# Improved Safety Analysis Integration in a Systems Engineering Approach
## 4 Improved System Architecture Based on FMEA Recommendation
### Step 2: Making Architecture Decision Using FMEA Information  
Severity [30] is a rating between 1 (negligible effect) and 10 (catastrophic effect) and it indicates the severity of an effect of a potential FM. Four main categories are used to classify the impact of an occurrence of a FM which are \"catastrophic\", \"critical\", \"marginal\", and \"negligible\". The catastrophic category is the most critical category and it is used when multiple losses of life are expected. The critical category is used when there is just loss of one life. The marginal and negligible categories are used when major or minor injuries are detected. Occurrence is also rated between 1 and 10. It gives an idea of the frequency or the probability of the failure mode occurring during the system life time. Just like severity, the occurrence is classified into six different categories, which are \"Frequent\", \"Probable\", \"Occasional\", \"Remote\", \"Improbable\", and \"Incredible\". The frequent category corresponds to an inevitable failure with a range of failures bigger than 0.001 per year. The probable category corresponds to repeated failures with a range of failure between 0.001 and 0.0001 per year. The occasional category corresponds to occasional failures with a range of failure between 0.0001 and 0.00001 per year. For the remote, improbable, and incredible categories, the failure should be very unlikely or never happen in the life of the system. Detection is rated between 1 and 10 and it is defined by an opportunity for an unidentified failure because of difficulty in detecting it [30].  
The IEC61508, which is an international standard published by the International Electro-technical Commission [31], divides the possible risk, depending on the occurrence and severity categories, into four class as shown in Table 1. Class I, which is the most dangerous, means that the risk is unacceptable in any circumstance. Class II means that risk is undesirable but tolerable only if the reduction of the risk is very costly. Class III and class IV mean that the risk is tolerable.  
Once the generation of FMEA is made, the FMEA information is analyzed and some modifications about the structure of the system are recommended according to architecture decision criteria. When the risk of the failure mode is classified as class I, the structure of the system should be updated in order to decrease the criticality of the failure mode. Hence, the component related to this failure mode will be dubbed. The redundancy is the solution used in this work to correct the structure of the system and enhance its safety. After making architecture decisions, three SysML diagrams will be manually updated, which are the requirement diagram, to say that the component \"X\" should be dubbed, the activity diagram, and the IBD to modify the structure of the system. Then, a new iteration should be made and a new FMEA will be generated and computed. When the system reaches the safety level, no more changes need to be made in the system architecture and it is time to move to Step 3.