58IEEE TRANSACTIONS ON RELIABILITY, VOL. 56, NO. 1, MARCH 2007Reliability Evaluation of Phased-Mission Systems With Imperfect Fault Coverage and Common-Cause FailuresLiudong Xing, Member, IEEEAbstract—This paper proposes efficient methods to assess the reliability of phased-mission systems (PMS) considering both imperfect fault coverage (IPC), and common-cause failures (CCF). The IPC introduces multimode failures that must be considered in the accurate reliability analysis of PMS. Another difficulty in analysis is to allow for multiple CCF that can affect different subsets of system components, and which can occur -dependently. Our methodology for resolving the above difficulties is to separate the consideration of both IPC and CCF from the combinatorics of the binary decision diagram-based solution, and adjust the input and output of the program to generate the reliability of PMS with IPC and CCF. According to the separation order, two equivalent approaches are developed. The applications and advantages of the approaches are illustrated through examples. PMS without IPC and/or CCF appear as special cases of the approaches. Index Terms—Binary decision diagram, common-cause failure, fault tree, imperfect fault coverage, phased-mission reliability.PMS-BDD RAN SA NotationA BDD-based PMS approach [2] Rendezvous And Navigation Solar Arraynumber of phases in the PMS set of all components in all phases of PMS number of CC in phase of PMS total number of CC in PMS, duration of phase of PMS an elementary CC occurring in phase . All CC in phase are indexed by subscript a CCE defined over CC, CCE space: a subset of containing all components that are affected by a group of phase components caused to fail by the same common cause a subset of containing all components in , plus all those components in all later of PMS phases a component in the PMS state indicator variable of in phase modified failure function of in phase used in PMS-BDD evaluation event: 1 or more components fail uncovered event: no component fails uncovered event: PMS fails given that occurs orAcronyms1 ACS BDD CC CCE CCF CCG CDSAttitude Control System Binary Decision Diagram Common Cause CC Event CC Failure CC Group Command and Data handling SystemGPMS-CPR A PMS approach considering IPC [1] HGA High-Gain Antenna if-then-else representation IPC ImPerfect fault Coverage IPCM IPC Model (Fig. 4) MBDD Multi-state BDD MDD Multiple-valued Decision Diagrams MOI Mars Orbit Insertion OS Orbiting Sample PMS Phased-Mission SystemManuscript received June 26, 2006; revised July 25, 2006; accepted August 3, 2006. Associate Editor: J. P. Kharoufeh. The author is with the Department of Electrical and Computer Engineering, University of Massachusetts, Dartmouth, MA 02747 USA (e-mail: lxing@). Digital Object Identifier 10.1109/TR.2006.8909001Theunreliability of PMS ignoring IPC Pr(transient restoration) in the IPCM Pr(permanent coverage) in the IPCM Pr(single point failure) in the IPCM unreliability of PMS unreliability of reduced PMS, i.e.,singular & plural of an acronym are always spelled the same. 0018-9529/$25.00 © 2007 IEEEXING: RELIABILITY EVALUATION OF PMS WITH IMPERFECT FAULT COVERAGE AND COMMON-CAUSE FAILURES59I. INTRODUCTION HE operation of missions encountered in aerospace, nuclear power, and many other applications often involves several different tasks or phases that must be accomplished in sequence. Systems used in these missions are usually called phased-mission systems (PMS). A classic example is an aircraft flight that involves take-off, ascent, level-flight, descent, and landing phases. During each mission phase, the system has to accomplish a specified task, and may be subject to different stresses as well as different dependability requirements. Thus, system configuration, success criteria, and component failure behavior may change from phase to phase [1]. This dynamic behavior usually requires a distinct model for each phase of the mission in the reliability analysis. Further complicating the analysis are -dependencies across the phases for a given component. For example, the state of a component at the beginning of a new phase is identical to its state at the end of the previous phase [2]. The consideration of these dynamics and dependencies poses unique challenges to existing analysis methods. Considerable research efforts have been expended in the reliability analysis of PMS; efficient combinatorial methods (see, e.g., [1]–[4]), state space oriented approaches based on Markov chains or/and Petri nets (see, e.g., [5]–[8]), as well as a modular solution based on binary decision diagrams (BDD) and Markov chains [9] have been developed. PMS, especially those devoted to safety-critical applications such as aerospace, and nuclear power, are typically designed with sufficient redundancies, and automatic recovery mechanisms to be tolerant of errors that may occur. However, the recovery mechanisms can fail, such that the system cannot adequately detect, locate, and recover from a fault occurring in the system. This uncovered fault can propagate through the system, and may lead to an overall system failure, despite the presence of sufficient redundancies. This phenomenon is known as imperfect fault coverage (IPC) [10]. The IPC introduces additional failure modes that must be considered for accurate reliability analysis of fault-tolerant PMS. Specifically, the analysis must allow two failure modes including covered failure, and uncovered failure, as well as an operation mode, rather than the traditional binary designation of failure and operation. At this point, it is relevant to mention that recently more attention has been focused on the study of multi-state systems in which both the system, and its components exhibit multiple performance levels varying from perfect operation to complete failure [11], [12]. Systems with multimode failures (for example, caused by the IPC as described above) are also widely referred to as multi-state systems [13]. Various approaches have been proposed for the analysis of multi-state systems; examples include the universal moment generating function-based methods [14], [15], and the BDD-based method [1], [13], [16]. Xing & Dugan also proposed efficient approaches based on multi-state BDD (MBDD) [17], and multiple-valued decision diagrams (MDD) [18] to the reliability analysis of PMS with multimode failures. It is interesting as future research to study the general multi-state PMS with multiple performance levels using MBDD or MDD methods. The analysis becomes even more complicated when considering components can be subject to common-cause failures (CCF) during any phase of the mission. CCF are multiple dependent component failures within a system that are a directTresult of a common cause (CC) [19], such as extreme environmental conditions, or human errors. It has been shown by many studies that the presence of CCF tends to increase a system’s joint failure probabilities, and thus contributes significantly to the overall unreliability of the system subject to CCF [19]. Therefore, it is crucial that CCF be modeled & analysed appropriately. Considerable research efforts have been expended in the study of CCF for the system reliability analysis; refer to [20] for a discussion of various approaches, their contributions, and their limitations concerning the analysis of non-PMS. We find many of the same limitations in the CCF models developed for the reliability analysis of PMS in the literature; for example, the method presented in [21] allows at most one CC to affect a component, and CCF to exist only among -identical components. In this paper, we seek to address the limitations of existing CCF models by using a more general CCF model which allows for multiple CC that can affect different subsets of system components, and which can occur -dependently. Because failure to consider either IPC or CCF results in overestimated system reliability, it is significant to incorporate both IPC, and CCF into the system reliability analysis. A great deal of work has been done to separately study IPC (see, e.g., [1], [10], [17], [22], [23]), and CCF (see, e.g., [19], [21], [24]–[27]). To the best of our knowledge, little work ([8], [29]) considered both IPC, and CCF in solving reliability problems for non-PMS. Moreover the existing work [28], [29] shares a restricted assumption that a single elementary CC affects all the system components. In this paper, we relax this restriction by employing our general CCF model described in Section II-B. And we present efficient, separable BDD-based approaches for analyzing the reliability of PMS with both IPC, and CCF. The remainder of the paper is organized as follows. Section II presents an overview of the problem to be solved, as well as assumptions. Section III depicts an illustrative example PMS subject to IPC, and CCF. Section IV presents a separable approach to the reliability analysis of PMS with both IPC, and CCF. Section V illustrates the approach through the step-by-step analysis of the example PMS. Section VI presents an alternative approach, and a proof of the equivalence of the two approaches. In the last section, we present our conclusions, as well as directions for future work. II. PROBLEM STATEMENT This paper considers the problem of evaluating the reliability of fault-tolerant PMS subject to both IPC, and CCF. To help make tangible the type of systems for which the proposed approaches are meant as well as the analytical challenges we address in this paper, we present an example of PMS subject to IPC, and CCF (adapted from [20]). Fig. 1 shows the high-level fault tree model of a proposed Mars orbiter mission system, which involves Launch, Cruise, Mars Orbit Insertion (MOI), Commissioning, and Orbit phases. Each mission phase is characterized by at least one major event in which the mission failure can occur. Examples of failure events for this example include: • the launch event during the launch phase; • the deployment of the solar arrays (SA) & high-gain antennas (HGA), and the configuration of the heaters after launch which occur during the cruise phase;60IEEE TRANSACTIONS ON RELIABILITY, VOL. 56, NO. 1, MARCH 2007Fig. 1. High-level fault tree model of the Mars orbiter mission system; the triangles are transfer gates to the fault tree for Subsystem F.Fig. 2. Fault tree model of Subsystem F.• the propulsive capture into Mars’ orbit during the MOI phase; and • the release of an orbiting sample (OS), and the inclusion of a rendezvous and navigation (RAN) platform on the orbiter which might induce additional failure modes during orbit [20]. As shown in Fig. 2, Subsystem F of Fig. 1 is decomposed into the Telecom, Power, Propulsion, Command and Data handling System (CDS), Attitude Control System (ACS), and Thermal subsystems. Subsystem F has the same configuration for each mission phase. As described in [20], these subsystems are subject to CCF from two CC: a micrometeoroid attack that can result in the failure of the entire system, and a solar flare which fails the subsystem’s electronics, most notably the CDS in all pre-MOI phases. The subsystems can also be subject to IPC. Consider the fault tree model of the CDS system in Fig. 3; it includes a hot standby system that consists of two -identical subsystems: Side-A, and Side-B. For example, the Side-A is the primary subsystem, and Side-B is the standby subsystem that is automatically switched on upon failure of the primary subsystem Side-A. Under ideal circumstances, the CDS system functions correctly as long as one of the two subsystems, and other components as indicated in Fig. 3, operate correctly. However, in reality, the failure of the primary subsystem Side-A must be detected, and appropriately handled before the standby subsystem Side-B can be used. In other words, an uncovered fault of any component in the subsystem Side-A may lead to the failure of the CDS system, and thus the failure of the entire mission, despite the presence of adequate redundancies (i.e., the subsystem Side-B).Fig. 3. Fault tree model of CDS.As described in the Introduction, the reliability analysis of PMS subject to IPC, and CCF, like the Mars orbiter system, requires the consideration of dynamics & dependencies across different phases including the multiple failure modes introduced by IPC, as well as the multiple dependent component failures caused by CCF. All of them pose a big challenge to the existing analysis methods. In this paper, we propose two equivalent separable approaches to the reliability analysis of PMS with both IPC & CCF as one way to meet the above challenge in an efficient, elegant manner. PMS without IPC and/or CCF will appear as special cases of our methods. The assumptions, and inputs for the problem are listed in the following subsections. A. General Assumptions on PMS 1) Component failures are -independent within each phase. Dependencies arise among different phases, and failure modes. 2) For at least one component, an uncovered fault causes the overall system failure, even in the presence of fault-tolerant mechanisms. 3) Conditional fault occurrence probability for each component for each phase is given either as a fixed probabilityXING: RELIABILITY EVALUATION OF PMS WITH IMPERFECT FAULT COVERAGE AND COMMON-CAUSE FAILURES61Fig. 4. General structure of the IPCM for a component.4) 5)6)7)8)for a specified mission time, or in terms of a lifetime distribution. Phase durations are deterministic. The system fails to achieve the mission if it fails during any one phase. That is, phase-OR requirements are assumed for this paper. Thus, the reliability of a PMS is the probability that the mission successfully achieves its objectives in all phases. The system is not maintained during the mission; once a component transfers from the operation mode to a failure mode (covered or uncovered), it will remain in that failure mode for the rest of the mission time. The system is coherent, which means that each component contributes to the system state, and the system state worsens (at lease does not improve) with an increasing number of component failures [30]. The IPC behavior is described using Dugan et al.’s imperfect coverage model (IPCM) [10]. Within the context of the quantitative reliability analysis, it is required only to refer to the 3 exit probabilities, also known as coverage factors: , , and , where . Each of them is a conditional probability conditioned on a fault occurring to a component, as defined in Fig. 4.Fig. 5. System configuration for the example PMS in the fault tree model.to the same elementary common-cause common-cause group .constitute aB. CCF Model for PMS 1) PMS can be subject to CCF due to different elementary CC occurring within a phase or in different phases. In general, we express the elementary CC existing in a PMS as (Phase 1); (Phase 2); ; (Phase ). denotes the number of elementary CC involved in phase . is the total number of phases in the PMS; thus is the total number of CC to which the PMS is subject. 2) CC are external to the system. Note that the failure of a component within the system may cause simultaneous failure of multiple other components within the system. Such CCF due to internal CC can be dealt with by the functional dependency gate in the dynamic fault trees approach [10]. 3) Different CC, whether from the same phase or from different phases, can be mutually exclusive, -independent, or -dependent. 4) A component may be affected by multiple CC, that is, one single component can belong to more than one common-cause group (CCG). All components that fail dueC. Problem Inputs The following lists all the required input parameters for solving the problem. 1) Mission time. 2) Number of phases: . 3) Duration of each phase : . 4) Failure criteria for each phase, described using the fault tree model. 5) Failure parameters for each component in phase , which are conditioned on the success of in the previous phase (refer to assumption 3 in Section II-A). 6) Fault coverage factors ( , , ) for each component in each phase. 7) Statistical relationship between elementary CC: -independent, -dependent, or mutually exclusive. 8) Occurrence probabilities of elementary CC or conditional occurrence probabilities of CC in case of two CC being -dependent. We recognize that analytical results are strongly influenced by the input parameters, therefore realistic estimates of them are crucial. Fault injection (see, e.g., [31], [32]) is a commonly used technique for estimating values of component failure parameters, and fault coverage factors. The occurrence probabilities of CC, and their statistical relationship may be obtained from available data sources [24], [25]; for example, research into estimating parametric values using failure event data was presented in [26], [27]. In this paper, we consider the above listed parameters as given input parameters of the problem. Follow-up research will include investigation of the sensitivity of results to changes in the input parameter values. III. AN ILLUSTRATIVE EXAMPLE To illustrate the applications & advantages of the proposed approaches, and to perform comparative study with and without IPC/CCF, we consider an example PMS adapted from [1]. As shown in the system fault tree model (Fig. 5), the system consists of 4 types of components that are used in different system configurations over 3 consecutive phases: 1) , : needed for all phases; one of them must be functional during all the three : only needed for Phase 1, and Phase 2; it must phases. 2)62IEEE TRANSACTIONS ON RELIABILITY, VOL. 56, NO. 1, MARCH 2007TABLE I INPUT PARAMETERS FOR THE EXAMPLE PMS ( , ARE ALL IN THE COVERAGE FACTOR IS 0 FOR ALL COMPONENTS IN ALL PHASES, ) AND CAN BE OBTAINED USING;. This hypothetical scenario about CCF in the example PMS is general, breaking the assumptions or restrictions usually found in the literature, which include each component belonging to at most one CCG, CC affecting -identical components only, and all CC occurring -independently. IV. ANALYSIS OF PMS WITH IPC AND CCF To analyse the reliability of a PMS with both IPC and CCF, we propose to decompose the original problem into a number of reduced PMS reliability problems that are freed from the concern about CCF. And then we separate the IPC from the combinatorics of the solution to each reduced problem based on the simple, efficient algorithm in [1], [22]. After the above two-step separation process, the set of reduced reliability problems does not have to consider both IPC, and CCF. Thus, existing PMS reliability analysis approaches that ignore both IPC and CCF, such as the PMS-BDD method [1], [2], can be directly applied to solve these reduced problems. Finally, results of all the reduced problems are integrated to obtain the entire phased-mission reliability considering both IPC, and CCF. In the following subsections, we present the details of these four steps: separating CCF, separating IPC, solving reduced problems using the PMS-BDD, and aggregating for final results. We summarize the whole approach at the end of this section. A. Step 1: Separating CCF Our methodology for incorporating CCF into the phased-mission analysis is to decompose a reliability problem with CCF into a number of reduced reliability problems based on the Total Probability Theorem [33]. The set of reduced problems need not consider CCF because the effects of CCF have been factored out. Finally, results of all the reduced reliability problems are aggregated to obtain the reliability measure considering CCF. Specifically, according to the general CCF model described in Section II-B, there exist totally elementary CC in a PMS. The CC partition the event space into the following disjoint subsets, each called a common-cause event (CCE):be functional during these two phases. 3) , : work during Phase 1, and Phase 3; both of them must be functional during Phase 1, and at least one of them must be functional during , , : work during Phase 2, and Phase 3; all of Phase 3. 4) them must be functional during Phase 2, and at least two of them must be functional during Phase 3. Note that some components may not be explicitly used in some phase, although they can still fail & contribute to the system failure. For example, component may suffer an uncovered failure in Phase 3, and thus contribute to the system failure even though its covered failure in Phase 3 does not affect the entire system operation. The failure parameter of each component for the duration of a phase is given as a fixed probability ; or in terms of an exponential distribution with a constant failure rate ; or in terms of a Weibull distribution defined with a scale parameter , and . The coverage factors of each compoa shape parameter nent are given as fixed probabilities. To perform comparative study with and without the consideration of IPC/CCF, we use the same values for the input parameters (including failure parameters, coverage factors, and phase durations) as in [1] (also see Table I). To demonstrate the effects of CCF on the reliability analysis of this example PMS, we propose that the system is sub) ject to CCF from three CC: hurricanes (denoted by during Phase 2, during Phase 1, lightning strikes during Phase 3. A hurricane of sufficient and floods intensity in Phase 1 would cause components and to fail, that is, , where is the in Phase 1, and state indicator variable of component denotes the failure of in Phase 1; serious lightning strikes in Phase 2 would cause , , and to fail, that ; serious flooding in Phase 3 is, to fail, that is, . would cause , and We use the following probabilities in our example (they could be extracted from available weather information; see Section II-C). The probability of a hurricane occurring in Phase 1 ; the probability of a lightning strike occurring is ; the floods often occur in conin Phase 2 is junction with hurricanes, and the -dependency between these two CC can be defined by a set of conditional probabilities conditioned on the state of hurricanes in Phase 1 (occurred or not occurred). The probability that floods occur in Phase 3 conditioned on the occurrence of hurricanes in Phase 1 is denoted ; similarly, by , , andWe build a space called "CCE space" over this set of collectively exhaustive, and mutually exclusive events that can occur . in the PMS, that is, denote the occurrence probability of ; Let , and , then we have . Based on the above CCE space, and the Total Probability Theorem, the unreliability of a PMS with IPC and CCF can be evaluated as(1)XING: RELIABILITY EVALUATION OF PMS WITH IMPERFECT FAULT COVERAGE AND COMMON-CAUSE FAILURES63As we will show through the analysis of an example in Seccan be obtained based on the relationship tion V, between the elementary CC, and the occurrence probabilities of in (1) is a conCC, which are given as input parameters. ditional probability that the PMS fails conditioned on the occur. The evaluation of is actually a reduced rence of reliability problem in which the set of components affected by (represented by ) does not appear. Specifically, in the system fault tree model, each basic event (denoting the will be replaced failure of a component) that appears in by a constant logic value ‘1’ (True). After the replacement, a Boolean reduction can be applied to the PMS fault tree to generate a simpler fault tree in which all the components in do not appear. Most importantly, the evaluation of the reduced fault tree can proceed without further consideration of CCF. Thereby, the overall solution complexity is reduced. In the following subsection, we present an efficient approach for further separating the effects of IPC from the combinatorics in (1). of the solution to each reduced problem B. Step 2: Separating IPC Xing & Dugan [1] proposed a BDD-based algorithm called GPMS-CPR for incorporating the IPC into the analysis of PMS without CCF. The methodology is to separate all component uncovered failures from the combinatorics of the solution based on the simple, efficient algorithm in [1], [22]. We apply this in (1). method to the evaluation of each (1 Consider two mutually exclusive & complete events: (no or more components in the PMS fail uncovered), and component in the PMS experiences an uncovered failure). According to the Total Probability Theorem, for event (meaning ), we haveFig. 6. A PMS BDD branch used in the recursive algorithm.in different must consider the uncovevaluation of ered failures of all components in the system, including those , and thus being removed from the problem affected by . This is due to the fact that an uncovered failure leads to the overall mission failure, even in the presence of adequate are calculated by the same redundancies. Therefore, all the (3). or in (2) is the unreliability of the corresponding perfect coverage system ignoring both IPC, and CCF; . that is, It should be evaluated given that no component experiences an uncovered failure, and that all components from are eliminated. Therefore, before calculating , we need to modify the failure function of each component in each phase to a conditional failure probability , conditioned on there being no uncovered failure during the mission using (13) in [1]. Using these modified component failure functions, we using any approach that ignores both IPC, can calculate and CCF. In this research, we use an efficient approach called , and we brief the basics of PMS-BDD [2] for solving PMS-BDD in the next subsection. C. Step 3: Solving Reduced Problems Using PMS-BDD(2) Because an uncovered failure leads to the overall system failure even in the presence of fault-tolerant mechanisms, the conditional probability in (2) simply equals 1. To which is defined as , and which is calculate defined as in (2), we need to use (9)–(12) in [1] to find the occurrence probabilities of three mutually exclusive before the end of & complete events for each component ( has not failed before the end of phase each phase : ), ( has failed covered before the end of phase ), and ( has failed uncovered before the end of phase ). Let denote the set of all components in PMS, and be the number can be calculated as of phases; then(3) where is the probability that fails uncovered during the mission, and can be calculated using (9) in [1]. Note that theReference [2] presented a five-step algorithm based on BDD for the reliability analysis of PMS without IPC and CCF. The algorithm uses phase algebra [4] to combine each single phase BDD to obtain a final PMS BDD. The PMS unreliability can be obtained through a recursive evaluation of the final PMS BDD. For the 1-edge or 0-edge linking variables of different components, the evaluation method is the same as the ordinary BDD. But for the 1-edge linking variables of the same component, a special treatment is needed due to -dependence between , ( , are phases, and ): , , and and . The following gives the summary of the recursive algorithm for calculating the unreliability from the final PMS BDD. Consider a PMS BDD branch in Fig. 6, the if-then-else [2] representation of the figure is , and . The 1-edge of each node (representing a component in the PMS) is associated with the failure function of the component; the 0-edge is associated with the operation function of the component. The unreliability concerning the sub-PMS BDD can be evaluated using the following recursive algorithm: • If , belong to the same component, then .64IEEE TRANSACTIONS ON RELIABILITY, VOL. 56, NO. 1, MARCH 2007Fig. 7. First separate CCF, and then IPC.belong to different components, then . is the unreliability with respect to the current where sub-PMS BDD. Let be the root node of the entire PMS BDD, is the unreliability of the entire PMS. is the then failure function of component . Note that as discussed in ((13) in [1]) must be Section IV-B, to consider IPC, used for computing . The exit condition of this recursive algorithm is , then . • If , then . • If The nature of the BDD ensures that an automatic cancellation of components from earlier phases can be done without additional operations [2]. Thus, there is a considerable reduction in computing and storage requirements over the earlier approaches like the EZ approach [3], and Markov-chain based approaches (see, e.g., [6]) for the PMS analysis. Therefore, we select this in (2) in this research. PMS-BDD algorithm for computing D. Step 4: Aggregating for Final Results After obtaining all the in (2) using the PMS-BDD apwith using (2) proach, we integrate the result of each . And then we aggregate the results of to obtain each with using (1) to obtain the final unreliability of PMS subject to both IPC, and CCF. E. Approach Summary The approach first separates CCF, and then IPC, as summarized in (4). Fig. 7 shows a conceptual overview of the separable approach for analyzing the unreliability of PMS with both IPC, and CCF presented in the preceding subsections.• If,can be implemented in constant time. After the separation of IPC, and CCF from the solution combinatorics, we obtain reduced reliability problems, each of which can be solved using the PMS-BDD method. It has been shown that, in most cases, the BDD-based methods require less memory, and are more efficient in reliability evaluation than other traditional methods [1], [2], [10], [13], [23]. Refer to [34] for the computational & storage complexity analysis of an efficient implementation of the BDD method. Also, given the fact that CCF rarely occur of (i.e., systems are usually subject to a very small number elementary CC), and considering the parallel processing capability of modern computing systems, even though there are reduced problems involved in our approach, the overall solution complexity is still low. In addition, as we will show through the example in Section V, most PMS fault trees after the reduction (i.e., the reduced problems) are trivial to solve. Another advantage offered by our approach is that it allows reliability engineers to use their favorite software package that ignores both IPC, and CCF for computing PMS reliability, and adjust the input, and output of the program to produce the PMS reliability considering both IPC, and CCF. Based on this proposed approach, we present a concrete step by step analysis of the example PMS (Section III) in the next section. V. EXAMPLE ANALYSIS AND RESULTS We present the analysis of the example PMS with both IPC, and CCF (Section III) step by step in the following subsections. A. Step 1: Separating CCF According to the decomposition & aggregation approach to considering CCF (Section IV-A), we first build a CCE space for the example PMS. Because there are 3 elementary common (hurricanes), (lightning strikes), and causes, (floods), the CCE space is composed of CCE, that is, . Each is a distinct, disjoint combination of elementary CC, as defined in the first column of Table II. is the set of As briefly defined in Section IV-A, components that are the only ones affected by the event . In other words, the occurrence of leads to(4) As described in Sections IV-A, and IV-B, the two-step separation process for considering IPC, and CCF is simple, and。
