Engineering PapersSearch

SEARCH · Engineering Papers

Results for “Common-Cause Failure”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

Common Cause Failure Modeling: Aerospace Versus Nuclear

Aggregate nuclear plant failure data is used to produce generic common-cause factors that are specifically for use in the common-cause failure models of NUREG/CR-5485. Furthermore, the models presented in NUREG/CR-5485 are specifically designed to incorporate two significantly distinct assumptions about the methods of surveillance testing from whence this aggregate failure data came. What are the implications of using these NUREG generic factors to model the common-cause failures of aerospace systems? Herein, the implications of using the NUREG generic factors in the modeling of aerospace systems are investigated in detail and strong recommendations for modeling the common-cause failures of aerospace systems are given.

Stott, James E.

An Efficient Approach for the Reliability Analysis of Phased-Mission Systems with Dependent Failures

We consider the reliability analysis of phased-mission systems with common-cause failures in this paper. Phased-mission systems (PMS) are systems supporting missions characterized by multiple, consecutive, and nonoverlapping phases of operation. System components may be subject to different stresses as well as different reliability requirements throughout the course of the mission. As a result, component behavior and relationships may need to be modeled differently from phase to phase when performing a system-level reliability analysis. This consideration poses unique challenges to existing analysis methods. The challenges increase when common-cause failures (CCF) are incorporated in the model. CCF are multiple dependent component failures within a system that are a direct result of a shared root cause, such as sabotage, flood, earthquake, power outage, or human errors. It has been shown by many reliability studies that CCF tend to increase a system's joint failure probabilities and thus contribute significantly to the overall unreliability of systems subject to CCF.We propose a separable phase-modular approach to the reliability analysis of phased-mission systems with dependent common-cause failures as one way to meet the above challenges in an efficient and elegant manner. Our methodology is twofold: first, we separate the effects of CCF from the PMS analysis using the total probability theorem and the common-cause event space developed based on the elementary common-causes; next, we apply an efficient phase-modular approach to analyze the reliability of the PMS. The phase-modular approach employs both combinatorial binary decision diagram and Markov-chain solution methods as appropriate. We provide an example of a reliability analysis of a PMS with both static and dynamic phases as well as CCF as an illustration of our proposed approach. The example is based on information extracted from a Mars orbiter project. The reliability model for this orbiter considers the various phases of Launch, Cruise, Mars Orbit Insertion, and Orbit. Some of the CCF for the orbiter in this mission include environmental effects, such as micrometeoroids, human operator errors, and software errors.

reliability analysis

VIPER project

The VIPER project has so far produced a formal specification of a 32 bit RISC microprocessor, an implementation of that chip in radiation-hard SOS technology, a partial proof of correctness of the implementation which is still being extended, and a large body of supporting software. The time has now come to consider what has been achieved and what directions should be pursued in the future. The most obvious lesson from the VIPER project was the time and effort needed to use formal methods properly. Most of the problems arose in the interfaces between different formalisms, e.g., between the (informal) English description and the HOL spec, between the block-level spec in HOL and the equivalent in ELLA needed by the low-level CAD tools. These interfaces need to be made rigorous or (better) eliminated. VIPER 1A (the latest chip) is designed to operate in pairs, to give protection against breakdowns in service as well as design faults. We have come to regard redundancy and formal design methods as complementary, the one to guard against normal component failures and the other to provide insurance against the risk of the common-cause failures which bedevil reliability predictions. Any future VIPER chips will certainly need improved performance to keep up with increasingly demanding applications. We have a prototype design (not yet specified formally) which includes 32 and 64 bit multiply, instruction pre-fetch, more efficient interface timing, and a new instruction to allow a quick response to peripheral requests. Work is under way to specify this device in MIRANDA, and then to refine the spec into a block-level design by top-down transformations. When the refinement is complete, a relatively simple proof checker should be able to demonstrate its correctness. This paper is presented in viewgraph form.

Kershaw, John

Safety Expertise and the Perils of Novelty

Emerging aviation markets such as urban air mobility are giving rise to new technologies and means of operation. However, novelty may hide ‘unknown unknowns,’ raising new hazards. This paper examines how expertise and safety techniques enable transformative technologies such as reduced crew operations, hybrid wing-borne and rotor-born flight, federated air traffic services, and urban operations. We explore how analysts use expertise to address common-cause failures, collect and interpret safety data, and perform exacting tradeoffs between dissimilarity, redundancy, independence, and diversity (human, process lifecycle, or otherwise) to ensure safety. When novelty is present, analysts might not possess the expertise needed to fully understand the implications of design decisions and tradeoffs being made, especially in early lifecycle phases, on emergent properties such as safety. Safety expertise must be carefully cultivated. The conflicting views of safety experts must be unpacked to identify the divergence in fundamental assumptions, models, means, and methods that may be causing them. Once systems venture beyond the basis of what safety expertise can reliably guarantee, projects take on risk that must be managed. The paper contains key takeaways and actionable recommendations for novel OEMs and regulators touching on topics such as robust monitoring; clear and transparent reporting; incremental approaches to fielding novel systems in hazard-rich, risk-tolerant environments; the cultivation of safety culture and expertise in an organization; and the use of scientific study to reduce epistemic uncertainty in novel operations with new technologies. Since excessive novelty in aviation can undermine the current foundation of safety, humility and incrementalism are necessary to enable emerging aviation markets safely.

safety expertise

Safety Expertise and the Perils of Novelty

Emerging aviation markets such as urban air mobility are giving rise to new technologies and means of operation. However, novelty may hide ‘unknown unknowns,’ raising new hazards. This paper examines how expertise and safety techniques enable transformative technologies such as reduced crew operations, hybrid wing-borne and rotor-born flight, federated air traffic services, and urban operations. We explore how analysts use expertise to address common-cause failures, collect and interpret safety data, and perform exacting tradeoffs between dissimilarity, redundancy, independence, and diversity (human, process lifecycle, or otherwise) to ensure safety. When novelty is present, analysts might not possess the expertise needed to fully understand the implications of design decisions and tradeoffs being made, especially in early lifecycle phases, on emergent properties such as safety. Safety expertise must be carefully cultivated. The conflicting views of safety experts must be unpacked to identify the divergence in fundamental assumptions, models, means, and methods that may be causing them. Once systems venture beyond the basis of what safety expertise can reliably guarantee, projects take on risk that must be managed. The paper contains key takeaways and actionable recommendations for novel OEMs and regulators touching on topics such as robust monitoring; clear and transparent reporting; incremental approaches to fielding novel systems in hazard-rich, risk-tolerant environments; the cultivation of safety culture and expertise in an organization; and the use of scientific study to reduce epistemic uncertainty in novel operations with new technologies. Since excessive novelty in aviation can undermine the current foundation of safety, humility and incrementalism are necessary to enable emerging aviation markets safely.

safety expertise

Multiversion software reliability through fault-avoidance and fault-tolerance

In this project we have proposed to investigate a number of experimental and theoretical issues associated with the practical use of multi-version software in providing dependable software through fault-avoidance and fault-elimination, as well as run-time tolerance of software faults. In the period reported here we have working on the following: We have continued collection of data on the relationships between software faults and reliability, and the coverage provided by the testing process as measured by different metrics (including data flow metrics). We continued work on software reliability estimation methods based on non-random sampling, and the relationship between software reliability and code coverage provided through testing. We have continued studying back-to-back testing as an efficient mechanism for removal of uncorrelated faults, and common-cause faults of variable span. We have also been studying back-to-back testing as a tool for improvement of the software change process, including regression testing. We continued investigating existing, and worked on formulation of new fault-tolerance models. In particular, we have partly finished evaluation of Consensus Voting in the presence of correlated failures, and are in the process of finishing evaluation of Consensus Recovery Block (CRB) under failure correlation. We find both approaches far superior to commonly employed fixed agreement number voting (usually majority voting). We have also finished a cost analysis of the CRB approach.

Vouk, Mladen A.