# Calculation of the Dangerous Failure Rate of the Safety Function
## 4 Rate of Dangerous Failure of a Safety Function for Dual Architecture with Two Absorption States
### Merging of Absorption States  
Let us convert a model with two absorption states (Figure 6) to a model with one absorption state by putting state D and state S into one state--state Y (Figure 12). The probability of state Y (Figure 12) is:  
\[p_{Y}(t)=1+e^{-2\lambda t}-\frac{2\lambda c\cdot e^{-(\lambda+\delta)t}}{( \lambda c-\delta)}+\frac{2\cdot\delta\cdot e^{-(1+c)\lambda t}}{(\lambda c- \delta)}. \tag{32}\]  
The equation calculating of the rate of the transition to the Y state and the adjustment according to (24) and (25) is  
\[ \begin{split}\lambda_{\rm Y}(t)=\frac{\frac{dp_{Y}(t)}{dt}}{1-p _{Y}(t)}=\frac{-2\lambda(\lambda c-\delta)\cdot e^{-2\lambda t}-2\cdot\lambda \cdot\delta(1+c)\cdot e^{-(1+c)\lambda t}+2\cdot\lambda\cdot c(\lambda+\delta) \cdot e^{-(\lambda+\delta)t}}{-(\lambda c-\delta)\cdot e^{-2\lambda t}+2 \lambda c\cdot e^{-(1+c)\lambda t}-2\cdot e^{-(1+c)\lambda t}}\\ \lambda_{\rm Y}(t)=\frac{\frac{dp_{Y}(t)}{dt}}{1-p_{Y}(t)}= \lambda_{\rm D}(t)+\lambda_{\rm S}(t).\end{split}  \tag{33}\]  
with a defined SIL, then the simplified relations given in the standards can be used. An example of such a system is the application published in paper [18]. However, in more complex cases, simplified relationships from standards cannot be used, and it is necessary to create a suitable model. One of the tools used to create such a model is the CTMC. The available literature and scientific publications consider the use of CTMC for the safety analysis with one absorption state. The transition of SF to this state is interpreted as the occurrence of a dangerous fault of SF and means the transition of a system that implements a SF to a down state. The fact is that ESRCS can also enter the down state due to the fault detection and negation, which leads to the creation of a CTMC with two absorption states. The problematics of the influence of fault detection and negation mechanisms on the safety properties of SF and related problems are analysed in paper [11]. However, in paper [11], the analysis ends at the level of calculating the probability of occurrence of individual absorption states. The standard [1] requires the calculation of the SF dangerous failure rate for the SF in continuous operation mode. This paper directly solves this issue. The results can be used directly in the safety analysis of SF implemented on hardware with fault detection and subsequent fault negation. From the point of view of CTMC analysis, such hardware leads to multiple absorption states. In this paper, the relations are applied to the calculation of the dangerous failure rate of the dual architecture with two absorption states (Sections 4.1-4.3). In Section 4.4, the results are verified by merging the absorption states. Verification confirms the correctness of the derived equations. The procedure for calculating the SF dangerous failure rate was designed to develop a real ESRCS (system with architecture 2 oo3), intended for use in railway transport. This procedure has been assessed and accepted by an independent organization with international accreditation to assess the safety of SRCS for railway applications. Comparing the results presented in this article with other publicly available scientific articles is problematic because the available literature solves this problem with only one absorption state (e.g., paper [19]). Further development aims to extend this approach for use in ESRCS safety integrity assessment, which has a learning feature and can restart in uninterrupted operation. It is an ESRCS with a 2 oo3 architecture. After identifying a failure state in one channel, this channel is isolated, and the system goes into a degraded mode (it works in the 2 oo2 architecture). If it was a short-term fault condition, automatic recovery to full mode (without interruption of operation) is required. However, this activity must not lead to a reduction in safety integrity, which must be demonstrated. This procedure could be applied to analyse other RAMS (reliability, availability, maintainability, and safety) parameters of ESRCS.