- Email: [email protected]
A general method dealing with correlations in uncertainty propagation in fault trees
Reliability Engineering and System Safety 26 (1989) 231-247
A General Method Dealing with Correlations in Uncertainty Propagation in Fault Trees
Qin Zhang* Institute of Nuclear Energy Technology, Tsinghua University, Beijing, People's Republic of China
(Received 24 October 1988; accepted 1 February 1989)
ABSTRACT This paper deals with the correlations among the failure probabilities (frequencies) of not only the identical basic events but also other basic events in a fault tree. It presents a general and simple method to include these correlations in uncertainty propagation. Two examples illustrate this method and show that neglecting these correlations results in large underestimation of the top event failure probability (frequency).
NOTATION BE-/
CCF CUS
g(X) k
basic event i, i = 1. . . . , k c o m m o n cause failure c o m m o n uncertainty source probability density function o f Xi, X u relation between X and .~, i.e. X = gO~) number o f input variables
* This work was carried out whilst the author was at JBF Associates, Inc., Knoxville, Tennessee. The author is a visiting scholar at Mechanical, Aerospace and Nuclear Engineering Department, University of California, Los Angeles. Correspondence address until October 1989:5532 Boelter Hall, UCLA, Los Angeles, California 90024-1597, USA. 231 Reliability Engineering and System Safety 0951-8320/89/$03"50 © 1989 Elsevier Science Publishers Ltd, England. Printed in Great Britain
232 mi tl qi
X
X.j
Y Y. ],2i, (7i, ]lij, (Tij
Qin Zhang
exp {/~i}, mediam value of X i number of CUS E { X i } , expected value of Xi exp { 1"645ai}, Range Factor of X~ (see Ref. 4) Range Factor of Xi~ output variable, i.e. Pr{top event}: top event probability or frequency input variable i, i.e. Pr{BE-i}: probability or frequency of basic event i a log normally distributed random variable relative to only B E - / a n d uncertainty source j, j = 0, 1..... n; when j = 0, j indicates the s-independent uncertainty source of BE-i; w h e n . / # 0, j is the index of CUS any one of X~j, X2j . . . . . Xkj, chosen as a reference ( x l . . . . . xk) (X. 1,..., X.,) (Xo.1 . . . . . Xo.k) distribution parameters of X i, Xij, such that fi(Xi) = ( x / 2 ~ o i X i ) - t exp { -(In X i -/~i)2/2o-2 } .[ij(Xij ) = ( x ~ a i j X i j ) -
~.j, O'.j Pit
I exp { - ( l n Xij - #ij)2/2a~}
distribution parameters of X.j a 2ij// a i2 , correlation fraction coefficient reflecting the effect of uncertainty source j on X~ (see Section 2) 1 INTRODUCTION
The uncertainty of basic event data is one of the important uncertainty sources for fault tree analysis. To estimate the effect of this uncertainty, analysts have developed several methods 1 -5 by which the upper or lower bound of the top event probability (frequency) can be calculated with certain s(statistically)-confidence, given that the probability density distributions of basic event data are known. All these methods have the same assumption: the uncertainty distributions of basic event data are s-independent. But in practice, it is usually not true. References 6 and 7 pointed out that there is correlation or coupling among the data of identical basic events such as the failures of two identical pumps, three identical valves, etc. This correlation means that the data of the identical basic events are entirely correlated and should be treated as a single random variable rather than s-independent random variables in the uncertainty analysis. However, correlations also exist among the data of not
Correlations in uncertainty propagation in fault trees
233
identical basic events, where the correlations are usually imperfect. The following examples illustrate this.
Example 1 As shown in Fig. 1, the Primary Pump (not identical to the Emergency Pump) pumps cooling water into the Chemical Reactor to remove the heat generated from the chemical reaction so that it is in a safe state. If there is no cooling water, the reactor will explode due to the cumulative heat (top event). Assume that the following two failure modes are the only failure modes of this system: mode 1: mode 2:
The Primary Pump fails (BE-l) and the Valve fails to open on demand (BE-2); The Primary P u m p fails (BE-l) and the Emergency P u m p fails to work on demand (BE-3).
Thus we have approximately Pr{top event} = Pr{BE-1}Pr{BE-2} + Pr{BE-1}Pr{BE-3} or X = X 1 X 2 -at-
XiX 3 = XI(X 2 --]-X3)
(1)
where X = Pr{top event} and Xi = Pr{BE-i}. X 1, X 2 and X 3 c a n be found from a reliability data handbook. However, these data may not be appropriate because the working condition here may not be the same as considered in the data handbook. For example, there may be some acidic material in the cooling water so that the valve and pumps fail easier. Thus X~, X 2 and "~3 will be greater than those given in handbooks. On the other hand, if better maintenance is given to the valve and pumps, X~, X 2 and X 3 will be less than those in handbooks. It is noted that these uncertainty sources are c o m m o n to Xt, X 2 and X 3. Therefore, X1, )(2 and X 3 a r e not s-independent. Primary pump Cooling
water
t
To heat sink
C7'
Valve
C2
Chemical reactor
Emergency pump
Fig. I. Chemical reactor cooling system.
Qin Zhang
234
Example 2 Consider the truck transportation of a container used to contain toxic materials. If the truck accident causes a rupture of the container, the toxic material will be released. According to Ref. 8, the fault tree can be constructed as shown in Fig. 2, which gives approximately Pr{top event} =
X~(X2 +
X"3 31- X 4 "~- X 5 + X 6 ( X 7 --1--X 8 --I-X 9 -1- X l o ) )
(2)
F r o m Ref. 8, we can work out X1,..., Xs, XT,..., Xlo. However, for a specific road, the real values may be different from what we work out from Ref. 8. For example, the average speed of the truck on a specific road may be higher or lower than that on the public highway. Since the condition considered in Ref. 8 is the public highway, the data from Ref. 8 for X~ . . . . . Xs, XT,..., X~o m a y be lower or higher than the real values. Therefore the truck speed is a c o m m o n uncertainty source of X~,...,Xs, X7 ..... X~o. Moreover, we can find that the configuration of loading the container and the possible collision objects in the road are also c o m m o n uncertainty sources of X~ . . . . . X 5, Xv,...,X~o. Thus X~ . . . . . Xs, X7 . . . . . X~o are not sindependent. Another example of the c o m m o n uncertainty source of not identical basic event data is engineering judgments. It is frequently encountered in practice that people have to make engineering judgments to determine some basic event data because they are not available from any data source. Since all these engineering judgments are made by the same people or the same assumptions and considerations are taken into account for all these engineering judgments, these engineering judgments become a c o m m o n uncertainty source to all of such obtained data, and thus these data are not s-independent. It is noticed that the effects of a c o m m o n uncertainty source on different basic event data are usually not the same. Also, a basic event datum is usually affected by different uncertainty s o u r c e s - - c o m m o n uncertainty sources and its own s-independent uncertainty source. Thus the correlations are usually imperfect. The imperfect correlations are also found in other areas such as the structure reliability analysis. 9' 10 Reference 10 developed a method based on a transformation of multinormal variables. It is an analytical method. The traditional correlation coefficients are used. But since it requires the transformation of all correlation coefficients, which results in the iterative computations or the numerical integrations, it is difficult to be applied to practical systems while the empirical formulae developed in Ref. 11 appear able to help to solve this problem. Based on the rank correlation theory,'2 another method for inducing a
i
Toxic materials release from container in truck accidents
]
in truck accidents
©
I I break Impact forces container
, container not meeting design specification
©
l
I
C3
I
break container
break container
I container rupture
0
~2
Crush forces break ] container not meeting design specification
0
Puncture forces break container not meeting design specification
Fire causes rupture of container not meeting design specification
0
0
Legend BE-I: BE-2: BE-3: BE-4: BE-5:
Truck accident occurs. Impact forces break container meeting design specification. Crush forces break container meeting design specification. Puncture torces break container meeting design specification. Fire causes rupture of container meeting design specification. Fig. 2.
BE-6: Container does not meet design specification. BE-7: Impact forces break defective container. BE-8: Crush forces break defective container. BE-9: Puncture forces break defective container. BE-10: Fire causes rupture of defective container.
Fault tree of Example 2.
t~
236
Q&Zhang
desired rank correlation matrix on a multivariate input r a n d o m variable for use in a simulation study was presented in Ref. 13. By this method, the input r a n d o m variables (the basic event data) are sampled to get a N × K sample matrix as if they were s-independent, where N is the sample size and K is the number of input variables. Then, according to a somehow calculated rank correlation matrix, the sample matrix is arranged so that these samples become correlated. This arranged sample matrix is then used as samples of the Monte Carlo method to get the desired results. Since N is usually a few thousand, it is expected that the a m o u n t of work to arrange the sample matrix is quite large. Moreover, this method does not guarantee that the arranged sample matrix fairly reflects the real correlations among the input variables. Another method was presented in Ref. 14. In this method, the degree of the correlation between two r a n d o m variables (e.g. X~ and X 2) is measured by d, de[0,1]. That means: if X ~ = x , X 2 must be within [ x - l + d , x + 1 - d ] . This causes two technical problems: (1)
(2)
Usually a correlation between X 1 and X 2 does not mean that X 2 can only take a certain range of values, given that X 1 is determined. It only means that X2 is more likely to take some values than the others. In other words, X~[x - 1 + d, x + 1 - d] is still possible although it is less likely. So dis not a good measure for the correlation between two random variables. Suppose that there are three r a n d o m variables X1, X 2 and X3, dl indicates the correlation between X1 and X z, d 2 indicates the correlation between X 2 and X 3 and d3 indicates the correlation between X1 and X 3. According to this method, once d~ and d 2 a r e determined, d 3 is determined. But this may be incorrect. For example, it can be a real case that X 1 and X 3 are entirely correlated (d 3 = 1) and they are partially correlated to X2(d ~ =d2). According to this method, X1 determines a possible range of X 2, X 2 determines a possible range of X 3, then X 3 may not equal to X~. This conflicts with our assumption that X1 and X 3 are entirely correlated.
Considering the two technical problems, I do not think this method is good although it is quite simple. Due to the lack of the appropriate calculation method, Ref. 9 simply treated the imperfect correlations as perfect correlations. Of course, this treatment results in large overestimations. By analyzing the effect of each c o m m o n uncertainty source on each input variable, this paper presents a simple and general method to deal with these
Correlations in uncertainty propagation in fault trees
237
correlations. The main idea of this method is to modify the relation between the input variables and the output variable (the top event probability or frequency) by adding extra input random variables, so that the final input variables in the modified relation are s-independent. Then, by using any method such as those presented in Refs 1-5, one can get the desired results. Section 2 describes this method. Section 3 calculates the two examples above to illustrate this method. Section 4 discusses the difference between common uncertainty sources and common cause failures. Section 5 discusses how to find the correlation fraction coefficient used in this method. The basic assumptions in this paper are: (1) All input variables are lognormally distributed (2) The relation between the output variable and the input variables is known.
2 THE M E T H O D Based on assumption 1 in Section 1, I assume n
X i = m i~
Xij
(3)
1=0
where X~j is defined as a lognormally distributed random variable with ~lij = 0
(4)
n
(5) j=O
and Xio represents only the effect of Xis own s-independent uncertainty source on X i and Xij (j #0) represents only the effect o f j t h CUS on X~. Since each X~j has only one uncertainty source, X~o, Xil ..... X~. are s-independent of each other. If the CUS j has no effect on X~, a~j = 0 and Xij = E { X , j } = 1.
For any lognormally distributed random variable Y with parameters/~r and o-r, it is known that E{ Y} = exp {pr + o-~/2}
(6)
Qin Z h a n g
238
Thus we have
j=o
j=o
j=o
j=O
= E{Xi}
(7)
which is the expected result. Define the correlation fraction coefficient Pi~ as
Then Pit is the fraction of the effect of uncertainty sourcej on X~. Obviously,
2
Pij = 1
(9)
j=0
After knowing Pij, we can calculate o-i~ from <, = aix/-PT,
(10)
RFij = ----iRF"",,
( 11 )
or
Although Xio, Xil .... , Xi, and X~.o, XE. o . . . . . Xk.O are s-independent, X1j, Xz~ . . . . . Xkj are not s-independent because they share the same C U S j (j 4: 0). Select any one of XIj, X2i . . . . . X,j as a reference and denote it as X.j. Since X~j, Xzj . . . . . XRj have only one uncertainty source, I assume 1
_l(lnx~7
= f~'~
__1 exp { -- -1(ln x'J -- P'i~2~ dx.~ ,,/2n~.jx.j 2\ G.j / j
(12)
i.e. the shaded areas of(a) and (b) in Fig. 3 are equal. This is correct because Xij and X.j have and only have uncertainty sourcej. Therefore X;j and X.~ are entirely correlative. When X.~ takes a certain value, X o also takes a certain value, and the deviatoric extents and directions of Xij and X.j from their mean values are the same. From Eqn (12), let In xij 3'ij --
-
O'ij
~ij
Correlations in uncertainty propagation in fault trees
fij (xij)
239
b"f'J (x .j)
L_
X.j
Xij
Xq
X.j (b)
(a)
Fig. 3.
The relation between X u and X u (/-¢ 0).
and In x.j - ~u.j ~7.j
y.j= we have
f[
"
1
7=- exp {-y~/2} dy u =
f['J
1
~--- exp { -y.~/2} dy.j
,,/2~
,d2,~
where
Ytj
In
--
~ij
--
~ij
(Tij
Yq=
In X.j -- #.j O'.j
Obviously, Yij:
Y.j
Then
X u = .U.y% exp {/~u- P'fu/au}
(13)
Since Pu = P-J = O, we have
x,j xr.;;°'
(14)
=
Then from Eqn (3), we have
x, = m,X,oH ~;'/°'
(15)
j=l
Substituting Eqn (15) into g(X), we get
x= g*(2o, 2.)
(16)
Qin Zhang
240
In g*(Xo, X.), there are k + n lognormally distributed r a n d o m variables and all of them are s-independent of each other. Then by using any uncertainty propagation methods presented in Refs 1-5, one can calculate the uncertainty of the top event probability or frequency. It should be pointed out that the choice of the reference variable X.~ is arbitrary. Different choices will lead to the same result. This is because the two sides of Eqn (12) are identical. Moreover, it is easy to see that this m e t h o d may be expanded to other distributions of basic event data. For example, if all Xg~ are normally distributed, Eqns (3), (14) and (15) are changed to
Xi = qi + ~'~ Xij j=O
(3')
(14')
Xij = ai-~ X.~ O'.j tl
Xi = q~ + X~o + ~ ' a~ X.j L.a o-.j
(15')
j=l
and Eqns (4), (5), (8)-(11) and (16) remain the same.
3 EXAMPLES
Example 1 Consider Example 1 in Section 1. Suppose that there is only one C U S - - t h e environment in which the valve and p u m p s work, and the effects of this C U S on all X 1, X z and X 3 are 50%, i.e. P~.I = Pz,1 = P3,1 = 0.5. Given a i and qi as shown in Table 1, from mi = qi exp { - a 2 / 2 ) and Eqn (10), chosen XI~ as the reference, mi, ai~ and ai~/o'.~ are calculated as shown in Table 1. F r o m Eqn (15), XI = mlXl,oX.~
X2 --' m2X2,oX. 1
(17)
)(3 = m3X3.0 )(- l
Substitute Eqn (17) into Eqn (1).
X = mlXl,oX. 1 (m2X2,0X. 1 + m 3 S 3 , 0 S . l ) = mlXl,O)(.. 2 (m2X2, 0 + m3X3.o)
(18)
Correlations in uncertainty propagation in fault trees
241
TABLE 1 Data ofXi, Xio and Xn for Example 1 (Xll =X.1) i
qi(lO -4)
oi(RFi = 10)
mi(lO -s)
Pio, Pil
°io, Oil
¢Til/(~'l
1 2 3
1 1 2
1"4 1'4 1'4
3-754 4 3"7544 7'508 8
0'5 0"5 0"5
0"99 0"99 0"99
1 1 1
By using Monte Carlo method, ~5 the final results are shown in Table 2 in which they are compared with the results of not considering the correlations among X1, X2 and X 3. It is noted that the latter is in a large underestimation.
Example 2 Consider Example 2 in Section 1. Suppose that there are seven CUSs: (1) (2) (3) (4) (5) (6) (7)
Speed of the truck; Configuration of loading container; Possible collision objects in the road; Correlation between X2 and XT; Correlation between X3 and Xa; Correlation between X4 and )(9; Correlation between X 5 and X10.
Given qi, ai and Pij a s shown in Tables 3 and 4, chosen/~2,1, X2,2, )('2,3, X2,4, X3.5, X4.6, X5.7 as the references, m~, a.j and a~j/a.jare calculated as shown in Tables 3, 5 and 6. Finally, substitute Eqn (15) into Eqn (2). X = 8"26 × 10-TXl,0X) '414 (7"51 × lO-3Xz,oX.1X.2X.3X.4 + 3"75 x 10- 3X3.0J(.iX12225X~.37°TX.5 +3"75
×
10-3X4,oX.IX.2X~.37°TX.6
+ 1"88 x IO-3Xs,oX.1X.3X.7 +3.75 × 10-4X6,o(3.75 x IO-2X7,oX.1X.2X.3X.4 + 3"75 × lO-2Xs,oX.IXI.z22SX?37°TX.5 + 1"88 × 1 0 - 2 X 9,0 X "1 X "2X °"3' V ° v X "6 + 7 " 5 1 x IO-2XlO,OX.IX.3X.7))
By using Monte Carlo method, 15 the final results are calculated as shown in Table 7 in which they are compared with the results of not considering the correlations among XI, X2 .... , Xlo. It is noted again that the latter is in large underestimation.
Qin Zhang
242
TABLE 2 Results o f Considering a n d N o t Considering Correlations a m o n g Basic Event Data of Example 1 (4800 Trials)
Item
Assuming s-independence (10 8)
Considering correlations (10 s)
0'033 0 0'597 2-97 11-1
0.011 2 0511 7.18 24.6
5 % percentile m e d i a n value m e a n value 9 5 % percentile
TABLE 3 q~, a i and m i of X~ for Example 2
l 2 3 4 5 6 7 8 9 10
q(lO - 2)
cii(RFi = 10)
0.000 22 2 1 1 0"5 0"1 10 10 5 20
1-4 1.4 1.4 1.4 1.4 1.4 1.4 1.4 1.4 1.4
mi(l 0
-
3)
0.000 826 7-51 3.75 3.75 1.88 0.375 37.5 37.5 18.8 75.1
TABLE 4 Pi~ in Example 2
.......0 ......' 1 2 3 4 5 6 7 8 9 10
0.6 0.1 0"1 0'1 0"2 1" 0"1 0"1 0"I 0"2
0-4 0.2 0"2 0"2 0"2 0-2 0-2 0'2 0'2
2 0.2 0'3 0"2
0"2 0-3 0-2
;5
!
0.2 0'1 01 0"2
0-3
0-2 0"1 0'1 0-2
0"3 -
. . 0"3
6 .....! .
.
.
0'4 0.4
0"3 ~
0.4 ~
-0"4
Correlations in uncertainty propagation in fault trees TABLE
aio
and
a.~ f o r
Example
243
5
X2,2:X.2,
2 ( X 2 , 1 = X . 1,
X2,3 = X.a, X 2 , 4 = X.4, X3,5 = X . 5 , X4,6 = X . 6, X5,7 : X . 7 )
i
O'iO
j
O'.j
1 2 3 4 5 6 7 8
1.084 0.443 0-443 0.443 0.626 1.4 0-443 0.443
1 2 3 4 5 6 7 --
0.626 0.626 0.626 0.767 0.767 0.885 0.885 --
9 10
0.443 0.626
---
---
TABLE
~ij/~.j
l
2 3 4 5
1
2
1.414 l ! 1 1
. 1 1"225 1 --
6
.
7 8 9 10
1 1 1 1
.
3
4
.
.
--
.
Item
5% percentile median value mean value 95% percentile
.
5 .
6
7
--1 --
---1
. -1 --
.
.
I 0"707 0"707
1 ---
-1 --
-1
1
--
--
--
TABLE
Results of Considering
. 1 ----
1 0.707 0.707 1 .
1 1'225 1
6
for Example 2
A ssuming s-independence (10- s)
10.3 37.7
1
7
and Not Considering Correlations E x a m p l e 2 (4800 T r i a l s )
0-164 2.44
----
among
Basic Event Data
Considering correlations ( 1 0 0'065 7 1'94 16'0 58"8
si
of
244
Qin Zhang
It is interesting to note that although Example 2 has less s-independence among its input variables, the difference between the results of assuming s-independence and considering correlations is less than that of Example 1. This is because Example 2 has seven s-independent CUSs while Example 1 has only one CUS. The seven s-independent CUSs are actually seven s-independent input variables. Thus finally, the correlations in Example 2 is less strong than that in Example I. Readers may also note that the median values of the two results are quite close to each other. This is because the correlations affect mainly the width but not the position of the distribution of X. Moreover, the reason that the mean values are so different is because the non-symmetry o f the lognormal distribution. If the input variables obey a symmetrical distribution, the mean values will be the same. But no matter what the distributions of the input variables are, the difference exists for the 5% percentile and 95% percentile.
4 D I F F E R E N C E B E T W E E N CCF A N D CUS C C F means that more than one basic events fail simultaneously due to a same reason, where 'simultaneously' is roughly used. In other words, the basic events involved in a CCF are not s-independent r a n d o m events. However, in the case of CUS, the basic events involved are still s-independent but their probabilities of occurrence become higher or lower simultaneously due to a same reason. Here, readers should carefully keep in mind that there are two kinds of dependencies involved. One is the dependence of the basic events, which leads to the analysis of CCF. Another is the dependence of the basic event data, which leads to the analysis of CUS. Anything that causes more than one basic events fail simultaneously is a source of CCF; anything that causes the probabilities of more than one basic events higher or lower simultaneously is a CUS. For example, an event that an operator closed two valves during the system test and forgets to open them after the test is a CCF. An event that an operator does a better or worse maintenance on two valves than usual so that they have higher or lower failure probabilities is a CUS. In a fault tree, ifa cut set occurs due to both the r a n d o m failures and CCF, the contributions of them should be considered separately. For example, if two valves failing to open (BE-1 and BE-2) is a cut set, then in g()() there should be two terms: X I X 2 and Xc, where X I X 2 is only the contribution of r a n d o m failures and Xc is only the contribution of CCF, i.e. the event that an operator forgets to open the two valves after the system test does not contribute to X 1 and X 2. However, if the operator who does the system test and the operator who does valve maintenance are the same person, there
Correlations in uncertainty propagation in fault trees
245
may be correlation among XI, X2 and X c. If this operator is a careless person, all X1, X 2 and Xc may be higher; if he is a careful person, all X~, X2 and X c may be lower. That is, the responsibility of this operator is a CUS of X~, X 2 and X c. Here it is noted that a C C F and a CUS may have a same source and both of them should be considered.
5 HOW TO K N O W p~j It is obvious that the key to apply this method is to find Pij. The first step to find pij is to find all independent CUSs. Sometimes they are easy to find, like in Example 1. Sometimes it is not so easy. Usually, when a CUS is hard to determine, it is not important. To make the calculation easier, we should so define a CUS that the number of CUSs is as small as possible. For example, we can also define the CUS in Example 1 as two CUSs: the acidic materials in the cooling water and the maintenance. However, considering that the two CUSs are in a same way to affect XI, X2 and X3, Section 3 combines them into one C U S - - t h e environment of the valve and pumps. From the author's experience, the usual CUSs in practice may include the following: temperature pressure speed load moisture shake stress radiation acid or other materials in the air, gas or liquid quality of maintenance engineering judgments quality of manufacturing similarity among events (e.g. CUSs 5, 6 and 7 in Example 2) The second step is to do tests to find a~j as follows: divide a number of components i into a number of groups (of course, the more the numbers of groups and components i in a group, the better). Stop the actions of all CUSs except CUSj. Let C U S j act just like in practice. F r o m each group, we can get a sample ofm~Xi~, where mi is the median value ofX~, a constant in which we are not interested. After being divided by mi, this sample becomes a sample of Xij, i.e. x~i. Thus, by using the standard statistical method, tr~iis found. From Eqn (8), we get Pij.
246
Qin Zhang
However, p~j is quite difficult to be found from the data collected from industry, because in these data, all CUSs are mixed. Therefore, Po is more difficult to find than RF~. Fortunately, p~j is very intuitive. One can use his/ her engineering judgments to determine p~j, and such determined p~j will be quite accurate because Pit is simply a fraction.
ACKNOWLEDGEMENT The author wishes to thank Dr Jerry B. Fussell, Dr Henrique Paula (both at JBF Associates, Inc.), and Professor George E. Apostolakis (Mechanical, Aerospace and Nuclear Engineering Department, University of California, Los Angeles) for m a n y helpful discussions. The author also wishes to thank M r G a n g Xie (Institute o f Nuclear Energy Technology, Tsinghua University) for his calculating the numerical results of the two examples in this paper.
REFERENCES 1. Levy, L. L. & Moore, A. H., A Monte Carlo technique for obtaining system reliability confidence limits from component test data. IEEE Trans. Reliahilio', R-16 (1977) 69-72. 2. Jackson, P. S., A second-order moments method for uncertainty analysis. IEEE Trans. Reliability, R-31 (1982) 382 4. 3. Kaplan, S., On the method of discrete probability distributions in risk and reliability calculations--application to seismic risk assessment. Risk ~4nal., 1 (1981) 189-96. 4. Mazumdar, M., An approximate method for computation of probability intervals for the top-event probability of fault tree. Nucl. Eng. Des., 71 (1982) 45-50. 5. Filshtein, E. L., Goldstein, R. & Kozmin, A. P., Extreme quantile sampling for safety analyses. Statistical Margin Development, Nuclear Power Systems, Combustion Engineering, Inc., Windsor, Connecticut, TIS-6962, 1981. 6. Apostolakis, G. & Kaplan, S., Pitfalls in risk calculations. Reliability Engineering, 2 (1981) 13545. 7. Kafka, P. & Polke, H., Treatment of uncertainties in reliability models. Nucl. Eng. Des., 93 (1986) 203-14. 8. Clarke, R. K., Severities of transportation accidents. Sandia Laboratories, Albuquerque, New Mexico 87115, USA, SLA-74-0001, Sep. 1976. 9. Kennedy, R. F., Cornetl, C. A., Campbell, R. D., Kaplan, S. & Perla, H. F., Probabilistic seismic safety study of an existing nuclear power plant. Nucl. Eng. Des., 59 (1980) 315-8. 10. Der Kiureghian, A., Multivariate distribution modles for structural reliability. Structural Mechanics in Reactor Technology, Volume M, A. A. Balkema, Rotterdam, Boston, 1987.
Correlations in uncertainty propagation in fault trees
247
!I. Der Kiureghian, A. & Liu, P.-L. Structural reliability under incomplete probability information. J. Engineering Mechanics, ASCE, 112(1) (1986) 85-104. 12. Kendall, M. G., Rank Correlation Methods. J. W. Arrowsmith Ltd, Bristol, Great Britain, 1970. 13. Iman, R. L. & Conover, W. J., A distribution-free approach to inducing rank correlation among input variables. Commun. Statist. Simula. Computa., !1(3) (1982) 311 34. 14. Cooke, R. M. & Waij, R., Monte Carlo sampling for generalized knowledge dependence with application to human reliability. Risk Analysis, 6(3)(1986) 335543. 15. Xie, G., The method study of the uncertainty propagation and the development of the computer code in calculating system reliability parameters. MS Degree thesis (in Chinese), Institute of Nuclear Energy Technology, Tsinghua University, Beijing, P. R. China, Oct. 1984.
A General Method Dealing with Correlations in Uncertainty Propagation in Fault Trees
Qin Zhang* Institute of Nuclear Energy Technology, Tsinghua University, Beijing, People's Republic of China
(Received 24 October 1988; accepted 1 February 1989)
ABSTRACT This paper deals with the correlations among the failure probabilities (frequencies) of not only the identical basic events but also other basic events in a fault tree. It presents a general and simple method to include these correlations in uncertainty propagation. Two examples illustrate this method and show that neglecting these correlations results in large underestimation of the top event failure probability (frequency).
NOTATION BE-/
CCF CUS
g(X) k
basic event i, i = 1. . . . , k c o m m o n cause failure c o m m o n uncertainty source probability density function o f Xi, X u relation between X and .~, i.e. X = gO~) number o f input variables
* This work was carried out whilst the author was at JBF Associates, Inc., Knoxville, Tennessee. The author is a visiting scholar at Mechanical, Aerospace and Nuclear Engineering Department, University of California, Los Angeles. Correspondence address until October 1989:5532 Boelter Hall, UCLA, Los Angeles, California 90024-1597, USA. 231 Reliability Engineering and System Safety 0951-8320/89/$03"50 © 1989 Elsevier Science Publishers Ltd, England. Printed in Great Britain
232 mi tl qi
X
X.j
Y Y. ],2i, (7i, ]lij, (Tij
Qin Zhang
exp {/~i}, mediam value of X i number of CUS E { X i } , expected value of Xi exp { 1"645ai}, Range Factor of X~ (see Ref. 4) Range Factor of Xi~ output variable, i.e. Pr{top event}: top event probability or frequency input variable i, i.e. Pr{BE-i}: probability or frequency of basic event i a log normally distributed random variable relative to only B E - / a n d uncertainty source j, j = 0, 1..... n; when j = 0, j indicates the s-independent uncertainty source of BE-i; w h e n . / # 0, j is the index of CUS any one of X~j, X2j . . . . . Xkj, chosen as a reference ( x l . . . . . xk) (X. 1,..., X.,) (Xo.1 . . . . . Xo.k) distribution parameters of X i, Xij, such that fi(Xi) = ( x / 2 ~ o i X i ) - t exp { -(In X i -/~i)2/2o-2 } .[ij(Xij ) = ( x ~ a i j X i j ) -
~.j, O'.j Pit
I exp { - ( l n Xij - #ij)2/2a~}
distribution parameters of X.j a 2ij// a i2 , correlation fraction coefficient reflecting the effect of uncertainty source j on X~ (see Section 2) 1 INTRODUCTION
The uncertainty of basic event data is one of the important uncertainty sources for fault tree analysis. To estimate the effect of this uncertainty, analysts have developed several methods 1 -5 by which the upper or lower bound of the top event probability (frequency) can be calculated with certain s(statistically)-confidence, given that the probability density distributions of basic event data are known. All these methods have the same assumption: the uncertainty distributions of basic event data are s-independent. But in practice, it is usually not true. References 6 and 7 pointed out that there is correlation or coupling among the data of identical basic events such as the failures of two identical pumps, three identical valves, etc. This correlation means that the data of the identical basic events are entirely correlated and should be treated as a single random variable rather than s-independent random variables in the uncertainty analysis. However, correlations also exist among the data of not
Correlations in uncertainty propagation in fault trees
233
identical basic events, where the correlations are usually imperfect. The following examples illustrate this.
Example 1 As shown in Fig. 1, the Primary Pump (not identical to the Emergency Pump) pumps cooling water into the Chemical Reactor to remove the heat generated from the chemical reaction so that it is in a safe state. If there is no cooling water, the reactor will explode due to the cumulative heat (top event). Assume that the following two failure modes are the only failure modes of this system: mode 1: mode 2:
The Primary Pump fails (BE-l) and the Valve fails to open on demand (BE-2); The Primary P u m p fails (BE-l) and the Emergency P u m p fails to work on demand (BE-3).
Thus we have approximately Pr{top event} = Pr{BE-1}Pr{BE-2} + Pr{BE-1}Pr{BE-3} or X = X 1 X 2 -at-
XiX 3 = XI(X 2 --]-X3)
(1)
where X = Pr{top event} and Xi = Pr{BE-i}. X 1, X 2 and X 3 c a n be found from a reliability data handbook. However, these data may not be appropriate because the working condition here may not be the same as considered in the data handbook. For example, there may be some acidic material in the cooling water so that the valve and pumps fail easier. Thus X~, X 2 and "~3 will be greater than those given in handbooks. On the other hand, if better maintenance is given to the valve and pumps, X~, X 2 and X 3 will be less than those in handbooks. It is noted that these uncertainty sources are c o m m o n to Xt, X 2 and X 3. Therefore, X1, )(2 and X 3 a r e not s-independent. Primary pump Cooling
water
t
To heat sink
C7'
Valve
C2
Chemical reactor
Emergency pump
Fig. I. Chemical reactor cooling system.
Qin Zhang
234
Example 2 Consider the truck transportation of a container used to contain toxic materials. If the truck accident causes a rupture of the container, the toxic material will be released. According to Ref. 8, the fault tree can be constructed as shown in Fig. 2, which gives approximately Pr{top event} =
X~(X2 +
X"3 31- X 4 "~- X 5 + X 6 ( X 7 --1--X 8 --I-X 9 -1- X l o ) )
(2)
F r o m Ref. 8, we can work out X1,..., Xs, XT,..., Xlo. However, for a specific road, the real values may be different from what we work out from Ref. 8. For example, the average speed of the truck on a specific road may be higher or lower than that on the public highway. Since the condition considered in Ref. 8 is the public highway, the data from Ref. 8 for X~ . . . . . Xs, XT,..., X~o m a y be lower or higher than the real values. Therefore the truck speed is a c o m m o n uncertainty source of X~,...,Xs, X7 ..... X~o. Moreover, we can find that the configuration of loading the container and the possible collision objects in the road are also c o m m o n uncertainty sources of X~ . . . . . X 5, Xv,...,X~o. Thus X~ . . . . . Xs, X7 . . . . . X~o are not sindependent. Another example of the c o m m o n uncertainty source of not identical basic event data is engineering judgments. It is frequently encountered in practice that people have to make engineering judgments to determine some basic event data because they are not available from any data source. Since all these engineering judgments are made by the same people or the same assumptions and considerations are taken into account for all these engineering judgments, these engineering judgments become a c o m m o n uncertainty source to all of such obtained data, and thus these data are not s-independent. It is noticed that the effects of a c o m m o n uncertainty source on different basic event data are usually not the same. Also, a basic event datum is usually affected by different uncertainty s o u r c e s - - c o m m o n uncertainty sources and its own s-independent uncertainty source. Thus the correlations are usually imperfect. The imperfect correlations are also found in other areas such as the structure reliability analysis. 9' 10 Reference 10 developed a method based on a transformation of multinormal variables. It is an analytical method. The traditional correlation coefficients are used. But since it requires the transformation of all correlation coefficients, which results in the iterative computations or the numerical integrations, it is difficult to be applied to practical systems while the empirical formulae developed in Ref. 11 appear able to help to solve this problem. Based on the rank correlation theory,'2 another method for inducing a
i
Toxic materials release from container in truck accidents
]
in truck accidents
©
I I break Impact forces container
, container not meeting design specification
©
l
I
C3
I
break container
break container
I container rupture
0
~2
Crush forces break ] container not meeting design specification
0
Puncture forces break container not meeting design specification
Fire causes rupture of container not meeting design specification
0
0
Legend BE-I: BE-2: BE-3: BE-4: BE-5:
Truck accident occurs. Impact forces break container meeting design specification. Crush forces break container meeting design specification. Puncture torces break container meeting design specification. Fire causes rupture of container meeting design specification. Fig. 2.
BE-6: Container does not meet design specification. BE-7: Impact forces break defective container. BE-8: Crush forces break defective container. BE-9: Puncture forces break defective container. BE-10: Fire causes rupture of defective container.
Fault tree of Example 2.
t~
236
Q&Zhang
desired rank correlation matrix on a multivariate input r a n d o m variable for use in a simulation study was presented in Ref. 13. By this method, the input r a n d o m variables (the basic event data) are sampled to get a N × K sample matrix as if they were s-independent, where N is the sample size and K is the number of input variables. Then, according to a somehow calculated rank correlation matrix, the sample matrix is arranged so that these samples become correlated. This arranged sample matrix is then used as samples of the Monte Carlo method to get the desired results. Since N is usually a few thousand, it is expected that the a m o u n t of work to arrange the sample matrix is quite large. Moreover, this method does not guarantee that the arranged sample matrix fairly reflects the real correlations among the input variables. Another method was presented in Ref. 14. In this method, the degree of the correlation between two r a n d o m variables (e.g. X~ and X 2) is measured by d, de[0,1]. That means: if X ~ = x , X 2 must be within [ x - l + d , x + 1 - d ] . This causes two technical problems: (1)
(2)
Usually a correlation between X 1 and X 2 does not mean that X 2 can only take a certain range of values, given that X 1 is determined. It only means that X2 is more likely to take some values than the others. In other words, X~[x - 1 + d, x + 1 - d] is still possible although it is less likely. So dis not a good measure for the correlation between two random variables. Suppose that there are three r a n d o m variables X1, X 2 and X3, dl indicates the correlation between X1 and X z, d 2 indicates the correlation between X 2 and X 3 and d3 indicates the correlation between X1 and X 3. According to this method, once d~ and d 2 a r e determined, d 3 is determined. But this may be incorrect. For example, it can be a real case that X 1 and X 3 are entirely correlated (d 3 = 1) and they are partially correlated to X2(d ~ =d2). According to this method, X1 determines a possible range of X 2, X 2 determines a possible range of X 3, then X 3 may not equal to X~. This conflicts with our assumption that X1 and X 3 are entirely correlated.
Considering the two technical problems, I do not think this method is good although it is quite simple. Due to the lack of the appropriate calculation method, Ref. 9 simply treated the imperfect correlations as perfect correlations. Of course, this treatment results in large overestimations. By analyzing the effect of each c o m m o n uncertainty source on each input variable, this paper presents a simple and general method to deal with these
Correlations in uncertainty propagation in fault trees
237
correlations. The main idea of this method is to modify the relation between the input variables and the output variable (the top event probability or frequency) by adding extra input random variables, so that the final input variables in the modified relation are s-independent. Then, by using any method such as those presented in Refs 1-5, one can get the desired results. Section 2 describes this method. Section 3 calculates the two examples above to illustrate this method. Section 4 discusses the difference between common uncertainty sources and common cause failures. Section 5 discusses how to find the correlation fraction coefficient used in this method. The basic assumptions in this paper are: (1) All input variables are lognormally distributed (2) The relation between the output variable and the input variables is known.
2 THE M E T H O D Based on assumption 1 in Section 1, I assume n
X i = m i~
Xij
(3)
1=0
where X~j is defined as a lognormally distributed random variable with ~lij = 0
(4)
n
(5) j=O
and Xio represents only the effect of Xis own s-independent uncertainty source on X i and Xij (j #0) represents only the effect o f j t h CUS on X~. Since each X~j has only one uncertainty source, X~o, Xil ..... X~. are s-independent of each other. If the CUS j has no effect on X~, a~j = 0 and Xij = E { X , j } = 1.
For any lognormally distributed random variable Y with parameters/~r and o-r, it is known that E{ Y} = exp {pr + o-~/2}
(6)
Qin Z h a n g
238
Thus we have
j=o
j=o
j=o
j=O
= E{Xi}
(7)
which is the expected result. Define the correlation fraction coefficient Pi~ as
Then Pit is the fraction of the effect of uncertainty sourcej on X~. Obviously,
2
Pij = 1
(9)
j=0
After knowing Pij, we can calculate o-i~ from <, = aix/-PT,
(10)
RFij = ----iRF"",,
( 11 )
or
Although Xio, Xil .... , Xi, and X~.o, XE. o . . . . . Xk.O are s-independent, X1j, Xz~ . . . . . Xkj are not s-independent because they share the same C U S j (j 4: 0). Select any one of XIj, X2i . . . . . X,j as a reference and denote it as X.j. Since X~j, Xzj . . . . . XRj have only one uncertainty source, I assume 1
_l(lnx~7
= f~'~
__1 exp { -- -1(ln x'J -- P'i~2~ dx.~ ,,/2n~.jx.j 2\ G.j / j
(12)
i.e. the shaded areas of(a) and (b) in Fig. 3 are equal. This is correct because Xij and X.j have and only have uncertainty sourcej. Therefore X;j and X.~ are entirely correlative. When X.~ takes a certain value, X o also takes a certain value, and the deviatoric extents and directions of Xij and X.j from their mean values are the same. From Eqn (12), let In xij 3'ij --
-
O'ij
~ij
Correlations in uncertainty propagation in fault trees
fij (xij)
239
b"f'J (x .j)
L_
X.j
Xij
Xq
X.j (b)
(a)
Fig. 3.
The relation between X u and X u (/-¢ 0).
and In x.j - ~u.j ~7.j
y.j= we have
f[
"
1
7=- exp {-y~/2} dy u =
f['J
1
~--- exp { -y.~/2} dy.j
,,/2~
,d2,~
where
Ytj
In
--
~ij
--
~ij
(Tij
Yq=
In X.j -- #.j O'.j
Obviously, Yij:
Y.j
Then
X u = .U.y% exp {/~u- P'fu/au}
(13)
Since Pu = P-J = O, we have
x,j xr.;;°'
(14)
=
Then from Eqn (3), we have
x, = m,X,oH ~;'/°'
(15)
j=l
Substituting Eqn (15) into g(X), we get
x= g*(2o, 2.)
(16)
Qin Zhang
240
In g*(Xo, X.), there are k + n lognormally distributed r a n d o m variables and all of them are s-independent of each other. Then by using any uncertainty propagation methods presented in Refs 1-5, one can calculate the uncertainty of the top event probability or frequency. It should be pointed out that the choice of the reference variable X.~ is arbitrary. Different choices will lead to the same result. This is because the two sides of Eqn (12) are identical. Moreover, it is easy to see that this m e t h o d may be expanded to other distributions of basic event data. For example, if all Xg~ are normally distributed, Eqns (3), (14) and (15) are changed to
Xi = qi + ~'~ Xij j=O
(3')
(14')
Xij = ai-~ X.~ O'.j tl
Xi = q~ + X~o + ~ ' a~ X.j L.a o-.j
(15')
j=l
and Eqns (4), (5), (8)-(11) and (16) remain the same.
3 EXAMPLES
Example 1 Consider Example 1 in Section 1. Suppose that there is only one C U S - - t h e environment in which the valve and p u m p s work, and the effects of this C U S on all X 1, X z and X 3 are 50%, i.e. P~.I = Pz,1 = P3,1 = 0.5. Given a i and qi as shown in Table 1, from mi = qi exp { - a 2 / 2 ) and Eqn (10), chosen XI~ as the reference, mi, ai~ and ai~/o'.~ are calculated as shown in Table 1. F r o m Eqn (15), XI = mlXl,oX.~
X2 --' m2X2,oX. 1
(17)
)(3 = m3X3.0 )(- l
Substitute Eqn (17) into Eqn (1).
X = mlXl,oX. 1 (m2X2,0X. 1 + m 3 S 3 , 0 S . l ) = mlXl,O)(.. 2 (m2X2, 0 + m3X3.o)
(18)
Correlations in uncertainty propagation in fault trees
241
TABLE 1 Data ofXi, Xio and Xn for Example 1 (Xll =X.1) i
qi(lO -4)
oi(RFi = 10)
mi(lO -s)
Pio, Pil
°io, Oil
¢Til/(~'l
1 2 3
1 1 2
1"4 1'4 1'4
3-754 4 3"7544 7'508 8
0'5 0"5 0"5
0"99 0"99 0"99
1 1 1
By using Monte Carlo method, ~5 the final results are shown in Table 2 in which they are compared with the results of not considering the correlations among X1, X2 and X 3. It is noted that the latter is in a large underestimation.
Example 2 Consider Example 2 in Section 1. Suppose that there are seven CUSs: (1) (2) (3) (4) (5) (6) (7)
Speed of the truck; Configuration of loading container; Possible collision objects in the road; Correlation between X2 and XT; Correlation between X3 and Xa; Correlation between X4 and )(9; Correlation between X 5 and X10.
Given qi, ai and Pij a s shown in Tables 3 and 4, chosen/~2,1, X2,2, )('2,3, X2,4, X3.5, X4.6, X5.7 as the references, m~, a.j and a~j/a.jare calculated as shown in Tables 3, 5 and 6. Finally, substitute Eqn (15) into Eqn (2). X = 8"26 × 10-TXl,0X) '414 (7"51 × lO-3Xz,oX.1X.2X.3X.4 + 3"75 x 10- 3X3.0J(.iX12225X~.37°TX.5 +3"75
×
10-3X4,oX.IX.2X~.37°TX.6
+ 1"88 x IO-3Xs,oX.1X.3X.7 +3.75 × 10-4X6,o(3.75 x IO-2X7,oX.1X.2X.3X.4 + 3"75 × lO-2Xs,oX.IXI.z22SX?37°TX.5 + 1"88 × 1 0 - 2 X 9,0 X "1 X "2X °"3' V ° v X "6 + 7 " 5 1 x IO-2XlO,OX.IX.3X.7))
By using Monte Carlo method, 15 the final results are calculated as shown in Table 7 in which they are compared with the results of not considering the correlations among XI, X2 .... , Xlo. It is noted again that the latter is in large underestimation.
Qin Zhang
242
TABLE 2 Results o f Considering a n d N o t Considering Correlations a m o n g Basic Event Data of Example 1 (4800 Trials)
Item
Assuming s-independence (10 8)
Considering correlations (10 s)
0'033 0 0'597 2-97 11-1
0.011 2 0511 7.18 24.6
5 % percentile m e d i a n value m e a n value 9 5 % percentile
TABLE 3 q~, a i and m i of X~ for Example 2
l 2 3 4 5 6 7 8 9 10
q(lO - 2)
cii(RFi = 10)
0.000 22 2 1 1 0"5 0"1 10 10 5 20
1-4 1.4 1.4 1.4 1.4 1.4 1.4 1.4 1.4 1.4
mi(l 0
-
3)
0.000 826 7-51 3.75 3.75 1.88 0.375 37.5 37.5 18.8 75.1
TABLE 4 Pi~ in Example 2
.......0 ......' 1 2 3 4 5 6 7 8 9 10
0.6 0.1 0"1 0'1 0"2 1" 0"1 0"1 0"I 0"2
0-4 0.2 0"2 0"2 0"2 0-2 0-2 0'2 0'2
2 0.2 0'3 0"2
0"2 0-3 0-2
;5
!
0.2 0'1 01 0"2
0-3
0-2 0"1 0'1 0-2
0"3 -
. . 0"3
6 .....! .
.
.
0'4 0.4
0"3 ~
0.4 ~
-0"4
Correlations in uncertainty propagation in fault trees TABLE
aio
and
a.~ f o r
Example
243
5
X2,2:X.2,
2 ( X 2 , 1 = X . 1,
X2,3 = X.a, X 2 , 4 = X.4, X3,5 = X . 5 , X4,6 = X . 6, X5,7 : X . 7 )
i
O'iO
j
O'.j
1 2 3 4 5 6 7 8
1.084 0.443 0-443 0.443 0.626 1.4 0-443 0.443
1 2 3 4 5 6 7 --
0.626 0.626 0.626 0.767 0.767 0.885 0.885 --
9 10
0.443 0.626
---
---
TABLE
~ij/~.j
l
2 3 4 5
1
2
1.414 l ! 1 1
. 1 1"225 1 --
6
.
7 8 9 10
1 1 1 1
.
3
4
.
.
--
.
Item
5% percentile median value mean value 95% percentile
.
5 .
6
7
--1 --
---1
. -1 --
.
.
I 0"707 0"707
1 ---
-1 --
-1
1
--
--
--
TABLE
Results of Considering
. 1 ----
1 0.707 0.707 1 .
1 1'225 1
6
for Example 2
A ssuming s-independence (10- s)
10.3 37.7
1
7
and Not Considering Correlations E x a m p l e 2 (4800 T r i a l s )
0-164 2.44
----
among
Basic Event Data
Considering correlations ( 1 0 0'065 7 1'94 16'0 58"8
si
of
244
Qin Zhang
It is interesting to note that although Example 2 has less s-independence among its input variables, the difference between the results of assuming s-independence and considering correlations is less than that of Example 1. This is because Example 2 has seven s-independent CUSs while Example 1 has only one CUS. The seven s-independent CUSs are actually seven s-independent input variables. Thus finally, the correlations in Example 2 is less strong than that in Example I. Readers may also note that the median values of the two results are quite close to each other. This is because the correlations affect mainly the width but not the position of the distribution of X. Moreover, the reason that the mean values are so different is because the non-symmetry o f the lognormal distribution. If the input variables obey a symmetrical distribution, the mean values will be the same. But no matter what the distributions of the input variables are, the difference exists for the 5% percentile and 95% percentile.
4 D I F F E R E N C E B E T W E E N CCF A N D CUS C C F means that more than one basic events fail simultaneously due to a same reason, where 'simultaneously' is roughly used. In other words, the basic events involved in a CCF are not s-independent r a n d o m events. However, in the case of CUS, the basic events involved are still s-independent but their probabilities of occurrence become higher or lower simultaneously due to a same reason. Here, readers should carefully keep in mind that there are two kinds of dependencies involved. One is the dependence of the basic events, which leads to the analysis of CCF. Another is the dependence of the basic event data, which leads to the analysis of CUS. Anything that causes more than one basic events fail simultaneously is a source of CCF; anything that causes the probabilities of more than one basic events higher or lower simultaneously is a CUS. For example, an event that an operator closed two valves during the system test and forgets to open them after the test is a CCF. An event that an operator does a better or worse maintenance on two valves than usual so that they have higher or lower failure probabilities is a CUS. In a fault tree, ifa cut set occurs due to both the r a n d o m failures and CCF, the contributions of them should be considered separately. For example, if two valves failing to open (BE-1 and BE-2) is a cut set, then in g()() there should be two terms: X I X 2 and Xc, where X I X 2 is only the contribution of r a n d o m failures and Xc is only the contribution of CCF, i.e. the event that an operator forgets to open the two valves after the system test does not contribute to X 1 and X 2. However, if the operator who does the system test and the operator who does valve maintenance are the same person, there
Correlations in uncertainty propagation in fault trees
245
may be correlation among XI, X2 and X c. If this operator is a careless person, all X1, X 2 and Xc may be higher; if he is a careful person, all X~, X2 and X c may be lower. That is, the responsibility of this operator is a CUS of X~, X 2 and X c. Here it is noted that a C C F and a CUS may have a same source and both of them should be considered.
5 HOW TO K N O W p~j It is obvious that the key to apply this method is to find Pij. The first step to find pij is to find all independent CUSs. Sometimes they are easy to find, like in Example 1. Sometimes it is not so easy. Usually, when a CUS is hard to determine, it is not important. To make the calculation easier, we should so define a CUS that the number of CUSs is as small as possible. For example, we can also define the CUS in Example 1 as two CUSs: the acidic materials in the cooling water and the maintenance. However, considering that the two CUSs are in a same way to affect XI, X2 and X3, Section 3 combines them into one C U S - - t h e environment of the valve and pumps. From the author's experience, the usual CUSs in practice may include the following: temperature pressure speed load moisture shake stress radiation acid or other materials in the air, gas or liquid quality of maintenance engineering judgments quality of manufacturing similarity among events (e.g. CUSs 5, 6 and 7 in Example 2) The second step is to do tests to find a~j as follows: divide a number of components i into a number of groups (of course, the more the numbers of groups and components i in a group, the better). Stop the actions of all CUSs except CUSj. Let C U S j act just like in practice. F r o m each group, we can get a sample ofm~Xi~, where mi is the median value ofX~, a constant in which we are not interested. After being divided by mi, this sample becomes a sample of Xij, i.e. x~i. Thus, by using the standard statistical method, tr~iis found. From Eqn (8), we get Pij.
246
Qin Zhang
However, p~j is quite difficult to be found from the data collected from industry, because in these data, all CUSs are mixed. Therefore, Po is more difficult to find than RF~. Fortunately, p~j is very intuitive. One can use his/ her engineering judgments to determine p~j, and such determined p~j will be quite accurate because Pit is simply a fraction.
ACKNOWLEDGEMENT The author wishes to thank Dr Jerry B. Fussell, Dr Henrique Paula (both at JBF Associates, Inc.), and Professor George E. Apostolakis (Mechanical, Aerospace and Nuclear Engineering Department, University of California, Los Angeles) for m a n y helpful discussions. The author also wishes to thank M r G a n g Xie (Institute o f Nuclear Energy Technology, Tsinghua University) for his calculating the numerical results of the two examples in this paper.
REFERENCES 1. Levy, L. L. & Moore, A. H., A Monte Carlo technique for obtaining system reliability confidence limits from component test data. IEEE Trans. Reliahilio', R-16 (1977) 69-72. 2. Jackson, P. S., A second-order moments method for uncertainty analysis. IEEE Trans. Reliability, R-31 (1982) 382 4. 3. Kaplan, S., On the method of discrete probability distributions in risk and reliability calculations--application to seismic risk assessment. Risk ~4nal., 1 (1981) 189-96. 4. Mazumdar, M., An approximate method for computation of probability intervals for the top-event probability of fault tree. Nucl. Eng. Des., 71 (1982) 45-50. 5. Filshtein, E. L., Goldstein, R. & Kozmin, A. P., Extreme quantile sampling for safety analyses. Statistical Margin Development, Nuclear Power Systems, Combustion Engineering, Inc., Windsor, Connecticut, TIS-6962, 1981. 6. Apostolakis, G. & Kaplan, S., Pitfalls in risk calculations. Reliability Engineering, 2 (1981) 13545. 7. Kafka, P. & Polke, H., Treatment of uncertainties in reliability models. Nucl. Eng. Des., 93 (1986) 203-14. 8. Clarke, R. K., Severities of transportation accidents. Sandia Laboratories, Albuquerque, New Mexico 87115, USA, SLA-74-0001, Sep. 1976. 9. Kennedy, R. F., Cornetl, C. A., Campbell, R. D., Kaplan, S. & Perla, H. F., Probabilistic seismic safety study of an existing nuclear power plant. Nucl. Eng. Des., 59 (1980) 315-8. 10. Der Kiureghian, A., Multivariate distribution modles for structural reliability. Structural Mechanics in Reactor Technology, Volume M, A. A. Balkema, Rotterdam, Boston, 1987.
Correlations in uncertainty propagation in fault trees
247
!I. Der Kiureghian, A. & Liu, P.-L. Structural reliability under incomplete probability information. J. Engineering Mechanics, ASCE, 112(1) (1986) 85-104. 12. Kendall, M. G., Rank Correlation Methods. J. W. Arrowsmith Ltd, Bristol, Great Britain, 1970. 13. Iman, R. L. & Conover, W. J., A distribution-free approach to inducing rank correlation among input variables. Commun. Statist. Simula. Computa., !1(3) (1982) 311 34. 14. Cooke, R. M. & Waij, R., Monte Carlo sampling for generalized knowledge dependence with application to human reliability. Risk Analysis, 6(3)(1986) 335543. 15. Xie, G., The method study of the uncertainty propagation and the development of the computer code in calculating system reliability parameters. MS Degree thesis (in Chinese), Institute of Nuclear Energy Technology, Tsinghua University, Beijing, P. R. China, Oct. 1984.