DOCSLIB.ORG

Quantitative Assessment of Human Contribution to Risk in Nuclear Power Plants Abdallah Ahmad Ezzedin Iowa State University

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Quantitative Assessment of Human Contribution to Risk in Nuclear Power Plants Abdallah Ahmad Ezzedin Iowa State University Iowa State University Capstones, Theses and Retrospective Theses and Dissertations Dissertations 1983 Quantitative assessment of human contribution to risk in nuclear power plants Abdallah Ahmad Ezzedin Iowa State University Follow this and additional works at: https://lib.dr.iastate.edu/rtd Part of the Nuclear Engineering Commons Recommended Citation Ezzedin, Abdallah Ahmad, "Quantitative assessment of human contribution to risk in nuclear power plants " (1983). Retrospective Theses and Dissertations. 7669. https://lib.dr.iastate.edu/rtd/7669 This Dissertation is brought to you for free and open access by the Iowa State University Capstones, Theses and Dissertations at Iowa State University Digital Repository. It has been accepted for inclusion in Retrospective Theses and Dissertations by an authorized administrator of Iowa State University Digital Repository. For more information, please contact [email protected]. INFORMATION TO USERS This was produced from a copy of a document sent to us for microfilming. While the most advanced technological means to photograph and reproduce this document have been used, the quality is heavily dependent upon the quality of the material submitted. The following explanation of techniques is provided to help you understand markings or notations which may appear on this reproduction. 1.The sign or "target" for pages apparently lacking from the document photographed is "Missing Page(s)". If it was possible to obtain the missing page(s) or section, they are spliced into the film along with adjacent pages. This may have necessitated cutting through an image and duplicating adjacent pages to assure you of complete continuity. 2. When an image on the film is obliterated with a round black mark it is an indication that the film inspector noticed either blurred copy because of movement during exposure, or duplicate copy. Unless we meant to delete copyrighted materials that should not have been filmed, you will find a good image of the page in the adjacent frame. If copyrighted materials were deleted you will find a target note listing the pages in the adjacent frame. 3. When a map, drawing or chart, etc., is part of the material being photo­ graphed the photographer has followed a definite method in "sectioning" the material. It is customary to begin filming at the upper left hand corner of a large sheet and to continue from left to right in equal sections with small overlaps. If necessary, sectioning !s continued again—beginning below the first row and continuing on until complete. 4. For any illustrations that cannot be reproduced satisfactorily by xerography, photographic prints can be purchased at additional cost and tipped into your xerographic copy. Requests can be made to our Dissertations Customer Services Department. 5. Some pages in any document may have indistinct print. In all cases we have filmed the best available copy. Universi^ Micrcxilms International 300 N. 2EEB RD., ANN ARBOR, Ml 48106 8316315 Ezzedin, Abdallah Ahmad QUANTTTATIVE ASSESSMENT OF HUMAN CONTRIBUTION TO RISK IN NUCLEAR POWER PLANTS Iowa State University PH.D. 1983 University Microfilms Intsmâtioriâ! m N. Zeeb Road. Ann Arbor. MI 48106 PLEASE NOTE: In all cases this material has been filmed in the best possible way from the available copy. Problems encountered with this document have been identified here with a check mark V . 1. Glossy photographs or pages 2. Colored illustrations, paper or print 3. Photographs with dark background 4. Illustrations are poor copy 5. Pages with black marks, not original copy 6. Print shows through as there is text on both sides of page 7. Indistinct, broken or small print on several pages 8. Print exceeds margin requirements 9. Tightly bound copy with print lost in spine 10. Computer printout pages with indistinct print ^ 11. Page(s) lacking when material received, and not available from school or author. 12. Page(s) seem to be missing in numbering only as text follows. 13. Two pages numbered . Text follows. 14. Curling and wrinkled pages 15. Other University Microfilms international Quantitative assessment of human contribution to risk in nuclear power plants by Abdallah Ahmad Ezzedin A Dissertation Submitted to the Graduate Faculty in Partial Fulfillment of the Requirements for the Degree of DOCTOR OF PHILOSOPHY Major; Nuclear Engineering Approved; Signature was redacted for privacy. In Charge of Major Work Signature was redacted for privacy. For the Major Dapartm^t Signature was redacted for privacy. For the Graduate College Iowa State University Ames, Iowa 1983 ii TABLE OF CONTENTS Page LIST OF ABBREVIATIONS USED vi 1. INTRODUCTION 1 2. LITERATURE REVIEW 5 3. PERFORMANCE SHAPING FACTORS 15 3.1. External PSFs 15 3.1.1. Situational characteristics (SCs) 15 3.1.2. Task and equipment characteristics 22 3.1.3. Job and task instruction 29 3.2. Stressors 30 3.2.1. Psychological stress 31 3.2.2. Physiological stress 33 3.3. Internal PSFs 35 3.4. PSFs and its Effect on Human Reliability 38 4. SAFETY ASPECTS OF NUCLEAR POWER PLANTS (PWR) 41 4.1. Introduction 41 4.2. PWR System Description 42 4.3. The Nature of Nuclear Power Plant Accidents 46 4.3.1. Loss of coolant accidents 48 4.4. Reactor Transients 56 5. S2C ACCIDENT SEQUENCE AND ITS HUMAN CONTRIBUTION TO RISK IN NUCLEAR POWER PLANTS 58 5.1. Introduction 58 5.2. SgC Accident Sequence Description 58 5.3. SgC Accident Sequence Systems Description 60 5.3.1. CSIS description and function 60 5.3.2. CSRS description and function 63 5.3.3. CHRS description and function 65 5.3.4. SHAS description and function 67 iii Page 6. ESTIMATION OF UNAVAILABILITY OF THOSE SYSTEMS INVOLVED IN SgC ACCIDENT SEQUENCE 70 6.1. Introduction 70 6.2. Method of Calculation 70 6.2.1. Distribution of human performance 70 6.2.2. Availability theory 72 6.2.3. Unavailability estimations 77 6.2.4. Discussion of the results 84 7. OPERATOR ERROR RATES ESTIMATION 87 7.1. Introduction 87 7.2. Operator Error Rate Estimates 87 7.3. Valve Mispositioning of Those Systems and Subsystems Involved in S2C Accident Sequence 92 7.3.1. Human error rates estimated for CSIS 92 7.3.2. Human error rates estimated for CSRS 99 7.3.3. Human error rates estimated for SHAS 102 7.3.4. Human error rates estimated for CHRS 107 7.4. Comparison with Other Estimates of Human Error Probabilities 111 7.5. Discussion of the Results 118 8. QUANTITATIVE EVALUATION OF SYSTEMS INVOLVED IN S2C ACCIDENT SEQUENCE 122 8.1. Introduction 122 8.2. Fault Tree Analysis and its Applications 123 8.2.1. Fault Tree Analysis (FTA) 123 8.2.2. Event symbols 124 8.2.3. Application of fault trees 128 iv Page 8.3. CSIS Fault Tree "Insufficient Fluid Flow" 133 8.3.1. CSIS fault tree description 133 8.3.2. PREP and KITT codes description 148 8.3.3. The PREP run for the CSIS fault tree 149 8.4. KlTT-1 Results for the CSIS Fault Tree 172 8.4.1. Case 1: WASH-1400 172 8.4.2. Case 2: LERs 178 8.4.3. Case 3: NUREG/CR-1278 182 8.4.4. Case 4: Sensitivity of CSIS relia­ bility to human errors 186 8.4.5. Discussion of the results 192 8.5. CHRS Unavailability Fault Tree 193b 8.5.1. CHRS fault tree description 193b 8.5.2. The PREP run for the CHRS un­ availability fault tree 202 8.5.3. KITT-1 results for CHRS un­ availability fault tree 224 9. SUMMARY AND CONCLUSIONS 236 10. RECOMMENDATION FOR FURTHER WORK 239 11. REFERENCES 241 12: ACKNOWLEDGMENTS 247 13. APPENDIX A: CHARACTERIZATION OF OPERATOR "ERRORS" FROM ANALYZED LICENSEE EVENT REPORTS (LERs) 248 14. APPENDIX B: DERIVED HUMAN ERROR PROBABILITIES AND RELATED PERFORMANCE SHAPING FACTORS 277 15. APPENDIX C: DESCRIPTION OF THE PREP CODES AND ITS INPUT DATA 284 15.1. Input Data Description 287 15.1.1. Input group 1 287 15.1.2. Input group 2 288 15.1.3. Input group 3 288 V Page 16. APPENDIX D; DESCRIPTION OF THE KITT CODES AND ITS INPUT DATA 291 17. APPENDIX E; KITT-1 OUTPUT RESULTS FOR THE CSIS FAULT TREE 300 18. APPENDIX F; KITT-1 OUTPUT RESULTS FOR CHRS FAULT TREE 317 vi LIST OF ABBREVIATIONS USED BWRs Boiling water reactors CHRS Containment heat removal system CI Containment integrity CLCS Containment limiting control system CSIS Containment spray injection system CSRS Containment spray recirculation system ECCS Emergency core coolant system EP Experienced personnel ESFs Engineered safety features ESSs Engineering safeguard systems FTA Fault tree analysis GPM Gallon per minute HE Heat exchanger HEPS Human error probabilities HPIS High pressure injection system HPRS High pressure recirculation system LERs Licensee event reports LOCAs Loss of coolant accidents LPIS Low pressure injection system LPRS Low pressure recirculation system LWRS Light water reactors NPPs Nuclear power plants NSRG Nuclear safety research group PARR Post accident radioactivity removal vii PAHR Post accident heat removal PRAs Probabilistic risk assessments PSFs Performance shaping factors PWRs Pressurized water reactors RCS Reactor coolant system RT Reactor trip RWST Refueling water storage tank SHAS Sodium hydroxide addition system THERP Technique for human error rate prediction TMI Three Mile Island 1 1- INTRODUCTION A high-technology society places a premium on its de­ mand for energy sources. Of the alternative available energy sources at the present time, nuclear power is one of the most efficient and economical sources. However, there is widespread concern (founded or unfounded) over the safety of nuclear power plants. Much of this concern surfaced as a result of the accident in March of 1979 at the Three Mile Island (TMI) generating station near Harrisburg, Pennsylvania. This accident was the result of a complex set of interactions involving design deficiencies, equipment failure and human errors.
Load more

Recommended publications
  • A Zonal Safety Analysis Methodology for Preliminary Aircraft Systems and Structural Design
    A Zonal Safety Analysis Methodology for Preliminary Aircraft Systems and Structural Design Chen, Z. and Fielding, J. P. School of Aerospace, Transport and Manufacturing, Cranfield University ABSTRACT Zonal Safety Analysis (ZSA) is a major part of the civil aircraft safety assessment process described in Aerospace Recommended Practice 4761 (ARP4761). It considers safety effects that systems/items installed in the same zone (i.e. a defined area within the aircraft body) may have on each other. Although the ZSA may be conducted at any design stage, it would be most cost-effective to do it during preliminary design, due to the greater opportunity for influence on system and structural designs and architecture. The existing ZSA methodology of ARP4761 was analysed but it was found to be more suitable for detail design rather than preliminary design. The authors therefore developed a methodology that would be more suitable for preliminary design and named it the Preliminary Zonal Safety Analysis (PZSA). This new methodology was verified by means of the use of a case-study, based on the NASA N3-X project. Several lessons were learnt from the case study, leading to refinement of the proposed method. These lessons included focusing on the positional layout of major components for the zonal safety inspection, and using the Functional Hazard Analysis (FHA)/Fault Tree Analysis (FTA) to identify system external failure modes. The resulting PZSA needs further refinement, but should prove to be a useful design tool for the preliminary design process. _____________________________________ INTRODUCTION This paper outlines the development of a methodology, hereafter referred to as the Preliminary Zonal Safety Historically, system safety analysis was primarily based Analysis (PZSA).
    [Show full text]
  • Risk Assesment: Fault Tree Analysis
    RISK ASSESMENT: FAULT TREE ANALYSIS Afzal Ahmed+, Saghir Mehdi Rizvi*Zeshan Anwer Rana* Faheem Abbas* +COMSAT Institute of Information and Technology, Sahiwal, Pakistan *Navy Engineering College National University of Sciences and Technology, Islamabad drafzal@ciitsahiwal>edu.pk, 03452325972 ABSTRACT The failure of engineering equipment causes loss of capital as well as human loss, injuries, and stoppage of production line. The hazards can be classified as safe, minor, major, critical and catastrophic Risk analysis or hazard analysis pin points the potential failures of engineering systems and or components when being used.. Failure mode and effects analysis is used to identify hazard and to make system safer. A system is broken down up to level of components and using reliability data the safety or probability of failure of assemblies and the system can be calculated. The failure mode and effects analysis is used with fault tree analysis to point the areas of a complex system where failure mode effect analysis is required. Fault tree analysis (FTA) is a technique which pinpoints any failure or severe accidents. It tells how things fail rather than emphasize on the design performance. It is a logic diagram connecting inputs an outputs using Boolean algebra. This paper shows how FTA can be applied to car carburetor failure and car brake failure. Key words : Risk Management, Reliability, Fault tree, Failure mode INTRODUCTION The world is full risk. We are at risk of accident minor. A failure of an aircraft may cause death when crossing a road or driving. We are at risk to passengers, while a machine may cause living in an apartment not properly designed.
    [Show full text]
  • NASA Fault Tree Handbook with Aerospace Applications
    Fault Tree Handbook with Aerospace Applications Version 1.1 FFFaaauuulllttt TTTrrreeeeee HHHaaannndddbbbooooookkk wwwiiittthhh AAAeeerrrooossspppaaaccceee AAAppppppllliiicccaaatttiiiooonnnsss Prepared for NASA Office of Safety and Mission Assurance NASA Headquarters Washington, DC 20546 August, 2002 Fault Tree Handbook with Aerospace Applications Version 1.1 FFFaaauuulllttt TTTrrreeeeee HHHaaannndddbbbooooookkk wwwiiittthhh AAAeeerrrooossspppaaaccceee AAAppppppllliiicccaaatttiiiooonnnsss NASA Project Coordinators: Dr. Michael Stamatelatos, NASA Headquarters Office of Safety and Mission Assurance Mr. José Caraballo, NASA Langley Research Center Authors: NASA Dr. Michael Stamatelatos, NASA HQ, OSMA Lead Author: Dr. William Vesely, SAIC Contributing Authors (listed in alphabetic order): Dr. Joanne Dugan, University of Virginia Mr. Joseph Fragola, SAIC Mr. Joseph Minarick III, SAIC Mr. Jan Railsback, NASA JSC Fault Tree Handbook with Aerospace Applications Version 1.1 FFFaaauuulllttt TTTrrreeeeee HHHaaannndddbbbooooookkk wwwiiittthhh AAAeeerrrooossspppaaaccceee AAAppppppllliiicccaaatttiiiooonnnsss Acknowledgements The project coordinators and the authors express their gratitude to NASA Office of Safety and Mission Assurance (OSMA) management (Dr. Michael Greenfield, Deputy Associate Administrator and Dr. Peter Rutledge, Director of Enterprise Safety and Mission Assurance) and to Mr. Frederick Gregory, NASA Deputy Administrator, for their support and encouragement in developing this document. The authors also owe thanks to a number of reviewers
    [Show full text]
  • Hazard Analysis of Complex Spacecraft Using Systems- Theoretic Process Analysis *
    Hazard Analysis of Complex Spacecraft using Systems- Theoretic Process Analysis * Takuto Ishimatsu†, Nancy G. Leveson‡, John P. Thomas§, and Cody H. Fleming¶ Massachusetts Institute of Technology, Cambridge, Massachusetts 02139 Masafumi Katahira#, Yuko Miyamoto**, and Ryo Ujiie†† Japan Aerospace Exploration Agency, Tsukuba, Ibaraki 305-8505, Japan Haruka Nakao‡‡ and Nobuyuki Hoshino§§ Japan Manned Space Systems Corporation, Tsuchiura, Ibaraki 300-0033, Japan Abstract A new hazard analysis technique, called System-Theoretic Process Analysis, is capable of identifying potential hazardous design flaws, including software and system design errors and unsafe interactions among multiple system components. Detailed procedures for performing the hazard analysis were developed and the feasibility and utility of using it on complex systems was demonstrated by applying it to the Japanese Aerospace Exploration Agency H-II Transfer Vehicle. In a comparison of the results of this new hazard analysis technique to those of the standard fault tree analysis used in the design and certification of the H-II Transfer Vehicle, System-Theoretic Hazard Analysis found all the hazardous scenarios identified in the fault tree analysis as well as additional causal factors that had not been) identified by fault tree analysis. I. Introduction Spacecraft losses are increasing stemming from subtle and complex interactions among system components. The loss of the Mars Polar Lander is an example [1]. The problems arise primarily because the growing use of software allows engineers to build systems with a level of complexity that precludes exhaustive testing and thus assurance of the removal of all design errors prior to operational use [2,3] Fault Tree Analysis (FTA) and Failure Modes and Effects Analysis (FMEA) were created long ago to analyze primarily electro-mechanical systems and identify potential losses due to component failure.
    [Show full text]
  • A Simulation Tool for Extended Dynamic Fault Trees
    DFTSim: A Simulation Tool for Extended Dynamic Fault Trees H. Boudali, A.P. Nijmeijer, M.I.A. Stoelinga University of Twente, CS Department, Enschede, NL. hboudali, andre, marielle @cs.utwente.nl { } Keywords: Dependability analysis, dynamic fault trees, simulation computation-time required to solve the DFT. tool, reliability benchmark. A simulation-based approach of standard DFTs has been sug- gested (but not implemented) in [11] as a possible solution tech- Abstract nique. In this paper, we propose DFTSim, a tool for simulating We present DFTSim, a simulation tool for dynamic fault trees (DFT). extended DFTs, where the input DFT file is compatible with the The simulation is carried out by directly sampling the failure distri- Galileo and the Coral textual DFT format. Such compatibility is butions attached to the leaves (called basic events) of the tree and indeed desired because it allows interoperability and integration propagating the failure times upwards in the tree. among these DFT tools. Sampling the distributions of the DFT leaves is however not ob- One of the major problems in DFT simulation-based approaches vious. To sample from the correct distributions, the analytical ex- is to sample from the correct distributions. In order to carry out such pression of the failure distributions of all basic events (BE) must be sampling the analytical expression of the failure distributions of all known. These are indeed known for non-spare BEs; but for spare basic events must be known. Such failure distributions are indeed BEs, they become conditional on the failure of other BEs. Hence, known for non-spare basic events; unfortunately, for spare basic the derivation of the analytical expression of the spares’ failure dis- events the failure distribution becomes conditional on the primary’s tributions and their sampling is not a trivial task.
    [Show full text]
  • An Overview of Fault Tree Analysis (FTA) Method for Reliability Analysis & Life Cycle Cost (LCC) Management
    IOSR Journal of Mechanical & Civil Engineering (IOSR-JMCE) ISSN: 2278-1684, PP: 14-18 www.iosrjournals.org An Overview of Fault Tree Analysis (FTA) Method for Reliability Analysis & Life Cycle Cost (LCC) Management Rajkumar B. Patil1, L. Y. Waghmode2, P. B. Chikali3, T. S. Mulla4. 1,3,4 ( Department of Mechanical Engineering ,Dr. J. J. Magdum College of Engineering, Jaysingpur, Shivaji University, Kolhapur, Maharashtra India). 2 ( Department of Mechanical Engineering, Annasaheb Dange College of Engineering and Technology, Ashta, Shivaji University, Kolhapur, Maharashtra(India). Abstract – Reliability analysis plays crucial role in the design process. In order to increase reliability of a system, analysis of failure data is essential. Fault Tree Analysis (FTA) is a method that directly focuses on the modes of failures. FTA is a graphical representation of the major faults or critical failures associated with a product and the causes for the faults and potential countermeasures. This paper presents the FTA of Lathe Machine. Qualitative and quantitative analysis helps to identify critical design parameters, maintenance suggestions. It also includes how reliability analysis fruitful for Life cycle cost management. Keywords – Fault Tree Analysis, FRACAS, Life Cycle Cost, MTBF, MTTF, Reliability Analysis. I.INTRODUCTION Reliability based design focuses on three terms as reliability, availability and maintainability. Reliability is defined to be the probability that the component or system will perform its intended functions for a specified period of time when used under stated operating conditions [1]. In simple words, reliability is nothing but the non-failure of the system over a given period of time. Reliability engineering is a sub-discipline within system engineering.
    [Show full text]
  • NASA Activities in Risk Assessment
    NASANASA ActivitiesActivities inin RiskRisk AssessmentAssessment NASANASA ProjectProject ManagementManagement ConferenceConference MarchMarch 30-31,30-31, 20042004 Michael G. Stamatelatos, Ph.D.,Director Safety and Assurance Requirements Division Office of Safety and Mission Assurance NASA Headquarters 1 NASA is a Pioneer and a Leader in Space; Therefore Its Business Is Inherently Risky International Space Station Safe assembly and operation Space Transportation Space Shuttle Orbital Space Plane 2 Our Goal z Improve risk awareness in the Agency ¾ Conduct PRA training for line and project managers and for personnel z Develop a corps of in-house PRA experts z Transition PRA from a curiosity object to baseline method for integrated system safety, reliability and risk assessment z Adopt organization-wide risk informed culture ¾ PRA to become a way of life for safety and technical performance improvement and for cost reduction ¾ Implement risk-informed management process 3 Probabilistic Risk Assessment (PRA) Answers Three Basic Questions Risk is a set of triplets that answer the questions: 1) What can go wrong? (accident scenarios) 2) How likely is it? (probabilities) 3) What are the consequences? (adverse effects) Kaplan & Garrick, Risk Analysis, 1981 Event Event Sequence Sequence Frequency Modeling Evaluation 2. How frequently does it happen? (Scenario frequency quantification) Event Initiating Sequence Risk Event PRA Insights Logic Integration Selection Development 1. What can go wrong? Risk statement Decision Support (Definition of scenarios) 3. What are the consequences? (Scenario consequence quantification) Consequence Modeling PRA is generally used for low-probability and high- consequence events 4 Relationship Between Risk Management and Probabilistic Risk Assessment (PRA) Continuous Risk Management Method Technique Application QualitativeQualitative FMEA.
    [Show full text]
  • Booklet No. 15 Fault Tree Analysis
    Fault Tree Analysis Table of Contents Register of figures ................................................................................................................................... 3 1. Preface ............................................................................................................................................. 4 2. Introduction ..................................................................................................................................... 5 2.1. Objectives of the FTA .............................................................................................................. 5 2.2. History of the FTA .................................................................................................................... 5 2.3. Benefits and drawbacks of the FTA ......................................................................................... 5 2.3.1. Benefits of the method ................................................................................................... 5 2.3.2. Drawbacks of the method ............................................................................................... 6 2.4. FTA application areas .............................................................................................................. 6 3. Fundamentals of the FTA ................................................................................................................ 7 3.1. Roles .......................................................................................................................................
    [Show full text]
  • Probabilistic Safety Assessment for UAS Separation Assurance and Collision Avoidance Systems
    aerospace Article Probabilistic Safety Assessment for UAS Separation Assurance and Collision Avoidance Systems Asma Tabassum 1 , Roberto Sabatini 2,* and Alessandro Gardi 2 1 Department of Mechanical Engineering, University of North Dakota, Grand Forks, ND 58202, USA; [email protected] 2 School of Engineering, Aerospace Engineering and Aviation, RMIT University, Bundoora, VIC 3083, Australia; [email protected] * Correspondence: [email protected]; Tel.: +61-399-258-015 Received: 6 September 2018; Accepted: 17 January 2019; Published: 14 February 2019 Abstract: The airworthiness certification of aerospace cyber-physical systems traditionally relies on the probabilistic safety assessment as a standard engineering methodology to quantify the potential risks associated with faults in system components. This paper presents and discusses the probabilistic safety assessment of detect and avoid (DAA) systems relying on multiple cooperative and non-cooperative tracking technologies to identify the risk of collision of unmanned aircraft systems (UAS) with other flight vehicles. In particular, fault tree analysis (FTA) is utilized to measure the overall system unavailability for each basic component failure. Considering the inter-dependencies of navigation and surveillance systems, the common cause failure (CCF)-beta model is applied to calculate the system risk associated with common failures. Additionally, an importance analysis is conducted to quantify the safety measures and identify the most significant component
    [Show full text]
  • Model-Based Safety Analysis
    Model-Based Safety Analysis Anjali Joshi† Mats P.E. Heimdahl† Steven P. Miller‡ Mike W. Whalen‡ Department of Computer Science and Engineering† University of Minnesota 4-192 EE/SC Building 200 Union Street S.E. Minneapolis, Minnesota 55455 Advanced Technology Center‡ Rockwell Collins, Inc., 400 Collins Road NE, Cedar Rapids, IA 52498 USA Abstract System safety analysis techniques are well established and are used extensively during the design of safety-critical systems. Despite this, most of the techniques are highly subjective and dependent on the skill of the practitioner. Since these analyses are usually based on an informal system model, it is unlikely that they will be complete, consistent, and error free. In fact, the lack of precise models of the system architecture and its failure modes often forces the safety analysts to devote much of their effort to gathering architectural details about the system behavior from several sources and embedding this information in the safety artifacts such as the fault trees. This report describes Model-Based Safety Analysis, an approach in which the system and safety engineers share a common system model created using a model-based development process. By extending the system model with a fault model as well as relevant portions of the physical system to be controlled, automated support can be provided for much of the safety analysis. We believe that by using a common model for both system and safety engineering and automating parts of the safety analysis, we can both reduce the cost and improve the quality of the safety analysis. Here we present our vision of model-based safety analysis and discuss the advantages and challenges in making this approach practical.
    [Show full text]
  • Supporting the ARP4761 Safety Assessment Process with AADL
    Supporting the ARP4761 Safety Assessment Process with AADL Julien Delange and Peter Feiler Carnegie Melon Software Engineering Institute, 4500 5th Avenue, 15213 Pittsburgh, PA USA Abstract Cyber-physical systems, used in domains such as avionics or medical devices, perform critical functions where a fault might have catastrophic consequences (mission failure, severe injuries, etc.). Their development is guided by rigorous practice standards to avoid any error. However, as software importance continues to grow, integration and validation activities are becoming overwhelming. Late discovery of errors introduced in requirements and architecture design have resulted in costly rework, making up as much as 70% of the total software system cost. To overcome these issues, architecture-centric model-based approaches abstract system concerns into models that are analyzed to detect errors, issues or defects that are usually detected lately in the development process. This predictive analysis approach is automated by tools, avoiding any tedious manual efforts. In this paper, we present our model-based approach for capture and analyze system safety and reliability. We have added an error behavior annotation to SAE AADL, a standard for modeling embedded software system architectures. We also implemented analysis methods to automate safety analysis and production of safety assessment reports, as requested by safety recommended practices standards (such as ARP4761). Introduction Context Cyber-physical systems perform critical functions under constrained and potentially hostile circumstances. Because errors can have catastrophic consequences [12], they must be designed carefully and validated/certified according to a rigorous process to prove assurance of correct operation and increase confidence of system design. Verification criteria depend on applications criticality: the most demanding standards require validating and inspecting software code to prove evidence of behavior correctness.
    [Show full text]
  • Software Fault Tree Analysis for Safety Critical and Reliable Software
    PROTEUS JOURNAL ISSN/eISSN: 0889-6348 Software Fault Tree Analysis for Safety Critical and Reliable Software #1 Mr. S. P. Santhoshkumar, #2Mr. M. Praveen Kumar, #3Mr. T. Udhayakumar, #4Mr. S. Syed Shajahaan #1 Assistant Professor, Dept. of CSE, Rathinam Technical Campus, Coimbatore, Tamilnadu, India. #2,3,4 Assistant Professor, Dept. of IT, Rathinam Technical Campus, Coimbatore, Tamilnadu, India. Abstract —— U R Rao Satellite centre is the lead centre which will bring out failure modes at the early stage of the of ISRO, for building communication, remote sensing, development cycle like software requirement specification or navigation, and inter planetary missions. Software plays software design specification. This stage is more important a major role in satellite functionalities. The complexity of as it will not allow the faults to propagate to next phase in the software is increasing from spacecraft to spacecraft. the SDLC which is expensive and time consuming. Hence Requirements has to be classified into safety critical and SFTA helps in achieving better fault tolerant systems. Soft non-safety critical. The critical software has to be emergency check and voltage control logics are used for analysed in a different way. To achieve high reliability shedding path of Thresholds. Load Shedding check is done software safety standards and guidelines has to be on the basis of comparison of battery voltage with thresholds followed strictly. The quality and reliability of the A, B, C, D, E and F. SFTA is applied to all the thresholds. software can be achieved by applying technique like For every comparison there are possible outcomes and based PHA, SFTA, SFMEA.
    [Show full text]