# Calculation of the Dangerous Failure Rate of the Safety Function
## 3 The Dangerous Failure Rate of the SF  
Let the ESRCS implement only one SF and all its elements participate in the implementation of this SF, then the SI of safety function (SI-SF) can be identified with the SI ESRCS. Because random failures occur randomly and continuously over time, CTMCs can be used to analyse the effects of random failures on SI-SF. In general, it is a state-oriented, graphic-mathematical method. The qualitative part of the method is related to the creation of a graphical model, which expresses the relationship between the elements of the considered system and their impact on SI-SF. Model creation is a very important activity in [PERSON]'s analysis. The automatic model generating is theoretically possible (under certain conditions) in paper [12], but practically unusable. The extent to which the developed  
Figure 2: CTMCs with multiple absorption states. CTMC model corresponds to the real properties of SF depends on the experience of the analyst and knowledge of the operational and technical characteristics of ESRCS, which implements SF. The quantitative part of the analysis is focused on the mathematical description of the graphical model and the subsequent calculation of the monitored system property--the dangerous failure rate of the SF. Available sources of information in the papers [15; 16; 17] consider CTMC-based models with only one absorption state (Figure 3) or no absorption state when analysing the impact of random failures on SI-SF. CTMC without an absorption state is considered when the recovery mechanism is also considered in the modelling. The model without absorption state cannot be used to calculate the dangerous failure of the SF. If the CTMC contains one absorption state, then this state is considered as a down state and dangerous state (state D) in safety analyses. The ESRCS (which implements the SF) enters this state due to the occurrence of a dangerous failure. If the state probability \(p_{D}(t=0)=0\), then the probability \(p_{D}(t)\) has the properties of the distribution function. The transition rate to state D can be interpreted as a dangerous failure rate of SF and is determined by the equation  
\[\lambda_{D}(t)=\frac{\frac{dp_{D}(t)}{dt}}{1-p_{D}(t)}, \tag{7}\]  
which is consistent with the definition of failure rate for a non-restored object. Recovery from state D is possible, but it is a special case of recovery. In general, the cause of a dangerous condition needs to be identified, which usually leads to changes in the system, and given the extent of the change, all procedures and measures within each life cycle phase should be applied appropriately as if it were a new system. In such a case, the recovery has its specific features, for example, because these changes are subject to assessment by an independent authority. After the recovery, ESRCS is considered \"as good as new\" and starts a new operation (RandF-SI of SF re-analysis starts again in time \((t=0)\)). If ESRCS operates in a continuous mode of operation and has an online mechanism for detecting and negating the fault, then ESRCS can go to the down and safety state (in the next part of this article, this is referred to as state S). Recovery from this state is possible either without interruption of ESRCS operation or after interruption of operation (depending on the ESRCS architecture and the method of organization of the recovery). However, in many cases, when the down state (state D or state S) is reached, the RandF-SI analysis of SF is required to be completed and the dangerous failure rate of SF (transition rate to state D) is calculated. Since states D and S are absorption states, in this case, Equation (7) cannot be used to calculate the dangerous failure rate of SF (transition rate to state D).