Fuzzy-Based Failure Modes, Effects and Criticality Analysis Applied to Cyber-Power Grids

1. Introduction

The Failure Modes, Effects and Criticality Analysis (FMECA) is a structured qualitative method for reliability analysis intended to identify failures that have significant consequences affecting the system performance in the application considered. FMECA is very useful for identifying potential failures in a system, understanding their causes and consequences, categorizing them, and using this information to help prioritize maintenance tasks [1,2].

The standard IEC 60812:2006, titled “Analysis Techniques for System Reliability: Procedure for failure mode and effects analysis (FMEA)”, can be considered an official guide for the application of FMEA and the FMECA principles [3]. FMECA is an extension of FMEA that includes criticality analysis through calculating risk metrics [3]. Although FMECA differs from FMEA because the first considers the calculation of criticality, both terms are commonly used as synonyms. In this work, we use the correct term FMECA.

The primary objective of an FMECA analysis is to improve design [1,2,3]. However, it can also be applied at any stage of a project (or process) to plan preventive maintenance actions. In FMECA, the potential failure modes for all components are analyzed, identifying the causes that originated the failure, the failure effects on the system, and the actions that must be executed to mitigate its effects before it occurs.

FMECA provides a risk level for each identified failure mode. A Risk Priority Number RPN is used to assess the risk level. It is computed based on three criteria called risk factors: the occurrence (O), which represents the frequency of occurrence of the failure mode, the severity (S), representing the impact of the failure mode on the system; and the detection (D), which represents a ranking of the level of detection of this failure mode. Numerical categories characterize risk factors. Each category is usually represented by a numerical scale that can be a 1 to 10 scale, as proposed in [4], or in 1 to 5 scale, as proposed in [5], or scales specially defined according to the characteristics of the problem. For the severity and occurrence scales, the higher the effect or frequency, the higher its rating; conversely, for the detection scales, the lower the failure mode’s detectability, the higher its rating.

In the classical FMECA context, the RPN is calculated as in (1) [3]:

$$RPN=S\circ O\circ D$$

(1)

where the symbol $\circ$ represents a composition between the risk factors, the product being the most used operator. The higher the RPN for a specific failure mode, the higher its risk. The failure modes are ranked from higher to lower RPN, producing a failure mode’s ordinal ranking.

FMECA is widely used in several industrial and commercial applications such as oil and gas, energy, mining, nuclear, chemical processes, and, lately, healthcare, among others. Concerning electrical power systems, the main applications are currently oriented toward wind energy [6,7], hydropower energy [8], photovoltaic systems [9,10], capacitor banks [11], substations [12,13], and power transformers [13,14,15].

The application of FMECA analysis in the cyber-power grid context is limited. In [16] is shown the FMECA analysis applied to a specific designed smart distribution grid that includes power and cyber equipment. A total of 107 failure modes were identified, and 42 were fully analyzed. The results show that transformer explosions, control failures in IEDs, and loss of structural integrity in busbars present the highest risk among failure modes (highest RPN). Although the FMECA procedure is considered a powerful tool for identifying potential failure modes and their effects, the conventional approach has many drawbacks, including [17]:

• The computation of RPN does not take into account the relative importance of Severity, Occurrence, and Detection;
• Different combinations of S, O, and D can produce the same RPN;
• The numerical scales used to represent risk factors are usually attributed and are essentially qualitative scales;
• The assessment of risk factors is subjective, and;
• Although risk factors are represented as intervals, the risk computing method is inappropriate for this kind of data.

FMECA analysis is a team-based qualitative risk analysis method. Therefore, human reasoning plays an essential role in the main process. To consider a natural representation of risk factors defined by experts, fuzzy logic was successfully applied to improve the FMECA process. Using fuzzy logic, each risk factor can be represented by a function with uncertainty associated, thus, including information about the expert's knowledge.

The main objective of this paper is to apply the type-I fuzzy inference system to improve risk prioritization, considering a more natural risk definition based on expert knowledge. The cyber-power grid proposed in [16] was analyzed to verify the proposed method's applicability.

The paper has the following structure: Section 2 includes a literature review of the methods used to improve the FMECA analysis. Section 3 presents a brief introduction to fuzzy sets and type-I fuzzy inference systems applied in the context of the FMECA analysis. Section 4 shows the implementation of the proposed fuzzy-FMECA approach, including detailed information about the membership functions representing the FMECA risk factors, fuzzy rules, and operators for the fuzzy inference system. Section 5 presents the case study of classical FMECA analysis in cyber-power systems and the configuration of the fuzzy-FMECA test cases. Section 6 shows the results and a detailed discussion about the failure modes prioritization obtained by the classical and fuzzy-FMECA. Finally, section 7 includes the paper conclusions and future work.

2. Literature Review

Several approaches have been applied in the last two decades to overcome the shortcomings mentioned above in classical FMECA. In [18], the author shows extensive bibliographic research on methods to improve the FMECA prioritization process. Methods like gray theory and fuzzy inference systems appear to be the most used in the last decade to improve the FMECA analysis in mechanical systems, aircraft systems, microelectronics reliability, the automobile industry, and medical processes risk management [18].

In [19], the authors compare classical FMECA and two modified FMECA based on grey theory and fuzzy rule base. Five categories represent the linguistic terms related to a risk factor. The approaches were applied to identify risks in pipeline systems. The authors conclude that their approaches allow expressing the expert’s judgment in natural language and incorporating the expert’s knowledge into the fuzzy rule-base procedure.

In [20], the authors propose an FMECA method based on fuzzy set theory, analytical hierarchy process, and data development analysis to handle uncertainty in the risk analysis of aircraft landing systems. The authors conclude that their approach can provide more information to support better decisions and provide corrective actions on the riskiest failure mode.

Reference [21] shows an approach based on a combination of modified fuzzy AHP (Analytic Hierarchy Process), a modified fuzzy weighted MULTIMOORA method and a new ranking method based on fuzzy numbers. The approach considers the weights associated with each failure mode instead of their RPN and includes three new factors: time, cost, and profit. The model was applied for risk assessment in a steel factory, and the FMECA team comprised five members. The authors conclude that using weights for the six factors provides a more precise risk evaluation.

In [22], a type-II fuzzy system is applied to identify hazardous conditions in marine power systems applications. Five categories represented the risk factors, and the fuzzy inference system contained 125 rules. Compared to classical FMECA, the proposed approach is more robust and efficient for the RPN calculation and the prioritization process.

In [23], the authors have shown an application of a combined method based on fuzzy logic and the decision-making trial and evaluation laboratory (DEMATEL) for the correlation between failure modes and their causes. The fuzzy logic stage considers ten categories with triangular fuzzy numbers to represent risk factors and five categories with triangular fuzzy numbers to represent the weights associated with risk factors. When applied to the risk assessment in shipboard-integrated electric propulsion systems, the authors conclude that their approach improves risk priority decision-making and disastrous accident prevention.

In [24], the authors propose a new method for fuzzy risk assessment in the FMECA analysis based on D numbers and multisensor information. The risk factors are represented by triangular and trapezoidal membership functions and grouped into ten risk categories. In addition, fuzzy weights for the risk factors were included. The proposed method was applied to a case study that assesses the risk of the general anesthesia process. Results show that this approach achieves performance comparable with other multicriteria decision-making methods applied to improve the FMECA analysis.

In [25], the authors show an approach based on fuzzy rules and gray theory applied to risk assessment in an ocean-going fishing vessel. This approach considers five categories for the risk factors and a 1 to 10 numerical scale. The results show that using linguistic terms allows the FMECA's team members to give more meaningful value for their judgment about the risk factors.

In [5], the authors show a first approach that applied type-I fuzzy systems for the FMECA in the smart grid environment. The risk factors were represented by triangular and Gaussian membership functions corresponding to five risk categories. An intermediate risk factor called impact is also included due to severity and occurrence. The approach was applied for risk assessment in eight components of a test smart grid. The results show that the fuzzy-based FMECA adequately prioritizes the failure modes.

Reference [26] shows the application of type-I fuzzy inference systems for improving the FMEA analysis in a smart grid distribution system; the authors consider 125 fuzzy rules, triangular membership functions for the risk factors O, S, and D, and Gaussian membership functions for the RPN. The model efficiently classified the failure modes when applied to assess 24 failure modes.

Due to the limited applications of FMECA analysis in the context of cyber-power grids, this work aims to contribute to the prioritization of failure modes, introducing the application of fuzzy systems to represent the uncertainty associated with human language and the human logical reasoning mechanism.

The following section introduces type-I fuzzy inference systems and the FMECA risk factors representation in fuzzy logic terms.

3. Type-I Fuzzy Inference Systems

3.1. Fuzzy Sets and Fuzzy Logic

A fuzzy set can be viewed as an extension of a classical set that “introduces vagueness by eliminating the sharp boundary that defines when an object belongs to a set (or category) or not” [27]. In classical sets theory, a particular element belongs to a set or not; in fuzzy sets’ terms, it is possible to say that this element belongs to a set with a certain membership grade.

For example, the probability of occurrence for a particular failure mode is 5x10^-2 occurrences per year. We state that it belongs to a risk category named “Occurrence Probable” (OP). To represent the risk category OP as a fuzzy set, we consider that the failure mode’s probability of occurrence is around 5x10^-2 occurrences per year. The term around means that fuzzy set OP will contain not only the failure modes with probability 5x10^-2 but also failure modes whose probability of occurrence is close to 5x10^-2 within a predefined interval.

Let us say that the fuzzy set OP (occurrence around 5x10^-2) is defined in the interval from 3x10^-2 to 30x10^-2. All failure modes with a probability of occurrence within this interval will belong to the OP with a certain grade of membership. The grade of membership in fuzzy sets can be modeled through a membership function, denoted by$\mu \left(x\right)$, that assigns a membership grade between 0 and 1 to each element in the interval.

Figure 1 shows a triangular-shaped membership function defined to represent the category Occurrence Probable (OP), defined on the interval [3x10^-2, 30x10^-2], and whose membership varies from 0 (non-membership) to 1 (full membership). When the probability of occurrence is 5x10^-2, it has a grade of membership equal to 1; when the probability of occurrence is 20x10^-2, it has a grade of membership equal to 0.4; when the probability of occurrence is 30x10^-2, it has a grade of membership equal to 0, and so on.

Formally, a fuzzy set$\tilde{A}$ can be defined as a set of ordered pairs as shown in the equation (2), where ${\mu }_A\left(x\right)$ is the “membership function” of $x$ in the fuzzy set $\tilde{A}$ (the degree that $x$ belongs to $\tilde{A}$). $U$ is called the universe of discourse and represents all the possible values for $x$ [27]. This kind of fuzzy set is a standard or Type-1 fuzzy set [28,29]. A fuzzy set is completely characterized by its membership function [30].

$$\tilde{A}=\left\{\left(x,{\mu }_{\tilde{A}}\left(x\right)\right)/x\in U\right\}$$

(2)

The membership function would be considered a subjective representation of the human language [30,31]. It can be constructed using intuition or inference procedures, neural networks, genetic algorithms, soft partitioning, and other procedures. In general, it is always preferable that the membership function represents the expert knowledge for a particular application if this knowledge is available.

In the context of FMECA, the three risk factors (S, O, and D) can also be represented in fuzzy terms as linguistic variables. A linguistic variable is a variable whose values are words or sentences expressed in natural or artificial language [31]. For example, linguistic values such as “Remote”, “High”, or “Moderate” can be used to define the occurrence, O, instead of using numerical values.

A quintuple represents a linguistic variable $\left(x,T\left(x\right),U,G,M\right)$, where $x$ is the variable, $T\left(x\right)$ is the term-set of $x$ (collection of linguistic values for $x$), $U$ is the universe of discourse for $x$ (all possible values of $x$), $G$ is a syntactic rule for generating terms $T\left(x\right)$, and $M$ is a semantic rule which associates each linguistic value with is meaning $M\left(x\right)$, where $M\left(x\right)$ is a fuzzy set in $U$ [31].

3.2. Fuzzy Membership Functions

The membership functions characterize the fuzziness in a fuzzy set. Usually, membership functions can be represented by mathematical formulae. The most common membership functions are the triangular and trapezoidal membership functions. The triangular membership function, denoted by$tri\left(x;a,b,c\right)$, is specified by three parameters as shown in equation (3) [30]:

$$tri\left(x;a,b,c\right)=\left\{\begin{array}{cc}0,& x<a\\ \left(x-a\right)/\left(b-a\right),& a\le x\le b\\ \left(c-x\right)/\left(c-b\right),& b\le x\le c\\ 0,& x>c^{+}\end{array}\right.$$

(3)

The trapezoidal membership function, denoted by$trap\left(x;a,b,c,d\right)$, is specified by four parameters, as shown in the equation (4) [30].

$$trap\left(x;a,b,c,d\right)=\left\{\begin{array}{cc}\left(x-a\right)/\left(b-a\right),& a\le x\le b\\ 1& b\le x\le c\\ \left(d-x\right)/\left(d-c\right),& c\le x\le d\\ 0,& otherwise\end{array}\right.$$

(4)

The functions mentioned above will be used to represent the FMECA risk factors.

3.3. Fuzzy If-Then Rules

In fuzzy logic, approximate reasoning refers to a mode of reasoning in which the input-output relation of a system is expressed as a collection of fuzzy IF-THEN rules where the preconditions and consequents involve linguistic variables [27,30]. The fuzzy if-then rule is also known as a fuzzy rule, fuzzy implication, or fuzzy conditional statement [30].

A general structure of if-then rules is “IF $x$ is $A$ then $y$ is $B$”, where the expression “$x$ is $A$” is called the antecedent or premise, and the expression “$y$ is $B$” is called the consequent or conclusion [30]. Fuzzy if-then rules can be explained in detail using the context of fuzzy relations, but because this work is not a treatise on fuzzy relations, this topic was not covered in this section. As an example, a fuzzy if-then rule associated with a particular failure mode can be expressed as follows:

IF (Severity is hazardous) AND (Occurrence is remote) AND (Detection is high) THEN (RPN is moderate).

The terms hazardous, remote, and high are categories related to severity, occurrence, and detection, respectively; the term moderate is a category related to the risk priority number. Usually, fuzzy rules are defined by a group of experts or using artificial intelligence mechanisms. This work considers that the rule's antecedent is composed of the combination of the three risk factors based on fuzzy sets.

3.4. Fuzzy Inference Systems

The Fuzzy Inference System FIS is a computational framework that formulates input/output mappings through fuzzy if-then rules and fuzzy reasoning mechanisms. The FIS consists of three stages, as shown in Figure 2 [30]:

• The input processing stage is called fuzzification, where the input variables are transformed into fuzzy sets;
• The reasoning mechanism, which performs the inference procedure based on the pre-defined fuzzy rules and the selected fuzzy inference mechanism, to derive a reasonable output or conclusion; and,
• In the output processing stage, defuzzification transforms the fuzzy sets resulting from the reasoning mechanism into a crisp value.

The inputs of a FIS can be either fuzzy or numerical values. In fuzzy logic, the numerical values are called crisp and can be represented as a fuzzy singleton function [27,30]. There are two main fuzzy inference systems: the Mamdani FIS and Takagi-Sugeno FIS [27,30]. Figure 3 illustrates the Mamdani fuzzy inference system with the following two fuzzy rules:

Rule 1: If ($x_{11}$ is $A_{11}$) AND If ($x_{12}$is $A_{12}$) THEN ($z_1$ is $C_1$).

Rule 2: If ($x_{21}$ is $A_{21}$) AND If ($x_{22}$is $A_{22}$) THEN ($z_2$ is $C_2$).

Where the operator AND is represented by the min(∙) (T-norm), the implication operator THEN is represented by the min(∙) (T-norm), the aggregate operator is represented by max(∙) (T-conorm), and the defuzzification is obtained by the centroid of the resulting area (COA).

The Mamdani FIS shown in Figure 3 comprises the following steps [30]:

• Step 1: Obtain the membership value for each input variable in the antecedent part of the fuzzy rule. In the example of Figure 3, for Rule 1, the membership value for the input $x_{11}$ in the fuzzy set $A_{11}$ is ${\mu }_{11}$, and the membership value for the input variable $x_{12}$ in the fuzzy set $A_{12}$ is ${\mu }_{12}$. The same analysis is valid for rule 2;
• Step 2: Combine the membership values on the antecedent part of each rule through a specific fuzzy operator, usually the min(∙) operator or the max(∙) operator, to get a fuzzy rule’s weight (called firing strength); this step is equivalent to use the AND operator or the OR operator in Boolean logic. If the result of the combination is greater than zero, the rule is “fired,” and its consequent will be computed using this firing strength. In the example of Figure 3, the operator min(∙), equivalent to the Boolean operator AND, is used to obtain the minimal value between ${\mu }_{11}$ and ${\mu }_{12}$, resulting in the rule 1 firing strength ${\alpha }_1$. The same analysis is valid for rule 2;
• Step 3: Generate the qualified consequents of each rule by weighting each consequent fuzzy set with the firing strength obtained in step 2. This step is equivalent to the implication (THEN) in Boolean logic. In the example of Figure 3, the fuzzy output rule 1 is weighted by the firing strength ${\alpha }_1$. The implication operator, usually the min operator, truncates the consequent’s fuzzy set at the ${\alpha }_1$ value, obtaining the shaded area in set C1. The same analysis is valid for rule 2.
• Step 4: Aggregate all the qualified consequents to produce the FIS fuzzy output, then this output is defuzzified to obtain the final crisp output. The aggregation process combines all rule’s consequents to obtain a single fuzzy set through an aggregation operator, usually the operator max(∙). Defuzzification is the process of extracting a crisp representative value from a fuzzy set. This work considers the centroid of the area, COA, because it is the most popular defuzzification method [30]. In the example of Figure 3, the application of the operator max(∙) between the rule’s outputs produces the shaded area, and the application of the operator COA produces the FIS crisp output $y*$.

3.5. FMECA Risk Factors Expressed in Fuzzy Terms

As stated in section 1, the risk categories in the classical FMECA are represented by an integer numerical scale, being the most used on the 1 to 10 scale and the 1 to 5 scale. The selected scale usually determines the number of risk categories associated with the risk factors.

To establish the number of fuzzy categories, we consider the “seven plus or minus two” criterion defined by Miller in [32]. According to Miller, the limit of the information processing capacity of human memory is seven units of information simultaneously, more or less two pieces of information. In [33], the authors use the Miller criterion to support their decision to fix the number of linguistic terms associated with a specific fuzzy category. Although the authors state that they do not have sufficient theoretical arguments to support their selection, they conclude that their decision to assign eight linguistic terms (seven plus one) is simple enough to be understood by the decision maker and analyzed by the fuzzy system. Following this logic, we have selected five linguistic terms (exactly seven minus two terms) to represent the fuzzy categories associated with the risk factors.

FMECA is conducted by human experts, who assign an integer value from 1 to 10 for each risk factor; then, we consider the universe of discourse for each risk factor as the interval $U=\left[1,10\right]$. The three risk factors (Severity S, Occurrence O, Detection D, and the Risk Priority Number RPN) will be represented by fuzzy variables.

Regarding the severity, we consider the following assumptions:

• The severity categories are as follows: Severity minor (SMI), severity low (SL), severity moderate (SM), severity very high (SVH), and severity hazardous (SH);
• The term-set for Severity is: $T\left(S\right)=\left\{SMI,SL,SM,SVH,SH\right\}$;
• The semantic rule $M$ for the term set for Severity $T\left(S\right)$ is shown in Table 1:

Table 1. Semantic rules for term-set Severity.

Semantic rule	Fuzzy subset
$M\left(SMI\right)$	The effect of the failure mode is considered minor when assessed as 1
$M\left(SL\right)$	The effect of the failure mode is considered as low when assessed between 2 and 3
$M\left(SM\right)$	The effect of the failure mode is considered moderate when assessed between 4 to 6
$M\left(SVH\right)$	The effect of the failure mode is considered very high when assessed between 7 to 8
$M\left(SH\right)$	The effect of the failure mode is considered hazardous when assessed between 9 to 10

Table 1. Semantic rules for term-set Severity.

Semantic rule	Fuzzy subset
$M\left(SMI\right)$	The effect of the failure mode is considered minor when assessed as 1
$M\left(SL\right)$	The effect of the failure mode is considered as low when assessed between 2 and 3
$M\left(SM\right)$	The effect of the failure mode is considered moderate when assessed between 4 to 6
$M\left(SVH\right)$	The effect of the failure mode is considered very high when assessed between 7 to 8
$M\left(SH\right)$	The effect of the failure mode is considered hazardous when assessed between 9 to 10

• Regarding the occurrence, we consider the following assumptions:
• The occurrence categories are the following: Occurrence remote (OR), occurrence very unlikely (OVU), occurrence occasional (OO), occurrence probable (OR), and occurrence frequent (OF);
• The term-set for O is: $T\left(O\right)=\left\{OR,OVU,OO,OP,OF\right\}$;
• The semantic rule $M$ for $T\left(O\right)$ are:

Table 2. Semantic rules for term-set Occurrence.

Semantic rule	Fuzzy subset
$M\left(OR\right)$	The occurrence of the failure mode is considered remote when assessed as 1
$M\left(OVU\right)$	The occurrence of the failure mode is considered very unlikely when assessed between 2 and 3
$M\left(OO\right)$	The occurrence of the failure mode is considered occasional when assessed between 4 to 6
$M\left(OP\right)$	The occurrence of the failure mode is considered probable when assessed between 7 to 8
$M\left(OF\right)$	The occurrence of the failure mode is considered frequent when assessed between 9 to 10

Table 2. Semantic rules for term-set Occurrence.

Semantic rule	Fuzzy subset
$M\left(OR\right)$	The occurrence of the failure mode is considered remote when assessed as 1
$M\left(OVU\right)$	The occurrence of the failure mode is considered very unlikely when assessed between 2 and 3
$M\left(OO\right)$	The occurrence of the failure mode is considered occasional when assessed between 4 to 6
$M\left(OP\right)$	The occurrence of the failure mode is considered probable when assessed between 7 to 8
$M\left(OF\right)$	The occurrence of the failure mode is considered frequent when assessed between 9 to 10

Regarding the occurrence, we consider the following assumptions:

• The categories for detection are as follows: Detection almost certain (DAC), detection high (DH), detection moderate (DM), detection low (DL), and detection absolutely impossible (DAI);
• The term-set for D is: $T\left(D\right)=\left\{DAC,DH,DM,DL,DAI\right\}$;
• The semantic rule $M$ for $T\left(D\right)$ are:

Table 3. Semantic rules for term-set Detection.

Semantic rule	Fuzzy subset
$M\left(DAC\right)$	The detection of the failure mode is considered almost certain when assessed as 1
$M\left(DH\right)$	The detection of the failure mode is considered as high when assessed between 2 and 3
$M\left(DM\right)$	The detection of the failure mode is considered moderate when assessed between 4 to 6
$M\left(DL\right)$	The detection of the failure mode is considered as low when assessed between 7 to 8
$M\left(DAI\right)$	The detection of the failure mode is considered absolutely impossible when assessed between 9 to 10

Table 3. Semantic rules for term-set Detection.

Semantic rule	Fuzzy subset
$M\left(DAC\right)$	The detection of the failure mode is considered almost certain when assessed as 1
$M\left(DH\right)$	The detection of the failure mode is considered as high when assessed between 2 and 3
$M\left(DM\right)$	The detection of the failure mode is considered moderate when assessed between 4 to 6
$M\left(DL\right)$	The detection of the failure mode is considered as low when assessed between 7 to 8
$M\left(DAI\right)$	The detection of the failure mode is considered absolutely impossible when assessed between 9 to 10

In the classical FMECA, the RPN results from the product of S, O, and D and has a range from 1 to 1000. The RPN can be divided into risk categories in the fuzzy reasoning context to implement the reasoning mechanism. Therefore, the range or universe of discourse does not necessarily need to be equal to the classical RPN. In this work, the universe of discourse for RPN is considered as $U=\left[1,10\right]$ follows;

• The categories for the RPN were defined as follows: Risk minor (RMI), risk low (RL), risk moderate (RM), risk high (RH), and risk extreme (RE);
• The term-set for RPN is: $T\left(RPN\right)=\left\{RMI,RL,RM,RH,RE\right\}$;
• The semantic rule $M$ for $T\left(RPN\right)$ are:

Table 4. Semantic rules for term-set Detection.

Semantic rule	Fuzzy subset
$M\left(RMI\right)$	The overall risk of the failure mode is considered minor when assessed around 1
$M\left(RL\right)$	The overall risk of the failure mode is considered as low when assessed between 2 and 3
$M\left(RM\right)$	The overall risk of the failure mode is considered moderate when assessed between 4 and 6
$M\left(RH\right)$	The overall risk of the failure mode is considered very high when assessed between 7 to 8
$M\left(RE\right)$	The overall risk of the failure mode is considered hazardous when assessed between 9 to 10

Table 4. Semantic rules for term-set Detection.

Semantic rule	Fuzzy subset
$M\left(RMI\right)$	The overall risk of the failure mode is considered minor when assessed around 1
$M\left(RL\right)$	The overall risk of the failure mode is considered as low when assessed between 2 and 3
$M\left(RM\right)$	The overall risk of the failure mode is considered moderate when assessed between 4 and 6
$M\left(RH\right)$	The overall risk of the failure mode is considered very high when assessed between 7 to 8
$M\left(RE\right)$	The overall risk of the failure mode is considered hazardous when assessed between 9 to 10

In the next section, we apply the fuzzy framework to represent the risk categories in the FMECA analysis. We propose a methodology to apply the fuzzy inference systems to prioritize the failure modes in a cyber-power grid.

4. Implementation

Figure 4 shows the flowgraph of the proposed Fuzzy-FMECA approach. This approach is divided into two stages:

• Stage 1: The classical FMECA is conducted; as a result, we obtain the value of the three risk factors for each failure mode and its respective ranking. The steps corresponding to these stages are shown in blue in Figure 4;
• Stage 2: This stage comprises the fuzzy-based FMECA, and their respective steps are shown in orange in Figure 4. The fuzzy database (composed of the fuzzy sets) and the fuzzy rules are constructed considering the expert criteria of the FMECA team members; using the information of the fuzzy database, the risk factors (S, O, D and RPN) are fuzzified. The fuzzy risk factors and the fuzzy rules are the input for the fuzzy inference mechanism; once the inference mechanism is executed, the fuzzy RPN and the failure mode’s ranking are obtained;

To maintain the essence of the classical FMECA and for comparison purposes, we consider the rating for each risk factor as an integer number resulting from the FMECA team members' consensus.

4.1. Fuzzy Categories for the FMECA Risk Factors

As stated in section 3.5, FMECA risk factors are assessed using integer numbers on a numerical scale from 1 to 10. This work considers five categories for each risk factor and the fuzzy RPN. Table 5 shows the proposed categories and their respective ratings. For example, when the rating for severity is 4, 5, or 6, it belongs to the category severity moderate SM. The next section shows the proposed fuzzy membership functions used to represent the risk categories in Table 5.

4.2. Membership Functions for the FMECA Risk Factors

The use of membership functions to represent the risk categories allows for the inclusion of the vagueness associated with the natural language used by the FMECA team members to classify the failure modes. While the classic FMECA considers strict membership for each category, the fuzzy FMECA is flexible, and ratings may belong to two risk categories simultaneously, with different membership values.

Table 5. Ratings for risk categories used in the classical FMECA.

Severity	Occurrence	Detection	FRPN1	Rating
Hazardous – SHA	Frequent – OF	Absolutely impossible – DAI	Extreme – RE	9,10
Very High – SVH	Probable – OP	Low – DL	High – RH	7,8
Moderate – SM	Occasional – OO	Moderate – DM	Moderate – RM	4,5,6
Low – SL	Very unlikely – OVU	High – DH	Low – RL	2,3
Minor – SMI	Remote – OR	Almost certain – DAC	Minor – RMI	1

¹ FRPN (Fuzzy Risk Priority Number) resulting from defuzzification is not always an integer number, and its value falls inside the limits of the corresponding rating.

Table 5. Ratings for risk categories used in the classical FMECA.

Severity	Occurrence	Detection	FRPN1	Rating
Hazardous – SHA	Frequent – OF	Absolutely impossible – DAI	Extreme – RE	9,10
Very High – SVH	Probable – OP	Low – DL	High – RH	7,8
Moderate – SM	Occasional – OO	Moderate – DM	Moderate – RM	4,5,6
Low – SL	Very unlikely – OVU	High – DH	Low – RL	2,3
Minor – SMI	Remote – OR	Almost certain – DAC	Minor – RMI	1

¹ FRPN (Fuzzy Risk Priority Number) resulting from defuzzification is not always an integer number, and its value falls inside the limits of the corresponding rating.

In this work, we use two widely-used membership functions: triangular and trapezoidal. To parameterize the membership functions, we considered the criteria of the FMECA team members who performed the FMECA analysis presented in [16]; they set the central point, limits, slope, and the overlapping of the functions. Table 6 shows the parameters for the triangular membership functions that represent the risk factors, and Figure 5 shows their shapes.

To parametrize the triangular membership functions were considered the following assumptions:

• Most of the functions’ shapes are non-symmetrical to allow different overlapping levels between categories.
• The triangular membership function SMI has the lower limit at S = 0 and the upper limit at S = 2.5; the maximum membership value occurs at S = 1.5.
• The triangular membership function SL has the lower limit at S = 0.6 and the upper limit at S = 3.5; the maximum membership value occurs at S = 2.5, that is, at the mid-point of its respective interval.
• Categories SMI and SL are superposed. When a failure mode’s severity is rated as 1, we can say that it belongs to category SMI with membership 0.667 and, simultaneously, to category SL with membership 0.285. When a failure mode’s severity is rated as 2, we can say that it belongs to category SL with a membership of 0.70, and at the same time, it belongs to category SM with a membership of 0.50. The simultaneous membership of a particular failure mode into two different categories shows the flexibility of the system to represent the vagueness associated with the risk perception of the members of the FMECA team.
• The membership functions for occurrence, detection, and fuzzy RPN were parametrized following the abovementioned criteria.

Table 7 shows the parameters for the trapezoidal membership functions to represent the risk factors, and Figure 6 shows their shapes. To parametrize the trapezoidal membership functions were considered the following assumptions:

• Most of the functions are shaped as non-symmetrical to allow different overlapping levels between categories.
• The trapezoidal membership function SMI has the lower limit at S = 0 and the upper limit at S = 2.4; the maximum membership value occurs between S = 1 and S=1.5.
• The trapezoidal membership function SL has the lower limit at S = 0.9 and the upper limit at S = 3.5; the maximum membership value occurs between S = 2 and S = 3.
• Categories SMI and SL are superposed. When a failure mode’s severity is rated as 1, we can say that it belongs to category SMI with the maximum membership of 1.0 and, at the same time, it belongs to category SL with a membership of 0.09. When a failure mode’s severity is rated as 2, we can say that it belongs to category SM with the maximum membership of 1.0 and, at the same time, it belongs to category SL with a membership of 0.44.
• The membership functions for occurrence and detection were parametrized following the criteria mentioned above and considered full membership for the range that defines each category, except for the fuzzy RPN.

4.3. Fuzzy If-Then Rules for the Proposed Approach

The fuzzy rules used in this work were defined by the same team that conducted the classical FMECA analysis shown in [16] and considered the combination between the five risk factor categories as premises. The respective consequent was selected from the Fuzzy RPN categories. We included the 125 fuzzy rules in Appendix A.

4.4. Operations for the type-I fuzzy inference system

We select the same operators used for the Mamdani FIS example of section 3.4:

• And method – min;
• Implication method – min;
• Aggregation method – max;
• Defuzzification – centroid of the area;

5. Application of the Fuzzy-FMECA Approach to Cyber-Power Grid

5.1. Cyber-Power Grid Test System

The proposed fuzzy-FMECA approach was tested on the cyber-power grid test system analyzed in [16], composed of a four-bus 30kV power system and a cyber network. One hundred seven failure modes were initially identified, but only the 42 riskiest failure modes were selected for further analysis. Table 8 shows the classical FMECA worksheet for the cyber-power grid test system. The values for S, O, and D were considered as obtained from the consensus of the FMCEA team members and are used as inputs for the proposed fuzzy-based FMECA approach.

5.2. Membership Functions for the FIS Implemented

We propose three fuzzy inference systems for the application in cyber-power grids, considering the combinations between the two membership functions detailed in Section 4.2. Table 9 shows the FIS configurations used to test the proposed fuzzy FMECA approach.

The first configuration, FIS-01, considers trapezoidal membership functions for the severity and the FRPN and triangular membership functions for the occurrence and the detection. The second configuration, named FIS-02, considers the triangular membership function for all the risk factors, and the third configuration, named FIS-03, considers the trapezoid membership function for all the risk factors.

6. Results and Discussion

This section shows the results of applying the three FIS configurations shown in Table 9. Table 10 shows the classical RPN, the fuzzy RPN, and the rankings for the classical FMECA and configurations FIS-01, FIS-02, and FIS-03.

In the next sections, we conduct a detailed analysis of the results obtained for the FIS configuration FIS-01. The first analysis (section 6.1) considers the higher differences in prioritization between the classical FMECA and the configuration FIS-01, and the second analysis (section 6.2) discusses the failure modes with the same FRPN obtained from the configuration FIS-01.

6.1. Higher Differences in Prioritization for the Riskiest Failure Modes

Table 11 compares the rankings of the ten riskiest failure modes considering the classical FMECA and the proposed FIS01.

According to classical FMECA, the riskiest failure mode corresponds to FM22 – transformer tank rupture. This failure mode was ranked priority 1 for the three proposed configurations FIS01. FM38, IED control failure, is ranked as priority 2 by classical FMECA, but FIS01 decreased its priority to 16. The FM02 – Loss of structural integrity in the busbar caused by a break of the support insulators is ranked as priority 3 by classical FMECA and ranked as priority 7 by FIS01.

Regarding FM01 (Loss of structural integrity in busbar caused by fracture of the copper bar), the classical FMECA classifies it as priority 9. Still, the configuration FIS01 ranks it as priority 4. The FM03 (Loss of structural integrity of busbar caused by cracking of connection welds) is ranked as priority 10 by the classical FMECA, but configuration FIS01 rank this failure mode as priority 5.

The classical RPN for FM38 is obtained using the single arithmetic product between S = 8, O = 7, and D = 7, giving RPN = 392. Table 5 shows that S = 8 belongs to the risk category Severity Very High SVH, O = 7 belongs to Occurrence Probable OP, and D = 7 belongs to the risk category Detection Low DL. Instead, the fuzzy RPN is obtained from a more elaborate procedure. According to the fuzzy sets shown in Figure 5 and Figure 6 defined by the FMECA team members, the rating S = 8 means that the failure mode can be considered simultaneously as Severity Very High SVH with membership 1 and as Severity Hazardous SHA with membership 0.2857. The rating O = 7 means that the failure mode can be considered simultaneously Occurrence Occasional OO with membership 0.2 and Occurrence Probable OP with membership 0.5614. The rating D = 10 means that the failure mode can be considered as Detection Moderate DM with membership 0.0.2 and Detection Low DL with membership 0.8088. Figure 10 shows the fired fuzzy rules and the fuzzy inference mechanism for the FM38. The fuzzy rules represent the FMECA team members' risk perception regarding the risk factors previously assessed for each failure mode. The ratings for failure mode FM38 (severity S = 8, occurrence O = 7 and detection D = 7) fire the following eight fuzzy rules:

• Rule 88: If (sev is SVH) and (occ is OO) and (det is DM,) then (RPN is RH)
• Rule 89: If (sev is SVH) and (occ is OO) and (det is DL), then (RPN is RH)
• Rule 93: If (sev is SVH) and (occ is OP) and (det is DM), then (RPN is RH)
• Rule 94: If (sev is SVH) and (occ is OP) and (det is DL), then (RPN is RH)
• Rule 113: If (sev is SHA) and (occ is OO) and (det is DM), then (RPN is RH)
• Rule 114: If (sev is SHA) and (occ is OO) and (det is DL), then (RPN is RH)
• Rule 118: If (sev is SHA) and (occ is OP) and (det is DM), then (RPN is RH)
• Rule 119: If (sev is SHA) and (occ is OP) and (det is DL), then (RPN is RE)

The risk factors' fuzzy sets and fuzzy rules represent, respectively, the uncertainty and the logical reasoning of the FMECA team members. The classical RPN calculation does not include these human reasoning characteristics, so the fuzzy-based FMECA combines them to produce the output.

The failure mode FM04, loss of electrical continuity in busbar caused by arc flash, replaces the FM38 in priority 2. The severity for both failure modes is 8. The occurrence of FM04 (4) is less than the occurrence of FM38 (7), but the detection of FM04 (10) is higher than FM38 (7). In this case, the inference mechanism gives more relative importance to severity and detection when computing the FRPN due to its more defined memberships for higher values. Rules 94 and 119 completely define the resulting FIS area, and we can conclude that both rules completely explain the FRPN results.

Since the FRPN includes the characteristics mentioned above, we consider that the ranking obtained using the fuzzy FMECA is adequate regarding the assumptions introduced by the FMECA team members into the fuzzy mechanism.

6.2. Failure Modes with the Same FRPN

For the configuration FIS01, failure modes FM32, FM39, FM41, and FM42 achieve the same FRPN = 7.049 and were ranked as priority 24, 25, 26, and 27, respectively. For the FIS02, these failure modes achieve an FRPN = 7.367 and ranking 22, 23, 24, and 25, respectively. For the FIS03, these failure modes achieve an FRPN = 7.501 and ranking 25, 26, 27, and 28, respectively. Failure modes FM32 and FM39 have the same ratings for severity S = 7, occurrence O = 3, and detection D = 10. These ratings fire the following four fuzzy rules:

• Rule 59: If (sev is SM) and (occ is OVU) and (det is DL), then (RPN is RM)
• Rule 60: If (sev is SM) and (occ is OVU) and (det is DAI), then (RPN is RH)
• Rule 84: If (sev is SVH) and (occ is OVU) and (det is DL), then (RPN is RH)
• Rule 85: If (sev is SVH) and (occ is OVU) and (det is DAI), then (RPN is RH)

Considering the above-mentioned fuzzy rules, the rating S = 7 means that the failure mode can be considered Severity Moderate SM with a membership of 0.286 and Severity Very High SVH with a membership of 1. The rating O = 3 means that the failure mode can be considered as Occurrence Very Unlikely OVU with membership 0.857. The rating D = 10 means that the failure mode can be considered as Detection Low DL with membership 0.1379 and Detection Almost Impossible DAI with membership 0.7742.

Figure 7. Fired rules and fuzzy RPN (Centroid) for the FM38 – IED Control failure by Defective data processing (software error).

Figure 7. Fired rules and fuzzy RPN (Centroid) for the FM38 – IED Control failure by Defective data processing (software error).

Figure 8 shows the fired fuzzy rules and the resulting output (fuzzy and defuzzified) for the FM32 and FM39. For FM32 with S = 7, O = 3, and D = 10, the resulting output for rules 60, 84, and 85 is the fuzzy set RH fired at $\alpha$ = 0.857, $\alpha$ = 0.138, and $\alpha$ = 0.774, respectively; if we apply the max(∙) operator to aggregate these three outputs, we obtain the same area under the fuzzy set RH resulting from rule 85 (Figure 8). Then we can conclude that rule 59 and rule 85 determine the shape of aggregated output and the FRPN = 7.049 for failure modes FM32 and FM39. Failure modes FM41 and FM42 have the same ratings for severity S = 4, occurrence O = 3, and detection D = 10. These ratings fire the following two fuzzy rules:

• Rule 59: If (sev is SM) and (occ is OVU) and (det is DL), then (RPN is RM)
• Rule 60: If (sev is SM) and (occ is OVU) and (det is DAI), then (RPN is RH)

Considering the above-mentioned fuzzy rules, the rating S = 4 means that the failure mode can be considered Severity Moderate SM with membership 1. The rating O = 3 means that the failure mode can be considered as Occurrence Very Unlikely OVU with membership 0.857. The rating D = 10 means that the failure mode can be considered as Detection Low DL with a membership of 0.138 and Detection Almost Impossible DAI with a membership of 0.774.

Figure 9 shows the fired fuzzy rules and the resulting output (fuzzy and defuzzified) for FM11, FM28, and FM31. The resulting output of rule 59 is the same for FM32 and FM41. That is, the fuzzy set RM is fired at $\alpha$= 0.138. For FM41 with S = 4, O = 3, and D = 10, the resulting output for rule 60 is the fuzzy set RH fired at $\alpha$ = 0.774.

When comparing rule 85 (Figure 8) and rule 60 (Figure 9), we can see that the fuzzy set DAI with D = 10 determines the resulting output for both rules. Then the shape of the aggregated output and the FRPN = 7.049 is the same for FM32 and FM41. Figure 10 shows the aggregated fuzzy output for the failure modes FM32 (FM39) and FM41 (FM42) with the same FRPN = 7.049. The same analysis can explain the same FRPN for other failure modes with the same FRPN and similar ratings.

To reduce the existence of failure modes with equal FRPN, we can consider the following actions:

• Establish individual categories for the risk factors rankings, that is, ten categories instead of 5;
• Modify the overlapping between fuzzy categories and;
• Modify the membership function parameters or use non-linear membership functions.

Figure 11 shows a radar chart for the classical FMECA (red line), configuration FIS01 (blue line), FIS02 (green line), and FIS03 (red line). This kind of chart simplifies the comparison between the FMECA rankings for small problems. The yellow line represents the classical FMECA ranking, and the blue line represents the highest agreement ranking.

As we can evidence, the three fuzzy-based FMECA configurations produce a similar shape, that is, a similar prioritization for the failure modes.

Figure 8. Fired fuzzy rules and aggregated output for failure modes FM32 and FM39.

Figure 8. Fired fuzzy rules and aggregated output for failure modes FM32 and FM39.

Figure 9. Fired fuzzy rules and aggregated output for failure modes FM41 and FM42.

Figure 9. Fired fuzzy rules and aggregated output for failure modes FM41 and FM42.

Figure 10. Fuzzy output for the failure modes FM32 (FM39) and FM41 (FM42) with the same FRPN = 7.049.

Figure 10. Fuzzy output for the failure modes FM32 (FM39) and FM41 (FM42) with the same FRPN = 7.049.

Figure 11. Radar chart showing the ranking for the classical FMECA ranking (yellow line) and the ranking for the three proposed approaches.

Figure 11. Radar chart showing the ranking for the classical FMECA ranking (yellow line) and the ranking for the three proposed approaches.

7. Conclusions

This paper introduces the application of a fuzzy-based FMECA in the context of cyber-power grids. A case study previously analyzed using classical FMECA was selected to conduct the tests. Three configurations of fuzzy inference systems were proposed, and configuration FIS01 was further analyzed. From our results and its previous discussion, we extract the following conclusions:

1.

The use of fuzzy sets allows us to represent the uncertainty related to the expert knowledge of the FMECA team members, sometimes represented by the boundary sharpness and overlapping between risk categories;

1.

The fuzzy rules are useful to represent, in the form of “if-then” rules, the risk perception of the FMECA team members;

2.

According to the selection of the fuzzy sets and fuzzy rules, some failure modes can produce the same FRPN value;

3.

The difference in ranking obtained from the classical and the fuzzy-based FMECA depends on the defined fuzzy consequent and the rule’s firing strength;

4.

The fuzzy-based FMECA considered a different level of importance for the risk factors. In this way, failure modes previously ranked as the riskiest by classical FMECA were relocated to a most correct priority;

5.

The fuzzy systems do not have a rigid configuration and must be adapted for each problem and environment. Once the parameters of the fuzzy sets and rules capture the criteria of the FMECA team member, the fuzzy-based FMECA becomes a powerful tool for the failure modes evaluation.

Additional aspects are under development and will be included in forthcoming works:

• Definition of tailor-made risk categories and scales for the FMECA risk factors in the context of cyber-power grids;
• The use of ten risk categories to represent the risk factors;
• A sensibility analysis of the overlapping between the membership functions;
• The use of non-linear membership functions;
• The application of Type-II Fuzzy Inference Systems for the fuzzy-based FMECA analysis in cyber-power grids;
• The proposal for a statistical-based comparison method for different FMECA approaches.