3.6.2 Software reliability model In spite of all efforts to ensure that the software is free from errors, some residual errors (‘bugs’) often persist. Shooman has produced a simple model for software reliability which assumes that the average rate at which software bugs are detected and corrected from similar programs is approximately constant.’ The software failure rate will then be proportional to the number of remaining bugs. Thus if we assume: (a) no new bugs are created during the debugging process and (b) all detected errors are corrected then we have: Fractional number of residual bugs = Fractional number of total bugs — Fractional number of corrected bugs [3.13] where t = debugging time in months E, = total number of errors J; = total number of instructions @ scanned with OKEN ScannerSoftware reliability 78 Shooman’s experimental findings suggest that the ratio (Ey/Jr) approximately constant and lies in the range 3x wr <(F <10 (3.14] Tr In his model the fractional number of corrected bugs é¢(t) is proportional to tie. ec(t) = pt (3.15) where p = fractional rate at which errors are removed per month. Again p is approximately constant and lies in the range: 3 x 10-3

X > Y, then X is selected. If the X transducer fails, so that X =OmA, Y= 11.3mA and Z = 119mA, ie, Z > Y>X, then Y is selected. The system therefore survives the failure of ‘one transducer and is more reliable than the corresponding single channel system. If both X and Y transducers fail, ie. X =OmA, Y= OmA and Z~=I19mA, the program should select Z: however, since this possibility has not been considered in the specification, it is uncertain which value will be selected. An extra logical operation is required which selects the non-zero signal if the other two signals are zero. Software system design This follows from the specification and is often a flow chart (Fig. 3.5) which defines the program structure, test points, limits, efc, To be reliable a program must be robust, ie. it should be able to survive error conditions without serious effect such as ‘crashing’ or becoming locked in a loop. Structure Structured programming is a methodology that forces the programmer to use certain clear, well-defined methods of program design, rather than allow complete freedom to design intricate, complex programs which are prone to error and difficult to understand and debug. A major source of error is the @ scanned with OKEN ScannerFigure 3.5 Flow diagram for ‘middle value selector program X>¥? ence Soltovare reliability zs Road XM 1 Select ¥ 25¥>X y Y>Z>x | Yes Select Z Y X>¥ 2x Z>Xo¥ Select X vox xz AND) Yo Xoz Select X X>¥ ane No X>Z>¥ Select Z X> Voz {Yes Select ¥ @ scanned with OKEN ScannerFigure 3.6 Structured and unstructured programming 78 Failure rate data and models t several points in 2 in loops and branches. A use of the GOTO statements Ps “PX is greater than Y Ya ed, Fig. 3.5 two numbers, e.g. X and Y, are compar _ . the program branches one way, if Y is greater than X the program branches another way. Figure 3.6 shows how the above branch instruction = be programmed (using BASIC) either in an unstructured or a structured Way The unstructured method is sensitive to errors in the line numbers and it may be difficult to trace the line numbers back to the decision point. The structured method eliminates this dependency on line numbers and is casier to understand and check. No ves oa UNSTRUCTURED IfX> ¥go 10 X line number) tse goto ¥ tine number) Xiline number) ¥ line number) £ £_stmuctunep ifX> Ythen X (subroutine) a else Y (subroutine) Modularity Modular programming breaks a program down into smaller, individual blocks or modules cach one of which can be separately specified, written and tested. This makes the program much easier to understand and check The middle value selector program of Fig. 3.5 is an example of such a module. Fault tolerance Programs should be written so that if an error does occur, the program should be able to find its way out of the error condition and indicate the source of the error. This can be done, for example, by checking each program @ scanned with OKEN ScannerSoftware reliability 79 module in turn by comparing the value of the variable at the module output with a specified range of values : if a variable is out of range then the module which contains the error can quickly be identified. In applications where safety is vital, for example, where a computer is used to control an industrial Process, if an error does occur the program should first detect it, send an alarm message and then move the process to known safe conditions, Fault tolerance can also be provided using program redundancy. Here separately coded programs, i.e. programs written to the same specification by different Programmers, are cither run simultaneously on separate computers or at different times on one computer. A voting or selection procedure then decides | which output is to be used (Section 2.4 and Fig. 3.5). This method is based on the assumption that it is extremely unlikely that separately coded | Programs will contain the same coding errors but provides no protection against errors on the program specification. Languages | The reliability of software also depends on the computer language used. There are two main types of language in industrial use: (a) Assembly level programming (b) High level language programming Assembly level programs are faster to run and require less memory than \ high level programs and may be preferred for real-time systems, However, | assembly level programming is far more difficult ; a large number of detailed instructions, which are specific to a given processor, are required in order to perform a given operation. This makes checking far more difficult, also there are several types of error in assembly level programming which cannot be made in high level language. High level languages, for example, FORTRAN, BASIC, Ada, PASCAL, are processor-independent and operate using a compiler which translates the high level language into the assembly language of a given processor. High level languages therefore run more slowly and require more memory; programming and checking is, however, much simpler. The older high level languages, e.g. FORTRAN and BASIC, do not encourage structured programming. BASIC, for example, allows GOTO statements which are very | error prone. The newer languages, e.g. PASCAL and Ada, strongly encourage | structured programming and discourage the use of GOTO. statements; less } error prone statements such as IF...THEN...ELSE are used as an | alternative. } | i @ scanned with OKEN Scanner80 Failure rate data and models Software checking Modern high level language compilers have error detection capability so that errors of logic, syntax and other coding errors can be detected and corrected before an attempt is made to load the program. When the program is capable of being run, it is then necessary to confirm that it meets all requirements of the specification under alll anticipated input conditions, 3.7 Human reliability The subject of human reliability is a wide one; a large amount of data has been collected on the reliability of human response in a number of different situations. However, no adequate models exist which will enable the failure rate of a given human, carrying out a given operation, to be accurately predicted. This is because human failure rates for a given operation depend on a large number of factors which can be conveniently grouped under three main headings: intrinsic, environmental and stress. Intrinsic factors These cover the basic characteristics of an individual and include: Motivation — i.e. does the person want to perform the operation correctly”? Physical ability — ie. is the person physically capable of performing the operation? Mental ability — i.e. has the person the basic intelligence required. to perform the operation? Temperament ie. can the person remain sufficiently calm under stress to perform the operation? Concentration - i.e. can the person exclude all other influences while performing the operation? ‘Speed of response — can the person respond quickly enough in an emergency situation? Knowledge — has the person sufficient knowledge to carry out the operation correctly? Ideally, the characteristics required for a given operation or job should first be clearly identified and the selection process then designed to choose people with these characteristics. The selected personnel should then undergo @ course of training, which gives them the technical knowledge and relevant experience necessary for performance of the operation or job. @ scanned with OKEN ScannerHuman reliability 81 Environmental factors The reliability ofa given individual, performing a given operation, will depend on the total environment in which the individual is working. This total environment is made up of physical, organizational and personal factors. Physical factors include: temperature, humidity, noise level, dirt, time of day (eg. night shift). Organizational factors include: relationship with colleagues, relationship with supervisor/management, job satisfaction, salary/wages, job security, promotion prospects. Personal factors include hunger, thirst, tiredness, physical and mental health, home life. Stress factors ‘The reliability of a given person performing a given task in a given environment depends on their stress level. Figure 3.7 shows qualitatively the relation between human error rate (expressed in number of errors per operation) and stress level. It can be seen that there is an optimum stress level at which the error rate is minimum; if the person is either bored or overexcited the error rate increases. A recent UK aircraft crash shows the effect of stress on error rate: in a situation where one engine was on fire he crew shut down the good engine. and one was working normal Error rate 4 (No. of errors per operation) red Optimum ‘Overexcit Figure 3.7 Effect of stress level Boret pti recited ‘on human error rate ‘ Research also indicates that human error rate increases significantly as the complexity of the operation or task increases. Some suggested error rates are: 1074 to 107? for simplest possible tasks, e.g. failure to respond to an annunciator, reading a single alphanumeric digit wrongly. @ scanned with OKEN Scanner82 Failure rate data and models cg. failure to read analogue 1073 to 107? for routine simple ta’ indicator correctly, failure to correctly replace a printed circuit board. 10-2 to 10°! for routine tasks requiring care, e.g. typing in a character wrongly, failure to reset a valve after a related task. for complicated non-routine tasks, e.g. failure to notice 107! tol position of valves, failure to act correctly after one minute in an emergency situation. 3.8 Conclusion In general there is a large amount of good failure rate data for most engineering components and elements. This is especially so for electronic components where detailed failure rate models exist. However, it is far more difficult to predict software and human reliability. References 1. Wright R I (SRD Warrington) 1984 Instrument reliability. Instrument Science and Technology. Vol 1. Bristol, Institute of Physics: 82-92 2. Smith D J 1988 Reliability and Maintainability in Perspective. 3rd Edn. Basingstoke, Macmillan : 243-9 3. Lees F P 1976 The reliability of instrumentation. Chemistry and Industry, March: 195-205 4. Carter A D S 1986 Mechanical Reliability. 2nd Edn. Basingstoke, Macmillan: 20-63 5. National Semiconductor Corporation 1987 The Reliability Handbook. 3rd Edn. Santa Clara, California, January: 131-2 6. Hellyer EI Gc (Protech Instruments and Systems) 1985 The application of reliability engineering to high integrity plant control systems. Measurement and Control 18 June: 172-6 7. Shooman M L 1979 In T Anderson and B Randell (Eds) Computing Systems Reliability Cambridge, CUP @ scanned with OKEN Scanner26 Principles of quality and reliability 13.5.2 Mutually exclusive events These are events that cannot happen at the same time, the beelied of one event prohibits the other event; for example, light bulb cannot be both on and of, [Link] Simultaneous events — product rule Suppose that A and B are independent events which are non-mutually exclusive and that Pa is the probability of A occurring and Pp the probability of B occurring. The probabilities Py and Py are represented by the areas of the circles A and B in the Venn diagram (Fig, 1.10). The probability of both events A and B occurring is equal to the product of the individual probabil ie. product rule for simultaneous events [1.34] AND B 10 Venn diagram for ‘ous events and is represented by the shaded overlap area in Fig. 1.10. For mutually exclusive events, P,P, = 0 and the overlap area is zero. In general, if there are n independent non-mutually exclusive events with probabilities Py, Pay -»s Piy-++y Py then the probability of event 1 and event 2... and event j...and event n occurring is given by: product rule [1.35] @ scanned with OKEN ScannerTho reliability of a product 20 1.384 Occurrence % Occurrence of atleast one of soveral events ~ addition rule Given th ilities P B occur n eebilties P, and P, of the individual independent events A and ene i we also need to know the probability of either event A or Napa ott events occurring. This is represented by the total area of the Cverlapping circles in Fig. 1.10 and is given by: P, probability of ‘AOR BOR BOTH = Py + Py — PyPy either event [1.36] orboth ‘-. by the sum of the areas of the individual circles less the area of overlap. If the events are also mutually exclusive, then the probability P,P, of both events occurring is zero; the Probability of A or B occurring is then given by the sum of the individual probabilities probability of Paorn = Pa + Py either event [1.37] ~addition rule In general if there are n independent, mutually exclusive events with probabilities P,, P,,..., Pi,...,P,, then the probability of event 1 or event 2... or event i... or event n occurring is given by: daiti Pronzontnonn = Pit Peto +R +P, | addition [1.38] The above addition rule may also be approximately true for n independent, non-mutually exclusive events where the probabilities of the events occurring simultaneously is small. For example, if we have Py=P,=0.1 and P,Pq = 0.01 then from Eq. 1.36 we have = 0.1 +0.1—0.01 = 0.19 and from Eq. 1.37: Pat Py = 0.20 ie. the error introduced by using the addition rule is only 5%. This is called the rare events approximation. @ scanned with OKEN Scanner30 Principles of quality and reliability 13.5.5 The binomial distribution e probability distribution which applies ials are made and there are only two ample a coin is tossed ten times, ‘alculate the probability of getting n is therefore The binomial distribution is a diseret in situations where n independent tri possible outcomes to each trial. If, for ex the binomial distribution can be used to ¢! 7 heads ten times or tails three times. The binomial distributior very useful in reliability engineering where there are only two possible outcomes, survival with probability R and failure with probability F. The binomial distribution is obtained from the polynomial expansion of (R + F)", since R + F = 1 we also have: FR fee (R+ FY = Re oR OF +" MIN BLD poi +nRF"! + F" i = "CRF [1.39] =o where "C= a!/[(n —J)!i!- The first term R" represents the probability of n survivals in n trials, the second term nR"~'F the probability of n — 1 survivals in n trials, and the jth term "C)R"~JF the probability of n —j survivals in n trials. Examples of the use of the binomial distributions are given in Section 2.4, Example 2.2 and in Section 6.5.2. : 14 Conclusion This chapter has explained and defined the concepts of quali iabili : xplained and quality and and discussed their relationship and then shown how they hearin References 1, BS 5760: 1986 Reliability of Constructed or Manufactured Pr 5 rodu Equipments and Components, Part Q: Introductory Guide to Reliabiliy, ta z British Standards Institution: 2 ae 2, Thomson J R 1987 Engineering Safety Assessment, Harlow, Longman: 10-13 @ scanned with OKEN Scannerre 2.1] Markov state ‘ams: (a) two state ‘am for single element ; hree state diagram for by system 50 _ Reliability of systems > | 2.7 Availability of systems 1.32 we examined the failure pattern for N items of a sin 7 sable clement over a test interval T and defined mean time betyees arab) terval oped . ip 7 MTBF and mean down time MDT (Eqs 1.18 and 1.19), We then failures } a defined availability A by: Total up time availability = 7 1 up time + Total down time giving: eat (223 “* MTBF + MDT Pee ce Using similar arguments, unavailability U is given by: er (224) MTBF + MDT so that we have A+ U =1 In order to be able to calculate the availability of systems of repairable elements the techniques of Markov analysis can be used.! We first apply this analysis to a single repairable element; at any time ¢ the element can only be in one of two possible states: state 0 the up state, or state 1 the down state (Fig. 2.11(a)). The element moves from state 0 to state 1 as a result @ scanned with OKEN ScannerAvailability of systems 51 offailure, a constant failure rate 2 is assumed, where 2 = 1/MTBF. Similarly the clement moves from state 1 to state 0 as a result of repair, a constant Tepair rate qt is assumed, where p= 1/MDT. If Po(t), P,(t) are the Probabilities of the element being in states 0 and I respectively at time t, then the probability that the element isin state Oat timet + Atis given by: Po(t + At) = Probability of being in 0 at time ¢ and probability of not failing between ¢ and ¢ + At or Probability of being in 1 at time ¢ and Probability of being repaired between ¢ and ¢ + At. From Eq. 1.24 the probability of failure between ¢ and ¢ + At is 2 At, the Probability of not failing is (1 — 7 Ar); similarly the probability of repair is u At, Using the addition and multiplication rules for probabilities (Eqs 1.34 and 1.37) we have: Po(t + At) = Po(t)(1—2At) + Py(t) wat [2.25] Using similar arguments for state 1 we have: Pi(t-+ At) = Po(t)A At + P,(t)(1 — At) [2.26] Rearranging these equations gives: Po(t + At) ~ Po(t) At ~APo(t) + MP, (t) [2.27] Pi(t + At) — P,(t) = Po(t) — uP, (t) [2.28] In the limit that At > 0, the equations become: 4 oe =APo(t) + uP, (0) [2.29] d o = APo(t) — uP, (t) (2.30) Since P(t) + Py(t) = 1, Eq. 2.29 simplifies to: dP, a a TH ANPOt) + (231) @ scanned with OKEN Scannerity of systems 52 Reliabi 1 3 ang the initial condition Po(0)=1 gives 1 ing Eq. 2.31 and using the ' i Integrating Eq. 23 g following solution © A ; - —(u +A) [2.32] Polt)= yeh etd ea Similarly integrating Eq. 2.30 gives [2.33] 41 —expl—(H + AT} MO ility Ass is the long term probabillty that the ‘The steady state availal clement is in the up state, ie: [2.34] Ass him Po(t) = Po(o) = pea Similarly the steady state unavailability Uss is the long term probability that the element is in the down state, i.e. 7 5 =. 235 Usg = lim P(t) = Py(20) = [235] By substituting 2 = 1/MTBF and p= 1/MDT, we can show that Eqs 2.34 and 2.35 are identical with Eqs 2.23 and 2.24. Thus if we consider a single element with 2 = 1.0 year? and MDT = 1 week = 1/52 year, ie. 1 = 52 year”, the corresponding availability A = 52/53 = 0.981. Since availability is simply the long term probability that a repairable system is in the up state, the calculation of availability of series and parallel systems is similar to that of reliability. Thus for a series system consisting of m elements (Fig. 2.1) with individual availabilities A,, Ay, ..., Aiy «++ Am respectively, the system availability Agysr is the product of the individual clement availabilities, ie. : il Asyst = AyA2A3+ ++ Ay “Ay availa ity system [2.36] Thus the availability of a syste Poe reduced to Asysr = (0: outs ae of the above elements in series iS @ scanned with OKEN Scanner1.16 onents, we can find 7 using Pq. For non-repairable comp. N 1 131] Yee MITE L where A, = total number of failures Mie Y 7 = total up time MTTF = mean time to fail Fusing Eq. 1.20 ie. For repairable clements, we can cateulate 7 using Eq. 1.206 - Ne : [32] YoY ty) NTN x MDT MTBE Table 3.1. Observed average failure rate data for some mechanical, hydraulic and pneumatic components, Main type of fault (%a/kh) Component Hellows (metal) Rupture os Bourdon tubes Leakape 0.005 Creep) 002 Diaphragms (metal) Rupture os (rubber compound) Rupture os Fitters (sintered ceramic) Blockage o1 Leakage a Fulerums Wear of knife edge Lo. Gaskets Leakage iy Gruby serews (or clamp serews} Loose 005 Guides (valve) lambs 00s Hair spnings o1 Hoses (plastic) 40 Joints (pipe) 00s Joints (mechanical) 002 Joints (ball) 010 Nuts, bolts, rods, shalts, ete 0002 O-ring seals 002 Oniices 0.05 Onifives: variable Calibration of blockage 10 Pivots Breakage or weat o1 Pipes (metal He OF Lea 002 Pressure vessels hag 03 Rack and pinion a Wear or jambing 02 Restriction Blockage os cals Leakage ‘ons rings (return force) Breakage 001 on, helical) Breakage 002 Crosp 02 Leakage 02 Blockage 005 @ scanned with OKEN Scannerye me total number of elements = total down time MDT = mean down time M = mea ITBF = mean time between failures N Size g, Table 3.1 gives Bives the observed average failure rate data for typical in terms of percent us and pneumatic components. The values are expressed values applicabt '@ge of components failing per 1000 hours, and are average siress valoes nnd oy large samples of components, working at nominal Section 3.3) Thee erating under normal environmental conditions (see terms of the manne TIaeS Should be divided by 100 to give failure rates in Table 39 ember of failures per 1000 hours able 3.2 giv urs: componente anes the, Cbserved average failure rates for some electronic bane ‘MIS expressed in terms of failure rates per 10° hours.’ The assi ‘i F . os low electrical stress and average environmental conditions tee fon ae, The numerical values are for components which have been in ‘SF Over 10000 hours. so that early failure effects are likely to be eliminated. y Table 3.2. Observed average failure rate data for some electronic components (after Wright! ) | SSS | ‘Component Type Failure rate (failures /10° h) Resistor Metal oxide 0.001 | Wirewound 0.002 Capacitor Plastic film 0.0001 Ceramic 0.002 Aluminium, electrolytic ou Solid tantalum, electrolytic 0.0001 Transistor npn, small signal 0.003 FET. ‘Small signal 0.04 Diode Rectifier 0.004 Logic switching 0.003 Zener 002 Two-input gate cmos 0.02 Flip-flop cmos ou Operational amplifier Silicon monolithic ous Voltage regulator Silicon monolithic 0.04 Switch contact oO. Transformer Audio, small signal 0.02 Fuse O41 Lamp Filament (under-run) 0.05 Meter 10.0 Connector Coaxial 0.63 Trimpot Cermet 26 @ scanned with OKEN Scanner61 tors influencing failure rate Table 3.4, Observed failure rates for larger mechanical, electrical and electronic items (after Smith?) Ttem Failure rate (in failures n hours) Compressor Centrifugal, turbine driven 150 Reciprocating, turbine driven 500 Electric motor driven 100 300 Computer Mainframe 4000 8000 Mini 100 500 Micro (CPU) 30 100 PLC 20 50 Generator AC 3 30 DC 1 10 | Turbine set 10 200 800 | Motor set 30 70 Diesel set 125 4000 Power supply DC/DC converter 2 20 AC/DC stabilized 5 20 Printed circuit boards Single-sided 0.02 Double (plated through) 01 03 Multilayer 0.07 On Printer (line) 300 1000 | Pumps | Centrifugal 10 50 100 | Boiler 100 700 Fire water diesel 200 3000 electric 200 500 | Turbine, steam 30 80 ae Table 3.3 gives the observed average failure rates for typical instruments in a variety of operating environments. These data have been taken from the UK data bank operated by the Systems Reliability Service (SRS).! Table 3.4 gives the observed failure rates for larger, more complex mechanical, electrical and electronic items of equipment. The failure rates are expressed in failures per 10° hours. In cases where there is good agreement between different sources a single figure is quoted. In most cases two or three figures are quoted to indicate a range of values. @ scanned with OKEN Scanner