# Calculation of the Dangerous Failure Rate of the Safety Function
## 4 Rate of Dangerous Failure of a Safety Function for Dual Architecture with Two Absorption States
### CTMC for Dual Architecture with Two Absorption States  
Let SRES with dual architecture (Figure 5) have the following features:  
* the R and L channels are hardware identical, \(\lambda_{R}=\lambda_{L}=\lambda\), where \(\lambda_{R}\) is the failure rate of channel R, and \(\lambda_{L}\) is the failure rate of channel L;
* the SRES has a fault detection and negation mechanism, which is characterized by a diagnostic failure coverage coefficient \(c\), fault detection time \(t_{d}\), and fault negation time \(t_{N}\);
* SRES operates in continuous operation mode.  
To evaluate ESRCS with such properties, the CTMC is shown in Figure 6. The paper [11] also deals with a similar problem.  
The characteristic of the individual states of the model in Figure 6 is described in Table 1.  
The rate of the transition from state 3 to state S (induction of a safe ESRCS response because of the fault detection and negation) can be expressed by the relationship (20).  
\[\delta=\frac{1}{t_{d}+t_{N}}. \tag{20}\]  
The CTMC in Figure 6 can be described by a system of differential equations:  
Figure 4: CTMC with two absorption states.  
Figure 5: Block diagram of a two-channel ESRCS architecture.  
\[\begin{array}{c}\frac{d_{\text{POK}}(t)}{dt}=-2\lambda\cdot p_{\text{OK}}(t),\\ \frac{dp_{2}(t)}{dt}=2\lambda\cdot(1-c)\cdot p_{\text{OK}}(t)-\lambda\cdot(1+c) \cdot p_{2}(t),\\ \frac{dp_{3}(t)}{dt}=2\lambda\cdot c\cdot p_{\text{OK}}(t)+\lambda\cdot c\cdot p _{2}(t)-(\lambda+\delta)\cdot p_{3}(t),\\ \frac{dp_{5}(t)}{dt}=\delta\cdot p_{3}(t),\\ \frac{dp_{D}(t)}{dt}=\lambda\cdot p_{2}(t)+\lambda\cdot p_{3}(t).\end{array} \tag{21}\]  
If at time \(t=0\) the ESRCS is in the OK state (Figure 6), then the initialization vector is:  
\[P(t=0)=\{1,\ 0,\ 0,\ 0,\ 0\}. \tag{22}\]  
Then the probabilities of each state are:  
\[\begin{array}{c}p_{1}(t)=e^{-2\lambda t},\\ p_{2}(t)=-2\cdot e^{-2\lambda t}+2\cdot e^{-(1+c)\lambda t},\\ p_{3}(t)=\frac{2\lambda c}{(\lambda c-\delta)}\cdot\left(e^{-(\lambda+\delta)t} -e^{-(1+c)\lambda t}\right),\\ p_{4}(t)=p_{D}(t)=e^{-2\lambda t}-1+\frac{2\delta}{(\lambda c-\delta)\cdot(1+c )}\cdot\left(e^{-(1+c)\lambda t}-1\right)-\frac{2\lambda c\lambda^{2}}{( \lambda c-\delta)\cdot(1+\delta)}\cdot\left(e^{-(\lambda+\delta)t}-1\right), \\ p_{5}(t)=p_{5}(t)=\frac{2\lambda c}{(\lambda c-\delta)\cdot(1+c)}\cdot e^{-(1+ c)\lambda t}-\frac{2\lambda c\lambda}{(\lambda c-\delta)\cdot(1+\delta)}\cdot e^{-( \lambda+\delta)t}+\frac{2\delta c}{(\lambda+\delta)\cdot(1+c)}.\end{array} \tag{23}\]  
\begin{table}
\begin{tabular}{c c} \hline
**State** & **Characteristics** \\ \hline OK & ESRCS is fault-free; neither channel is in a fault due to a random failure. \\ \multicolumn{2}{c}{_ESRCS is in up state._} \\ \multicolumn{2}{c}{Channel R or channel L is in an undetectable fault due to the occurrence of one} \\ \multicolumn{2}{c}{_2_} & random failure or due to the occurrence of several random failures. \\ \multicolumn{2}{c}{_ESRCS is in up state._} \\ \multicolumn{2}{c}{Channel R or channel L is in a detectable fault due to the occurrence of one random} \\ \multicolumn{2}{c}{failure (transition from state OK to state 3) or due to the occurrence of several} \\ \multicolumn{2}{c}{3} & random failures (transition from state OK to state 2 and subsequent transition from state 2 to state 3). \\ \multicolumn{2}{c}{_ESRCS is in up state._} \\ \multicolumn{2}{c}{The safe state that the ESRCS enters after the fault detection and negation of channel} \\ \multicolumn{2}{c}{S} & R or channel L. \\ \multicolumn{2}{c}{_ESRCS is in a down state._} \\ \multicolumn{2}{c}{D} & Dangerous state—both channels are faulty. \\ \multicolumn{2}{c}{_ESRCS is in a down state._} \\ \hline \end{tabular}
\end{table}
Table 1: States of the model from Figure 6.  
Figure 6: CTMC for two-channel ESRCS architecture with continuous mode of operation; a time-continuous fault detection and negation mechanism.