Risk analysis o sa e y-c i ical con ol sys ems 227
RISK ANALYSIS OF SATETY-CRITICAL CONTROL SYSTEMS
K. Rás oný
Depa men o Con ol and In o ma ion Sys ems, Facul y o Elec ical Enginee ing, Uni e si y o Žilina, Uni e zi ná
8215/1, SK-010 26 Žilina, Slo akia, Phone.: +421 41 513 3320, E-mail: ka ol. as ocny@ el.uniza.sk
Summa y: This pape deals wi h p oblems associa ed wi h isks analysis o a sa e y-c i ical con ol sys em. In he pape
he e a e in oduced ecommenda ions enabling p ac ical en o ceabili y o isk analysis by he assu ance o su icien
objec i i y le el. In he ini ial phases o he sys em li ecycle isk analysis se es o a ole able haza d a e de ini ion o
indi idual sa e y ele an unc ions. In he end o he con ol sys em de elopmen p ocess he isk analysis (an analysis o
ailu es consequences on sys em sa e y) se es o he e i ica ion o sys em sa e y a ibu es.
1. INTRODUCTION
The e is a class o con ol sys ems (so-called
sa e y-c i ical), whose aul y unc ion can esul in
pe sonal inju ies, conside able ma e ial damages,
en i onmen al damages, o o he undesi able a e -
e ec s. Sys em like his has o be ealized in such a
way, ha in he case o a ailu e- ee ope a ion i
mus pe o m exac ly he speci ied unc ions
( unc ional sa e y) and in he case o a ailu e
occu ence i mus ei he emain in a sa e s a e (i he
s a e in which he sys em is ound doesn’ endange
he con olled p ocess), o p oceed o a p ede ined
sa e s a e ( echnical sa e y).
I ’s ob ious, ega d o he knowledge le el,
echnological le el and limi ed inancial esou ces,
ha i is no possible o calcula e on he absolu e
sa e y (ze o isk), bu eally i is necessa y o assume
he occu ence o an e o , o a ailu e in he sys em,
which can lead o a ce ain isk o he con olled
p ocess. P o iding he e idence o sa e y
equi emen s ul ilmen and o a inal isk
accep abili y is possible only on he basis o he
sa e y analysis. I ’s no possible o p o e he s ic
sa e y equi emen s o he sa e y ele an sys em
only by es s o p axis esul s.
Gene ally, sa e y o a sys em can be unde s ood
as a se o sys em p ope ies. A ce ain dependency
exis s be ween hese p ope ies. The goal is o c ea e
a model, which enables o analyze he sensi i i y o
he sys em o pa icula ac o s in luencing i s sa e y
a ibu es and o ind a global op imum wi h he
espec o hese a ibu es, assuming an economical
accep abili y o he p oposed solu ion.
Accomplishmen o his goal is ela ed o he
p oblems sol ing in he ollowing a eas:

Risk analysis;

Modelling o sys em RAMS pa ame e s.
The undamen al in e na ional s anda d dealing
wi h sa e y-c i ical con ol sys ems is he s anda d
[12]. On he base o his s anda d some o he
applica ion s anda ds a e de i ed, among hem o
example s anda ds o ailway applica ions [9], [10],
[11] o indus ial applica ions [13]. Depending upon
equi emen s on sys em sa e y hese s anda ds de ine
4 sa e y in eg i y le els and o e e y sa e y in eg i y
le el (SIL) p ac ices a e ecommended, ha ha e o
be pe o med in indi idual li e-cycle phases o he
sys em in o de o achie e he abili y o he sys em o
ul il equi ed unc ions in ega d o he Reliabili y,
A ailabili y, Main ainabili y, Sa e y (RAMS
pa ame e s) and hei mu ual e ec s.
These s anda ds de ine common sa e y a ge s,
ecommend p ac ices o achie ing he equi ed
sa e y in eg i y le el and me hods o i s e alua ion,
howe e de ini ion o objec i es is ambiguous and
me hodical di ec i es o he sa e y e alua ion a e
a he gene al. Nega i e in luence also esul s om
he ac , ha a gene ally accep able heo e ical
appa a us o a isk analysis and sa e y le el
e alua ion is missing, which would objec i y he
whole p ocess o sa e y conside a ion. The e o e a
g ea a en ion is paid o his p oblem in in e na ional
discussion o ums (e.g. h p://www.sipi61508.com),
open specialised conso ia (e.g.
h p://www. ailwaydomain.o g,
h p://www. meu ope.o g), p ojec s (e.g.
h p://samne .in e s. ) and con e ences (e.g.
h p://www. o ms- o ma .ne ). I is pleasan , ha by
issuing o hese s anda ds he s anda diza ion p ocess
in sa e y c i ical con ol sys ems a ea is no inishing
bu o e shoo ing he p epa a ion o new s anda ds
and e ision o al eady accep ed s anda ds.
Nowadays used o de eloped p ac ises o sa e y
a ibu es e alua ion may be basically di ided in wo
g oups:

C ea ion o he model, ha p o ides he complex
desc ip ion o ailu e consequences on unc ional
and echnical sa e y; such a model could be usable
o he isk analysis, speci ica ion o he
unc ional equi emen s and e i ica ion o sa e y
a ibu es o he sys em; on he basis o Pe i ne s
such a model is de eloped wi hin he p ojec
Thomason [6], [8];

Using he combina ion o me hods; special
me hods and models a e used o he isk analysis
(haza d g aph, isk ma ix, BP- isk, ..), o he o
speci ica ion and modelling o unc ional
p ope ies o he sys em (UML, ini e au oma on,
Z-language, Pe i ne s, …), and ano he o
modelling o RAMS pa ame e s o he sys em
(FMEA, FTA, Ma ko chains, Pe i ne s, ..) [3],
[4], [7].
228 Ad ances in Elec ical and Elec onic Enginee ing
2. MODELLING OF RAMS PARAMETERS
OF THE CONTROL SYSTEM
Since pa icula RAMS pa ame e s in luence
each o he , i is necessa y o p opose such a solu ion,
which enables complex modelling o RAMS
pa ame e s. When modelling RAMS pa ame e s, he
ac o s a ec ing hem mus be espec ed, especially:

Deg ee o edundancy applied in he sys em;

Reliabili y o sys em componen s;

Diagnos ic co e age, aul de ec ion-and-nega ion
ime;

Reco e y o a ailabili y o he sys em a e
ailu e.
In he case o complex RAMS pa ame e s
analysis he s ochas ic p ocess is conce ned o
whose modelling o example Ma ko chains o Time
Pe i Ne s can be success ully used. Howe e ,
Ma ko chains ha e hei limi s. Thei main
disad an age is ha du ing modelling cons an
ansi ion in ensi ies a e supposed (homogenous
Ma ko chain). Tha means, ha occu ence o
e en s, which in luence ansi ions be ween s a es,
mus be app oxima ed by he exponen ial dis ibu ion,
ha mus n’ always co espond o eali y. Though
non-homogenous Ma ko chains can be heo e ically
conside ed, bu he solu ion is a he complica ed.
E en hough in he case o RAMS pa ame e s
analysis o he sys em, he Ma ko models ha e
speci ic cons ain s, hey a e gene ally accep ed.
Basically, c ea ion o such a Ma ko model may
p oceed in wo ways:

Logical conside a ion based on analys ’s expe
app oach; his way ends o analys ’s mis akes and
he e o e has limi a ions in espec o sys em’s
s a es quan i y; nowadays i is a u ilised me hod
o diag ams c ea ion;

Au oma ic gene a ion; au oma ic compu e model
gene a ion leads o models wi h la ge numbe o
s a es; his me hod equi es he u ilisa ion o
quali y compu e equipmen and speci ic so wa e
ools, which enable s a es numbe educ ion and
selec ion o an app op ia e nume ical me hod so
ha esul s can be ob ained in eal ime wi h he
su icien p ecision; his p ac ice is sui able o
he analysis o sys em eliabili y a ibu es, bu i
is no used o he analysis o RAMS pa ame e s.
Nowadays he p ojec [5] is submi ed; whose
one o he goals is achie ing an au oma ic gene a ion
o ansi ion in ensi ies ma ix ei he in a uni e sal
way, o a leas o some speci ic cases. Solu ion
based on an a omisa ion o he sys em and a
combina ion o di e en quan i a i e me hods comes
in o accoun . Sa e y a ibu es on sys em’s
componen s le el would be modelled using one
me hod and bonds be ween componen s would be
modelled using ano he me hod.
Analysis o s ochas ic models can be ealised in
se e al ways. They di e in he esul s p ecision,
applica ion op ions and compu ing demands. The
ollowing app oaches a e supposed:

Simula ion;

Nume ical solu ion;

Analy ical solu ion.
The use o an analy ical solu ion in combina ion
wi h he nume ical solu ions suppo ed by an
app op ia e so wa e ool seems o be he mos
sui able.
3. PROCESS OF THE RISK ANALYSIS OF
THE CONTROL SYSTEM
De elopmen o he sa e y-c i ical con ol sys em
mus be based on speci ica ion o he sa e y
equi emen s, which a e de ined on he base o isk
analysis associa ed wi h a con olled p ocess. SIL o
he sys em is p opo ional o a di e ence be ween
calcula ed o es ima ed isk and accep able isk.
Nowadays he e is no gene ally accep ed uni ied
me hod o isk analysis. The e a e numbe s o
me hods and p ocedu es o isk analysis (depending
on an applica ion a ea), which a e usually based on a
subjec i e e alua ion o “sensi i i y” o isk ac o s,
wha esul s in he ac , ha di e en collec i es o
analys s may ob ain signi ican ly di e en esul s,
e en when using he same me hod. This p oblem
comes in o spo ligh especially when mal unc ion o
he con ol sys em can lead o human casual ies
(p oblem o an accep able isk). P ocess o he isk
analysis can be objec i ied only on he base o
quan i a i e me hods, which lean on he heo e ical
conside a ions and acciden -e en s s a is ical da a.
Risk analysis (e en analysis o ailu e
consequences on con ol sys em sa e y) can be
ealised using quan i a i e o quali a i e me hods, bu
mo e equen ly by he combina ion o hese me hods
[7]. Quali a i e me hods help o unde s and
consequences o di e en ailu es o sys em
componen s on he en i e sys em and a logical
s uc u e o hei mu ual ela ions. Quan i a i e
me hods u ilise a ailable da a abou componen
ailu es, human mis akes, epai imes, and so on and
enable o de e mine he p obabili y o a ce ain
sys em’s c i ical s a e occu ence [1].
Gene ally isk can be o mula ed as a
combina ion o haza ds a e and hei consequences
o a ce ain ime uni . The e o e in he p ocess o
isk analysis i is necessa y o de ine sys em’s
incidence bounda ies, iden i y haza ds, de e mine
in ensi ies o hei occu ence, e alua e damages
caused by indi idual haza ds, and e alua e he
o e all isk associa ed wi h a con olled p ocess.
Based on knowledge o he o e all isk and
accep able isk ole able haza d a e (THR) can be
de i ed and consequen ly SIL can be assigned o
unc ions and componen s o he sys em.
Haza ds iden i ica ion is an impo an momen o
he isk analysis ( o c ea e a haza d lis ). Haza d lis
may be c ea ed on he base o heo e ical
conside a ion and analyses o on he base o p esen
expe iences in an analogical sys em ope a ion and
s a is ical en ies, bu mo e o en by p ope
Risk analysis o sa e y-c i ical con ol sys ems 229
combina ion o hese wo possibili ies. Wha is
necessa y o conside being haza d depends on
sys em analysis le el. Risk analysis esul is no
dependen on quan i y o he haza ds iden i ica ion bu
he eon how he en i e a ea o he haza dous s a es is
co e ed. Indi idual haza ds ha e o be independen
o each o he . I is desi able, i he haza d lis copies
lis o sa e y ele an sys em unc ions (Fig. 1). Fo
ins ance, i unc ion F
1
s a es claim on pe o mance o
ce ain ope a ion, hen he haza d H
1
s a es aul y
pe o mance o his ope a ion. This kind o he
app oach o haza ds iden i ica ion and o c ea ion o
bonds among haza ds conside ably simpli ies he
sa e y equi emen de ini ion p ocess o indi idual
modules o he con ol sys em. De ini ion o haza d
a e is qui e p oblema ic and gene ally has o be
accomplished on he base o he expe es ima ion
(solu ion like his conside ably impac s objec i i y o
quan i a i e analysis). The de e mina ion o haza d
a e is inaccu a e on he basis o s a is ical da a abou
acciden s, since no e e y haza d esul s in acciden .
F
21
F
22
F
23
F
2
F
3
F
1
F
H
21
H
22
H
23
H
2
H
3
H
1
H
Fig.1 Rela ion be ween unc ions ee and haza ds
ee Iden i ica ion o he indi idual haza d esul s may
be se on he basis o he p ac ical expe iences
(s a is ical da a) in he con ol p ocess o on he
expe es ima ions (mainly when he e a e p ocesses
wi hou p ac ical expe iences). P oblems a e up ising
i haza d may cause no only ma e ial damages bu
also human casual ies.
Quan i a i e isk analysis equi es ma e ial
damages and human casual ies ans e o a common
uni (how o quali y human heal h?). In his case he
ollowing possibili ies come in o accoun :

Ma e ial damages neglec , i haza d can esul in a
se ious human heal h ha m;

Risk calcula ion pa icula ly o ma e ial damages
and pa icula ly o human casual ies.
By quali a i e isk analysis simul aneously
ma e ial damages and human casual ies can be
conside ed.
Consume s a es ange o accep able isks in he
case o ma e ial damages. Conce ning human
casual ies he legal eques s mus be espec ed, which
issue ei he om collec i e isk ( o example
GAMAB c i e ia) o om indi idual isk ( o
example MEM o ALARP c i e ia) [9]. In he
p ac ical li e such an app oach can be me when
design o a new sys em esul s om s a is ical da a
ela ed o an old (exis ing) sys em. The p oblem is
ha he se o he new and he old sys em unc ions
ha e no o be iden ical on each o he ( o example i
a new sys em con ains a new unc ion, necessa y
s a is ical da a does no exis ).
4. IMPLEMENTATION OF SAFETY
REQUIREMENTS
Resul o isk analysis is de ini ion o THR o
he indi idual sa e y ele an unc ions (F
1
, F
2
, ... F
m
).
I is necessa y o ealise he decomposi ion o he
con ol sys em o indi idual modules (M
1
, M
2
, ... M
n
)
and hese consequen ly iden i y wi h he ealised
unc ions. Ne e heless, one module can ealise mo e
unc ions o one unc ion is ealised by mo e modules
(Fig. 2). Decomposi ion ha e o be ealised in such a
way, in o de o modules could be independen on
each o he .
F
1
F
2
F
3
M
1
M
2
M
3
M
4
RS
Se o
unc ions
RS
Se o
unc ions
THR
RS
THR
unc ions
Fig. 2 Func ion assignmen o sys em modules
Resul o isk analysis is de ini ion o THR o
he indi idual sa e y ele an unc ions (F
1
, F
2
, ... F
m
).
I is necessa y o ealise he decomposi ion o he
con ol sys em o indi idual modules (M
1
, M
2
, ... M
n
)
and hese consequen ly iden i y wi h he ealised
unc ions. Ne e heless, one module can ealise mo e
unc ions o one unc ion is ealised by mo e modules
(Fig. 2). Decomposi ion ha e o be ealised in such a
way, in o de o modules could be independen on
each o he .
I he i- h unc ion is ealised only by he j- h
module hen holds:
FM
THRTHR ≤
, (1)
whe e
F
THR
is a ole able haza d a e o gi en
unc ion and
M
THR
is a ole able haza d a e o
he gi en module.
I he unc ion is ealised by se e al modules (n
modules), hen holds:
MnMMF
THRTHR
∩∩∩
≥
....21
, (2)
whe e
Mn....M
THR
∩∩1
is an en i e ole able haza d
a e o modules 1 o n conside ing ealised unc ion.
I he module ealises se e al unc ions (n
unc ions) hen holds:
FmFFM
THRTHR
∩∩∩
≤
....21
, (3)
230 Ad ances in Elec ical and Elec onic Enginee ing
whe e
Fm...F
THR
∩∩1
is an en i e ole able haza d
a e o unc ions 1 o m conside ing he module, ha
ealises hem.
I he module ealises no sa e y ele an unc ion,
hen no sa e y equi emen s a e laid on i .
In connec ion wi h he dissemina ion o THR on
indi idual pa s o he sys em ques ion o sys em
s uc u e is also necessa y o be sol ed.
Selec ion o a sys em s uc u e is one o he mos
impo an decisions du ing he de elopmen p ocess.
By choice o he s uc u e i is necessa y o p og ess
e y ca e ully, because a comp omise be ween cos ,
SIL and a ailabili y o he sys em is conce ned. The
selec ion o he s uc u e has o be done based on he
esul s o RAMS pa ame e s modelling. C ea ed
model enables choosing he mos sui able solu ion so
ha cus ome ’s equi emen s on he indi idual RAMS
pa ame e s o he sys em will be espec ed. A model
c ea ed in ea ly phases o li ecycle can be
p og essi ely e ined and u ilised o he esul s
e i ica ion ob ained in pa icula phases o he
de elopmen p ocess.
5. CONCLUSION
Risk analysis has o be ealised se e al imes
(wi h di e en dep h) du ing he sys em de elopmen .
In he ini ial sys em de elopmen phase i se es o a
de ini ion o ole able haza d a es o he sys em o
i s indi idual pa s. In o he sys em de elopmen
phases i se es o he con ol whe he eal alues o
he haza d a e o he sys em o i s indi idual pa s
a e accep able.
In p ac ical li e we also o en mee wi h demand
o imp o ing quali y o se ices ha ha e al eady
been p o ided by an exis ing sa e y- ela ed sys em
( o example change o an exis ing unc ion o
implemen a ion o a new unc ion). To accep his
demand means o implemen a new module (ha dwa e
and/o so wa e) in o he sys em. Accep able isk
esul ing om p ocess con ol usually does no a y
(is no inc eased) e en hough a new unc ion has
been implemen ed. On he con a y, implemen a ion
o a new unc ion can cause inc ease o isk esul ing
om ope a ion o a modi ied sys em. Howe e ,
adding a new module (sys em) canno b ing inc ease
o isk o he con olled p ocess abo e he accep able
le el. The e o e i is necessa y o de ine no only
unc ional bu also sa e y equi emen s o his kind o
module.
This wo k has been suppo ed by he scien i ic g an
agency VEGA, g an No. VEGA-1/0040/08
“Ma hema ic-g aphical modelling o sa e y
a ibu es o sa e y-c i ical con ol sys ems”.
REFERENCES
[1] BRADLEY, J.: Elimina ion o Risk in Sys ems.
Tha sis Books, 2002
[2] RÁSTONÝ, K. – JANOTA, A. -
ZAHRADNÍK, J.: The Use o De elopmen o
a Railway In e locking Sys em. In Jou nal:
Lec u e No es in Compu e Science, Sp inge -
Ve lag Heidelbe g, 2004, pages 174-198,
ISSN 0302-9743
[3] RÁSTONÝ, K.: Model o sa e y analysis o
he in e locking sys em. In e na ional scien i ic
con e ence ELEKTRO ′99, 25 – 26 May 1999,
Žilina, pp.13 – 18, ISBN 80-7100-602-5
[4] RÁSTONÝ, K.: Risk Analysis o a Railway
In e locking Sys em. In: AEEE, No. 3 – 4 Vol.
2/2003, ŽU Žiline, pp. 24 -29, ISSN 1336-
1376 (in Slo ak)
[5] RÁSTONÝ, K.: Ma hema ic-g aphical
modelling o sa e y a ibu es o sa e y-c i ical
con ol sys ems. P ojec VEGA, No. 1/0040/08
[6] SLOVAK, R. e al.: Toolun e s ü z e
Modellie ung, Analyse und Syn hese
siche hei s ele an e S eue ungen ü den
Einsenbahn e keh mi Pe ine z echnologie.
P ojec Tomasen. TU B aunschweig
[7] ZAHRADNÍK, J. – RÁSTONÝ, K. –
KUNHART, M.: Sa e y o Railway
In e locking Sys ems. EDIS, 2004, ISBN 80-
8070-296-9 (in Slo ak)
[8] ZAHRADNÍK, J. e al.: Tool-suppo ed
modelling, analysis and syn hesis o ailway
sa e y sys ems by Pe i ne s echnologies.
P ojec No. 03 Cos 04 24/604, ŽU Žiline
[9] EN 50126: Railway applica ions: The
speci ica ion and demons a ion o
dependabili y, eliabili y, a ailabili y,
main ainabili y and sa e y (RAMS)
[10] EN 50128: Railway applica ions:
Communica ions, signalling and p ocessing
sys ems - So wa e o ailway con ol and
p o ec ion sys ems
[11] EN 50129: Railway applica ions: Sa e y
ela ed elec onic sys ems
[12] EN 61508: Func ional sa e y o elec ical
/elec onic/p og ammable elec onic sa e y-
ela ed sys ems
[13] EN 61511 Func ional Sa e y. Sa e y
Ins umen ed Sys ems o he P ocess Indus y
Sec o