In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

For example, experts have argued that for large, complex systems involvingsoftware it is difficult for design engineers and safety analysts to comprehend all theways in which the system could respond to different events (Rushby 1995). Morespecifically, Bozzano et al. (2003) stated:One of the most challenging issues in system development today is to takeinto consideration, during development, all possible failure modes of a systemand to ensure safe operation of a system under all conditions. Currentinformal methodologies, like manual fault tree analysis (FTA) and failuremode and effect analysis (FMEA)..., that rely on the ability of the safetyengineer to understand and to foresee the system behaviour are not ideal whendealing with highly complex systems, due to the difficulty in understandingthe system under development and in anticipating all its possible behaviours.A significant amount of guidance material is available on how to develop fault treesand use fault trees to calculate failure probabilities (Lisagor et al. 2010). 118However, very little of this guidance discusses exactly how to identify failurescenarios. Leveson (1995) stated that much of the focus of fault tree analysis isdirected towards generating probabilities of failure, whereas most of the errors inhazard analysis are due ‘to the failure to foresee all the ways in which the hazardcould occur’.Furthermore, Leveson (2009a) noted that traditional safety analysis techniques likefault tree analysis provide little guidance to analysts about the actual analysisprocess, and that the quality of the resulting analyses for complex systems variessignificantly depending on the analysts’ skill. Redmill (2002) also noted that theconstruction of fault trees involves a significant degree of subjectivity andvariability between users, and Manion (2007) concluded that a variety of biases caninfluence the performance of each step in the process of developing a fault tree.Similarly, Papadopoulos et al. (2001) stated:...the safety case usually fails to offer a coherent and complete picture of theways in which low-level component failures contribute to hazardousmalfunctions of the system. Although fault trees are built for this purpose, thetraditional process of constructing these fault trees relies heavily on expertknowledge, and lacks a systematic or structured algorithm which the analystcan apply on a system model in order to derive the tree. In the context of acomplex system this process becomes tedious, time consuming and errorprone...FMEA are also frequently described as being time consuming and tedious toconduct for complex items of equipment, and consequently they are often notcompleted and able to be used until late in the PSSA process. In addition, an FMEAgenerally only deals with single failures rather than more complex failure modesinvolving multiple failures (Leveson, 1995).118Examples of standards providing guidance on fault tree analysis include ARP4761 and the Faulttree handbook with aerospace applications (NASA, 2002).- 104 -