Fault tree conversion to binary decision diagrams

Transcription

1 Loughorough University Institutionl Repository Fult tree onversion to inry deision digrms This item ws sumitted to Loughorough University's Institutionl Repository y the/n uthor. Cittion: ANDREWS, J.D. nd REMENTYE, R., 25. Fult tree onversion to inry deision digrms. 23rd Interntionl System Sfety Conferene, August 22-26, 25, Sn Diego, Westin Hotel Additionl Informtion: This is onferene pper. It ws presented t 23rd Interntionl System Sfety Conferene, August 22-26, 25, Sn Diego, Westin Hotel. Metdt Reord: Pulisher: System Sfety Soiety Plese ite the pulished version.

2 This item ws sumitted to Loughorough s Institutionl Repository y the uthor nd is mde ville under the following Cretive Commons Liene onditions. For the full text of this liene, plese go to:

3 PROCEEDINGS OF THE 23rd INTERNATIONAL SYSTEM SAFETY CONFERENCE - 25 Fult Tree Conversion to Binry Deision Digrms J.D. Andrews; Deprtment of Aeronutil nd Automotive Engineering Loughorough University; Loughorough, Leiestershire, Englnd R. Remenyte; Deprtment of Aeronutil nd Automotive Engineering Loughorough University; Loughorough, Leiestershire, Englnd Keywords: Fult Tree Anlysis, Binry Deision Digrms Astrt Fult Tree Anlysis is ommonly used tehnique to predit the uses of speifi system filure mode nd to then determine the likelihood of this event. Over reent yers the Binry Deision Digrm (BDD) method hs een developed for the solution of the fult tree. It n e shown tht this pproh hs dvntges in terms of oth ury nd effiieny over the onventionl method of nlysis formulted in the 97 s. The BDD expresses the filure logi in disjoint form whih gives it n dvntge from the omputtionl viewpoint. Fult Trees, however, remin the etter wy to represent the system filure uslity. Therefore the usul wy of tking dvntge of the BDD struture is to onstrut fult tree nd then onvert this to BDD. It is on the fult tree onversion proess tht this pper will fous. In order to onstrut BDD the vriles whih represent the ourrene of the si events in the fult tree hve to e pled in n ordering. Depending on the ordering seleted n effiient representtion of the filure logi n e otined or if poor ordering is seleted less effiient nlysis will result. One the ordering is estlished one pproh is to utilise set of rules developed y Ruzy whih re repetedly pplied to generte the BDD. An lterntive pproh n e used wherey BDD onstruts for eh of the gte types re first formed nd then joined together s speified y the gtes in the fult tree. Some omments on the effetiveness of these pprohes will e provided. Introdution The inry deision digrm (BDD) method (ref. ) hs een developed s n lterntive to onventionl methods for performing qulittive nd quntittive nlysis of fult trees. This method ppers to e more effiient mens of nlysing system nd does not need to tke dvntge of the pproximtions used in the trditionl pproh of kineti tree theory (ref. 2). Rther thn nlysing the fult tree diretly the BDD method first onverts the fult tree to inry deision digrm, whih represents the Boolen eqution for the top event. However, prolems my our with the onversion proess of the fult tree to the BDD. If the ordering of the si events is not hosen suitly, the size of the finl BDD n grow exponentilly. It is not possile to identify n optimum sheme for produing BDDs for ll fult trees. In this pper n lterntive onversion method is presented where BDDs for eh of the gte types re formed nd then joined together ording to the type of the prent gte in the fult tree. The effetiveness of this pproh is ompred with Ruzy s method using different effiieny mesures, while working on the optimum onnetion tehnique. Binry Deision Digrms A BDD is direted yli grph, i.e. ll pths through the BDD re in one diretion nd no loops n exist. The BDD is omposed of terminl nd non-terminl verties (nodes) whih re onneted y rnhes. Terminl verties orrespond to the finl stte of the system, filure () or suess (), nd non-terminl verties orrespond to the si events of the fult tree. Eh non-terminl vertex hs rnh, whih represents si event ourrene, nd rnh, whih represents si event non-ourrene. The fult tree nd its equivlent BDD re presented in figure. The BDD enodes system filure logi funtion in disjoint form. Originlly pulished y the System Sfety Soiety, in the Proeedings of the 23rd Interntionl System Sfety Conferene, held t Sn Diego, USA, August 25

4 PROCEEDINGS OF THE 23rd INTERNATIONAL SYSTEM SAFETY CONFERENCE - 25 Top rnh root vertex rnh G G2 intermedite node terminl node ( + )( + ) = Top = + Figure Exmple of Binry Deision Digrm BDD Quntifition All pths through the digrm strt t the root vertex nd proeed to terminl vertex, whih mrks the end of the pth. Eh pth tht termintes in stte gives ut set of the fult tree, s tht prtiulr omintion of omponent filures whih, if they ll our, will result in system filure. Only verties tht lie on the rnhes of these pths re inluded in the ut sets. For exmple, in the BDD shown in figure there re two possile pths tht terminte in stte. These re:. 2.,, This gives the two orresponding ut sets:. {} 2. {, }. In this exmple the BDD is in its miniml form nd so genertes only miniml ut sets (ut sets with oth neessry nd suffiient elements). However, this is not lwys the se. In order to otin miniml ut sets the BDD hs to undergo minimistion proedure, introdued in referene, fter whih new BDD is reted tht enodes only the miniml ut sets of the fult tree. Sine pths through the BDD re disjoint (mutully exlusive), the proility of ourrene of the top event, Q SYS, n e expressed s the sum of the proilities of the disjoint pths through the BDD. Eh disjoint pth represents omintion of working nd filed omponents whih leds to system filure. Therefore, events lying on oth the nd rnhes re inluded in the proility lultion. The proility of system filure for the BDD shown in figure is: QSYS q + ( q ) qq = () Other proilisti properties of the system, suh s the unonditionl filure intensity nd omponent importne mesures, n lso e lulted (ref. 4).

5 PROCEEDINGS OF THE 23rd INTERNATIONAL SYSTEM SAFETY CONFERENCE - 25 BDD/FT Fetures Fult Tree Anlysis is the most widely used tool in system sfety nd reliility ssessment. This tehnique nlyses the usl reltionships etween omponent filures nd system filure. The fult tree itself provides visul representtion of engineering filure logi nd produes omplete desription of the uses of system filure. However, even for moderte sized prolems the lultion of miniml ut sets n e time onsuming tsk nd the system filure proility is lulted y pplying pproximtions. Rther thn nlysing the fult tree diretly the BDD method first onverts the fult tree to inry deision digrm. The BDDs re diffiult to onstrut diretly from the engineering system nd they do not provide ler doumenttion of the system filure uses. When the quntittive nlysis is performed, the BDD hs the dvntge tht, due to the struture of the logi eqution, ext proilities n e lulted. There re no requirements to lulte miniml ut sets s n intermedite phse. However, the qulittive nlysis of BDDs n e performed nd miniml ut sets otined (ref. 5). The BDD method hs een developed nd used to overome inury nd ineffiieny prolems with onventionl methods. It does however require n effetive method to onvert the fult tree struture into the BDD form. Two methods re now onsidered. Constrution method Ruzy A ommonly used method of onstruting BDDs ws developed y Ruzy (ref. ) nd proeeds y pplying n ifthen-else (ite) tehnique to eh of the gtes in the fult tree. The ite struture derives from the Shnnon s formul (ref. 3) suh tht if f ( x) is the Boolen eqution for the top event, then y pivoting out ny vrile X the Shnnon formul n e written s: ( x) Xf Xf2 f = + (2) where f nd f 2 re Boolen equtions, known s the residues of f, with X = nd X = respetively. The orresponding ite struture is ite( X, f, f2 ), whih mens tht if X fils then onsider f, else onsider f 2. Therefore, in the BDD struture f lies elow the rnh of the node enoding X nd f 2 lies elow the rnh. One vrile ordering hs een estlished, the following proedure n e implemented to onstrut the BDD. Let J nd H e two nodes in the BDD where J = ite( X, f, f2 ) nd G = ite( Y, g, g2 ).. if X < Y (i.e. X ppers efore Y in the vrile ordering) then J op > G = ite X, f < op > G f < op > G. (3) ( ) <, 2 2. if X = Y then J < op > G = ite X, f < op > g f < op > g. (4) ( ), 2 where < op > orresponds to Boolen opertion of the gtes in the fult tree. 2 An dvntge of the ite lgorithm is tht the method utomtilly uses su-node shring. This not only redues the omputer memory requirements, s eh ite struture is only stored one, ut it lso inreses the effiieny, sine one n ite struture hs een lulted the proess does not need to e repeted. The ite method n e demonstrted y n exmple in figure 2. The ordering < < d < represents simple top-down left-right trversl of the fult tree. Applying eqution 3 gives the expression for gtes G, G2 nd Top: G = + + d = ite = ite (,, ) + ite(,, ) + ite( d,, ) (,, ite(,, ite( d,, ))). (5)

6 PROCEEDINGS OF THE 23rd INTERNATIONAL SYSTEM SAFETY CONFERENCE - 25 G2 = + = ite Top = G G2 = ite (,, ite(,,) ). (,ite(,, ite(,,) ),ite(,, ite( d,ite(,,),))). (6) (7) Top G G2 d d Figure 2 BDD otined using the ite tehnique Constrution method 2 Component Connetion method The seond method onsidered (ref. 6) uses the oserved struture tht results when BDD is formed for n AND gte or n OR gte. In this wy BDDs re onstruted for fult trees initilly without onsidering when si events in the fult tree re duplited (repeted). The resulting BDD then undergoes simplifition to produe the finl struture for nlysis. This setion of the pper desries the onnetion nd simplifition rules, with some lterntive strtegies, for produing BDD for ny fult tree. The si event ordering, s required in Ruzy s method, does not neessrily need to e estlished euse the method n work without following ny predetermined ordering sheme for the whole system. However, efore the onstrution proess n e implemented seletion sheme hs to e speified whih will govern the wy in whih gte inputs, either si events or BDDs, re seleted nd omined. In the pproh presented gte inputs to ny prent gte re onsidered in left-right wy so tht this provides some ordering to onsider si events nd lso the BDD for sutree of the left-most gte is uilt efore onsidering the remining gte inputs. When ll BDDs, representing gte inputs of prent gte, hve een formed they re merged to otin the BDD of the prent gte. This ottom-up proess is over when the BDDs, representing gte inputs of the top-event, re omined. The following onnetion rules re used.. If two inputs in fult tree re inputs to n AND gte, their representing nodes on BDD re onneted to eh other through the rnh of the node. A similr sttement holds true for the OR gte, i.e. the nodes re onneted through the rnh. 2. If there re two BDDs, whih represent two gte inputs of prent gte, one of them is set to e the min BDD, ording to the rule of seletion. Then, ) If two BDDs re inputs to n AND gte, the seondry BDD is onneted to every terminl node of the min BDD. ) If two BDDs re inputs to n OR gte, the seondry BDD is onneted to every terminl node of the min BDD.

7 PROCEEDINGS OF THE 23rd INTERNATIONAL SYSTEM SAFETY CONFERENCE - 25 After every onneting opertion we need to hek for the repetition of si events on ny pth through the BDD. If there is t lest one repeted event, two simplifition rules will e pplied:. Eh pth strting t the node tht represents the first ourrene of repeted event in pth, nd proeeding to terminl vertex, must e djusted in order to void the ontrditory sttes of the repeted event in the BDD. The node, tht represents the seond ourrene of the event, needs to e repled y the events elow it on either its working rnh or filed rnh depending on the omponent stte s speified y its first ourrene in the pth. For exmple, if we trverse the BDD strting with the rnh of node, the seond pperne of tht node should e repled y the BDD struture elow the rnh of this seond node for onsisteny. 2. If the stte of the system is the sme regrdless of the si event ourrene or non-ourrene, the insignifint vertex must e removed. In other words, if the BDD strutures elow oth rnhes of the node re the sme, the node is irrelevnt nd needs to e repled y the struture elow either one of the rnhes. To demonstrte this method it hs een pplied to the fult tree illustrted in figure 2. The resulting proess is presented in figure 3. In this exmple the seletion sheme used is tht when omining BDDs representing inputs for ny gtes they re onsidered in left-right mnner nd the left-most BDD is set to e the min BDD to whih the other is joined. A left-right vrile ordering for every gte in fult tree is lso dopted nd the fult tree trversed in ottom-up mnner. First of ll, gtes G nd G2 re onstruted, shown in figure 3(i) nd figure 3(ii) respetively, uilding two BDDs, whih re oth OR hins. Then the top event ( AND gte) is onsidered. The left-most BDD (figure 3(i)) is seleted s the min BDD. Then the BDD, illustrted in figure 3(ii), is onneted to every ville rnh of the min BDD. The resulting BDD is presented in figure 3(iii). Finlly, the simplifition rules re pplied. The repeted event is removed from the pth F-F2-F6-F7 repling node F6 y the terminl node, sine the pth trverses the rnh of node F2, the first ourrene of the repeted event. In the sme wy the repeted event is removed from the pth F-F2-F3-F8-F9, repling node F8 y diret onnetion to node F9. The finl BDD is shown in figure 3(iv). No system-wide vrile ordering ws expliitly presented in this exmple, i.e. si events were onneted ording to the order tht they pper in the list of gte inputs. However, it is possile to pply defined ordering sheme for the nodes whih will e used in the onstrution method. In forming the BDD of prent gte the BDDs of its input events re merged together, one t time. In this exmple BDDs were seleted ording to the order tht gte inputs re listed, i.e. the BDD, presenting the left-most gte, is set to e the min BDD. Other seletion shemes n e used whih will, to some degree, ffet the effiieny of the proess. For exmple, BDDs n e ordered ording to the position of their root vertex in n ordering sheme defined for the si events or to minimise the numer of ville rnhes where onnetions will e mde. The effiieny of different strtegies n e nlysed ompring the numer of nodes in the finl BDD nd the proessing time. Both qulittive nd quntittive nlysis n e rried out on BDDs s in the first method. However, this method does not use su-node shring, therefore, there re some prts in the struture tht re identil. This might led to the ineffiient memory usge. For exmple, in figure 3(iv) there re two identil nodes F5 nd F9, whih re not duplited in Ruzy s method.

8 PROCEEDINGS OF THE 23rd INTERNATIONAL SYSTEM SAFETY CONFERENCE - 25 G: F G2: F4 F2 F5 d F3 (ii) F (i) F F4 F4 F2 F5 F6 F2 F5 d F3 F9 (iii) F7 d F3 F8 F9 (iv) Figure 3 BDD otined using the Component Connetion method Comprison of methods The performne of method for fult tree onversion to the BDD form will e dependent upon the struture of the fult tree. An indition of the merit of method n only e guged over lrge rnge of prolems. As omprison etween the two BDD onstrution methods presented they hve oth een pplied to lirry of 2 fult trees. The hrteristis of test fult trees re summrised in tle. The first olumn is lel to identify the exmple fult tree, then the next three olumns present the omplexity of fult tree in terms of the numer of gtes, the numer of si events nd the numer of repeted events. The lst olumn presents the numer of miniml ut sets. For eh of the two methods, wht re onsidered s effetive vrile ordering shemes nd gte omintions input seletion shemes hve een used. The vrile ordering tht ws pplied for si events is the modified top-down left-right pproh (ref. 7).

9 PROCEEDINGS OF THE 23rd INTERNATIONAL SYSTEM SAFETY CONFERENCE - 25 Numer of Numer of Numer of test FT gtes si events Numer of repeted events Numer of ut sets Tle Complexity of test fult trees The mesurements tht were hosen for the omprison of the two methods re the numer of nodes in the finl BDD nd the proessing time. The results otined y pplying the two methods to the fult trees in the lirry re shown in tle 2. Numer of test FT Numer of nodes Method Method 2 Method s frtion of Method 2 (%) Proessing time Method Method 2 Method s frtion of Method 2 (%) Tle 2 Comprison of two onstrution methods y the numer of nodes nd the proessing time The first onstrution method resulted in smller BDDs for ll the exmple fult trees. The proessing time ws lso shorter for lmost ll exmple fult trees, exept two exmples, (6) nd (7). Therefore, Ruzy s method hs ig dvntge over the Component Connetion method. This is due t lest prtly to its pility to use su-node shring. Conlusions This pper presents two lterntive tehniques y whih fult trees re onverted to BDDs. The first method is Ruzy s ite method, the seond is the Component Connetion method. Exmple fult trees hve een used nd the results for oth methods ompred. Proessing time nd numer of nodes were used s effiieny mesures while

10 PROCEEDINGS OF THE 23rd INTERNATIONAL SYSTEM SAFETY CONFERENCE - 25 working on wht were onsidered effiient onnetion tehniques for oth methods. It hs een shown tht the Component Connetion pproh hs high demnd for memory spe sine the identil prts in the BDD struture re repeted ut not shred. It is shown tht s generl fult tree to BDD onversion tehnique the method proposed y Ruzy performs est. If the Component Connetion method is to ompete with Ruzy s method then it must e ple of inorporting su-node shring. Referenes. Antoine Ruzy, New Algorithms for Fult Tree Anlysis, Reliility Engineering nd System Sfety, no. 4 (993): W.E. Vesely, A Time Dependent Methodology for Fult Tree Evlution, Nuler Design nd Engineering, no. 3 (97): Rndle E. Brynt, Grph-Bsed Algorithms for Boolen Funtion Mnipultion, IEEE Trns. Computers C- 35, no. 8 (986): R.M. Sinnmon, J.D. Andrews, Improved Aury in Quntittive Fult Tree Anlysis, Qulity nd Reliility Engineering Interntionl, no. 3 (997): R.M. Sinnmon, J.D. Andrews, Improved Effiieny in Qulittive Fult Tree Anlysis, Qulity nd Reliility Engineering Interntionl, no. 3 (997): Yun-Shun Wy, Der-Yu Hsi, A simple omponent-onnetion method for uilding inry deision digrms enoding fult tree, Reliility Engineering nd System Sfety, no. 7 (2): Kren A. Rey, Effiient Fult Tree Anlysis Using Binry Deision Digrms, Dotorl Thesis, Loughorough University (22). Biogrphy John D. Andrews, Deprtment of Aeronutil nd Automotive Engineering, Loughorough University, Loughorough, Leiestershire, LE 3TU, UK, telephone +44 () , fsimile +44 () , e-mil J.D.Andrews@loro..uk John Andrews is Professor of Systems Reliility in the Deprtment of Aeronutil nd Automotive Engineering. He joined Loughorough University in 989 hving previously gined nine yers industril reserh experiene with British Gs. His urrent reserh interests onern the ssessment of the sfety nd risk of potentilly hzrdous industril tivities. This reserh hs een hevily supported y industril funding. Over reent yers grnts hve een seured from BAE Systems, MOD, Rolls-Roye, ExxonMoil nd Behtel. Professor Andrews hs over one hundred journl/onferene pulitions long with jointly uthored ook Reliility nd Risk Assessment whih is now in its seond edition. Rs Remenyte, Deprtment of Aeronutil nd Automotive Engineering, Loughorough University, Loughorough, Leiestershire, LE 3TU, UK, telephone +44 () , fsimile +44 () , e-mil R.Remenyte@loro..uk Rs Remenyte is urrently studying for PhD t Loughorough University, hving previously ttined msters degree with honours in mthemtis t Kuns University of Tehnology in Lithuni. During the ourse of these studies she ttended Loughorough University s prt of the Sortes\Ersmus exhnge progrm, ompleting two modules of n industril mthemtil modelling ourse. Her urrent reserh studies re undertken s prt of the Risk nd Reliility reserh group in the Aeronutil nd Automotive Engineering Deprtment of Loughorough University.