阐述基于模糊可靠性故障树分析的优势

基于模糊故障树的配电网可靠性分析摘要：针对传统蒙特洛仿真方法在配电系统可靠性评估中存在的缺陷，提出模糊故障树的配电网可靠性算法。

建立数学模型对某配电网进行评估，确认算法的有效性。

关健词：配电网电力系统可靠性配电系统一般来说在电力系统中处于最末端，直接与用户联系，主要包含配电站、馈电线路、断路器、隔离开关等设备，因此配电系统的可靠性评估不仅关系到配网规划的优劣对比而且关系到电力系统的供电能力和电能质量。

随着大量分布式发电技术使用和特殊用户的接入系统，新型的供电方式加入到电力系统日益广泛。

各种类型的分布式电源和非线性大量接入配电网，使得配电系统结构发生了巨大的改变，对配电系统的运行产生了重大影响。

应用模糊故障树数学方法建立由大量不确定因素组成的结构层次清晰明了的配电系网具有直观表达的优势，通过计算配电系统可靠性指标，从而对配电系统进行整体综合评价。

1 配电系统可靠性指标1.1 系统平均停电频率指标每个由配电系统供电的使用用户在单位时间内的平均停电次数，以用户的停电次数与系统所供电的总用户数之比来表示，即：式中，λi为负荷点的故障率；Ni为负荷点的用户。

1.2 系统平均供电可用率指标1年内使用用户不停电的时间总数与使用用户需求供电的时间总数之比，即：式中，μi为用户负荷点的年平均停电时间。

1.3 系统平均停电持续时间指标每个由配电系统供电的使用用户在1年内的平均停电持续时间为：1.4 用户平均停电持续时间指标1年内被停电使用用户的平均停电持续时间为：1.5 总电量不足配电系统在1年中因停电而造成的使用用户总电量损失为：式中，Li为连接在每个负荷点上的平均负荷；Fi为负荷系数。

2 影响配电网可靠性因素2.1 内部因素（1）线路:线路因素包含线路非全相运行、倒杆、瓷瓶闪络、线路接地、单相或多相、短路。

（2）配变：配电变压器主要故障主要有铁芯局部短路或烧毁，变压器绝缘损坏；配变套管对地击穿或放电；变压器分接开关触头放电或灼伤；变压器线圈间短路、对地击穿放电、断线。

International Journal of Emerging Electric Power Systems Volume9,Issue42008Article1Application of Fuzzy Fault-Tree Analysis to Assess the Reliability of a Protection Systemfor a SwitchyardYing-Yi Hong∗Lun-Hui Lee†Heng-Hsing Cheng‡∗Chung Yuan Christian University,yyhong@.tw†Chung Yuan Christian University,lhlee@.tw‡Chung Yuan Christian University,xingxing@Copyright c 2008The Berkeley Electronic Press.All rights reserved.Application of Fuzzy Fault-Tree Analysis to Assess the Reliability of a Protection Systemfor a Switchyard∗Ying-Yi Hong,Lun-Hui Lee,and Heng-Hsing ChengAbstractThis paper proposed a method for reliability assessment of the protection system for a switch-yard by fault-tree analysis considering uncertainty of unavailability for an element.Unavailability of an element with uncertainty is expressed with the fuzzy set.The fault-tree analysis incorpo-rated with the fuzzy set is employed to conduct the reliability assessment.The importance of elements influencing reliability can be achieved by the Fuzzy Importance pared with traditional methods,the fault-tree analysis requires less computation.In this paper,a345 kV switchyard in the3rd nuclear power plant in Taiwan serves as an example for illustrating the results of the proposed method.KEYWORDS:reliability,protection system,switchyard,fault-tree analysis,fuzzy set theory∗This work is sponsored by the National Science Council(Taiwan)under the grant96-2221-E-033-069-MY2.I. I NTRODUCTIONReliability assessment is important for both operation and planning in the power system [1]. A protection system for the switchyard will be activated if a bus or transmission line is faulted. The protection system will enable breakers to trip in order to retain the remaining power system in a normal condition. Therefore, reliability of the protection system for the switchyard is very important.There are many methods for reliability assessment such as fault-tree (FT) analysis, reliability block diagrams (RBD), Markov modeling (MM) and Monte Carlo (MC) method, and so on [2, 3]. An FT is a logic diagram that shows potential events affecting system performance and the relationship between potential events. For a complicated system, the ultimate (top) event can be decomposed into different fault events. The structure of a FT is just like a tree that is built from top to bottom [4]. The RBD is similar to the FT analysis. Blocks can be connected through sets of series and parallel connections in order to accurately present a system. The reliability, obtained by the RBD, is required to be assessed again when the structure of a system is changed. The state-space based MM is different from others described previously in that it is a dynamic approach [5]. For the MM, more calculation time is required for a large system because a more complicated state transition matrix needs to be solved. Calculation for the MM method becomes complicated and dimension of the matrix becomes very large when the number of the system components increases. The MC method doesn’t need any mathematical models, just using random variables to simulate the random process [6]. The MC simulation can be divided into two types: One is sequential simulation and the other is non-sequential simulation. Each method described above has its advantages and defects. Compared with the others, the MC method and MM require more computation time.Compared with the others, the FT analysis is an analytical technique and requires less computation time. Once the system structure is changed, one needs to re-evaluate reliability of the altered part of the system using FT analysis. The FT analysis was developed in 1961 by H.A. Watson, who worked in the Bell Telephone Laboratories [7]. It is commonly used to predict reliability of the complicated system in many fields, such as nuclear plants, chemical works, pipelines, control systems, and power systems [8]-[10]. In the area of the power engineering, the FT analysis was used to perform the reliability assessment of electric elements, transmission system [11], supervisory control and data acquisition (SCADA) [12], special protection system [13], communication system in the distribution automation [14, 15], and substation control system [16].For the reliability assessment of protection system, Kjolle et al. provides a comparative review [17]. Meeuwsen presented the influence of protection system failures and preventive maintenance on protection systems using Markov models 1Hong et al.: Fuzzy Fault-Tree Analysis to Assess Reliability of Protection SystemPublished by The Berkeley Electronic Press, 2008in distribution systems [18]. Wang and Thorp proposed a method to determine optimal locations for protection system enhancement [19]. A random search algorithm based on power system heuristics was given for fast rare-event simulation of consecutive relaying malfunctions in bulk power systems [19]. A nonsequential Monte Carlo simulation approach was used to implement the stochastic properties of contingencies, protective response and protection system failures by Yu and Singh [20]. Moreover, the mechanism and scheme of protection system were analyzed on their contribution to the cascading outages after a fault occurs [21].Measurement and statistic will cover uncertainties in many engineering problems. When using the FT analysis, the unavailability, which includes uncertainty, of an element will be employed to assess unavailability of the whole system. In this paper, fuzzy set theory is used for expressing the uncertainty in the FT. More specifically, the unavailability is considered as a fuzzy set and is in terms of a triangular membership function.This paper uses the FT analysis with uncertainty to assess the reliability of a protection system for a switchyard. Not only the reliability of subsystems and system can be attained, but also the measures of importance of fault events can be attained.The problem will be described in Sec. II. Then the fuzzy set and the FT analysis will be introduced in Sec. III. Studied results of the protection system of a 345kV switchyard serving as an example will be provided in Sec. IV. Conclusions will be given in Sec. V.II. P ROBLEM D ESCRIPTIONA 345kV switchyard in the 3rd nuclear power plant in Taiwan serves as an example in this paper. The 345kV switchyard is composed of a 1-1/2 buses structure, which connects two generators and four 345kV transmission lines. The diagram of the switchyard is shown in Figure 1.Figure 1 Switchyard Structure DAPENG #1DAPENG #2DAPENG #3LONGQI 2International Journal of Emerging Electric Power Systems, Vol. 9 [2008], Iss. 4, Art. 1/ijeeps/vol9/iss4/art1The switchyard has 11 SF 6 breakers named from BR01 through BR11. There are five functions in the protection system in order to protect generator, bus and transmission line. If any fault happens, the protection system will be active and enable the breakers to trip. The five functions are (i) bus protection, (ii) transmission line protection, (iii) breaker failure protection, (iv) generator backup protection and (v) remote trip protection. This paper uses the FT analysis to assess the reliability of this protection system incorporating these 5 functions. The mathematical background is provided first below.III. M ATHEMATICAL B ACKGROUND3.1 Fuzzy SetThe unavailability of an element actually should be updated regularly according to the operation conditions. However, reliability study is a planning issue for a long-term consideration. Hence, the unavailability of the element becomes uncertain. The uncertainty is treated as the fuzzy set. The triangular membership function in the fuzzy set is used to express each relevant parameter in this paper. That is,μA (x 2) = 1 and μA (x 1) = μA (x 3) = 0whereμA (x ) = the membership function of fuzzy set Ax 1 = the lower bound of xx 2 = the x with membership value of onex 3 = the upper bound of xIn this paper, the α-cut (level) is used for representing the fuzzified degree. A fuzzy set with an α-cut means that a smaller x domain with respect to the membership values higher than α is considered. For triangular fuzzy sets, fuzzy arithmetic operations are equivalent to the corresponding interval arithmetic operations for each α-cut [22]. A fuzzy set with the α-cut can be represented mathematically as:()],[21ααααa a A x A == (1)where a 1 and a 2 represent the lower and upper limits (with membership value of α) of x , respectively.3Hong et al.: Fuzzy Fault-Tree Analysis to Assess Reliability of Protection SystemPublished by The Berkeley Electronic Press, 2008For the basic arithmetic operations, Eqs. (2) and (3) can be attained:],[2211ααααααb a b a B A ++=+ (2)],[2211ααααααb a b a B A ××=× (3)3.2 Fault Tree AnalysisThe protection system of a switchyard is composed of many different elements. In this paper, the most commonly used probabilistic model for the element, i.e., the conventional two-state model, will be used.The FT analysis is a logic and diagrammatic method for assessing reliability of a system. The critical elements affecting the reliability should also be identified first. In this paper, failure of a protection system is called as a top event ; failure of a function (defined in Sec. 2) is named as a sub-top event and failure of an element is called a fault event .Any FT consists of a finite number of minimum cut sets (MCSs), which are unique for the (sub-) top event [7]. In other words, a (sub-) top event includes finite MCSs. The (sub-) top event can be written in the general form as follows:(Sub-)TOP Event (4)∑==ki i MCS 1whereMCS i = the i-th minimum cut set.k = the number of minimum cut sets.3.3 Measures of ImportanceOne significant quantity in the reliability assessment is the so called “measures of importance” [22]. It provides the “influence measure” of a fault event (element) to the top event. The measures of importance can be regarded as the sensitivity of a fault event with respect to the top event. A larger measure of importance indicates the corresponding fault event is more important compared to other events. The measures of importance in an uncertain environment considering the fuzzy unavailability can be achieved by Fuzzy Importance Measure (FIM) [23].Let Top_event =f (U 1, U 2, …, U i-1, U i , U i+1, …, U n ) be the unavailability of the top event. The symbol U i is the unavailability for the i-th element. If the i-th element is fully unavailable, then the unavailability of the top event becomes()n i i Ui U U U U U f event Top ,, ,1 ,,,_11211L L +−== (5)4International Journal of Emerging Electric Power Systems, Vol. 9 [2008], Iss. 4, Art. 1/ijeeps/vol9/iss4/art1If the i-th element is fully available, then the unavailability of the top event becomes()n i i Ui U U U U U f event Top ,, ,0 ,,,_11210L L +−== (6)Then[]01_,_===Ui Ui i event Top event Top ED FIM (7)whereFIM i = index of FIM for element iED = Euclidean distance between two fuzzy setsMore specifically, let ED[A,B] be the Euclidean distance between two fuzzy setsA and B. ED[A, B] is defined as follows:[]()()5.010222211,∑=⎥⎦⎤⎢⎣⎡−+−=αααααααb a b a B A ED (8)where and are defined in Equation (1).,1αa ,2αa α1b α2bIV . C ASE S TUDY - R ESULTS AND D ISCUSSIONS4.1 Overall FT TreeFailure of the 345kV switchyard, as shown in Figure 1, is considered as the top event in this paper. Any failure of the 5 protection functions (defined in Sec. 2) will lead to the top event. Failure of the whole protection system (top event) is made up of the failure of the five functions (the sub-top events defined in Sec.3.2). The relationship between the top event and 5 sub-top events is shown in Figure 2.5Hong et al.: Fuzzy Fault-Tree Analysis to Assess Reliability of Protection SystemPublished by The Berkeley Electronic Press, 2008In the protection system, the elements, influencing the top event, include breaker, relay, DC power for control and communication, etc. The fuzzy unavailability (x 2, the x with membership value of one, defined in Sec. 3.1) for each fault event is provided in Table I [11, 24]. The upper and lower bounds of x are the deviation of ±30% from x 2, respectively.T ABLE I U NA V AILABILITIES OF E LEMENTSElements No. Fault event Unavailability x 2Breaker 1 SF 6 circuit breaker 150×10-6Relay 2 Relay 87 fault 100×10-6 3 Relay 50BF fault 100×10-6 4 Relay 86BF fault 100×10-6 5Relay 50 fault 100×10-6 6Relay 21 fault 100×10-6 7Relay 2 fault 100×10-6 8Relay 87 malfunction 100×10-6 9Relay 50BF malfunction 100×10-6 10Relay 86BF malfunction 100×10-6 11Relay 50 malfunction 100×10-6 12Relay 21 malfunction 100×10-6 13Relay 2 malfunction 100×10-6 Digitalrelay 14 Digital relay fault200×10-6 15 Digital relay malfunction 100×10-6 DC power 16 DC power50×10-6 Optical fiber 17 Optical fiber equipment fault10×10-6 18 Optical fiber communication fault 100×10-6 Microwave 19Microwave equipment fault 200×10-620 Microwave communication fault 100×10-66International Journal of Emerging Electric Power Systems, Vol. 9 [2008], Iss. 4, Art. 1/ijeeps/vol9/iss4/art14.2 Five Sub-top EventsThe function of bus protection is designed for protecting bus 1 and bus 2. Figure 3 illustrates the FT for the bus protection. In the viewpoint of this function alone, the sub-top event is the bus protection failure. If a bus has an abnormal condition, it should be isolated (2nd layer in Figure 3). The bus isolation is achieved by breakers (BR01, BR04, BR07 and BR10 for bus 1) and isolation action (3rd layer in Figure 3). The isolation action consists of the main protection and backup protection (4th layer in Figure 3). Both main protection and backup protection require differential relays (items 2 and 8 defined in Table I) and DC power (item 16 defined in Table I). Hence, any failure of differential relays or DC power will result in the main/backup protection failure. If both main and backup protections fail, then the isolation action fails. Furthermore, if any breaker or isolation action fails, the bus isolation will fail. Bus isolation failure for either bus 1 or 2 will lead to the bus protection failure.A FT of the transmission line protection is illustrated in Figure 4. When only this function is considered, the sub-top event is transmission line protection failure. Each transmission line has the same protective function including phase protection or grounding protection incorporating with breakers. Each transmission line has its own dedicated breakers (BR10 and BR11 for DAPENG #1, BR09 and BR08 for DAPENG #2, BR06 and BR05 for DAPENG #3, BR03 and BR02 for LONGQI). The line protection failure may result from phase protection, grounding protection or breaker failures. Two protective equipments and communications perform the protective function.The FT of the breaker failure protection is depicted in Figure 5. If only this function is considered, the failure of the breaker failure protection is defined as the sub-top event. There are 11 SF 6 breakers, each of which has a protective function, in the switchyard. Figure 6 is the diagrammatic FT for the generator backup protection. The generator backup protection failure is the sub-top event in this case. If MW generation cannot be transferred into buses, the protection function will isolate the generators to keep them safe. Moreover, the remote tripping is conducted using two breakers and communications, as shown in Figure7. Failure of the remote trip protection is the sub-top event for this function. Each transmission line has its remote trip protection.7Hong et al.: Fuzzy Fault-Tree Analysis to Assess Reliability of Protection SystemPublished by The Berkeley Electronic Press, 2008Figure 3 Fault-tree of Bus Protection8International Journal of Emerging Electric Power Systems, Vol. 9 [2008], Iss. 4, Art. 1/ijeeps/vol9/iss4/art1Figure 4 Fault-tree of Transmission Line Protection9Published by The Berkeley Electronic Press, 2008Figure 5 Fault-tree of Breaker Failure Protection10/ijeeps/vol9/iss4/art1Figure 6 Fault-tree of Generator Backup Protection Published by The Berkeley Electronic Press, 200811Figure 7 Fault-tree of Remote Trip Protection4.3 Reliability of Protection SystemAfter the above sub-FTs are constructed, all sub-FTs are transferred into MCSs by Boolean operations. The unavailabilities of fault events shown in Table I are used for the MCSs in order to calculate fuzzy unavailability of each sub-top event. Table II illustrates the reliabilities of the top event and each sub-top event. The reliability is in terms of fuzzy unavailability which provides a possible range with membership. The strongest function with the smallest unavailability and the weakest function with the largest unavailability are the remote trip protection and the breaker failure protection, respectively. The corresponding failure rates and annual downtimes, transformed from x2 (see appendix), are also shown in the 5th and 6th columns of Table II./ijeeps/vol9/iss4/art1124.4 Fuzzy Importance MeasureThe FIM of fault events is calculated by Eq. (7). For example, Table III shows the FIMs of the bus protection. The elements (16, 2 and 8) in Figure 3 denote DC power, relay 87 fault and relay 87 malfunction, defined in Table I, respectively. Because they are at the same level as shown in Figure 3, these three elements have the same FIMs (4.581378E-03), as shown in Table III. On the other hand, the element 1 (BR10, 07, 04 and 01), as shown in Figure 3, is the SF6 breaker defined in Table I. The SF6 breaker has a higher level compared with the previous elements. Hence, SF6 breaker has a larger FIM (1.555635E+01). Table IV illustrates FIMs of all elements with respect to the top event. It is found that SF6 breaker and relays (50, 86, 21 and 2) are crucial.T ABLE II R ELIABILITIES OF T OP E VENT AND S UB-T OP E VENTSTop event and Sub-top eventUnavailability(×10-3)Failure rate(times/year)Equivalentannualdowntime(hours/year) x2UpperboundLowerboundProtection systemfailure 7.940840 10.32330 5.558377 15.96632×10-3 69.56 Bus protection failure 1.200183 1.560284 0.840082 2.40229×10-3 10.51 Transmission lineprotection failure 1.200778 1.561207 0.840350 2.40348×10-3 10.52 Breaker failureprotection failure 6.600000 8.580000 4.620000 13.25840×10-3 57.82 Generator backupprotection failure 2.390000 3.107000 1.673000 4.78763×10-3 20.94 Remote trip protectionfailure 0.600389 0.780603 0.420175 1.20126×10-3 5.26T ABLE III FIMs OF B US P ROTECTIONFault events FIMsSF6 circuit breaker 1.555635E+01Protection relay malfunction (87)4.581378E-03Protection relay fault (87) 4.581378E-03DC power 4.581378E-0313 Published by The Berkeley Electronic Press, 2008T ABLE IV FIMs OF P ROTECTION S YSTEMFault events FIMsSF6 circuit breaker 1.555635E+01Protection relay malfunction (50) 1.555635E+01Protection relay fault (50BF) 1.555635E+01Protection relay malfunction (50BF) 1.555635E+01Protection relay fault (86BF) 1.555635E+01Protection relay malfunction (86BF) 1.555635E+01Protection relay fault (50) 1.555635E+01Protection relay fault (21) 1.555635E+01Protection relay malfunction (21) 1.555635E+01Protection relay fault (2) 1.555635E+01Protection relay malfunction (2) 1.555635E+01DC power 1.555635E+01Digital relay fault 5.529250E-03Protection relay malfunction (87) 4.581378E-03Digital relay malfunction 5.529250E-03Optical fiber communication fault 5.529250E-03Microwave equipment fault 2.527657E-03Protection relay fault (87) 4.581378E-03Microwave communication fault 2.527657E-03Optical fiber equipment fault 5.529250E-03V. C ONCLUSIONSIn this paper, reliability of the protection system for a switchyard was assessed using the fault-tree analysis with fuzzy unavailability. It could be achieved by the minimum cut sets using Boolean operation and fuzzy arithmetic operations. The unavailability of a system was then transformed to the failure rate and the downtime. The planner may know the possible range of reliability with fuzziness. The measure of importance for the fault event was also identified using Fuzzy Importance Measure (FIM). A 345kV switchyard in the 3rd nuclear power plant in /ijeeps/vol9/iss4/art114Taiwan served as an example in this paper. From the simulation results, it could be found that the strongest and weakest functions were the remote trip protection and the breaker failure protection, respectively. Moreover, it was found that SF6 breaker, relays (50, 86, 21 and 2) and DC power were crucial considering FIMs.AppendixFor reliability assessment, one needs to attain the unavailability data of the fault events and then compute the unavailability of the system using Equation (4). Finally, the annual down time of the system can be evaluated from the unavailability as follows:Annual downtime = unavailability ×8760(hr/year) (A-1)The failure rate λ can be obtained by solving Eq. (A-2):Unavailability = 1 + TITI ⋅−⋅−λλ1)exp( TI=1 year (A-2)Equation (A-2) can be derived as follows: Assume that States 1 and 2 for an element are in the UP and DOWN conditions, respectively. Let the initial probability for State 1 be unity. Then the probability for State 1 at time t is exp(-t λ). The definition of unavailability for State 2 is the corresponding probability, i.e., 1- exp(-t λ). For a given test interval TI, the average unavailability for State 2 can be obtained byUnavailability = ∫−−TI dt t TI 0))exp(1(1λ = 1 + TITI ⋅−⋅−λλ1)exp(VI. R EFERENCES[1] R. Billinton, M. Fotuhi-Firuzabad, L. Bertling, “Bibliography on the Application of Probability Methods in Power System Reliability Evaluation 1996-1999,” IEEE Power Engineering Review, Vol. 21, No. 8, pp. 56-56, 2001.[2] ISA-TR84.00.02-2002, The Instrumentation, Systems, and Automation Society(ISA), 2002.15Published by The Berkeley Electronic Press, 2008[3] I EEE guide for selecting and using reliability predictions based on IEEE 1413,IEEE Std 1413.1-2002.[4] Y. Dutuit, and A. Rauzy, “Efficient Algorithms to Assess Component andGate Importance in Fault Tree Analysis,” Reliability Engineering and System Safety, V ol. 72, No. 2, pp. 213-222, 2001.[5] L. Xing, K. N. Fleming, and W. T. Loh, “Comparison of Markov Model andFault Tree Approach in Determining Initiating Event Frequency for Systems with Two Train Configurations,” Reliability Engineering and System Safety, V ol. 53, pp. 17-29, 1996.[6] R. Billinton and A. Sankarakrishnan, “A Comparison of Monte CarloSimulation Techniques for Composite Power System Reliability Assessment,”WESCANEX 95. Communications, Power and Computing, Conference Proceedings, IEEE, V ol. 1, pp. 145-150, May 1995.[7] NUREG, “Fault Tree Handbook,” Report NUREG-0492, 1981.[8] S. U. Chang, C. R. Lin, and C. T. Chang, “A Fuzzy Diagnosis Approach usingDynamic Fault Trees,” Chemical Engineering Science, V ol. 57, pp.2971-2985, 2002.[9] D. Yuhua, and Y. Datao, “Estimation of Failure Probability of Oil and GasTransmission Pipelines by Fuzzy Fault Tree Analysis,” Journal of Loss Prevention in the Process Industries, V ol. 18, pp. 83-88, 2005.[10] J. D. McCalley, and F. Weihui, “Reliability of Special Protection System,”IEEE Trans. on Power Systems, V ol. 14, No. 4, pp. 1400-1406, Nov. 1999. [11] E. O. Schweitzer, III, B. Fleming, T. J. Lee and P. M. Anderson, “ReliabilityAnalysis of Transmission Protection Using Fault Tree Methods,” Proceedings of the 24th Annual Western Protective Relay Conference, Spkane, Washington, October 21-23, 1997.[12] G. W. Scheer, and R. E. Moxley, “Digital Communications Improve ContactI/O Reliability,” SEL Literature CD, 2005.[13] C. L. Su, “Effects of Communication Network on Reliability of a Wide AreaProtection Scheme,” Proceedings Energy and Power Systems - 2006, Chiang Mai, Thailand, March 29-31, 2006.[14] Y. He, L. Soder, R.N. Allan, “Distribution Automation: Impact ofCommunication System on Reliability of Automatic Control,” 2001 IEEE Power Tech Proceedings, Porto, Vol. 3, Sep 10-13, 2001. [15] M.A. Azarm, R. Bari, M. Yue, Z. Musicki, “Electrical Substation ReliabilityEvaluation with Emphasis on Evolving Interdependence on Communication Infrastructure,” International Conference on Probabilistic Methods Applied to Power Systems, Sep 12-16, 2004.[16] L.R.C. Ferreira, P.A. Crossley, J. Goody, and R.N. Allan, “ReliabilityEvaluation of Substation Control Systems,” IEE Generation, Transmission and Distribution, Vol. 146, pp. 626-632, Nov. 1999./ijeeps/vol9/iss4/art116[17] G.H. Kjolle, O. Gjerde, B.T. Hjartsjo, H. Engen, L. Haarla, L. Koivisto and P.Lindblad,“Protection System Faults: a Comparative Review of Fault Statistics,” International Conference on Probabilistic Methods Applied to Power Systems, Page(s):1 – 7, 11-15 June 2006.[18] J.J. Meeuwsen, W.L. Kling, W.A.G.A. Ploem, “The Influence of ProtectionSystem Failures and Preventive Maintenance on Protection Systems in Distribution Systems,” IEEE Transactions on Power Delivery, Vol. 12, No. 1, pp.125-133, Jan. 1997.[19] H. Wang and J.S. Thorp,“Optimal Locations for Protection SystemEnhancement: A Simulation of Cascading Outages,” IEEE Trans. on Power Delivery, V ol. 16, No. 4, pp. 528 – 533, Oct. 2001.[20] X.B. Yu and C. Singh, “A practical approach for integrated power systemvulnerability analysis with protection failures,” IEEE Trans. on Power Systems, Vol. 19, No. 4, pp. 1811-1820, Nov. 2004.[21] X.B. Yu and C. Singh, “Power System Reliability Analysis ConsideringProtection Failures,” IEEE Power Engineering Society Summer Meeting, V ol.2, pp. 963 – 968, 22-25 July 2002.[22] John B. Blowles and Colón E. Peláez, “Application of Fuzzy Logic toReliability Engineering,” Proceedings of the IEEE, V ol. 83, No. 3, pp.435-449, 1995.[23] P. V. Suresh, A. K. Babar, and V. Venkat Raj, “Uncertainty in Fault Analysis:a Fuzzy Approach,” Fuzzy Sets and Systems, V ol. 83, pp. 135-141, 1996.[24] T. L. Huang, J. A. Jiang, K. L. Lai, Y. C. Wang, C. S. Chen, M. H. Shih, andY. T. Hsiao, “Reliability Analysis of Wind Power Generation Grid Connection Using Fault Tree Method,” The 26th Symposium on Electric Power Engineering, pp. 2195-2200, Taiwan, 2005.Published by The Berkeley Electronic Press, 200817。

故障树分析法(Fault Tree Analysis简称FTA)什么是故障树分析法故障树分析（FTA）技术是美国贝尔电报公司的电话实验室于1962年开发的，它采用逻辑的方法，形象地进行危险的分析工作，特点是直观、明了，思路淸晰，逻辑性强，可以做左性分析，也可以做泄量分析。

体现了以系统工程方法研究安全问题的系统性、准确性和预测性，它是安全系统工程的主要分析方法之一。

一般来讲，安全系统工程的发展也是以故障树分析为主要标志的。

1974年美国原子能委员会发表了关于核电站危险性评价报告，即“拉姆森报告”，大量、有效地应用了FTA,从而迅速推动了它的发展。

目前，故障树分析法虽还处在不断完善的发展阶段，但其应用范围正在不断扩大，是一种很有前途的故障分析法。

故障树分析（Fault Tree Analysis）是以故障树作为模型对系统进行可靠性分析的一种方法，是系统安全分析方法中应用最广泛的一种自上而下逐层展开的图形演绎的分析方法。

在系统设计过程中通过对可能适成系统失效的各种因素（包括硬件、软件、环境、人为因素）进行分析，画出逻辑框图（失效树），从而确左系统失效原因的各种可能组合方式或其发生概率，以讣算的系统失效概率，采取相应的纠正措施，以提髙系统可靠性的一种设计分析方法。

故障树分析方法在系统可靠性分析、安全性分析和风险评价中具有重要作用和地位。

是系统可靠性研究中常用的一种重要方法。

它是在弄淸基本失效模式的基础上，通过建立故障树的方法，找出故障原因，分析系统薄弱环节，以改进原有设备，指导运行和维修，防止事故的产生。

故障树分析法是对复杂动态系统失效形式进行可靠性分析的有效工具。

近年来, 随着计算机辅助故障树分析的岀现，故障树分析法在航天、核能、电力、电子、化工等领域得到了广泛的应用。

既可用于定性分析又可定量分析。

故障树分析（Fai山Tree Analysis）是一种适用于复杂系统可靠性和安全性分析的有效工具，是一种在提髙系统可靠性的同时又最有效的提高系统安全性的方法。

模糊故障树分析方法在HACCP中的应用研究王开义1，2，赵春江2※，张方田2（1．北京工业大学计算机学院，北京100022；2．国家农业信息化工程技术研究中心，北京100097）摘要：HACCP（Hazard Analysis and Critical Control Point)称为“危害分析与关键控制点",HACCP是一个复杂的系统工程，对于农产品加工企业或食品企业而言，制定一个产品的HACCP计划有很大的难度,特别是对于关键控制点的正确选取更需要领域专家的帮助。

本文介绍了故障树分析方法在HACCP体系第一原则和第二原则上的应用，并引入模糊数学理论中的模糊算法和非模糊化方法与故障树分析方法相结合，分别适用于HACCP计划的制定和HACCP计划的变更，并可根据该方法开发出制定HACCP计划的软件工具，使得HACCP计划的制定趋于简单化和自动化。

关键词:危害分析与关键控制点（HACCP);故障树分析方法;模糊算法；非模糊化方法0 引言：HACCP称为“危害分析与关键控制点”。

其强调的是在生产过程中通过预防使可能发生的食品安全危害降低到最低限度，而不是靠事后检验产品的安全性。

采用HACCP原理预防农产食品的不安全危害,已成为农产品生产加工企业全过程质量安全控制技术发展的新趋势[1］.目前的农产品生产加工企业绝大多数是中小型企业，而这些农产品加工企业在实施HACCP过程中无一例外地面临着技术、人才、资金等方面的困难[2］，因为HACCP管理体系涉及到食品工艺学、微生物学、化学和物理学、质量控制和危险性评估等多方面的专业知识［3]。

国内外很多研究人员一直致力于研究简单化、自动化、智能化的HACCP实施方法与工具[4］［5］［6］。

这些研究成果多数针对某一个特定的产品（如：鱼罐头等),通过对多个企业实施HACCP的大量实践数据进行危害分析，挖掘危害分析及关键控制点的规律，进而为新实施该产品HACCP体系的企业提供技术支持.但是,目前应用效果还不能满足实际需求，现实中人们还是采用传统的方法，借鉴专家的经验并结合企业的实际情况来实施HACCP.本研究结合近些年来开发农业企业HACCP管理软件的工程实践,探索利用故障树理论、模糊数学理论来降低HACCP实施难度的方法。