Download ASSESSING AND N. MITNE-284

ASSESSING THE RELIABILITY OF COMPONENTS
AND COMPLEX SUBSYSTEMS
MITNE-284
July, 1988
Prepared by:
N. Siu
T. Pagnoni
ASSESSING THE RELIABILITY OF COMPONENTS
AND COMPLEX SUBSYSTEMS
MITNE-284
July, 1988
Prepared by:
N. Siu
T. Pagnoni
Principal Investigator:
N. Siu
Department of Nuclear Engineering
Massachusetts Institute of Technology
Cambridge, Massachusetts 02139
Progress Report Prepared for:
Rockwell International Corporation
R. T. Lancet, Program Manager
Reactor Plant Safety/Reliability
ACKNOWLEDGEMENTS
This report is part of the MIT Department of Nuclear Engineering project
"Nuclear Power Design Innovation for the 1990's." The objective of this project is
to assess and explore promising technological avenues for enhancing the
attractiveness of the U.S. nuclear energy option.
Financial support for this study was provided by the Rocketdyne Division of
Rockwell International Corporation. The authors would like to acknowledge Bob
Lancet of Rockwell International for his support, and Anne Hudson for her
assistance in report preparation.
TABLE OF CONTENTS
Page
Section
Title
1.0
Introduction and Summary
1
1.1
1.2
1.3
Objectives
Background
Summary of Results
1
1
3
2.0
Overview of Approach
5
3.0
Check Valve Characterization
11
3.1
3.2
Check Valve Modeling
Check Valve Failure Data
11
13
4.0
Check Valve Analysis
19
4.1
4.2
4.3
4.3.1
4.3.2
4.3.3
Failure Mode Identification
Statistical Analysis of MCS Frequencies
Continuous Variable MCS Quantification
Independent Failure
Dependent Failures
Quantification
19
19
22
22
25
25
5.0
Concluding Remarks
35
6.0
References
37
Appendix
An Overview of First Order Reliability Analysis
A-1
LIST OF TABLES
Table
Title
Page
1
Check Valve Failure Data
14
2
Minimal Cut Sets for Swing Check Valve (Fail to Close)
30
3
Characteristic Parameters for rl(Ad| E)
31
4
Typical Values for Check Valve Wear Model Parameters
32
5
Sensitivity Analysis Results
33
LIST OF FIGURES
Figure
Title
Page
1
A Typical Swing Check Valve [8]
7
2
Hypothetical Relationship for Stud and Shaft Wear
8
3a
Conventional Fault Tree for Failure Example
9
3b
Shorthand Fault Tree for Continuous Variables
(Using CAND Gate)
9
4
Stress-Strength Model
10
5
Multivariable Failure Model
10
6
Regions of Flow-Induced Motion in Check Valves [16]
16
7
Distribution of Failure Types, Swing Check Valve
Fail-To-Open (FTO)
17
8
Distribution of Failure Types, Swing Check Valve
Fail-To-Close (FTC)
18
9
Fault Tree for Swing Check Valve Fail-To-Close
34
1. Introduction and Summary
1.1
Objectives
The reliability of a component (or a complex subsystem), the probability that
the component will function when demanded and for the duration of the mission, is
one of the key parameters to be considered when designing a new component for use
in a nuclear power plant safety system. In order to conduct the design optimization
process, formal tools for analyzing component reliability are required. These tools
must be capable of treating those characteristics unique to components (as opposed
to larger systems composed of components), and must be useful even when no
operational or test data are yet available.
The latter case, where the component is still in the design or construction
phase, is especially important to the expanded use of reliability analysis methods in
the design process. Without success/failure data, of course, the predictions even of
formal models will be subject to considerable uncertainty. However, they will show
the level of reliability and the principal contributors to failure expected based on the
current state of knowledge. Perhaps more importantly, they will also identify levels
of key parameters needed to assure a high level of reliability. For example, if
particular component assembly tolerances are identified as being critical to the
overall reliability, special attention can be paid to ensuring that these tolerances are
met.
This report identifies and, where necessary, develops tools useful for the
quantitative reliability modeling of components. These tools are intended for the
use of a designer, and are to be applicable even when developing an entirely new
design for which no directly applicable failure data are available. The initial area of
application is in the design of mechanical components; however, the methods
adopted should be general enough to handle a wide variety of cases.
Background
Formal methods have been developed to evaluate the reliability of systems
composed of components whose individual reliabilities can be estimated from
available data, and where the interactions between components are fairly limited
(e.g., [1,2]). However, methods to analyze the reliability of the components
themselves when data are not available have not received the same amount of
1.2
attention.
In a typical safety system reliability analysis, the hardware contribution to
1
component unreliability is quantified using two parameters: Qd, the unreliability on
demand, and A, the (assumed) constant failure rate of the component. The
hardware unreliability is then given by
Qd+(1-Qd)(1-e
Qh
Qd + A
where r is the system mission time.
Both Qd and A can be estimated from available failure and success data using
a variety of approaches. Bayesian methods are generally used when the amount of
data is fairly limited and when experts' opinions are employed to supplement the
data base [3].
More complex models than the Qd-A model can be used, of course. One
approach, not generally used in nuclear plant assessments but fairly widespread in
other industries, is to assume that the time-to-failure model is governed by a more
complex distribution, such as the Weibull, rather than an exponential distribution.
In the case of the Weibull, the single parameter A is replaced by two parameters a
and
#:
Qh
~
A(t)
=at-
(1.2)
d + JA(t)dt
where
Equations (1.1) and (1.2) are statistical models for component failure. They
quantify the likelihood of failure, but do not identify the failure mode, and,
therefore, do not indicate design options that can be taken to reduce the likelihood
of failure. To accomplish the latter objective, a more detailed model of the
component is required.
At first glance, the standard methods used to analyze system reliability (e.g.,
block diagrams and fault trees) should also be used to analyze component reliability,
since most power plant components can be considered as complex subsystems.
However, two characteristics of system designs which enable the effective use of
2
these methods are not shared by many components.
First, the performance of a standby safety system can usually be modeled in
terms of the success or failure of its constituent components. The question of how a
system will fail can be answered in terms of discrete combinations of component
failures. Thus, a particular swing check valve can be singled out as being a
dominant contributor to unreliability; improvements to increase system reliability
can be made by improving the valve or adding a redundant path. At the component
level, however, a discrete model may not be as useful. The check valve failure may
be due to a combination of continuously varying factors, such as the amount of wear
of the valve hinge, the amount of corrosion product build up in the valve body, and
so forth, all of which combine to cause overall failure. The failure of the component,
therefore, often cannot be resolved in terms of the success or failure of the
component's parts, but rather must be described in terms of continuous changes in
these parts and the interaction between the parts.
The second problem, related to the first, is that the current reliability analysis
methods for treating interactions between components are not tailored to treat the
interactions between component parts. In a standard system analysis, interactions
between components are usually limited in number and quite well defined. Cause
and effect relationships often are non-existent (e.g., the failure of one valve does not
cause the failure of another) or unimportant (e.g., loss of flow through a valve
causes pump failure through overheating, but the system is already failed due to loss
of flow). Correlation models for treating coupling between components exist (e.g.,
[4-6]), but are intended to model the more or less simultaneous failure of
components due to a single common cause. Compared with components in a
system, the parts in a component are often more tightly coupled. Changes in a part,
which, as indicated above, cannot always be modeled in terms of "success" or
"failure" of that part, affect the behavior of other parts; the combination of changes
in all of the parts leads to success or failure of the component.
1.3
Summary of Results
From the above discussion, it can be seen that current plant analysis methods
for determining reliability are not completely suited for analyzing components. This
report presents a potential approach for extending these methods.
The approach employs conventional reliability analysis tools (e.g., fault trees)
to identify component failure modes (see Section 2). Some of the failure modes
involve mechanical failure, and are treated by limited physical modeling of the
3
component. Structural reliability analysis methods developed in civil engineering
which deal explicitly with continuous systems, are applied when appropriate. A
computer code which implements these latter methods, called FORM [7], is useful in
this context. Other failure modes are treated using statistical techniques currently
used to analyze component failure frequencies.
To ensure a good degree of practicality and realism in the approach, the study
is conducted with reference to a particular example: the analysis of swing check
valve reliability. This is believed to be a good example because of the simple design
involved; a realistic analysis can be performed without becoming overwhelmed by
details. It is also a good example because failure data obtained from actual field
experience are available, therefore allowing a comparison of the relative importance
of the different failure modes.
The characteristics of swing check valves and available information on their
failure are outlined in Section 3. The latter information include predictions of
engineering models as well as field data. Information has also been obtained from
interviews with Professor P. Griffith, an expert on check valve behavior, and with
personnel familiar with the operation and failure of check valves in marine
propulsion applications.
The methodology discussed in Section 2 is applied to selected portions of the
check valve reliability analysis in Section 4. The purpose is not to actually quantify
check valve reliability, but rather to: a) show how this quantification can be
performed, given the available models and data, and b) to show how the
methodology is useful in identifying and quantifying the impact of critical design
parameters which can affect reliability.
Section 5 discusses the results of the analysis and how these results can be
applied to the design of new components and subsystems.
4
2. Overview of Approach
From the preceding discussion, component reliability models must treat
complex interactions between parts, interactions which are not naturally
represented using discrete logic diagrams. On the other hand, specific component
failure modes can generally be identified. The approach adopted, therefore, has
both continuous and discrete features.
The first step in the analysis is to construct a fault tree for the component.
As with any other fault tree, the objective is to identify all of the different
mechanisms that may cause failure; special care must be taken to ensure
completeness. Unlike conventional fault trees, the basic events for the tree may
include partial failures; a special AND gate the "CAND" gate, is introduced to show
that continuous combinations of different levels of degraded part performance can
lead to failure. While the CAND gate is an AND gate with respect to the logic
structure of the tree, it is not treated as a conventional (discrete) AND gate when
quantifying the likelihood of the gate's top event.
For example, consider a swing check valve where the combined wear of the
shaft and of the attaching stud (see Figure 1 [8]) can cause improper seating of the
gate. Consider a hypothetical relationship between the wear of the two parts and
failure (improper seating) as illustrated in Figure 2, a conventional fault tree for this
event is shown in Figure 3a. The corresponding tree which uses the shorthand
CAND notation is shown in Figure 3b.
The second part of the analysis is to quantify the likelihood of the fault tree
top event, i.e., to quantify the minimal cut sets of the tree. In some cases, the basic
event likelihoods are determined as in standard analyses (e.g., the frequency of
improper re-assembly following maintenance). In others, particularly those linked
by CAND gates, a methodology which can treat the interaction of continuous
variables is needed.
A direct treatment of continuous variables is suggested by the well-known
stress strength model [9]. Let a represent the "stress" on a particular part, and
let S represent that part's "strength" with respect to the stress. Let a be a random
variable with probability density function p (-) and let S be a fixed value (see
Figure 4). Then,
5
P{failure} = P{Stress > Strength}
=
(2.1)
PU(u)da
An extension of this method to more than one variable is immediately
suggested. Let X and Y be two governing random variables with joint density
function PXy(-, -), and define a region of failure RF as shown by the shaded area in
Figure 5. Then
P{failure} =
J
JPxy(x,y)dxdy
RF
(2.2)
Two practical problems keep the analysis from being entirely straightforward.
First, the key parameters (X and Y in this case), the joint density function, and the
failure region must be defined. Depending upon the particular problem, this may
not be an easy task; it is further addressed in the context of check valve analysis in
Section 4. Second, a very large amount of computation is required if several
variables, rather than just two, are needed to characterize component failure, or if
the parameters of the joint density function are themselves uncertain. Numerical
approximations to reduce the computational load have been considered extensively
by civil engineers. One approach is to linearize the boundaries of RF and to
transform the governing variables (e.g., X and Y) such that the transformed
variables (e.g., X' and Y') follow a multivariate normal distribution. This method,
called "First Order Reliability Analysis" [7,10-14], is discussed in the Appendix.
An application of this method to the swing check valve problem is discussed in
Section 4.
6
anti-rotation
gate
Figure 1: A typical swing check valve [8]
7
Stud
Wear
No Failure
Shaft Wear
Figure 2: Hypothetical Failure Relationship
for Stud and Shaft Wear
8
Figure 3a: Conventional Fault Tree for Failure Example
Figure 3b: Shorthand Fault Tree for Continuous Variables
(Using CAND Gate)
9
Survival
Stress
pdf
Failure
W=S
Stress
Figure 4: Stress-Strength Model
V
RF (f eil ure)
/
,
x
.
Figure 5: Multiveriable Failure Model
10
3. Check Valve Characterization
The problem of check valve reliability analysis is selected to provide a simple
area of application for the methodology. It should be noted that despite this
simplicity, check valve failures are often visible contributors to system
unavailability, and the analysis of these failures is therefore important.
A typical check valve design is shown in Figure 1 [8]. It can be seen that the
valve has only one moving assembly: the arm/gate assembly. Two failure modes of
importance are fail to close (FTC) and fail to open (FTO). The former can be
caused by improper seating of the gate on the valve seat which, in turn, can be
caused by a number of mechanisms. For example, shaft or hinge wear can lead to
vertical displacement of the gate and, therefore, improper seating of the gate.
Improper seating can also be caused by cocking of the gate, which may occur after
the securing nut is loosened.
In this section, physical models relevant to check valve degradation due to
hinge wear and due to gate tapping are briefly outlined and failure data from
nuclear power experience are described. The presentation in both cases is not
exhaustive; the objective is to indicate the kind of information available for existing
components and the failure modes likely to be experienced under realistic operating
conditions.
Check Valve Modeling
Reference 15 presents a number of mechanisms leading to the FTC mode
observed in nuclear power plants. Two particular failure initiators analyzed in some
3.1
detail are hinge wear, which may lead directly to improper seating or to jamming,
and gate tapping against the stop (see Figure 1), which may lead to failure of the
cotter pin, loosening of the nut, and eventual improper seating or jamming.
Hinge wear is caused by pivoting of the arm/gate assembly about the hinge.
A correlation for the volume of material removed as a function of the flow velocity
is [15]:
V
=
(3.1)
(KF) 3FAe
11
where
V
= rate of volume removal
K, F
P
= material constants
= material hardness
Fn
= normal force =
W
= weight of gate
Wa
= weight of arm
sin( ave
[W -
Wa/2l sin( 0ave)
- W a/2)bg[(W
_ K pA(vave
)2g
b
= buoyancy factor for metal in liquid
g
=
=
=
=
p
A
vave
At
6max
'min
v.
vm
weddy
rp
acceleration of gravity
liquid density
gate area
average flow velocity
= sliding distance = 2(Oax =
=
=
=
min)eddy
maximum angle of displacement (calculate using vmax)
maximum angle of displacement (calculate using vmin)
maximum flow velocity
minimum flow velocity
eddy frequency = 0.04 vave
r
=
p
= pipe radius
Note that vmax and vmin characterize the short time scale fluctuations of flow
velocity about vave'
For a given valve in a given application, the only random variable in
Equation (3.1) is vave, the average flow velocity. Thus, if the distribution for vave
can be developed, the distribution for the amount of hinge wear can be developed
very simply from Equation (3.1).
Valve tapping, the striking of the valve stop by the gate, becomes a problem
when the flow is not strong enough to keep the gate in the fully open position
(pegged against the stop) and is not weak enough to allow the gate to swing freely.
Figure 6 presents an experimentally derived map of the three different regimes
(pegged, tapping, and swinging free) as a function of flow velocity and the L/D
12
ratio, where L is the distance of the valve from the nearest flow disturbance in the
pipe and D is the pipe diameter. The L/D ratio is an indication of the amount of
turbulence at the valve location; high values are associated with fully developed
flow, which is less likely to lead to tapping. Not shown in Figure 6 is the frequency
of tapping, which probably increases with decreasing L/D.
If the frequency of tapping can be determined as a function of vave and L/D,
figures such as Figure 6 [16] can be used to determine the distribution of the number
of taps in a given time interval (recall that vave is a random variable). Mechanical
models needed to translate the tapping into the likelihood of cotter pin failure, nut
backing off, and subsequent displacement of the gate are still needed.
Check Valve Failure Data
The above models for check valve behavior focus on specific valve failure
modes which can be analyzed using physical principles. While these modes have
actually been observed, they are not all-inclusive. Failure mechanisms less
amenable to rigorous theoretical analysis, such as the plugging of the valve by trash
in the system, may be equally important, if not more so.
To determine the importance of these other failure modes, and to obtain a
3.2
general picture of the variety of failures that may be experienced by a mechanical
component in real service, descriptions of 63 check valve failures were obtained from
Nuclear Power Experience (NPE) [17], covering the years 1975 through 1983. NPE
is a private compilation of event narratives based largely, but not entirely, on the
Licensee Event Reports (LERs) submitted by the utilities to the United States
Nuclear Regulatory Commission. The narratives vary greatly in detail, but usually
indicate such information as the plant name, the date of the incident, the system
involved, the failure cause, the failure mode, and the consequences of the event.
A breakdown of the fail-to-open failure data (12 events) for swing check
valves is presented in Figure 7; a similar breakdown for the fail-to-close failure
mode (40 events) is presented in Figure 8. Table 1 provides a listing of all of the
events considered. The two figures show that both random (e.g., jamming by a
foreign object) and degradation-related failures are important. Thus, a complete
failure model must address both types of failure.
13
Table 1 - Check Valve Failure Data (Page 1 of 2)
Record
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
Event
BWR-2.VII.E.p6.34
BWR-2.VII.A.p7.40
BRW-2.VII.C.p14.61
BWR-2.VII.D.p4.16
BWR-2.VII.C.p14.61
BWR-2.VII.E.p3.11
BWR-2.VI.E.p17.65
BWR-2.VII.A.p13.76
BWR-2.VII.A.p14.83
BWR-2.VII.A.p16.94
BWR-2.VII.A.p16.95
BWR-2.VII.D.p36.171
BWR-2.VII.D.p40.185
BWR-2.VII.D.p48.236
BWR-2.VII.E.p22.90
BWR-2.VII.E.p33.139
BWR-2.VII.E.p47.213
BWR-2.VII.F.p18.65
BWR-2.VIII.C.p21.86
BWR-2.VII.D.p40.185
BWR-2.VII.D.p48.236
BWR-2.VII.E.p22.90
BWR-2.VII.E.p33.139
BWR-2.VII.E.p47.213
BWR-2.VII.F.p18.65
BWR-2.VIII.C.p21.86
BWR-2.IV.B.p68.213
BWR-2.VII.D.p59.291
BWR-2.VII.E.p51.235
BWR-2.VII.F.p52.215
BWR-2.VIII.C.p51.24
BWR-2.VIII.C.p58.28
BWR-2.VIII.C.p59.28
Plant
Brunswick 2
Brunswick 2
Dresden 2
Quad Cities 2
Dresden 3
Pilgrim
Cooper
Browns Ferry 2
Hatch 2
Brunswick 1
Hatch 1
FitzPatrick
FitzPatrick
Vermont Yankee
Browns Ferry 3
Browns Ferry
Browns Ferry 2
FitzPatrick
Vermont Yankee
FitzPatrick
Vermont Yankee
Browns Ferry
Browns Ferry 2
Browns Ferry 2
FitzPatrick
Vermont Yankee
LaSalle 1
Brunswick 1
Monticello
Lasalle 1 & 2
Hatch 1
FitzPatrick
Hatch 2
Failure
Mode
Component
Type
fto
fto
ftc
ftc
ftc
fte
ftc
ftc
fto
ftc
fto
ftc
ftc
swing check
swing check
stop-check
na
stop-check
rising plug
na
swing check
swing check
swing check
stop-check
swing check
swing check
swing check
na
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
ftc
fto
ftc
ftc
ftc
ftc
ftc
ftc
fto
ftc
ftc
ftc
ftc
ftc
ftc
ftc
ftc
ftc
ftc
ftc
Failure
Type
jammed closed
disassembly
improper seating
foreign object
improper seating
foreign object
foreign object
disassembly
disassembly
foreign object
vibrated closed
foreign object
disassembly
improper seating
na
jammed open
foreign object
foreign object
improper seating
disassembly
improper seating
jammed closed
jammed open
foreign object
foreign object
improper seating
jammed open
improper seating
disassembly
foreign object
improper seating
jammed open
jammed open
Failure
Cause
na
na
na
na
na
loose object
loose object
pin
stud
loose object
na
loose object
pin
na
na
na
crud buildup
loose object
stud-gate
pin
na
na
mechanical
crud buildup
loose object
stud-gate
chemical
na
pin
loose object
stud-gate
mechanical
na
Table 1 - Check Valve Failure Data (Page 2 of 2)
Record
H
U1
Event
Plant
Failure
Mode
Component
Type
Failure
Tve
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
BWR-2.VIII.C.p69.33
BWR-2.VIII.C.p70.33
BWR-2.VIII.C.p72.33
BWR-2.XI.A.pl01.430
BWR-2.XI.A.pl01.430
PWR-2.VII.A.p52.172
PWR-2.VII.A.p53.175
PWR-2.VII.A.p104.39
PWR-2.VII.A.p101.39
PWR-2.VIII.B.p13.43
PWR-2.VIII.B.p30.11
PWR-2.VII.B.p32.127
PWR-2.VIII.B.p37.15
PWR-2.VIII.B.p42.18
PWR-2.VIII.B.p43.18
PWR-2.VI.E.p57.199
PWR-2.VI.E.pl 17.378
PWR-2.VI.E.p122.386
PWR-2.VII.A.p73.275
PWR-2.VIII.B.p51.22
PWR-2.VIII.B.p52.23
PWR-2.VIII.B.p72.31
PWR-2.VIII.B.p97.42
PWR-2.VIII.B.p106.4
PWR-2.VIII.B.p114.4
PWR-2.VIII.B.p131.5
PWR-2.VI.E.p171.555
PWR-2.VI.E.p171.555
PWR-2.VII.E.p38.168
Monticello
ftc
Hatch 2
ftc
Peach Bottom 2
ftc
Dresden 2
ftc
Dresden 3
ftc
Indianan Pt. 2
ftc
San Onofre 1
ftc
Arkansas One 2
ftc
Arkansas One 2
ftc
Robinson 2
ftc
Palisades
fto
Calvert Cliffs 1
fto
fto
Palisades
Davis Besse 1
ftc
Palisades
fto
Beaver Valley 1
ftc
Surry 1
ftc
North Anna 1 & 2 na
Beaver Valley 1
ftc
Cook 2
ftc
Calvert Cliffs 1I fto
fto
Palisades
fte
Surry 2
Surry 2
fte
Davis-Besse
ftc
fto
Summer
Byron 1
fto
Byron 1
fto
Maine Yankee
ftc
swing check
swing check
swing check
swing check
swing check
swing check
tilting check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
swing check
na
swing check
swing check
swing check
swing check
swing check
na
swing check
swing check
swing check
improper seating
jammed open
jammed open
disassembly
disassembly
disassembly
improper installation
jammed open
jammed open
foreign object
jammed closed
improper installation
jammed closed
jammed open
jammed closed
foreign object
disassembly
na
improper seating
improper seating
foreign object
jammed closed
improper seating
jammed open
jammed open
jammed closed
improper installation
improper installation
foreign object
63
PWR-2.VIII.B.p134.574
Surry 1 & 2
ftc
swing check
foreign object
Failure
Cause
stud
chemical
mechanical
stud
shaft
pin
na
mechanical
mechanical
loose object
na
na
chemical
chemical
chemical
loose object
pin
na
na
na
loose object
chemical
stud-gate
na
chemical
na
na
na
corrosion
product
loose object
Flow Regions
20.0
-"Swinging
18.0
16.0
A
14.0
Free
A
Tapping
0
Pegged
A
-Pegged/Tapping
V
e
12.0
0
10.0
C
t
y
A
Tapping/Swinging
0
A
A
00
A
8.0
6.0
-
4.0
-
-I
2.0
-
0.0
0.0
1.0
2.0
3.0
4.0
5.0
6.0
L/D's from upstream disturbances
Fig. 6:
REGIONS OF FLOW-INDUCED MOTION IN CHECK VALVES [16]
7.0
8.0
Foreign
object
Disassembly
Jammed
closed
Improperly
installed
Fig. 7: DISTRIBUTION OF FAILURE TYPES,
SWING CHECK VALVE FAIL-TO-OPEN (FTO)
17
Foreign
object
Disassembly
Improperly
installed
Improper
seating
Jammed
open
Fig. 8: FAILURE TYPE DISTRIBUTION, SWING CHECK VALVE
FAIL-TO-CLOSE (FTC)
18
4. Check Valve Analysis
Failure Mode Identification
A fault tree for check valve failure (FTC) is shown in Figure 9. This tree is
developed based on the discussion in Reference 15, the NPE failure data [17], and
interviews of Professor P. Griffith and engineering personnel familiar with naval
nuclear propulsion systems. The CAND gate, as discussed in Section 2, is a
convenient shorthand for situations where infinite combinations of
4.1
continuous-valued variables can lead to the top event.
The minimal cut sets (MCS) for the FTC failure mode are given in Table 2.
As expected, most of these cut sets are of first order, there being little redundancy
within the valve. This is likely to also be the case for most nuclear plant
components.
The quantification of each branch/event in the fault tree of Figure 9 follows
along one of two paths. The first path, involving a more or less conventional
statistical analysis, is used for events under AND and OR gates. These events,
described as being "random" in Section 3, lead to discrete changes to the system,
and are well treated by current analyses. For example, the frequency at which loose
objects hold the valve open can be estimated on the basis of the number of events
observed and the length of the period of observation [3].
The second path is used when dealing with events following CAND gates
(whose cut set members are denoted by asterisks in Table 2). These events, while
having some random characteristics, are largely the outcome of physical processes
which can be modeled. An example of such modeling is described in Section 3 and is
quantified in Section 4.3.
Statistical Analysis of MCS Frequencies
If data are available, the parameters of the failure model can be estimated in
the same manner as used in current risk studies. Since the amount of available data
is usually small, a Bayesian approach is best suited for the analysis [3].
Let A be the parameter to be estimated based on evidence E; Bayes' Theorem
4.2
states that
19
rl(A IE)
=
Y
(EjA) ir0(A)
L(EIA) r 0 (A) dA
(4.1)
where r, (AIE) is the posterior probability density function (pdf) for A, L(E IA) is
the likelihood function, and 7r0 (A) is the prior pdf for A. The denominator is simply
a normalization factor to ensure that the posterior pdf integrates to unity over all
possible values of A.
The prior distribution, w0(A), quantifies the analyst's state of knowledge
concerning the value of A prior to observing evidence E. The prior distribution is
commonly used to incorporate "engineering judgment" into the analysis, and plays
an important role when the available data are limited. The likelihood function,
L(E IA), gives the conditional probability of observing E, given that A takes on a
certain value. This function can be used to incorporate non-statistical as well as
statistical evidence. For example, Reference 3 describes methods to treat expert
opinions in a Bayesian analysis.
To illustrate the approach, the available data are used to quantify the
frequency of valve disassembly, Ad. This is the parameter which governs
probability of observing any number of disassemblies in a given time period:
P{r disassemblies in time T} =
(AdT)r eAd
r!
(4.2)
where the conventional assumption that the number of disassemblies is Poisson
distributed is used. If the observed evidence consists of the pair of values (r,T), it
can be seen from the definition of the likelihood function that the right hand side of
Eq. (4.2) is actually the likelihood function for this particular problem.
For convenience, we assume that the prior distribution can be represented by
a "noninformative" form [3,18]:
(4.3)
rO(Ad)
d
Note that this distribution is improper, since it is unbounded at Ad = 0. The
noninformative form is used as a mathematical convenience to represent the
behavior of 7ro(Ad) over the range of interest; if no data are available, a prior
20
distribution which treats the analyst's state of knowledge more carefully should be
developed, since it will directly influence the results of the analysis.
Using the noninformative prior distribution, it can be shown that Eq. (4.1)
results in
T(AdT)r-le
(r-1)!
1(Adr,T) =
dT
The mean and variance of Ad are, respectively,
E[Ad
(4.5)
Var[A d]
r
T
For the case of the fail to close swing check valve failure mode, Table 1 shows
that the data set includes 8 valve disassemblies. Thus, r = 8. However, an
appropriate value of T is more difficult to determine. T represents the total
experience (in valve-years) for swing check valves accumulated over the period 1975
through 1983. To estimate T, we need to know the number of swing check valves in
each plant which are similar to the valve being analyzed, and the amount of
relevant experience (plant years) for each plant.
It should be noted that T is an inherently uncertain quantity. Uncertainty
arises when deciding which valves are similar to the valve of interest, and when
determining the appropriate amount of plant experience (i.e., deciding among
operating years, calendar years, or some other measure). To illustrate the approach,
we assume that T is lognormally distributed with a mean value of 71,150
valve-years (obtained by multiplying the number of swing check valves in the
safety-related systems of the Seabrook Unit 2 PWR [19] by the total number of
U.S. plant years of operation for the period 1975 through 1983) and a logarithmic
standard deviation (aT) of 1.0 (corresponding to a range factor of 5.2).
The final distribution for Ad, given r and a distribution for T, is obtained by
recognizing that 7r1 (Ad Ir,T) is a conditional distribution for Ad, given r and T.
Thus,
21
00
,(A dIr,p(T))
=
{r
d(AdIr,T)p(T)dT
(4.6)
0
where p(T) is the lognormal distribution for T described above and where
l(A dIr,T) is given by Eq. (4.4).
Eq. (4.6) can be evaluated using standard quadrature techniques. The
resulting moments of Ad are given in Table 3 and the distribution of Ad is
characterized in Figures 10 and 11. Also shown is the distribution obtained when
UT = 0.001 (i.e., T is essentially a certain quantity). It can be seen that the
decrease in aT leads to a small (factor of 1.5) decrease in the mean value of Ad, but
a large (factor of 15) decrease in the the variance. Thus, the uncertainty in Ad can
be badly underestimated if uncertainties in the data are not properly accounted for.
Continuous Variable MCS Quantification
To treat minimal cut sets involving continuous variables (events under a
CAND gate), a somewhat different approach is required. For example, consider
minimal cut set number 1, involving improper seating of the gate. In this case,
combinations of wear conditions in the shaft, stud and gate can lead to increased
free play and eventual improper seating. The following discussion illustrates the
4.3
modeling process, using the valve wear model described in Section 3.
Two cases can be considered at this point. First, we notice that any single
part in consideration (i.e., the shaft, the stud or the gate) can lead to improper
seating independently. For example, wearing in the shaft alone can be responsible
for the gate displacement even if the stud and gate have undergone little or no
wearing at all. If we limit ourself, initially, to the consideration of this case only
(independent failures), then the CAND gate degenerates into an OR gate and we are
left with the study of the probabilities of extreme displacement due to each
component separately.
4.3.1 Independent Failures
Let us examine the case of displacement due to shaft wear. The other two
cases will involve a similar procedure. The analysis requires the following steps:
a)
Identification of the random state variables which define the shaft
deterioration process.
22
b)
Estimation of the probability distributions of the random variables
identified in (a).
c)
Modelling of the deterioration process.
d)
Definition of a failure region (domain in which the values of the state
variables correspond to excessive wear).
e)
Computing the probability integral over the failure region (exactly or
with an approximation such as the one described in the appendix).
In the case of shaft wear, steps (a) and (c) have been already carried out in
Section 3 of this report. Eq. (3.1) describes the wearing process in terms of the rate
of shaft material volume removal. In that equation, the average velocity of the fluid
is the only random state variable (as long as the maximum and minimum
fluctuation velocities, vmax and vmin, are functions of vave). Then
V
Vshaft (ave)
-
K 1K 2K3
v e
si-1
K2
max
n-1
K2.7
where
1
=
37(W - Wa/ 2 )
(W - Wa/ 2 )bg
IC2
K=
3
KpA
0.04
r
p
Step (b), estimation of the distribution of vave, is straightforward in principle,
although the necessary data may not be available. Note that vave is a function of
time; what is needed, therefore, is an estimate of time (perhaps expressed in terms
of fractions of the operating year) the component is subjected to a characteristic
flow rate. Such an estimate might be obtained, for example, by assessing the
fraction of time the plant spends in full load, partial load, and no load conditions,
and determining the average flow rates for each of these conditions. Uncertainties
in the assessment are expressed as probability distributions for the model
parameters (e.g., the fraction of time spent in each condition).
23
The failure region (step (d)) for this case can be formally defined to be that
for which
Vshaft(ave) > Vshaft(vave)
(4.8)
where V is the integral over time of Eq. (4.7) and V is a critical value for shaft
wear (recall that we are assuming little or no wear for the stud and the gate in this
case). This criteria can be recast into the following standard form:
Fshaft(vave) > 0
(4.9)
where
Fshaft(ave) = Vshaft(vave) - Vshaft(vave)
(4.10)
Of course, the problem is to determine V . This parameter is a direct
function of the valve design, which establishes nominal clearances, and the assembly
tolerances. Therefore, these equations provide the connection between the
measurable, physical characteristics of the valve and the valve reliability (with
respect to the particular failure mode being analyzed). As a result, they indicate
how changes in design and manufacturing can lead to reliability enhancement or
degradation.
It is important to note that assembly tolerance is a random variable, which
means that the critical shaft wear, V is also random. This uncertainty is
accounted for using standard stress-strain modeling techniques [9].
The remaining step in the analysis is that of computing the probability
integral
(4.11)
Pshaft = P[Fshaft(ave) > 0]
Since the previous steps have determined the failure region and the distribution of
vave, this is a problem in numerical analysis. The software package (FORM) used
to perform this analysis is documented in Reference 7; this package employs the
First Order Reliability Method described in the Appendix. It is also suitable for
handling many more variables and complex failure regions.
24
Following the same approach, similar relations such as Eq. (4.11) can be
developed for stud and gate wear. In these latter cases, wear models analogous to
Eq. (4.7) must be developed for both parts. Assuming that such relations can be
found, the probability of improper seating assuming independence of failure modes is
then
is
shaft +Pstud +Pgate
(4.12)
(using the rare event approximation).
4.3.2 Dependent Failures
While the three different failure mechanisms do not lead independently to
overall component failure, the procedure used in the previous discussion is also
applicable to the more realistic situation of dependent mechanisms. In this latter
case, a failure condition defined in terms of the three wear variables must be
defined, and a joint probability distribution for the variables assessed:
is = P{Fis(Vshaft,Vstud,Vgate) > 0}
(4.13)
Notice that Fis degenerates into Fshaft when Vstud = Vgate = 0, and similarly for
F stud and Fgate'
This example for treating continuous variables has been aimed at the
"Improper Seating" failure mode. Examination of the "Mechanical Jamming"
failure mode (MCS 5) shows that shaft, stud, and gate wear also apply, although the
failure function Fmj may be very different. Note also that the interference term
between the two MCSs (which are essentially connected by an OR gate) may not be
negligible.
4.3.3 Quantification
As an example of the actual computation of the failure probability associated
to a CAND-gate, we analyze the improper seating failure mode for the swing check
valve. The purpose of this analysis is to illustrate in detail the computational
procedure. Thus, arbitrary values are used for the limited number of parameters for
which no data are currently available.
25
It is assumed that the gate seats improperly when its vertical displacement
due to wear at the hinge and at the stud-gate connection, exceeds the actual
tolerance which results from the design tolerance and potential construction errors.
It is assumed that the valve is maintained and brought back to initial conditions
every year. The probability of failure (for improper seating) is then defined as the
probability that the valve seats improperly in any given year of operation between
two consecutive inspections.
Hinge Wear. The wear at the hinge is assumed to be governed by the model
described by Eq. (4.7). Typical values for the material and geometrical parameters
of a 10 inch diameter valve are given in Table 4. For this analysis, it is assumed
that the average flow velocity, vave, takes on the nominal value during reactor
operation, and is zero when the reactor is not operating. During operation,
therefore, the nominal rate of material removal is V = 0.27 inch 3 /year.
The area of the cross-section of the hinge pin which is removed can be
computed by dividing the total volume of material removed from the hinge (V -to)
by the length of the pin (2- rP), where to is the time of actual operation during the
year of observation. Assuming that the vertical drop dh is proportional to the
square root of the area removed from the circular cross-section:
dh
Vt
dh =P 2 P
(4.14)
where for the sake of illustration the constant p1 is assumed to have a value of 3.4.
The uncertainty associated to the expression for V is described by assuming a
normal distribution with mean equal to the nominal value just found (0.27 in 3 /yr),
and standard deviation representing a nominal variability of ±10%about the mean
V ~ N(p = 0.27, o-= 0.03) inch 3/year
Stud-Gate Wear. The assumed mechanism of wear at the connection of the
arm and the gate is assumed to be initiated by the failure of the cotter pin that
holds the nut to the stud. When this happens the nut slowly backs off causing
26
increasing free play between the stud and gate, leading to increasing wear of the two
parts. Let t be the operating time when the cotter pin fails. If t > to, no drop
due to this wear mechanism is assumed to take place. If t < to, the drop due to
arm-stud wear, da, is assumed to be a quadratic function of the time of operation
after the cotter pin breakage:
da
*2
P 2 (to -t )
if
0
otherwi s e
*
t
<to
(4.15)
For purposes of illustration, let p2 = 3.3 .
The time of cotter pin failure, and the time of actual operation are random
variables which we assume to be normally distributed with means and standard
deviations as follows:
t
to
N(jp = 0.90, a = 0.03) years
N(p = 0.85, a = 0.03) years
The mean of to is obtained from data on nuclear power plants down time; the mean
time to cotter pin failure is assumed for the purpose of illustration.
*
Tolerance. The actual tolerance, or permissible vertical drop of the gate, d
is given by the sum of a design tolerance p3 , and a construction error c:
*
d =p
3
+
(4.16)
where a typical value for p3 is 0.787 inch and Eis assumed to be normally
distributed:
S~ N(pL = 0.0, a = 0.0472) inch
State Equation. From the previous assumptions it is possible to assemble the
following state equation:
27
g(x) = p3 + x4 - pl(x3x1/10)1/2 ~p2 (x1
)2
(417)
and the corresponding failure condition:
(4.18)
g(x) < 0
The state variables (x) are:
x1 =to
*
x2 =t
x3
V
xx4- =(
Results. Once the state equation is developed, the failure probability can be
determined as
Pf = P{g(x) < 0}
(4.19)
In this analysis, the First Order Reliability Method (FORM), described in the
Appendix, is applied. The computer code used which employs this method (also
called FORM) is described in Reference 7. Alternative approaches for solution
include using exact distributions, moment methods, or Monte-Carlo methods.
The result obtained using FORM is that Pf = 6.6 x 10 . This is the
probability (for a year of operation) that the check valve will fail to close due to
improper seating of the gate. Again, although this number is lower than the valve
disassembly result obtained earlier, it should not be viewed as a serious estimate,
since arbitrary values were assigned to the parameters p1 and p2 , and since the
failure model for arm/gate wear, while plausible, is not based on any rigorous
derivation. The calculation does indicate what types of input are needed to
estimate the component reliability. It also shows that once the failure model (state
equation) is developed, the failure probability computation can be accomplished
quite easily using FORM.
Because the FORM code is quick running, sensitivity studies can be performed
quite easily. As a simple example, Table 5 shows the results obtained from
28
modifying each of the model constants, pi, and the distribution constants (p,-)
individually. Variations are set at ± 10% of the nominal (base case) value.
The analysis identifies two parameters of importance: the mean of x 2 and p .
3
In both of these cases, the computed value of Pf is comparable to the valve
disassembly failure rate. Thus, while the base case value of Pf indicates that
improper seating is not a significant contributor to the total failure probability of
the valve, the sensitivity study results show that small variations in parameters can
change this result. This shows the importance of the treatment of uncertainties; a
realistic analysis should spend significant resources in characterizing the
uncertainties in models and model parameters, as well as on obtaining reasonable
nominal estimates for the model parameters.
Validation of First Order Analysis Results. FORM is a very efficient
technique to obtain approximate solutions, but it is important to assess the
accuracy of its results. Some work has been done in this respect, and according to
Reference 7 the probability estimate can be insufficiently accurate in
high-dimensional problems (for example with more than thirty random variables).
In this case, it is suggested that the solution be checked using the Second Order
Reliability Method (see Reference 20). Other numerical problems can occur when
one variable dominates the failure (or survival) probability and this probability is
very small (or very large). However, it is reasonable to assume that the calculated
results are accurate to the first order in the range of 104 < Pf 5 1 - 10.
For the improper seating problem treated in this analysis, the solution of
FORM has been check by repeating the last sensitivity listed in Table 5 using a
standard Monte Carlo simulation. The result of this test is that the FORM value is
within 4% of the Monte Carlo result, and is therefore quite acceptable for our
purposes.
29
Table 2 - Minimal Cut Sets for Swing Check Valve (Fail to Close)
(*) 1.
2.
Loose Object Obstruction
3.
Buildup Obstruction
4.
Backward Installation
(*) 5.
*
CAND( Worn Shaft - Worn Stud - Worn Gate) leading to improper
seating
CAND( Worn Shaft - Worn Stud - Worn Gate) leading to mechanical
jamming
6.
Shaft Corrosion
7.
Hole in Valve (corrosion)
8.
Shaft Broken
9.
Arm Broken
10.
Stud Broken
11.
Gate Broken
Probability of MCS must be evaluated using continuous variable methods
30
Table 3 - Characteristic Parameters for r1 (Ad IE)
Parameter
E[Ad]
Var[Ad]
aT = 1.0
aT = 0.001
1.6 x 104/yr
1.1 x 104/yr
2.8 x 10
1.9 x 10-9/yr 2
31
/yr2
Table 4 - Typical Values for Check Valve Wear Model Parameters
Parameter
KI
P
F
W
Wa
b
Value
5 X 10-3 (dimensionless)
18.000 psi
7.47 lb
13 lb
6.5 lb
g
p
A
.88 (dimensionless)
384 inch/sec 2
0.036 lb/inch 2
78 inch 2
Vave
K
sin 0ave
7.4 inch/sec
28 (dimensionless)
0.766
'eddy
0 .
0.0592 sec-1
200
min
0max
Al
800
0.124 inch/sec
32
Table 5 - Sensitivity Analysis Results
Parameter
m
Nominal
Value
Variation
Failure
Probability
.85
+10%
.99-5
-10%
.35-4
+10%
.58-6
-10%
.77-6
+10%
.20-5
-10%
.17-3
+10%
.56-6
-10%
.84-6
+10%
.47-5
-10%
.88-7
+10%
.42-6
-10%
.21-5
+10%
.27-5
-10%
.11-6
+10%
-10%
.58-4
+10%
-10%
.77-6
+10%
-10%
.50-9
.26-3
x1
ax
mx
2
x2
mx
3
x3
x4
p1
.03
.90
.03
.27
.03
.0472
3.4
3.3
p3
.787
33
.37-8
.52-6
La)
4:-
Fig.
9:
FAULT TREE FOR SWING CHECK VALVE FAIL-TO-CLOSE
5. Concluding Remarks
This report investigates the modeling of component reliability, a necessary
step when reliability goals are specified for a system design. Using swing check
valves as an example, it is shown that a wide variety of failure modes are possible,
some of which involve continuous component degradation and are not amenable to
standard statistically-based reliability analysis. Physical models for component
behavior are required to handle these latter failure modes.
The report shows how the two types of failure analyses can be integrated into
a reliability analysis and presents a limited quantification of some of the factors in
the check valve failure model. An analysis is performed for a discrete failure mode
(valve disassembly) for which the failure data are uncertain. A Bayesian approach
is used to estimate the frequency of this mode. The likelihood that the valve seats
improperly due to continual wear of component parts is treated by developing a
model for part wearing and displacement and quantifying this model using First
Order Reliability Method (FORM) analysis.
While values for a limited number of the model parameters are selected
arbitrarily, the analysis is useful in that not only does it demonstrate the procedure
and tools needed to obtain results, it also shows how the importance of different
model parameters (e.g., the value of the design tolerance) can be determined. This
importance is measured in terms of nominal contribution to unreliability, and in
terms of the sensitivity of the component reliability to uncertainties in the
parameter values. Thus, the analysis procedure can be used to determine if a part
in a component should be improved, if additional data characterizing the part
should be gathered, or both.
While the methodology has been applied to a swing check valve for
demonstration purposes, it is clearly not limited to such simple cases, nor even to
existing components. Consider, for example, the shutdown rod assemblies for the
secondary self-actuated shutdown system described in Reference 21. Based on the
proposed assembly design and operating/maintenance procedures, a fault tree can be
constructed to identify postential failure modes. This fault tree can incorporate
continuous as well as discrete variables. Quantification of the fault tree gates can
be accomplished by conventional methods, in the case of discrete variables, and by
such methods as FORM, in the case of continuous variables. Note that if failure
data are completely lacking, as may be the case for innovative components,
35
simulation models may be needed to quantify the discrete event failure modes.
As in the case of the swing check valve example, the analysis would:
-
provide a basis for rigorous reliability estimates in the case of strongly
interdependent variables even in absence of failure data, and
-
determine relative importance of the model parameters and therefore
indicate which ones need to be investigated with additional experimental
and/or analytical methods.
Of course, to perform the analysis, models for the degradation failure modes
are needed, as well as documentation concerning system design, operation, testing,
and maintenance. For many components, a significant effort may be required to
develop these models. An additional potential problem is that there may be
interactions between the failure processes characterized by discrete events and those
characterized by gradual degradation; methods to treat this situation have not been
developed in this report, and require additional investigation.
36
6. References
1)
U.S. Nuclear Regulatory Commission, "Reactor Safety Study: An Assessment
of Accidental Risks in U.S. Commercial Nuclear Power Plants," WASH-1400,
NUREG-75/014, October 1975.
2)
American Nuclear Society and IEEE, "PRA Procedures Guide - A Guide to
the Performance of Probabilistic Risk Assessments for Nuclear Power Plants,"
U.S. Nuclear Regulatory Commission, NUREG/CR-2300, April, 1983.
3)
G. Apostolakis, "Bayesian Methods in Risk Assessment," Advances in Nuclear
Science and Technology, 13, 415-65 (1981).
4)
K.N. Fleming, "A Reliability Model for Common Mode Failure in Redundant
Safety Systems," Proceedings of the Sixth Annual Conference on Modeling
and Simulation, Pittsburgh, April 1975.
5)
J.A. Hartung, H.W. Ho, P.D. Rutherford, and E.U. Vaughan, "The Statistical
Correlation Model For Common Cause Failure," Proceedings of the Annual
Conference of the Society for Risk Analysis, August 1-3, 1983.
6)
A. Mosleh and N. Siu, "A Multi-Parameter, Event-Based Common-Cause
Failure Model," Paper M7/3, Proceedings of the Ninth International
Conference on Structural Mechanics in Reactor Technology, Lausanne,
Switzerland, August 1987.
7)
S. Gollwitzer, F. Guers, and R. Rackwitz, FORM (First Order Reliability
Method) Manual. Nymphenburger Str. 134, 8000 Munchen 19, West
Germany, 1987.
8)
U.S. Nuclear Regulatory Commission, "Loss of Power and Water Hammer
Event at San Onofre, Unit 1, on November 21, 1985," NUREG-1190, January
1986.
9)
M.L. Shooman, Probabilistic Reliability: An Engineering Approach,
McGraw-Hill, New York, 1968.
10)
M. Hohenbichler, et al., "New Light on First- and Second-Order Reliability
Methods," Structural Safety, 1, (1987).
11)
G.I. Schueller, "A Critical Appraisal of Methods to Determine Failure
Probabilities," Structural Safety, 1, (1987).
12)
M. Hohenbichler and R. Rackwitz, "First-Order Concept in System
Reliability," Structural Safety, 1, (1983).
13)
M. Shinozuka, "Basic Analysis of Structural Safety," Journal of the Structural
Division of ASCE, 109, (1983).
14)
M.J. Grimmelt, et al., "Benchmark Study of Methods to Determine Collapse
Failure Probabilities of Redundant Structures, Structural Safety, 1, (1983).
37
15)
P. Griffith, "Check Valve Inspection and Redesign," Proposal to Northeast
Utilities, 1987.
16)
J. Snopkowski and P. Griffith, Letter to C. Nalezney, EG&G Idaho, NRC
Public Document Room, April 1, 1986.
17)
S.M. Stoller, Nuclear Power Experience, updated monthly.
18)
R.L. Winkler and W.L. Hays, Statistics, 2nd d., Holt, Rinehart, and
Winston, 1975.
19)
Pickard, Lowe and Garrick, Inc., "Seabrook Station Probabilistic Safety
Assessment," prepared for the Public Service Company of New Hampshire and
the Yankee Atomic Electric Company, PLG-0300, December 1983.
20)
S. Gollwitzer, F. Guers, and R. Rackwitz, SORM (Second Order Reliability
Method) Manual. Nymphenburger Str. 134, 8000 Munchen 19, West
Germany, 1987.
21)
Rockwell International, "Sodium Advanced Fast Reactor Preliminary Safety
Information Document," AI-DOE-13527, Revision 7, prepared for the U.S.
Department of Energy, September 1986.
38
Appendix - An Overview of First Order Reliability Analysis
In this appendix, the first order reliability analysis method is briefly
described. Additional details are provided in Reference 7 and References 10-14.
Problem Formulation
The state of the system is described by a set of known and uncertain
parameters. All the uncertain quantities are listed in a time-invariant
n-dimensional random vector x.
A limit state is defined (e.g. excessive deformation, excessive stress, cracking,
etc.) such that if the system is in that state, than the system is considered to have
failed; otherwise the system is said to survive.
X2
RF
:. :::.... (failure)
S
(survival)
We are interested in the probability Pf that the system fails.
If the joint cumulative distribution function (CDF) P . is known, than the
problem of computing Pf is called a full distribution (FD) reliability problem.
If only the mean and standard deviation of x are available then Pf is not
uniquely defined and one has to be satisfied with other measures of the system
reliability, the so called reliability indices. This last problem is referred to as second
moment (SM) reliability analysis.
The limit state allows the partition of the space of x into two parts: a safe
region, R5 , which is the collection of all points for which the system survives, and a
failure region RF which is the complement of R5 .
The probability of failure is given by:
A-1
Pf
= P{x belongs to RF1
= 1 - P{ belongs to Rs}
= 1-
dP (x)
S
In cases where x has a high dimension, the computation of this integral is
usually impractical. Approximate procedures have been developed for such cases.
First Order Analysis
Two factors play an important role on the computation of Pf: the type of
failure condition and the type of CDF. First order analysis takes advantage of the
fact that if the x has a multivariate normal distribution, and if the failure condition
is linear, then Pf can be easily obtained.
A linear failure condition is one for which survival depends on x only through
a linear function
y= a+
TX
(A.1)
where the condition is of the type
*
y > y
For example, let x1 be a random normal load, x2 a random normal resistance
and x 1 > x 2 the failure condition. We can define y as y = (x1 - x2). Then, if mi is
the mean value of xi, o1 its standard deviation, and p is the correlation coefficient
between x1 and x2'
y
N(myo ) (y is normally distributed)
y~=
y=O
where
m
=
M1 -m2
2
2
1'
A-2
X
2
9xl
The probability of failure is given by
12
1
Pf
-
e
=
dz
where
m
m2
-
y
The parameter
# can
be seen as the minimum of the standardized distance of the
mean of x from the boundary.
If x is normal but the failure condition is not linear of the type
*
y = g(x) > y
one can still use, as an approximation, the procedure shown in the previous example
after having linearized the boundary B with a plane tangent to B at a point x
This is the basis of the first order method.
Best results are obtained by selecting the linearization point as the one for
which the likelihood of failure is maximized. The determination of this point, called
the #-point, varies according to the type of joint CDF. If x is standard normal, then
the #-point is the point on the boundary for which the Euclidean distance from the
mean of x is minimized.
A-3
p-point
::
If x is normal but not standardized, one has to minimise the so called
Mahalanobis distance which is defined as
1
[~~)=(x
- rn)T
where
-1
-n)2
is the covariance matrix for x.
If x is not normal, it can be transformed to normality with a standard
procedure such as the Rosenblatt transformation. If the failure condition in the
normal space happens to be linear then we can directly use the procedure of the
previous example; otherwise we can linearize it at the /3-point, as explained above,
and then proceed as in the example.
The process of transforming x to the normal space can be computationally
very demanding. A more efficient strategy has been developed in which x is not
transformed to normality, but rather approximated to a normal distribution. This
procedure of "normal tail approximation", is known as the Rackwitz-Fiessler
algorithm; it can greatly increase the efficiency of first order reliability analysis.
A-4