472
C. E. Budde et al.
I r (x) = 0, I l (x
) = 0, I r (x
) = 3. This means that in both states one child of v
is “good-as-new” and the other is “half-failed” and hence the system is equally
close to fail in both cases. Hence we expect I
naive
v
(x) = I
naive
v
(x
) when actually
I
naive
v
(x) = 1 = 3 = I
naive
v
(x
). Instead, I v operates with
I l (x)
max I
l
and
Ir(x)
max I
r
, which
can be interpreted as the “percentage of failure” of the children of v. To make
these numbers integers we scale them by lcm v , the least common multiple of their
max importance values. In our case lcm v = 6 and hence I v (x) = I v (x
) = 3.
Similar problems arise whit all gates, hence normalization is applied in general.
SPARE gates with m children (including its primary) behave similarly to
AND gates: every failed child brings the gate closer to failure, as reflected in the
left operand of the max in Table 1. However, SPAREs fail when their primaries
fail and no SBEs are available, e.g. possibly being used by another SPARE. This
means that the gate could fail in spite of some children being operational. To
account for this we exploit the gate output: multiplying z v by m we give the
gate its maximum value when it fails, even when this happens due to unavailable
but operational SBEs. For a PAND gate v we have to carefully look at the states.
If the left child l has failed, then the right child r contributes positively to the
failure of the PAND and hence the importance function of the node v. If instead
the right child has failed first, then the PAND gate will not fail and hence we let
it contribute negatively to the importance function of v. Thus, we multiply
Ir(x)
max I
r
(the normalized importance function of the right child) by −1 in the later case
(i.e. when state x v /
∈ {1, 4}). Instead, the left child always contribute positively.
Finally, the max operation is two-fold: on the one hand, z v · 2 ensures that the
importance value remains at its maximun while failing (PANDs remain failed
even after the left child is repaired); on the other, it ensures that the smallest
value posible is 0 while operational (since importance values can not be negative.)
4.2 Automatic importance splitting for FTA
Our compositional importance function is based on the distribution of operational/failed basic elements in the fault tree, and their failure order. This follows
the core idea of importance splitting: the more failed BEs/SBEs (in the right
order), the closer a tree is to its top event failure.
However, isplit is about running more simulations from state with higher
probability to lead to rare states. This is only partially reflected by whether basic
element b is failed. Probabilities lie also in the distributions F b , R b , D b . These
distributions govern the transitions among states x ∈ S, and can be exploited
for importance splitting. We do so using the two-phased approach of [11, 12],
which in a first (static) phase computes an importance function, and in a second
(dynamic) phase selects the thresholds from the resulting importance values.
In our current work, the first phase runs breadth-first search in the iosa
module of each tree node. This computes node-local importance functions, that
are aggregated into a tree-global I using our compositional function in Table 1.
The second phase involves running “pilot simulations” on the importancelabelled states of the tree. Running simulations exercises the fail/repair distri-
C. E. Budde et al.
I r (x) = 0, I l (x
) = 0, I r (x
) = 3. This means that in both states one child of v
is “good-as-new” and the other is “half-failed” and hence the system is equally
close to fail in both cases. Hence we expect I
naive
v
(x) = I
naive
v
(x
) when actually
I
naive
v
(x) = 1 = 3 = I
naive
v
(x
). Instead, I v operates with
I l (x)
max I
l
and
Ir(x)
max I
r
, which
can be interpreted as the “percentage of failure” of the children of v. To make
these numbers integers we scale them by lcm v , the least common multiple of their
max importance values. In our case lcm v = 6 and hence I v (x) = I v (x
) = 3.
Similar problems arise whit all gates, hence normalization is applied in general.
SPARE gates with m children (including its primary) behave similarly to
AND gates: every failed child brings the gate closer to failure, as reflected in the
left operand of the max in Table 1. However, SPAREs fail when their primaries
fail and no SBEs are available, e.g. possibly being used by another SPARE. This
means that the gate could fail in spite of some children being operational. To
account for this we exploit the gate output: multiplying z v by m we give the
gate its maximum value when it fails, even when this happens due to unavailable
but operational SBEs. For a PAND gate v we have to carefully look at the states.
If the left child l has failed, then the right child r contributes positively to the
failure of the PAND and hence the importance function of the node v. If instead
the right child has failed first, then the PAND gate will not fail and hence we let
it contribute negatively to the importance function of v. Thus, we multiply
Ir(x)
max I
r
(the normalized importance function of the right child) by −1 in the later case
(i.e. when state x v /
∈ {1, 4}). Instead, the left child always contribute positively.
Finally, the max operation is two-fold: on the one hand, z v · 2 ensures that the
importance value remains at its maximun while failing (PANDs remain failed
even after the left child is repaired); on the other, it ensures that the smallest
value posible is 0 while operational (since importance values can not be negative.)
4.2 Automatic importance splitting for FTA
Our compositional importance function is based on the distribution of operational/failed basic elements in the fault tree, and their failure order. This follows
the core idea of importance splitting: the more failed BEs/SBEs (in the right
order), the closer a tree is to its top event failure.
However, isplit is about running more simulations from state with higher
probability to lead to rare states. This is only partially reflected by whether basic
element b is failed. Probabilities lie also in the distributions F b , R b , D b . These
distributions govern the transitions among states x ∈ S, and can be exploited
for importance splitting. We do so using the two-phased approach of [11, 12],
which in a first (static) phase computes an importance function, and in a second
(dynamic) phase selects the thresholds from the resulting importance values.
In our current work, the first phase runs breadth-first search in the iosa
module of each tree node. This computes node-local importance functions, that
are aggregated into a tree-global I using our compositional function in Table 1.
The second phase involves running “pilot simulations” on the importancelabelled states of the tree. Running simulations exercises the fail/repair distri-