MODELING THE RELIABILITY OF C4ISR SYSTEMS HARDWARE/SOFTWARE COMPONENTS USING AN IMPROVED MARKOV MODEL

Transcription

1 Technical Sciences and Alied Mathematics MODELING THE RELIABILITY OF CISR SYSTEMS HARDWARE/SOFTWARE COMPONENTS USING AN IMPROVED MARKOV MODEL Cezar VASILESCU Regional Deartment of Defense Resources Management Studies, Brasov, Romania Abstract: An imortant roblem for CISR systems is choosing the right reliability modeling method. Because CISR system s comonents are redundant and configurable, both at the level of functional entities and inside them, the resulting reliability models are comlex. The redundancy adds sulementary comlexity elements associated with the resonse caability of hardware and software to the failure events. A comlicated issue is to choose the right degree of detail. Too many details could result in loosing the existing hardware and software interdeendencies of the redundant structures within the model. In this aer I am roosing an enhanced theoretical calculus method of the reliability indicators based on an imroved Markov model, and its alication to the reliability modeling of CISR systems hardware/software comonents. A detailed alication of the enhanced method is resented in aragrah. The reliability modeling of CISR systems comonents may use status diagrams recommended for redundant hardware/software structures. Nevertheless, this solution could be hard to be alied, considering the CISR system s comlexity, its number of ossible states, and the large number of redundant elements and arameters of interest. Therefore I aroach the study by adating the status diagrams reresentation, through a combination of system s status tables with transitions states grahs, using also the matrix reresentation of fluency grahs. Keywords: hardware/software systems, reliability analysis, dynamic models, Markov model.. INTRODUCTION CISR systems are basically comuterized networks that include sensors, communication nodes and command centers, each of it erforming secial / essential tasks for good functioning of the entire system. From a reliability oint of view it reresents a serial reliability structure made of indeendent comonents, each with its own functional restore caabilities - ultimately a system with multile recovery caacity. Each of the system s comonents could have a more or less comlex redundant structure, but we should consider it as a whole. Consequently the system could be considered a minimal serial structure with multile recovery caacity. The considerations regarding the reliability modeling of combined hardware/software systems had as a starting oint the Rome Laboratory s "System and Software Reliability Assurance Notebook (Lakey & Neufelder, 99). The document offers a methodology for the reliability assurance study of systems comosed both from hardware and software elements, designed for estimation and rediction of its reliability. The methodology concentrates on software configuration reliability rediction and estimation methods and on the techniques used to correlate hardware and software reliability metrics with system s general arameters. The reliability model roosed by Rome Laboratory consists of state transition diagrams that artially resond to the issues related with the comlexity of a CISR system and its comonents. Even if the model contains restrictive hyotheses, the reliability 5

2 Modeling the reliability of CISR systems hardware/software comonents using an imroved indicators of the system s comonents calculus can utilize a large scoe of methods. Consequently, in the first art of the aer I am roosing an enhanced theoretical calculus method of the reliability indicators based on an imroved Markov model, while in the second art I aly it to the reliability modeling of CISR systems hardware/software comonents. A comlicated issue was to choose the right degree of detail. Too many details could result in loosing the existing hardware and software interdeendencies of the redundant structures within the model. Because the CISR system s comonents are redundant and configurable, both at the level of functional entities and inside them, the resulting reliability models are comlex. The redundancy adds sulementary comlexity elements associated with the resonse caability of hardware and software to the failure events. For the reliability modeling of CISR systems comonents I used one of the general methods alicable to comlex redundant structures, based on hardware, software and hardware/software elements - the Markov rocesses method. A detailed alication of the enhanced method will be resented in aragrah. The reliability modeling of CISR systems comonents may use the status diagrams recommended for redundant hardware/software structures. Nevertheless, this solution could be hard to be alied, considering the CISR system s comlexity, its number of ossible states, the large number of redundant elements and arameters of interest (for only two identical elements and five arameters of interest it results 2 ossible states). Therefore I aroach the study by adating the status diagrams reresentation roosed by Rome Laboratory, through a combination of system s status tables with transitions states grahs, using also the matrix reresentation of fluency grahs. 2. MODELING THE SYSTEM S COMPONENTS RELIABILITY USING AN IMPROVED MARKOV METHOD The reliability modeling rocess of system s comonents through Markov rocesses method uses a dynamic system model (Ghiă & Ionescu, 99:55-5). These dynamic models follow the temoral evolution of the system s state and are defined using characteristic states. A system s state reresents synthetic information regarding the condition of its elements and could have only two ossible values: an oerational state or a failure state. Assuming n is the number of elements of the system and X the set of system s states X { xi ; i,2,..., N}, in n which N 2, it results that X is a finite set with elements defined as x i ( xi, xi2,..., xin ) and x ik 0 when element k is in an oerational state and x ik when element k is in a failure state, k,2,...,n for state xi. Due to the failure and recovery of comonent elements, the current state of the system at t moment, noted υ () t, t T [ 0, ] is a random rocess. Mathematically seaking, this rocess has the following characteristics: evolves in a continuum time; has a finite set of states X and has a oissonian character (in a very short time interval it could be distinguished maximum one change of state). The subset S X reresents the set of failure states and the comlementary subset S X S reresents the set of oerational states. The model allows to determine the time duration when the rocess υ () t will remain in S or S. A random rocess with the above mentioned characteristics could be modeled as a grah G ( X, Λ), where X reresents the nodes set (identified with the states set) and Λ reresents the set of arches that connect the nodes. Each oissonian rocess can be associated with a grah following certain rules (Lakey & Neufelder, 99): the nodes identify the states; nodes are connected one to each other through arches if there is a ossibility to move from one state to other in a single ste; on arches is secified the reliability or maintainability arameter that determines the transition, λ i for failures and μ i for recoveries. The resulting grah is named States Transition Grah. The Markov rocesses

3 Technical Sciences and Alied Mathematics method is based on a dynamic model that follows the evolution in time of the current system s state υ () t. On each moment t, υ () t is a random discrete variable. Let s note k () t P( υ () t xk ). The robabilities k () t are absolute robabilities with fundamental roerties: ) k () t 0 N () 2) t k k () Poissonian rocesses theory shows that those absolute robabilities are solutions for a differential equation system that could be determined by alying Venttel rule to the state transition grah. () Derivative k t is equal with the algebraic sum of the roducts between the starting nodes robabilities and the corresonding transition intensities of the arches leaving those nodes, calculated for all incoming and outgoing arches belonging to node x k. In the sum, the terms entering x k are ositive ( + ), while the exiting ones are negative ( ). Let s note the set of arches entering node k, and Λ k + Λ k the set of arches exiting node k λ ij the transition intensity of the arch that exit node i and enter node j. The following equations system results: k () t j () t λ jk k () t + λ jk A k λ kj A k λ, k, 2,..., N kj (2) The system of equation is integrated for the initial condition (): ( 0) k ( 0) 0, k. where x ( 0,0,..., 0) is the state in which all elements are oerational. The main reliability indicator of a system calculated through this method is the robability function P() t. Having S X - the set of failure states and S - the set of oerational states, it results: P t k t () () () k S In order to calculate this robability it is necessary to eliminate from the state transitions grah all the transitions from S to S. If the grah maintains his structure comlete, through the same relation we can obtain the system s availability coefficient K D () t or D() t. It should be mentioned that when we aly the method to CISR systems, the following indicators must be calculated: F def ()() i t P() t () and T def 0 () i P() t dt. (5) The advantage of the method is the transformation of system s reliability calculus to standard mathematical roblems. It alies both irrearable and reairable systems, when failure and restore follow an exonential distribution law. The method imlies a great volume of calculations which exonentially increases with the system s states number. Alying the method to CISR systems needs data regarding the software failure rates (oerating systems of alicative software) and hardware failure rates. The oerating systems failure rates could be obtained from the manufacturers, usually as number of failures in a secific time interval. Those failure rates are calculated taking in consideration the time of the system, because the oerating system is active when the comuter is on and ready for rocessing. To obtain the comatibility with hardware failure rates the measuring unit of the obtained failure rates must be numbers of failures er hour. Regarding the failures of reusable software code, that information could be obtained from the alications in which the software was used before. The information is relevant only if the oerational rofile of the revious designed alication is aroximately the same with the current alication and in this case the historical data regarding failure rates could be used. In comarison with Rome Laboratory s aroach, reliability analysis with dynamic models has several advantages, such as:

4 Modeling the reliability of CISR systems hardware/software comonents using an imroved systematize the states transition grah, because the arches connect only the states that differ one from each other with a single defect; offers a systematization surlus, the status diagrams (states number) are organized tacking in consideration the number of existing system s failures; offers the ossibility to reresent the states transition grah using fluency grahs methods (incident / adjacent matrix) and offers a comlete methodology for the calculus of reliability indicators.. IMPLEMENTATION OF THE RELIABILITY MODELING METHOD TO CISR SYSTEMS HARDWARE/ SOFTWARE COMPONENTS. CASE STUDY The objective of the aragrah is to detail the imlementation of the imroved Markov methodology resented before to the reliability modeling of CISR systems. For this urose we will use the reliability model of a simle redundant structure. Figure deicts the simlified state diagram of a hardware/software structure with two identical elements (at least one must be in an oerational state). To model the system s states, I took into account five arameters: status of the basic hardware latform (oerational or faulty); status of the basic software (oerational or faulty); status of the backu hardware latform; status of the backu software and status of the oeration s recovery. System s oeration recovery may be successful or fail. Success is defined by: the structure switched on backu equiments, as a result of a basic hardware or software failure; a failure to the backu equiment has been detected, and it has been reaired. Because there are five arameters of interest, each with two ossible states, it results a total of 2 states. Nevertheless, in ractice, some of the states could not exist (e.g. software could not be oerational on a faulty hardware latform) and others are functionally equivalent. The following notations were used: # - state number; T - tye (success or failure); A - basic hardware; B - basic software; C - backu hardware; D - backu software; E recovery, where A, B, C, D values are O oerational; F failure; - not alicable; E values are S successful recovery or failure on backu equiment detected; F - unsuccessful recovery or latent failure on backu equiment. The structure described has a total number of states equal with 0, as shown in table. Table. Descrition of system s states State State no. tye Exlanations 0 Success Comlete oerational structure A software failure was Success detected in the backu equiment that was reaired The system is oerational, 2 Success with a latent software failure in the backu equiments The system is oerational, Success with a detected hardware failure in the backu equiments The system is oerational, Success with a latent hardware failure in the backu equiments Failure on basic software, switching on backu hardware and software equiments 5 Failure failed; an intervention is necessary for system s recovery on either of hardware latforms Failure on basic hardware and the recovery rocess failed; it occurred an incorrect Failure detection, isolation or incomlete recovery; a manual intervention is required for system s recovery on backu equiments Software failures occurred on Failure both basic and backu equiments Basic hardware and backu Failure software failed; recovery is not ossible without a manual intervention 9 Failure Both hardware equiments failed

5 Technical Sciences and Alied Mathematics Fig.. The simlified state diagram Transitions from one state to another take lace due to hardware (software) failures or as a consequence of recovery rocess. Usage of state diagrams that model hardware and software failures ermit a recise redundant systems reliability estimation. Comaring these two aroaches, it result some observations, such as:. The methodology for modeling the system s comonents reliability using an imroved Markov method (resented in aragrah 2) is a alicable to every tye of system (hardware, software or hardware/software) and allow the calculus of reliability indicators relevant for CISR systems (e.g. ( P () t or D() t, resectively DS ). The main roblem related with its imlementation is determined by the state transition grah s imlementation manner and esecially by the states transition rates. 2. The states diagram resenting manner (figure ) is similar with the states reresentation manner from aragrah, comleted with secific asects regarding the recovery of hardware/software system s comonents. Moreover, it introduces also state diagram systematization, resenting a list of states transition rates (table ).. The imlementation of the reliability modeling method is conditioned by the knowledge of numeric values of robabilities such as Cd, Cd, Ci, Ci, Cr and Cr that must be inferred analytically and/or statistically, where: Fault detection coverage ( C d ) - is the robability of detecting a fault given that a fault has occurred; Fault isolation coverage ( C i ) - is the robability that a fault will be correctly isolated to the recoverable interface (level at which redundancy is available) given that a fault has occurred and been detected and Fault recovery coverage ( C r ) - is the robability that the redundant structure will recover system services given that a fault has occurred, been detected, and correctly isolated. To facilitate the imlementation, it results three new architectural roducts, secific to the CISR system s Reliability Vision (Vasilescu, 200:9-200), as follows: RV- - 9

6 Modeling the reliability of CISR systems hardware/software comonents using an imroved Descrition of states (table 2); RV- - The matrix of states transition rates (table ); RV- - The list of states transition rates (table ). Table 2 derives from the simlified state diagram (fig.). Table 2. Descrition of states A B C D E Comosition Index Meaning 0 O O O O - S O O O F S S 2 O O O F F S O O F - S S O O F - F S 5 O F O O F F F - O O F F O F O F - F F O O F - F 9 F - F - - F Through the table we divide the states in S and F, their index starting with working states (S) - state ( O, O, O, O, ), continuing ste by ste with every change of state generated by its corresonding elements. In this reresentation, all failure states (F) are shown in the lower art of the table. 20 Table. The matrix of states transition rates Index (0, ) (0, 2) (0, ) (0, ) (, 0) (, ) 2 (2, ) (2, ) (, 0) (, ) 5 (5, ) (5, ) (, ) (, ) (, ) (, ) 9 (9, ) Index (0, 5) (0, ) (, ) (, ) 2 (2, ) (2, ) (, ) (, 9) (, ) (, 9) 5 (5, ) (5, ) Index 5 9 (, ) (, 9) (, ) (, 9) 9 ( ) In this matrix Λ, the lines contain states transition rates corresonding to outgoing arches form the node and columns contain states transition rates corresonding to incoming arches form the node (essential information for the associated differential equation system). Table. The list of states transition rates. Code Content (0, ) λ Cd S Cd Ci Cr λ (0, 2) ( ) C d (0, ) λ Cd H Cd Ci Cr λ (0, ) ( C d ) (0, 5) λ ( Cd Ci Cr ) (0, ) λ ( C C C ) (, 0) μ (, ) λ (, ) λ (, ) λ (2, ) λ Cd λ d (2, ) ( ) C d (2, ) λ (2, ) λ (, 0) μ (, ) λ (, 9) λ (, ) λ Cd (, ) λ (, 9) λ (5, ) ( Tr ) (5, ) λ i r

7 Technical Sciences and Alied Mathematics Code Content rates from working states (S) to failure states (F), Λ (5, ) λ 2 contains transition rates from failure states (F) to working states (S), Λ 22 contains (5, ) λ transition rates between failure states (F). To (, ) ( Tr ) calculate the availability ( D) we use the matrix (, ) λ Λ D Λ () (, 9) λ and to calculate the reliability ( P) we use the (, ) μ matrix (, ) 2λ Λ Λ2 Λ () (, ) μ 0 Λ 22 in which 0 is the null identical matrix, when (, ) μ the determination methodology of the (, 9) λ differential equation system associated with the model is imlemented. We also observe that the matrix ( Λ) has a cellular format (marked in table ) It is remarkable that this aroach significantly orders (systematizes) the deduction of the differential equation system Λ Λ2 associated with the model (Guta, 20; Lai et Λ, () Λ 2 Λ al., 2002). Thus to calculate the availability 22 ( D) it result the following systems of in which Λ contains transition rates between equations: working states (S), Λ 2 contains transition 0 [ ( 0,) + ( 0,2) + ( 0,) + ( 0,) + ( 0,5) + ( 0,) ] 0 + (,0) + (,0) ( 0, [(,0) + (,) + (,) + (,) ] + ( 5,) 5 + (,) + (,) 2 ( 0,2 [( 2,) + ( 2,) + ( 2,) ] 2 ( 0, + (,) + ( 2,) 2 [(,0) + (,) + (,9) ] + (,) + ( 5,) 5 + (,) + (,) + ( 9,) 9 (9) ( 0, + ( 2,) 2 [(,) + (,) + (,9) ] 5 ( 0,5 [( 5,) + ( 5,) + ( 5,) + ( 5,) ] 5 ( ) [( ) + ( ) + ( )] 0, 0,,,9 (,) + ( 2,) 2 + ( 5,) 5 [(,) + (,) ] (,) + ( 2,) 2 + (,) + (,) + ( 5,) 5 + (,) + (,) [(,) + (,) + (,9) ] 9 (,9) + (,9) + (,9) + (,9) ( 9,) 9 while to calculate the reliability ( P) it result the following systems of equations: 0 [ ( 0,) + ( 0,2) + ( 0,) + ( 0,) + ( 0,5) + ( 0,) ] 0 + (,0) + (,0) ( 0, [(,0) + (,) + (,) + (,) ] 2 ( 0,2 [( 2,) + ( 2,) + ( 2,) ] 2 ( 0, + (,) + ( 2,) 2 [(,0) + (,) + (,9) ] + (,) (0) ( 0, + ( 2,) 2 [(,) + (,) + (,9) ] 5 ( 0,5 [( 5,) + ( 5,) ] 5 ( ) [( ) ( )] 0, 0, +,9 (,) + ( 2,) 2 + ( 5,) 5 (,) (,) + ( 2,) 2 + (,) + (,) + ( 5,) 5 + (,) + (,) (,9) 9 (,9) + (,9) + (,9) + (,9) 2

8 Modeling the reliability of CISR systems hardware/software comonents using an imroved Relacing the states transition rates from table in formula (9), it results the system: λ ( λ Cd Cd Ci Cr λ ( Cd ( λ Cd Cd Ci Cr λ( Cd λ ( Cd Ci Cr λ( Cd Ci Cr + μ + μ ( λ Cd S Cd Ci Cr [ μ ] + ( Tr ) 5 + μ + μ λ ( Cd [ λ ( Cd ) Cd ] 2 ( λ Cd H Cd Ci Cr + ( λ Cd ) 2 [ μ ] + ( λ Cd ) 5 + ( Tr ) + μ + μ9 λ( Cd ( Cd ) 2 [ λ Cd ] λ ( Cd Ci Cr [( Tr ) ] 5 λ ( Cd Ci Cr [( Tr ) ] λ 2 5 [ μ + 2λ ] λ + 2λ [ μ + μ ] 2 μ 5 9 () that could be reresented in canonical format as: λ 2( λ + μ + μ ( λ Cd S Cd Ci Cr [ μ ] + ( Tr ) λ ( Cd [ λ ( Cd ) Cd ] 2 ( λ Cd H Cd Ci Cr + ( λ Cd ) 2 - [ μ ] + ( λ Cd ) 5 + ( Tr ) + μ + μ 9 λ ( Cd ( Cd ) 2 [ λ Cd ] λ ( Cd Ci Cr [( Tr ) ] 5 λ ( Cd Ci Cr [( Tr ) ] λ 2 5 [ μ + 2λ ] λ + 2λ [ μ + μ ] 2 μ μ 5 + μ (2) Also, relacing the states transition rates from table in formula (0), it results: 22

9 Technical Sciences and Alied Mathematics λ λ 9 λ ( λ Cd Cd Ci Cr λ ( Cd - ( λ Cd Cd Ci Cr λ ( Cd - λ ( Cd Ci Cr λ ( Cd Ci Cr + μ ( λ Cd Cd Ci Cr [ μ ] λ ( Cd [ λ ( Cd ) Cd ] 2 ( λ Cd Cd Ci Cr + ( λ Cd ) 2 - [ μ ] + ( λ Cd ) λ ( Cd ( Cd ) 2 [ λ Cd ] λ ( Cd Ci Cr [ λ ] 5 λ ( C C C ) [ λ ] d i 2 2 r 5 2λ λ λ + μ () The system can be reduced to: λ λ 9 λ 2( λ + μ + μ ( λ Cd Cd Ci Cr [ μ ] λ ( Cd [ λ ( Cd ) Cd ] 2 ( λ Cd Cd Ci Cr + ( λ Cd ) 2 - [ μ ] + ( λ Cd ) λ ( Cd ( Cd ) 2 [ λ Cd ] λ ( Cd Ci Cr [ λ ] 5 λ ( C C C ) [ λ ] d i r 2 5 2λ λ λ () A secification has to be made: to solve the equations systems (2) and () - which are differential equations systems in Cauchy canonical format - secialized software is required (e.g. MathLab or MathCad). When data regarding software and hardware failure rates and robabilities C d,, C, C, C, C are known or Cd i i r r it had been inferred analytically and/or statistically, the calculus could go further to determine the equations systems solutions, for ( ) ( ) the initial condition 0 0; 0 0; k. 0 k > Once calculated the differential equations systems solutions, the reliability indicators of the system (availability ( D) and working robability P() t ) are determined using the formulas from aragrah 2. Also the following indicators are determined using the value of the system s failure robability: F def ()() i t P() t (5) resectively def 0 T dt. () () i P() t 2

10 Modeling the reliability of CISR systems hardware/software comonents using an imroved. CONCLUSIONS The findings roosed in this aer give a methodological framework to the field of reliability modeling of CISR systems hardware/software comonents. In summary, the goal of this aer is to roose certain contribution, such as: () Elaboration of an imroved Markov model regarding the reliability of CISR system s comonents (aragrah 2) that augments the Markov model roosed by Rome Laboratory s methodology for hardware/software reliability modeling with information offered by general reliability theory in resect with Markov rocesses method. Synthesizing (based on the model) of new architectural roducts, secific to CISR system s Reliability Vision; (2) The imlementation of the roosed Markov model for a reresentative case study - modeling the reliability of a simle redundant hardware/software system, using a combination of system s states tables with states transition grahs and a matrix reresentation of fluency grahs. BIBLIOGRAPHY. Ghită, Al. & Ionescu, V. (99). Methods for Reliability Calculus. Bucharest: Military Technical Academy Publishing House Guta, P. (20). Markov Modeling and Availability Analysis of a Chemical Production System-A Case Study. Proceedings of the World Congress on Engineering, Vol I, July 20, London, U.K.. Lai, C.D. et al. (2002). A model for availability analysis of distributed software/ hardware systems. Information and Software Technology, Vol, Issue. -.. Lakey, P.B. &.Neufelder, A.M. (99). System and Software Reliability Assurance Notebook. Rome Laboratory Reort. Rome, NY: Griffins Air Force Base 5. Vasilescu, C. (200). The Reliability of Command and Control Systems within Romanian Air Force. Brasov: Transilvania University Publishing House.. 2