Rare-Event Estimation for Dynamic Fault Trees

Transcription

1 Rare-Event Estmaton for Dynamc Fault Trees SERGEY POROTSKY Abstract. Artcle descrbes the results of the development and usng of Rare-Event Monte-Carlo Smulaton Algorthms for Dynamc Fault Trees Estmaton. For Fault Trees estmaton usually analytcal methods are used (Mnmal Cut sets, Markov Chans, etc.), but for complex models wth Dynamc Gates t s necessary to use Monte-Carlo smulaton wth combnaton of Importance Samplng method. Proposed artcle descrbes approach for ths problem soluton accordng for specfc features of Dynamc Fault Trees. There are assumed, that falures are non-reparable wth general dstrbuton functons of tmes to falures (there may be Exponental dstrbuton, Webull, Normal and Log-Normal, etc.). Expessons for Importance Samplng Re-Calculatons are proposed and some numercal results are consdered.. INTRODUCTION One of the mportant tasks of the Relablty Estmaton s Analyss of the Fault Tree. Buldng and calculaton of the Fault Tree are consdered n the [ - 3]. Usually analytcal methods are used (Mnmal Cut sets, Markov Chans, etc.), but sometmes, for complex models, t s necessary to use Monte-Carlo smulaton. A problem of Fault Trees calculaton s consdered one of the most complex ones, snce structure of such trees s characterzed by a consderable number of nterconnectons. Fault Trees wth Dynamc Gates are often used n some specfc felds of relablty. Examples of such gates are PAND (Prorty AND), SEQ (Sequence Enforcng), SPARE, etc. Classcal Fault Tree Analyss methods (Mnmal Cut Sets calculatons) are applcable only for Statc Fault Trees. Usng of analytcal methods, based on Markov Chan methods, are restrcted only for dynamc trees wth very low scalablty. For large Fault Trees may be used approxmate method, proposed on the SAE ARP 476 [] to calculate probablty of requred order of falures and to use calculated value as addtonal event. Unfortunately, ths approach was developed only for PAND gate and sn't applcable for other types of Dynamc Gates (SEQ, SPARE, etc.). Moreover, even for PAND gate ths approach get us only very and very approxmate estmatons and hard applcable for Fault Trees, whch have Basc Events wth dfferent Mean Values of Tme to Falure (MTTF). In general case the Monte Carlo method s used [4 6, 9 3]. Usually relablty estmaton has hgh requrements for Probablty for example, t has to be less than ; so, t wll be rare event. Estmaton of rare-event probablty by means of the drect Monte-Carlo method s mpossble, because t requres a lot of smulaton cycles (at least ). Standard way to reduce computatonal tme and to mprove the smulaton accuracy s the Varance Reducton technque (Importance Samplng) [7-9]. For rare-event estmaton the Importance Samplng method s used and most essental problem on ths method how to select approprate reference probablty dstrbuton. Unfortunately, well-known approaches (e.g., [7-9]) for reference dstrbuton selecton (scalng, translaton) are not applcable for Dynamc Fault Trees analyss. Reason s followng classcal rare-event estmaton task allows to calculate

2 Probablty{ S(x,,x N ) > T } for very large T, by means of Importance Samplng method usng. It s assumes, that functon S "s good n some sense", e.g. t s combnaton of Mn, Max, Sum, etc. Typcal example of the "good functon" S s shortest path calculaton. For Fault Tree rare-event estmaton the task s some another to calculate Probablty{ H(x,,x N ) < T }, where H s falure tme of the fault tree TOP, x,,x N are falure tmes of the basc events N, and T s msson tme. Certanly, t s possble to transform ths task for the classcal task by means of estmaton of Probablty{ /H(x,,x N ) > /T }, but n ths formulaton the functon S(x,,x N ) = /H(x,,x N ) wll not be "good" as supposed for the classcal task and so results of rare-event estmaton wll be non-correct. Proposed artcle descrbes approach for ths problem soluton accordng for specfc features of Dynamc Fault Trees. Some sngle aspects of ths problem are consdered n dfferent artcles, denoted for Fault Tree Monte Carlo smulaton. For example [4, 0] consder usng of Monte Carlo smulaton for Dynamc Fault Tree Analyss, but they use drect smulaton, so they are not applcable for rare event smulaton. Artcles [5, 9] propose to use Importance Samplng for estmate TOP probablty of Fault Trees. But suggested formulas don't allow take nto account order of events, so they are not applcable for dynamc fault trees. Artcle [6] consders Importance Samplng usng for Dynamc Fault Trees, but suggested formulas (as on [5]) correspond only for Statc Fault Tree, because they don't take nto account order of events. :Table of man defntons s below 2. ALGORITHM DESCRIPTION T N Length of Sysstem Lfe Amount of Basc events Index of Basc Event ( = N) x Falure Tme of -th Basc Event K Amount of Cycles to perform Man Smulaton(for default = 00,000) j f (t) F (t) g (t) G (t) P K_Prelm v Index of Smulaton Cycle ( j = K) Probablty Densty Functon (PDF) of -th Basc Event Falure Tme Cumulatve dstrbuton Functon (CDF) of -th Basc Event Falure Tme Reference Probablty Densty Functon of -th Basc Event Falure Tme Reference Cumulatve Dstrbuton functon of -th Basc Event Falure Tme Probablty of TOP Falure Amount of Cycles to perform Prelmnary Smulaton (for default = 000) Reference Parameter for Reference Probablty Densty functon g (t) of -th Basc Event 2

3 D AmPos AmPos_Up AmPos_Dn IC D_Up D_Dn Common (for all Basc Events) Secondary Reference Parameter Amount of smulaton cycles, for whch TOP = Falure Upper Bound of AmPos for Prelmnary Smulaton (for default = 00) Down Bound of Am_Pos for Prelmnary Smulaton (for default = 0) Iteraton Counter for step-by-step Prelmnary Smulaton Current Upper Bound of D value Current Down Bound of D value A Fault Tree s a Drected Acyclc Graph n whch the leaves are basc events and the other elements are gates. Usng Boolean Algebra Laws, usually any statc Fault Tree may be represented by means of two types of gates: AND gate whch fals f all nputs fal; OR gate whch fals f at least one of ts nputs fals. Other, more complex gates (e.g., "K out of M" gate, named as Votng gate), may be expressed as combnaton of AND gates and OR gates. Assume, that nputs for some gate are characterzed by the falure tmes of z,,z q there may be Basc Events or outputs of some ntermedate gates; let us y s falure tme of gate output. Durng Fault Tree Monte-Carlo smulaton we use followng formulas: For gate OR : y = mn{ z,,z q } () For gate AND : y = max{ z,,z q } (2) On the statc Fault Tree the value of "TOP = Falure" really depends only of Boolean states of the Basc Events (True Versus False),.e. really don't depend on falure tmes of Basc Events, rather on condton, when ths falure was before of after tme T. Dynamc Fault Trees extends statc Fault Trees wth the followng dynamc gates: Prorty AND gate (PAND) gate s a gate whch fals when all ts nputs fal from left to rght n order. For ths gate y = z q, f z z 2 z q ; else y = Infnte. (3) Sequence Enforcng gate(seq), for whch y = z + z 2 + +z q (4) SPARE gate, for whch y = z, f z 2 < a*z else y = (- a)*z + z 2. In ths formula "a" parameter s the dormancy factor of the second nput. (5) Consder Fault Tree wth Basc Events, for whch the falures are non-reparable wth Probablty Densty Functon (PDF) f (t) and Cumulatve Dstrbuton Functon (CDF) F (t); the correspondng probablty, that falure of Basc Event wll be before tme T, s p = F (T). Our task s to estmate the probablty of "TOP = Falure": P = Probablty{TOP = Falure}. For very small values of p ths rare event estmaton needs a very large number of smulatons. Importance Samplng approach get us possblty to deal wth new probabltes q nstead of real values p and so the man problem s to select optmal values for q values [5, 6, 9]. These approaches are 3

4 applcable only for Statc Fault Trees,.e. "TOP = Falure" s ndependent of dfferent falures tmes of Basc Events mportant only, these tmes less or more than tme T. For Dynamc Fault Trees the Important Samplng should use values of PDF functons f (t) nstead of probablty values p. Defne g (t) and G (t) new (reference) probablty densty and cumulatve dstrbuton functons for falure tme of Basc Event. Value of P wll be followng: N f t K j P It j N, where K j g t j K Amount of smulaton cycles, j ndex of smulaton cycle (j = K) N Amount of Basc Events, ndex of Basc Event ( = N) t j = (t j, t j,,t jn ) - vector of Basc Event falure tmes for smulaton cycle number j wth reference vector probablty densty functon g(t), j = K I(t j ) ndcator functon for smulaton number j, I(t j )=, f S(t j ) < T; otherwse, I(t j )=0. S(t) functon to calculate TOP accordng Fault Tree structure for vector t of Basc Event falure tmes However, the Fault Tree rare-event estmaton technque, based on these expressons, cannot always guarantee the successful results. For example, above formula for TOP probablty P doesn't get us correct soluton even for smplest case exponental PDF functon f (t) for all Basc Event falure tmes and smplest statc gate OR. Such a stuaton s typcal for a Fault Trees, n whch some gates are OR and some gates are PAND. To get correct soluton, t s necessaryto to modfy Importance Samplng expresson. If for some Basc Event the falure tme wll be more than tme T, t sn't sgnfcant for event "TOP = Falure" n what concrete tme was falure of the Basc Event. It s understood, that Dynamc Fault Tree should really use concrete values of Basc Event falure tmes, there are not enough to use only Boolean values (less than T or more than T) but only for values less than T! It has been proposed and proven, that for gates OR, AND, PAND, SEQ and SPARE: If the falure tme y of the gate output s less than tmr T, then t ndependent of concrete values x of gate nputs, for whch x T sgnfcant are only concrete values x, for whch x < T and boolean values (false) for whch x T. Ths statement allows modfyng the equaton for Probablty{TOP = Falure}: N f _ mod f t K j P It j N, where (6) K j g _ mod f t j 4

5 f_modf (t j ) = f (t j ), f t j <T, otherwse f_modf (t j ) = F (T) (7) g_modf (t j ) = g (t j ), f t j <T, otherwse g_modf (t j ) = G (T) (8) Such t s necessary to use Mxed Contnuous-Dscrete PDFs (both for ntal f(t) and reference g(t) ) nstead of usually used pure Contnuous PDFs. Based of above proposed modfed Importance Samplng equaton, were proposed the orgnal procedure to select the optmal values of reference probablty densty functons g (t). Reference probablty densty functons g (t) selecton for each Basc Event s started by buldng an ntal type of g (t). Although there are many knds of possble transformatons, the followng two approaches are most wdely used for Importance Samplng: Scalng and Translaton. For Scalng usng we defne g( t) f ( t / a). For example, f f(t) s Exponental PDF a wth f ( t) exp( t / u), we wll get, that g( t) exp( t / v) and, so, u v G( t) exp( t / v) where v s control (unknown and has to be defned) reference parameter. If f(t) s Webulll PDF wth f(t) = b*(u (-b) )*(t (b-) )*exp(-(t/u) b ), we wll get, that g(t) = b*(v (-b) *(t (b-) )*exp(-(t/v) b ), and, so, G(t) = - exp(-(t/v) b ), where v s reference control parameter. For Translaton usng we defne g(t) = f(t - a), where "a" s control parameter and has to be chosen. Other Importance Samplng Transformaton also may be used. For our pont of vew, for Dynamc Fault Tree rare-event estmaton the best soluton s to use Scalng transformaton. After the type of g (t) s selected for each -th Basc Event ( = N), t s necessary to choce the optmal value of the control parameter v. It s performed by means of Monte- Carlo smulaton of evaluated Falt Tree wth small amount K_Prelm of smulaton cycles (usually t s enough to use K_Prelm = 000). For current smulaton cycle frst there are calculated falure tmes for each of the Basc Events - accordng early bulded reference probablty densty functons g_modf (t) wth some control parameter v. For each Basc Event t s generated a random value x. These values are propagated through the fault tree accordng gates and formulas () (5). Ths s done untl the TOP node s arrved at whch pont a sampled falure tme of the entre tree s calculated. After ths the amount of smulaton cycles, for whch "TOP = Falure" tme less than tme T, s calculated value of AmPos. For each of the Basc Event number the followng equatons are proposed to calculate values of v : F (t) G (t) (9) D where D s some common (for all Basc Events) secondary control reference parameter. For usng of Importance Samplng Scalng transformaton the followng expressons are proved: 5

6 v log( D) / - for Exponental PDF of f (t) (0) u T v T u T b b log( D) - for Webull PDF of f (t) () Also may be used several secondary control reference parameters D,, D s. To defne values of prmary control reference parameters v,,v, v N some other expressons may be used. For frst teraton (IC = ) the reference parameters v are setted equaled for u for all Basc Events N (t corresponds D = ). It s necessary to perform Fault Tree Monte- Carlo prelmnary smulaton (accordng PDF functons g_modf (t) of Basc Events and formulas () (5) ). After ths the Amount of smulaton cycles (from full amount of smulaton cycles, equaled to K_Prelm), for whch tme of the {TOP = Falure} less than tmet, s calculated - t s Am_Pos. If after frst prelmnary smulaton wth K_Prelm cycles we get AmPos[IC=] > 0, Importance Samplng sn't requred and t s necessary smply to contnue smulaton up K smulaton cycles. If AmPos[IC=] == 0, t s necessary to choce v values. Followng man schema to defne optmal values of v s proposed: If AmPos_Dn AmPos AmPos_Up, the current values v are selected as optmal else t s necessary to change value of D accordng receved values of AmPos on prevous smulaton steps, to ncrement Iteraton Counter (IC) and to repeat Monte-Carlo smulaton of the Fault Tree wth new v values (due to new D value, accordng formulas (9) ()) and same sample sze of K_Prelm smulaton cycles. For default the "tuned" values are settled as: K_Prelm = 000, AmPos_Dn = 0, AmPos_Up = 00. Detals of proposed procedure of D changng, based on method of secants, are presented on fg.. After the optmal values of the reference parameters v are calculated, t s performed the fnal Monte-Carlo smulaton of evaluated Dynamc Falt Tree wth amount K of smulaton cycles (usually t s enough to use K = 00,000). Calculaton of the value of P s performed accordng formulas (6) (8). 6

7 IC =, D =, D_Dn =, D_Up = Infnte Monte-Carlo Smulaton of K_Prelm cycles wth updated v reference parameters < AmPos_Dn AmPos? > AmPos_Up Yes D_Dn = D D_Up=I nf No AmPos_Up and AmPos_Dn Fnsh D_Up=D D = 2*D_Dn D = (D_Dn + D_Up)/2 IC = IC + 7

8 FIG.. Schematc flowchart to select optmal values of reference parameter. 3. NUMERICAL EXAMPLE Consder Fault Tree wth followng parameters: T =, N = 4, F(t) = - exp(-t/u)), where u = 000*, = N. Structure of the Fault Tree s followng: TOP = (BE AND BE2 AND BE3) PAND (BE2 AND BE3 AND BE4), where BE s Basc Event wth ndex. It s seen, that ths Fault Tree has strong overlap between two parts each of the part contants 3 BEs, and 2 BEs of them are common for two parts. To select optmal value of the Secondary Reference Parameter D t was performed the Monte-Carlo smulaton of 000 cycles (.e. K_Prelm = 000). Table below llustrates proposed method explanng a quck way of fndng the optmal values of reference parameters. INPUT OUTPUT IC D_Dn D_Up D AmPos Inf 0 (< AmPos_Dn) 2 Inf fnal 5 ( AmPos_Dn & AmPos_Up) Based on D = 2.0 we have calculated reference parameters v accordng expressons v / u log( D) T Fnal Monte-Carlo smulaton was performed wth K = 00,000 cycles accordng reference parameters v, = N. Fnal Results after Importance Samplng usng (.e after re-calculatons) are followng: P(TOP) = 3.2e-4, STD = 4.9e-6, so Confdence Interval for TOP probablty s [3.0e-4 3.4e-4] wth Confdence Level of

9 It was also attempted to perform drect Monte-Carlo smulaton (.e. wthout Importance Samlng and re-calculatons) of the analysed Fault Tree. Results after performng of the,000,000,000 cycles were "zero",.e. no TOP events were observed. So, although for comparson wth proposed algorthm t was used of 0,000 tmes more Amount of Cysles, results of drect smulaton are negatve. 4. CONCLUSIONS In ths artcle we have ntroduced a new algorthm for calculaton of the Dynamc Fault Trees. A general purpose Importance Samplng methodology s used for ths algorthm development. Man goal was to estmate rare-event Probablty of the {TOP = Falure} n an Dynamc Fault Tree havng a pluralty of Basc Events. It was assumed, that for each of thebasc Events, the falures are non-reparable and falure tmes are accordng general dstbuton functon (Exponental, Webull, Normal, Log-Normal, etc.). Dynamc Fault Tree may nclude both Statc gates (AND, OR and based of them composed gates as "K out of M", etc.) and Dynamc gates (PAND, SEQ, SPARE, etc.). The method beng performed by the followng steps: a) based on the PDF and CDF for each of the Basc Events, t s constructed a modfed, mxed Contnous-Dscrete, reference PDF. b) based on ths modfed reference PDF performng step-by-step prelmnary Monte-Carlo smulaton of Dynamc Fault Tree untll condtons of optmal reference parameters selecton wll be satsfyed; c) selecton of the optmal prmary reference parameter for each of the Basc Events by means of the optmzaton under some one common (for all Basc Events) secondary reference parameter D. d) based on ths optmal value of the secondary reference parameter D and correspondng prmary reference parameters for each of the Basc Events, performng full Monte-Carlo smulaton of the Dynamc Fault Tree and correspondng Importance Samplng re-calculaton. The smulaton have gote accurate enough answers and s able to calculate the unavalablty for systems whch cannot be analytcally analyzed. References [] SAE, The Engneerng Socety for Advancng Moblty Land Sea Ar and Space Internatonal, Aerospace Recommended Practce. Gudelnes and Methods for Conductng the Safety Assessment Process on Cvl Arborne Systems and Equpment. ARP476 (Dec. 996). [2] L. Sants, E. Hugues, C. Bès, M. Mongeau. Computng In-Servce Arcraft Relablty. Internatonal Journal of Relablty. Qualty and Safety Engneerng, Volume: 6, Issue: 2(2009) pp. 9-6 [3] Fault Tree Handbook wth Aerospace Applcatons. NASA Headquarters. Washngton, DC August,

10 [4] K. Dugra Rao, V. Gopka, V. V. S. Sanyas Rao, H. S. Kushwaha, A. K. Verma, A Srvdya. Dynamc fault tree analyss usng Monte Carlo smulaton n probablstc safety assessment. Relablty Engneerng and System Safety, vol. 94, No 4, 2009, pp [5] C. H. Jun and S. M. Ross. System relablty by smulaton: random hazards versus mportance samplng. Probablty n the Engneerng and Informaton Scence, vol. 6, 992, pp [6] O. Yevkn. An Improved Monte Carlo Method n Fault Tree Analyss. 200 Proceedngs of the Annual Relablty and Mantanablty Symposum (RAMS 200) [7] R. Y. Rubnsten. Optmzaton of Computer smulaton Models wth Rare Events. European Journal of Operatons Research, 99, 89-2, 997. [8] A. Rdder and R. Y. Rubnsten. Mnmum Cross-Entropy Methods for Rare Event Smulaton. Smulaton Vol. 83, pp , [9] D.P. Kroese and K. P. Hu. Applcatons of the Cross-Entropy Method n Relablty. Computatonal Intellgence n Relablty Engneerng., pp , 2006 [0] H. Boudal, A.P.Njmejer, M. I. A. Stoelnga. DFTSm: a smulaton tool for extended dynamc fault trees. Proceedngs of the 2009 Sprng Smulaton Multconference. San Dego, Calforna [] J. B. Dugan, S. J. Bavuso, M. A. Boyd. Dynamc fault tree models for fault tolerant computer systems". IEEE Transactons on Relablty, 992, vol. 4, No 3, pp [2] R. Gulat and J.B. Dugan. A Modular Approach for Analyzng Statc and Dynamc Fault Trees. 997 Proceedngs of the Annual Relablty and Mantanablty Symposum, Phladelpha (RAMS 997), pp [3] J. B. Dugan, K. J. Sullvan, D. Coppt. Developng a low-cost, hgh-qualty software tool for dynamc fault tree analyss. Transactons on Relablty, December 999, pp