Mission critical safe and reliable controller design with consideration human and occupational safety and health

The interest in safety critical systems in various industries such as process, nuclear power and transportation increases continuously with the development of societies due to technological enhancements and increased attachment of importance to the human life, property and environment. Especially, the requests for faster and more comfortable transportation systems and the developments in accordance with these requests can be observed concretely. Airline and Railway transport are the safest among all transport modes according to the report of European Commission [1]. Still, safer and more reliable systems can be developed to decrease the risk of accidents and resulted fatalities and injuries. Data interchange between CPUs, synchronization, computation speed and diagnostic measures are exhaustively evaluated for designing safety critical computing units. These functional and performance criteria are considered together with the safety and availability concerns ex tunc as any change in the design requires re-performing the whole development processes. Therefore, firstly the system under control is to be analyzed correctly, the requirements shall be set consistently and completely as Einstein's approach, which underlines using fifty-five minutes thinking about the problem and five minutes thinking about the solutions for a given time of one hour to solve the problem. While being applicable to all safety areas as the main safety standard [2] is followed along the entire work, the domain selected in this study is railway, and in this context, the requirements for the unmanned CBTC metro systems and ERTMS ETCS used especially at the high-speed railway lines and across the borders are researched deeply. For thispurpose, international and European norms as well as domain specific standards are studied. Since the main interest of this study is vital computing system with low PFHG, dual, triple or more redundant architectures are from the main concerns. Safety, availability, reliability as well as dependant failure models in the literature are investigated for the redundant systems. It is found that reliability calculations are also dependent on several parameters such as reference handbook and data usage method (field, datasheet, library, direct calculation, adjustment factor etc.). Consequently, for the same unit results might differ from each other. After exhaustive analyses, it is shown that at the level of five times better results can be yielded for each computing unit when several items are taken into account during the reliability predictions. Similar to reliability prediction, safety analysis requires much attention due to incorporation of several parameters. Hence, safety parameters are simulated for various architectures to select correct architecture with minimum design effort and costs, which is also a topic of optimization. It is illustrated that some parameters are dependent upon each other although they seem being independent in the formulas. Besides, some parameters affect the outcomes for some architectures unexpectedly such as the influence of the parameter DC for the architecture 1oo2D. Furthermore, a novel definition of a dual redundant system is formed owing to the ambiguous definition in the safety standard for the architectures 1oo2 and 1oo2D and owing to not covering the relevant designs, hence resulting in wrong formulas. As per the simulation results, a design route map is created newly in this study which is to be utilized when designing mission critical vital safe controller. The international standard for safety critical electronic systems provides formulas for some architectures. Yet, it does not give a clue or reference how these formulas are derived, whether there is some confidence level and if this is the case, what is this value. In the literature and in the industry, it has been met that, reliability block diagrams, fault tree analyses and Markov models are mainly used for the safety calculations. In this study, a new PFH calculation model is proposed for the safety calculations. It is shown that it can conduct more accurate results in comparison to the previous works in the literature and current safety standard. It is also applicable to diverse redundancy differently from the formulas in the standard and literature, which is crucial forasmuch as diversity plays a major role to decrease the rate of dependant failures. Next, a safety critical computer design for a real application in the aforementioned domain and application areas is proposed. The reliability predictions for several cases are realized in a detailed way and compared with each other. Then, the safety calculations based on the formulas in the safety standard and in the literature with conventional models are conducted. Finally, the proposed model is applied to the application design and the results are compared. The outcomes for the computing platform developed to be used on-board and wayside applications for unmanned CBTC metro system and ERTMS ETCS high speed train lines show that the proposed model conducts 3.44 times lower hazard rates than the IEC 61508 [2] standard and 16.86 times lower than the conventional Markov model in the literature. Not only the technical safety, but also safety management is considered in this study, since a broad understanding of the safety management is compulsory for the independent safety assessment and finally SIL 4 certification of the vital product. Consequently, safety management in the international safety standards and in the industry is examined. In addition, despite the fact that current norms are very detailed and strict as they are related to complex safety critical electronic systems, several ambiguities and misinformation are revealed in these standards by providing use cases, and proposals are given for both qualitative and quantitative parts to overcome these problems which is seen an important contribution of this study to the aforementioned norms. These are in the scope of redefinition of V&V, innovative safety organization responding current safety management requirements, corrections to the failure and hazard analysis methods, discussing the subjective approach for techniques / measures, different perspectives for safety critical tool usage and CCF scoring table, drawbacks of statement SIL 0 SW, comparison of different requirements for single faults, unexpected DC effect on PFH for the architecture 1oo2D, the lack of explicit placement of the planning phase for the development process, the ambiguity of the required THR, the relation between RAM and Safety.