Safety and MBSA (Model Based Safety Assessment): evaluation of an aeronautical brake control system

The safety assessment represents a key aspect to consider during the design and development of a complex system, especially in the aerospace domain. Nowadays the traditional methods (Fault trees, FMEA, HAZOP) used for the qualitative and quantitative analyses reveal several drawbacks, for example the large investment of time needed to perform the safety assessment of a single system architecture. MBSA (Model Based Safety Assessment) is a new method to elaborate the dysfunctional models of complex systems by using block diagrams. In the context of digitalization and constant innovation, MBSA finds interesting applications in several phases of the safety assessment process in order to substitute the traditional methods and tools, in particular the fault trees. The main advantage of MBSA is the possible reuse of parts of the models in future projects that leads to faster safety analyses. MBSA offers two different approaches: System Design Model Enrichment and Direct Safety Model Elaboration. The first approach consists in a Model Based Systems Engineering model who is “enriched” with safety parameters. This kind of model allows only partial safety analysis. On the other hand, the Direct Safety Model Elaboration is based on the elaboration of a specific model for safety analysis by the use of a safety modelling language, like the Altarica language. In this way, it is possible to obtain more precise results. An application of the Direct Safety Model Elaboration is presented. Through the use of the software Simfia Neo, a MBSA model of a brake control system of a landing gear has been elaborated. This model, written in Altarica language, allows the illustration of the failure propagation in the system architecture, the identification of the Minimal Cut sets and the computation of the probability of the failure condition analysed, that is the total loss of braking. The results obtained through the MBSA model of the brake control system demonstrate a realistic failure propagation in the system architecture and the correct identification of a large number of Minimal cut sets; on the other hand, the absence of all the redundancies and reconfigurations of the real system into the model limits the precision of the results. Even though its application in the Preliminary System Safety Assessment needs further studies, MBSA currently represents a valid alternative to the fault trees during the architecture trade-off phase.