Common Mode Failures Research Articles

A subsystem based probabilistic approach for the assessment of transmission capital project reliability impacts

An efficient probabilistic approach for the assessment of transmission capital project impact is presented. The approach employs a subsystem based technique and takes advantage of the calculation accuracy of widely used commercial program for power flow analysis and accounts for equipment failure probability, variation in bus load, outage consequences and other system specific characteristics such as remedial action plan, specific operating procedures, tapped line and common mode failures. The approach also uses efficient computing techniques such as the breadth-first search algorithm and the recursive invocation method to facilitate the evaluation process. The proposed method is illustrated by evaluating and comparing several actual utility projects. The approach proposed in this paper will facilitate more realistic evaluation of large practical power systems using probabilistic methods.

Parametric explorative study of DEMO galleries pressurization in case of ex-vessel LOCA

Radioactive toxins confinement is a main safety function for fusion power plants, hence the importance of confinement design parameters optimization. Moving from this perspective, two Loss of Coolant Accidents (LOCAs) were analyzed: loss of water from Vacuum Vessel (VV) cooling loop and loss of cryogenic helium from Toroidal Field (TF) cooling loop. In fact these two LOCAs may result into galleries pressurization possibly jeopardizing this second confinement boundary for radioactive toxins.Publicly available ITER data (2000 baseline design) have been scaled to DEMO. A set of sensitivity simulation analyses are performed on main variables (coolant inventories, enthalpy, rooms volume, etc.) in order to derive resulting galleries pressure and temperature conditions.As first design feedback to keep gallery pressure below an assumed design pressure of 120kPa, the VV H2O LOCA requires pressure reduction (e.g. increase expansion volume, inventory partitioning, sprinkler), while TF He LOCA requires releasable inventory to be limited at about 4.4tons and Cryo-systems designed against Common Mode Failure (e.g. seismic and fire, quench valve failure).

Three-layer seasonal reliability analysis in meshed overhead and underground subtransmission networks in the presence of co-generation

This study presents a reliability assessment tool for meshed subtransmission networks in a three-layer structure. In this model, the three critical zones of influence, containing four blocks, are determined, described and quantified as reliability parameters. Moreover, this work is framed on the distinction between subtransmission networks consisted of underground cables (UGC) and overhead lines (OHL), accrediting attributed failure rates, repair times and intrinsic features under multiple circumstances and the seasonal variation of load and co-generation within them. For this achievement, the current analysis ascribes differentiation between adverse and normal weather conditions and the impact on considered equipment, as well as division of time period of analysis into different scenarios. This method is tested in the IEEE 30-bus network, as underground and as overhead networks, and in a typical Nordic 25-bus subtransmission network; and the influence of each of the four blocks is described at the end of this paper. As results, underground parts of the network exhibit more homogeneous outage time throughout the year than the overhead parts and the presence of co-generation improved reliability both in the directly connected substations and in the entire network. Furthermore, the block constituted by the substation equipment presents the largest influence on the system reliability. Similarly, common-mode failures in overhead networks introduce significant decrease on network availability.

Safety Critical Computer Systems: Failure Independence and Software Diversity Effects on Reliability of Dual Channel Structures

Abstract The paper examines Safety Critical real-time Systems (SCS), in particular their dual-channel structures. The analytical study on computer-based SCS recognizing failures comparing the results of both channels is based on the theory of reliability. The aim is to establish reliable models that include independence rate between failures of both channels and their diversity. The created formulas are used to calculate the function of reliability, probability of safety failures and hazard failures. The intensity of failures of the system and the intensity of its recovery, the ratio between Common Mode Failures (CMF) and failures of individual channels are explicitly presented in the models. for the independence of hardware and software Faults are introduced. The analytical models obtained allow evaluating the effects of independence of channels and the depth of their diversity. A formula for calculating the improvement of safety thanks to the dual-channel architecture in comparison to a single-channel structure of the same output reliability parameters has been worked out. Analytical models can be used to calculate indicators of systems in order to establish their compliance with safety standards. Analytical models can be used to calculate indicators of specific systems to determine their compliance with safety standards. The results make possible to find out technical solutions with better reliability and safety features.

系统级软件可靠性屋在运行时间框架模块上的应用

To improve the software reliability of the host computer subsystem in a simulation experimental system, a system-level House of Software Reliability (HOSR) was established. The Run-time Infrastructure (RTI) management module was taken as an example, the dependence of failure modes on the failure causes was analyzed and the relationships between the failure modes and the failure causes were discussed. The Failure Mode and Effects Analysis (FMEA) and Quality Function Deployment (QFD) were introduced. And then, the HOSR formed by FMEA with the system concept house from the QFD was described. According to the software level diagram of the host computer subsystem, the established library of failure modes and failure causes was used to fill HOSR. Finally, the failure of RTI management module was analyzed on the HOSR analysis matrix. The analytical results indicate that, in RTI management module, there are 23 potential failure modes, 35 potential causes of failure, 116 relationships between failure modes and failure causes, 9 relationships between the failure modes, 14 relationships between the failure causes. Analysis method can distinguish failure modes and failure causes much more comprehensive, especially for common-mode failures and common-cause failures. Meanwhile, it can significantly reduce the defect omission of brainstorming and staff workloads.

Reliability assessment of N-version software fault tolerant system with common mode failures

Common mode failures create the major impact on the system reliability in many real time systems. In this paper, we incorporate the concept of common mode faults (CMF) for the reliability prediction of fault tolerant software system consisting of N-version with different failure characteristics. The common mode faults may occur simultaneously in two or more versions due to faults in the common communication buses or shared environmental factors, failure of common source of power, design mistake, etc.. The recursive algorithm based on universal generating function approach is presented to obtain the system probabilities. Various performance measures of the fault tolerant software system are established. Furthermore, by setting appropriate parameters, some special cases are illustrated numerically.

A new self-diagnosing approach based on petri nets and correlation graphs for fault management in wireless sensor networks

In most fault-detection algorithms in wireless sensor networks (WSNs), each sensor compares its data with the data of neighboring nodes. The majority of comparative methods will not work properly if more than half of the neighboring nodes of a sensor are faulty. Moreover, such comparative methods are unable to detect common mode failures (CMFs). Hence, having noticed the deficiencies of the existing comparative methods and as a reaction against such problems, we introduced a novel self-diagnosing approach to reduce the effect of neighboring node's data in determining the status of nodes so that a sensor's status will be determined independently of any comparisons. A sensor will be deemed to be fault-free if its components and the inner links between the components are flawless. In this paper, the behaviors of the components of a sensor are independently analyzed by means of the proposed model based on Petri nets and the links of the sensor's components are investigated by means of the correlation graph. In addition, the authors extended and generalized the proposed method to all the nodes of a network and evaluated their operation. Simulation results showed that the modeling implemented by the HPSim tool can cover both permanent and transient faults accurately. Moreover, using the correlation graph and Pearson correlation coefficient helped us to gain confidence in the correctness of the inner links between the components of a sensor. Evaluation of the results indicated that the statistical results from the QI Macros tool were substantially similar to those from HPSim and Matlab tools. Furthermore, simulations results demonstrated that the detection accuracy and false alarm rate of the proposed method is acceptable even when the fault probability of each sensor is generally to be high. As a result, using these mechanisms leads to the development of the self-diagnosing capability in the sensors of a WSN.

The Common Mode Failure Analysis Based on Markov Model

Common Mode Failure (CMF) analysis is an important method for evaluating the reliability, safety and risk of complex systems. As the increasing in the system complexity, the common-mode question has become an important factor for conditioning the reliability and security of the control system. Based the discussion on the concepts of CMF, this paper provided a CMF analysis method using Markov model, including the modeling and analysis process. A case study was also presented to verify the feasibility of the analysis method.

JSSlicer: A Static Program Slicing Tool for JavaScript

The rapid development of Web 2.0 leads scripting language such as JavaScript to be ubiquitous in web pages; however the dynamic nature and flexibility of JavaScript make its development, debugging, maintenance, and reuse difficult. To improve the efficiency and accuracy of JavaSript security analysis, we propose a new JavaScript analysis method based on program slicing, together with a prototype-implemented JavaScript slicing tool, named JSSlicer. We also present a proof-of-concept application example of JSSlicer where an example of the common mode failure problem is tackled.

Software safety analysis application of safety-related I&C systems in installation phase

This work performed a software safety analysis (SSA) in the installation phase of the Lungmen nuclear power plant (LMNPP) in Taiwan, under the cooperation of INER and TPC. The US Nuclear Regulatory Commission (USNRC) requests licensee to perform software safety analysis (SSA) and software verification and validation (SV&V) in each phase of software development life cycle with Branch Technical Position (BTP) 14. In this work, 37 safety grade digital instrumentation and control (I&C) systems were analyzed by Failure Mode and Effects Analysis (FMEA), which is suggested by IEEE Standard 7-4.3.2 (2003). During the installation phase, skew tests for safety grade network and point to point tests were performed. The FMEA showed all the single failure modes can be resolved by the redundant architecture. The common mode failures can be resolved by operator manual actions via the diverse displays.

Disturbances in the European Nuclear Power Plant Safety Related Electrical Systems

Disturbances in the European Nuclear Power Plant Safety Related Electrical Systems This work is part of the European Clearinghouse on Nuclear Power Plant Operational Experience Feedback (NPP-OEF) activity carried out at the Joint Research Centre/Institute for Energy (JRC/IE) with the participation of ten EU Regulatory Authorities. It investigates the Forsmark-1 event of July 2006, as well as about 120 disturbances in the plant electrical systems that were reported to the Incident Reporting System (IRS) and US Licensee Event Reports (LER) in the period 1985-2008. The aim of the work was to provide important insights from the Forsmark event of July 2006 and illustrate some vulnerabilities of the plant electrical system to over voltage transients. It identified electrical equipment involved, failure modes, contributing factors, actual and potential consequences, and corrective actions. Initiating factors and associated root causes were also analysed. The analysis of International Operation Experience Feedback revealed number of events that involved disturbances in the plant electrical systems, and which may have features in common with the Forsmark-1 event. It underlines the importance of sharing lessons learned from design modifications made at another unit of similar design that if known, it could have identified susceptibility of emergency diesel generators to common mode failure before the event occurred. This paper also summarizes international projects that were initiated by Forsmark event, as well as important lessons that still can be learned from Forsmark event. This paper presents actions taken at nuclear power plants and regulatory authorities in different countries to prevent similar event to occur.

Markov Process-Based Availability Analysis of Rendering Cluster Systems

Considering common mode failure (CMF) in the rendering cluster systems, the availability of rendering cluster systems with the increase of cluster’s number was studied. Firstly, based on availability of system with one cluster node, system with two cluster nodes was modeled with continuous time markov chain (CTMC) model. Then, the CTMC model was extended to the case of system with three cluster nodes. Furthermore, by solving these three CTMC models, availability for different cases were numerically deduced. Additionally, during one year the unavailable time for different cases was calculated and analysis by comparison was conducted. Finally, conclusions on different cases’ advantages and disadvantages are derived thereby, which offers theoretical foundations for establishing rendering cluster systems.

Pressure Measurement Based on Thermocouples

Measuring gas pressures reliably in a harsh radiation environment was confirmed to be tricky during operation of the liquid spallation target of MEGAPIE at the Paul Scherrer Institute (PSI). Severe drift of calibration and the loss of a sensor were experienced. At the same time, the only instrumentation that worked flawlessly in the system were thermocouples. Motivated by this experience, a novel pressure sensor for application in high radiation fields has been developed, which is based on temperature measurement. The new sensor takes advantage of the fact that the thermal conductivity over a mechanical joint exhibits a strong dependence on the contact pressure. In the novel sensor heating is applied at one point and temperatures are measured at different specific locations of the pressure gage; in particular, the temperatures on the two sides of a mechanical contact are monitored. From the observed temperature distribution the gas pressure can be derived. By choosing specific mechanical details in the lay-out, it is possible to tailor the useful measurement range. In addition to yielding pressure values, the new sensor concept admits for obtaining a measure for the accuracy of the result. This is done by continuous self monitoring of the device. The health status and based thereupon the plausibility of the indicated pressure value can be deducted by comparing sensed temperatures to expectation values for any given heating power. Malfunctioning of the pressure gage is reliably detected from the diverse readings of only one device; this can be seen as providing internal redundancy while at the same time immunity to common mode failure. After some analytical and finite element studies to verify the concept in principle, a first prototype of such a novel pressure sensor has been built at PSI. Initial measurement campaigns demonstrated the correct operation of the device as anticipated. Further potential for optimization, like designing a gage for high temperature applications or the miniaturization of such sensors, has been revealed.

Fault and Error Containment of Gateways in Distributed Real-Time Systems

The composition of large embedded computer systems out of heterogenous clusters requires gateways that resolve property mismatches between networks with different communication protocols and diverse computational models. At the same time, fault and error containment mechanisms are needed in order to prevent common mode failures that could be induced by the propagation of faults between clusters. This paper presents gateways to systematically tackle these challenges. The introduced gateways contain structured collections of time-sensitive variables associated with timing information (called a realtime database). The real-time database facilitates fault and error containment by temporally decoupling clusters. For accessing the real-time database from attached networks, we introduce network adaptors that ensure compliance with temporal specifications expressed using state machines with timing constraints. The containment of faults within clusters is of particular importance for mixed-criticality systems and increases the robustness of the overall systems. The proposed solution is experimentally evaluated in an example system with a time-triggered Ethernet network and a Controller Area Network (CAN).

Special issue on swarm robotics

Swarm robotics is a new approach to the coordination of multi-robot systems. In contrast with traditional multi-robot systems which use centralised or hierarchical control and communication systems in order to coordinate robots’ behaviours, swarm robotics adopts a decentralised approach in which the desired collective behaviours emerge from the local interactions between robots and their environment. Such emergent or self-organised collective behaviours are inspired by, and in some cases modelled on, the swarm intelligence observed in social insects. The potential for swarm robotics is considerable. Any task in which physically distributed objects need to be explored, surveyed, collected, harvested, rescued, or assembled into structures is a potential real-world application for swarm robotics. The key advantage of the swarm robotics approach is robustness, which manifests itself in a number of ways. Firstly, because a swarm of robots consists of a number of relatively simple and typically homogeneous robots, which are not pre-assigned to specific roles or tasks within the swarm, then the swarm can self-organise or dynamically re-organise the way individual robots are deployed. Secondly, and for the same reasons, the swarm approach is highly tolerant to the failure of individual robots. Thirdly, the fact that control is completely decentralised means that there is no common-mode failure point or vulnerability in the swarm. Indeed, it could be said that the high level of robustness evident in robotic swarms comes for free in the sense that it is intrinsic to the swarm robotics approach, which contrasts with the high engineering cost of fault tolerance in conventional robotic systems. The realisation of the potential of swarm robotics requires the solution of a number of very challenging problems. Firstly, in algorithm design: swarm roboticists face the problem of designing both the physical morphology and behaviours of the individual robots such that when those robots interact with each other and their environment, the desired overall collective behaviours will emerge. At present there are no principled approaches to the design of low-level behaviours for a given desired collective behaviour. Secondly, in implementation

Impact of emergency shutdown devices on relief system sizing and design

In the sizing of individual relief valves protecting equipment or process or system, it is a common practice not to take cognizance of any immediate operator action or the action of any mitigating devices. However, an increasing number of consultants and practitioners are recommending not to apply the same philosophy when it comes to designing an overall refinery flare system to cope with common mode failures (e.g., loss of power, cooling water supply failure, etc.). They propose taking credit for the action of devices such as unit emergency shutdown (ESD) systems, trips (for example, fired heater fuel supply cut-offs), or autostarts of pumps whose actions reduce the potential load on the overall refinery flare system. Savings can thus be realized in the sizing of flare headers and other ancillary equipment. While there is no objection, in principle, to taking credit for ESDs in the design of relief systems, its application in practice deserves careful scrutiny. There are still many related issues that have not been adequately addressed by the proponents of the credit-taking approach. This paper highlights these concerns and offers practical advice to those facing relief system design decisions.

Impact of risk analysis on ITER nuclear buildings layout

The internal layout of ITER nuclear buildings (Tokamak, Tritium, Hot cell and Radwaste buildings) is the result of an iterative process. Notwithstanding civil engineering requirements, technical and functional requirements for the processes housed in the buildings, the internal layout must also take into account safety requirements and workers protection requirements in normal, incidental and accidental conditions. Potential hazards and constraints result in the definition of various zonings. Each room is classified depending on the level of the risks induced by normal and incidental or accidental conditions: • radiological exposure to tritium, and activated products ⇒ radiological zoning; • exposure to beryllium (vacuum vessel blankets) ⇒ beryllium zoning; • exposure to electromagnetic fields during plasma shots ⇒ electromagnetic zoning; • fire hazard: fire compartmentalization; • explosion hazard: anti-blast zoning; • waste treatment ⇒ waste zoning. Prevention of common mode failure due to internal hazards (fire, flooding, load drop…) for redundant safety important components is also taken into account by geographical separation or by installation of protections between components (either in the same room or preferably when possible by segregation in different rooms). The designer has also taken into account access requirements to equipments and circulation rules for personal, material and substances in ITER nuclear buildings. Risk analyses are performed in the Preliminary Safety Report in order to demonstrate that the layout of ITER nuclear buildings allows meeting the safety objectives and takes into account the requirements associated with the zonings classifications and complies with the regulation. When necessary, modifications are implemented in the design. For example, recent layout modifications are been studied in the tritium building: utility rooms (electrical supply) were transferred outside the radiological hazard zones. A direct access from the outside has been provided, so that personal can access these electrical rooms without having to go through radiological zones.

Interactions between process and utility systems

Utility systems have many connections to processes, both physical and electrical. This interconnectivity introduces common mode failures and the potential for crosscontamination. This article uses “real-plant” incidents to illustrate what can happen when the hazards of interactions between process and utility systems are not identified or understood. Some tools to evaluate interactions between process and utility systems are discussed. The reactivity matrix tool, which can help evaluate crosscontamination issues, is introduced. Individual types of utility systems and issues specific to them are discussed. © 2007 American Institute of Chemical Engineers Process Saf Prog:, 2007.

Failure Bunching Phenomena in Electric Power Transmission Systems

The physical environment in which a component resides can have a significant effect on the resulting reliability of the system. This is particularly true in electric power systems containing overhead transmission lines. Extreme weather conditions can create significant increases in transmission element stress levels leading to sharp increases in the component failure rates. The phenomenon of increased transmission line failures during bad weather is generally referred to as ‘failure bunching’. This condition should not be misconstrued as a common mode failure. This is an entirely different phenomenon and one that is important for multi-circuit transmission lines on single tower structures. This paper illustrates the inclusion of weather conditions in the reliability analysis of parallel redundant systems. A series of weather models are presented with application to electric transmission lines. The reliability effects of incorporating common mode failures in multi-circuit tower structures and independent events incorporating normal, adverse, and major adverse weather considerations in separated parallel line configurations are illustrated and examined. The applications described in this paper are to electric power transmission lines. The concepts of stress related failure bunching and common mode failures are, however, applicable to a wide range of engineering systems.

Diversity analysis in the presence of delay faults affecting duplex systems

This paper analyzes the problem of timing related common mode failures in redundant systems. The specific case of duplex systems in the presence of delay faults is analyzed by providing a probabilistic characterization of undetectable errors. PDF simulation was used to evaluate the probability of undetectable errors in conventional duplex systems and in duplex systems making use of a simple kind of data diversity.