Phased mission modelling using fault tree analysis

Transcription

1 Loughborough Unversty Insttutonal Repostory Phased msson modellng usng fault tree analyss Ths tem was submtted to Loughborough Unversty's Insttutonal Repostory by the/an author. taton: L ND, R.. and NDREWS, J.D., 23. Phased msson modellng usng fault tree analyss. IN: Proceedngs of the 5th RTS, dvances n Relablty Technology Symposum, Loughborough Unversty, prl 23, pp 8-98 ddtonal Informaton: Ths s a conference paper. Metadata Record: Publsher: (c) The authors Please cte the publshed verson.

2 Ths tem was submtted to Loughborough s Insttutonal Repostory by the author and s made avalable under the followng reatve ommons Lcence condtons. For the full text of ths lcence, please go to:

3 Phased Msson Modellng usng Fault Tree nalyss R La and and J D ndrews Department of Systems Engneerng, Loughborough Unversty, Lecestershre, UK bstract: Many types of system operate for mssons whch are made up of several phases. For the complete msson to be a success, the system must operate successfully durng each of the phases. Examples of such systems nclude an arcraft flght, and also many mltary operatons for both arcraft and shps. n arcraft msson could be consdered as the followng phases: taxng to the runway, takeoff, clmbng to the correct alttude, crusng, descendng, landng and taxng back to the termnal. omponent falures can occur at any pont durng the msson but ther condton may only be crtcal for one partcular phase. s such t may be that the transton from one phase to another s the crtcal event leadng to msson falure, the component falures resultng n the system falure may have occurred durng some prevous phase. Ths paper descrbes a means of analysng the relablty of non-reparable systems whch undergo phased mssons. Fault Tree nalyss has been used as the method to assess the system performance. The results of the analyss are the system falure modes n each phase (mnmal cut sets), the falure probablty n each phase and the total msson unrelablty. To ncrease the effcency of the analyss the fault trees constructed to represent the system falure logc are analysed usng a modularsaton method. nary Decson Dagrams (DD s) are then employed to quantfy the lkelhood of falure n each phase. Keywords: phased mssons, fault tree analyss, bnary decson dagrams Introducton If the success of a msson s relant upon a set of objectves operatng over dfferent tme ntervals, t may be referred to as a Phased Msson. Durng the executon of the phases n a msson, the system s altered such that the logc model, system confguraton, or system falure characterstcs may change to accomplsh a dfferent objectve. The phases n a msson may be expressed n terms of: phase number, tme nterval, system confguraton, task(s) to be undertaken, performance measure(s) of nterest, and mantenance polcy. Ths type of msson can be characterzed as a sequence of dscrete events requred to complete a task e.g. an arcraft flght phase pattern. In order to dentfy possble causes of phase and msson falure, a method s requred to express how combnatons of component falures (basc events) can occur durng the phases throughout the msson and cause system falure. These falure events then requre quantfcaton to enable the lkelhood and frequency of msson falure to be determned.

4 The man technques that have prevously been mplemented for the soluton to phased msson problems are that of Fault Tree nalyss, Markov nalyss and Smulaton. The technque of fault tree analyss (FT) s a commonly used tool to assess the probablty of falure of ndustral systems. Ths method may be adapted for analyss of systems comprsng of more than one phase, where each phase depends on a dfferent logc model. Hence the complexty of the modellng s sgnfcantly more dffcult than for sngle phase systems. The fault tree approach represents the falure logc of the system n an nverted tree structure, and allows for both qualtatve and quanttatve system relablty analyss to take place. The earlest nspecton of the analyss of phased mssons was that carred out by Esary and Zehms []. Ths research employed a fault tree method by whch the msson s splt nto consecutve phases whereby each phase performs a specfed task. The success of the msson depends on the performance of the non-reparable components used n each phase. The probablty of ths success s referred to as the Msson Relablty. Msson unrelablty s defned as the probablty that the system fals to functon successfully durng at least one phase of the msson. n mportant problem s to calculate, as effcently as possble, ether the exact value or bounds for the msson unrelablty parameter. Methods to obtan estmates of such bounds are dscussed by urdck et al [2]. Stuatons may be encountered n phased msson analyss that prevent the assumpton of ndependence between component falure or repar beng made. In such crcumstances, methods other than fault tree analyss must be appled. One such technque s the Markov approach [3]. The relablty of a msson may not be obtaned by the smple multplcaton of the ndvdual phase relabltes. Ths s due to the fact that at the phase change tmes, the system must occupy a state that allows both of the nvolved phases to functon. The phases of the msson wll be statstcally dependent and an approach for soluton has been presented by Smotherman and Zemoudeh[4] for reparable components. Of the many consdered solutons to phased msson problems, smulaton technques typcally offer the greatest generalty n representaton, but are also often the most expensve n computatonal requrements. The Markov method offers a combnaton of flexblty n representaton and ease of soluton but requres transton rates to be ndependent of tme[5], and suffers from a potental exploson n the number of state equatons for even moderate szed problems. In some stuatons, t wll be dffcult to model a system by fault tree or Markov methods. Ths type of stuaton wll occur f a system s too complex to use determnstc analyss, or f the falure and repar dstrbutons of a component may not have a constant falure or repar rate. In such crcumstances, smulaton may be necessary. Prevous work has concentrated on assessng msson success. Ths paper dentfes the probablty of falure n each phase. Dependng on the phase that the falure occurs, the consequences can be sgnfcantly dfferent. Havng calculated the probablty of falure n each phase, the msson unrelablty s smply the sum of the phase falure probabltes. In reducng the complexty of the problem n ths way, the effcency of the approach s mproved. Further mprovement can be acheved by employng modularsaton methods and the nary Decson Dagram (DD) method. Focus wll be restrcted to a system where components are non-reparable.

5 2 Prevous Fault Tree Methods for Phased Mssons very smple phased msson problem consstng of non-reparable components wth, and representng component falures n each of the phases may be used to demonstrate approaches to phased msson analyss (Fgure. ). The smple system wll enable the features of the approaches to be understood wthout complcated analyss. Durng phase whch lasts untl tme t the success of the msson s dependent upon all of the three components,, and. Successful completon of phase means the system then enters phase 2 whch requres component to functon between tmes t and t 2, along wth at least one of the remanng two components and. The fnal phase requres that only one out of the three components must functon between t 2 and t 3 for the msson to be accomplshed successfully. Phase Phase 2 Phase 3 t t t 2 t 3 Fgure Relablty Network of a Smple Phased Msson System onsderng the phases as separate systems, the fault trees to represent ndvdual phase falure are as shown n Fgure 2. The notaton used to represent component falure n phase s,, for components, and respectvely. Falure n Phase Falure n Phase 2 Falure n Phase 3 Fgure 2 Fault Tree Representaton of Indvdual Phase Falures

6 The mnmal cut sets for each phase when treated as separate systems are: Phase Phase 2 Phase 3 The method of calculatng the relablty of a phased msson cannot smply be obtaned by the multplcaton of the relabltes of each of the ndvdual phases as ths nvolves the false assumptons that the phases are ndependent and all components are n the workng state at the begnnng of each phase, and results n an apprecable over-predcton of system relablty. method proposed by Esary and Zehms [] nvolves the transformaton of a mult-phase msson to that of an equvalent sngle phase msson. Ths transformaton process nvolves three stages and s only concerned wth the falure of the msson. It does not account for the phase n whch falure occurs. Havng expressed the falure causes for each phase by separate fault trees as n Fgure 2, the transformaton to sngle phased msson s acheved by:. Elmnaton of unnecessary cut sets. If cut sets of an earler phase contan any from a later phase they may be removed from the frst. For example f the mnmal cut sets for each phase n the msson are: Phase Phase 2 DE F then mnmal cut set can be removed from phase as falng n phase means t wll stll be faled n phase 2 whch wll fal the msson. Ths makes the status of component rrelevant. In the problem shown n fgure 2 t means that mnmal cut set can be removed from phase. 2. omponent falure events n each phase fault tree are replaced by an OR combnaton of the falure events for that and all precedng phases. For example, component falure n phase 2 would be represented by the OR of the falure of the component n phase ( ) and n phase 2 ( 2 ) snce the component s non-reparable (see Fgure. 3). [Note the replacement s only performed on phase fault trees whch have the elmnated mnmal cut sets removed]. Falure of component n Phase 2 2 Fgure. 3 Replacement OR combnaton

7 3. Each phase falure s combned usng an OR gate to represent overall msson falure (.e. the event that any phase does not complete successfully). Ths transforms the orgnal mult-phase msson nto an equvalent sngle phase msson as shown n Fgure. 4. Msson Falure Falure n Phase Falure n Phase 2 Falure n Phase Fgure. 4 Equvalent sngle phase msson Ths equvalent sngle phase msson (see Fgure. 4) produces dfferent mnmal cut sets than would have resulted from the combnaton of the ndvdual phase mnmal cut sets. The process of removng cuts sets pror to the constructon of fault trees can generally be seen to produce a smpler falure dagram and problem for analyss. However, snce cuts sets are removed to produce ths sngle phase msson, t becomes mpossble to calculate ndvdual phase falure probabltes whch would be desrable. 3 Proposed Fault Tree Method for Phased Mssons new method s proposed whch enhances the fault tree approach n the prevous secton. It wll enable the probablty of falure n each phase to be determned n addton to the whole msson unrelablty. For any phase, the method combnes the causes of success of prevous phases wth the causes of falure for the phase beng consdered to allow both qualtatve and quanttatve analyss of both phase falure and msson falure. The event of component falure n phase s agan represented as the event that the component could have faled durng any phase up to and ncludng phase. System falure n phase s represented by the ND of the success of phases..- and the falure durng phase. (Fgure. 5)

8 Falure Durng Phase Success n Prevous Phases Falure ondtons Met Durng Phase Phase fault tree wth each basc event replaced wth an OR combnaton of component falure n any prevous phase Falure n Phase Falure n Phase - Fgure. 5 Generalsed Phase Falure Fault Tree Msson unrelablty, Q MISS, s then obtaned from Q MISS = n = Q () where Q s the falure probablty n phase and n s the total number of phases. Ths method allows for the evaluaton of ndvdual phase falures, and also accounts for the condton where components are known to have functoned to enable the system to functon n prevous phases. However, due to the fact that cut sets are not removed untl a later stage n the analyss, the fault tree can be much more complex and requre sgnfcantly more effort to solve. The falure of a system may occur n many dfferent ways. Each unque way s referred to as a system falure mode, and nvolves the falure of ether a sngle component, or the combnaton of falures of multple components. To determne the mnmal cut sets of a phase or msson, ether a top-down or a bottom-up approach s appled to the relevant fault tree. For any phases after the frst phase, the ncorporaton of the success of prevous phases means that the fault tree wll be non-coherent and not smply consst of ND and OR gates. NOT logc wll be requred to represent ths success, and the combnatons of basc events that lead to the occurrence of the top event are referred to as Prme Implcants. Ths proposed method may be appled for the smple three-phase msson gven n Fgure. The fault tree to represent the ntal phase falure of the msson remans dentcal to the fault tree representaton of the ndvdual phase falure of phase shown n Fgure 2. Phase 2 falure can then be shown as the combnaton of phase success and falure n phase 2 (Fgure 6).

9 Fals durng Phase 2 Functon through Phase Falure ondtons met n Phase Fgure 6 Phase 2 Falure Fault Tree Smlarly, phase 3 falure can be represented as the combnaton of phase and phase 2 successes, and falure n phase 3 (Fgure 7). Fals Durng Phase 3 Functons Through Phase Functons Through Phase 2 Falure ondtons Met n Phase Fgure 7 Phase 3 Falure Fault Tree 3. Fault Tree Modularsaton Fault tree modularsaton technques are helpful to reduce the sze of a fault tree to enable prme mplcants to be found more effcently. These modularsaton technques reduce both memory and tme requrements. non-coherent extenson of a modularsaton technque developed by Rso [6] has been

10 employed n ths work. It repeatedly apples the stages of contracton, factorsaton and extracton to reduce the complexty of the fault tree dagram. The phases are dentfed as: ontracton Subsequent gates of the same type are contracted to form a sngle gate. The resultng tree structure s then an alternatng sequence of OR and ND gates. Factorsaton Identfcaton of basc events that always occur together n the same gate type. The combnaton of events and gate type s replaced by a complex event. However, snce NOT logc s ncluded n order to combne phase success and falure means that n ths stage, the prmary basc events that are found to always occur together n one gate type must have complements that always occur together n the opposte gate type by De Morgans s laws, e.g. 2 = + 2 = 2 = 2 = + Extracton Searches for structures wthn the tree of the form shown n Fgure 8 that may be smplfed by extractng an event to a hgher level. Fgure 8 Extracton Stage of the Modularsaton Technque

11 3.2 Prme Implcants n Phased Msson Systems Due to the non-coherent nature of the fault trees, the combnatons of basc events that lead to the occurrence of the top event of any phase falure are expressed as prme mplcants. The notaton used to represent the falure of component n phase s. represents the functonng of component throughout phase. The notaton used to ndcate the falure of a component n phase to j s j,.e. fals at some tme from the start of phase to the end of phase j. Ths notaton enables us to defne a new algebra over the phases to manpulate the logc equatons. What s of concern n later phases s the tme duraton (.e. phases) durng whch the component falures occur. So f we produce a combnaton of events for component : ( + 4 ) 2 3 t means we wll only produce the top event beng developed f fals n phases 3 or 4.e. 34 where, q = q ( t t f t dt 34 2, 4 ) = ( ) f ( t) s the densty functon of falure tmes for component t4 t2 summary of the new algebrac laws are: = j = j j = = +, j j = = j Therefore f two mplcant sets contan exactly the same components where all but one of whch occur over the same tme ntervals and the other s a falure n contguous phases, the two mplcant sets may be combned wth the perod of falure for the component wth tme dscrepancy adjusted, eg: j = j (2) 2 2

12 s the components are non-reparable, the event of component falure wll only be possble over contguous phases. Ths smplfcaton approach therefore allows the prme mplcants for the smple example gven n Fgure to be expressed as: Phase T = + + Mnmal ut Sets: Phase 2 T = ( ) = = Prme Implcants: Phase 3 T 3 = (( ( 3 3 = ) ( ) ( ) ( ) 3 Prme Implcants: Quantfcaton Havng establshed the prme mplcants for each phase they may now be used to quantfy the probablty of phase and msson falure. The unrelablty, Q,for each ndvdual phase s found usng a smple ncluson-excluson expanson for the prme mplcants j n the phase,

13 N Q = P ( ) P ( ) + + ( ) L P ( L ) N N j j j = j = k = j k 2 Therefore the event of phase falure for ths smple three-phase msson may be expressed as: Phase : Q = q + q + q q q q q q q + q q q Phase 2: Q = q ( q )( q ) + ( q ) q q q q q (3) Phase 3: Q = q q q + q q q q q q s the falure of each of the phases produce mutually exclusve causes, the probablty of msson falure may be expressed as a sum of the unrelabltes of the ndvdual phases: N Q MISS = n = Q (4) For systems wth non-reparable components, the expected number of falures per msson s equal to the msson unrelablty. 4 nary Decson Dagram nalyss for Phased Mssons Fault Tree Structure s very effcent to represent system falure logc, however s not an deal form for mathematcal analyss. nary Decson Dagrams (DDs) represent a logc expresson and offer effcent mathematcal manpulaton, although t s very dffcult to construct drectly from the system defnton. For larger fault trees t s more effcent to convert to a DD pror to analyss. The approach of performng the quantfcaton process after frst convertng the fault tree to a DD form offers sgnfcant advantages for large complex fault trees. Ths s partcularly true of structures whch are non-coherent, such as the phase falure fault trees. Fgure 9 shows a nary Decson Dagram. Paths through the DD start at the top root node and termnate at one of two termnal nodes, or. termnal one ndcates top event occurrence and termnal zero s top event non-occurrence. Root Node Termnal Vertex Termnal Vertex Fgure 9 nary Decson Dagram

14 Each node on the dagram corresponds to a basc event n the fault tree whch has to be placed n an orderng pror to DD constructon. In ths case the orderng s <<. ll nodes have two out branches, a branch corresponds to component falure and a branch corresponds to a component workng state. Prme mplcants are gven by events on paths through the dagram whch lead to a termnal vertex,.e., In ths case, by consensus these can be reduced to mnmal cut sets: snce ths DD does not represent a non-coherent system. More detals of qualtatve DD analyss can be found n reference [7]. 4. onstructon bnary decson dagram conssts of vertexes where each vertex has an f-then-else structure as shown n Fgure. If(X) then onsder functon f else onsder functon f2 endf X f f2 Fgure nary Decson Dagram Vertex Ths f-then-else structure s represented n shorthand (te) notaton as te(x, f, f2) To combne two basc events usng a logcal operaton, If and J = te( X, f, f 2) H = te( Y, g, g2)

15 If X < Y J H = te( X, f H, f 2 H ) If X = Y J H = te( X, f g, f 2 g2) (5) The basc events n any DD are represented as = te(,, ) and = te(,, ). For phased msson systems, the DD s constructed so that each component s consdered n each phase (n phase order) before the next basc event s taken nto account. 4.2 Quantfcaton Snce each path to a termnal s dsjont then the exact top event probablty Q EXT s gven by: Q = n p( EXT r = where p r ) s the probablty of the th dsjont path to ( ) Further detals of DD quantfcaton can be found n reference [8]. 4.3 Example The smple three-phase msson llustrated n Fgure may be represented n DD form for each phase and then quantfed. The fault trees for phase (Fgure 2), phase 2 (Fgure 6) and phase 3 (Fgure 7) are frst converted to DDs. These DDs are shown n Fgures -3 respectvely. Ther analyss s presented below. In DD methodology to evaluate the success of a phase as opposed to the falure, a s replaced by a and a by a for the termnal nodes.

16 Phase For phase, the te structure represented by the DD n Fgure s: te(,, te(,, te(,, ))) Fgure Phase Falure DD nalyss of ths DD gves Mnmal ut Sets: Q = q + ( q ) q + ( q )( q ) q Phase 2 The DD for falure durng phase 2 s gven by the followng te structure: te(,, te(, te(,, te(,, )), te(,, te(, te(,, te(,, )), )))) 2 2 2

17 2 2 2 Fgure 2 Falure Durng Phase 2 DD For each path to a termnal, usng the algebra of events gves, Prme Implcants: => Nodes on a DD path wll represent falure or functonng of a partcular component through dfferent phases. These must be combned usng the algebra of events gven earler pror to evaluatng the probablty of the status requred of that component. Havng consdered each component encountered on a path the probablty of the path to the termnal s evaluated as usual by takng the product of the probablty of the component status. The phase falure s then obtaned by summng the probablty of each dsjont path. Q = ( )( ) + ( ) 2 q q 2 q q q q 2 q 2 2

18 Phase 3 The DD representaton for the fault tree representng falure durng phase 3 s: Fgure 3 Falure durng Phase 3 DD Prme Implcants: Q = q q q + q q q q q q Therefore t can be seen that the unrelablty of each of the phases as found by the DD method s dentcal to that obtaned usng fault tree analyss (Equaton 3). 5 onclusons. The accurate assessment of msson unrelablty for systems wth non-reparable components operatng over a sequence of phases can be performed usng non-coherent fault tree structures.

19 2. The drect quantfcaton of the fault trees s frequently problematc for even moderate szed problems due to the sze and complexty of the resultng logc functons. 3. Fault tree modularsaton methods provde some reducton n the sze of the problem but not enough for ths alone to offer a practcal soluton method. 4. The use of nary Decson Dagrams (enhanced to account for the phased nature of component falures) to calculate the falure probablty of each phase n the msson provdes an effcent and accurate means of evaluatng the msson relablty. 6 References [] J.D.Esary, H. Zehms, Relablty of phased Mssons, Relablty and Fault-Tree nalyss, Socety for Industral ppled Mathematcs, Phla. 975, pp23-236, 974 September. [2] G.R.urdck, J..Fussell, D.M.Rasmuson, J.R.Wlson, Phased Msson nalyss: Revew of New Developments and an pplcaton, IEEE Trans. Relablty, vol R-26, 977 pr, pp [3]..larott, S.ontn, R.Somma, Reparable Multphase Systems - Markov and Fault-Tree pproaches for Relablty Evaluaton, n postolaks, Garrbba, Volta (eds.), Synthess and nalyss Methods for Safety and Relablty Studes, Plenum Press, 98, pp [4] Mark Smotherman, Kay Zemoudeh, Non-Homogeneous Markov Model for Phased Msson Relablty nalyss, IEEE Trans. Relablty, vol 38, 989 Dec, pp [5] Mark Smotherman, Robert M. Gest, Phased Effectveness usng a Non-homogeneous Markov Reward Model, Relablty Engneerng and System Safety, vol 27, 99, pp [6] K. Reay, J.D. ndrews, fault tree analyss strategy usng bnary decson dagrams, Relablty Engneerng and System Safety, vol 78, 22, pp [7] R.M. Snnamon, J.D. ndrews, Improved effcency n qualtatve fault tree analyss, Qualty and Relablty Eng g Int l, vol 3, num 5, 997, pp [8] R.M. Snnamon, J.D. ndrews, Improved accuracy n qualtatve fault tree analyss, Qualty and Relablty Eng g Int l, vol 3, num 5, 997, pp cknowledgement The work descrbed n ths paper was conducted as part of a research project funded by the Mnstry of Defence. The vews expressed are those of the authors and should not be consdered as those of the Mnstry of Defence. The authors would lke to thank Rchard Dennng, MOD, for hs nput to the research descrbed n the paper.

20