Modelling Methods

Reliability Engineering

16EPEX15_SIS_Anbu
1
Introduction
• Given the failure rate of a component and an operational time
interval (mission time), one can calculate the reliability of that
component.

• If the failure rates, proof test interval, proof test coverage, and
component lifetime are known, one can calculate the average
probability of failure.

16EPEX15_SIS_Anbu
2
Introduction
• But the problem is usually much more complicated. Real problems
involve systems of many components.

• Many of these systems have “redundancy” designed into the system

in order to maintain successful system operation even when a
component fails.

• How does one calculate reliability or availability of these complex

systems?

16EPEX15_SIS_Anbu
3
A redundant system

16EPEX15_SIS_Anbu
4
Modelling Methods

Reliability Block Diagram

Fault Trees
Markov Models
16EPEX15_SIS_Anbu
5
Reliability Block Diagram

16EPEX15_SIS_Anbu
6
Reliability Block Diagram

• Many reliability engineers use block diagrams to represent the

construction of a system from a reliability perspective.

• A Reliability Block Diagram (RBD) is a method of graphically showing

probability combinations.

• The overall concept in the RBD method is that a system is successful if

one can find a path across the drawing
16EPEX15_SIS_Anbu
7
Reliability Block Diagram (RBD)

Reliability Block Diagram Showing Successful System With One Failed Component

16EPEX15_SIS_Anbu
8
Reliability Block Diagram—Series System

The reliability of the system equals the product of the reliability of the
components, since the system is successful only if all components are
successful.

Rs = Ra × Rb × Rc × …
16EPEX15_SIS_Anbu
9
The unreliability of the system is given by the “union” of component
unreliability. For a two-component system, the equation is:

Fs = Fa + Fb – Fa × Fb

16EPEX15_SIS_Anbu
10
Example #1
A system consists of a power generator and a motor. The system is successful
only if both components are successful. The power generator has an
availability of 0.95 and the motor has an availability of 0.9. What is the
system availability?

 The system reliability equals the product of component reliabilities.

 The problem provides availabilities, not reliabilities, but the same equation applies as
the RBD method is a probability combination method. Therefore, the system
availability equals
As = 0.95 × 0.9 = 0.855

16EPEX15_SIS_Anbu
11
Example #2
A system consists of three sensors, a controller, a solenoid and an air-
operated valve. The system is successful only if all components are
successful. The sensors are identical and have steady state availabilities
of 0.96. The controller has a steady state availability of 0.999. The
solenoid has a steady state availability of 0.9 during its useful life of 5
years. The valve has a steady state availability of 0.9. What is the
system steady state availability?

The system availability is the product of the component availabilities.

In this case
As = 0.96 × 0.96 × 0.96 × 0.999 × 0.9 × 0.9 = 0.716

16EPEX15_SIS_Anbu
12
Example #3 Parallel System
A system consists of two power supplies. The system is successful only
if either component is successful. The two power supplies are the same
and have a reliability of 0.95 for a one-year mission time. What is the
system reliability?
The reliability for a parallel system is the “union” of the
reliabilities for the components.

A two-component system will be reliable if either

component A or component B is reliable.

For a two-component system, the equation is:

Rs = Ra + Rb – (Ra × Rb)
The unreliability of the system equals the product of the unreliability of the
components, since the system will fail only if all components fail.
Fs = Fa × Fb × Fc × ……
16EPEX15_SIS_Anbu
13
Example #3
A system consists of two power generators and two motors. The system
is successful if one set of components is successful. The power
generator has an availability of 0.95 and the motor has an availability of
0.9. What is the system availability?

Using reliability equation of series and parallel gives the solution

Rs = (0.95 × 0.9) + (0.95 × 0.9) – [(0.95 × 0.9) × (0.95 × 0.9)] = 0.9789

16EPEX15_SIS_Anbu
14
Another RBD example

When will the overall system fail? If A, B, or G failed

Which are all the redundant items? Items C and D, as well as E and F

16EPEX15_SIS_Anbu
15
Fault Trees

16EPEX15_SIS_Anbu
16
Fault Trees
• This technique begins with the definition of an “undesirable event,”
usually a system failure of some type.

• The analyst continues by identifying all events and combinations of

events that result in the identified undesirable event.

• The fault tree is therefore quite useful when modeling failures in a

specific failure mode.

16EPEX15_SIS_Anbu
17
• The fault tree method requires that one define an undesirable event
(often called the “top event”).

• Consider the equipment set used for the safety instrumented

function.

Safety Instrumented Function Equipment Set

16EPEX15_SIS_Anbu
18
PFD Fault tree for SIF For Dangerous Failure

16EPEX15_SIS_Anbu
19
PFS Fault tree for SIF For Safe Failure

16EPEX15_SIS_Anbu
20
Fault Tree Symbols - IEC 61025

16EPEX15_SIS_Anbu
21
Comparison of the Reliability Block Diagram and the Fault Tree

The fault tree modeler is focused on RBD modeler is focused on system

a failure event success

Fault tree with AND Gate

16EPEX15_SIS_Anbu
22
Comparison of the Reliability Block Diagram and the Fault Tree

The fault tree modeler is RBD modeler is focused on

focused on a failure event system success

Fault tree with OR Gate

16EPEX15_SIS_Anbu
23
Fault Tree AND Gates
• Fault trees can be solved quantitatively like any probability combination
method.

• With a two input AND gate, both events A and B must occur for the gate be
active.

• Referring to failure events, both failures must occur for the gate to be failed.

• (And from probability theory including definitions of independent events and

mutually exclusive events), then the probability of getting failure event A and
failure event B is given by the formula:
Fs = Fa × Fb
16EPEX15_SIS_Anbu
24
Example #1
A power system has a fault tree shown in Figure @ slide #22. Steady
state unavailability of the battery system is estimated to be 0.01
probability of failure at any moment in time). Steady state unavailability
of commercial power is estimated to be 0.0001. What is the steady
state unavailability of the power system?

The fault tree can be applied quantitatively. Since both power sources
must fail for the system to fail, then using the formula Fs = Fa × Fb

Steady state unavailability for the system = 0.01 × 0.0001 = 0.000001

16EPEX15_SIS_Anbu
25
Fault Tree OR Gates
• With an OR gate, when any of the inputs are true, then the gate output
will be true or, as we have indicated before, active.

• Quantitative evaluation requires summation of the probabilities.

• For non-mutually exclusive events (the correct case for independent

failures):
Fs = Fa + Fb – (Fa × Fb)

16EPEX15_SIS_Anbu
26
Example #2
A motion subsystem consists of a motor and a power source. If steady
state unavailability of a motor is 0.01 and steady state unavailability of
the power source is 0.001, what is the steady state unavailability of the
subsystem?

Applying; Fs = Fa + Fb – (Fa × Fb)

F(subsystem failure) = 0.01 + 0.001 – (.00001) = 0.01099

16EPEX15_SIS_Anbu
27
Example #3
Three thermocouples are used to sense temperature in a reactor. The three
signals are wired into a safety PLC, and a trip will occur if only one of the
sensors indicates a trip. The probability of failure in the safe mode (causing a
spurious trip) for a one-year mission time is 0.005. What is the probability of a
spurious (false) trip?

F(subsystem failure) = Fa + Fb + Fc – (Fa × Fb) – (Fa × Fc) – (Fb × Fc) + (Fa × Fb × Fc)

F(subsystem failure) = 0.005 + 0.005 + 0.005 – (0.005 × 0.005) – (0.005 × 0.005) –

(0.005 × 0.005) + (0.005 × 0.005 × 0.005) = 0.014925

16EPEX15_SIS_Anbu
28
Approximation Techniques
• To speed up and simplify the calculation, the faults and events in a fault tree
are sometimes assumed to be mutually exclusive and independent.

• probabilities for the OR gates are added.

• Probabilities for the AND gates are multiplied.

• This approximation technique can provide rough answers when

probabilities are low, as is the case when doing SIF verification.

• The approach is conservative when working with failure probabilities

because the method gives an answer that is larger than the accurate
answer.
16EPEX15_SIS_Anbu
29
Example #4
Use an approximation technique to estimate the probability of
subsystem failure for the example# 3.

If mutually exclusive events are assumed, then probabilities can be

added.

F(subsystem failure) = Fa + Fb + Fc = 0.005 + 0.005 + 0.005 = 0.015

16EPEX15_SIS_Anbu
30
Example #5
• Consider a system with one main valve and four secondary valves.
The system is successful if the main valve is successful or if all four of
the secondary valves are successful.
• The system will fail if the main valve and one of the secondary valves
fail.
• The main valve has one failure mode and a failure rate of 0.000003
failures per hour.
• The secondary valves have one failure mode and a failure rate of
0.000002 failures per hour.
• What is the probability of system failure if operated for a one-year
mission time?
16EPEX15_SIS_Anbu
31
 The probability of failure for defined interval of time is
unreliability.

For the main valve:

PF(one year) = 0.000003 failures per hour × 8760 hours per year
= 0.0263

For each secondary valve:

PF(one year) = 0.000002 failures per hour × 8760 hours per year
= 0.0175

16EPEX15_SIS_Anbu
32
The Fault tree…
PF (valve subsystem, one year) =
(0.0263 × 0.0175) + (0.0263 × 0.0175) +
(0.0263 × 0.0175) + (0.0263 × 0.0175)
= 0.00184

16EPEX15_SIS_Anbu
33
Alternative Valve Subsystem Fault Tree
PF (valve subsystem, one year)
= 0.0263 × (0.0175 + 0.0175 + 0.0175 + 0.0175)
= 0.00184

16EPEX15_SIS_Anbu
34
Markov Model

16EPEX15_SIS_Anbu
35
Markov Model
• The Markov model is a mathematical modeling technique used in
reliability and safety engineering to analyze systems that change
states over time with probabilistic transitions.

• It is particularly useful for modeling complex systems with repairable

components, redundancy, and dependencies between components.

16EPEX15_SIS_Anbu
36
Markov Model
• Markov models are a reliability and safety modeling technique that uses
state diagrams.

• These diagrams have only two simple symbols: a circle representing a

working or a failed system state and a transition arc representing a
movement between states caused by a failure or a repair.

16EPEX15_SIS_Anbu
37
Two State Model - Success and Failure

From State 0 (Working), the component can fail with rate λ.

From State 1 (Failed), the component can be repaired

with rate μ, returning to State 0

16EPEX15_SIS_Anbu
38
Redundant Dual System
Markov models can show redundancy
with different levels of redundant
components.

Figure shows a system with two

subsystems where only one is required
for successful system operation.

All failures are immediately recognized

and the repair probability is modeled
as a constant.

16EPEX15_SIS_Anbu
39
Redundant Dual Identical System

If both units in a dual redundant

system are identical (or close enough
so that we do not care which one
fails), the model can be simplified to
show only the number of failed units
in each state as shown here

16EPEX15_SIS_Anbu
40
Multiple Failure Modes

Markov models can show

multiple failure states on one
drawing

16EPEX15_SIS_Anbu
41
A Markov Model in a Nutshell
Circles (states) show combinations of successfully
operating components and failed components.

Possible component failures and repairs are shown

with transition arcs, arrows that go from one state to
another.

A number of different combinations of failed and

successful components are possible.

Some represent system success states, while others

represent system failure states.

Multiple failure modes can be shown on one drawing.

16EPEX15_SIS_Anbu
42
 Features of Markov Model
• On a single drawing, a Markov model can show the entire operation of a
fault tolerant control system including multiple failure modes.

• Different repair rates can be modeled for different failure situations.

• If the model is created completely, it will show full system success states.

• It will also show degraded states where the system is still operating
successfully but is vulnerable to further failures.

• The modelling technique provides clear ways to express failure sequences

and can be used to model time dependent probabilities.

16EPEX15_SIS_Anbu
43
 Markov models have been constructed for four
Markov Model Types fundamental classes of problems.

Markov models continuous states

State
discrete states
Two random
variables
continuous time
Time
discrete time

16EPEX15_SIS_Anbu
44
Box with Three Compartments and a Ball Problem
A ping-pong ball is placed in one compartment and the box
is tapped on the bottom periodically.

At every tap, the ping-pong bounces up.

There is a probability that the ball will move to a new

compartment or return to the existing compartment.

This is an example of a discrete time, discrete space Markov

model.

If the partitions were removed and the point where the ball
landed was recorded, the model would be a discrete time,
continuous state model.

16EPEX15_SIS_Anbu
45
Markov Solution Techniques
• A number of methods have been developed to solve Markov models.

• Some solution methods are not suitable for safety instrumented

function verification.

• When periodic inspection and repair are performed, solving for

steady-state unavailability is not correct.

• A “time interval” is chosen, and failure rates are scaled for that time
interval. The probability of a transition on each arc is given by the
failure rate multiplied by the time interval.

16EPEX15_SIS_Anbu
46
• By choosing very small time intervals, the model can be solved with
great accuracy.

• By convention, the scaled failure rate is listed above every transition

arc instead of the probability, which includes failure rate and time
interval.

• The time interval (∆t) is implied but rarely shown.

16EPEX15_SIS_Anbu
47
The Markov Model and Solution
Availability and unavailability of a single component can be derived using steady-state probability
techniques. Consider the example of a single repairable component

The P matrix for this model is

NOTE: The probabilities in a Markov model showing failure

rates (λ) and repair rates (µ)

16EPEX15_SIS_Anbu
48
The Markov Model and Solution
Limiting state probabilities are obtained by multiplying the matrices:

16EPEX15_SIS_Anbu
49
The Markov Model and Solution

16EPEX15_SIS_Anbu
50
The Markov Model and Solution

16EPEX15_SIS_Anbu
51
The Markov Model and Solution
• The steady-state solution technique is useful for many situations. However, it is
not appropriate for situations where the probability of moving from state to state
is not constant (a non-homogeneous Markov model).

• This solution technique is not appropriate for safety instrumented functions

where many failures are not detected until a periodic inspection and repair is
performed.

• In the case of failures detected by a non-constant inspection and test process, the
probability of repair is not constant. It is zero for most time periods.

• Do not use steady-state techniques to model repair processes with inspection and
test.
16EPEX15_SIS_Anbu
52
The Transition Matrix
Any discrete state Markov model may be represented by a square matrix showing the probabilities
of moving from one state to another.

0 1 2
0
1
2

16EPEX15_SIS_Anbu
53
Solution to Multiple Failure Modes
Solve the Markov model of the given Figure using
a Lambda S of 0.02 failures per hour and a Lambda
D of 0.01 failures per hour. The model starts in
state 0 where there are no failures.

The Transition matrix (P) :

1 − (λ𝑠 + λ𝐷 ) λ𝑠 λ𝐷
0 1 0
0 0 1

0.97 0.02 0.01

0 1 0
0 0 1
16EPEX15_SIS_Anbu
54
Solution to Multiple Failure Modes
The problem can be solved by multiplying a starting row
matrix times the transition matrix in a spreadsheet.

0.97 0.02 0.01

1 0 0 × 0 1 0
0 0 1
The row matrix represents the initial state is “0” with system working fine
Failure Probability
1.2

0.8

0.6

0.4

0.2

0
0 100 200 300 400 500
Solution in Excel State-0 State-1 State-2

16EPEX15_SIS_Anbu
55
Valve subsystem
Markov Model of the Valve Subsystem

16EPEX15_SIS_Anbu
56
Matrix representation of Markov Model

Excel Solution

Since state 3 is the failure state, the probability of failure (unreliability) at a

mission time of one year (8760 hours) is 0.00176.
This number is lower than the number obtained from the fault tree, 0.00184, as the
Markov solution does not use the approximation techniques.
16EPEX15_SIS_Anbu
57
Multiple Failure State Markov Model

16EPEX15_SIS_Anbu
58
Multiple Failure State Markov Model

16EPEX15_SIS_Anbu
59
Exercise #1

What is the P matrix for the Markov model?

Restore Rate:
1
𝜇=
𝑀𝑇𝑇𝑅

16EPEX15_SIS_Anbu
60
Solution

16EPEX15_SIS_Anbu
61
Markov model with Two Failure states

• Assume that the system being modeled

is a single channel (1oo1) system and
that all failures in state 1 are
immediately recognized.

• Failures in state 2 are not immediately

recognized. They are repaired only after
a periodic inspection.

16EPEX15_SIS_Anbu
62
Draw a Markov model for the given system :

Refer Fault Tree

16EPEX15_SIS_Anbu
63
Solution

16EPEX15_SIS_Anbu
64
 Exercise #2
For a gas burner to work without failure, one of
two identical fans, the burner, and the controls
have to function without failure. The reliability
of a fan is 0.9. The reliability of the burner is
0.98. The reliability of the control system is 0.85.
The aforementioned reliabilities are for a period
of five years. It can be assumed that the failure
of each of the listed components is independent
of any other failure. Calculate the reliability of
the furnace system over a five-year period.

16EPEX15_SIS_Anbu
65
Solution

R Fan sub-system = RFan1 + RFan2 – (RFan1 × RFan2)

= 0.9 + 0.9 – (0.9 × 0.9) = 0.99

R System = R Fan sub-system × R Burner × R Controls

R System = 0.99 × 0.98 × 0.85 = 0.8247

16EPEX15_SIS_Anbu
66