Yang Y * and Jung I U.S. NRC Abstract

Transcription

1 International Journal of afety cience Vol. 01, No. 01, 2017, OI: / oolean lgebra lication in imlifying ault Tree nalysis Yang Y * and Jung I U.. NR yaguang.yang@nrc.gov, ian.jung@nrc.gov bstract This aer discusses oolean algebra alications in fault tree analysis. ault tree analysis has been extensively used in nuclear ower lant safety analysis, such as analysis of system hazard, determination of critical characteristics in commercial grade dedication, and estimation of industrial system reliability. In general, the logic relations resented in fault tree models can be equivalently reresented in oolean algebra formulas. The oolean algebra reresentation has several advantages over the original fault tree reresentation. The most significant one is that the oolean reresentation can easily be simlified to get a so-called minimum cut reresentation. rom there, fault tree analysis can be alied to several alications mentioned above. In this aer, we use some simle examles to demonstrate how to use oolean algebra as a tool to simlify the fault tree model to get an exression of minimum cut. We then oint out ossible alications of this technique, such as common mode failure using identical digital system/comonents and remedy by diversity design, hazard analysis, and critical characteristics determination. Keywords: oolean algebra, fault tree analysis, minimum cut reresentation 1. Introduction ault tree analysis is an imortant branch in reliability and risk analysis theory. It has been investigated extensively in literatures see for examle and references therein cott and malley 2003, Lee et al 1985 and ven ault tree analysis has many alications in nuclear industry Ruijters and toelinga 2015 and Pelow et al 2004 and it is believed to be the most efficient way of handling the large logical models that are necessary for a nuclear ower lant [lause 4.154, Mcormick 1981]. ecause of the large logical models that are necessary to describe a nuclear ower lant, there is a clear need to simlify the large logical models to get a logical exression which is easy to understand. In reference I 2001, a oolean algebra method is roosed to achieve this goal. However, the main urose of reference I 2001 is to derive a systematic method to estimate the reliability for digital instrumentation and control systems, which involves the estimation of both hardware reliability Yang and ydnor 2012 and software reliability ickel In this aer, we will focus the details on how to simlify the large logical models using oolean algebra method. We will demonstrate the efficiency of the this method in many alications, such as single failure event identification, ommon ause ailure imact on system safety, hazard analysis, failure rate estimation, etc. The remainder of the aer is organized as follows: ection 2 gives the detailed descrition of oolean algebra method in fault tree model simlification. ection 3 rovides various ossible alications of the roosed logical simlification method. onclusions are summarized in ection ault Tree Model imlification 12

2 irst, we briefly review the basics about oolean algebra. International Journal of afety cience Vol. 01, No. 01, 2017, OI: / oolean lgebra oolean algebra was named after George oole who invented the algebra in his book Yang The main oerations of oolean algebra are the conjunction and denoted as, the disjunction or denoted as, and the negation not denoted as. oolean variable x can take only two values: 1 or true and 0 or false. The values of x y, x y, and x can be exressed by tabulating their values with truth tables as follows. Table I. Truth Table x y x y x y x x Using Venn diagram, we can exress the above oerations as in ig. 1. igure 1. Venn for oolean algebra oerations oolean algebra satisfies many of the same laws as ordinary algebra when one matches u with addition and with multilication. In articular the following laws are common to both kinds of algebra: ssociativity of x y z = x y z 1 ssociativity of x y z = x y z 2 ommutativity of x y = y x 3 ommutativity of x y = y x 4 istributivity of over x y z = x y x z 5 Identity for x 0 = x 6 Identity for x 1 = x 7 nnihilator for x 0 = 0 8 nnihilator for x 1 = 1 9 Idemotence of x x = x 10 Idemotence of x x = x 11 bsortion 1 x x y = x 12 bsortion 2 x x y = x 13 However, distributivity of over is different from the ordinary algebra and is given as follows: istributivity of over x y z = x y x z 14 esides, there are one double negation and two comlement oeration laws: ouble negation x = x 15 13

3 International Journal of afety cience Vol. 01, No. 01, 2017, OI: / omlementation 1 x y z = x y x z 16 omlementation 2 x y z = x y x z 17 inally, there are two e Morgan s laws: e Morgan 1 x y = x y 18 e Morgan 2 x y = x y ault Tree Model imlification Using oolean lgebra It will be easy to illustrate the method by using a simle examle. Let consider an artificial digital I& system as discussed in reference I 2001 as given in ig. 2, which has three identical redundant smart sensors which have both hardware and software. sensor1 sensor2 igital inut ingle board comuter / actuator sensor2 igure 2. n artificial I& system The measurements from the three sensors are sent to an / converter, the signal is rocessed in a single-board comuter, and the control command is then sent to a / converter and then to an actuator. ll comonents have two different failures, i.e., agingrelated hardware failures and hysical-damage related failures, excet for the single-board comuter and the smart sensors, which have two failure modes, i.e., aging related hardware failure and software failure. We also assume that the / always receives signals correct or incorrect from the three sensors while the signals are useful only if two of the sensors rovide correct measurement. The fault tree corresonding the digital I& system can then be created as shown in ig. 3, where,,,, G, K, and M are aging-related failures; H, L, and N are hysicaldamage-related failures, I denotes comuter hardware failures, and,, and are software failures due to common-cause failure events in smart sensors. J denotes software failures in the comuter. The failure tree model in ig. 3 can be written in oolean algebraic exressions as follows: 21 P I J 22 H G lthough oolean algebra equations rovides a comlete descrition of failure logic, this descrition is not the most convenient form in risk analysis. Using oolean algebra formulas 1-17, we can reduce the oolean algebra equations into equivalent minimal cut set descrition which define all the failure modes of the I& failure events. irst, from 24 and 25, we have: 20 14

4 International Journal of afety cience Vol. 01, No. 01, 2017, OI: / igure 3. ault tree of the I& system imilarly, we can obtain

5 International Journal of afety cience Vol. 01, No. 01, 2017, OI: / This gives [ Using and 31, we obtain the comlete failure logic given as follows: M N N M L K P N M L K J I N M L K J I G H N M L K J I G H This simlification rocess looks tedious, but there are many software ackages which can be used to handle the oerations ven lications The oolean exression 32 is logically much clear and easier to be used in risk analysis relation alications than the fault tree exression in ig. 3. rom 32, we can see all ossible failure modes are 1 single failure events, including N, M, L, K, J, I, G, H, and, 2 double failure events, including,, and, and 3 trile failure event. This logical failure modes were used in robabilistic risk analysis PR in [7]. We will discuss several other alications in this section. or the sake of simlicity in our discussion/analysis, we assume in the rest of section that all failures,,,,,,,, G, H, I, J, K, L, M, and N, have the same failure robability 10-4 er year and the robabilities are indeendent and identically distributed. ] ingle ailure vent In nuclear industry, one of the very imortant safety system design criteria is ingle ailure riteria oole It basically says that the safety systems shall erform all safety functions required for a design basis event in the resence of any single detectable failure event. In this aer, the single failure event is defined differently. In the examle discussed above, equation 32 indicates N, M, L, K, J, I, G, H, and are single failure events in which any single event will disable the system to erform its function. We refer these events as to single failure events. ut due to the redundancy and voting design for the smart sensors, the system will function correctly unless at least two of the three sensor hardware fail at the same time or or or. We refer,, and as to double failure events, and as to trile failure events, and so on Hazard and Risk nalysis 16

6 International Journal of afety cience Vol. 01, No. 01, 2017, OI: / lthough all failure events in the examle of revious section, N, M, L, K, J, I, G, H,,,,, and, will cause the system to fail to erform its function, and should be considered in hazard analysis, the risk of these events are different. or all single failure events, N, M, L, K, J, I, G, H,, as we have assumed, their failure robabilities are 10-4 er year. ut the failure robabilities for the double failure events are 8 10 er year; the failure robability of trile failure events er year. Therefore, redundancy and voting design for smart sensor hardware failure reduces the risk significantly 10-4 vs That is the main reason that single failure events are most risk events and should be considered seriously and iversity onsideration nother serious safety concern in nuclear industry is ommon ause ailure scenario in safety system. In the examle discussed in the revious section, if all three smart sensors use the same hardware and identical software, then a bug in the software can trigger a event. ased on the analysis in the revious section, this event will revent the system from erforming it function, which has the failure robability of 10-4 er year. However, if the smart sensors use three different software ackages to conduct the same function, the system can be modeled as three different failure events,,, and. With this design diversity consideration, we can show that will not be a concern in this scenario. Indeed, equation 27 in this scenario becomes ] [ [ [ imilarly, we can obtain Note that we omitted some higher order terms in 36 which have very little imact in risk analysis if any. The comlete failure logic in this scenario becomes H G I J K L M N 37 Therefore, the smart sensor software failure is no longer a single failure event in this scenario. lthough, there are a few more double and trile failure events, these double and trile failure robabilities are much lower than the single failure robabilities in the

7 International Journal of afety cience Vol. 01, No. 01, 2017, OI: / failure event. This shows how much the diversity design consideration reduces the risk of the smart sensor failure 10-4 vs ommercial Grade edication and ritical haracteristics In nuclear industry, all comonents and systems used in safety system should be designed and manufactured by following the rocess described in ode of ederal Regulations, 10 R endix I standard , which has very strict requirements on design and manufacture documentations. However, these requirements are very difficult to be satisfied for comonents and systems available in today s market where comonents and systems are not designed and manufactured following the rocess of endix. n alternative rocess with less documentation requirements, called commercial grade dedication, is therefore introduced in Part 21, I standard or a commercial grade item meaning a structure, system, or comonent, or art thereof that affects its safety function, that was not designed and manufactured under a quality assurance rogram comlying with aendix to art 50 I standard , an imortant concet in this rocess is critical characteristics Part 21, I standard ] which is defined as: critical characteristics are those imortant design, material, and erformance characteristics of a commercial grade item that, once verified, will rovide reasonable assurance that the item will erform its intended safety function. Therefore, we may consider all single failure events as art of critical characteristics. If the robability of these failure events is verified to be small enough, it will rovide reasonable assurance that the commercial grade item will erform its intended safety function because the failure robabilities for higher order failure events are much small and therefore can be ignored. This idea is similar to the PRI s roosed method of using failure modes and effects analysis method to determine the critical characteristics [ection 1.5.3, ode of ederal Regulations 2014], but we rovides an easy to imlement and mathematically rigorous method rather than a general method. 4. onclusions In this aer, we roosed a method to use oolean algebra to simlify the fault tree model to obtain all failure modes of a structure or a system or a comonent. The result obtained from this method rovides a clear descrition of all failure modes of the structure, or the system or the comonent. It is easy to see that single failure events are the most risk events and need to have secial consideration in the safety analysis. This method can be alied to several roblems related to the safety and risk analysis, such as, robabilistic risk analysis, hazard and risk analysis, analysis, and commercial grade dedication in nuclear industry. References [1].. cott and R.. malley, iagnostic Ultrasound: Princiles and Instruments, Journal of Nanosci. Nanotechnology., vol. 3, no. 2, 2003, [2] W.. Lee,.L. Grosh,.. Tillman, and.h. Lie, ault tree analysis, methods, and alications a review, I Transactions on reliability, vol. 34, 1985, [3] T. ven, Reliability and risk analysis, lsevier lied cience, London and New York [4]. Ruijters and M. toelinga, ault tree analysis: survey of the state-of-the-art in modeling, analysis and tools, omuter cience Review, vol , 2015, [5].. Pelow,.. ulfredge, R. L. anders, R. H. Morris, and T.. Hann, alculating Nuclear Power Plant Vulnerability Using Integrated Geometry and vent/ault Tree Models, Nucl. ci. ng. vol. 1461, 2004,

8 International Journal of afety cience Vol. 01, No. 01, 2017, OI: / [6] N. J. Mcormick, Reliability and risk analysis: methods and nuclear ower alications, cademic Press, an iego, [7] I, afety ssessment and verification for nuclear ower lants, I afety tandards eries No. N-G-1.2, Vienna [8] Y. Yang and R. ydnor, Reliability estimation for a digital instrumentation and control system, Nuclear ngineering Technology, vol. 44, 2012, [9] J. H. ickel, Risk Imlications of igital Reactor Protection ystem Oerating xerience, Reliability ngineering & ystem afety, vol. 93, 2008, [10] Y. Yang, flow network model for software reliability assessment, Proceeding of 6 th merican nuclear society international toical meeting on nuclear lant instrumentation, control, and humanmachine interface technologies, Knoxville, 2009, ril 5-9. [11] G. oole, n investigation of the laws of thought, Macmillan and o., London [12] I standard 603, riteria for safety systems for nuclear ower generating stations, I tandard 603, New York [13] ode of ederal Regulations, 10 R, Office of the ederal Register, [14] PRI, Plant ngineering: Guideline for the ccetance of ommercial-grade Items in Nuclear afety- Related lications, Revision 1 of NP-5652 and TR ,