Mean time to first failure of repairable systems with one cold spare

IEEE TRANSACTIONS ON RELIABILITY, VOL. 44, NO. 4, 1995 DECEMBER 567

Mean Time to First Failure of Repairable Systems with One Cold Spare

Winfrid G. Schneeweiss, Senior Member IEEE FernUniversitat, Hagen

Key Words - Mean time to first failure, Repairable system, (n - 1)-out-of-n:G system, Cold spare, Petri net

Summary & Conclusions - A general (non Markov) l-out- of-2:G system with statistically-identical components, repair, and cold standby is reviewed. Coverage is considered, viz, failures of the switching mechanism for activating the spare. The explicit derivation of the mean time-to-first-failure and its in-depth discus- sion appear to be new. The state transition graph and the Petri net both show the way to general (n-1)-out-of-n:G systems of this category. However, for n > 2, results are given only for statistically- identical components which are all as good as new, when a repaired component is put to use. This limits applicability of results to electronic systems.

For a fallible switch, 3 subcases are discussed i) no switch repair, ii) switch behavior of a type known from the Arnold (1972) classical coverage modeling for Markov-type systems, iii) general case of a repairable switch. The subcase, ‘no switch repair’ could be solved completely, but the result is of frustrating complexity. Numerical approximations would be quite involved due to multi- ple integrations. The subcase ‘switch behavior modeling along the lines of Bouricius et al(1969), Arnold (1972), Trivedi (1982)’ con- tains one of the most interesting results of this paper, viz, for highly dependable switching the assumption of independence of successive successes of switching is not very plausible. The subcase of a general repairable switch could not (yet) be solved. Only hints could be given at the type of a general solution and at how one could imple- ment an obvious kind of computer simulation using a Petri net model. Also a detailed state diagram was given for that case, which is useful beyond Markov modeling.

Results for n =2 are fairly easily extended to n > 2. However, since in the long run there can be operating components of widely different summed working-times in the system, in order to reduce complexity, still maintaining usefulness of results for electronic systems, only components with Markov behavior (exponentially distributed lives) were considered. A general repair-time distribution was used and (if considered at all) with a fairly general switch.

The appendix presents some simple exercises in Markov modeling which could not be found exactly in standard textbooks.

1. INTRODUCTION

Acronyms

MTTFF mean time to first failure PN Petri net.

1.1 Motivation & Outline

In many real situations, a system’s usefulness ends with the first failure. Any repair activities are stopped on system

failure, even though prior to this event, repairs or replacements of components are executed. In other cases, system operation is resumed later. Regardless, MTTFF is the dependability parameter of paramount interest here. The class of systems considered is (n- 1)-out-of-n:G systems, where the (first) failed component is used as a cold standby after repair. For an ideally dependable switch for activating spares, system MTTFF can be calculated, once the probability of component life surpass- ing component down-time is known. In general, MTTFF is calculated via system (strict sense) reliability, viz, survivor func- tion of its life-time. Hence, the latter dependability characteristic is also included here.

For ease of reference, the well known Markov case (both, components’ uptimes as well as downtimes being exponentially distributed), of a l-out-of-2:G system is treated in full detail in the appendix.

Section 2 presents the case n=2. First the case of an ideal switch for reactivating cold spares is studied. Thereafter the influence of switch failures is modeled, viz, coverage [9] is ad- dressed. A special case of some practical relevance is fixed repairheplacement time. This is typical for a spare ordered and shipped by mail on demand.

Since the basic results for the duplex case are in the literature [ l - 31, what appears to be new here and even more relevant, due to the increased size of modern engineering systems, is the case n>2, treated in section 3.

Ref [lo] gives the theory of l-out-of-2:G Markov systems with a plausible coverage model for hot standby. The appendix develops the same, as far as MTTFF is concerned, for cold standby. This is useful for comparisons with, and checks of, more general results.

1.2 Type of Petri Nets Used

A PN is a bipartite directed graph with a dynamic marking of certain nodes @laces). The latter can be connected (via edges) with nodes of a second kind (transitions). Places are usually drawn as circles containing fat dots, the representatives of the tokens, being the specific marking of a PN. Transitions are drawn here as squares containing thejiring delay, T, of timed transitions. A transition is enabled to fire (Tunits of time later), once all its predecessor places contain at least 1 token. On firing, each predecessor place looses 1 token, and each successor place receives 1 more token. Transitions with T=O are immediate transitions.

1.3 Notation 8z Assumptions

Notation

a Pr{L 5 0) C coverage parameter

0018-9529/95/$4.00 01995 IEEE

5 68 IEEE TRANSACTIONS ON RELIABILITY, VOL. 44. NO. 4, 1995 DECEMBER

e e, component i C,, D, down-time of C, LZ up-time (life-time) of C,

c Laplace-transform operator E“, Pr((Markov) state i} R,( t ) S

uZc

k-n:G implies: k-out-of-n:G system sw

Other, standard notation is given in “Information for Readers & Authors” at the rear of each issue.

1-8; 8 is any parameter E [0, I]

switch (for activating the cold spare)

f~(t), FL(Q [pdf, Cdfl o f L at t

reliability (strict sense) of C, at t variable of the Laplace transform sum of the first i components lives

* implies: Laplace transform, eg, g* (s) = 6: ( g ( t ) }

implies: switch (for activating spares).

Assumptions

la. All systems are (n - 1)-out-of-n:G [2-out-of-n:F]

lb. All components and the system are either working or

2a. Failed components are repaired or replaced to ‘as good

2b. Repairheplacement damages nothing in the system. 3. The 1 spare component of these systems is - initially

and after repair - a cold standby (neither deteriorates nor fails). It is switched to active use only on the next component failure. The switch is an extra component, different from the Ci.

4. At the instant of spare activation, all working components are ‘as good as new’. (This limits the direct applicability of this paper to electronic systems, for n > 2.)

systems of s-identical components.

failed (non-working).

as new’.

2. REPAIRABLE I-OUT-OF-2:G SYSTEM WITH COLD STANDBY

2.1 System Description

As an alternative for figure 1, one can use the Petri net of figure 2 (it is self-explanatory).

(wansition 3) C, as cold standby

, down (odd down)

2 (place 2)

system ?I Anwn Y” 1. I I

(f ai I ed)

C, down (even down)

C, as cold standby

[Transitions with a 0 inside are immediate, with a D (downtime) or L (lifetime) are timed. Only selected places and transitions are

numbered.]

Figure 2. Petri Net of Repairable 1-out-of9:G System

The following comments might be needed for an insight beyond a general understanding of this fairly simple type of Petri net

* The places (round nodes) have their meaning of states only, when they are marked by at least one token ( a ) .

e The token inplace 1 waits for L units of time before reaching place 2 [after the firing of transition (square node) 11. Then, if there is a token in place 4, it moves immediately (0 firing delay) to place 3; but a further token is returned to place 2 to wait for the firing delay D of transition 3 to pass.

* The number of tokens in the Petri net is 2 during system life and 1 thereafter.

The influence of a repairable switch for activating spares

[4, 51.

is shown in figure 3 as an addendum to figure 2.

The behavior of the simplest system with 1 cold standby,

the state transition graph, figure 1. Of course the two states ‘C, active’ could each be split in 2 elementary states depending on the state (working or failed) of the other component.

(1-out-of-2:G system of this type) is understood roughly from . 4

switch down

Figure 3. Modeling a Repairable Switch For Spare Activation

The firing delay of a transition is not reset, when a waiting token, typically the one in figure 3, is used for the firing of another transition which has 0 delay [5].

I

Figure 1. A State Graph For a 1-out-of-2:G System Repaired Up To System Failure

SCHNEEWEISS: MEAN TIME-TO-FIRST-FAILURE OF A REPAIRABLE SYSTEM WITH ONE COLD SPARE 569

2.2 Ideally Reliable Activation of Spares

As reported in [l] and derived in [2, 31: R1-2:G ( t ) and system MTTFF, E {L1.2:G}, are determined.

S - -

Use was made of i) 6: { l} = 1 /s, ii) of the integration rule: C- transform, and iii)

C & ( t ) . F D ( t ) } = fL(t).[l-FD(t)].exp(-s.t) dt SK Check: In the Markov case we presume - for system states 1 & 2 of figure 8 -

The verification is in appendix A.2. As explained in appendix A. l , system MTTFF,

E{L1-2:G}, is R?-2:G(0). This can be given an elegant form which is very useful for practical work. Since: i) by (49), f t (O)= 1; ii) by (50), factor#l of (2) has E(L) as its limiting value (for s-O), and iii) l-lims,o[d:~L(t) .F,(t)}] = 1 - So” h ( t ) * F D ( ~ ) dt = So” f ~ ( t ) .&(t) dt,

we get from (2) the system MTTFF:

Also,

00

a = 1 f L ( t ) . & ( t ) dt = Pr{L 5 D}, (6) 0

is Pr{system failure at the end of the life of an active component}, since the repair of the other component is not completed then.

2.2.1 Example 1 (and check)

[Up-time and down-time are exponentially distributed]

Notation

x failure (hazard) rate cc repair (hazard) rate.

Figure 4. The 2 Factors of the Integrand of a in Definition (6)

The fact that, due to 2 initially good components,

E{L1-2:G} 2E{L}

is obvious from the following alternative for (9):

E(~51-2:~) = E{L} *(2 + E/cY). (10)

2.2.2 Example 2

[Deterministic, fixed down-time]

D = Do, by (5) and figure 4:

E(J%-2:G} = E{L} *[1+1/FL(DO)l, (1 1)

which means that also in this case, (9) can be fulfilled, given that FL ( DO) Q 1, ie, L % Do most of the time. For exponentially distributed L; see (7):

For comparison with the Markov case of (5 l) , rewrite (12) according to (10) as:

2.3 Fallible Switch For Activating Spares

We discuss two cases of switches: without and with repair.

Notation

L, residual life time of the active component ( C1 or C2) at t = Lsw.

2.3.1 No switch-repair

Since C,, is not repaired, system life either ends as in section 2.2 with probability Pr{L1.2:G 5 Lsw} or it ends at Lsw+L,. with probability Pr{L1,:G > Lsw}; see figure 5. As usual in

570 IEEE TRANSACFKONS ON RELIABILITY, VOL. 44, NO. 4. 1995 DECEMBER

Figure 5. Forward Recurrence Time of the Ordinary Renewal Process of Starting At 0 and Restarts after Random- Time L (crosses)

renewal theory, L, is 'forward recurrence time' (at Lsw). Details on its distribution are given in (15) - (21). The general (formal) result is a typical conditional s-expectation [6, SI:

Eq (14) means: E{L~.~:G} of (5) ,

The only conceptual problem left is to determine E (LJ . By (47h

From [S: p 441:

FL,(t]7) = F L ( t + T ) - F j - ( t + ~ - t ' ) * h ( t ' ) dt', (20) 1: -

h ( t ) 3 renewal density [7, 81 with the well known Laplace transform [7, 81:

What is conceptually fairly obvious can be computationally tricky, depending on the distribution of L and of Lsw,

2.3.2 Example 3

[Deterministic life time of the switch and exponential life of components]

A plausible value of E{&} is ?hE(L}. Yet, as is well known [7], quite different values are possible too. Specifical- ly, if the restart points define a stationary renewal process with exponentially distributed lives, then

Assumptions

1. Fq (22) holds for Ls, % L (with high probability). This way we circumvent in this simplistic example the problems of evaluating (18) via (21).

2. With high probability, L,, = L,,,o, eg, if switch operability usually ends after using a fixed amount of energy. 4

By (15) or the definition of a Cdf

Finally, substitute for E{Li-z:G} from (51); (14) becomes:

+ [LSW,O + *FL,.2 G(LSW,O)

= Lsw,o + E{L} + [E{L} -[1 + E{L}lE{D}]

with FL,IG(LSW,O) of (55). It is plausible, depending largely on E(L)IE(D} , that the last term in (23) is positive or negative.

2.3.3 With switch-repair

The conceptually simplest modeling of a switch-with- repair, as indicated in figure 3, is to assume that with fixed probability c (coverage [9]) any switching operation is successful s-independently of others. Hence, with index sw,r for switch with repairs:

PT(L1-2:G = qL} .ci-' is Pr{system death after i- 1 renewals due to L, < D2 or & < D l } ;

Pr{L1-z:G > .c is Pr{system death after i-1 renewals at the (failed) renewal i , which is not completed due to switch failure}.

Use CY (6); consider that at t = L1 system failure is impossi- ble for an intact switch:

-


It is easily checked that,

W

Pr(L1-2:G > ai,L} = Pr{L1-2:G = Uj,L}*

j = i + l

Insertion in (24) results in:

Note that:

= -1 + d[x/( 1 -x)]/dx = -1 + 1 / ( 1 -x)2.

Simplify (27) to:

E{L1-2:G;sw,r}

= E{L}.[F + (F + ( l~/(Y)*[( l - -a! .~)-~ - 111. (28)

Check: For c= 1, (28) becomes (9) and for c=O, since no spares can ever be activated, we get:

2.3.4 Example 4

[Exponential case]

From (7) & (8):

a / E = X/p. Insert in (28) and simplify:

which equals (59). Hence the model behind (24) is equivalent to that of figure 9.

2.3.5 With switch-repair, extended

In the model behind (24) the ci- l indicate the s-independence of the various switching operations. This is cer- tainly not always realistic. Rather, when the switch is small com- pared to Cl & C2, such that

there is considerable coherence between the binary switch states, at least for several consecutive faults of C1 & C2. Hence, for

instance, at least approximately, for some fixed m > 1, the c should be replaced by, say , its m' root, which would increase mean system-life according to (24), because 0 < c < 1.

A future general theory could have a final result similar to (14):

P,, = Pr{System failure due to switch failure}

U,, = unavailability of the switch,

For unsophisticated computer simulation for determining P,,, figure 6 is an addendum to the Petri net of figure 3.

switch switch down

Figure 6. Petri Net Addendum for Simulation

Alternatively, simulation (and a future improved closed- form solution) could be based on the state transition graph of figure 7, which is self-explanatory, at least for the Markov model case documented with the transfer rates. Xl,X2, Xs, are the binary-state indicators of components 1,2, switch, respec- tively; with 0 for the working state and 1 for the failed state. The elementary states 000 (all ok) and 001 (only the switch is bad) are split into 2 parts, depending on which component is active (and not in cold standby mode).

XI X, Xsw C, active C, active

[with cold standby and a repairable switch for activating the spares]

Figure 7. State Diagram of a Repairable 1-out-of-2:G System

572 IEEE TRANSACTIONS ON RELIABILITY, VOL. 44. NO. 4, 1995 DECEMBER

3. SYSTEMS WITH MORE THAN 2 COMPONENTS From (38),

A general theory of ( n - 1)-out-of-n:G systems with a cold spare, for n > 2 (more than 2 components - excepting the switch for activating the spare) would have to keep track of the age of each active component even if all repairs end with components as good as new. (This is trivially the case with n=2.)

3.1 Special Case

Assumption (for tractability)

After each exchange of a working-component for a failed- 4

This restricts the model to electronic systems. Whereas in general now, with n components, L = Ln-l.n-l:G; only in the special case just defined we have to replace according to

component, the system is as good as new.

E{~n-l-n:Gl = .[2 + (n- 1) - A

which checks with (51) for

E(L} + I/[(Tz-~)*X]; E(D) = l/p.

APPENDIX

A. 1 MTTFF of a Markov-Type 1-out-of-2:G System with Cold Standby

Figure 8 shows the well-known state-transition graph of this system.

since the system is working, iff n - 1 components are working. Furthermore, by (32) the following replacements hold:

down c1 E{L} = FL(t) dt + [F~(t)l"-' dt, (33) iK - SR Figure 8. State Graph of I-out-of-2:G System with Cold

f L ( t ) = -dFL(t)/dt + (n-l)*[FL(t)]"-2'fL.(t) . (34) Standby

So we have, by (5) , in a pretended generality, useful for better understanding : The Markov-model differential equations of probability flow

are (see also [ l l : p 411):

P, = -X*P, + p-P2; P , (O)= l ;

P 2 = X.P1 - ( p + X ) . P z ; P2(0)=0. (42) [ 1 + [ (n- 1) im [FL(t)]n-2.fL(t) .FD(t) dt]- '] . (35) The Laplace transforms [6, 81) are:

S-P? - 1 = -h-PT + p*Pz*,

0

In practice, this result holds only for:

h(t) = h-exp(-X.t); FL( t ) = exp(-X.t),

such that, since

E{L} - ll[(n-l).h],

by (35):

(43)

(36) s.Pz* = h.PT - (A + p) .Pz* , (44)

(37)

Pi* = P1*(s) = . e{P, ( t ) }

Solve (43) & (44) for P! & PZ:

Pr(s) = [s 4- X + p]/Denom, (45)

Pz(s) = h/Denom, (46) E{Ln-i.Tz,~} = [(n- 1) *XI-'.

[ 1 + [ (n- l ) .h* / : exP(-(n-l).X.t).FD(t) dt .(38)

3.2 Example 5

[Exponentially distributed down times]

Denom = s2 + s(2h + p ) + hz.

Ref [3: section 6.61 has a different derivation. 1 -'I

Now derive E{L~-~.G}. For any random L 2 0 [6,7]:

E{L} = &(t ) dt. (47) FD(t) = exp(-p.t). (39) 5, -


From Laplace-transform theory: After inverse transformation [3: p 731:

y1 = X + Y2p + h . p + %p2,

eir E x + ‘/2p - J X . ~ + ‘ / p 2 , (49)

(50) A.4 A Typical Coverage-Model

As given for the first time in [lo] and used again, eg, in [6], coverage for the system of figure 8 is modeled according to figure 9. Instead of (42), the probability flow equation is:

Hence, for this problem,

yielding instead of (44): A.2 Verification of (4)

By (45) & (46) in the Markov case,

Use (56) with (43) and simplify:

Pf(s) = (s+X+p)/Denom,

P~(s) = c.X/Denom, (52) = [s + 2X + p]/[s2 + s*(2X + p ) + X2].

On the other hand, Denom = s2 + s.(2X+p) + X. ( X + c . p ) .

(1 -c)X

= [X/(s+h)] - [X/(s+X+p)].

Figure 9. Figure 8 Enriched By a Link From Node 1 to Node 3 for the Modeling of Coverage 1

[ l +

X. ( S + X + p ) R?-2:G(S) = - *

S + X Instead of (51) the result is:

(53) X. ( 1 + c ) + p

E(LI-2:G;c} = Q. E. D. A . ( h + F p ) . (59) which equals (52).

A.3 Distribution of System Life

By figure 8,

Check: For c = l , (59) coincides with (51); for c=O, the result is 1 /X = E{L} in accordance with L,.2,G=L,.

So, by (45) & (46) and by P1+P2+P3= 1:

W L , . * & ) I = P;(s)

[I] S. Srinivan, R. Subramanian, Probabilistic Analysis of Redundant Systems, Lecture Notes in Econ. and Math. Syst., vol 175, 1980; Springer.

[2] B. Gnedenko, Y. Belyayev, A. Solovyev, Mathematical Methods of Reliability, 1969; Academic Press.

[3] W. Schneeweiss, Zuverlaessigkeitstechnik (Reliability Technology), 1992; = X2/[s.[s2+s.(2X+p) + P I ] . (54) Datakontext.

5 74 IEEE TRANSACTIONS ON RELIABILITY. VOL. 44, NO. 4, 1995 DECEMBER

141 T. Agerwala, “Putting Petri nets to work”, IEEEComputer, 1979 Dec,

[5] M. Malhotra, K. Trivedi, “Dependability modeling using Petri nets”, (Under review for IEEE Trans. Reliability)

161 K. Trivedi, Probability and Stclristics with Reliability, Queueing and CO” puter Science Applications, 1982; Prentice Hall.

171 D. Cox, Renewal Theory, 1962; Methuen. [8] S. Ross, Applied Probability Models with Optimizcllin Applications, 1992;

Dover. [9] W. Bouricius, W. Carter, P. Schneider, “Reliability modeling techni-

ques for self-repairing computer systems”, Proc. 24“ NUY~ ACM,

[lo] T. Amold, “The concept of coverage and its effect on the reliability model of a repairable system”, IEEE Trans. Computers, vol C-22, 1973 Mar,

pp 85-94.

(1969), pp 295-309.

pp 251-254.

[I I] N. Ravichandran, Stochastic Methods in Reliability Theory, 1990; John WiIey & Sons.

AUTHOR

Prof. Dr. Winfrid G. Schneeweiss; FemUniversiht; D-58084 Hagen, Fed. Rep. GERMANY.

W. Scheeweiss: For biography, see IEEE Trans. Reliability, vol44, 1995 Jm, p 314.

Manuwept received 1995 April 24

EEE Log Number 94-14205 4 T R W

rlRWMS ARWMS ARWMS ARUMS ARUMS ARWMS ARHMS ARWMS ARUMS ARWMS ARUMS ARUMS ARWMS

1996 Annual alntainability Symposium January 22-25 Sahara Hotel Eas Vegas, Nevada USA

1

The P. K. MeElroy Award for Best Paper I

Each year the Symposium presents the P. K. McElroy Award for the best paper at the previous Symposium. The P.K. Award Plaque is accompanied by an Honorarium of $1500. T h e two criteria for best paper are:

The written paper is lucid, excellent, and important to the theory andlor practice of R&M engineering. 10 The presentation of the gaper at the Sympos?~m is likewise lucid and excellent.

P. R. McEIroy was an intensely practical person. Papers that receive the P.K. Award must be able to make a difference to R&M engineers and/or managers. It is not enough that the content be competent and important; that competence and importance must be obvious in both the written paper and the presentation at the Symposzum.

Before the Symposzum, the content of each written paper is examined by the Program Committee for technical excellence and for clarity of exposition. T h e best of the gapers a re chosen and then referred to a select g roup of past General Chair’n of the Sym~usium. Each person in that g roup attends each presentation; that g roup chooses the best paper to receive the P. K. McElroy Award.

Watch for Your Symposzzcm Brochure in the Mail. For more information on the Symposium o r the P. K. McElroy Award, write to:

AR&MS Database Coordinator 804 Vickers Avenue 0 Durham. North Carolina 27701-3143 USA.

Documents

Mean time to first failure of repairable systems with one cold spare