EFFICIENT STATISTICAL ANALYSIS OF FAILURE RISK IN ENGINE ROTOR DISKS USING IMPORTANCE SAMPLING TECHNIQUES

Transcription

1 EFFICIENT STATISTICAL ANALYSIS OF FAILURE RISK IN ENGINE ROTOR DISKS USING IMPORTANCE SAMPLING TECHNIQUES Luc Huyse & Michael P. Enright 2 Southwest Research Institute San Antonio, Texas Abstract In recent years, probabilistic methods have been applied to life prediction of aircraft turbine rotors to address the occurrence of relatively rare defects that can lead to uncontained engine failures. Some of these failures have been traced to metallurgical defects (e.g., hard alpha) that can form during processing of premium grade titanium. To account for these anomalies, the Rotor Integrity Subcommittee (RISC) of the Aerospace Industries Association (AIA) recommended the adoption of a probabilistic damage tolerance approach to supplement the current safe life methodology. In addition, the Federal Aviation Administration released an Advisory Circular (33.4- Damage Tolerance for High Energy Turbine Engine Rotors) introducing a probabilistic design and life management process for aircraft turbine rotors. The DARWINd * computer program computes the probability-of-fracture as a function of flight cycles, considering random defect occurrence and location, random inspection schedules, and several other random variables. The most current release, DARWIN 4.2, is available on Windows, Linux, SunOS, HP-UX and SGI IRIX platforms. Efficient estimation of small failure probabilities using either Monte Carlo or Importance Sampling techniques is a key feature of the DARWIN code. This paper describes the Importance Sampling algorithm in DARWIN Releases 4.x. In particular, the paper details how conditional samples can be generated efficiently. The accuracy of the Importance Sampling method is demonstrated through comparison of its confidence bounds with those associated with Monte Luc.Huyse@swri.org, Research Engineer Carlo simulation. The conditional samples generated by the Importance Sampling algorithm can be used () to gain additional insight into the most likely combinations of variables associated with failure, (2) to assess the probabilistic sensitivity of the failure risk to each random variable and also (3) to guide the validation efforts of the original assumptions about the PDF for each of the random variables. This is extremely efficient because it does not require the limit state be evaluated. Introduction and Background The need for probabilistic damage tolerance methods for life management of aircraft turbine rotors is well recognized. The FAA advisory circular AC (FAA, 2) recommends that a probabilistic approach be used to account for rare metallurgical anomalies (hard alpha) that may be present in titanium rotor disks. Although rare, these anomalies have led to uncontained engine failures (Figure ). Titanium Matrix Hard Alpha Defect Figure : Hard alpha inclusion in titanium matrix (Leverant et al., 997) 2 menright@swri.org, Senior Research Engineer Under the direction of the FAA, Southwest Research * DARWIN is a registered trademark of Southwest Research Institute. Institute has developed the probabilistic damage tolerance computer program DARWIN for fatigue

2 life prediction of titanium rotors and disks containing hard alpha defects. The software was developed in collaboration with a Steering Committee consisting of four major U.S. aircraft engine manufacturers (General Electric, Honeywell, Pratt & Whitney, and Rolls- Royce). Use of DARWIN is an acceptable method for compliance with AC (Enright & Millwater, 22). DARWIN s Probabilistic Approach The DARWIN computer program integrates finite element stress analysis, initial defect modeling, crack growth analysis, inspection simulation and probabilistic analysis to compute the risk of rotor disk fracture with in-service inspection. The critical source of failure is either a hard alpha anomaly in the titanium or a surface defect. This paper focuses on hard alpha defects. When a defect is present, both the initial defect size d and stress intensity factor K may increase with the number of flight cycles N. It is assumed that material failure occurs when K exceeds the fracture toughness K c for a number of cycles N less than the target service life N service. The conditional disk failure probability p F,disk,cond (assuming that a defect is present) is: p = Pr( K K ) = Pr( N N ) (),, F disk cond C service It is reasonable to assume a Poisson distribution to describe the occurrence of rare events, such as hard alpha defects. If α represents the average occurrence rate, the probability of m defects is: m α exp( α) pm ( ) = ( m=,,2,...) (2) m! The total failure probability for the disk is then: p p( m). p(disk failure m defects in disk) (3) F, disk m= Since α << (hard alpha are rare defects), this equation can be approximated using only the first term in the series expression Eq. (3) and substitution of Eq. (2) in Eq. (3) gives: p α. p(disk failure defect in disk) F, disk (4) DARWIN TM considers the following random variables related to the occurrence or detection of defects: initial defect size, location, inspection time and probability of defect detection during inspection. The distribution of the initial defects is semi-empirical and was established by the Rotor Integrity Structures Committee (AIA RISC, 997). The RISC curve defines the number of exceedances per millon pounds of titanium as a function of the initial defect size d. This curve can be converted to a cumulative distribution function (CDF): Exceeda nce s per 6 lb Ti exc( d ) exc( d ) min CDF( d ) = i exc( d ) exc( d ) min max (5) where exc(d) is the number of defects of size d or smaller per million pounds of titanium. The exceedance and CDF curves of the initial defect size distribution that is used in the application in this paper, is shown in Figure 2. Eq. (5) demonstrates that both ends of the exceedance curve bound the CDF. This is done because no information is available about the likelihood of defects beyond the recorded values. The validity of this assumption will be addressed later in the paper Exceedance CDF Initial defect size (sq. mils) Figure 2: Exceedance curve and corresponding CDF for initial defect size CDF The uncertainty associated with the finite element stress results is modeled by means of a log-normally distributed stress scatter factor B. In the impeller application in this paper a median value of. and coefficient of variation (COV) of 2% are used. The importance of the lognormal assumption will be addressed at the end of the paper. The actual stress is: σ actual = B σ (6) Considerable uncertainty may be associated with the crack growth model. Because DARWIN is intended as a practical design tool, a simple random variable model is used to represent the uncertainty associated with the crack growth law (Yang et al, 983). In the example application in this paper the life scatter factor FE 2

3 S is assumed to be lognormal with median value equal to and a 2% COV. The sensitivity of the failure risk to the lognormal assumption will be addressed at the end of the paper. The random variable model essentially adds an error band to the regression curve of the dd/dn data. For instance, for a Paris growth law, the equation becomes: dd dn ( K ) m = S C (7) where K denotes the change in stress intensity factor K over the interval dn and C and m are material coefficients associated with the Paris Law. The failure probability estimate in Eq. (4) consists of two factors. The defect occurrence rate α depends on the amount of material in a part. Consequently, a larger volume will have a proportionally larger probability of having a defect. The location of a defect will generally depend on the manufacturing process and could be anywhere in the part. Placing the defect at the life-limiting location in the part therefore represents a conservative approach. In other words, both factors in Eq. (4) are estimated conservatively. The total failure probability is therefore overestimated. A practical approach to reduce the conservatism in the failure probability estimation is to divide the disk into several zones. Each zone has its own defect occurrence rate (which depends on the volume of the zone) and conditional failure probability (which primarily depends on the local stresses and temperatures in that zone). The total disk risk consists of the union of failures in any of the zones: p n Pr( Failure in zone j) F, disk j= (8) where n is the number of zones. When α is small, the failure events can be assumed independent and for p F,disk << this is approximated as: The zone refinement approach is illustrated in the following impeller example. The FE stresses are shown in Figure 3. Blue indicates low stress values and red represents high stress values. The initial zone configuration is shown in Figure 5. The red-colored zones indicate the zones with the largest contribution to the entire disk failure probability. Comparison with Figure 3 indicates that these are the zones with the highest stresses and stress gradients. Several iterative zone refinements were performed and the final, riskconverged zone layout is shown in Figure 5. Note that it was unnecessary to refine the large zones near the right end of the impeller because the stresses are low near that end. The convergence of the total impeller risk as a function of the number of zones is shown in Figure 6. Figure 3: FE stresses in impeller model p α p(failure in zone i defect in zone) F, disk F, disk n i = n p α p (zone i) i= i i cond (9) where α i is the defect occurrence rate in zone i and n is the number of zones. For each zone i, the conditional failure probability p cond (zone i) is computed under the assumption that the defect is located at the life-limiting location. It is clear that p cond (zone i) is overestimated when the stresses vary rapidly over a particular zone. The zones must be sufficiently small to obtain an accurate estimate of the total disk failure. It can be shown that the failure probability estimate Eq. (9) converges to the exact failure risk value from above with increasing number of zones. Figure 4: Initial zone layout for impeller model 3

4 PDF (, Monte Carlo samples) 2.E-6.5E-6.E-6 5.E-7 Service Life is 2, cycles Zone of interest is at most a few percent of the total area Relative failure probability Figure 5: Risk-converged zone layout for impeller model Number of zones Figure 6: Risk convergence as a function of the number of zones (Millwater et al. 22) DARWIN s Monte Carlo Sampling Method The conditional failure probabilities per zone can be estimated using Monte Carlo simulation. Sample values of the initial defect size d, the stress scatter factor B and the life scatter factor S are generated and the service life N computed while accounting for potential in-service inspections. DARWIN has the capability to schedule inspections at random intervals. For each of these samples the limit state function K K c (see Eq. ) is evaluated and the failure probability is estimated as the fraction of failed samples..e+.e+.e+6 2.E+6 3.E+6 Predicted life given a defect occurs (cycles) Figure 7: Sample histogram of life Although easily implemented, the failure probability estimates obtained with Monte Carlo simulation are subject to random sampling error and converge only slowly to the exact failure probability. Therefore a much more efficient method, importance sampling, has been implemented in DARWIN as well. In addition, when the failure probability is small as is typically the case in structural applications most of the life calculations seem to have been done in vain because they do not result in failures. This is illustrated in Figure 7. DARWIN s Importance Sampling Method As indicated in Figure 7, huge computational gains would be achieved if one could only generate those samples that do fail. The importance sampling implementation in DARWIN achieves these gains. It is a hybrid method and combines numerical integration of the failure probability with random sampling. The method is described in more detail in Wu et al. 22 and consists of two steps:. Compute the failure probability when no in-service inspections are performed by numerical integration of the conditional failure probability p cond in Eq. (9) over all random variables for each zone: p = f ( d) f ( B) f ( S)dddBdS cond d B S failure () where d is the initial defect size, B the stress-scatter factor and S the life scatter factor, f represents the probability density functions (PDF s). The critical 4

5 defect size d* is defined as the smallest defect which will cause the disk to fail within the specified service life. To assess the effectiveness of the inspection schedule, use the results of Step to generate only those samples that will result in a life smaller than the target service life, i.e. fail, if not inspected. Limit the simulation to these conditional samples to estimate the effectiveness of the inspection.. Pr(d > d*).2 c to sc L ife s ca tt The first step of the numerical integration procedure of the conditional failure probability consists of computing the predicted life as a function of the initial defect size and the stress and life scatter factors. Because the life scales linearly with the life scatter factor (see Eq. 7), this response surface can be reduced to a function of only two variables (see Figure 8). ss 2.2 () a tt er fa..2 re pcond = Pr( d d *) f B ( B ) f S ( S )dbds.4 r By definition, the failure domain in the probability integral in Eq. is limited to the defects that exceed the critical defect size. Equivalently, Eq. can be rewritten:. e r fa c St 2. to r Figure 9: Exceedance probability of the critical defect size According to Eq., the conditional failure probability pcond in a zone is equal to the integral of the exceedance probability in Figure 9 over the stress and life scatter factors (see Figure and Figure ). To ensure an accurate integration of the total probability, the integration domain for the life and stress scatter factors in DARWIN is [-5σ, 3σ] and [-3σ, 5σ] respectively where σ is the standard deviation. 6 5 Pre dic ted life S tr ess Pr(d > d*) f B(b) f S(s) s ca tt e r fa c to r.22 s iz D e fe c t c a le ) e (lo g s S t.25 re ss sc at te.5 rf ac to. r Figure 8: Predicted life response surface The critical defect size d*, associated with each value of the life and stress scatter factors, can subsequently be computed from this response surface. The critical defect size is then plugged into the cumulative distribution function (Figure 2) of the initial defect size to determine the exceedance probability of the critical defect size as a function of the life and stress scatter factors (see Figure 9)..4 L. ca t ife s.2 a ct te r f or Figure : 3D Plot of the integrand in Eq., used for the computation of the failure probability without inspection 5

6 Stress scatter factor Pr(d > d*) f B (b) f S (s) Median value Life scatter factor Figure : Contour plot of integrand in Eq. To assess the effectiveness of the inspection schedule, subsequently generate samples for the initial defect size and the stress and life scatter factors that fall inside the failure domain. The efficient generation of conditional samples in a general purpose Importance Sampling tool is by no means a trivial task (Au and Beck, 22). However, due to the nature of the numerical integration scheme for the failure probability without inspection, the conditional probability density functions, required for the cases with inspection, are readily obtained in DARWIN : Integration of Figure over the stress scatter factor B results in a conditional likelihood curve for the life scatter factor S from which, upon appropriate scaling, a conditional life scatter factor S i is sampled using the inverse CDF method. This value S i is plugged into Eq. and a sample stress scatter factor B i can be obtained from the following likelihood curve: Pr( d d* S ) f ( B) f ( S ) i This conditional likelihood curve for the stress scatter factor B is obtained by setting S = S i in Figure. The exceedance probability Pr(d > d* B i, S i ) corresponding to the sample values S i and B i is shown in Figure 9. This exceedance probability value determines the critical defect size d* through the initial defect distribution (see Figure 2). A sample initial defect size d i is subsequently generated from the PDF f d (d), which is truncated and rescaled to include only defect values d > d*. B B i e-7 e-6 e-5 e-4 e-3 e-2 e- e+ e+ The conditional sample values d i, B i, and S i are subsequently used to assess the life when in-service inspections are performed. Figure 2 illustrates that each of these samples results in a failure if no inspection is performed (the target service life is 2, cycles in this example). PDF (,, Importance samples) 9.E-5 8.E-5 7.E-5 6.E-5 5.E-5 4.E-5 3.E-5 2.E-5.E-5.E Predicted life (cycles) Figure 2: PDF of the service life for the conditional samples used in importance sampling Figure 3: Location of Zone 2 in FE model Verification of the Importance Sampling Results The Monte Carlo results are an unbiased estimator for the true failure probability. Unfortunately, the estimator converges rather slowly to the true failure probability and requires a lot of samples when the probability is small. Provided that the importance sampling density 6

7 covers the entire failure domain (which is the case in DARWIN ), the importance sampling results are also unbiased (Madsen et al, 986). Figure 4 shows the conditional failure probability p cond (Eq. 9 or Eq. ) for a surface zone of an impeller. The definition of the idealized rectangular plate used for the fracture mechanics computations is shown in Figure 3. Figure 4 demonstrates the improved accuracy of the Importance Sampling algorithm in DARWIN 4.x. Sufficient samples were used (see next section on confidence bounds) to remove the statistical uncertainty (due to sampling) from the failure probability estimates. Conditional Failure Probability in Zone ,, Monte Carlo, IS in Darwin 4.x, IS in Darwin 3.x Number of flight cycles Figure 4: Improved accuracy of the importance sampling (IS) algorithm in DARWIN 4.x Confidence Bounds As outlined above, simulation methods generate only a statistical estimate of the actual failure probability. When the seed value for the random number generator is altered the simulator generates a different sequence of random numbers, which results in a slightly different estimate for the failure probability. The extent of this statistical uncertainty decreases when the sample size increases. Confidence bounds for the Monte Carlo simulation were introduced in the 3.5 release of DARWIN. The Coefficient of Variation (standard deviation divided by mean value) of the Monte Carlo estimate is given by: COV (2) p N F sample The 95% confidence bounds associated with a Monte Carlo simulation using, samples of the impeller model (Figure 3) are shown in Figure 5 (unconditional failure probability results for all zones in the impeller). These bounds have a width equal to.96 standard deviations on either side of the mean and are included to estimate the uncertainty or accuracy associated with sampling-based probabilistic methods. As shown in Figure 6, failure probability estimates vary depending on the initial seed value used in the random number generator. Since a range of values is possible, confidence bounds are often provided to specify a range values in which the exact value can be found. Failure Probability for Rotor Disk Probability Density 2.e-6.8e-6.6e-6.4e-6.2e-6.e-6 8.e-7 6.e-7 4.e-7 2.e-7.e+ Monte Carlo Sampling (, samples) Without inspection With inspection Number of Flight Cycles Figure 5: Monte Carlo confidence bounds for impeller model confidence bound and PDF of failure probability estimate using Seed True value Failure probability confidence bound and PDF of failure probability estimate using Seed 2 Figure 6: Uncertainty associated with failure probability estimates for two different seed values In the DARWIN 4. release, confidence interval values were added for the Importance Sampling method. Provided that the numerical integration of the 7

8 failure probability without inspection, p F,tot,wo (Step ), is performed with sufficient accuracy, the uncertainty associated with p F,tot,wo is negligible. The COV associated with the Importance Sampling estimate is: COV p F, tot, wo (3) p N F sample When p F,tot,wo is small, the COV of the importance sampling estimate will be substantially smaller than the COV of a Monte Carlo estimate for equal number of samples N sample. For typical values of p F,tot,wo, the Importance Sampling method typically needs about times fewer samples than the crude Monte Carlo method to achieve comparable accuracy. Figure 7 shows the Importance Sampling confidence bounds for the impeller model obtained after only samples. Comparing Figure 5 and Figure 7, it can be observed that the Importance Sampling confidence bounds are slightly narrower than those associated with the Monte Carlo simulation, indicating a more accurate solution. In addition, since this accuracy is achieved using times fewer samples, this illustrates the computational efficiency associated with Importance Sampling. Failure Probability for Rotor Disk 2.e-6.8e-6.6e-6.4e-6.2e-6.e-6 8.e-7 6.e-7 4.e-7 2.e-7.e+ Importance Sampling ( samples) Without inspection With inspection Number of Flight Cycles Figure 7: Importance sampling confidence bounds for impeller model Failure Analysis of Samples For a general purpose Importance Sampling tool, not all samples will lead to failure. Sampling results of most general Importance Sampling algorithms include samples that fall outside the failure domain. The efficiency of the Importance Sampling tool directly depends on its capability to generate only failing samples (see Madsen et al., 986). In the specific implementation of Importance Sampling in DARWIN, described in this paper, all importance samples belong to the failure domain because they are generated directly from the conditional PDF s, given that disk failure will occur within the target service life if no inspections are performed. Because the importance sampling densities are identical to the conditional density given that failure occurs, they can be used to expediently identify the most likely failure combinations for all random variables. It is important to understand that this information can be obtained without evaluating the limit state function. In the impeller application, the probabilistic analysis is limited to the effect of three random variables: initial defect size, and the stress and life scatter factors. These three random variables are assumed to be mutually independent. The defect distribution is semi-empirical and both the life and stress scatter factors have a lognormal PDF with COV of 2%. The complete joint PDF is a function of all three variables and cannot be visualized in 2D. Figure 8 and Figure 9 show the three bi-variant joint histograms that are obtained when any two of the three random variables are selected: a) life scatter factor vs. initial defect size, b) stress scatter factor vs. life scatter factor, and c) stress scatter factor vs. initial defect size. Note that the histograms with defect size do not have the typical contour shape because the initial defect size is plotted on a logarithmic scale. The histograms were obtained on a grid of 5 by 5 bins using million simulations. The number of samples in each bin is indicated in the legend of Figure 8 and Figure 9. The bi-variant histogram in Figure 8-b is effectively a sample representation of the continuous bi-variant PDF shown in Figure and Figure. The bi-variant histograms that are used for importance sampling are shown in Figure 9 and the most probable combinations of the defect size, life and stress scatter factor that lead to failure can readily be identified. A conditional failure analysis can be performed quickly through a visual comparison of Figure 8 and Figure 9. The following observations are made: The life scatter factor range of interest does not differ much between the conditional (Figure 9-a and Figure 9-b) and original (Figure 8-a and Figure 8-b) densities. This suggests that the failure probability is not very sensitive to the life scatter factor in this example. 8

9 Histogram obtained from,, samples Histogram obtained from,, samples Life scatter factor.2. Life scatter factor a) Initial defect size (log scale) Histogram obtained from,, samples a) Initial defect size (log scale) Histogram obtained from,, samples Stress scatter factor.5 Stress scatter factor.5.. b) Life scatter factor Histogram obtained from,, samples b) Life scatter factor Histogram obtained from,, samples Stress scatter factor.5 Stress scatter factor.5.. c) Initial defect size (log scale) Figure 8: Bi-variant histograms of samples drawn from the entire domain for d, B and S c) Initial defect size (log scale) Figure 9: Bi-variant histograms of conditional samples drawn from failure region only 9

10 The conditional histograms in Figure 9-a and Figure 9-c clearly show that failures are more likely for moderately small initial defects. Even though extremely small defects are plentiful (see Figure 8-a and Figure 8-c), they do not cause failure before the specified service life (2, cycles). Extremely large defects on the other hand, although guaranteed failures, simply do not occur frequently enough to significantly contribute to the zone failure risk. The failure risk is highest when the initial defect size is approximately sq. mils. This suggests that validation efforts for the initial defect distribution should be concentrated on that region. The data also confirm that the truncation of the initial defect distribution (see Figure 2) does not unduly influence the results. Comparison of Figure 8-b, Figure 8-c, Figure 9-b and Figure 9-c indicates that failures predominantly occur for larger stress scatter values. Because the failure risk seems to depend a lot on the precise shape of the right tail of the stress scatter PDF, we recommend additional verification of the validity of the lognormal distribution assumption for the stress scatter factor. Figure 8-c and Figure 9-c clearly show the strong impact of the stress scatter factor. For moderately small initial defects, say square mils, failure will occur only if the stress scatter factor is significantly greater than the median value of.. The required stress scatter value to cause failure decreases as the initial defect size increases (Figure 9-c). Although the numerical results only apply to the specific impeller problem, multiple benefits are associated with this type of failure analysis: The conditional histograms can be generated very efficiently because there is no need to evaluate the limit state function. This results in substantial computational savings. This benefit is a specific feature of the importance sampling implementation in DARWIN. The conditional failure histograms provide the engineer with valuable information regarding the most likely combination of input variables that causes failure (similar to the MPP in FORM). The conditional histograms indicate the important range for each of the random variables and can be used to guide the validation efforts of the original PDF assumptions. The degree to which the original and the conditional histograms differ can be used as a measure of the relative sensitivity of the failure probability to this variable. Summary: This paper documents some of the recent improvements in the probabilistic methods available in the DARWIN software for the evaluation of rotor integrity. The paper describes how the general purpose Importance Sampling method was tailored to this particular application field. The impeller example illustrates the improved accuracy of the algorithms through verification of the results against Monte Carlo simulations. The confidence bounds indicate the advantage of using the Importance Sampling method versus pure Monte Carlo simulation. The Importance Sampling algorithm in DARWIN TM is extremely efficient because the importance sampling densities coincide with the conditional failure densities. An analysis of the conditional failure densities can be used to gain additional insight into the most likely failure combinations, assess the probabilistic sensitivity of the failure risk to each random variable and also guide the validation efforts of the original assumptions about the PDF for each of the random variables. The conditional densities can be generated very quickly and efficiently because there is no need to evaluate the limit state function. Acknowledgements The Federal Aviation Administration supports this work under Cooperative Agreement 95-G-4 and Grant 99- G-6. The authors wish to thank the FAA Technical Center project managers, Bruce Fenton and Joe Wilson for their continued diligence and encouragement and Tim Mouzakis of the FAA Engine and Propeller Directorate for his continued support. The authors would also like to acknowledge Dr. Y.-T. (Justin) Wu and Prof. Harry R. Millwater Jr. for their pioneering work in this field. References. Yang et al., 983, Statistical Modeling of Fatigue- Crack Growth in a Nickel-base Super-alloy, Journal of Engineering Fracture Mechanics, 8, Aerospace Industries Association Rotor Integrity Subcommittee, 997, The Development of Anomaly Distributions for Aircraft Engine Titanium Disk Alloys, 38 th AIAA SDM Conference, , Reston, VA.

11 3. Y.-T. Wu, M.P. Enright, H.R. Millwater, G. Chell, C. Kuhlman, G.R. Leverant, 2, Probabilistic Methods For Design Assessment Of Reliability With Inspection (DARWIN TM ), 4 st AIAA SDM Conference, Atlanta, GA. 4. G.R. Leverant, D.L. Littlefield, R.C. McClung, H.R. Millwater, Y.-T. Wu, 997, A Probabilistic Approach To Aircraft Turbine Rotor Material Design, ASME International Gas Turbine & Aeroengine Congress, Paper 97-GT Federal Aviation Administration, 2, Advisory Circular - Damage Tolerance for High Energy Turbine Engine Rotors, U.S. Department of Transportation, AC 33.4-, Washington, DC. 6. M.P. Enright, H.R. Millwater, 22, Optimal Sampling Techniques for Zone-Based Probabilistic Fatigue Life Prediction, AIAA Paper , 43 rd AIAA SDM Conference, Denver, CO. 7. H.R. Millwater, M.P. Enright, S.H.K. Fitch, A Convergent Probabilistic Technique For Risk Assessment Of Gas Turbine Disks Subject To Metallurgical Defects, AIAA Paper , 43 rd AIAA SDM Conference, Denver, CO. 8. National Transportation Safety Board, 99, Aircraft Accident Report - United Airlines Flight 232 McDonnell Douglas DC-- Sioux Gateway Airport, Sioux City, Iowa, July 9, 989, NTSB/AAR-9/6, Washington, DC. 9. Y.-T. (Justin) Wu, M.P. Enright, H.R. Millwater, 22, Probabilistic methods for Design Assessment of Reliability with Inspection, AIAA Journal, 4(5), H.O. Madsen, S. Krenk, N.C. Lind, 986, Methods of Structural Safety, Prentice-Hall, Englewood Cliffs, NJ.. Au, S.K., Beck, J.L. (2). Estimation of small failure probabilities in high dimensions by subset simulation, Probabilistic Engineering Mechanics, 6(4),