Quantitative Analysis for Multi-Point Failures
This article examines how quantitative analysis can be used to evaluate multi-point failures in redundant automotive safety architectures. It explains the probability of simultaneous and ordered failures, connects those calculations to ISO 26262 PMHF targets, and shows how they can inform defensible diagnostic and service intervals. It was written by an SRES senior systems and safety expert with more than 25 years of experience across automotive, aerospace, and other safety-critical industries. Their expertise spans systems and hazard analysis, failure analysis, embedded controls, autonomy, and functional safety.
Looking to go deeper? Explore our training programs, including ISO 26262 Functional Safety Certificate Training (AFSP). Need support beyond training? Explore our consulting services.
Introduction
The use of redundancy is a trusted design solution to mitigate single-point failures in safety-critical systems, especially where continued operation is desired (instead of simply shutting down). The use of redundancy dramatically reduces the probability of system failure, but the mathematics can sometimes be imposing and counterintuitive.
This blog discusses the mathematics of dual-point failure probability and how those computations can be used to evaluate a design for acceptable risk.
Recall that there are two typical situations involving dual-point failure:
| Situation | Multi-point considerations for the situation |
|---|---|
| Backup system B fails before it needs to be used, then the primary system A fails. | The hazardous condition manifests when system A fails because system B is not available as a backup. The risk is associated with the amount of time B is not operational—that is, the probability that A fails sometime after B has failed. |
| Backup system B is operational and the primary system A fails. Then, before system A is repaired, system B fails. | The hazardous condition manifests when system B fails because system A has already failed. The risk is associated with the amount of time subsystem A is not operational. |
Risk is quantified by determining the probability that either A fails after B fails or that B fails after A fails, over the life of the vehicle. Without loss of generality, we can consider just the situation where A fails after B. Graphically we can show the progression:
The key safety engineering questions are:
- Do we have an acceptably low overall probability that both systems are in a failed state at the same time, over the expected life?
- Do we have an acceptably low probability that, given one system fails, the other will fail within some time of being detected? Or put another way: what is the longest the system should be operated with one system failed, so the risk of both being failed is low enough?
To answer these questions, we need some mathematical tools.
Review of Two-Element Failure Statistics
For a constant failure-rate model, we have probability R of an element surviving until time t, and correspondingly probability of failure (PoF) at or before time t:
R = e−λt
PoF = 1 − e−λt
Where λ is the continuous failure rate for the element.
Systems with two redundant paths have a straightforward computation for the effective probability of failure. Consider a system with two elements, A and B. There are four independent combinations which can be combined into various overall probabilities:
- Both elements survive
- A survives, B fails
- A fails, B survives
- Both A and B fail
These expressions can be visualized graphically by noting that the probabilities are equivalent to areas of sub-sections of a unit square. This gives rise to various combinations, such as if A and B fail, if A or B fails, or if only one of A or B fails, by summing the individual areas.
The mathematical formulae for each quadrant are:
| Quadrant | Exact Probability | Small-value approximation |
|---|---|---|
| Both Survive | PSA,SB = SASB = e−λAte−λBt = e−(λA+λB)t | PSA,SB = (1 − λAt)(1 − λBt) |
| Only A Fails / Only B Survives | PFA,SB = FASB = (1 − e−λAt)e−λBt | PFA,SB = (λAt)(1 − λBt) |
| Only B Fails / Only A Survives | PSA,FB = SAFB = e−λAt(1 − e−λBt) | PSA,FB = (1 − λAt)(λBt) |
| Both Fail | PFA,FB = FAFB = (1 − e−λAt)(1 − e−λBt) | PFA,FB = (λAt)(λBt) |
PB after A = ∫0t ∫ut λAe−λAuλBe−λBv dv du
= λA / (λA + λB) (1 − e−(λA+λB)t) − e−λBt(1 − e−λAt)
The structure of this expression is a scaled form of “A, B, or both failed” minus the portion that is “only A failed.” The log-log plot shows the probability of the situation as a function of time. In this plot, λA = 1 × 10−7 and λB = 0.5 × 10−7, which are typical failure rates for automotive systems.
This illustrates that the probabilities of failure for short time periods are very low, less than 10−8. Note also that the probability of B after A is a relatively fixed fraction of A AND B; in fact, this ratio is exactly ½ at t = 0 and remains close to ½ until large times, settling at λA / (λA + λB) at large times. This can be shown by taking the ratio of the two expressions and using properties of limits for indeterminate forms as t approaches 0. For the automotive range of failure rates and lifetimes, using ½ the probability of both failing is a conservative approximation.
Once we know the probability of ordered failure, we need to characterize the probability of how much time passes between each failure: the probability that a failure occurs within some time of another failure. For example, if element A fails and we are operating in a degraded mode for a time d, what is the probability B fails during that interval? This is a critical value for evaluating suitability of a design for diagnostic and service intervals.
To find this expression, we start with a similar analysis for determining the probability of B after A, but add in the criteria that B fails not just any time after A, but no earlier than some interval d after A.
PB, d or more after A = ∫0t−d ∫u+dt λAe−λAuλBe−λBv dv du
= λA / (λA + λB) e−λBd(1 − e−(λA+λB)(t−d)) − e−λBt(1 − e−λA(t−d))
Note that this expression is only valid for times t ≥ d, because if the total time t is less than d then, by definition, B cannot have failed d or more later than A; if t ≤ d, the probability is uniformly 0.
This expression allows us to determine the probability that B fails after A, but before a time interval d has elapsed. This follows from the fact that the probability of B failing after A must be the sum of B failing after A before d has passed and B failing after A after d has passed:
PB, within d of A = PB after A − PB, d or more after A
Note that this illustrates how the condition of B failing within a short period after A is a small portion of the overall probability of B failing after A. Zooming in, we can compare this with the expression from ISO 26262-2018 part 10, clause 8.3.2.4 which approximates the probability of failure as the probability that A has failed by time t, then multiplying the “exposure” or probability that B fails within a timespan of d.
Notably the approximation is very reasonable at time-in-service well beyond the interval of interest d but at small time-in-service the approximation suggests a higher-than-actual probability of failure. This is therefore a conservative estimate.
This formula, for the probability that B fails within a time d after A fails, allows us to answer the question of what is an acceptable operating time (time d in this example) if one element has failed: we pick a value for d where the overall probability is within the acceptable thresholds for the determined integrity level.
A note on PMHF versus actual probability of failure:
All the expressions above are in terms of probability, which is different from the ISO 26262 PMHF metric. The PMHF metric takes the probability over some timeframe, typically the operating life, and divides by that operating life, to obtain an “average failure rate” over the lifetime. Since the probability of failure with respect to time for a multi-element system is not constant, the PMHF is a function of time.
Also note that care must be taken to use a consistent denominator for the computation of PMHF.
Putting it into Practice
The utility of these expressions, in their exact or approximate forms, is in their ability to argue for the acceptable probability of hazardous failures as improved by adding redundant elements to the system. These expressions can also be used to establish allowable limits for service intervals based on an acceptable probability of failure during the service interval.
We had two questions to answer, and now have the tools to argue for acceptable risk for a given design based on redundancy:
For an overall acceptable failure rate:
- Determine the acceptable PMHF target based on ASIL, PMHFTarget.
- Compute the probability of both elements in the system failing over the target lifetime, and divide by the lifetime. PMHFActual = PBoth(TLife) / TLife.
- If PMHFActual ≤ PMHFTarget, we have a claim for acceptable risk. Otherwise, design changes or operating-time restrictions must be applied.
For an acceptable failure rate when one element of a system fails:
- Determine the acceptable PMHF target based on ASIL.
- Convert the PMHF into an acceptable probability by multiplying the target by the operating life. Ptgt = PMHF × TLife.
- Compute the probabilities of one element failing within a time interval d, over a range of values for d. PA within d of B(TLife, d).
- Select a value for d, or a range of values, such that the probability of one element failing within d of the other is less than the acceptable probability from the earlier step. That is, select d such that PA within d of B(TLife, d) ≤ Ptgt.
- Specify a combination of diagnostic test interval (e.g., runtime check interval) and service interval after fault detection, such that Tdiagnostic + Tservice ≤ d. Note: If the probability cannot be reduced to an acceptable level within a reasonable interval, design changes or operating-time restrictions must be applied. Also note that this formulation often shows that an acceptable interval may be fairly long and a shorter interval may be selected for other reasons such as customer experience, rather than being limited by safety considerations.
Have insights or questions? Send us an email at info@sres.ai or leave a comment below—we welcome thoughtful discussion from our technical community.
Interested in learning more about our approach? Explore why teams choose SRES training and how we support organizations with consulting for automotive and physical AI applications.
