Common Mode Failures Research Articles

Modelling multistate problems in sequential simulation of power system reliability studies

The paper presents a new approach for taking into account multistate units and common-mode outages in sequential Monte Carlo simulation. Although the state space transition diagrams for multistate units and common-mode outages are well established, they can only be utilised in random or nonsequential simulation, and not in sequential simulation. Using an equivalent or derating-adjusted forced outage rate for generating units instead of a multistate model can lead to pessimistic results. Usually, the common-mode failure rate is small compared with independent failure rates, but such failures may have severe consequences on the power system performance. Many utilities are, therefore, now using multistate and common-mode representations for composite power system adequacy analysis. The conventional sequential simulation is capable of evaluating composite generation-transmission systems without these failure modes. The effectiveness of the technique is demonstrated using several small examples. Also, the adequacy of the RBTS and the IEEE-RTS is evaluated, and the results are compared with those given by an analytical technique. These again demonstrate the applicability and effectiveness of the approach.

Helenic fault tolerance for robots

In robot applications where the consequences of system failure are unbearable, fault tolerance is mandatory. Fault tolerant robots continue to function correctly despite component failures. Fault tolerant robots can be designed using the Helenic architecture. This architecture uses non-homogeneous functional modular redundancy and a democratic dynamic weighted voting algorithm for redundancy management to achieve fault tolerance. The benefits offered are increased reliability, maintainability, common mode failure resistance, and significant cost reductions. To demonstrate the fault tolerance capabilities of this system architecture, a 5 wheel omnidirectional mobile robot with sensors, computing elements and actuators was designed and simulated. Simulation results verify the robot's ability to continue ‘correct’ operation despite internal subsystem failures.

Empirical process modeling technique for signal validation

Some techniques for fault detection involve the comparison of measured process signals with independent estimates. The prediction of process variables can be achieved either by physical or empirical modeling of a plant subsystem. An automated procedure for generating empirical process models is developed here. Independent prediction of critical signals is required for consistency checking of instrument outputs, for their degradation monitoring and for isolating common-mode failures. The steady-state empirical models are developed using data from different steady-state conditions. Signal anomaly is identified by comparing the error between the model-based prediction and the actual measurement with a fuzzy function (curve) utilizing the signal tolerance as a threshold. In the event a signal is declared as failed, the predicted estimate is used as input to a control/safety system or for display to an operator. Application of the methodology to signal validation using operational data from a commercial PWR and the EBR-II is presented.

Programmable electronic systems applied for risk control in petrochemical plants

The chemical industry today is in transition, with increasing emphasis on total quality control along with needs to meet even more stringent levels of health, safety and environmental management. Fortunately, these needs are being paralleled by major developments in process monitoring and control instrumentation. Microprocessor-based process sensors, programmable electronic systems (PESs), and precision throttling valves make possible the implementation of complex process control strategies in DCSs where operators interact with the process through video display human/machine interfaces. The automation of past, manual operating tasks is justified under the umbrella of reducing the likelihood of human errors. Although automation does reduce the sources of human error in plant operations, these programmable control systems and software introduce new and different potential sources of error, leading to new implementation considerations. Many of the hazard identification and risk assessment methodologies used today treat the process control system as a ‘black box’. Furthermore these methodologies are based on techniques that assume independence of failures. However, when PESs are used for both regulatory and safety interlock controls, the possibilities for common mode failures and covert faults are greatly increased over that demonstrated by older technologies. Data highways, common software, central supervisory control computers and subtle deficiencies in design all introduce new potential sources of shared failures. Today, achievement of plant safety is a systems issue [1]. Process hazard assessment and control requires an integrated analysis with inputs from each of the disciplines involved in process design and plant operation, as well as the guidance of safety and risk specialists. This paper presents an approach to total process safety assessment in which instrumentation is applied as one means for risk mitigation. A methodology for reduction of hazardous event likelihood by using modern programmable electronic monitoring and control systems is described, and applications of the methodology to industrial examples are presented. The methodology applied is that documented in [2].

Occurrence of common mode failure

Abstract In technical facilities, for example in nuclear power plants, redundant systems are used to prevent random failures from deleting the complete system function. However, although this redundancy concept is adequate to cope with random failures in single redundancies, its applicability is limited in case of multiple failures due to a systematic failure cause to which all redundancies are submitted due to their identical features. Some general considerations have been formulated to rule out the occurrence of such common mode failure (CMF) in redundant systems under certain circumstances. CMF means that in more than one redundancy the systematic failure cause is activated at the same time, or within the same frame of time (e.g. during the mission time for an accident). It therefore has to be distinguished between the systematic cause and the actual occurrence of CMF: a latently existing systematic cause does not necessarily lead to simultaneous failure; it must be activated and therefore is only the prerequisite for CMF. A systematic cause results in simultaneous failure if • —the systematic cause is activated by specific circumstances associated with the accident: a triggering effect to which the redundancies are subjected due to their identical features. • —previous failures have accumulated undetectedly before the accident. They now appear on demand due to the accident. For exclusion of CMF, both exclusion of a triggering effect and of accumulation is necessary. A trigger can be excluded, if the components are not affected by the accident at all, or are not submitted to any ‘abnormal’ operation. Accumulation can be ruled out by self annuciation. From this a matrix for excluding CMF-susceptibility has been derived.

Quantified risk assessment - a nuclear industry viewpoint

This paper presents a brief summary of the methodology used for the assessment of risk arising from fuel handling and dismantling operations in advanced gas-cooled reactor power stations. The difficulties with and problems arising from such risk assessments are discussed. In particular, difficulties arise from (i) the onerous risk criteria that nuclear plants are expected to satisfy, (ii) the necessary complexity of the plant, (iii) the conflicting requirements for the fault consequence assessments to be bounding but not grossly pessimistic, and (iv) areas of fault frequency assessment which contain possibly subjective considerations such as software and common mode failure.

Interim def stan 00–56: hazard analysis and safety classification of the computer and programmable electronic system elements of defence equipment

Interim Defence Standard 00–56 is an influential standard, particularly in its approach to the problem of design faults, and despite its title addresses, system safety as a whole. The paper contains an overview of the standard, concentrating on the way that accidents are categorised, and functions and components given safety integrity levels according to the safety implications of their operation or maloperation. The use of tabular schemes and claim limits for enforcing system architectures with good resistance to design faults and common mode failures is explained. The way in which the standard is ‘calibrated’ using numerical safety targets is also addressed. The paper concludes with a summary of the activities and supporting documentation required by the standard, and the plans for its further development.

Operating reserve risk assessment in composite power systems

This paper presents an operating reserve risk assessment procedure for composite generation and transmission systems. This method is utilized to study risk constrained unit commitment under various system operating conditions. The unit commitment studies are done on composite generation and transmission system and recognize common mode failures of transmission lines and station initiated outages. The procedure presented in this paper incorporates a physical appreciation of the effect of transmission lines and station elements on the composite system operating risk index and therefore on the units committed for operation. This procedure is illustrated by application to the hypothetical test system designated as the RBTS.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

A safety evaluation framework for process hazards management in chemical facilities with PES‐based controls

AbstractThe chemical industry today is in transition, with increasing emphasis on total quality control along with needs to meet ever more stringent levels of health, safety, and environmental management. Fortunately, these needs are being met by tremendous strides in process monitoring and control instrumentation. Microprocessor‐based process sensors, programmable electronic systems (PESs), and precision throttling valves now improve the implementation and maintenance of complex process control strategies, with operators interacting with the process through modern human/machine interfaces. Sophisticated graphical displays and powerful control algorithms aid the operators in their work. Many formerly manual tasks are being automated. Some sources of human error are reduced by the use of PES controls, but these systems introduce new and different potential sources of error, leading to new implementation considerations.Many of the hazard identification and risk assessment methodologies used today are based on techniques that assume independence of failures. However, possibilities for common mode failures and covert faults are greatly increased in process control systems that make use of PES technology. PES controls are interconnected through data highways; use common hardware and software functions in many modules; and may depend on central supervisory control computers for some critical control data. Today, achieving plant safety is a systems issue, requiring an integrated analysis with inputs from each of the disciplines involved in design and operation, as well as the guidance of safety and risk specialists. This article presents a systematic, semi‐quantitative approach to total system safety design in which modern programmable electronic monitoring and control systems are integrated with traditional administrative and engineering controls to achieve acceptable levels of operating risk. The philosophy presented is a reflection of the consensus of a group of experienced control system specialists from some ten leading companies.

A Methodology for the Design and Analysis of a Sensor Failure Detection Network

Two topics are discussed: a method to evaluate and construct a sensor failure detection network and use of the network for signal validation of a complex system such as a nuclear power plant. The network is arranged in a tree structure and consists of plantwide sensor measurements and component models. Sensors are categorized into four classes via a logic state analysis to determine the effectiveness of the tree layouts and to reveal deficiencies in the sensor arrangements. Network building is automatic via a rule-based algorithm. Besides analytical redundancy and parity relations, plantwide consistency checks are implemented in the validation scheme to detect possible common-mode failures and modeling or process faults. Data are structured with an entity relationship and processed with an object-oriented technique. The working sequence is arranged using topological sorting to facilitate on-line, real-time applications. For a demonstration, the package is implemented on a microcomputer and applied to a pressurized water reactor plant for safety parameter validation. Its performance in detecting hypothetical sensor failures during power maneuver transients is presented.

Instrument failure detection and reconstruction methodology in space-time nuclear reactor dynamic systems with fixed in-core detectors

The detection and isolation of instrument failures in nuclear reactors equipped with fixed in-core detectors were studied in order to improve reliability and safety. This was done by representing the reactor as a linear stochastic distributed parameter system. A bank of detection observers based on the Kalman filter concept was constructed in order to isolate component failures via robust observation. Each observer was sensitive to only one specified component failure. This was done to minimize the covariance matrix error. However, because observed deviations may be attributed to changes in system behavior, failure decisions are confirmed by a multiple consecutive miscomparison (MCM) counter. Following failure detection, the failed sensor's output is replaced with an estimate from the failure-free filter. Various simulations were performed to verify this failure detection method as applied to reactor instrument failures. It was demonstrated that the method can detect both single- and common-mode failures. Also, without hardware redundancy, it can describe the system dynamics in the event of failures.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

A simulation model for reliability evaluation of space station power systems

A Monte Carlo simulation program to perform reliability analysis of the Space Station hybrid power configuration (consisting of photovoltaic and solar dynamic systems) is presented. The model considers the dependence of reliability and storage characteristics during the sun and eclipse periods. It also considers certain types of common-mode failures. In particular, the charging and discharging of the energy-storage modules can be modeled in a more accurate fashion on a continuous basis than in the approach of C. Singh et al. (1987). The model has been implemented in a computer program. All the relevant system reliability indices including the probability, frequency, and mean duration of failure can be calculated. >

Human Error Data Collection and Data Generation

Human error data in the form of human error probabilities should ideally form the corner‐stone of human reliability theory and practice. In the history of human reliability assessment, however, the collection and generation of valid and usable data have been remarkably elusive. In part the problem appears to extend from the requirement for a technique to assemble the data into meaningful assessments. There have been attempts to achieve this, THERP being one workable example of a (quasi) database which enables the data to be used meaningfully. However, in recent years more attention has been focused on the PerformanceShaping Factors (PSF) associated with human reliability. A “database for today” should therefore be developed in terms of PSF, as well as task/ behavioural descriptors, and possibly even psychological error mechanisms. However, this presumes that data on incidents and accidents are collected and categorised in terms of the PSF contributing to the incident, and such classification systems in practice are rare. The collection and generation of a small working database, based on incident records are outlined. This has been possible because the incident‐recording system at BNFL Sellafield does give information on PSF. Furthermore, the data have been integrated into the Human Reliability Management System which is a PSF‐based human reliability assessment system. Some of the data generated are presented, as well as the PSF associated with them, and an outline of the incident collection system is given. Lastly, aspects of human common mode failure or human dependent failures, particularly at the lower human error probability range, are discussed, as these are unlikely to be elicited from data collection studies, yet are important in human reliability assessment. One possible approach to the treatment of human dependent failures, the utilisation of human performance‐limiting values, is described.

The trinomial failure rate model for treating common mode failures

Abstract Common cause, or common mode failures are a major concern in analyzing system reliability. This paper presents a model, called the Trinomial Failure Rate model, that allows careful and elaborate treatment of common cause failures. To date, the models that have been used as tools for common cause failure analysis are of the binary type, that is, a component state is either a success or a failure in describing component failure events. The simple on-off method cannot explicitly analyze existing complex phenomena such as partial failures, incipient failures and potential failures. The trinomial Failure Rate model has been developed to explicitly analyze such ambiguous events. The maximum likehood estimation method is used to develop estimators of model parameters. The results of the Trinomial Failure Rate model are compared with those of the Binomial Failure Rate and the beta-factor models using assumed data for the events that fall into the gray area between success and failure. By identifying the ambiguous situations and subdividing the events which are used as input data, events that cannot be clearly classified as success or failure can be discovered so that more detailed system analyses can be performed.

Power Signal Validation for Taiwan Research Reactor

A personal-computer-based neutron and thermal power validation system has been developed for the Taiwan Research Reactor (TRR). An extended Kalman filter is used to reduce the neutron power signal noise, and an identified neutron power/thermal power empirical model is used instead of a theoretical physical model for the analytic redundancy model. The parity-space technique is adopted to estimate the measurements and identify sensor failure. Performance of the system is evaluated using data from a TRR simulation model and the results show that common-mode failure is successfully identified without additional sensors.

Availability analysis in a cable transmission system with repair restrictions

Single-system generating capacity adequacy analysis normally does not include recognition of transmission constraints or availabilities. These considerations are usually included in multiarea adequacy studies and in single system studies involving remote generating facilities connected to the system through either high-voltage AC or DC transmission. The availability of the transmission link can be critical to the overall system adequacy and to the benefit associated with the remote generation facility. The authors present a technique for modelling a transmission facility with repair restrictions. The example chosen is an underwater direct-current cable installation. The system is analyzed using a Markov model, and results are presented on time-dependent and steady-state unavailability, as well as on the common mode failure of trenches. >

Quantification of human error and common-mode failures in man-machine systems

An analysis of human errors in nuclear power plant systems when measured against common-mode failures (CMF) is presented. Human errors evaluated are improper testing, inadequate maintenance strategy, and miscalibration. The methodology improves power plant systems availability by identifying sources of common-mode failure when operational functions are involved. It is also applicable to other complex systems such as chemical plants, aircraft, and motor industries; in fact, any large man-created, man-machine system could be included.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Reliability analysis of transmission lines with common mode failures when repair times are arbitrarily distributed

The authors present the evaluation of the probability and frequency of failure for a system of two parallel redundant transmission lines with common mode failure. The component down times are assumed to follow an overdispersed Gamma distribution. The two system models are presented based, respectively, on the parallel device of stages on the use of supplementary variables. The results are checked by Monte Carlo simulations. The merits of the supplementary variable model are pointed out and the relevance of the form of the distribution as well as the necessity of a careful statistical analysis of the actual failure data is addressed. It is shown that, for a Gamma distribution with shape parameter less than unity, the form of the down-time distribution can have an orders-of-magnitude effect on the probability of failure. >

Quantification of human error and common-mode failures in man-machine systems

An analysis is presented of human errors in nuclear-power-plant systems in conjunction with common-mode failures. The errors evaluated are improper testing, inadequate maintenance strategy, and miscalibration. The methodology used is believed to represent a positive contribution to power plant systems availability by identifying sources of common-mode failure when operational functions are involved. It is also applicable to other complex man-created, man-machine system.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

The Development and Implementation of a Program to Improve the Performance of Reactor Trip Breakers after Salem

A program to improve the performance of reactor trip breakers after Salem is described. It consists of a maintenance program, a hardware program, and a followup program designed to correct the age-related lubrication degradation problem identified as a common mode failure mechanism by post-Salem investigations.