Calculating the failure intensity of a non-coherent fault tree using the BDD technique.

Transcription

1 Loughborough Unversty Insttutonal Repostory Calculatng the falure ntensty of a non-coherent fault tree usng the BDD technque. Ths tem was submtted to Loughborough Unversty's Insttutonal Repostory by the/an author. Ctaton: BEESON, S. and ANDREWS, J.D., 23. Calculatng the falure ntensty of a non-coherent fault tree usng the BDD technque. IN: Andrews, J.D. (ed.) Proceedngs of the 5th Advances n Relablty Technology Symposum (ARTS), Loughborough, UK, 23, pp Addtonal Informaton: Ths s a conference paper. Metadata Record: Publsher: c Loughborough Unversty Please cte the publshed verson.

2 Ths tem was submtted to Loughborough s Insttutonal Repostory by the author and s made avalable under the followng Creatve Commons Lcence condtons. For the full text of ths lcence, please go to:

3 Calculatng the Falure Intensty of a Non-coherent Fault Tree Usng the BDD Technque Sally Beeson and John Andrews Department of Systems Engneerng Loughborough Unversty Abstract Ths paper consders a technque for calculatng the uncondtonal falure ntensty of any gven non-coherent fault tree. Conventonal Fault Tree Analyss (FTA) technques nvolve the evaluaton of lengthy seres expansons and approxmatons are unavodable even for moderate szed fault trees. The Bnary Decson Dagram (BDD) technque overcomes some of the shortfalls of conventonal FTA technques enablng effcent and exact quanttatve analyss of both coherent and non-coherent fault trees. Keywords: Non-coherent, Bnary Decson Dagrams, Uncondtonal Falure Intensty, and Brnbaum s Measure of Relablty Importance.. Introducton The Bnary Decson Dagram (BDD) technque developed by Rauzy n the early 99 s has been shown to sgnfcantly mprove the accuracy and effcency of conventonal fault tree analyss for coherent systems []. More recently attenton has focused on the analyss of non-coherent systems usng the BDD method. The top event probablty can be calculated drectly from the SFBDD, whch encodes the structure functon for a non-coherent fault tree. Quantfcaton of the falure frequency of non-coherent systems could be accomplshed by conventonal fault tree methods [5]. In 2 an extenson of Brnbaum s measure of mportance for the analyss of non-coherent systems was developed [4]. Ths extenson can be used to calculate the uncondtonal falure ntensty of a non-coherent fault tree drectly from the SFBDD. Ths provdes an exact and effcent means of calculatng ths parameter and s descrbed n ths paper.

4 2. Non-coherent Systems Fault Tree structures can be categorsed as ether coherent or non-coherent accordng to ther underlyng logc. If durng fault tree constructon the falure logc s restrcted to the use of the AND gate and the OR gate, the resultng fault tree s sad to be coherent. If however, the NOT gate s used or drectly mpled, the resultng fault tree can be non-coherent. A more precse defnton of coherency can be obtaned by consderng the structure functon of the fault tree [2]. A fault tree s coherent f ts structure functon φ(x) comples wth the defnton of coherency gven by the propertes of relevance and monotoncty. The frst condton requres that each component s relevant; ths means that each component contrbutes to the system state. φ(,x) φ(,x) for some x The second condton requres the structure functon of the fault tree to be monotoncally ncreasng,.e. non-decreasng. φ(,x) φ(,x) Where: φ(,x)= φ(x,,x -,,x +,,x n ) φ(,x)= φ(x,,x -,,x +,,x n ) The structure functon of a fault tree s monotoncally ncreasng (non-decreasng) f as the state of a component deterorates the system state ether remans the same or also deterorates. The three possbltes, dependng on the state of the remanng components, are shown n fgure. So the system ether remans n the same state (workng or faled) when component fals. Φ Φ Φ x x x Fgure : Non-Decreasng Structure Functons For a structure functon of a non-coherent system the remanng possblty, shown n fgure 2, can also occur. Ths system s non-coherent for component, hence, for some

5 state of the remanng components, the system s n a faled state when component works and a workng state when component fals. Φ x Fgure 2: Non-coherent Structure Functon 3. Calculatng the SFBDD of a Non-coherent Fault Tree Rauzy [] developed the If-Then-Else (te) method for computng a SFBDD for a coherent fault tree n 993. Ths method has the advantage of producng a SFBDD, whch encodes Shannon s formula,.e., f f(x) s the Boolean functon for the top event of the fault tree, then by pvotng about varable x, Shannon s theorem states: f( x ) = x x f f + 2 Where f and f 2 are Boolean functons: f f 2 = f( x = f( x, x 2, x,..., x 2,..., x,, x +,, x +,... x n,... x n ) ) Ths s represented by the te structure gven n equaton (). te(x,f,f 2 ) () Where x represents a varable and f and f 2 represent logc functons. Ths te structure s nterpreted as follows: If x fals then consder the logc functon f else consder the logc functon f 2. Thus n the BDD, f forms the logc functon for the one branch of x and f 2 forms the logc functon for the zero branch of x. Fgure 3 shows the dagram that represents ths te structure.

6 x f f 2 Fgure 3: te structure for te(x,f,f 2 ) The process to convert a fault tree structure to a SFBDD frst requres a varable orderng scheme to be chosen for the varables (basc events) n the fault tree. Once the varables have been ordered the followng procedure s employed to compute the SFBDD.. Assgn each basc event x n the fault tree an te structure, 2. Modfy the fault tree structure so that each gate has only two nputs 3. Apply De Morgan s rules to push the Not logc down to the basc events: A. B = A + B A + B = A. B where AND s represented by. And OR by Consder each gate n a bottom-up fashon 5. If two gate nputs are J and H such that: J=te(x, F, F2) H=te(y, G, G2) Then the followng rules are appled: - If x<y, J<op>H=te(x, F<op>H, F2<op>H) - If x=y, J<op>H=te(x, F<op>G, F2<op>G2) These rules are used n conjuncton wth the followng denttes: <op>h=h, <op>h= f <op> s an AND gate <op>h=, <op>h=h f <op> s an OR gate Where <op> descrbes the Boolean operaton of the logc gates (AND, OR) of the fault tree. To llustrate ths procedure, consder the fault tree shown n fgure 4.

7 Top G G2 a b a c Fgure 4: Non-coherent Fault Tree Dagram Assumng a varable orderng a<b<c: Assgnng each basc event an te structure: a=te(a,,) a =te(a,,) b=te(b,,) c=te(c,,) Consderng the gates n a bottom-up fashon accordng to the rules and denttes ntroduced above, begnnng wth gate G: G=a.b G=te(a,,).te(b,,) G=te(a,[.te(b,,)], [.te(b,,)]) G=te(a,te(b,,),) Now dealng wth gate G2: G2= a.c G2=te(a,,).te(c,,) G2=te(a,[.te(c,,)], [.te(c,,)]) G2=te(a,,te(c,,) Fnally dealng wth the top gate, Top: Top=G+G2

8 Top=te(a,te(b,,),)+te(a,,te(c,,)) Top=te(a,[te(b,,)+],[+te(c,,)]) Top=te(a,te(b,,),te(c,,)) The te structure computed for the fault tree shown n fgure 4, s gven n equaton 2 and the SFBDD s shown n fgure 5. te(a,te(b,,),te(c,,)) (2) a F b F2 c F3 Fgure 5: SFBDD Obtaned for the Non-coherent Fault Tree n Fgure 4 4. The Uncondtonal Falure Intensty of a Coherent System The uncondtonal falure ntensty s denoted by w sys (t) and defned as the probablty that a system fals per unt tme at t gven that t was workng at t=. Ths s an mportant system parameter to calculate durng quantfcaton snce, havng determned w sys (t) the expected number of system falures n a gven nterval, W sys (,t) can be calculated: SYS t = o W (, t) w ( u) du The uncondtonal falure ntensty of a coherent system can be expressed n terms of the crtcalty functon, G (q). n c w sys (t)= = SYS G (q) w ( t) (3) Where, w (t) s the falure ntensty of component, and n c s the total number of components.

9 The crtcalty functon, also known as Brnbaum s measure of component relablty mportance, denoted by, G (q), s defned as the probablty that the system s n a workng but crtcal state for component such that the falure of component would cause system falure. Ths can be calculated from: G (q)=q sys (, q)-q sys (, q) (4) Where: Q sys (, q) = Q sys (x, x 2,.., x -,,x +,.., x n ) s the probablty that the system has faled and component s faled. Q sys (, q)= Q sys (x, x 2,.., x -,,x +,.., x n ) s the probablty that the system has faled and component s workng. q s the probablty that component I fals. Equaton 3 enables effcent and accurate calculaton of the uncondtonal falure ntensty usng the BDD technque. 5. The Concept of Component Relevancy / Irrelevancy When analysng non-coherent fault trees, both component faled states and component workng states can contrbute to system falure. A component can be ether relevant to the system state or rrelevant to the system state. If a component s relevant to the system state, t can be ether falure relevant or repar relevant. Component s sad to be falure relevant f the system s n a crtcal state such that the falure of component would cause the system to fal. Smlarly component s sad to be repar relevant f the system s n a crtcal state such that the repar of component would cause system falure. Fnally component s sad to be rrelevant f ts state has no bearng on the state of the system. Expressons for the falure relevance and rrelevance of a component can be obtaned from the Boolean expresson for the top event. Consder the Boolean expresson for the top even, Top, gven n equaton 5. Top=ab+ a d+ce+bd (5)

10 An expresson for the falure relevance or rrelevance of component a denoted by, Top a=, can be obtaned by substtutng the value for component a nto equaton 5. Top a= =b+ce+bd =b+ce Smlarly an expresson for the repar relevance or rrelevance of component a denoted by, Top a=, can be obtaned by substtutng the value for component a nto equaton 5. Top a= =d+ce+bd=d+ce An expresson for the rrelevance of component a, denoted by, Top a= _ s obtaned by takng the product of Top a= and Top a=. Top a= _ =Top a=.top a= =(b+ce)(d+ce) =bd+ce 6. An Extenson of Brnbaum s Measure of Importance for Non-coherent Fault Trees Brnbaum s measure of component relablty s a fundamental probablstc measure of mportance [3]. However, Brnbaum developed ths measure strctly for the analyss of coherent systems. In 2 an extenson of Brnbaum s measure of mportance for the analyss of non-coherent structures was developed [4]. When dealng wth a coherent system, system falure can only be caused by component falure. Hence a component n a coherent system can only be falure crtcal. However, when dealng wth a non-coherent system, system falure can be caused not only by the falure of component, () but also by the repar of component I, ( ). Thus a component n a non-coherent system can be falure crtcal or repar crtcal. These two crtcaltes must be consdered separately snce component can exst n only one state at any tme.

11 The probablty that component s crtcal to system falure, can be expressed as the probablty that component s repar crtcal, G R (q), or the probablty that component s falure crtcal, G F (q). G (q)= G R (q)+ G F (q) (6) Ths can be obtaned from the system unavalablty functon Q sys (t) that can be determned from Henley and Inagak s calculaton procedure outlned n [5]. Component s falure crtcal f the system s workng, but wll fal f component fals. Thus the probablty that component s falure crtcal s the probablty that the system s n a workng state such that the falure of component causes at least one prme mplcant set contanng event to occur. Ths probablty s calculated by obtanng the probablty that at least one prme mplcant set contanng event exsts at tme t and then dvdng ths probablty by the unavalablty of component. To calculate ths probablty t s frst helpful to re-express the system unavalablty as three dstnct terms havng expressed t n the form used by Inagak and Henley. Qsys(t)=q Pr[A]+p Pr[B]+Pr[C] (7) The three terms of ths equaton are grouped so that Pr[A] represents the probablty terms whch appear together wth the falure probablty of component, Pr[B] represents the probablty terms whch appear together wth the functonng probablty of component ( p = q ), and Pr[C] represents the probablty terms whch do not contan q or p,.e. for whch component s rrelevant respectvely. Now the probablty that component s falure crtcal s calculated as follows: F Q SYS G ( ) = = Pr[ A] q q (8) Smlarly the probablty that component s repar crtcal s the probablty that the system s n a workng state such that the repar of component causes at least one prme mplcant set contanng event to occur. Ths s calculated as follows: G Q SYS ( ) = Pr[ B] p R = q (9)

12 The top event can only exst at tme t f at least one prme mplcant set exsts at tme t. Hence the falure and repar crtcalty can be calculated separately by dfferentatng the system unavalablty functon, Q sys (t), wth respect to q and p respectvely. The uncondtonal falure ntensty for a coherent fault tree s expressed n terms of the crtcalty functon, G (q): n c w sys (t)= = G (q) w ( t) () Ths can be now be extended to non-coherent systems as follows: w sys (t)= nc n c F G = = ( ) w ( t) + G ( q) v ( t) R q () where v s the uncondtonal repar ntensty for component. Ths can be then be used to calculate the expected number of system falures n a gven nterval: W sys (,t)= t nc n F G ) w ( u) + = = c R ( G ( q) v ( u) du q (2) The frst term on the rght hand sde of equaton (2) calculates the number of occurrences of system falure due to the falure of component n a gven nterval. The second term calculates the number of occurrences of system falure due to the repar of component n a gven nterval. 7. Calculatng the Uncondtonal Falure Intensty of a Non-coherent Fault Tree Usng the BDD Method The BDD Method has been extended to enable full and exact analyss of non-coherent fault trees [6, 7]. The expressons for calculatng Brnbaum s measures of component falure and repar mportance are gven n equatons 8 and 9 respectvely.

13 From the defnton of component relevance / rrelevance gven n secton 6, t s possble to defne Brnbaum s measure of component falure mportance as the probablty that component s falure relevant to the system state [6] gven by: G F (q)=e[φ = ]-E[φ = _ ] (3) Where: E[φ = ] s the probablty that component s ether falure relevant or rrelevant to the state of the system. E[φ = _ ] s the probablty that component s rrelevant to the state of the system. Smlarly, Brnbaum s measure of component repar mportance can be defned as the probablty that component s repar relevant to the system state: G R (q)=e[φ = ]-E[φ = _ ] (4) Where: E[φ = ] s the probablty that component s ether repar relevant or rrelevant to the system state. φ =, φ =, φ = _ are the structure functon wth x =, and - respectvely. It s possble to calculate E[φ = ], E[φ = ] drectly from the SFBDD, the procedure for calculatng these probabltes s outlned below: [ = ] = φ Pr x (q).po x (q) (5) E x [ = ] = φ Pr x (q).po x (q) (6) E x Where: Pr x (q) s the probablty of the path secton from the root vertex to node x. Po x (q) s the probablty of the path secton from the one branch of node x to a termnal node (excludng the probablty of x ). Po x (q) s the probablty of the path secton from the zero branch of node x to a termnal node (excludng the probablty of x ).

14 Although E[φ = _ ] can be calculated by takng the expectaton of the logcal product of Top = and Top =. Ths s an neffcent means of calculatng E[φ = _ ]. An alternatve technque can be employed whch nvolves computng an ntermedate BDD for each node from whch E[φ = _ ] can be effcently calculated. The ntermedate BDD for each node s obtaned by ANDng the one and zero branches of the node. An expresson for E[φ = _ ] s then calculated by multplyng the probablty precedng the node n the SFBDD by the probablty of the sum of all the termnal one paths through the ntermedate BDD. To llustrate ths technque consder agan the SFBDD calculated n secton 3, fgure 5. The te table for ths BDD shown n table. Node Varable branch branch F a F2 F3 F2 b F3 c Table : te Table The next stage s to calculate each of the terms n equatons 5 and 6. The frst term, Pr x (q) s the probablty of the path from the root vertex to node x, whch s recorded n Table 2. Node Pr x (q) Comment F Root vertex tself F2 q a F2 reached va the one branch of node F F3 p a F3 reached va the zero branch of node F Table 2: Pr x (q) for each node n the SFBDD n fgure 5 The Po x (q) term s calculated by summng the probablty of all the paths from the selected node, x, along the one branch to a termnal vertex, excludng the probablty of the selected node. Table 3 records Po x (q) for each node.

15 Node Po x (q) Comment F q b branch of F passes to F2 and the branch of F2 passes to a termnal node F2 branch of F2 passes to a termnal node F3 branch of F3 passes to a termnal node Table 3: Po x (q) each node n the SFBDD n fgure 5 Smlarly Po x (q) s calculated by summng the probablty of all the paths from the selected node x, along the zero branch to a termnal vertex, excludng the probablty of the selected node. Table 4 records Po x (q) for each node. Node po x (q) Comment F q c branch of F passes to F3 and the branch of F3 passes to a termnal node F2 No termnal one paths F3 No termnal one paths Table 4: Po x (q) for each node n the SFBDD n fgure 5 Fnally E[φ = _ ] must be calculated for each of the nodes n the SFBDD. The calculaton procedure requres some addtonal work. An ntermedate BDD must be calculated for each node x. The probablty of the sum of the dsjont paths through ths ntermedate BDD s calculated and multpled by the probablty precedng the node x to gve E[φ = _ ]. The ntermedate BDD s computed by ANDng the one and zero branches of a node. Each of the nodes n the SFBDD n fgure 5 wll be consdered below: Dealng wth node F F2.F3=te(b,,).te(c,,) =te(b,te(c,,),) The resultng BDD s shown n fgure 6:

16 b c Fgure 6: Intermedate BDD for Node F There s one termnal path through ths BDD, bc, the probablty of ths path s: q b q c Dealng wth node F2:.= The probablty of ths s zero. Dealng wth node F3:.= The probablty of ths s zero. Table 5 summarses the results obtaned for E[φ = ], E[φ = ] and E[φ = _ ]. Node Varable () E[φ = ] E[φ = ] E[φ = _ ] F a q b q c q b q c F2 b q a F3 c p a Table 5: Summary of results obtaned for E[φ = ], E[φ = ] and E[φ = _ ] From the results n table 5 and equatons 3 and 4 the falure and repar mportance of each component s obtaned as follows: G a F (q)=q b -q b q c G b F (q)=q a G c F (q)=p a G a R (q)=q c -q b q c G b R (q)= G c R (q)=

17 From ths t s possble to calculate the uncondtonal falure ntensty and then the expected number of system falures n a gven nterval usng equatons and 2 respectvely. w sys (t)=(q b - q b q c )w a +q a w b +p a w c +( q c -q b q c )v a =(- q c ) q b w a +q a w b +p a w c +( -q b ) q c v a 8. Concluson The uncondtonal falure ntensty s a key parameter to calculate durng fault tree quantfcaton. Once the uncondtonal falure ntensty s known t s possble to calculate the expected number of system falures n a gven nterval. Untl now t has not been possble to calculate the uncondtonal falure ntensty of a non-coherent fault tree usng the BDD method. In 2 an extenson of Brnbaum s measure of relablty mportance to enable the analyss of non-coherent systems was developed. Ths measure can be used to calculate the uncondtonal falure ntensty of a noncoherent fault tree effcently and accurately usng the BDD method. 9. References. A. Rauzy, New Algorthms for Fault Tree Analyss, Relablty Engneerng and System Safety, vol. 4, 993, p A. Bendall and J. Ansell, The Incoherency of Multstate Coherent Systems, Relablty Engneerng, Vol. 8, 984, pp Z. W. Brnbaum, On the Importance of Dfferent Components n a Multcomponent System, Multvarate Analyss II, PR Krshnaah, ed, Academc Press, S. Beeson and J. D. Andrews, Brnbaum s Measure of Component Importance for Non-coherent Systems, IEEE Transactons on Relablty, n press. 5. Inagak and E. J. Henley, Probablstc Evaluaton of Prme Implcants and Top Events for Non-coherent Systems, IEEE Transactons on Relablty, vol. R-29, No. 5, Dec S. Beeson, Non-coherent Fault Tree Analyss, Doctoral Thess, Loughborough Unversty, 22.

18 7. Y. Dutut and A. Rauzy, Exact and Truncated Computatons of Prme Implcants of Coherent and Non-coherent Fault Trees wth Arala, Relablty Engneerng and System Safety, vol. 58, 997, p27-44.