WinSURE User Interface

Ricky W. Butler

NASA Langley Research Center

http://shemesh.larc.nasa.gov/people/rwb/rel.html

November 19, 1999

## Abstract 

WinSURE is a reliability analysis program used for calculating upper and
lower bounds on the operational and death state probabilities for a
large class of semi-Markov models. The program is especially suited for
the analysis of fault-tolerant reconfigurable systems. The calculated
bounds are close enough (usually within 5 percent of each other) for use
in reliability studies of ultra-reliable computer systems. The WinSURE
bounding theorems have algebraic solutions and are consequently
computationally efficient even for large and complex systems. WinSURE
can optionally regard a specified parameter as a variable over a range
of values, enabling an automatic sensitivity analysis.

# **Introduction**

The WinSURE program is a flexible, user-friendly reliability analysis
tool. It is a Windows 98 version of the SURE program developed in the
early 1980's at NASA Langley Research Center. The program provides a
rapid computational capability for semi-Markov models useful in
describing the fault-handling behavior of fault-tolerant computer
systems. The only modeling restriction imposed by the program is that
the nonexponential recovery transitions must be fast in comparison to
the mission time---

a desirable attribute of all fault-tolerant systems. The WinSURE
reliability analysis method utilizes a fast bounding theorem based on
means and variances. This bounding theorem enables the calculation of
upper and lower bounds on system reliability. The upper and lower bounds
are typically within about 5 percent of each other. Since the
computation method is extremely fast, large state spaces are not a
problem.

This paper describes the Windows interface to the WinSURE program. The
reader is referred to the online documentation entitled "The SURE INPUT
Language" for a detailed description of the model definition language
and to \[1\] and \[2\] for a detailed description of the solution
methods used. A tutorial/user's guide is available in \[3\].

### Basic Program Concept

The user of the WinSURE program must first define a semi-Markov by
enumerating all the transitions of the model using a simple language.
This can be done inside the WinSURE program (See CREATE button), though
the more powerful Emacs text editor is recommended. The states of the
model are named with natural numbers. The semi-Markov input model is
described by enumerating all the transitions between the states of the
system. There are two different statements used to enter
transitions\-\--one for slow transitions and the other for fast. If a
transition is slow, then the following type of statement is used:

1,2 = 0.0001;

This defines a slow exponential transition from state 1 to state 2 with
rate 0.0001. The program does not require any particular units, e.g.,
hour^-1^ or sec^-1^ . However, the user must use consistent units (i.e.
if the mission time is specified in hours, then the rates should be
hour^-1^ ). If the transition is fast, the following syntax is used:

2,4 = \< 1E-4, 1E-6, 1.0 \>;

The numbers in the brackets correspond to the conditional mean,
conditional standard deviation[^1], and transition probability of the
fast transition, respectively.

**WinSURE By Way Of Example**

The following semi-Markov model describes a quadraplex architecture that
degrades to a triplex and then to a simplex in response to detected
processor failures.

![](media/image1.wmf)

The horizontal transitions represent fault arrivals. The coefficients of
λ  represent the number of processors in the configuration. The vertical
transitions represent recovery from a fault through removal of the
faulty processor. Since the quadraplex uses 3-way voting for fault
masking, there is a race between the occurrence of fault #2 and removal
of fault #1. If fault #2 wins the race, then the system fails (state 3).
This model is described by the following WinSURE input file

LAMBDA = 1E-4;

MU1 = 2.7E-4;

SIGMA1 = 1.3E-3;

MU2 = 2.7E-4;

SIGMA2 = 1.3E-3;

1,2 = 4\*LAMBDA;

2,3 = 3\*LAMBDA;

2,4 = \<MU1,SIGMA1\>;

4,5 = 3\*LAMBDA;

5,6 = 2\*LAMBDA;

5,7 = \<MU2,SIGMA2\>;

7,8 = LAMBDA;

The first 5 statements equate values to identifiers (symbolic names).
The identifier LAMBDA represents the processor failure rate. The
identifiers MU1 and SIGMA1 are the mean and standard deviation of the
time to remove a faulty processor. The identifiers MU2 and SIGMA2 are
the mean and standard deviation of the time to degrade to a simplex.
Conveniently, the only information that WinSURE needs about the
non-exponential recovery processes are the means and standard
deviations. The final 7 statements define the transitions of the model.
If the transition is a fault-arrival (or slow) the transition is assumed
to be exponentially distributed and only the exponential rate need be
provided. For example, the last statement defines a transition from
state 7 to state 8 with a rate LAMBDA. If the transition is a recovery
transition (or fast), the mean and standard deviation of the recovery
time must be given. For example, the statement 2,4 = \<MU1,SIGMA1\>
defines a transition from state 2 to state 4 with mean recovery time MU1
and standard deviation SIGMA1.

When the WinSURE program is started, the following window is opened:

![](media/image2.png){width="5.238888888888889in" height="3.7625in"}

The WinSURE user begins an interactive section by designating the
working directory (i.e. the directory containing the model files) using
the Directory button. The Model button is used to specify the file that
contains the definition of the semi-Markov model to be solved. This text
file can be created using a text editor such as Emacs or NotePad.
Alternatively, the model can be created using the Create button;
however, the editing features provided are minimal.

Once the model file has been selected its location appears in the box
labeled input file. (If desired a user can directly enter the location
of the file into this box.) The user then presses the Solve button to
obtain the WinSURE analysis. The box labeled Time is used to specify the
mission time, if not specified in the model file directly. The following
is the output received when the model described above is solved:

![](media/image3.png){width="4.914583333333334in"
height="3.561111111111111in"}

Changing the box labeled List to 2, directs WinSURE to list the
probability of entering each death state separately:

![](media/image4.png){width="4.445833333333334in"
height="3.229861111111111in"}

##  

## If the LAMBDA statement is changed to the following,

LAMBDA = 1E-12 to\* 1E-1 BY 10;

the WinSURE program solves the model repeatedly for the specified values
of LAMBDA:

## 

![](media/image5.png){width="5.051388888888889in"
height="3.670138888888889in"}

Because the Echo Box was changed to "N", the model file was not listed.
If the user then presses the Plot button the results are plotted[^2]:

![](media/image6.png){width="3.640972222222222in"
height="2.517361111111111in"}

Alternatively, you can start GNUPLOT and issue the GNUPLOT command load
'sure.plt' after pressing the Plot button or after issuing the "Write
Plot File" command on the Plot menu.

The model file can be graphically displayed using the Display
button[^3].

![](media/image7.png){width="4.120138888888889in"
height="2.783333333333333in"}

Alternatively, you can start VCG and load the .vcg file created when the
Display button is pressed.

## The WinSURE Interface Details

## 

## Directory Button -- This button is used to select the working directory (i.e. the directory where the model files are stored and the output files are written.)

## 

## Model Button -- This button is used to select the model to be solved. 

## 

## Solve Button -- This button is used to solve the selected model. The probability that the system enters any of the death states within the specified mission time is computed. The results are displayed in the window and optionally written to a .run file. For example, if the Auto Save Output flag is set (see below) and the selected model file is fta.mod, the output file is named fta.run. The amount of detail is determined by the value of List. This parameter can be set in the model file or through the LIST box:

## 0 = No output is sent to the window

## 1 = Only the total system failure probability is listed 

## 2 = The probability bounds for each death state in the model are reported along with the totals 

## 3 = The probability for the operational states are reported in addition to the death states 

## 4 = Every path in the model is listed and its probability of traversal. 

## Clear Button -- This button is used to clear the Output Window. 

## 

## Create Button -- This button is used to create a new model. It opens up an edit dialog window in which a new model file can be entered and saved:

![](media/image8.png){width="2.35in" height="1.66875in"}

## 

## Parameters Button -- The parameter button opens the following window

![](media/image9.png){width="3.0791666666666666in"
height="3.0993055555555555in"}

Prune Level: The SURE program follows paths in the model until they
reach a death state or the probability drops below the Prune level
specified here. If this parameter is set to Automatic, the prune level
is determined automatically. The error due to pruning is always added to
the upper bound, so the results are always conservative.

QTcalc: 0 = use algebraic method (FAST) to calculate Q(T)

1 = use algebraic method (MORE ACCURATE) to calculate Q(T)

Automatic = Let WinSURE decide on a path by path basis.

Start: The Start constant can be used to specify the start state. If set
to Automatic, the program will use the source state (i.e. the state with
no transitions into it) If set to Automatic and there is no source state
the first state entered will be the start state.\';

Autofast: If set to YES or 1, the program will accept fast exponential
transitions without the FAST keyword\';

Trunc: This parameter sets the maximum number of times that WinSURE will
unfold a fast loop. Note: models that contain fast loops, i.e. loops
with only fast transitions, can cause the program to run forever unless
this \"safety value\" is used. Fast loops generate an infinite sequence
of paths which do not decrease in probability (as far as WinSURE's Upper
Bound is concerned).

Warndig: Issue warning when the number of digits of accuracy in the
results are less than this value;

Auto Save: If set to YES, the output will be written to a file as well
as to the window. The file name is the model name with a .run extension.
This is especially useful for large output, which exceeds the capacity
of the window.

## 

## Plot Button -- This button calls GNUPLOT to plot results of the last solution.

## 

## OrProb Button -- Computes the probabilistic OR of all of the runs since the last clear command.

### Print Button -- Print contents of output window.

## Display Button -- Use VCG to graphically display the model on the screen.

## 

#### File Menu -- Provides menu interface to (1) open and create models files, (2) print, save and clear the output window, (3) run a file list, and (4) exit. All of these functions except (3) can be accomplished by using a button described above. 

#### 

#### The Run File List item opens a new window:

![](media/image10.png){width="2.942361111111111in"
height="1.0631944444444446in"}

that allows one to provide WinSURE with a file containing a list of
model files to be solved. When the Run File List button is pressed,
WinSURE solves all of the models listed in the specified file.

**Parameters Menu --** Opens the same parameters window that the
Parameters button opens.

**Plot Menu --** The Plot menu has three items: (1) Plot Options, (2)
Gnuplot Execute, and (3) Write Plot File.

> The Plot Options item opens the following window:

![](media/image11.png){width="2.745138888888889in"
height="1.5805555555555555in"}

> which allows the user to (a) select either Gnuplot format or Matlab
> format, (b) change the name of the plot file, and (c) specify which
> axes should be logarithmically scaled.
>
> The Gnuplot Execute item calls GNUPLOT to plot the results and the
> Write Plot File item just writes out a file that can be processed by
> GNUPLOT or Matlab subsequently[^4].

#### Defaults Menu -- This menu allows the user to save the current values of parameters and options so that subsequent executions of WinSURE will be loaded with the desired values.

## Concluding Remarks

The WinSURE program is an Semi-Markov model reliability analysis program
that runs on the Windows operating system. It computes the death state
and operational state probabilities for user-input models.

## References

> \[1\] Butler, Ricky W.; and White, Allan L.: SURE Reliability
> Analysis: Program and Mathematics. NASA Technical Paper 2764, Mar.
> 1988.
>
> \[2\] Butler, Ricky W.: The SURE Approach to Reliability Analysis.
> IEEE Transactions on Reliability, vol. 41, no. 2, June 1992, pp.
> 210\--218.
>
> \[3\] Ricky W. Butler and Sally C. Johnson, Techniques for Modeling
> the Reliability of Fault-Tolerant Systems With the Markov State-Space
> Approach , NASA RP-1348, September 1995, pp. 130.

[^1]: The mean and standard deviation are conditioned on the event that
    this transition succeeds over any other competing fast recoveries
    from the state. If there are no other fast recoveries from this
    state, the conditional mean and standard deviation are the same as
    the unconditionals.

[^2]: GNUPLOT must be installed and registered to open .plt files in
    order for this to work. This can be accomplished by double clicking
    on a .plt file and using the OTHER button of the Open With dialog
    box to provide Windows with the location of the "wgnuplot.exe" file.
    The GNUPLOT software is copyrighted but freely distributed at
    http://www.cs.dartmouth.edu/gnuplot_info.html

[^3]: VCG must be installed and registered to open .vcg files in order
    for this to work. This can be accomplished by double clicking on a
    .vcg file and using the OTHER button of the Open With dialog box to
    provide Windows with the location of the "VCG.EXE" file. The VCG
    software is available by anonymous ftp at ftp.cs.uni-sb.de
    (134.96.7.254) in the directory /pub/graphics/vcg. It is freely
    available under the GNU General Public License.

[^4]: The WinSURE program closes the plot output files as soon as the
    PLOT command completes, so that GNUPLOT can run immediately after
    the PLOT command in a separate X window.