Pith. sign in

REVIEW 4 major objections 4 minor 33 references

SIL Allocation for Mitigation Safety Functions

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proposes a method that sets target PFDs for mitigation safety functions by enumerating every possible subsystem state and comparing the resulting consequence frequencies to tolerable limits.

desk verdict A useful, spreadsheet-implementable SIL allocation method for mitigation functions, but the paper overclaims independence from dependencies and contains an internal numeric inconsistency. read the letter →

arxiv 2506.02309 v2 pith:KDQEY6XZ submitted 2025-06-02 eess.SY cs.SY

Hamid Jahanian This is my paper
classification eess.SYcs.SY
keywords SafetyIntegrityLevelSILallocationMitigationfunctionProbabilityofFailureonDemandStateenumerationEventtreeanalysisFunctionalRoadtunnelfire
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SIL allocation has mostly been designed for preventive functions, which stop a hazardous event before it happens, while mitigation functions, which reduce consequences after the event, have lacked a dedicated allocation method. This paper proposes a method that sets the target probability of failure on demand (PFD) for a mitigation function by enumerating every possible availability state of the subsystems that carry the function and its neighbours, then comparing the resulting consequence frequencies with tolerable limits. The approach handles multiple consequence severity categories and lets functions share subsystems, the two features the paper identifies as breaking simpler methods such as layer-of-protection analysis and event tree analysis. In a road tunnel fire case study with ten subsystems and five mitigation functions, the method yields a target PFD of 4E-03 (SIL2) for automatic smoke extraction.

What carries the argument

The machinery is a state-enumeration calculation built from five matrices. The system-state matrix $\Psi$ lists all $2^l$ binary availability rows for the $l$ subsystems; the subsystem-to-function mapping $F$ specifies which subsystems each function requires; the function-state matrix $\Phi$ is derived from $\Psi$ and $F$ by a conjunction rule that marks a function successful exactly when all its required subsystems are available; the state-consequence matrix $\Gamma$ is filled by analyst-defined logic functions $\gamma_h(\Phi_i)$ that assign each function-success pattern to one of $n$ consequence segments; and the state-frequency vector $\omega$ computes each state's frequency as $w_{\mathrm{HE}} \prod_j [\psi_{ij}(1-p_j) + (1-\psi_{ij})p_j]$, where $p_j$ is the subsystem's probability of failure on demand and the subsystems are assumed to be independent. The consequence-segment frequency vector $w = \omega^\top \Gamma$ is compared with tolerable segment frequencies, and the candidate function's PFD entries are reduced iteratively until every segment, or the collective risk, is within tolerance. The final values of $p$ give the target PFDs for the function's subsystems.

What would settle it

Re-running the tunnel case with a joint failure probability of a few percent coupling LHD and FDP will push the Catastrophic consequence frequency above the 0.001-per-year tolerance at the claimed target PFD of 4E-03, which can be checked against field data for correlated unavailability.

Watch

Extended reading notes

Core claim

The paper claims that for mitigation safety functions, the target PFD should not be estimated by condensing many outcomes into a single hazardous-event frequency, as preventive-function methods do, but by modelling the full post-event system. The mitigation system consists of $l$ subsystems, and at the moment the hazardous event occurs those subsystems are in exactly one of $2^l$ binary availability states; each state renders some mitigation functions successful and others failed, and an analyst-defined logic function maps each state to a consequence segment. The frequency of each state is the hazardous-event frequency times the product of per-subsystem availability terms built from each subsystem's PFD, and summing these state frequencies within each consequence segment gives the estimated segment frequency. The target PFD is the value, found by iteratively lowering the candidate function's PFD entries, at which every estimated segment frequency lies below its tolerable frequency, or alternatively the collective risk lies below the collective tolerance. Because all states are enumerated, the method requires no event trees and allows functions to share subsystems, which the paper presents as the two limitations of current practice.

Load-bearing premise

The whole calculation rests on the assumption that the subsystems fail independently: the frequency of any system state is computed by multiplying each subsystem's availability probability, so shared power supplies, common maintenance, or common-cause failures between subsystems would make every resulting target PFD wrong.

Editorial extensions

If this is right

  • For fire and gas systems and other mitigation functions that share subsystems, the target PFD can be derived from a single state enumeration instead of separate event trees, so the result is consistent across all functions and outcome categories.
  • The method produces target PFDs that respect per-segment risk criteria such as 'Catastrophic consequences no more often than 0.001 per year', and can also handle a single aggregated risk limit with weighted consequence severities.
  • A target PFH for high-demand mitigation functions follows from the target PFD via the standard relation $P_\mathrm{FH} = 2 P_\mathrm{FD}/\tau$, so the same state enumeration covers continuous- and high-demand safety functions.
  • Because the calculation is matrix-based and uses only spreadsheet operations, it can be applied without commercial fault-tree or event-tree software, lowering the barrier to formal SIL allocation for mitigation scenarios.
  • The case study shows the method is actionable at realistic scale: with ten subsystems the 1024 states are generated mechanically, and the iterative PFD search converges to a target of 4E-03 (SIL2) for automatic smoke extraction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The independence assumption is load-bearing for the product in Eq. (16), so the paper's claim that the method is 'not limited by the independence condition' should be read narrowly: it removes the need for protection layers to be failure-independent in the event-tree sense, but not the need for subsystem unavailability events to be statistically independent.
  • The state enumeration is exponential in the number of subsystems, so applying the method to very large systems would require compression techniques (for example, binary decision diagrams or lumping equivalent states), a scaling question the paper leaves open.
  • The target PFD is sensitive to how each function's degree of success is dichotomised (e.g., the threshold for a ventilation damper 'successfully opened'), since that threshold determines the state-consequence logic functions; different defensible thresholds would yield different target PFDs.
  • The same machinery could be extended to optimise the apportionment of the target PFD across a function's subsystems under cost constraints, which the paper names as future work.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a quantitative method for allocating a target PFD (and hence SIL) to mitigation safety functions. The method enumerates all 2^l availability states of l subsystems, maps subsystem states to mitigation-function success/failure via a Boolean mapping matrix F, maps function states to consequence segments via analyst-defined logic functions, and computes consequence frequencies as w = ω^T Γ, where each state frequency is w_HE times a product of subsystem availability probabilities. The target PFD is found by iterating the PFDs of the candidate function's subsystems until the estimated consequence frequencies satisfy either per-segment or collective risk tolerances. A road-tunnel fire case study with 10 subsystems and 5 mitigation functions illustrates the calculation, yielding a target PFD for the Automatic Smoke Extraction function.

Significance. The paper's contribution is a transparent, spreadsheet-implementable procedure for a problem that is indeed less standardized than SIL allocation for preventive functions. Its formal separation of subsystems, functions, and consequence segments, together with the explicit enumeration of system states, is a useful alternative to hand-built event trees, and it does capture functional coupling that arises from shared subsystems. The derivations in Equations (9)-(23) are internally consistent under the stated assumption of independent subsystems, and the case study walks through the calculation completely. The main weaknesses are overbroad claims about handling dependencies and analysis scale, and an inconsistency in the reported numerical result. If these are corrected, the method can be a practically useful tool for practitioners.

major comments (4)
  1. [Section 3 vs. Sections 2 and 6.1] The method's central frequency computation, Equation (16), uses the product formula for the probability of a system state, which is valid only when the l subsystems fail independently. This is acknowledged in footnote 2 of Section 3. However, Section 2 claims the method applies "regardless of analysis scale or subsystem dependencies," and Section 6.1 claims it is "not limited by the independence condition." The mapping matrix F captures functional coupling through shared subsystems, but it does not capture statistical dependence between subsystem failures, such as common-cause failures, shared power supplies, or common maintenance. Under any such dependence, Equation (16) is invalid and the resulting target PFD is biased. The paper should either restrict its claims to independent subsystems or extend the model to include joint failure probabilities.
  2. [Section 2 and Section 6.1] The claim of applicability "regardless of analysis scale" is not supported by the proposed method, which enumerates all 2^l system states and builds matrices of size 2^l × l. For l = 10 the case study has 1024 states, which is manageable, but for l = 20 the state space exceeds one million, and for larger systems the approach quickly becomes impractical. The paper should state the exponential complexity as a limitation rather than claiming scale independence.
  3. [Section 4 vs. Section 6.2] The case study reports a target PFD of p = 4E-03 in Section 4 and states that this is within the SIL2 range, but Section 6.2 says "the target PFD was calculated as 2.1E-03" for the same case study. These two values cannot both be the output of the same calculation. The inconsistency is load-bearing because the target PFD is the paper's central result; the calculation should be repeated and a single value reported consistently in both sections.
  4. [Section 4, Equation (24)] The p vector in Equation (24) is difficult to parse: it appears to contain eleven entries for a system defined as having ten subsystems, and the spacing in "0.2 p" is ambiguous. Since the case-study result depends directly on this apportionment, the vector should be written with explicit subsystem labels and unambiguous comma-separated entries, e.g., [p_LHD, p_FDP, ...].
minor comments (4)
  1. [Abstract and Section 1] The abstract and introduction say the method addresses "independence between mitigation subsystems," while Section 3 assumes independence of subsystems. The terminology should be harmonized: the method handles shared subsystems (functional coupling) but not statistical dependence, and this distinction should be stated clearly from the outset.
  2. [Section 3, notation] The symbols w and w (estimated versus tolerable consequence frequency vectors) are visually almost indistinguishable in the typeset text. Please use a different notation, such as a hat or bar, to avoid confusion in Equations (19)-(23).
  3. [Section 6.1] There is a typo in "because of the the way in which FTA tools often calculate top event frequencies"; remove the duplicated "the."
  4. [Figure 2] Figure 2 is referenced as a summary of the risk estimation process, but it is not described in the text. Please add a brief caption and a sentence explaining how its blocks correspond to Equations (9)-(23).

Circularity Check

0 steps flagged · score 1.0 of 10

No material circularity: the target PFD is the designed solution of the stated risk inequalities, and the two self-citations are not load-bearing.

full rationale

The derivation chain is a forward risk model (Eqs. 6-19) followed by an iterative search over the candidate SF's PFD until the segment-wise or collective risk inequalities (21)/(23) are satisfied. The final p is not an independent quantity that is "predicted"; it is, by construction, the value that closes the gap between estimated and tolerable risk, so the loop is not circular. No equation assumes the target PFD as an input. The two self-references ([17] in the survey of optimization methods, and [33] for the standard single-component PFH relation) do not supply any load-bearing premise. I also examined the independence-related claims: footnote 2 and Eq. (16) explicitly require subsystem independence, while Section 6.1 states the method is "not limited by the independence condition"; this is a correctness/overclaim gap, not a circular step, because the assumption is stated rather than concealed. Similarly, Section 6.2's target PFD of 2.1E-03 does not match the case study's 4E-03 derived earlier; this is an internal numerical inconsistency, not circularity. Neither issue causes a derivation step to reduce to its own input.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The method is a normative allocation procedure, so the target PFD is by construction chosen to meet risk criteria. The main uncharged inputs are the subsystem-independence assumption, the analyst-defined Gamma mapping, the assumed wHE, and the experience-based p values for non-target subsystems. These should be tested or justified in practice.

free parameters (5)
  • Target PFD p for ASE function = 4E-03 (Section 4); 2.1E-03 (Section 6.2)
    Chosen iteratively until consequence frequencies satisfy Eq. (21); the two reported values conflict.
  • Apportionment of ASE PFD across LHD/FDP/PCS/TVS = 25% / 20% / 20% / 35%
    Set from 'industry experience' in Section 4; determines how the scalar p enters the subsystem PFD vector.
  • PFD values of non-target subsystems (IAD, TOp, OMS, FSS, EMS, TUs) = 0.05, 0.1, 7E-04, 0.04, 0.02, 0.2
    Assigned as 'realistic, conservative' estimates in Section 4; no data or uncertainty provided.
  • Frequency of fire wHE = 0.7 per year
    Assumed case-study input in Section 4; no basis or uncertainty given.
  • Tolerable consequence frequencies w = [0.001, 0.01, 0.1, 1, 10] per year
    Risk criteria in Table 1, adjusted for confidentiality; no derivation given.
assumptions (6)
  • domain assumption Subsystems are statistically independent.
    Footnote 2 says 'Subsystems are assumed to be independent of each other'; Eq. (14)/(16) multiply per-subsystem availability probabilities, so this assumption is required for the state frequencies.
  • domain assumption The hazardous event frequency wHE is independent of subsystem states.
    Eq. (16) multiplies wHE by state probabilities; demand and subsystem availability are treated as independent, which is typical for low-demand systems but not stated as a condition.
  • domain assumption Each system state maps to exactly one consequence segment.
    For w = omega^T Gamma (Eq. 19) to be a valid frequency distribution, each row of Gamma must contain a single 1; the paper does not state this explicitly, though the case-study gamma functions satisfy it.
  • domain assumption Analyst-defined logic functions gamma_h correctly represent consequences.
    Eq. (12) delegates consequence assignment to the analyst; target PFD depends directly on this subjective mapping.
  • domain assumption PFD values for non-target subsystems are known and fixed.
    Section 4 sets IAD, TOp, OMS, FSS, EMS, TUs PFDs 'based on prior experience' with no uncertainty; these constants affect the estimated risk and hence the target PFD.
  • domain assumption Tolerable consequence frequencies w are the correct risk criteria.
    The allocation result is defined relative to these thresholds; no derivation or regulatory source is given beyond the confidentiality-adjusted Table 1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SIL Allocation for Mitigation Safety Functions." pith.science (2026). https://pith.science/paper/KDQEY6XZ

@misc{pith2026250602309,
  author       = {Pith},
  title        = {Pith review of: SIL Allocation for Mitigation Safety Functions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KDQEY6XZ}},
  note         = {Machine review of arXiv:2506.02309}
}
read the original abstract

SIL (Safety Integrity Level) allocation plays a pivotal role in evaluating the significance of Safety Functions (SFs) within high-risk industries. The outcomes of a SIL allocation study determine the design specifications necessary to uphold the Probability of Failure on Demand (PFD) below permissible limits, thus managing risk effectively. While extensive research has focused on SIL allocation for preventive SFs, there is a noticeable gap in attention towards mitigation SFs. To address this gap, this paper discusses the shortcomings of current methods and proposes a new approach to overcome them. The principles of the proposed method are substantiated by detailed mathematical formulation and the practical application of the method is demonstrated through a case study in a road tunnel project.

Figures

Figures reproduced from arXiv: 2506.02309 by the authors.

Figure 1
Figure 1. Bowtie Accident Model While SIL allocation for preventive SFs has been extensively studied and addressed, there has been surprisingly limited focus on allocating SIL for mit￾igation SFs. To bridge this gap, this paper aims to review the methodological challenges and propose remedies. We first argue how the differences between mit￾igation SFs and preventive SFs render existing methods inefficient for allocating SIL t… view at source ↗
Figure 2
Figure 2. Risk Estimation Process In a SIL allocation analysis, whether we use (21) or (23), the target SIL will be determined by the gap between the tolerable and estimated levels of risk. Generally, our SIL allocation method comprises the following steps [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Relationships Between Subsystems, Functions and Consequences [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

33 extracted references · 33 canonical work pages

  1. [1]

    IEC 61508-1: Functional safety of electrical/electronic/programmable elec- tronic safety related systems - Part 1: General requirements,

    IEC, “IEC 61508-1: Functional safety of electrical/electronic/programmable elec- tronic safety related systems - Part 1: General requirements,” 2010

    work page 2010

  2. [2]

    IEC 61508-4: Functional safety of electrical/electronic/programmable elec- tronic safety related systems - Part 4: Definitions and abbreviations,

    IEC, “IEC 61508-4: Functional safety of electrical/electronic/programmable elec- tronic safety related systems - Part 4: Definitions and abbreviations,” 2010

    work page 2010

  3. [3]

    IEC, “IEC 61508-5: Functional safety of electrical/electronic/programmable elec- tronic safety related systems - Part 5: Examples of methods for the determination of safety integrity levels,” 2010

    work page 2010

  4. [4]

    Techniques for assigning a target safety integrity level,

    A. E. Summers, “Techniques for assigning a target safety integrity level,” ISA transactions, vol. 37, no. 2, pp. 95–104, 1998. 20 Hamid Jahanian

    work page 1998

  5. [5]

    Center for Chemical Process Safety, 2001

    AIChE, Layer of Protection Analysis: Simplified Process Risk Assessment. Center for Chemical Process Safety, 2001

    work page 2001

  6. [6]

    IEC 61025: Fault tree analysis (FTA),

    IEC, “IEC 61025: Fault tree analysis (FTA),” 2006

    work page 2006

  7. [7]

    Fault tree handbook with aerospace applications,

    M. Stamatelatos, W. Vesely, J. Dugan, J. Fragola, J. Minarick, and J. Railsback, “Fault tree handbook with aerospace applications,” 2002

    work page 2002

  8. [8]

    Rausand and A

    M. Rausand and A. Høyland,System reliability theory: models, statistical methods, and applications, vol. 396. John Wiley & Sons, 2003

    work page 2003

Show all 33 references
  1. [9]

    Event-tree analysis using binary decision dia- grams,

    J. D. Andrews and S. J. Dunnett, “Event-tree analysis using binary decision dia- grams,” IEEE Transactions on Reliability, vol. 49, no. 2, pp. 230–238, 2000

    2000

  2. [10]

    ISA-TR84.00.07-2018, Guidance on the Evaluation of Fire, Combustible Gas, and Toxic Gas System Effectiveness,

    ISA, “ISA-TR84.00.07-2018, Guidance on the Evaluation of Fire, Combustible Gas, and Toxic Gas System Effectiveness,” 2018

    2018

  3. [11]

    IEC, “IEC 61511-1: Functional safety-Safety instrumented systems for the process industry sector - Part 1: Framework, definitions, system, hardware and application programming requirements,” 2016

    2016

  4. [12]

    IEC 62061: Safety of machinery - Functional safety of safety-related control systems,

    IEC, “IEC 62061: Safety of machinery - Functional safety of safety-related control systems,” 2021

    2021

  5. [13]

    CENELEC - EN 50129: Railway applications - Communication, sig- nalling and processing systems - Safety related electronic systems for signalling,

    CENELEC, “CENELEC - EN 50129: Railway applications - Communication, sig- nalling and processing systems - Safety related electronic systems for signalling,” 2018

    2018

  6. [14]

    ISO 13849-1: Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design,

    ISO, “ISO 13849-1: Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design,” 2023

    2023

  7. [15]

    BS EN ISO 10418: Petroleum and natural gas industries - Offshore produc- tion installations - Process safety systems,

    BSI, “BS EN ISO 10418: Petroleum and natural gas industries - Offshore produc- tion installations - Process safety systems,” 2019

    2019

  8. [16]

    Developments in SIL determination and cal- culation,

    A. Gabriel, C. Ozansoy, and J. Shi, “Developments in SIL determination and cal- culation,” Reliability Engineering & System Safety, vol. 177, pp. 148–161, 2018

    2018

  9. [17]

    Optimization, a rational approach to SIL determination,

    H. Jahanian, “Optimization, a rational approach to SIL determination,”Process Safety and Environmental Protection, vol. 109, pp. 452–464, 2017

    2017

  10. [18]

    A mathematical optimization model for determin- ing safety integrity levels in process facilities,

    M. Cheraghi and S. Taghipour, “A mathematical optimization model for determin- ing safety integrity levels in process facilities,”Reliability Engineering & System Safety, vol. 243, p. 109896, 2024

    2024

  11. [19]

    Uncertainty analysis for target SIL determination in the offshore industry,

    K. Chang, S. Kim, D. Chang, J. Ahn, and E. Zio, “Uncertainty analysis for target SIL determination in the offshore industry,” Journal of Loss Prevention in the Process Industries, vol. 34, pp. 151–162, 2015

    2015

  12. [20]

    Quantitative assessment of safety barrier performance in the prevention of domino scenarios triggered by fire,

    G. Landucci, F. Argenti, A. Tugnoli, and V. Cozzani, “Quantitative assessment of safety barrier performance in the prevention of domino scenarios triggered by fire,” Reliability Engineering & System Safety, vol. 143, pp. 30–43, 2015

    2015

  13. [21]

    Domino effect frequency assessment: The role of safety barriers,

    G. Landucci, F. Argenti, G. Spadoni, and V. Cozzani, “Domino effect frequency assessment: The role of safety barriers,”Journal of Loss Prevention in the Process Industries, vol. 44, pp. 706–717, 2016

    2016

  14. [22]

    Assessment of safety barrier performance in the mitigation of domino scenarios caused by natech events,

    A. Misuri, G. Landucci, and V. Cozzani, “Assessment of safety barrier performance in the mitigation of domino scenarios caused by natech events,”Reliability Engi- neering & System Safety, vol. 205, p. 107278, 2021

    2021

  15. [23]

    Probabilistic assessment aimed at the evaluation of escalating scenarios in process facilities combining safety and security barriers,

    V. C. Moreno, G. Marroni, and G. Landucci, “Probabilistic assessment aimed at the evaluation of escalating scenarios in process facilities combining safety and security barriers,” Reliability Engineering & System Safety, vol. 228, p. 108762, 2022

    2022

  16. [24]

    Use of combustible gas detectors in safety instrumented systems–a practical application case study,

    S. Famuyiro, “Use of combustible gas detectors in safety instrumented systems–a practical application case study,”Journal of Loss Prevention in the Process Indus- tries, vol. 54, pp. 333–339, 2018. SIL Allocation for Mitigation Safety Functions 21

    2018

  17. [25]

    Use of hazardous event frequency to evaluate safety integrity level of subsea blowout preventer,

    S. Chung, S. Kim, and Y. Yang, “Use of hazardous event frequency to evaluate safety integrity level of subsea blowout preventer,”International Journal of Naval Architecture and Ocean Engineering, vol. 8, no. 3, pp. 262–276, 2016

    2016

  18. [26]

    Estimation of average hazardous-event-frequency for allo- cation of safety-integrity levels,

    Y. Misumi and Y. Sato, “Estimation of average hazardous-event-frequency for allo- cation of safety-integrity levels,”Reliability Engineering & System Safety, vol. 66, no. 2, pp. 135–144, 1999

    1999

  19. [27]

    Reliability assessment of safety instrumented systems subject to different demand modes,

    Y. Liu and M. Rausand, “Reliability assessment of safety instrumented systems subject to different demand modes,” Journal of Loss Prevention in the Process Industries, vol. 24, no. 1, pp. 49–56, 2011

    2011

  20. [28]

    Cost-effective maintenance of safety and security barriers in the chemical process industries via genetic algorithm,

    S. Yuan, G. Reniers, M. Yang, and Y. Bai, “Cost-effective maintenance of safety and security barriers in the chemical process industries via genetic algorithm,” Process Safety and Environmental Protection, vol. 170, pp. 356–371, 2023

    2023

  21. [29]

    Multi-objective op- timization of design and testing of safety instrumented systems with moon voting architectures using a genetic algorithm,

    A. C. Torres-Echeverría, S. Martorell, and H. A. Thompson, “Multi-objective op- timization of design and testing of safety instrumented systems with moon voting architectures using a genetic algorithm,”Reliability Engineering & System Safety, vol. 106, pp. 45–60, 2012

    2012

  22. [30]

    Robust multi-objective optimization of safety barriers performance parameters for natech scenarios risk assessment and management,

    F. Di Maio, S. Marchetti, and E. Zio, “Robust multi-objective optimization of safety barriers performance parameters for natech scenarios risk assessment and management,” Reliability Engineering & System Safety, vol. 235, p. 109245, 2023

    2023

  23. [31]

    T. A. Kletz,HAZOP and HAZAN: identifying and assessing process industry haz- ards. IChemE, 1999

    1999

  24. [32]

    IEC 61508-6: Functional safety of electrical/electronic/programmable elec- tronic safety related systems - Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-3,

    IEC, “IEC 61508-6: Functional safety of electrical/electronic/programmable elec- tronic safety related systems - Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-3,” 2010

    2010

  25. [33]

    Jahanian,Failure mode reasoning in safety-critical programs

    H. Jahanian,Failure mode reasoning in safety-critical programs. PhD thesis, Mac- quarie University, 2023

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.