Comparison of Fault Tree and Bayesian Networks for Modeling Safety Critical Components in Railway Systems

In spite of reliable signaling and train protection and warning systems, trains are still passing red signals even in modern railway systems. These so-called SPAD events can lead to train derailment, head on collisions with other trains, collisions with infrastructure and other adverse consequences. The classical way of modeling such events is by means of Fault Tree (FT) analysis. However, the FT methodology has limitations when modeling complex systems. This motivates an investigation into the use of Bayesian Networks (BN) for modeling and analyzing SPAD and other safety critical events in railway systems. BN allows combining systematic, expert and factual knowledge about the system and is a flexible and compact form of system representation. In this paper, it is studied by means of the SPAD example whether the use of BN provides significant advantages over the FT methodology for modeling safety risks in railway systems. The causes of train derailment due to SPAD are summarized and the FT and BN methods are compared with respect to different modeling and analysis aspects that are relevant for railway systems. 2 SIGNAL PASSING AT DANGER (SPAD) SPAD events occur when trains do not stop before a red light. SPAD can be caused by faulty brakes, high train speed, defective signals and train drivers wrongly reading and responding to cautionary signals (Whittingham, 2004). SPAD events can lead to train derailment, collision with infrastructure or collision with other trains. To prevent SPAD, modern railways have automatic signaling systems, which stop the trains whenever components of the system fail to perform their function. These signals ensure an adequate distance between the trains to avoid collisions. Train drivers follow these signals along the railway track in order to proceed further and switch railway lines. Additionally, trains are equipped with train protection and warning systems (TPWS) that further ensure safe train movement. This system prevents SPAD by automatically applying the brakes if the train speed is too high. 3 FAULT TREE MODELLING The Fault Tree (FT) is a common technique used for logical representation of a technical system for the purpose of safety and reliability analysis. It provides a rational framework for modeling the possible scenarios leading to system failure. It is a deductive method in which an undesired event – called Top Event (TE) – is postulated and the scenarios leading to the TE are identified. These scenarios originate from so-called basic events, and are described by a series of logical operators and intermediate events leading to the TE. The system is analyzed in the context of its operational and safety requirements and environment to find all combinations of basic events that will lead to the occurrence of the TE (Stewart & Melchers, 1997). The basic assumptions of the standard FT methodology are  the FT is based on events, it can thus only represent random variables with binary states;  basic events are statistically independent;  the relationship between events is represented by logical gates. The basic constituents of the FT analysis used in this paper are shown in Figure 1 and explained below.  Basic event: a triggering event for the TE, e.g. human error, failure of a system component.  Intermediate event: events other than TE & basic events, defined through gates.  OR gate: the output event occurs if one of the input events occur;  AND gate: the output event occurs if all input events occur;  NOT gate: the output event occurs if the input event does not occur;  Repeat bar: the intermediate event (and the events leading to it) are repeated. Figure 1. Graphical symbols for Fault Tree. In the quantitative analysis of the FT, the probability of the TE is computed as a function of the probability of the basic events, by identifying (minimal) cutsets. Algorithms for these computations are provided in (Bertsche, 2008) and (Aven, 2008). By using importance measures, the criticality of each basic event towards system failure can be determined (Borgonovo, et al., 2003). Here, the diagnostic importance factor from (Assaf & Dugan, 2004) is used, which for the basic event is defined as the conditional probability of given system failure :