direct evaluation of fault trees using object-oriented programming techniques

IEEE TKANSACTIONS ON RELIABILITY, VOL. 38, NO. 2, 1989 JUNE 186

Direct Evaluation of Fault Trees Using Object-Oriented Programming Techniques

F. A. Patterson-Hine

B. V. Koen NASA Ames Research Center, Moffett Field

The University of Texas, Austin

Key Words - Fault tree, Recursion, Exact analysis, Object- oriented programming, List-processing

Reader Aids - Purpose: Present a new method for the direct evaluation of fault trees Special math needed for derivations: Fault-tree logic Special math needed to use results: None Results useful to: System reliability analysts, Fault-tree researchers

Abstract - Object-oriented programmming techniques are used in an algorithm for the direct evaluation of fault trees. The algorithm combines a simple bottom-up procedure for trees without repeated events with a top-down recurisve procedure for trees with repeated events. The object-oriented approach results in a dynamic modularization of tree at each step in the reduction process. The algorithm reduces the number of recursive calls required to solve trees with repeated events, and calculates intermediate results as well as the solution of the top event. The intermediate results can be reused if part of the tree is modified. An example is presented that compares the results of the algorithm implemented with conventional techniques with the object- oriented approach.

1 . INTRODUCTION

Fault trees are used widely as system models in quan- titiative risk assessments. The usual manner in which fault trees are evaluated is by quantification of the minimal cut sets. This method produces an approximate result in most practical applications, since the determination of minimal cut sets for larger trees requires truncation techniques to restrict the number of cut sets that are generated. Several direct-evaluation codes are available that employ a variety of techniques to solve the tree exactly. PATREC [l] uses a list-processing, pattern-matching algorithm implemented in PL/1. The fault tree is reduced by repeatedly identifying subtree patterns whose corresponding equation for evaluation is stored in a library, and replacing the subtrees by a leaf with equal probability of occurrence. This process is continued until the tree is reduced to a single leaf that corresponds to the top event. Another approach [2] combines

,

a simple bottom-up algorithm which simplifies fault trees without repeated events, with a bottom-up algorithm which produces the structure function for trees that contain repeated events. This algorithm is implemented in FORTRAN and partially in Assembler, and supports the evaluation of large trees (up to 500 basic events and lo00 gates). PAFT F77 [3] is also written in FORTRAN, and calculates: 1) the probability of occurrence of the top event and all intermediate events, and 2) the marginal importance of each basic event; but it is limited to solving moderately-sized trees containing no more than 99 gates and basic events combined. The most recently developed code, TDPP [4], uses a recursive, top-down algorithm to evaluate the probability that the top event occurs. The algorithm, implemented in PASCAL, is well-suited for use on microcomputers. Its development demonstrates the usefulness of the simple, top-down approach for reducing moderate size trees that contain repeated events.

The present work combines many of these powerful features including list-processing, the simple bottom-up procedure for gates without repeated inputs, and the top-down recursive technique for trees containing repeated events. The list-processing language LISP is used, adding the capability of symbolic manipulation. A simple code, PATREC-L [ 5 ] , was developed to demonstrate the applicability of LISP to fault tree evaluation. A second code was developed in PRO- LOG [6] which solves simple fault trees using the top-down matching procedures inherent in the language. LISP is bet- ter suited for the present application due to its flexibility, and the availability of object-oriented programming extensions in the LISP environment on the Texas Instruments Ex- plorer workstation used for this project [7]. The Flavors system [8] on the Explorer is an object-oriented [9, 101 language that can be used in combination with the LISP environment. The following sections describe the application of object-oriented programming to fault-tree reduction, and conclude with examples that demonstrate the usefulness of this technique for exactly solving binary trees containing repeated basic events and subtrees.

The fundamental concepts of object-oriented programming are summarized in section 2. Fault trees are then defined using object-oriented techniques, and the procedures used to evaluate the trees are described in section 3. Several example applications are described in section 4, and the final section 5 discusses the benefits of using object-oriented programming for fault-tree reduction.

2. OBJECT-ORIENTED PROGRAMMING

Object-oriented programming techniques are used widely in expert system packages, graphics, system

0018-9529/89/0600-0186$01 .00O 1989 IEEE

PATTERSON-HINEIKOEN: DIRECT EVALUATION OF FAULT TREES USING OBJECT-ORIENTED PROGRAMMING TECHNIQUES 187

programming, database management systems, and for many other demanding applications. Object representations are based on the well-known frame representations developed by Minsky [l l] , but offer more flexibility for knowledge representation. Object-oriented programming extends the notion of frames with powerful features that enable encapsulation of modules of code, and a unique concept called inheritance. These features allow the development of a software system that is modular, exten- dable, flexible, and concise. One of the most serious prob- lems with previous direct evaluation algorithms is the loss of information about the system, both pre-defined struc- tural interrelationships and intermediate results during tree simplification. Fault trees represent complex system in- teractions, and the software techniques used to model the trees must be capable of capturing complete system information.

The basic entity in object-oriented programming is the object, which is an abstract data type [9]. Objects are defined in terms of classes that combine the behavior and state of the objects. Classes describe one or more similar objects, and a particular object is called an instance of the class. For example, if Power-Drill is a class, then my-drill is an instance of that class. Inheritance allows information used to define classes to be accessed by more specialized objects. The inheritance mechanism simplifies modifications and eliminates redundant data specification. Object state is stored in variables that can be accessed via the inheritance hierarchy. Changes that affect the state of all objects of a particular class can be made by updating the class definitions, thus changing at once the information inherited by multiple objects.

Object behavior is controlled by sending messages among the objects, rather than by function calls as in conventional languages. Message sending is another important feature of object-oriented programming since it provides the mechanism for data abstraction and generic operations. It shifts the responsibility of determining which operations pertain to various data types from the calling procedures to the objects themselves. Operations are defined in the procedures called methods. When an object receives a message, it responds with actions specified in the method associated with that object's class. Each class may require specific methods, or methods may be inherited from other classes.

The Flavors system refers to abstract type definitions, usually called objects in object-oriented languages, as flavors. Variables that describe the state of the instances of flavors are called instance variables. Flavors may inherit information from any other specific flavor or from multiple flavors. This feature is called multiple inheritance. The application of these concepts to fault-tree analysis results in a clear and concise representation of the tree, and provides a powerful mechanism for the storage, retrieval, and evaluation of system information.

3. FAULT-TREE FLAVORS

The most general flavor definition in the fault-tree description is the flavor TREE. All logic-gate and basic- event descriptions are specializations of the TREE flavor. Instance variables that contain information common to both basic events (nodes) and logic gates are defined in this flavor. All gates and nodes have both a name and parents, so two instance variables, :name and :parent, hold this information. Since the top event of the fault tree does not have a parent, the value of :parent variable is nil. A variable called :unavailability stores basic-event data for nodes. Results from the simplification of logic gates are stored in :unavailability for gates. Another variable, :dependent, indicates whether repeated events are located under a particular gate. Nodes are terminal leaves, making the value of the :dependent variable nil for all nodes. The TREE flavor is specialized into two other flavors, GATE and NODE.

The GATE flavor includes instance variables that describe more specifically the state of logic gates. All gates are non-terminal leaves, and the names of their children are stored in a variable called :children. A second variable, :dependent-eval, indicates whether or not the gate must be evaluated using the top-down algorithm capable of hand- ling repeated events. The NODE flavor inherits the :unavailability variable from the TREE flavor, but may change the value of :unavailability for all nodes by using a default specification. The :unavailability of each node can also, of course, be changed individually. Specific logic gate types, such as AND- and OR-gates, are described by specializations of the GATE flavor. These flavors are necessary for defining methods that apply the specific reduction equations required by each type of gate.

4. FAULT-TREE METHODS

The procedures that evaluate the tree combine a straight-foward bottom-up procedure for branches without repeated events with a top-down recursive algorithm for subtrees that contain repeated events. For subtrees that do not contain multiple occurrences of any event, eq. (1)-(2) are used to evaluate AND- and OR-gates:

where A and B are the children of the gate. An AND-gate that receives a :reduction message applies (1) to its inputs, and stores the result in the :unavailability variable of that gate. Eq. (2) is applied in the :reduction method for OR- gates. As the procedure continues to the next level in the tree, these intermediate results are used to simplify the upper-level logic gates.

188 IEEE TRANSACTIONS ON RELIABILITY, VOL. 38, NO. 2,1989 JUNE

When a repeated event is encountered, the name of the event is stored in its parent’s :dependent variable, and the names are then propagated up the tree at each level. A gate receiving the same repeated event indicator from both its children stores this indicator in :dependent-eval and must use the recursive procedure for evaluation. In this way, information about the locations of repeated NODEs are stored in all the GATE objects located above the particular NODEs. The simple bottom-up procedure can be applied to all GATES whose :dependent-eval variable is empty. The top-down, recursive procedure is used when a GATE’S :dependent-eval is non-nil, indicating that event is the top event of a subtree containing more than one occurrence of a repeated NODE. Those subtrees can then be treated as independent modules since the GATE requiring the recursive procedure passes only one :dependent indicator for each repeated NODE up to its parent(s).

The basic element of a top-down algorithm for reduction of fault trees containing AND- and OR-gates is the ex- tension of (1)-(2) to represent set operations [12]. Top- down algorithms are conceptually simple and well-suited to implementation using computer languages that allow recursive function calls. LISP allows recursion, so the algorithms developed in [12] are easy to implement in a LISP environment. Representation of the tree as a collec- tion of objects allows these algorithms to be improved to achieve results in much fewer recursions.

The usual top-down algorithm begins by trying to simplify the event of interest, represented by a set containing one element which is the top gate of that event. If the gate is AND, it is replaced by a set of gates consisting of the children of the AND-gate, and the algorithm is called recursively to simplify the new set. This operation corresponds to:

PROB-OF-EVENT (s) =

PROB-OF-EVENT(S - {n} U { j , k}) (3)

Notation

PROB-OF-EVENT name of the algorithm S n an AND-gate j , k children of n.

set of events being considered

Other, standard notation is given in “Information for Readers & Authors” at the rear of each issue.

If the top gate is OR, the algorithm is called for: a set of events containing its left child, a set containing its right child, and a set containing both children. These operations correspond to:

PROB-OF-EVENT (5‘) =

PROB-OF-EVENT(S - {n} U { j } )

+ PROB-OF-EVENT ( S - {n} U {k})

- PROB-OF-EVEVT(S - {n} U { j , k}) (4)

Notation

n an OR-gate.

When the algorithm tries to simplify a set that contains more than one element, the sets resulting from (3)-(4) represent the union of the other elements of the set with the children of the gate being expanded. For example, the simple tree in figure 1 contains 2 AND-gates and 1 OR-gate. Figure 2 illustrates the steps required to simplify GATE-A. GATE-A, an AND-gate, is first replaced by its children, GATE-B and GATE-C. The procedure continues until a set contains only basic events at which time the :unavailability values of each event are multiplied together. The final result of GATE-A is obtained by adding the results of 2 sets of events and subtracting the result of a third set from that sum. For more complicated gates, many recursions might be required to obtain the final result.

0 0 0 0 Fig. 1 . Sample Fault Tree.

This basic algorithm is impractical for even moderate size trees containing multiple events. Ref. [ 121 describes several ways to search for statistical independence in the set of events being evaluated to reduce the number of recursive calls considerably. The first search technique ex- amines each of the gates in the set for statistical independence. Once a gate is found to be statistically independent from the other gates in the set, a simpler equation can be used that results in fewer recursive function calls:

PATTERSON-HINE/KOEN: DIRECT EVALUATION OF FAULT TREES USING OBJECT-ORIENTED PROGRAMMING TECHNIQUES 189

PROB-OF-EVENT(S) = PROB-OF-EVENT({ n ] )

PROB-OF-EWNT(S - { n } ) (5)

Notation

S- implies statisticaluy) n an event that is s-independent from every other event

in S .

A gate is s-independent from the other events in the set if none of the events below that gate in the tree also occur below any other gate in the set. Although techniques such as this do reduce the number of recursive calls compared to the basic algorithm, a subtree must be repeatedly expanded each time it is included in a set of events.

Objects have the capability of storing the results of intermediate tree reductions, and the use of these results ap- preciably improves the performance of the top-down algorithm. An event that is s-independent from the others in the set does not have to be re-evaluated. s-Independent gates are thus treated as modules, without having to modularize the tree explicitly before any reduction begins. This not only saves recursion time, but also the time for modularization. Since any event that is repeated in the tree is propagated up- wards in each parent gate’s :dependent variable, gate s-independence is easily established by checking the intersec- tion of one gate’s :dependent list with another gate’s :dependent list. A gate that is s-independent from the other gates in the set must also be s-independent from any basic events that are in the set, and the gate’s :dependent list is also checked to determine if any of the basic events are in its list. This technique for indicating s-dependencies results in a dynamic modularization of the tree according to which events are in the set being evaluated.

A second, more extensive search can be used if no gate is s-independent from the other events in the set. The children of each OR-gate can be examined for s-independence, and a simpler equation can be employed in the case where an s-independent child is found. This technique is described in detail in [12] and is not repeated here. It is incorporated into the procedures used in this study, and a comparison of the benefits of each search technique, combined with the object- oriented approach, is included in the next section. The basic algorithm (Algorithm I), the algorithm that employs a search for s-independent gates (Algorithm 2), and the algorithm that also searches the children of OR-gates for s-independence (Algorithm 3), all have names that are consistent with names in [12]. Figure 3 summarizes the top-down algorithm that in- corporates all of the information made available by the object representation of the fault-tree events and the most extensive search techniques.

5 . EXAMPLES

5.1 Example 1

One of the trees used as an example by Page & Perry [ 121 to illustrate the use of top-down recursive algorithms is shown in figure 4. Since their algorithms are implemented

on a microcomputer, it is not appropriate to compare run times with algorithms implemented on a dedicated LISP machine. It is appropriate, however, to compare the number of recursive calls required by each algorithm. Table 1 summarizes the number of recursive calls required by 3 algorithms. Page & Perry indicated that in the cases of Algorithms 1 & 2, solution on the microcomputer was not feasible. The object-oriented Algorithm 1 requires 583 820 calls to produce the exact solution of the top event. This calculation takes over an hour on the Explorer’. Searching for s-independent gates reduces the number of calls required by the object-oriented Algorithm 2 to 24 800. This is still impractical for productive applications, and the more extensive search for s-independent children in OR- gates is added. The tree is solved by the object-oriented Algorithm 3 in 91 recursive calls, including the solution of all intermediate gates in the tree, as summarized in table 2. This represents a marked improvement in performance over [12, algorithm 31 that employs the same search for s-independence, and requires 758 calls to produce the solution of the top event only. The object-oriented solution was calculated in less than 3 seconds on the Explorer, while the microcomputer implementation required 26 seconds.

An additional benefit of using objects is the ability to modify the tree and reuse intermediate results from branches that are not affected by the modifications in the evaluation of the new tree. For example, the unavailability of NODE-5 in the example tree was changed, and the tree was then reduced in only 41 calls. The number of previous results that can be reused depends, of course, on the location of the modifications. The capability of interactively editing and evaluating fault trees, and reusing partial results in the direct evaluation of the tree is not possible in any common fault-tree code. This ability greatly increases the productivity of design engineers in comparing the reliability characteristics of similar systems.

5.2 Example 2

Two other trees were randomly constructed containing both AND-and OR-gates and having several repeated basic events. Algorithm 3 was used to evaluate these trees to determine the effect of increasing the numbers of repeated events on the performance of the algorithm. The trees are shown in figures 5 and 6. The tree in figure 5 contains 21 logic gates and 15 basic events, 7 of which are repeated at one other location in the tree. This tree required 7368 recursive calls for solution, and the computation took 155 seconds on the Explorer. The second tree, shown in figure 6, contains 27 logic gates and 18 basic events, 10 of which are repeated. This tree required only 2223 recursive calls and 45 seconds of computation time. This may seem odd until the object descriptions of the fault tree events are carefully examined. For figure 5 , only one s-dependency was resolved before the evaluation of the top event: GT required the top-down algorithm because N10 appeared twice beneath it. The other 6 s-dependencies were resolved

‘These calculations were performed on a Texas Instruments Explorer workstation running Explorer System version 3.0.

~

190 IEEE TRANSACTIONS ON RELIABILITY, VOL. 38, NO. 2, 1989 JUNE

Fig. 5 . Fault Tree with 7 Repeated Events.

Fig. 6. Fault Tree with 10 Repeated Events.

TABLE 2 Solution of Figure 3

Event Unavailability

GATE-1 GATE-2 GATE-3 GATE-4 NODE-5 GATE-6 NODE-7 GATE-8

NODE- 10 GATE- 1 1 NODE-12

NODE-9

GATE-13 NODE-14 GATE- 15 NODE-16 GATE-17 NODE-1 8 NODE-19

NODE-21 GAT E - 2 2

GATE-24

GATE-20

NODE-23

GATE-25 GATE-26 NODE-27 NODE-28 NODE-29 GATE-30 NODE-3 1 GATE-32 GATE-33 GATE-34 NODE-35 NODE-37

0.18614957 0.10346344 0.12602672 0.3439 0.1 0.271 0.1 0.19 0.1 0.1 0.40951 0.1 0.3439 0.1 0.271 0.1 0.19 0.1 0.1 0.30085328 0.1 0.22317031 0.1 0.1368559 0.19 0.46855897 0.1 0.1 0.1 0.40951 0.1 0.3439 0.19 0.19 0.1 0.1

The examples illustrate the benefits of using the object representation compared with conventional methods. The current implementation is limited to binary trees and does not support com- plementary events, although these limitations can be eliminated easily. The object-oriented approach offers much more flexibility for implemen- ting these extensions than do conventional programming paradigms and produces a more powerful algorithm. Of equal importance to the run- time comparisons with conventional techniques is the introduction of a reliability tool that is easy to use, improves data consistency by using libraries of components described as objects, and is available on workstations that are designed to improve productivity. The current version is implemented in LISP on a symbolic processor, but future work is planned to implement this approach in a conventional language with object extensions that would be optimized for a numeric processor.

PATTERSON-HINE/KOEN: DIRECT EVALUATION OF FAULT TREES USING OBJECT-ORIENTED PROGRAMMING TECHNIQUES 191

~~~

-I- -_____- 'ROIi-OF.I:VI!NT (S)

II; S cwt,ii:is iiidrpctird~nt evetits l ' l i B N

hlwk iiidepcridrnt w r i i t s so they will 1101 bc cxpntidtd.

IF all cvciits i n S arc iiidependuiit 'I'IIEN

I'ROB-OI--IiVENT ( S ) = the product of tlic : i i i i i tvi i i l~ibil i I)~ o f ;ill cvc11Is i n S

ELSF IF: S coiitnins .4ND-GATEs 'l'tlEN

S' = S wiiii all ANDGATES replaced by [!ieir c l i i l d rc i i , j :ind k .

!I: S' contiiins ANI)-GAI'Es lI1EN

h lwk iiidepeiident AND-GAEs or exp;intl thcni .

ELSE

PROR-OF-EVENT ( S ) = PROR-OI;-I<'dLiNT (S')

ELSE IFS contains :in OR-GATE that has an indcpeiident child, j, 1'1 IllN

PROD-OF-EVEN'I'(S) = PROB-OF-IIVIIN'l'( (j]uS-( 11))

+ [ I - : u n a v a i ! ; t b i l i t ~ ~ ( j ) ) ]

' PROR-OF-IVI~N'I'(Sc,(kJ- [ 11))

ELSE

PROR-OF-EVENT (S) = PROB-OF-EVtN ' I ' (S - (nJo ( j ) )

+ FROB-OF-EVENT ( S - [ n ) u [ k ) )

- PROD OF-EVENT ( S - ( n ) u ( j , h l )

Fig. 3. Top-Down Recursive Algorithm.

A '1'211

A h

L

Fig. 4. Fault Tree from Ref [12].

during the evaluation of GB. The tree in figure 6 con- tained more s-dependencies; however, 7 of them were resolved before the evaluation of the top event. This allowed more s-independence to be used in evaluating the top event, making the calculation more efficient. These two examples demonstrate that the difficulty of evaluation of fault trees with repeated events depends more on the structure of the tree than on the number of repeated events.

6. DISCUSSION

Representing a fault tree with objects creates a flexible environment in which to improve conventional fault-tree analysis. In this study, a simple bottom-up procedure for solving fault trees without repeated events is combined with a top- down procedure capable of solving fault trees with repeated events. The top-down procedure is chosen for its simplicity and its suitability for implementation in LISP. A bottom-up procedure that produces the structure function of a tree could also have been used for the subtrees with repeated events. In fact, the modularity of the object-oriented approach makes it possible to implement both techniques and allows the user to select the method more appropriate for a given problem.

Reuse of partial results in the reduction of fault trees is a desirable capability that is available in one of the most widely used minimal cut set codes, SETS [13]. In SETS, the user must specify which subtrees to treat as modules so that partial results can be stored and used in another run. In the object-oriented approach, all tree modularity is determined inherently by the :dependent in- dicators, and partial results are stored for all objects, removing the burden of specifying subtree modules from the user. This technique assures that all existing s-independence is exploited during each step of tree reduction.

TABLE 1 Number of Recursive Calls Required to Evaluate the Fault Tree in Figure 3 .

Object-Oriented Approach Page & Perry [I21

Algorithm 1 not feasible* 583820* Algorithm 2 not feasible* 24800** Algorithm 3 758* 91**

*Solution of top event only. **Solution for all events in the tree.

192 IEEE TRANSACTIONS ON RELIABILITY, VOL. 38, NO. 2,1989 JUNE

ACKNOWLEDGMENT [ l l ] M. Minsky, “A framework for representing knowledge,” The Psychology of Computer Vision, P. H. Winson, Ed. McGraw-Hill,

This work was sponsored by the us NASA Graduate [12] ril Page, J . E. Perry, “A simple approach to fault-tree prob- abilities,” Computers and Chemical Engineering, vol 10, 1986, pp Student Researchers ‘ONTA

Amelia Earhart Program, and US NSF grant 249-257. . DMC-8615432. We specially thank Dr. Jon Erickson for [13] R. B. Worrel, “A SETS users’ manual for the fault tree analyst,” his interest and support of this work. S a n d i a L a b o r a t o r i e s , A l b u r q u e r q u e , New Mexico,

NUREGICR-0465, SAND 77-2051, 1978.

REFERENCES AUTHORS

111 B. V. Koen, Annick Carnino, “Reliability calculations with list processing techniques,” IEEE Trans. Reliability, vol R-23, 1974 Apr,

[2] K. Stecher, “Evaluation of large fault-trees with repeated events using an efficient bottom-up algorithm,” IEEE Trans. Reliability, vol R-35, 1986 Apr, pp 51-58.

Trans. Reliability, vol R-35, 1986 Apr, pp 48-50.

F. A. Patterson-Hine; MS 2444; NASA Ames Research center; ~ ~ f f ~ ~ ~

Field, California, 94035 USA, F. A. Patterson-Hine was born in 1959. She received a BS in

Mechanical Engineering form The University of Alabama in 1981, an M~ in 1984, and a PhD in 1988, both from the University of Texas at Austin in Mechanical Engineering. She was a NASA Graduate Student Research

in the Information Sciences Division at NASA Ames Research Center.

pp 43-50.

[3i T. Fee, F77, Program for the analysis Of trees,” IEEE Fellow and a ZONTA Amelia Earhart Fellow. She is a Research Associate

[4] L. B. Page, J. E. Perry, “An algorithm for exact fault-tree prob-

[51

[71

[81 [91

abilities without cut sets,” IEEE Trans. Reliability, vol R-35, 1986 December, pp 544-558. F. A. Patterson, B. V. Koen, “Implementation of PATREC nuclear reliability program in LISP,” Trans. American Nuclear Society, vol

B. V. Koen, D. B. Koen, “Implementation of PATREC nuclear reliability program in Prolog,” Trans. American Nuclear Society,

F. A. Patterson-Hine, B. V. Koen, “System safety and reliability using object-oriented programming techniques,” to appear in Trans. American Nuclear Society, vol 55, 1987, pp 431-432. Explorer Lisp Reference, Texas Instruments Incorporation, 1987. M. Stefix, D. G . Bobrow, “Object-oriented programming: Themes and variations,” The A I Magazine, vol VI, 1985 Winter, pp 40-62. B. J . Cox, Object Oriented Programming: An Evolutionary Ap- proach, Addison-Wesley Publishing Company, 1986.

50, 1985, pp 286-287

VOI 54, 1987, pp 54-55.

Dr. B. V. Koen; ETC 5.134; Department of Mechanical Engineering; The Uninversity of Texas; Austin, Texas 78712 USA.

B. V. Koen was born in 1939. He received a BA in Chemistry in 1960 and a BS in Chemical Engineering in 1961 from The University of Texas, an SM in Nuclear Engineering from Massachusetts Institute of Technology in 1962, a Dipl^ome d’lng’enieur en G’enie Atomique: L’Institut National des Sciences et Techniques Nucl’eaires, Saclay, FRANCE in 1963, and a ScD, in Nuclear Engineering from Massachusetts Institute of Technology in 1968. He is Professor of Mechanical Engineering at The University of Texas. He teaches artifical intelligence courses for engineering students, and courses in nuclear engineering and engineering design.

Manuscript TR87-722 received 1987 November 23; revised 1988 September 1 .

IEEE Log Number 25543 4 TR b

FROM THE EDITORS FROM THE EDITORS FROM THE EDITORS FROM THE EDITORS FROM THE EDITORS FROM THE EDITORS

Manuscript Preparation - Revised & Updated Procedures The “Information for Readers & Authors” that appears at the rear of each issue has been revised and updated as of

the 1989 April issue. Please re-read it carefully before preparing and submitting your manuscript.

The major changes incolve: 1. Authors outside of North America need send only 1 copy of the manuscript (be sure it can be legibly copied on

ordinary copy-machines). It is cheaper for us to make more copies than it is for those authors to pay the airmail postage. Authors within North America will contine to send 3 copies.

2. Figure originals may be made by any of the current technologies. They must be very legible and free from extraneous marks.

3 . Suggestions for organizing the paper have been added.

DON’T FORGET! RE-READ IT! “Information for Readers & Authors”

IT WAS REVISED IN APRIL!

direct evaluation of fault trees using object-oriented programming techniques

Documents