failure frequencies of non-coherent structures

Reliability Engineering and System Safety 41 (1993) 209-215

Failure frequencies of non-coherent structures

G. Becker Technische Universitiit Berlin, lnstitut fiir ProzeB- und Anlagentechnik, Marchstr. 18, Berlin 10587, Germany

&

L. Camarinopoulos Aristotelian University of Thessaloniki, Department of Mathematics, Physics and Computer Science,

Thessaloniki, 540 06 Greece

(Received 23 September 1992; accepted 14 January 1993)

Algorithms to determine the failure frequency of a non-coherent structure function are few, and they depend on the knowledge of the prime implicants. For coherent structures, there exists a well-known approach based on criticality and the Birnbaum importance measure, which is more flexible concerning the form in which the structure function is given. This concept is extended to cover non-coherent structure functions by considering two types of criticality functions and a corresponding extension of the Birnbaum importance measure. This theory is a generalization of presently existing concepts, as it includes systems described by prime implicants as well as coherent systems. For the components, renewal frequency densities are required in addition to failure frequency densities and unavailabilities. For common component models, these are given to show that everything that can be done for coherent systems can also be achieved for non-coherent ones. This includes also the method of modularization, which is addressed in a final section. The topic of multi-state components is not addressed in this paper.

1 INTRODUCTION

Reliability analysis by the fault tree method or by reliability block diagrams is sometimes referred to as Boolean reliability modelling, as either method is based on a different graphical representat ion of a Boolean function, which relates component behaviour (intact or failed) to system behaviour. Boolean logic is a two-state logic using the integer numbers 0 and 1. If the meaning of 'failed' is assigned to the number 0, and ' intact ' to the number 1, the Boolean function is called a structure function. If the assignments are chosen the other way round, i.e. 0 is mapped to ' intact ' and 1 to ' failed' , which is sometimes called 'negative logic', the resulting Boolean function is called a failure function. As the fault tree method, which is presently most widely used for reliability analysis in practice, nearly exclusively makes use of failure functions, and as it is confusing to intermix both conventions in the same paper , this paper is

Reliability Engineering and System Safety 0951-8320/93/$06.00 (~) 1993 Elsevier Science Publishers Ltd, England.

209

restricted to failure functions, which implies no loss of generality, as every failure function can be transformed into an equivalent structure function and vice versa. This isomorphism has been described in detail by Alesso ~ and is covered there in Theorem 2.

Reliability modelling presently is per formed in practice only for a subclass of the Boolean functions, which are called coherent or monotonic functions. A Boolean function ~ of a vector of components x (with n elements) is coherent if the following conditions hold:

~o(0) = 0 (1)

qg(1) = 1 (2)

(p (Xl ' X2 . . . . . Xi I ' O, Xi+ l . . . . . X n )

-< qg(xt, x2 . . . . . xi-1, 1, Xi+ 1 . . . . . X n ) (3)

For eqn (3), a shorthand notation is used in this paper:

qo(Oi, x) --< g0(1,, x) (4)

Put into plain words, this means that a coherent system is intact if all its components are intact (eqn (1)), it is failed if all its components are failed (eqn

210 G. Becker, L. Camarinopoulos

(2)), and, should it be failed, failure of an additional component will not cause it to function again (or, if the system is intact, repair of one of the failed components will not fail it) (eqn (3) or (4)).

If the failure function can be written in a form that contains only conjunctions and disjunctions, but no negations, the system is coherent in the strict sense, as defined in eqns (1)-(3). Commercial reliability analysis codes offer few facilities to handle non- coherent structures. If negated events are included at all, quantification will occur with constant figures only, which corresponds to an unavailability calculation.

Whereas unavailability calculations for non- coherent systems can be performed by taking the expectation of the failure function in much the same way, as is possible for coherent systems 2 (though some approximative techniques do not work3), little has been published on the determination of failure frequencies, and existing approaches depend on the failure function being given in a special form, in terms of its prime implicantsf1-7 This appears to be unsatisfactory as, for a coherent system, the system failure frequency may be determined using the concepts of criticality and Birnbaum importance ~ for a much more general class of Boolean function. An extension of these concepts has been developed, which allows for computation of frequencies for non-coherent systems.

in the following, a simple example will be introduced, which will serve for demonstration purposes. Then, after a brief review of frequency computation for coherent systems using criticality functions and Birnbaum importance, this concept is generalized to allow for frequency calculations for any non-coherent system.

2 A SIMPLE EXAMPLE FOR A NON- COHERENT SYSTEM

Practitioners frequently ask to what extent non- coherent systems occur in realistic situations, and may even doubt whether they exist at all. The example given in Ref. 4 is not very convincing: though the prime implicants given certainly are non-coherent; it can be doubted whether they correctly reflect the behaviour of the given technical system. Non-coherent structures do occur, however, as will be shown by a more obvious example. Typically, a system may be non-coherent if it contains some redundant components which share a resource which, due to some limitation, cannot supply all redundancies at the same time. Such a system will contain some switching device, which has the function to keep the number components required active and spare ones inactive. If the switching device fails with respect to this function,

Supply

S

7

Radiator

! i

Radiator ]

a .... r b T I

Fig. 1. A simple non-coherent structure.

the system will fail if the redundant components are all intact, but it will work if some redundancies are not operational.

A very simple system with the property outlined above is given in Fig. l. It consists of two electric radiators a and b, which might form an emergency heating system for the apartment of one of the authors. As the mains can supply just one of these radiators, there is a switch s, which allows one to switch between the radiators and has the function to connect at most one of the radiators to the electric supply. Now, the switch has a failure node, which causes all of its poles to be short-circuited with one another. If this happens, the system will be defective if both radiators are intact, but it will be intact if one of the radiators is failed. As the system is also failed, if both redundant radiators are defective it can be seen easily that the failure function is given by

cp(a, b, s) = ab + s(1 - a)(1 - b). (5)

If the object is the determination of the unavailability, it can be found by taking the expectation of eqn (5), which is in a form applicable for the substitution rule, which states that if a failure function is in the form of a sum of disjunct product terms, and if the events associated with the Boolean variables are independent, the component unavailabilities may be substituted for the corresponding Boolean variables to determine system unavailability. Hence

U~,,~ = U~Uh + U~(1 - U.)(1 - Uh) (6)

In this case, for realistically small component unavailability values, the negated terms in eqn (5) could be neglected. This yields a system with no negated events with a conservative unavailability result. If, however, the failure frequency is to be found, such a simple approximation can no longer be given.

3 CRITICALITY, MARGINAL IMPORTANCE AND SYSTEM FAILURE FREQUENCY

In the following section, the concepts and terminology of criticality, marginal (Birnbaum) importance and

Failure frequencies of non-coherent structures 211

system failure frequency will be reviewed for coherent systems. This approach will then be extended to non-coherent systems.

3.1 Concepts and terminology for coherent systems

A component i is called critical for the system under consideration, if the system is in such a state that if that component is intact the system is intact, and if the component is defective the system is defective. Using the shorthand notation of eqn (4), these two conditions can be written as

(~(1i, x) = 1) and (qg(0~, x) = 0) (7)

A Boolean function which yields the value of 1 exactly when the conditions (7) hold is called the criticality function of component i, denoted by q~. Such a function may be expressed as

x ) (1 - x ) ) (8) o r

q~i = (p(1,, x) - cp(1,, x)(p(0,, x) (9)

The form (9) of the criticality function may be simplified further if the Boolean function under consideration is coherent. In this case, the criticality function assumes the well-known form s

q0{= (p(1,, x) - q~(O,, x) (10)

This follows from eqn (4). For some realizations of x, (p(li, x) will be equal to q0(0~, x). For these, eqn (10) obviously holds due to the law of idempotency (stating that a Boolean object taken to any power greater than one is identical with the object itself). For all other realizations of x, ~(l i , x) must be greater than (p(0, x), which means that it must be equal to one. Thus eqn (10) also holds in these cases.

Note that ~ is a Boolean function, just like q~ itself. Thus, the expectation of q~ is the probability p~f that component i is critical for the system, and it can be found in the usual way by bringing it into a form of disjunct products and substituting the component unavailability vector U for x, provided that the events associated with the Boolean variables are independent. By simple algebraic transforms, it can be shown for the right-hand side of eqn (10) that if it is in a form that has no such dependent factors,

tP(li, x) - tp(Oi, x) = O<p(x) (11) Oxi

From this, it can be concluded that, for a coherent system, the probability of criticality p~i is equal to the partial derivative of the system unavailability with respect to the unavailability of the component i. Both are identical and are known as the marginal importance of this component, according to Birn- baum. With this concept, it is easy to determine the

system failure frequency density h~, where h{(t)dt is the probability of system failure in some time interval (t, t +dt ) . In this time interval (t, t +d t ) , the system will fail if one of its components fails and the component is critical for the system at time t. This results in

h{(t) = ~ hfi(t)pJ(t) (12) Vi

where h{ is the failure frequency density of component i. For a parallel system, or a minimal cut set (this is a set of components which leads to system failure if all members of the set fail, and which is minimal with respect to this property), this results in the well-known relationship

h((t) = ~ h{(t) I-I uj(t) (13) Vi Vj~ i

which is implemented in most modern computer codes to quantify minimal cut sets.

3.2 An extension to cover non-coherent systems

Whereas system failure frequency density can be found via the criticality function for coherent structure functions and failure functions in a general way, up to now the only published algorithms depend on a special form of the failure function, its prime implicants. 4-6 In this section the method for coherent systems, as outlined above, is extended to find the failure frequency density for non-coherent systems in a similar way.

First, it can be noted that the formulation of the criticality function given in eqns (8) and (9) does not depend on coherence or non-coherence. Also, the system will fail if a component fails which is critical for the system. This, however, is not the only case when the system can fail. A non-coherent system may fail if one of its components changes to an intact state. Therefore a second type of critically function has to be introduced to represent such states where the system is intact when component i is failed, and the systems is failed when component i is intact. For the purpose of distinction, the criticality function t~ as defined by eqn (8) will be referred to as the f-criticality function (failure criticality function), whereas the new one will be called the r-criticality function q~7 (renewal criticality function). As in the previous section, q0~ can be expressed as

q~r = qg(0i, X)(1 -- cp(li, X)) (14)

Note that with a similar argument as was used for the derivation of eqn (10) above, it can be shown that q0~: = 0 for a coherent system. The properties of q97 are equivalent to those of tf~. It also is a Boolean function not depending on the state of component i. Thus, by takijng expectation, the probability p~r that a component is r-critical can easily be determined.


Now the probability that a component is critical for a system, and the partial derivative of system unavailability, are no longer the same. The latter has to be evaluated by taking the expectation of eqn (11). For a non-coherent system, this is not a probability; it may assume values between - 1 and 1. Subsequently, the expectation of eqn (11) will be referred to as Birnbaum's importance measure, bearing in mind that it has lost one of its interpretations if the system is non-coherent.

With this concept of criticality, it is easy to find the failure frequency of a non-coherent system. A system will fail in some time interval (t, t + d t ) if in this interval either a component fails which is f-critical for the system, or a component is repaired which is r-critical for the system. This result in

h~(t) = ~ h{(t)p'/(t) + ~ hT(t)p}~(t) (15) V i V t

This result is valid under the assumption that at most one component will fail or be repaired in an infinitesimally small interval of time. This is true for such events between different components, as the components are assumed to behave independently of each other. For the fai lure-repair event of one component, this is not necessarily true. For example, if the instantaneous renewal model is applied, failure and repair will always occur at the same time. However, from the definition of criticality, a component cannot be s-critical and r-critical at the same time. Thus, system failure due to failure of component i and due to repair of component i are exclusive events and eqn (15) holds even in this situation.

The case of instantaneous renewal is interesting for another reason, as in this case failure frequency density and renewal frequency density are identical. For a system composed of components where h{= h7 = h;, eqn (15) can be rewritten as

h.{(t) = ~ h;(t)(p'/(t) + p}~(t)) (16) Vi

where

p)~(r) +p}~(t) = E{q~7 + ~ } = E{q~,} (17)

% = 1 holds if the component is critical for the system in either way. With trivial algebraic transforms, it can be shown that

~; = I~(1,, x) - ~(0;, x)) (18)

Jackson 7 proposed using the expectation of eqn (18) as the definition of a 'Birnbaum importance for non-coherent systems'. With this definition, Birnbaum's meaure loses its property to yield the effect of changes of component unavailablity on system unavailability. Only if failure frequency density and renewal frequency density are identical can E{ (p; } be used for calculation of failure frequency density. This is clearly the case if there is instantaneous

renewal. It is approximately the case if the component state is observable and repair starts immediately after failure. It is definitely not the case if the state of the component cannot be monitored but by inspection, or if the component is non-repairable, as will be shown in Section 5. As eqn (18) is thus useful only in special cases for frequency determination, it appears to be better to leave the definition of Birnbaum's importance meaure as it is, and to see that for a non-coherent system it is generally not related to the probability that a component is critical.

As failure frequency density and renewal frequency density may be different for components, so may they be for systems. With a reasoning similar to the method used for the derivation of eqn (15), the system renewal frequency density h~ can be found to be given by

hf(t) = ~_, h~(t)p'/{t) + ~ h{(t)p',.'(t) (19) Vi V i

The renewal frequency density is especially useful if the structure is to be transformed into modules. As a module of a failure function is treated like an independent component , its renewal frequency density must be known in the same way as is required for components.

4 SOLUTION FOR THE EXAMPLE SYSTEM

As the example system is very simple, it could be evaluated manually. With the aid of modern symbolic equation processors, neither manual calculation nor the development of a new piece of software is necessary. The Mathematica program 9 requires only 10 statements for the solution of the example problem; a protocol is given in Fig. 2.

In the session protocol, user input is bold-faced and system responses are printed in normal style. Very briefly, the input may be described as follows. Statement (a) gives a rule to determine the linear form of a Boolean function. The function has to be expanded completely, and all powers of anything have to be omitted. Statements (b) and (c) give rules to determine the failure criticality function and the renewal criticality function according to eqns (8) and (14) respectively. These first three statements may be considered as a 'program'. Statement (d) defines the failure function under consideration. Statements (e) and (f) provide rules to associate numerical values for unavailabilities and frequency densities with the symbols for future use. Statements (g) and (h) determine the linear form of the failure function in symbolic form and numerically after substituting component unavailabilities to yield the system unavailability. Statements (i) and (j) finally determine the system failure frequency density in symbolic and numeric form respectively.


L i f O [ p _ ] : = ( p / / I x p ~ 1 1 ) / . x * n _ - > x

rKrltFa [ p _ , z _ ] : = L i f O [ ( p / . s - > 1 ) ( 1 - ( p / . z - > 0 ) ) ]

~ £ t R O [ p _ , s _ ] : - L i f o [ ( 1 - ( p / . s - > 1 ) ) ( p / . • - > 0 ) ]

ww ~ s (1 - a) (i - b) + a b

a b + (i - a) (i - b) s

U~v&ilabilltleg = {& - > 2 0 I 5 0 0 0 ,

b - > 2 0 1 5 0 0 0 ,

s - > 10 1 2 0 0 0 0 )

1 1 1

{a -> ---, b -> ---, s -> .... )

250 250 2000

Frequencies = {ha -> 1 / 5000,

h b - > 1 1 5 0 0 0 ,

h s - > 1 1 2 0 0 0 0 )

i 1 1

{ha -> .... , hb -> .... , hs -> ..... }

5000 5000 20000

Lifo [ F F ]

ab+ s- as- bs+ abs

SymteaUnav&ilability s Lifo [FF] /. Un&v&ilabilitie8 1/ N

0.000512008

Bystem~&ilureFrequencyDengity m

ha (FKrltFa [FF, &] + FKrltRe [FF, &]) +

hb (FKritFa [FF, b] + FKrltRe [FF, hi) ÷

h8 (FKrltFa [FF, 8l ÷ FKrltRe [FF, m] )

(i - a - b + a b) hs + hb (a + s - a s) +

ha (b + s - b s)

SystemFailureFrequencyDen|ity I. Unavailabilities I.

Frequencies I I N

0.0000514

Fig. 2. Protocol of a Mathematica session to solve the simple example.

(-) (b) (c)

(d)

(e)

(f)

(g)

(h)

(i)

5 C O M P O N E N T M O D E L S F O R N O N - C O H E R E N T SYSTEMS

Some simple component models are in widespread use for the time dependent evaluation of system reliability parameters like unavailability and failure frequency. For these models, relations describing unavailability and failure frequency density have been published in several papers. These relations will be repeated here in addition to the renewal frequency density, which is required to evaluate non-coherent systems. For the sake of practical use, all relations will be given for the case of exponentially distributed lifetimes with a failure rate A and exponentially distributed repair times with a repair rate p. The unavailability is denoted by U(t), the failure frequency density by hf(t), and the renewal frequency density by h~(t).

5.1 The observable component model

For a component which is observable (or self- annunciating), it is assumed that a failure is noticed immediately and repair action is started at once. With

some simplifying assumptions, this leads to an alternating renewal process. Solving it for durations with constant rates leads to

U(t) = ~ (1 - exp(-(~, + p)t)) (20)

hI ( t )=~p (l +~exp(-(~.+ p)t))) (21)

W(t) = ~ (1 - exp(-(~, + /9)) (22) A-t-p

5.2 The instantaneous renewal model

A simplified version of the observable component model is the instantaneous renewal model. Renewal occurs at the same instant of failure, which corresponds to an infinite repair rate. This results in

U(t) = 0 (23)

hf (t) = hr(t) = ~. (24)


5.3 The non-repairable component model

A component which is not repaired observation period is described by

U(t) = 1 - exp(-)~t)

hl(t) = ~. exp(-~.t)

hr(t) = 0

during the

(25)

(26)

(27)

5.4 The basic inspection model

If state change of a component is not annunciated immediately, components are frequently inspected at given time points Tk and repaired, if necessary. The frequently used basic inspection model is valid with the following assumptions. After an inspection, the component is as good as new (which is always true, if the lifetime distribution is constant), the inspection is performed without disturbing the intended function of the component, and repair time is negligible. This results in

U(t )= l - e x p ( - ) ~ ( t - Tk)) Tk <-t < Tk+, (28)

h J ( t ) = , ~ e x p ( - ; ~ ( t - Tk)) Tk <-t<Tk+~ (29)

hr(t) = ~] (1 - exp(-~.(Tk - Tk ,))) 6(t -- Tk) VT~

"ilk --< t < L +, (30)

where 6 is the Dirac pulse function and T. = 0.

6 MODULES IN NON-COHERENT STRUCTURES

question whether a finest modular decomposition exists for these. Secondly, it must be pointed out that, if a module behaves like a component , the renewal frequency density of the module is required in the same way as it is for components. It can be determined using eqn (19).

For practical purposes, e.g. in fault tree analysis, the finest modular decomposition is not used, but rather, modules are identified from the structure of the fault tree (being sub-trees, which have a single entry point from the rest of the tree). Thus, modularization techniques used in practice apply to non-coherent systems.

7 CONCLUSION

An extension to the concept of criticality has been used for failure frequency determination of non- coherent systems. It can be shown that a time dependent frequency density calculation can be performed with the usual component models in the same way as is possible for coherent systems. For this purpose, it is necessary to see a distinction between Birnbaum's importance measure and probability of criticality. Non-coherent systems do exist; examples from the literature show this, and a very simple example has been provided in this paper. The mathematical framework is available to handle them in the same way as coherent structures. It is only a matter of programming to create fault tree codes with this capability.

Informally, a module of a failure function is a group of components which acts like a single component and thus may be evaluated separately. If modules can be identified, the evaluation of a structure, e.g. a fault tree, becomes considerably simpler. Formally, a set of components Xm is a module if the failure function can be written as

cp(x) = ~P(X(x,,), xa) (31)

where Xm and Xd are disjoint, and ~p and X are Boolean functions. A module is a proper module unless it is a trivial module, i.e. Xm or Xd consists of one component or less. All this is completely unaffected by the question whether the structure is coherent or not.

There are two main differences, however, which should be noted. Using results from game theory, Billera ~° and Chatterjee ~ have shown that a unique finest modular decomposition exists for coherent structures. These proofs heavily depend on the representation of the failure function in terms of cut sets and path sets. Thus, they are not valid for non-coherent structures, and it is indeed an open

REFERENCES

1. Alesso, H. P., Some algebraic aspects of decomposed non-coherent structure functions, Reliability Engineering, 5 (1983) 129-38.

2. Alesso, H. P. & Benson, H. J., Fault tree and reliability relationships for analyzing non-coherent two-state systems, Nuclear Engineering & Design, 56 (1980) 309-14.

3. Chu, T. L. & Apostolakis, G., Methods for probabilistic analysis of noncoherent fault trees, IEEE Trans. Reliability, R-29 (1980) 354-60.

4. Inagaki, T. & Henley, E. J., Probabilistic evaluation of prime implicants and top-events for non-coherent systems, IEEE Trans. Reliability, R-29 (1980) 361-77.

5. Bossche, A., The top-event's failure frequency for non coherent multi-state fault trees, Microelectronics & Reliability, 24 (1984) 707-15.

6. Bossche, A., Top-frequency calculation of multi-state fault trees including interstate frequencies, Microelectronics & Reliability, 26 (1986) 481-2.

7. Jackson, P. S., On the s-importance of elements and prime implicants of non-coherent systems, 1EEE Trans. Reliability, R-32 (1983) 21-5.

8. Birnbaum, Z. W., On the importance of different components in a multicomponent system, in


Multivariate Analysis II, ed. P. R. Krishnaih, Academic Press, New York, 1969, pp. 581-92.

9. Wolfram, S., Mathematica---a System for Doing Mathemathics by Computer, Addison-Wesley, Califor- nia, 1991.

10. Billera, L. J., On the composition and decomposition of

clutters, J. Combinatorial Theory, 11 (1971) 234-45. 11. Chatterjee, P., Modularization of fault trees: a method

to reduce the cost of the analysis. In: Reliability and Fault Tree Analysis, Society for the Industrial Application of Mathematics. Philadelphia, USA, 1975, pp. 101-26.

failure frequencies of non-coherent structures

Documents