Professional Documents
Culture Documents
Bill Vesely
NASA HQ
Mission Success Starts With Safety
Inductive and Deductive Modeling are the
Two Basic Types of Modeling
Inductive models forwardly induce the consequences
of an event.
Induce Forwards
2
Mission Success Starts With Safety
An Inductive Model Defines Scenarios
for an Initiating Event
3
Mission Success Starts With Safety
A Deductive Model Resolves the Causes
for an Event
3
Mission Success Starts With Safety
Fault Tree Analysis: a Systematic and
Stylized Deductive Process
4
Mission Success Starts With Safety
5
Mission Success Starts With Safety
6
Mission Success Starts With Safety
7
Mission Success Starts With Safety
8
Mission Success Starts With Safety
9
Mission Success Starts With Safety
11
Mission Success Starts With Safety
12
Mission Success Starts With Safety
13
Mission Success Starts With Safety
ACCIDENT
MAXIMUM TOLERABLE FAILURE
(CAR DAMAGED; NO PERSONAL INJURY)
MINOR ACCIDENT
FLAT TIRE
TRAFFIC JAM
TRAFFIC CONGESTION
LOST HUBCAP
ARRIVES AT 8:30
TOTAL SUCCESS (NO DIFFICULTIES WHATSOEVER
14
Mission Success Starts With Safety
16
Mission Success Starts With Safety
Door Bell Example Differentiating Failure
Modes and Failure Mechanisms
17
Mission Success Starts With Safety
Failure Modes and Mechanisms of the Door
Bell System
Failure Effect Failure Mode Mechanism
Switch fails to Contacts broken Mechanical shock
make contact High contact resistance Corrosion
Bell-solenoid unit Clapper broken or not attached Shock
fails to ring Clapper stuck Corrosion
Solenoid link broken or stuck Open circuit in solenoid
Insufficient magneto-motive Short circuit in solenoid
force
Low voltage from No electrolyte Leak in casing
battery Positive pole broken Shock
18
Mission Success Starts With Safety
19
Mission Success Starts With Safety
Review Questions
21
Mission Success Starts With Safety
Top Undesired
Event
Logic Gates
Intermediate
Events
Basic Events
22
Mission Success Starts With Safety
The Four Necessary Steps to
Begin a Fault Tree
1. Define the undesired event to be analyzed (the focus
of the FTA)
23
Mission Success Starts With Safety
Define FTA
Scope
Interpret/
Identify FTA Define FT Define FTA Construct Evaluate
Present
Objective Top Event Resolution FT FT
Results
Define FTA
Ground Rules
24
Mission Success Starts With Safety
Undeveloped Event
Basic Event
25
Mission Success Starts With Safety
26
Mission Success Starts With Safety
Motor
Battery
27
Mission Success Starts With Safety
28
Mission Success Starts With Safety
OR
OR
A
29
Mission Success Starts With Safety
No EMF
from Battery
OR
Battery Fails
No EMF
to produce EMF
to Battery
OR
30 B
Mission Success Starts With Safety
No EMF
across Switch
OR
31
Mission Success Starts With Safety
BVA CVA
CVB
BVB
32
Mission Success Starts With Safety
gate description
Intermediate
Event (Gate) gate identifier
gate logic type
event identifier
(Basic Cause)
primary event identifier
33
Mission Success Starts With Safety
G1
Logic Gate
A Fa ils B O R C Fa il
Intermediate event
A G2
B Fa ils C Fa ils
B C
Gate or Event
Identifier
Basic events
34
Mission Success Starts With Safety
OVERRUN OF ANY MOTOR
AFTER TEST IS
INITIATIED
G019
G023
FOR T>60 SEC
G024 A Typical
EMF REMAINS ON K5 KS RELAY CONTACTS K2 RELAY CONTACTS EMF NOT REMOVED FROM
Fault Tree
COIL FOR T>60 SEC FAIL TO OPEN FAIL TO OPEN K2 RELAY COIL WHEN K5
CONTACTS CLOSED FOR
t>60 SEC
TEST SIGNAL REMAINS K5 RELAY CONTACTS EMF TO K1 COIL THRU EMF TO K1 COIL THRU
ON K3 COIL FOR t>60 FAIL TO OPEN TIMER CIRCUIT WHEN K5 S1 CONTACTS WHEN K5
SEC CONTACTS CLOSED FOR CONTACTS CLOSED FOR
t>60 SEC t>60 SEC
B095 B096
35
Mission Success Starts With Safety
36
Mission Success Starts With Safety
37
Mission Success Starts With Safety
The OR Gate
The OR Gate represents the logical union of the
inputs: the output occurs if any of the inputs occur
The OR gate is used when an event is resolved into
more specific causes or scenarios
The OR gate is used when a component failure is
resolved into an inherent failure or a command
failure
The OR gate is used when an event is described in
terms of equivalent, more specific events
38
Mission Success Starts With Safety
An OR Gate Resolving A Component
Failure into Specific Failures
VAL VE IS FAIL ED
CLOSED
G001
VAL VE IS C L O S ED D U E VAL VE IS C L O S ED D U E
T O H AR D W AR E FAIL U R E T O T ES T IN G
B001 B002
VAL VE IS C L O S ED D U E
TO H U M AN ERROR
B003
39
Mission Success Starts With Safety
40
Mission Success Starts With Safety
P O W E R U N A V A I L A B L E
T O D C B U S
G 0 0 1
F U E L C E L L 1 I S B A T T E R Y I S F A I L E D
F A I L E D
B 0 0 1 B 0 0 2
F U E L C E L L 2
I S F A I L E D
B 0 0 3
41
Mission Success Starts With Safety
Summary of OR and AND Gates
OU TPU T Q
OR Gate G0 0 1
+
(Logical Plus Gate) IN P U T A IN P U T B
B001 B002
OU T P U T Q
AND Gate G0 0 1
(Multiplication Gate)
IN PU T A IN PU T B
B001 B002
42
Mission Success Starts With Safety
Q OCCU RS
G0 0 1
A OCCU RS AN D TH EN B B OCCU RS AN D TH EN A
OCCU RS OCCU RS
G0 0 2 G0 0 3
43
Mission Success Starts With Safety
44
Mission Success Starts With Safety
Expanded Types of Terminating Events
45
Mission Success Starts With Safety
B A S I C E V E N T - A b a s ic in it ia t in g f a u lt r e q u ir in g n o f u r t h e r d e v e lo p m e n t
C O N D I T I O N I N G E V E N T - S p e c if ic c o n d it io n s o r r e s t r ic t io n s t h a t a p p ly t o
a n y lo g ic g a t e ( u s e d p r im a r ily w it h P R I O R I T Y A N D a n d I N H I B I T g a t e s )
U N D E V E L O P E D E V E N T - A n e v e n t w h ic h is n o t f u r t h e r d e v e lo p e d e it h e r
b e c a u s e it is o f in s u ffic ie n t c o n s e q u e n c e o r b e c a u s e in fo r m a tio n is
u n a v a ila b le
H O U S E E V E N T - A n e v e n t w h ic h is n o r m a lly e x p e c t e d t o o c c u r
G A TE SYM B O LS
A N D - O u t p u t f a u lt o c c u r s if a ll o f t h e in p u t f a u lt s o c c u r
O R - O u t p u t f a u lt o c c u r s if a le a s t o n e o f t h e in p u t f a u lt s o c c u r s
n C O M B I N A T I O N - O u t p u t f a u lt o c c u r s if n o f t h e in p u t f a u lt s o c c u r
E X C L U S IV E O R - O u tp u t fa u lt o c c u r s if e x a c tly o n e o f th e in p u t fa u lts
o c c u rs
P R IO R IT Y A N D - O u tp u t fa u lt o c c u r s if a ll o f th e in p u t fa u lts o c c u r in a
s p e c ific s e q u e n c e ( th e s e q u e n c e is r e p r e s e n te d b y a C O N D IT IO N IN G
E V E N T d r a w n t o t h e r ig h t o f t h e g a t e )
IN H IB IT - O u tp u t fa u lt o c c u r s if th e ( s in g le ) in p u t fa u lt o c c u r s in th e
p r e s e n c e o f a n e n a b lin g c o n d itio n ( th e e n a b lin g c o n d itio n is r e p r e s e n te d
b y a C O N D T I O N I N G E V E N T d r a w n to t h e r ig h t o f t h e g a t e )
TR A N SFER SYM B O LS
T R A N S F E R IN - In d ic a te s th a t th e tr e e is d e v e lo p e d fu r th e r a t th e
o c c u r r e n c e o f t h e c o r r e s p o n d in g T R A N S F E R O U T ( e . g . , o n a n o t h e r p a g e )
T R A N S F E R O U T - I n d ic a t e s t h a t t h is p o r t io n o f t h e t r e e m u s t b e a t t a c h e d
a t t h e c o r r e s p o n d in g T R A N S F E R I N
46
Mission Success Starts With Safety
O -R I N G F A I L U R E T < T (c r it ic a l)
G0 0 2 B003
EXIS T EN CE O F
T EM P ERAT U RE T
B004
47
Mission Success Starts With Safety
Transfer Gates
48
Mission Success Starts With Safety
Review Questions
49
Mission Success Starts With Safety
51
Mission Success Starts With Safety
Remember the Four Key Attributes of a
Fault Tree
Top Event- What specific event is being analyzed?
52
Mission Success Starts With Safety
Defining the Boundary and Resolution of
the Fault Tree
The boundary defines what is inside the analysis
and what is outside the analysis
The resolution defines the basic causes to be
resolved
The boundary defines the interfaces to be included
or excluded
The resolution defines what types of events are
modeled
53
Mission Success Starts With Safety
54
Mission Success Starts With Safety
55
Mission Success Starts With Safety
The initial state for the FTA defines the initial states of
components, initial conditions, and initial inputs assumed
The initial states for the components involve what
components are assumed to be initially operational
The initial state can also involve the past history
description of the component
Initial conditions include assumed environments and
operational conditions
Initial inputs include assumed initial commands, assumed
failures existing, and assumed events that have occurred
56
Mission Success Starts With Safety
A Fault Tree Distinguishes Faults
Versus Failures
The intermediate events in a fault tree are called faults
The basic events, or primary events, are called failures
if they represent failures of components
It is important is to clearly define each event as a fault
or failure so it can be further resolved or be identified
as a basic cause
Write the statements that are entered in the event boxes as faults; state
precisely what the fault is and the conditions under which it occurs. Do not
mix successes with faults.
57
Mission Success Starts With Safety
A Fault Tree Distinguishes a Component
Fault From System Fault
58
Mission Success Starts With Safety
Component Fault Versus System Fault
(Continued)
59
Mission Success Starts With Safety
Gates for Component Versus System
Faults
For a state of component fault use an OR gate if the
fault is not a failure (basic event)
For a state of system fault the gate depends on the
event description
If the fault event is classified as state of component, add an OR-gate below the event
and look for primary, secondary and command failure modes. If the fault event is
classified as state of system, look for the minimum necessary and sufficient immediate
cause or causes. A state of system fault event may require an AND-gate, an OR-gate,
an INHIBIT-gate, or possibly no gate at all. As a general rule, when energy originates
from a point outside the component, the event may be classified as state of system.
60
Mission Success Starts With Safety
Example of
Component
Versus System
OPERATING STATE
Faults FAULT CLASSIFICATION
Switch fails to close when State of component
thumb pressure is applied.
Switch inadvertently opens State of component
when thumb pressure is
applied
Motor fails to start when State of component
power is applied to its
terminals.
Motor ceases to run with State of component
power applied to terminals
STANDBY STATE
FAULT CLASSIFICATION
Switch inadvertently closes State of component
with no thumb pressure
applied.
Motor inadvertently starts. State of system
Mission Success Starts With Safety
62
Mission Success Starts With Safety
Primary failure
under normal
environment
Secondary
failure under
abnormal
environment Abnormal
condition exists
63
Mission Success Starts With Safety
64
Mission Success Starts With Safety
65
Mission Success Starts With Safety
66
Mission Success Starts With Safety
67
Mission Success Starts With Safety
P R A F a ilu r e D a ta fa ilu r e
S u b
s y s te m C o m p o n e n t
C o m p o n e n t ID M o d e
T y p e
A_O_LH2_DISCVL_FTCM
A_O_LH2_DISCVL_FTCE Valve, 17" fails to
LH2 A_O_LO2_DISCVL_FTCE Disconnect close
E_O_LDS_ACTLUL_JAM
E_O_LDS_ACTRUL_JAM Actuator, hyd
LDS E_O_LDS_ACTNUL_JAM uplock jams
68
Mission Success Starts With Safety
70
Mission Success Starts With Safety
Attribute
Fault
Attribute
Fault
Undesired Event
Attribute
Fault
Attribute
Fault
71
Mission Success Starts With Safety
Review Questions
72
Mission Success Starts With Safety
73
Mission Success Starts With Safety
Defining the FT Key Attributes for the
Monopropellant System Fault Tree
74
Mission Success Starts With Safety
I n e r t g a s is o la tio n
v a lv e I V 1
In e rt g a s p re ssu re
K 3 re g u la to r R G 1
In ert g a s ch e ck
v a lv e C V 1
R e lie f
v a lv e R V 2
P ro p e lla n t ta n k
w ith b la d d e r
PT1
S3 R e lie f
v a lv e R V 3
T h r u s te r is o la tio n
v a lv e
IV 2
S2 T im e r re la y R e lie f v a lv e
K 6 R V 4
K 5 T h ru s t c h a m b e r in le t
v a lv e
K 4 IV 3
C a ta ly s t
76
Mission Success Starts With Safety
The system consists of a reservoir TK1 of inert gas that is fed through an isolation valve IV1 to a
pressure regulator RG1. The pressure regulator RG1 senses pressure downstream and opens or
closes to control the pressure at a constant level. A check valve, CV1 allows passage of the inert
gas to the Propellant Tank PT1. Separating the inert gas from the propellant is a bladder that
collapses as propellant is depleted. Propellant is forced through a feed line to the Thruster
Isolation Valve IV2 and then to the Thrust Chamber Inlet Valve IV3. For the Thruster to fire, the
system must first be armed, by opening IV1 and IV2. After the system is armed, a command is
sent to IV3, to open, allowing H2O2 into the thrust chamber. As the propellant passes over the
catalyst, it decomposes producing the byproducts and heat and the expanding gas that creates the
thrust. The relief valves RV1-4 are available to dump propellant overboard should an
overpressure condition occur in any part of the system.
77
Mission Success Starts With Safety
The electrical command system controls the arming and thrusting of the propellant
system. To arm, switch S1 is momentarily depressed, allowing electromotive force
(emf) to activate relay switches K1, K2 and K3, and open valves IV1 and IV2. K1
closes and sustains the emf through the arming circuit. K2 momentarily opens to
preclude the inadvertent firing of the system during the transition to the armed mode,
and closes when S1 is released. K3 closes in the firing circuit. The system is now
armed with power supplied to sustain IV1 and IV2 in the open position. When firing
switch S2 is momentarily depressed, K4 closes sustaining the firing circuit. K5 closes
completing the circuit for K6, which begins timing to a predetermined time for the
thruster to fire. The completed circuit opens IV3 and thrusting begins.
78
Mission Success Starts With Safety
System Description: Termination of
Thrusting
When K6 times out, it momentarily opens breaking the arming circuit and opening K1.
Power is removed from the IV1 and IV2 relays and both valves are spring-loaded
closed. K3 opens breaking the firing circuit, which opens K4 and K5. IV3 is spring-
loaded closed, and the system is in now in the dormant mode. Should K6 fail and
remain closed after timing out, the system can be shut down manually by depressing S3,
which breaks the arming circuit, opening K1 and closing IV1 and IV2. The firing
circuit relay switch K3 will open breaking the firing circuit, which causes K4 and K5 to
open. When K5 opens, IV3 will be spring-loaded closed, and the system will be in the
dormant mode.
79
Mission Success Starts With Safety
80
D orm ant M ode A rm ed M ode
R V 1, 2, 3, 4 C losed Mission
R V 1, 2, 3,Success
4 C losed Starts With Safety
IV 1 C losed T ransition to arm ed m ode IV 1 O pen
RG1 A s is RG1 R egulating
CV1 C losed CV1 C losed
S1 m om entarily closed
IV 2 C losed K 1 closes IV 2 O pen
IV 3 C losed K 2 m om entarily opens IV 3 C losed
S1 O pen K 3 closes S1 O pen
S2 O pen IV 1 opens S2 O pen
S3 C losed IV 2 opens S3 C losed
K1 O pen K1 C losed
K2 C losed K2 C losed
K3 O pen K3 C losed
K4 O pen K4 O pen
K5 O pen K5 O pen
K6 C losed K6 C losed
T ransition to
T hrust M ode
T ransition to
State transition D orm ant M ode
C V 1 opens
IV 3 opens
diagram K 6 opens m om entarily (tim es out)
IV 1 closes
K 4 closes
K 5 closes
C V 1 closes
IV 2 closes K 6 tim ing
IV 3 closes
K 1 opens
K 3 opens
K 4 opens
K 5 opens
THRUSTER IS SUPPLIED
WITH PROPELLANT AFTER
THRUST CUTOFF
G1
82
Mission Success Starts With Safety
Fault Tree Construction Step 2
T H RU ST ER S U P P L IED
W IT H P ROP EL L AN T
AFT ER T H RU S T
CU T O FF
G1
G2
E2
83
Mission Success Starts With Safety
84
Mission Success Starts With Safety
Valve Isolation
Training Material Valves
Failure
Inadequate Strength
Propellant
Volume Valve Lack of focus on
Lack of Internals safety
Specification Clogged
Time out
time Switch
Lack of Contacts
Specification Corroded
85
Mission Success Starts With Safety
86
Mission Success Starts With Safety
87
Mission Success Starts With Safety
Modeling of Human Error Contribution
and Test Contribution
VAL VE IS FAIL ED
CL OSED
G0 0 1
VAL VE IS CL OS ED D U E VAL VE IS CL OS ED D U E
TO H ARD W ARE FAIL U RE TO TESTIN G
B001 B002
VAL VE IS CL OS ED D U E
TO H U M AN ERRO R
B003
88
Mission Success Starts With Safety
Modeling of More Detailed Human Error
Contributions
G0 0 3
B004 B005
89
Mission Success Starts With Safety
Questions to Determine Whether to
Include a Human Error Contribution
1. Can an crew error cause the fault?
2. Can a test or maintenance error cause the fault?
3. Can a processing error cause the fault?
4. Can a calibration error cause the fault?
5. Can the fault be recovered by a human action?
6. Is a human action necessary for proper
functioning?
7. Can an inadvertent human error result in other
faults occurring?
90
Mission Success Starts With Safety
91
Mission Success Starts With Safety
Performance Shaping Factors for Human
Error Probabilities
CRE AM Perform ance Factors
Cognitive Function
Factor Level O bservation Interpretation Planning Execution
Adequacy of Very efficient 1.0 1.0 0.8 0.8
O rganization Efficient 1.0 1.0 1.0 1.0
Inefficient 1.0 1.0 1.2 1.2
Deficient 1.0 1.0 2.0 2.0
W orking Conditions Advantageous 0.8 0.8 1.0 0.8
Com patible 1.0 1.0 1.0 1.0
Incom patible 2.0 2.0 1.0 2.0
Adequacy of M an Supportive 0.5 1.0 1.0 0.5
M achine Interface Adequate 1.0 1.0 1.0 1.0
Tolerable 1.0 1.0 1.0 1.0
Inappropriate 5.0 1.0 1.0 5.0
Availability of Appropriate 0.8 1.0 0.5 0.8
Procedures Acceptable 1.0 1.0 1.0 1.0
Inappropriate 2.0 1.0 5.0 2.0
Num ber of Fewer than capacity 1.0 1.0 1.0 1.0
m ultaneous G oals M atching capacity 1.0 1.0 1.0 1.0
M ore than capacity 2.0 2.0 5.0 2.0
Available Tim e Adequate 0.5 0.5 0.5 0.5
Tem porarily inadequate 1.0 1.0 1.0 1.0
Continuously inadequate 5.0 5.0 5.0 5.0
Tim e of day Day-tim e 1.0 1.0 1.0 1.0
Night-tim e 1.2 1.2 1.2 1.2
Adequacy of Adequate, high experience 0.8 0.5 0.5 0.8
raining/Preparation Adequate, low experience 1.0 1.0 1.0 1.0
Inadequate 2.0 5.0 5.0 2.0
Crew Collaboration Very efficient 0.5 0.5 0.5 0.5
Q uality Efficient 1.0 1.0 1.0 1.0
Inefficient 1.0 1.0 1.0 1.0
Deficient 2.0 2.0 2.0 5.0
Mission Success Starts With Safety
93
Mission Success Starts With Safety
Examples of CCFs
1. A common design or material deficiency that results in multiple components
failing to perform a function or to withstand a design environment. Examples
include undetected flaws in main engines and low material strengths in turbo
pumps.
2. A common installation error that results in multiple components being
misaligned or being functionally inoperable. Examples include check valves
being installed backwards that remained undetected because they were not
tested after installation.
3. A common maintenance error that results in multiple components being
misaligned or being functionally inoperable. Examples include multiple
valves remaining in a misaligned position after maintenance.
4. A common harsh environment such as vibration, radiation, moisture or
contamination that causes multiple components to fail.
95
Mission Success Starts With Safety
Examples of CCFs Usually Included
in FTA
Redundant sensors having a common calibration
procedure
Redundant components that can be left in the wrong
configuration due to a common test or maintenance
Redundant components that are supplied by the
same supplier that have not been independently
tested
Redundant components that have common
processing that are not subsequently independently
checked
96
Mission Success Starts With Safety
Modeling of CCFs in a FT
CCF
97
Mission Success Starts With Safety
T H REE CO M P O N EN T S FAIL
G0 0 1
G0 0 2 G0 0 3
CO M P O N EN T 2 FAIL S D U E
T O IN D EP EN D EN T CAU S ES
B002
98
Mission Success Starts With Safety
Quantification of CCFs: the Beta
Factor Model
= beta factor
= the probability that a failure cause results
multiple failures
P(C1 C2 C3) = P( C1)
values range from 0.3 to 0.01 when CCF
susceptibilities exist
values are given in various PRAs and data sources,
e.g., the Space Shuttle PRA
99
Mission Success Starts With Safety
100
Mission Success Starts With Safety
101
Mission Success Starts With Safety
Multiphase FTA
102
Mission Success Starts With Safety
Component
Failure
103
Mission Success Starts With Safety
Phase Changes in Event Probabilities
Cont.
Changes in event probabilities can alternatively be
handled in the quantification stage
AB (A1+A2+A3)(B1+B2+B3)
System Failure
105
Mission Success Starts With Safety
Fault Trees Used in Multi-Phase
Event Sequence Modeling
1 succeeds 2 succeeds.
1 succeeds 2 fails
1 fails 2 succeeds
1 fails 2 fails
106
Mission Success Starts With Safety
B-A A-E
107
Mission Success Starts With Safety
Review Questions
108
Mission Success Starts With Safety
FT Exercise Problem
109
Mission Success Starts With Safety
110
Mission Success Starts With Safety
Steps in Qualitatively and Quantitatively
Evaluating the Fault Tree
Each gate event is expressed as a logic equation of input
events
By successive substitution, each gate event is express
in terms of basic events
The resulting gate equation is expanded and simplified
to be a sum of products (sop)
The resulting equations provide a basis for qualitative
and quantitative evaluations
111
Mission Success Starts With Safety
Representation of the Gate Events of
the Monopropellant Fault Tree
112
Mission Success Starts With Safety
Representation of the Basic Events of
the Monopropellant Fault Tree
113
Mission Success Starts With Safety
Logic Equations for the
Monopropellant Fault Tree
G1 = G2 G3
G2 = G4 + E2
G3 = G5 + E1
G4 = G6 + E3
G5 = G8 G9
G6 = G7 + E4
G7 = G8 G9
G8 = E7 + E8
G9 = E5 + E6
114
Mission Success Starts With Safety
116
Mission Success Starts With Safety
The Minimal Cutsets Provide Key
Qualitative Information
117
Mission Success Starts With Safety
Basic Boolean Relationships Used in
Fault Tree Evaluations
A(B + C) = AB + AC Distributive Law
A+A=A Identity Union Law
(Identity Absorption Law)
A + AB = A Subset Absorption Law
AA = A Identity Intersection Law
(Idempotent Law)
(A + B)= AB Union Complementation Law
(AB)= A + B Intersection Complementation
118
Mission Success Starts With Safety
Q OCCURS
G001
BI OR B2 OCCURS B2 OR B3 OCCURS
G002 G003
119
Mission Success Starts With Safety
120
Mission Success Starts With Safety
The Minimal Cut Set Equation (Sum of
Products) for the Monopropellant Tree
121
Mission Success Starts With Safety
Description of the Minimal Cutsets of the
Monopropellant Tree
122
Mission Success Starts With Safety
Review Questions
123
Mission Success Starts With Safety
124
Mission Success Starts With Safety
Basic Formulas for Primary Event Probabilities
(P(E))
125
Mission Success Starts With Safety
Details of Formulas: P = c
128
Mission Success Starts With Safety
A s s e m b ly ,
G y r o R a te n o o u tp u t n o o u tp u t per hour 4 .E - 0 6 1 .E - 0 5
A s s e m b ly ,
s ta r tr a c k e r n o o u tp u t n o o u tp u t per hour 1 .E - 0 6 3 .E - 0 6
s tru c tu r a l s tru c tu ra l
B o d y F la p f a ilu r e f a ilu r e per hour 1 .E - 0 7 3 .E - 0 7
f a ils to per
B ra k e c lo s e fa il t o c lo s e dem and 1 .E - 0 5 3 .E - 0 5
129
Mission Success Starts With Safety
fa il to
P um p, hyd f a ils t o r u n o p e ra te per hour 1 .E -0 6 3 .E -0 6
f a ils t o per
P um p, hyd s ta rt fa il to s ta r t dem and 2 .E -0 4 3 .E -0 4
S e n s o r , t e m p f a i ls h i fa il h ig h per hour 4 .E -0 7 1 .E -0 6
S e n s o r , t e m p f a i ls lo w fa il lo w per hour 4 .E -0 7 1 .E -0 6
V a lv e , f a ils t o per
bypass pneu open fa il to o p e n dem and 2 .E -0 4 3 .E -0 4
V a lv e , tra n s fe rs
bypass pneu open tra n s fe r o p e n p e r h o u r 1 .E -0 6 3 .E -0 6
130
Mission Success Starts With Safety
Steps in Quantifying Component Failure
Probabilities
1. Identify the specific component failure mode
2. Determine whether the failure is time-related or demand-
related
3. Determine the environment e.g., ground or air
4. Select the appropriate failure rate value
5. For a time-related failure determine the exposure time
6. For a time-related failure, if the failure is repairable
determine the repair time
7. For a demand-related failure, determine the number of
demands if greater than 1
8. Input into the software package or if a manual
evaluation use the appropriate formula to quantify
131
Mission Success Starts With Safety
132
Mission Success Starts With Safety
Quantification of the Minimal Cutsets for
the Monopropellant Tree
G1=2-04+3-05+1-06+6-07+6-07+1.5-07+4-08 = 2.3-04
133
Mission Success Starts With Safety
135
Mission Success Starts With Safety
Review Questions
137
Mission Success Starts With Safety
Three Basic Importance Measures Used
for Prioritization in FTA
FV Importance (Contribution Importance)- the relative
contribution to the top event probability from an event.
Risk Achievement Worth RAW (Increase Sensitivity,
Birnbaum Importance)- the increase in the top event
probability when an event is given to occur (probability set
to 1).
Risk Reduction Worth RRW (Reduction Sensitivity)- the
reduction in the probability of the top event when an event
is given to not occur (probability set to 0).
138
Mission Success Starts With Safety
Calculation of the Importance
Measures
139
Mission Success Starts With Safety
Basic Event Importance Measures for
the Monopropellant Example
FV RRW RAW
Basic Event Importance (Reduction) (Increase)
Operational Fail to Open S3 0.993 0.993 0.023
Primary Time Out Failure of K6 0.867 0.867 0.01
Primary Fail to Open of K6 0.13 0.13 0.01
Primary Fail to Open of S3 0.005 0.005 0.023
Primary Fail to Close of IV2 0.003 0.003 0.003
Primary Fail to Open of K3 0.003 0.003 0.0002
Primary Fail to Close of IV3 0.0001 0.0001 0.0002
140
Mission Success Starts With Safety
Questions on the Monopropellant
Illustration
1. Why is the Operational Failure of S3 so high?
2. Why is the Primary Failure of K6 so high?
3. Why is importance of IV2 higher than IV3?
4. What components should be a focus of upgrades?
5. What is the potential improvement from such upgrades?
6. What components can be the focus for relaxations?
7. If the system fails, where should diagnosis be focused?
8. What possible changes can reduce the failure
probability?
9. What are other system failures (top events) that can be
analyzed?
141
Mission Success Starts With Safety
142
Mission Success Starts With Safety
143
Mission Success Starts With Safety
FT Uncertainty Propagation
Validating an FTA
145
Mission Success Starts With Safety
146
Mission Success Starts With Safety
147
Mission Success Starts With Safety
Primary
Switch
Standby
Basic events as
defined by the
above event
149
Mission Success Starts With Safety
150
Mission Success Starts With Safety
Special DFTA Software Can Be Used to
Expedite the FTA
151
Mission Success Starts With Safety
DFTA Exercise
152
Mission Success Starts With Safety
153
Mission Success Starts With Safety
The Use of FTA to Understand System Failure
and its Contributors
154
Mission Success Starts With Safety
FTA: Understanding/Communicating
155
Mission Success Starts With Safety
The Use of FTA to Identify Design Features and
Weaknesses
156
Mission Success Starts With Safety
157
Mission Success Starts With Safety
The MLD Identified the Initiating Events in the
Space Shuttle PRA
158
Mission Success Starts With Safety
Dispositioning of the Initiating Events in the
PRA
159
Mission Success Starts With Safety
Structure of the MLD for the Space Shuttle PRA
160
Mission Success Starts With Safety
The Space Shuttle MLD Continued
LOCV
LOCV LOCV
MISSION-based ABORT-based
LOCV During LOCV During LOCV During LOCV During LOCV During LOCV During LOCV During
Pre-Launch Ascent Orbit Descent/Landin Ascent ABORT Orbital ABORT Landing ABORT
g
161
Mission Success Starts With Safety
Further Development of the IE-MLD for Fires and Explosions on Ascent
L O C V D ue to L oss o f
Stru ctu ral I nte grity C ause d b y
Fire/E x plosion d u rin g As ce nt
L O C V -Ascent-LS-F irE xp
2
1
APU cause d F ire/E xplosio n SRB cause d Fire/E xplosion M PS cause d OM S/R CS cau sed
Fire/E x plosion Fire/E x plosion
FC P fue l le ak
M PS H2 le ak M PS O2 le ak
161
Mission
Cross-Reference of Hazard Reports Success
with Starts With Safety
MLD Events
162
Mission Success Starts With Safety
List of Accident Initiating Events Identified in the
IMLD (MPS Related Initiators)
U SA M L D M is s i T h re a t e n e H a z a rd P ro b R e fe re n A n al y s t In d i vid u a l H a z a r d D e s c r ip t i o n
en
H a za rd in i ti a on d F u n c t io n C a t e g o ry C a t e g o ry c e E S D R e m a rk s
qu
N u m be r e ve n P h a s m
N am es
se
te
F /P T yp e S ev L ike FT / E J u s ti
on
ys
t e
S
C
T f ic a ti
A
R
on
P
I g n it i o n o f F la m m a b le A t m os p h e re a t t h e E T / O rb i t e r L H 2 U m bi l ic a l
IN T G 0 0 6 4 PA MPS LOC V SI P FE A c D is c o n n e c t A s s e m b ly
I s o la ti o n o f t h e E T fro m t h e O rb i t e r M P S o r S S M E s ( 1 7 i nc h va lv e b u rs t s
IN T G 009 6 P M P S LOC V S I F C HE F FE A c o p e n u n d e r pr e s s ur e fro m E T )
IN T G 016 12 PA M P S LOC V SI FC P FE A c I g n it i o n S o u rc e s Ign i t i n g F la m m a b le F l u id s i n th e A f t C o m p a rt m e n t
IN T G 019 390 A M P S LOC V FC F SE A c P re m a t u re s h u td o w n o f o n e o r m o re S S M E 's
IN T G 020 18 A M P S LOC V SI FC P FE A c H y d ro g e n A c c u m ul a t i o n i n th e A ft C o m p a rt m e n t D u ri n g A s c e n t
C o n t a m i n at io n in t h e In t e g ra t e d M a in P ro p u l s io n S y s t e m (w hi c h c l o gs
IN T G 023 20 A M P S LOC V SI FC P FE A c t he s y s t e m )
IN T G 034 24 P A M P S LOC V SI FC P FE A c A u t o ig n i t i o n in H i g h P re s s u re O x y ge n E n vi ro n m e n t (i n M P S )
IN T G 041 392 P A M P S LOC V FC F FE A c L o s s o f M P S / S S M E H e s u p p ly pr e s s ur e
IN T G 042 32 P A M P S LOC V SI P SE A c T u rb o p u m p F r a gm e n ta t i o n D ur in g E n g in e O p e ra t io n
IN T G 112 48 A D M P S LOC V SI FC P FE A c H 2 / O 2 C o m po n e n t L e a k a g e D u ri n g A s c en t / E n t ry
IN T G 112 49 A D M P S LOC V SI FC P FE A c H 2 / O 2 C o m po n e n t L e a k a g e D u ri n g A s c en t / E n t ry
IN T G 168 81 P A M P S LOC V SI FC EE A c F la m m a b le A t m o s p he r e i n th e E T I n t e rt a n k (s e e 2 3 8 )
H y d ro g e n A c c u m ul a t i o n i n th e O rb i te r C o m p a r t m e n ts D u r in g R T L S / T A L
OR BI 035 102 AD MPS LOC V SI FC P FE A c A b o rt
I g n it i o n o f O r b it er F l ui d s E n t ra p p e d i n t h e T C S M a t e ri al s ( a ft
OR BI 045 107 P A O DM P S LOC V S I F C HE P FE A c c o m p a rt m e n t)
O ve rp re s s u ri z a ti o n o f t h e O rb it e r A f t F u s e la g e C a u s e d b y t he F a i lu r e o f
OR BI 108 133 P A O DM P S LOC V SI P SE A c a n M P S H e li u m R e g u la t o r o r R e l ie f V a lve
L o s s o f S t ru c t ur a l In t e g r it y D u e t o O ve rp re s s u ri z a ti o n o f t h e M id a n d /o r
OR BI 278 187 P A O DM P S LOC V SI P SE A c A ft F u s e la g e
F ir e / E x p lo s io n in t h e O r b it er A ft C o m p a rt m e n t C a u s e d b y M P S
OR BI 306 205 PA MPS LOC V SI FC P FE A c P ro p e ll a n t L e a k a g e / C om p o ne n t R u pt u re
OR BI 338 219 PA MPS LOC V SI FC P FE A c G O 2 E x t e rn a l T a n k P re s s u ri z a tio n L in e a s M P S / A P U I g n it io n S o u rc e
F ir e / E x p lo s io n in t h e O r b it er A ft C o m p a rt m e n t C a u s e d b y C on t a m in a t io n
OR BI 343 224 PA MPS LOC V SI FC P FE A c i n th e M a in P r op u l s io n S y s te m F e e d S y s te m
IN T G 0 8 5 4 4 P MPS LOC V SI P FE A d I g n it i o n o f F la m m a b le A t m os p h e re a t T - 0 U m b il ic a l s
M a l fu n c t io n o f th e L H 2 a n d L O 2 T -0 U m bi l ic a l C a r ri er P la t e R e s u l t i n g in
IN T G 0 8 9 45 PA MPS LOC V SI F SE A d D a m a g e t o S h u t t le V e h i c le
IN T G 1 5 3 71 P MPS LOC V SI P EE A d P o t e n t i a l G e y s e ri ng in th e L O 2 F e e d Li n e ( Ts a t = b o i li ng p o in t )
IN T G 1 6 6 79 P MPS LOC V SI FC P SE A d P re m a t u re S e p ar a t i o n o f O rb i te r T -0 U m b i li c a l C a rr ie r P la t e
O ve rp re s s u ri z a ti o n o f L O 2 O rb i te r B l e ed S y s t em o r L H 2 R e c ir c u la ti o n
IN T G 1 6 7 8 0 P M P S LOC V S I FC P SE A d S y s te m
M E-F G 3P, 346 PA M P S LOC V S I P SE A d g e y s e ri n g o f L O X ( M P S ) (s e e 7 1 )
M E-F G 6S, 354 P M P S LOC V S I P SE A d a b n o rm a l t h ru s t l o a d s
M E-F G 8M 356 A M P S LOC V S I P SE A d t hr u s t o s c i ll a ti on s le a d in g t o p o g o ( s ee 3 )
OR BI 248 172 P A O DM P S LOC V S I FC P FE A d F ir e / E x p lo s io n in G O X P r es s u r iz a t i o n S y s t e m
M E-F A1S 310 P M P S S I FC FE C c h y d ro g e n f ir e /e x p lo s i on e x t e rn a l t o a ft c o m p a rtm e n t ( s ee 2 1 )
164
Mission Success Starts With Safety
The Shuttle PRA Process
iagram Over-arching
E v e nt Logic D Event Trees
g
Initiatin
165
Mission Success Starts With Safety
OK xxxxx
LOCV-DMP 1 xxxxx
Success
LOCV-ETSEP 2 xxxxx
LOCV-MECO 3 xxxxx
Failure
ETSEP-SHUTDW-LOCV
LOCV due to Top #5
ETSEP/Shutdown LOCV
Sequence failure
166
Mission Success Starts With Safety
Extending a System Fault Tree to a
Master Hazard Diagram (MHD)
The top event is defined as a system failure event
The fault tree is developed to the basic component
level
Each component failure is further resolved into
hazards and conditions that can cause failure or
increase its likelihood
The resulting system MHD identifies the hazards
affecting the system and their consequences
Of particular importance are single failures and
hazards affecting multiple redundant components
167
Mission Success Starts With Safety
Ranking the Criticality of Hazards Using
FTA
Each hazard is linked to a basic event or events on the
fault tree
Equivalently each hazard is linked to the basic events in
the minimal cutsets
The criticality of the hazard is the likelihood of the
hazard times the importance of the basic event
The component importance is determined from the FTA
The likelihood is determined from the hazard analysis
Hazard Criticality=Likelihood x Importance of
Components Affected
168
Mission Success Starts With Safety
169
Mission Success Starts With Safety
Command
Enable/Disable
Command
Software Module
Enable/Disable
Command
Software Module
Initiation of Thrust
171
Mission Success Starts With Safety
FTA in Design
173
Mission Success Starts With Safety
174
Mission Success Starts With Safety
175
Mission Success Starts With Safety
176
Mission Success Starts With Safety
177
Mission Success Starts With Safety
Reducing the Probability of the
Monopropellant Failure to Terminate Thrust
What are the options for reducing the probability of
failure to terminate thrust in the monopropellant
example?
How do these options effect the probability of no
thrust for the other monopropellant example?
Are there options which reduce both probabilities?
What criteria can be used to determine whether
such reductions are needed or are effective?
178
Mission Success Starts With Safety
179
Mission Success Starts With Safety
Diagnostic FTA
182
Mission Success Starts With Safety
184
Mission Success Starts With Safety
Top Part of Monopropellant Success Tree
G1
OR
185
Mission Success Starts With Safety
Success Tree Construction Step 2
THRUSTERNOT SUPPLIED
WITH PROPELLANT
AFTER THRUST
CUTOFF
G1
OR
ISOLATION VALVE ISOLATION VALVE IV2
IV3 DOES NOT REMAIN OPEN NOT REMAINS OPEN
AFTER CUTOFF AFTER CUTOFF
G2
AND
NO E2
186
Mission Success Starts With Safety
Minimal Path Sets from the Minimal
Cut Sets
Take the complement of the union of the minimal
cut sets (mcs)
Carry out Boolean manipulation to obtain a union of
intersections
The intersections, or combinations of events, are
the minimal path sets (mps)
The set of minimal path sets is the totality of
combinations of preventions stopping the top event
from occurring
187
Mission Success Starts With Safety
T=E6E7+E6E8+E5E7+E5E8+E1E3+E1E4+E1E2
Take the complement (denoted by a superscript):
T=(E6E7+E6E8+E5E7+E5E8+E1E3+E1E4+E1E2)
Apply the Union Complementation Law
T=(E6E7)(E6E8)(E5E7)(E5E8)(E1E3)(E1E4)(E1E2)
T=(E6+E7)(E6+E8)(E5+E7)(E5+E8)(E1+E3)(E1+E4)
(E1+E2)
T=E6E5E1+E7E8E1+E6E5E3E4E2+E7E8E3E4E2
188
Mission Success Starts With Safety
189
Mission Success Starts With Safety
190
Mission Success Starts With Safety
191
Mission Success Starts With Safety
192
Mission Success Starts With Safety
Reference
193