Search

Présentation Poster; International audience; In nuclear I&C safety systems, redundant and separated architectures reduce risk to a residual level, mostly due to Common Cause Failures (CCF). Common Cause Failures (CCF) are faults, resulting from a single cause, which can affect different components at the same time. There are different models to represent them, such as the Atwood model. The latter assumes that components are almost identical, and have the same common-cause failure probability due to shocks. However, these hypothesis are too restrictive for our needs and may induce modeling errors. Thus, we introduce the concept of “oriented CCF”, which takes into account the difference of vulnerabilities among similar components, due to the structural features of our system. Oriented CCF may represent various root causes (hardware, software, human failure), and different spreading patterns. To handle the complexity of our system, we chose to use hierarchical, timed, Colored Petri Nets (CPN). CPN is a discrete-event modeling language combining the capabilities of Petri Nets with the capabilities of a high level programming language. The main difference with Petri Nets is that the CPN tokens can have different colors representing data types (e.g. Boolean, integer or more complex data structure). CPN concept of hierarchy allows us to propose a modular modeling approach for a complex system, based on generic modules that can be instantiated as often as needed. The modeling software we use is CPN Tools, an open-source tool for editing, simulating and analyzing hierarchical and timed CPN. The tool also features various probability distributions, which can be used to emulate a stochastic behavior.

International audience; The object of the article is the estimation of Common Cause Failures (CCF) in digital systems, e.g. protection system of nuclear plants. The system under study is composed of four divisions, with identical hardware. Colored Petri Nets are used because of their capability to model complex digital systems and assess their dependability. The Atwood model is also implemented into the CPN model. It represents the CCF impact on the system dependability. Assumptions related to hardware reliability and system logic, maintenance and repairs are taken into account in the model that is thus dynamic. The simulation, based on a CPN model and the assumptions of the Atwood model, permits to compare estimators of CCF parameters. An example of comparison is presented in this article, based on the Impact Vectors approach. Finally, some conclusions are presented.

International audience; The object of the article is the estimation of dependability and other probabilities of interest for digital systems, e.g. protection system of nuclear plants. The system under study is composed of four divisions, all with identical hardware. Colored Petri Nets are used because of their capability to model complex digital systems and assess their dependability. The Atwood model is also implemented into the CPN model. It represents Common Cause Failures that are contributing to the residual risk of unavailability. Assumptions related to hardware reliability and system logic, maintenance and repairs are taken into account in the model that is dynamic. We explain in this article how the Atwood model can be modified to "direct" non-lethal CCF on certain parts of the system and take into account the different possible origins of CCF. This extension permits to avoid the assumption of uniform distribution of non-lethal shock on the components and to represent some benefits of diversity and separation between divisions.

Industrial systems are often large, and complex, in terms of structure, dynamic interactions between subsystems and components, dynamic operational environment, ageing, etc. The dynamic reliability approach is a convenient framework to model the behavior of such systems. However, there is a price to pay, e.g. in terms of amount of data, size of state graphs, volume of reliability calculations, and combination of various engineering activities. A sound Systems Engineering process, benefiting from the improvement of most recent tools, may be a fruitful approach to decrease these difficulties. Although feasibility demonstrations have been done for conventional, static, approaches of dependability, interoperability between dynamic reliability modeling and Systems Engineering has not the same maturity level. The article explains how, on the basis of Systems Engineering (SE) process definitions, a Meta-model defines a framework for integrating the safety into SE processes. It supports a "hub automaton", that is the key element for interoperability with the tools and activities required for a dynamic reliability assessment. The case study is the dynamic assessment of availability of a feed-water control system in a power plant steam generator, presented in previous articles.

7 pages; International audience; In order to overcome the increasing difficulty of critical systems development, integrating the safety concerns into Systems Engineering processes seems to be the relevant solution. This paper proposes a meta-model to perform this integration by considering phased mission systems composed of repairable components. This kind of system requires in particular that several redundancy policies be defined. The benefits of this contribution are illustrated on a small example from the domain of electric power production.

The safety of high criticity industrial systems relies heavily on relatively complex programmed systems. Due to the complexity of the interactions between physical processes and their control, classical methodologies such as even-trees/fault-trees or Petri nets may not represent adequately the dynamic interactions existing between the physical processes (modeled by continuous variables) and the functional and dysfunctional behavior of its components (modeled by discrete variables). These hybrid systems can be mathematically modeled by piecewise deterministic Markov processes. To illustrate our approach, we present an academic problem. It has already been extensively studied in the literature under the name “heated hold-up tank” (Marseguerra, 1994; Marseguerra et al., 1995; Zhang et al., 2009).

8 pages; International audience; The Boolean logic Driven Markov Processes (BDMPs) have been developed by EDF to conduct predictive risk modeling and assessment for critical systems. A BDMP is a dynamic model based on fault trees dedicated to repairable systems. The qualitative reliability analyses performed on this kind of model consist in computing the minimal scenarios that lead to the system failure which are known as Minimal Cut Sequences (MCS). This paper defines the concept of Minimal Cut sequences for BDMPs and gives a way to compute them using an equivalent finite automaton developed in our previous works.

International audience

International audience; The Boolean Driven Markov Processes (BDMPs) were developed by EDF to conduct predictive risk modelling and assessment on critical systems. A BDMP model is a description of the combinations of failures that makes a system to fail like it is done with Fault tree models. The calculation of all the sequences of events that conduct to the global failure is complex as they are implicitly represented by a BDMP that generates a large state space. This paper provides a semantic analysis of BDMP models conducted within the languages and finite automaton theories in order to develop a systematic way to obtain an extensive representation of all scenarios contained in a BDMP. This representation is obtained by using an algorithm given in this paper which constructs an equivalent finite automaton of a BDMP. This FA representation leads to the possibility of extracting all the minimal scenarios of failure implicitly described by a BDMP.

International audience; This paper addresses the issues resulting from the concomitant allocation of safety and security objectives to an industrial facility. The authors analyse the liaison between the concepts of security and safety They attempt to describe the possible disconnections or even contradictions between them, as well as the benefits expected from increased disciplinary exchanges between safety and security studies. The first section of the paper introduces to key security challenges and threats in industrial facilities. The second section briefly reviews, on the basis of available literature, the major differences between a safety study and a security assessment for a given industrial facility. The third section discusses the boundary conditions for security-related application of probabilistic and deterministic risk assessment methodologies usually applied in safety studies. The fourth section presents situations where safety and security objectives appear to have been inconsistent. Examples include: risks caused by false alarms, increased complexity of operating procedures, risks caused by active security measures, negative effects of barriers accumulation, competing rationalities or paradigms . . . The authors conclude that safety and security objectives are not easily compatible on an industrial facility and those innovative scientific paradigms and methods need to be developed so that operators of industrial facilities can consider a more integrated approach

International audience