A method for generating an FTA fault tree from a technical system's FMEA table, or vice versa.

Abstract

To provide a computer-based method for generating one or a plurality of FTA fault trees from an FMEA table of a technical system, or vice versa.SOLUTION: A method comprises: defining a common data set for both an FMEA table of a technical system and one or more FTA fault trees; acquiring data of the common data set of the technical systems; selecting a representation of the technical system as the FMEA table or the one or more FTA fault trees; and using data from the common data to generate and display on a graphical user interface the FMEA table of the technical system or the one or more FTA fault trees of the technical system, according to the selected representation.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] This invention relates to a technical system, more particularly to a technical system used in the medical field, such as radiation therapy, and to the field of risk analysis.

[0002] The present invention also relates to a device for generating one or more FTA fault trees from an FMEA table of a technical system, or vice versa, and a computer program product for storing executable instructions. [Background technology]

[0003] Risk analysis is well-known in several industries, and many methods and computer-based tools have been developed to help users perform such analyses. Currently, two methods and related computer-aided tools for assessing risk in advance, namely Failure Mode and Effects Analysis (FMEA) and Fault Tree Analysis (FTA), as well as their variations, are the most frequently used.

[0004] These two methods each have their own unique characteristics, advantages, and disadvantages. FMEA is often used because it can be intuitively and easily implemented using common software tools such as spreadsheets, but it is a relatively inefficient method because it is time-consuming. FTA, on the other hand, has the function of representing the logical connections between causes and effects, but it is neither intuitive nor simple to implement and requires specialized software tools that are not necessarily suited to the specific business or technology system being analyzed.

[0005] Nevertheless, because each has its advantages, it is desirable, and in some cases even recommended, to use both FMEA and FTA to perform a risk analysis of a given technology system. However, in current practice, FMEA and FTA are built and maintained separately, and are usually set up for various purposes at various stages of the system development process, which is time-consuming and prone to errors and inconsistencies. This is particularly important for safety-critical applications, such as when assessing risks associated with the use of medical devices in advance.

[0006] European Patent Registration No. 1192543B1 and European Patent Registration No. 3270249B1 disclose a method for generating a fault tree of an technical system by starting with data determined using a system FMEA and adding information about the functional relationships between system elements. However, the reverse operation, namely generating an FMEA table starting with data determined using a fault tree, is either impossible or not disclosed in any way that is possible.

[0007] U.S. Patent No. 9430311B2 (Lee) discloses a method for performing FMEA on a portion of a fault tree in a FTA. The initiating event and higher-level events of a portion of the fault tree are considered as cause and effect, respectively, in the FMEA analysis. However, the reverse operation, i.e., generating a fault tree starting from data determined using FMEA, is either impossible or at least not disclosed in a feasible manner.

[0008] These two known risk assessment methods and their respective data structures are complementary but incompatible. Specifically, these data structures cannot be combined in a way that allows users to seamlessly switch between FMEA and FTA models, and vice versa, thus failing to ensure compatibility and consistency between both types of analysis in a given technical system. [Prior art documents] [Patent Documents]

[0009] [Patent Document 1] European Patent Registration No. 1192543B1 [Patent Document 2] European Patent Registration No. 3270249B1 [Patent Document 3] U.S. Patent No. 9430311B2 [Summary of the Invention] [Problems to be Solved by the Invention]

[0010] An object of the present invention is to provide a computer-based method that enables a user to perform a prior risk analysis of a given technical system in either an FMEA representation or an FTA representation of the given technical system and to switch between the two representations at any time as needed without requiring any additional data input. [Means for Solving the Problems]

[0011] The present invention is defined by the independent claims. The dependent claims define advantageous embodiments.

[0012] According to the present invention, there is provided a computer-based method for generating one or more FTA fault trees from an FMEA table of a technical system or vice versa, the method including the following steps. a) Defining a common data set for both the FMEA table of the technical system and one or more FTA fault trees, the common data set being - a set of at least one failure mode, - a set of causes associated with each failure mode of the set of failure modes, - a set of effects associated with each failure mode of the set of failure modes, - A set of risk mitigation measures associated with each failure mode in the set of failure modes, each risk mitigation measure being classified as a preventative measure if it can prevent the cause from activating the associated failure mode, or as a barrier if it can detect the failure mode before it has an associated effect, and - A set of processing steps performed by a technical system during operation, wherein each processing step in the set of processing steps is associated with a set of failure modes from the set of at least one failure modes. The steps include defining a common data set, b) A step of acquiring data from a common data set of the technical system, c) A step of selecting a representation of the technical system as an FMEA table or one or more FTA fault trees, c1) If the representation of the technical system as an FMEA table is selected, the steps include generating an FMEA table of the technical system by using data from a common data set to group failure modes within the table according to the corresponding processing steps, and displaying it on a graphical user interface, c2) If a representation of the technical system as one or more FTA fault trees is selected, the step of generating one or more FTA fault trees of the technical system using data from a common data set and displaying them on a graphical user interface. Here, each FTA failure tree has one of the set of effects as a higher-level event and is configured to represent the following relationships between cause, failure mode, effect, preventive measures, and barriers. - If the associated failure mode has an effect, the effect will occur. - When a failure mode occurs and all barriers associated with the failure mode are unable to detect the failure mode, the failure mode has associated effects, and - A failure mode occurs when a failure mode is activated by one of the associated causes, and all associated precautions fail to prevent the associated cause from activating the failure mode.

[0013] In this manner, the FMEA table and FTA fault tree of a given technical system become essentially equivalent, simply constituting two different representations of data relating to the same risks. Therefore, users can work similarly with the FMEA or FTA representation of the technical system under consideration and can easily switch between FMEA and FTA, or vice versa, at any time as needed, without requiring the user to input any additional data.

[0014] This equivalence and the use of a common data set ensure that any data added, deleted, or modified in one representation is automatically reflected in the other. Therefore, consistency and completeness between both representations can be ensured.

[0015] In some embodiments of the method according to the present invention, in each FTA fault tree corresponding to a given EFFECT, the fault mode is represented as a branch and transformed (casted) into the following form: · EFFECT=OR(effect(1),~,effect(I)); · effect(i)=AND(failure mode(i),barrier(i,0),~,barrier(i,J)); · failure mode(i)=OR(failure mode(i,1),~,failure mode(i,K)); · failure mode(i,k)=AND(cause(i,k),prevention(i,k,1),~,prevention(i,k,N)); Here - effect(i)=EFFECT is generated by the i-th failure mode (i=1~I), - Failure mode(i) = The i-th failure mode related to effect(i) occurs (i=1~I), - barrier(i,j)=j-th barrier fails to detect the occurrence of the i-th failure mode before the i-th failure mode produces effect(i) (j=0...J), - failure mode(i,k) = the i-th failure mode is caused by the k-th cause (k=0~K), - cause(i,k) = the k-th cause related to the i-th failure mode activates the i-th failure mode. - prevention(i,k,n) = the nth prevention fails to prevent cause(i,k) from activating failure mode(i) (n=0~N).

[0016] This embodiment is advantageous because it uses a specific representation of the FTA failure tree that is simplified and concisely visualized for various events, gates, and their respective connections, making risk analysis based on this specific representation of the FTA failure tree easier and more valuable.

[0017] In some embodiments of the method according to the present invention, a preventive measure is classified as an initial preventive measure, or as an additional preventive measure if it is chronologically later than the initial preventive measure, and / or a barrier is classified as an initial barrier, or as an additional barrier if it is chronologically later than the initial barrier.

[0018] This embodiment is particularly beneficial because, as more information becomes available regarding the technical system under consideration, users can update the data in a common data set. This leads to more accurate and efficient risk analysis of the technical system under investigation.

[0019] In some embodiments of the method according to the present invention, the step of acquiring data from a common data set is performed by specifically prompting the user to input data from the common data set via a graphical user interface.

[0020] In some embodiments of the method according to the present invention, the step of selecting a representation of the technical system as an FMEA table or one or more FTA fault trees is performed by prompting the user to select a representation of the technical system as an FMEA table or one or more FTA fault trees. This particular execution allows the user to flexibly manipulate the process according to their preferences to select the type of representation that best suits the technical system under study.

[0021] In some embodiments, the method according to the present invention further includes the step of calculating a risk assessment index related to a failure mode, the risk assessment index including: a) The probability that the failure mode is activated by the relevant cause, b) A measure of the strength of the risk mitigation measures associated with the failure mode, and / or c) The probability that the failure mode will have a related effect.

[0022] According to this embodiment, end users can add risk assessment metrics to the overall risk analysis, thereby enabling them to perform a statistical analysis of the risk. Using such additional metrics not only has a beneficial impact on the overall efficiency of the relevant risk analysis by focusing on the most impactful failure modes, but it can also increase the objectivity of the risk analysis by using more measurable parameters.

[0023] In some embodiments, the risk assessment metrics used herein include the incidence (O), detection rate (D), and / or severity (S) of the failure mode. This allows relatively subjective parameters to be transformed into probabilities that are not only more quantifiable but also more benchmarkable, ultimately leading to a more objective risk analysis.

[0024] Another object of the present invention is to provide a device for generating one or more FTA fault trees from an FMEA table of an technical system, or vice versa, the device comprising one or more modules configured to perform the methods described herein.

[0025] A further object of the present invention is to provide a computer program product that stores executable instructions, which, when executed by a computer, cause a computer to perform the methods described herein.

[0026] These and further embodiments of the present invention will be described in more detail with reference to the following accompanying drawings, as examples. [Brief explanation of the drawing]

[0027] [Figure 1] This is a flowchart illustrating an exemplary embodiment of the method according to the present invention. [Figure 2] This diagram shows an exemplary graphical user interface illustrating one exemplary way of performing the step of retrieving data from a common data set of a technical system. [Figure 3] This figure shows an exemplary FMEA table for an exemplary technology system. [Figure 4] Figure 3 shows an exemplary FTA fault tree of an exemplary technical system used to generate the FMEA table. [Figure 5] This flowchart shows another exemplary embodiment of the method according to the present invention. [Figure 6]This flowchart shows yet another exemplary embodiment of the method according to the present invention. [Figure 7] Figure 4 shows another exemplary FTA failure tree, representing an exemplary technical system used to generate the FTA failure tree. [Figure 8] This figure shows another exemplary FMEA table of the exemplary technical system used to generate the FMEA table in Figure 3. [Figure 9] Figure 7 shows yet another exemplary FTA failure tree, representing an exemplary technical system used to generate the FTA failure tree. [Figure 10] This figure shows an exemplary cost-benefit analysis table of exemplary risk mitigation measures used in one exemplary embodiment of the method according to the present invention. [Figure 11] This figure shows another exemplary cost-benefit analysis table for another exemplary risk mitigation measure used in another exemplary embodiment of the method according to the present invention. [Figure 12] This flowchart shows an exemplary embodiment of a computer program according to the present invention. [Modes for carrying out the invention]

[0028] The drawings in the figures are not drawn to a consistent scale, nor are they drawn proportionally. Generally, similar or identical components are indicated by the same reference number in the figures.

[0029] According to a first aspect of the present invention, a computer-based method is provided for generating one or more FTA fault trees from an FMEA table of an technical system, or vice versa, the method comprising the following steps: a) A step of defining a common data set for both the FMEA table and one or more FTA fault trees of the technical system, wherein the common data set is - At least one set of failure modes, - A set of causes associated with each failure mode in the set of failure modes, - A set of effects associated with each failure mode in the set of failure modes, - A set of risk mitigation measures associated with each failure mode in the set of failure modes, each risk mitigation measure being classified as a preventative measure if it can prevent the cause from activating the associated failure mode, or as a barrier if it can detect the failure mode before it has an associated effect, and - A set of processing steps performed by a technical system during operation, wherein each processing step in the set of processing steps is associated with a set of failure modes from the set of at least one failure modes. The steps include defining a common data set, b) A step of acquiring data from a common data set of the technical system, c) A step of selecting a representation of the technical system as an FMEA table or one or more FTA fault trees, c1) If the representation of the technical system as an FMEA table is selected, the steps include generating an FMEA table of the technical system by using data from a common data set to group failure modes within the table according to the corresponding processing steps, and displaying it on a graphical user interface, c2) If a representation of the technical system as one or more FTA fault trees is selected, the step of generating one or more FTA fault trees of the technical system using data from a common data set and displaying them on a graphical user interface. Here, each FTA failure tree has one of the set of effects as a higher-level event and is configured to represent the following relationships between cause, failure mode, effect, preventive measures, and barriers. - If the associated failure mode has an effect, the effect will occur. - When a failure mode occurs and all barriers associated with the failure mode are unable to detect the failure mode, the failure mode has associated effects, and - A failure mode occurs when a failure mode is activated by one of the associated causes, and all associated precautions fail to prevent the associated cause from activating the failure mode.

[0030] As used herein, the terms “computer-based,” “generate,” “determine,” or “configure” refer to the actions and / or processes of a computer that process data and / or convert it into other data. The term “computer” refers to any electronic device having data processing capabilities. The term “module” refers to a processor and / or a memory unit that stores computer-readable instructions.

[0031] The term "technological system" refers to a technological system comprising multiple technological components that may interact with each other. Illustrative technological systems used herein include, but are not limited to, medical technological systems or power plants. Specifically, technological systems used herein are preferably medical technological systems for clinical use, such as particle therapy systems.

[0032] Here, we will refer in detail to several specific embodiments of the present invention, the examples of which are shown in the attached figures. The attached figures are intended to provide a better understanding of the embodiments. The attached figures show schematic diagrams of the embodiments and, together with the description, serve to illustrate the principles and concepts of the disclosed subject matter.

[0033] Figure 1 is a graphical representation of the fundamental principles and components of the method of the present invention, as well as how these components interact with each other.

[0034] As detailed above, the method for generating one or more FTA fault trees from the technical system's FMEA table, or vice versa, includes the step of defining a common data set for both the technical system's FMEA table and the one or more FTA fault trees. The common data set includes: 1) a set of at least one failure mode; 2) a set of causes associated with each failure mode in the set of failure modes; 3) a set of effects associated with each failure mode in the set of failure modes; 4) a set of risk mitigation measures associated with each failure mode in the set of failure modes; and 5) a set of processing steps performed by the technical system during operation.

[0035] The method of the present invention further includes the step of acquiring data from a common data set of a technical system. The data from the common data set is typically entered by a user, usually via a graphical user interface (GUI), in accordance with techniques well known to those skilled in the art. The data from the common data set is typically stored in a database, which may be, for example, a local database on the user's computer, a database on a remote server, or a cloud database.

[0036] Figure 2 shows an exemplary graphical user interface illustrating one exemplary way of performing the step of retrieving data from a common data set, where the user can input data regarding failure modes, causes associated with the failure modes, effects associated with the failure modes, and corresponding processing steps.

[0037] The graphical user interface shown in Figure 2 can be used as many times as needed until all the data in the common data set has been entered by the user. While not directly available through the graphical user interface shown in Figure 2, the risks associated with each failure mode in the set of failure modes are also available. MitigationOther data in the common data set, including the means, can be entered via any other suitable graphical user interface.

[0038] The method of the present invention further includes the step of selecting a representation of the technical system as an FMEA table or one or more FTA fault trees. This selection step can be carried out in any manner commonly known in the art.

[0039] In some embodiments of the method according to the present invention, the step of selecting a representation of the technical system as an FMEA table or one or more FTA fault trees is performed by prompting the user to select a representation of the technical system as an FMEA table or one or more FTA fault trees. In a typical embodiment, the selection can preferably be performed via a graphical user interface.

[0040] According to the methods described herein, if the representation as an FMEA table is selected, the FMEA table of the technical system is generated by using data from a common data set to group failure modes within the table according to the corresponding processing steps, and is displayed on a graphical user interface. Alternatively, if the representation as one or more FTA failure trees is selected, one or more FTA failure trees of the technical system are generated using data from a common data set and are displayed on a graphical user interface. These steps are typically performed on a computer according to techniques well known in the art.

[0041] As shown in Figure 1, the FMEA table and FTA failure tree are generated using data from a common data set entered by the user. Therefore, the FMEA table and FTA failure tree generated by the method according to the present invention are two different representations of the same data, i.e., the data from the common data set. Thus, it is advantageous that the user can easily switch between the FMEA table and the FTA failure tree, or vice versa, on the graphical user interface at any time, without necessarily requiring the input of any additional data or the execution of any additional steps.

[0042] Specifically, this equivalence between the FMEA and FTA representations of the technical system under consideration is even more advantageous because any data optionally added, deleted, or modified by the user will be automatically reflected in both representations. Therefore, the FMEA and FTA representations are continuously and automatically synchronized.

[0043] As will be apparent to those skilled in the art, an FMEA table shows the risk from a processing perspective (i.e., failure modes are grouped according to the corresponding processing step), while an FTA failure tree shows the risk from the perspective of the effects caused by the corresponding failure modes (i.e., failure modes are grouped according to the corresponding effects).

[0044] Figure 3 shows an exemplary FMEA table generated and displayed as part of the method according to the present invention, with respect to an exemplary technical system, after the user has entered corresponding data from a common data set.

[0045] In this table, failure modes (FM(1) to FM(6)) are grouped according to the associated processing steps (Step(1) to Step(3)) and substeps (Substep(2,1), Substep(2,2)). The table also shows not only the effects (EFFECT1 to EFFECT3) associated with each failure mode and the causes associated with the corresponding failure mode (Cause(1,0) to Cause(6,1)), but also the risk mitigation measures (preventive measures Prev(1,0,0) to Prev(6,1,1)) and barriers (Barrier(1,0) to Barrier(6,3)) associated with each failure mode.

[0046] According to the FMEA table shown in Figure 3, for example, it can be derived that processing step Step(1) is associated with two failure modes (FM(1) and FM(2)), cause(1,0) is associated with failure mode FM(1) which produces effect EFFECT1, and failure mode FM(1) is further associated with preventative measure Prev(1,0,0) and barrier(1,0). Processing step Step(1) is further associated with failure mode FM(2) which produces effect EFFECT2, and failure mode FM(2) is further associated with preventative measure Prev(2,0,0) and barrier(2,0).

[0047] Figure 4 shows an exemplary FTA failure tree generated and displayed as part of the method according to the present invention, corresponding to the data from the common data set used to generate the FMEA table in Figure 3, specifically for a single effect "EFFECT1".

[0048] In the FTA failure tree shown in Figure 4, failure modes (FM(1), FM(3), and FM(6)) are not only grouped according to their associated effects (EFFECT1) and their respective causes (Cause(3,0), Cause(6,0), and Cause(6,1)), but also the associated risk mitigation measures (preventive measures Prev(1,0,0), Prev(3,0,0), Prev(3,0,1), Prev(6,0,0), Prev(6,0,1), Prev(6,0,2), Prev(6,1,1), and barriers (1,0), Barrier(3,0), Barrier(3,1), Barrier(6,0), Barrier(6,1), Barrier(6,2), Barrier(6,3)). However, the FTA failure tree in this example does not represent the relevant processing steps (Step(1) to Step(3)) that are performed by the technical system during operation.

[0049] According to the method of the present invention, similar FTA failure trees can be generated and displayed, particularly for a single effect "EFFECT2" and a single effect "EFFECT3". As part of the method according to the present invention, these additional FTA failure trees may be automatically generated and displayed on a graphical user interface, or they may be generated and displayed individually according to user priorities and selections.

[0050] In an exemplary embodiment of the method according to the present invention, in each FTA failure tree corresponding to a given EFFECT, the failure mode is visualized as a branch and converted into the following form. · EFFECT=OR(effect(1),~,effect(I)); · effect(i)=AND(failure mode(i),barrier(i,0),~,barrier(i,J)); · failure mode(i)=OR(failure mode(i,1),~,failure mode(i,K)); · failure mode(i,k)=AND(cause(i,k),prevention(i,k,1),~,prevention(i,k,N)); Here, - effect(i)=EFFECT is generated by the i-th failure mode (i=1~I), - Failure mode(i) = The i-th failure mode related to effect(i) occurs (i=1~I), - barrier(i,j)=j-th barrier fails to detect the occurrence of the i-th failure mode before the i-th failure mode produces effect(i) (j=0...J), - failure mode(i,k) = the i-th failure mode occurs due to the k-th cause (k=0 to K), - cause(i,k) = the k-th cause related to the i-th failure mode activates the i-th failure mode. - prevention(i,k,n) = the nth prevention fails to prevent cause(i,k) from activating failure mode(i) (n=0~N).

[0051] The "OR" and "AND" functions should be understood as logical "OR" and "AND" functions (Boolean logic). As shown in Figure 4, the "OR" function may be represented on the graphical user interface, for example, by a logical OR gate, and the "AND" function may be represented on the graphical user interface, for example, by a logical AND gate.

[0052] In the example shown in Figure 4, the following items are generated and displayed in the fault tree corresponding to EFFECT1 in Figure 3. · EFFECT1=OR(effect(1),effect(2),effect(3))=>(I=3) · effect(1)=AND(FM1,Barrier(1,0))=>(J=0) FM(1)=FM(1,0)=>(K=0) · FM(1,0)=OR(Cause(1,0),Prev(1,0,0))=>(N=0) · effect(2)=AND(FM(3),Barrier(3,0),Barrier(3,1))=>(J=1) FM(3)=FM(3,0)=>(K=0) · FM(3,0)=OR(Cause(3,0),Prev(3,0,0);Prev(3,0,1))=>(N=1) · effect(3)=AND(FM(6),Barrier(6,0),Barrier(6,1),Barrier(6,2),Barrier(6,3))=>(J=3) · FM(6)=OR(FM(6,0),FM(6,1))=>(K=1) · FM(6,0)=OR(Cause(6,0),Prev(6,0,0);Prev(6,0,1),Prev(6,0,2))=>(N=2) · FM(6,1)=OR(Cause(6,1),Prev(6,1,1))=>(N=1)

[0053] In another exemplary embodiment of the method of the present invention, the failure modes used herein are considered independent of each other, meaning that the occurrence of one failure mode is considered unrelated to the occurrence of other failure modes.

[0054] In yet another exemplary embodiment of the method of the present invention, all failure modes used herein are considered to have only one (primary) effect.

[0055] In another example of the method according to the present invention, preventive measures are classified as initial preventive measures, or as additional preventive measures if they are chronologically later than initial preventive measures, and / or barriers are classified as initial barriers, or as additional barriers if they are chronologically later than initial barriers. This is beneficial because, as more information about the technical system under consideration, specifically the results of processing risk analyses performed on initial data in a common data set, becomes available, risk mitigation measures can be updated and integrated into the overall risk analysis. This not only leads to a more accurate and efficient risk analysis, but also allows for appropriate adaptation and improvement to the technical system under consideration.

[0056] In a further embodiment of the method according to the present invention, the step of obtaining data from a common data set is performed by prompting the user to input data from the common data set. According to an exemplary embodiment, the user manually inputs suitable data into various fields that can be viewed through a graphical user interface suggested by the computer.

[0057] Alternatively, the step of obtaining data from a common data set may be performed, for example, by loading or importing data from an external device or data storage center.

[0058] In yet another embodiment, the method according to the present invention further includes the step of calculating a risk assessment index related to the failure mode.

[0059] In a typical embodiment of the method of the present invention, the risk assessment indicators used herein are calculated by a relevant computer based on additional data incorporated into a common data set. This additional data in the common data set is typically entered by a user and specifically includes values ​​such as the incidence score (O), detection score (D), or severity (S) of individual failure modes. Exemplary additional data in the common data set include the average number of times the technical system was operated over a particular period (T), the percentage of technical system operation in which a processing step related to a particular failure mode is performed (F), the average number of times the processing step is performed per technical system operation (R), and the probability P that the failure mode will remain undetected before it has an associated impact. miss , and the probability P that the preventive measures cannot prevent the occurrence of the failure mode. res It may also include the following. All of this additional data will be defined from here on.

[0060] In some embodiments of the method according to the present invention, the risk assessment indicators used herein may include the following: a) The probability that the failure mode is activated by the relevant cause, b) A measure of the strength of the risk mitigation measures associated with the failure mode, and / or c) The probability that the failure mode will have a related effect.

[0061] In some other embodiments, the risk assessment index further includes the expected frequency of occurrence of a major event within a given period.

[0062] The steps for calculating an appropriate risk assessment, as detailed above, enable the user to perform a statistical analysis of the risks associated with the technology system under consideration. Figure 5 shows a schematic flowchart illustrating an exemplary embodiment of the statistical risk analysis further enabled by the method according to the present invention.

[0063] In an exemplary embodiment, the risk assessment indicators used herein include the occurrence rate (O), detectability (D), and / or severity (S) of the failure mode. In this regard, the risk priority number (RPN: risk priority number) corresponding to RPN = S × O × D can be used and further included in the risk assessment indicators.

[0064] According to yet another embodiment, the method according to the present invention further includes a step of calculating a probability p eff that the failure mode brings about an associated impact, and the probability p eff is calculated as follows. p eff =P occ ×P miss , P miss =p miss 1×~×p miss J,

Number

[0065] This particular implementation of the method of the present invention makes it possible to achieve a more accurate determination of the probability that a failure mode will have an associated effect.

[0066] According to a favorable embodiment, the method according to the present invention further includes the following steps: a) Function P occ (O) by P occ The step of relating it to the incidence index O of FMEA, b) Function P miss (D) by P miss The step of relating it to the detection index D of FMEA, Here, P occ (O) and P miss (D) is an invertible function.

[0067] The statistical risk analysis or assessment enabled by the method of the present invention makes it possible to make decisions regarding the implementation of suitable risk mitigation measures and to determine suitable risk mitigation scenarios that can be advantageously implemented in the technical system under consideration. Specifically, this determination can be made by a cost-benefit analysis of the particular risk mitigation measure under consideration, which is also possible by the method of the present invention.

[0068] Figure 6 shows a flowchart illustrating an exemplary embodiment that schematically represents the cost-benefit analysis of specific risk mitigation measures and the determination of a suitable risk mitigation scenario, which are further made possible by the method according to the present invention.

[0069] According to a more advantageous embodiment, the method according to the present invention is based on the expected frequency N of occurrence of a major event over a certain period. eff The process further includes the step of calculating frequency N eff It is calculated as follows: N eff =n eff 1 + ~ + n eff W neff w=p eff w×T×F×R Here, · n eff w is the expected frequency at which the higher-level event will occur during the period due to the w-th failure mode (w=1~W). · p eff w is the probability that the w-th failure mode will have an effect. T is the average number of times the technical system was operated during that period. F is the percentage of time the technical system is operational during which the processing steps associated with the w-th failure mode are performed, and R is the average number of times the processing step is executed each time the technical system is run.

[0070] This particular implementation of the method of the present invention makes it possible to achieve a more accurate determination of the frequency with which a higher-level event (i.e., one of the effects in the set of effects) is expected to occur during a particular period.

[0071] In the context of the present invention, the expression "operation of the technical system" means the execution of a process performed by the technical system, and the process includes a series of sequential processing steps and substeps that are performed in a predetermined order.

[0072] Figure 7 shows another exemplary FTA failure tree of the exemplary technical system used to generate the FTA failure tree in Figure 4, illustrating the relationship between various calculated statistical parameters, such as probability and frequency factors (detailed above), and failure-related events.

[0073] Figure 8 shows another exemplary FMEA table of the exemplary technical system used to generate the FMEA table in Figure 3, representing the results of various risk mitigation scenarios. The same results of these various risk mitigation scenarios are similarly represented in Figure 9, this time using an FTA fault tree representation.

[0074] More specifically, the various statuses of different risk mitigation measures (preventive measures or barriers) are represented as follows: • Active (A): Currently implemented and active in the system. • Possibility (P): Ideas currently being tested or evaluated. • Inactive (NA): Previously performed or evaluated, but no longer performed (e.g., because it is no longer important).

[0075] The values ​​(frequency or probability) of the statistical parameters displayed in the FMEA table and FTA failure tree vary depending on which risk mitigation measures are considered. Therefore, more values ​​can be displayed for the same parameter corresponding to various risk mitigation scenarios. This is specifically shown in Figures 8 and 9, according to the representations in the FMEA table and FTA failure tree, respectively, and the following points can be made: • There are no possible mitigation measures for failure modes FM(1), FM(2), and FM(5). Therefore, O, D, RPN, and n in the FMEA table are not applicable. eff Only one value is displayed for this. Similarly, P in the FTA fault tree occ , n eff , and N eff Only one value is displayed for that. • Failure mode FM(3) has one possible barrier. Therefore, D, RPN, n eff , N eff Two values ​​are displayed for this. These values ​​are reduced by possible barriers, because possible barriers reduce the overall probability that the failure will no longer be detected. O and P occ It is unaffected. • Failure mode FM(4) has one possible preventive measure. The possible preventive measure reduces the overall probability of occurrence. Therefore, in the FMEA table, O, RPN, and n eff Two values ​​are shown for this. The tree for Effect(3) is not shown in Figure 9, and if it is shown, P occSimilarly, two values ​​will be observed for this. • Failure mode FM(6) has both one possible barrier (to increase detection) and two possible preventive measures (to reduce the incidence), therefore, O, P occ , D, n eff , N eff Regarding this, two different values ​​are displayed in the FMEA table and the corresponding FTA fault tree.

[0076] In another advantageous embodiment of the method according to the present invention, failure modes in which the value of the risk assessment index is lower than a threshold are removed from the FTA failure tree of the technical system. A particular implementation of this method has a beneficial impact on the overall efficiency of the relevant risk analysis by focusing on such failure modes that have the greatest impact on the technical system under consideration.

[0077] In yet another advantageous embodiment, the method according to the present invention further includes a step of evaluating the benefits provided by a given risk mitigation measure related to a failure mode in terms of the impact of the given risk mitigation measure on the value of a risk assessment index related to the failure mode. A particular implementation of this method has a beneficial impact on the overall efficiency of the relevant risk analysis by focusing on such risk mitigation measures that have the greatest impact on the technical system under consideration.

[0078] In yet another advantageous embodiment, the method according to the present invention further includes the step of comparing the benefits provided by a given risk mitigation measure with the costs of implementing the given risk mitigation measure. A specific implementation of this method can be used to formulate an appropriate risk mitigation scenario and to perform a favorable cost-benefit analysis of the corresponding risk mitigation measure.

[0079] In a typical embodiment of the method of the present invention, the cost of implementing a given risk mitigation measure used herein is calculated by a relevant computer based on additional cost relationship data incorporated into a common data set. Such additional cost relationship data in the common data set is typically entered by a user and specifically includes values ​​such as the acquisition, implementation, maintenance, and operation costs of a given risk mitigation measure.

[0080] The costs of acquiring, implementing, maintaining, and operating mitigation measures can be specified when creating the risk mitigation measures or by editing them later. These one-time and recurring costs can be easily aggregated by a single parameter, for example, the overall cost over a five-year (5y) period of operation. Thanks to the statistical parameters described above, the benefit can be assessed as the difference in the average number of operational periods of the technical system affected by the failure mode between cases where the new mitigation measures are implemented and cases where they are not.

[0081] For example, the benefit can be calculated for a new possible mitigation measure X according to the following formula: Benefit = N eff (If active mitigation measures are in place) -N eff (If there are active mitigation measures and X)

[0082] When cost-benefit analyses of various risk mitigation measures are presented in a table, it becomes easy to determine which measures are worth implementing using the available budget.

[0083] Figure 10 shows an exemplary cost-benefit analysis table of exemplary risk mitigation measures used in one exemplary embodiment of the method according to the present invention.

[0084] According to the method of the present invention, in cost-benefit analysis, the fact that the same mitigation measure (prevention measure or barrier) is effective against more failure modes, or that a prevention measure is effective against more causes of the same failure mode, can also be taken into consideration. For example, the same barrier (two separate P miss If the two failure modes (which are of a certain value) are related separately, this barrier generates two entries in the cost-benefit table. These two entries can be combined so that acquisition costs are counted only once and benefits are summed up. In this way, risk mitigation measures that are effective against more failure modes are assessed in a more favorable and realistic manner.

[0085] This alternative embodiment is shown in Figure 11, which illustrates the results of the cost-benefit analysis table in Figure 10, with several entries conveniently integrated.

[0086] According to particularly advantageous embodiments of the method of the present invention, the technical system used herein is a medical technical system, specifically a radiotherapy technical system or a particle therapy technical system.

[0087] Another object of the present invention is to provide a device for generating one or more FTA fault trees from an FMEA table of a technical system, or vice versa, the device comprising one or more modules configured to perform the methods described above.

[0088] The apparatus according to the present invention may typically comprise a receiving module, a generating module, and a graphical user interface, all of which are communically connected via a bus.

[0089] As will be readily apparent to those skilled in the art, the apparatus may typically include, but is not limited to, a processor, a memory unit, an input device such as a keyboard or computer mouse, and a display device, as well as further components or modules.

[0090] The receiving module is configured to receive a common data set and data for impact analysis of the technical system. The receiving module can be implemented using a processor, a memory unit, and computer program components that can execute instructions executable by the processor, for example.

[0091] The generation module is configured to generate an FMEA table and / or one or more FTA fault trees using data from a common data set. The generation module can typically be implemented using a processor, memory units, and program components.

[0092] A further object of the present invention is to provide a computer program product that stores executable instructions that, when executed by a computer, cause the computer to perform the methods described above.

[0093] Figure 12 shows a flowchart illustrating an exemplary embodiment of a computer program according to the present invention. This diagram schematically represents a series of steps performed by the computer program: i) a step of defining a common data set; ii) a step of inputting the common data set; iii) a step of selecting a representation of the technical system; iv) a step of generating and displaying an FMEA table or one or more FTA fault trees, depending on the user's selection; v) a step of asking whether to input further data into the common data set, where if yes, the data will be input in the appropriate step; otherwise, vi) a step of asking whether the user wants to switch the representation of the technical system, where if yes, the switch will be input in the appropriate step; otherwise, vii) the program terminates.

[0094] Although the present invention has been described in relation to specific embodiments, this is for illustrative purposes only and should not be construed as limiting. More generally, those skilled in the art will understand that the present invention is not limited to what has been specifically shown and / or described above.

[0095] The reference numbers in the claims do not limit the scope of protection of the claims. The use of the verbs “to include,” “to contain,” “to consist of,” or any other variations thereof, as well as their respective conjugations, does not preclude the existence of elements other than those described. The use of the articles “a,” “an,” or “the” before an element does not preclude the existence of multiple such elements.

[0096] The present invention can also be described as follows: a computer-based method for generating one or more FTA fault trees from an FMEA table of a technical system, or vice versa. The method includes the steps of: defining a common data set for both the FMEA table and one or more FTA fault trees of the technical system; obtaining data from the common data set of the technical system; selecting a representation of the technical system as an FMEA table or one or more FTA fault trees; and using the data from the common data, generating an FMEA table of the technical system or one or more FTA fault trees of the technical system, depending on the selected representation, and displaying them on a graphical user interface.

Claims

1. A computer-based method for generating one or more FTA (Fault Tree Analysis) fault trees from an FMEA (Failure Modes and Effects Analysis) table of a technical system, or vice versa, wherein the method is a) A step of defining a common data set for both the FMEA table and the one or more FTA fault trees of the technical system, wherein the common data set is i. A set of at least one failure mode, ii. A set of causes associated with each failure mode in the set of failure modes, iii. Set of effects relating to each failure mode in the set of failure modes, iv. A set of risk mitigation measures associated with each failure mode in the set of failure modes, each of which is classified as a preventive measure if it can prevent the cause from activating the associated failure mode, or as a barrier if it can detect the failure mode before it has an associated effect, and v. A set of processing steps performed during operation by the aforementioned technical system, wherein each processing step in the set of processing steps is associated with a set of failure modes from the set of at least one failure modes. The steps include defining a common data set, b) A step of acquiring data from the common data set of the technical system, c) A step of selecting the representation of the technical system as an FMEA table or one or more FTA fault trees, c1) If representation as an FMEA table is selected, the steps of generating the FMEA table of the technical system and displaying it on a graphical user interface by using the data of the common data set to group the failure modes in the table according to the corresponding processing steps, c2) If one or more representations as FTA fault trees are selected, the steps of generating the one or more FTA fault trees of the technical system using the data of the common data set and displaying them on the graphical user interface: Each FTA failure tree includes having one of the set of effects as a higher-level event, and between the cause, the failure mode, the effect, the preventive measures, and the barrier, i. When the relevant failure mode has an effect, the effect occurs, ii. When a failure mode occurs and all of the barriers associated with the failure mode are unable to detect the failure mode, the failure mode has associated effects, and iii. The failure mode occurs if the failure mode is activated by any of the associated causes and all of the associated precautions fail to prevent the associated causes from activating the failure mode. A computer-based method designed to represent relationships.

2. In each FTA fault tree corresponding to a given EFFECT, the fault mode is displayed as a branch path. ・EFFECT=OR(effect(1),~,effect(I)); ・ effect (i) = AND (failure mode (i), barrier (i, 0), ~, barrier (i, J)); ・ Failure mode (i) = OR (failure mode (i, 1), ~, failure mode (i, K)); ・Failure mode (i, k) = AND (cause (i, k), prevention (i, k, 1), ~, prevention (i, k, N)); It is converted into this form, and here - effect(i) = EFFECT is generated by the i-th failure mode (i = 1 to I), - The i-th failure mode related to failure mode (i) = effect (i) occurs (i = 1 to I), - Barrier(i, j) = the j-th barrier failed to detect the occurrence of the i-th failure mode before the i-th failure mode produced effect(i) (j = 0...J), - failure mode (i, k) = the i-th failure mode is caused by the k-th cause (k = 0 to K), - cause(i,k) = the k-th cause related to the i-th failure mode activates the i-th failure mode, - The computer-based method according to claim 1, wherein prevention(i,k,n) = the nth prevention cannot prevent cause(i,k) from activating failure mode(i) (n = 0 to N).

3. The computer-based method according to claim 1, comprising the steps of classifying preventive measures as initial preventive measures, or as additional preventive measures if they are chronologically later than the initial preventive measures, and / or classifying a barrier as an initial barrier, or as an additional barrier if it is chronologically later than the initial barrier.

4. The computer-based method according to claim 1, wherein the step of obtaining data from the common data set is performed by requiring a user to input data from the common data set.

5. The computer-based method according to claim 1, wherein the step of selecting a representation of the technical system as an FMEA table or one or more FTA fault trees is performed by requesting a user to select a representation of the technical system as an FMEA table or one or more FTA fault trees.

6. The process further includes the step of calculating a risk assessment index related to the failure mode, wherein the risk assessment index is a) The probability that the failure mode is activated by the associated cause, b) A measure of the intensity of the risk mitigation measures related to the failure mode, and / or c) The probability that the failure mode will have a related effect The computer-based method according to claim 1, including the method described in claim 1.

7. The computer-based method according to claim 6, wherein the risk assessment indicators include the incidence rate (O), detection rate (D), and / or severity (S) of the failure mode.

8. The probability p of a failure mode causing a related effect. ｅｆｆ The process further includes the step of determining the probability p ｅｆｆ but, p ｅｆｆ =P ｏｃｃ ×P ｍｉｓｓ , P ｍｉｓｓ =p ｍｉｓｓ 1×~×p ｍｉｓｓ J, [Math 2] It is calculated here ・ P ｏｃｃ is the probability that the failure mode occurs, P ｍｉｓｓ However, assuming the aforementioned failure mode occurs, the conditional probability that the aforementioned failure mode will not be detected is as follows: p ｍｉｓｓ j is the probability that the j-th barrier cannot detect the failure mode before the failure mode has an effect (j = 1 to J), p ｏｃｃ k is the probability that the failure mode is activated by the k-th cause (k = 1 to K), p ｏｃｃ，ｉ k is the probability that the k-th cause activates the failure mode in the absence of any additional relevant preventative measures. p ｒｅｓ The computer-based method according to claim 1, wherein n is the probability that an nth additional preventative measure acting on the kth cause fails to prevent the occurrence of the failure mode (n = 1 to N(k)).

9. a) Function P ｏｃｃ (O) by P ｏｃｃ The steps include relating the FMEA of the failure mode to the incidence index O, b) Function P ｍｉｓｓ (D) by P ｍｉｓｓ The steps of relating the failure mode to the detection index D of the FMEA and It further includes, P ｏｃｃ (O) and P ｍｉｓｓ The computer-based method according to claim 8, wherein (D) is reversible.

10. The frequency N of the above-mentioned higher-level events that are expected to occur during a certain period. ｅｆｆ The process further includes the step of calculating the frequency N ｅｆｆ but, N ｅｆｆ =n ｅｆｆ 1+~+n ｅｆｆ W n ｅｆｆ w=p ｅｆｆ w×T×F×R It is calculated here n ｅｆｆ w is the frequency at which the higher-level event is expected to occur during the period due to the w-th failure mode (w = 1 to W), p ｅｆｆ w is the probability that the w-th failure mode will have an effect. T is the average number of times the technical system was operated during the aforementioned period. F is the percentage of time the technical system is operational during which the processing steps related to the w-th failure mode are performed. The computer-based method according to claim 8, wherein R is the average number of times the processing step is performed each time the technical system is operated.

11. The computer-based method according to claim 6, wherein failure modes in which the value of the risk assessment index is lower than a threshold are removed from the FTA failure tree of the technical system.

12. The computer-based method according to claim 6, further comprising the step of evaluating the benefits provided by a given risk mitigation means related to a failure mode in terms of the influence of the given risk mitigation means on the value of the risk assessment index related to the failure mode.

13. The computer-based method according to claim 12, further comprising the step of comparing the benefits provided by the given risk mitigation means with the costs of implementing the given risk mitigation means.

14. An apparatus for generating one or more FTA fault trees from an FMEA table of a technical system, or vice versa, wherein the apparatus comprises one or more modules configured to perform the method according to claim 1.

15. A computer-readable recording medium that stores executable instructions that, when executed by a computer, cause the computer to perform the method according to claim 1.

Images