A hazard is always a hazard of something. This chapter takes eight systems, one from each industry the platform serves, and works the safety question on each of them end to end: what harm the machine can do, how that consequence was classified, what target the classification bought, what the architecture had to look like before anyone was entitled to quote a probability, and then the formulas, the arithmetic and the decision the answer forces.
The eight systems are the same in every concept topic of this row. The aircraft electrical system worked here for its catastrophic failure condition is the one worked in reliability for its failure rates, in maintainability for its repair times, in availability for its dispatch rules and in testability for its built-in test coverage. Read a column and you learn one property across eight industries; read a row and you watch one machine reveal its five RAMS faces. Every page hands the reader sideways to the same machine's other properties, because a safety argument that consumes a failure rate, a repair interval or a detection coverage without asking where it came from is an argument resting on somebody else's assumptions. All numbers here are illustrative, invented for teaching and chosen to keep the arithmetic legible; none is field data from any real product, and no certification rule quoted on any page applies outside the sector that wrote it.
The technique is a choice, not a default
The single most useful thing this chapter does is refuse to apply one method everywhere. A fault tree is right when the question is consequence-driven and the structure is a coincidence of failures, and wrong for a hazard delivered by equipment working correctly. A probability of failure on demand is right for a dormant protective function and meaningless for a continuously operating one. A constant failure rate is right for mature electronics in their useful life and wrong for anything that wears, which matters here because a rising hazard moves a demand rate, and a demand rate is half of every hazard rate. Each page names its technique, justifies it, shows the arithmetic, and closes with what a different technique would have given.
| Industry | System | Technique this system calls for |
|---|---|---|
| Defence and aerospace | Transport aircraft AC electrical power | Fault tree read for cut-set order before it is read for numbers, with a beta-factor common-cause event and the no-single-failure rule |
| Railway | Wayside level-crossing controller | Failure-direction analysis: only the wrong-side branch is carried into the tolerable hazard rate |
| Space systems | Satellite attitude control | Consequence classification carried past end of mission, with Weibull wheel ageing and a third-party exposure branch |
| Automotive | Electric vehicle brake system | Severity, exposure and controllability to an integrity class, then a decomposition worth only its independence |
| Energy and resources | Gas compressor train | PFD for a proof-tested function, where the test interval and not the hardware sets the integrity level |
| Medical devices | Infusion pump fleet | Hazard apportionment between device failure and use error, with the dominant branch outside the failure-rate table |
| Electronics and high tech | Storage array controller pair | Energy-release hazard identification with a barrier argument, not a success-path model |
| Nuclear | Emergency diesel generator train | Beta-factor common cause worked explicitly, plus a latent term, delivered as an input to a plant risk model |
What the eight rows have in common
One shape repeats in all eight. The target came from the consequence rather than from what the hardware could plausibly achieve; the architecture was settled on qualitative grounds before quantification began; and the computed probability arrived last, to confirm a decision already taken rather than to make it.
Two habits fall out of the set. The first is that the analysis boundary must include whatever actually delivers the harm: the operator on the pump, the ground segment on the satellite, the proof-test regime on the compressor, the surveillance schedule on the diesel, the annual service on the vehicle. In four of the eight rows the decisive quantity was an interval written in a maintenance document rather than a property of any component. The second is that a rule belonging to one sector must not be carried across the boundary as though it were physics. The single-failure prohibition, the ASIL decomposition notation, the SIL bands and the technical specifications each come from a regime with its own history and its own residual assumptions, and borrowing one into another sector is among the commonest ways a safety argument quietly stops being true. The ladders are laid side by side in the foundations chapter.
The third thing they share is the least comfortable. Every quantitative answer above rested on an independence claim that no arithmetic could check: the aircraft's two channels, the vehicle's two decomposed paths, the diesel's two trains, the array's three barriers. Where independence was priced, as it was with the beta factor, it dominated; where it was assumed, it was the weakest part of the argument. That is the case for reading the other four columns, because safety took its rates on trust from reliability, its intervals from maintainability, the cost of failing safe from availability, and whether a dangerous failure is revealed at all from testability.