← All chapters Chapter 18

Safety Measures and Requirements Decomposition

Every safety measure is an AND gate placed where it acts.

A measure enters the tree not as a description but as its own failure event, ANDed at the point where it acts in the fault-error-failure chain — turning a single point into a double fault. Where the AND goes matters more than the AND itself. Requirements decomposition is the same move one level up, valid only where the two parts are genuinely independent, and it never relaxes the integration, verification, or FMEDA the original ASIL demands.