wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

21-6 Industrial Communication Systems
a requirements document. Therefore, such documentation should be available. It also remains to be
decided at which granularity the analysis is carried out. A high-level system function can usually be
divided into a number of sub-functions, which can in turn be divided into more sub-functions. The
lower the level at which the analysis is conducted, the more effort is required, but the more benefit can
be gained from the analysis. The right level of the analysis should be decided at the beginning. It will
generally always be a compromise between rigor and efficiency. A good starting point for the analysis is
the highest-level requirements description of a system.
HAZOP should also be conducted as a team activity. This means that the team should include not
only safety professionals but also engineers, system designers, software engineers, or even end users.
One person shall take the lead and moderate the HAZOP sessions. This lead will generally be taken over
by the safety manager or engineer. The HAZOP sessions should be planned well in advance, and it is
important to keep the focus and not to get sidetracked into long discussions, which do not contribute
to the goal. Also, soft factors such as sufficient breaks and an adequate environment are crucial to the
success of the sessions.
Finally, the results are documented in a tabular format. The main outputs are the hazards, against
which adequate safety requirements have to be specified. In the course of the remainder of the safety
lifecycle, it must be shown that these hazards are under control.
21.4.3 FMEA
The Failure Modes and Effects Analysis (FMEA) is a method that systematically analyzes all failure modes
of components and determines the associated risk and potential mitigations. It is a bottom-up approach,
which starts on the component level and aims to determine the effect of failure modes on the system functions.
For a safety engineer, it is essential to determine the safety impact of the analyzed failure modes.
An international standard, which comprehensively describes the method as a technique for system
reliability, is available in [IEC60812]. The method consists of analyzing all components or items of a
system and filling out of all the columns of a given table. It starts from the component level, and hence
is a typical “bottom-up” method. The headings of such a possible FMEA table are given in Table 21.3, an
example will be shown in Table 21.6.
Similar to HAZOP, an FMEA is best performed as a group activity, since diverse expertise is needed
to record all information necessary.
21.4.4 Fault Tree Analysis
Whereas FMEA has its origins in reliability engineering, fault tree analysis [IEC61025] is a typical safety
engineering technique. It is in many ways complementary to an FMEA, and therefore should not be considered
as an alternative, but as another necessary method to be used during the safety analysis phase.
It is a top-down method, which starts from the undesired events, in our case, it starts with the hazards.
It is then analyzed, what the contributing factors to a hazard could be, and this is then presented in the
form of logic gates. For example, if the communication system and the backup communication system
must fail for a hazard to occur, this is represented by an “and” gate. If one wants to say that the communication
system fails when the power supply fails or when the medium fails, this is represented by
an “or” gate. This tree is then constructed until one reaches the basic events, which cannot be split up
further. The example just described is shown in Figure 21.3.
TABLE 21.3
FMEA Table Header
Item ID
Description
and
Function
Failure
Mode
Possible
Causes
Effect
Detection
Method Mitigation Severity Probability
Safety
Impact
© 2011 by Taylor and Francis Group, LLC