Method for generating a fault tree from an FMEA table of a technical system or vice versa

Abstract

A computer-based method for generating one or more FTA fault trees from an FMEA table of a technical system or vice versa. The method comprises defining a common data set for both the FMEA table and the one or more FTA fault trees of the technical system, obtaining data for the common data set of the technical system, selecting a representation of the technical system as the FMEA table or as the one or more FTA fault trees, and using the data of the common data, generating the FMEA table of the technical system or the one or more FTA fault trees of the technical system according to the selected representation and displaying it on a graphical user interface.

Description

TECHNICAL FIELD

[0001] The present invention relates to the field of risk analysis of technical systems, more specifically to the field of risk analysis of technical systems used in the field of healthcare, such as radiotherapy.

[0002] The present invention also relates to an apparatus for generating one or more FTA fault trees from a FMEA table of a technical system or vice versa, and to a computer program product storing executable instructions. BACKGROUND

[0003] Risk analysis is well known in various industries and a variety of methods and computer-based tools have been developed to help users perform such analysis. Currently, two proactive risk assessment methods and related computer-aided tools are very frequently used, namely Failure Modes and Effects Analysis (hereinafter “FMEA”) and Fault Tree Analysis (hereinafter “FTA”), and variants thereof.

[0004] Each of the two methods has its own details, advantages and drawbacks. FMEA is often used because it is intuitive and easy to implement with common software tools (e.g. spreadsheets), but it is a time-consuming and thus relatively inefficient method. On the other hand, FTA has the ability to represent logical connections between causes and effects, but it is neither intuitive nor simple to implement, and it requires specialized software tools that are not always suitable for the particular industry or technical system to be analyzed.

[0005] Due to their respective advantages, it is still desirable (and in some cases even recommended by standards) to use both FMEA and FTA to perform a risk analysis of a given technical system. However, in current practice, FMEA and FTA are built and maintained separately, and they are often established during different phases of the system development process for different purposes, which is both time-consuming and prone to errors and inconsistencies. This is of particular concern for safety-critical applications, such as when assessing risks related to the use of medical devices.

[0006] European patents EP 1192543 B1 and EP 3270249 B1 disclose methods for generating fault trees for technical systems, which start from data determined using a FMEA of the system and by adding information about functional relationships between system elements. However, the reverse operation, i.e. generating a FMEA table starting from data determined using a fault tree, is not possible or at least not disclosed in a way that it could be implemented.

[0007] US Patent 9430311B2 (Lee) discloses how to perform a fault tree portion of an FTA (Fault Tree Analysis). The initial event and top event of the fault tree portion are considered as the cause and effect in the FMEA analysis, respectively. However, the reverse operation (i.e., generating the fault tree from the data already determined using the FMEA) is either impossible or at least not disclosed in a way that can be implemented.

[0008] Although complementary, these two known risk assessment methods and their respective data structures are incompatible. Specifically, these data structures cannot be combined in a way that allows users to seamlessly switch from FMEA to an FTA model or vice versa, and therefore cannot guarantee compatibility and consistency between the two analyses for a given technical system. Summary of the Invention

[0009] The purpose of this invention is to provide a computer-based method that allows a user to perform proactive risk analysis of a given technical system in either FMEA or FTA representation, and allows the user to switch between these two representations at any time and as desired without inputting any additional data.

[0010] According to the present invention, a computer-based method is provided for generating one or more FTA fault trees or vice versa based on an FMEA table of a technical system, the method comprising the following steps:

[0011] a) Define a common data set for the FMEA table and one or more FTA fault trees of the technical system, wherein the common data set includes:

[0012] - At least one set of failure modes;

[0013] - The set of causes associated with each failure mode in the set of failure modes;

[0014] - The set of effects associated with each failure mode in the set of failure modes;

[0015] - A set of risk mitigation measures associated with each failure mode in the set of failure modes, wherein each risk mitigation measure is classified as prevention if it can prevent the cause from activating the associated failure mode, or as barrier if it can detect the failure mode before the failure mode generates its associated effects; and

[0016] - A set of processing steps performed by a technical system during operation, wherein each processing step in the set of processing steps is associated with a set of failure modes in the at least one set of failure modes;

[0017] b) Obtain data from a public dataset used for the technical system;

[0018] c) Select a representation of the technical system as an FMEA table or as one or more FTA fault trees; and

[0019] c1) If the technical system is selected as the representation of the FMEA table, the FMEA table of the technical system is generated by using data from a common data set and by grouping the failure modes in the table according to the processing steps corresponding to the failure modes, and the FMEA table of the technical system is displayed on the graphical user interface.

[0020] c2) If a technical system representation as one or more FTA fault trees is selected, then one or more FTA fault trees of the technical system are generated using data from a common data set and displayed on a graphical user interface.

[0021] Each FTA fault tree has one effect from the set of effects as the top event and is configured to represent the following relationships between cause, failure mode, effect, prevention, and barrier:

[0022] - An effect occurs if the associated failure mode generates an effect;

[0023] - If a failure mode occurs, the failure mode generates its associated effects, and all barriers associated with the failure mode cannot detect it; and

[0024] - If any of the associated causes of a failure mode activates the failure mode, the failure mode occurs, and all associated preventive measures fail to prevent the associated cause from activating the failure mode.

[0025] In this way, the FMEA table and FTA fault tree of a given technical system become truly equivalent and simply constitute two different representations of the same risk-related data. Therefore, users can work equally well in either the FMEA or FTA representation of the technical system under study, and effortlessly switch from FMEA to FTA or vice versa at any time and as needed, without requiring any additional data input from the user.

[0026] Because of this equivalence and the use of a common data set, data added, deleted, or modified in one representation will be automatically reflected in the other. This ensures consistency and integrity between the two representations.

[0027] In some embodiments of the method according to the invention, in each FTA fault tree corresponding to a given EFFECT, the failure mode is displayed as branches and constructed in the following form:

[0028] ·EFFECT=OR(effect(1),…,effect(I));

[0029] ·effect(i)=AND(failure mode(i),barrier(i,0),…,barrier(i,J));

[0030] ·failure mode(i)=OR(failure mode(i,1),…,failure mode(i,K));

[0031] ·failure mode(i,k)=AND(cause(i,k),prevention(i,k,1),…,prevention(i,k,N));

[0032] in:

[0033] -effect(i) is equal to the EFFECT generated by the i-th failure mode, (i = 1…I).

[0034] -failure mode(i) equals the occurrence of the i-th failure mode associated with effect(i), (i = 1...

[0035] I),

[0036] -barrier(i,j) means that before the i-th failure mode generates effect(i), the j-th barrier cannot detect the occurrence of the i-th failure mode (j=0…J).

[0037] -failure mode(i,k) equals the occurrence of the i-th failure mode due to the k-th cause.

[0038] (k = 0…K),

[0039] -cause(i,k) equals the kth cause associated with the i-th failure mode activating the i-th failure mode.

[0040] -prevention(i,k,n) equals the nth prevention which cannot prevent cause(i,k) from activating failuremode(i), (n=0…N).

[0041] This embodiment is advantageous because it uses a concrete representation of the FTA fault tree, which involves a simplified and concise visualization of different events, gates and their corresponding connections, making risk analysis based on it easier and more valuable.

[0042] In some embodiments of the method according to the invention, prevention is classified as initial prevention or as additional prevention if the prevention follows the initial prevention in chronological order, and / or barrier is classified as initial barrier or as additional barrier if the barrier follows the initial barrier in chronological order.

[0043] This implementation is particularly beneficial because it allows users to update the data in the public dataset as more information about the technical system under study becomes available. This leads to a more accurate and effective risk analysis of the technical system under study.

[0044] In some embodiments of the method according to the invention, the step of obtaining data from a public data set is performed by requesting the user (especially via a graphical user interface) to input data from the public data set.

[0045] In some embodiments of the method according to the invention, the step of selecting a representation of the technical system as an FMEA table or as one or more FTA fault trees is performed by requesting the user to select a representation of the technical system as an FMEA table or as one or more FTA fault trees. This particular execution gives the user the flexibility to operate according to his / her preferences and allows the user to select the type of representation that better matches the technical system under study.

[0046] In some embodiments, the method according to the invention further includes the step of calculating a risk assessment metric associated with the failure mode, the risk assessment metric including:

[0047] a) The probability that the failure mode is activated by an associated cause; and / or

[0048] b) Measurement of the strength of risk mitigation measures associated with the failure mode; and / or

[0049] c) The probability of the associated effects of the failure mode generating the failure mode.

[0050] According to this embodiment, end users have the possibility to add risk assessment metrics to the overall risk analysis and thus perform statistical analysis of the risks. The use of such additional metrics not only advantageously affects the overall efficiency of the associated risk analysis by focusing on the most effective failure modes, but also allows for increased objectivity in the risk analysis through the use of measurable parameters.

[0051] In some embodiments, the risk assessment metrics used herein include the occurrence (O) and / or detectability (D) and / or severity (S) of the failure mode. This allows relatively subjective parameters to be transformed into probabilities that are not only more quantifiable but also more benchmarkable. This ultimately leads to a more objective risk analysis.

[0052] Another object of the present invention is to provide an apparatus for generating one or more FTA fault trees or vice versa based on an FMEA table of a technical system, the apparatus comprising one or more modules configured to perform the methods described herein.

[0053] Another object of the present invention is to provide a computer program product storing executable instructions that, when executed by a computer, cause the computer to perform the methods described herein. Attached Figure Description

[0054] These and other aspects of the invention will be explained in more detail by way of example and with reference to the accompanying drawings, wherein:

[0055] Figure 1 A flowchart depicting an exemplary embodiment of the method according to the present invention is shown;

[0056] Figure 2 An exemplary graphical user interface is shown, illustrating an exemplary manner of performing steps to obtain data from a public data set of a technical system;

[0057] Figure 3 An exemplary FMEA table for an exemplary technical system is shown;

[0058] Figure 4 It shows the method for generating Figure 3 An exemplary FTA fault tree for an exemplary technical system with an FMEA table;

[0059] Figure 5 A flowchart depicting another exemplary embodiment of the method according to the present invention is shown;

[0060] Figure 6 A flowchart depicting yet another exemplary embodiment of the method according to the present invention is shown;

[0061] Figure 7 It shows the method for generating Figure 4 Another exemplary FTA fault tree of an exemplary technical system;

[0062] Figure 8 It shows the method for generating Figure 3 Another exemplary FMEA table for an exemplary technical system;

[0063] Figure 9 It shows the method for generating Figure 7 Another exemplary FTA fault tree of an exemplary technical system;

[0064] Figure 10An exemplary cost-benefit analysis table is shown for exemplary risk mitigation measures used in an exemplary embodiment of the method according to the invention;

[0065] Figure 11 Another exemplary cost-benefit analysis table is shown, illustrating other exemplary risk mitigation measures used in another exemplary embodiment of the method according to the invention;

[0066] Figure 12 A flowchart depicting an exemplary embodiment of a computer program according to the present invention is shown.

[0067] These drawings are neither drawn to scale nor to scale. Typically, similar or identical parts are represented by the same reference numerals in the drawings. Detailed Implementation

[0068] According to a first aspect of the present invention, a computer-based method is provided for generating one or more FTA fault trees or vice versa based on an FMEA table of a technical system, the method comprising the steps of:

[0069] a) Define a common data set for the FMEA table and one or more FTA fault trees of the technical system, wherein the common data set includes:

[0070] - At least one set of failure modes;

[0071] - The set of causes associated with each failure mode in the set of failure modes;

[0072] - The set of effects associated with each failure mode in the set of failure modes;

[0073] - A set of risk mitigation measures associated with each failure mode in the set of failure modes, wherein each risk mitigation measure is classified as prevention if it can prevent the cause from activating the associated failure mode, or as barrier if it can detect the failure mode before the failure mode generates the associated effects;

[0074] as well as

[0075] - A set of processing steps performed by a technical system during operation, wherein each processing step in the set of processing steps is associated with a set of failure modes in the at least one set of failure modes;

[0076] b) Obtain data from a public dataset used for the technical system;

[0077] c) Select a representation of the technical system as an FMEA table or as one or more FTA fault trees; and

[0078] c1) If the technical system is selected as the representation of the FMEA table, the FMEA table of the technical system is generated by using data from a common data set and by grouping the failure modes in the table according to the processing steps corresponding to the failure modes, and the FMEA table of the technical system is displayed on the graphical user interface.

[0079] c2) If a technical system representation as one or more FTA fault trees is selected, then one or more FTA fault trees of the technical system are generated using data from a common data set and displayed on a graphical user interface.

[0080] Each FTA fault tree has one effect from the set of effects as the top event and is configured to represent the following relationships between cause, failure mode, effect, prevention, and barrier:

[0081] - An effect occurs if the associated failure mode generates an effect;

[0082] - If a failure mode occurs, the failure mode generates its associated effects, and all barriers associated with the failure mode cannot detect it; and

[0083] - If any of the associated causes of a failure mode activates the failure mode, the failure mode occurs, and all associated preventive measures fail to prevent the associated cause from activating the failure mode.

[0084] As used herein, the terms “computer-based,” “generate,” “determine,” or “configure” are intended to refer to computer actions and / or processes that process data and / or transform data into other data. The term “computer” is intended to refer to any electronic device with data processing capabilities. The term “module” is intended to refer to a processor and / or memory unit that stores computer-readable instructions.

[0085] The term "technical system" is intended to refer to any technical system having multiple technical components that may interact with each other. Exemplary technical systems used herein include, but are not limited to, healthcare technical systems or power plants. Preferably, the technical systems used herein are healthcare technical systems, particularly those for clinical use, such as particle therapy systems.

[0086] Reference will now be made in detail to some specific embodiments of the invention, examples of which are illustrated in the accompanying drawings. The drawings are intended to provide a better understanding of the embodiments. They illustrate schematic diagrams of the embodiments and, in conjunction with the description, explain the principles and concepts of the disclosed subject matter.

[0087] Figure 1The diagram illustrates the basic principles and components of the method of the present invention, as well as a graphical representation of how those components interact with each other.

[0088] As detailed above, a method for generating one or more FTA fault trees or vice versa based on an FMEA table of a technical system includes the following steps: defining a common data set for both the FMEA table of the technical system and one or more FTA fault trees. The common data set includes: 1) at least one set of failure modes; 2) a set of causes associated with each failure mode in the set of failure modes; 3) a set of effects associated with each failure mode in the set of failure modes; 4) a set of risk mitigation measures associated with each failure mode in the set of failure modes; and 5) a set of processing steps implemented by the technical system during operation.

[0089] The method of the present invention further includes the step of obtaining data from a public data set of the technical system. The data from the public data set is generally input by a user (typically via a graphical user interface (GUI) according to techniques known to those skilled in the art). The data from the public data set is generally stored in a database, which may be, for example, a local database on the user's computer, a database on a remote server, or a database in the cloud.

[0090] Figure 2 An exemplary graphical user interface is shown, illustrating an exemplary manner of performing steps to obtain data from a public data set, wherein a user can input data related to the failure mode, the cause associated with the failure mode, the effect associated with the failure mode, and the corresponding processing steps.

[0091] Figure 2 The graphical user interface depicted can be used multiple times as needed, until the user has entered all the data for the public dataset. Although not through... Figure 2 The graphical user interface depicted is directly enabled, but additional data, including a public data set of risk transfer measures associated with each failure mode in the set of failure modes, can be entered via any suitable alternative graphical user interface.

[0092] The method of the present invention further includes the step of selecting a representation of the technical system as an FMEA table or one or more FTA fault trees. This selection step can be performed in any manner known in the art.

[0093] In some embodiments of the method according to the invention, the step of selecting the representation of the technical system as an FMEA table or one or more FTA fault trees is performed by requesting the user to select the representation of the technical system as an FMEA table or one or more FTA fault trees. In general, this selection can be appropriately made via a graphical user interface.

[0094] According to the method described herein, if a representation as an FMEA table is chosen, the FMEA table of the technical system is generated by using data from a common dataset and by grouping the failure modes in the table according to the processing steps corresponding to the failure modes, and then displayed on a graphical user interface. Alternatively, if a representation as one or more FTA fault trees is chosen, one or more FTA fault trees of the technical system are generated by using data from a common dataset and then displayed on a graphical user interface. These steps are typically performed by a computer according to techniques well known in the art.

[0095] like Figure 1 As shown, the FMEA table and FTA fault tree are generated using data from a common dataset input by the user. The FMEA table and FTA fault tree generated by the method according to the invention are therefore two different representations of the same data (i.e., data from the common dataset). Advantageously, the user can conveniently switch from the FMEA table to the FTA fault tree, and vice versa, at any time on a graphical user interface without entering any additional data or performing any additional steps.

[0096] Advantageously, and particularly due to the equivalence between the FMEA and FTA representations of the studied technical system, any data appropriately added, deleted, or modified by the user will be automatically reflected in both types of representations. Accordingly, the FMEA and FTA representations are continuous and automatically synchronized.

[0097] As will be apparent to those skilled in the art, an FMEA table shows risks from a process perspective (i.e., grouping failure modes according to their respective handling steps), while an FTA fault tree shows risks from the perspective of the effects generated by the respective failure modes (i.e., grouping failure modes according to their respective effects).

[0098] Figure 3 An exemplary FMEA table is shown, generated and displayed for an exemplary technical system as part of the method according to the invention, after the user has entered the corresponding data from a public data set.

[0099] In this table, failure modes (FM(1)–FM(6)) are grouped according to the associated processing steps (Step(1)–Step(3)) and substeps (Substep(2,1), Substep(2,2)). The table also shows the effects (EFFECT1–EFFECT3) associated with each failure mode, the causes (Cause(1,0)–Cause(6,1)) associated with the corresponding failure mode, and the risk mitigation measures (Prev(1,0,0)–Prev(6,1,1)) and barriers (Barrier(1,0)–Barrier(6,3)) associated with each failure mode.

[0100] according to Figure 3 The FMEA table shown shows that, for example, step (1) is associated with two failure modes (FM(1) and FM(2)), where cause (1, 0) is associated with failure mode FM(1) that affects EFFECT1, and failure mode FM(1) is also associated with prevention (Prev(1, 0, 0)) and barrier (1, 0). Step (1) is further associated with failure mode FM(2) that affects EFFECT2, and failure mode FM(2) is further associated with prevention (Prev(2, 0, 0)) and barrier (2, 0).

[0101] Figure 4 An exemplary FTA fault tree according to the present invention is shown, which is generated and displayed as part of the method and corresponds to data in a common data set specifically generated for a single effect “EFFECT1”. Figure 3 The FMEA table.

[0102] exist Figure 4In the FTA fault tree depicted in the figure, failure modes (FM(1), FM(3) and FM(6)) are grouped according to their associated effects (EFFECT1) and the causes associated with their respective failure modes (FM(1), FM(3) and FM(6)) (Cause(3,0), Cause(6,0) and Cause(6,1)), and also represent associated risk mitigation measures (Prev(1,0,0), Prev(3,0,0), Prev(3,0,1), Prev(6,0,0), Prev(6,0,1), Prev(6,0,2), Prev(6,1,1)) and barriers (Barrier(1,0), Barrier(3,0), Barrier(3,1), Barrier(6,0), Barrier(6,1), Barrier(6,2) and Barrier(6,3)). However, in this example, the associated processing steps (Step(1)-Step(3)) implemented by the technical system at runtime are not represented in the FTA fault tree.

[0103] According to the method of the present invention, similar FTA fault trees can be generated and displayed specifically for a single effect "EFFECT2" and for a single effect "EFFECT3". As part of the method of the present invention, those additional FTA fault trees can be automatically generated and displayed on a graphical user interface, or can be generated and displayed individually according to user preferences and selections.

[0104] In an exemplary embodiment of the method according to the invention, in each FTA fault tree corresponding to a given EFFECT, the failure mode is visualized as branches and constructed in the following form:

[0105] ·EFFECT=OR(effect(1),…,effect(I));

[0106] ·effect(i)=AND(failure mode(i),barrier(i,0),…,barrier(i,J));

[0107] ·failure mode(i)=OR(failure mode(i,1),…,failure mode(i,K));

[0108] ·failure mode(i,k)=AND(cause(i,k),prevention(i,k,1),…,prevention(i,k,N));

[0109] in:

[0110] -effect(i) is equal to the EFFECT generated by the i-th failure mode, (i = 1…I).

[0111] -failure mode(i) equals the occurrence of the i-th failure mode associated with effect(i).

[0112] (i = 1…I),

[0113] -barrier(i,j) means that before the i-th failure mode generates effect(i), the j-th barrier cannot detect the occurrence of the i-th failure mode (j=0…J).

[0114] -failure mode(i,k) equals the occurrence of the i-th failure mode due to the k-th cause.

[0115] (k = 0…K),

[0116] -cause(i,k) equals the kth cause associated with the i-th failure mode activating the i-th failure mode.

[0117] -prevention(i,k,n) equals the nth prevention which cannot prevent cause(i,k) from activating failure mode(i), (n=0…N).

[0118] The "OR" and "AND" functions can be understood as logical "OR" and "AND" functions (Boolean logic). For example... Figure 4 As shown, the "OR" function can be represented, for example, in a graphical user interface using a logical OR gate, and the "AND" function can be represented, for example, in a graphical user interface using a logical AND gate.

[0119] exist Figure 4 In the example, generate and display with Figure 3 The following items in the fault tree correspond to EFFECT1:

[0120] ·EFFECT1=OR(effect(1),effect(2),effect(3))=>(I=3)

[0121] ·effect(1)=AND(FM1,Barrier(1,0))=>(J=0)

[0122] ·FM(1)=FM(1,0)=>(K=0)

[0123] ·FM(1,0)=OR(Cause(1,0),Prev(1,0,0))=>(N=0)

[0124] ·effect(2)=AND(FM(3),Barrier(3,0),Barrier(3,1))=>(J=1)

[0125] ·FM(3)=FM(3,0)=>(K=0)

[0126] ·FM(3,0)=OR(Cause(3,0),Prev(3,0,0); Prev(3,0,1))=>(N=1)

[0127] ·effect(3)=AND(FM(6),Barrier(6,0),Barrier(6,1),Barrier(6,2),

[0128] Barrier(6,3)) => (J=3)

[0129] ·FM(6)=OR(FM(6,0),FM(6,1))=>(K=1)

[0130] ·FM(6,0)=OR(Cause(6,0),Prev(6,0,0); Prev(6,0,1),Prev(6,0,2))=>

[0131] (N=2)

[0132] ·FM(6,1)=OR(Cause(6,1),Prev(6,1,1))=>(N=1)

[0133] In another exemplary embodiment of the method of the present invention, the failure modes used herein are considered to be independent of each other, which means that the onset of a failure mode is considered to be unrelated to the onset of other failure modes.

[0134] In yet another exemplary embodiment of the method of the present invention, each failure mode used herein is considered to have one and only one (primary) effect.

[0135] In another example of the method according to the invention, prevention is classified as initial prevention, or, if prevention follows the initial prevention in chronological order, prevention is classified as additional prevention; and / or barriers are classified as initial barriers, or, if barriers follow the initial barriers in chronological order, barriers are classified as additional barriers. This is advantageous because it allows risk mitigation measures to be updated and integrated into the overall risk analysis as more information about the technical system under study becomes available (especially due to initial risk analysis performed on initial data from public datasets). This not only leads to more accurate and effective risk analysis but also allows for appropriate adaptations and improvements to the technical system under study.

[0136] In another example of the method according to the invention, the step of obtaining data from a public data set is performed by requesting the user to input data from the public data set. According to an exemplary aspect, the user manually enters appropriate data into various fields suggested by the computer and visible via a graphical user interface.

[0137] The step of obtaining data from a public dataset can alternatively be performed by loading or importing data from an external device or data storage center.

[0138] In yet another embodiment, the method according to the invention further includes the step of calculating a risk assessment metric associated with the failure mode.

[0139] In a typical embodiment of the method of the present invention, the risk assessment metric used herein is calculated by an associated computer based on additional data introduced from the public dataset. This additional data in the public dataset is typically input by the user and specifically includes values ​​such as the occurrence score (O), detectability score (D), or severity (S) of a particular failure mode. Exemplary additional data in the public dataset may further include: the average number of times the technical system is run (T) during a specific time period; the run score (F) of the technical system during the operation of the technical system that executes processing steps associated with a particular failure mode; the average number of times the processing steps are executed per run of the technical system (R); and the probability P that the failure mode remains undetected before it generates its associated effects. miss And the probability P of failing to prevent the occurrence of the failure mode. res All of this additional data is defined below.

[0140] In some embodiments of the method according to the invention, the risk assessment metrics used herein may include:

[0141] a) The probability that the failure mode is activated by the associated cause; and / or

[0142] b) Measurement of the strength of risk mitigation measures associated with the failure mode; and / or

[0143] c) The probability that the failure mode generates its associated effects.

[0144] In some other embodiments, the risk assessment metric further includes the expected frequency of the top event occurring during the time period.

[0145] The steps for calculating an appropriate risk assessment, as detailed above, allow users to perform statistical analysis on the risks associated with the technical system under study. Figure 5A flowchart depicting an exemplary embodiment is shown, wherein statistical risk analysis further implemented by the method according to the invention is schematically illustrated.

[0146] In an exemplary embodiment, the risk assessment metrics used herein include the occurrence (O) and / or detectability (D) and / or severity (S) of the failure mode. In this context, the risk priority number (RPN) corresponding to RPN = SOD may also be used and included in the risk assessment metrics.

[0147] According to yet another embodiment, the method according to the invention further includes the step of: calculating the probability p of the associated effects of the failure mode generation. eff The probability p is calculated as follows: eff :

[0148] p eff =P occ *P miss ,

[0149] P miss =p miss 1·…·p miss J,

[0150] P occ =p occ 1∪…∪p occ K,

[0151] p occ k = p occ,i k·p res 1·…·p res N(k),

[0152] in,

[0153] ·P occ It is the probability of the failure mode occurring.

[0154] ·P miss It assumes that the failure mode occurs, and the failure mode remains undetected as a conditional probability.

[0155] ·p miss j is the probability that the j-th barrier failed to detect the failure mode before the failure mode generates its effect (j = 1…J).

[0156] ·p occ k is the probability that the failure mode is activated by the k-th cause (k = 1…K).

[0157] ·p occ,i k is the probability that the failure mode is activated by the k-th cause if no associated additional preventative measures are taken.

[0158] ·p res n is the probability that the nth additional preventive action acting on the kth cause fails to prevent the failure mode from occurring (n = 1…N(k)).

[0159] This specific implementation of the method of the present invention allows for a more accurate determination of the probability of the associated effects of the failure mode generation.

[0160] According to an advantageous embodiment, the method according to the invention further includes the following steps:

[0161] a) Through function P occ (O) will P occ It is associated with the FMEA occurrence index O;

[0162] b) Through function P miss (D) P miss Related to the FMEA detection capability index D;

[0163] Where P occ (O) and P miss (D) is an invertible function.

[0164] The statistical risk analysis or assessment achieved by the method of the present invention can also make decisions regarding the implementation of appropriate risk mitigation measures and determine suitable risk mitigation scenarios that can be advantageously deployed in the studied technical system. In particular, this determination is possible through a cost / benefit analysis of the specific risk mitigation measures under consideration, and this is also achieved through the method according to the invention.

[0165] Figure 6 A flowchart depicting an exemplary embodiment is shown, schematically illustrating a cost / benefit analysis of a specific risk mitigation measure and the determination of a suitable risk mitigation scenario to be further achieved by the method according to the invention.

[0166] According to a more advantageous embodiment, the method according to the invention further includes calculating the frequency N of the top event expected to occur during the time period. eff The steps include calculating the frequency N as follows. eff :

[0167] N eff =n eff 1+…+n eff W

[0168] n eff w = p eff w*T*F*R

[0169] in,

[0170] ·n effw is the expected frequency of the top event due to the w-th failure mode during the time period (w = 1…W).

[0171] ·p eff w is the probability of being affected by the w-th failure mode.

[0172] • T is the average number of times the technical system operates during the stated time period.

[0173] • F is the operational score of the technical system, where the processing steps associated with the w-th failure mode are executed during the operation of the technical system, and

[0174] R is the average number of times the processing step is executed in each run of the technical system.

[0175] This particular execution of the method of the present invention allows for a more accurate determination of the frequency of the top event (i.e., one of the effects in the set of effects) expected to occur during a specific time period.

[0176] In the context of this invention, the expression "operation of a technical system" is intended to specify the execution of a process implemented by a technical system, wherein the process includes a series of successive processing steps and sub-steps executed according to a defined sequence.

[0177] Figure 7 It shows the method for generating Figure 4 Another exemplary FTA fault tree of an exemplary technical system, which illustrates the relationship between different calculated statistical parameters (such as probability and frequency factors (as detailed above)) and fault-related events.

[0178] Figure 8 It shows the method for generating Figure 3 Another exemplary FMEA table for an exemplary technical system, where the results of different risk mitigation scenarios are represented. The same results for these different risk mitigation scenarios are... Figure 9 The fault tree representation of the FTA at this time is used to represent it similarly.

[0179] More specifically, the different states of various risk mitigation measures (preventions or barriers) are represented as follows:

[0180] • Activation (A): Currently implemented and activated in the system;

[0181] • Potential (P): Ideas that are currently being tested or evaluated;

[0182] • Not Activated (NA): Was implemented or evaluated in the past, but is no longer implemented (e.g., due to lack of interest).

[0183] The values ​​of statistical parameters (frequency or probability) displayed in the FMEA table and FTA fault tree depend on which risk mitigation measures are considered. Therefore, multiple values ​​for the same parameter can be displayed, corresponding to different risk mitigation scenarios. Specifically, as shown in the FMEA table and FTA fault tree respectively... Figure 8 and Figure 9 As shown, it should be noted that:

[0184] Failure modes FM(1), FM(2), and FM(5) do not offer potential mitigation. Therefore, in the FMEA table, for O, D, RPN, n eff Only one value is displayed. Similarly, for P in the FTA fault tree... occ n eff and N eff Display only one value;

[0185] Failure mode FM(3) has a potential barrier. Therefore, for D, RPN, n eff N eff Two values ​​are displayed. These values ​​decrease based on the potential barrier, as the potential barrier reduces the overall probability of an undetected failure. O and Pocc are unaffected;

[0186] Failure Mode FM(4) has a potential preventative effect. It reduces the overall probability of occurrence; therefore, it is used to prevent O, RPN, and n in the FMEA table. eff Indicates two values. The tree of Effect(3) is not in Figure 9 As shown in the diagram, otherwise you will also see P. occ Two values;

[0187] Failure Mode and Effects (FM) (6) has both potential barriers (improved detectability) and two potential preventative measures (reduced occurrence); therefore, O, P occ D, n eff N eff The two double values ​​are displayed in the FMEA table and the corresponding FTA fault tree.

[0188] In another advantageous embodiment of the method according to the invention, failure modes whose risk assessment metrics are below a threshold are removed from the FTA fault tree of the technical system. By focusing on those failure modes that most affect the technical system under study, this specific implementation of the method beneficially impacts the overall efficiency of the associated risk analysis.

[0189] In yet another advantageous embodiment, the method according to the invention further includes the step of evaluating the benefits provided by the given risk mitigation measures associated with the failure mode based on the impact of the given risk mitigation measures on risk assessment metrics associated with the failure mode. This specific implementation of the method beneficially influences the overall efficiency of the associated risk analysis by focusing on the risk mitigation measures that most affect the technical system under study.

[0190] In yet another advantageous embodiment, the method according to the invention further includes the step of comparing the benefits provided by a given risk mitigation measure with the costs of implementing the given risk mitigation measure. This particular execution of the method enables the formulation of appropriate risk mitigation scenarios and the performance of suitable cost-benefit analyses of the corresponding risk mitigation measures.

[0191] In a typical embodiment of the method of the present invention, the cost of implementing a given risk mitigation measure used herein is calculated by an associated computer based on additional cost-related data introduced from a public dataset. That additional cost-related data in the public dataset is typically input by the user and specifically includes values ​​such as the acquisition, implementation, maintenance, and operational costs of the given risk mitigation measure.

[0192] When creating risk mitigation measures, or through later editing, the acquisition, implementation, maintenance, and operational costs to be mitigated can be specified. These non-recurring and recurring costs can be easily summarized using a single parameter, such as the total cost of operation over 5 years (5y). Thanks to the statistical parameters described above, benefits can be assessed as the difference in the average number of times the technical system will be run, regardless of whether new mitigation measures are implemented, as the system will be affected by failure modes.

[0193] For example, for a new potential mitigation X, the benefit can be calculated using the following formula:

[0194] Benefit = N eff (with active mitigations)-N eff (with active mitigations andX)

[0195] If a cost / benefit analysis of different risk mitigation measures is presented in a table, it is easy to determine which measures are worth implementing using the available budget.

[0196] Figure 10 An exemplary cost-benefit analysis table is shown for an exemplary risk mitigation measure used in an exemplary embodiment of the method according to the invention.

[0197] According to the method of the present invention, the following facts can also be considered in the cost / benefit analysis: the same mitigation (prevention or barrier) is effective for more failure modes, or prevention is effective for more causes of the same failure mode. For example, if the same barrier is already independently associated with two failure modes (with two independent P... miss (Value). This barrier generates two entries in the cost / benefit table. These two entries can be combined so that the acquisition cost is counted only once, and the benefits are added together. In this way, effective risk mitigation measures for a wider range of failure modes can be evaluated in a more favorable and realistic manner.

[0198] This alternative embodiment is in Figure 11 China stated that Figure 11 It shows Figure 10 The results of the cost-benefit analysis table, but some of the entries have been appropriately merged.

[0199] In a particularly advantageous embodiment of the method according to the invention, the technical system used herein is a healthcare technology system, particularly a radiotherapy technology system or a particle therapy technology system.

[0200] Another object of the present invention is to provide an apparatus for generating one or more FTA fault trees or vice versa based on an FMEA table of a technical system, the apparatus comprising one or more modules configured to perform the methods described above.

[0201] The device according to the present invention typically includes a receiving module, a generating module, and a graphical user interface connected via bus communication.

[0202] As will be readily apparent to those skilled in the art, the device may typically also include components or modules, including but not limited to a processor, memory units, input devices (such as a keyboard or computer mouse), and a display device.

[0203] The receiving module is configured to receive data from a common data set and to perform impact analysis on the technical system. The receiving module can be implemented using the processor, the memory unit, and a computer program component, which can, for example, execute executable instructions using the processor.

[0204] The generation module is configured to generate FMEA tables and / or one or more FTA fault trees using data from a common data set. The generation module can typically be implemented using a processor, memory units, and program components.

[0205] Another object of the present invention is to provide a computer program product storing executable instructions, which, when executed by a computer, cause the computer to perform the above-described method.

[0206] Figure 12 A flowchart illustrating an exemplary embodiment of a computer program according to the present invention is shown. The flowchart schematically represents the sequential steps performed by the computer program as follows: i) defining a common data set; ii) inputting the common data set; iii) selecting a representation of the technical system; iv) generating and displaying an FMEA table or one or more FTA fault trees based on the user's selection; v) querying whether further data should be input into the common data set, and if so, inputting the data at the appropriate step, otherwise; vi) querying the user whether they want to switch the representation of the technical system, and if so, inputting the switch at the appropriate step, otherwise; vii) ending the program.

[0207] The invention has been described with reference to specific embodiments, which are illustrative and should not be construed as limiting. More generally, those skilled in the art will understand that the invention is not limited to what has been specifically shown and / or described above.

[0208] The reference numerals in the claims do not limit the scope of protection. The use of the verbs “to comprise,” “to include,” “to consist of,” or any other variations thereof, and their corresponding variations, does not exclude the presence of elements other than those stated. The use of the articles “a,” “an,” or “the” before an element does not exclude the presence of a plurality of such elements.

[0209] The present invention can also be described as follows: a computer-based method for generating one or more FTA fault trees or vice versa based on an FMEA table of a technical system. The method includes: defining a common data set for both the FMEA table and one or more FTA fault trees of the technical system; obtaining data for the common data set of the technical system; selecting a representation of the technical system as either the FMEA table or one or more FTA fault trees; and using the data from the common data set, generating the FMEA table or one or more FTA fault trees of the technical system based on the selected representation and displaying it on a graphical user interface.

Claims

1. An apparatus for generating one or more FTA fault trees based on an FMEA table of a technical system, or for generating one or more FMEA tables based on an FTA fault tree of a technical system, comprising: Input device, memory, display, and processor, among which The display is equipped with a graphical user interface; The input device is configured to: input a common data set of the FMEA table and the one or more FTA fault trees of the technical system into the memory, and input a selection of representing the technical system as an FMEA table or as one or more FTA fault trees into the memory, wherein the common data set includes: i. At least one set of failure modes; ii. The set of causes associated with each failure mode in the set of failure modes; iii. The set of effects associated with each failure mode in the set of failure modes; iv. A set of risk mitigation measures associated with each failure mode in the set of failure modes, wherein each risk mitigation measure is classified as prevention if it can prevent the cause from activating the associated failure mode. If each risk mitigation measure can detect the failure mode before it generates its associated effects, then each risk mitigation measure is classified as a barrier; and v. A set of processing steps performed by the technical system during operation, wherein each processing step in the set of processing steps is associated with a set of failure modes in the at least one set of failure modes; and The processor is configured to: retrieve data from the memory of the common data set; if an FMEA table is selected as the representation, automatically generate an FMEA table for the technical system by using the data of the common data set and by grouping the failure modes according to the processing steps of the technical system corresponding to the failure modes, and display the FMEA table on the display via the graphical user interface; and if one or more FTA fault trees are selected as the representation, automatically generate one or more FTA fault trees for the technical system by using the data of the common data set, and display the one or more FTA fault trees on the display via the graphical user interface. Each FTA fault tree has one effect from the set of effects as the top event and is configured to represent the following relationships between cause, failure mode, effect, prevention, and barrier: i. If the associated failure mode generates an effect, then an effect is generated; ii. If a failure mode occurs, the failure mode generates associated effects, and all barriers associated with the failure mode cannot detect the failure mode; and iii. If any of the associated causes of the failure mode activates the failure mode, the failure mode occurs, and all associated preventive measures fail to prevent the associated cause from activating the failure mode.

2. The device according to claim 1, characterized in that, In each FTA fault tree corresponding to a given EFFECT, the failure mode is displayed as a branch on the display via the processor through the graphical user interface and the failure mode is constructed in the following form: EFFECT=OR(effect(1),…,effect(I)); effect(i)=AND(failure mode(i),barrier(i,0),…,barrier(i,J)); failure mode(i)=OR(failure mode(i,1),…,failure mode(i,K)); failure mode(i,k)=AND(cause(i,k),prevention(i,k,1),…,prevention(i,k,N)); in: effect(i) is equal to the EFFECT generated by the i-th failure mode, (i = 1…I). failure mode(i) equals the occurrence of the i-th failure mode associated with effect(i). (i = 1…I), barrier(i,j) equals the condition that before the i-th failure mode generates effect(i), the j-th barrier cannot detect the occurrence of the i-th failure mode (j=0…J). failure mode(i,k) equals the occurrence of the i-th failure mode due to the k-th cause. (k = 0…K), cause(i,k) equals the kth cause associated with the i-th failure mode activating the i-th failure mode. prevention(i,k,n) is equal to the nth prevention that cannot prevent cause(i,k) from activating failuremode(i), (n=0…N).

3. The device according to claim 1 or 2, characterized in that, The processor is also configured to: classify a prevention as an initial prevention or, if the prevention is chronologically sequential and follows the initial prevention, classify a prevention as an additional prevention; and / or classify a barrier as an initial barrier or, if the barrier is chronologically sequential and follows the initial barrier, classify a barrier as an additional barrier.

4. The device according to claim 1 or 2, characterized in that, The processor is also configured to calculate risk assessment metrics associated with failure modes, the risk assessment metrics including: a) The probability that the failure mode is activated by an associated cause; and / or b) Measurement of the strength of risk mitigation measures associated with the failure mode; and / or c) The probability of the associated effects of the failure mode generating the failure mode.

5. The device according to claim 4, characterized in that, The risk assessment metrics include the occurrence (O) and / or detectability (D) and / or severity (S) of the failure mode.

6. The device according to claim 1, 2 or 5, characterized in that, The processor is also configured to: determine the probability P of the associated effects generated by the failure mode. eff The probability P is calculated by the processor in the following manner. eff : p eff =P occ* P miss , P miss =p miss 1·…·p miss J, P occ =p occ 1∪…∪p occ K, p occ k=p occ,i k·p res 1·…·p res N(k), in, P occ It is the probability of the failure mode occurring. P miss It assumes that the failure mode occurs, and the failure mode remains undetected as a conditional probability. p miss j is the probability that the j-th barrier failed to detect the failure mode before the failure mode generates its effect (j = 1…J). p occ k is the probability that the failure mode is activated by the k-th cause (k = 1…K). p occ,i k is the probability that the failure mode is activated by the k-th cause if no associated additional preventative measures are taken. p res n is the probability that the nth additional preventive action acting on the kth cause fails to prevent the failure mode from occurring (n = 1…N(k)).

7. The device according to claim 6, characterized in that, The processor is also configured to: a) Through function P occ (O) will P occ It is associated with the FMEA occurrence index O; b) Through function P miss (D) P miss Related to the FMEA detection capability index D; Where P occ (O) and P miss (D) is reversible.

8. The device according to claim 7, characterized in that, The processor is also configured to: determine the frequency N of the top event expected to occur during the time period. eff The frequency N is calculated by the processor in the following manner. eff : N eff =n eff 1+…+n eff W n eff w=p e ffw*T*F*R in, n eff w is the expected frequency of the top event due to the w-th failure mode during the time period (w = 1…W). p eff w is the probability of being affected by the w-th failure mode. T is the average number of times the technical system was run during the said time period. F is the operational score of the technical system, wherein processing steps associated with the w-th failure mode are performed during the operation of the technical system, and R is the average number of times the processing step is executed in each run of the technical system.

9. The device according to any one of claims 5, 7 and 8, characterized in that, The processor is also configured to remove failure modes whose risk assessment metric values ​​are below a threshold from the FTA fault tree of the technical system.

10. The device according to any one of claims 5, 7 and 8, characterized in that, The processor is also configured to evaluate the benefits provided by the given risk mitigation measure associated with the failure mode, based on the impact of the given risk mitigation measure on the risk assessment metric associated with the failure mode.

11. The device according to claim 10, characterized in that, The processor is also configured to compare the benefits provided by the given risk mitigation measure with the cost of implementing the given risk mitigation measure.

Images