Operational reliability calculations for critical systems

Transcription

1 Loughborough University Institutional Repository Operational reliability calculations or critical systems his item was submitted to Loughborough University's Institutional Repository by the/an author. Citation: GOODALL, R.M., DIXON, R. and DWYER, V.M., 6. Operational reliability calculations or critical systems. IN: Sixth IFAC Symposium on Fault Detection, Supervision and Saety o echnical Processes, singhua University, P.R. China, Aug 9 - Sept st Additional Inormation: his is a conerence paper. he deinitive version is available at: Metadata Record: Publisher: c Elsevier Please cite the published version.

2 his item was submitted to Loughborough s Institutional Repository by the author and is made available under the ollowing Creative Commons Licence conditions. For the ull text o this licence, please go to:

3 OPERAIONAL RELIABILIY CALCULAIONS FOR CRIICAL SYSEMS Roger Goodall, Roger Dixon, Vincent M Dwyer Electronic and Electrical Engineering Department Loughborough University, LE U, UK r.m.goodall@lboro.ac.uk Abstract: Reliability theory deals with the eect o mean time to repair upon overall system ailure rates, but or critical systems such calculations are not what is required because an important perormance criterion relates to operational ailures, which are undamentally dierent to unsae ailures: essentially they are the result o the system-level response to avoid unsae ailures. his paper introduces the particular problem or critical systems in general, presents an analysis o some o the relevant conditions and provides some simulation results in the context o a railway active suspension application that illustrate the overall eects and trends. Copyright 6 IFAC Keywords: Reliability analysis, ault tolerance, railways, saety analysis. INRODUCION In critical systems parallel/unctional redundancy is used to ensure continued operation in the present o aults, the objective being to accommodate aults such that they don t cause unsae system ailures, probabilistically determined to be consistent with the speciied saety integrity level (BSI, Jesty and Hobley ). In practice ault monitoring is included such that remedial action is taken to avoid unsae conditions, or example when one more ault would cause a system ailure i.e. an aircrat landing at the nearest airport, a train running at reduced speed or stopping completely, an adaptive cruise control system in a car identiying the problem and handing responsibility back to the driver. All these can be classiied as operational ailures because the intended schedule or operational state can no longer be sustained, and the corresponding level o operational reliability is clearly an important system-level perormance indicator. It is thereore necessary to distinguish between the mean time between actual (i.e. unsae) ailures (MBF) and the mean time between operational ailures (MBOF). he ormer will typically be required 8 9 hours or modern high-intensity systems (SIL4), i.e. so high that one would not normally expect to encounter such a situation within the working lie o a particular system or set o systems. he latter will inevitably be substantially lower and will relect the service quality that must be provided.. OPERAIONAL RELIABILIY DEFINIION In practice, i a single ault causes an unsae condition then some level o unctional replication or redundancy is essential. his will usually ensure a satisactory level o saety but always compromises reliability in some manner. he well known ormula MBF/(MBF MRR) takes account o repair time to predict system availability, but this is dierent rom operational availability because or a ault-tolerant system with redundancy operation continues while the repair is being eected. With a duplex system, i either o the channels ails then this then represents an operational ailure or a saety critical system unless o course the probability o the second channel ailing beore the irst channel has been repaired is suiciently low to meet the speciied probability o an unsae ailure. In practice triplication is required, in which case the ollowing paragraph deines the problem to be solved: A system consists o three identical and independent units, each o which is working under the same conditions. Each unit has a constant ailure rate. When any one unit ails, it is repaired in a ixed time. An operational ailure occurs i, ater any unit has ailed, a second unit ails within a time, such that then there would only be one o the three units let operating (and is thereore potentially unsae). What is the mean-time until the system irst ails?

4 he paper also analyses the situation or a quadruplex system, in which case an operational ailure occurs i there are two urther ailures beore the irst unit has been repaired. It should be emphasised that the basic elements in a critical system will oten be so-called Line Replaceable Units (LRUs). In general these will not be repaired: there will be a stock o unctioning units that the maintenance engineers can use to replace the ailed unit (which may subsequently be repaired in the background). In this paper we have continued to use the word repair, even though in practice it will usually mean replace. In terms o existing approaches, one way is to identiy the most critical component in the system, and then calculate the probability o ailure o the system with this component removed. However this gives a pessimistic assessment o reliability because it does not allow or repair and thereore is not considered urther in this paper. In general the problem comes under the category o "k out o N" reliability problems in which o N units, N - k units are redundant, e.g. (Moustaa ). wo scenarios are considered here: (i) Ater a unit ails it takes some time to be repaired. his standard view models the situation in which the train is still operational while the repairs are being undertaken. I other units ail during this time the overall system may become operationally unsae. Repair times are assumed to ollow some general distribution (). We also consider the speciic examples o (a) the exponential distribution, which has been considered by many authors and may be solved by the Chapmann- Kolmogorov technique, e.g. [], (b) the case o ixed replacement times where is constant. riplex and quadruplex systems i.e. out o and out o 4 systems, are suiciently simple to allow a general analysis. (ii) Additionally we consider the case o a ixed maintenance schedule in which maintenance periods are scheduled at intervals o time, during which the train is assumed to be non-operational. It is assumed that all existing ailures are ixed during this down time. his latter case is probably more realistic in practice and provides an interesting alternative to the more usual methods.. ANALYSIS his section presents the operational reliability calculation techniques. It has been carried out or both triplex and quadruplex systems, the ormer resulting in a closed orm solution, the latter requiring a numerical solution o the equations. Both analyses have been validated by means o simulation, which also shows the ailure probability distribution with time. In all cases a constant ailure rate giving an exponential distribution has been assumed, although the analyses can readily be conducted or other ailure scenarios.. riplex system We consider irst the case o a triplex system in which the ailures o each unit are described by independent, identical (iid) exponential distributions with a constant ailure rate λ. wo classes o repair strategy are considered. he irst assumes that repair times or the three units are described by the same general iid probability distribution unction (pd)(); speciic examples also considered here are the well known case o an exponential repair time distribution o constant repair rate µ, and the case o a constant repair time. O particular interest to the current work is the case in which repair times are generally much smaller than ailure times... Arbitrary repair time distribution. he system is described by a state machine with parameter S, equal to the number o units currently in repair. he system starts, at time t, in state S, with all units operational, Fig. (). When a component ails it moves to state S with a repair time o. Provided that there are no urther ailures it will progress through this state returning to S ater a time. I a urther ailure occurs it will progress to the ailure state S. he state diagram approach works because the MBOF can be conditioned, on the irst and then subsequent ailures. Suppose that the pd or the system ailure time is t (t ), the pd or the system ailure time given that the irst ailure occurred at t is t (t t ) and the pd or the time o the irst ailure is t (t ). he MBOF may then be written generally as t t (t t t )dt (t t )dt t dt t t (t t )dt t (t t ) t t (t )dt () Now, i the ailure rate is ixed, it is clear that the value o t (t t ) depends upon t and t only through terms in z (t t ), the additional time to system ailure ater the ailure o the irst unit. hus t (t )dt (t z) (z)dz t z (z) dz () z As t (t ) λexp(-λt) in this case, the irst term in eqn () is simply (λ) -, while the second term is the expected additional time to ailure, ater the irst unit ails. I we suppose that the repair time or the ailed unit is, then with probability exp(-λ), there will be no more ailures in the time interval (, ) and the system will be restored to state S ater the extra time. Alternatively i there is another ailure, the system will enter the state S o operational ailure. his will occur with probability exp( λ). Given that a ailure occurs in that interval, the expected extra time to ailure (given repair time ) is z

5 t λexp( λt) t dt exp( λ) x tλexp( λt)dt exp( λ) () Combining eqns () and () we obtain ( ) λ λ λ λ t t exp( ) texp( t)dt (4) t λ S exp( λ) exp( λ) λ Fig. State transitions or the triplex system. In the special case that all repair times are equal, t is independent o and t t. hus eqn (4) gives exp( λ) λ λ t (5) exp( λ) λ( exp( λ)) λ Notice that in the limit o we obtain the expected result that t 5/ 6λ and in the limit o small ( λ) λ t ~ (6) 6λ 6λ In the case o more general repairs with repair time distribution () we obtain 5 ~ (λ) λ t t ( )d 6 λ (7) ~ (λ) ~ where is the Laplace ransorm o (). In particular, or the exponential repair case o ( ) μexp( μ), eqn (7) reduces to 5( μ λ) μ 5 μ λ t (8) λ 4λ 6 6λ which can be conirmed using the usual imbedded Markov methods and the Chapmann-Kolmogorov equations, see e.g. Rausand and Hoyland. Expanding the Laplace ransorm around small repair times ~ (λ) ( )exp( λ)d ~ λ λ... (9) Repair time Repair time dt S S Repair time - dt Repair time eqn (7) becomes approximately λ λ t ~ ( λ λ / ) λ λ 6λ () which agrees with eqn (6) or a ixed repair time, i.e. () δ( - )... Deined maintenance schedule As a comparison we consider also the case o a ixed maintenance schedule. his assumes that units are working continuously between maintenance periods regularly spaced days apart. his strategy is more representative o what occurs in many practical situations and, provided that repairs are conducted during these periods, requires no speciic knowledge o the repair time distribution. It is a simple matter to allow the schedule periods to be stochastic and is useul as it allows us to see the eect, on the MBOF, o missed maintenance periods. o do this we condition the MBOF on the length o time beore the next scheduled maintenance. hus, in general, t dt t (t ) ()d t ()d t (t )dt t G(t ) ()d () where G(t ) is the mean time to ailure given that the next maintenance is in time. As all units are assumed to be ixed during the maintenance period, our concern is only whether or not the system ails in time t. I it does not then it is returned to state S at time t which will occur, i the ailure rate is constant, with probability p exp(- λt) exp(-λt)( exp(-λt)). Failure occurs with probability ( p) and occurs ater a time t t( exp( λt) exp( λt) )dt () p hus we can write in a similar ashion to eqn (4) G(t ) ( t )p t ( exp( λt) exp( λt) ) exp( λ) t ( exp( λ) exp( λ) ) λ exp( λ) λ () Again in the case that is constant G (t ) t and eqn () may be rearranged to give 5 exp( λ) exp( λ) λ t 6 exp( λ) exp( λ) (4) 5 5 exp( λ) exp( λ) 6 6 exp( λ) exp( λ) Clearly in the limit o we again obtain the expected result that λ t 5/ 6 and in the limit o small 5 λ 5 λ t ~ (5) λ λ 9 Finally, with a stochastic maintenance schedule, combining eqns () and () yields ~ ~ 5 9F(λ) 4F(λ) λ O( λ ) λ t ~ ~ ~ 6 F(λ) F(λ) λ 5λ (6) λ / ( ) 5λ dt

6 where F ~ is the Laplace ransorm o (). Fig. State-transition diagram or quad system. Suppose, or example, that % o the maintenance he details o the analysis o this case can be ound periods are missed so that in Dwyer, et al. he equivalent expressions o eqn ().9δ( ).δ( ) (7) (4) in the triplex case, in this case, is: exp( λ) Eqn (6) then gives G( ) t t exp( λ) 4λ λ (9) 8.5λ λ t.9λ.9 dδexp( Δ) (y')h(x Δ,y')dy' (8) which decreases the MBOF by around 5%. where exp( w) H(y, y') exp( w)g( y y' ) (). Quadruplex system or w min(y,y ). For the case o exponential repair For quadruplex systems the analysis is much the ( ) μexp( μ), Laplace ransorming eqns (9) same, although now the system can continue running and () provides the same result as the imbedded in the state S. In the case o ixed repair times, Markov method and the appropriate Chapmanailing units go into and come out o repair in the Kolmogorov equations, giving a value o MBOF o same order, while or a general repair time 5μ μ distribution this may not be the case. he state λ t () λ λ representation is still appropriate although, except or For the case o a ixed repair time eqns (9) and () the case o exponentially distributed repair times combine to produce with constant repair rate μ, the Markov method cannot be used as the transition rates between states λg(x) λg()exp( λx) exp( λx) exp( λx) also depend upon the remaining repair times or x 5 those objects still in repair. he state transition λexp( λx) dw exp( λw) λg( w) 6 diagram is shown in Fig. and is o M/G/ type (Cassandras and Laortune). his is more complex () than the triplex case as H(y, y ), the additional time together with the condition to ailure given that two units are in repair with λ MOF λg() λg( ) () remaining repair times y and y, is also required. 4 Note that the parameterized states S and S which expresses the act that i there is no time let have been condensed or the sake o brevity. In until the repair is inished, the extra time to ailure reality the state S is identical to that in Fig., will be equal to the MBOF. he closed orm while the state S is a two dimensional version analytic solution to the integral equation, eqn (), and would be represented by a checker board using does not have a simple orm (Dwyer et al). the same sort o representation. Moreover, the Fredholm equation is numerically stable and may readily be solved iteratively. For large values o λ the result is the expected value o S /4λ /λ /λ /λ, while or small λ we can expand eqn () to give Unit ails ater time hree good units 7 λ t ~... (4) (t, t dt) w.p. survive repair time x λ 4λ 4λexp(-4λt)dt w.p. exp(-λx) he, validity o the numerical solution to eqn () and the accuracy o the approximation, eqn (4), is demonstrated in Fig. () wo good units survive repair time y w.p. exp(-λy ) S Repair time x. S Repair times y < y time t. System Failure Unit ails ater extra time (δ, δ dδ) w.p. λ exp(-λδ) dδ Unit ails ater extra time (φ, φ dφ) w.p. λ exp(-λφ) dφ Finally with the repair schedule described in section..ii, the appropriate results are, or a ixed maintenance period, exp( λ) exp( λ) exp( λ) λ t 4 exp( λ) 5exp( λ) exp( λ) 9 ~... 4λ 6λ (5) or small λ, while or a stochastic period given by pd F () ~ 8 ~ ~ F(λ) F(λ) F(4λ) λ t 4 ~ ~ ~ (6) 6F(λ) 8F(λ) F(4λ) ~ 4λ 4 9λ / 4

7 In this case missing % o the scheduled repair periods will lower MBOF by around 5%.. Comparison For the saety-critical systems under investigation here, the expected repair times, or the expected maintenance period, will be signiicantly smaller than the expected ailure times so the region o interest is that o small values o ε equal to λ or λ. Comparing eqns (5, 8,, 5) with eqns (, 4, 5, 6) it is clear that, in this limit, the λmbof o triplex systems ~ / λ, while or quadruplex systems, λmbof ~ / λ. For higher order redundancy, N-plex systems, one would expect a N N behaviour o ~ λ. For a value o ε., the quadruplex system has a MBOF o around 5 times that o the triplex system. A scheduled maintenance scheme with a maintenance interval o gives the same MBOF as a scheme which ixes ailures with a constant repair time. Conversely, ixing ailed items with a constant repair time o / is equivalent to a proposed maintenance schedule o ixed period. Fig. Numerical solution to eqn () 4. AN ENGINEERING EXAMPLE (ACIVELY- CONROLLED RAILWAY BOGIE) 4. Problem description he work described in the paper is motivated by research into active suspension technology applied to railway vehicles (Goodall et al 5). Some types o active suspension are not critical systems, or example when they are just used to improve ride quality they can simply be switched o in case o a ault. However, when the active control technology is applied to control the wheels and wheelsets to provide steering and/or stability control o the running gear, a ailure is likely to cause an unsae condition such as derailment o the train. A typical modern train will on average operate or 5, hours (typically 8,km o operation, depending upon the type o service) beore a ault interrupts its operation, and so the MBOF due to the additional active suspension equipment needs to be speciied as 5, hours or higher, i.e. such that it has only a marginal impact upon the overall train casualty rate. he situation has been analysed or equipment having a MBF o 4 days (, hours) which is considered typical or a unction involving sensor, processor and power electronics. A repair time o 7 days (i.e. a weekly maintenance schedule), is used. With a weekly schedule, the appropriate results are given in eqn (5) or triplex systems and eqn (5) or quadruplex. For λ 7/4, eqn (5) gives λmbof 4/, thus MBOF 8 days or around, hours. By contrast, eqn (5) gives λmbof (4/7) /4 86, so MBOF 8 6 hours. his implies that the reliability o a triplex suspension, with weekly maintenance, will aect the train s overall reliability somewhat, whereas a quadruplex suspension will essentially have no impact. 4. Results For the parameter values listed in section 4., the MBOF values corresponding to the leading order expressions are listed in able, and their corresponding numerical values or the railway example are given in able. o acilitate comparison the period o the maintenance schedule is assumed equal to the mean repair time. able Expressions giving MBOFs riplex Quadruplex General Distribution --- 6λ 6 Chap-Kolm 5 5 Mean time 6λ 6 λ λ /µ Fixed 7 6λ λ 4λ Scheduled 5 9 Maintenance λ 9 4λ 6λ able Values o MBOFs riplex Quadruplex General ~, h ~,, h Distribution Chap-Kolm 4,57 h,5,45 h Mean time /µ Fixed,67 h,9,7 h Scheduled Maintenance 97,58 h 8,76,499 h he analysis discussed above does not give the ailure probability distributions, and so a simulation experiment has been developed to provide the distributions. he simulation uses time-stepping loops with an assessment being made at each timestep as to whether an individual unit has ailed (the ailed units will then be returned to ull health once the repair period is complete). I, in the case o the triplex system, two simultaneous ailures occur the

8 operational ailure time is recorded and the simulation repeated. In this way, over many runs (e.g., 5) a PDF can be built up. Note that, the simulation results can also be used to conirm the analytical results (in terms o MBOF). ypical PDF results or the active suspension example are given in Figs. 4 and 5. he proound eect o repairing ailed units is clear rom the graph shown in Fig.4. he simulation uses 5 runs and but still will not give an exact comparison: it shows a MBOF o 468days compared with the analytical expression which gives 496, about a 6% error. Increasing the number o simulation runs progressively decreases this error. Number o ailures with repair Results: MBF 4, MBF With Repair 468 (c 498 theoretical) ime to Failure [Days] Fig. 4 Simulation pds or the triplex railway application with ixed repair time (Note: grey represents results or no repair, black with repair). Number o ailures no repair Number o ailures with repair Quadx est over 5 runs: au 7 and MBF 46 Days Results: MBF 5, MBF With Repair 5 (c 664 theoretical) ime to Failure [Days] x 5 Fig. 5 Simulation pds or the quadruplex railway application (ixed repair time) to assure high-integrity) upon operational reliability. It shows that the well-known Chapman-Kolmogorov equations give a good assessment i the mean value o the exponential distribution assumed or these equations is equal to the ixed repair time (although the ailure distribution will be very dierent in the two cases). However the exponential distribution o repair times is not what is encountered in a practical maintenance situation. A ixed maintenance schedule is not well predicted by these equations, and the analysis shows that the MBOF is avourably increased - by a actor o around or triplex and or quadruplex systems. It is also useul to see the eect o moving rom triplex to quadruplex, or which the MBOF is typically increased by a actor o. he MBOF, as opposed to the classical MBF, is an idea that is practically important but seems to have neglected in reliability engineering. Further work is required to consolidate the concept and to reine it or more complex situations. Some o this work is considered in Dwyer et al. (submitted). REFERENCES BS EN 658 Functional saety o electrical / electronic / programmable electronic saetyrelated systems (). Goodall R M, Bruni S and Mei X, Concepts and prospects or actively-controlled railway running gear Proc 9th IAVSD Symposium (5) Milan, Italy Jesty P H, Hobley K M, Evans R, and Kendall I, Saety Analysis o Vehicle-Based Systems, Proceedings o the Eighth Saety Critical Systems Symposium () pp. 9-. Moustaa M S Availability o K-out-o-N:G Systems with Exponential Failures and General Repairs, Economic Quality Control 6 (), Dwyer V M, Goodall R M and Dixon R, Reliability o riplex and Quadruplex saety systems with ixed repair times, submitted to IEEE ransactions on Reliability. Cassandras C G and Laortune S, Introduction to Discrete Event Systems, Springer, USA, (999). Rausand M and Høyland A, System Reliability heory, Models, Statistical Methods and Applications, nd Ed., Wiley, 4. In the quadruplex case (Fig. 5) the large dierence in scales means that showing the results on the same graph is not useul hence the two graphs. Note that again the simulation results match the theoretical value airly closely. 5. CONCLUSIONS his paper analyses the situation or ault-handling in high-integrity systems, in particular representing a realistic maintenance approach. It is ocussed not upon the probability o an unsae ailure, but upon the consequent eect o the redundancy (introduced