Fault Tree Modeling for Redundant Multi-Functional Digital Systems

Transcription

1 International Journal of Perforability Engineering, Vol. 3, No. 3, July, 2007, pp RAMS Consultants Printed in India Fault Tree Modeling for Redundant Multi-Functional Digital Systes HYUN GOOK KANG *, SEUNG-CHEOL JANG and JAEJOO HA Integrated Safety Assessent Division, Korea Atoic Energy Research Institute, Daejeon, Korea (Received on July 30, 2006) Abstract: A digital syste is ulti-functional and it ay cause a ris concentration if it is installed without any redundancy. In order to reduce this ris of a concentration, ultiple redundancies are applied for the safety-critical systes. Siplified coon cause failure (CCF) odeling technique is coonly used for a practical reason when the target syste consists of any redundant coponents. This technique enables us to avoid an ipractically large nuber of CCF events for a syste fault tree. One of its deerits is that it ay hide iportant inforation regarding a syste s status. Condition-based huan reliability assessent (CBHRA) ethod which is a practical ethod to develop a ore realistic fault-tree odel with a consideration of the various conditions endured by a huan operator uses the syste status inforation for post-processing of iniu cut sets. Since the CBHRA post-processing should be perfored based on the status inforation of the sensors and the signal-processing equipent and noting that the siplified CCF odeling technique ay cause the loss of soe inforation, in order to perfor a ore realistic analysis, we have to overcoe this possible inforation loss. In this study, we also present a case study of a fault tree odeling which adopted both the CBHRA ethod and the siplified alpha factor ethod. Key Words: Condition-based HRA, siplified alpha-factor ethod, fault tree odel. 1. Introduction For the past several decades, probabilistic safety assessent (PSA) techniques have been used to assess the relative effects of contributing events on a syste-level safety or reliability since they provide a unifying eans of assessing physical faults, recovery processes, contributing effects, huan actions, and other events. The fault tree is the ost popular tool for the PSA of safety-critical plants. Its logical and siple structure aes it easy for analysis staffs and syste design engineers to develop a odel and understand its result. In the fault tree odel, the coon cause failures (CCF) of redundant coponents are treated as the basic events which correspond to all the possible cobinations of each coponent. * Corresponding author e-ail: hgang@aeri.re.r. 329

2 330 Hyun Goo Kang, Seung-Cheol Jang and Jaejoo Ha Higher level of redundancy causes a difficulty in a CCF analysis because it results in an ipractically large nuber of CCF events in the fault tree odel. Siplified CCF odelling technique is useful in this case. This technique enables us to avoid this ipracticality in a syste fault tree since it erges the CCF events into a single CCF event. A previous study [1] has shown that SAF ethod is quite realistic but siple when we consider the syste success criteria carefully. One of its deerits is that it ay hide iportant inforation regarding the syste status. That is, since it erges inforation fro the CCF events, we cannot trace which coponents fail or succeed. For a convenient explanation, we will use a case study. The digital plant protection syste (DPPS) of Korean Optiized Pressurized Reactor 1000 (OPR1000) could be a typical exaple which would require a siplified CCF odelling technique but needs syste status inforation for post processing of cutsets fro the fault tree. In safety-critical systes such as in nuclear power plants, a safety-feature actuation is fully autoated. In an eergency situation, the huan operator could also play the role of a bacup for the autoated systes. Thans to the ulti-tasing feature of digital systes, the safety-critical signal generation systes could also supply the relevant alars or ey inforation to the huan operator. In the OPR1000, several different functions such as an alar generation, trip signal generation, and a safety-function-actuation signal generation for all the trip paraeters are siultaneously perfored by the DPPS. With a consideration of these relationships, the reasons for a specific safety function failure can be expressed as shown in Fig. 1. FAILURE OF SAFETY FUNCTION ACTUATOR FAILURE SIGNAL FAILURE SIGNAL GENERATION FAILURE SIGNAL BLOCKED BY OPERATOR HUMAN OPERATOR MANUAL SIGNAL FAILURE AUTOMATIC SIGNAL GENERATION FAILURE ALARM GENERATION FAILURE DISPLAY/ ACTUATION DEVICE FAILURE INSTRUMENTATION SENSOR FAILURE Fig. 1: The Scheatic of the Concept of the Safety Function Failure Mechanis Therefore, in the event that the DPPS fails, an operator will not receive alars related to the reactor trip and the autoatic safety-feature actuation. In order to accoodate this issue, the authors have proposed the condition-based huan reliability assessent (CBHRA) ethod.

3 Fault Tree Modeling for Redundant Multi-Functional Digital Systes 331 which is a practical ethod to develop a ore realistic fault-tree odel with a consideration of various conditions endured by a huan operator [2]. On the other hand, the safety critical systes adopt a ultiple-redundancy design in order to reduce the ris of a single coponent failure. The level of a redundant design of the digital systes is usually higher than those of the conventional echanical systes. In OPR1000, there are four signal processing channels for the safety paraeters and each channel consists of two or four icroprocessor odules for the sae function. This high-redundancy design raises the iportance of a CCF analysis. As entioned above, for the any redundancy coponents, a siplified CCF odelling technique is usually applied. In this study, the siplified alpha-factor (SAF) ethod is applied to the digital signal-processing syste s CCF analysis. The CBHRA post processing should be perfored based on the status inforation of the sensors and the signal-processing equipent. The status inforation could be obtained by analyzing the inial cut sets (MCS) of a fault tree. Since the CCF event is one of the ost iportant inforation sources, it should be treated carefully. The SAF ethod effectively reduces the nuber of CCF events, but it ay cause the loss of soe inforation. In this study, we present a case study of fault tree odeling which adopted both the CBHRA ethod and the SAF ethod for verifying their applicability. 2. Condition-based HRA Method An unsafe action (UA) of huan operator is affected by error-forcing context (EFC) including the unavailability of inforation sources. For sensors (S) and autoatic systes (A), in consideration that the failure of autoatic syste iplies the failur of safety signal generation and the loss of alars, the signal generation failure probability (F) is calculated as: F P( UA A, S ) P( A S ) P( S ) (1) = i j i j A fault tree is one of the favored ethods by the PSA personnel. Based on the fault tree ethod, in order to tae into account the huan error probability (HEP) issue with conditional events in a ore effective anner, we propose the following CBHRA steps: (1) Conducting an investigation into possible EFCs (2) Selecting iportant EFCs (3) Developing a set of conditions in consideration of selected EFCs () Estiating the HEP for each condition (5) Constructing a fault tree which includes one huan error (HE) event for each anual action (6) Obtaining MCS by solving the fault tree (7) Post-processing of MCSs Fro the viewpoint of the HE event, after step (6), we can categorize the MCSs into several sets. The nuber of MCS sets equals to that of the huan error events used in step (5). In a set of MCSs, step (7) iplies a substitution of the HE event with the EFC-group-specified HE event in consideration of the other events in each MCS. For exaple, the event of the anual reactor trip failure (MRTF) should be substituted by one of the possible EFC-groupspecified HE events: MRTF given EFC group 1, MRTF given EFC group 2 or MRTF given EFC group n. i j j

4 332 Hyun Goo Kang, Seung-Cheol Jang and Jaejoo Ha The quantification of a HEP doinates the quality of a probabilistic safety assessent (PSA) which plays a very iportant role in proving the safety of a syste or a plant [3],[]. In the conventional PSA odel of the OPR1000 which consists of nuerous event trees and fault trees, the failure of a signal generation is odeled in the fault trees with a few basic events. In order to construct a ore realistic signal-generation failure odel, we have to consider ore coplicated conditions in a ore realistic anner. The condition which affects the operator s perforance should be carefully considered [5]. The detailed description of the CBHRA ethod and its application cases can be found in [2]. The result of the reference shows that in the case of single-paraeter safety function, the adoption of the CBHRA ethod is very iportant because there is no doinant EFC-groupspecified HE event. If there exists a doinant EFC-group-specified HE event, the use of the conventional single-event HRA ethod could be effective. 3. Siplified Alpha-factor Method The first step for applying the SAF ethod is an analysis of the target syste for deterining the function failure cases. That is, the success criteria of the syste should be derived fro the target syste s function and configuration. Based on this analysis, we can calculate the probability of single CCF event which represents the CCF events resulting in the syste failure [6],[7]. For the convenience of explanation, an exaple syste of the four-channel DPPS of the OPR1000 is considered. The signals fro the four channels are auctioneered by selective-twoout-of-four voting as shown in Fig. 2. The syste ust open the circuit to interrupt the electricity supply when a deand signal arrived. That is, the failure of interrupting the electricity supply fro the top to the botto iplies the failure of the syste function. If we consider the odules or coponents in each channel, the syste failure criteria becoe ore coplicated. In the case of the OPR1000 DPPS, in a channel, there are four redundant signalprocessing paths whose results are auctioneered two-out-of-four logic. Again, inside each signal-processing path, there are four redundant inputs fro coparison processors. Since this exaple is too coplicated to be explained in this article, we will explain the CCF of instruentation channels only in this article for a siple explanation. Instruentation Channel a b c d Fig. 2: The Conceptual Drawing for the Syste Success/Failure Criteria The cobinatorial failures of {a, c}, {b d}, {a, b, c}, {a, b, d}, {a, c, d}, {b,c, d}, or {a, b, c, d} cause the failure of a given function. Based on this analysis, we can calculate the probability of single CCF event ( CCF ) which represents the CCF events resulting in the syste failure by the following equations:

5 Fault Tree Modeling for Redundant Multi-Functional Digital Systes 333 CCF = = = 2 C ( C p ) α t 1 1 α t (3) is the probability of a CCF of out of coponents under non-staggered test condition, p denotes the ratio of a syste failure CCF over possible coponents CCFs, t is the failure probability of a coponent, α denotes the portion of coponents CCF over the -coponent CCF group, and i= 1 α = i α. t Table 1 shows a typical exaple of the calculation sheet of a four-instruentationchannel syste when α is assued to be the generic values in reference [8]. Table 1: The Calculation Sheet of a Four-Instruentation-Channel Syste No. of CCF No. of syste p channels () C failure CCF (F ) (=F / C ) / t CCF coefficient ( CCF / t ) A Case Study: Concurrent Application of CBHRA and SAF Method In this section we will describe a case study for a concurrent application of the CBHRA ethod and the SAF ethod to the DPPS fault-tree odel of the OPR1000. We considered two EFCs: the unavailability of alars and the unavailability of indications. For the singleparaeter safety function in the case of the four-channel syste, we can develop the set of conditions in step (2) as shown in Table 2. It is notable that if the success criteria of syste are changed or ore EFCs are considered, the set in the table should be odified. The gray-colored cells in Table 2 correspond to the error of oission which is beyond the scope of this study. In other words, the existence of a MCS iplies that the MCS does not belong to <Condition 1 or 1*>. We consider <Condition 2> and <Condition 3> only. In <Condition 2>, the indication is available, but in <Condition 3>, it is unavailable. Since the probabilities of the cobinations of independent events are relatively saller than that of a CCF event, the top-raned MCSs usually contain CCF event which doinate the ris fro a syste. It eans that for the condition categorization of a MCS the careful treatent is required. For siplicity, in Table 2, assue that the alar is available when two or ore alars out of four are available. Then the availability of the indication is the only variable. That is, the MCS which contains the CCF event of instruentation channels should be analyzed. Table 2: The Conditions of a Huan Error in the Case of the -Channel-Single- Paraeter Functions (O: available, X: unavailable) i (2)

6 33 Hyun Goo Kang, Seung-Cheol Jang and Jaejoo Ha Status of the autoated Status of Syste instruentation 3 or ore channels available 2 channels available 1 channel available No channel available Noral Auto. signal: O Indication: O Alar: O <Condition 1> Auto. signal: O Indication: O/X Alar: O < Condition 1*> Indication: O/X Alar: X <Condition 2/3> Indication: X Alar: X <Condition 3> Abnoral Indication: O Alar: X <Condition 2> Indication: O/X Alar: X <Condition 2/3> Indication: O/X Alar: X <Condition 2/3> Indication: X Alar: X <Condition 3> Case (1): Indication is considered as available when three or ore instruentation channels are available. The CCF does not affect on the categorization. The CCF event iplies the failure of ore than two instruentation channels. Case (2): Indication is considered as available when two or ore instruentation channels are available. In the CCF event, the probability of CCFs {a,c} and {b,d} is included. In the CBHRA post-processing (step (7)), their portion should be considered as <Condition 2>. The other portion of the CCF probability (corresponds to the failures of {a,b,c}, {a,b,d}, {a,c,d}, {b,c,d}, or {a,b,c,d}) should be considered as <Condition 3>. That is, the CCF event of instruentation channels should be substituted by one of two different events: <CCF- Condition2> or <CCF-Condition3>. The probabilities of each event could be obtained by using a siple calculation based on the equations (2) and (3): 2 CCF Condition 2 = ( C p ) = 2 CCF Condition3 = ( C p ) = 3 It is notable that we don t have to consider the failures of {a,b}, {a,d}, {b,c} and {c,d} because they do not result in the autoatic signal generation failure and they correspond to <Condition 1*>. Case (3): Indication is considered as available when one or ore instruentation channels are available. The CCFs of {a,c}, {b,d}, {a,b,c}, {a,b,d}, {a,c,d} and {b,c,d} eans one or ore channels are available. Their portion should be considered as <Condition 2>. The () (5)

7 Fault Tree Modeling for Redundant Multi-Functional Digital Systes 335 other portion of the CCF probability ({a,b,c,d} only) should be considered as <Condition 3>. The probabilities can be easily obtained as in the case (2) based on the equations (2) and (3). 3 CCF Condition 2 = ( C p ) = 2 CCF Condition3 = ( C p ) = In the OPR1000, there are seven engineered-safety-feature (ESF) actuation signals which are the ost iportant signals considered in the safety assessent. Given a specific initiating event, each target signal could be generated by single or ultiple trip paraeters, and each paraeter is instruented by four redundant sensors. Aong the target safety signals, the auxiliary feed water actuation signal (AFAS) is generated based on the instruented value of a single paraeter. Based on the fault tree odels developed in previous studies, we developed an AFAS fault tree odel which consists of 16 basic events and 206 logical gates. For the hardware equipent failure probabilities, we used the experienced data and the data provided by the vendors. Using KIRAP which is a fault-tree analysis software pacage produced by the Korea Atoic Energy Research Institute, we analyzed the developed ris odels. The results of Cases (1), (2) and (3) are graphically illustrated in Fig. 3. We used the sae condition in [2] except for the indication failure criteria and the treatent of the CCF of instruentation channels. The data in Table 1 was also used. (6) (7) 1.50E E E-03 y ilit b a b o r P 1.30E-03 e r ilu a F S A F1.20E-03 A 1.38E E E-03 Case 1 Case 2 Case 3 Fig. 3: Coparison of Case Study Results The results show that a concurrent application of the siplified CCF odelling technique and the CBHRA ethod to the fault-tree odel of this case study could successfully accoodate the various environents of a huan operator in a practical anner. 5. Conclusions A digital syste is ulti-functional and it ay cause a ris concentration if it is installed without any redundancy. In order to reduce this ris concentration ultiple redundancies are applied for the safety-critical systes. For these inds of systes, the accuracy of fault tree

8 336 Hyun Goo Kang, Seung-Cheol Jang and Jaejoo Ha analysis results depends on the treatent of the CCF and the coplicated relationship aong sensor signals, processing systes and huan operators. In this study, we addressed a topic whether the siplified CCF odeling technique and the CBHRA ethod could be used concurrently. Authors precedent paper proposed the CBHRA ethod which is a practical technique to develop a ore realistic fault-tree odel with a consideration of the various conditions endured by a huan operator. The siplified CCF odeling has a erit in a reduction of the nuber of CCF events in a syste fault tree, but it also has a deerit in that it ay cause a loss of syste status inforation which is iportant in cutset analysis phase. In this paper we have proposed a systeatic procedure for accoodating both ethodologies in a fault-tree odel. In the post-processing phase of the CBHRA ethod, we could successfully reflect the effect of a siplified CCF odeling ethod. We also presented a case study for a concurrent application of the SAF and the CBHRA ethod. The effects of various conditions were clearly deonstrated in the results. Acnowledgeents: This wor has been carried out under the Nuclear R&D Progra supported by MOST References [1]. Kang H.G. and S.C. Jang, Coon Cause Failure Analysis for the Digital Plant Protection Syste, Proceeding of KNS Conference, [2]. Kang H.G. and S.C. Jang, Application of Condition-Based HRA Method for a Manual Actuation of the Safety Features in a Nuclear Power Plant, Reliability Engineering and Syste Science, Vol.91, No. 6, pp , June [3]. Jung W., W.C. Yoon and J.W.Ki, Structured Inforation Analysis for Huan Reliability Analysis of Eergency Tass in NPPs, Reliability Engineering and Syste Safety, Vol.71, No.1, pp , []. Hirschberg S., Huan Reliability Analysis in Probabilistic Safety Assessent for Nuclear Power Plants, CSNI Technical Opinion Papers, ISBN , 200. [5]. Strater O., Considerations on the Eleents of uantifying Huan Reliability, Reliability Engineering and Syste Safety, Vol. 83, 200. [6]. Han S.H., PSA of the PRHRS Design of SMART-P, Technical note, ISA tea, KAERI, 200. [7]. Kang H.G., et al., The Coon Cause Failure Probability Analysis on the Hardware of the Digital Protection Syste in Korean Standard Nuclear Power Plant, KAERI/TR-2908/2005, Korea Atoic Energy Research Institute, [8]. USNRC, Guidelines on Modeling Coon-Cause Failures in Probabilistic Ris Assessent, NUREG/CR-585, Nov Hyun Goo Kang is currently a senior researcher in the Integrated Safety Assessent Tea of Korea Atoic Energy Research Institute, Daejeon, Korea. He received the B.S. degree in 1993, the M.S. degree in 1995 and the Ph.D. degree in 1999, all in nuclear engineering, all fro Korea Advanced Institute of Science and Technology. His research interests include the application of digital technologies to safety critical systes and the assessent of their safety. His recent wor has been focused on the developent of the probabilistic safety assessent fraewor for the safety-critical digital equipent.