Analytical Calculation of Failure Probabilities in Dynamic Fault Trees including Spare Gates

Transcription

1 Analytical Calculation of Failure Probabilities in Dynamic Fault Trees including Spare Gates Guillaume Merle, Jean-Marc Roussel, Jean-Jacques Lesage, Nicolas Vayatis To cite this ersion: Guillaume Merle, Jean-Marc Roussel, Jean-Jacques Lesage, Nicolas Vayatis. Analytical Calculation of Failure Probabilities in Dynamic Fault Trees including Spare Gates. Ben J.M. Ale, Ioannis A. Papazoglou, Enrico Zio. European Safety and Reliability Conference (ESREL 21, Sep 21, Rhodes, Greece. Taylor & Francis, pp , 21. HAL Id: hal Submitted on 13 Sep 21 HAL is a multi-disciplinary open access archie for the deposit and dissemination of scientific research documents, hether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or priate research centers. L archie ouerte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de nieau recherche, publiés ou non, émanant des établissements d enseignement et de recherche français ou étrangers, des laboratoires publics ou priés.

2 Analytical Calculation of Failure Probabilities in Dynamic Fault Trees including Spare Gates Guillaume Merle, Jean-Marc Roussel, and Jean-Jacques Lesage LURPA, ENS de Cachan, Cachan, France Nicolas Vayatis CMLA, ENS de Cachan, Cachan, France This paper focuses on one of the dynamic gates hich are used in Dynamic Fault Trees (DFT: the Spare gate. We proide an algebraic model hich allos to determine the structure function of DFTs ith Spare gates from hich qualitatie analysis can be performed directly. We also proide a probabilistic model alloing to determine the failure probability of Spare gates ithout any restriction on the failure distribution for basic eents. 1 INTRODUCTION Fault Tree Analysis (FTA is one of the oldest, most diffused techniques in industrial applications, for the dependability analysis of large safety-critical systems (Henley and Kumamoto 1981; Leeson 1995; Stamatelatos and Vesely 22. When the interactions beteen eents can be described by means of boolean OR/AND gates only, so that only the combination of eents is releant, and not their sequence, Fault Trees are called Static Fault Tree (SFT. Dugan et al. (Dugan, Bauso, and Boyd 199; Dugan, Sullian, and Coppit 2 proposed a ne model alloing to include arious kinds of temporal and statistical dependencies in the SFT model, hich is the Dynamic Fault Tree (DFT. The DFT is based on the definition of ne gates: Priority-AND (PAND, Functional Dependency (FDEP, Warm Spare (WSP, and Sequence Enforcing (SEQ. The first dynamic gate, gate Priority-AND, as introduced in 1976 (Fussel, Aber, and Rahl 1976 to model sequences of failures. Then, gate FDEP as introduced in 199 (Dugan, Bauso, and Boyd 199 to model common cause failures, and the Spare gate as finally introduced in 22 (Coppit and Sullian 22 to model redundancies. Een though such dynamic gates allo to model failure scenarios that SFTs cannot handle, the analytical techniques commonly used to analyze SFTs cannot be used to analyze DFTs, and other types of techniques, mainly based on state models, must be used. As stated in (Merle, Roussel, Lesage, and Bobbio 21, gates PAND and FDEP hae sequential or preemption-based behaiors and can easily be modeled by means of discrete mathematics. Hoeer, the Spare gate is more complex since statistically dependent on the failure order of eents and its probability of occurrence is not completely defined by an order relation. Many compositional techniques hae been enisaged to analyze DFTs ith Spare gates, either in terms of Stochastic Petri Nets (Bobbio and Raiteri 24; Raiteri 25, or in terms of Input/Output Interactie Marko Chains (Boudali, Crouzen, and Stoelinga 27. In (Dutuit and Rauzy 1996, the quantitatie analysis of the DFT consists in exploding minimal subtrees containing dynamic gates into their state-space representation, and computing numerically the related occurrence probability by means of a Continuous Time Marko Chain (Dugan, Bauso, and Boyd 1992; Gulati and Dugan 1997, thus assuming exponential time-to-failure distributions. Another approach, based on Temporal Bayesian Netorks, is introduced in (Boudali and Dugan 25 and allos to include any probability distribution. In (Amari, Dill, and Hoals 23, closed form expressions are determined as a function of the generic probability distributions of the basic eents, and a numerical integration is proposed to sole them. In any case, the solution of a DFT forces a quantitatie analysis. A common obstacle in any quantitatie technique is the lack of accurate, reliable data on the failure distribution of the components. To oercome this ell-knon defi- 1

3 ciency, the qualitatie analysis is often the only aluable information on the system dependability. Neertheless, the qualitatie analysis of DFTs has neer been fully considered in the literature, and the concept of minimal cut set needs to be reisited to account for the possible order of the failure eents. The authors of (Tang and Dugan 24 propose to decompose the qualitatie analysis into a logical (Boolean part, and into a timing part. Dynamic gates are replaced ith the static gates hich correspond to their logical constraints, the minimal cut sets of the resulting SFT are then generated, and each minimal cut set is expanded to minimal cut sequences by considering timing constraints. Hoeer, the procedure is not completely deeloped. In preious papers, e presented an algebraic frameork alloing to determine the structure function of DFTs ith PAND gates (Merle and Roussel 27 and FDEP gates (Merle, Roussel, Lesage, and Bobbio 29; Merle, Roussel, Lesage, and Bobbio 21. We also detailed ho to perform the quantitatie analysis of such DFTs from their structure function. In this paper, e recall the basics of this algebraic frameork and e extend the preious results to the case of Spare gates. The algebraic frameork that e introduce to model Spare gates is presented in Section 2. The algebraic model of Spare gates is introduced in Section 3, and the probabilistic model hich can be deduced from it is gien in Section 4. Finally, a DFT example allos to highlight the usefulness of both models for the qualitatie and quantitatie analysis in Section 5. 2 BASICS AND NOTATIONS OF THE ALGE- BRAIC FRAMEWORK This algebraic frameork as described in (Merle, Roussel, Lesage, and Bobbio 21 and has been proposed to render the order of occurrence of eents hich is necessary for the modeling of dynamic gates. It ill not be detailed here, and only the basics and notations needed to understand the remainder of this paper ill be explained. To take into account the temporal aspect of eents, e consider the top eent, the intermediate eents, and the basic eents as temporal functions hich are defined on the set of positie times and take Boolean alues. As e consider nonrepairable eents only, a generic timing diagram of an eent a is gien in Fig. 1, here d(a is the unique date of occurrence of a. The neer-occurring eent is denoted by. a 1 d(a Figure 1: A non-repairable eent. t This algebraic frameork does not need to explicitly take time into account, since e only need to kno the order in hich eents occur to model dynamic gates. We then defined three temporal operators to model dynamic gates, hich are operators non-inclusie BEFORE (noted, SIMULTA- NEOUS (noted, and Inclusie BEFORE (noted. Thus, for instance, the algebraic model of the PAND gate in Fig. 2 becomes Q = (A B (A B, hich expresses that the output Q of the gate fails if A and B fail and if A fails before or at the same time as B. Figure 2: A PAND gate As the non-inclusie BEFORE operator is sufficient to model Spare gates, it is the only temporal operator that ill be retained in the remainder of this paper. Furthermore, e hae demonstrated that this algebraic frameork allos to determine the structure function of SFTs as it is commonly done by using the classical Boolean algebra of Boolean ariables. Besides, the definition of the three temporal operators allos to determine the structure function of any DFT ith gates PAND, and FDEP, and some theorems hich ere proided allos to reduce this structure function to the canonical form in (1, here T E is the Top Eent of the DFT and the eents b i are the basic eents of the DFT. T E = ( bi (b j b k, j / {i, k}. (1 3 ALGEBRAIC MODEL OF THE SPARE GATE To factors impact the difficulty to model the Spare gate: the number of input eents of the Spare gate, and the possibility for many Spare gate to share one or many spare eents. This section presents the algebraic model of the Spare gate in an increasing order of complexity. The algebraic model of a single Spare gate ith 2 to n input eents is presented in Sections 3.1 to 3.3. The particular case of 2 Spare gates ith 2 input eents sharing a spare eent is presented in Section 3.4, and e sho ho to generalize it to n Spare gates ith 2 input eents sharing a spare eent in Section 3.5. Besides, e consider that there is only one type of Spare gate, hich is the Warm Spare gate, and that 2

4 Cold and Hot Spare gates (Stamatelatos and Vesely 22 are particular cases of Warm Spare gates. Both of them are studied in Section Algebraic model of a single Spare gate ith 2 input eents Let us consider a Spare gate ith 2 input eents the primary eent A and one spare eent B as shon in Fig. 3. As stated in (Stamatelatos and Vesely 22, Figure 3: A single Spare gate ith one primary eent A and one spare eent B the output Q of the gate occurs hen the primary and all spares hae failed, so hen A and B hae failed, in this case. A and B are basic eents and cannot fail simultaneously (noted A B = so Q ill occur if A and B fail according to sequences [A, B] or [B, A]. It is important to note that in sequence [A, B], B fails hile in its actie mode (denoted as B a, hereas in sequence [B, A], B fails hile in its dormant mode (denoted as B d. It is essential to distinguish both failure modes by using to different ariables, for quantitatie analysis purposes. Indeed, B does not hae the same failure distribution hen it fails during its dormant mode (B B d or during its actie mode (B B a. As e aim at making possible the quantitatie analysis of DFTs from their structure function, this structure function must hence proide sufficient information to kno hether spare eents are in their dormant or actie mode. The algebraic behaior of gate Spare can hence be expressed as Q = B a (A B a A (B d A. hich expresses that the output Q of the gate fails if A fails before B B a (A B a, B hence being in its actie mode B a or if B fails before A A (B d A, B hence being in its dormant mode B d. Furthermore, as B cannot be both in an actie state and in a dormant state, e hae B d B a =. 3.2 Algebraic model of a single Spare gate ith 3 input eents Let us consider a Spare gate ith 3 input eents the primary eent A and to spare eents B and C as shon in Fig. 4. Figure 4: A single Spare gate ith one primary eent A and to spare eents B and C As stated in (Stamatelatos and Vesely 22, the output Q of the gate occurs hen the primary and all spares hae failed, so hen A, B, and C hae failed. A, B, and C are basic eents and cannot fail simultaneously so Q ill occur if A, B, and C fail according to sequences [A, B, C], [A, C, B], [B, A, C], [B, C, A], [C, A, B], or [C, B, A]. It is important to note that, hen the quantitatie analysis ill be performed from the structure function, B and C ill not hae the same distribution function in the 6 sequences. For instance, in sequence [A, B, C], both B and C fail during their actie mode (denoted by B a and C a, hereas in sequence [B, C, A], both B and C fail during their dormant mode (denoted by B d and C d. The algebraic behaior of gate Spare can hence be expressed as Q = C a (A B a (B a C a B a (A C d (C d B a C a (B d A (A C a A (B d C d (C d A B a (C d A (A B a A (C d B d (B d A As B and C cannot be both in an actie state and in a dormant state, e hae { Bd B a = C d C a = 3.3 Algebraic model of a single Spare gate ith n input eents The algebraic model of a single Spare gate ith n input eents can be determined in the same ay. It is just necessary to determine the n! possible failure sequences of the input eents of the Spare gate and denote the dormant and actie mode of the (n 1 spare eents in these failure sequences. The algebraic model of the Spare gate ill then be the algebraic sum of the expressions for hich each failure sequences holds, ith the additional condition that each spare 3

5 eent cannot be both in an actie and in a dormant mode. 3.4 Algebraic model of 2 Spare gates ith 2 input eents sharing a spare eent Let us consider 2 Spare gates ith 2 input eents ith primary eents A and B sharing a spare eent C, as shon in Fig. 5. Figure 5: To Spare gates sharing a spare eent C If e focus on the Spare gate on the left side, Q1 occurs as soon as A and C hae failed as stated in Section 3.1 or if A fails and C is made unaailable because B has failed before A. As a consequence, the algebraic model of the first Spare gate is { Q1 = Ca (A C a A (C d A A (B A C d C a = The algebraic expression for Q2 can be determined in the same ay by symmetry. Consequently, the final algebraic model of any of to Spare gates sharing a spare eent is { Q1 = Ca (A C a A (C d A A (B A Q2 = C a (B C a B (C d B B (A B C d C a = 3.5 Algebraic model of n Spare gates ith 2 input eents sharing a spare eent Let us consider n Spare gates ith 1 output eent Q i and 2 input eents: a primary eent P i i {1,, n} and a spare eent S. If e focus on the first Spare gate, Q 1 ill occur as soon as P 1 and S hae failed as stated in Section 3.1 or if P 1 fails and S is made unaailable because the primary eent of any of the other Spare gates has failed before P 1. As a consequence, the algebraic model of the first Spare gate is Q 1 = S a (P 1 S a P 1 (S d P 1 i 1 P 1 (P i P 1 S d S a = The algebraic expression for Q i, i {1,..., n}, can be determined in the same ay by symmetry. Consequently, the final algebraic model of any of n Spare gates sharing a spare eent is Q i = S a (P i S a P i (S d P i j i P i (P j P i S d S a = 3.6 Specific case of Cold and Hot Spare gates The algebraic models presented in Sections 3.1 to 3.5 are the algebraic models of Spare gates in the general case of Warm Spare eents. These algebraic models can be simplified in the specific cases of Cold and Hot Spare eents: if a spare eent S is a Cold Spare eent, it cannot fail hile in a dormant state, so S d ill neer occur and any expression containing S d in the algebraic models can be remoed; if a spare eent S is a Hot Spare eent, it ill hae the same distribution function hen in an actie and in a dormant state, so S a S d S and the algebraic models can be simplified. It can be noted that the algebraic models defined inole the temporal operator hich is used to model gates PAND and FDEP, so the expression (1 still holds in the case of a DFT ith Spare gates, and the structure function of any DFT can be determined and reduced to the canonical form in (1 as ell. 4 PROBABILISTIC MODEL OF THE SPARE GATE The probabilistic model of the Spare gates can be deduced from their algebraic model presented in Section 3 by determining the failure probability of each failure sequence thanks to the standard inclusion-exclusion formula (Triedi 21 and the folloing expressions (Amari, Dill, and Hoals 23; Fussel, Aber, and Rahl 1976, hich hold under the hypothesis of statistical independence: P r {a b} (t = F a (t F b (t P r {a b} (t = F a (t F b (t F a (t F b (t P r {a b} (t = P r {b (a b} (t = f a (u(1 F b (u du f b (u F a (u du (2 The probabilistic model of a single Spare gate ith 2 input eents is presented in Section 4.1 hereas the probabilistic model of 2 Spare gates ith 2 input eents sharing a spare eent is presented in Section

6 4.1 Probabilistic model of a single Spare gate ith 2 input eents According to Section 3.1, the algebraic model of a single Spare gate ith 2 input eents is Q = B a (A B a A (B d A. On the one hand, the cumulatie distribution function (Cdf and probability density function (pdf of B d do not depend on A, so P r {A (B d A} (t can be determined by means of the expressions (2 as P r {A (B d A} (t = f A (u F Bd (u du On the other hand, the Cdf and pdf of B a depend on the failure date of A, so P r {B a (A B a } (t cannot be determined by means of the expressions (2. If e respectiely denote by T A and T Ba the failure dates of A and B a, P r {B a (A B a } (t can be defined as P r {B a (A B a } (t = P r {T A T Ba t} = E [ 1 {TA T Ba }1 {TBa t}], here 1 is the indicator function and E is the expectation alue such that E [1 A ] = P r {A} According to the la of total expectation (Billingsley 1995, if X is an integrable random ariable and if Y is any random ariable, not necessarily integrable, on the same probability space, then As a consequence, E [X] = E [E [X Y ]] P r {B a (A B a } (t = = ( ( f TB T A (u T A = du f TA (d f Ba (u, du f A (d The probabilistic model of a single Spare gate ith 2 input eents hence is ( P r {Q} (t = f Ba (u, du f A (d F Bd (uf A (udu. The probabilistic model of a single Spare gate ith 3 or een n input eents can be determined in the same ay from the algebraic model of Spare gates presents in Sections 3.2 and Probabilistic model of 2 Spare gate ith 2 input eents sharing a spare eent According to Section 3.4, the algebraic model of the Spare gate on the left side in Fig. 5 is Q1 = C a (A C a A (C d A A (B A It can be noted that the first to terms of this expression C a (A C a and A (C d A do not depend on B hile the third term A (B A does. As a consequence, these three terms are not disjunctie. This expression can be conerted to an equialent form hich contains only disjunctie terms by introducing B in the first to terms: Q1 = C a (A B (B C a B (A C a (C a B C a (A C a B (3 B (C d A (A B A (C d A B A (B A, Its failure probability thus is P r {Q1} (t = P r {C a (A B (B C a } (t P r {B (A C a (C a B} (t P r { C a (A C a B } (t (4 P r {B (C d A (A B} (t P r { A (C d A B } (t P r {A (B A} (t and can hence be expressed according to the failure 5

7 distributions of A, B, and C as follos: P r {Q1} (t = ( (1 F B (t (1 F B (t f B (d f Ca (u, du f A (d f Ca (, d f A (d f B (udu ( f Ca (u, du f A (d f A (F Cd (d f B (udu f A (uf B (udu f A (uf Cd (udu The failure probability of Q2 can be determined in the same ay, by symmetry. The probabilistic model of n Spare gate ith 2 input eents sharing a common eent can be determined in the same ay from the algebraic model in Section APPLICATION TO A DFT EXAMPLE We propose to determine the failure probability of the Spare gates of a DFT example from (Boudali and Dugan 25 hich is depicted in Fig. 6. This DFT models the failure of a cardiac assist system (HCAS hich is diided into 4 modules: Trigger, CPU unit, motor section, and pumps. The Trigger consists of a crossbar sitch (CS and a system superision (SS. The failure of either CS or SS triggers the failure of both CPUs. The CPU unit is a arm spare, hich has a primary P and a spare unit B haing a dormancy of.5. For the motor section to function, either MOTOR or MOTORC need to be orking. The pumps unit is comprised of to cold spares, each haing a primary pump (PUMP 1 and PUMP 2, and sharing a common spare pump (Backup PUMP. In order for the pumps unit to fail, all three pumps need to fail and CSP 1 needs to fail before (or at the same time as CSP 2, i.e. PAND gate. This DFT can be diided into 3 subtrees: subtree 1, hich corresponds to the failure of the CPU unit: this subtree contains one OR gate, one FDEP gate, and one Warm Spare gate, and is hence dynamic; subtree 2, hich corresponds to the failure of the motor section: this subtree contains a single AND gate and is hence static; subtree 3, hich corresponds to the failure of the pumps unit: this subtree contains one PAND gate and to Cold Spare gates, and is hence dynamic. The failure probability of the to Spare gates of subtree 3 can be determined thanks to the probabilistic model of Section 4.2: P r {CSP 1} (t = ( (1 F P 2 (t f P 2 (d f BPa (u, du f P 1 (d f BPa (, d f P 1 (d f P 2 (udu ( f P 1 (uf P 2 (udu f BPa (u, du f P 1 (d here CSP 1 denotes the output of the Spare gate CSP Gate 1, and P 1, P 2, and BP denote the basic eents P UMP 1, P UMP 2, and Backup P UMP, respectiely. It can be noted that, contrary to the probabilistic model of Section 4.2, this expression contains only 4 terms since BP is a cold spare eent hich can consequently not fail hile in its dormant mode. In the same ay, P r {CSP 2} (t = ( (1 F P 1 (t f P 1 (d f BPa (u, du f P 2 (d f BPa (, d f P 2 (d f P 1 (udu ( f P 2 (uf P 1 (udu f BPa (u, du f P 2 (d here CSP 2 denotes the output of the Spare gate CSP Gate 2. In the particular case of exponential distributions, 6

8 Figure 6: The HCAS Dynamic Fault Tree from (Boudali and Dugan 25 F P 1 (t = 1 e λ P 1t F P 2 (t = 1 e λ P 2t F BPd (t = F BPa (t, min(t P 1, t P 2 = 1 e λ BP (t min(t P 1,t P 2 If e consider failure rates λ P 1 = λ P 2 = λ BP = for P 1, P 2, and BP, e get a failure probability of.84 at mission time T = 1, hours for both Spare gates. This result is the same as the result obtained thanks to the tool Galileo (Dugan, Sullian, and Coppit 2. It can be noted that the failure probability of the Top Eent of the DFT in Fig. 6 could be determined as ell, thanks to the theorems and the probabilistic models of gates PAND and FDEP presented in (Merle, Roussel, Lesage, and Bobbio 21. Hoeer, a Weibull distribution ould be more suitable to model the failure behaior and the aging of pumps, but such a distribution could not be handled by Continuous-Time Marko Chains or Stochastic Petri Nets based methods. The probabilistic model that e proide for Spare gates does not depend on the failure distribution considered for basic eents, and thus allos to consider such a case. The Weibull distribution has the expression so that 1 e λ(udu Let us consider that the failure of basic eents is modeled by a Weibull distribution ith a failure rate λ(t = t, hich means that the pumps hae an infant mortality and ill fail at a constant failure rate λ = after 2, 5 hours. We thus obtain a failure probability of.98 at mission time T = 1, hours for both Spare gates. 6 CONCLUSION In this paper, e hae presented an algebraic model of Spare gates. This model can be determined for any number of Spare gates ith any number of input eents, hether they are sharing spare eents or not, and for any type of Spare gate. This algebraic model alloed us to deduce a probabilistic model of Spare gates hich does not depend on the failure distribution considered for basic eents. Ongoing ork is currently addressed to the elaboration of efficient algorithms alloing to automatically perform the calculation of the structure function of DFTs and their analysis. F (t = 1 e t γ ( η β λ(t = β(t γβ 1 η β 7

9 REFERENCES Amari, S., G. Dill, and E. Hoals (23. A ne approach to sole dynamic fault-trees. In Proceedings IEEE Annual Reliability and Maintainability Symposium, pp Billingsley, P. (1995. Probability and measure. Ne York, USA: John Wiley & Sons. Bobbio, A. and D. C. Raiteri (24. Parametric Fault Trees ith Dynamic Gates and Repair Boxes. In Proceedings of the Annual Reliability and Maintainability Symposium (RAMS, Los Angeles, CA, USA, pp Boudali, H., P. Crouzen, and M. Stoelinga (27. A compositional semantics for dynamic fault trees in terms of interactie marko chains. In Proceedings of the 5th International Symposium on Automated Technology for Verification and Analysis (ATVA 27, Tokyo, Japan, pp Boudali, H. and J. B. Dugan (25. A discretetime Bayesian netork reliability modeling and analysis frameork. Reliability Engineering & System Safety 87, Coppit, D. and K. J. Sullian (22. Designing Modeling Languages: A Case Study in Dynamic Fault Trees. IEEE Transactions on Dependable and Secure Computing. Dugan, J., S. Bauso, and M. Boyd (199. Fault Trees and Sequence Dependencies. In Proceedings of the Annual Reliability and Maintainability Symposium (RAMS 199, pp Dugan, J., K. Sullian, and D. Coppit (2. Deeloping a lo-cost high-quality softare tool for dynamic fault-tree analysis. IEEE Transactions on Reliability 49(1, Dugan, J. B., S. Bauso, and M. Boyd (1992. Dynamic fault-tree models for fault-tolerant computer systems. IEEE Transactions on Reliability 41, Dutuit, Y. and A. Rauzy (1996. A Linear-Time Algorithm to Find Modules of Fault Trees. IEEE Transactions on Reliability 45(3, Fussel, J., E. Aber, and R. Rahl (1976. On the quantitatie analysis of priority-and failure logic. IEEE Transactions on Reliability R- 25(5, Gulati, R. and J. Dugan (1997. A modular approach for analyzing static and dynamic fault trees. In Proceedings of the Annual Reliability and Maintainability Symposium, Philadelphia, PA, USA, pp Henley, E. and H. Kumamoto (1981. Reliability Engineering and Risk Assessment. Engleood Cliffs: Prentice Hall. Leeson, N. (1995. Safeare: System Safety and Computers. Addison-Wesley. Merle, G. and J.-M. Roussel (27. Algebraic modelling of Fault Trees ith Priority AND gates. In Proceedings of the 1st IFAC Workshop on Dependable Control of Discrete Systems (DCDS 7, Paris, France, pp Merle, G., J.-M. Roussel, J.-J. Lesage, and A. Bobbio (29. Algebraic Expression of the Structure Function of a subclass of Dynamic Fault Trees. In Proceedings of the 2nd IFAC Workshop on Dependable Control of Discrete Systems (DCDS 9, Bari, Italy, pp Merle, G., J.-M. Roussel, J.-J. Lesage, and A. Bobbio (21. Probabilistic Algebraic Analysis of Fault Trees ith Priority Dynamic Gates and Repeated Eents. IEEE Transactions on Reliability 59(1, Raiteri, D. C. (25. The Conersion of Dynamic Fault Trees to Stochastic Petri Nets, as a case of Graph Transformation. Electronic Notes in Theoretical Computer Science 127(2, Stamatelatos, M. and W. Vesely (22. Fault tree handbook ith aerospace applications. Volume 1.1, pp NASA Office of Safety and Mission Assurance. Tang, Z. and J. Dugan (24. Minimal cut set/sequence generation for dynamic fault trees. In Proceedings of the Annual Reliability and Maintainability Symposium, Los Angeles, CA, USA, pp Triedi, K. (21. Probability & Statistics ith Reliability, Queueing & Computer Science Applications (2 ed.. Wiley. 8