Siti Mastura, profile picture
Uploaded bySiti Mastura
PDF, PPTX15,555 views

fault tree analysis

This document provides an overview of fault tree analysis, including its origins in 1962 for the US Air Force, how it is a graphical model of pathways leading to an undesirable loss event using logic symbols, and some key steps and rules in developing a fault tree analysis. It defines important terms like fault, failure, primary and secondary failures. It also illustrates some common logic symbols used and provides examples of potential top events to analyze.

Embed presentation

Download as PDF, PPTX
Fault Tree Analysis P.L. Clemens February 2002 4th Edition
Topics Covered Fault Tree Definition Developing the Fault Tree Structural Significance of the Analysis Quantitative Significance of the Analysis Diagnostic Aids and Shortcuts Finding and Interpreting Cut Sets and Path Sets Success-Domain Counterpart Analysis Assembling the Fault Tree Analysis Report Fault Tree Analysis vs. Alternatives Fault Tree Shortcoming/Pitfalls/Abuses All fault trees appearing in this training module have been drawn, analyzed, and printed using FaultrEaseTM, a computer application available from: Arthur D. Little, Inc./Acorn Park/ Cambridge, MA., 02140-2390 – Phone (617) 864- 2 8671 5770.
First – A Bit of Background Origins of the technique Fault Tree Analysis defined Where best to apply the technique What the analysis produces Symbols and conventions 3 8671
Origins Fault tree analysis was developed in 1962 for the U.S. Air Force by Bell Telephone Laboratories for use with the Minuteman system…was later adopted and extensively applied by the Boeing Company…is one of many symbolic logic analytical techniques found in the operations research discipline. 4 8671
The Fault Tree is A graphic “model” of the pathways within a system that can lead to a foreseeable, undesirable loss event. The pathways interconnect contributory events and conditions, using standard logic symbols. Numerical probabilities of occurrence can be entered and propagated through the model to evaluate probability of the foreseeable, undesirable event. Only one of many System Safety analytical tools and techniques. 5 8671
Fault Tree Analysis is Best Applied to Cases with Large, perceived threats of loss, i.e., high risk. Numerous potential contributors to a mishap. Complex or multi-element systems/processes. Already-identified undesirable events. (a must!) Indiscernible mishap causes (i.e., autopsies). Caveat: Large fault trees are resource-hungry and should not be undertaken without reasonable assurance of need. 6 8671
Fault Tree Analysis Produces Graphic display of chains of events/conditions leading to the loss event. Identification of those potential contributors to failure that are “critical.” Improved understanding of system characteristics. Qualitative/quantitative insight into probability of the loss event selected for analysis. Identification of resources committed to preventing failure. Guidance for redeploying resources to optimize control of risk. 7 8671 Documentation of analytical results.
Some Definitions – FAULT • An abnormal undesirable state of a system or a system element* induced 1) by presence of an improper command or absence of a proper one, or 2) by a failure (see below). All failures cause faults; not all faults are caused by failures. A system which has been shut down by safety features has not faulted. – FAILURE • Loss, by a system or system element*, of functional integrity to perform as intended, e.g., relay contacts corrode and will not pass rated current closed, or the relay coil has burned out and will not close the contacts when commanded – the relay has failed; a pressure vessel bursts – the vessel fails. A protective device which functions as intended has not failed, e.g, a blown fuse. 8 *System element: a subsystem, assembly, component, piece part, etc. 8671
Definitions – PRIMARY (OR BASIC) FAILURE • The failed element has seen no exposure to environmental or service stresses exceeding its ratings to perform. E.g., fatigue failure of a relay spring within its rated lifetime; leakage of a valve seal within its pressure rating. – SECONDARY FAILURE • Failure induced by exposure of the failed element to environmental and/or service stresses exceeding its intended ratings. E.g., the failed element has been improperly designed, or selected, or installed, or calibrated for the application; the failed element is 9 8671 overstressed/underqualified for its burden.
Assumptions and Limitations I Non-repairable system. I No sabotage. I Markov… – Fault rates are constant… = 1/MTBF = K – The future is independent of the past – i.e., future states available to the system depend only upon its present state and pathways now available to it, not upon how it got where it is. I Bernoulli… – Each system element analyzed has two, mutually exclusive states. 10 8671
The Logic Symbols TOP Event – forseeable, undesirable event, toward which all fault tree logic paths flow,or Intermediate event – describing a system state produced by antecedent events. Most Fault Tree “Or” Gate – produces output if any input Analyses can be exists. Any input, individual, must be carried out using OR only these four (1) necessary and (2) sufficient to cause the output event. symbols. “And” Gate – produces output if all inputs co-exist. All inputs, AND individually must be (1) necessary and (2) sufficient to cause the output event Basic Event – Initiating fault/failure, not developed further. (Called “Leaf,” “Initiator,” or “Basic.”) The Basic Event marks the limit of resolution of the analysis. Events and Gates are not component parts of the system being analyzed. They are symbols representing the logic of the analysis. They are bi-modal. They function flawlessly. 11 8671
Steps in Fault Tree Analysis 1 Identify undesirable TOP event 3 Link contributors to TOP by logic gates 2 Identify first-level contributors 5 Link second-level contributors to TOP by logic gates 4 Identify second-level contributors Basic Event (“Leaf,” “Initiator,” or “Basic”) indicates limit of analytical 6 Repeat/continue resolution. 12 8671
Some Rules and Conventions Do use single-stem gate-feed inputs. NO YES Don’t let gates feed gates. 13 8671
More Rules and Conventions Be CONSISTENT in naming fault events/conditions. Use same name for same event/condition throughout the analysis. (Use index numbering for large trees.) Say WHAT failed/faulted and HOW – e.g., “Switch Sw-418 contacts fail closed” Don’t expect miracles to “save” the system. Lightning will not recharge the battery. A large bass will not plug the hole in the hull. 14 8671
Some Conventions Illustrated MAYBE Flat Tire – A gust of wind will come along and correct the skid. ? – A sudden cloudburst will extinguish the ignition source. Air – There’ll be a power Tire Escapes From Pressure Tire outage when the worker’s Drops Deflates Casing hand contacts the high- voltage conductor. Initiators must be statistically No miracles! independent of one another. 15 Name basics consistently! 8671
Identifying TOP Events Explore historical records (own and others). Look to energy sources. Identify potential mission failure contributors. Development “what-if” scenarios. Use “shopping lists.” 16 8671
Example TOP Events Wheels-up landing Dengue fever pandemic Mid-air collision Sting failure Subway derailment Inadvertent nuke launch Turbine engine FOD Reactor loss of cooling Rocket failure to ignite Uncommanded ignition Irretrievable loss of Inability to dewater primary test data buoyancy tanks TOP events represent potential high-penalty losses (i.e., high risk). Either severity of the outcome or frequency of occurrence can produce high risk. 17 8671
“Scope” the Tree TOP Too Broad Improved Computer Outage Outage of Primary Data Collection computer, exceeding eight hours, from external causes Exposed Conductor Unprotected body contact with potential greater than 40 volts Foreign Object Ingestion Foreign object weighing more than 5 grams and having density greater than 3.2 gm/cc Jet Fuel Dispensing Leak Fuel dispensing fire resulting in loss exceeding $2,500 “Scoping” reduces effort spent in the analysis by confining it to relevant considerations. To “scope,” describe the level of penalty or the circumstances for which the event becomes intolerable – use modifiers to narrow the event description. 18 8671
Adding Contributors to the Tree Examples: (2) must be an INDEPENDENT* FAULT or FAILURE CONDITION Electrical power fails off (typically described by a noun, an Low-temp. Alarm fails off action verb, and specifying • Solar q > 0.043 btu/ft2/ sec modifiers) Relay K-28 contacts freeze EFFECT closed * At a given level, under a given gate, Transducer case ruptures each fault must be Proc. Step 42 omitted independent of all CAUSE others. However, the (1) EACH same fault may CONTRIBUTING (3) and, each element appear at other points ELEMENT must be an immediate on the tree. contributor to the level above NOTE: As a group under an AND gate, and individually under an OR gate, contributing elements must be both necessary and sufficient to serve as immediate cause for the output event. 19 8671
Example Fault Tree Development Constructing the logic Spotting/correcting some common errors Adding quantitative data 20 8671
An Example Fault Tree Late for Work Undesirable Event Sequence Transport Life Process and Initiation Failures Support Misc. Failures Failures System Oversleep Malfunctions Causative Modalities* * Partitioned aspects of system function, subdivided as the purpose, physical 21 8671 ? arrangement, or sequence of operation
Sequence Initiation Failures Oversleep No “Start” Pulse Natural Apathy Artificial Bio- Wakeup Fails rhythm Fails 22 8671 ?
Verifying Logic Oversleep No “Start” Does this Pulse Natural “look” Apathy correct? Should the gate Artificial Bio- be OR? rhythm Wakeup Fails Fails ? 23 8671
Test Logic in SUCCESS Domain Oversleep Wakeup Redraw – invert all Succeeds statements and gates “trigger” “motivation” No “Start” “Start” Pulse Failure Pulse Success Natural Natural Works Domain Apathy Domain High Torque Bio- Artificial Artificial Bio- Rhythm Wakeup Fails Rhythm Wakeup Works Fails Fails ? ? 24 8671 If it was wrong here……it’ll be wrong here, too!
Artificial Wakeup Fails Artificial Wakeup Fails Alarm Clocks Fail Nocturnal Deafness Main Backup Plug-in (Windup) Clock Fails Clock Fails Faulty Faulty Forget Forget Power Innards Forget to Mech- to to Outage Set anism Set Wind Electrical Mechanical Fault Fault What does the tree tell up about system vulnerability at this point? Hour Hour Hand Hand Falls Jams Off Works 25 8671
Background for Numerical Methods Relating PF to R The Bathtub Curve Exponential Failure Distribution Propagation through Gates PF Sources 26 8671
Reliability and Failure Probability Relationships I S = Successes I F = Failures I S Reliability… R =(S+F) I Failure Probability… PF = F (S+F) S R + PF = (S+F)+ F ≡ 1 (S+F) 1 = Fault Rate = MTBF 27 8671
Significance of PF Fault probability is modeled acceptably ) λ = 1 / MTBF lity M IN well as a function of exposure interval O RN ta nt N Random fa UR or BU UT Failure (T) by the exponential. For exposure (In B intervals that are brief (T < 0.2 MTBF), T PF is approximated within 2% by λT. λ0 PF ≅ λT (within 2%, for λT ≤ 20%) 0 1.0 0 The Bathtub Curve t Most system elements have fault rates 0.63 PF = 1 – ε–λT (λ = 1/MTBF) that are constant (λ0) 0.5 over long periods of useful life. During ℜ = ε–λT these periods, faults occur at random times. T 0 0 1 MTBF Exponentially Modeled Failure Probability 28 8671
ℜ and PF Through Gates OR Gate For 2 Inputs AND Gate Either of two, independent, element Both of two, independent elements must fail to failures produces system failure. produce system failure. ℜT = ℜ A ℜB ℜT = ℜA + ℜ B – ℜA ℜ B R + PF ≡ 1 PF = 1 – ℜT PF = 1 – ℜT PF = 1 (ℜA ℜB) PF = 1 – (ℜ A + ℜ B – ℜA ℜ B) PF = 1 – [(1 – PA)(1 – PB)] PF = 1 – [(1 – PA) + (1 – PB) – (1 – PA)(1 – PB)] PF = PA + PB – PA PB [Union / ∪] PF = PA PB [Intersection / ∩] …for PA,B ≤ 0.2 “Rare Event PF ≅ PA + PB Approximation” with error ≤ 11% For 3 Inputs PF = PA + PB + PC PF = PA PB PC – PA PB – PA PC – PB PC Omit for + PA PBPC approximation 29 8671
PF Propagation Through Gates AND Gate… OR Gate… TOP TOP PT = Π Pe PT = P1 P2 PT ≅ Σ Pe PT ≅ P1+ P2 [Intersection / ∩] [Union / ∪] 1 2 1 2 P1 P2 P1 P2 1&2 are INDEPENDENT events. PT = P1 P2 PT = P1 + P2 – P1 P2 Usually negligible 30 8671
“Ipping” Gives Exact OR Gate Solutions Failure TOP Success TOP Failure TOP PT =Π (1 – Pe) Π PT = ? PT = Pe 1 2 3 1 2 3 1 2 3 P1 P2 P3 P1 P2 P3 P1 = (1 – P1) P3 = (1 – P3) The ip operator ( ) is the P2 = (1 – P2) Π co-function of pi (Π). It PT = Pe= 1 – Π (1 – Pe) Π provides an exact solution for propagating probabilities through the PT = 1 – [(1 – P1) ( 1 – P2) (1 – P3 … (1 – Pn )] OR gate. Its use is rarely justifiable. 31 8671
More Gates and Symbols Inclusive OR Gate… PT = P1 + P2 – (P1 x P2) Opens when any one or more events occur. Exclusive OR Gate… PT = P1 + P2 – 2 (P1 x P2) Opens when any one (but only one) event occurs. Mutually Exclusive OR Gate… PT = P1 + P2 Opens when any one of two or more M events occur. All other events are then precluded. For all OR Gate cases, the Rare Event Approxi- 32 8671 mation may be used for small values of Pe. PT ≅ Σ Pe
Still More Gates and Symbols Priority AND Gate PT = P1 x P2 Opens when input events occur in predetermined sequence. Inhibit Gate External Event Opens when (single) input An event normally event occurs in presence expected to occur. of enabling condition. Conditioning Event Undeveloped Event Applies conditions or An event not further restrictions to other developed. symbols. 33 8671
Some Failure Probability Sources Manufacturer’s Data Industry Consensus Standards MIL Standards Historical Evidence – Same or Similar Systems Simulation/testing Delphi Estimates ERDA Log Average Method 34 8671
Log Average Method* If probability is not estimated easily, but upper and lower credible bounds can be judged… • Estimate upper and lower credible bounds of probability for the phenomenon in question. • Average the logarithms of the upper and lower bounds. • The antilogarithm of the average of the logarithms of the upper and lower bounds is less than the upper bound and greater than the lower bound by the same factor. Thus, it is geometrically midway between the limits of estimation. 0.01 0.0 2 0.03 0.04 0.05 0.07 0.1 0.0316+ PL PU Lower Log PL + Log PU Upper Probability Log Average = Antilog = Antilog (–2) + (–1) = 10–1.5 = 0.0316228 Probability 2 2 Bound 10–1 Bound 10–2 Note that, for the example shown, the arithmetic average would be… 0.01 + 0.1 = 0.055 2 i.e., 5.5 times the lower bound and 0.55 times the upper bound * Reference: Briscoe, Glen J.; “Risk Management Guide;” System Safety Development Center; SSDC-11; DOE 76-45/11; September 1982. 35 8671
More Failure Probability Sources WASH-1400 (NUREG-75/014); “Reactor Safety Study – An Assessment of Accident Risks in US Commercial Nuclear Power Plants;” 1975 IEEE Standard 500 Government-Industry Data Exchange Program (GIDEP) Rome Air Development Center Tables NUREG-0492; “Fault Tree Handbook;” (Table XI-1); 1986 Many others, including numerous industry-specific proprietary listings 36 8671
Typical Component Failure Rates Failures Per 106 Hours Device Minimum Average Maximum Semiconductor Diodes 0.10 1.0 10.0 Transistors 0.10 3.0 12.0 Microwave Diodes 3.0 10.0 22.0 MIL-R-11 Resistors 0.0035 0.0048 0.016 MIL-R-22097 Resistors 29.0 41.0 80.0 Rotary Electrical Motors 0.60 5.0 500.0 Connectors 0.01 0.10 10.0 Source: Willie Hammer, “Handbook of System and Product Safety,” Prentice Hall 37 8671
Typical Human Operator Failure Rates Activity Error Rate *Error of omission/item embedded in procedure 3 x 10–3 *Simple arithmetic error with self-checking 3 x 10–2 *Inspector error of operator oversight 10–1 *General rate/high stress/ dangerous activity 0.2-0.3 **Checkoff provision improperly used 0.1-0.09 (0.5 avg.) **Error of omission/10-item checkoff list 0.0001-0.005 (0.001 avg.) **Carry out plant policy/no check on operator 0.005-0.05 (0.01 avg.) **Select wrong control/group of identical, 0.001-0.01 (0.003 avg.) labeled, controls Sources: * WASH-1400 (NUREG-75/014); “Reactor Safety Study – An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants,” 1975 **NUREG/CR-1278; “Handbook of Human Reliability Analysis with Emphasis on 38 8671 Nuclear Power Plant Applications,” 1980
Some Factors Influencing Human Operator Failure Probability Experience Stress Training Individual self discipline/conscientiousness Fatigue Perception of error consequences (…to self/others) Use of guides and checklists Realization of failure on prior attempt Character of Task – Complexity/Repetitiveness 39 8671
Artificial Wakeup Fails Artificial Wakeup Fails KEY: Faults/Operation………...8. X 10–3 3.34 x 10–4 Rate, Faults/Year………. 2/1 approx. 0.1 / yr Alarm Assume 260 operations/year Clocks Fail Nocturnal Deafness 3.34 x 10–4 Negligible Main Backup Plug-in (Windup) Clock Fails Clock Fails 1.82 x 10–2 1.83 x 10–2 Faulty Faulty Forget Forget Power Innards Forget to Mech- to to Outage Set anism Set Wind 1. x 10–2 3. x 10–4 8. x 10–3 4. x 10–4 8. x 10–3 1. x 10–2 3/1 2/1 1/10 2/1 3/1 Electrical Mechanical Fault Fault 3. x 10–4 8. x 10–8 1/15 Hour Hour Hand Hand Falls Jams Off 4. x 10–4 Works 2. x 10–4 40 1/10 1/20 8671
HOW Much PT is TOO Much? Consider “bootstrapping” comparisons with known risks… Human operator error (response to repetitive stimulus) ≅10–2- 10–3/exp MH† Internal combustion engine failure (spark ignition) ≅10–3/exp hr† Pneumatic instrument recorder failure ≅10–4/exp hr† Distribution transformer failure ≅10–5/exp hr† U.S. Motor vehicles fatalities ≅10–6/exp MH† Death by disease (U.S. lifetime avg.) ≅10–6/exp MH U.S. Employment fatalities ≅10–7-10–8/exp MH† Death by lightning ≅10–9/exp MH* Meteorite (>1 lb) hit on 103x 103 ft area of U.S. ≅10–10/exp hr‡ Earth destroyed by extraterrestrial hit ≅10–14/exp hr† † Browning, R.L., “The Loss Rate Concept in Safety Engineering” * National Safety Council, “Accident Facts” ‡ Kopecek, J.T., “Analytical Methods Applicable to Risk Assessment & Prevention,” Tenth International System Safety Conference 41 8671
Apply Scoping What power outages are of concern? Power Outage Not all of them! Only those that… 1 X 10–2 3/1 • Are undetected/uncompensated • Occur during the hours of sleep • Have sufficient duration to fault the system This probability must reflect these conditions! 42 8671
Single-Point Failure “A failure of one independent element of a system which causes an immediate hazard to occur and/or causes the whole system to fail.” Professional Safety – March 1980 43 8671
Some AND Gate Properties Cost: TOP Assume two identical elements having P = 0.1. PT = 0.01 PT = P1 x P2 Two elements having P = 0.1 may cost much less than one element having P = 0.01. 1 2 Freedom from single point failure: Redundancy ensures that either 1 or 2 may fail without inducing TOP. 44 8671
Failures at Any Analysis Level Must Be • Independent of each other Don’t • True contributors to the level above Do Mechanical Faulty Fault Innards Independent Hand Hand Hand Elect. Falls/ Gearing Other Falls Off Jams Mech. Works Fault Jams Fails Works Fault Alarm Alarm Failure Failure True Contributors Alarm Toast Backup Alarm Backup Clock Burns Clock Clock Clock Fails Fails Fails Fails 45 8671
Common Cause Events/Phenomena “A Common Cause is an event or a phenomenon which, if it occurs, will induce the occurrence of two or more fault tree elements.” Oversight of Common Causes is a frequently found fault tree flaw! 46 8671
Common Cause Oversight – An Example Unannunciated Intrusion by Burglar Microwave Electro- Seismic Acoustic Optical Footfall DETECTOR/ALARM FAILURES Four, wholly independent alarm systems are provided to detect and annunciate intrusion. No two of them share a common operating principle. Redundancy appears to be absolute. The AND gate to the TOP event seems appropriate. But, suppose the four systems share a single source of operating power, and 47 that source fails, and there are no backup sources? 8671
Common Cause Oversight Correction Unannunciated Intrusion by Burglar Detector/Alarm Detector/Alarm Failure Power Failure Microwave Basic Power Failure Electro-Optical Emergency Power Failure Seismic Footfall Acoustic Here, power source failure has been recognized as an event which, if it occurs, will disable all four alarm systems. Power failure has been accounted for as a common cause event, leading to the TOP event through an OR gate. OTHER COMMON CAUSES SHOULD ALSO BE SEARCHED FOR. 48 8671
Example Common Cause Fault/Failure Sources Utility Outage Dust/Grit – Electricity Temperature Effects – Cooling Water (Freezing/Overheat) – Pneumatic Pressure Electromagnetic – Steam Disturbance Moisture Single Operator Oversight Corrosion Many Others Seismic Disturbance 49 8671
Example Common Cause Suppression Methods Separation/Isolation/Insulation/Sealing/ Shielding of System Elements. Using redundant elements having differing operating principles. Separately powering/servicing/maintaining redundant elements. Using independent operators/inspectors. 50 8671
Missing Elements? Unannunciated Contributing elements Intrusion by SYSTEM must combine to Burglar CHALLENGE satisfy all conditions essential to the TOP event. The logic Detector/Alarm Intrusion By criteria of necessity Failure Burglar and sufficiency must be satisfied. Detector/Alarm Detector/Alarm System Failure Power Failure Burglar Barriers Present Fail Microwave Basic Power Failure Electro-Optical Seismic Footfall Emergency Power Failure Acoustic 51 8671
Example Problem – Sclerotic Scurvy – The Astronaut’s Scourge BACKGROUND: Sclerotic scurvy infects 10% of all returning astronauts. Incubation period is 13 days. For a week thereafter, victims of the disease display symptoms which include malaise, lassitude, and a very crabby outlook. A test can be used during the incubation period to determine whether an astronaut has been infected. Anti-toxin administered during the incubation period is 100% effective in preventing the disease when administered to an infected astronaut. However, for an uninfected astronaut, it produces disorientation, confusion, and intensifies all undesirable personality traits for about seven days. The test for infection produces a false positive result in 2% of all uninfected astronauts and a false negative result in one percent of all infected astronauts. Both treatment of an uninfected astronaut and failure to treat an infected astronaut constitute in malpractice. Problem: Using the test for infection and the anti-toxin, if the test indicates need for it, what is the probability that a returning astronaut will be a victim of malpractice? 52 8671
Sclerotic Scurvy Malpractice What is the greatest Malpractice contributor to this probability? 0.019 Should the test be Fail to Treat Treat used? Infection Needlessly (Disease) (Side Effects) 0.001 0.018 False Infected False Negative Healthy Positive Astronaut Astronaut Test Test 0.01 0.1 0.9 0.02 10% of returnees are infected – 90% are not infected 1% of infected cases test falsely negative, 2% of uninfected cases test falsely positive, receive no treatment, succumb to disease receive treatment, succumb to side effects 53 8671
Cut Sets AIDS TO… System Diagnosis Reducing Vulnerability Linking to Success Domain 54 8671
Cut Sets A CUT SET is any group of fault tree initiators which, if all occur, will cause the TOP event to occur. A MINIMAL CUT SET is a least group of fault tree initiators which, if all occur, will cause the TOP event to occur. 55 8671
Finding Cut Sets 1. Ignore all tree elements except the initiators (“leaves/basics”). 2. Starting immediately below the TOP event, assign a unique letter to each gate, and assign a unique number to each initiator. 3. Proceeding stepwise from TOP event downward, construct a matrix using the letters and numbers. The letter representing the TOP event gate becomes the initial matrix entry. As the construction progresses: Replace the letter for each AND gate by the letter(s)/number(s) for all gates/initiators which are its inputs. Display these horizontally, in matrix rows. Replace the letter for each OR gate by the letter(s)/number(s) for all gates/initiators which are its inputs. Display these vertically, in matrix columns. Each newly formed OR gate replacement row must also contain all other entries found in the original parent row. 56 8671
Finding Cut Sets 4. A final matrix results, displaying only numbers representing initiators. Each row of this matrix is a Boolean Indicated Cut Set. By inspection, eliminate any row that contains all elements found in a lesser row. Also eliminate redundant elements within rows and rows that duplicate other rows. The rows that remain are Minimal Cut Sets. 57 8671
A Cut Set Example PROCEDURE: TOP – Assign letters to gates. (TOP A gate is “A.”) Do not repeat letters. – Assign numbers to basic initiators. If a basic initiator B D appears more than once, represent it by the same 1 2 4 number at each appearance. C – Construct a matrix, starting with the TOP “A” gate. 2 3 58 8671
A Cut Set Example A B D 1 D 1 D C D 2 D 3 TOP event A is an AND B is an OR gate; 1 C is an AND gate is A, the gate; B & D, its & C, its inputs, gate; 2 & 3, its initial matrix inputs, replace it replace it vertically. inputs, replace it entry. horizontally. Each requires a new horizontally. row. These Boolean- 1 2 1 2 1 2 2 D 3 2 2 3 Indicated Cut Sets… 2 3 Minimal Cut Set 1 4 1 4 1 4 rows are least 2 4 3 D (top row), is an …reduce to these groups of OR gate; 2 & 4, its D (second minimal cut sets. inputs, replace it row), is an OR initiators which vertically. Each gate. Replace will induce TOP. requires a new as before. row. 59 8671
An “Equivalent” Fault Tree Boolean TOP Equivalent An Equivalent Fault Tree can be constructed Fault Tree from Minimal Cut Sets. For example, these Minimal Cut Sets… 1 2 1 2 1 4 2 3 2 3 1 4 …represent this Fault Tree… …and this Fault Tree is a Logic Equivalent of the original, for which the Minimal Cut Sets were derived. 60 8671
Equivalent Trees Aren’t Always Simpler 4 gates 6 initiators This Fault Tree has this logic equivalent. 9 gates 1 2 3 4 5 6 24 TOP initiators Minimal cut sets 1/3/5 1 3 5 1 3 6 1 4 5 1 4 6 1/3/6 1/4/5 1/4/6 2/3/5 2 3 5 2 3 6 2 4 5 2 4 6 2/3/6 2/4/5 2/4/6 61 8671
Another Cut Set Example TOP Compare this case to the first Cut Set A example – note differences. TOP B C gate here is OR. 1 6 In the first F D example, TOP gate was AND. 2 3 5 G Proceed as with E first example. 3 4 4 1 62 8671
Another Cut Set Example Construct Matrix – make step-by-step substitutions… A B 1 D 1 2 1 2 C F 6 F D 3 5 G 6 I E 1 E Boolean-Indicated Cut Sets Minimal Cut Sets 1 2 1 2 1 2 Note that there are 3 5 G 6 3 5 G 6 1 3 four Minimal Cut 1 3 1 3 1 4 Sets. Co-existence of 1 4 1 4 3 4 5 6 3 5 1 6 all of the initiators in any one of them will precipitate the TOP event. An EQUIVALENT FAULT TREE can again be constructed… 63 8671
Another “Equivalent” Fault Tree These Minimal Cut Sets… 1 2 represent this Fault Tree 1 3 – a Logic Equivalent of the 1 4 original tree. 3 4 5 6 TOP 1 2 1 3 1 4 3 4 5 6 64 8671
From Tree to Reliability Block Diagram Blocks represent functions of system elements. TOP Paths through them represent success. A “Barring” terms (n) denotes consideration of their success properties. 3 B 2 3 4 C 5 1 1 6 4 1 F D 6 2 3 5 TOP The tree models a system fault, in failure G E domain. Let that fault be System Fails to Function as Intended. Its opposite, System Succeeds to 3 4 4 1 function as intended, can be represented by a Reliability Block Diagram in which success flows through system element functions from left to right. Any path through the block diagram, not interrupted by a fault of an element, results in system success. 65 8671
Cut Sets and Reliability Blocks TOP A 3 2 3 4 B C 5 1 4 1 1 6 F 6 D 3 5 Note that 2 3/5/1/6 is a Cut G 1 2 E Set, but not a 1 3 Minimal Cut Set. 3 4 4 1 (It contains 1/3, 1 4 a true Minimal 3 4 5 6 Cut Set.) Each Cut Set (horizontal rows in the matrix) interrupts all left-to-right paths Minimal Cut Sets 66 8671 through the Reliability Block Diagram
Cut Set Uses Evaluating PT Finding Vulnerability to Common Causes Analyzing Common Cause Probability Evaluating Structural Cut Set “Importance” Evaluating Quantitative Cut Set “Importance” Evaluating Item “Importance” 67 8671
Cut Set Uses/Evaluating PT Minimal Cut Sets TOP 1 2 PT A 1 3 1 4 B C 3 4 5 6 1 6 F Pt ≅ Σ P k = D P 1 x P2 + 3 5 P1 x P3 + 2 G P1 x P4 + E P3 x P4 x P5 x P6 3 4 4 1 Note that propagating 1 2 probabilities through an 3 5 4 6 Cut Set Probability (Pk), the product of “unpruned” tree, i .e., 1 3 probabilities for events within the Cut Set, using Boolean-Indicated 1 4 is the probability that the Cut Set being Cut Sets rather than 3 5 1 6 considered will induce TOP. minimal Cut Sets, would 68 produce a falsely high PT. 8671 Pk = Π Pe = P1 x P2 x P3 x…Pn
Cut Set Uses/Common Cause Vulnerability Uniquely subscript initiators, using letter indicators TOP of common cause susceptibility, e.g…. A l = location (code where) m = moisture h = human operator Minimal Cut Sets B C q = heat 1 v 2h f = cold 1v 6m v = vibration 1v 3 m F …etc. D 1v 4 m 2h 3m 5m 3m 4m 5m 6m G E 3m 4m All Initiators in this Cut Set are 4m 1v vulnerable to moisture. Some Initiators may be vulnerable to several Moisture is a Common Cause Common Causes and receive several corresponding and can induce TOP. subscript designators. Some may have no Common ADVICE: Moisture proof one or 69 Cause vulnerability – receive no subscripts. more items. 8671
Analyzing Common Cause Probability TOP PT System Common-Cause Fault These Induced Fault must be OR Analyze as …others usual… Moisture Human Heat Vibration Operator Introduce each Common Cause identified as a “Cut Set Killer” at its individual probability level of both (1) occurring, and (2) inducing all terms within the 70 affected cut set. 8671
Cut Set Structural “Importance” Minimal Cut Sets TOP 1 2 A 1 3 1 4 B C 3 4 5 6 1 6 F D All other things being equal… • A LONG Cut Set signals low 2 3 5 vulnerability G • A SHORT Cut Set signals higher E vulnerability 3 4 4 1 • Presence of NUMEROUS Cut Sets signals high vulnerability …and a singlet cut set signals a Potential Single-Point Failure. Analyzing Structural Importance enables qualitative ranking of contributions to System Failure. 71 8671
Cut Set Quantitative “Importance” TOP The quantitative importance of a Cut Set (Ik) is the numerical probability that, PT A given that TOP has occurred, that Cut Set has induced it. Pk Ik = B C PT …where Pk = Π Pe = P3 x P4 x P5 x P6 1 6 D F Minimal Cut Sets 1 2 2 3 5 G 1 3 E 1 4 3 4 4 1 3 4 5 6 Analyzing Quantitative Importance enables numerical ranking of contributions to System Failure. To reduce system vulnerability most effectively, attack Cut Sets having greater Importance. Generally, short Cut Sets have greater Importance, long Cut Sets have lesser Importance. 72 8671
Item ‘Importance” The quantitative Importance of an item (Ie) is the numerical probability that, given that TOP has occurred, that item has contributed to it. Ne = Number of Minimal Cut Sets Ne containing Item e Ie ≅ Σ Ike Minimal Cut Sets Ike = Importance of the Minimal Cuts Sets containing Item e 1 2 1 3 Example – Importance of item 1… 1 4 3 4 5 6 (P1 x P2) + (P1 x P3) + (P1 x P4) I1 ≅ PT 73 8671
Path Sets Aids to… Further Diagnostic Measures Linking to Success Domain Trade/Cost Studies 74 8671
Path Sets A PATH SET is a group of fault tree initiators which, if none of them occurs, will guarantee that the TOP event cannot occur. TO FIND PATH SETS* change all AND gates to OR gates and all OR gates to AND. Then proceed using matrix construction as for Cut Sets. Path Sets will be the result. *This Cut Set-to-Path-Set conversion takes advantage of de Morgan’s duality theorem. Path Sets are complements of Cut Sets. 75 8671
A Path Set Example TOP Path Sets are least A groups of initiators which, if they cannot B C occur, guarantee 1 6 against TOP This Fault Tree has D F occurring these Minimal Cut sets 3 5 1 3 2 E G 1 4 1 2 1 5 3 4 4 1 1 3 1 6 1 4 …and these Path Sets 2 3 4 “Barring” terms (n) denotes 3 4 5 6 consideration of their success properties 76 8671
Path Sets and Reliability Blocks TOP A 3 2 3 4 B C 5 1 4 1 1 6 F 6 D 3 5 2 Each Path Set E G 1 3 (horizontal rows in 1 4 the matrix) 3 4 4 1 1 5 represents a left-to- 1 6 right path through the Reliability Block 2 3 4 Path Sets Diagram. 77 8671
Pat Sets and Trade Studies 3 Path Set Probability (Pp) is 2 3 4 Pp ≅ Σ Pe the probability that the 5 system will suffer a fault at 1 4 1 one or more points along the 6 operational route modeled by the path. To minimize Path Sets failure probability, minimize Pp $ path set probability. a 1 3 PPa $a Sprinkle countermeasure resources amongst b 1 4 PPb $b the Path Sets. Compute the probability $c decrement for each newly adjusted Path Set c 1 5 PPc option. Pick the countermeasure d 1 6 PPd $d ensemble(s) giving the most favorable e 2 3 4 PPe $e ∆ Pp / ∆ $. (Selection results can be verified by computing ∆ PT/ ∆ $ for competing 78 candidates.) 8671
Reducing Vulnerability – A Summary Inspect tree – find/operate on major PT contributors… – Add interveners/redundancy (lengthen cut sets). – Derate components (increase robustness/reduce Pe). – Fortify maintenance/parts replacement (increase MTBF). Examine/alter system architecture – increase path set/cut set ratio. Evaluate Cut Set Importance. Rank items using Ik.} Ik= Pk/ PT Identify items amenable to improvement. N e Evaluate item importance. Rank items using Ie’ Ie ≅ Σ Ike Identify items amenable to improvement. } Evaluate path set probability. } Reduce PP at most favorable ∆P/∆ $. Pp ≅ Σ Pe For all new countermeasures, THINK… • COST • EFFECTIVENESS • FEASIBILITY (incl. schedule) AND Does the new countermeasure… • Introduce new HAZARDS? • Cripple the system? 79 8671
Some Diagnostic and Analytical Gimmicks A Conceptual Probabilistic Model Sensitivity Testing Finding a PT Upper Limit Limit of Resolution – Shutting off Tree Growth State-of-Component Method When to Use Another Technique – FMECA 80 8671
Some Diagnostic Gimmicks Using a “generic” all-purpose fault tree… TOP PT 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 81 8671
Think “Roulette Wheels” TOP A convenient, thought-tool model of PT probabilistic tree modeling… 1 2 3 4 5 6 7 Imagine a roulette wheel representing 8 9 each initiator. The “peg count” ratio for each wheel is determined by 10 11 12 13 14 probability for that initiator. Spin all 15 initiator wheels once for each system 16 17 exposure interval. Wheels “winning” in 18 19 20 21 gate-opening combinations provide a path to the TOP. 26 27 28 29 22 23 24 25 P22 = 3 x 10–3 1,000 peg spaces 30 31 32 33 34 997 white 3 red 82 8671
Use Sensitivity Tests TOP Gaging the “nastiness” of PT untrustworthy initiators… 1 2 3 4 5 Embedded within the tree, there’s a bothersome initiator with 6 7 8 9 an uncertain Pe. Perform a crude sensitivity test to obtain quick relief from worry… or, to justify the urgency of need for more exact input data: 10 11 12 13 14 15 1.Compute PT for a nominal value of Pe. Then, recompute PT P10 = ? for a new Pe = Pe + ∆ Pe. ´ 20 21 ∆ PT 16 17 18 19 ´ now, compute the “Sensitivity” of Pe = ∆ Pe If this sensitivity exceeds ≈ 0.1 in a large tree, work to ~27 26 ~ 28 29 22 23 24 25 Find a value for Pe having less uncertainty…or… 2.Compute PT for a value of Pe at its upper credible limit. Is the corresponding PT acceptable? If not, get a better Pe. 30 31 32 33 34 83 8671
Find a Max PT Limit Quickly The “parts-count” approach gives a sometimes-useful early estimate of PT… TOP PT 1 2 3 4 5 6 7 PT cannot exceed an8 upper bound given by: 9 PT(max) = Σ Pe = P1 + P2 + P3 + …Pn 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 84 8671
How Far Down Should a Fault Tree Grow? TOP Severity Probability PT Where do you stop the analysis? The analysis is a Risk Management enterprise. The TOP statement gives severity. The tree analysis provides probability. ANALYZE 1 2 3 4 5 NO FURTHER DOWN THAN IS NECESSARY TO ENTER PROBABILITY DATA WITH CONFIDENCE. Is risk acceptable? If YES, stop. If NO, use the tree to guide risk reduction. SOME EXCEPTIONS… 8 6 7 9 1.) An event within the tree has alarmingly high probability. Dig deeper beneath it to find the source(s) of the high probability. 2.) Mishap autopsies must sometimes analyze down to the cotter-pin level to 10 11 12 13 14 15 produce a “credible cause” list. 16 17 18 19 20 21 ? Initiators / leaves / basics define the LIMIT OF RESOLUTION of the analysis. ? 85 8671
State-of-Component Method WHEN – Analysis has proceeded to the device level – i.e., valves, Relay K-28 Contacts Fail pumps, switches, relays, etc. Closed HOW – Show device fault/failure in the mode needed for upward propagation. Relay Install an OR gate. Basic K-28 Failure/ Command Relay Place these three events beneath K-28 Secondary the OR. Relay Fault Fault K-28 This represents faults from environmental and service This represents internal Analyze further to find the stresses for which the device is “self” failures under normal source of the fault not qualified – e.g., component environmental and service condition, induced by struck by foreign object, wrong stresses – e.g., coil presence/absence of component burnout, spring failure, external command selection/installation. (Omit, if contacts drop off… “signals.” (Omit for most negligible.) passive devices – e.g., 86 8671 piping.)
The Fault Tree Analysis Report Executive Summary (Abstract of complete report) Scope of the analysis… Say what is analyzed Title Brief system description and TOP Description/Severity Bounding what is not analyzed. Company Analysis Boundaries Author Physical Boundaries Interfaces Treated Date Operational Boundaries Resolution Limit etc. Operational Phases Exposure Interval Human Operator In/out Others… The Analysis Show Tree as Figure. Discussion of Method (Cite Refs.) Software Used Include Data Sources, Presentation/Discussion of the Tree Cut Sets, Path Sets, etc. Source(s) of Probability Data (If quantified) as Tables. Common Cause Search (If done) Sensitivity Test(s) (If conducted) Cut Sets (Structural and/or Quantitative Importance, if analyzed) Path Sets (If analyzed) Trade Studies (If Done) Findings… TOP Probability (Give Confidence Limits) Comments on System Vulnerability Chief Contributors Candidate Reduction Approaches (If appropriate) Conclusions and Recommendations… Risk Comparisons (“Bootstrapping” data, if appropriate) 87 8671 Is further analysis needed? By what method(s)?
FTA vs. FMECA Selection Criteria* Preferred Selection Characteristic FTA FMECA Safety of public/operating/maintenance personnel √ Small number/clearly defined TOP events √ Indistinctly defined TOP events √ Full-Mission completion critically important √ Many, potentially successful missions possible √ “All possible” failure modes are of concern √ High potential for “human error” contributions √ High potential for “software error” contributions √ Numerical “risk evaluation” needed √ Very complex system architecture/many functional parts √ Linear system architecture with little/human software influence √ System irreparable after mission starts √ *Adapted from “Fault Tree Analysis Application Guide,” Reliability Analysis Center, Rome Air Development Center. 88 8671
Fault Tree Constraints and Shortcomings Undesirable events must be foreseen and are only analyzed singly. All significant contributors to fault/failure must be anticipated. Each fault/failure initiator must be constrained to two conditional modes when modeled in the tree. Initiators at a given analysis level beneath a common gate must be independent of each other. Events/conditions at any analysis level must be true, immediate contributors to next-level events/conditions. Each Initiator’s failure rate must be a predictable constant. 89 8671
Common Fault Tree Abuses Over-analysis – “Fault Kudzu” Unjustified confidence in numerical results – 6.0232 x 10–5…+/–? Credence in preposterously low probabilities – 1.666 x 10–24/hour Unpreparedness to deal with results (particularly quantitative) – Is 4.3 x 10–7/hour acceptable for a catastrophe? Overlooking common causes – Will a roof leak or a shaking floor wipe you out? Misapplication – Would Event Tree Analysis (or another technique) serve better? Scoping changes in mid-tree 90 8671
Fault Tree Payoffs Gaging/quantifying system failure probability. Assessing system Common Cause vulnerability. Optimizing resource deployment to control vulnerability. Guiding system reconfiguration to reduce vulnerability. Identifying Man Paths to disaster. Identifying potential single point failures. Supporting trade studies with differential analyses. FAULT TREE ANALYSIS is a risk assessment enterprise. Risk Severity is defined by the TOP event. Risk Probability is the result of the tree analysis. 91 8671
Closing Caveats Be wary of the ILLUSION of SAFETY. Low probability does not mean that a mishap won’t happen! THERE IS NO ABSOLUTE SAFETY! An enterprise is safe only to the degree that its risks are tolerable! Apply broad confidence limits to probabilities representing human performance! A large number of systems having low probabilities of failure means that A MISHAP WILL HAPPEN – somewhere among them! P1 + P2+ P3+ P4 + ----------Pn ≈ 1 More… 92 8671
Caveats Do you REALLY have enough data to justify QUANTITATIVE ANALYSIS? For 95% confidence… We must have no failures in to give PF ≅… and ℜ ≅ … Assumptions: 1,000 tests 3 x 10–3 0.997 I Stochastic System Behavior 300 tests 10–2 0.99 I ConstantSystem Properties 100 tests 3 x 10–2 0.97 I Constant Service Stresses 30 tests 10–1 0.9 I Constant Environmental Stresses 10 tests 3 x 10–1 0.7 Don’t drive the numbers into the ground! 93 8671
Analyze Only to Turn Results Into Decisions “Perform an analysis only to reach a decision. Do not perform an analysis if that decision can be reached without it. It is not effective to do so. It is a waste of resources.” Dr. V.L. Grose George Washington University 94 8671

More Related Content

PPTX
Fault Tree Analysis
byWoh Pelam
 
PPTX
fault tree analysis
byali taghaddosi
 
PPTX
FAULT TREE ANALYSIS (FTA) SEMINAR PRESENTATION
byOrange Slides
 
PPTX
Fault tree analysis
byDeep parmar
 
PDF
Fault tree analysis
byMudit M. Saxena
 
PPT
FAULT & EVENT TREE ANALYSIS
byNitesh Dongare
 
PPT
Event tree analysis and risk assessment
bySalah Mansour
 
PPTX
Functional safety by FMEA/FTA
bymehmor
 
Fault Tree Analysis
byWoh Pelam
 
fault tree analysis
byali taghaddosi
 
FAULT TREE ANALYSIS (FTA) SEMINAR PRESENTATION
byOrange Slides
 
Fault tree analysis
byDeep parmar
 
Fault tree analysis
byMudit M. Saxena
 
FAULT & EVENT TREE ANALYSIS
byNitesh Dongare
 
Event tree analysis and risk assessment
bySalah Mansour
 
Functional safety by FMEA/FTA
bymehmor
 

What's hot

PPT
Fault tree and event tree in risk analysis
byJennifer Gutierrez
 
PPTX
Hazop Study
byIhsan Ali
 
PDF
LOPA | Layer Of Protection Analysis | Gaurav Singh Rajput
byGaurav Singh Rajput
 
PPT
Fault Tree Analysis
byChellamuthu K
 
PPTX
Fault tree analysis
bykongu Engineering College
 
PPTX
Hazop Hazard and Operability Study
byAnand kumar
 
PPTX
Industrial safety unit iv ppt
bykannagi varadarajan
 
PDF
PSM Process Safety Management.pdf
byssuser2fc67e
 
PDF
Mechanical Integrity.pdf
byaashir14
 
PPTX
Presentation hazop introduction
bySundararajan Thangavelu
 
PDF
Bow Tie Risk Analysis
byJohn Kingsley
 
PPT
Hazop analysis
byAnand Kumar
 
PPTX
Phenomenon & Mechanism Analysis
byShubham Singh
 
PPTX
Fault tree analysis
byRodney Maverick
 
PPTX
Process safety managment
byDoruk Kimyasal Yönetim Sistemeri
 
PPTX
Work Permit System
byGagan Tanwar
 
PPTX
QRA
byMatt Loong
 
PPT
Reliability centred maintenance
bySHIVAJI CHOUDHURY
 
PPTX
Hazardous Area Classification
bydebuddit
 
PPT
Industrial safety
byAnita Sharma
 
Fault tree and event tree in risk analysis
byJennifer Gutierrez
 
Hazop Study
byIhsan Ali
 
LOPA | Layer Of Protection Analysis | Gaurav Singh Rajput
byGaurav Singh Rajput
 
Fault Tree Analysis
byChellamuthu K
 
Fault tree analysis
bykongu Engineering College
 
Hazop Hazard and Operability Study
byAnand kumar
 
Industrial safety unit iv ppt
bykannagi varadarajan
 
PSM Process Safety Management.pdf
byssuser2fc67e
 
Mechanical Integrity.pdf
byaashir14
 
Presentation hazop introduction
bySundararajan Thangavelu
 
Bow Tie Risk Analysis
byJohn Kingsley
 
Hazop analysis
byAnand Kumar
 
Phenomenon & Mechanism Analysis
byShubham Singh
 
Fault tree analysis
byRodney Maverick
 
Process safety managment
byDoruk Kimyasal Yönetim Sistemeri
 
Work Permit System
byGagan Tanwar
 
QRA
byMatt Loong
 
Reliability centred maintenance
bySHIVAJI CHOUDHURY
 
Hazardous Area Classification
bydebuddit
 
Industrial safety
byAnita Sharma
 

Similar to fault tree analysis

PDF
Fault tree analysis
byelsonpaul11
 
PPT
Fault Tree Analysis in Maintenance Principles
bysshoaib1
 
PDF
stpfaulttree
bySiti Mastura
 
PDF
Vortrag LWS Schweiz
byMichael Rumpler
 
PDF
(2020) FAULT TREE ANALYSIS.pdf
byDanielSetyo2
 
PPTX
TESTING AND VERIFICATION OF VLSI CIRCUITS -1
bylakshmi9229
 
DOCX
Fault tree analysis
byAkku Singh
 
PPTX
Fault tree analysis application & its procedure
by2203031097101
 
PPTX
faulttreeanalysis2-130611000044-phpapp02-converted.pptx
byNurman Pamungkas
 
PPT
Fault Tree Analysis.ppt FGHRRDYSUYSUTAYFSAUTW w
bymarikannan20077
 
PPT
FTA Slides for users.ppt slides for engineering.
byjohnacme123
 
PPT
Fault Tree Analysis CONCEPTS WITH ADVANTAGES
byD. Palani Kumar / Kamaraj College of Engineering & Technology
 
PPTX
Fault Tree analysis
byShailesh Dewangan
 
PDF
Fta &amp; pokayoke
byrashmi322
 
PPT
Supp HAZOP 1 Hazard Analysis Review: The Concept of Risk
byAhmed Ramadan
 
PDF
Fault Tree Analysis-Concepts and Application-Bill Vesely
byICTperspectives
 
PPT
Chapter-6 Quality and Reliability (L4T2).ppt
byayeshamily1
 
DOC
Understanding fire and gas mapping software
byKenexis
 
PPTX
FTA
byOjes Sai Pogiri
 
PDF
Failures and Failure Classificationmmmmm
byMohammedAbdalla64
 
Fault tree analysis
byelsonpaul11
 
Fault Tree Analysis in Maintenance Principles
bysshoaib1
 
stpfaulttree
bySiti Mastura
 
Vortrag LWS Schweiz
byMichael Rumpler
 
(2020) FAULT TREE ANALYSIS.pdf
byDanielSetyo2
 
TESTING AND VERIFICATION OF VLSI CIRCUITS -1
bylakshmi9229
 
Fault tree analysis
byAkku Singh
 
Fault tree analysis application & its procedure
by2203031097101
 
faulttreeanalysis2-130611000044-phpapp02-converted.pptx
byNurman Pamungkas
 
Fault Tree Analysis.ppt FGHRRDYSUYSUTAYFSAUTW w
bymarikannan20077
 
FTA Slides for users.ppt slides for engineering.
byjohnacme123
 
Fault Tree Analysis CONCEPTS WITH ADVANTAGES
byD. Palani Kumar / Kamaraj College of Engineering & Technology
 
Fault Tree analysis
byShailesh Dewangan
 
Fta &amp; pokayoke
byrashmi322
 
Supp HAZOP 1 Hazard Analysis Review: The Concept of Risk
byAhmed Ramadan
 
Fault Tree Analysis-Concepts and Application-Bill Vesely
byICTperspectives
 
Chapter-6 Quality and Reliability (L4T2).ppt
byayeshamily1
 
Understanding fire and gas mapping software
byKenexis
 
FTA
byOjes Sai Pogiri
 
Failures and Failure Classificationmmmmm
byMohammedAbdalla64
 

More from Siti Mastura

PDF
Poster on Psychosocial risk factors and musculoskeletal symptoms among nurses
bySiti Mastura
 
PDF
PSYCHOSOCIAL RISK FACTORS AND MUSCULOSKELETAL SYMPTOMS AMONG NURSES
bySiti Mastura
 
PDF
PenyakitKelamin
bySiti Mastura
 
PDF
valuation of toxicological implications of inhalationexposure to kerosene fum...
bySiti Mastura
 
PDF
SPSS GUIDE
bySiti Mastura
 
PDF
865_file_UNEP__20Emergency__20Preparedness_final
bySiti Mastura
 
PDF
Principles_Of_Hazard_Tree_Risk_Mgmnt
bySiti Mastura
 
PDF
fire fighting prevention
bySiti Mastura
 
PDF
PIHAK BERKUASA TEMPATAN
bySiti Mastura
 
PDF
Guidelines for Incident Commanders- Final ReportFFPE Use in Chemical Agent Vapor
bySiti Mastura
 
PDF
jurnal of occupational safety and health
bySiti Mastura
 
PDF
1-introductionbacteria
bySiti Mastura
 
PDF
Requirement and Technical Standard for Non Convention Cargo
bySiti Mastura
 
PDF
Communicable_Diseases_Guidelines_for_Prevention_and_Control_Japanese_Encephal...
bySiti Mastura
 
PDF
japanese encephalitis
bySiti Mastura
 
PDF
Communication for behavioral impact(COMBI)
bySiti Mastura
 
PDF
VECTOR CONTROL
bySiti Mastura
 
PDF
nominal group technique
bySiti Mastura
 
PDF
157-national-medicines-policy-of-malaysia
bySiti Mastura
 
PDF
NINTH MALAYSIA PLAN
bySiti Mastura
 
Poster on Psychosocial risk factors and musculoskeletal symptoms among nurses
bySiti Mastura
 
PSYCHOSOCIAL RISK FACTORS AND MUSCULOSKELETAL SYMPTOMS AMONG NURSES
bySiti Mastura
 
PenyakitKelamin
bySiti Mastura
 
valuation of toxicological implications of inhalationexposure to kerosene fum...
bySiti Mastura
 
SPSS GUIDE
bySiti Mastura
 
865_file_UNEP__20Emergency__20Preparedness_final
bySiti Mastura
 
Principles_Of_Hazard_Tree_Risk_Mgmnt
bySiti Mastura
 
fire fighting prevention
bySiti Mastura
 
PIHAK BERKUASA TEMPATAN
bySiti Mastura
 
Guidelines for Incident Commanders- Final ReportFFPE Use in Chemical Agent Vapor
bySiti Mastura
 
jurnal of occupational safety and health
bySiti Mastura
 
1-introductionbacteria
bySiti Mastura
 
Requirement and Technical Standard for Non Convention Cargo
bySiti Mastura
 
Communicable_Diseases_Guidelines_for_Prevention_and_Control_Japanese_Encephal...
bySiti Mastura
 
japanese encephalitis
bySiti Mastura
 
Communication for behavioral impact(COMBI)
bySiti Mastura
 
VECTOR CONTROL
bySiti Mastura
 
nominal group technique
bySiti Mastura
 
157-national-medicines-policy-of-malaysia
bySiti Mastura
 
NINTH MALAYSIA PLAN
bySiti Mastura
 

Recently uploaded

PPTX
How to Track & Manage My Time Section in Odoo 18 Time Off
byCeline George
 
PPTX
Greengnorance Toolkit Module 3 Shopping and Food
byKarl Donert
 
PPTX
PRE TERM LABOR ( PREMATURE LABOUR IN PREGNANCY)
byMuthu Kumar
 
PPTX
Greengnorance Toolkit Module 5 Waste Management
byKarl Donert
 
PDF
Chapter 05 Drugs Acting on the Central Nervous System: Anti-Depressant Drugs
bySandeshSul
 
PPTX
How to Change Shipping Label Size in Odoo 18 Inventory
byCeline George
 
PPTX
MEMORY &FORGETTING. Shilpa Hotakar.Psychology pptx
bySHILPA HOTAKAR
 
PDF
Conservation of Earthen Structures in India Preserving Traditional and Sustai...
byAman Kumar Singh
 
PPTX
Math 8 Quarter 4 Week 4-SECONDARY DATA.pptx
byshahanieabbat3
 
PPTX
Greengnorance Toolkit Module1 Climate Change
byKarl Donert
 
PDF
The Sheep and the Goat: Beckett’s Subversion of Divine Justice in Waiting for...
bysejadchokiya
 
PDF
Workshop 29 Crystal Review All Students by YogiGoddess
by©LDMMIA, ©Reiki Yoga
 
PPTX
Renal Physiology- Functional anatomy of Kidney.pptx
byDisha Soriya
 
PDF
Family and Marriage __ Sociology __ Jhasketan Kuanar __ NURSING VIBE ONLY .pdf
byJK NURSING VIBES ONLY JHASKETAN KUANAR
 
PDF
Artificial Intelligence in Research and Academic Writing, Workshop on Researc...
byProf. Vinod Kumar Kanvaria
 
PPTX
Plato's Insight model teaching and learning.pptx
byNikhitaDS
 
PPTX
How to perform product search based on a custom field from the Website Shop p...
byCeline George
 
PPTX
Renal Physiology- Juxtaglomerular Apparatus.pptx
byDisha Soriya
 
PDF
Pharmaceutical Quality Assurance Unit 1 (BP606T)
byChetan Mali
 
PDF
Chapter 05 Drugs Acting on the Central Nervous System: Anticonvulsant (Antiep...
bySandeshSul
 
How to Track & Manage My Time Section in Odoo 18 Time Off
byCeline George
 
Greengnorance Toolkit Module 3 Shopping and Food
byKarl Donert
 
PRE TERM LABOR ( PREMATURE LABOUR IN PREGNANCY)
byMuthu Kumar
 
Greengnorance Toolkit Module 5 Waste Management
byKarl Donert
 
Chapter 05 Drugs Acting on the Central Nervous System: Anti-Depressant Drugs
bySandeshSul
 
How to Change Shipping Label Size in Odoo 18 Inventory
byCeline George
 
MEMORY &FORGETTING. Shilpa Hotakar.Psychology pptx
bySHILPA HOTAKAR
 
Conservation of Earthen Structures in India Preserving Traditional and Sustai...
byAman Kumar Singh
 
Math 8 Quarter 4 Week 4-SECONDARY DATA.pptx
byshahanieabbat3
 
Greengnorance Toolkit Module1 Climate Change
byKarl Donert
 
The Sheep and the Goat: Beckett’s Subversion of Divine Justice in Waiting for...
bysejadchokiya
 
Workshop 29 Crystal Review All Students by YogiGoddess
by©LDMMIA, ©Reiki Yoga
 
Renal Physiology- Functional anatomy of Kidney.pptx
byDisha Soriya
 
Family and Marriage __ Sociology __ Jhasketan Kuanar __ NURSING VIBE ONLY .pdf
byJK NURSING VIBES ONLY JHASKETAN KUANAR
 
Artificial Intelligence in Research and Academic Writing, Workshop on Researc...
byProf. Vinod Kumar Kanvaria
 
Plato's Insight model teaching and learning.pptx
byNikhitaDS
 
How to perform product search based on a custom field from the Website Shop p...
byCeline George
 
Renal Physiology- Juxtaglomerular Apparatus.pptx
byDisha Soriya
 
Pharmaceutical Quality Assurance Unit 1 (BP606T)
byChetan Mali
 
Chapter 05 Drugs Acting on the Central Nervous System: Anticonvulsant (Antiep...
bySandeshSul
 

fault tree analysis

  • 1.
    Fault Tree Analysis P.L. Clemens February 2002 4th Edition
  • 2.
    Topics Covered Fault Tree Definition Developing the Fault Tree Structural Significance of the Analysis Quantitative Significance of the Analysis Diagnostic Aids and Shortcuts Finding and Interpreting Cut Sets and Path Sets Success-Domain Counterpart Analysis Assembling the Fault Tree Analysis Report Fault Tree Analysis vs. Alternatives Fault Tree Shortcoming/Pitfalls/Abuses All fault trees appearing in this training module have been drawn, analyzed, and printed using FaultrEaseTM, a computer application available from: Arthur D. Little, Inc./Acorn Park/ Cambridge, MA., 02140-2390 – Phone (617) 864- 2 8671 5770.
  • 3.
    First – ABit of Background Origins of the technique Fault Tree Analysis defined Where best to apply the technique What the analysis produces Symbols and conventions 3 8671
  • 4.
    Origins Fault tree analysis was developed in 1962 for the U.S. Air Force by Bell Telephone Laboratories for use with the Minuteman system…was later adopted and extensively applied by the Boeing Company…is one of many symbolic logic analytical techniques found in the operations research discipline. 4 8671
  • 5.
    The Fault Treeis A graphic “model” of the pathways within a system that can lead to a foreseeable, undesirable loss event. The pathways interconnect contributory events and conditions, using standard logic symbols. Numerical probabilities of occurrence can be entered and propagated through the model to evaluate probability of the foreseeable, undesirable event. Only one of many System Safety analytical tools and techniques. 5 8671
  • 6.
    Fault Tree Analysisis Best Applied to Cases with Large, perceived threats of loss, i.e., high risk. Numerous potential contributors to a mishap. Complex or multi-element systems/processes. Already-identified undesirable events. (a must!) Indiscernible mishap causes (i.e., autopsies). Caveat: Large fault trees are resource-hungry and should not be undertaken without reasonable assurance of need. 6 8671
  • 7.
    Fault Tree AnalysisProduces Graphic display of chains of events/conditions leading to the loss event. Identification of those potential contributors to failure that are “critical.” Improved understanding of system characteristics. Qualitative/quantitative insight into probability of the loss event selected for analysis. Identification of resources committed to preventing failure. Guidance for redeploying resources to optimize control of risk. 7 8671 Documentation of analytical results.
  • 8.
    Some Definitions – FAULT • An abnormal undesirable state of a system or a system element* induced 1) by presence of an improper command or absence of a proper one, or 2) by a failure (see below). All failures cause faults; not all faults are caused by failures. A system which has been shut down by safety features has not faulted. – FAILURE • Loss, by a system or system element*, of functional integrity to perform as intended, e.g., relay contacts corrode and will not pass rated current closed, or the relay coil has burned out and will not close the contacts when commanded – the relay has failed; a pressure vessel bursts – the vessel fails. A protective device which functions as intended has not failed, e.g, a blown fuse. 8 *System element: a subsystem, assembly, component, piece part, etc. 8671
  • 9.
    Definitions – PRIMARY (OR BASIC) FAILURE • The failed element has seen no exposure to environmental or service stresses exceeding its ratings to perform. E.g., fatigue failure of a relay spring within its rated lifetime; leakage of a valve seal within its pressure rating. – SECONDARY FAILURE • Failure induced by exposure of the failed element to environmental and/or service stresses exceeding its intended ratings. E.g., the failed element has been improperly designed, or selected, or installed, or calibrated for the application; the failed element is 9 8671 overstressed/underqualified for its burden.
  • 10.
    Assumptions and Limitations I Non-repairable system. I No sabotage. I Markov… – Fault rates are constant… = 1/MTBF = K – The future is independent of the past – i.e., future states available to the system depend only upon its present state and pathways now available to it, not upon how it got where it is. I Bernoulli… – Each system element analyzed has two, mutually exclusive states. 10 8671
  • 11.
    The Logic Symbols TOP Event – forseeable, undesirable event, toward which all fault tree logic paths flow,or Intermediate event – describing a system state produced by antecedent events. Most Fault Tree “Or” Gate – produces output if any input Analyses can be exists. Any input, individual, must be carried out using OR only these four (1) necessary and (2) sufficient to cause the output event. symbols. “And” Gate – produces output if all inputs co-exist. All inputs, AND individually must be (1) necessary and (2) sufficient to cause the output event Basic Event – Initiating fault/failure, not developed further. (Called “Leaf,” “Initiator,” or “Basic.”) The Basic Event marks the limit of resolution of the analysis. Events and Gates are not component parts of the system being analyzed. They are symbols representing the logic of the analysis. They are bi-modal. They function flawlessly. 11 8671
  • 12.
    Steps in FaultTree Analysis 1 Identify undesirable TOP event 3 Link contributors to TOP by logic gates 2 Identify first-level contributors 5 Link second-level contributors to TOP by logic gates 4 Identify second-level contributors Basic Event (“Leaf,” “Initiator,” or “Basic”) indicates limit of analytical 6 Repeat/continue resolution. 12 8671
  • 13.
    Some Rules andConventions Do use single-stem gate-feed inputs. NO YES Don’t let gates feed gates. 13 8671
  • 14.
    More Rules andConventions Be CONSISTENT in naming fault events/conditions. Use same name for same event/condition throughout the analysis. (Use index numbering for large trees.) Say WHAT failed/faulted and HOW – e.g., “Switch Sw-418 contacts fail closed” Don’t expect miracles to “save” the system. Lightning will not recharge the battery. A large bass will not plug the hole in the hull. 14 8671
  • 15.
    Some Conventions Illustrated MAYBE Flat Tire – A gust of wind will come along and correct the skid. ? – A sudden cloudburst will extinguish the ignition source. Air – There’ll be a power Tire Escapes From Pressure Tire outage when the worker’s Drops Deflates Casing hand contacts the high- voltage conductor. Initiators must be statistically No miracles! independent of one another. 15 Name basics consistently! 8671
  • 16.
    Identifying TOP Events Explore historical records (own and others). Look to energy sources. Identify potential mission failure contributors. Development “what-if” scenarios. Use “shopping lists.” 16 8671
  • 17.
    Example TOP Events Wheels-up landing Dengue fever pandemic Mid-air collision Sting failure Subway derailment Inadvertent nuke launch Turbine engine FOD Reactor loss of cooling Rocket failure to ignite Uncommanded ignition Irretrievable loss of Inability to dewater primary test data buoyancy tanks TOP events represent potential high-penalty losses (i.e., high risk). Either severity of the outcome or frequency of occurrence can produce high risk. 17 8671
  • 18.
    “Scope” the TreeTOP Too Broad Improved Computer Outage Outage of Primary Data Collection computer, exceeding eight hours, from external causes Exposed Conductor Unprotected body contact with potential greater than 40 volts Foreign Object Ingestion Foreign object weighing more than 5 grams and having density greater than 3.2 gm/cc Jet Fuel Dispensing Leak Fuel dispensing fire resulting in loss exceeding $2,500 “Scoping” reduces effort spent in the analysis by confining it to relevant considerations. To “scope,” describe the level of penalty or the circumstances for which the event becomes intolerable – use modifiers to narrow the event description. 18 8671
  • 19.
    Adding Contributors tothe Tree Examples: (2) must be an INDEPENDENT* FAULT or FAILURE CONDITION Electrical power fails off (typically described by a noun, an Low-temp. Alarm fails off action verb, and specifying • Solar q > 0.043 btu/ft2/ sec modifiers) Relay K-28 contacts freeze EFFECT closed * At a given level, under a given gate, Transducer case ruptures each fault must be Proc. Step 42 omitted independent of all CAUSE others. However, the (1) EACH same fault may CONTRIBUTING (3) and, each element appear at other points ELEMENT must be an immediate on the tree. contributor to the level above NOTE: As a group under an AND gate, and individually under an OR gate, contributing elements must be both necessary and sufficient to serve as immediate cause for the output event. 19 8671
  • 20.
    Example Fault TreeDevelopment Constructing the logic Spotting/correcting some common errors Adding quantitative data 20 8671
  • 21.
    An Example FaultTree Late for Work Undesirable Event Sequence Transport Life Process and Initiation Failures Support Misc. Failures Failures System Oversleep Malfunctions Causative Modalities* * Partitioned aspects of system function, subdivided as the purpose, physical 21 8671 ? arrangement, or sequence of operation
  • 22.
    Sequence Initiation Failures Oversleep No “Start” Pulse Natural Apathy Artificial Bio- Wakeup Fails rhythm Fails 22 8671 ?
  • 23.
    Verifying Logic Oversleep No “Start” Does this Pulse Natural “look” Apathy correct? Should the gate Artificial Bio- be OR? rhythm Wakeup Fails Fails ? 23 8671
  • 24.
    Test Logic inSUCCESS Domain Oversleep Wakeup Redraw – invert all Succeeds statements and gates “trigger” “motivation” No “Start” “Start” Pulse Failure Pulse Success Natural Natural Works Domain Apathy Domain High Torque Bio- Artificial Artificial Bio- Rhythm Wakeup Fails Rhythm Wakeup Works Fails Fails ? ? 24 8671 If it was wrong here……it’ll be wrong here, too!
  • 25.
    Artificial Wakeup Fails Artificial Wakeup Fails Alarm Clocks Fail Nocturnal Deafness Main Backup Plug-in (Windup) Clock Fails Clock Fails Faulty Faulty Forget Forget Power Innards Forget to Mech- to to Outage Set anism Set Wind Electrical Mechanical Fault Fault What does the tree tell up about system vulnerability at this point? Hour Hour Hand Hand Falls Jams Off Works 25 8671
  • 26.
    Background for NumericalMethods Relating PF to R The Bathtub Curve Exponential Failure Distribution Propagation through Gates PF Sources 26 8671
  • 27.
    Reliability and FailureProbability Relationships I S = Successes I F = Failures I S Reliability… R =(S+F) I Failure Probability… PF = F (S+F) S R + PF = (S+F)+ F ≡ 1 (S+F) 1 = Fault Rate = MTBF 27 8671
  • 28.
    Significance of PF Fault probability is modeled acceptably ) λ = 1 / MTBF lity M IN well as a function of exposure interval O RN ta nt N Random fa UR or BU UT Failure (T) by the exponential. For exposure (In B intervals that are brief (T < 0.2 MTBF), T PF is approximated within 2% by λT. λ0 PF ≅ λT (within 2%, for λT ≤ 20%) 0 1.0 0 The Bathtub Curve t Most system elements have fault rates 0.63 PF = 1 – ε–λT (λ = 1/MTBF) that are constant (λ0) 0.5 over long periods of useful life. During ℜ = ε–λT these periods, faults occur at random times. T 0 0 1 MTBF Exponentially Modeled Failure Probability 28 8671
  • 29.
    ℜ and PFThrough Gates OR Gate For 2 Inputs AND Gate Either of two, independent, element Both of two, independent elements must fail to failures produces system failure. produce system failure. ℜT = ℜ A ℜB ℜT = ℜA + ℜ B – ℜA ℜ B R + PF ≡ 1 PF = 1 – ℜT PF = 1 – ℜT PF = 1 (ℜA ℜB) PF = 1 – (ℜ A + ℜ B – ℜA ℜ B) PF = 1 – [(1 – PA)(1 – PB)] PF = 1 – [(1 – PA) + (1 – PB) – (1 – PA)(1 – PB)] PF = PA + PB – PA PB [Union / ∪] PF = PA PB [Intersection / ∩] …for PA,B ≤ 0.2 “Rare Event PF ≅ PA + PB Approximation” with error ≤ 11% For 3 Inputs PF = PA + PB + PC PF = PA PB PC – PA PB – PA PC – PB PC Omit for + PA PBPC approximation 29 8671
  • 30.
    PF Propagation ThroughGates AND Gate… OR Gate… TOP TOP PT = Π Pe PT = P1 P2 PT ≅ Σ Pe PT ≅ P1+ P2 [Intersection / ∩] [Union / ∪] 1 2 1 2 P1 P2 P1 P2 1&2 are INDEPENDENT events. PT = P1 P2 PT = P1 + P2 – P1 P2 Usually negligible 30 8671
  • 31.
    “Ipping” Gives ExactOR Gate Solutions Failure TOP Success TOP Failure TOP PT =Π (1 – Pe) Π PT = ? PT = Pe 1 2 3 1 2 3 1 2 3 P1 P2 P3 P1 P2 P3 P1 = (1 – P1) P3 = (1 – P3) The ip operator ( ) is the P2 = (1 – P2) Π co-function of pi (Π). It PT = Pe= 1 – Π (1 – Pe) Π provides an exact solution for propagating probabilities through the PT = 1 – [(1 – P1) ( 1 – P2) (1 – P3 … (1 – Pn )] OR gate. Its use is rarely justifiable. 31 8671
  • 32.
    More Gates andSymbols Inclusive OR Gate… PT = P1 + P2 – (P1 x P2) Opens when any one or more events occur. Exclusive OR Gate… PT = P1 + P2 – 2 (P1 x P2) Opens when any one (but only one) event occurs. Mutually Exclusive OR Gate… PT = P1 + P2 Opens when any one of two or more M events occur. All other events are then precluded. For all OR Gate cases, the Rare Event Approxi- 32 8671 mation may be used for small values of Pe. PT ≅ Σ Pe
  • 33.
    Still More Gatesand Symbols Priority AND Gate PT = P1 x P2 Opens when input events occur in predetermined sequence. Inhibit Gate External Event Opens when (single) input An event normally event occurs in presence expected to occur. of enabling condition. Conditioning Event Undeveloped Event Applies conditions or An event not further restrictions to other developed. symbols. 33 8671
  • 34.
    Some Failure ProbabilitySources Manufacturer’s Data Industry Consensus Standards MIL Standards Historical Evidence – Same or Similar Systems Simulation/testing Delphi Estimates ERDA Log Average Method 34 8671
  • 35.
    Log Average Method* If probability is not estimated easily, but upper and lower credible bounds can be judged… • Estimate upper and lower credible bounds of probability for the phenomenon in question. • Average the logarithms of the upper and lower bounds. • The antilogarithm of the average of the logarithms of the upper and lower bounds is less than the upper bound and greater than the lower bound by the same factor. Thus, it is geometrically midway between the limits of estimation. 0.01 0.0 2 0.03 0.04 0.05 0.07 0.1 0.0316+ PL PU Lower Log PL + Log PU Upper Probability Log Average = Antilog = Antilog (–2) + (–1) = 10–1.5 = 0.0316228 Probability 2 2 Bound 10–1 Bound 10–2 Note that, for the example shown, the arithmetic average would be… 0.01 + 0.1 = 0.055 2 i.e., 5.5 times the lower bound and 0.55 times the upper bound * Reference: Briscoe, Glen J.; “Risk Management Guide;” System Safety Development Center; SSDC-11; DOE 76-45/11; September 1982. 35 8671
  • 36.
    More Failure ProbabilitySources WASH-1400 (NUREG-75/014); “Reactor Safety Study – An Assessment of Accident Risks in US Commercial Nuclear Power Plants;” 1975 IEEE Standard 500 Government-Industry Data Exchange Program (GIDEP) Rome Air Development Center Tables NUREG-0492; “Fault Tree Handbook;” (Table XI-1); 1986 Many others, including numerous industry-specific proprietary listings 36 8671
  • 37.
    Typical Component FailureRates Failures Per 106 Hours Device Minimum Average Maximum Semiconductor Diodes 0.10 1.0 10.0 Transistors 0.10 3.0 12.0 Microwave Diodes 3.0 10.0 22.0 MIL-R-11 Resistors 0.0035 0.0048 0.016 MIL-R-22097 Resistors 29.0 41.0 80.0 Rotary Electrical Motors 0.60 5.0 500.0 Connectors 0.01 0.10 10.0 Source: Willie Hammer, “Handbook of System and Product Safety,” Prentice Hall 37 8671
  • 38.
    Typical Human OperatorFailure Rates Activity Error Rate *Error of omission/item embedded in procedure 3 x 10–3 *Simple arithmetic error with self-checking 3 x 10–2 *Inspector error of operator oversight 10–1 *General rate/high stress/ dangerous activity 0.2-0.3 **Checkoff provision improperly used 0.1-0.09 (0.5 avg.) **Error of omission/10-item checkoff list 0.0001-0.005 (0.001 avg.) **Carry out plant policy/no check on operator 0.005-0.05 (0.01 avg.) **Select wrong control/group of identical, 0.001-0.01 (0.003 avg.) labeled, controls Sources: * WASH-1400 (NUREG-75/014); “Reactor Safety Study – An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants,” 1975 **NUREG/CR-1278; “Handbook of Human Reliability Analysis with Emphasis on 38 8671 Nuclear Power Plant Applications,” 1980
  • 39.
    Some Factors InfluencingHuman Operator Failure Probability Experience Stress Training Individual self discipline/conscientiousness Fatigue Perception of error consequences (…to self/others) Use of guides and checklists Realization of failure on prior attempt Character of Task – Complexity/Repetitiveness 39 8671
  • 40.
    Artificial Wakeup Fails Artificial Wakeup Fails KEY: Faults/Operation………...8. X 10–3 3.34 x 10–4 Rate, Faults/Year………. 2/1 approx. 0.1 / yr Alarm Assume 260 operations/year Clocks Fail Nocturnal Deafness 3.34 x 10–4 Negligible Main Backup Plug-in (Windup) Clock Fails Clock Fails 1.82 x 10–2 1.83 x 10–2 Faulty Faulty Forget Forget Power Innards Forget to Mech- to to Outage Set anism Set Wind 1. x 10–2 3. x 10–4 8. x 10–3 4. x 10–4 8. x 10–3 1. x 10–2 3/1 2/1 1/10 2/1 3/1 Electrical Mechanical Fault Fault 3. x 10–4 8. x 10–8 1/15 Hour Hour Hand Hand Falls Jams Off 4. x 10–4 Works 2. x 10–4 40 1/10 1/20 8671
  • 41.
    HOW Much PTis TOO Much? Consider “bootstrapping” comparisons with known risks… Human operator error (response to repetitive stimulus) ≅10–2- 10–3/exp MH† Internal combustion engine failure (spark ignition) ≅10–3/exp hr† Pneumatic instrument recorder failure ≅10–4/exp hr† Distribution transformer failure ≅10–5/exp hr† U.S. Motor vehicles fatalities ≅10–6/exp MH† Death by disease (U.S. lifetime avg.) ≅10–6/exp MH U.S. Employment fatalities ≅10–7-10–8/exp MH† Death by lightning ≅10–9/exp MH* Meteorite (>1 lb) hit on 103x 103 ft area of U.S. ≅10–10/exp hr‡ Earth destroyed by extraterrestrial hit ≅10–14/exp hr† † Browning, R.L., “The Loss Rate Concept in Safety Engineering” * National Safety Council, “Accident Facts” ‡ Kopecek, J.T., “Analytical Methods Applicable to Risk Assessment & Prevention,” Tenth International System Safety Conference 41 8671
  • 42.
    Apply Scoping What power outages are of concern? Power Outage Not all of them! Only those that… 1 X 10–2 3/1 • Are undetected/uncompensated • Occur during the hours of sleep • Have sufficient duration to fault the system This probability must reflect these conditions! 42 8671
  • 43.
    Single-Point Failure “A failure of one independent element of a system which causes an immediate hazard to occur and/or causes the whole system to fail.” Professional Safety – March 1980 43 8671
  • 44.
    Some AND GateProperties Cost: TOP Assume two identical elements having P = 0.1. PT = 0.01 PT = P1 x P2 Two elements having P = 0.1 may cost much less than one element having P = 0.01. 1 2 Freedom from single point failure: Redundancy ensures that either 1 or 2 may fail without inducing TOP. 44 8671
  • 45.
    Failures at AnyAnalysis Level Must Be • Independent of each other Don’t • True contributors to the level above Do Mechanical Faulty Fault Innards Independent Hand Hand Hand Elect. Falls/ Gearing Other Falls Off Jams Mech. Works Fault Jams Fails Works Fault Alarm Alarm Failure Failure True Contributors Alarm Toast Backup Alarm Backup Clock Burns Clock Clock Clock Fails Fails Fails Fails 45 8671
  • 46.
    Common Cause Events/Phenomena “A Common Cause is an event or a phenomenon which, if it occurs, will induce the occurrence of two or more fault tree elements.” Oversight of Common Causes is a frequently found fault tree flaw! 46 8671
  • 47.
    Common Cause Oversight– An Example Unannunciated Intrusion by Burglar Microwave Electro- Seismic Acoustic Optical Footfall DETECTOR/ALARM FAILURES Four, wholly independent alarm systems are provided to detect and annunciate intrusion. No two of them share a common operating principle. Redundancy appears to be absolute. The AND gate to the TOP event seems appropriate. But, suppose the four systems share a single source of operating power, and 47 that source fails, and there are no backup sources? 8671
  • 48.
    Common Cause OversightCorrection Unannunciated Intrusion by Burglar Detector/Alarm Detector/Alarm Failure Power Failure Microwave Basic Power Failure Electro-Optical Emergency Power Failure Seismic Footfall Acoustic Here, power source failure has been recognized as an event which, if it occurs, will disable all four alarm systems. Power failure has been accounted for as a common cause event, leading to the TOP event through an OR gate. OTHER COMMON CAUSES SHOULD ALSO BE SEARCHED FOR. 48 8671
  • 49.
    Example Common Cause Fault/Failure Sources Utility Outage Dust/Grit – Electricity Temperature Effects – Cooling Water (Freezing/Overheat) – Pneumatic Pressure Electromagnetic – Steam Disturbance Moisture Single Operator Oversight Corrosion Many Others Seismic Disturbance 49 8671
  • 50.
    Example Common Cause Suppression Methods Separation/Isolation/Insulation/Sealing/ Shielding of System Elements. Using redundant elements having differing operating principles. Separately powering/servicing/maintaining redundant elements. Using independent operators/inspectors. 50 8671
  • 51.
    Missing Elements? Unannunciated Contributing elements Intrusion by SYSTEM must combine to Burglar CHALLENGE satisfy all conditions essential to the TOP event. The logic Detector/Alarm Intrusion By criteria of necessity Failure Burglar and sufficiency must be satisfied. Detector/Alarm Detector/Alarm System Failure Power Failure Burglar Barriers Present Fail Microwave Basic Power Failure Electro-Optical Seismic Footfall Emergency Power Failure Acoustic 51 8671
  • 52.
    Example Problem –Sclerotic Scurvy – The Astronaut’s Scourge BACKGROUND: Sclerotic scurvy infects 10% of all returning astronauts. Incubation period is 13 days. For a week thereafter, victims of the disease display symptoms which include malaise, lassitude, and a very crabby outlook. A test can be used during the incubation period to determine whether an astronaut has been infected. Anti-toxin administered during the incubation period is 100% effective in preventing the disease when administered to an infected astronaut. However, for an uninfected astronaut, it produces disorientation, confusion, and intensifies all undesirable personality traits for about seven days. The test for infection produces a false positive result in 2% of all uninfected astronauts and a false negative result in one percent of all infected astronauts. Both treatment of an uninfected astronaut and failure to treat an infected astronaut constitute in malpractice. Problem: Using the test for infection and the anti-toxin, if the test indicates need for it, what is the probability that a returning astronaut will be a victim of malpractice? 52 8671
  • 53.
    Sclerotic Scurvy Malpractice What is the greatest Malpractice contributor to this probability? 0.019 Should the test be Fail to Treat Treat used? Infection Needlessly (Disease) (Side Effects) 0.001 0.018 False Infected False Negative Healthy Positive Astronaut Astronaut Test Test 0.01 0.1 0.9 0.02 10% of returnees are infected – 90% are not infected 1% of infected cases test falsely negative, 2% of uninfected cases test falsely positive, receive no treatment, succumb to disease receive treatment, succumb to side effects 53 8671
  • 54.
    Cut Sets AIDS TO… System Diagnosis Reducing Vulnerability Linking to Success Domain 54 8671
  • 55.
    Cut Sets A CUT SET is any group of fault tree initiators which, if all occur, will cause the TOP event to occur. A MINIMAL CUT SET is a least group of fault tree initiators which, if all occur, will cause the TOP event to occur. 55 8671
  • 56.
    Finding Cut Sets 1. Ignore all tree elements except the initiators (“leaves/basics”). 2. Starting immediately below the TOP event, assign a unique letter to each gate, and assign a unique number to each initiator. 3. Proceeding stepwise from TOP event downward, construct a matrix using the letters and numbers. The letter representing the TOP event gate becomes the initial matrix entry. As the construction progresses: Replace the letter for each AND gate by the letter(s)/number(s) for all gates/initiators which are its inputs. Display these horizontally, in matrix rows. Replace the letter for each OR gate by the letter(s)/number(s) for all gates/initiators which are its inputs. Display these vertically, in matrix columns. Each newly formed OR gate replacement row must also contain all other entries found in the original parent row. 56 8671
  • 57.
    Finding Cut Sets 4. A final matrix results, displaying only numbers representing initiators. Each row of this matrix is a Boolean Indicated Cut Set. By inspection, eliminate any row that contains all elements found in a lesser row. Also eliminate redundant elements within rows and rows that duplicate other rows. The rows that remain are Minimal Cut Sets. 57 8671
  • 58.
    A Cut SetExample PROCEDURE: TOP – Assign letters to gates. (TOP A gate is “A.”) Do not repeat letters. – Assign numbers to basic initiators. If a basic initiator B D appears more than once, represent it by the same 1 2 4 number at each appearance. C – Construct a matrix, starting with the TOP “A” gate. 2 3 58 8671
  • 59.
    A Cut SetExample A B D 1 D 1 D C D 2 D 3 TOP event A is an AND B is an OR gate; 1 C is an AND gate is A, the gate; B & D, its & C, its inputs, gate; 2 & 3, its initial matrix inputs, replace it replace it vertically. inputs, replace it entry. horizontally. Each requires a new horizontally. row. These Boolean- 1 2 1 2 1 2 2 D 3 2 2 3 Indicated Cut Sets… 2 3 Minimal Cut Set 1 4 1 4 1 4 rows are least 2 4 3 D (top row), is an …reduce to these groups of OR gate; 2 & 4, its D (second minimal cut sets. inputs, replace it row), is an OR initiators which vertically. Each gate. Replace will induce TOP. requires a new as before. row. 59 8671
  • 60.
    An “Equivalent” FaultTree Boolean TOP Equivalent An Equivalent Fault Tree can be constructed Fault Tree from Minimal Cut Sets. For example, these Minimal Cut Sets… 1 2 1 2 1 4 2 3 2 3 1 4 …represent this Fault Tree… …and this Fault Tree is a Logic Equivalent of the original, for which the Minimal Cut Sets were derived. 60 8671
  • 61.
    Equivalent Trees Aren’t Always Simpler 4 gates 6 initiators This Fault Tree has this logic equivalent. 9 gates 1 2 3 4 5 6 24 TOP initiators Minimal cut sets 1/3/5 1 3 5 1 3 6 1 4 5 1 4 6 1/3/6 1/4/5 1/4/6 2/3/5 2 3 5 2 3 6 2 4 5 2 4 6 2/3/6 2/4/5 2/4/6 61 8671
  • 62.
    Another Cut SetExample TOP Compare this case to the first Cut Set A example – note differences. TOP B C gate here is OR. 1 6 In the first F D example, TOP gate was AND. 2 3 5 G Proceed as with E first example. 3 4 4 1 62 8671
  • 63.
    Another Cut SetExample Construct Matrix – make step-by-step substitutions… A B 1 D 1 2 1 2 C F 6 F D 3 5 G 6 I E 1 E Boolean-Indicated Cut Sets Minimal Cut Sets 1 2 1 2 1 2 Note that there are 3 5 G 6 3 5 G 6 1 3 four Minimal Cut 1 3 1 3 1 4 Sets. Co-existence of 1 4 1 4 3 4 5 6 3 5 1 6 all of the initiators in any one of them will precipitate the TOP event. An EQUIVALENT FAULT TREE can again be constructed… 63 8671
  • 64.
    Another “Equivalent” FaultTree These Minimal Cut Sets… 1 2 represent this Fault Tree 1 3 – a Logic Equivalent of the 1 4 original tree. 3 4 5 6 TOP 1 2 1 3 1 4 3 4 5 6 64 8671
  • 65.
    From Tree toReliability Block Diagram Blocks represent functions of system elements. TOP Paths through them represent success. A “Barring” terms (n) denotes consideration of their success properties. 3 B 2 3 4 C 5 1 1 6 4 1 F D 6 2 3 5 TOP The tree models a system fault, in failure G E domain. Let that fault be System Fails to Function as Intended. Its opposite, System Succeeds to 3 4 4 1 function as intended, can be represented by a Reliability Block Diagram in which success flows through system element functions from left to right. Any path through the block diagram, not interrupted by a fault of an element, results in system success. 65 8671
  • 66.
    Cut Sets andReliability Blocks TOP A 3 2 3 4 B C 5 1 4 1 1 6 F 6 D 3 5 Note that 2 3/5/1/6 is a Cut G 1 2 E Set, but not a 1 3 Minimal Cut Set. 3 4 4 1 (It contains 1/3, 1 4 a true Minimal 3 4 5 6 Cut Set.) Each Cut Set (horizontal rows in the matrix) interrupts all left-to-right paths Minimal Cut Sets 66 8671 through the Reliability Block Diagram
  • 67.
    Cut Set Uses Evaluating PT Finding Vulnerability to Common Causes Analyzing Common Cause Probability Evaluating Structural Cut Set “Importance” Evaluating Quantitative Cut Set “Importance” Evaluating Item “Importance” 67 8671
  • 68.
    Cut Set Uses/EvaluatingPT Minimal Cut Sets TOP 1 2 PT A 1 3 1 4 B C 3 4 5 6 1 6 F Pt ≅ Σ P k = D P 1 x P2 + 3 5 P1 x P3 + 2 G P1 x P4 + E P3 x P4 x P5 x P6 3 4 4 1 Note that propagating 1 2 probabilities through an 3 5 4 6 Cut Set Probability (Pk), the product of “unpruned” tree, i .e., 1 3 probabilities for events within the Cut Set, using Boolean-Indicated 1 4 is the probability that the Cut Set being Cut Sets rather than 3 5 1 6 considered will induce TOP. minimal Cut Sets, would 68 produce a falsely high PT. 8671 Pk = Π Pe = P1 x P2 x P3 x…Pn
  • 69.
    Cut Set Uses/Common Cause Vulnerability Uniquely subscript initiators, using letter indicators TOP of common cause susceptibility, e.g…. A l = location (code where) m = moisture h = human operator Minimal Cut Sets B C q = heat 1 v 2h f = cold 1v 6m v = vibration 1v 3 m F …etc. D 1v 4 m 2h 3m 5m 3m 4m 5m 6m G E 3m 4m All Initiators in this Cut Set are 4m 1v vulnerable to moisture. Some Initiators may be vulnerable to several Moisture is a Common Cause Common Causes and receive several corresponding and can induce TOP. subscript designators. Some may have no Common ADVICE: Moisture proof one or 69 Cause vulnerability – receive no subscripts. more items. 8671
  • 70.
    Analyzing Common Cause Probability TOP PT System Common-Cause Fault These Induced Fault must be OR Analyze as …others usual… Moisture Human Heat Vibration Operator Introduce each Common Cause identified as a “Cut Set Killer” at its individual probability level of both (1) occurring, and (2) inducing all terms within the 70 affected cut set. 8671
  • 71.
    Cut Set Structural“Importance” Minimal Cut Sets TOP 1 2 A 1 3 1 4 B C 3 4 5 6 1 6 F D All other things being equal… • A LONG Cut Set signals low 2 3 5 vulnerability G • A SHORT Cut Set signals higher E vulnerability 3 4 4 1 • Presence of NUMEROUS Cut Sets signals high vulnerability …and a singlet cut set signals a Potential Single-Point Failure. Analyzing Structural Importance enables qualitative ranking of contributions to System Failure. 71 8671
  • 72.
    Cut Set Quantitative“Importance” TOP The quantitative importance of a Cut Set (Ik) is the numerical probability that, PT A given that TOP has occurred, that Cut Set has induced it. Pk Ik = B C PT …where Pk = Π Pe = P3 x P4 x P5 x P6 1 6 D F Minimal Cut Sets 1 2 2 3 5 G 1 3 E 1 4 3 4 4 1 3 4 5 6 Analyzing Quantitative Importance enables numerical ranking of contributions to System Failure. To reduce system vulnerability most effectively, attack Cut Sets having greater Importance. Generally, short Cut Sets have greater Importance, long Cut Sets have lesser Importance. 72 8671
  • 73.
    Item ‘Importance” The quantitative Importance of an item (Ie) is the numerical probability that, given that TOP has occurred, that item has contributed to it. Ne = Number of Minimal Cut Sets Ne containing Item e Ie ≅ Σ Ike Minimal Cut Sets Ike = Importance of the Minimal Cuts Sets containing Item e 1 2 1 3 Example – Importance of item 1… 1 4 3 4 5 6 (P1 x P2) + (P1 x P3) + (P1 x P4) I1 ≅ PT 73 8671
  • 74.
    Path Sets Aids to… Further Diagnostic Measures Linking to Success Domain Trade/Cost Studies 74 8671
  • 75.
    Path Sets A PATH SET is a group of fault tree initiators which, if none of them occurs, will guarantee that the TOP event cannot occur. TO FIND PATH SETS* change all AND gates to OR gates and all OR gates to AND. Then proceed using matrix construction as for Cut Sets. Path Sets will be the result. *This Cut Set-to-Path-Set conversion takes advantage of de Morgan’s duality theorem. Path Sets are complements of Cut Sets. 75 8671
  • 76.
    A Path SetExample TOP Path Sets are least A groups of initiators which, if they cannot B C occur, guarantee 1 6 against TOP This Fault Tree has D F occurring these Minimal Cut sets 3 5 1 3 2 E G 1 4 1 2 1 5 3 4 4 1 1 3 1 6 1 4 …and these Path Sets 2 3 4 “Barring” terms (n) denotes 3 4 5 6 consideration of their success properties 76 8671
  • 77.
    Path Sets andReliability Blocks TOP A 3 2 3 4 B C 5 1 4 1 1 6 F 6 D 3 5 2 Each Path Set E G 1 3 (horizontal rows in 1 4 the matrix) 3 4 4 1 1 5 represents a left-to- 1 6 right path through the Reliability Block 2 3 4 Path Sets Diagram. 77 8671
  • 78.
    Pat Sets andTrade Studies 3 Path Set Probability (Pp) is 2 3 4 Pp ≅ Σ Pe the probability that the 5 system will suffer a fault at 1 4 1 one or more points along the 6 operational route modeled by the path. To minimize Path Sets failure probability, minimize Pp $ path set probability. a 1 3 PPa $a Sprinkle countermeasure resources amongst b 1 4 PPb $b the Path Sets. Compute the probability $c decrement for each newly adjusted Path Set c 1 5 PPc option. Pick the countermeasure d 1 6 PPd $d ensemble(s) giving the most favorable e 2 3 4 PPe $e ∆ Pp / ∆ $. (Selection results can be verified by computing ∆ PT/ ∆ $ for competing 78 candidates.) 8671
  • 79.
    Reducing Vulnerability –A Summary Inspect tree – find/operate on major PT contributors… – Add interveners/redundancy (lengthen cut sets). – Derate components (increase robustness/reduce Pe). – Fortify maintenance/parts replacement (increase MTBF). Examine/alter system architecture – increase path set/cut set ratio. Evaluate Cut Set Importance. Rank items using Ik.} Ik= Pk/ PT Identify items amenable to improvement. N e Evaluate item importance. Rank items using Ie’ Ie ≅ Σ Ike Identify items amenable to improvement. } Evaluate path set probability. } Reduce PP at most favorable ∆P/∆ $. Pp ≅ Σ Pe For all new countermeasures, THINK… • COST • EFFECTIVENESS • FEASIBILITY (incl. schedule) AND Does the new countermeasure… • Introduce new HAZARDS? • Cripple the system? 79 8671
  • 80.
    Some Diagnostic and Analytical Gimmicks A Conceptual Probabilistic Model Sensitivity Testing Finding a PT Upper Limit Limit of Resolution – Shutting off Tree Growth State-of-Component Method When to Use Another Technique – FMECA 80 8671
  • 81.
    Some Diagnostic Gimmicks Using a “generic” all-purpose fault tree… TOP PT 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 81 8671
  • 82.
    Think “Roulette Wheels” TOP A convenient, thought-tool model of PT probabilistic tree modeling… 1 2 3 4 5 6 7 Imagine a roulette wheel representing 8 9 each initiator. The “peg count” ratio for each wheel is determined by 10 11 12 13 14 probability for that initiator. Spin all 15 initiator wheels once for each system 16 17 exposure interval. Wheels “winning” in 18 19 20 21 gate-opening combinations provide a path to the TOP. 26 27 28 29 22 23 24 25 P22 = 3 x 10–3 1,000 peg spaces 30 31 32 33 34 997 white 3 red 82 8671
  • 83.
    Use Sensitivity Tests TOP Gaging the “nastiness” of PT untrustworthy initiators… 1 2 3 4 5 Embedded within the tree, there’s a bothersome initiator with 6 7 8 9 an uncertain Pe. Perform a crude sensitivity test to obtain quick relief from worry… or, to justify the urgency of need for more exact input data: 10 11 12 13 14 15 1.Compute PT for a nominal value of Pe. Then, recompute PT P10 = ? for a new Pe = Pe + ∆ Pe. ´ 20 21 ∆ PT 16 17 18 19 ´ now, compute the “Sensitivity” of Pe = ∆ Pe If this sensitivity exceeds ≈ 0.1 in a large tree, work to ~27 26 ~ 28 29 22 23 24 25 Find a value for Pe having less uncertainty…or… 2.Compute PT for a value of Pe at its upper credible limit. Is the corresponding PT acceptable? If not, get a better Pe. 30 31 32 33 34 83 8671
  • 84.
    Find a MaxPT Limit Quickly The “parts-count” approach gives a sometimes-useful early estimate of PT… TOP PT 1 2 3 4 5 6 7 PT cannot exceed an8 upper bound given by: 9 PT(max) = Σ Pe = P1 + P2 + P3 + …Pn 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 84 8671
  • 85.
    How Far DownShould a Fault Tree Grow? TOP Severity Probability PT Where do you stop the analysis? The analysis is a Risk Management enterprise. The TOP statement gives severity. The tree analysis provides probability. ANALYZE 1 2 3 4 5 NO FURTHER DOWN THAN IS NECESSARY TO ENTER PROBABILITY DATA WITH CONFIDENCE. Is risk acceptable? If YES, stop. If NO, use the tree to guide risk reduction. SOME EXCEPTIONS… 8 6 7 9 1.) An event within the tree has alarmingly high probability. Dig deeper beneath it to find the source(s) of the high probability. 2.) Mishap autopsies must sometimes analyze down to the cotter-pin level to 10 11 12 13 14 15 produce a “credible cause” list. 16 17 18 19 20 21 ? Initiators / leaves / basics define the LIMIT OF RESOLUTION of the analysis. ? 85 8671
  • 86.
    State-of-Component Method WHEN – Analysis has proceeded to the device level – i.e., valves, Relay K-28 Contacts Fail pumps, switches, relays, etc. Closed HOW – Show device fault/failure in the mode needed for upward propagation. Relay Install an OR gate. Basic K-28 Failure/ Command Relay Place these three events beneath K-28 Secondary the OR. Relay Fault Fault K-28 This represents faults from environmental and service This represents internal Analyze further to find the stresses for which the device is “self” failures under normal source of the fault not qualified – e.g., component environmental and service condition, induced by struck by foreign object, wrong stresses – e.g., coil presence/absence of component burnout, spring failure, external command selection/installation. (Omit, if contacts drop off… “signals.” (Omit for most negligible.) passive devices – e.g., 86 8671 piping.)
  • 87.
    The Fault TreeAnalysis Report Executive Summary (Abstract of complete report) Scope of the analysis… Say what is analyzed Title Brief system description and TOP Description/Severity Bounding what is not analyzed. Company Analysis Boundaries Author Physical Boundaries Interfaces Treated Date Operational Boundaries Resolution Limit etc. Operational Phases Exposure Interval Human Operator In/out Others… The Analysis Show Tree as Figure. Discussion of Method (Cite Refs.) Software Used Include Data Sources, Presentation/Discussion of the Tree Cut Sets, Path Sets, etc. Source(s) of Probability Data (If quantified) as Tables. Common Cause Search (If done) Sensitivity Test(s) (If conducted) Cut Sets (Structural and/or Quantitative Importance, if analyzed) Path Sets (If analyzed) Trade Studies (If Done) Findings… TOP Probability (Give Confidence Limits) Comments on System Vulnerability Chief Contributors Candidate Reduction Approaches (If appropriate) Conclusions and Recommendations… Risk Comparisons (“Bootstrapping” data, if appropriate) 87 8671 Is further analysis needed? By what method(s)?
  • 88.
    FTA vs. FMECASelection Criteria* Preferred Selection Characteristic FTA FMECA Safety of public/operating/maintenance personnel √ Small number/clearly defined TOP events √ Indistinctly defined TOP events √ Full-Mission completion critically important √ Many, potentially successful missions possible √ “All possible” failure modes are of concern √ High potential for “human error” contributions √ High potential for “software error” contributions √ Numerical “risk evaluation” needed √ Very complex system architecture/many functional parts √ Linear system architecture with little/human software influence √ System irreparable after mission starts √ *Adapted from “Fault Tree Analysis Application Guide,” Reliability Analysis Center, Rome Air Development Center. 88 8671
  • 89.
    Fault Tree Constraints and Shortcomings Undesirable events must be foreseen and are only analyzed singly. All significant contributors to fault/failure must be anticipated. Each fault/failure initiator must be constrained to two conditional modes when modeled in the tree. Initiators at a given analysis level beneath a common gate must be independent of each other. Events/conditions at any analysis level must be true, immediate contributors to next-level events/conditions. Each Initiator’s failure rate must be a predictable constant. 89 8671
  • 90.
    Common Fault TreeAbuses Over-analysis – “Fault Kudzu” Unjustified confidence in numerical results – 6.0232 x 10–5…+/–? Credence in preposterously low probabilities – 1.666 x 10–24/hour Unpreparedness to deal with results (particularly quantitative) – Is 4.3 x 10–7/hour acceptable for a catastrophe? Overlooking common causes – Will a roof leak or a shaking floor wipe you out? Misapplication – Would Event Tree Analysis (or another technique) serve better? Scoping changes in mid-tree 90 8671
  • 91.
    Fault Tree Payoffs Gaging/quantifying system failure probability. Assessing system Common Cause vulnerability. Optimizing resource deployment to control vulnerability. Guiding system reconfiguration to reduce vulnerability. Identifying Man Paths to disaster. Identifying potential single point failures. Supporting trade studies with differential analyses. FAULT TREE ANALYSIS is a risk assessment enterprise. Risk Severity is defined by the TOP event. Risk Probability is the result of the tree analysis. 91 8671
  • 92.
    Closing Caveats Be wary of the ILLUSION of SAFETY. Low probability does not mean that a mishap won’t happen! THERE IS NO ABSOLUTE SAFETY! An enterprise is safe only to the degree that its risks are tolerable! Apply broad confidence limits to probabilities representing human performance! A large number of systems having low probabilities of failure means that A MISHAP WILL HAPPEN – somewhere among them! P1 + P2+ P3+ P4 + ----------Pn ≈ 1 More… 92 8671
  • 93.
    Caveats Do you REALLYhave enough data to justify QUANTITATIVE ANALYSIS? For 95% confidence… We must have no failures in to give PF ≅… and ℜ ≅ … Assumptions: 1,000 tests 3 x 10–3 0.997 I Stochastic System Behavior 300 tests 10–2 0.99 I ConstantSystem Properties 100 tests 3 x 10–2 0.97 I Constant Service Stresses 30 tests 10–1 0.9 I Constant Environmental Stresses 10 tests 3 x 10–1 0.7 Don’t drive the numbers into the ground! 93 8671
  • 94.
    Analyze Only toTurn Results Into Decisions “Perform an analysis only to reach a decision. Do not perform an analysis if that decision can be reached without it. It is not effective to do so. It is a waste of resources.” Dr. V.L. Grose George Washington University 94 8671