Fault tree creation method, fault tree creation device, and program

Abstract

To provide a method for creating an FT that enables the evaluation of realistic failure probabilities when multiple backup devices fail due to time-dependent failures.SOLUTION: When multiple devices are in a backup relationship and all of the multiple devices fail, the system comprehensively calculates the combinations of failure factors for each of the devices, extracts, from these, failure patterns in which two or more of the devices fail due to time-dependent factors, calculates a correction coefficient for the extracted failure patterns as the ratio of a first failure probability that takes time dependency into account to a second failure probability that does not take time dependency into account, and creates a fault tree in which the final device failure, correction coefficient, and failure pattern are treated as nodes and connected by AND gates.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to a fault tree creation method, a fault tree creation device, and a program. [Background technology]

[0002] Probabilistic Risk Assessment (PRA) is used to assess the risk of nuclear power plants. In PRA, equipment is comprehensively extracted from the plant's system diagram, and the failure modes of the extracted equipment are examined to create fault trees and event trees. The purpose of fault tree analysis is to calculate the probability and frequency of an undesirable event, and it is used in a variety of fields. A fault tree (hereinafter sometimes abbreviated as FT) represents the undesirable event as a top event and its causes in the form of a tree diagram, with base events (failures or failure events whose causes cannot be broken down any further) at the bottom. The logical relationships between these base events are defined by OR gates or AND gates, and the probability and frequency of the top event's occurrence are calculated based on that logic.

[0003] In a plant or system, multiple devices are prepared to perform a certain function. Normally, one of the devices operates. If that device fails, one of the remaining devices starts up and replaces the failed device. This relationship is called a backup relationship. When multiple devices in a backup relationship are expected to achieve a certain system function, the base event indicating the failure of each device is modeled using an AND gate in FT. An AND gate represents an event that occurs when all of the base events directly connected to it occur. Furthermore, to avoid undesirable events, the specified period during which the system and devices must operate is defined as the mission time. The probability that each of multiple devices in a backup relationship will fail to continue operating (time-dependent failure) follows an exponential distribution with a mean value of (1 / failure rate), so the occurrence probability increases with operating time. FT cannot represent the time-series relationship between devices. Therefore, conventional methods calculate the failure probability by uniformly setting the mission time of the system to the mission time of multiple devices in a backup relationship, as shown in Figure 1(a). However, in reality, as shown in Figure 1(b), if the subsequent device starts up after the preceding device fails and the system functions within the mission time can be achieved by combining the preceding and subsequent devices, undesirable events can be successfully avoided. In other words, the conventional method, which sets the system mission time uniformly for multiple devices regardless of the timing of the preceding device's failure, overestimates the probability of failure of the preceding and subsequent devices and is therefore conservative.

[0004] Patent Document 1 discloses a data group creation support device that reads out data necessary for creating a fault trace from a database of the facilities and equipment that make up a plant, guides a person in charge through the work procedure for creating a fault trace, and creates a data group that makes up a fault trace when the person in charge inputs data according to the guidance.Patent Document 1 does not disclose a method for assessing the risk of multiple devices in a backup relationship by setting a system mission time for each device to prevent an overly conservative assessment and for assessing a realistic failure probability. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 7051640 Summary of the Invention [Problem to be solved by the invention]

[0006] We provide a method for creating a fault tolerance (FT) that enables the evaluation of a realistic failure probability when multiple devices in a backup relationship fail due to time-dependent factors.

[0007] The present disclosure provides a fault tree creation method, a fault tree creation device, and a program that can solve the above-mentioned problems. [Means for solving the problem]

[0008] The fault tree creation method to be evaluated in the present disclosure includes the steps of: when a plurality of devices are in a backup relationship such that when one of the devices fails, one of the remaining devices is started to replace the failed device; comprehensively calculating combinations of failure factors for each of the plurality of devices when all of the plurality of devices fail; extracting from the combinations failure patterns in which two or more of the devices fail due to time-dependent factors; calculating a first failure probability that two or more of the devices will fail within a predetermined time period, taking into account the order and timing of failure of the devices, for the two or more devices that fail due to the time-dependent factors in the extracted failure patterns; the step of calculating, as a correction coefficient, a ratio of the first failure probability to a second failure probability which represents the probability that any of the devices will fail due to the time-dependent factor within the predetermined time; and the step of creating a fault tree in which, when event symbols in a fault tree are called nodes, a failure of the device which is last activated when all of the devices fail is designated as a first node, the correction coefficient is designated as a second node, and a fault tree which represents the extracted failure pattern is designated as a third node, connecting the first node, the second node, and the third node with AND gates, and connecting the AND gates directly below a node which represents a top event.

[0009] Furthermore, the fault tree creation device of the present disclosure includes a means for comprehensively calculating combinations of failure factors for each of the plurality of devices in the case where all of the plurality of devices fail, in the case where the plurality of devices are in a backup relationship such that when one of the devices fails, one of the remaining devices is activated to replace the failed device, and extracting from the combinations a failure pattern in which two or more of the devices fail due to a time-dependent factor; and for the two or more devices that fail due to the time-dependent factor in the extracted failure pattern, calculating a first failure probability that two or more of the devices will fail within a predetermined time period, taking into account the order and timing of failure of the devices; The fault tree system includes: means for calculating, as a correction coefficient, a ratio of the first failure probability to a second failure probability which represents the probability that any of the devices will fail due to the time-dependent cause within the predetermined time; and means for creating a fault tree in which, when event symbols in a fault tree are called nodes, a failure of the device that is last activated when all of the devices fail is defined as a first node, the correction coefficient is defined as a second node, and a fault tree indicating the extracted failure pattern is defined as a third node, connecting the first node, the second node, and the third node with AND gates, and connecting the AND gate directly below a node indicating a top event.

[0010] Furthermore, a program disclosed herein includes a step of causing a computer to comprehensively calculate combinations of failure factors for each of a plurality of devices in the case where all of the plurality of devices fail, when the plurality of devices are in a backup relationship such that when one of the devices fails, one of the remaining devices is started to replace the failed device, and extracting from the combinations a failure pattern in which two or more of the devices fail due to a time-dependent factor; calculating a first failure probability that two or more of the devices will fail within a predetermined time period, taking into account the order and timing of failure of the devices, for the two or more devices that fail due to the time-dependent factor in the extracted failure pattern; and calculating, as a correction coefficient, a ratio of the first failure probability to a second failure probability which represents the probability that all of the devices will fail due to the time-dependent factor within the predetermined time period; and creating a fault tree in which, when event symbols in a fault tree are called nodes, a failure of the device that is activated last when all of the devices fail is designated as a first node, the correction coefficient is designated as a second node, and a fault tree indicating the extracted failure pattern is designated as a third node, the first node, the second node, and the third node are connected by AND gates, and the AND gate is connected directly below a node representing a top event. [Effects of the Invention]

[0011] The above-described fault tree creation method, fault tree creation device, and program can create a fault tree that enables a realistic evaluation of the failure probability when multiple devices in a backup relationship fail due to time-dependent factors. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 10 is a diagram illustrating risk assessment of multiple devices in a backup relationship. [Figure 2] 1 is a block diagram illustrating an example of a fault tree creation device according to an embodiment; [Figure 3] 10 is a flowchart illustrating an example of a fault tree creation process according to an embodiment. [Figure 4] FIG. 10 is a diagram illustrating an example of a combination of failure causes of a target device according to the embodiment. [Figure 5A] FIG. 1 is a first diagram illustrating calculation of a correction coefficient according to the embodiment. [Figure 5B] FIG. 2 is a second diagram illustrating calculation of a correction coefficient according to the embodiment. [Figure 6] FIG. 10 is a diagram illustrating an example of a condition FT according to the embodiment. [Figure 7] FIG. 10 is a diagram illustrating an example of an FT that reflects a failure probability that takes time dependency into consideration according to an embodiment. [Figure 8] FIG. 1 is a diagram illustrating an example of a hardware configuration of a fault tree creation device according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] <Embodiment> The fault tree creation method of this embodiment will be described below with reference to FIGS. (System Configuration) 2 is a block diagram showing an example of a fault tree creation device (hereinafter referred to as FT creation device) according to an embodiment. The FT creation device 10 creates a FT that can calculate the realistic probability of a system losing function when a failure due to a time-dependent factor occurs in two or more devices in a backup relationship that is required for the system to function.

[0014] The FT creation device 10 includes a data acquisition unit 11 that acquires various data such as the FT of the system to be evaluated, an input acceptance unit 12 that accepts user operations, a control unit 13 that controls the execution of the FT creation process, an output unit 14 that outputs the created FT etc. on a display device or as an electronic file, and a storage unit 15 that stores the data acquired by the data acquisition unit 11 and data during and as the processing result. The control unit 13 includes an extraction unit 131, a correction coefficient calculation unit 132, a condition FT creation unit 133, and a FT creation unit 134.

[0015] The extraction unit 131 extracts cut sets required to create a FT that takes into account the time dependency of equipment failures, and comprehensively calculates failure patterns that indicate combinations of equipment failure factors. The correction coefficient calculation unit 132 calculates a correction coefficient (a non-negative number equal to or less than 1) that represents the ratio between the failure probability of the preceding device and the succeeding device taking time dependency into consideration and the failure probability according to a conventional method in which a mission time is set for each of the multiple devices and calculations are performed. The correction coefficient calculation unit 132 calculates the correction coefficient for each failure pattern. The condition FT creating unit 133 creates a FT for each failure pattern, with the failures due to the failure causes of the devices that make up the failure pattern as base events. The fault tree creation unit 134 creates a fault tree (an Fault Tree that reflects the failure probability taking into account the time dependency of equipment failures) by connecting the nodes (1) to (3) above with AND gates directly below the node representing the top event (loss of function of the system being evaluated) for at least one of the multiple devices in a backup relationship (for example, the device that will be last operational), with respect to (1) the failure of that device, (2) a correction coefficient for one of the failure patterns, and (3) a condition fault tree (an Fault Tree that reflects the failure probability taking into account the time dependency of equipment failures) as nodes.In this specification, when the symbols used in the fault tree are event symbols, logical symbols, transition symbols, etc., the event symbols may be called nodes.

[0016] (operation) In this embodiment, we identify combinations of equipment failures to be refined from the cut sets (combinations of failures and faults that cause top events) obtained by FT using conventional methods, and create an FT that takes into account the time dependency of equipment failures. Next, we will explain how to create an FT that reflects the failure probability that takes into account the time dependency of equipment failures, with reference to Figures 3 to 7.

[0017] FIG. 3 is a flowchart illustrating an example of a fault tree creation process according to the embodiment. First, the data acquisition unit 11 acquires a conventional fault tracer (step S1). The conventional fault tracer is, for example, a fault tracer used in reliability assessment of a nuclear power plant, and is used to assess the reliability of a system to be assessed in a nuclear power plant when the system to be assessed loses its function. This fault tracer includes a cutset for when the system to be assessed loses its function. A cutset is a combination of one or more base events that cause a top event (a system loss of function). A base event is, for example, a failure to start equipment, a shutdown of equipment due to human error, or a failure of equipment due to a time-dependent factor. For example, if the system to be assessed includes equipment A, equipment B, and equipment C in a backup relationship, and the system is operated in such a way that equipment A starts up first, and when equipment A fails, equipment B starts up next, and when equipment B fails, equipment C starts up last, the cutset includes a fault tracer for when the system loses its function due to a failure of equipment A, a fault tracer for when the system loses its function due to a failure of equipment B, and a fault tracer for when the system loses its function due to a failure of equipment C. If devices are to be started in the order of A, B, and C, the entire FT is configured to indicate that device C will operate if devices A and B lose their functions, and that the system will lose its functions if devices A, B, and C lose their functions, and the failure probability of device C is set to the failure probability of device C itself. In conventional methods, the configuration of the entire FT is taken into account when assessing the risk of system function loss, and as a result, the probability that the system will lose its function due to the failure of device C is calculated by the failure probability of device C assuming the failure of devices A and B. For example, if devices A to C all fail to continue operating due to time-dependent factors, the probability that device A will fail to continue operating within the mission time multiplied by the probability that device B will fail to continue operating within the mission time multiplied by the probability that device C will fail to continue operating within the mission time is set. In reality, for device B, it is sufficient to consider the probability that device B will fail to continue operating during the time remaining after subtracting the time that device A was operating from the mission time, and for device C, it is sufficient to consider the probability that device C will fail to continue operating during the time remaining after subtracting the time that device A or device B was operating from the mission time, so the failure probability of device C calculated using the conventional method is overly conservative.Therefore, in the following process of this embodiment, for devices B and C, the probability of failure to continue operation within an appropriate time (failure probability taking into account time dependency) is calculated instead of the mission time, and the failure probability taking into account the time dependency of device failure is reflected in the FT. The data acquisition unit 11 stores the acquired conventional FT in the memory unit 15.

[0018] Next, the extraction unit 131 extracts quantitatively significant cutsets from the cutsets constituting the FT acquired in step S1 (step S2). A quantitatively significant cutset is a cutset that includes a base event whose importance (e.g., contribution to the risk of a top event occurring) is higher than a threshold, or a cutset whose occurrence frequency (occurrence probability) is higher than a threshold. The importance (contribution), the threshold for importance (contribution), and the threshold for occurrence frequency (occurrence probability) of each base event can be set arbitrarily, and, for example, this information is registered in advance in the storage unit 15. For each cutset, the extraction unit 131 compares the importance (contribution) of the base event included in the cutset and the occurrence frequency of the cutset with the respective thresholds, and extracts cutsets whose importance (contribution) or occurrence frequency is equal to or greater than the threshold. Cutsets whose importance (contribution) or occurrence frequency is lower than the threshold are excluded from processing.

[0019] Next, the extraction unit 131 extracts cut sets including multiple devices in a backup relationship from the cut sets extracted in step S2 (step S3). For example, the extraction unit 131 extracts cut sets including basic events related to failures (failure to continue operation, startup failure, etc.) of devices A, B, and C. Cut sets that are not related to multiple devices in a backup relationship are excluded from the processing. Assume that cut sets related to devices A to C have been extracted by the processing up to this point.

[0020] Next, the extraction unit 131 extracts combinations of failure factors (failure patterns) for the target devices A to C (step S4). The FT creation method according to this embodiment targets failures due to time-dependent factors that follow an exponential distribution (e.g., continued operation failures). Therefore, different correction coefficients (described later) must be applied depending on the combination of the base events of the continued operation failures. In step S4, combinations of failure factors for the target devices A to C are comprehensively extracted to organize the targets for which the correction coefficients should be calculated. The failure factors are classified into two categories: continued operation failures and other factors. Furthermore, the FT creation method according to this embodiment aims to create a FT for calculating a realistic failure probability, as opposed to calculating an overly conservative system failure probability by assuming that time-dependent factor failures will occur within the mission time for all of the multiple devices in a backup relationship. Therefore, only failure patterns in which two or more of the target devices A to C fail due to time-dependent factors are extracted. The extraction unit 131 creates a cutset for each extracted failure pattern. For example, the extraction unit 131 extracts failure patterns exemplified in cut sets A to D in FIG. 4 for the target devices A to C. "Other failures" in FIG. 4 represent failures (start-up failures, etc.) other than failures (failure to continue operation) caused by time-dependent factors. The correction coefficients in FIG. 4 will be explained in the next step S5. The extraction unit 131 stores the extracted failure patterns (cut sets) in the storage unit 15.

[0021] Next, the correction coefficient calculation unit 132 calculates a failure probability that takes time dependency into account and a corresponding correction coefficient for each extracted combination (failure pattern) (step S5). For example, in the case of a failure pattern in which all of devices A to C fail to continue operation (cut set A in FIG. 4), the correction coefficient calculation unit 132 calculates the probability that device A will fail to continue operation at some point during the mission time, the probability that device B will fail to continue operation for the remaining time during the mission time after device A fails, and the probability that device C will fail to continue operation for the remaining time during the mission time after device B fails. Then, by multiplying these values, the correction coefficient calculation unit 132 calculates the failure probability that takes time dependency into account for this failure pattern. The correction coefficient calculation unit 132 then calculates the correction coefficient A by dividing the failure probability that takes time dependency into account by the occurrence probability of the failure pattern according to the conventional method, which is obtained by multiplying the probabilities that devices A, B, and C will each fail to continue operation within the mission time. An example of a method for calculating the failure probability that takes time dependency into account is shown in FIGS. 5A and 5B. For ease of explanation, we will use as an example a method for calculating the probability that two pieces of equipment, for example, an emergency DG (diesel generator) and an alternative power source, will fail to continue operating when they are in a backup relationship where they are started up in that order. Figure 5A shows a calculation method based on a theoretical solution. If the probability density that the first emergency DG will fail (fail to continue operating) at time x is g(x), and the probability that the second alternative power source that started up at time x following the emergency DG failure will fail (fail to continue operating) at time t is f(tx), then the probability P(T) that all power sources will fail by mission time T can be calculated using the following equation (1):

[0022]

number

[0023] Figure 5B shows the calculation method using Monte Carlo simulation. Assuming that the probability that the emergency DG and alternative power source will fail to continue operation follows a normal distribution, the time x at which the emergency DG will fail to continue operation during mission time T is randomly selected based on probability distribution 5B1 in Figure 5B. Next, the time t at which the alternative power source will fail to continue operation between time x and time T is randomly selected based on probability distribution 5B2 in Figure 5B. The probability P(T) that all power sources will fail by mission time T is calculated by multiplying the probability density corresponding to time x based on probability distribution 5B1 by the probability density corresponding to time t based on probability distribution 5B2. This process is tried n times. The probability P(T) can then be calculated using the following equation (2):

[0024]

number

[0025] Similarly, the correction coefficient calculation unit 132 can calculate the probability P(T) that all of the devices A to C will fail due to each failure cause by the mission time T for each of the cut sets A to D in Fig. 4 using the above formula (1) or (2). The correction coefficient calculation unit 132 calculates correction coefficients A to D as the ratio of the calculated P(T) to the failure probability using the conventional method (for example, the calculated value of the cut set extracted in step S3), and stores the correction coefficients A to D (correction coefficient A corresponds to cut set A, correction coefficient B corresponds to cut set B; the same applies below) in the storage unit 15 in association with the failure pattern (cut set) extracted in step S4.

[0026] Next, the condition FT creating unit 133 creates a condition FT, which is a FT for identifying each combination (failure pattern) extracted in step S4 (step S6). In step S6, in order to limit the application range of the correction coefficients for each failure pattern calculated in step S5 to the corresponding failure pattern, a condition FT is created, which is a FT for associating unique correction coefficients one-to-one. Specifically, a logical condition is added so that correction coefficients A to D do not appear in cut sets other than the corresponding cut sets. FIG. 6 shows the condition FT for each cut set in FIG. 4. A condition FT 60a is a condition FT corresponding to cut set A in FIG. 4. Similarly, condition FTs 60b, 60c, and 60d in FIG. 6 are condition FTs corresponding to cut sets B, C, and D, respectively. The condition FT creating unit 133 associates the created condition FTs 60a, 60b, 60c, and 60d with the failure patterns (cut sets) extracted in step S4 and stores them in the storage unit 15.

[0027] Next, the FT creation unit 134 links the correction coefficient and the condition FT to the failure of the device that is expected last in the event progression (step S7). In this example, the device that is expected last in the event progression is device C, which is the last to start up. The correction coefficient calculated in step S5 and the condition FT created in step S6 are linked to the primitive event of device C. Specifically, the FT creation unit 134 links the primitive event representing the failure of device C due to a time-dependent factor (failure to continue operation) to the correction coefficient A and the condition FT60a, links the primitive event representing the failure of device C due to a time-dependent factor to the correction coefficient B and the condition FT60b, links the primitive event representing the failure of device C due to a time-dependent factor to the correction coefficient C and the condition FT60c, and links the primitive event representing the failure of device C due to a factor other than time-dependent to the correction coefficient D and the condition FT60d.

[0028] Next, the FT creation unit 134 creates an FT that reflects the failure probability taking time dependency into consideration, and the output unit 14 outputs the created FT to a display device, an electronic file, or the like (step S8). The FT creation unit 134 creates an FT (an FT that reflects the failure probability taking time dependency into consideration) by connecting the nodes (1) to (3) above with AND gates directly below the node representing the top event, with (1) the failure of device C, (2) a correction coefficient for one of the failure patterns, and (3) a condition FT for that failure pattern as nodes. The FT creation unit 134 creates an FT for each failure pattern extracted in step S4. Figure 7 illustrates an example of an FT that reflects the failure probability taking time dependency into consideration for each failure pattern (cutset) illustrated in Figure 4. FTs 70a, 70b, 70c, and 70d in Figure 7 are FTs that reflect the failure probability taking time dependency into consideration for cutsets A, B, C, and D, respectively. The FT creation unit 134 stores the created FTs 70a, 70b, 70c, and 70d in the storage unit 15 in association with the failure patterns (cut sets) extracted in step S4. For example, in the case of FT 70a illustrated in FIG. 7, the probability that all of devices A, B, and C will fail to continue operation (the probability according to the conventional method) is set as the base event of "Device C fails to continue operation" in the left node. The condition FT 60a in the right node is true only if FT 60a in FIG. 6 is satisfied (i.e., when devices A, B, and C all fail to continue operation). Therefore, FT 70a is an FT indicating that a top event (e.g., loss of system function) will occur if all of devices A to C fail to continue operation, and that the occurrence probability is the probability that all of devices A to C will fail to continue operation calculated by the conventional method multiplied by the correction coefficient A. The same applies to FTs 70b to 70d. FTs 70a to 70d are FTs that reflect the failure probability calculated taking into consideration the time dependency of the order of failures of multiple devices A to C in a backup relationship and the timing of failures of each device within the mission time, etc. This FT makes it possible to perform fault tree analysis for multiple devices in a backup relationship, taking into consideration the time dependency of the order of failures and the total mission time of the devices.Furthermore, by incorporating the time-dependent failure probability into FT as a correction coefficient, the importance of each piece of equipment relative to the probability and frequency of the loss of overall system functionality can also be appropriately evaluated.

[0029] (effect) As described above, according to this embodiment, only cut sets related to quantitatively significant and backup-related equipment failures are extracted from existing fault patterns, and all combinations of failure factors for each device when all devices fail are extracted. Then, for each extracted failure pattern, the occurrence probability is calculated taking time dependency into account, and the ratio to the failure probability obtained using the conventional method is calculated as a correction coefficient, which is reflected in the fault pattern as a base event. By multiplying the cut sets obtained using the conventional method by the correction coefficient, the probability and frequency of system loss of function can be calculated without excessive conservatism. Furthermore, a conditional fault pattern (FT) is created that specifies the combination of failure factors for which the calculated correction coefficient is valid, and the conditional fault pattern (FT) is reflected as a node. This allows a correction coefficient specific to that pattern to be valid only for a specific combination pattern of failure factors, enabling the failure probability corresponding to that failure pattern (the failure probability considering time dependency) to be accurately calculated. In this way, the FT creation device 10 according to this embodiment creates a FT that reflects a failure probability that takes time dependency into account by connecting a node representing a base event that indicates the failure of the last device to be activated when two or more of multiple devices fail due to a failure in continued operation, a node representing a correction coefficient, and a node representing a condition FT with an AND gate. This FT makes it possible to calculate a realistic failure probability when two or more of multiple devices in a backup relationship fail due to time-dependent factors. Furthermore, there are a huge number of FTs used in risk assessments in nuclear power plants, and each FT often has a large and complex structure. However, by using this embodiment to separately create a FT that reflects a failure probability that takes time dependency into account, the effort and time required for risk assessment can be reduced.

[0030] The above embodiment is directed to FTs used in reliability evaluation of nuclear power plants, but the application field of the FT creation device 10 is not limited to reliability evaluation of nuclear power plants, and it can also be applied to other industrial fields where reliability evaluation is performed using FTs.

[0031] 8 is a diagram showing an example of the hardware configuration of a fault tree creation device according to an embodiment. A computer 900 includes a CPU 901, a main storage device 902, an auxiliary storage device 903, an input / output interface 904, and a communication interface 905. The above-described fault tree creation device 10 is implemented in a computer 900. Each of the above-described functions is stored in the auxiliary storage device 903 in the form of a program. The CPU 901 reads the program from the auxiliary storage device 903, loads it into the main storage device 902, and executes the above-described processing in accordance with the program. The CPU 901 also allocates a storage area in the main storage device 902 in accordance with the program. The CPU 901 also allocates a storage area in the auxiliary storage device 903 for storing data being processed in accordance with the program.

[0032] A program for implementing all or part of the functions of the fault tree creation device 10 may be recorded on a computer-readable recording medium, and the program may be loaded into a computer system and executed to perform processing by each functional unit. The term "computer system" as used herein includes hardware such as an OS and peripheral devices. If a WWW system is used, the term "computer system" also includes a homepage provision environment (or display environment). The term "computer-readable recording medium" refers to portable media such as CDs, DVDs, and USBs, as well as storage devices such as hard disks built into the computer system. If the program is distributed to the computer 900 via a communication line, the computer 900 may load the program into the main storage device 902 and execute the processing described above. The program may be for implementing part of the functions described above, or may be capable of implementing the functions described above in combination with a program already stored in the computer system.

[0033] As described above, several embodiments according to the present disclosure have been described, but all of these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope of the invention and its equivalents as defined in the claims, as well as in the scope and spirit of the invention.

[0034] <Additional Notes> The fault tree creation method, fault tree creation device, and program described in each embodiment can be understood, for example, as follows.

[0035] (1) A fault tree creation method according to a first aspect is a fault tree creation method executed by a computer, the fault tree creation method including the steps of: when a plurality of devices are in a backup relationship such that when one of the devices fails, one of the remaining devices is started to replace the failed device; exhaustively calculating combinations of failure factors for each of the plurality of devices in the case where all of the plurality of devices fail; and extracting from the resultant failure patterns a failure pattern in which two or more of the devices fail due to a time-dependent factor; and, for the two or more devices that fail due to the time-dependent factor in the extracted failure patterns, calculating a failure pattern in which two or more of the devices fail within a predetermined time period, taking into account the order and timing of the devices' failures. and calculating, as a correction coefficient, a ratio of the first failure probability to a second failure probability representing the probability that any of the two or more devices will fail due to the time-dependent factor within the predetermined time period; and creating a fault tree in which, when event symbols in a fault tree are called nodes, a failure of the device that is last activated when all of the plurality of devices fail is designated as a first node, the correction coefficient is designated as a second node, and a fault tree representing the extracted failure pattern is designated as a third node, the first node, the second node, and the third node are connected by AND gates, and the AND gate is connected directly below a node representing a top event. This makes it possible to create a FT that enables the evaluation of realistic failure probabilities when multiple devices in a backup relationship fail due to time-dependent factors.

[0036] (2) A second aspect of the fault tree creation method for an evaluation target is the fault tree creation method of (1), wherein in the step of calculating the correction coefficients, correction coefficients are calculated for each of the failure patterns, and in the step of creating the fault tree, the fault tree is created for each of the failure patterns. This makes it possible to calculate realistic failure probabilities for each failure pattern.

[0037] (3) A fault tree creation method according to a third aspect is a fault tree creation method according to (1) to (2), in which, for a first device that starts up in a certain order and a second device that starts up next when the first device fails, if the extracted failure pattern causes the second device to fail due to the time-dependent factor, the first failure probability is calculated on the assumption that when the first device fails at time t in the specified time, the second device will fail due to the time-dependent factor within a time period after time t in the specified time. This makes it possible to calculate the failure probability taking time dependency into account.

[0038] (4) A fault tree creation method according to a fourth aspect is the fault tree creation method of (1) to (3), in which the second failure probability is set for the first node in the fault tree. This makes it possible to create an FT that can calculate a realistic failure probability by using the failure probability set in the original FT as is.

[0039] (5) A fault tree creation method according to a fifth aspect is a fault tree creation method according to any one of (1) to (4), wherein in the extraction step, the fault pattern is extracted if the occurrence frequency of the fault pattern or the importance (contribution) set for the fault pattern is equal to or greater than a threshold value. This allows only quantitatively significant failure patterns to be processed.

[0040] (6) A fault tree creation device according to a sixth aspect is a fault tree creation device, comprising: a means for comprehensively calculating combinations of failure factors for each of a plurality of devices in the case where all of the plurality of devices fail, when the plurality of devices are in a backup relationship such that when one of the devices fails, one of the remaining devices starts up to replace the failed device; a means for extracting from the combinations a failure pattern in which two or more of the devices fail due to a time-dependent factor; and a means for calculating a first failure probability in which two or more of the devices fail within a predetermined time period, taking into account the order and timing of failure of the devices, for the two or more devices that fail due to the time-dependent factor in the extracted failure pattern. and means for calculating, as a correction coefficient, a ratio of the first failure probability to a second failure probability which represents the probability that any of the two or more devices will fail due to the time-dependent cause within the predetermined time; and means for creating a fault tree in which, when event symbols in a fault tree are called nodes, a failure of the device which is last activated when all of the plurality of devices fail is defined as a first node, the correction coefficient is defined as a second node, and a fault tree which represents the extracted failure pattern is defined as a third node, connecting the first node, the second node, and the third node with AND gates, and connecting the AND gates directly below a node which represents a top event.

[0041] (7) A program according to a seventh aspect includes the steps of: in a computer 900, when a plurality of devices are in a backup relationship such that when one of the devices fails, one of the remaining devices is started to replace the failed device; comprehensively calculating combinations of failure factors for each of the plurality of devices in the case where all of the plurality of devices fail; and extracting from the combinations failure patterns a failure pattern in which two or more of the devices fail due to a time-dependent factor; and calculating a first failure probability that two or more of the devices will fail within a predetermined time period, taking into account the order and timing of failure of the devices, for the two or more devices that fail due to the time-dependent factor in the extracted failure pattern; the step of calculating, as a correction coefficient, a ratio of the first failure probability to a second failure probability which represents the probability that any of the two or more devices will fail due to the time-dependent factor within the predetermined time; and the step of creating a fault tree in which, when event symbols in a fault tree are called nodes, a failure of the device which is activated last when all of the plurality of devices fail is designated as a first node, the correction coefficient is designated as a second node, and a fault tree which represents the extracted failure pattern is designated as a third node, connecting the first node, the second node, and the third node with AND gates, and connecting the AND gates directly below a node which represents a top event. [Explanation of symbols]

[0042] 10. Fault tree creation device 11. Data acquisition section 12 Input reception section 13 Control section 131...Extraction part 132 Correction coefficient calculation unit 133...Conditional FT Creation Section 134···FT Creation Department 14. Output section 15...Storage section 900···Computer 901 CPU 902...Main memory 903...Auxiliary storage device 904 Input / Output Interface 905···Communication Interface

Claims

1. 1. A computer-implemented method for creating a fault tree, comprising: When a plurality of devices are in a backup relationship such that when one of the devices fails, one of the remaining devices is started to replace the failed device, a step of comprehensively calculating combinations of failure factors for each of the plurality of devices in the case where all of the plurality of devices fail, and extracting from the combinations failure patterns in which two or more of the devices fail due to time-dependent factors; a step of calculating a first failure probability that two or more of the devices will fail within a predetermined time period, taking into consideration the order and timing of failure of the devices, for two or more devices that fail due to the time-dependent cause in the extracted failure pattern, and calculating, as a correction coefficient, a ratio of the first failure probability to a second failure probability that represents the probability that any of the two or more devices will fail due to the time-dependent cause within the predetermined time period; an event symbol in a fault tree is called a node, and when all of the plurality of devices fail, the failure of the device that will be activated last is designated as a first node, the correction coefficient is designated as a second node, and a fault tree representing the extracted failure pattern is designated as a third node, then a step of connecting the first node, the second node, and the third node with an AND gate, and creating a fault tree in which the AND gate is connected immediately below a node representing a top event; A fault tree creation method comprising:

2. In the step of calculating the correction coefficient, a correction coefficient is calculated for each of the failure patterns, In the step of creating the fault tree, the fault tree is created for each of the failure patterns. The fault tree creation method according to claim 1 .

3. Regarding the second device that is activated next when the first device fails, if the second device fails due to the time-dependent factor in the extracted failure pattern, In calculating the first failure probability, the first failure probability is calculated on the assumption that the second device will fail due to the time-dependent factor at a time after the time at which the first device fails within the predetermined time period.

3. The fault tree creation method according to claim 1 or 2.

4. The first node in the fault tree is assigned the second failure probability.

3. The fault tree creation method according to claim 1 or 2.

5. In the extracting step, when an occurrence frequency of the failure pattern or an importance level set for the failure pattern is equal to or greater than a threshold, the failure pattern is extracted.

3. The fault tree creation method according to claim 1 or 2.

6. a means for comprehensively calculating combinations of failure factors for each of the plurality of devices in the case where all of the plurality of devices fail, and extracting from the combinations failure patterns in which two or more of the devices fail due to time-dependent factors, when the plurality of devices are in a backup relationship such that when one of the devices fails, one of the remaining devices is activated to replace the failed device; means for calculating a first failure probability that two or more of the devices will fail within a predetermined time period, taking into consideration the order and timing of failure of the devices, for two or more devices that fail due to the time-dependent cause in the extracted failure pattern, and for calculating, as a correction coefficient, a ratio of the first failure probability to a second failure probability that represents the probability that any of the two or more devices will fail due to the time-dependent cause within the predetermined time period; an event symbol in a fault tree is called a node, and when all of the plurality of devices fail, the failure of the device that is last activated is designated as a first node, the correction coefficient is designated as a second node, and a fault tree representing the extracted failure pattern is designated as a third node, a means for creating a fault tree in which the first node, the second node, and the third node are connected by AND gates and the AND gate is connected directly below a node representing a top event; A fault tree creation device having the above.

7. On the computer, When a plurality of devices are in a backup relationship such that when one of the devices fails, one of the remaining devices is started to replace the failed device, a step of comprehensively calculating combinations of failure factors for each of the plurality of devices in the case where all of the plurality of devices fail, and extracting from the combinations failure patterns in which two or more of the devices fail due to time-dependent factors; a step of calculating a first failure probability that two or more of the devices will fail within a predetermined time period, taking into consideration the order and timing of failure of the devices, for two or more devices that fail due to the time-dependent cause in the extracted failure pattern, and calculating, as a correction coefficient, a ratio of the first failure probability to a second failure probability that represents the probability that any of the two or more devices will fail due to the time-dependent cause within the predetermined time period; an event symbol in a fault tree is called a node, and when all of the plurality of devices fail, the failure of the device that will be activated last is designated as a first node, the correction coefficient is designated as a second node, and a fault tree representing the extracted failure pattern is designated as a third node, then a step of connecting the first node, the second node, and the third node with an AND gate, and creating a fault tree in which the AND gate is connected immediately below a node representing a top event; A program that executes the following.

Images