System Reliability Analysis Considering Fatal and Non-Fatal Shocks

Transcription

1 System Relablty nalyss Consderng Fatal and Non-Fatal Shocks Ludong Xng, PhD, Unversty of Massachusetts, Dartmouth Prashanth Boddu, Unversty of Massachusetts, Dartmouth Yan (Lndsay Sun, PhD, Unversty of Rhode Island, Kngston Key Words: shock, relablty, Posson decomposton SUMMRY & CONCLUSIONS Systems desgned wth fault-tolerance technques are typcally subject to common-cause shocks. Falure to consder common-cause shocks n the system relablty analyss leads to optmstc results, whch makes the relablty analyss less effectve n the system desgn and turnng actvtes. In ths paper, we consder two types of common-cause shocks: fatal and non-fatal n the relablty evaluaton of fault-tolerant systems. fatal shock wll fal all components of a system, whle a non-fatal shock causes the affected components to fal wth dfferent probabltes. Herarchcal combnatoral approaches and a Markov approach have been proposed for ncorporatng common-cause shocks n the relablty analyss of statc and dynamc systems, respectvely. The bascs of the proposed approaches and effects of common-cause shocks on the system relablty are llustrated through examples. 1 INTRODUCTION Systems desgned wth fault-tolerance/redundancy technques are typcally subject to common-cause shocks [1]. xamples of common-cause shocks nclude extreme envronmental condtons, computer vruses, sabotages, power outages, desgn weaknesses, or human errors []. Shocks can be classfed nto two types: fatal and non-fatal. fatal shock (FS wll cause the smultaneous falure of all the system components; whereas when a non-fatal shock (NFS hts the system, a subset of components wthn the system wll fal and they can fal wth dfferent probabltes. Falure to consder shocks n the system relablty analyss wll lead to optmstc or overestmated results, whch makes the relablty analyss less effectve n system desgn and tunng actvtes. Therefore, t s mportant to ncorporate the effects of both fatal and non-fatal shocks n the system relablty modelng and analyss. There are many exstng common-cause shock models desgned for general computer-based systems (see, e.g., [3, 4, 5, 6]. However, most of them have assumed that the occurrence of a non-fatal shock results n the determnstc/guaranteed falure of components affected by that shock. In practce, however, the occurrence of a non-fatal shock may result nto falures of dfferent components wth dfferent probabltes. bnomal falure rate (BFR model has been used to address such probablstc non-fatal shocks [7, 8]. But ths model has three lmtatons: 1 sutable only for systems wth all component falures beng ndependent, lmtng analyss to scenaros where all the system components fal wth the same fxed probablty gven the occurrence of a shock, and 3 applcable only to systems wth s-dentcal components. In ths paper, we frst propose two combnatoral methods for ncorporatng common-cause shocks n the relablty analyss of statc systems, for whch the system falure crtera can be fully expressed n terms of combnatons of component fault events. The methods wll be herarchcal, consstng of a total falure probablty calculaton for each component at the lower level and a combnatoral analyss of relablty for the entre system at the upper level. For systems subject to dynamc behavors of functonal dependence, sequence dependence, prortes of fault events, and cold spares, Markov chan based methods have been used for the relablty analyss [9]. However, due to the smultaneousness of the occurrence of multple component falures resultng from a common-cause shock, the tradtonal Markov chan based methods, whch consder the component falures one by one, cannot be drectly appled to the relablty analyss of dynamc systems wth shocks. We propose to combne the Markov approach wth the Posson decomposton property [10] to address the above challenge. Due to the well-known state space exploson problem, the usage of the Markov model wll be kept at a mnmum level through the modularzaton technque that allows the use of the Markov approach only when necessary and retans the effcency of combnatoral solutons as much as possble [11]. The proposed methods wll elmnate the lmtatons that the exstng models have. Furthermore, our methods are able to evaluate a system subject to multple dfferent shocks. In addton, the proposed methods take nto account the cases n whch a sngle component can be affected by multple shocks. Bascs and advantages of the proposed approaches wll be llustrated through the analyses of examples. PROBLM STTMNT In ths paper, we consder the problem of relablty evaluaton of fault-tolerant systems subject to both fatal and non-fatal common-cause shocks. The followng assumptons are used n our analyses:

2 (1 system can be subject to multple common-cause shocks wth dfferent occurrence probabltes. ach nonfatal shock denoted by NFS causes ts affected component to fal wth probablty p = Pr(Component fals NFS occurs. ach non-fatal shock NFS can ht the system wth ether a constant rate of λ NFS or a fxed probablty of p NFS. ach fatal shock denoted by FS causes the determnstc falure of all the system components. ach fatal shock FS can ht the system wth ether a constant rate of λ FS or a fxed probablty of p FS. Some parametrc models, such as the Basc Parameter model, the Beta model, the lpha Factor model, and the Multple Greek Letter model, have been suggested to estmate the occurrence probabltes of common-cause shock events [1]. In ths paper, we assume p NFS, λ NFS, p FS, λ FS, and p are all gven as nput parameters. ( system component may be affected by multple shocks. In other words, a sngle component may belong to more than one common-cause group (CCG, whch s defned as a set of components affected by the same commoncause shock. 3 ILLUSTRTIV XMPLS Two examples of fault tolerant systems wll be presented n ths secton: a statc system and a dynamc system. In general, a statc system s falure crtera depends only on the combnaton of component fault events, whle a dynamc system s falure can be senstve to the order of occurrence of component fault events. dynamc system may also contan cold spares and functonal dependences [9]. The two examples wll be used to llustrate our proposed methods n Secton 4 and Secton 5, respectvely. 3.1 xample 1: Statc System Fgure 1 shows the fault tree model of a Fve Modular Redundancy (5MR system. The system fals when three or more than three modules fal. 5MR Falure [], the fault tree model of 5MR system consderng the above common-cause shock events can be constructed as shown n Fgure. Note that when the fatal shock hts the system, all the system components fal, thus the whole system fals. So the fatal shock event s connected to the top OR gate drectly. PCCF NFS 1 p 1 p 1B p 1 3/5 PCCF p C p NFS 5MR Falure B C D Fgure - Fault Tree of the 5MR System Subject to Shocks The followng parameter values wll be used n the analyss: Component falure probabltes due to s-ndependent causes: q = q B = q C = q D = q = 0.1. For smplcty, we assume all the fve components fal wth the same fxed probablty; our approach s applcable to components wth any arbtrary tme-to-falure dstrbutons. Shock occurrence probabltes: p = 0.01, p NFS = 0.0, and p FS1 = Component condtonal falure probabltes due to nonfatal shocks: p 1 = 0.3, p 1B = 0.6, p 1 = 0.7, p C = 0.6, p = xample : Dynamc System Fgure 3 shows the fault tree model of a dynamc system wth a cold standby sparng subsystem. The system fals when all the three components have faled. System Falure FS 1 3/5 B C D Fgure 1 - Fault Tree Model of the 5MR System The followng scenaro s used to llustrate the effects of non-fatal and fatal shocks: the 5MR system s subject to two ndependent non-fatal shocks and a fatal shock: NFS 1, NFS, and FS 1. The occurrence of NFS 1 would cause, B, and to fal wth probabltes p 1, p 1B, and p 1, respectvely. The occurrence of NFS would cause C and to fal wth probabltes p C and p, respectvely. The occurrence of FS 1 would cause all the fve components to fal wth probablty of 1. Thus, CCG = {, B, }, CCG NFS = {C, }, and CCG FS1 = {, B, C, D, }. Usng the PCCF gates proposed n P 1 P CSP Fgure 3 - Fault Tree of the xample Dynamc System The dynamc system s subject to a non-fatal shock NFS and a fatal shock FS. The occurrence of NFS would cause P 1 and P s to fal wth probabltes p 1 and p s, respectvely. The occurrence of FS would cause all the three components to fal wth probablty of 1. Thus, CCG NFS = {P 1, P s }, and CCG FS = {P 1, P, P s }. The followng parameter values wll be used n the P S

3 analyss: Component falure rates due to s-ndependent causes: λ P1 = 1 e-5/hour, λ P = e-5/hour, λ Ps = 3e-5/hour. Shock occurrence rates: λ NFS = 5e-5/hour, λ FS = 6e- 5/hour. Component condtonal falure probabltes due to nonfatal shocks: p 1 = 0.3, p s = HIRRCHICL COMBINTORIL PPROCHS In ths secton, two herarchcal and combnatoral approaches are presented for the relablty analyss of statc systems subject to common-cause shocks. The analyss of xample 1 (Secton 3.1 s gven to llustrate the proposed methods. In our prevous work n [], a generalzed explct method has been proposed for ncorporatng the effects of commoncause shocks nto the system relablty analyss. In that method, each shock s modeled as multple nput events, one for each component affected by the shock. For example, applyng the generalzed explct method to the example 5MR system descrbed n Secton 3.1, an expanded statc fault tree model can be obtaned as shown n Fgure 4. Specfcally, snce NFS 1 affect, B, and, t s modeled as three basc events NFS 1, NFS 1B, and NFS 1 wth probabltes of P *p 1, P *p 1B, and P *p 1, respectvely. Smlarly, NFS s modeled as two basc events NFS C and NFS wth probabltes of P NFS *p C and P NFS *p, respectvely. The fatal shock FS 1 s modeled as a basc event contrbuted to the entre system falure drectly. The analyss of the expanded fault tree n Fgure 4 gves the system relablty consderng the effects of shocks. 5MR Falure subsystem BDD gves the total falure probablty of the correspondng component. In the upper level, a system BDD s bult wth each node representng a component subsystem. Note that the effects of all fatal shocks are consdered n the upper-level system BDD generaton and evaluaton. Fgure 7 shows the upper-level BDD model of the expanded fault tree n Fgure 4. The entre system relablty can be obtaned va the evaluaton of the system BDD usng the total falure probabltes calculated at the lower level BDD evaluaton. 1-p *p q NFS 1 p *p Fgure 5 - BDD of component subsystem 1-p NFS *p 1-p *p 1 NFS 1 - q NFS 1 p NFS *p q q p *p Fgure 6 - BDD of component subsystem 3/5 FS 1 FS 1 Falure B Falure C Falure Falure B B NFS 1 B NFS 1B C NFS C D NFS 1 NFS C C C Fgure 4 - xpanded fault tree n the explct method of [] To evaluate the expanded fault tree models wth the consderaton of non-fatal and fatal shocks, a two-level bnary decson dagrams (BDD [9] based method can be used and t s referred to as Method 1 herenafter. In the lower level, a BDD s bult for each component subsystem, consderng the falures of the component resultng from both ndependent causes and all non-fatal shocks. For example, Fgure 5 shows the BDD for component of the example 5MR system, whch s subject to falures due to s-ndependent cause and one nonfatal shock NFS 1. Fgure 6 shows the BDD for component, whch s subject to falures due to s-ndependent cause and two non-fatal shocks NFS 1 and NFS. The evaluaton of each D D 0 1 Fgure 7 - Upper-level system BDD model Consder the example 5MR system n xample 1, the lower-level BDD evaluaton produces the total falure probablty of, B, C, D, and as 0.107, , , 0.1, and 0.14, respectvely. The evaluaton of the upperlevel system BDD n Fgure 7 gves the overall system unrelablty wth the consderaton of effects from both fatal

4 and non-fatal shocks as The system relablty s thus n alternatve way (referred to as Method herenafter to mplement the herarchcal approach for the relablty analyss of statc systems wth shocks s to apply the total probablty theorem for calculatng the total falure probablty of a system component at the lower level, as llustrated by the followng examples. Consder the example 5MR system n Secton 3.1. Component can fal due to ether some ndependent cause (.e., no shock occurrng or common-cause shock NFS 1. The total falure probablty of component, denoted by TF can be calculated usng the total probablty theorem as TF Pr( Pr( NFS q (1 pnfs 1p1 1 p q (1 q p p 1 1 Pr( NFS p 1 Pr( NFS Ths result matches that obtaned va the evaluaton of the lower-level BDD for component n Fgure 5. The component n the example 5MR system s subject to two non-fatal shocks NFS 1 and NFS. To apply the total probablty theorem, we construct a shock event (S space, {,,, }. ach S S1 S S3 S4 s a dstnct and dsjont combnaton of NFS events that affect component,.e., NFS 1 and NFS. Specfcally, S1 NFS 1 NFS, NFS NFS, NFS NFS, NFS NFS. Let S 1 S S 4 1 Pr(S be the occurrence probablty of S. Pr(S can be easly calculated based on the occurrence probabltes of the relevant NFS events and the s-relatonshp between the NFSs. In the example 5MR, the two NFSs are s-ndependent, we can calculate the occurrence probablty of each S as follows: Pr(S 1 = (1-p * p 1 *(1- p NFS* p, Pr(S = (p * p 1 *(1-p NFS* p, Pr(S 3 = (1-p * p 1 *(p NFS* p, Pr(S 4 = ( p * p 1 *( p NFS* p. Based on the S space, we can apply the total probablty theorem to calculate the total falure probablty of component 4 as TF Pr( S Pr( 1 S. pparently, Pr( S = 1 for =, 3, 4. In case of no NFS events occurrng, Pr( S 1 s actually q, whch s the falure probablty of resultng from ndependent causes. Therefore, we can expand the calculaton of the total falure probablty of component as: In Method, the total probablty theorem s appled at the component level; whle n the D approach, the 4 TF Pr( Pr( total probablty theorem s appled at the system level. S 1 S q *(1 p * p1 *(1 pnfs * p 1*( p * p1 *(1 pnfs * p 1*(1 p * p1 *( pnfs * p 1*( p * p1 *( pnfs * p q (1 q * p * p (1 q *(1 p 1 * p 1 * ( p NFS * p Ths result also matches that obtaned va the evaluaton of the lower-level BDD for component n Fgure 6. Based on the prevous dscussons for calculatng the total falure probablty of a component subject to one or two NFSs, we can easly extend the total probablty theorem method to components subject to any fnte number of NFSs. In general, we need to construct a S space for the component subject to m NFSs and then apply the total probablty theorem. The m NFSs wll partton the event space nto m dsjont subsets or shock events: S, = 1,,, m. The total falure probablty of the component, for example, K, s calculated as: m TF (1 Pr( K fals S Pr( S K 1 ach S n equaton (1 s a dstnct and dsjont combnaton of NFS events that affects the component K,.e., NFS 1K, NFS K,, NFS mk. ach NFS K has the occurrence probablty of p NFS *p K. In summary, we can descrbe the herarchcal method based on the total probablty theorem (Method as the followng three-step process: 1 Lower-level/component-level evaluaton: calculate the total falure probablty of each component subject to NFSs usng the total probablty theorem based method (equaton (1. Upper-level/system-level modelng: buld the fault tree model of the system wth the consderaton of fatal shocks, but wthout consderng the effects of non-fatal shocks. 3 Upper-level/system-level evaluaton: evaluate the system fault tree model bult n step usng the total falure probabltes calculated n step 1 as the component falure probabltes. In partcular, the BDD based method as descrbed n the upper-level evaluaton of Method 1 can be used. For example, evaluatng the BDD constructed n Fgure 7 wth the use of the total falure probabltes obtaned n step 1 gves the fnal relablty of the example 5MR system. Note that the proposed Method s dfferent from the ffcent Decomposton and ggregaton (D approach proposed n [13], whch s also based on total probablty theorem, n the followng two major aspects: 1 Method can handle probablstc non-fatal shocks, the occurrence of whch results nto falures of dfferent components wth dfferent probabltes; whle the D approach can only handle determnstc non-fatal shocks, the occurrence of whch results n the determnstc/guaranteed falure of components affected by the shock. Determnstc shocks are specal cases of probablstc shocks when all the condtonal probabltes p beng 1. 5 MRKOV PPROCH FOR DYNMIC SYSTMS In ths secton, we propose a Markov chan based approach for the relablty analyss of dynamc systems subject to common-cause shocks. The analyss of xample (Secton 3. s gven to llustrate the proposed method. s mentoned n the Introducton secton, the tradtonal Markov chan based methods, whch consder the component falures one by one, s not adequate for the relablty analyss of dynamc systems wth probablstc shocks. To account for the smultaneousness of the probablstc occurrence of multple component falures resultng from a common-cause shock, we propose to combne the Markov approach wth the

5 Posson decomposton property/law [10]. ccordng to the Posson decomposton property, f a Posson stream wth rate λ branches out nto n output paths or sub-streams such that each path occurs wth a fxed probablty, then these output paths are also Posson streams wth rates beng λ tmes the respectve occurrence probablty of the output path. pplyng the above property to the Markov soluton of xample, we can dvde the stream/transton representng the occurrence of NFS nto 4 output streams, each representng a dsjont combnaton of occurrence/nonoccurrence of components affected by NFS. Fgure 8 llustrates the decomposton process, where the four output paths represent that gven the occurrence of NFS, nether P 1 nor P s fals, P 1 fals and P s does not fal, P 1 does not fal and P s fals, both P 1 and P s fal, respectvely. The transton rates assocated wth those four output paths are respectvely λ NFS *(1 - p 1 *(1 - p s, λ NFS *p 1 *(1 - p s, λ NFS *(1 - p 1 *p s, λ NFS *p 1 *p s, as shown n Fgure 8. worsens the state space exploson problem of the Markov methods. s a result, t s sutable only for systems wth small sze and wth a small number of non-fatal shocks. In practce, the modularzaton technque [11] can be used to mnmze the use of the Markov model whle retanng the effcency of combnatoral solutons as much as possble. More effcent soluton wll be explored n the future work, to provde a vable soluton to the relablty analyss of large-scale dynamc systems subject to non-fatal and fatal common-cause shocks. Fgure 8 pplcaton of Posson decomposton law Fgure 9 shows the complete state transton dagram n the Markov soluton to the example dynamc system (xample, ncorporatng the effects of fatal and non-fatal shocks va the Posson decomposton law. The development of the dagram starts wth an ntal state representng all the three components (P 1, P, P S are workng. The falure of P 1 would lead to the state (P, P S meanng that both P and P S are workng, but P 1 s faled. The rate assocated wth the transton from state (P 1, P, P S to state (P, P S ncludes the falure rate due to ndependent cause (λ P1 and the falure rate due to the non-fatal shock (λ NFS *p 1 *(1-p S. From the state (P, P S we would reach state (P S when P fals, and state (P when P S fals. P can fal only due to the ndependent cause wth the rate of λ P. Snce we assumed that the cold spare component can fal n the standby condton only when t s ht by the shock, P S wll fal before the falure of P occurs. The transton from state (P, P S to state (P wll be assocated wth the rate of λ NFS *(1-p 1 *p s + λ NFS *p 1 *p s = λ NFS *p s. Smlarly other transtons and states can be developed. Note that snce the occurrence of the fatal shock would result n the falure of all the system components, thus there s a drect transton from each non-absorbng state to the absorbng state (F wth the rate of λ FS. The evaluaton of the above developed Markov chan usng the parameters provded n Secton 3., we obtan the unrelablty of the example dynamc system wth the consderaton of effects from both non-fatal and fatal shocks as The system relablty s thus major dsadvantage of the proposed soluton s that t Fgure 9 Markov chan of the example dynamc system 6 CONCLUSIONS & FUTUR WORK In ths paper, we presented methods for the relablty analyss of systems subject to fatal and non-fatal shocks. Specfcally, two herarchcal combnatoral methods based on bnary decson dagrams and the total probablty theorem were proposed for ncorporatng the effects of shocks nto the relablty analyss of statc systems; a Markov approach combned wth the Posson decomposton law was proposed for ncorporatng the effects of shocks nto the relablty analyss of dynamc systems. Future drectons of ths work nclude nvestgatng more effcent soluton to the relablty analyss of dynamc systems subject to shocks and performng more case studes on the relablty analyss of dynamc systems wth sequence dependence and/or functonal dependence. nother future work s to nvestgate the mpact of jammng attacks on the network relablty va the shock models. CKNOWLDGMNT Ths work was supported n part by the Natonal Scence Foundaton under grant CNS RFRNCS 1. S. Mtra, N. R. Saxena, and. J. McCluskey, Common-

6 Mode Falures n Redundant VLSI Systems: Survey, I Trans. on Relablty, vol. 49, no. 3, 000, pp L. Xng and W. Wang, Probablstc Common-Cause Falures nalyss, Proc. nnual Relablty & Mantanablty Symposum, (Jan Y. Da, M. Xe, K. L. Poh, and S. H. Ng, Model for Correlated Falures n N-Verson Programmng, II Transactons, vol. 36, no. 1, 004, pp Z. Tang and J. B. Dugan, n Integrated Method for Incorporatng Common Cause Falures n System nalyss, Proc. nnual Relablty & Mantanablty Symposum, (Jan. 004, pp J. K. Vauro, n Implct Method for Incorporatng Common-Cause Falures n System nalyss, I Trans. on Relablty, vol. 47, no., (June 1998, pp L. Xng, Relablty valuaton of Phased-Msson Systems wth Imperfect Fault Coverage and Common- Cause Falures, I Trans. on Relablty, vol. 56, no. 1, (Mar. 007, pp J. Borcsok, S. Schaefer, and. Ugljesa, stmaton and valuaton of Common Cause Falures, Proc. Second Internatonal Conference on Systems, K. C. Chae, System Relablty Usng Bnomal Falure Rate, Proc. nnual Relablty & Mantanablty Symposum, (Jan. 1988, pp J. B. Dugan and S.. Doyle, New Results n Fault-Tree nalyss, Tutoral Notes nnual Relablty and Mantanablty Symposum, (Jan K. S. Trved, Probablty and Statstcs wth Relablty, Queung, and Computer Scence pplcatons, John Wley and Sons, New York, R. Gulat and J. B. Dugan, Modular pproach for nalyzng Statc and Dynamc Fault Trees, Proc. nnual Relablty & Mantanablty Symposum, (Jan. 1997, pp M. Modarres, What very ngneer Should Know bout Relablty and Rsk nalyss, Marcel Dekker, Inc., New York, Chapter 6, L. Xng, L. Meshkat, and S. K. Donohue, Relablty nalyss of Herarchcal Computer-Based Systems Subject to Common-Cause Falures, Relablty ngneerng and System Safety, vol. 9, no. 3, (Mar. 007, pp BIOGRPHIS Ludong Xng, PhD Department of lectrcal and Computer ngneerng Unversty of Massachusetts, Dartmouth 85 Old Westport Road, North Dartmouth, M, 0747, US e-mal: lxng@umassd.edu Ludong Xng receved her M.S., and Ph.D. degrees from the Unversty of Vrgna (U.Va. n 000, and 00, respectvely. She s now an ssocate Professor wth the lectrcal and Computer ngneerng Department, Unversty of Massachusetts, Dartmouth. Dr. Xng served as a program co-char for I DSC 06, a program vce char for ICSS 07 and ICPDS 08, and an assocate guest edtor for the Journal of Computer Scence n 006. She s the dtor for Short Communcatons n the Internatonal Journal of Performablty ngneerng. Dr. Xng s the recpent of the I Regon 1 Technologcal Innovaton (cademc ward n 007. Her research nterests nclude dependable computng and networkng, relablty engneerng, and sensor networks. Her research has been supported by Natonal Scence Foundaton. She s an author or co-author of over 50 techncal papers. She s a senor member of I and a member of ta Kappa Nu. Prashanth Boddu Department of lectrcal and Computer ngneerng Unversty of Massachusetts, Dartmouth 85 Old Westport Road, North Dartmouth, M, 0747, US e-mal: pboddu@umassd.edu Prashanth Boddu receved her B. degree n lectrcal and lectroncs ngneerng from Osmana Unversty, College of ngneerng, Inda n 006. She s currently pursung her M.S degree n lectrcal and Computer ngneerng at Unversty of Massachusetts, Dartmouth. She has been workng as a Research ssstant under Dr. Ludong Xng snce January 007. Her area of research focuses on relablty engneerng. Yan (Lndsay Sun, PhD Department of lectrcal and Computer ngneerng Unversty of Maryland, College Park 4 ast lumn ve., Kngston, RI 0881, US e-mal: yansun@ele.ur.edu Yan (Lndsay Sun receved her B.S. degree wth the hghest honor from Pekng Unversty, Bejng, Chna, n 1998, and the Ph.D. degree n electrcal and computer engneerng from the Unversty of Maryland n 004. She s currently an assstant professor n the lectrcal and Computer ngneerng Department, Unversty of Rhode Island. Her research nterests nclude network securty and wreless communcatons and networkng. Dr. Sun receved the Graduate School Fellowshp at the Unversty of Maryland from 1998 to 1999, and the xcellent Graduate ward of Pekng Unversty n She receved NSF Career ward n 007. She s a member of the I Communcaton and Computer Socetes.