Architecture Modeling - SPES 2020

Architecture Modeling
of particular risks in the geometric perspective can be traced to the respective installed technical
components. A particular risk is a failure condition for a geometric component which
has a description of the sphere of effect in its geometric context. Such a description can be a
shape which has a position and orientation relative to the component to which the particular risk
belongs. I.e. the particular risk of a released airplane engine fragment has a description of a trajectory
which describes its possible flight. This trajectory provides information about locations
which may be impacted by the released fragment. Since the relative speed of an airplane engine
fragment is very high the fragment will probably break though the skin of the airplane. Thus
the trajectory can be considered to be the complete sphere of effect for the airplane. For other
particular risks the spheres of effect can vary regarding parameters like mass, speed or orientation.
An interference analysis provides information between the sphere of effect of particular
risks, like the trajectory of a fragment, and parts of a geometric system under design. The result
of such an analysis is a hitlist. Such a hitlist specifies geometric component parts of the geometric
system under design that can take damage being affected by a paricular risk. Impacted
installations of technical components which host essential safety functions can be determined
that way. Furthermore the effect of particular risks can be other failures of components on the
geometric perspective such as leaks which again effect involvement of liquids.
Relationship of particular risks to the technical perspective Particular risks can have several
effects on the safety of technical components in a system under design. I.e. a hit by an
airplane engine fragment can lead to leakage of a fuel tank or damage of electric cables which
results in lost of thrust. Such safety impacts can be identified based the results of a PRA. The
destruction or damage of geometric components are again failure conditions. Using the allocation
relationship from technical components to geometric components these failure conditions
can be mapped to failure conditions of technical components. These failure conditions can be
analyzed in an FHA to identify safety hazards which result from particular risks. Thus, the violation
of functional independence on a technical perspective can be determined based on related
failure conditions of a geometrical perspective which result from a PRA. Safety risks can be
calculated to estimate the probability for a failure condition on the technical perspective based
on the probability of a particular risk on the geometric perspective. Furthermore the installation
of technical components can be optimized to improve the safety. Target of such an optimization
can be the installation of technical components in a way that they are not impacted together
by the same particular risk. Such an analysis and optimization can be embedded in a Common
Cause Analysis (CCA) as defined in ARP 4761.
Exemplary Particular Risk Analysis In an example the airbag system of a car is enhanced
by an emergency call system. Considerable particular risks can be water intrusion due to leaks
and a crash with an obstacle or another car. Loss of airbag and emergency call functionality
is a failure which shall not be reached. Function loss due to intruding water can be prevented
by improving covering materials. Thus, for this particular risk a safety analysis to optimize the
component installation is not important. But in a crash an ECU can be completely destroyed
by the forces that take effect from the crash. We consider the in time reaction of the airbag
system to release the airbag during a crash to be verified. An emergency call system shall be
hosted on the same ECU as the airbag system to ensure direct call of emergency services in
case of a crash. Therefore, the ECU that hosts the airbag controller still has to work correctly
after having released the airbag. This implicates additional requirements on the installation of
the ECUs to positions in the car. As depicted in figure 3.22 an installation decision for the
redundant airbag system with emergency call function can be analyzed in a PRA on the effects
33/ 156