a fuzzy set approach for event tree analysis

Fuzzy Sets and Systems 118 (2001) 153–165www.elsevier.com/locate/fss

A fuzzy set approach for event tree analysisDavid Huanga, Toly Chenb, Mao-Jiun J. Wanga ; ∗

aDepartment of Industrial Engineering, National Tsing Hua University, Hsinchu, Taiwan 300, ROCbDepartment of Information Management, Ling Tung Institute of Technology, Taichung, Taiwan 408, ROC

Received January 1998; received in revised form May 1998

Abstract

The traditional event tree analysis uses a single probability to represent each top event. However, it is unrealistic toevaluate the occurrence of each event by using a crisp value without considering the inherent uncertainty and imprecision astate has. The fuzzy set theory is universally applied to deal with this kind of phenomena. The main purpose of this study isto construct an easy method to evaluate human errors and integrate them into event tree analysis by using fuzzy concepts.A systematic fuzzy event tree analysis algorithm is developed to evaluate the risk of a large-scale system. A practical examplein a nuclear power plant is used to demonstrate this procedure. c© 2001 Elsevier Science B.V. All rights reserved.

Keywords: Event tree analysis; Fuzzy error rate=possibility; Human error; Linguistic variable

1. Introduction

Event tree analysis (ETA) is an inductive logic anddiagrammatic method for identifying the various pos-sible outcomes of a given initiating event. For an ini-tiating event, if two-state modeling is employed (onefailure state and one success state), then an event treecan be constructed as a binary tree with nodes repre-senting a set of possible failure and success states.In conventional ETA, system failures that cause

these events are analyzed by using fault tree analysis(FTA) to identify the interrelationships between sys-tems and components. The failure rate of a componentis treated as a random variable and often lognormalprobability density function is used to describe thefailure rate variability and uncertainty. Through FTA

∗ Corresponding author.E-mail address: [email protected] (M.-J.J. Wang).

quanti�cation, lognormal probability density functionsof component failures are modeled by Monte Carlosimulation to determine the whole system failure rate.The output often contains the median, 5% and 95%percentiles of the occurrence rate. After getting thesevaluable data, only the median value will be incorpo-rated into the ETA, and a lot of information about therange of uncertainty are lost through this procedure.However, the whole state of a system often has un-certainty involved, it is incomplete using one value torepresent a fuzzy state. Sometimes a system can stillfunction with some failed components. Therefore, thefuzziness of the system state comes from the states ofits components and other factors (such as the opera-tions performed by human) that can a�ect it. Since thesystem state depends on the states of its components,Cutello et al. [4] proposed a fuzzy-state structure tomodel analytic uncertainty about the performanceof a real system. Besides, FTA of a very large and

0165-0114/01/$ - see front matter c© 2001 Elsevier Science B.V. All rights reservedPII: S 0165 -0114(98)00288 -7

154 D. Huang et al. / Fuzzy Sets and Systems 118 (2001) 153–165

complicated process can be simpli�ed by the conceptof a macro-event [25]. Based on this concept, a fuzzynumber can be used to represent the failure rate ofa macro-event.In conventional ETA, human errors are also quan-

ti�ed as probabilities and can be divided into threeparts [12], i.e., fail to detect correctly (P1), fail torespond in a timely manner (P2), and fail to exe-cute successfully (P3). The evaluation of P1 oftenresults from the opinions of experts. The humancognitive reliability (HCR) model [28] is used topredict P2. The technique for human error rate pre-diction (THERP) developed by Swain [24] is usedto calculate P3. After getting all three probabilities(P1, P2, P3), the total human error probability isapproximated as P1 + P2 + P3. However, it is dif-�cult to analyze human reliability microscopically[14]. Since human errors are in uenced by manyfactors (which are often called performance shapingfactors), it is nearly impossible to express humanerrors in terms of crisp values. Thus, for human-error-dominated events, which are too complex or illde�ned by numerical values, linguistic expressionsare appropriate to deal with them.In order to incorporate with hardware-failure-

dominated events, a function proposed by Onisawa[14–21] is used to transform the subjective scalerecognized by each expert into the objective scale ofprobability. Based on these concepts, a systematicfuzzy event tree analysis (FETA) approach is pro-posed to assess the reliability of a large-scale system.The anticipated transient without scram (ATWS)event of a nuclear power plant in Taiwan is used todemonstrate this procedure.

2. Fuzzy set theory

In this study, two special kinds of fuzzy numbersincluding triangular fuzzy numbers (TFNs) and trape-zoidal fuzzy numbers (TrFNs) are employed. A TFNcan be de�ned by a triplet A = (a1; a2; a3). The mem-bership function is

�A (x) =

0 for x¡a1;

(x − a1)=(a2 − a1) for a16x6a2;

(a3 − x)=(a3 − a2) for a26x6a3;

0 for x¿a3:

(1)

A TrFN can be de�ned by a quadruplet A =(a1; a2; a3; a4). The membership function is

�A (x) =

0 for x¡a1;

(x − a1)=(a2 − a1) for a16x6a2;

1 for a26x6a3;

(a4 − x)=(a4 − a3) for a36x6a4;

0 for x¿a4:

(2)

According to the extension principle proposed byZadeh [29], the arithmetic operations of fuzzy num-bers can be de�ned by means of �-cut operations:

A� = {x | x∈R; �A (x)¿�} ≡ the �-cut of A;

B� = {x | x∈R; �B (x)¿�} ≡ the �-cut of B:

Then

A�(+)B�= [a�1; a�2](+)[b

�1; b

�2]= [a

�1 + b

�1; a

�2 + b

�2];

(3)

A�(−)B�= [a�1; a�2](−)[b�1; b�2]= [a�1 − b�2; a�2 − b�1];(4)

A�(·)B� = [a�1; a�2](·)[b�1; b�2]= [a�1 · b�1; a�2 · b�2];a�1¿0; b

�1¿0; (5)

A�(÷)B� = [a�1; a�2](÷)[b�1; b�2]= [a�1 ÷ b�2; a�2 ÷ b�1];a�1¿0; b

�1¿0: (6)

(+), (−), (·), and (÷) denote fuzzy addition, subtrac-tion, multiplication and division, respectively.Defuzzi�cation of fuzzy numbers is a very impor-

tant procedure for decision making in a fuzzy envi-ronment [10]. Not only the ordering information butalso the representative value of a fuzzy number willbe obtained through this procedure. There are manydefuzzi�cation methods which can be selected byconsidering the requirement of the real situation anddi�erent points of view concerning what kind of in-formation the decision maker is interested in. In orderto match �-cut operations and to keep the pertinentand complete information obtained, the defuzzi�ca-tion method with total integral value and an indexof optimism � representing the attitude of a decisionmaker is adopted [10]:

�L(A )≡ the lower �-cut of A;�U(A )≡ the upper �-cut of A;

D. Huang et al. / Fuzzy Sets and Systems 118 (2001) 153–165 155

where A is a LR-type fuzzy number. The defuzzi�edvalue of A is de�ned as

D�(A)= (1− �)IU(A ) + �IL(A ); (7)

where

Ui(A )=1∑

�= 0:1

�i(A )��; (8)

Li(A)=0:9∑�=0

�i(A)��; (9)

Ii(A)= 12{Ui(A) + Li(A)}; (10)

i=L; U ; ��=0:1:

The defuzzi�ed values of �=0 and 1 can be, re-spectively, regarded as the upper and lower bounds ofa fuzzy number.

3. Fuzzy event tree analysis (FETA)

In FETA, the evaluation of an event tree is general-ized to the operations of some fuzzy sets. The occur-rence of each top event can be categorized into twotypes: hardware-failure-dominated and human-error-dominated events. For hardware-failure-dominatedevents, according to Singer’s opinion [22], the moststraightforward approach is to consider the relativefrequencies of these events as fuzzy numbers. For ex-ample, the failure rate of a component can be denotedby a TFN E=(l; m; n). The parameter “m” is themost possible value. “l” and “n” are the lower andupper bounds, respectively. These three parameterscan be obtained from data books or estimated by theconcept “error factor” [9,23,26], which is de�ned as

Error factor (EF) =Upper bound rateMost possible rate

=Most possible rateLower bound rate

: (11)

The reason of using error factor concept is becauseof the imprecision of the data [26]. In addition, theerror factor is often associated with the most possiblevalue of the occurrence rate which is provided in databook like [12].

For human-error-dominated events, it is often dif-�cult to estimate the occurrence rate of an event byusing one single probability, especially with humanerrors involved. Besides, only few or no empiricaldata are available to get reliable estimates of humanerror rates. For this reason, the linguistic expressionof each expert’s opinion from a macroscopic pointof view is adopted. One advantage of using linguis-tic variables is that this kind of expression is moreintuitive and easy for experts to give their opinionsin an ambiguous situation where numerical estima-tions are hard to get. According to Wickens [27], thetypical estimate of human’s working memory capac-ity is 7 ± 2 chunks, which means the suitable num-ber of comparisons for human beings to judge at atime is 5–9. In this study, the occurrence of a human-error-dominated event is evaluated by using seven lin-guistic values {“Very Low”, “Low”, “Fairly Low”,“Medium”, “Fairly High”, “High”, “Very High”}:“Very Low” (“VL”) ≡ (0; 0:1; 0:2);“Low” (“L”) ≡ (0:1; 0:2; 0:3);“Fairly Low” (“FL”) ≡ (0:2; 0:3; 0:4; 0:5);“Medium” (“M”) ≡ (0:4; 0:5; 0:6);“Fairly High” (“FH”) ≡ (0:5; 0:6; 0:7; 0:8);“High” (“H”) ≡ (0:7; 0:8; 0:9);“Very High” (“VH”) ≡ (0:8; 0:9; 1):The subjective scale is designed to �t the natural feel-ing of human beings. In order to get a more reliableassessment of the human-error-dominated event withlinguistic variables, it is necessary to aggregate theopinions of multiple experts. It is evident that expertopinions can, in fact, be used well in practical settings[11]. There are many methods available to aggregateexperts’ opinions, e.g. voting, arithmetic averagingoperation, fuzzy preference relations [13], max–minDelphi method, and fuzzy Delphi method [6]. How-ever, no �rm theoretical guidance can be used tochoose the most suitable one. The arithmetic averag-ing operation satis�es two characteristics of rationalcombination [3]: (a) a small variation in any possibil-ity distribution does not produce a noticeable changein the combined possibility distribution; and (b) whenexperts are equally weighted it can also includeweights that contain the relative importance of one


expert to another. The arithmetic averaging operationis also the most commonly used one. Thus, it is usedto aggregate the opinions of multiple experts. If theevaluation is conducted by a committee of n experts,their opinions can be aggregated by

Ai=(1=n)⊗ (Ei1 ⊕ Ei2 ⊕ · · · ⊕ Ein);i=1; 2; : : : ; m; (12)

where Ai is the “fuzzy error possibility” indicatingthe aggregated fuzzy value of event i, Eij is the lin-guistic value assessed by expert j to event i, m is thenumber of events. The term “error possibility” followsOnisawa’s de�nition [14] and it is essentially a kindof fuzzy probability. It is also di�erent from the math-ematical notion of possibility measure [2].In order to integrate with fuzzy failure rates of

hardware-failure-dominated events, a transformationis needed to convert the subjective fuzzy error pos-sibility into the objective fuzzy error rate. Onisawa[14–21] has proposed a function which can be used asa conversion between these two measurements. Thisfunction is derived from satisfying some propertiessuch as the proportionality of human sensation to thelogarithmic value of a physical quantity. The fuzzyerror rate can be obtained from the fuzzy error possi-bility as follows:

Er =

{1=10M ; Ep 6=0;0; Ep = 0;

(13)

M = [1=Ep − 1]1=3× 2:301;Er ≡ error rate;Ep≡ error possibility;k ≡ 1=log(1=(5× 10−3))≈ 2:301−1:Conversely, the fuzzy error possibility is obtained

from the fuzzy error rate by

Ep =f(Er)

=

{1=(1 + (k × log(1=Er))3); Er 6=0;0; Er = 0:

(14)

The relationship between error possibility and er-ror rate is shown in Table 1. According to Swainand Guttmann [24], the routine human error rateis 10−2−10−3 and the lower bound error rate is

5× 10−5. From Table 1, the corresponding error pos-sibilities are near 0.5 and 0.1, respectively. It showsthe range of the error rate obtained by this formulamatches very well with that suggested by human errordata [24].Finally, the steps of FETA are summarized:Step 1: For an initiating event identi�ed, the set of

possible failure and success states must be de�ned toconstruct the event-tree logic diagram.Step 2: Analyze human operations and human-

system interactions involved in these events, andthen divide them into hardware-failure-dominated,human-error-dominated, and mixed events.Step 3: Transform the failure rates of hardware-

failure-dominated events into proper TFNs.Step 4: Conduct linguistic values to assess human-

error-dominated events and the human-error part ofmixed events.Step 5: Transform linguistic values into correspond-

ing fuzzy error possibilities and aggregate experts’opinions into one fuzzy error possibility.Step 6: Convert the fuzzy error possibility into the

fuzzy error rate.Step 7: Integrate the fuzzy error rates and fuzzy

failure rates of di�erent types of events into the wholeevent tree analysis.Step 8: Analyze and interpret the results.

4. Practical example

A fuzzy event tree analysis of the ATWS event in anuclear power plant in Taiwan is used to explain anddemonstrate our approach.

4.1. Problem situation

According to Section 1 of WASH-1270, “ATWS”is an acronym for “anticipated transients withoutscram”. The �rst part of ATWS, “anticipated tran-sients”, is concerned with various events that mayhappen during the operation of a water-cooled reactorpower plant. These deviations from normal operationconditions are called the “anticipated transients”, andmight occur one or more times during the service lifeof a nuclear power plant. The other part of ATWS,“without scram”, is concerned with the reactor


Table 1The corresponding error rate (Er) of error possibility (Ep)

Ep 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0

Er 1.64E−5 2.23E−4 8.81E−4 2.32E−3 5.00E−3 9.77E−3 1.84E−2 3.55E−2 7.83E−2 1.0

protection system. The protection system is arrangedto detect o�-normal conditions and to work automati-cally when needed. If the protection system diagnosesthat there is a potential damage in the plant, the auto-matic reaction of this system is to insert control rodsinto the reactor core and to shut down nuclear reac-tion. If such a transient occurs and a scram does notresult, then an ATWS event will occur.

4.2. FETA

Step 1: For an initiating event identi�ed, the set ofpossible failure and success states must be de�ned toconstruct the event-tree logic diagram.The construction of an event tree is mostly based

on engineering experiences. The ATWS event treeadopted (Fig. 1) is extracted from Taiwan’s nuclearpower plant II operating PRA report (draft) [12].Step 2: Analyze human operations and human-

system interactions involved in these events, thendivide them into hardware-failure-dominated, human-error-dominated, and mixed events.In order to classify these events, engineering

knowledge and judgment are required to analyze theircauses. These top events are brie y explained in thefollowing.1. Event T1ACM–main condenser isolation ATWS:

This event will happen when the reactor is isolated andthe automatic scram system fails. It is also assumedthat mechanical failures cannot be repaired within theallowable time [1].2. Event R–recirculation pump trip: If the plant

fails to scram, an automatic recirculation pump systemis required to limit power generation immediately. Afailure of the automatic recirculation pump systemwillresult in event R.3. Event M–safety=relief valves (S=RVs) open: At

the time the reactor is isolated, at least 13 of 16 S=RVsmust open to prevent overpressurization of the reactorvessel. If insu�cient S=RVs open, then event M willhappen.

4. Event C0–Boron injection: When an ATWSevent happens, the power of the core is very high.If the power cannot be slowed down to the state ofshutdown, and the vapor produced by the reactorcontinues to inject into the suppression pool, then thetemperature will increase to fail the high-pressuresystem. This will increase the possibility of core-meltdown. As a result, automatic redundant reactivitycontrol system (RRCS) is supposed to inject liquidBoron into the vessel to shut down the reactor safely.If automatic RRCS fails, and operators fail to injectliquid Boron by using standby liquid control system(SLCS), it will result in event C0. It is assumed thatoperators cannot manually inject liquid Boron withinthe allowable time.5. Event XI–ADS inhibit: Automatic depressuriza-

tion system (ADS) is designed to decrease the pres-sure of the reactor in order to start the low-pressuresystem. The low-pressure system will inject water intothe reactor vessel to protect the fuel. When an ATWSevent happens, the reactor power is controlled by thelevel of water in core. Since high-level water willcause high power, the operator should inhibit all ADSvalves manually. If the operator fails to do so, eventXI will occur.6. Event U1–early high-pressure makeup: Follow-

ing the stop of feedwater supply, the high-pressuremakeup system is supposed to work automaticallywhen automatic actuation alarm appears as soon asthe water level is lowering till level 2. The water levelis expected to reach the top of the fuel. Thus, if thehigh-pressure system fails to work automatically, itwill lead to event U1.7. Event U–long-term high-pressure makeup: The

success criterion of avoidance of this event is that thehigh-pressure system can maintain the water level inthe vessel 24 h after the start. If the system fails andcauses event U , then using the low-pressure systemto maintain the water level is needed.8. Event XC–manual reactor depressurization: If

the pressure in the reactor vessel is too high to set


Fig. 1. Main condenser ISO ATWS event tree.

up the low-pressure system, the operator should de-pressurize the vessel manually in time to avoid coremelt-down.9. Event V–reactor inventory makeup at low pres-

sure: If the low-pressure system fails as well as thehigh-pressure system, then event V will occur and thewater level in the vessel will be so low as to probablycause core melt-down.10. Event XV–vessel over�ll prevention: When

the pressure in the vessel is decreased till the levellow enough for the low-pressure system to injectwater, huge amount of water will come into thecore. The operator should pay attention to the waterlevel and make sure that the level is kept not sohigh as to lead to core melt-down. The de�nitionof this event is the operator fails to complete thisjob.11. Event W–long-term heat removal: The resid-

ual heat removal (RHR) system is initialed to cool

down the suppression pool and containment in orderto maintain other supporting systems work well. If thissystem fails, event W will happen.12. Event VW–vessel inventory makeup after con-

tainment (CTMT) failure: The CTMT might failbecause of over-pressure or over-heat. The water inthe reactor vessel must be kept supplying to protectthe fuel not to be melt in the condition of CTMTfailure.Among these events, XI ; XC and XV are mainly

caused by human errors. The others are mainly causedby hardware failures.Step 3: Transform the failure rates of hardware-

failure-dominated events into proper TFNs.For each hardware-failure-dominated event, the

most possible rate can be referred [12]. The upper andlower bounds can be estimated by using the concept“error factor” or adopting the 5% and 95% percentilesof error rate distribution:


Table 2Assessment of human-error-dominated events by linguistic terms

Event XI Event XC1 Event XC2 Event XV

Expert 1 H M VH VHExpert 2 VH M VH VHExpert 3 H M VH VHExpert 4 H FL VH H

Event T1ACM: the most possible rate= 1:52E−7; the5% and 95% percentiles are 1:82E−8 and 1:28E−6,respectively, so the TFN= (1:82E−8, 1:52E−7,1:28E−6),Event R: the most possible rate= 1:96E−3, EF=5,

so the TFN is (3:92E−4, 1:96E−3, 9:8E−3),Event M : (2:00E−6, 1:00E−5, 5:00E−5), EF=5,Event C0: (4:56E−3, 1:37E−2, 4:11E−2), EF=3,Event U1: (2:82E−2, 8:45E−2, 2:53E−1), EF=3,Event U : (4:26E−4, 2:13E−3, 1:07E−2), EF=5,Event V : This event depends on the previous top

event and has three di�erent estimations. Thus it isdenoted by three di�erent symbols:

V1 = (1:12E−7, 1:12E−6 1:12E−5), EF=10,V2 = (3:40E−7, 3:40E−6, 3:40E−5), EF=10,V3 = (9:49E−6, 9:49E−5, 9:49E−4), EF=10,EventW : (2:03E−6, 2:03E−5, 2:03E−4), EF=10,Event VW : (1:35E−1, 4:00E−1, 9:60E−1), EF=

2.4.Step 4: Conduct linguistic values to assess human-

error-dominated events and the human-error part ofmixed events.For each human-error-dominated event, four ex-

perts assess the error possibility by using seven lin-guistic values {“Very High”, “High”, “Fairly High”,“Medium”, “Fairly Low”, “Low”, “Very Low”}. Theopinions are listed in Table 2.Step 5: Transform linguistic values into correspond-

ing fuzzy error possibilities and aggregate experts’opinions into one fuzzy error possibility.Event XI : The aggregated fuzzy error possibility is

14{(0.7, 0.8, 0.8, 0.9) · 3 + (0.8, 0.9, 1, 1)}=(0.725,0.825, 0.85, 0.925) in the TrFN form,Event XC1 : (0.35, 0.45, 0.475, 0.575),Event XC2 : (0.8, 0.9, 1, 1),Event XV : (0.775, 0.875, 0.95, 0.975).

Step 6: Convert the fuzzy error possibility into thefuzzy error rate.The fuzzy error possibility of each human-error-

dominated event can be converted into the fuzzy er-ror rate by using Eq. (13). The results are listed inTable 3.Step 7: Integrate the fuzzy error rates and fuzzy

failure rates of di�erent types of events into the wholeevent tree analysis.Since the fuzzy failure (error) rates of di�erent

types of events are obtained, we can integrate theminto the calculation of the occurrence rate of each out-come. The �-cut intervals of each outcome are shownin Table 4.Step 8: Analyze and interpret the results.Among all sequences, some of them {SEQ 3, 6, 7,

8, 9, 12, 13, 14, 15, 18, 19, 20, 21, 22, 23} will re-sult in core melt-down. In the following discussion,only these severe sequences will be taken into con-sideration. The defuzzi�cation method introduced inEq. (7) is applied to �nd out the representative val-ues (�=0:5) and the ordering of these sequences. Forcomparison with the traditional probabilistic analy-sis, the mean of �-cut interval with �=1 (dMOM) isadopted. Since the dMOM value of a fuzzy outcome in-dicates the most possible value in the fuzzy quantity,it can be used to compare with probability directly [3].The results are summarized in Table 5. Note that eachprobabilistic value is quite close to its correspondingdMOM value.In Table 5, the ordering ranked by using the rep-

resentative value is di�erent from that provided byusing probability. Using Spearman rank correlationcoe�cient to compare these two ranks, we can getrs = 0:953. This slight di�erence in ordering may bemainly due to the inherent di�erences of these two as-sessment approaches. The defuzzi�cation method in-troduced in this study considers the uncertainty andvagueness of a fuzzy outcome that are propagatedfrom related events, but the traditional probabilisticapproach just ranks these outcomes by using an ex-act probability value. This di�erence also shows thatwithout considering the uncertainties and vaguenessassociated with the outcomes, the information aboutthe real state of a complex system will not be re-vealed su�ciently. Thus the results of this kind ofanalysis might lead to misunderstanding and wrongdecisions.


Table 3Transformation between fuzzy error possibilities and fuzzy error rates of human-error-dominated events

Error possibility Error rate

Event XI (0.725, 0.825, 0.85, 0.925) (2.16E−2, 4.2E−2, 5.12E−2, 1.0E−1)Event XC1 (0.35, 0.45, 0.475, 0.575) (1.48E−3, 3.46E−3, 4.18E−3, 8.3E−3)Event XC2 (0.8, 0.9, 1, 1) (3.55E−2, 7.83E−2, 1, 1)Event XV (0.775, 0.875, 0.95, 0.975) (3.0E−2, 6.3E−2, 1.37E−1, 2.1E−1)

5. Discussion and interpretation

To provide some insight for a proper interpretation,two indexes are used to quantify these fuzzy outcomesin the following.

5.1. Interpretation of importance

One main purpose in system safety analysis is to�nd out the most important cause so that more at-tention can be paid to it to reduce the possibility ofsystem failure. One useful index called fuzzy impor-tance index (FII) proposed by Liang and Wang [9] isused in FTA to indicate the importance of a cause byobserving the e�ect of eliminating it from the origi-nal fault tree. The same concept is also mentioned inFuruta and Shiraishi [5]. Although FII is mainly usedin FTA, it can also be used to identify the relativeimportance among the events involved. Eq. (15) pro-vides the calculation of FII.

FII = PT −PTi =1∑

�=0:1

∣∣P�T −P�Ti ∣∣

=1∑

�=0:1

[|PUT −PUTi |+ |PLT −PLTi |]�; (15)

P�T = [PUT ; P

LT ]: � cut of total core melt-down fuzzy

error rate,P�Ti = [P

UTi ; P

LTi ]: � cut of total core melt-down fuzzy

error rate with top event i eliminated.The importance measure of each top event is shown

in Table 6. FII can help the analyst to �nd out thecritical event for reducing the occurrence of severeaccidents. From Table 6, the top �ve ranking forFII is U1; XC; XV ; C0; and XI . The three human-error-dominated events are all involved. This shows human

errors always play a key role in the occurrence ofsevere event sequences.

5.2. Interpretation of uncertainty

Since uncertainties are inevitably involved in thesefuzzy outcomes, it is important to identify which eventcontributes the most uncertainties to the fuzzy out-comes. An index called fuzzy uncertainty index (FUI)is used to help the analyzer to decide which data in theevent tree should be collected so that the uncertain-ties in the severe accidents’ occurrence possibilitiescan be lowered. Here, we revise the formula proposedin [23] by using the absolute-value operation instead.It will simplify the calculation without violating theconcept. This index is de�ned as

FUI = PT −PTi =1∑

�= 0:1

|P�T −P�Ti |

=1∑

�= 0:1

[|PUT −PUTi |+ |PLT −PLTi |]�; (16)

P�T = [PUT ; P

LT ]�: � cut of total core melt-down fuzzy

probability rate,P�Ti = [P

UTi ; P

LTi ]�: � cut of total core melt-down fuzzy

probability rate when the occurrence rate of ith eventis a crisp value.The uncertainty measure of each event is also shown

in Table 6. FUI can provide the analyst useful infor-mation on the design of data gathering strategies thatfocus on the reduction of total uncertainty [23]. FromTable 6, we can �nd the top �ve ranking for FUI alsocontains all three human-error-dominated events. Thisis not surprising because of the inherent vaguenessand variability of human performance.


Table4

The�-cutintervalsofeachsequenceofanATWSevent

�0.1

0.2

0.3

0.4

0.5

SEQ1

[2.059E−08,1.094E

−06]

[3.026E−08,9.79E−07]

[4.051E−08,8.663E

−07]

[5.136E−08,7.555E

−07]

[6.281E−08,6.466E

−07]

SEQ2

[7.626E−15,1.694E

−10]

[2.615E−14,1.323E

−10]

[6.33E

−14,1.008E

−10]

[1.266E−13,7.45E−11]

[2.244E−13,5.288E

−11]

SEQ3

[1.283E−14,1.827E

−10]

[3.234E−14,1.382E

−10]

[6.528E−14,1.017E

−10]

[1.156E−13,7.224E

−11]

[1.876E−13,4.909E

−11]

SEQ4

[9.811E−12,1.04E−08]

[1.87E

−11,8.466E

−09]

[3.086E−11,6.753E

−09]

[4.663E−11,5.25E−09]

[6.636E−11,3.95E−09]

SEQ5

[3.633E−18,1.61E−12]

[1.616E−17,1.144E

−12]

[4.822E−17,7.861E

−13]

[1.15E

−16,5.17E−13]

[2.371E−16,3.231E

−13]

SEQ6

[6.112E−18,1.736E

−12]

[1.998E−17,1.195E

−12]

[4.972E−17,7.926E

−13]

[1.049E−16,5.02E−13]

[1.982E−16,2.999E

−13]

SEQ7

[4.098E−13,2.18E−09]

[8.507E−13,1.717E

−09]

[1.517E−12,1.323E

−09]

[2.459E−12,9.921E

−10]

[3.734E−12,7.188E

−10]

SEQ8

[2.619E−18,1.096E

−13]

[7.289E−18,8.071E

−14]

[1.575E−17,5.751E

−14]

[2.933E−17,3.933E

−14]

[4.946E−17,2.552E

−14]

SEQ9

[2.082E−14,8.497E

−11]

[4.393E−14,6.582E

−11]

[7.94E

−14,4.979E

−11]

[1.302E−13,3.658E

−11]

[1.996E−13,2.592E

−11]

SEQ10

[0,2.483E

−07]

[0,2.06E−07]

[0,1.68E−07]

[0,1.34E−07]

[0,1.041E

−07]

SEQ11

[0,3.846E

−11]

[0,2.785E

−11]

[0,1.955E

−11]

[0,1.322E

−11]

[0,8.515E

−12]

SEQ12

[0,4.147E

−11]

[0,2.908E

−11]

[0,1.971E

−11]

[0,1.282E

−11]

[0,7.904E

−12]

SEQ13

[0,5.206E

−08]

[0,4.178E

−08]

[0,3.291E

−08]

[0,2.533E

−08]

[0,1.894E

−08]

SEQ14

[0,7.947E

−12]

[0,5.962E

−12]

[0,4.342E

−12]

[0,3.048E

−12]

[0,2.042E

−12]

SEQ15

[3.665E−11,2.675E

−07]

[6.801E−11,2.237E

−07]

[1.116E−10,1.838E

−07]

[1.696E−10,1.479E

−07]

[2.439E−10,1.158E

−07]

SEQ16

[5.666E−10,1.067E

−07]

[8.876E−10,9.101E

−08]

[1.259E−09,7.653E

−08]

[1.683E−09,6.323E

−08]

[2.161E−09,5.108E

−08]

SEQ17

[2.098E−16,1.652E

−11]

[7.67E

−16,1.23E−11]

[1.968E−15,8.909E

−12]

[4.15E

−15,6.235E

−12]

[7.722E−15,4.177E

−12]

SEQ18

[3.53E

−16,1.781E

−11]

[9.487E−16,1.285E

−11]

[2.029E−15,8.983E

−12]

[3.788E−15,6.046E

−12]

[6.455E−15,3.878E

−12]

SEQ19

[2.367E−11,2.237E

−08]

[4.038E−11,1.846E

−08]

[6.189E−11,1.499E

−08]

[8.877E−11,1.195E

−08]

[1.216E−10,9.294E

−09]

SEQ20

[1.283E−14,9.53E−11]

[2.934E−14,7.352E

−11]

[5.451E−14,5.523E

−11]

[8.976E−14,4.014E

−11]

[1.366E−13,2.796E

−11]

SEQ21

[1.713E−10,4.475E

−08]

[2.848E−10,3.753E

−08]

[4.228E−10,3.093E

−08]

[5.853E−10,2.495E

−08]

[7.724E−10,1.96E−08]

SEQ22

[8.763E−14,5.366E

−11]

[1.605E−13,4.425E

−11]

[2.548E−13,3.575E

−11]

[3.705E−13,2.815E

−11]

[5.076E−13,2.145E

−11]

SEQ23

[1.733E−11,1.052E

−08]

[3.172E−11,8.68E−09]

[5.031E−11,7.013E

−09]

[7.31E

−11,5.523E

−09]

[1.001E−10,4.21E−09]

SUM-SEV

[2.495E−10,3.999E

−07]

[4.261E−10,3.322E

−07]

[6.486E−10,2.713E

−07]

[9.199E−10,2.168E

−07]

[1.243E−09,1.687E

−07]


Table4(Continued)

�0.6

0.7

0.8

0.9

1

SEQ1

[7.489E−08,5.397E

−07]

[8.76E

−08,4.346E

−07]

[1.01E

−07,3.315E

−07]

[1.15E

−07,2.303E

−07]

[1.297E−07,1.309E

−07]

SEQ2

[3.659E−13,3.558E

−11]

[5.608E−13,2.218E

−11]

[8.202E−13,1.231E

−11]

[1.156E−12,5.565E

−12]

[1.58E

−12,1.595E

−12]

SEQ3

[2.861E−13,3.145E

−11]

[4.161E−13,1.854E

−11]

[5.832E−13,9.648E

−12]

[7.934E−13,4.051E

−12]

[1.053E−12,1.063E

−12]

SEQ4

[9.041E−11,2.847E

−09]

[1.192E−10,1.932E

−09]

[1.531E−10,1.201E

−09]

[1.925E−10,6.46E−10]

[2.379E−10,2.61E−10]

SEQ5

[4.417E−16,1.877E

−13]

[7.631E−16,9.862E

−14]

[1.244E−15,4.458E

−14]

[1.935E−15,1.561E

−14]

[2.898E−15,3.179E

−15]

SEQ6

[3.454E−16,1.659E

−13]

[5.661E−16,8.244E

−14]

[8.842E−16,3.495E

−14]

[1.328E−15,1.136E

−14]

[1.932E−15,2.119E

−15]

SEQ7

[5.401E−12,4.979E

−10]

[7.525E−12,3.243E

−10]

[1.018E−11,1.93E−10]

[1.343E−11,9.914E

−11]

[1.737E−11,3.816E

−11]

SEQ8

[7.773E−17,1.543E

−14]

[1.159E−16,8.457E

−15]

[1.657E−16,3.991E

−15]

[2.293E−16,1.462E

−15]

[3.088E−16,3.12E−16]

SEQ9

[2.91E

−13,1.751E

−11]

[4.084E−13,1.108E

−11]

[5.556E−13,6.389E

−12]

[7.372E−13,3.165E

−12]

[9.578E−13,1.168E

−12]

SEQ10

[0,7.807E

−08]

[0,5.58E−08]

[0,3.718E

−08]

[0,2.211E

−08]

[0,1.046E

−08]

SEQ11

[0,5.147E

−12]

[0,2.848E

−12]

[0,1.38E−12]

[0,5.342E

−13]

[0,1.274E

−13]

SEQ12

[0,4.549E

−12]

[0,2.381E

−12]

[0,1.082E

−12]

[0,3.888E

−13]

[0,8.494E

−14]

SEQ13

[0,1.366E

−08]

[0,9.364E

−09]

[0,5.974E

−09]

[0,3.393E

−09]

[0,1.529E

−09]

SEQ14

[0,1.285E

−12]

[0,7.413E

−13]

[0,3.751E

−13]

[0,1.519E

−13]

[0,3.796E

−14]

SEQ15

[3.367E−10,8.752E

−08]

[4.504E−10,6.306E

−08]

[5.871E−10,4.236E

−08]

[7.492E−10,2.539E

−08]

[9.393E−10,1.211E

−08]

SEQ16

[2.695E−09,4.007E

−08]

[3.286E−09,3.019E

−08]

[3.937E−09,2.142E

−08]

[4.648E−09,1.376E

−08]

[5.423E−09,7.177E

−09]

SEQ17

[1.317E−14,2.642E

−12]

[2.104E−14,1.541E

−12]

[3.198E−14,7.952E

−13]

[4.671E−14,3.325E

−13]

[6.605E−14,8.742E

−14]

SEQ18

[1.029E−14,2.335E

−12]

[1.561E−14,1.288E

−12]

[2.274E−14,6.235E

−13]

[3.207E−14,2.42E−13]

[4.403E−14,5.828E

−14]

SEQ19

[1.61E

−10,7.009E

−09]

[2.075E−10,5.066E

−09]

[2.617E−10,3.442E

−09]

[3.243E−10,2.111E

−09]

[3.959E−10,1.049E

−09]

SEQ20

[1.964E−13,1.841E

−11]

[2.708E−13,1.12E−11]

[3.612E−13,6.034E

−12]

[4.692E−13,2.639E

−12]

[5.964E−13,7.27E−13]

SEQ21

[9.841E−10,1.485E

−08]

[1.22E

−09,1.073E

−08]

[1.482E−09,7.23E−09]

[1.768E−09,4.345E

−09]

[2.078E−09,2.078E

−09]

SEQ22

[6.663E−13,1.566E

−11]

[8.465E−13,1.077E

−11]

[1.048E−12,6.786E

−12]

[1.272E−12,3.701E

−12]

[1.517E−12,1.517E

−12]

SEQ23

[1.313E−10,3.074E

−09]

[1.666E−10,2.115E

−09]

[2.062E−10,1.332E

−09]

[2.5E−10,7.266E

−10]

[2.979E−10,2.979E

−10]

SUM-SEV

[1.62E

−09,1.267E

−07]

[2.054E−09,9.072E

−08]

[2.549E−09,6.056E

−08]

[3.108E−09,3.608E

−08]

[3.733E−09,1.711E

−08]

SEQ:Sequence.

SUM-SEV:Intervalsumofseveresequences{SEQ3,6,7,8,9,12,13,14,15,18,19,20,21,22,23

}.


Table 5The lower bound, upper bound, representative (defuzzi�ed) value and rank (FETA), probability and rank (ETA), and dMOM of theoccurrence rate of each severe sequence

Sequence [L-bound, U-bound] Representative value (Rank) Probability (Rank) dMOM

SEQ-3 [3.02E−13, 7.26E−11] 3.64523E−11 (7) 1.05441E−12 (9) 1.06E−12SEQ-6 [4.47E−16, 6.04E−13] 3.02441E−13 (14) 1.9718E−15 (14) 2.03E−15SEQ-7 [5.43E−12, 9.42E−10] 4.7386E−10 (6) 3.31136E−11 (6) 2.78E−11SEQ-8 [8.48E−17, 4.15E−14] 2.07742E−14 (15) 3.0906E−16 (15) 3.1E−16SEQ-9 [2.95E−13, 3.56E−11] 1.79269E−11 (9) 1.23067E−12 (8) 1.06E−12SEQ-12 [0, 1.48E−11] 7.40822E−12 (11) 4.1196E−14 (12) 4.25E−14SEQ-13 [0, 2.36E−08] 1.18054E−08 (2) 6.91827E−10 (4) 7.65E−10SEQ-14 [0, 3.11E−12] 1.55415E−12 (13) 1.96018E−14 (13) 1.9E−14SEQ-15 [3.23E−10, 1.32E−07] 6.6196E−08 (1) 6.24568E−09 (1) 6.53E−09SEQ-18 [1.16E−14, 6.61E−12] 3.31205E−12 (12) 5.3452E−14 (11) 5.12E−14SEQ-19 [1.49E−10, 1.09E−08] 5.50431E−09 (4) 8.97648E−10 (3) 7.23E−10SEQ-20 [1.92E−13, 3.91E−11] 1.96572E−11 (8) 7.09958E−13 (10) 6.62E−13SEQ-21 [8.77E−10, 2.22E−08] 1.15515E−08 (3) 2.0783E−09 (2) 2.08E−09SEQ-22 [5.99E−13, 2.53E−11] 1.29464E−11 (10) 1.51702E−12 (7) 1.52E−12SEQ-23 [1.18E−10, 4.96E−09] 2.53984E−09 (5) 2.9792E−10 (5) 2.98E−10

Table 6Two indices for interpreting and ranking the events

Top event FII (Rank) FUI (Rank)

R 5.55559E−08 (6) 4.35791E−08 (6)M 2.83205E−10 (10) 2.22159E−10 (11)C0 2.45929E−07 (4) 1.57399E−07 (3)XI 7.51745E−08 (5) 9.26286E−08 (5)U1 1.75657E−06 (1) 1.0009E−06 (1)U 1.12841E−08 (8) 8.28085E−09 (7)XC 1.47242E−06 (2) 8.72979E−07 (2)V 1.58133E−08 (7) 4.31593E−10 (10)XV 4.03843E−07 (3) 1.49775E−07 (4)W 1.11061E−09 (9) 9.61619E−10 (8)VW 1.11061E−09 (9) 5.74324E−10 (9)

6. Conclusion

With inherent uncertainty and fuzziness an eventhas, it is unreasonable to use one crisp probabil-ity to represent the occurrence rate. To e�ectivelyhandle the vague and dynamic phenomenon of anevent, the fuzzy set theory is adopted to enhance riskassessment.The existing FETAmethodologies either fail to deal

with human errors as in [7] or lack a complete proce-dure to integrate all kinds of events. In this study, threetypes of events are categorized according to their def-initions. For hardware-failure-dominated events, the

occurrence probability can be modeled by the con-cept of error factor and using a triangular fuzzy num-ber to represent it. The parameters can be obtainedfrom referring data books or from simulation out-comes. However, for human-error-dominated events,due to the intrinsic variability of human performance,it is impractical to use a mathematical model to ob-tain a single probability to represent the occurrencerate as traditional probabilistic methods do. The ex-isting fuzzy methodologies emphasize analyzing hu-man errors through a microscopic viewpoint as in[8,9]. Since there are so many factors that can af-fect human performance and result in human errors,it is hard to take all of them into consideration. Here,linguistic expressions of experts’ subjective opinionsthrough a macroscopic viewpoint are aggregated toassess human-error-dominated events. It is more in-tuitive and easy for experts to give their opinionsin linguistic terms than in numerical data directly asin [3].After getting the evaluations of all types of events,

the proposed FETA algorithm provides a simple ande�ective procedure to integrate those events into thewhole event tree analysis.From the results of the example of an ATWS event

in a nuclear power plant, some concluding remarkscan be drawn:(1) The fuzzy outcomes contain the uncertainties

propagated from all previous events.


(2) The defuzzi�cation method should re ect theoptimistic degree of decision-maker’s attitude and takeinto account all the information available.(3) Without considering the uncertainties and

vagueness associated with the fuzzy outcomes, theinformation about the real state of a complex systemwill not be revealed su�ciently and might lead towrong decisions.(4) FII can provide useful information about how

much the total occurrence rate of severe accidents willbe reduced after eliminating the occurrence of anyevent. This is important for system safety improve-ment.(5) FUI can measure how much uncertainty an

event contributes to the �nal sequences. The informa-tion about those events with higher FUIs should begathered more to reduce total uncertainty.This study provides a formal procedure for apply-

ing fuzzy concepts to integrate both human-error-dominated and hardware-failure-dominated eventsinto ETA. Through this simple procedure, the analystcan give system more reliable risk analysis due to thatthe assessment of each event is expressed in terms ofa fuzzy number which carries more information thana crisp probability. Besides, the judgmental uncer-tainties associated with experts’ subjective opinionscan be expressed properly by using fuzzy sets. How-ever, using fuzzy concepts is aimed at enhancing theprobabilistic methodology in dealing with the dynam-icity and uncertainty of system safety, not to replaceit. Since the purpose of risk analysis is to e�ectivelyevaluate the safety of a system and to avoid possiblefailures or errors, the combination of fuzzy conceptsand probability theory should be further explored.

References

[1] Atomic Energy Council, Probabilistic Risk Assessment ofKuosheng Nuclear Power Station Unit 1, vol. 1, Taipei,Taiwan, 1985.

[2] K.Y. Cai, System failure engineering and fuzzy methodology:an introductory overview, Fuzzy Sets and Systems 83 (1996)113–133.

[3] M.H. Chun, K.-II Ahn, Assessment of the potentialapplicability of fuzzy set theory to accident progression eventtrees with phenomenological uncertainties, Reliability Eng.System Safety 37 (1992) 237–252.

[4] V. Cutello, J. Montero, J. Yanez, Structure functions withfuzzy states, Fuzzy Sets and Systems 83 (1996) 189–202.

[5] H. Furuta, N. Shiraishi, Fuzzy importance in fault treeanalysis, Fuzzy Sets and Systems 12 (1984) 205–213.

[6] A. Ishikawa et al., The max–min Delphi method and fuzzyDelphi method via fuzzy integration, Fuzzy Sets and Systems55 (1993) 241–253.

[7] R. Kenaranguie, Event tree analysis by fuzzy probability,IEEE Trans. Reliability (April 1991) 120–124.

[8] J.M. Kim, D.C. Lee, S.D. Lee, A fuzzy reasonal analysis ofhuman reliability represented as fault tree structure, Proc. 4thPan Paci�c Conf. on Occupational Ergonomics, 1996.

[9] G.S. Liang, M.J.J. Wang, Evaluating human reliability usingfuzzy relation, Microelectron. Reliability 33 (1) (1993)63–80.

[10] T.S. Liou, M.J.J. Wang, Ranking fuzzy numbers with integralvalue, Fuzzy Sets and Systems 50 (1992) 247–255.

[11] A. Mosleh, V.M. Bier, G. Apostolakis, A critique of currentpractice for the use of expert opinions in PRA, ReliabilityEng. System Safety 20 (1988) 63–85.

[12] Nuclear Power Plant 2 Operating Living PRA Report (Draft).Nuclear Energy Research Center, Tao Yuan, Taiwan, 1995.

[13] H. Nurmi, Approaches to collective decision making withfuzzy preference relations, Fuzzy Sets and Systems 6 (1981)249–259.

[14] T. Onisawa, Fuzzy concepts in human reliability, in:M.M. Gupta, T. Yamakawa (Eds.), Fuzzy Logic inKnowledge-Based Systems, Decision and Control, North-Holland, New York, 1988.

[15] T. Onisawa, Y. Nishiwaki, Fuzzy human reliability on theCHERNOBYL accident, Fuzzy Sets and Systems 28 (1988)115–127.

[16] T. Onisawa, An approach to human reliability in man-machinesystems using error possibility, Fuzzy Sets and Systems 27(1988) 87–103.

[17] T. Onisawa, An application of fuzzy concepts to modelingof reliability analysis, Fuzzy Sets and Systems 37 (1990)266–286.

[18] T. Onisawa, Subjective analysis of system reliability and itsanalyzer, Fuzzy Sets and Systems 83 (1996) 249–269.

[19] T. Onisawa, A representation of human reliability using fuzzyconcepts, Inform. Sci. 45 (1988) 153–173.

[20] T. Onisawa, On fuzzy set operations in system reliabilityanalysis with natural language, Japanese J. Fuzzy TheorySystems 5 (1) (1993) 1–14.

[21] T. Onisawa, Use of natural language in the system reliabilityanalysis, Fuzzy Logic: State of the Art, Kluwer AcademicPublishers, Dordrecht, The Netherlands, 1993, pp. 517–529.

[22] D. Singer, A fuzzy set approach to fault tree and reliabilityanalysis, Fuzzy Sets and Systems 34 (1990) 145–155.

[23] P.V. Suresh, A.K. Babar, V.V. Raj, Uncertainty in fault treeanalysis: a fuzzy approach, Fuzzy Sets and Systems 83 (1996)135–141.

[24] A.D. Swain, H.E. Gutemann, Handbook of human reliabilityanalysis with emphasis on nuclear power plant applications,NUREG=CR-1278, Sandia National Labs, NM, 1983.

[25] T. Terano, Y. Murayma, N. Akiyama, Human reliability andsafety evaluation of man-machine systems, Automatica 19(1) (6) (1983) 719–722.


[26] W.E. Vesely, Reliability quanti�cation techniques used inthe Rasmussen study, Reliability and Fault Tree Analysis,Theoretical and Applied Aspects of System Reliability andSystem Safety Assessment @, SIAM, Philadelphia, 1975,pp. 775–803.

[27] C.D. Wickens, Engineering Psychology and HumanPerformance, 2nd ed., Harper Collins Publishers Inc.,New York, 1992, pp. 211–257.

[28] D.H. Worledge, V. Joksimovich, A.J. Spurgin, Interim resultsand conclusions of the EPRI operator reliability experimentprogram, IEEE 4th Conf. on Human Factors and Power Plants,1988, pp. 315–322.

[29] L.A. Zadeh, Fuzzy sets, Inform. and Control 8 (1965)338–353.

a fuzzy set approach for event tree analysis

Documents