Calculation of MTTF values with Markov Models for Safety Instrumented Systems

Transcription

1 7th WEA International Conference on APPLIE COMPUTE CIENCE, Venice, Italy, November -3, 7 3 Calculation of MTTF values with Markov Models for afety Instrumented ystems BÖCÖK J., UGLJEA E., MACHMU. University of Kassel eartment of Comuter Architecture and ystem Programming Wilhelmshöher Allee 73 Germany Abstract: - This aer deals with the calculation of MTTF values with the hel of Markov models. It shows what Markov models are and how they can be utilised to achieve valid and imortant information for safety instrumented systems. In few examles the different calculations stes are resented, detailed and examined. Key-words: stochastic model, Markov model, safety related system, MTTF Introduction Probability calculation is alied to redict future events or develoment with the hel of stochastic models. Additional, it is ossible that a stochastic rocess behaves in eriodic manner. imle descrition of such relationshis was done by the ussian mathematician Andrei Andrejewitsch Markov (856-9).With so called Markov chains, it is ossible to describe and examine stochastic rocesses over a longer eriod without a lot of difficulties, which makes them very interesting to observe future events. Andrei Markov was born in jasan, ussia. He studied under Professor Pafnuti Tschebyschow (often in Literature stated as Tschebyscheff or Tschebyschev) in t. Petersburg and became member of the academy of science in 886. Markov is known for this develoed theories of stochastic rocesses. In 93, he calculated the characters sequences in ussian literature to roof the necessity of indeendency of the law of large numbers. The calculations can also be used to state the quality of shaeliness of the orthograhy of character chains. From this aroach were general stochastic tools develoed, the so called stochastic Markow rocess, which can be used to redict future events or develoments on base of current knowledge. Today s alication using hidden Markov models for voice recognition software. Markov chains and Markov inequalities are named after Andrei Markov. Basic Theory of stochastic Processes ince Markov chains are stochastic rocesses, fundamental concets and terms have to be defined and described first. A stochastic rocess describes a sequence of stochastic exeriments, which can be exressed by a function X(t) wit t T. T is the amount of all ossible oints in time of the system and is stated as arameter sace. It T ossesses only integer elements is the system time discrete and if T contains real elements the system is called continuous in time. Besides the amount of time oints, a states sace exists as well, which is often described as M or Z. The state sace is the number of states a system can occuy. These states have to be indeendent, since the system can only be in one state. If a fixed number of states exists, then the sace is discrete otherwise is it continuous. In the next few examles different architectures of Markov models will be detailed.. imle examles of Markov models A Markov models rimarily knows two system states. Either the systems is oerating, that means the system is fully functioning without errors, or the system is out of order, which means the system is in state which has a dangerous failures. tates are resented as circle and a transition is shown as a transition line as resented in Fig. tate Transition rate Fig. : eresentation of a Markov model Changes a state to another, then this will be resented with two circles and a transition line or transition arch. It has to be assured that the direction of the arrow oints towards the new state. Generally, a Markov model can have two different systems. The first system ossesses a

2 7th WEA International Conference on APPLIE COMPUTE CIENCE, Venice, Italy, November -3, 7 3 no reairable comonent the second system has a reairable element. Non reairable systems, cannot be reaired if a dangerous failure occurred, excet the faulty comonent gets exchanged. Figure shows such a system. The question might be risen how a transition from state Z to the same state Z within the time interval can be exressed. This is illustrated in equation : ( Z Z ) j k k with ( j,,,, n; k,,,, n; j k) n () ystem ystem failed Z Z Fig. : Non reairable system with Markov model The second term in equation can be simlified as: n k (3) The system ins oerating in state Z. After a certain time the system changes from state Z according to a transition rate or failure rate into state Z : the system has failed. The state Z reresents the condition, when the system is our of order. To change the condition, the system s comonent has to exchanged, since the system cannot be reaired. eairable systems, are systems which can be brought into fully oeration when after a dangerous failure occurred the system is getting reaired. Figure 3 shows such a architecture. ystem Z Fig. 3: reairable system as Markov model ystem failed After a system changes its state from Z (fully oerational) to Z (failed), the system can be brought after a certain time, here reair time, into the fully oerational state Z. In the next section the transitions will be mathematically described. 3 Mathematical descrition of state transitions The transition robability from current states to other states can mathematically be described. Migrates the state Z j within a time interval into the state Z k, then transition robability exists for the two states. This can be described as: ( Z Z ) j k Z () where as is the transition rate and it has to be valid that. When for examle then this means that the a transition for state Z to state Z is not ossible. Inserting equation 3 into equation results in: ( Z Z ) j k (4) Alying equation 4 for state Z,with a transition to the same state, results in: (5) To resent all states of a Markov model a transition matrix is used. The general form of this matrix is shown in equation 6: P n n n n nn Using the transition rates as in equations 4 and 5, equation 6 becomes: P n n n n nn With the transition matrix P all states transitions of an arbitrary Markov model architecture can be described. If no direct connection between two states exists then this will be reresented the matrix with a zero. To ensure that a transition matrix of an arbitrary Markov model is correct, all arameters can be summed u. Is the result of the summation equal to one, then the matrix is correct. It has to be mentioned that the P-Matrix as shown in equation 7 reresents the initial state of the system at T. If a transition matrix at time T3 should be (6) (7)

3 7th WEA International Conference on APPLIE COMPUTE CIENCE, Venice, Italy, November -3, 7 3 calculated then the initial P-matrix has to taken by the ower of three as shown in equation 8: ( T 3 ) P( T ) P( T ) P( T ) [ P( T ) ] 3 P (8) The next section shows how the MTTF (Mean Time To Failure) of Markov models can be calculated: 4 General mathematical descrition of MTTF MTTF stands for Mean Time To failure and gives the mean time between to failures of a system. To calculate the MTTF value for a system described with a Markov model, the transmission matrix for Markov models is necessary. The following stes are necessary to determine the MTTF for a system. First ste: etermine the Q-matrix: The reliability matrix also known as Q-matrix can be derived from the P-matrix. To determine the Q-matrix from the P-matrix some criteria has to be fulfilled and observed. Firstly, the system has to be in an oerational mode and absorbing states do not exist. econdly, the following states are excluded, which are safe states and dangerous undetected states. An absorbing state ossesses either a transition to a safe state or to a failure free state and has not other transition. Therewith the Q- matrix can be determined. econd ste: etermine the M-matrix: After the Q-matrix is established, the M-matrix has to be derived. Therefore the Q-matrix has to subtracted from the unity matrix, as shown in equation 9: M I Q (9) Third ste: etermine the N-matrix: The N-matrix is established with the hel of the M- matrix. The N-matrix is the inverse of the M-matrix as shown below: N M () [ ] Fourth ste: etermine the MTTF value To calculate the MTTF value from a system described as a Markov model the sum of all elements from the first row of the N-matrix has to be calculated. With these for stes the general MTTF calculation for Markov models is finished. 4. Examles for a P-matrix The P-matrix should be derived from the Markov model shown in Figure Z..5 Fig. 4: imle Markov model Z.5 ince the Markov model has only two states, the P-matrix has a dimension of x. The general P-matrix of this architecture is shown in equation : P () The values from Figure 4 can be inserted in equation and results in:.99. P ().5.5 The sum of each row of the P-matrix has to be always one, which is true for the resented examle and therefore the P-matrix is correct. 4. Examle for a MTTF calculation The MTTF value for the Markov model illustrated in Figure 5 should be calculated. The system has four states Z, Z, Z and Z 3. It is assumed that system is oeration in states Z, Z. ince four states exists the P-matrix has a dimension of 4x4. Z Z.5 Fig. 5: Examle of a Markov model Z..5 Z 3 Using Equation 7 the P-matrix results in:

4 7th WEA International Conference on APPLIE COMPUTE CIENCE, Venice, Italy, November -3, P (3) The next ste is to determine the Q-matrix out of the P- matrix. The condition for the Q-matrix are, that it has to be oerating states and do not have any absorbing states. ince this is true for the states Z, Z, the Q-matrix is:.973. Q (4) The next ste is to calculate the M-matrix using Equation 9: M (5) The next ste is to calculate the N-matrix from equation : N (6) Finally, the MTTF value can be calculated by summing u the first row of the N-matrix: MTTF h (7) The examle system has a mean life cycle of 7.5h hours. 5 oo-ystem as Markov Model The Markov model of a oo architecture is resented in the figure below. This model ossesses no redundant comonents and is already in a critical state, when one single comonent fails due to a dangerous undetected failure. This Markov model has four states. Every system has a initial state Z. This state is the failure free state (system ) and the system is oerating correctly. From this initial state (system ), three other states can be reached. tate Z The state system s constitutes a safe state. afe states mean that the failure or fault is safe detected. This failures does not harm the system, since it is a safe one, one can eliminate (reair) it safely and this state can be left with a transition rate. tate Z This state system has a dangerous detected failure. With the transition rate and the system can reach the failure free state. tate Z 3 The failure free state changes into the dangerous undetected state system U. This state is critical for the system. ince the system failure due to a undetected failure, the system can reach only the state failure free after the life cycle duration, which means the system has to be comletely exchanged. + ystem Z U U ystem U Z 3 ystem Z Fig. 6: oo ystem as Markov model ystem 5. MTTF calculations for a oo system Again, the calculations starts with the determination of the P-matrix: P ( + ) Z U (8) ince only one failure free state exists, the Q-matrix becomes: ( ) Q (9) The M-matrix is the unity matrix subtracted from the Q- matrix: [ ( )] ( + ) M I Q ()

5 7th WEA International Conference on APPLIE COMPUTE CIENCE, Venice, Italy, November -3, 7 34 The N-matrix is the inverse of the M-matrix and is stated as: N [ M ] ( + ) () ince equation is a matrix with dimension one, the N- matrix is equal to the MTTF value. MTTF oo N () ( + ) 6 oo ystem as Markov model The oo system has two indeendent channels. The safety function is still functioning if one channels is able to oerate. If two channels fail then the system is not functioning and therefore out of order. The next examle is going to illustrate this. In state Z both systems are in oeration (ystem ). Next, the different states are going to be described: tate Z As in the revious examle, this is the state system safe. This state can be reached from the failure free state with a transition of. The value results from the fact that the system has two indeendent channels. stands for the safe failures of the system. These failures do not resent any risk for the system. s can be divided into and U. The first are safe detected failures and the second are safe undetected failures. + (3) U With a transition rate of (reair) can the system return to the failure free state Z. (4) τ tate Z The system is in a critical situation, when it reaches this state. One system is oerating the other one is in the state of a dangerous detected failure. The state Z can be reached with the transition rates of and via the state Z. (5) τ test system is in dangerous situation, but the system cannot be reaired, since it is not known that the system is in this articular state. Therefore, one has to wait, until the life cycle or life time () is exired and the comonent is getting exchanged or the reaired. The transition rate to the initial state is. τ s (5) Additionally, the ossibility exists that a transition is carried out to state Z via the states Z 5 and Z with the transition rates and, resectively. tate Z 4, Z 5, Z 6 The remaining states are where both systems have dangerous detected failures (Z 4 ), or one system has a dangerous detected failure, while the other has a undetected failure (Z 5 ) and last state (Z 6 ) is where both systems have dangerous undetected failures. β U ystem Z ys.u ys.u Z 6 β U ystem Z U ys. ys.u Z 3 ys. ys. Z Fig. 7: oo ystem as Markov model U ys. ys. Z 4 ys. ys.u Z 5 The P-matrix can de determined, whereby the following abbreviations are used: A + β β (6) A + + (7) U A3 + + (8) The P-matrix with equation 9: U U U the abbreviations are stated in tate Z 3 One system is functioning correctly, the second is in state of dangerous undetected failure U. This means that the

6 7th WEA International Conference on APPLIE COMPUTE CIENCE, Venice, Italy, November -3, 7 35 A P β U A βu U U A 3 (9) The necessary Q-matrix is taken from the equation 9 and results in equation 3: A Q A U A (3) Equation 3 can be simlified since for this oo system described as a Markov model, τ and therefore : and equation 3 becomes: A U Q A A The next ste is to calculate the M-matrix: (3) A U M A (3) A and results in: A M U A A (33) To determine the MTTF value the N-matrix has to be comuted: N [ M] A And the final result is: A N U A A U A A A A3 A A3 (33) (34) The MTTF value can now be calculated, by taken the first row of the N-matrix: MTTF oo U + + (35) A A A A A Equation 35 resents the mean life cycle (life time) of a oo architecture derived from Markov models. 7 Conclusion The aer resented a systematic aroach from the set u of Markov models to the final ste of calculating the MTTF value, which is an imortant arameter for in the research area of safety instrumented systems. Two different architecture were examined a oo and a oo architecture. This systematic aroach can alied to different safety related architectures and systems. eferences: [] Börcsök, J.. Elektronic afety ystems. Heidelberg: Hüthig ublishing comany 4 [] Börcsök J., Ugljesa E.. Advanced oo4 hardware architectures for safety related systems, Journal WEA Transactions on Comuter esearch, Vol. 6, Issue,. 4-, IN: , 7 [3] Goble, W. M afety of rogrammable electronic systems Critical Issues, iagnostic and Common Cause trength Proceedings of the IchemE ymosium, ugby, U. K: Institution of Chemical Engineers [4] hooman, M.L.. Probabilistic reliability. McGraw- Hill. 986 [5] mith,.j.. eliability Maintainability and isk. Newnes. [6] torey N.. afety critical comuter systems, Addison Wesley