System Reliability: Method

Block Diagrams, Redundancy, Standby, Importance, Spares and Apportionment

The reliability block diagram

A system is modelled as a diagram of blocks, one per component, drawn so that the system works whenever a path of working blocks runs from one end to the other. The diagram is a statement of logic, not of physical connection: blocks in series all have to work, blocks in parallel back each other up, and a k-of-n group works when any k of its n members do. The tool takes the diagram as a text expression over the component names, with and for series, or for active parallel, parentheses for grouping, 2of3(D, E, F) (or kofn(2, D, E, F)) for a voting group and standby(G, H) for a cold-standby chain switched in order. The expression is written back in words so that the logic can be checked against the drawing before the numbers are read. Each block is assumed to fail independently of the others; a common cause that fails several blocks at once is not represented and has to be added as a block of its own in series.

Component models

Every component carries one of three models of its probability of surviving to the mission time t. The exponential model, entered as a failure rate λ (exp 0.001) or as a mean time between failures (mtbf 1000), has R(t) = e^−λt and a constant hazard rate: the usual model of electronic parts in their useful life and the model behind the MIL-HDBK-338B tables. The Weibull model (weibull β η) has R(t) = exp[−(t/η)^β], a hazard rate that rises with age for β > 1 (wear-out) and falls for β < 1 (infant mortality), and a mean life η Γ(1 + 1/β); its parameters come from a life-data analysis such as the Weibull Life Analysis tool. A fixed model (fixed 0.95) is a probability of success that does not depend on time: a one-shot device, a demand failure probability, or the probabilities of a textbook example. Adding mttr X gives the mean repair time for the availability calculation.

Series, parallel and k-of-n

For independent blocks the probability of success follows from the product rule. In series every block must work, R = Π R_i, so the weakest block sets the limit and adding blocks can only lower the result. In active parallel the group fails only when every member fails, R = 1 − Π (1 − R_i); the second unit of a pair gives the largest gain, and each further unit gives less (MIL-HDBK-338B Figure 7.5-9: the MTBF of one-of-n identical exponential units is θ(1 + 1/2 + … + 1/n), 1.5θ for two and 2.28θ for five). A k-of-n group is the binomial sum of the states with at least k working members; for unequal members the tool evaluates the sum by a recursion on the number of working units, exactly, so a 900-of-1000 phased array or a 2-of-3 flight computer are handled alike. The two-of-three vote R = 3p² − 2p³ is better than a single unit only while p > 0.5, and better than a parallel pair never: voting buys fault detection, not reliability.

Repeated names and bridge networks

When a component feeds more than one path (the handbook's example of a unit A feeding either of two channels C1, C2 that also have their own sources B1, B2) the paths are not independent and the product rule cannot be applied to them. The tool then uses the conditional-probability identity of MIL-HDBK-338B eq. 6.19, P_S = P_S(X good) R_X + P_S(X bad) Q_X: the repeated component X is set to certainly working and to certainly failed in turn, each reduced diagram is evaluated, and the results are weighted by R_X and Q_X. With several repeated names every combination of their states is enumerated (up to twelve). The result is exact, which the classical bridge structure shows: with all five blocks at p the tool returns 2p² + 2p³ − 5p⁴ + 2p⁵, the polynomial of Barlow and Proschan. Writing an expression that names a component twice is therefore allowed and is the way to enter a bridge, a shared power supply or a common sensor.

Cold standby

In a cold-standby chain the first unit runs while the others wait unpowered; when it fails the next is switched in, so the chain survives t when the member lives add up to more than t. For n identical exponential units the chain reliability is the Poisson sum e^−λt Σ_r=0ⁿ⁻¹ (λt)^r/r! and the mean life is nθ (MIL-HDBK-338B §7.5.5.3): a standby pair at t = θ gives 0.736 against 0.600 for an active pair, and its MTBF is 2θ against 1.5θ. Two unequal exponential units give the mixed exponential λ_b/(λ_b − λ_a) e^−λ_at − λ_a/(λ_b − λ_a) e^−λ_bt, which the tool extends to any number of distinct rates; Weibull or near-equal units go through a numerical convolution of the member life distributions on a 500-point grid (a Stieltjes sum, accurate to about 10⁻⁵ in R). The switch is taken as perfect and the waiting units as not ageing; the handbook's §7.5.5.2 shows how a switch that fails to operate (probability q_s) or operates prematurely (q′_s) is added for a pair, Q = p_aq_bq′_s + q_ap_bq_s + q_aq_b, and warns that switching devices with a failure rate comparable to the units can cancel the gain. A fixed-probability unit inside a standby chain has no life to add; it is taken as a unit that works with its probability when called, in parallel with the rest of the chain.

Reliability function, MTTF and hazard rate

The whole system reliability function R_sys(t) is evaluated at a hundred points to the time where it has fallen to 0.02 (between 1.5 and 10 mission times) and drawn with the component curves. Its mean time to failure is the area under it, MTTF = ∫₀^∞ R_sys(t) dt, computed by Simpson's rule over 800 intervals to the time where R_sys has fallen below 10⁻⁶; the closed forms (1/λ for one unit, θ Σ 1/k for an active group, nθ for a standby chain) are reproduced to six figures. The MTTF of a redundant system is not 1/(hazard rate): the system hazard rate h_sys(t) = −d ln R_sys/dt, taken by a central difference at the mission time, starts at zero for any redundant arrangement of exponential units and rises as the spare units are used up, so a system of constant-hazard parts has an increasing hazard rate of its own. The times at which R_sys reaches 0.90 and 0.50 are found by bisection. A fixed-probability component keeps R_sys above zero for all time, and then no finite MTTF exists; the page says so instead of integrating to a cutoff.

Steady-state availability

Reliability asks whether the system survives a mission without repair; availability asks what fraction of the time a repairable system is up. For a component with constant failure and repair rates the inherent availability is A_i = MTBF/(MTBF + MTTR) (MIL-HDBK-338B eq. 5.107), which excludes logistic and administrative delays. The system availability combines the A_i through the same block diagram, with every unit repaired independently of the others: series Π A_i, parallel 1 − Π (1 − A_i) (eq. 10.37), k-of-n by the same binomial recursion, and a standby chain as a parallel group, since any member that is up can carry the function. Components without a repair time are taken as always available and named. The handbook's §5.8 example of five series subsystems shows the exact product (0.7355) a little below its approximation 1/(1 + Σ MTTR_i/MTBF_i) = 0.752. Shared repair crews (a failed unit waiting for the crew busy on another) reduce the parallel availability below the independent value; the handbook's Markov example gives 0.946 against 0.972 for a pair with one crew. Such queueing for repair is not modelled here.

Importance measures

Which component to improve first is answered by the importance measures of Birnbaum (1969) and their descendants (Rausand and Høyland 2004, ch. 5). The Birnbaum importance I_B(i) = ∂R_sys/∂R_i = R_sys(R_i = 1) − R_sys(R_i = 0) is the system's sensitivity to the component: the probability that the component is critical, that is, that the system is in a state where its working or failing decides the outcome. For a series system it is the product of the other reliabilities (the weakest component ranks highest); for a parallel system the product of the other unreliabilities (the strongest ranks highest, because only when the others have failed does it matter). The criticality importance I_C(i) = I_B(i) Q_i/Q_sys multiplies the sensitivity by the probability that the component has actually failed and divides by the system unreliability: the probability that, given the system has failed, component i is the one that caused it. It is the measure to rank improvements by, because a component with a large sensitivity but a tiny failure probability is seldom the culprit. The improvement potential I_P(i) = R_sys(R_i = 1) − R_sys is the most the system could gain from a perfect component i. All three are evaluated exactly by the pivot identity at the mission time.

Spares provisioning

With a constant failure rate λ the number of failures in a period T is Poisson with mean λT, so s spares cover the period with probability P = Σ_x=0^s (λT)^x e^−λT/x! (MIL-HDBK-338B eq. 5.58; the handbook's §5.3.8.1 example, λ = 0.001 per hour, 500 hours and two spare lamps, gives 0.986). The tool reports, for every component with a failure rate, the smallest s that reaches the chosen confidence and the confidence that s − 1 and s + 1 would give. A Weibull component is taken at its average rate 1/MTTF, which assumes that failed units are replaced by new ones and that the period is long compared with the life. The confidences are per component; the probability that every line is covered at once is about their product.

Apportionment of a target

At the start of a design the system requirement R* has to be split among the subsystems. Equal apportionment gives every one of the n subsystems R_i* = (R*)^1/n (MIL-HDBK-338B §6.3.2: 0.729 for three subsystems gives 0.90 each); it ignores how hard each goal is. The ARINC method (§6.3.3) assumes series subsystems with constant failure rates, converts the target to an allowable rate λ* = −ln R*/t, and splits it in proportion to the present (predicted or observed) rates, w_i = λ_i/Σλ_i, λ_i* = w_i λ*, R_i* = exp(−λ_i* t): every subsystem has to improve by the same factor Σλ_i/λ*, so the ones that fail most carry most of the budget. The handbook's example (rates 0.003, 0.001 and 0.004 per hour, R* = 0.90 at 20 hours) gives the weights 0.375, 0.125 and 0.5 and the allocations 0.96, 0.99 and 0.95. For a Weibull or a fixed component the tool uses the mission-average rate −ln R_i(t)/t. Both methods assume the components in series; the page therefore also evaluates the actual structure with the allocated values, and when the structure has redundancy the result exceeds the target, which means the allocation could be relaxed where the redundancy is. The handbook's further methods (feasibility of objectives, minimum effort, AGREE) weigh complexity and criticality and are not implemented.

Worked example on the page

The default is the series-parallel example of MIL-HDBK-338B §6.4.4.2.1.3: unit A (P_A = 0.3) feeding either channel C1 or C2 (P_C = 0.2), each channel also fed by its own source B1 or B2 (P_B = 0.1). Because C1 and C2 sit on two paths, the handbook conditions on A: P_S = (2P_C − P_C²) P_A + [2P_BP_C − (P_BP_C)²](1 − P_A) = 0.13572, and its Boolean truth-table method (§6.4.4.2.2) gives the same number; the equivalent series model P_AP_B²P_C² = 0.00012 shows what the redundancy buys. The tool reproduces both, pivoting on C1 and C2. The test script also checks the handbook's standby example (θ = 100 hours, four units in cold standby give 0.981 at 100 hours, meeting the 0.98 requirement), the 2-of-3 vote, the 900-of-1000 array, the spares example, the availability examples and the two apportionment examples, and the standby convolution against an independent numerical integration and Monte Carlo.

Limits of the tool

• Components fail independently; common-cause failures, load sharing (surviving units of a parallel group running harder) and failure propagation are not modelled.
• Standby switching is perfect and waiting units do not age; the handbook's switch-failure terms and warm-standby rates are not included.
• Availability assumes independent repair of every unit with a constant repair rate; queueing for a shared crew, preventive maintenance and logistic delay are excluded (MIL-HDBK-338B §5.7.2 Markov models cover them).
• Up to twelve names may be repeated in the structure (4,096 pivot states); larger non-series-parallel networks need a minimal-cut-set or a Markov tool.
• Spares demand is Poisson at a constant rate; a Weibull unit's demand is approximated by its average rate.
• Apportionment follows the handbook's series assumption; the structure check only shows the margin that redundancy leaves.