JP5473995B2 - Safety level evaluation support device - Google Patents

Description

  The present invention relates to a safety level evaluation support apparatus that supports the evaluation of a safety level in the system by simulating the safety level of a safety-related system based on functional safety.

  In the living environment in recent years, there are cases where accidents due to device component failures or human error are caused as devices and systems become more sophisticated, complicated, and larger in various fields. In order to prevent this, there is an intrinsic safety concept of improving the quality of components, software, etc. and removing the cause of harm. However, increasing the quality of components and the like is accompanied by an increase in cost, and it is difficult to remove all harmful factors. Therefore, there is a concept of functional safety that implements a function that can ensure the safety of a device even if a device or system fails.

  Such a safety related system based on functional safety is standardized by the international standard IEC61508 established by the International Electrotechnical Commission (IEC). According to this international standard, a safety-related system is classified into one of four levels (SIL1 to SIL4) according to a safety integrity level (SIL (Safety Integrity Level)) that is an index of safety. For example, a safety-related system in an electric / electronic / programmable electronic system (hereinafter referred to as “E / E / PES device”) is required to achieve SIL2 or SIL3. ing. This safety-related system is configured by integrating a plurality of subsystems to which predetermined functions are assigned. Further, the subsystem is formed by a device or the like that is a combination of components and parts necessary for exhibiting a predetermined function.

  The safety level of the above E / E / PES apparatus is based on, for example, FMEDA (Failure) based on the failure rate of subsystems and devices, the average repair time of failures, the self-diagnosis rate, and the endurance test interval (proof test interval). It can be calculated by performing failure analysis using Modes Effects and Diagnostic Analysis. As such a safety level calculation method, for example, Patent Document 1 discloses a method for calculating a safety level based on a design parameter related to a safety-related system and comparing it with a target safety level. Yes. Further, Non-Patent Document 1 discloses that a failure analysis by FMEDA is performed on each subsystem for a safety-related system or each device for a subsystem, and a safety level of the safety-related system or subsystem is calculated. Yes.

JP 2004-341814 A

Functional Safety Network Co., Ltd., "FS SNavi2" software for calculating probability of failure according to IEC 61508, [online], Functional Safety Network Co., Ltd. [Search June 14, 2011], Internet <URL: http: // fs-net.com/fssnavi.php>

  By the way, when the calculated safety level of the safety-related system does not reach the target value, for example, corrections such as redundancy and diversification of circuits in hardware, improvement of self-diagnosis rate, and improvement of parts quality Can be considered. Further, when the E / E / PES apparatus is advanced, the number of parts of the devices forming the subsystem increases, and the influence degree of each device on the entire system may be different. Therefore, it is difficult to select a subsystem or device to be corrected and to set an appropriate correction amount for the current design parameter. For these reasons, even in the apparatus described in Patent Document 1 or Non-Patent Document 1, when correcting a safety-related system for the purpose of improving the safety level, for example, correction is made based on the experience of the designer. The target device was selected and the correction amount was set. Therefore, the correction of the design parameters and the failure analysis by FMEDA are repeated, and much time and cost are required to achieve the target safety level.

  The present invention has been made in view of the above problems, and simulates the safety level of a safety-related system and can achieve the target safety level more efficiently. The purpose is to provide.

In order to solve the above-described problem, according to the first aspect of the present invention, there is provided a safety level evaluation support device for a safety-related system, wherein the safety-related system is configured by integrating a plurality of subsystems. Each of the subsystems is formed by a plurality of elements and is assigned to any one of an input unit, a logic unit, and an output unit of the overall system, and the safety level evaluation support device includes the subsystems and the elements. A storage unit that stores design parameters; an analysis value that includes a failure rate in the overall system based on the design parameter; an arithmetic unit that calculates a safety level of the overall system based on the analysis value; A display unit for displaying at least a part of the design parameters stored in the storage unit and a safety level of the overall system; And a correction unit for receiving the correction value of the design parameters displayed on the display unit, the display unit, the contribution of the subsystem for the Safety Integrity Level and the whole system of the subsystems, the element At least one of the safety level and the contribution degree of the element to the entire system or the subsystem is further displayed as an index of selection of the design parameter to be corrected and a correction amount, and the design is performed by the correction unit. When the correction value of the parameter is input, the calculation unit aggregates the analysis value in the entire system based on the correction value, recalculates the safety level of the entire system based on the analysis value, and the design Simulate the safety level of the entire system when the parameter is changed to the correction value. And down to display on the display unit.

According to a second aspect of the present invention, in the first aspect, the calculation unit performs a failure analysis based on a design parameter to calculate the analysis value, and based on a total result of the analysis value, the overall system safety In addition to the design parameter , the display unit displays at least a part of the analysis value in the overall system calculated in the failure analysis, and the correction unit displays on the display unit by accepting the correction value of the design parameters and the analysis values, the correction values of the analyzed values by the correction unit is input, the arithmetic unit aggregated analysis value in the entire system based on the correction value The safety level of the whole system is calculated again based on the analysis value, and the safety level of the whole system when the analysis value is changed to the correction value is simulated. Shon to be displayed on the display unit.

  According to the invention according to claim 3, in claim 1 or 2, the calculation unit further calculates a safety level of the subsystem based on the analysis value in the overall system, and determines the safety level of the subsystem. Display on the display unit.

  According to the invention according to claim 4, in any one of claims 1 to 3, the calculation unit further calculates a safety level of the element based on the analysis value in the overall system, and the safety of the element The degree level is displayed on the display unit.

According to the invention of claim 5, in any one of claims 1 to 4, the design parameters of the subsystem Ri Sadama by the configuration of the subsystem, and the failure rate in the failure analysis for each its kind Architectures with different calculation formulas are included, and the correction unit receives a correction value indicating a change in the type of the architecture in the subsystem, and the correction unit inputs the correction value of the architecture in the subsystem. Assuming that the configuration of the subsystem is changed, the arithmetic unit aggregates the virtual analysis values in the entire system based on the correction value, and the virtual safety of the entire system is calculated based on the virtual analysis value. The virtual safety level of the entire system when the degree level is further calculated and the architecture is changed to the correction value To simulate a quasi be displayed on the display unit.

According to the invention of claim 6, in any one of claims 1 to 5, the design parameters of the elements Ri Sadama the configuration of the elements, and of the failure rate in the failure analysis for each its kind Architectures having different calculation formulas are included, and the correction unit receives a correction value indicating a change in the type of the architecture in the element, and when the correction value of the architecture in the element is input by the correction unit, the element Assuming that the configuration is changed, the calculation unit aggregates the virtual analysis values in the entire system based on the correction values, and further calculates the virtual safety level of the entire system based on the virtual analysis values. And the virtual safety level of the entire system when the architecture is changed to the correction value. And simulation displayed on the display unit.

  According to the invention according to claim 7, in claim 5 or 6, the arithmetic unit further calculates a virtual safety level of the subsystem based on the virtual analysis value in the overall system, and the virtual safety of the subsystem is calculated. The degree level is displayed on the display unit.

  According to the invention according to claim 8, in claim 6, the arithmetic unit further calculates a virtual safety level of the element based on the virtual analysis value in the overall system, and sets the virtual safety level of the element to the virtual safety level. Display on the display.

  According to the invention according to claim 9, in any one of claims 5 to 8, when the correction value of the architecture is input by the correction unit, the calculation unit calculates a coefficient corresponding to the correction value. By multiplying the analysis value in the entire system, the virtual analysis values in the entire system are totaled.

  According to a tenth aspect of the present invention, in any one of the first to ninth aspects, the arithmetic unit corrects at least a part of the analysis value or the design parameter related to the subsystem by a certain amount. The analysis values in the entire system are totaled, and the contribution of the subsystem to the overall system is calculated by comparing the analysis values before and after the correction, and the contribution of the subsystem is displayed in the display unit. To display.

  According to the invention according to claim 11, in any one of claims 1 to 10, the calculation unit corrects at least a part of the analysis value or the design parameter related to the element by a certain amount. By calculating the analysis values in the overall system and comparing the analysis values before and after the correction, the contribution of the element to the overall system or the subsystem is calculated, and the contribution of the element is displayed in the display Displayed in the section.

  According to the twelfth aspect of the invention, in any one of the first to eleventh aspects, the correction unit continuously receives correction values that increase or decrease by a certain amount for the design parameter or the analysis value, and When the correction value is continuously input by the correction unit, the calculation unit aggregates the analysis values in the overall system based on the correction values, and determines the safety level of the overall system based on the analysis values. The safety level of the overall system when the design parameter or the analysis value is continuously changed to the correction value is simulated and sequentially displayed on the display unit.

  According to a thirteenth aspect of the present invention, in any one of the first to twelfth aspects, the display unit is currently calculated in the calculation process of the safety level of the overall system by the calculation unit. Displays the safety level of the entire system and that the calculation unit is in the process of calculation.

  According to the first aspect of the present invention, the correction unit takes the design parameter of the subsystem or element as a correction target, and when the correction value is input, the safety level of the entire system is calculated again. As a result, it is possible to simulate the safety level when correction is performed on any design parameters of the subsystems and elements constituting the overall system. Therefore, stepwise correction from the subsystem to the element is possible, and the design parameters can be corrected so that the overall system achieves the target safety level.

  According to the second aspect of the invention, the correction unit sets the analysis value in the entire system as a correction target, and when the correction value is input, calculates the safety level of the entire system again. Here, the “analyzed value in the entire system” is a value calculated for each of the entire system, subsystem, and element when a failure analysis is performed by FMEDA, for example, based on the design parameter of the subsystem or element. It is. This analysis value includes a failure rate λ, a safety failure rate SFF, a low frequency failure rate PFD, and the like. Therefore, the correction for the analysis value is performed by collectively correcting a plurality of design parameters used for calculation of the analysis value. Therefore, the safety level of the entire system can be simulated more efficiently.

  According to the invention of claim 3, the calculation unit calculates the safety level of the subsystem. A subsystem is a basic component group that is assigned to any of an input unit, a logic unit, and an output unit of the entire system and constitutes the entire system. Therefore, in order to improve the safety level of the entire system, for example, correction such as shortening of the subsystem durability test interval or redundancy of the subsystem can be considered. In such a case, by confirming the safety level of each subsystem, it is possible to simulate whether the correction performed on the subsystem is useful for each subsystem. Thereby, the target safety level of the entire system can be achieved more efficiently.

  According to the invention of claim 4, the calculation unit calculates the safety level of the element. An element is a device that is a combination of components and components necessary for a subsystem to perform a predetermined function. Therefore, in order to improve the safety level of the entire system, for example, it is conceivable to replace the element with an element that improves the safety-side failure rate SFF of the element or to correct the circuit configuration. In such a case, by confirming the safety level of each element, it is possible to simulate whether the correction performed on the element is useful for each element. Thereby, the target safety level of the entire system can be achieved more efficiently.

  According to the fifth aspect of the present invention, the correction unit takes the architecture in the subsystem as a correction target, and when the correction value is input, the virtual analysis values in the entire system are tabulated. Then, the calculation unit calculates the virtual safety level of the entire system based on the virtual analysis value. Here, the “architecture” is a hardware configuration in the safety-related system, and is redundant and diversified to ensure safety. Changing the architecture is an effective means as a correction for improving the safety level of the entire system because, for example, the dangerous fault λDU that cannot be detected can be reduced by increasing the diagnostic rate of the circuit. However, since the change of the architecture changes the design of the hardware, when the number of items forming the architecture increases, it is necessary to input the design parameters of the items.

  Therefore, according to the present invention, when the correction value of the architecture in the subsystem is input, it is assumed that the configuration of the subsystem is changed, and the calculation unit adds up the virtual analysis values in the entire system. The virtual analysis value in the entire system is calculated based on the design parameters of the virtually configured subsystem after the architecture change. Further, by calculating the virtual safety level of the entire system, the simulation can be performed as if the architecture of the subsystem was changed. Thereby, it can be determined whether or not the change in the architecture of the subsystem is effective in improving the safety level of the entire system. Therefore, it is possible to efficiently determine which subsystem of the plurality of subsystems constituting the entire system should be changed.

  According to the sixth aspect of the invention, the correction unit sets the architecture of the element as a correction target, and when the correction value is input, the virtual analysis values in the entire system are totaled. Then, the calculation unit calculates the virtual safety level of the entire system based on the virtual analysis value. As described above, the architecture change is an effective means as a correction for improving the safety level of the entire system, and the same applies to the architecture in the element. Therefore, in the present invention, when the correction value of the architecture in the element is input, the calculation unit adds up the virtual analysis values in the entire system on the assumption that the configuration of the element is changed. The virtual analysis value in the entire system is calculated based on the design parameters of the virtually changed element after the architecture change. Further, by calculating the virtual safety level of the entire system, it is possible to simulate that the element architecture is changed. Thereby, it can be determined whether or not the change in the architecture of the element is effective in improving the safety level of the entire system. Therefore, it is possible to efficiently determine which element of the plurality of elements constituting the subsystem should be changed in architecture.

  According to the invention of claim 7, the calculation unit calculates the virtual safety level of the subsystem. As described above, changing the architecture of the subsystem or element is an effective means as a correction for improving the safety level of the entire system. However, since the safety level of the entire system is calculated based on design parameters of a plurality of subsystems constituting the entire system, it may be difficult to determine the effectiveness of a specific architecture change. Therefore, when the subsystem or element architecture is changed, the virtual safety level of the subsystem is calculated based on the virtual analysis value in the entire system. As a result, the virtual safety level of the subsystem related to the architecture change can be confirmed, and the effectiveness of the architecture change for each subsystem can be determined. Therefore, the subsystem or element architecture can be changed more efficiently.

  According to the eighth aspect of the present invention, the calculation unit calculates the virtual safety level of the element. As described above, changing the architecture of the element is an effective means as a correction for improving the safety level of the entire system. However, since the safety level of the entire system is calculated based on design parameters of a plurality of subsystems and elements constituting the entire system, it may be difficult to determine the effectiveness of a specific architecture change. Therefore, when the architecture of the element is changed, the virtual safety level of the element is calculated based on the virtual analysis value in the entire system. Thereby, the virtual safety level of the element related to the architecture change can be confirmed, and the effectiveness of the architecture change for each element can be determined. Therefore, the element architecture can be changed more efficiently.

  According to the invention of claim 9, the calculation unit adds up the analysis values in the entire system by multiplying the analysis values in the entire system by a coefficient corresponding to the correction value of the architecture. As described above, the change of the architecture changes the design of the hardware. Therefore, when the number of items forming the architecture increases, it is necessary to input the design parameters of the items. Here, the virtual safety level of the entire system can be calculated by the calculation unit summing up the virtual analysis values in the entire system. Therefore, according to the present invention, as one means for totaling the virtual analysis values in the entire system, the virtual analysis values are simply totaled by multiplying the analysis values before the architecture change by a predetermined coefficient.

  Here, for example, when the architecture is changed so as to make it redundant, it is possible to estimate that the analysis value such as the failure interval fluctuates at the same magnification, assuming that the number of items constituting the architecture is simply doubled. Therefore, by setting in advance a correction value for the architecture, that is, a coefficient for the architecture after the change, virtual analysis values in the entire system can be easily estimated and aggregated. Further, for example, by adjusting the coefficient in consideration of the function of the subsystem or element and the type of configuration item, the virtual analysis values in the entire system can be aggregated with higher accuracy.

  According to the invention which concerns on Claim 10, a calculating part calculates the contribution degree of the subsystem with respect to the whole system. Here, each subsystem constituting the entire system may have a different degree of influence on the entire system. Therefore, in order to improve the safety level of the entire system, it is difficult to set any subsystem as a correction target and to set an appropriate correction amount for the design parameter or analysis value of the subsystem. Therefore, in the present invention, first, the calculation values are summed up for analysis values in the entire system, assuming that the calculation unit corrects a certain amount of the analysis values or design parameters of the subsystem. Then, the degree of contribution of the subsystem is calculated by comparing the analysis values before and after the correction. The contribution of this subsystem indicates how much the correction to the analysis value or design parameter contributes to the safety level of the entire system.

  As a result, since the safety level becomes the target level for the entire system, the degree of contribution can be selected as an index for a plurality of subsystems to be corrected. Furthermore, an appropriate correction amount can be set based on the degree of contribution for the analysis value or design parameter of the selected subsystem. Therefore, the target safety level of the entire system can be achieved more efficiently.

  According to the eleventh aspect of the present invention, the calculation unit calculates the degree of contribution of elements to the entire system or subsystem. Here, each element forming the subsystem may have different degrees of influence on the subsystem. Therefore, in order to improve the safety level of the entire system and the subsystem, it is difficult to set any element as a correction target and to set an appropriate correction amount for the design parameter or analysis value of the element. Therefore, in the present invention, first, the calculation values are summed up for the analysis values in the entire system assuming that the calculation unit corrects a certain amount of the analysis values or design parameters of the elements. Then, the element contribution is calculated by comparing the analysis values before and after the correction. The contribution of this element indicates how much the correction to the analysis value or design parameter contributes to the safety level of the entire system or subsystem.

  Thereby, in order to achieve the target safety level for the entire system or subsystem, it is possible to select a contribution degree as an index for a correction target from a plurality of elements. Furthermore, an appropriate correction amount can be set based on the magnitude of contribution for the analysis value or design parameter of the selected element. Therefore, the target safety level of the entire system can be achieved more efficiently.

  According to the twelfth aspect of the present invention, the safety level of the entire system is simulated and sequentially displayed on the display unit when the calculation unit continuously changes the design parameter or analysis value to a correction value that increases or decreases by a certain amount. Thereby, the influence of the design parameter or the analysis value on the safety level of the entire system can be visually grasped based on the state of fluctuation of the safety level of the entire system displayed sequentially. This makes it possible to determine which design parameter or analysis value is to be corrected for a plurality of subsystems and a plurality of elements.

  According to the invention of claim 13, the display unit displays the safety level of the entire system in the calculation process and that the calculation unit is in the calculation process. The time required for calculating the safety level of the entire system varies depending on the number of subsystems and elements included in the entire system, the type of architecture, and the like. However, since the analysis values are aggregated in subsystem units and element units, the safety level of the entire system can be simulated and displayed as the current value based on these analysis values. Therefore, when displaying the safety level of the entire system in the calculation process of such a calculation unit, it is preferable that the displayed one is not mistaken as the one when the calculation is completed. Therefore, by adopting the configuration as in the present invention, it is possible to grasp the current state in the calculation process and prevent it from being mistaken for the completion of the calculation.

It is a reliability block diagram which shows the safety related system in embodiment. FIG. 2 is a block diagram illustrating an architecture in a subsystem or element. It is a block diagram which shows a SIL evaluation assistance apparatus. It is a flowchart figure which shows the operation | movement which supports evaluation of the safety level by a SIL evaluation assistance apparatus. It is a table | surface which shows the result (analysis value) of the failure analysis by FMEDA. It is a graph which displays SIL of a whole system, each subsystem, and a selection element. It is a flowchart figure which shows operation | movement of the 1st correction example. It is a flowchart figure which shows operation | movement of the 2nd correction example. It is a flowchart figure which shows operation | movement of the 3rd correction example. It is a table | surface which shows the coefficient in an architecture change. It is a flowchart figure which shows the operation | movement of the 4th correction example. It is a figure which shows selection of the design parameter or analysis value of correction | amendment object. It is a figure which shows SIL of the whole system displayed sequentially when a correction value is input continuously.

  Hereinafter, an embodiment in which a safety level evaluation support apparatus (hereinafter also referred to as “SIL evaluation support apparatus”) of the present invention is embodied will be described with reference to the drawings.

<Embodiment>
(About safety-related systems)
The safety related system will be described with reference to FIGS. The Safety Related System is standardized by the international standard IEC61508, and is classified into four stages of SIL1 to SIL4 according to a safety level (hereinafter, also referred to as “SIL”) that is an index of safety. As shown in FIG. 1, the safety-related system is configured by integrating a plurality of subsystems to which a predetermined function is assigned. In addition, the subsystem is formed by components (components) necessary for exhibiting a predetermined function and devices (hereinafter referred to as “elements”) that are combinations of components.

  The subsystem is a basic component group that is assigned to any of the input unit 10, the logic unit 20, and the output unit 30 of the overall system 1 and constitutes the overall system 1. Although there is a form which does not have a logic part as a safety related system, in this embodiment, it explains as what has logic part 20 as a subsystem. An element is a device that is a combination of components and components necessary for the input unit 10, the logic unit 20, and the output unit 30, which are subsystems, to exhibit predetermined functions. The input unit 10 is formed by input devices 11 to 13, the logic unit 20 is formed by logic devices 21 to 26, and the output unit 30 is formed by output devices 31 to 33.

  As shown in FIG. 1, in the E / E / PES apparatus, when the SIL is determined, the function of the safety-related system and the flow of information are represented by a reliability block diagram. FIG. 1 shows some subsystems constituting the entire system 1 and some elements forming each subsystem. The reliability block diagram is for the purpose of understanding the failure mechanism in the overall system 1 and preparing for failure analysis, and includes information such as assumed failure and redundancy method as design parameters. In the safety-related system, the hardware configuration (architecture) in the subsystem or element is made redundant and diversified in order to ensure safety. As shown in FIG. 2, the architecture of the subsystems and elements is classified into either one according to its configuration. For example, in a redundant architecture, it is expressed as MooN (M out of N) by the total number N of channels constituting redundancy and the number M of channels necessary for ensuring a safety function.

  Further, the architecture has a different calculation formula for the failure rate λ in failure analysis for each type (see IEC61508-6), and affects the SIL of the entire system 1. In the present embodiment, failure analysis by FMEDA (Failure Modes Effects and Diagnostic Analysis) is exemplified as a method for obtaining the safety level of the entire system 1. This FMEDA analyzes the failure mode for each part used in the overall system 1 and calculates the failure rate λ, the safety failure rate SFF, the low-frequency failure rate PFD ( Analysis values such as probability of failure on demand) or high frequency failure rate PFH (probability of dangerous failure per hour) are obtained. At this time, the calculation formula of the failure rate λ is properly used depending on the architecture of the subsystem and the element.

(Configuration of SIL evaluation support device)
Next, the configuration of the SIL evaluation support apparatus 2 will be described with reference to FIG. The SIL evaluation support device 2 is a device that supports the evaluation of the safety level in the safety-related system by simulating the safety level of the safety-related system. And the SIL evaluation assistance apparatus 2 is provided with the memory | storage part 40, the calculating part 50, the display part 60, and the correction | amendment part 70, as shown in FIG.

  The storage unit 40 includes an initial data storage unit 41 and a temporary data storage unit 42. The initial data storage unit 41 stores individual component data used in the overall system 1 and subsystem and element design parameters as initial values. In the present embodiment, the initial data storage unit 41 imports and stores a list of parts and the like from the CAD system that designed the overall system 1. Furthermore, the initial data storage unit 41 stores design parameters such as failure modes and architectures set for individual component data in association with each other. The temporary data storage unit 42 stores component data and design parameter copy data stored in the initial data storage unit 41. Further, the temporary data storage unit 42 stores the failure analysis by FMEDA performed by the calculation unit 50 and the result of the analysis value aggregation, and stores the correction value received by the correction unit 70 described later.

  The calculation unit 50 performs failure analysis by FMEDA based on the design parameters, and simulates the SIL of the entire system 1. The calculation unit 50 includes an FMEDA analysis unit 51, an analysis value totaling unit 52, an SIL calculation unit 53, and a contribution calculation unit 54. The FMEDA analysis unit 51 performs failure analysis by FMEDA based on the subsystem and element design parameters stored in the temporary data storage unit 42 and calculates analysis values in the entire system 1. That is, analysis values are calculated for each of the entire system 1, the subsystem, and the element.

  More specifically, the FMEDA analysis unit 51 analyzes the failure rate and the diagnosis rate in the failure mode for each hardware component that implements the safety function of the overall system 1. Then, when a failure occurs in the entire system 1, it is analyzed whether the failure is a dangerous side or a safe side, and whether the failure is detectable or not detectable. Accordingly, the FMEDA analysis unit 51 calculates four types of failure rates λSD, λSU, λDD, and λDU as analysis values. Here, when the subscript on the left side of the failure rate λ is S, it indicates a safe failure, and when it is D, it indicates a dangerous failure. Further, when the subscript on the right side of the failure rate λ is D, it indicates a detectable failure, and when it is U, it indicates a non-detectable failure. In addition, the analysis value includes a safety failure rate SFF, a low frequency failure rate PFD, a high frequency failure rate PFH, and the like.

  The analysis value totaling unit 52 inputs the initial data related to the subsystems and elements from the temporary data storage unit 42 and the analysis value such as the failure rate λ calculated by the FMEDA analysis unit 51 and totals them. Further, the temporary data storage unit 42 receives and stores the total result from the analysis value totaling unit 52. Further, when the correction value of the architecture in the subsystem or element is input by the correction unit 70, the analysis value totaling unit 52 multiplies the analysis value in the overall system 1 by the coefficient corresponding to the correction value, thereby Aggregate virtual analysis values. This is for enabling the SIL evaluation support apparatus 2 of the present embodiment to perform SIL simulation of the entire system 1 by changing the architecture, and details will be described later.

  The SIL calculation unit 53 inputs the total result from the analysis value totaling unit 52 and calculates the SIL of the entire system 1. The safety level SIL determines the degree of safety of the safety-related system by the failure rate, and is assigned by the value of the failure rate PFD (or PFH) (see IEC61508). In this embodiment, in addition to the SIL of the entire system 1, the SIL of the subsystem and the SIL of the element are also calculated.

  The contribution calculation unit 54 calculates the contribution of each subsystem to the entire system 1 and the contribution of each element to the entire system 1 or subsystem. Here, the degree of contribution of the subsystem or element is the degree of influence on the entire system 1 or subsystem. For example, the contribution degree of an element is how much the correction contributes to the safety level of the overall system 1 when a certain amount of correction is performed on the analysis value or design parameter of each element among a plurality of elements. Is shown. Therefore, the contribution calculation unit 54 calculates the failure analysis result by FMEDA when the analysis value or the design parameter is corrected by a certain amount, and the failure analysis by FMEDA before the correction stored in the temporary data storage unit 42. It is calculated by comparing the total results.

  More specifically, the contribution calculation unit 54 first inputs and holds an initial analysis value from the temporary data storage unit 42. Next, a correction value obtained by adding a certain amount of the design parameter in the subsystem or element whose contribution is to be calculated is set. Then, when the correction unit 70 receives the correction value, the analysis value in the entire system 1 is stored again in the temporary data storage unit 42, assuming that the analysis value of the subsystem or a part of the design parameter is corrected by a certain amount. Tally. Then, the contribution degree calculation unit 54 calculates the contribution degree of the subsystem by comparing the analysis values before and after the correction. Each contribution is acquired by repeating this for the contribution calculation target.

  The display unit 60 is a display unit that displays at least some of the design parameters stored in the temporary data storage unit 42 and the SIL of the entire system 1. In the present embodiment, the display unit 60 displays the design parameters of the subsystems and elements, the total result of the analysis values, and the calculated SIL from the SIL calculation unit 53. Further, in the process of calculating the SIL of the entire system 1 by the calculation unit 50, the display unit 60 temporarily displays the SIL of the entire system 1 based on the subsystem and element analysis values calculated at that time. . However, the display unit 60 also displays that the calculation unit 50 is in the process of calculating SIL. Further, the display unit 60 inputs and displays the contribution degree of each subsystem and each element from the contribution degree calculation unit 54.

  The correction unit 70 receives a correction value for the one displayed on the display unit 60 among the design parameters and analysis values including the subsystem or element architecture from the external input device. Further, as described above, the correction unit 70 also receives a correction value from the contribution degree calculation unit 54 when the contribution degree calculation unit 54 calculates the contribution degree. The correction value received by the correction unit 70 is stored in the temporary data storage unit 42 and used for failure analysis by FMEDA.

  Further, the correction unit 70 inputs design parameters and analysis values of elements or subsystems related to the correction target of the received correction value from the temporary data storage unit 42. Then, when the element or subsystem is corrected with the correction value, the correction unit 70 automatically analyzes the analysis value for the other design parameter so as to maintain consistency with the other design parameter or the analysis value. adjust. More specifically, for example, the total of the four types of failure rates λSD, λSU, λDD, and λDU calculated as analysis values is the failure rate λ × diagnosis rate (DC), and the total of the four types of failure rates λ. The value does not change. Therefore, when correction is made to reduce the failure rate λDU, automatic adjustment is performed to increase the failure rate λDD so that the total value does not change. In addition, when the analysis value of the subsystem is corrected, automatic adjustment is performed so that each design parameter of a plurality of elements forming the subsystem is changed at a constant ratio. Thus, when the automatic adjustment by the correction unit 70 is performed, the other automatically adjusted design parameters or analysis values are stored in the temporary data storage unit 42 and used for failure analysis by FMEDA.

(About FMEDA analysis and safety level)
Next, FMEDA analysis and safety level calculation by the SIL evaluation support apparatus 2 will be described with reference to FIGS. First, as shown in FIG. 4, the SIL evaluation support apparatus 2 imports a list of parts constituting the element from the CAD system that designed the overall system 1 of the safety-related system, and stores it in the initial data storage unit 41 of the storage unit 40. Store (S101). Individual component data used in the overall system 1 is input, and the configurations of elements and subsystems are determined. The SIL evaluation support apparatus 2 inputs element and subsystem design parameters (S102), and stores them in the initial data storage unit 41 together with component data. At this time, the design parameters of the elements and subsystems include a diagnosis rate and an architecture.

  Then, the calculation unit 50 copies the component data and design parameters stored in the initial data storage unit 41 to the temporary data storage unit 42 (S103). This is intended to reliably retain initial data because design parameters and the like may be corrected in the simulation of the safety level of the safety-related system.

  Next, the FMEDA analysis unit 51 of the calculation unit 50 performs failure analysis by FMEDA based on the design parameters (S104). When failure analysis by the FMEDA analysis unit 51 is executed, failure rates λSD, λSU, λDD, λDU, a safety failure rate SFF, a low frequency failure rate PFD, a high frequency failure rate PFH, and the like are calculated as analysis values. The analysis value totaling unit 52 receives the analysis value every time the analysis value is calculated during the execution of the failure analysis by the FMEDA analysis unit 51, and totals the analysis value for each configuration (S105).

  The SIL calculation unit 53 inputs the total result from the analysis value totaling unit 52, and sequentially calculates the SIL of the element or subsystem for which the PFD (or PFH) is calculated. Further, the SIL calculation unit 53 calculates the SIL of the entire system 1 based on the currently aggregated values even if the analysis value aggregation unit 52 is counting the analysis values. The display unit 60 tentatively displays the SIL of the entire system 1 calculated at that time even in the process of calculating the SIL of the entire system 1 by the calculation unit 50. At this time, as shown in the lower part of FIG. 6, the display unit 60 displays a progress display relating to the calculation of the SIL by the SIL calculation unit 53 to indicate that it is in the SIL calculation process. As a result, it is possible to grasp the current state in the calculation process and prevent it from being mistaken for the calculation being completed.

  Then, as shown in FIG. 6, the display unit 60 displays the SIL of the entire system 1 and subsystems in a graph (S106). FIG. 6 shows SILs of the overall system 1 and subsystems, and SILs related to the PFD and PFH of each system. It is also possible to select a specific element and monitor the SIL for that element.

  In the present embodiment, the contribution of each subsystem and each element is further calculated and displayed on the display unit 60 as shown in the right column of FIG. 5 (S107). Therefore, when the SIL calculation unit 53 finishes calculating the SIL of the entire system 1, the contribution calculation unit 54 corrects the correction unit 70 so as to apply a certain amount of correction to one of the design parameters of the elements and subsystems. Enter the correction amount in. The correction unit 70 receives the correction amount from the contribution calculation unit 54 and stores the correction amount in the temporary data storage unit 42.

  Then, the analysis value totaling unit 52 totals the analysis values in the entire system 1 based on the correction value, and the contribution calculation unit 54 inputs the totaling result and compares it with the analysis value before correction. Then, the corrected design parameter is restored, and the correction amount is input to the correction unit 70 so that the same fixed amount of correction is applied to the next design parameter. The contribution degree calculation unit 54 repeats the input of the correction value and the comparison of the analysis value as many times as the number of elements and subsystems for which the contribution degree is to be calculated, and displays the result on the display unit 60.

  Subsequently, when the SIL of the overall system 1 does not achieve the target SIL, an operator of the SIL evaluation support apparatus 2 (hereinafter, also simply referred to as “user”) Then, the design parameter or the analysis value is corrected using the analysis value, the design parameter, and the contribution as an index (S108). Here, various measures can be taken for the correction of the design parameter or the analysis value in the SIL evaluation support apparatus 2. Therefore, details will be described later as a first correction example to a fourth correction example.

(First correction example)
A first correction example will be described with reference to FIG. In this correction example, the user refers to the SIL of the entire system 1 and uses the design parameter or analysis value as a correction target to achieve the target SIL of the entire system 1. First, as shown in FIG. 7, the user checks the SIL of the entire system 1 displayed on the display unit 60 (S201). Here, how much the current SIL is deficient in the target SIL of the entire system 1 is determined based on the SIL value, the analysis value of the entire system 1 displayed on the display unit 60, and the contribution degree of the subsystem or element. Consider based on.

  Then, a correction target and a correction value are set from the design parameter or analysis value of any subsystem or element from the examination result (S202). The input correction value for the correction target is received by the correction unit 70 and stored in the temporary data storage unit 42 (S203). Then, the calculation unit 50 aggregates the analysis values in the entire system 1 based on the correction values, and calculates the SIL of the entire system 1 again based on the correction values (S204). Since the calculation of the SIL of the entire system 1 is the same as that described in S104 to S106, the description thereof is omitted. As a result, the SIL evaluation support apparatus 2 simulates the SIL of the entire system 1 when the design parameter or the analysis value is changed to the correction value, and displays it on the display unit 60 (S205).

  The user refers to the SIL of the entire system 1 after the correction, and determines whether this reaches the target SIL (S206). When the target SIL has not been reached (S206: No), the extent to which the corrected SIL is insufficient for the target SIL is examined again based on the SIL value and the analysis value of the entire system 1. Then, by repeating S203 to S205, the design parameters and analysis values that achieve the target SIL of the overall system 1 are corrected.

  Next, when the SIL of the entire system 1 after the correction has reached the target SIL (S206: Yes), it is determined whether an analysis value is included in the correction target set in S202 (S207). Here, the SIL evaluation support apparatus 2 of the present embodiment enables a simulation in which the analysis values in the overall system 1 are also corrected. However, since the analysis value in the overall system 1 is calculated based on the design parameter or the like, when the analysis value is corrected and the target SIL is achieved, the design parameter is set so that the analysis value becomes the calculation result. Need to be corrected.

  On the other hand, in the SIL evaluation support apparatus 2 according to the present embodiment, for example, when the analysis value of the subsystem is a correction target, the correction unit 70 keeps the design parameters of a plurality of elements forming the subsystem constant. Automatic adjustment is performed to change the ratio. As a result, the consistency between the correction target and other design parameters or analysis values is maintained, but the automatically adjusted design parameters and the like are not necessarily within the appropriate range in terms of design. Therefore, when an analysis value is included in the correction target set in S202 (S207: Yes), final adjustment is performed on the automatically adjusted design parameter (S208). On the other hand, when the analysis value is not included in the correction target (S207: No), or when the final adjustment is performed on the design parameter, the correction is finished.

  According to the first correction example, the correction unit 70 sets the subsystem or element design parameter as a correction target, and when the correction value is input, calculates the SIL of the entire system 1 again. As a result, it is possible to simulate the SIL when correction is performed on any design parameter of the subsystems and elements constituting the overall system 1. Therefore, stepwise correction with elements from the subsystem is possible, and the design parameters can be corrected so that the overall system 1 achieves the target SIL.

  Further, the correction unit 70 sets the analysis value in the entire system 1 as a correction target, and when the correction value is input, the SIL of the entire system 1 is calculated again. The analysis values of the entire system 1 are calculated based on a plurality of design parameters, and the correction to the analysis values is performed by collectively correcting the plurality of design parameters used for calculation of the analysis values. Become. Therefore, the SIL of the entire system 1 can be simulated more efficiently.

  Further, the contribution calculation unit 54 of the calculation unit 50 calculates the contributions of the subsystems and elements. Thereby, in order to become the target SIL of the entire system 1 or the subsystem, it is possible to select a contribution degree as an index for a plurality of subsystems or elements to be corrected. Furthermore, an appropriate correction amount can be set based on the degree of contribution for the analysis value or design parameter of the selected subsystem or element. Therefore, the target SIL of the entire system 1 can be achieved more efficiently.

(Second correction example)
A second correction example will be described with reference to FIG. In this correction example, the user refers to the SIL of the subsystem and the SIL of the element in addition to the SIL of the entire system 1 and uses the design parameters or analysis values as correction targets to achieve the target SIL of the entire system 1. is there. First, as shown in FIG. 8, the user checks the SIL of the entire system 1 displayed on the display unit 60 (S301). Further, the SIL of the subsystem displayed on the display unit 60 is confirmed (S302). Here, as a cause that the current SIL does not reach the target SIL, which subsystem is the cause is examined by using the SIL of the subsystem and the contribution degree of the subsystem or element as an index.

  Then, based on the examination result, which subsystem is to be corrected is set (S303). Next, in the subsystem to be corrected, it is selected whether to correct the design parameters of the subsystem or the design parameters of the elements forming the subsystem (S304). For example, when the SIL improvement of the subsystem is expected by correcting design parameters such as the durability test interval of the subsystem, or when confirming whether the SIL improvement of the subsystem contributes to the SIL improvement of the entire system, Subsystem design parameters and the like are to be corrected (S304: Yes). On the other hand, for example, when the failure rate λ or the diagnosis rate is corrected by correcting the element or the like, the design parameter of the element or the like is set as a correction target (S304: No).

When the subsystem design parameter or the like is to be corrected (S304: Yes), the user sets the correction target and correction value from the design parameter or analysis value using the subsystem SIL or the like as an index (S305).
The input correction value for the correction target is received by the correction unit 70 and stored in the temporary data storage unit 42 (S306). Then, the calculation unit 50 aggregates the analysis values in the entire system 1 based on the correction values, and again calculates the SIL of the entire system 1 and the SIL of the subsystem based on the correction values (S307). Since the calculation of the SIL of the entire system 1 and the SIL of the subsystem is the same as that described in S104 to S106, description thereof is omitted. As a result, the SIL evaluation support apparatus 2 simulates the SIL of the entire system 1 and the SIL of the subsystem when the design parameters of the subsystem are changed to correction values and displays them on the display unit 60 (S308).

  The user refers to the SIL of the subsystem after correction, and determines whether this has reached the target SIL of the subsystem (S309). When the target SIL has not been reached (S309: No), the extent to which the corrected SIL is insufficient for the target SIL is examined again based on the SIL value and the analysis value of the subsystem. Then, by repeating S305 to S308, the design parameters and analysis values for achieving the target SIL of the subsystem are corrected. On the other hand, when the target SIL of the subsystem has been reached (S309: Yes), it is determined whether the calculated SIL of the entire system 1 has reached the target SIL (S310).

  Here, in S304, when an element design parameter or the like is to be corrected (S304: No), the SIL of the element displayed on the display unit 60 is confirmed (S321). Here, as a cause of the current SIL not reaching the target SIL, which element is the cause is examined using the SIL of the element as an index. Then, based on the examination result, a correction target and a correction value are set from a design parameter of any element (S322).

  The input correction value for the correction target is received by the correction unit 70 and stored in the temporary data storage unit 42 (S323). Then, the calculation unit 50 aggregates the analysis values in the entire system 1 based on the correction values, and calculates the SIL of the entire system 1 and the SIL of the elements again based on the correction values (S324). The calculation of the SIL of the overall system 1 and the SIL of the element is the same as that described in S104 to S106, and thus the description thereof is omitted. As a result, the SIL evaluation support apparatus 2 simulates the SIL of the entire system 1 and the SIL of the element when the element design parameters and the like are changed to correction values and displays them on the display unit 60 (S325).

  The user refers to the SIL of the element after correction, and determines whether this has reached the target SIL of the element (S326). When the target SIL has not been reached (S326: No), the extent to which the corrected SIL is insufficient for the target SIL is examined again based on the SIL value and the element analysis value. Then, by repeating S322 to S325, the design parameters and analysis values for achieving the target SIL of the element are corrected. On the other hand, when the target SIL of the element has been reached (S326: Yes), it is determined whether the calculated SIL of the entire system 1 has reached the target SIL (S310).

  In S310, when the SIL of the entire system 1 does not reach the target SIL (S310: No), the SIL value indicating how much the corrected SIL is insufficient for the target SIL, and the analysis value of the entire system 1 Consider based on the above. And by repeating S303-S310, it correct | amends to the design parameter and analysis value which achieve the target SIL of the whole system 1. FIG. On the other hand, when the target SIL of the entire system 1 has been reached (S310: Yes), it is determined whether an analysis value is included in the correction target set in S305 or S322 (S311). If the analysis value is included (S311: Yes), final adjustment is performed on the design parameter (S312). On the other hand, when the analysis value is not included (S311: No), or when the final adjustment is performed on the design parameter, the correction is terminated. Since S311 and S312 correspond to S207 and S208 of the first correction example and are substantially the same, detailed description thereof will be omitted.

  According to the second correction example, the calculation unit 50 calculates the SIL of the subsystem and the SIL of the element. As a result, when selecting a subsystem or element to be corrected, the SIL of the subsystem or the SIL of the element can be used as an index, so that correction for improving the SIL of the entire system 1 can be performed more efficiently. It can be carried out. In addition, when correction is performed on the design parameters of the subsystem, it is possible to simulate whether the correction is useful for each subsystem by checking the SIL of the corrected subsystem. Similarly, when the element design parameters are corrected, by checking the SIL of the element after correction, it is simulated whether the correction performed on the element is useful for each element. Can do. Thereby, the target SIL of the entire system 1 can be achieved more efficiently.

(Third correction example)
A third correction example will be described with reference to FIGS. In this correction example, the SIL of the entire system 1 when the subsystem or element architecture is changed is virtually calculated. Thus, the effectiveness of the architecture change is simulated, and the target SIL of the entire system 1 is efficiently achieved. First, as shown in FIG. 9, the user confirms the SIL of the entire system 1 displayed on the display unit 60 (S401). Further, the SIL of the subsystem displayed on the display unit 60 is confirmed (S402). Here, as a cause that the current SIL does not reach the target SIL, which subsystem is the cause is examined using the SIL of the subsystem and the contribution of the subsystem as an index.

  Then, it is determined from this examination result whether the architecture of any subsystem is to be changed (S403). For example, when the dangerous failure λDU that cannot be detected by increasing the diagnosis rate of the subsystem is reduced and the SIL of the subsystem is expected to be improved, the subsystem architecture is corrected (S403: Yes). On the other hand, for example, when the SIL of the subsystem is improved by making the element configuration redundant, the current state of the subsystem architecture is maintained (S403: No).

  When the subsystem architecture is changed (S403: Yes), the user selects any one of the plurality of subsystems as a correction target based on the SIL of the subsystem (S404). Next, the user sets an architecture to be corrected based on the architecture classification of the current subsystem (S405). For example, when the architecture of the current subsystem is 2oo2, it is possible to add a configuration and set the architecture to change 2oo3.

  The set subsystem architecture is received as a correction value by the correction unit 70 and stored in the temporary data storage unit 42 (S406). Here, since the change of the architecture in the safety-related system changes the design of the hardware, if the number of items forming the architecture increases, the component data and the design parameters of the component that would normally increase are increased. Need to be entered. However, since the SIL of the safety-related system does not always improve with the architecture change, there is a demand for simulation of the effectiveness of the architecture change.

  Therefore, when the correction value of the architecture in the subsystem is input by the correction unit 70, the analysis value totaling unit 52 multiplies the analysis value of the entire system 1 by a coefficient corresponding to the correction value. Thereby, the analysis value totaling unit 52 totals the virtual analysis values in the entire system 1 (S407). Here, the “coefficient according to the correction value” is a coefficient corresponding to the architecture after the change, and is a failure rate coefficient having a value as shown in FIG. For example, when the architecture is changed from 1oo1 to 1oo2, it is assumed that the same configuration is duplicated as shown in FIG. 2, and the coefficient corresponding to the correction value is 2.0. Further, in practice, if the value is changed to 1oo2, the increment of the diagnostic circuit or the like may increase. In this case, this coefficient may be adjusted as appropriate.

  Subsequently, the SIL calculation unit 53 inputs the total result of the virtual analysis value from the analysis value totaling unit 52, and calculates the virtual SIL of the entire system 1 and the virtual SIL of the subsystem based on the virtual analysis value (S408). . As a result, the SIL evaluation support apparatus 2 simulates the virtual SIL of the entire system 1 and the virtual SIL of the subsystem when correction is made to change the subsystem architecture and displays the simulation on the display unit 60 (S409).

  The user refers to the virtual SIL of the subsystem after the architecture change, and determines whether it has reached the target SIL of the subsystem (S410). When the virtual SIL does not reach the target SIL (S410: No), the degree of lack of the virtual SIL after the architecture change is examined again based on the value of the virtual SIL and the virtual analysis value of the subsystem. And you may correct | amend to change to another architecture so that S405-S409 may be repeated. On the other hand, when the virtual SIL of the subsystem has reached the target SIL (S410: Yes), it is determined whether the calculated virtual SIL of the entire system 1 has reached the target SIL (S411).

  Here, when the architecture of the subsystem is not changed in S403 (S403: No), the SIL of the element displayed on the display unit 60 is confirmed (S421). Here, as the cause that the SIL of the current element does not reach the target SIL, which element is the cause is examined using the SIL of the element and the contribution degree of the element as an index. If the SIL improvement of the element is expected due to the change from the examination result, correction is made to change the architecture of any element (S422: Yes). On the other hand, when the current state of the element architecture is maintained (S422: No), this correction is terminated.

  The user selects one of a plurality of elements as a correction target based on the SIL of the element (S423). Next, the user sets an architecture to be corrected based on the architecture classification of the current element (S424). The set architecture of the element is received by the correction unit 70 as a correction value and stored in the temporary data storage unit 42 (S425). When the correction value of the architecture in the element is input by the correction unit 70, the analysis value totaling unit 52 multiplies the analysis value of the entire system 1 by a coefficient corresponding to the correction value. Thereby, the analysis value totaling unit 52 totals the virtual analysis values in the entire system 1 (S426). Here, S424 to S426 are the same as S405 to S407 in the architecture change in the subsystem, and thus description thereof is omitted.

  Subsequently, the SIL calculation unit 53 inputs the total result of the virtual analysis value from the analysis value totaling unit 52, and calculates the virtual SIL of the entire system 1 and the virtual SIL of the element based on the virtual analysis value (S427). As a result, the SIL evaluation support apparatus 2 simulates the virtual SIL of the entire system 1 and the virtual SIL of the element when correction for changing the architecture of the element is performed and displays it on the display unit 60 (S428).

  The user refers to the virtual SIL of the element after the architecture change, and determines whether this reaches the target SIL of the element (S429). When the virtual SIL does not reach the target SIL (S429: No), the degree of lack of the virtual SIL after the architecture change is examined again based on the value of the virtual SIL and the virtual analysis value of the subsystem. And you may correct | amend to change to another architecture so that S424-S428 may be repeated. On the other hand, if the virtual SIL of the subsystem has reached the target SIL (S429: Yes), it is determined whether the calculated virtual SIL of the entire system 1 has reached the target SIL (S411).

  In S411, when the SIL of the entire system 1 does not reach the target SIL (S411: No), the SIL value indicating how much the corrected SIL is insufficient for the target SIL, and the analysis value of the entire system 1 Consider based on the above. And it can correct | amend to the structure which achieves the target SIL of the whole system 1 by changing a some architecture so that S403-S411 may be repeated. On the other hand, when the target SIL of the entire system 1 has been reached (S411: Yes), this correction is terminated.

  According to the third correction example, the correction unit 70 sets the architecture of the subsystems and elements as correction targets. When correction values are input, the virtual analysis values in the entire system 1 are totalized. Then, the calculation unit 50 calculates the virtual SIL of the entire system 1 based on this virtual analysis value. As a result, the simulation can be performed assuming that the architecture of the subsystem or element is changed. Therefore, it can be determined whether or not the change in the architecture of the subsystem or element is effective in improving the SIL of the entire system 1. Accordingly, it is possible to efficiently determine which subsystem of the plurality of subsystems constituting the entire system 1 should be changed. Similarly, it is possible to efficiently determine which element of the plurality of elements constituting the subsystem should be changed in architecture.

  In addition, the calculation unit 50 calculates virtual SILs of subsystems and elements. Changing the architecture of the subsystem or element is an effective means as a correction for improving the SIL of the entire system 1. However, since the SIL of the overall system 1 is calculated based on the design parameters of a plurality of subsystems constituting the overall system 1, it may be difficult to determine the effectiveness of a specific architecture change. The same applies to the element.

  Therefore, when the architecture of the subsystem or element is changed, the virtual SIL of the subsystem or the virtual SIL of the element is calculated based on the virtual analysis value in the entire system 1. Thereby, the virtual SIL of the subsystem related to the architecture change can be confirmed, and the effectiveness of the architecture change for each subsystem or element can be determined. Therefore, the subsystem or element architecture can be changed more efficiently.

  Furthermore, the analysis value totaling unit 52 of the calculation unit 50 totals the virtual analysis values in the entire system 1 by multiplying the analysis values in the entire system 1 by coefficients corresponding to the correction values of the architecture. Thus, by summing up the virtual analysis values in the overall system 1, the virtual analysis values can be summed up more easily. This coefficient is set in advance for the architecture to be changed. For example, the virtual analysis value in the entire system 1 can be adjusted by adjusting the function of the subsystem or element and the type of configuration item. Aggregation can be performed with higher accuracy.

(Fourth correction example)
A fourth correction example will be described with reference to FIGS. In the present correction example, an index for setting a correction target from the design parameters of the subsystem or element and the analysis value in the entire system 1 is provided. As a result, the target SIL of the overall system 1 can be achieved more efficiently. First, as shown in FIG. 11, the user checks the SIL of the entire system 1 displayed on the display unit 60 (501). Further, the SIL of the subsystem and the SIL of the element displayed on the display unit 60 are confirmed (S502). Here, as a cause that the current SIL does not reach the target SIL, which subsystem or which element is the factor is considered as an index.

  For example, when it is not possible to set how much correction value should be set even if the above-mentioned examination is performed, the user can select any design from the total result of the analysis values displayed on the display unit 60 as shown in FIG. A parameter or analysis value is selected as a correction target (S503). Then, as shown in FIG. 13, the display unit 60 displays the SIL of the entire system 1 for the correction target on the horizontal axis and the correction target on the vertical axis. The vertical axis may indicate SIL, PFD, PFH, etc. of the element or subsystem to which the correction target belongs. FIG. 13 illustrates a state where the safety failure rate SFF is selected as a correction target from the design parameters.

  Subsequently, the user presses the “+” display increase button or the “−” display decrease button shown in the lower right of FIG. 13. Accordingly, the correction unit 70 continuously receives correction values that increase or decrease by a certain amount for the design parameter or analysis value set as the correction target (S504). As a result, correction values that change by a fixed amount are stored in the temporary data storage unit 42, and the calculation unit 50 aggregates the analysis values in the entire system 1 based on the correction values, and the SIL of the entire system 1 based on the correction values. Are calculated continuously (S505).

  Then, the display unit 60 sequentially displays the correction value and the SIL of the entire system 1. For example, an “+” display increase button is pressed against the SFF to be corrected, and the value is increased. Then, as indicated by an arrow in FIG. 13, the vertical broken line moves to the right, and the SIL of the entire system 1 corresponding to the value is displayed. As a result, the user can visually grasp the influence of the set correction target on the SIL of the entire system. In this correction example, the relationship between the correction value and the SIL of the entire system 1 is shown as shown in FIG. 13, but may be displayed together with a graph as shown in FIG. 6, for example. When the correction target is continuously corrected, as shown in FIG. 12, the amount of change in the correction target value is displayed as a difference from the original value.

  Then, in consideration of the degree of influence of the correction target, the user determines whether the currently selected design parameter or analysis value is to be corrected (S506). For example, when searching for another design parameter having a higher influence (S506: No), by repeating S502 to S505, a more appropriate design parameter or analysis value is set as a correction target and how much correction is required. You can consider whether to set a value. On the other hand, when the set design parameter or analysis value is to be corrected (S506: Yes), the process proceeds to any of the first to third correction examples described above (S507). In the present correction example, when the correction target and the correction value are sufficiently determined, the other correction (S507) may be omitted. Thus, the main correction is finished.

  According to the fourth correction example, the safety level of the entire system 1 is simulated and sequentially displayed on the display unit 60 when the calculation unit 50 continuously changes the design parameter or analysis value to a correction value that increases or decreases by a certain amount. To do. Thereby, the influence of the design parameter or the analysis value on the SIL of the entire system 1 can be visually grasped based on the state of fluctuation of the SIL of the entire system 1 displayed sequentially. Thereby, it is possible to immediately determine which design parameter or analysis value is to be corrected for the plurality of subsystems and the plurality of elements.

(Other correction examples)
The SIL evaluation support apparatus 2 can more efficiently achieve the target safety level by performing the correction as described above. These corrections can also be performed in combination as shown in the fourth correction example. For example, after the subsystem design parameters are to be corrected, the element design parameters may be further corrected, and if the target SIL is still not reached, the architecture change may be attempted.

  In the present embodiment, the SIL evaluation support apparatus 2 has been described by exemplifying various correction examples for the purpose of achieving the target SIL by the safety-related system. On the other hand, in the safety-related system that has already achieved the target SIL, the SIL of the safety-related system may be evaluated for the purpose of checking whether there are subsystems or elements that are redundant more than necessary. . By such an evaluation method, for example, the number of parts in the circuit can be reduced, and the size can be reduced.

1: Overall system 2: SIL evaluation support device (safety level evaluation support device)
10: Input unit (subsystem), 11-13: Input device (element)
20: Logic part (subsystem), 21-26: Logic devices (elements)
30: Output unit (subsystem), 31-33: Output device (element)
40: storage unit, 41: initial data storage unit, 42: temporary data storage unit, 50: calculation unit, 51: FMEDA analysis unit, 52: analysis value aggregation unit, 53: SIL calculation unit, 54: contribution calculation unit, 60: display Part, 70: correction part

Claims (13)

A safety level evaluation support device for a safety-related system,
The safety-related system is configured as an overall system by integrating a plurality of subsystems,
Each of the subsystems is formed by a plurality of elements, and is assigned to any of an input unit, a logic unit, and an output unit of the overall system,
The safety level evaluation support device includes:
A storage unit for storing design parameters of the subsystem and the element;
A total of analysis values including failure rates in the overall system based on the design parameters, and a calculation unit that calculates a safety level of the overall system based on the analysis values;
A display unit for displaying at least a part of the design parameters stored in the storage unit and a safety level of the overall system;
A correction unit that receives a correction value of the design parameter displayed on the display unit;
With
The display unit includes at least one of the safety level of the subsystem and the contribution of the subsystem to the overall system, and the safety level of the element and the contribution of the element to the overall system or the subsystem. One of them is further displayed as an index of the selection of the design parameter to be corrected and the correction amount,
When the correction value of the design parameter is input by the correction unit, the calculation unit aggregates the analysis value in the entire system based on the correction value, and determines the safety level of the entire system based on the analysis value. A safety level evaluation support apparatus that calculates again and simulates the safety level of the overall system when the design parameter is changed to the correction value and displays the simulation level on the display unit. In claim 1,
The calculation unit performs a failure analysis based on a design parameter to calculate the analysis value, and calculates a safety level of the overall system based on a total result of the analysis value,
In addition to the design parameters , the display unit displays at least a part of the analysis values in the overall system calculated in failure analysis ,
The correction unit receives the design parameter and the correction value of the analysis value displayed on the display unit,
When the correction value of the analysis value is input by the correction unit, the calculation unit aggregates the analysis value in the overall system based on the correction value, and determines the safety level of the overall system based on the analysis value. A safety level evaluation support apparatus that calculates again and simulates the safety level of the whole stem when the analysis value is changed to the correction value and displays the simulation level on the display unit. In claim 1 or 2,
The safety level evaluation support apparatus in which the arithmetic unit further calculates a safety level of the subsystem based on the analysis value in the entire system, and displays the safety level of the subsystem on the display unit. In any one of Claims 1-3,
The safety level evaluation support apparatus in which the arithmetic unit further calculates a safety level of the element based on the analysis value in the overall system, and displays the safety level of the element on the display unit. In any one of Claims 1-4,
Wherein the subsystem design parameters of Ri Sadama by the configuration of the subsystem, and the calculation formula of the failure rate in the failure analysis for each its kind contain different architectures,
The correction unit receives a correction value indicating a change in the architecture type in the subsystem;
When the correction value of the architecture in the subsystem is input by the correction unit, it is assumed that the configuration of the subsystem is changed, and the calculation unit performs virtual analysis in the entire system based on the correction value. The values are aggregated, the virtual safety level of the entire system is further calculated based on the virtual analysis value, and the virtual safety level of the entire system when the architecture is changed to the correction value is simulated and displayed. Safety level evaluation support device to be displayed in the department. In any one of Claims 1-5,
The said design parameters of the elements Ri Sadama the configuration of the elements, and the calculation formula of the failure rate in the failure analysis for each its kind contain different architectures,
The correction unit accepts a correction value indicating a change in the architecture type in the element;
When the correction value of the architecture in the element is input by the correction unit, it is assumed that the configuration of the element is changed, and the calculation unit calculates a virtual analysis value in the entire system based on the correction value. The virtual safety level of the whole system is further calculated based on the virtual analysis value, and the virtual safety level of the whole system when the architecture is changed to the correction value is simulated and displayed on the display unit. Safety level evaluation support device to display. In claim 5 or 6,
The safety level evaluation support device, wherein the arithmetic unit further calculates a virtual safety level of the subsystem based on the virtual analysis value in the entire system, and displays the virtual safety level of the subsystem on the display unit. In claim 6,
The safety level evaluation support apparatus in which the arithmetic unit further calculates a virtual safety level of the element based on the virtual analysis value in the entire system, and displays the virtual safety level of the element on the display unit. In any one of Claims 5-8,
When the correction value of the architecture is input by the correction unit, the arithmetic unit multiplies the analysis value in the overall system by the coefficient corresponding to the correction value, thereby calculating the virtual analysis value in the overall system. Safety level evaluation support device for aggregation. In any one of Claims 1-9,
The calculation unit aggregates the analysis values in the overall system when a predetermined amount is corrected for at least a part of the analysis values or the design parameters related to the subsystem, and the analysis values before and after the correction are calculated. By comparing, the contribution of the subsystem to the overall system is calculated,
A safety level evaluation support apparatus that displays the contribution degree of the subsystem on the display unit. In any one of Claims 1-10,
The calculation unit aggregates the analysis values in the overall system when a predetermined amount of at least a part of the analysis value or the design parameter related to the element is corrected, and compares the analysis values before and after the correction To calculate the contribution of the element to the overall system or the subsystem,
A safety level evaluation support apparatus for displaying the contribution degree of the element on the display unit. In any one of Claims 1-11,
The correction unit continuously receives correction values that increase or decrease by a certain amount for the design parameter or the analysis value,
When the correction value is continuously input by the correction unit, the calculation unit aggregates the analysis values in the overall system based on the correction values, and determines the safety level of the overall system based on the analysis values. A safety level evaluation support apparatus that calculates the safety level of the entire system when the design parameter or the analysis value is continuously changed to the correction value, and sequentially displays the safety level on the display unit. In any one of Claims 1-12,
The display unit displays a safety level of the overall system currently calculated in the calculation process of the safety level of the overall system by the calculation unit, and a safety indicating that the calculation unit is in the calculation process. Level evaluation support device.

Images