Computation¶

The Fault Tree module calculates the probability of failure (Unavailability) of a given fault tree. This probability can be calculated via two different types of calculation: The Exact method and the Minimal Cutsets method.

The Unavailability of the top gate is calculated taking the probability of each primary event and applying the logic of the gates. The primary events have different ways to enter the probability: Constant, Failure Rate and MTBF. Moreover, the primary events can be also dormant or hidden.

Average Flight Time (AFT)¶

The Average Flight Time is the mean time that the flight mission lasts, in hours. This time is taken to normalize the top gate probability per flight hour.

\[Q\;per\;FH = \frac{Top\;gate\;probability}{AFT}\]

The AFT is defined when the project is created.

Operation Time¶

The Operation Time (OT) is the percentage of time with respect to the AFT over which the Unavailability computation is performed. It can be used to calculate the probability of a certain incident taking place on a specific mission segment (e.g. during take-off). Computationally, it multiplies the Unreliability at the basic event level, thus affecting the value of each subsequent parent gate.

\[Q_{OT} = Q \cdot \frac{OT}{100}\]

However, the OT does not apply to hidden or dormant events. The OT is defined as a computation parameter in the “Calculate the probability” dialog box.

Primary Events Parameters¶

When a new primary event is inserted, one of the following calculation models shall be chosen:

Constant probability
In this model, the user can directly enter the Unavailability (Q). This value will remain constant.

The value can be entered with scientific notation (e.g. 1e-6)
- Failure Rate
In this model, the user can enter the failure rate to calculate the Unavailability (Q).

The Unavailability of the event is calculated using the following equation:

\[Q = 1 - e^{-\lambda t}\]

where:
\(\lambda\) is the Failure Rate

t is the dormancy/life time (see the Dormant/Hidden Primary Events section)
MTBF
In this model, the user can enter the MTBF (Mean Time Between Failure) to calculate the Unavailability (Q).

The Unavailability of the event is calculated using the following equation:

\[Q = 1 - e^{-\lambda t}\]

where:
\[\lambda = \frac{1}{MTBF}\]

MTBF is the Mean Time Between Failure

t is the dormancy/life time (see the Dormant/Hidden Primary Events section)
Dormant/Hidden Primary Events

For Failure Rate/MTBF models, the primary event could be treated as Dormancy Event or Hidden Event checking the corresponding checkboxes as shown in the picture below:

The Unavailability is defined by the Dormancy Time if the event is a dormant or by Life time if the event is hidden.

Note

If the event is not a dormant or hidden event, the AFT will be the value of t by default.

Vote Gate (K-of-N)¶

Beyond the AND and the OR gates, Robin supports the Vote gate, which represents a redundant configuration where the output occurs when at least \(K\) out of its \(N\) inputs occur. It is the usual way of modelling a redundancy such as “2 out of 3 channels must fail for the function to be lost”.

The Vote gate is logically equivalent to the OR of every possible AND combination of \(K\) of its children. Therefore, each combination of \(K\) children is a cut set of the gate, and the number of cut sets it contributes is:

\[\binom{N}{K} = \frac{N!}{K! \, (N-K)!}\]

For the particular case where all the \(N\) inputs are independent and share the same probability \(q\), the probability of the Vote gate reduces to the binomial expression:

\[Q = \sum_{i=K}^{N} \binom{N}{i} q^{i} (1-q)^{N-i}\]

In the general case, where the inputs have different probabilities and may share basic events, Robin applies the same combination logic used for the rest of the gates, so that repeated events are correctly accounted for in both the Exact Method and the Minimal Cutsets analysis.

Note

The value of \(K\) must be an integer between 2 and \(N\). The limit cases are already covered by the other gates: \(K=1\) is an OR gate and \(K=N\) is an AND gate.

Warning

The number of cut sets generated by a Vote gate grows very quickly with \(N\). A gate with a large number of children and an intermediate value of \(K\) can noticeably increase the computation time of the Minimal Cutsets analysis.

Creating and editing a Vote gate¶

A Vote gate can be created in the same way as the rest of the gates from the diagram, and it can also be used as the top gate of a fault tree. When the gate is created, or when its type is changed to Vote, Robin opens the Vote Threshold (K-of-N) dialog to introduce the value of \(K\).

The dialog indicates the number of children \(N\) of the gate and only accepts values within the valid range. The threshold can be modified at any time by editing the gate.

Note

Changing the type of an existing gate to Vote, or changing the value of \(K\), invalidates the previous results. The calculator symbol turns red to indicate that the tree needs to be recalculated.

Type of Calculation Method¶

There are two different types of calculation in Robin: Exact Method and Minimal Cutsets (MCS).

Minimal Cutsets calculation method

The Minimal Cut Sets are the smallest groups of basic events that combined cause the top event to occur.

Once the minimal cut sets are found, the top event probability \(Q_T\) can be approximated with the so-called “rare event approximation”:

\[Q_T \cong \sum_i Q_i\]

where \(Q_i\) denotes the unavailability of each considered cut set, which can be expressed as the product of all the basic events conforming that cut set:

\[Q_i = \prod_k Q_k\]

This method ignores the possibility of two or more minimal cut sets being simultaneous, but it generally gives results agreeing within 10% of the exact unavailability for Q<0.1.

Although the MCS enables the analytical computing of Fault Tree Analysis, a maximum order of cut sets has to be set to improve the performance of the computer-aided calculation. A cut set cutoff allows the higher-order cut sets, which have a small contribution to the total probability (e.g. a few orders of magnitude less than 10-9), to be ignored as they would not have a relevant effect on the overall probability calculation.

To calculate the Unavailability using the Minimal Cutsets, click on the red calculator. Leave unchecked the Exact computation (not MCS)* option. The user can define the cutset cutoff and the percentage of operation time. Finally, the user can calculate only a selected gate clicking first in a gate and checking the option Calculate selected*.

The method of Minimal Cut Sets is extensively used and accepted by many industries as it provides an approximation that can be tailored to obtain a result suitable for certification substantiation, which usually involves usage of small probabilities (order of magnitudes smaller than 0.1). For applications where higher probabilities are used, MCS is not a suitable solution.
Exact calculation method

The Minimal Cut Sets methods are widely used due to its performance advantages and not needing the data of all the basic events. However, an exact solution can only be achieved using the direct analysis evaluation, which involves creating a top-down recursive algorithm that directly analyzes the exact probability of the desired event not considering minimal cut sets or maximum order of cut sets.

To calculate the Unavailability using the exact, click on the red calculator. Check the Exact computation (not MCS)* option. The user can define the percentage of operation time, the cutset cutoff parameter will be disabled for this calculation method. Finally, the user can calculate only a selected gate clicking first in a gate and checking the option Calculate selected*.

This method gives the exact top gate probability but needs more computational resources and the spends more time than the Minimal Cutsets method.

Note

The calculator symbol will be red if the fault tree has been modified and needs to be recalculated. Once the probability has been calculated, the calculator color will change to brown.

Calculating in the background¶

Calculate current FTA and Select FTAs to calculate go on in the server while you keep working: you can open another fault tree, change system, go to another module or even close Robin, and the calculation does not stop.

While it runs, the message at the bottom right corner of every page of Robin says which fault tree is being calculated and how far it got, for example Please wait. SFC-29_32-03.1B is being calculated (7 of 10).

When it ends, if you are in the diagram of its system, the results open there as always. Anywhere else, the message shows them: click a fault tree to open it, and Close to hide the results. If you closed Robin, they wait for you the next time you open any page.

Only one calculation per user runs at a time: wait until it ends, or cancel it, before starting another one.

If the server restarts during the calculation (for example while Robin is being updated), it stops: the fault tree being calculated keeps its previous results, and the message says which fault trees were not calculated, so you can calculate them again.

The Summary page and the options to calculate all the fault trees of a system or project still calculate while the page waits.

Cancelling a calculation¶

While a calculation runs, the message at the bottom right corner that says which fault tree is being calculated has a Cancel calculation button, on any page. On the Summary page the button is below the loading image. Click it to stop the calculation:

The fault tree being calculated keeps the results it had before: its probability, the probability of its gates (and of their copies in other fault trees) and the calculator color do not change. Its calculation stops in about a second, except when it is already writing its results, which takes a moment: then it finishes and shows them.

With Select FTAs to calculate, the fault trees calculated before the cancel keep their new results, and the ones not calculated yet are not calculated. The Calculation Results window lists each of them: its new probability, or that it was cancelled and keeps its previous results.

Nothing of a cancelled fault tree pops up later when a page of the module loads.

Out of date alert¶

When a fault tree is changed after its last calculation, an alert at the top right corner of the diagram, also when it is maximized, says that the fault tree has changed and has to be recalculated. After 3 seconds it collapses to its warning icon so the diagram below can be seen. Click the icon to open the alert again, or to collapse it. Once collapsed, it stays collapsed while you edit the fault tree; it opens again when you change to another fault tree or another system. A fault tree that has never been calculated has its calculator red, but no alert: nothing changed in it. Its Calculate link opens the same window as the calculator. The alert disappears once the probability of the whole fault tree is calculated again (calculating only a selected gate leaves it on screen).

The fault tree is out of date after any change that alters the result:

Adding, deleting, pasting or cutting nodes.

Changing the Q, the failure rate or MTBF, the model, the dormancy time, the dormant or life time option of an event, or turning it into a copy of another one (giving it an existing ID).

Changing the type of a gate or the K of a Vote gate.

Switching a node or a branch off or on.

Undo and Redo.

Changing the Average Flight Time of the project, or the OH/FH ratio of a system linked to an FMEA, when it changes the Q of its events.

Importing the basic events from a CSV file with new values.

Changing the failure rate of an FMEA failure mode linked to an event.

When the event changed is repeated in other fault trees, those are out of date as well. Changing only the description, the notes, the source or the DSR of an event, hiding a node in the print or moving it does not change the result, so the calculator stays as it was.

Calculating several fault trees¶

In the “Calculate the probability” dialog box, choose Select FTAs to calculate and check the fault trees of the system to calculate, or Select All. They are calculated one after the other with the same parameters, and the Calculation Results window lists them all at the end with their probability, or the reason why one could not be calculated.

The Time (s) column of the Calculation Results window gives the seconds each fault tree took, and the text above the list gives the total of all of them. It counts all the time the server spent on the fault tree: checking it, calculating it and saving its results, so it can be a little longer than the Time (s) of the Calculation log, which counts only the calculation. A fault tree that was not calculated now (skipped, cancelled or blocked by its warnings) shows a dash.

A fault tree with no changes since its last calculation is skipped, because it would give the same result:

It is skipped only when that last calculation was of the whole fault tree, it went well, and it used the same parameters: the cutset cutoff, the percentage of operation time, the exact or MCS method and the dormancy failure model. With any other parameter it is calculated again.

The results window says how many were skipped, and the row of each one shows the probability of its last calculation with the notice Skipped: no changes since its last calculation.

Any of the changes listed in Out of date alert makes it be calculated again.

To calculate every fault tree selected, also the ones with no changes, click Force recalculate instead of Calculate. The button is shown only with Select FTAs to calculate: Calculate current FTA always calculates the fault tree.

Calculation log¶

Check Print log in the “Calculate the probability” dialog box to download an Excel file when the calculation ends. It works with Calculate current FTA and with Select FTAs to calculate.

The file has one row for each fault tree calculated, in the order they were calculated, with these columns:

FT name: the ID of the top gate of the fault tree.

Nodes nº: the nodes the calculation takes into account, the top gate included. Remarks and switched off branches are left out.

Primary events nº: the basic and undeveloped events, counting each copy of a repeated event.

Primary events nº (unique): the different primary events, each repeated event counted once.

Gates nº: the AND, OR and Vote gates, the top gate included. A transfer gate counts as the type of gate it is.

Nº of AND gates, Nº of OR gates, Nº of vote gates: the gates of each type.

q: the probability of the top event per flight hour, the one shown when the calculation ends.

Method: MCS with the cutset cutoff and the probability cutoff used, or Exact when Exact computation (not MCS)* is checked (the exact method leaves no cut set out, so it has no cutoffs).

Time (s): the time the calculation took, in seconds.

Notes: why a fault tree has no result (it could not be calculated or the calculation was cancelled), or that it was skipped.

Note

A fault tree skipped because it has no changes since its last calculation with the same parameters shows the q, the Method and the Time (s) of that last calculation, and says so in Notes. Use Force recalculate to get the time of a new calculation of each one. Cancelling a Calculate current FTA downloads no log.

Minimal Cutsets Analysis¶

Minimal cut set analysis identifies all combinations of basic events that result in the occurrence of the top event. These basic event combinations, called cut sets, are then reduced to identify those “minimal” cut sets, which contain the minimum sets of events necessary to cause of the top event. This analysis ensures that any single event that appears repeatedly in various branches of the fault tree is properly accounted for.

The result of this analysis is a report (PDF or Excel) with the list of all the minimal cutsets (the ones containing a dormant/hidden event are highlighted) and their probablities. This analysis is useful to identify the Single Points of Failure (SPFs) that lead to the top event to occur.

To calculate the Minimal Cutsets, click on the red symbol circled in the picture below. Define the Cut Set Cutoff and the Probability Cutoff parameters. These parameters are used to assign a cutoff in order to improve the speed of the analysis, ignoring the minimal cutsets that would not have a relevant effect on the overall probability calculation.

Note

The Probability Cutoff also leaves out the order 1 cutsets (Single Points of Failure) less likely than it. When that happens, Robin shows a warning listing them with their probability, so that no SPF is missed without notice, and asks whether to include them in the export before downloading it. Answer Yes to add them to the export, whose header then reads Probability Cutoff: <value> except for Single Points of Failure, or No to download it without them. In the full export the question appears in the cutsets section, and only the cutsets file waits for the answer.

The user can analyze only the Minimal Cutses of a selected gate clicking first in a gate and checking the option Calculate selected*.

Checking the option Print in .xlsx format* (or the Excel format switch of the Minimal Cut Sets in the Full export) generates an Excel file instead of the PDF. The file has two sheets:

Export Sheet: one cutset per row, with its order and its probability.
CutSets: the same cutsets with each basic event in its own column (Basic Event 1, Basic Event 2, …), as many columns as the highest order, followed by the order and the probability. The header has a filter, so the cutsets can be filtered and grouped by basic event, for instance for a Common Cause Analysis.

Once the Minimal Cutsets have been analyzed, the user can highlight the different minimal cutsets clicking on the new dropdown and selecting a cutset as shown in the pictures below.

Note

The Minimal Cutset symbol will be red if the fault tree has been modified and needs to be recalculated. Once the probability has been calculated, the symbol color will change to brown.