wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Functional Safety 21-7
Hazard: total
communication
failure
TOP 1
Main
communication
system failure
Backup
communication
system failure
GATE 1
GATE 2
Failure of
medium
Failure of
power supply
EVENT 1 EVENT 2
FIGURE 21.3
Fault tree example.
Probabilities can then be assigned to the basic events. If this is done completely, it is possible to
calculate the numerical probability for the hazard on the top. Several tools are available, which aid in the
construction of such fault trees, and which can perform these calculations automatically.
21.4.5 Safety Cases
A safety case shall show that the safety requirements and objectives are met. Simply said, it shall show
that “the system is acceptably safe for its intended use.” In order to prove this statement, structured
textual arguments can be made up, which show that this claim is true. However, textual arguments can
become very long and difficult to read. Especially, it can become hard to verify if the line of argumentation
is sound and the safety objectives are really met.
For this reason, [Kel&04] suggests a clearly defined notation for safety cases, called the Goal
Structuring Notation (GSN). GSN is already used widely and is likely to be standardized in the near
future. The basic elements of the notation are goals, strategies, and solutions. The goals contain some
propositional statement that shall be shown to be true. The strategies contain arguments on how this
proof can be made. The solutions are the evidences that contain the necessary information to show the
truth of the goal. An example is shown in Figure 21.4.
This example contains a claim that a system is safe. The argument is made over the hazard mitigation.
It is suggested that if all hazards are found and they are mitigated, the system is safe by definition.
Finally, this argument requires two subgoals, namely that all hazards are identified and that all hazards
© 2011 by Taylor and Francis Group, LLC