4.1 Before proceeding with a detailed FMEA into
the effects of the failure of the system elements on the system functional
output it is necessary to perform a functional failure analysis of
the craft's important systems. In this way only systems which fail
the functional failure analysis need to be investigated by a more
detailed FMEA.
4.2 When conducting a system FMEA, the following
typical operational modes within the normal design environmental conditions
of the craft shall be considered:
-
.1 normal seagoing conditions at full speed;
-
.2 maximum permitted operating speed in congested
waters; and
-
.3 manoeuvring alongside.
4.3 The functional interdependence of these systems
shall also be described in either block diagrams or fault-tree diagrams
or in a narrative format to enable the failure effects to be understood.
As far as applicable, each of the systems to be analysed is assumed
to fail in the following failure modes:
-
.1 complete loss of function;
-
.2 rapid change to maximum or minimum output;
-
.3 uncontrolled or varying output;
-
.4 premature operation;
-
.5 failure to operate at a prescribed time; and
-
.6 failure to cease operation at a prescribed
time.
Depending on the system under consideration, other failure modes
may have to be taken into account.
4.4 If a system can fail without any hazardous
or catastrophic effect, there is no need to conduct a detailed FMEA
into the system architecture. For systems whose individual failure
can cause hazardous or catastrophic effects and where a redundant
system is not provided, a detailed FMEA as described in the following
paragraphs shall be followed. Results of the system functional failure
analysis shall be documented and confirmed by a practical test programme
drawn up from the analysis.
4.5 Where a system, the failure of which may cause
a hazardous or catastrophic effect, is provided with a redundant system,
a detailed FMEA may not be required provided that:
-
.1 the redundant system can be put into operation
or can take over the failed system within the time-limit dictated
by the most onerous operational mode in 4.2 without hazarding the
craft;
-
.2 the redundant system is completely independent
from the system and does not share any common system element the failure
of which would cause failure of both the system and the redundant
system. Common system element may be acceptable if the probability
of failure complies with section 13;
and
-
.3 the redundant system may share the same power
source as the system. In such case an alternative power source shall
be readily available with regard to the requirement of .1.
The probability and effects of operator error to bring in the
redundant system shall also be considered.