After the FuSa goal has been established, the next phase is to develop the FSC. The system block diagram is shown in Figure 2-5, which is one level deeper than the block diagram in item definition. The objective is to define sub-functional elements and interconnections on preliminary architecture diagrams.

To simplify the analysis, SG2 is chosen as an example. Figure 2-6 is the one level deeper block diagram related to SG2, and related sub-functional elements and interactions are defined in Table 2-9.

FTA is performed to generate FSRs of SG2. FTA analysis is structured by three steps. The first step is to create the fault tree with SG2 violation as top event, then the second step is to derive each potential malfunction of the defined sub-functional element that leads to top events occur, then the third step is to use logic gates to represent the relationships between events.

Following the above steps, the FTA tree is illustrated in Figure 2-7. Critical failure paths must be identified for cut set analysis. If SPF directly violates the FuSa goal, FSR must be designed; if SPF does not directly violate the FuSa goal, it is necessary to determine whether the dual-point failure system is acceptable and to analyze the independence of dual-point failures.

For the FTA analysis of the SG, in FSR level it can be terminated at the component, while more detailed analysis must be carried out at the TSR level. As shown in Figure 2-7, If there is abnormal current sensing, or a control malfunction, or a power supply issue, SG2 is violated. Then it can be broken down into different components.

• The incorrect current sensing can be caused by the fault on current sensor, or any fault on the discrete comparator used for overcurrent protection.
• The incorrect control command can be caused by many components. It can be caused by communication with VCU (Incorrect charging command or fail to report fault state). It can be caused by incorrect control signals from MCU. It can be caused by the incorrect driving waveform from gate driver. It can be caused by any fault on discrete logic components in the fault reaction path.
• The fault on power supply can cause malfunction of key components, including MCU, gate driver, sensors, voltage references.

Cut set is a logical analysis to determine sets of combinations of gate/events which causes the top gate condition to fail.

• 1-order cut set. Only one event can lead the top event occurs. These events are transformed into an FSR with FTTI requirement.
• 2-order cut set. Two events occur at the same time can lead to the top events occurring. These events will be transformed into an FSR with MPFHTI requirement.
• More than 2-order cut set. More than two events occur at the same time can lead to the top events occurring. These events will not be transformed into an FSR.

Each FSR must be assigned to the logical block that is responsible for the implementation. Where an FSR spans more than one block, all relevant subsystems must be listed. Table 2-10 lists the concise set of FSRs that underpin the goal Avoid vehicle fire due to DC bus overcurrent.