You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: process/process_areas/safety_analysis/safety_analysis_concept.rst
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,12 +34,12 @@ To have a structured DFA the failure initiators have to be applied :need:`gd_gui
34
34
|- Development failure initiators: Failures that occur during the development process, potentially leading to safety issues.
35
35
36
36
The objective of the **FMEA** is to show that the architecture created to fulfil the requirements does not introduce possible errors which would
37
-
break the safety requirements. Or rather that the possibility of these errors is reduced to an acceptable level. This can be done by detection, prevention or mitigation.
37
+
break the safety requirements. Or rather that the possibility of these errors is reduced to an acceptable level. This can be achieved through detection, prevention or mitigation measures.
38
38
The FMEA is used to find possible failures and their effects. The possible failures are systematically identified by applying fault models :need:`gd_guidl__fault_models`.
39
39
40
40
The DFA shall be performed once at platform level to analyse the dependencies between the features of the platform.
41
-
Typically the FMEA and DFA shall be performed at feature level and component level.
42
-
If a component have no sub-components, the results of the analysis are the same as at feature level. So no additional consideration is needed.
41
+
Typically, the FMEA and DFA are performed at feature level and component level.
42
+
If a component has no sub-components, the results of the analysis are the same as at feature level. So no additional consideration is needed.
43
43
In this case please document this in the content of the document.
44
44
45
45
Inputs
@@ -109,8 +109,8 @@ The analysis were applied at static and dynamic architecture diagrams. The follo
109
109
110
110
Feature Architecture
111
111
112
-
With the diagrams the dependencies and signal flows are shown. The analysis is done by applying the fault models
113
-
:need:`gd_guidl__fault_models` for FMEA and the failure initiators :need:`gd_guidl__dfa_failure_initiators` for DFA.
112
+
With the diagrams the dependencies and signal flows are shown. The analysis is performed by applying FMEA fault models
113
+
:need:`gd_guidl__fault_models` and DFA failure initiators :need:`gd_guidl__dfa_failure_initiators` for DFA.
114
114
Some fault models and failure initiators may not be applicable for one safety function. In this case the reason shall
115
115
be documented in the FMEA/DFA documents. So it can be shown that the analysis is completely done.
116
116
@@ -119,7 +119,7 @@ If we apply the fault model we may find the possible failure: "the message is no
119
119
could be mitigated by telling the user in an AoU: "the feature can not guarantee that the message is sent"
120
120
121
121
DFA: Here we see in the static view that component 1 uses component 2. If we apply the failure initiators we may find the possible failure:
122
-
"Component 2 is using up all execution time available to Component 1" which could be avoided by a OS which is reserving time for every component
122
+
"Component 2 is using up all execution time available to Component 1" which could be avoided by an OS which reserves time for every component
123
123
or by running these components on different processors.
124
124
125
125
A step-by-step-approach is described in :need:`gd_guidl__safety_analysis`. There are also examples for FMEA and DFA are given
@@ -132,8 +132,8 @@ in :ref:`examples_fmea_dfa` to show how to use the templates, failure initiators
132
132
133
133
Component Architecture
134
134
135
-
At component level you can see inside of the component when the component consists of two or more sub-components. If a component has no sub-components
136
-
there results of the analysis are the same as at feature level. So no additional consideration is needed. This should be also documented in the content of the document.
135
+
At component level you can see inside of the component when the component consists of two or more sub-components. If a component has no sub-components,
136
+
the analysis results are the same as at feature level. So no additional consideration is needed. This should be also documented in the content of the document.
137
137
In the example the component "Component 1" consists of two sub-components, "Component 3" and "Component 4".
138
138
139
139
A step-by-step-approach is described in :need:`gd_guidl__safety_analysis`. There are also examples for FMEA and DFA are given in :ref:`examples_fmea_dfa` to show how to use the templates, failure initiators and fault models.
@@ -158,7 +158,7 @@ The Safety Analysis (DFA and FMEA) shall consider the architectural elements on
158
158
2. **Feature Level**: This level involves a more detailed analysis of individual components within the feature. The analysis shall consider the internal structure of components and their interactions with other components in the feature.
159
159
160
160
|**Example DFA:** A dependent failure could be if two or more components share a common resource or if they are dependent on the same signal. If one component fails, it could lead to a failure in another component.
161
-
|**Example FMEA:** The FMEA shall used to analyse if the safety requirements of a feature can be violated. This might be a unintended sent of a message between two components.
161
+
|**Example FMEA:** The FMEA shall be used to analyse if the safety requirements of a feature can be violated. This might be an unintended sending of a message between two components.
162
162
163
163
3. **Component Level**: If a component consists of multiple sub-components, the analysis shall be extended to these sub-components. This level of detail is necessary to identify specific fault models that may not be apparent at higher levels.
0 commit comments