Added value in fault tree analyses

Transcription

1 Safety, Relablty and Rsk Analyss: Theory, Methods and Applcatons Martorell et al. (eds) 2009 Taylor & Francs Group, London, ISBN Added value n fault tree analyses Tommy Norberg Department of Mathematcal Scences, Chalmers Unversty of Technology, Göteborg, Sweden Department of Mathematcal Scences, Unversty of Gothenburg, Göteborg, Sweden Lars Rosén & Andreas Lndhe Department of Cvl and Envronmental Engneerng, Chalmers Unversty of Technology, Göteborg, Sweden ABSTRACT: It s recognzed that the usual output of a fault tree analyss n some studes s not suffcently nformatve. For added value n a wdely used nstrument for dong rsk analyses, a Markovan approach s suggested. It s shown how to extend the calculatons of the standard fault tree gates, so that nformaton s avalable not only on the falure probablty at the top level, but also on estmates of ts rate of falure and mean down tme. In applyng ths to an ntegrated fault tree analyss of a muncpal drnkng water system, we further dentfed the need for gates that are varatons of those currently n use. 1 INTRODUCTION A major purpose of a fault tree s to assst n the calculaton of the probablty of falure, P(F) say, for systems bult by smpler subsystems or components. A fault tree s constructed deductvely untl a sutable level of detal s reached. Input to the fault tree calculatons are probabltes P(F ) for base events F, where F denotes falure of subsystem or component. Often t s assumed, and so wll we, that the base events are ndependent. If for any, F represents the event that subsystem s down at a partcular pont n tme, then P(F) s the probablty that the system s down at that partcular tme pont. Moreover, n the statonary case, P(F) as well as all P(F ) do not depend on tme. Assumng ergodcty, P(F) can be thought of as the rato between the Mean Down Tme (MDT) and the Mean Tme Between Falures (MTBF), P(F) = MDT MTBF where MTBF = MTTF + MDT and MTTF s short for Mean Tme To Falure. Ths fact tells us that the probablty P(F) s not partcularly nformatve, snce two systems wth very dfferent dynamc behavor can share the same P(F). It s the purpose of ths paper to suggest a way to extend the fault tree calculatons so that also estmates of MTTF and MDT are calculated at the top level as well as at each ntermedate level. Ths of course requres knowledge of all MTTFs and all MDTs at the base level. Estmates are then recursvely calculated at each level of the tree. These estmates are calculated under the assumpton that the nput processes are ndependent and Markovan wth only two states, up and down. That s, the falure rate s assumed to be constant and equal to 1/MTTF. A smlar remark apples to the rate at whch the process recovers from falure. At ntermedate levels and at the top, the rates typcally are not constant. The calculatons, however, assumes constant nput rates and yeld constant output rates. Thus there are errors that when propagated to the top level may be qute substantal. We beleve, however, that n applcatons wth gross parameter uncertantes often the man errors n the fnal result are due to the errors n the assumed base parameter values. In such cases the enlargement of the standard fault tree calculatons suggested n ths paper wll provde a consderable and valuable nsght nto the dynamcs of the system under study. We commence n Secton 2 by showng how ths can be done for the two basc types of gates n a fault tree. We then extend the argumentaton to two auxlary gates that we have found use for. Then, n Secton 3, we study a smple example to some extent. In Secton 4 we brefly dscuss how our deas were used n a fault tree analyss of a large muncpal drnkng water system, 1041

2 see (Lndhe et al. 2008). It was ths study that motvated the present work. Fnally, n Secton 5 we dscuss and draw some general conclusons. 2 FAULT TREES The reader s referred to (Rausand and Højland 2004, Chapter 3.6) for a basc ntroducton to fault tree analyss n relablty; (Bedford and Cook 2001, Chapters 6, 7) dscuss fault trees from a rsk perspectve. Typcally a fault tree s a combnaton of two types of logc gates the OR- and the AND-gate and the fault tree s bult by repeated applcaton from the top event and down untl a sutable level of detal s obtaned. We wll refer to a gate wth top or output event F and base events F as a subsystem consstng of components all of whch are ether up or down at a partcular pont n tme. Below we wll consder the two basc types of gates and two varatons of the AND-gate. A subsystem comprsed of an OR-gate s up (functonng) as long as every component s up. That s, F c = Fc (A c s the logcal complement of A). Hence, F = F (1) Smlarly, a subsystem comprsed of an AND-gate s up as long as at least one of ts components s up. That s, F c = Fc or F = F (2) Cf. Fgures 1 and 2. The abbrevatons n these fgures wll be explaned n the example of Secton 3 below. If the base events are ndependent (whch wll be assumed throughout), then (1) and (2) mply Fgure 2. An AND-gate wth base events F D1, F D2 and output event F DP = F D1 F D2. P(F) = 1 P(F) = (1 P(F )) (3) P(F ) (4) respectvely. These are the basc fault tree calculatons that wll be enlarged below. 2.1 The OR-gate We frst study the OR-gate, whch s defned by formulae (1) and (3). In relablty, the OR-gate corresponds to a seres structure. See e.g. (Rausand and Højland 2004). Replace each base event of the gate by a Markov Process (MP) havng two states, up 1 and down 0. Let λ and 1/μ denote the falure rates and the mean down tmes, respectvely, for these base MPs; (Rausand and Højland 2004) contans an ntroducton to contnuous tme Markov chans n relablty. Clearly, λ P(F ) = λ + μ so, by (3), P(F) = 1 μ λ + μ (5) In Fgure 3 the state dagram of the combned MP s shown for the case of two base components. Suppose the system s up. Then the tme to the next falure s exponental ( λ ). The system falure rate s thus Fgure 1. An OR-gate wth base events F PS, F SC, F D and output event F AS = F PS F SC F D. λ = λ (6) 1042

3 Fgure 3. State dagram of a Markov Processes representng an OR-gate. The process s down (.e., n faled state) f at least one base process s down. Fgure 4. State dagram of a Markov Process representng an AND-gate. The process s down when all base processes are down. Let further 1/μ be the system mean down tme. Then P(F) = λ λ + μ (7) By equalng (7) and (5), and usng (6) whle solvng for μ, we obtan ( ) μ = μ (λ + μ ) μ λ (8) The formulae (6) and (8) enlarge the standard fault tree calculatons for the case of an OR-gate, so that now we know not only how to calculate the probablty P(F) that the subsystem comprsng the gate s n ts faled state, but also ts falure rate λ and mean down tme 1/μ. 2.2 The AND-gate We next study the standard AND-gate, the calculaton of whch s gven by (4); cf. also (2). In relablty, an AND-gate corresponds to a parallel structure. Agan replace each base event by an MP wth only two states, up 1 and down 0. Let λ and 1/μ denote the falure rates and the mean down tmes, respectvely, for the base MPs. Then, by (4), P(F) = λ λ + μ (9) s the probablty that the combned MP s down. In Fgure 4 the state dagram of the combned MP s shown for the case wth two base events. Wrte 1/μ for the mean down tme of the combned MP. Then, necessarly, μ = μ (10) Next, ntroduce a mean up tme 1/λ so that (7) holds true. By equalng (9) and (7), and usng (10) whle solvng for λ, we obtan ( ) λ = λ (λ + μ ) λ μ (11) The formulae (10) and (11) extend the standard fault tree calculatons for the case of an AND-gate, so that now we know not only how to calculate the probablty P(F) that the subsystem comprsng the gate fals, but also ts falure rate λ and mean down tme 1/μ. (We make here and n smlar nstances below the smplfyng assumpton that the falure rate s constant and equals the recprocal of the mean tme to falure.) 2.3 A 1st varaton of the AND-gate Consder e.g. a subsystem comprsng of a power generator and a battery back-up of lmted lfe length and such that t may fal on demand. The state dagram of such a process s shown n Fgure 5. The combned system s up as long as the man subsystem s up (state 1) or down whle at the same tme the back-up s up (state 1043

4 01); t s down when n state 0; λ 1 and 1/μ 1 denotes the falure rate and mean down tme of the subsystem (.e., power generator), q 2 s the probablty of falure on demand for the back-up system and ts up-tme s exponental(λ 2 ). The balance equatons for ths Markovan system are p 1 λ 1 = p 01 μ 1 + p 0 μ 1 p 01 (μ 1 + λ 2 ) = p 1 λ 1 (1 q 2 ) p 0 μ 1 = p 1 λ 1 q 2 + p 01 λ 2 where p 1 and p 01 are the statonary probabltes for the system to be n ether of ts up-states, and p 0 s the probablty that the system s n ts down state. Solvng for p 0 s straghtforward. We get p 0 = λ 1 λ 2 + q 2 μ 1 λ 2 + μ 1 If the lfe length of the back-up s unlmted,.e., λ 2 = 0, ths formula becomes p 0 = λ 1 q 2 Smlarly, one may prove that p 0 = λ 1 =1 λ + q μ 1 λ + μ 1 f the subsystem has several ndependent back-ups. From the fact that P(F) = p 0, we now conclude P(F) = λ 1 =1 λ + q μ 1 λ + μ 1 (12) The rate at whch the system recovers from ts down state 0 s μ 1. Hence μ = μ 1 (13) Now λ may be calculated by nsertng (13) n (7) and equatng the latter and (12). 2.4 A 2nd varaton of the AND-gate Consder next a subsystem comprsng a power generator havng another power generator as back-up. The back-up may fal to start on demand. Some people would refer to such a system wth the phrase cold stand-by. The state dagram of such a process s shown n Fgure 6. The down states are 0 and 00; λ 1 and 1/μ 1 denotes the falure rate and mean down tme of the man power generator, q 2 s the probablty of falure on demand for the back-up generator whle ts upand down tmes are ndependent and exponental(λ 2 ) and (μ 2 ), respectvely. A straghtforward analyss of the balance equatons shows that p 0 = λ 1q 2 (14) p 00 = λ 1(1 q 2 ) λ 2 λ 2 + μ 1 + μ 2 (15) Hence, P(F) = λ 1 λ 2 + q 2 (μ 1 + μ 2 ) (16) λ 2 + μ 1 + μ 2 Fgure 5. State dagram of a Markov Processes representng the varant of the AND-gate studed n Secton 2.3. The process s down whle n state 0. Fgure 6. State dagram of a Markov processes representng the varant of the AND-gate studed n Secton 2.4. The process s down whle n state 0 or

5 The down tmes are 1/μ 1 and 1/(μ 1 + μ 2 ), whle n states 0 and 00, respectvely. Hence, 1 μ = p 0 p 0 + p 00 1 μ 1 + p 00 p 0 + p 00 1 μ 1 + μ 2 By solvng for μ, we obtan μ = μ 1 (μ 1 + μ 2 )(λ 2 + q 2 (μ 1 + μ 2 )) q 2 (λ 2 + μ 1 + μ 2 )(μ 1 + μ 2 ) + (1 q 2 )λ 2 μ 1 (17) Now λ follows readly from (16) and (2.4) by means of (7). It s clear that f μ 2 = 0, then ths 2nd varant of the AND-gate concdes wth the one dscussed n Secton 2.3. The reason for a separate dscusson of the 1st varant s that t readly extends to cases wth several ndependent back-ups. Ths s not so for the 2nd. 2.5 Remarks on our enlarged fault tree calculatons The calculatons n a fault tree are from bottom to top. The data (.e., results) at one level form the nput to the calculatons on the level mmedately above. Our approach presumes that the nput data to one level consst of Markovan down and up rates. The calculated rates, however, are not necessarly Markovan. Stll, the calculatons at the next level presume that they are. Clearly, ths ntroduces an error makng t wrong to assume that rates calculated at the top or at any ntermedate level are Markovan. We clam, however, that t s n many nstances reasonable to assume that they are Markovan. In other words, denote by λ the calculated rate of falure at the, say, top level. Let T be a typcal uptme and denote by ρ(t) ts falure rate. Then T s not necessarly exponental(λ) and t needs not to be true that ρ(t) = λ. However, n many nstances λ s a reasonably good frst order constant approxmaton to ρ(t). That s, by constructon always s true. Ths fnal remark apples of course only to fault trees that only contan the standard OR- and AND-gates. 3 EXAMPLE An Alarm System (AS) conssts of a Supervsng Computer (SC), ts Power Supply (PS) and a Detector Package (DP). In order for the system to functon all these subsystems must. Thus they are coupled n seres and the approprate fault tree gate s an OR-gate. See Fgure 1. The detector package conssts of two detectors (D1 and D2) that are separately battery powered and t s regarded enough that one of them s functonng at each partcular tme nstant. Thus they are coupled n parallel and the approprate fault tree gate s an ANDgate. See Fgure The power supply We now drect our attenton to the relablty of the power supply, snce t s naturally modeled by the 2nd varaton of the AND-gate dscussed n Secton 2.4. The back-up generator does not always start on demand, and that f so then t s not at all lkely that t wll be repared before the man power s up agan. On the other hand, f t does start, t may stop because of lack of fuel and such stops are lkely to be short. The estmated values of the parameters of the Man Power system (MP) and the Back-up power system (BP) s shown n Fgure 7. The unt of tme s hours. ρ(t) λ A smlar remark apples to the mean down tme 1/μ. Notce, however, that the probablty P(F) of falure s calculated exactly at each level and that (7),.e., P(F) = λ λ + μ Fgure 7. Fault tree representaton of the Power Supply (PS). Its components are the Man Power (MP) and the Back-up Power (BP) systems. The AND-gate s of the knd dscussed n Secton 2.4. The tme unt s hours. 1045

6 It s requred that the long run unavalablty of the alarm system s less than 0.15%, and that ts rate of falure s less than 1 per month. A rsk measure of nterest s the yearly frequency of down perods that last for more than 12 hours. If ths (rsk) frequency s consdered to be too large, rsk reducton measures have to be mplemented. Thus, at the top level, the requrements are 100P(F) 0.15 and 8766λ 12. Our unt of tme s hours. Let Y denote a generc down tme. Then P(Y > y) e yμ. An estmate of the frequency of long stops (LS), λ LS λe 12μ, s requred from the analyss. Usng the formulae of Secton 2.4, we get 100P(F) λ /μ λ LS 0.1 (In the next secton these values wll be referred to as beng FT-calculated.) A few remarks are n order. 1. The power supply system long run unavalablty s 0.14%. 2. The back-up generator changes the falure rate from 2 falures per 1000 hours, to 0.4 whch s well below the stpulated 1.4 for the complete system. 3. The mean down tme s 3.3 hours. 4. The frequency of long stops s about 1 per 10 year. It s then recognzed that there are gross uncertantes n the nput parameters. Thus an uncertanty analyss of the system s needed n order to see how t s translated nto the output parameters and especally nto the frequency λ LS of long stops. After approprately combnng the avalable sparse data wth expert opnon, the uncertanty denstes of the parameters were specfed. See Table 1. The reason for choosng Gamma denstes for the Markov rates λ and μ are two-fold: (1) the Gamma densty s conjugate to the exponental (or Posson) densty; and (2) our experence s that t s easer for experts to state ther opnon n terms of falure Table 1. Specfcaton of the uncertanty denstes for the parameters of the power supply system. The subscrpts 1 and 2 refer to the man and the back-up system, respectvely. From left to rght: the parameter, the medan, the 90th percentle and the partcular choce of densty. λ Gamma (0.9,0.0033) 1/μ /Gamma (0.78,0.52) λ Gamma (0.87,0.19) 1/μ /Gamma (0.78,4.17) q Beta (11.2,97) Table 2. Man facts on the uncertanty of the output parameters of the power supply system. From left to rght: the parameter, estmatons of the 10th percentle, the medan and the 90th percentle, the requrement f any and unt. 100P(F) % 8766λ /year 1/μ hours 8766λ LS /year rates and mean down tmes, compared to n terms of P(F) and ether λ or μ. Notce also that the Beta densty s conjugate to the Bnomal. These conjugacy facts mply that all uncertanty dstrbutons are easly updated wth hard data f and when such become avalable. The calculatons of the fault tree were repeated 10 6 tmes wth smulated values of the nput parameters. The man facts for the uncertanty denstes of the output parameters are tabulated n Table 2. Generally there are large uncertantes n the output parameters. Ths s of course a consequence of the correspondng fact for the nput parameters. Notce that the medans typcally do not concde wth the calculated values. Although not n focus here we remark furthermore that 53.6% of the smulatons fulflled both 100P(F) <0.15 and 8766λ 12. That s, we are about 50% certan that the power system smultaneously fulflls the requrements on P(F) and λ. Ths s n accordance wth the result of the frst calculaton. 3.2 Remarks on accuracy As notce already t s not to be expected that the rates λ and μ at the top level are Markovan. However, we thnk that they are approxmately so. We dd compare the results from the fault tree modelng of the power supply system wth the results from one long smulaton of a Markov process havng the state dagram n Fgure 6. The followng estmates of the output parameters were obtaned: 100P(F) λ /μ λ LS 0.09 There are clear dscrepances between our MPsmulated results above and the FT-calculated ones of the foregong secton. The FT-calculated rates λ and μ are consderably lower then the MP-smulated rates, whch we consder to be qute near the true values. The error n P(F) = λ/(λ + μ) λ/μ s small n the FT-calculaton. Thus the errors n λ and μ are of 1046

7 comparable sze and have the same sgn. It follows that a negatve error n λ tends to cancel out a postve error n the probablty P(Y > 12) = e 12μ. Indeed, the FT-calculated value, 0.10, concdes nearly wth the MP-smulated estmate One long MP-smulaton needs a consderable amount of computng tme (ths one needed nearly 20 mnutes on a two year old desk top usng an nterpretng code), whle a consderable amount of FTcalculatons can be done wth almost no computng tme. Thus analysng the effect of parameter uncertanty wth, say 10 4 smulated sets of base parameter values, s probably not feasble wth todays computng power. In that perspectve and recognzng the fact that qute often the parameter uncertanty s large n FTcalculatons, we argue that the n Secton 2 suggested enlargement of the FT-calculatons are of a consderable value and gve much nsght nto the dynamc behavor of the system under nvestgaton. 4 APPLICATION We now brefly dscuss how the above gate constructons were used to analyse a muncpal drnkng water system (Lndhe et al. 2008). The drnkng water system was analyzed based on an ntegrated approach. Ths means that the entre system, from source to tap, was consdered. The man reasons for an ntegrated approach are: (1) nteractons between events exst,.e., chans of events have to be consdered; and (2) falure n one part of the system may be compensated for by other parts,.e., the system has an nherent ablty to prevent falure. The top event, supply falure, was defned as ncludng stuatons when no water s delvered to the consumer, quantty falure, as well as stuatons when water s delvered, but t does not comply wth exstng water-qualty standards, qualty falure. The fault tree was constructed so that the top event may occur due to falure n any of the three man subsystems raw water, treatment or dstrbuton. Wthn each subsystem quantty or qualty falures may occur. Note that, for example, quantty falure n the treatment may occur due to the water utlty detects unacceptable water qualty and decdes to stop the delvery. To consder the fact that falures n one part of the system may be compensated for by other parts, cold stand-by AND-gates (cf. Sectons 2.3 and 2.4) were used. For example, f the supply of raw water to the treatment plant s nterrupted, ths may be compensated for by the drnkng water reservors n the treatment plant and dstrbuton network. Snce only a lmted amount of water s stored the ablty to compensate s lmted n tme. Smlar unacceptable raw water qualty may be compensated for n the treatment. In the case of compensaton by means of reservors the 1st varaton of the AND-gate was used. The probablty of falure on demand represents the probablty The fault tree of the drnkng water system was constructed so that falure n one subsystem cause the top event to occur only f subsequent subsystem are not able to compensate for falure. The possblty to not only estmate the probablty of falure, but also the falure rate and mean down tme at each ntermedate level provded valuable nformaton on the system s dynamc behavor. Two subsystems may have the same probablty of falure, but one may have a low falure rate and long down tme whle the other have a hgh falure rate and a short down tme. Propertes lke these are mportant to know about when analyzng a system and suggestng rsk reducton measures. Furthermore, the cold stand-by AND-gates made t possble to nclude the systems nherent ablty to compensate for falures, thus the system could be modeled n an adequate manner. We refer the reader to (Lndhe et al. 2008) for a more detaled descrpton of how the new formulae for dong fault tree calculatons were used n a practcal applcaton. 5 DISCUSSION A major advantage wth ncorporatng Markov Processes nto the fault tree calculatons s the added dmensonalty of the output as can be seen already n smple examples such as the one n Secton 3. The applcaton to a muncpal drnkng water system (cf. Secton 4) also showed that the varatons of the AND-gate were of great mportance. The nformaton on falure rates and down tmes for each ntermedate level provded valuable nformaton on the system s dynamc behavor. It s moreover worth mentonng here that many experts prefer to elct ther thoughts on dynamc systems n terms of percentles for falure rates and mean down tmes, makng t farly easy to defne uncertanty dstrbutons that n the future may be updated by hard data. We fnally emphasze the fact that the resultng bnary process at the top level typcally s not Markov. Thus, t s wrong to thnk of λ and μ at the top level as beng parameters of an MP, although we do not hestate to do so approxmately. For nstance, n the example of Secton 3, we approxmated the down tme dstrbuton usng an exponental(μ) densty. Ths s also mplct n our referrng to λ as the system falure rate. ACKNOWLEDGMENTS All authors acknowledge support from the Framework Programme for Drnkng Water Research at Chalmers 1047

8 (DRICKS), and from the EU Sxth Framework project Techneau ( REFERENCES Beford, T. and R. Cooke (2001). Probablstc Rsk Analyss: Foundataton and methods. Cambrdge. Lndhe, A., L. Rosén, T. Norberg, O. Bergstedt, T. Pettersson, J. Åström, and M. Bondeld (2008). Integrated probablstc rsk analyss of a drnkng-water system: A fault-tree analyss. In preparaton. Rausand, M. and A. Højland (2004). System Relablty Theory. Model, Statstcal Methods, and Applcatons. Wley. 1048