Aircraft safety modeling for time-limited dispatch

Transcription

1 Loughborough Universiy Insiuionl Reposiory Aircrf sfey modeling for ime-limied dispch This iem ws submied o Loughborough Universiy's Insiuionl Reposiory by he/n uhor. Ciion: PRESCOTT, D.R. nd ANDREWS, J.D., 005. Aircrf sfey modeling for ime-limied dispch. IN: Proceedings of he Annul Relibiliy nd Mininbiliy Symposium, RAMS'05, Virgini, USA, 4h-7h Jnury, pp [DOI:0.09/RAMS ] Addiionl Informion: This is conference pper [ c IEEE]. I is lso vilble from: hp://ieeexplore.ieee.org/ Personl use of his meril is permied. However, permission o reprin/republish his meril for dverising or promoionl purposes or for creing new collecive works for resle or redisribuion o servers or liss, or o reuse ny copyrighed componen of his work in oher works mus be obined from he IEEE. Med Record: hps://dspce.lboro.c.uk/34/3834 Publisher: c Insiue of Elecricl nd Elecronics Engineers (IEEE) Plese cie he published version.

2 This iem ws submied o Loughborough s Insiuionl Reposiory (hps://dspce.lboro.c.uk/) by he uhor nd is mde vilble under he following Creive Commons Licence condiions. For he full ex of his licence, plese go o: hp://creivecommons.org/licenses/by-nc-nd/.5/

3 Aircrf Sfey Modeling For Time-Limied Dispch Drren R. Presco, Loughborough Universiy John D. Andrews, Loughborough Universiy Key Words: Time-Limied Dispch, FADEC sysem relibiliy, Mone Crlo simulion SUMMARY & CONCLUSIONS This pper offers n lernive mehod of modeling he Time-Limied Dispch (TLD) of ircrf. Exising mehods involve he use of ful ree nlysis nd Mrkov nlysis wih vrious simplifying ssumpions. Mone Crlo simulion (MCS) is he suggesed lernive, which overcomes he problems ssocied wih he oher echniques, such s dependencies beween bsic evens (ful ree nlysis) or huge number of sysem ses (Mrkov nlysis). The resuls obined from he nlysis of simple exmple re compred for he exising modeling pproches nd MCS. MCS is seen o hve poenil dvnges, especilly when modeling TLD for lrge, full scle sysems.. BACKGROUND Inroduced o commercil rnspor ircrf bou 0 yers go, Full Auhoriy Digil Elecronic Conrol (FADEC) sysems govern engine hrus from he ime fuel meering begins o he poin of fuel shuoff. Unil he inroducion of hese elecronic engine conrol sysems hydromechnicl conrol (HMC) sysems were used. In hese pplicions of FADEC i ws o be he firs ime h pilos would hve no HMC sysems vilble s bckup in he even of n elecronic sysem filure []. FADEC sysems conin cerin level of redundncy, incorporing dul chnnel conrol sysem. This involves hving wo essenilly idenicl chnnels per engine. Ech criicl loop or funcion in he FADEC conins eiher redundn elemens or dul sysems. Despie his redundncy, he dispch crieri imposed fer he inroducion of FADEC were overly resricive, incresing he numbers of delys nd cncellions of flighs []. This ws due o he occurrence of independen fuls in more hn one chnnel. Becuse levels of relibiliy re higher for FADEC sysems hn for HMC sysems n opporuniy exised o use vilble redundncy o llow dispch wih fuls presen. This would sill llow irworhiness sndrds o be me nd lso reduce he numbers of delys nd cncellions, long wih he dded benefi of llowing beer plnning of minennce operions. This new pproch, llowing degrded redundncy dispch ws nmed ime-limied dispch (TLD).. INTRODUCTION TO TLD TLD llows he dispch of ircrf in he presence of one or more known fuls whils ssuring cerin level of sysem relibiliy. Depending on he significnce of he fuls ircrf my be dispched for differing lenghs of ime. These dispch inervls give he mximum lengh of ime h he ircrf my be dispched wih fuls presen before hose fuls mus be ddressed. There re four cegories of dispch inervl. These re: o Do No Dispch (DND), o Shor Time Dispch (), o Long Time Dispch (), o Mnufcurer/Operor Defined Dispch (MDD). The implemenion of he DND dispch cegory mens h he ircrf mus no be dispched becuse of he fuls presen nd minennce mus be underken immediely. The dispch cegory llows dispch in he shor-erm nd he cegory for relively longer ime before repirs re crried ou. The finl cegory of dispch, MDD, is reserved for fuls flling ino none of he oher hree cegories nd no ffecing he loss of hrus conrol (LOTC) re []. An upper limi for he LOTC re of 00 evens per 0 6 fligh hours (fl. hrs.) is given by he FAA for dispchble sysem configurions. The mximum verge LOTC re of he sysem mus no exceed 0 evens per 0 6 fl. hrs. This level mches h which ws chieved by he HMC sysems superceded by FADEC.. Minennce Sregies Two sregies exis h my be used o minin he FADEC sysems of ircrf when TLD is pplied. The firs of hese is minimum equipmen lis (MEL) minennce [], which would normlly be used on cegory fuls. The exc ime of occurrence of ny ful minined using his pproch mus be known. As he ful occurs coundown of he dispch ime is iniied. The ful mus be remedied, he les, by he ime he coundown reches zero. Figure illusres his process. The ful occurs ime, fer which he dispch inervl is iniied. A he end of he coundown,, he ful mus be repired, if he repir hs no lredy been implemened. The second minennce sregy used is periodic inspecion/repir (PIR), which involves checking he sysem for fuls regulr inervls. This is mos ofen used o minin fuls in he cegory. Unlike MEL minennce PIR does no require knowledge of he exc ime of occurrence of he ful. Fuls, discovered inspecions, re ssumed o occur he midpoin of consecuive inspecions []. This is considered resonble since he ful will, on verge, occur his ime, ssuming he filure res for fuls re consn wih ime nd he periodic inspecion inervl is less hn he men ime beween filures (MTBF) of RAMS /05/$ IEEE Auhorized licensed use limied o: IEEE Xplore. Downloded on Ocober 3, :30 from IEEE Xplore. Resricions pply.

4 dispch inervl Figure. MEL Minennce. A B Figure 3. Muliple Fuls dispch inervl T I f I A B 3 Figure. PIR Minennce. he sum of filure res in h cegory. The dispch inervl is hen deemed o hve begun he midpoin of he inspecions nd he llowble period of dispch fer he inspecion is clculed. This minennce sregy is illusred in Figure. I nd I represen wo consecuive inspecions. A ful, occurring ime f, is discovered I nd ssumed o occur. If he dispch inervl is ssumed o begin his ime he ircrf my be dispched unil ime, giving n llowble period of dispch of ime T I. In prcice he inspecion inervl for ful cegory mus no exceed wice he dispch inervl for fuls of h cegory. This ensures h he verge exposure o fuls does no exceed he dispch inervl. If PIR is used o minin fuls of more hn one dispch cegory siuion cn occur where ful is discovered n inspecion for fuls of differen cegory. In his cse he ful could be reed s if found for he firs ime he nex inspecion for fuls of is own dispch cegory. In his wy ful discovered inspecion could be reed s if discovered he nex inspecion for fuls []. Due o he differen pproches involved in he MEL nd PIR minennce sregies he mximum possible exposure ime of he sysem o fuls will differ. In MEL he mximum possible exposure ime is equl o he dispch inervl, bu in PIR he mximum possible exposure ime is equl o wice he dispch inervl. There is possibiliy h more hn one ful my exis wihin FADEC sysem ny one ime. In such cses hese fuls my be repired in number of differen wys. Below re some exmples of he siuions h my rise, long wih some of he minennce possibiliies. Figure 3 depics he occurrence of wo fuls, A nd B. If hese fuls were o be minined using MEL minennce dispch inervls for hese fuls would end nd respecively. Upon reching he end of he firs dispch inervl,, number of sregies re possible. A his poin ful A mus be ddressed o llow furher dispch. Ful B my lso be repired his ime, llowing dispch unil noher TLD ful occurs. Alernively, ful B my be lef in he sysem nd he ircrf my be dispched unil is ssocied dispch inervl ends ime. In he siuion jus described i my be h wih he simulneous occurrence of fuls A nd B reducion in he dispch inervl is specified. This scenrio is depiced in Figure 4, gin for he cse of MEL minennce. In his cse fuls A nd B, when occurring lone, bring bou he iniiion of inervls, which would end nd s before. However, when boh fuls re presen wihin he sysem he dispch inervl is reduced o. Thus, s ful B occurs he inervl ending 3 is iniied, rher hn he one ending. Upon reching 3 hree minennce sregies exis. These re: o Repir boh fuls, A nd B, llowing unlimied dispch of he ircrf, o Repir ful A only, llowing dispch unil, o Figure 4. Fuls Acing in Combinion MEL which poin ful B mus be repired, Repir ful B only, llowing dispch unil, which poin ful A mus be repired. When fuls combine in his mnner o reduce he dispch inervl i is possible for he ordering of he fuls o lso ply pr. I my be he cse h he dispch inervl would be reduced when eiher A ws followed by B or B ws followed by A. However, noher possibiliy is h he dispch inervl my only be reduced if A is followed by B bu no if B is followed by A. The siuions occurring bove my lso rise when PIR minennce is being used o minin he FADEC sysem. However, he reducion or oherwise of he dispch inervls cn be more complex, since he exc ime of occurrence of he fuls is no known. As n exmple of his incresed complexiy consider Figure 5, which shows he occurrence of wo fuls A nd B. Ech of hese fuls hs n ssocied inervl nd fuls re o be minined using PIR. In combinion he fuls A nd B iniie inervl. In he figure I nd I represen wo consecuive PIR inspecions. A inspecion I fuls A nd B re discovered nd ssumed o hve occurred he midpoin of he wo inspecions,. A inervl iniied his ime llows dispch of he ircrf for ime T fer inspecion I. However, if he simulneous exisence of fuls A nd B cuses he iniiion of inervl ending 3 he siuion is compliced somewh. Upon reching he minennce dedline 3 fuls A nd B, ful A lone or ful B lone could be repired. If A nd B re boh repired he ircrf my be dispched indefiniely. If jus ful A or ful B is repired he ircrf my hen be dispched unil when he remining ful mus be repired. These exmples of siuions h my rise when RAMS /05/$ IEEE Auhorized licensed use limied o: IEEE Xplore. Downloded on Ocober 3, :30 from IEEE Xplore. Resricions pply.

5 I A B I 3 Figure 5. Fuls Acing in Combinion PIR implemening TLD o FADEC sysems by no mens cover ll possibiliies. They merely highligh some of he mny cses h mus be considered when emping o model TLD. 3. MODELING TLD Before pplying TLD o ircrf i is imporn o be sure h he ircrf will sill conform o he levels of sfey desired of i. The firs sep in demonsring his conformiy is o consruc mhemicl model of he sysem in order o predic is behvior when TLD is used. In [] nd [3] wo of he commonly-used mehods of TLD nlysis re presened ful ree-bsed pproch nd Mrkov modeling pproch. These pproches re demonsred here for he simple sysem shown in Figure 6. Mone Crlo simulion is hen pplied o he sme sysem. The sysem is h given s n exmple in [] nd consiss of wo unis, U nd U. These hve filure res per hour of U = nd U = respecively. 3. Time-Weighed Averge (TWA) Ful Tree Approch In his mehod he overll verge filure re of he sysem is obined by dding he filure res of he HMC fuls, HMC, nd he uncovered fuls, UC, o imeweighed verge (TWA) of he filure res of he sysem from ech of is dispchble configurions, i.e., TWA = HMC + UC + FUFU,L +,L +,L () where TWA is he TWA filure re of he sysem. FU, nd re respecively he frcions of ime spen in he fullup, nd dispchble sysem configurions. FU,L is he LOTC re of he sysem from he FU se o LOTC.,L nd,l re he verge LOTC res wih nd fuls. If he sysem hs n dispchble configurions, le se i = represen he full-up configurion (i.e. he se wih no filed componens). Ses i =, m nd i = m +,,n will represen he nd dispchble sysem configurions respecively. If i,l is he filure re o LOTC for he i h configurion i my be clculed s follows. The filure probbiliy (of LOTC) for ech se is divided by suible ime period, such s he verge fligh ime, o Uni fils U T Sysem Fils Uni fils U Figure 6. A Dul Uni Sysem obin probbiliy per fligh hour. This is hen equed o he verge filure re o LOTC over he ime inervl []. Thus Q i,l i,l =, () where Q i,l is he filure probbiliy (of LOTC) for se i nd fl is he verge fligh ime. Define T nd T s he lenghs of ime spen in he nd dispchble sysem ses before repir, i.e. he nd dispch inervls. If i is he filure re ino filed dispchble sysem se hen he frcions of ime spen in he nd dispchble sysem configurions my be pproximed s follows (see[3]): = m T nd = T. (3) i n i m+ The frcion of ime spen in he full-up se, FU, is deermined using he fc h he frcion of ime spen in he filed ses dded o he frcion of ime in full-up se will be uniy. Therefore once he frcions of ime spen in ll he filed ses is known, FU my be clculed s follows: FU =. (4) The verge LOTC res wih nd fuls re defined in [3] s: m i n ii,l ii,l m+, L = nd = m,l n (5) i m+ The dul uni sysem shown in Figure 6 hs hree dispchble configurions, numbered ses o 3 s follows:. U nd U work (Full-up),. U is filed, U works (), 3. U works, U is filed (). If q U nd q U represen he probbiliies of filure of U nd U hen, subsiuing hese ino equion (), we ge: ququ qu qu,l =,,L =, 3,L =. (6) Subsiuing hese ino equion (3) we obin he frcions of ime spen in he nd dispchble sysem configurions: qu qu,, = T = T (7) which my hen be subsiued ino (4) o give he frcion of ime spen in he full-up se: qu qu. FU = T T (8) Subsiuing (6), (7) nd (8) ino () gives TWA for his dul uni sysem. If he filure probbiliies q Ui re given by: Ui qui = e, (9) hen TWA cn be clculed for differen vlues of T nd T, which re he dispch inervls for U nd U respecively. The fligh ime, fl, ws ssumed o be 5 hours. 3. Single Ful Se Mrkov Approch Like he ful ree pproch, his echnique hs severl RAMS /05/$ IEEE Auhorized licensed use limied o: IEEE Xplore. Downloded on Ocober 3, :30 from IEEE Xplore. Resricions pply.

6 rcive feures []. For insnce, Mrkov modeling mkes direc use of filure nd repir res, neging he need o eque he filure res o probbiliy/fligh hour, s is he cse wih he ful ree pproch. The min drwbck wih Mrkov nlysis is he poenilly huge number of sysem ses h my be presen wihin he model [4]. For his reson [3] considers filures h led o one finl filed se represening LOTC. This filed se is bsorbing, since once he sysem is in his se no rnsiion my occur o ny oher se. However, in [3] n rificil feedbck loop, simuled repir, is inroduced h kes he sysem from he finl filed se bck o he full-up se wih no componens filed. I is rgued h sedy-se soluion for he verge filure re of he sysem is required bu h wihou feedbck loop he sedy-se probbiliy of he sysem being filed will lwys pproch vlue of. In [3] his simuled repir re is se o uniy, for simpliciy. This choice is rbirry, mde since, if LOTC even occurs for n engine, he conrol mus be repired before he nex fligh kes plce. A repir inervl of one hour is deemed suible. This mehod lso differs from convenionl Mrkov echnique in h i involves only lower order ful ses, commonly only single-ful ses, lhough dul ful ses re included if imporn for he nlysis. The Mrkov model obined using his echnique is like h in Figure 7. The rnsiion res from he full-up se o he nd ful ses re nd nd he corresponding repir res re ν nd ν. In [3] nd re pproximed by he sums of he filure res of ll of he nd ype fuls respecively. ν nd ν re given by he reciprocl of he dispch inervls, T nd T. The filure res from he nd ful ses re given by,l nd,l nd he simuled repir is given by ν FB. The Mrkov model leds o sysem of 4 liner differenil equions, given by: Q = QA, (0) where A is he rnsiion re mrix, ( + ) 0 ( ν + ) ν,l 0,L A = () ν ( + ) 0 ν,l,l ν FB 0 0 ν FB nd Q = [ QFU, Q, Q, QLOTC ], () where Q FU, Q, Q nd Q LOTC re he probbiliies of he sysem being in he full-up,, nd LOTC ses respecively. A sedy se he derivives of hese probbiliies will be zero, i.e. Q A = 0, (3) nd hus sysem of 4 liner equions is obined. This sysem of equions is dependen. In order o obin sysem of independen equions one of he equions is replced by he condiion h he sum of he probbiliies of being in ech se is uniy, i.e. Q FU + Q + Q + QLOTC =. (4) Column of A is rbirrily chosen o be replced by (4), giving sysem of equions h is solved o find Q sedy se. In order o find he LOTC re for he sysem he Full-up ν ν,l LOTC,L verge rnsiion re ino he LOTC se is considered [3]. This LOTC re, obined from he single ful se Mrkov model is: Probbiliy flow ino LOTC se Mkv =, (5) Probbiliy of being in LOTC se A his poin fuls h re required o be modeled s leding direcly o he LOTC se, i.e. HMC fuls or uncovered elecronic fuls, re dded. Since hese fuls could led o LOTC from ny non-lotc se he sum of heir filure res is muliplied by he sum of he probbiliies of being in ll he ses excep he LOTC se [3]. Thus (5) becomes: ( QFU + Q + Q)( HMC + UC ) + Q,L + Q,L Mkv =.(6) QLOTC When modeling he dul uni sysem shown in Figure 6 he filure res for he single ful se Mrkov model my be clculed s hey were for he TWA model. Mrkov models of TLD ll inherenly model he MEL minennce sregy. This is becuse s soon s componen of he sysem fils he sysem will mke rnsiion o differen se nd hus he filure ime of he componen will be known. If PIR is o be used s minennce pproch he mximum llowed dispch ime clculed using Mrkov pproch is doubled in order o clcule he mximum periodic inspecion inervl. 3.3 Convenionl Mrkov Approch o Single Ful Se Model ν FB Figure 7. Single Ful Se Mrkov Digrm. Noe h he LOTC re obined from he single ful se Mrkov model, Mkv, is dependen on he vlue of he feedbck re, ν FB, nd independen of he iniil condiions of he sysem. Andrews nd Moss [4] deil mehod of finding he sympoic filure re of sysem wih bsorbing finl filed ses. This my be pplied o he Mrkov model described in he previous secion. In his cse here is no need o include simuled repir from he finl fully-filed se, i.e. he feedbck re, ν FB. Thus he rnsiion re mrix is: ( + ) 0 ( ) ν ν +,L 0,L A = (7) ν 0 ( + ) ν,l,l The reduced rnsiion re mrix, A m, is obined by runcing A by deleing enries for he bsorbing ses. Thus he finl row nd column of (7) is deleed o ge A m. The sympoic filure re, ASY, is hen given by: RAMS /05/$ IEEE Auhorized licensed use limied o: IEEE Xplore. Downloded on Ocober 3, :30 from IEEE Xplore. Resricions pply.

7 A m ASY = (8) 0 Q FU () 0 Q () 0 Q () 0,, 3, where he elemen of he reduced rnsiion re mrix in he i h row nd j h column is defined s i,j nd Q FU (0), Q (0) nd Q (0) re he iniil probbiliies of being in he FU, nd sysem ses. Therefore, noe h in his cse he soluion is dependen on he iniil condiions of he sysem.,, 3, 3.4 Mone Crlo Simulion Mehod Performing Mone Crlo simulion (MCS) involves consrucing nd using compuer model of he sysem under invesigion. This model is bsed on srucured, logicl sysem represenion nd conins se of rules h describe he response of he sysem o evens h occur o i during is lifeime [4]. These evens my be componen repirs, filures or sequences of filures or, in his cse, evens h will led o he implemenion of TLD nd is subsequen minennce dedlines. In fc, ny even my be dded o he model subjec o he complexiy of he sofwre used. MCS requires he generion of uniform se of rndom numbers. These rndom numbers re hen used o genere imes of componen filures by using he relevn filure disribuion ssocied wih ech componen. In he simulion code consruced during he course of his work he numbers genered re, in fc, pseudo-rndom. The sysem simulion my hen be run mny imes, mking noe fer ech simulion of ny prmeers of ineres, nd coninuing he simulions unil he required olernce is reched for hese prmeers. In he work presened here he prmeer of ineres h hd o be obined from he sysem ws is filure re. Ech simulion is crried ou unil suible poin in ime, wheher his be he lifeime of he sysem or he ime which he sysem fils. The lgorihm for he min module of he simulion progrm used in his work is given in Figure 8. When modeling sysem on which TLD will be pplied he correc scheduling of ll occurring evens is of gre impornce. In he MCS code used here he componen filure imes re iniilly genered nd dded o n rry h holds reference o he componen, long wih he ime h is filure will occur. A reference is lso kep of he order of ll he evens in he schedule nd his is upded s evens re removed from, or dded o, he schedule. As componen filures occur in he simulion lis of TLD crieri is checked o see if he filure of his componen will iniie, eiher on is own or in combinion wih oher componen filures, he implemenion of TLD dedline. If his is he cse he dedline iself is hen dded o he schedule long wih is ime of occurrence, which vries ccording o he dispch cegory for h priculr filure or combinion of filures. In ech simulion loop he firs even chronologiclly is removed from he schedule nd he simulion ime is dvnced o ime of his even. If his ime exceeds he,3,3 3,3 red sysem logic, componen filure nd repir disribuions nd TLD combinions from file inpu TLD opions se mx_sim_ime ol_sim_ime = 0, ol_fil = 0, filure_re = 0 while (filure re hs converged) mrker for simulion filure iniilized: flg = 0 iniil componen filures dded o empy schedule while (curren_sim_ ime mx_sim_ ime) curren_sim_ime = ime of s even in schedule remove s even from schedule if ( s even is componen filure) upde he sus of he sysem if (sysem fils due o his componen filure) simulion filed: flg = end his simulion if (TLD inervl iniied due o his filure) dd minennce dedlines o schedule else if ( s even is minennce dedline) implemen repirs ccording o minennce sregy else if ( s even is periodic inspecion) dd minennce dedline o schedule ol_sim_ime = ol_sim_ime + curren_sim_ime ol_fil = ol_fil + flg filure_re = ol_fil / ol_sim_ime check for convergence of filure re Figure 8. The Algorihm for he Min Module of he MCS. mximum lifeime of he sysem he simulion ends immediely. Oherwise, if he even is componen filure, he sus of he sysem is upded nd if he sysem fils he simulion ends. If he even is minennce dedline he pproprie repirs re crried ou o componens ccording o he minennce sregies being pplied o he sysem. In he cse of he sysem being modeled here his simply mens repiring he uni h filed o cuse he minennce dedline. Finlly, if he even is periodic inspecion, minennce dedline will be dded o he schedule he pproprie poin in ime. In he MCS code number of oher ssumpions re mde. These re: o The mximum lifeime of he sysem is se o be RAMS /05/$ IEEE Auhorized licensed use limied o: IEEE Xplore. Downloded on Ocober 3, :30 from IEEE Xplore. Resricions pply.

8 00000 fligh hours. This corresponds o lifeime of bou 37 yers for sysem used for 5 hours of fligh per dy, or 55 yers for sysem used for 0 hours per dy. o The lengh of fligh is 5 hours. This ws chosen since his ws used in he exmple in [] when fligh lengh is needed for he TWA modeling pproch. o Minennce operions nd inspecions cnno occur mid-fligh. Thus, for ny evens of his ype whose occurrence ime is clculed o occur in fligh, he ime of he even is moved o he beginning of h fligh. This is conservive pproch o his problem. I should be noed h, despie he fc h hey hve been used in order o model his priculr sysem, hese ssumpions my be esily chnged wihin he MCS code, if necessry. The code my lso be esily pplied o oher sysems. This is becuse he sysem upon which he simulion is o be implemened is supplied o he code in represenion of he form of is ful ree. Oher sysemspecific informion supplied o he code is he filure disribuion of ech componen, long wih is ssocied prmeers. The filure re of he sysem ws cully clculed fer every 000 simulions. Resuls were obined o n ccurcy of deciml plces (for filure re given in unis of number of filures per 0 6 fl. hrs.). If he filure re mched over 0 consecuive clculions convergence ws ssumed. 4. RESULTS Resuls were obined using ech of he bove modeling pproches for differing inervls of dispch for ech uni in he dul uni exmple. The dispch inervl for U () is represened s D nd he dispch inervl for U () s D. The MCS code ws used o model ll possible minennce sregies for he dul uni sysem, wih U nd U being minined using MEL nd/or PIR. The PIR minennce sregy ws simuled wih differing inspecion inervls, incremenlly from 0.5 o imes he lengh of he dispch inervl. Resuls re shown in Figure 9 for vlue of D=00 fl. hrs. s ws chosen in []. Presened in his wy i cn be seen h he resuls obined from ll of he mehods re similr. The resuls obined using he TWA pproch give n overesimion of he filure re in comprison o he oher pproches, nd ech of he MCS models gives similr resuls o he Mrkov model, which is cknowledged o be he more ccure of he wo pproches presened in [] nd [3]. Figure 0 shows he sme resuls presened s percenge difference from he resuls of he single ful se Mrkov pproch. The TWA resuls grow from 7.% bove hose of he single ful se Mrkov o 6.4% s D increses from 00 o 500 fl. hrs. All of he simulion resuls lie wihin 4% of he single ful se Mrkov resuls for D = 00 fl. hrs. As D increses from 00 o 500 fl. hrs. he simulion resuls remin close o he single ful se Mrkov resuls. However, s D rises he simulion resuls become progressively lrger in comprison o he single ful se Mrkov resuls. Indeed, when D = 500 fl. hrs. he resuls from ll of he simulions re greer hn he resuls single no. of filures per 0 6 fl. hrs. % difference D (fl. hrs.) D (fl. hrs.) fuls se model, by s much s 5.95%. A rend h is lso observed from he simulion resuls is h, for he mos pr, he sysem filure re is observed o be higher for he cse where boh unis re minined using PIR hn when one is repired using PIR nd one using MEL. The sysem filure res when boh unis re minined using MEL is he lowes obined from ll of he minennce sregies nd end o lie closes o he single ful se Mrkov resuls. These resuls re s would be expeced for his simple sysem. I should be noed h, for his simple dul uni sysem, ll of he modeling pproches br TWA give similr llowble dispch ime for he remining uni, given dispch ime for one of he unis, ssuming h filure re of 0 filures per 0 6 fl. hrs. mus no be exceeded. Noe h he resuls obined for he single ful se Mrkov model wih n rificil feedbck loop re, for his sysem, very close o hose chieved by using he convenionl Mrkov pproch o modeling he single ful se model wih iniil condiion h he sysem srs in he full-up se, i.e. boh unis work iniilly. 5. CONCLUSIONS MCS, U:PIR, U:PIR MCS, U:MEL, U:PIR MCS, U:PIR, U:MEL MCS, U:MEL, U:MEL TWA Single Ful Se Mrkov Figure 9. Comprison of Mehods D=00 fl. hrs. MCS, U:PIR, U:PIR MCS, U:MEL, U:PIR MCS, U:PIR, U:MEL MCS, U:MEL, U:MEL TWA Figure 0. Percenge Difference from Single Ful Se Mrkov D=00 fl. hrs. Ech of he mehods pplied o he dul uni sysem brings wih i boh dvnges nd disdvnges, some of he min exmples of which re shown in Tble. The MCS mehod proves o be mch for exising echniques for he simple dul uni sysem considered. However, he sligh differences in sysem filure re observed beween he MCS nd he single ful se Mrkov could grow lrger s he RAMS /05/$ IEEE Auhorized licensed use limied o: IEEE Xplore. Downloded on Ocober 3, :30 from IEEE Xplore. Resricions pply.

9 Mehod Advnges Disdvnges TWA ful ree Cler udible represenion of sysem filure logic. TLD inroduces dependencies beween he bsic evens, which re inpproprie for convenionl ful ree pproch. single ful se Mrkov/ convenionl Mrkov MCS Overcome problems ssocied wih dependencies in he sysem. Filure nd repir res re esily incorpored ino he model. Dependencies, non-consn filure res nd (ordered) combinions of fuls re esily del wih. PIR nd MEL minennce re esily modeled, including differen sregies for differen dispch cegories, e.g. -MEL, -PIR. Uses ful ree represenion of he sysem, which brings he ssocied dvnge of clriy of sysem filure logic represenion. More informion my be obined from he model hn wih oher mehods e.g. could idenify fuls wih inpproprie dispch inervls. Filure res pproximed from filure probbiliies. Only he MEL minennce sregy is modeled. Consn filure res re required. Model grows exponenilly nd becomes incresingly difficul o udi s he number of sysem ses increses (convenionl model). Involves n pproximion of he sysem, reducing he number of sysem ses nd ignoring mny combinions of fuls (single ful se only). Iniil generion of code my be ime-consuming however, he code cn be used for mny sysems. Exr CPU ime required o run mny simulions however, in comprison o he ime ken designing new ircrf nd gining cerificion his will be negligible. Tble. Advnges nd Disdvnges of he Differen Modeling Techniques. sysem being modeled becomes more complex. Preliminry work o invesige his heory, in which slighly more complex sysem is modeled, suggess he difference beween he echniques is greer hn for he dul uni sysem. REFERENCES. H. Lrsen, G. Horn, Time-Limied Dispch: An Inercive Trining nd Self-Sudy Course., Keybridge Technologies, Inc., 00.. FAA Memorndum: Policy for Time-Limied Dispch (TLD) of Engines Fied wih Full Auhoriy Digil Engine Conrols (FADEC) Sysems, June 9 00, Policy No. ANE TLD-R. 3. Guidelines for Time-Limied-Dispch (TLD) Anlysis for Elecronic Engine Conrol Sysems, SAE ARP 507, SAE Inernionl, J. D. Andrews, T. R. Moss, Relibiliy nd Risk Assessmen, nd Ediion, London, Professionl Engineering Publishing, 00. BIOGRAPHIES Drren R. Presco Deprmen of Aeronuicl nd Auomoive Engineering, Loughborough Universiy, Loughborough, Leicesershire, LE 3TU, UK e-mil: D.R.Presco@lboro.c.uk Drren Presco is currenly sudying for docore Loughborough Universiy, hving previously grdued wih firs clss honors degree in Mhemics nd gining msers degree wih disincion in Indusril Mhemicl Modeling. His curren reserch sudies re underken s pr of he Risk nd Relibiliy group in he Aeronuicl nd Auomoive Engineering deprmen of Loughborough Universiy. John D. Andrews Deprmen of Aeronuicl nd Auomoive Engineering, Loughborough Universiy, Loughborough, Leicesershire, LE 3TU, UK e-mil: J.D.Andrews@lboro.c.uk John Andrews is Professor of Sysems Relibiliy in he Deprmen of Aeronuicl nd Auomoive Engineering. He joined Loughborough Universiy in 989 hving previously gined nine yers indusril reserch experience wih Briish Gs. His curren reserch ineress concern he ssessmen of he sfey nd risk of poenilly hzrdous indusril civiies. This reserch hs been hevily suppored by indusril funding. Over recen yers grns hve been secured from BAE Sysems, MOD, Rolls-Royce, ExxonMobil nd Bechel. Professor Andrews hs numerous journl/conference publicions long wih joinly uhored book Relibiliy nd Risk Assessmen which is now in is second ediion. ACKNOWLEDGEMENT The uhors would like o cknowledge Phil Wilkinson for his involvemen nd suppor during he course of his work. RAMS /05/$ IEEE Auhorized licensed use limied o: IEEE Xplore. Downloded on Ocober 3, :30 from IEEE Xplore. Resricions pply.