Method and Means for Reliability and Maintainability Analysis

This invention relates generally to the analysis of complex systems for reliability and maintainability, and more particularly the invention relates to apparatus for simulating components in complex systems and the method of analysis using such apparatus.

In complex systems such as nuclear power generating plants, for example, considerable redundancy is provided to improve reliability and safety. However, because of the potential danger resulting from system failure, empirical data to substantiate mathematical models is highly desirable. In a system having a failure rate 10.sup.-2 failures per year, approximately 10,000 years of observation would be required to empirically demonstrate this failure rate to an accuracy of 10% with a confidence level of 90%. Consequently, the mathematical models and computer software which have evolved from these models suffer from the lack of rigorous and repeated observations of many events, and are therefore not critically tested with respect to validity or useful limitations.

Accordingly, an object of the invention is apparatus which emulates the reliability and availability of any general complex redundant system.

Another object of the invention is a method of analyzing the performance of such complex redundant systems on a highly compressed timescale.

Still another object of the invention is a failure simulation system with the flexibility for emulating various complex redundant systems.

Yet another object of the invention is a fast failing unit for use in a failure simulation system and which can emulate a component or subsystem thereof.

Briefly, in accordance with the present invention a failure simulation system includes a plurality of fast failing units which simulate the operational state and failed state of components of the simulator system. Each of the fast failing units includes a first electric pulse generator for generating pulses at random, a second electric pulse generator for generating pulses of a time varying rate correlated to the failure rate of a simulated system, and coincidence means responsive to coincidence of pulses from the first electric pulse generator and from the second electric pulse generator for establishing a fail state. Means logically interconnect the fast failing units whereby the operational states and fail states of all fast failing units interconnect logically to simulate the operational and fail states of the simulated system.

Preferably, the second electric pulse generator generates pulses at a first rate indicative of failure rate of a simulated new component, a second rate indicative of failure rate of a simulated new component after an initial time period of successful operation, and a third rate indicative of failure rate of a simulated component after prolonged use and aging. Such a sequence of failure rates is often termed a mortality failure rate or bath tub failure rate curve.

Preferably, at least some of the fast failing units include a third electric pulse generator responsive to a fail state and generating a pulse for resetting the unit to an operational state, the time period between initiation of the fail state and a pulse from the third electric pulse generator being correlated to time for repairing the simulated component. A pulse from the third electric pulse generator resets the pulse rate of the second electric pulse generator to a rate indicative of failure rate after repair of the simulated component.

In a preferred embodiment the first electric pulse generator includes a shift register in which bits are shifted once each a clock period, and the shift register has at least one feedback path between stages whereby shifting of bits in the serial shift register is altered. The feedback path of the electric pulse generator may include logic circuitry for responding to bits in the shift register and altering a bit in at least one stage of the shift register.

The invention and objects and features thereof will be more readily apparent from the following detailed description and appended claims when taken with the drawing, in which:

FIG. 1A is a schematic of a fast failing unit in accordance with the present invention.

FIG. 1B is a schematic of a random pulse generator useful in the circuit of FIG. 1A.

FIG. 2 is a plot of an example of time dependent failure rate curve for the unit of FIG. 1A.

FIG. 3 is a plot of operational state versus time of the unit of FIG. 1.

FIG. 4 is a plot illustrating the electronic state of the unit of FIG. 1.

FIG. 5 is a diagram of a system employing a plurality of fast failure units shown in FIG. 1.

FIG. 6 is a fault tree simulating an eighteen component low pressure coolant injection system.

FIG. 1 is a schematic of a fast failing unit in accordance with one embodiment of the present invention. The unit comprises a random pulse generator 10 and a variable pulse generator 12 with the outputs of the two pulse generators being applied as inputs to an AND gate 14. Preferably, the random pulse generator includes an N bit serial shift register with bits being shifted once per clock period. As illustrated in FIG. 1A, selective ones of the N stages 20 are interconnected to logic means such as OR gate 22 with the output of the OR gate summed with the input of another stage. Such circuitry is further illustrated in U.S. Pat. No. 3,911,216. By logically combining certain bits in the shift register and providing the combined bits as feedback to the shift register, the output bit stream can have a purely binomial distribution with each bit having a probability of 0.5 of being a one or a zero and being independent of the state of any other bit. The sequence of N bits so generated repeat after 2.sup.N shifts; and for N=40 and a time period of 0.1 microseconds, recycling occurs after 10.sup.5 seconds.

The variable pulse generator 12 generates pulses at a rate indicative of probable failure of a component, as will be described further hereinbelow with reference to FIG. 2. The failure rate may be stored in a preprogrammed read-only memory (PROM), allowing for any given time-dependent failure rate curve, and the PROM is uniformly and sequentially swept using a binary counter. The counters can be driven by a variable oscillator with the pulse train from the oscillator determined by a divider selected by the common-mode condition of the fast failing unit or by a repair reset signal. By sequencing the PROM at a faster rate the result is accelerated failure.

The coincidence of pulses from generator 10 and generator 12, as determined by AND gate 14, represents a unit failure. Common-mode inputs may be input to the variable pulse generator from other fast failure component outputs that may accelerate the failure of this component, as will be described further hereinbelow with reference to FIG. 5.

The output of AND gate 14 is applied to the reset terminal of a latch 16. The output of latch 16 is initially set as a "1" or positive voltage, and the signal from AND gate 14 to the reset terminal resets the output of the latch to a "0" or low voltage state indicative of unit failure.

The output of AND gate 14 is also applied to trigger a monostable multivibrator 18 with the triggering of the multivibrator 18 being dependent on suitable timing circuitry used to simulate the time to repair the component. The output of the multivibrator 18, indicative of the repair of the failed unit, is applied to the set terminal of latch 16 to again set the output of latch 16 to a plus voltage level indicative of unit operability. The output of multivibrator 18 is also applied as feedback to pulse generator 12 and resets the pulse rate of the generator to a rate indicative of failure rate of the repair.

FIG. 2 is a curve illustrating a specific example of the variable time dependent pulse rate or bathtub failure rate of generator 12 with the units of the axes being arbitrary. At time T=0 this failure rate has an arbitrary value of 2 and with increasing time the failure rate decreases in an exponential manner to a value of 1. After a period of relatively constant pulse rate of 1 the failure rate begins rising in an exponential manner and eventually reaches a steady level of 4. The initial failure rate is indicative of the probability of failure of a new component, and the decreasing failure rate is indicative of the reduced failure rate as the unit is burned in. The failure begins rising again as the unit ages, and reaches the maximum failure rate as the unit approaches its rated full life. Thus, the probability of a pulse from pulse generator 12 coinciding with a random pulse from generator 12 decreases as a unit is burned in and increases as the unit ages. FIG. 2 illustrates the concept of the variable pulse generator with the curve shown. The invention, however, allows any shape of failure rate vs. time to be programmed into each fast failing unit through the use of programmable read-only memory devices (PROMS).

FIG. 3 is a plot showing the operational state of a unit of FIG. 1. When the latch 16 is at a high voltage state (e.g. 2.3 volts) the unit is operational. Upon a coindicence of the pulses from generators 10 and 12 the voltage drops below 0.8 volts and is indicative of a failed state. Upon the setting of latch 16 in response to the multivibrator 18 the voltage again rises to 2.3 volts indicating that the unit is again operational. The length of the fail state is dependent on the repair time for the unit as indicated by the time period between AND gate 14 going positive and the actual generation of a pulse by multivibrator 18 as applied to the set input of latch 16.

The following table shows the electronic equivalents of the components:

FIG. 4 further illustrates the failure pulses from the AND gate 14, the repair pulses from the one shot multivibrator 18, and the resultant operational state of the unit. The failure pulses reset latch 16 and drive the output of the latch to a low voltage level indicative of the fail state, the repair pulses from the one shot multivibrator 18 again set the latch 16 and raise the output to the positive operational state, all as illustrated in FIG. 4.

Illustration of the operation of each fast failing unit in one of two states allows the units to be recorded mathematically as "logic elements" and therefore electronically represented by binary digits. When a unit makes a transition from one state to the other, the transition is considered to take place instantaneously and marks the moment of failure or repair. The equivalent electronic representation is a bit flip or merely a square wave swing in the binary voltage as illustrated in the table above. The time at which a failure or repair occurs is a continuous variable and because the moment of failure is not known beforehand and also the repair time cannot be predicted, these events have a characteristic of being random or "stochastic".

Another important failure mode which is provided in the fast failing units is that of common mode. Two types of common mode interactions have been identified from actual experience, deterministic and stochastic. The deterministic mode describes the case when the failure of one component immediately causes the failure of a second component. The stochastic mode is used to model the degradation but not immediate failure of a component caused by the failure of another. Thus, the failure rate (or pulse rate) of the second component can be increased by a predetermined factor in response to the failure of another unit. Further, once the failing component has been repaired, the original failure rate can be restored for the second unit.

FIG. 5 is a block diagram of a system utilizing a plurality of fast failing units such as illustrated in FIG. 1. The plurality of units U-1 . . . U-N are interconnected by logic elements such as AND gate 30, OR gate 32, AND gate 34, AND gate 36, and OR gate 30 so that the system status is determined by a logical combination of the states of the plurality of fast failing units.

Repair times for all fast failing units of the system can be established through a combination of modes including fixed time, fixed time plus a random or exponentially distributed time, or scheduled repairs that are synchronous with a clock. Repairs reset the failure rate or pulse rate of the variable pulse generator 12 so that a repair can be equivalent to a part replacement.

Fault simulation systems in accordance with the present invention have been successfully employed to simulate the failures of a complex system which would normally occur over a period of thousands of years to a time period measured in minutes. Time compression factors of 10 billion to one, where 40 years real time is simulated in one-eighth of a second have been demonstrated. FIG. 6 is one such system in which eighteen fast failing units were configured to model a low pressure coolant injection system for simulating a boiling water reactor (BWR) emergency core cooling system in a nuclear reactor. The eighteen units represented mechanical elements such as motor operated valves, pumps, emergency powered diesel generators, and level sensors, along with maintenance elements and offsite power. The components were assigned typical failure and repair values and arranged in a redundant manner characteristic of an actual system. The results from using the failure simulation system were compared with predictions based on independent computer code simulations. The results using the simulated failure system were in very good agreement with the results based on the computer code simulations.

The following table identifies the components of FIG. 6:

The logical connection of these components in standard fault tree notation is shown in FIG. 6. It will be noted that in several instances the same component is present in several branches of the tree.

The flexibility of the failure analysis system in accordance with the present invention and the correlation of the system with computer code simulations has demonstrated the accuracy and utility of the failure analysis tool. While the invention has been described with reference to a specific embodiment, the description is illustrative of the invention and is not to be construed as limiting the invention. Various modifications and applications may occur to those skilled in the art without departing from the true spirit and scope of the invention as defined by the appended claims.