Systems model safety system failure

Markov models can deal with a number of complex issues found in the probabilistic modeling of reliability and safety. The models can show system success versus system failure (Figure D-1). 

Human errors which can lead to safety system failures and loss of critical safety functions should be modelled explicitly in the event sequence and safety system failure analysis. 

In the quantification of the analysis, the importance of initiating event groups, component failures, safety system failure and operator errors should be derived to identify where the contributions to the risk are coming from and where there may be weaknesses in the design or operation of the safety systems. This could use quantitative measures of importance (such as Bimbaum and Fussell-Vesely — see Ref [10]) where applicable. This should be supported by sensitivity studies where there are uncertainties in the models and data. 

The use of BNs in this context aims at assessing their ability to present the modeling of a safety system failure, considering the dependent failure events that might be involved. 

The MSF model (NUREG/CR-3837) is used principally to determine the level of dependence between safety systems introduced by maintenance, testing, and calibration activities. It is a mathematical model which modifies the independent failure probability of any single component by considering that a component with which it is redundant has already failed. This allows the conditional failure probabilities of redundant components to be calculated to determine the overall system failure probability. Documentation requirements are given in Table 4.5-6. 

Fleming, K, N cs al., 1975, A Reliability Model for Common Mode Failures In Redundant Safety Systems, Proceedings of the Sixth Annual Pittsburgh Conference on Modeling and Simulation, April. 

This model of accident causation is described further in Figure 1.3. This represents the defenses against accidents as a series of shutters (engineered safety systems, safety procedures, emergency training, etc.) When the gaps in these shutters come into coincidence then the results of earlier hardware or human failures will not be recovered and the consequences will occur. Inap-... 

The event tree model is started from the initial occurrence and built upon by sequencing tlie possible events and safety systems tliat come into play. Tlie model displays at a glance, branches of events tliat relate tlie proper functioning or failure of a safety device or s) Stem and tlte ultimate consequence. 

II, Chapters 4, 5, and 6 give all the information regarding the theoretical aspects involved in designing a complete NMMS and ensuring its successful implementation and maintenance. A complete system to detect, describe, analyse and follow-up near misses is outlined (Chapter 4), with special emphasis on a model-based classification of system failure (Chapter 5) a number of key issues relating to organisational aspects like acceptance by employees, and safety cultures are discussed in Chapter 6,... 

In the previous chapters the purposes of near miss reporting have been outlined and a framework of designing such a safety management tool has been presented. The importance of human behaviour as a dominant factor in incident sequences was stressed by developing a system failure classification scheme largely based on a theoretical model of operator behaviour. Also an overview was given of the organisational factors necessary for a successful implementation of a NMMS. 

Most analysts doing safety instrumented system modeling use either fault trees or Markov models. Both methods provide a clear way to express the reality of multiple failure modes. Both methods, however, require careful modeling and appropriate solution techniques. Realistic levels of detad... 

Fleming, K. N. (1974). A reliability model forcotmnon cause failure in redundant safety systems. Technical Report GA-A13284, General Atomic Co., San Diego, California (USA). 

We further specify which systems we model. Safety critical systems are systems that lead to hazardous events in case of failure (SommerviUe 2007 Wdliamson 1997). Embedded systems (Wolf 2002) and embedded software (Baier and Katoen 2008) can be foimd in the safety critical domain (Metzner 2006). As examples of safety critical systems airplanes, vehicles, power plants and chemical plants are mentioned in (Borcsok 2006 Borscok 2004). 

Faidt tree models These logical cause-effect models trace the failures of the safety system functions considered in the event-trees back to basic events hke, for instance, the failures of system components. As result, they provide values for the unavailabiUties of the individual functions. 

The time-dependent evolution of the system and process dynamics in interaction with the stochastic failure behaviour of safety systems and hiunan actions is reduced to static cause-effect models which operate with fixed probabilistic assessments for the stochastic behaviour. The order of events is predetermined by the expert and may possibly represent the chronological order of some reference sequences, but the question is, whether it is apphcable to all sequences. What is the consequence, if specific process conditions induce another order of different events ... 

Event-tree models in a Level 1 PSA generally account for the order of demands of safety system functions at set points and for the (stochastic) failure behaviour of the required functions. It is common practice to consider just two alternative states at each set point, namely required function is successful and required function fails . No satisfactory consideration is given, for instance, to situations where technical safety systems which are successfully started fail to function with the required capacity and / or fail to run within the required mission time. What is the consequence, if sequences accounting for stochastic failure times of safety system functions are not considered Is the resulting spectrum of event sequences still sufficient enough to obtain an adequate probabilistic assessment for (core) damage states How reahstic are the probabilistic assessments for damage states derived from static event tree models ... 

Fault-tree models are used to determine the unavail-ahflities of the safety system functions to be considered in the event-trees. They are logical cause-effect models which trace the failure of a system function like, for instance, a technical safety system back to basic events like the failures of technical components. Finally, the fault-tree model provides a value for the unavailability of a system function which is derived from the unavailahilities of the components. 

ABSTRACT Nuclear power plant includes multiple components and systems, which are maintained in order to limit or prevent failures resulting from the ageing and deterioration. These components and systems are imavailable during the maintenance activities. The unavailability of the safety systems results in increased risk of the nuclear power plant. A method for optimization of the maintenance activities in the nuclear power plant applying heuristics algorithms is presented. The maintenance optimization is modelled as a combinatorial problem. The minimal cut sets identified in the prohahiUstic safety assessment are used for assessment of the risk in the optimization function. The periodically tested component model is apphed for the modelling of the components included in the maintenance. The developed method is apphed on test models and the obtained results are presented. Results show that optimization of maintenance decreases the risk and thus improves the plant safety. 

Determination of the predicted MTBF for significant and major failures has been based on detailed reliabihty and availability modelling of the relevant trainbome sub-system vital safety-relevant function-ahties, so that their failure results in the category either significant or major, and the use of predicted values of the needed LRUs. 

The system failure analysis should address all the relevant failure modes of individual items of safety system equipment. These failure modes would normally have been identified by the failure modes and effects analysis carried out as part of the design assessment. Any failures consequential to the PIE should also be included in the system model (if not already fully accounted for in the event sequence models). 

---