/Haz/Unsafe Unsafe
Unsafe
14
Actuator stage
15
Quantitatively we can predict the time the
system reaches the hazardous state or the unsafe
state by generating failure rates for the
components and computing the failure rate of the
system.
Failure rate for I1 310-5 per hour I13
310-5 310-5 310-5 9 10-15 I1 will
fail after 1/10-15 hours which is more than the
flight life of the aircraft.
16
Systems Algebra observations

• If the system component failure rates are known,
  one can model the system using system algebra and
  system tolerance to the faults can be determined.
  Based on the system state, availability of the
  system can be known apriori.
• Once the system design is conceptualized, the
  model can be used to analyze the design for its
  safety availability. The parameters can be
  verified against the project requirement.
• Every system needs to be broken down into AND, OR
  logic which may be tedious for complex systems.
• Algebra needs to be developed for common
  sub-systems like the k-by-n voter.
• The system life cycle phase at which the system
  algebra analysis can be used need to be analyzed.

17
Application of Systems Algebra approach for
Comparative Hazard Analysis of FCS of Boeing 777
Airbus A380
18
System Algebra description of FCS for A380
Airbus A380 FCS Input stage Computational
stageActuator stage   S Ik 4 O CM 2
OS 2 A2 where, Ik inputs to
the A380 system which define the input stage OCM
, OS command/monitor and the standby system
which define the computational stage A2
actuator redundancy due to hydraulic and
electrical drives which define the actuator stage
19
System Algebra description of FCS for B777
System Input stage Computational
stageActuator stage  S Ik 4 O C M
3 OS 3 A Where, Ik inputs to the
B777system which define the input stage OCM , OS
command/monitor and the standby system which
define the computational stage A3 actuator
redundancy due to hydraulic and electrical drives
which define the actuator stage
20
System state analysis
21
System state analysis contd.
22
System state analysis contd.
23
System analysis of A380 B777 FCS
Random signal failure rate based on Gaussian
distribution as input for different sub-systems
Y System state 0,1,2 -gt safe,hazardous,unsaf
e
Boeing system fails before Airbus system due to
no redundancy at the output drivers
Partial system failure, similar for A380 B777
FCS
Simulated using Matlab simulink as well