Common cause failures (CCFs) are two or more component failures that occur at the same time or occur within a relatively short interval and that are due to a common cause. "Component" is used in a general sense here and can mean a component such as a valve or pump or a subsystem
cause referred to here is an implicit dependency in the failures that can cause additional failures to be triggered once one failure occurs. CCFs must be considered and modeled in a fault tree because of their importance. Neglecting these CCF contributions can result in a significant underestimate of the probability of the top event. The key in successfully including CCFs in a fault tree is to identify the components that are susceptible to CCFs and then properly model them in the fault tree.
Before CCFs can be modeled properly they must be understood. Examples of CCFs that can occur and which have occurred are:
1. A common design or material deficiency that results in multiple components failing to perform a function or to withstand a design environment. Examples include undetected flaws in main engines and low material strengths in turbo pumps.
2. A common installation error that results in multiple components being misaligned or being functionally inoperable. Examples include check valves being installed backwards that remained undetected because they were not tested after installation. 3. A common maintenance error that results in multiple components being misaligned or
being functionally inoperable. Examples include multiple valves remaining in a misaligned position after maintenance.
4. A common harsh environment such as vibration, radiation, moisture or contamination that causes multiple components to fail.
If a particular common cause such as a maintenance error is explicitly modeled in the fault tree then this particular common cause would not be modeled as a CCF. However, other CCF causes would still need to be included in the fault tree. Generally CCFs are potentially important contributors to the failure of redundant identical components, e.g., two identical motor operated valves of the same specification, two identical turbo pumps of the same specification, etc. Generally CCFs are more significant for active redundant components (motor operated valves, etc.) and become more dominant contributors as the number of redundant components increases. The importance of CCF contributions can be illustrated by a simple example, which is representative of actual situations. Consider three redundant components that must all fail for the system to fail. The components can be relief valves, hydraulic pumps, controllers, or any other components providing a redundant function.
If each component has a failure probability p of 1 in a 1000, i.e. 1×10-3
, then the probability of the three components failing independently, Pindependent is
Pindependent = p3. (5.1)
That is
Pindependentt = 1×10-3•1×10-3•1×10-3 (5.2)
Pindependent=1×10-9. (5.3)
Consequently, the probability of the three components failing independently is 1 in one billion. Now consider the possibility of a common cause failing all three components. Assume that there is a likelihood of 1%, i.e., 1×10-2
, that a common cause occurs. This can be interpreted as saying that in 1% of the failures there are common cause dependencies. This is the probability, for example, that a flaw exists in multiple components due to a manufacturing deficiency where the flaw has been missed by inspection. If the component fails from the deficiency then all the components with this deficiency will fail. The probability of the three components failing due to CCF, PCCF is calculated as
PCCF = 1×10-3•1×10-2 (5.4)
or
PCCF = 1×10-5. (5.5)
Consequently PCCF is one in one hundred thousand and is a factor of 10,000 greater than the
independent failure probability Pindependent. Note that in determining PCCF, the individual
component failure probability (p=1×10-3
) is the first factor in Equation (4) and is multiplied by the probability of the CCF occurring which in this case is 1×10-2
. The common cause probability of 1×10-2
is a conditional probability of the remaining components failing given one component has failed. The common cause probability of 1×10-2
is equivalently the probability that the failure cause, given a failure, is a common cause that will affect all the other components. The CCF probability is thus a fraction of the failures involving all similar components. This is the basis for its estimation from data∗.
As can be observed, because the CCF probability affects all components in a redundant set, even if it has a small likelihood of occurrence, it can enormously increase the probability of all the components failing and hence the system failing. Even if the CCF probability were 1 in 1000, i.e., 1×10-3, the probability of all three components failing due to CCF would be 1×10-6
which is a factor of 1000 greater than the independent failure probability. This example is illustrative of the impacts of CCFs. Other specific CCF probabilities would produce other specific results, but the result would generally be larger than the independent probability of all the redundant components failing.
To include the CCF contribution in the fault tree, it must be separately modeled. For the three component redundancy example above, the fault tree structure could be as shown in Figure 5-3. alternately, the CCF contribution could be ORed with each individual component failure below the AND gate. This second approach is often more successful when modeling complex systems or when complex dependencies exist in a system.
TH REE COM PON EN TS FAIL
G0 0 1
TH REE COM PON EN TS FAIL IN DEPEN DEN TLY
G0 0 2
COM PON EN T 1 FAILS DU E TO IN DEPEN DEN T CAU SES
B 0 0 1
COM PON EN T 2 FAILS DU E TO IN DEPEN DEN T CAU SES
B 0 0 2
COM PON EN T 3 FAILS DU E TO IN DEPEN DEN T CAU SES
B 0 0 3
TH REE COM PON EN TS FAIL DU E TO CCF
G0 0 3
COM PON EN TS 1 , 2 , 3 FAIL FROM CCF
B 0 0 4
Figure 5-3. Fault Tree Representing Three Redundant Components with CCF Contribution.
In the actual fault tree, the identifiers of the components would be shown. What is important is that the CCF contribution is modeled as a separate contributor.
The same structure as above could be used for redundant trains of a system or redundant subsystems of a system. For example, instead of Component 1, 2, and 3, Train 1, 2, and 3 could be substituted. When the CCF at the train or subsystem level is modeled, it implies that the trains or subsystems are identical and that CCF data (e.g., the conditional CCF failure probability) is available at the train or subsystem level. If there is some doubt then CCF contributions should be modeled at the basic component level. A good rule of thumb is to include CCF contributions for any redundancy of identical, active components. If identical, redundant passive components are potentially important contributors then a CCF contribution can be included for these redundancies also. When in doubt, it is a good practice to model the CCF contribution in the fault tree. Sensitivity studies can be performed to determine the sensitivity of the top event probability to the CCF probability. If the top event probability is sensitive then more detailed analysis can be carried out.