Aerospace and Electronic Systems Magazine March 2017 - 14

Refining Fault Trees Using Aviation Definitions for Consequence Severity
case, summarized in Table 15, is highly dependent on operational
assumptions. Note that traditional fault-tree analysis accounts for
multiple repeated fault instances using multiplication, at least for
low probability events, as described in the development of (7). (For
example, if an event carries a very small failure probability p then
the approximate failure probability for ten events would be 10p.)
Multiple occurrences of an event are more precisely modeled by
applying an OR gate, particularly when probabilities are nonnegligible (as in the no fault case for our analysis).
More conventional promotions elevate the severities associated
with a fault event. In Figure 5, such events included promotions P02,
P04, and P05. The promotion events were implemented with an OR
operation for binary analysis, a fuzzy OR operation for fuzzy analysis, and a promotion operation for CSL analysis. In all cases, the
promotions were modeled to introduce an additional 10−7 probability
of a major consequence and a smaller additional probability of more
severe consequences (Table 16). In the binary analysis, all major,
hazardous, and catastrophic consequences were grouped together,
so the 10−7 fault probability covered all relevant cases. In the fuzzy
analysis, additional values in the probability distribution needed to
be defined, to allow promotion of severity to higher levels. To this
end, probabilities of 10−9 and 10−11 were assigned to the hazardous
and catastrophic severity levels of the modifier distribution used
in fuzzy analysis. By comparison, the CSL promotion operation is
simpler to implement, because the promotion allows all severities
to be promoted by one level with a specified probability. Thus, only
one probability needed to be assigned to define the CSL promotion
states. In our analysis the CSL probability for promoting severity by
one level was set to 10−7/m. The value was based on the minor event
probability m, based on the notion new major events result from the
promotion of otherwise minor events. In this example, the end result
is that promoted minor events contribute an additional increment of
10−7 (or more) toward the combined probability of major events.
Mitigation modifiers reduce the risk associated with each fault
event. In the binary analysis, mitigation was implemented using a binary AND gate. In fuzzy analysis, mitigation was implemented with a
fuzzy AND gate. In CSL analysis, mitigation was implemented with
the mitigation gate. (The mitigation gate provides a probability of
reducing each fault event by one severity level.) Mitigation failure
probabilities are listed in Table 17. The probability that the mitigation
succeeds is the complementary probability C, computed to ensure a
unit sum for the total mitigation probabilities in each row of the table.

Table 15.

Promotion (Repetition) Operations
Instances of Input Distribution
Combined by OR

Event
P01

N01 = 100

P03

N03 = 10

Table 16.

Promotion (Standard) Operations
Event

None

Min

Maj

Haz

Cat

Binary

10−7

Fuzzy

CSL

10−7/m

Min

Maj

Haz

Cat

P02, P04, P05
−7

−9

10−11

Table 17.

Mitigation Operations
Event

None

M01, M03, M04
Binary

10−2

Fuzzy

10−2

Binary

10−3

Fuzzy

10−3

CSL
M02

CSL

IEEE A&E SYSTEMS MAGAZINE

MARCH 2017

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine March 2017