Analysis of Non-coherent Fault Trees Using Ternary Decision Diagrams

Transcription

1 Analyss of Non-coherent Fault Trees Usng Ternary Decson Dagrams Rasa Remenyte-Prescott Dep. of Aeronautcal and Automotve Engneerng Loughborough Unversty, Loughborough, LE11 3TU, England John Andrews Dep. of Aeronautcal and Automotve Engneerng Loughborough Unversty, Loughborough, LE11 3TU, England Abstract Rsk and safety assessments performed on potentally hazardous ndustral systems commonly utlse Fault Tree Analyss (FTA) to forecast the probablty of system falure. The type of logc for the top event s usually lmted to AND and OR gates whch leads to a coherent fault tree structure. In non-coherent fault trees components workng states as well as components falures contrbute to the falure of the system. The qualtatve and quanttatve analyses of non-coherent fault trees can ntroduce further dffcultes over and above those seen n the coherent case. It s shown that the Bnary Decson Dagram (BDD) method can be used for ths type of assessment. The BDD approach can mprove the accuracy and effcency of the quanttatve analyss of non-coherent fault trees. Ths artcle demonstrates the value of the Ternary Decson Dagram method (TDD) for the qualtatve analyss of non-coherent fault trees. Such analyss can be used to provde nformaton to a decson makng process for future actons of an autonomous system and therefore t must be performed n real tme. In these crcumstances fast processng and small storage requrements are very mportant. The TDD method provdes a fast processng capablty and small storage s acheved when a sngle structure s used for both qualtatve and quanttatve analyses. The effcency of the TDD

2 method s dscussed and compared to the performance of the establshed methods for analyss of non-coherent fault trees. Keywords: fault tree analyss, bnary decson dagrams, non-coherent fault trees, ternary decson dagrams 1. Introducton Fault Tree Analyss (FTA) was frst ntroduced n the 1960s and t s commonly used for the relablty assessment of complex ndustral systems. Causes of system falure are analysed by performng qualtatve and quanttatve analyses. A large number of combnatons of events whch can cause system falure may be produced for real systems (mnmal cut sets/prme mplcant sets) and the calculaton of these falure combnatons can be tme-consumng. Also, the determnaton of the exact top event probablty requres lengthy calculatons. For real systems ths demand may exceed the capablty of the avalable computers, ntroducng approxmatons nto the analyss wth the resultng loss of accuracy. The Bnary Decson Dagram (BDD) method [1] provdes a more concse form for the logc functon of a fault tree. It overcomes some dsadvantages of conventonal FTA technques and provdes an effcent and exact analyss of coherent and non-coherent fault trees. The BDD method s effcent for quantfyng the lkelhood of system falure occurrence because t does not requre system falure modes as an ntermedate step. It s also more accurate snce approxmatons used n the tradtonal approach of knetc tree theory [2] are not appled. Prevous work on the effcency and the accuracy of the BDD method s presented n [3, 4]. Instead of analysng the fault tree drectly, the BDD method frst converts the fault tree to a bnary decson dagram, whch encodes the Boolean equaton for the top event. The resultng structure functon BDD (SFBDD) can be used n the quanttatve analyss to calculate the top event probablty

3 or frequency. An SFBDD s not of the correct form for the qualtatve analyss and further processng s requred. In the coherent case a lst of mnmal cut sets s obtaned by usng the mnmsaton technque [1]. In the non-coherent case a full set of prme mplcants s determned by applyng the consensus theorem [5] to pars of prme mplcant sets nvolvng a normal and negated lteral. There are several methods for the calculaton of prme mplcant sets proposed n the lterature. A metaproducts BDD method, the frst approach to ths problem, was presented n [6] and further developed n [7]. It was followed by a zero-suppressed BDD method (ZBDD), presented n [8]. The thrd alternatve method was developed n [9] and t uses a labelled bnary decson dagram (L-BDD). These methods produce prme mplcant sets and have ther advantages and dsadvantages n the converson and representaton technques. A new alternatve method for performng the qualtatve analyss of non-coherent fault trees s proposed n ths paper. In ths approach a fault tree s converted to a ternary decson dagram (TDD). The man concept of a TDD was presented n [10], whch s expanded nto an mplementaton methodology for fault tree analyss n ths paper. Every node n a TDD has three branches: the 1 branch whch represents the falure relevance of the component, the 0 branch whch represents the repar relevance of the component (so far ths s a conventonal BDD presentaton) and the consensus branch whch represents the rrelevance of the component to the system falure. A TDD encodes all prme mplcant sets, because the consensus branch for a node s calculated by applyng the consensus theorem whch gves all hdden prme mplcant sets. However, the TDD can be non-mnmal, thus, the mnmsaton process s performed to remove non-mnmal paths from the 1 and 0 branches. The obtaned TDD can be used for the quanttatve analyss as well as the qualtatve analyss. 2. Non-coherent fault trees Fault trees are classfed accordng to ther logc functon. If durng fault tree constructon only AND gates and OR gates are used, the resultng fault tree s defned as coherent. If NOT logc s used or drectly mpled the resultng fault tree can be non-coherent.

4 Introduce each component n the system by an ndcator x to show the status of the component: 1f component s faled, x (1) 0 f component s workng. where = 1,2, n, and n s the number of components n the system. The logc structure of the fault tree can be expressed by a structure functon : 1 f system s faled, (2) 0 f system s workng. = (x), where x = (x 1, x 2,, x n ). Accordng to the requrements of coherency [5], a structure functon (x) s coherent f: 1. Each component s relevant to the system,.e. ( 1, x) (0, x) for some x. (3) 2. (x) s ncreasng (non-decreasng) for each x,.e. where ( 1, x) (0, x). (4) 1, x ) ( x,, x,1, x,, x ), (5) ( n 0, x ) ( x,, x,0, x,, x ). (6) ( n The second condton means that the system condton does not change or deterorates as the component deterorates. If the system s non-coherent for component then for a partcular state of the rest of components the system s faled when component works and when component fals the system s restored to the non-faled condton. As a consequence of ths property, system falure mght occur due to the repar of a faled component or for a faled system the falure of an addtonal

5 component may gve a successful outcome of system performance. The fault tree becomes coherent f the NOT logc can be elmnated from the fault tree structure. Consder a smple example n Fgure 1. Cars A and B are approachng the juncton wth lghts on red and should stop. Car C has the rght of way and should proceed through the juncton. Three basc events are consdered: A Car A fals to stop, B Car B fals to stop, C Car C fals to contnue. The collson at the crossroads can happen n two ways: Car A fals to stop and hts car C whch s movng Car A stops but car B drves nto the back of t. A fault tree representng causes of falure of the collson s shown n Fgure 2. Workng n a bottomup way the followng logc expresson s obtaned. Top A C A B, where + s OR, s AND. Therefore, C A, and B A, are prme mplcants, as combnatons of component condtons (workng or faled) whch are necessary and suffcent to cause system falure. Ths lst s ncomplete because there s on more falure mode for the system: { B, C}.e. f B fals to stop and C contnues across the lghts t does not matter what A does there wll be a collson. Therefore, the full logc expresson for the Top event s:

6 Top A C A B B C, whch can be obtaned by applyng the consensus law: A X A Y A X A Y X Y. 3. Fault tree converson to Bnary Decson Dagram For the fault tree to be converted to a BDD t frst needs to be prepared so that n the non-coherent case the NOT logc s pushed down to the level of basc events by usng De Morgan s laws,.e. A B A B, (7) A B A B. (8) Each node n a SFBDD s defned by an te(f-then-else) structure. The te structure te(x, f 1, f 0 ) means that f x fals then consder functon f 1, else consder functon f 0. So, f 1 les on the 1 branch of x and f 0 les on the 0 branch n the dagram. Before the converson process takes place basc events n the fault tree are ordered. SFBDD constructon then moves through the fault tree n a bottom-up manner applyng the varable orderng n the converson process. Each basc event n the system s assgned an te structure: a = te(a,1,0). (9) Alternatvely, a basc event a s assgned an te structure: a = te(a,0,1). (10) For gates whose nputs have already been defned as an te structure the man rule of the converson process s appled,.e. f J = te(x, f 1, f 0 ) and H = te(y, g 1, g 0 ) represent two nputs to a gate of logc type, then:

7 J H te( x, f te( x, f 1 1 H, f g, f H) f x y n theorderng, g )f x y n theorderng. 0 (11) For small examples the varable orderng s largely rrelevant. Varable orderng schemes are dscussed n [11, 12]. For the fault tree example n Fgure 2 consder the varable orderng scheme A < B < C. Applyng the converson rules (9) - (11) to the fault tree results n a SFBDD presented n Fgure Calculaton of prme mplcant sets Knowledge of prme mplcant sets can be valuable n ganng an understandng of the system and the causes of system falure. It can help to develop a repar schedule for faled components f a system cannot be taken off lne for repar. For systems whose state has all the faled components n any prme mplcant care should be taken to ensure that the repar of other components does not then cause the remanng functonng events n the prme mplcant. The SFBDD whch encodes the structure functon cannot be used drectly to produce the complete lst of prme mplcant sets of a non-coherent fault tree and a converson process s usually performed to produce a dfferent form of a BDD whch encodes only the prme mplcants. Consder a general component x n a non-coherent system. In a prme mplcant set component x can appear n a faled or workng state, or can be excluded from the falure mode. In the frst two stuatons x s sad to be relevant, n the thrd case t s rrelevant to the system state. Component x can be ether falure relevant (the prme mplcant set contans x) or repar relevant (the prme mplcant set contans x ). A general node n the SFBDD, whch represents component x, has two branches. The 1 branch corresponds to the falure of x; therefore, x s ether falure relevant or rrelevant. Smlarly, the 0 branch corresponds to the functonng of x and so x s ether repar relevant or rrelevant. Hence t s mpossble to dstngush between the two cases for each branch and the prme mplcant sets cannot be dentfed drectly from the BDD. Therefore, addtonal methods for encodng prme mplcant sets are requred.

8 5. TDD method An approach to buld a Ternary Decson Dagram (TDD) for the analyss of non-coherent fault trees s proposed n ths secton. It employs the consensus theorem and creates, n addton to the two branches of the BDD, a thrd branch for every node, called the consensus branch. Ths thrd branch encodes the hdden prme mplcant sets. The mnmsaton algorthm [1] s appled to remove non-mnmal paths and obtan prme mplcant sets only. 5.1 Converson Every node n the TDD has three ext branches. A new fre structure s defned whch separates relevant and rrelevant components and also dstngushes between the type of relevancy,.e. falure relevant and repar relevant. The fre structure for a node x s gven n Fgure 4. So, f: = fre(x, f 1, f 0, f 2 ), (12) then = x f 1 + x f 0 + f 2, (13) where f 2 = f 1 f 0. (14) The 1 branch encodes prme mplcant sets for whch component x s falure relevant, the 0 branch encodes prme mplcant sets for whch component x s repar relevant, and the C (consensus) branch encodes prme mplcant sets for whch component x s rrelevant. The fre structure shown n Fgure 4 can be nterpreted as follows: If x s falure relevant then consder f 1, else f x s repar relevant

9 then consder f 0 else consder f 2 endf Functon f 2 encodes prme mplcant sets for whch x s rrelevant, but ths branch s not mportant for all components. For components that are only falure or repar relevant but not both ths branch can be kept empty. In our method we assgn f 2 = NIL, f the conjuncton of the two branches f 1 f 0 s not requred. Whle operatng the new symbol n the Boolean algebra, t s defned that NIL A= NIL. Symbol NIL s used to dentfy cases when the C branch s not requred and no Boolean operatons that nvolve ths branch are needed. The converson technque to compute the TDD from the non-coherent fault tree s an extenson of the method used to develop the conventonal BDD. Frst of all, basc events of the fault tree must be ordered. Then the followng process s presented: By the applcaton of De Morgan s laws push NOT logc down through the fault tree untl the basc event level s reached. Each basc event s assgned an fre structure: o If a s only falure or repar relevant: a = fre(a,1,0,nil), (15) a = fre(a,0,1,nil). (16) o If a s falure and repar relevant: a = fre(a,1,0,0) (17) a = fre(a,0,1,0) (18) Traversng the fault tree n a bottom-up manner and consderng gates whose nputs have been expressed n an fre format gves:

10 If J = fre(x, f 1, f 0, f 2 ) and H = fre(y, g 1, g 0, g 2 ), then fre( x, K1, K0, K1 K0 ) J H fre( x, L1, L0, L1 L0 ) f f x y n theorderng, (19) x y n theorderng. here K 1 f H, K f H 1 L 0 0, 1 f1 g1, L0 f0 g0, K 1 K 0 consensus of K 1 and K 0, L 1 L 0 consensus of L 1 and L 0. If component x s falure or repar relevant, K 1 K 0 = NIL, L 1 L 0 = NIL n equaton 19. Wthn each fre calculaton an addtonal consensus calculaton s performed to ensure all the hdden prme mplcant sets are encoded n the TDD. It calculates the conjuncton of the 1 and the 0 branch of every node and thus dentfes the consensus of each node. If a node n the TDD encodes component whch s only falure or repar relevant the conjuncton of the 1 and 0 branch for the node s not requred, because there are no hdden prme mplcant sets assocated wth ths component. Ths property makes the TDD method an effcent technque for performng the qualtatve analyss of non-coherent fault trees. Consder the fault tree n Fgure 2. Introducng the orderng of basc events A < B < C and applyng the rules descrbed n (15)-(19) gves the TDD n Fgure 5. It can be seen that the TDD n Fgure 5 s dfferent from the SFBDD n Fgure 3 only wth ts C branch that represents the ntersecton of the 1 and 0 branches. Only for node F1 there s a new structure F4 created as the C branch. The other nodes have the C branch leadng to value NIL, snce they encode varables that only appear as falure or repar relevant. To obtan prme mplcant sets non-mnmal combnatons from every path need to be removed.

11 5.2 Mnmsaton Once a fault tree s converted to a TDD there s no guarantee that the resultng structure wll be mnmal and gve exact prme mplcant sets. In order to perform the qualtatve analyss a mnmsaton procedure needs to be mplemented. The algorthm developed by Rauzy for mnmsng the BDD [1] was extended to create a mnmal TDD. Consder a general node n the TDD whch s represented by the functon F, where F = fre(x, G, H, K). (20) The process of mnmsaton s descrbed n three cases: 1. Component x s falure and repar relevant 2. Component x s falure relevant 3. Component x s repar relevant In case 1, the set of all mnmal solutons of F s mnmal solutons of G and H (G mn and H mn ), that are not mnmal solutons of K, and also all mnmal solutons of K (K mn ). Then f δ s a set of mnmal solutons of G, whch are not a mnmal soluton of K, then the ntersecton of δ and x ( x ) wll be mnmal solutons of F. Smlarly, let γ be a set of mnmal solutons of H whch are not mnmal solutons of K, then the ntersecton of γ and x ( x ) wll be mnmal solutons of F. The set of all the mnmal solutons of F (sol mn (F)) wll also nclude the mnmal solutons of K, so: sol mn (F) = ( x) ( x) K. (21) The set sol mn (F) represents the mnmal solutons of F by removng any mnmal solutons of G and H that are also mnmal solutons of K. mn

12 In case 2, where x s falure relevant, K = NIL and the calculaton of prme mplcant sets s equvalent adequate to the BDD case where the C branch does not exst,.e. sol mn (F) = ( x) H. (22) The set sol mn (F) represents the mnmal solutons of F by removng any mnmal solutons of G that are also mnmal solutons of H. mn In case 3, where x s repar relevant, K = NIL and the calculaton of prme mplcant sets s defned as: sol mn (F) = ( x) G. (23) The set sol mn (F) represents the mnmal solutons of F by removng any mnmal solutons of H that are also mnmal solutons of G. mn 5.3 Obtanng prme mplcant sets Traversng the TDD n Fgure 5, whch s already n ts mnmal form, from the root vertex to termnal 1 vertces gve all three prme mplcant sets. Agan, the algorthm depends on the relevance of node varable and the value of C branch. 1. If K NIL, traversng the 1 branch of node x results n a faled state of a component n a partcular falure mode. Traversng the 0 branch of node x results n a workng state of a component n a partcular falure mode. Fnally, traversng the C branch of node x does not nclude that component n a partcular falure mode at all. 2. If K = NIL and x s falure relevant, traversng the 1 branch of node x results n a faled state of a component n a partcular falure mode. Traversng the 0 branch of node x does not nclude that component n a partcular falure mode. 3. If K = NIL and x s repar relevant, traversng the 0 branch of node x results n a repared state of a component n a partcular falure mode. Traversng the 1 branch of node x does not nclude that component n a partcular falure mode.

13 The three paths obtaned gve the three prme mplcant sets: F1-F2 { A, C} F1-F3 { A, B} F1-F4-F5 { B, C} Ths method provdes an advanced technque for encodng prme mplcant sets. 5.4 Establshed methods for qualtatve analyss Ths secton presents the exstng methods for convertng non-coherent fault trees to BDDs and obtanng prme mplcant sets. In the later sectons the effcency of all methods, ncludng the TDD method, wll be nvestgated and compared usng some example fault trees Meta-products BDD method Ths method converts a SFBDD to a meta-products BDD whch produces all prme mplcant sets. A meta-products BDD obtaned s n ts mnmal form. The method was developed n [6,7] where two varables are assocated wth every component x. The frst varable, P x, denotes relevancy and the second varable, S x, denotes the type of relevancy,.e. falure or repar relevant. A meta-product, MP(π), s the ntersecton of all the system components accordng to ther relevancy to the system state and π represents the prme mplcant set encoded n meta-product MP(π): Px MP( ) Px Px S x f x, S x f x, f nether x nor x belongs to. (24) Consder node F n a SFBDD, where F = te(x, F1, F0). The meta-products BDD, that descrbes prme mplcant sets usng equaton (20), s expressed as: PI(F) = te(p x, te(s x, P1, P0), P2), (25) where

14 P2 = PI(F1 F0), P1 = PI(F1) P 2, P0 = PI(F0) P 2. x s the frst element n the varable orderng, PI(F) represents the structure of a meta-products BDD, PI s used to denote the prme mplcants. P2 encodes the prme mplcants for whch x s rrelevant, P1 encodes the prme mplcants for whch x s falure relevant and P0 encodes the prme mplcants for whch x s repar relevant. (26) (27) (28) The SFBDD n Fgure 3 has been converted to a meta-products BDD, shown n Fgure 6. Now t s possble to obtan the meta-products and dentfy the prme mplcant sets. Every path from the root node to a termnal 1 gves a prme mplcant set. P A S A PB PC SC { A, C} P A S A PB SB PC { A, B} P A PB SB PC SC { B, C} The number of nodes n a meta-products BDD ncreases largely snce every basc event x s presented by two nodes, P x and S x. The process can be tme-consumng ZBDD method An alternatve method presented by Rauzy n [8] uses the dea of zero-suppressed BDDs (ZBDD). Ths method requres to label nodes wth faled and/or workng states of basc events and to decompose prme mplcant sets accordng to the presence of a gven state of a basc event. Zerosuppressed BDDs are BDDs based on a reducton rule. Ths data structure provdes a unque and compact representaton whch s more effcent and smpler than the usual BDDs when manpulatng sets n combnatoral problems.

15 The prncple of ths algorthm s to traverse the SFBDD that encodes structure functon n a depthfrst way and to buld a ZBDD that encodes the prme mplcant sets of n a bottom-up way. The converson rule s dvded n four cases. Consder node F n a SFBDD, where F = te(x, F1, F0). Case 1: f basc event x appears n ts faled and workng states then: where PI(F) = xp1 xp0 P2, (29) P2 = PI(F1 F0), (30) P1 = PI(F1) \ P2, (31) P0 = PI(F0) \ P2. (32) Here \ s operator wthout [1] that s used mnmsng conventonal BDDs. Case 2: f basc event x appears n ts faled state only then where PI(F) = xp1 P0, (33) P0 = PI(F0), (34) P1 = PI(F1) \ P0. (35) Case 3: f basc event x appears n ts workng state only then t s consdered n a smlar way to case 2. Case 4: f basc event x does not appear n the system then PI(F) = PI(F1 + F0). (36) Applyng ths method to the SFBDD n Fgure 3 gves the ZBDD n Fgure 7. Every path from the root vertex to termnal vertex 1 presents a prme mplcant set. Therefore, ths ZBDD contans three prme mplcant sets: A C { A, C} A B { A, B}

16 B C { B, C} The ZBDD s an effcent technque where all prme mplcant sets are descrbed by a compact and easy handlng structure Labelled varable method The labelled varable method [9] provdes another alternatve method for constructng BDDs for noncoherent fault trees. BDDs constructed usng ths approach consst of varables that are labelled accordng to ther type. They are called labelled bnary decson dagrams (L-BDDs). The structure functon (x) of a non-coherent fault tree may contan three dfferent types of basc events. For example, the functon ( x) a b a c b c contans a double form (DF) varable a that appears n both states, a sngle form postve (SFP) varable b and a sngle form negatve (SFN) varable c. In the further presentaton the SFP varable x wll be smply presented by x, the SFN varable x wll be labelled as $x and the DF varable x wll be labelled as &x. The converson process for computng the L-BDD from the non-coherent fault tree s an extenson to the method used to develop the SFBDD. Consderng the orderng &x < x < $x mplements the addtonal equatons: If J = te(x, f 1, f 0 ) and H = te($x, g 1, g 0 ), then J H te (& x, f1 g0, f0 g1) If J = te(&x, f 1, f 0 ) and H = te(x, g 1, g 0 ), then J H te (& x, f1 g1, f0 g0) If J = te(&x, f 1, f 0 ) and H = te($x, g 1, g 0 ), Then J H te (& x, f1 g0, f0 g1) (37) (38) (39)

17 Applyng the converson rules to the fault tree n Fgure 2 results n a L-BDD presented n Fgure 8 (the top BDD). The L-BDD does not provde all the nformaton for the qualtatve analyss, therefore some addtonal calculatons are performed n order to get all prme mplcant sets. Vstng the L-BDD n the bottom-up way the procedure to be appled to the node F = te(x, F1, F0) to determne the prme mplcants s as follows: If x has label &, then: PI( F) xp1 $ xp0 P2 (40) where P2 F1 F0, P1 F1\ P2, P0 F0 \ P2. (41) Else: PI( F) P1 F0 (42) where x or $ x, P1 F1\ F0. (43) \ s the operator wthout proposed by Rauzy [1]. Some extra rules are appled n the cases wth labelled varables. The heavest operaton s the ntersecton P2 = F1 F0, shown n Fgure 8, the bottom BDD. The three prme mplcant sets are obtaned, tracng all paths from root vertex to termnal vertex 1 and takng nto account the results of ntersecton: & A $ C { A, C} & A B { A, B} B $ C { B, C}

18 The L-BDD method uses the pror nformaton about the type of every varable, however, the labellng ntroduces some addtonal varables and ncreases the sze of the structure. The three establshed methods for the calculaton of prme mplcant sets wll be consdered for the effcency test of the TDD method. 5.5 Quanttatve analyss usng TDDs In order to perform the quanttatve analyss for non-coherent fault trees usng the BDD method, a non-coherent fault tree s converted to a SFBDD that represents the structure functon of the fault tree. In the TDD method the non-coherent fault tree s converted to the TDD that has three branches from each node. The thrd branch s created to encode all prme mplcants of the system. However, the TDD can be used not only for the qualtatve analyss but also for the quanttatve analyss Top event probablty Consder node F n the TDD, F = fre(x, f 1, f 0, f 1 f 0 ). The structure functon (x) was expressed n (12),.e. ( x) xf1 xf0 f1 f0. Usng the pvotal decomposton to the structure functon of order n t s possble to express t n terms of structure functons that are of order n-1. Pvotng (x) about varable x and applyng the absorpton law gves: f1 f1 f0 x f0 f1 f0 xf1 x 0 ( x) x(1, x) x(0, x) x f. (44) Then the expectaton of (x) s obtaned and the top event probablty s calculated: Q SYS where q x s the falure probablty of component x. x q Q f ) 1 q Q( ) E. (45) x ( 1 x f0 Therefore, the probablty of the top event, Q SYS, s the sum of the probabltes of the dsjont paths through the TDD. The dsjont paths, that are taken nto account, can be found by tracng all paths from the root vertex va the 1 and 0 branches to termnal 1 vertces. The dsjont paths va the C branch are not ncluded n the quantfcaton process.

19 If f 1 f 0 = NIL, ( x) xf1 xf0 whch allows to calculate the Q SYS n the same way Brnbaum s measure of mportance The probablty that component s crtcal to system falure can be expressed as the probablty that component s falure crtcal, G F (q), or the probablty that component s repar crtcal, G R (q) [15]: F R, G ( q) G ( q) G ( q). (46) Beeson and Andrews [16] showed how to defne Brnbaum s measure of component falure mportance as the probablty that component s falure relevant to the system state gven by G F ( 1 ' ' q) E[ ] E[ ]. (47) where E[ 1] s the probablty that component s ether falure relevant or rrelevant to the state of the system; and E[ '' ] s the probablty that component s rrelevant to the state of the system. Smlarly s defned Brnbaum s measure of component repar mportance: G R ( 0 ' ' q) E[ ] E[ ]. (48) where E[ 0] s the probablty that component s repar falure relevant or rrelevant to the state of the system. It s possble to calculate E[ 1], E[ 1] and E[ 1] from the ternary decson dagram. The procedure for calculatng the falure and repar crtcalty of component s outlned below: 1, C E [ 1] prx ( q) po ( q). x x 0, C E [ 0] prx ( q) po ( q). x x (49) (50)

20 C E [ ' ' ] prx ( q) po ( q). x x (51) where: prx (q) - the probablty of the path secton from the root vertex to node x, 1, po C ( q) - the probablty of the path secton from the 1 branch of node x x to a termnal 1 vertex va 1 or 0 branches of non-termnal nodes, 0, po C ( q) - the probablty of the path secton from the 0 branch of node x x to a termnal 1 vertex va 1 or 0 branches of non-termnal nodes, po C (q) - the probablty of the path secton from the C branch of node x x to a termnal 1 vertex va 1 or 0 branches of non-termnal nodes. Therefore, the falure and repar crtcalty of component usng the TDD are expressed as: F 1, C C G ( q) prx ( q) po ( q) po ( q). x x x R 0, C C G ( q) prx ( q) po ( q) po ( q). x x x (52) (53) These expressons are true for every component that s falure and repar relevant [17]. For the other two cases,.e. when component s ether falure or repar relevant and the C branch s empty, Brnbaum s measure of mportance s expressed n the followng equatons. If component s only falure relevant, then: F 1, C 0, C G ( q) prx ( q) po ( q) po ( q). x x x (54) G R ( q) 0. (55)

21 If component s only repar crtcal, then: G F ( q) 0. (56) R 0, C 1, C G ( q) prx ( q) po ( q) po ( q). x x x (57) Usng the TDD n Fgure 5 and applyng the above equatons, the Brnbaum s measure of mportance can be calculated for all components n the system. For component A: For component B: G G F R A ( q) pc qb pc pb pc, GA q) qb qb pc qbqc F B ( q) pa, ( q) 0 G R B. (. For component C: G F R C ( q) 0, GC ( q) qa. Summarsng, f the quanttatve analyss s requred as well as the qualtatve analyss, the TDD before the mnmsaton can be used for the quantfcaton process. Addtonal calculatons for obtanng the SFBDD are not requred as t s requred n some of the establshed methods. Ths property makes the TDD method an effcent approach for full analyss of non-coherent fault trees 5.6 Effcency comparson between the TDD method and the establshed methods The effcency of the TDD method and the establshed methods for calculatng prme mplcant sets were nvestgated and compared usng a benchmark set of medum szed fault trees for engneerng systems from several ndustres. The performance over 16 example fault trees was obtaned, snce each method may perform well on some fault trees dependent upon the fault tree structure. The performance of each method over a range of test cases s montored. The complexty of the 16 fault trees s ndcated n columns 2, 3 and 4 of Table 1, representng the number of gates, the number of events and the number of prme mplcant sets n ther soluton. Example fault trees were smplfed pror to the converson process, usng the reducton [13] and modularsaton [14] technques. The number of complex and modular events are shown n columns 5 and 6.

22 The number of nodes usng the TDD method, the meta-products BDD method, the ZBDD method and the L-BDD method are presented n columns The number of nodes n the TDD method descrbes the sum of the number of nodes n the TDD before the mnmsaton (whch s also used for the quanttatve analyss) and the number of nodes n the TDD after the mnmsaton. The number of nodes for the second method covers the number of nodes n the SFBDD and the meta-products BDD. For the ZBDD method the sum of the number of nodes n the SFBDD and the number of nodes n the ZBDD s presented. The number of nodes n the L-BDD method contans the sum of the number of nodes n the L-BDD before applyng the mnmsaton, the number of nodes of the addtonal structures after applyng the conjuncton and the number of nodes n the mnmsed L-BDD. Smlarly, the processng tme covers the tme taken to convert example fault trees to BDDs and perform the qualtatve analyss. Results of processng tme are shown n columns of Table 1 for the four methods respectvely. Total number of nodes and processng tme for the four methods are shown n Table 2. As t s shown n Table 2 the TDD method performed as well as the ZBDD method. Both methods out performed the meta-products and L-BDD methods resultng n the smallest fnal BDDs n shortest calculaton tme. The L-BDD method gave the second worst result and the meta-products BDD method requred the longest processng tme snce the sze of the problem ncreased margnally. These results showed that the TDD method provdes an effcent way to represent prme mplcant sets, where hdden sets are obtaned by applyng the conjuncton of the two branches. It also has an ablty to do so only f t s requred, avodng the generaton of a structure that s not needed. Ths s acheved usng the nformaton about the falure/repar relevance of the component whch determnes f the conjuncton of the two branches s performed or not. The fnal advantage of ths technque s the fact that the quanttatve analyss can be also performed usng the TDD before the mnmsaton.

23 6. Conclusons Ths paper presents a new technque whch s developed for applcaton to fndng prme mplcant sets of non-coherent fault trees. Snce the ntroducton of NOT logc to the logc functon expands the calculaton tme and ncreases the sze of the problem, the BDD method can be used as an effcent way for qualtatve and quanttatve analyses of non-coherent fault trees. Ths paper proposes a new alternatve technque that produces a ternary decson dagram, whch allows the calculaton of all prme mplcants drectly. Its effcency s analysed and compared wth the establshed methods - the conventonal algorthm that produces a meta-products BDD, the zero-suppressed BDD method and the labelled BDD method - usng some example fault trees. Effcency analyss ndcates that the new proposed TDD method provdes as good a representaton of prme mplcant sets as other methods and has the advantage of beng sutable for both qualtatve and quanttatve analyses of non-coherent fault trees. References 1 Rauzy, A. New Algorthms for Fault Tree Analyss, Relablty Engneerng and System Safety, 1993, 40, pp Vesely, W.E. A Tme Dependent Methodology for Fault Tree Evaluaton, Nuclear Desgn and Engneerng, 1970, 13, pp Snnamon, R.M. and Andrews, J.D. Improved Effcency n Qualtatve Fault Tree Analyss, Qualty and Relablty Engneerng Internatonal, 1997, 13, pp Snnamon, R.M. and Andrews, J.D. Improved Accuracy n Quanttatve Fault Tree Analyss, Qualty and Relablty Engneerng Internatonal, 1997, 13, pp Andrews, J.D. To Not or Not to Not!!, Proceedngs of the 18th Internatonal System Safety Conference, 2000, pp

24 6 Courdet, O. and Madre, J.-C. A New Method to Compute Prme and Essental Prme Implcants of Boolean Functons, Advanced Research n VLSI and Parallel Systems, 1992, pp Dutut, Y. and Rauzy, A. Exact and Truncated Computatons of Prme Implcants of Coherent and Non-Coherent Fault Trees wth Arala, Relablty Engneerng and System Safety, 1997, 58, pp Rauzy, A. Mathematcal Foundaton of Mnmal Cutsets, IEEE Transactons on Relablty, 2001, 50(4), pp Contn, S. Bnary Decson Dagrams wth Labelled Varables for Non-Coherent Fault Tree Analyss, European Commsson, Jont Research Centre, Sasao, T. Ternary Decson Dagrams and ther Applcatons, Chapter 12, pp , Representatons of Dscrete Functons, Edted by Sasao, T. and Fujta, M. Kluwer Academc Publshers, Bartlett, L.M. and Andrews, J.D. Comparson of Two New Approaches to Varable Orderng for Bnary Decson Dagrams, Qualty and Relablty Engneerng Internatonal, 2001, 17, pp Bartlett, L.M. and Andrews, J.D. Selectng an Orderng Heurstc for the Fault Tree Bnary Decson Dagram Converson Process Usng Neural Networks, IEEE Transactons on Relablty, 2002, 51(3), pp Platz, O. and Olsen, J.V. FAUNET: A Program Package for Evaluaton of Fault Trees and Networks, Research Establshment Rsk Report, No. 348, DK-4000 Rosklde, Denmark, Dutut, Y. and Rauzy, A. A Lnear-Tme Algorthm to Fnd Modules of Fault Trees, IEEE Trans. Relablty, 1996, 45(3), pp Andrews, J.D. and Beeson, S. Brnbaum s Measure of Component Importance for Noncoherent Systems, IEEE Trans. Relablty, 2003, 52(2), pp

25 16 Beeson, S. and Andrews, J.D. Calculatng the Falure Intensty of a Non-coherent Fault Tree Usng the BDD Technque, Qualty and Relablty Engneerng Internatonal, 2004, 20, pp Remenyte-Prescott, R. System Falure Modellng Usng Bnary Decson Dagrams, Doctoral Thess, Loughborough Unversty, 2007