## 5 Methodology for Reliability and Availability Evaluation
### Device Failure  
After obtaining an expression for the network failure condition, it is necessary to define the conditions that may lead to the failure of a field device. Note that only devices that belong to the network failure  
Figure 6: Network failure condition (nfc). condition are analyzed. We consider two possibilities for a device failure: (i) its hardware has failed; (ii) there is no path between the device and the gateway. This latter case corresponds to a _connectivity failure_, since the device itself did not failed in a strict sense (_i.e._, it works), but it is considered non-operational from a network perspective because it is no longer possible to communicate with it. If a device along the path fails, the network may have the required mechanisms to reconfigure itself in order to use other paths. This type of reconfiguration is done by self-healing routing protocols. As aforementioned, the failure condition for a field device, \(fc\_Fd_{i}\), is split in two involving hardware and connectivity problems. Regarding to hardware failures, we must consider the cases where the field devices are configured with or without redundancy. A redundant device fails (Figure 7(a)) if the current operating device suffers an hardware failure (\(Fd_{i\_a}\)) and if all its spares have already failed (events \(Fd_{i\_b}\) to \(Fd_{i\_z}\)). This is represented by event \(r\_Fd_{i}\). On the other hand, for a device without redundancy (Figure 7(b)) the device fails when its hardware fails. Regarding failures related with the connectivity problem (represented by the event \(cp\) in Figure 7(a,b), a device is considered to be faulty if there is no path from the device to the gateway (_i.e._, sink). In other words, if a device has \(j\) paths connecting it to the gateway, at least one path must be working properly to consider that the device is operational. The event \(cp\) that represents this situation (Figure 7(c)) results from the combination of failures in access points (\(AP_{i}\)), routers (\(R_{i}\)), redundant devices (\(r\_Fd_{i}\)) and devices without redundancy (\(Fd_{i\_a}\)). We will use an example to clarify the notation described in Figure 7. Consider a WSN composed by 4 field devices: \(Fd_{1}\), \(Fd_{2}\), \(Fd_{3}\) and \(Fd_{4}\). The addressed problem is to find the failure condition associated to device \(Fd_{2}\). Assume that device \(Fd_{2}\) is redundant and has one spare device, while devices \(Fd_{1}\), \(Fd_{3}\), and \(Fd_{4}\) are not redundant. Regarding to the connectivity problem, if device \(Fd_{3}\) fails or if devices \(Fd_{1}\) and \(Fd_{4}\) fail, then device \(Fd_{2}\) will also fail since there is no path to the gateway. Based on this scenario, the failure condition for device \(Fd_{2}\) (\(fc\_Fd_{2}\)) is presented by Figure 8. Note that the event \(cp\_Fd_{2}\_and_{0}\) was replaced by a single event \(Fd_{3\_a}\) because it makes no sense to build an _AND_ gate with just one input. Figure 7: Device failure condition. (**a**) Redundant field device; (**b**) Simple field device; (**c**) Connectivity problem. Note that to find all combinations that lead to a connectivity failure necessarily requires some effort. To attain this, it is necessary to search all paths between the gateway and field devices that belong to the network failure condition. This procedure is described in Algorithm 1. The basic idea is to perform a depth-first search (DFS) in the adjacency matrix that represent the WSN. The procedure recursively traverse all devices on the path until the gateway is reached. Two restrictions were introduced to simplify the DFS. First, it makes no sense to search neighbor devices of the access point (line 5). Access points  
Figure 8: Example of a failure condition defined for the field device \(Fd_{2}\). are directly connected to the gateway, and an access point does not communicate with another access point. The second restriction is related to the elimination of paths within a cycle.