Estimation and Evaluation of the 1oo4-Architecture for Safety Related Systems

Transcription

1 ELECO 7th Internatonal Conference on Electrcal and Electroncs Engneerng, - December, Bursa, URKEY Estmaton and Evaluaton of the oo-rchtecture for Safety Related Systems Josef Börcsök and l Hayek Computer rchtecture and System Programmng, Unversty of Kassel Wlhelmshöher llee 7,,Kassel, Germany j.boercsoek@un-kassel.de, al.hayek@un-kassel.de bstract In the standard IEC 8 mscellaneous archtectures for safety related systems are ntroduced. Dependng on the requred safety, relablty and avalablty levels several archtectures such as oo-, oo-, oo-, and oo- archtectures can be selected. In ths paper, the concept and calculaton of a novel archtecture s presented. he oo- archtecture (one out of four) represents an advanced safety archtecture, whch s -falure safe. hs means that at least one of the four channels have to work correctly n order to trgger the safety functon. In order to classfy the qualty of the proposed archtecture for safety related systems the value s calculated. ddtonally, the Markov-model for a oo-archtecture s ntroduced and the MF-value for ths archtecture s calculated. he results are hgh safety and hgh relablty.. Introducton Desgnng archtectures for controllng safety related systems n all techncal felds requres the consderaton of several dependablty aspects such as system complexty, functonal safety, relablty and avalablty. he standard IEC 8 presents several measures and desgn methodologes as well as system archtectures, whch treat these aspects []. Bascally, the key factor of enhancng relablty, safety and avalablty of a gven system s the use of system redundancy and dagnoss elements. However, nowadays almost only approved archtectures wth the lowermost redundancy are used n safetyrelated systems such as the oo- and the oo-archtectures. here are varous reasons for ths: On one hand, hgher redundancy leads to more complex systems wth ncreasng system costs and power consumpton, whch are two key factors for desgnng such systems. On the other hand, the use of hgher redundancy leads to more complex desgn ssues such as synchronzaton and connectvty operatons, whch requre addtonal components and hghest verfcaton and valdaton efforts. However, wth the on-gong mnaturzaton of semconductor structures those reasons can be more and more neglected. On the one hand, a safety-related system wth all needed components can be nowadays ntegrated nto a sngle slcon chp, whch reduces component count, system area, costs and power consumpton. ddtonally, due to the ntra-chp communcaton hghest synchronzaton and connectvty operatons can be acheved. Furthermore, a hgh testablty can be acheved due to varous sophstcated ED-tools for verfcaton and valdaton of electronc chps. On the other hand, n the updated verson of the standard IEC 8 from gudelnes for desgnng safety-related systems wth onchp redundancy are nserted []. On the bass of the presented arguments, a concept for the realzaton of a safety controller based on a quadruple redundancy (oo-archtecture) for use n steer-by-wre applcatons has been presented n []. he benefts of ths archtecture are hgher safety and hgher relablty. In order to nsert a hgher avalablty to the proposed archtecture a concept of degradablty s ntroduced. Once a system falure s detected the faled system component wll be excluded and the controller wll be degraded to a oo-archtecture and so on to a oo- archtecture. However, ths paper presents the proposed oo- archtecture as well as the calculaton of the needed parameters for the evaluaton of ths archtecture. Secton brefly surveys the needed background on safetyrelated systems. In secton the proposedoo-archtecture s ntroduced. In secton the calculaton of the probablty dstrbuton s presented. For that a fault-tree analyss and the calculaton of the average probablty of falure on demand ) of the target archtecture are ntroduced. ( In secton the Markov model of the oo-archtecture s presented, from whch the mean tme of falure (MF) s deduced. Secton VI fnshes the paper wth a concluson and a short analyss about the presented archtecture. Survey on Safety Related Systems oday s controllng systems used for safety crtcal applcatons commonly consst of hghly complex sngle components, mplemented ether as software or hardware. Hardware and software models have to be generated, evaluatng aspects lke relablty and safety of a complex system. he varous functonal, non-functonal and safety-techncal demands to the system along wth common system characterstcs lead to a lst of system specfc features. hs contans: Relablty, avalablty and falure safe operaton System ntegrty and data ntegrty Mantenance and system restorng In order to have measurable parameters, the wdely used parameters mean tme to falure (MF) and probablty of falure on demand () characterzes the qualty of a faultless system. Combng all elements of a system n a safety archtecture, the system can be classfed wth a defned safety level, the safety ntegrty level (SIL) []. On one hand, a system can be judged by ts probablty of a dangerous falure,.e. an error occurs on the demand of a safety functon and the system can no longer perform ts safety functon. hs probablty of falure s defned as probablty of falure on demand (). It has a dmenson of unt.

2 ELECO 7th Internatonal Conference on Electrcal and Electroncs Engneerng, - December, Bursa, URKEY system s qualty can be specfed by defnng ts value referred to ts accuracy. he smaller ths value s, the better the system s. he value s calculated for a perod of tme called proof check nterval. fter the mantenance of the system s carred out, t s assumed that t works wthout any falures. Judgng and comparng systems s mostly specfed by the average value ( ) over a whole proof check nterval. On the other hand the MF-value can be calculated n order to evaluate system relablty. he MF-value s the mean tme to the frst falure under specfed condtons. he MF-value s usually expressed n hours (h) or years (a). he most known archtectures are the oo- and oo- archtectures, whch are common for safety-related systems n ndustry. In order to meet all requrements for safety the oo- archtecture s suffcent. If an addtonal hgh avalablty s requred a oo-archtecture has to be chosen. In order to take advantage of both systems n ndustry, a oo-archtecture has been developed [, ]. he oo-archtecture presented n the followng acheves a hgher safety and relablty level. he degradablty concept enhances the proposed archtecture wth hgher avalablty.. Descrpton of the oo-rchtecture for Safety Related Systems he oo-archtecture s a safety archtecture that normally conssts of four ndependent channels. he four channels are nterlnked n such way that only one needs to resolve the safety functon n order to carry out the safety functon correctly. dangerous breakdown of the system s generated f three of the four channels have dangerous falures themselves. Each sngle channel contans an nput crcle, a safe processng unt and an output whch s connected n seres to the other channel outputs. In a fault-tree-analyss [] t can be determned when a system can go nto a dangerous non safety state: n four channels s a dangerous detectable falure whch has a common cause n all four channels s a dangerous undetectable falure whch has a common cause each of the four channels have a dangerous detectable or a dangerous undetectable falure whch all have no common cause. heoretcally, a oo-archtecture s mmedately transferred from the operaton state nto the safe state f a dangerous falure arses. When a dangerous falure occurs then the faulty channel s swtched off. herefore, the oo-archtecture degrades to a oo-archtecture. In ths new system t s stll possble that another falure emerges. he system s n a defned state and t decdes to go nto the safe state. In a oo-archtcture one of the two channels has to work correctly. However, f there are two falures n each channel there s no possblty to swtch the process nto a safe state.. Calculaton of Probablty Dstrbuton In ths secton the mathematcal and statstcal calculatons for the safety analyss of the oo-archtecture are presented. he safety analyss ncludes the analyss of falures and the performance of the system n relaton to these falures. Especally the average probablty of falure on demand s essental for the evaluaton of the targeted SIL. he basc approach can be appled to determne the - equaton usng the probablty of falure functon (P(t)) of a oo-archtecture. herefore, the probablty of falure P (t) for a gven element s calculated usng the followng equaton: P = R () Where R (t) s the relablty functon of the element gven as follows: Under the condton: t R = e () = const. () D S = Where: : s the overall falure rate of the th element. : s the safe falure rate of the th element. S D : s the dangerous falure rate of the th element. Fg.. Fault-tree-Dagram of the oo-rchtecture In order to deduce the probablty of falure for the oo- archtecture a hazards analyss s needed. he hazard analyss s a systematcally method whch s used to dentfy the dangers that face a gven system. popular technque that can be used for ths purpose s the fault-tree-analyss. For the oo- archtecture the fault tree dagram s gven n Fg.. ccordng to ths, the system can fal dangerously n the followng cases: dangerous detected () falure occurs n all channels as a result of a common falure source. dangerous undetected () falure occurs n all channels as a result of common falure source. In each channel ether a or falure occurs as a result of non-common falure source. ccordng to ths, the total probablty of falure s gven by: P oo = P = P P C sngle P P common cause C ()

3 ELECO 7th Internatonal Conference on Electrcal and Electroncs Engneerng, - December, Bursa, URKEY wth P (t) as the probablty of falure for the th system of a oo-archtecture. he probablty of falure on demand s dependent from the tme t, because as tme ncreases, the ncreases. he ndex C means a dangerous undetected common-cause-falure, whereas C accounts for a dangerous detected common-cause falure. In the followng sectons the calculaton of each part of P oo s ntroduced brefly... Probablty of Sngle Falures If a oo-archtecture should fal wth sngle falures, the system s wthn the condton that each channel has to have a dangerous falure. If the probablty s calculated for ths case, then the product s derved from the probablty of falure of each channel and results n: t) = P () sngle ( P Where P(t) descrbes the probablty of falure for the th channel wth the falure rate of = D () for a dangerous, sngle falure n channel and the probablty of falure D t P = e (7) If the equaton () and (7) are used wth the general applcable -equaton, whereas ( ) s the probablty of falure on demand untl a gven pont n tme : then the result s: ( ) = P( t) dt (8) D e D e, sngle ( ) = D D D e D e D D e D D D ) ( D D D ) e D D D ) ( D D D ) e D D D ) ( D D D ) e D D D ) ( D D D ) e D D D D ) ( D D D D ) D D e D D ) e ) ( D D ) ( D D ) D D e D D ) e ) ( D D ) ( D D ) D D e D D ) e ) ( D D ) ( D D ) (9) hs functon can be developed nto a power seres wth the help of a aylor seres expanson (exactly MacLaurn seres). he condton that the ( ) s a contnuous functon,, sngle whch has a removable sngularty at = and thus all dervatons at ths pont exst can be proven, e.g. n [, 7]. fter some calculaton, we get the smplfed result:,sngle D ( ) = ().. Probablty of Common-Cause Falures In ths secton the falure probablty for dangerous undetectable and dangerous detectable common cause falures P C and P C are gong to be calculated. Common cause falures are those falures that occur n all system channels at the same tme and whch have a common cause. When determnng the ths knd of falure s rated for a mult channel system through the -factor. One dstngushes between the -factor for dangerous undetectable falures, wth the weght, and the -factor for dangerous detectable falures, wth the weght Calculatng the common cause part of the total probablty, the falure probabltes P C and P C have to be added: D Pβ = PC PC () nalogue, these common cause falure probabltes can be derved for a oo-archtecture wth, = β and, oo = β D. random common cause falure represents a oo functon block. herefore, t s possble to apply the derved equaton of the oo-archtecture for the calculaton of probablty of common cause falure, see []. he general soluton for the probablty falure results n: oo D = () Snce there are two common cause falure modes, C = β and C = β D, and wth the two assumptons that: a dangerous undetected common cause falure occurs wthn the tme perod MR the ( means the proof tme nterval, MR means the mean tme to repar) and a dangerous detected common cause falure occurs wthn the repar tme MR, calculated as, he -value for common cause falures can be = ( ) MR D MR () -equaton of a oo-archtecture s takng nto account the sngle falures, and the common cause falures.

4 ELECO 7th Internatonal Conference on Electrcal and Electroncs Engneerng, - December, Bursa, URKEY herefore, the total D -equaton can be gven as follows: = D MR ( MR) () he probablty of a common cause falure s the same n a oo-, oo-, oo-, oo- and n a oo-archtecture. If the probablty of a sngle falure n a oo-archtecture s compared wth the probablty of a oo- or oo-archtecture, then the probablty n a oo-archtecture s several dmensons smaller.. Relablty nalyss.. Markov model of the oo-rchtecture Markov models are stochastc models, whch can be used for evaluatng the safety and relablty of archtectures. Bascally, the Markov-model s a oo- Sngle-Board-System accomplshed wth conventonal calculaton methods and represents the archtecture usng states and transtons. In the followng the Markov model of the oo-archtecture gven n Fg. s descrbed. dfferent falure combnatons. hs leads to fourteen falure states. Due to page lmtaton a detaled explcaton s gven on the bass of state and state only. Further states and transtons can be understood n a smlar way. In state one of the four channels s operatng wth a falure. he occurrng falure s dangerous and s not detected by the falure dagnostcs. he transton rate between the states and has the value, because n one of the four channels a dangerous detected falure can exst. he same can be appled for the transton from state to state. Furthermore, from state a transton takes place nto state respectvely f a detected or undetected falure occurs n the untl then stll falure-free channels. In the same way, from state a transton takes place nto state respectvely f a detected or undetected falure occurs n the untl then stll falure-free channels (transton rates and respectvely). However, no transton possblty exsts for the system from state nto safe state because the falure cannot be detected wthn the test nterval τ = / µ. he system can transfer from state to state wth est the transton rate µ. he system can only change from state to state agan, where the system s falure free, after τ L f durng the total lfetme of the system n state no further falures occur. In praxs ths means: fter tme τ L the total system s exchanged. nalogue, the system can propagate through other states. Furthermore, followng two cases can be dstngushed whle common cause falures occur n a oo-archtecture: he common cause falure leads to dangerous detected falures. hen a transton exsts from state drectly nto state. he transton rate s β. D he common cause falure leads to dangerous undetected falures. hen a transton exsts from state drectly nto state. he transton s β... MF-Calculaton Fg.. Markov Model of the oo-rchtecture Sate represents the non falure state where all channels are falure free. State s the safe state n whch the system devolves f a safe falure occurs. he transton rate from state to state s, because n each of the four channels s a safe S falure possble. Furthermore, the oo-archtecture has fourteen From the Markov model descrbed n the last secton the MF value can be calculated. herefore, a transton matrx P should be bult (Probablty of falure matrx). hs transton matrx s a x matrx, because of the dfferent states. he P matrx s agan the bass for the Q matrx. he elements of the Q matrx are composed of the respectve probablty denstes, where the correspondng states meet the followng crtera: System operatonal or Non absorbng state. n operatonal system s possble for a oo-archtecture n the states,,,,,, 7, 8, 9 and. he states,,,, and should not be consdered durng the MF calculaton, as they are absorbng states. state s called absorbng f t s mpossble to leave ths state (states have only outgong transtons that are labeled wth µ and µ L transton rate). herefore, the Q matrx has a x matrx form. For the consdered Markov model we make the assumpton of = s made and results n: τ L µ L = () τ = L

5 ELECO 7th Internatonal Conference on Electrcal and Electroncs Engneerng, - December, Bursa, URKEY Once the Q-matrx s bult, the next step can be concerned, whch s the calculaton of the x M-matrx. he M-matrx s presented wth the followng formula: I Q = M dt () fterwards the N-matrx wll be calculated, whch s the nverse matrx of the M-matrx. he N-matrx needs to be composed to derve the MF value of the system. he MF value descrbes the mean tme between the occurrences of two falures. One assumes state at the start tme,.e. the state n whch the system operates falure free. fter the nverson the elements of the new matrx represent tme dependent values. One needs to sum up the frst row of the N-matrx n order to derve the MF value of the system. he MF term of a oo-system can be then calculated to the followng form: Wth MF oo L L S L = = ( ) ( ) ( ) 8 9 β D. Conclusons 7 β (7) (8) In ths paper the oo-archtecture for safety-related systems was presented. he proposed archtecture s targeted to use n automotve applcatons and can be targeted to be use n computer systems where hgher safety, relablty and avalablty are requred. s already mentoned n the ntroducton, today s techncal systems wll be more and more complex. One wll no longer be able to provde approprate safety n processes whch has to be montored. Future safety control must support hm, ether n recordng and analyzng data, or n operaton resultng from ths. dvanced safety archtectures lke the ntroduced oo-archtecture have to be utlzed n order to guarantee the requred safety. he degradable oo-archtecture enhances the safety benefts of the oo- and oo-archtecture and the avalablty of the oo- and oo- archtecture: smultaneously a hgher avalablty and a hgher safety than today s systems. Whle the probablty of a common cause falure s equal n all three system models, the probablty of a sngle falure n a oo-archtecture s several dmensons smaller than n a oo- or oo-archtecture as shown n Fg.. Furthermore, one can see that the oo-archtecture provdes a better MF-value that all establshed safety archtectures. Due to the degradable concept the oo-archtecture also offers a hgh avalablty. MF,E-9,E-8,E-7,E-,E-,E-,E-,E-,E-,E,E8,E7,E,E,E,E,E,E,E Safety-nalyss oo oo oo oo oo oo rchtecture Relablty-nalyss oo oo oo oo oo oo rchtecture Fg.. Evaluaton of the oo-rchtecture 7. References [] IEC Commsson, Functonal safety of electrcal/electronc/programmable electronc safetyrelated systems, IEC 8, part 7, CENELEC, Geneva, Swtzerland,. [] IEC Commsson, Functonal safety of electrcal/electronc/programmable electronc safetyrelated systems, IEC 8 Ed., part 7, CENELEC, Geneva, Swtzerland,. [] J. Börcsök, M. H. Schwarz, E. Ugljesa, P. Holub,. Hayek, Hgh-valablty Controller Concept for Steerng Systems: he Degradable Safety Controller, to be publshed n WSES conference, enerfe, Span,. [] J. Börcsök, Electronc Safety System, Hardware Concepts, Models and Calculaton, Hüthg Verlag, Hedelberg, Germany, 7. [] J. Börcsök, Functonal Safety: Basc Prncples of Safety- Related Systems, Hüthg Verlag Hedelberg, Germany, 7. [] W. E. Vesely et. al., Fault ree Handbook. Nuclear Regulatory Commsson, NUREG 9, staff/sr9/sr9.pdf, retreved --. [7] M. l-bokhat, Desgn and Implementaton of Mult- Processor-based Communcaton rchtecture for Safety- Related pplcatons Usng FPG, M.S. hess, EECS, Unversty of Kassel, Kassel,.