1.1.1.2.

The purpose of Functional Safety Analysis is to identify hazards associated with both the correct and incorrect operation and non-operation of the system, lower level functions and human functions.

1.1.1.4.

Functional Safety Analysis should examine all functional failures that may give rise to credible hazards, including:

• Those following directly from the behaviour of the function or component being evaluated
• Those due to the effects on another connected function or component (e.g. hazards due to the loss of an oil cooling function)
• Those due to indirect influence (e.g. hazards due to the generation of electro-magnetic interference (EMI) by a component when it has failed)

1.1.1.6.

For each identified function, a set of failure conditions, based on the aspects below should be defined:

• Normal performance: What hazards might be associated with the normal operation of the system functions ?
• Specific degraded performance: What hazards are introduced if the system is functionally degraded but still active, for example reduced performance from a ventilation system
• Incorrect functioning, including inadvertent functioning: An example might be a Radhaz transmission failure, as a result of a physical failure of the interlock, resulting in the radar transmitting when not expected.
• Absence of function: There may be, for example, a loss of a function which may result in the inability of the system to complete a required task, or part of that task (such as being able to turn a ship to Port but not to Starboard).
• Human error: This may be due to such factors as stopping an activity too soon or performing the right activities, but in the wrong order.
• Mis-timing of the function occurring, that is, sequencing too early or too late.

1.1.3.2.

Disadvantages

• Functional Safety Analysis is not good at examining hazards which relate to system components or system location. It must therefore be used in combination with other techniques.
• The value of Functional Safety Analysis is dependent on the quality of the functional description of the system. If subsidiary or non-obvious functions are not in the functional description, the hazard identification may be incomplete.
• Environmental conditions may alter the effects of failure and may need to be considered e.g. the effects of the loss of “anti-lock” on a car’s brakes may be more serious on wet or icy roads.
• Domain specific knowledge is required to effectively perform Functional Safety Analysis.
• Any interdependence or inter-relationship of system functions needs to be carefully identified so that they are accounted for in the analysis.

1.1.4.1.

A list of additional information (e.g., Standards, textbooks, and websites) includes but is not limited to:

• SAE ARP 4761: Excellence in Procedure for Safety Assessment
• International Electrotechnical Comission (IEC) 61508 Series (Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems).

1.1.5.1.

A list of software programs (e.g., Computer tools and related techniques) includes but is not limited to:

• SETTA, a toolset for Automated Safety Analysis designed by DaimlerChrysler, although a simple spreadsheet can support Functional Safety Analysis effectively.

1.1.5.3.

The function “Control Aircraft on the Ground” can be divided into a number of lower level functions including “Decelerate Aircraft on the Ground”. The functional failure condition considered in this example is loss of deceleration capability (other functional failures could be “reduced deceleration capability” or “inadvertent deceleration”). The phases of operation where deceleration of the aircraft on the ground is required are: Taxi, Landing, and Rejected Takeoff.

1.1.5.5.

Example data sheet:

1.2.0.1.

Version 3.0 to 3.1 Uplift

Links within Sources of Additional Information and Additional Comments have been updated.

Version 2.3 to 3.0 Uplift

Major uplift from the Acquisition System Guidance (ASG) to online version.