JP7354473B1 - Fault tree simplification method, fault tree simplification device and program - Google Patents

Abstract

A method for simplifying a fault tree is provided. [Solution] A fault tree simplification method includes a step of extracting a correspondence relationship between a top gate, a base event, and an intermediate gate included in a fault tree, and for each base event in the correspondence relationship, from the base event. The method includes the steps of specifying the highest OR gate reached when the fault tree is traced toward the top gate from the start, and aggregating elementary events under the specified OR gate. [Selection diagram] Figure 2

Description

The present disclosure relates to a fault tree simplification method, a fault tree simplification device, and a program.

Probabilistic Risk Assessment (PRA) is used for risk assessment of nuclear power plants (for example, Patent Document 1). In PRA, equipment, etc. are comprehensively extracted from a plant system diagram, failure modes of the extracted equipment, etc. are studied, and a fault tree and an event tree are created.

An example of a fault tree (hereinafter sometimes referred to as FT) is shown in FIG. 1A. The FT 100A in FIG. 1A uses a tree structure to represent combinations of conditions under which a top gate event occurs. The top gate of FT100A is "Failure of Mitigation Measure 1". The symbol connected to the bottom of the top gate is called an AND gate, and if both "device A/B failure" and "device C failure" connected to the AND gate occur, "mitigation measure 1 failure" occurs. This indicates that this will occur. Mitigation Measures 1 are measures and equipment that are implemented to stop the progression of the event in order to prevent it from leading to a serious accident when an abnormality occurs at a nuclear power plant. The symbol connected to the bottom of the "Device A/B failure" block is called an OR gate, and if either "Device A failure" or "Device B failure" connected to the OR gate occurs, This indicates that "device A/B failure" will occur. The events at the bottom of the FT (“Device A failure,” “Device B failure,” “Device C failure”) are called base events, and the “Device A/B failure” located between the top gate and the base event is called the base event. 'failure of mitigation measure 1' is called the intermediate gate for the top gate (here, 'failure of mitigation measure 1'). A basic event is a failure or failure event that cannot be broken down into smaller units. FT100A indicates that mitigation measure 1 will fail if either "failure of device A" or "failure of device B" occurs and a failure of device C occurs.

An example of an event tree (hereinafter sometimes referred to as ET) is shown in FIG. 1B. ET100B in FIG. 1B shows the evolution of an event that occurs when a certain undesirable event (initiating event) occurs in a nuclear power plant. "Mitigation 1" and "Mitigation 2" following "Undesirable event (initiating event) occurrence" at the top of ET100B are called headings, and the events that occur after the initiating event are shown in the order of occurrence, and the headings are as they move toward the right side of the diagram. This indicates that the event is in an advanced state. Below the heading is a tree diagram that branches depending on whether mitigation measures 1 and 2 indicated by the heading succeed or fail; if successful, proceed to the right side; if unsuccessful, proceed downwards. Repeat this and proceed to the right side of the tree diagram. The right end of the dendrogram shows the events that will eventually occur. ET100B shows that if mitigation measure 1 is successful, or if mitigation measure 1 is failed but mitigation measure 2 is successful, the initiating event will safely converge, but if both methods fail, an accident will occur. .

Fault tree analysis is widely used as a method for evaluating system reliability. In many applications, a combined analysis of FT and ET is used to quantify the risk of a system. For example, the probability that "mitigation measure 1 failure" occurs is calculated from FT 100A in FIG. 1A, and the calculated value is applied to the success and failure branches of mitigation measure 1 in ET 100B in FIG. 1B. Similarly, the probability that mitigation measure 2 fails is calculated based on the FT of mitigation measure 2 (not shown), and the calculated value is applied to the branch of mitigation measure 2 in FIG. 1B. Then, based on ET100B in FIG. 1B, it is possible to calculate the frequency of occurrence when both mitigation measures 1 and 2 fail and an accident occurs after the initiating event occurs.

Nuclear power plants have large-scale and complex control and safety functions, and the patterns of initiating events are diverse, so the structure of the FT becomes huge, and as a result, calculation times such as the probability of top gate occurrence take a long time. There is a tendency to Nuclear plants require periodic equipment maintenance, but during that period, the mitigation measures that require the equipment are unavailable, so the FT input information changes and the frequency of accidents increases accordingly. do. For example, if equipment C is under maintenance, the failure probability of equipment C becomes 1 in the input information of FT100A in Figure 1A, and as a result, the failure probability of mitigation measure 1 increases, and the frequency of accidents in ET100B in Figure 1B increases. will also increase.

JP 2021-117092 Publication

In order to ensure the safety of a nuclear plant and to confirm that risks do not exceed allowable values, it is necessary to calculate risk fluctuations each time the operating status of equipment changes. However, if the calculation time becomes long due to the huge FT structure, it may not be possible to promptly obtain the calculation results of risk fluctuations. Therefore, a technique is provided that improves the calculation speed by simplifying the structure of the FT while maintaining the calculation accuracy of the risk calculated based on the FT.

The present disclosure provides a fault tree simplification method, a fault tree simplification device, and a program that can solve the above problems.

The fault tree simplification method to be evaluated in the present disclosure includes a step of extracting a correspondence relationship between a top gate, a base event, and an element existing between them that constitute a fault tree, and the base event in the extracted correspondence relationship. for each case, starting from the base event and tracing the fault tree toward the top gate, identifying the highest OR gate that can be reached without passing through any other than the OR gate; and a step of aggregating basic events under the gate.

The fault tree simplification device of the present disclosure also includes a means for extracting a correspondence relationship between a top gate, a basic event, and an element existing between them that constitute a fault tree, and a means for identifying the highest OR gate that can be reached without passing through any other gate than the OR gate when starting from the base event and tracing the fault tree toward the top gate through intermediate gates; and means for aggregating basic events under the OR gate.

The program of the present disclosure also includes a step of causing a computer to extract a correspondence relationship between a top gate, a basic event, and an intermediate gate existing between them that constitute a fault tree, and for each basic event in the extracted correspondence relationship. starting from the base event, identifying the highest OR gate that can be reached without passing through any other gate when tracing the fault tree toward the top gate; and the identified OR gate. A step of aggregating basic events under the .

According to the fault tree simplification method, fault tree simplification device, and program described above, the structure of a fault tree can be automatically simplified while maintaining calculation accuracy.

FIG. 3 is a diagram showing an example of a fault tree. FIG. 3 is a diagram showing an example of an event tree. It is a block diagram showing an example of a fault tree simplification device of an embodiment. FIG. 1 is a diagram illustrating an example of simplifying a fault tree according to an embodiment. FIG. 2 is a second diagram illustrating an example of simplification of a fault tree according to the embodiment. It is a flow chart which shows the whole fault tree simplification processing of an embodiment. 12 is a flowchart illustrating an example of a process for extracting a correspondence relationship between a top gate and a basic event according to the embodiment. FIG. 1 is a diagram illustrating a correspondence table of the embodiment. FIG. 2 is a second diagram illustrating a correspondence table of the embodiment. It is a flow chart which shows an example of aggregation processing concerning an embodiment. It is a figure explaining aggregation processing concerning an embodiment. FIG. 1 is a diagram illustrating an example of a hardware configuration of a fault tree simplification device according to an embodiment.

<Embodiment>
The fault tree simplification method of this embodiment will be described below with reference to FIGS. 1 to 9.
(System configuration)
FIG. 2 is a block diagram illustrating an example of a fault tree simplification device (hereinafter referred to as FT simplification device) according to the embodiment. The FT simplification device 10 automatically simplifies FT while maintaining the calculation accuracy of risk evaluation.

The FT simplification device 10 includes a data acquisition unit 11 that acquires various data such as FT to be simplified, an input reception unit 12 that receives user operations, and a control unit 13 that controls execution of FT simplification processing. , an output unit 14 that outputs the created FT etc. as a display device or an electronic file, and a storage unit 15 that stores data acquired by the data acquisition unit 11 and data being processed. The control unit 13 includes a correspondence table creation unit 131 that creates a correspondence table that extracts the correspondence between the top gates and basic events that make up the FT, and the various gates that exist between them, and aggregates the basic events based on the correspondence table. An aggregation unit 132 that simplifies FT by doing so is provided. Details of these functional units will be explained in detail later using flowcharts (FIGS. 4 and 7).

The basic idea is to simplify the structure of the FT and reduce the computational load by reducing the number of basic events that are the constituent elements of the FT. FIG. 3A shows FT3A before simplification and FT3A' after simplification. The top gate 3A1 of the FT3A and the base events 3A3 and 3A4 are connected by an OR gate 3A2. In such a case, the base event 3A3 and the base event 3A4 are converted into a new base event Equivalent conversion is possible.

FIG. 3B shows FT3B before simplification and FT3B′ after simplification. In FT3B, the top gate 3B1, the intermediate gate 3B3, and the base event 3B4 are connected through an OR gate 3B2, and the intermediate gate 3B3 and the base events 3B6, 3B7, and 3B8 are connected through an OR gate 3B5. Although FT3B is a little more complex than FT3A in FIG. 3A, the number of base events can be effectively reduced by aggregating as much as possible upstream of FT. For example, the basic events 3B6 to 3B8 can be aggregated into one based on the same idea as in FIG. (as shown). Then, the basic event Y and the basic event 3B4 connected to the OR gate 3B2 can be combined and represented by one basic event 3B9, so FT3B can be simplified as FT3B'. In this way, by aggregating as much as possible upstream, it is possible to reduce the number of basic events and reduce the computational load.

(motion)
In this embodiment, the above-mentioned simplification is achieved by two processes shown in FIG. 4.
FIG. 4 is a flowchart showing the entire FT simplification process of the embodiment.
(P1) Extract the correspondence between the top gate and the basic event.
(P2) Aggregate basic events.
Each of the above processes will be explained in detail below.

(P1) Extracting the correspondence between top gates and basic events In aggregating basic events, it is necessary to specify the gate to which each basic event is aggregated. The aggregation destination gate is an OR gate that is as upstream as possible. In the first process (P1), in order to specify the aggregation destination gate, the correspondence between the top gate, each base event, and various gates in the FT constructed for each mitigation measure is extracted. This processing flow is shown in FIG. The correspondence table creation unit 131 identifies the specified top gate FT from one or more FTs, and creates various gates downstream from the top gate of the FT (intermediate gate, OR gate, AND gate, base event). , and create a correspondence table that organizes the top gates, basic events, and various gates that exist on the paths between the two.

FIG. 5 is a flowchart illustrating an example of a process for extracting the correspondence between top gates and basic events according to the present embodiment.
First, the data acquisition unit 11 acquires data necessary for processing, and stores the acquired data in the storage unit 15. For example, the data acquisition unit 11 acquires FT data (step S1). The FT data is, for example, data describing the structure of the FT 100A illustrated in FIG. 1A. The description may be in any format. For example, when evaluating the frequency of accident occurrence in the ET 100B illustrated in FIG. 1B, the data acquisition unit 11 acquires FT data of mitigation measure 1 failure and FT data of mitigation measure 2 failure. The data acquisition unit 11 also acquires a list of top gates (step S2). For example, the data acquisition unit 11 acquires a top gate list including the ID of mitigation measure 1 failure and the ID of mitigation measure 2 failure. After acquiring these data, the control unit 13 instructs the correspondence table creation unit 131 to create a correspondence table.

First, the correspondence table creation unit 131 extracts the top gate ID from the FT data (step S3). The correspondence table creation unit 131 identifies the top gate from the FT data acquired in step S1 based on the IDs of mitigation measures 1 and 2 listed in the top gate list acquired in step S2, and identifies the top gate. Extract.

Next, the correspondence table creation unit 131 determines whether a base event is included directly under the gate (step S4). The gate is the extracted gate, in this case the top gate. Directly below refers to an intermediate gate or base event directly below the gate that is directly connected to the top gate. The FT data acquired in step S1 includes the type of each gate (intermediate gate, gate type, base event) and connection relationship, and based on the type information, the gate immediately below is It is possible to determine whether the event is a basic event or not. If the element connected to the gate directly connected to the top gate is a base event, the correspondence table creation unit 131 determines that the base event is included directly under the top gate; otherwise, the top gate It is determined that the base event is not included directly under the gate. For example, in the case of FT3A in FIG. 3A, since gates 3A3 and 3A4 are both base events, the correspondence table creation unit 131 determines that the base events are included. If it is determined that the basic event is not included (step S4; No), the process proceeds to step S7.

If it is determined that the basic event is included (step S4; Yes), the correspondence table creation unit 131 extracts all the basic events immediately below (step S5). In the case of FT3A, the correspondence table creation unit 131 extracts base events 3A3 and 3A4. Next, the correspondence table creation unit 131 creates a correspondence table of the top gate ID, intermediate gate ID, and basic event ID (step S6). In the case of FT in FIG. 3A, the correspondence table creation unit 131 generates row data that associates the top gate 3A1, the base event 3A3, and that they are connected by an OR gate (there is no corresponding intermediate gate), and the top gate A correspondence table including 3A1, base event 3A4, and row data indicating that they are connected by an OR gate (no corresponding intermediate gate) is generated.

Next, the correspondence table creation unit 131 determines whether an intermediate gate is included directly below the gate (step S7). For example, in the case of FT3A in FIG. 3A, no intermediate gate is included directly below the top gate, so this determination is No. In the case of FT3B in FIG. 3B, the intermediate gate 3B3 is included directly below the top gate, so this determination is Yes. If it is determined that the intermediate gate is not included (step S7; No), the process proceeds to step S9.

If it is determined that an intermediate gate is included (step S7; Yes), the correspondence table creation unit 131 identifies the intermediate gate directly below the top gate from the FT data and extracts its ID (step S8). In the case of FT3B in FIG. 3B, intermediate gate 3B3 is extracted. Then, the processes from step S4 onwards are repeatedly executed. In this example, the gate in step S4 is the identified intermediate gate 3B3. Since the base events 3B6 to 3B8 are included directly under the intermediate gate 3B3, the correspondence table creation unit 131 extracts the base events 3B6 to 3B8 (step S5), and extracts the base events 3B6 to 3B8 from the top gate 3B1, the intermediate gate 3B3, and the base events 3B6. and row data that associates the connection relationship of each gate (which type of gate they are connected with); row data that associates the top gate 3B1, intermediate gate 3B3, and base event 3B7 with their connection relationships; A correspondence table is generated that includes row data that associates the top gate 3B1, the intermediate gate 3B3, the base event 3B8, and their connection relationships (step S6). Then, the determination in step S7 is made, and if this determination is Yes, the processes in step S8 and steps S4 to S6 are repeated, and if the determination in step S7 is No, the correspondence table generated so far is The information is outputted to the unit 13, a display device, etc. (step S9), and the flowchart of FIG. 5 ends.

FIG. 6A shows FT5 as an example of a processing target. In FT5, the top gate G1 is connected to the intermediate gate G2 and the base event A through an AND gate, and the intermediate gate G2 is connected to the intermediate gate G3, base event B, and base event C through an OR gate. The base event D is connected to the gate G3 through an OR gate. When a correspondence relationship is extracted for this FT5 using the processing flow described with reference to FIG. 5, a correspondence table illustrated in FIG. 6B is obtained. As shown in the figure, in the correspondence table, row data (each row of the table) of correspondence is generated by the number of top gates×the number of base events. After generating the correspondence table, the control unit 13 proceeds to the next process (P2).

(P2) Aggregation of basic events In this process (P2), based on the correspondence table between top gates and basic events generated in the previous process (P1), the FT structure is simplification. FIG. 7 shows the flow of the aggregation process. In the first determination logic (step S17 in FIG. 7), a base event is selected that has no influence on the risk evaluation result due to aggregation in terms of the logical structure of FT. In the next judgment logic (step S19 in FIG. 7), the logical structure of aggregation may have an impact on the risk assessment results, but it is necessary to By selecting aggregation targets limited to events, the impact on evaluation results is suppressed. Note that the evaluator can arbitrarily specify the importance threshold for determining whether or not aggregation is possible, and the input receiving unit 12 sets the specified threshold in the storage unit 15. After identifying the aggregation destination gates for all basic events, final simplification is performed by summing the probability values of basic events with the same aggregation destination gate and reflecting the aggregation FT structure to the original FT data. FT data is obtained.

FIG. 7 is a flowchart illustrating an example of the simplification process according to this embodiment.
First, the data acquisition unit 11 acquires data necessary for processing, and stores the acquired data in the storage unit 15. For example, the data acquisition unit 11 acquires FT data (step S11). The data acquisition unit 11 also acquires the correspondence table created in the previous process (P1) (step S12). If there is an FT in which mitigation measure 1 fails and an FT in which mitigation measure 2 fails, the correspondence table includes row data for the total of base events extracted in each of the two FTs. The data acquisition unit 11 also acquires a list of base events that are not subject to aggregation (step S13). The base event list includes IDs of base events that are not subject to aggregation. For example, the evaluator registers the IDs of base events that he/she wishes to evaluate individually without aggregating them in the base event list, and inputs the base event list to the FT simplification device 10. For example, if equipment C of the FT 100A in FIG. 1A is to be maintained, the base event that is to be evaluated individually without being aggregated is the base event "failure of equipment C." By excluding "Equipment C failure" from being aggregated and consolidating other base events (assuming that no maintenance, etc. is scheduled), there is no need to repeat calculations for other base events, and equipment It becomes possible to perform risk evaluations for periods within and outside of the period in a short amount of calculation time.

The data acquisition unit 11 also acquires a list of importance levels of basic events (step S14). The importance list describes the importance of basic events included in the FT data. The degree of importance indicates the degree of contribution of the basic event to the risk, and is obtained, for example, by separately performing a risk evaluation. The data acquisition unit 11 also acquires a probability value list of basic events (step S15). The probability value list describes the probability of occurrence of the basic event. The probability of occurrence is set by a knowledgeable engineer based on, for example, past failure record data. After acquiring these data, the control unit 13 instructs the aggregation unit 132 to perform aggregation processing of basic events.

First, the aggregation unit 132 extracts base events to be aggregated from the correspondence table (step S16). The aggregation unit 132 extracts, from the correspondence table obtained in step S12, IDs of base events that are not registered in the list of base events that are not subject to aggregation that was acquired in step S13. In the following processing, processing is performed on the base event extracted here.

Next, the aggregation unit 132 determines whether there is only one OR gate at the highest level counting from the base event (step S17). The OR gate at the top is the OR gate that is the one before reaching a gate other than OR (without passing through a gate other than OR) when starting from the target base event and tracing the FT toward the top gate. (the highest-level OR gate that can reach . Regarding whether there is only one, for example, if a certain base event is included only in the FT where mitigation measure 1 fails, and there is only one OR gate at the top when tracing from the base event to the top gate, this determination will be made. Yes, the basic event is included in both the FT of mitigation measure 1 failure and the FT of mitigation measure 2 failure, one topmost OR gate is found in each FT, and these two OR gates are If they are different, this means that there are two OR gates at the highest level, so this determination is No. A specific example of the determination in step S17 will be described later using FIG. 8. The aggregation unit 132 makes this determination for all base events to be processed.

If there is only one OR gate at the highest level counting from the basic event (step S17; Yes), the aggregation unit 132 identifies and extracts this OR gate as the aggregation destination of the basic event (step S18). In this case, aggregating basic events will not affect the risk assessment results. The aggregation unit 132 performs a process of extracting an aggregation destination OR gate for all base events for which the determination in step S17 is Yes. For the basic event for which the OR gate of the aggregation destination has been extracted, the process proceeds to step S22.

If there is not only one OR gate at the top when counting from the basic event (step S17; No), the aggregation unit 132 refers to the importance list acquired in step S14 and determines the importance of the basic event. It is determined whether or not is less than or equal to a threshold value (step S19). Note that the threshold value is set in advance by the evaluator. The aggregation unit 132 performs the determination in step S19 for all base events for which the determination is No in step S17. If the importance of the basic event exceeds the threshold (step S19; No), the aggregation unit 132 sets the basic event whose importance exceeds the threshold as not to be aggregated (step S20), and sets the basic event that is set not to be aggregated. , the processing is completed in step S20, and subsequent processing is not performed.

If the importance of the base event is less than or equal to the threshold (step S19; Yes), the aggregation unit 132 sets the base event as an aggregation target and extracts a plurality of OR gates at the highest level counting from the base event as aggregation destinations ( Step S21). In this case, aggregating basic events may have an impact on risk evaluation, but that impact can be suppressed by limiting the aggregation to basic events of low importance. The influence of aggregation on the risk evaluation results will be explained using FIG. 8.

Next, the aggregation unit 132 extracts base events that exist under the OR gate extracted in step S18 or step S21 and are not subject to aggregation (base events excluded in step S16 and base events set as non-aggregated in step S20). The probability value of the probability of occurrence of each base event is obtained with reference to the probability value list acquired in step S15 for all base events except for the base event (base event). The aggregation unit 132 sums up the probability values of the acquired base events for each OR gate extracted as the aggregation destination, and generates a new base event that aggregates the base events to be aggregated (step S22).

Next, the aggregation unit 132 performs two processes on the FT data acquired in step S11: overwriting the generated basic event and deleting the aggregated basic event (step S23). For example, when generating base event c by aggregating base events a and b, delete base event a and base event b from the original FT data and overwrite them with base event c (base events a, b is replaced by the base event c). Further, regarding the basic event c, the probability value totaled in step S22 may be included in the FT data in association with the basic event c, or the probability value that the basic event c occurs is included in the probability value list obtained in step S15. Additional values may be added. Next, the output unit 14 outputs the simplified FT data etc. to a display device, an electronic file, etc. (step S24).

Next, the determination in step S17 in FIG. 7 will be explained using FIG. 8. Top gates T1, T2, and T3 illustrated in FIG. 8 are, for example, failure of mitigation measure 1, failure of mitigation measure 2, and failure of mitigation measure 3. Figure 8 shows three FTs with these as top gates arranged side by side, and common structures among the three FTs are shown in a format that makes it clear that they are common in the structure of multiple FTs. It is described in In the FT of FIG. 8, basic events A, B, and C are connected to top gates T1 and T2, but in both cases of top gates T1 and T2, the most upstream OR gate is OR gate G2, and 1 Only one exists. Therefore, the determination result in step S17 is Yes, and OR gate G2 is extracted as the destination of aggregation of base events A, B, and C (step S18). On the other hand, basic event D exists in two places and is connected to top gates T1, T2, and T3, but in the case of top gates T1 and T2, the most upstream OR gate is gate G2. , the most upstream OR gate in the case of top gate T3 is gate G7, and there are a plurality of most upstream OR gates. Therefore, for the basic event D, the determination result in step S17 is No. If the importance of the base event D is greater than the threshold (step S19; No), the base event D is not aggregated. If the importance of the basic event D is less than or equal to the threshold value (step S19; Yes), the basic event D is aggregated for both the OR gate G2 and the OR gate G7.

If base event D is aggregated for both OR gate G2 and OR gate G7, there may be an impact on the risk assessment results. Here, to simplify the explanation, top gate T1 corresponds to the "failure of mitigation measure 1" in the heading of ET100B in FIG. 1B, top gate T3 corresponds to "failure of mitigation measure 2" in the heading of ET100B in FIG. It is assumed that there are no other gates than the basic events A to D and the various gates that exist on the path from the basic events A to D to the top gate. Then, when base event D occurs, a structure is created in which both the failure of mitigation measure 1 and the failure of mitigation measure 2 occur. In the simplified FT in which base event D is consolidated into both OR gate G2 and OR gate G7, is the failure of mitigation measure 1 and failure of mitigation measure 2 caused by base event D? It is unclear whether If we apply the probability that mitigation measure 1 will fail based on simplified FT by consolidating base event D into both OR gate G2 and OR gate G7 and the probability that mitigation measure 2 will fail, we will actually get Even though both mitigation measures 1 and 2 fail when basic event D occurs, this is not taken into account, and even when basic event D occurs, mitigation measure 1 fails. However, the probability that mitigation measure 2 will fail is calculated based on the possibility that an event may occur in which mitigation measure 2 is successful. In other words, taking the evaluation using ET in FIG. 1B as an example, the expected value of failure of mitigation measure 1 and failure of mitigation measure 2 is underestimated as the basic events D are aggregated. This is the effect of aggregating the base events for which the determination of No was made in step S17. However, such an influence on the risk evaluation result can be reduced by adjusting the importance threshold related to the determination in step S19.

(effect)
As explained above, according to this embodiment, by simplifying the huge and complicated structure of FT, it is possible to reduce the calculation load and shorten the time it takes to repeatedly calculate risks associated with system state changes. can. For example, if calculations are required for equipment C due to state changes such as maintenance, the base event of equipment C's failure is registered in the base event list that is not subject to aggregation, and the process shown in Figure 7 is used to A simplified FT that aggregates events is prepared, and probability values are calculated for the aggregated basic events. Then, for example, when maintenance occurs on device C, the probability value of the basic event of device C is changed based on the simplified FT, and the pre-calculated probability value is changed for other basic events. You can calculate the probability of top gate occurrence just by applying and calculating. Thereby, risk evaluation can be performed with less calculation amount and calculation time than when calculation is performed for all elements every time the state of device C changes based on unsimplified FT. Note that the simplification process itself of this embodiment requires calculation processing, but by specifying in advance all the equipment that is subject to maintenance as not subject to consolidation, once simplified FT can be used to calculate various plant conditions. Since it can be used repeatedly, the amount of calculation and calculation time can be reduced from a long-term perspective.

In addition, as explained using Figures 7 and 8, even if FTs are aggregated, the impact on risk assessment results is minimized by the logic that narrows down the basic events that are logically equivalent or of low importance to the subjects of aggregation. It can be fastened. That is, according to this embodiment, the FT structure can be simplified while maintaining the calculation accuracy of risk evaluation.

In the above embodiment, the FT used for risk assessment of a nuclear power plant is simplified, but the field of application of the FT simplification device 10 is not limited to risk assessment of a nuclear power plant, and reliability assessment using FT. It can also be applied to other industrial fields.

FIG. 9 is a diagram illustrating an example of the hardware configuration of the fault tree simplification device according to the embodiment. The computer 900 includes a CPU 901, a main storage device 902, an auxiliary storage device 903, an input/output interface 904, and a communication interface 905.
The fault tree simplification device 10 described above is implemented in a computer 900. Each of the above-mentioned functions is stored in the auxiliary storage device 903 in the form of a program. The CPU 901 reads the program from the auxiliary storage device 903, expands it to the main storage device 902, and executes the above processing according to the program. Further, the CPU 901 reserves a storage area in the main storage device 902 according to the program. Further, the CPU 901 secures a storage area in the auxiliary storage device 903 to store the data being processed according to the program.

Note that a program for realizing all or part of the functions of the fault tree simplification device 10 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed. Accordingly, processing may be performed by each functional unit. The "computer system" here includes hardware such as an OS and peripheral devices. Furthermore, the term "computer system" includes the homepage providing environment (or display environment) if a WWW system is used. Furthermore, the term "computer-readable recording medium" refers to portable media such as CDs, DVDs, and USBs, and storage devices such as hard disks built into computer systems. Further, when this program is distributed to the computer 900 via a communication line, the computer 900 that received the distribution may develop the program in the main storage device 902 and execute the above processing. Further, the above program may be one for realizing a part of the above-mentioned functions, and further may be one that can realize the above-mentioned functions in combination with a program already recorded in the computer system. .

As described above, several embodiments according to the present disclosure have been described, but all these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and changes can be made without departing from the gist of the invention. These embodiments and their modifications are included within the scope and gist of the invention as well as within the scope of the invention described in the claims and its equivalents.

<Additional notes>
The fault tree simplification method, fault tree simplification device, and program described in each embodiment can be understood, for example, as follows.

(1) The fault tree simplification method to be evaluated according to the first aspect consists of a top gate and base events constituting a fault tree, and elements existing between them (intermediate gates and their gate types (for example, OR gates, AND gate, etc.), and for each base event in the extracted correspondence, when the fault tree is traced toward the top gate starting from the base event, The method includes a step of specifying the highest OR gate that can be reached without going through any route other than the OR gate, and a step of aggregating elementary events under the specified OR gate.
This allows the fault tree to be automatically simplified.

(2) The fault tree simplification method to be evaluated according to the second aspect is the fault tree simplification method of (1), wherein in the aggregation step, the identified OR gate is When only one exists, the base event is the aggregation target.
Thereby, the structure of the FT can be simplified while maintaining the accuracy of the risk expressed by the FT before aggregation.

(3) The fault tree simplification method according to the third aspect is the fault tree simplification method of (1) to (2), wherein in the step of aggregating, the identified OR When a plurality of gates exist, if the importance of the basic event is less than or equal to the threshold value, the basic event is set as an aggregation target for each of the OR gates.
Thereby, the structure of the FT can be simplified while maintaining the accuracy of the risk expressed by the FT before aggregation.

(4) The fault tree simplification method according to the fourth aspect is the fault tree simplification method of (1) to (3), wherein in the step of aggregating, the identified OR When there are multiple gates, if the importance of the base event is greater than the threshold, the base event is not aggregated.
By excluding base events of high importance from the aggregation targets, the structure of the FT can be simplified while maintaining the accuracy of the risk expressed by the FT before aggregation.

(5) The fault tree simplification method according to the fifth aspect is the fault tree simplification method of (1) to (4), wherein in the step of aggregating, the basic events to be aggregated are The occurrence probabilities are added up, and the base event before aggregation in the fault tree is replaced with the base event after aggregation.
Thereby, the structure of the FT can be simplified while maintaining the accuracy of the risk expressed by the FT before aggregation.

(6) The fault tree simplification method according to the sixth aspect is the fault tree simplification method of (1) to (5), and includes the step of obtaining a list in which basic events that are not subject to aggregation are registered. Further, in the identifying step, the OR gate at the highest level is identified for the base event that is not registered in the list from among the base events in the extracted correspondence relationship.
Thereby, it is possible to specify base events that are not desired to be aggregated, and to simplify FT by setting only other base events as targets for aggregation.

(7) The fault tree simplification method according to the seventh aspect is the fault tree simplification method of (1) to (6), wherein in the extracting step, the number of top gates is added to the number of base events. Data indicating the correspondence relationship for the multiplied value is extracted.
As a result, for all basic events to be aggregated, the correspondence between basic events, intermediate gates, top gates, and their connection relationships (OR gates, AND gates, etc.) was extracted, and traced from each basic event to the top gate. It is possible to specify the topmost OR gate at the time.

(8) The fault tree simplification device 10 according to the eighth aspect includes means for extracting a correspondence relationship between a top gate, a basic event, and elements existing between them that constitute a fault tree, and the extracted correspondence relationship. means for identifying, for each of the base events in the base event, the highest OR gate that can be reached without passing through any other gate when the fault tree is traced toward the top gate starting from the base event; and means for aggregating basic events under the specified OR gate.

(9) The program according to the ninth aspect includes the step of causing the computer 900 to extract a correspondence between a top gate, a base event, and an element existing between them that constitute a fault tree, and For each of the basic events, starting from the basic event and tracing the fault tree toward the top gate, identifying the highest OR gate that can be reached without passing through other than OR gates; and aggregating basic events under the OR gate.

10...Fault tree simplification device 11...Data acquisition unit 12...Input reception unit 13...Control unit 131...Correspondence table creation unit 132...Aggregation unit 14...Output unit 15 ...Storage unit 900...Computer 901...CPU
902... Main storage device 903... Auxiliary storage device 904... Input/output interface 905... Communication interface

Claims (9)

a step of extracting a correspondence relationship between a top gate, a base event, and elements existing between them that constitute a fault tree;
For each base event in the extracted correspondence relationship, the highest OR gate that can be reached without passing through any OR gates when starting from the base event and tracing the fault tree toward the top gate. a step of identifying
aggregating basic events under the identified OR gate;
A fault tree simplification method with In the aggregation step, when there is only one identified OR gate for each of the base events, the base event is set as an aggregation target;
The fault tree simplification method according to claim 1. In the step of aggregating, when there is a plurality of the identified OR gates for each of the base events, if the importance of the base event is less than or equal to a threshold, the base event for each of the OR gates is to be aggregated. do,
The fault tree simplification method according to claim 1. In the step of aggregating, when there is a plurality of the identified OR gates for each of the base events, if the importance of the base event is greater than a threshold, the base event is not targeted for aggregation.
The fault tree simplification method according to claim 1 or claim 3. In the step of aggregating, the occurrence probabilities of the basic events to be aggregated are summed, and the basic event before aggregation in the fault tree is replaced with the basic event after aggregation.
The fault tree simplification method according to any one of claims 1 to 3. further comprising the step of obtaining a list in which base events not subject to aggregation are registered;
In the identifying step, the OR gate at the highest level is identified for the base event that is not registered in the list from among the base events in the extracted correspondence relationship;
The fault tree simplification method according to any one of claims 1 to 3. In the extracting step, data indicating the correspondence relationship is extracted for a value obtained by multiplying the number of basic events by the number of top gates.
The fault tree simplification method according to any one of claims 1 to 3. means for extracting the correspondence between top gates, base events, and elements existing between them that constitute a fault tree;
For each base event in the extracted correspondence relationship, the highest OR gate that can be reached without passing through any OR gates when starting from the base event and tracing the fault tree toward the top gate. a means of identifying the
means for aggregating basic events under the identified OR gate;
A fault tree simplifier with to the computer,
a step of extracting a correspondence relationship between a top gate, a base event, and elements existing between them that constitute a fault tree;
For each base event in the extracted correspondence relationship, the highest OR gate that can be reached without passing through any OR gates when starting from the base event and tracing the fault tree toward the top gate. a step of identifying
aggregating basic events under the identified OR gate;
A program to run.

Images