# Analysis of Failures and Influence Factors of Critical Infrastructures: A Case of Metro

Authors: Yongliang Deng; Liangliang Song; Jianliang Zhou; Na Xu; Guodong Ni; Linxiu Wang
Journal: Advances in Civil Engineering
 (2020)

---

## Abstract

Metro plays an indispensable role in promoting social and economic development of the big cities. However, the safety operation of the metro system is believed to be an arduous work for its operation being susceptible to various factors, especially equipment failure, which could bring about delay, interruption, and even accidents. In consideration of the seriousness of metro accident, it is becoming more and more crucial to conduct proactive, targeted, and effective risk management to reduce failures. Firstly, based on the FMECA and influence diagram theory, this paper proposes a new analytical framework to study metro equipment failure in accordance with system decomposition. Furthermore, a case study is implemented to verify the feasibility and availability of this framework in evaluating criticality of failure modes and assessing its influence factors based on the collected data from metro operation company. As indicated by the research results, wheel damage is the most serious failure mode in the bogie system, and its most paramount influence factor is the shortage of professional skills. Finally, a discussion about the research methods and results is carried out, and several recommendations are put forward to improve safety management on the basis of research findings. This study has the potential to offer suggestions in regard to metro equipment design, operation, and maintenance for raising the safety level in metro operation.


---

## Body

## 1. Introduction

The urbanization level of China has reached 53.7%, which is far below the developed countries [1]. With the acceleration of urbanization, an increasing number of peasants migrate to the developed metropolitan cities, which brings about problems of city transportation and pollution. Currently, serious traffic congestion has become a bottleneck of urban development and will directly influence the long-term and sustainable development of cities [2]. Regarding this situation, metro, a cleaner transportation mean, has been adopted by more and more cities to alleviate the urban traffic pressure and further promote urban development. According to the statistical data provided by China’s Ministry of Construction, by December 31, 2017, 33 cities already had metro systems in operation, and another 12 cities are building metro. The newly added operating mileage from 2005 to 2017 can be depicted in Figure 1. The total length of metro lines in the above cities is estimated to be about 6000 km by 2020, which will rank China first in the world in terms of total metro length.Figure 1
Newly added operating mileage from 2005 to 2017.Critical infrastructures can ensure a continuous flow of essential services and products in our daily lives, and their destruction or incapacity would significantly influence the social stability and healthy economic development of any country [3]. Compared with providing high-quality transportation services, the operational safety of the metro is more crucial. As a kind of complex transportation, metro has several special characteristics including relatively close space, poor ventilation, and difficult emergency evacuation. Its complexities mainly stem from a variety of complex functions as well as exogenous and endogenous functional dependencies and interdependencies [4]. For example, the power supply system provides electricity to the signal system, and the signal system offers running signal to the vehicle system. On account of to the exact interdependences inside the metro subsystems, the failure or breakdown of any equipment may affect the functions of other equipment or even diffuse directly or indirectly to the whole metro system [5]. As a consequence, the risk of technical equipment failure is extremely serious, which will probably result in delay, interruption, or even accidents that may cause huge economic loss and social disruption. For instance, the collision accident of June 22, 2009, in Washington, which led to 9 deaths and 76 injured people, was mainly caused by a failure in the signal system.According to the statistics of metro operation accidents, equipment failures or breakdowns are the main and direct causes of accidents, which account for approximately 70% [6]. Metro breakdowns or failures will usually lead to heavy losses in various aspects. It is of great importance to implement effective and proactive risk management for the metro system [7]. Failure analysis is an important approach to enhance the reliability and availability of equipment. Based on the failure analysis, not only the critical dangerous failure mode can be identified, but also the influence factors can be analyzed deeply by applying the influence diagram model, which could improve corresponding safety management level and generate preferable maintenance strategies in practice. There is no doubt that controlling the influence factors will be conducive to reducing the failure rate. In consequence, carrying out research on formulating corresponding coping strategies by analyzing equipment failure and its influence factors is necessary and of great significance to promote metro operation safety.The aim of this study is to analyze the metro failure and evaluate its influence factors thereby promoting safety management in metro operation. First, following this purpose, an analytical framework is put forward for defining the analysis process. Second, failure mode effects, criticality analysis (FMECA) method, and influence diagram (ID) theory are introduced successively. Subsequently, metro system decomposition is carried out with the collected information and data. The bogie system is selected as example for failure analysis and influence factor evaluation based on the FMECA method and the established ID model. Based on the research findings and discussion, recommendations are proposed for improving the safety level in metro operation management. This paper hopes to bring up some beneficial references and thoughts for healthy and persistent development of metro industry in a long run.The rest of the paper is organized as follows: a literature review concerning metro safety and failure analysis is summarized in Section2. The methodology including a methodical framework, failure mode effects and criticality analysis, and influence diagram theory is described in Section 3. In Section 4, an empirical analysis in which the critical failure modes and its influence factors are assessed in terms of expert experience and knowledge is expatiated. The discussion and recommendations about the research significance and possible implementation issues are presented in Section 5. Finally, Section 6 concludes the paper stating the future study.


## 2. Literature Review

### 2.1. Metro Operation Safety

Metro is playing an increasingly vital role in urban public transportation. With the rapid growth of metro network size and its capacity, safety management during the operation stage has become the focus of public concern. There is no doubt that metro operation safety will significantly influence the development and progress of society in multiple aspects.Research institutions and scholars have endeavored to identify and evaluate the safety risks of potential accidents in metro operation. This has brought out numerous studies on safety management. To be specific, Jiang et al. [8] analyzed the evacuation performance at two metro stations in Beijing and further discussed the causes of overcrowding as well as its influencing factors. Also, Pan et al. [9] developed a multilevel extensible model to evaluate the metro operation safety in Beijing metro, in which the risk degree of the line and its subsystems was determined and the reference in further research was discussed. By investigating the emergency evacuation during fire outbreak in metro station, Tsukahara et al. [10] found that the effect of downward evacuation was better than upward evacuation, which has the reference value for station design. Considering the importance of ability to perceive hazards, Lu et al. [11] combined signal detection theory (SDT) and fuzzy mathematical method to estimate the workers’ hazard perception in metro operation. By addressing behavioral culture, technical elements, and actual achievements, Kyriakidis et al. [7] developed a new safety maturity model to assist in reducing risks, such as precursors, top events, injuries, and deaths. Based on vehicle sensor network data and vehicle maintenance plan, Ding et al. [12] analyzed the metro vehicle condition data and proposed a modeling framework to improve the maintenance level, as it was a crucial factor in reducing failure frequency. Lu et al. [13] utilized case-based reasoning to analyze metro accident precursors from workers, physical equipment, and environment by combining case representation and retrieval, in which the similarity of the input and stored cases had a remarkable effect on the accuracy of result. Besides, Luo et al. [14] adopted three different ventilation modes in the experiment and complementary numerical simulation to study the influencing factors in the case of fire eruption at metro station, which could significantly minimize damage and avoid loss of life. Yang et al. [15] assessed the robustness of the Beijing metro network using complex network theory. According to their finding, the Beijing metro network exhibited relatively high robustness and survivability in the face of random failures, whereas error tolerance was relatively low when the hubs underwent malicious attacks. To prevent accident, Zhang et al. [6] identified 24 accident precursors by analyzing 83 accidents that occurred in Shanghai metro. Through the accelerated failure time (AFT) hazard model, Louie et al. [16] made some findings. Namely, the incident types that simultaneously affect both safety and operations generally have longer expected delays than incident types that affect either safety or operations alone. With an aim to improve safety performance, Li et al. [17] established a metro operation hazard network model to analyze the interactions among metro operation hazards. Song et al. [18] proposed an AHP-ISM-based framework to explore the vulnerability factors of the metro system. Their findings provide deep insights into the knowledge and perception about metro operation safety. Deng et al. [19] proposed a framework to research the running status of metro equipment and recommended a logic diagram of maintenance modes for supporting maintenance strategy.In general, the majority of previous research concentrated on safety evaluation, risk identification in terms of the causes and propagation of accidents, topological analysis, and fire emergency. In contrast, this paper chiefly focuses on vehicle failures and their influencing factors in the safety management of metro operations.


### 2.2. Failure Analysis

In recent years, more and more attention has been focused on the risk of technical system failure, and this has resulted to some standards being built [20]. During the process of failure analysis, the data sources are generally obtained from theoretical analysis, historical data, and expert opinion. Notwithstanding, different industries have unique characteristics. The failure risk analysis usually includes ascertaining the probability and consequences and thinking about the feasibility and operability of controlling influence factors. Failure analysis is critical to determining the maintenance action priority and maintenance management strategies [21]. In brief, failure analysis, as the most crucial foundation for reducing or eliminating failure occurrence, can positively raise the system safety through improved design, effective maintenance, appropriate operation, and other ways.At present, failure risk analysis primarily concentrates on the failure mode, influence factor, and failure cause. The major research methods on equipment include fault tree analysis (FTA) [22], FMECA [23], and common cause failure analysis (CCFA) [24]. FTA is a powerful method to investigate failure behavior based on logic diagram. FMECA is a systematic approach to map failure mode, effect, and cause of technical system. Additionally, some alternative approaches are selected, including data envelopment analysis (DEA) [25], technique for order preference by similarity to an ideal solution (TOPSIS) [26], grey relational analysis (GRA) [27], decision-making trial and evaluation laboratory (DEMATEL) [28], artificial neural network [29], knowledge base [30], and fuzzy linguistic variables [31]. By using fault tree analysis and Bayesian network, Dongiovanni and Iesmantas [32] presented a new methodology to extrapolate and estimate components failure rate. It has been revealed that mean inherent availability ranges from 79% to 82% when turbine subcomponent failure rate varies from 1E − 4/h to 1E − 8/h in 20 years. Furthermore, Zhou et al. [33] studied the fault diagnosis of the wind turbine by combining ontology and FMECA and realized knowledge sharing among different stakeholders. Hassija et al. [34] adopted the alpha factor model to assess common cause failure in two nuclear power plants. According to their finding, the contribution of common cause failure to failure probability was very sensitive to the change in the criterion. Moreover, Chen and Wu [35] employed FMECA to determine, classify, and analyze common failures in the municipal solid waste lifecycle, and the findings could be used to minimize potential failures and bring continuous improvement. Yang et al. [36] established an object-oriented Bayesian network (OOBN) model to analyze the observed abnormal events to evaluate the running status of the subsea pipeline. The estimated failure probabilities are important basis of failure control. Peeters et al. [37] combined the failure mode and effects analysis (FMEA) with FTA in a recursive manner in order to explore failure behavior, which had been demonstrated to be efficient and effective in a case study of metal painting.In general, the majority of previous research concentrated on enhancing the accuracy and operational property of failure analysis. However, failure analysis is not the ultimate goal, and it is the basis of reducing the failure ratio, minimizing the downtime, and improving the safety level. This paper does not only focus on failures but also pay more attention to safety management.


## 2.1. Metro Operation Safety

Metro is playing an increasingly vital role in urban public transportation. With the rapid growth of metro network size and its capacity, safety management during the operation stage has become the focus of public concern. There is no doubt that metro operation safety will significantly influence the development and progress of society in multiple aspects.Research institutions and scholars have endeavored to identify and evaluate the safety risks of potential accidents in metro operation. This has brought out numerous studies on safety management. To be specific, Jiang et al. [8] analyzed the evacuation performance at two metro stations in Beijing and further discussed the causes of overcrowding as well as its influencing factors. Also, Pan et al. [9] developed a multilevel extensible model to evaluate the metro operation safety in Beijing metro, in which the risk degree of the line and its subsystems was determined and the reference in further research was discussed. By investigating the emergency evacuation during fire outbreak in metro station, Tsukahara et al. [10] found that the effect of downward evacuation was better than upward evacuation, which has the reference value for station design. Considering the importance of ability to perceive hazards, Lu et al. [11] combined signal detection theory (SDT) and fuzzy mathematical method to estimate the workers’ hazard perception in metro operation. By addressing behavioral culture, technical elements, and actual achievements, Kyriakidis et al. [7] developed a new safety maturity model to assist in reducing risks, such as precursors, top events, injuries, and deaths. Based on vehicle sensor network data and vehicle maintenance plan, Ding et al. [12] analyzed the metro vehicle condition data and proposed a modeling framework to improve the maintenance level, as it was a crucial factor in reducing failure frequency. Lu et al. [13] utilized case-based reasoning to analyze metro accident precursors from workers, physical equipment, and environment by combining case representation and retrieval, in which the similarity of the input and stored cases had a remarkable effect on the accuracy of result. Besides, Luo et al. [14] adopted three different ventilation modes in the experiment and complementary numerical simulation to study the influencing factors in the case of fire eruption at metro station, which could significantly minimize damage and avoid loss of life. Yang et al. [15] assessed the robustness of the Beijing metro network using complex network theory. According to their finding, the Beijing metro network exhibited relatively high robustness and survivability in the face of random failures, whereas error tolerance was relatively low when the hubs underwent malicious attacks. To prevent accident, Zhang et al. [6] identified 24 accident precursors by analyzing 83 accidents that occurred in Shanghai metro. Through the accelerated failure time (AFT) hazard model, Louie et al. [16] made some findings. Namely, the incident types that simultaneously affect both safety and operations generally have longer expected delays than incident types that affect either safety or operations alone. With an aim to improve safety performance, Li et al. [17] established a metro operation hazard network model to analyze the interactions among metro operation hazards. Song et al. [18] proposed an AHP-ISM-based framework to explore the vulnerability factors of the metro system. Their findings provide deep insights into the knowledge and perception about metro operation safety. Deng et al. [19] proposed a framework to research the running status of metro equipment and recommended a logic diagram of maintenance modes for supporting maintenance strategy.In general, the majority of previous research concentrated on safety evaluation, risk identification in terms of the causes and propagation of accidents, topological analysis, and fire emergency. In contrast, this paper chiefly focuses on vehicle failures and their influencing factors in the safety management of metro operations.


## 2.2. Failure Analysis

In recent years, more and more attention has been focused on the risk of technical system failure, and this has resulted to some standards being built [20]. During the process of failure analysis, the data sources are generally obtained from theoretical analysis, historical data, and expert opinion. Notwithstanding, different industries have unique characteristics. The failure risk analysis usually includes ascertaining the probability and consequences and thinking about the feasibility and operability of controlling influence factors. Failure analysis is critical to determining the maintenance action priority and maintenance management strategies [21]. In brief, failure analysis, as the most crucial foundation for reducing or eliminating failure occurrence, can positively raise the system safety through improved design, effective maintenance, appropriate operation, and other ways.At present, failure risk analysis primarily concentrates on the failure mode, influence factor, and failure cause. The major research methods on equipment include fault tree analysis (FTA) [22], FMECA [23], and common cause failure analysis (CCFA) [24]. FTA is a powerful method to investigate failure behavior based on logic diagram. FMECA is a systematic approach to map failure mode, effect, and cause of technical system. Additionally, some alternative approaches are selected, including data envelopment analysis (DEA) [25], technique for order preference by similarity to an ideal solution (TOPSIS) [26], grey relational analysis (GRA) [27], decision-making trial and evaluation laboratory (DEMATEL) [28], artificial neural network [29], knowledge base [30], and fuzzy linguistic variables [31]. By using fault tree analysis and Bayesian network, Dongiovanni and Iesmantas [32] presented a new methodology to extrapolate and estimate components failure rate. It has been revealed that mean inherent availability ranges from 79% to 82% when turbine subcomponent failure rate varies from 1E − 4/h to 1E − 8/h in 20 years. Furthermore, Zhou et al. [33] studied the fault diagnosis of the wind turbine by combining ontology and FMECA and realized knowledge sharing among different stakeholders. Hassija et al. [34] adopted the alpha factor model to assess common cause failure in two nuclear power plants. According to their finding, the contribution of common cause failure to failure probability was very sensitive to the change in the criterion. Moreover, Chen and Wu [35] employed FMECA to determine, classify, and analyze common failures in the municipal solid waste lifecycle, and the findings could be used to minimize potential failures and bring continuous improvement. Yang et al. [36] established an object-oriented Bayesian network (OOBN) model to analyze the observed abnormal events to evaluate the running status of the subsea pipeline. The estimated failure probabilities are important basis of failure control. Peeters et al. [37] combined the failure mode and effects analysis (FMEA) with FTA in a recursive manner in order to explore failure behavior, which had been demonstrated to be efficient and effective in a case study of metal painting.In general, the majority of previous research concentrated on enhancing the accuracy and operational property of failure analysis. However, failure analysis is not the ultimate goal, and it is the basis of reducing the failure ratio, minimizing the downtime, and improving the safety level. This paper does not only focus on failures but also pay more attention to safety management.


## 3. Methodology

### 3.1. Overall Research Framework

As described above, the literature review is performed to construct a foundation for this research and support the development of the overall research framework. According to the research objective, a detailed methodical framework for failure analysis is proposed and described in Figure2. The approach, which consists of FMECA and influencing diagram, offers a new way to incorporate failure analysis and uncertainty model into metro safety research. The framework can be divided into four steps. The first step is specifically to decompose the metro system. The second step is to identify the most hazardous failure mode by assessing various failure modes. The third step is to analyze the influence factors of hazardous failure mode, and the final step is to present discussion and suggestions for improving metro operation safety. Overall, the failure mode and influence diagram model have formed two major parts of failure analysis.Figure 2
The analytical framework.


### 3.2. FMECA

All complex systems or equipment has their special failure modes. The failure modes, effects and criticality analysis (FMECA) is one of the famous methods in conducting the failure analysis. FMECA consists of two parts, failure mode and effects analysis (FMEA) and criticality analysis (CA). It is a systematic procedure to identify potential failure modes, cause, and effect on system performance. Given the prominent efficiency and effect on identifying failure modes and root causes of undesired consequences, this effective approach has widely been applied to various industries such as aircraft equipment [38], medicinal devices [39], and shipbuilding industry [23].FMECA, which is capable of analyzing a system with inductive logic, can rank the existing failure modes in terms of their severity [40]. Sankar and Prabhu [41] proposed a method to prioritize failure modes; they utilized the ranks 1 to 1000 to represent the increasing risk of the 1000 possible severity-occurrence-detection combinations. Risk priority number (RPN) refers to a proper approach for calculating severity of failure modes, which can be defined as equation (1). There are three parameters in RPN: severity represents the extent of damage effects, occurrence represents the likelihood of the failure mode, and detection represents the ease of detecting a failure [42]. The rating of severity, occurrence, and detection applied in this research comes from Sinha and Steel [43], as shown in Table 1. Each risk factor takes a discrete value in the range [0, 10]. Larger rating values indicate higher severity and higher occurrence probabilities. However, as to detection, higher values indicate less ease of detecting a failure:(1)Risk priority number=severity×occurance×detection.Table 1
Rating of severity, occurrence, and detection.
Rating
Severity (S)
Occurrence (O)
Detection (D)
Probability
Description
1
Effect is not noticed
<10−5
Extremely less
Certain
2
Very slight effect noticed
10−5
Remote
Very high
3
Slight effect causing annoyance
10−5
Very slight
High
4
Slight effect causing return of product
4 × 10−4
Slight
Moderate
5
Moderate effect causing return of product
2 × 10−3
Occasional
Medium
6
Significant effect
1 × 10−2
Moderate
Low chance
7
Major effect
4 × 10−2
Frequent
Slight
8
Extreme effect, system inoperable, safety issue
0.20
High
Remote
9
Critical effect, system shutdown, safety risk
0.33
Very high
Very remote
10
Hazardous, without warning, life threatening
0.5
Extremely high
No chance, no inspection


### 3.3. Influence Diagram Theory

As a powerful investigation technique, ID affords deep insights into the mutual influencing interactions between various factors and decisions which explicitly reveal probabilistic dependency in a flux of information. The process of establishing an ID model provides a deep understanding of the research problem, and its output is remarkably valuable. It was first used in 1973 by the Decision Analysis Group at Stanford Research Institute during a project which was done for the Defense Intelligence Agency [44]. The ID model has been widely applied in multiple fields, such as the medical field [45, 46], military applications [47], the human-robot communication for collaborative decision-making [48], and industrial engineering [49]. By employing ID to analyze the reliability of helicopter’s main gearbox system and the exact influence of each of its internal components or external factors (organizational/human), Rashid et al. [50] identified and estimated the maximum “permissible” probability of failure for a given component. Meanwhile, a selected set of governing failure probability is reached. Zheng et al. [51] presented a fuzzy evidential influence diagram (FEID) to evaluate the risk supply chain finance in tunnel construction. The results implied that FEID can more accurately reflect the true situation and achieve more useful results.An ID model mainly includes nodes and arcs. As shown in Table2, there are four types of nodes in the ID model. Furthermore, there are three different categories of arcs in an ID model: the arc directed to chance node represents probabilistic dependence, the arc directed to value node represents functional dependence, and the arc directed to a decision node represents what information is known when the decision has to be made [44].Table 2
Node introduction.
Node
Symbol
Description
Decision node
Rectangle
Representing variables that the decision-maker controls directly, these variables model the decision alternatives available for the decision-maker
Chance node
Circle
Representing random variables described by probability distribution, i.e., uncertain quantities that are relevant to the decision problem and cannot be controlled directly
Deterministic node
Concentric circles
Representing the value of a deterministic random variable that can be determined by the value of a known condition variable
Value node
Diamond
Representing the expected utilities that model the decision-maker’s preferences for outcome, i.e., they express the profit or the preference degree of the consequences derived from the decision processThe process of building an ID model mainly includes three steps: the first step is to identify the relevant variables, the second step is to determine the relationships between these variables, and the third step is to assess the probabilities for quantifying the relationships [52]. These three steps are closely related with each other, and they are not just organized as a single sequential process but also as a systematic procedure which can be reflected in the working mode. Although the interaction seemingly makes the modeling process more complicated, the clean graphical representation can do a great help to perfect the model by modifications. The solving process of the ID model can be deemed as a series of consistency transformations, including removing nodes, reversing arcs, and modifying probability. Different calculation methods of the transformation process may form different graphs, but the final result will be the same. In this research, the greedy algorithm is adopted to tackle the ID model, which is a systemic and integral method that can make graphic change with the least number of times. Based on the greedy algorithm, the solution of the proposed ID model includes three steps: (i) deleting the redundant nodes, (ii) deleting the chance node, and (iii) reversing the arcs. In addition, equations (2) and (3) will be used in the whole calculation process. What is calculated from the evaluation results of influence diagram is the contribution of each factor, namely, the influence of various important factors on the value node in the model.(2)PB=∑i=1nPAiPB∣Ai,(3)PBi∣A=PA∣BiPBi∑j=1nPA∣BjPBj.


### 3.4. Fuzzy Set Theory

Fuzzy set theory is an effective method to deal with linguistic data. Converting linguistic variables into quantitative data is the biggest advantage of this approach. It is especially powerful when evaluating the index system with no conventional model for estimating or measuring [53]. The accuracy of its application depends on the depth of understanding of the research object. In terms of risk or safety assessment criteria, fuzzy set theory provides a good opportunity to identify the weaknesses of technical systems.


#### 3.4.1. Fuzzy Number and Linguistic Variables

The fuzzy number could be expressed as a convex fuzzy set with a membership between 0 and 1. Several membership functions are widely used, such as and Gaussian, triangular and trapezoidal. The triangular fuzzy number could be expressed asA=a,b,c, and the trapezoidal fuzzy number could be expressed as A=a,b,c,d.Appropriate linguistic variables have to be set reasonably in accordance with actual situation. The triangular fuzzy number and trapezoidal fuzzy number are employed to cope with linguistic variables in this paper. A set of 7 linguistic variables is set to assess the indexes as shown in Table3, and the membership function could be illustrated in Figure 3.Table 3
The linguistic variables.
Linguistic variables
Fuzzy number
Very low (VL)
(0, 0.1, 0.2)
Low (L)
(0.1, 0.2, 0.3)
Medium low (ML)
(0.2, 0.3, 0.4, 0.5)
Medium (M)
(0.4, 0.5, 0.6)
Medium high (FH)
(0.5, 0.6, 0.7, 0.8)
High (H)
(0.7, 0.8, 0.9)
Very high (VH)
(0.8, 0.9, 1)Figure 3
Membership function of fuzzy linguistic variables.


#### 3.4.2. Defuzzification

Defuzzification refers to the process of converting linguistic variables into quantitative data. Based on the cut set, Liou and Wang [54] presented the integral value method. It is employed as the defuzzification method in this paper. According to this approach, if P is the L-R fuzzy number, its defuzzified value could be calculated with the following equation:(4)IP=1−kIRP+ILP.The optimistic coefficient is introduced in the evaluation process to indicate the attitude of decision-makers to risk in the fuzzy evaluation environment. In equation (4), k is the optimistic coefficient, and its value is between 0 and 1. When k equals to 0.5, IP is the representative value of the defuzzified value. According to the λ-cut set, ILP and IRP could be calculated with equations (5) and (6), where λRP and λLP are the upper bound and lower bound of the λ-cut of fuzzy number, Δλ = 0.1 and λ = 0.1, 0.2, …, 1:(5)ILP=12∑λ=0.11λLPΔλ+∑λ=00.9λLPΔλ,(6)IRP=12∑λ=0.11λRPΔλ+∑λ=00.9λRPΔλ.


## 3.1. Overall Research Framework

As described above, the literature review is performed to construct a foundation for this research and support the development of the overall research framework. According to the research objective, a detailed methodical framework for failure analysis is proposed and described in Figure2. The approach, which consists of FMECA and influencing diagram, offers a new way to incorporate failure analysis and uncertainty model into metro safety research. The framework can be divided into four steps. The first step is specifically to decompose the metro system. The second step is to identify the most hazardous failure mode by assessing various failure modes. The third step is to analyze the influence factors of hazardous failure mode, and the final step is to present discussion and suggestions for improving metro operation safety. Overall, the failure mode and influence diagram model have formed two major parts of failure analysis.Figure 2
The analytical framework.


## 3.2. FMECA

All complex systems or equipment has their special failure modes. The failure modes, effects and criticality analysis (FMECA) is one of the famous methods in conducting the failure analysis. FMECA consists of two parts, failure mode and effects analysis (FMEA) and criticality analysis (CA). It is a systematic procedure to identify potential failure modes, cause, and effect on system performance. Given the prominent efficiency and effect on identifying failure modes and root causes of undesired consequences, this effective approach has widely been applied to various industries such as aircraft equipment [38], medicinal devices [39], and shipbuilding industry [23].FMECA, which is capable of analyzing a system with inductive logic, can rank the existing failure modes in terms of their severity [40]. Sankar and Prabhu [41] proposed a method to prioritize failure modes; they utilized the ranks 1 to 1000 to represent the increasing risk of the 1000 possible severity-occurrence-detection combinations. Risk priority number (RPN) refers to a proper approach for calculating severity of failure modes, which can be defined as equation (1). There are three parameters in RPN: severity represents the extent of damage effects, occurrence represents the likelihood of the failure mode, and detection represents the ease of detecting a failure [42]. The rating of severity, occurrence, and detection applied in this research comes from Sinha and Steel [43], as shown in Table 1. Each risk factor takes a discrete value in the range [0, 10]. Larger rating values indicate higher severity and higher occurrence probabilities. However, as to detection, higher values indicate less ease of detecting a failure:(1)Risk priority number=severity×occurance×detection.Table 1
Rating of severity, occurrence, and detection.
Rating
Severity (S)
Occurrence (O)
Detection (D)
Probability
Description
1
Effect is not noticed
<10−5
Extremely less
Certain
2
Very slight effect noticed
10−5
Remote
Very high
3
Slight effect causing annoyance
10−5
Very slight
High
4
Slight effect causing return of product
4 × 10−4
Slight
Moderate
5
Moderate effect causing return of product
2 × 10−3
Occasional
Medium
6
Significant effect
1 × 10−2
Moderate
Low chance
7
Major effect
4 × 10−2
Frequent
Slight
8
Extreme effect, system inoperable, safety issue
0.20
High
Remote
9
Critical effect, system shutdown, safety risk
0.33
Very high
Very remote
10
Hazardous, without warning, life threatening
0.5
Extremely high
No chance, no inspection


## 3.3. Influence Diagram Theory

As a powerful investigation technique, ID affords deep insights into the mutual influencing interactions between various factors and decisions which explicitly reveal probabilistic dependency in a flux of information. The process of establishing an ID model provides a deep understanding of the research problem, and its output is remarkably valuable. It was first used in 1973 by the Decision Analysis Group at Stanford Research Institute during a project which was done for the Defense Intelligence Agency [44]. The ID model has been widely applied in multiple fields, such as the medical field [45, 46], military applications [47], the human-robot communication for collaborative decision-making [48], and industrial engineering [49]. By employing ID to analyze the reliability of helicopter’s main gearbox system and the exact influence of each of its internal components or external factors (organizational/human), Rashid et al. [50] identified and estimated the maximum “permissible” probability of failure for a given component. Meanwhile, a selected set of governing failure probability is reached. Zheng et al. [51] presented a fuzzy evidential influence diagram (FEID) to evaluate the risk supply chain finance in tunnel construction. The results implied that FEID can more accurately reflect the true situation and achieve more useful results.An ID model mainly includes nodes and arcs. As shown in Table2, there are four types of nodes in the ID model. Furthermore, there are three different categories of arcs in an ID model: the arc directed to chance node represents probabilistic dependence, the arc directed to value node represents functional dependence, and the arc directed to a decision node represents what information is known when the decision has to be made [44].Table 2
Node introduction.
Node
Symbol
Description
Decision node
Rectangle
Representing variables that the decision-maker controls directly, these variables model the decision alternatives available for the decision-maker
Chance node
Circle
Representing random variables described by probability distribution, i.e., uncertain quantities that are relevant to the decision problem and cannot be controlled directly
Deterministic node
Concentric circles
Representing the value of a deterministic random variable that can be determined by the value of a known condition variable
Value node
Diamond
Representing the expected utilities that model the decision-maker’s preferences for outcome, i.e., they express the profit or the preference degree of the consequences derived from the decision processThe process of building an ID model mainly includes three steps: the first step is to identify the relevant variables, the second step is to determine the relationships between these variables, and the third step is to assess the probabilities for quantifying the relationships [52]. These three steps are closely related with each other, and they are not just organized as a single sequential process but also as a systematic procedure which can be reflected in the working mode. Although the interaction seemingly makes the modeling process more complicated, the clean graphical representation can do a great help to perfect the model by modifications. The solving process of the ID model can be deemed as a series of consistency transformations, including removing nodes, reversing arcs, and modifying probability. Different calculation methods of the transformation process may form different graphs, but the final result will be the same. In this research, the greedy algorithm is adopted to tackle the ID model, which is a systemic and integral method that can make graphic change with the least number of times. Based on the greedy algorithm, the solution of the proposed ID model includes three steps: (i) deleting the redundant nodes, (ii) deleting the chance node, and (iii) reversing the arcs. In addition, equations (2) and (3) will be used in the whole calculation process. What is calculated from the evaluation results of influence diagram is the contribution of each factor, namely, the influence of various important factors on the value node in the model.(2)PB=∑i=1nPAiPB∣Ai,(3)PBi∣A=PA∣BiPBi∑j=1nPA∣BjPBj.


## 3.4. Fuzzy Set Theory

Fuzzy set theory is an effective method to deal with linguistic data. Converting linguistic variables into quantitative data is the biggest advantage of this approach. It is especially powerful when evaluating the index system with no conventional model for estimating or measuring [53]. The accuracy of its application depends on the depth of understanding of the research object. In terms of risk or safety assessment criteria, fuzzy set theory provides a good opportunity to identify the weaknesses of technical systems.


### 3.4.1. Fuzzy Number and Linguistic Variables

The fuzzy number could be expressed as a convex fuzzy set with a membership between 0 and 1. Several membership functions are widely used, such as and Gaussian, triangular and trapezoidal. The triangular fuzzy number could be expressed asA=a,b,c, and the trapezoidal fuzzy number could be expressed as A=a,b,c,d.Appropriate linguistic variables have to be set reasonably in accordance with actual situation. The triangular fuzzy number and trapezoidal fuzzy number are employed to cope with linguistic variables in this paper. A set of 7 linguistic variables is set to assess the indexes as shown in Table3, and the membership function could be illustrated in Figure 3.Table 3
The linguistic variables.
Linguistic variables
Fuzzy number
Very low (VL)
(0, 0.1, 0.2)
Low (L)
(0.1, 0.2, 0.3)
Medium low (ML)
(0.2, 0.3, 0.4, 0.5)
Medium (M)
(0.4, 0.5, 0.6)
Medium high (FH)
(0.5, 0.6, 0.7, 0.8)
High (H)
(0.7, 0.8, 0.9)
Very high (VH)
(0.8, 0.9, 1)Figure 3
Membership function of fuzzy linguistic variables.


### 3.4.2. Defuzzification

Defuzzification refers to the process of converting linguistic variables into quantitative data. Based on the cut set, Liou and Wang [54] presented the integral value method. It is employed as the defuzzification method in this paper. According to this approach, if P is the L-R fuzzy number, its defuzzified value could be calculated with the following equation:(4)IP=1−kIRP+ILP.The optimistic coefficient is introduced in the evaluation process to indicate the attitude of decision-makers to risk in the fuzzy evaluation environment. In equation (4), k is the optimistic coefficient, and its value is between 0 and 1. When k equals to 0.5, IP is the representative value of the defuzzified value. According to the λ-cut set, ILP and IRP could be calculated with equations (5) and (6), where λRP and λLP are the upper bound and lower bound of the λ-cut of fuzzy number, Δλ = 0.1 and λ = 0.1, 0.2, …, 1:(5)ILP=12∑λ=0.11λLPΔλ+∑λ=00.9λLPΔλ,(6)IRP=12∑λ=0.11λRPΔλ+∑λ=00.9λRPΔλ.


## 3.4.1. Fuzzy Number and Linguistic Variables

The fuzzy number could be expressed as a convex fuzzy set with a membership between 0 and 1. Several membership functions are widely used, such as and Gaussian, triangular and trapezoidal. The triangular fuzzy number could be expressed asA=a,b,c, and the trapezoidal fuzzy number could be expressed as A=a,b,c,d.Appropriate linguistic variables have to be set reasonably in accordance with actual situation. The triangular fuzzy number and trapezoidal fuzzy number are employed to cope with linguistic variables in this paper. A set of 7 linguistic variables is set to assess the indexes as shown in Table3, and the membership function could be illustrated in Figure 3.Table 3
The linguistic variables.
Linguistic variables
Fuzzy number
Very low (VL)
(0, 0.1, 0.2)
Low (L)
(0.1, 0.2, 0.3)
Medium low (ML)
(0.2, 0.3, 0.4, 0.5)
Medium (M)
(0.4, 0.5, 0.6)
Medium high (FH)
(0.5, 0.6, 0.7, 0.8)
High (H)
(0.7, 0.8, 0.9)
Very high (VH)
(0.8, 0.9, 1)Figure 3
Membership function of fuzzy linguistic variables.


## 3.4.2. Defuzzification

Defuzzification refers to the process of converting linguistic variables into quantitative data. Based on the cut set, Liou and Wang [54] presented the integral value method. It is employed as the defuzzification method in this paper. According to this approach, if P is the L-R fuzzy number, its defuzzified value could be calculated with the following equation:(4)IP=1−kIRP+ILP.The optimistic coefficient is introduced in the evaluation process to indicate the attitude of decision-makers to risk in the fuzzy evaluation environment. In equation (4), k is the optimistic coefficient, and its value is between 0 and 1. When k equals to 0.5, IP is the representative value of the defuzzified value. According to the λ-cut set, ILP and IRP could be calculated with equations (5) and (6), where λRP and λLP are the upper bound and lower bound of the λ-cut of fuzzy number, Δλ = 0.1 and λ = 0.1, 0.2, …, 1:(5)ILP=12∑λ=0.11λLPΔλ+∑λ=00.9λLPΔλ,(6)IRP=12∑λ=0.11λRPΔλ+∑λ=00.9λRPΔλ.


## 4. Case Study

### 4.1. Data Collection

In general, acquiring the accurate and effective data is the critical step to implement FMECA and ID analysis. In this research, a three-stage process has been designed to collect the basic data. At the beginning, a field investigation is implemented to obtain the daily statistical data on metro vehicle failure modes in Nanjing Metro Operation Company. Interviews are carried out to get further information concerning metro operation safety risk. By doing so, qualitative data are generated from nine face-to-face interviews. The managers, drivers, and workers may have rich experience and knowledge because of that they have kept their jobs here for a very long time. To maximize interviewee’s freedom, open-ended questions are designed in the interviews. In the second stage, a special meeting on the theme of failure mode, effect, and criticality is organized and implemented based on the brainstorming method. The participants include experts from NMOC and all members in our research team. The failure modes of vehicle and their influencing factors are analyzed deeply, and the potential means of improving safety management are also discussed. The basic data required by FMECA are determined in this stage. In the third stage, the ID model is established, and a questionnaire is designed. The questionnaire survey is carried out to collect the basic data in the ID model. The collected questionnaires are dealt in accordance with fuzzy set theory.


### 4.2. Metro System Decomposition

The metro system is typically a complex and giant system, covering the civil engineering, mechanical, electrical, electronic information, environmental control, transportation organization, and so on. From a system point of view, the metro system is composed of a number of completely diverse functional subsystems, including lines, vehicles, stations, electrical, operational, and signal control. Furthermore, there are also various components in every subsystem. The subsystems and main components of each subsystem are shown in Table4.Table 4
Subsystems and components.
Object
Subsystem
Main components
Metro
Vehicle system
Vehicle body, bogie system, coupler buffer device, brake device, power traction device, etc.
Power supply system
Traction substation, step-down substation, catenary system, power monitoring system, etc.
Fire extinguishing system
Gas fire extinguishing system, fire water system, emergency lighting and evacuation instructions, fire extinguishers, etc.
Track system
Rails, sleepers, track beds, ballasts, joint parts, etc.
Mechanical-electrical plant system
Environmental control system, water supply and drainage system, screen door system, elevator system, etc.
Communication system
Transmission system, wireless dispatch communication system, clock system, television system, broadcast system, etc.
Signal system
Automatic train protection system, automatic train operation system, automatic train supervision system, computer interlock, etc.
Building automatic system
Supervision, control, measurement and adjustment equipment, central control system, station control system, etc.
Automatic fare collection system
Automatic ticket vending machine, gate machine, ticket inspection machine, etc.
Civil engineering system
Station, tunnel, elevated structure, etc.Given the limitation of length in this paper, it is not feasible to analyze every type of failure mode in the metro system. According to a statistic analysis about failure of line 1, line 2, and line 3 in Shanghai metro, vehicle failure constitutes the maximum proportion, which is 37.8%, followed by signal failure with the proportion of 24.3%. As the pivotal equipment in metro operation, the quality and maintenance of the vehicle will inevitably exert a direct and significant influence on the safety level of metro operation. In consequence, a subsystem of vehicle would be chosen as an example to validate the feasibility and validity of the proposed approach. As the direct carrier in the metro transportation service, the vehicle consists of body, control and management system, traction, door, braking, auxiliary, air conditioning, and bogie. Taking the significance of components’ function into consideration, the bogie system is further utilized for empirical analysis.


### 4.3. FMECA

Bogie, as one of the key components of vehicle, is used to guide vehicle running along the track, adjust the axle load on uniform distribution, and buffer shock. In a sense, the capability of a vehicle mainly depends on the performance of bogie. According to the statistical data in NMOC, the failure modes of bogie are divided into seven types, including air spring failure, abnormal vibration, oil leakage of gear box, jib elastic node failure, damage of rubber ring, oil leakage of shock absorber, and wheel damage. Fracture, wear, and vibration are three primary causes of the bogie failure based on field investigation. Once happening, the negative effect would be reflected in the component, the bogie system, or even the vehicle system. Specifically speaking, the failure will cause relatively minor damage to the components at the first level, the effect on the second level will lead to the performance of the bogie degradation or temporarily damage, and the effect on the third level will result in the performance of vehicle safety and comfort. According to the collected data, the FMEA is shown in Table5.Table 5
FMEA.
No.
Failure mode
Failure cause
Failure effect
1
Air spring failure
Improper processing, violent vibration
Component damage
2
Abnormal vibration
Rubber elastic bushing failure, bearing deformation, excessive amplitude, severe friction
Minor component damage
3
Gear box oil leakage
Excessive wear, crack, fracture, improper processing
Poor performance or temporary damage to the bogie
4
Jib elastic node failure
Violent vibration, violent vibration
Component damage
5
Rubber ring damaged
Rubber ring is pulled out, rubber ring is broken, excessive wear
Minor component damage
6
Shock absorber oil leakage
Vibration amplitude overrun, excessive wear, crack, fracture, shock absorber position tilt
Poor performance or temporary damage to the bogie
7
Wheel damage
Poor tread contact, abnormal wear, tread foreign body, wheel internal crack, dimensional deformation
Affecting the safety and comfort of vehicleFurthermore, the severity, occurrence, and detection of each failure mode are obtained, which is expatiated in Table6. Then, the RPN could be calculated based on equation (1). The result of CA is illustrated in Figure 4.Table 6
CA.
Item
Failure mode
Severity
Occurrence
Detection
Bogie
Air spring failure
4
4
3
Abnormal vibration
4
4
4
Gear box oil leakage
5
5
4
Jib elastic node failure
3
3
4
Rubber ring damage
3
3
3
Shock absorber oil leakage
6
7
4
Wheel damage
7
7
5Figure 4
RPN of failure modes.As indicated by the RPN analysis results, the sequence of risk severity for these failure modes would be wheel damage, oil leakage of the shock absorber, oil leakage of the gear box, abnormal vibration, air spring failure, jib elastic node failure, and damage of the rubber ring. Regarding the improvement of safety level, it would be a rewarding way to prioritize maintenance resources, optimize maintenance strategies, and implement more effective maintenance measures in accordance with the characteristics of failure modes. Therefore, influence factors, which have a straightforward impact on the occurrence of failures, should be deeply and systematically analyzed at first. Wheel damage, the most dangerous failure mode, is further employed to perform influence factors analysis by using the ID model in the next section.


### 4.4. Influence Factor Evaluation

In metro operation, identifying and evaluating influence factors are the vital work to enhance the performance of the vehicle and prevent the occurrence of accidents. In the bogie system, the wheel damage is the key failure mode. The factors triggering the wheel damage can be placed into three categories, comprising organizational factors (e.g., maintenance procedure), human factors (e.g., driver and maintainer), and environmental factors (e.g., rain, snow, and temperature variation). Given the influence of different factors, a graphical representation-based approach influence diagram is adopted to evaluate the consequences of each factor.Indeed, the data extracted from the existing resources, such as literature and media, cannot cover all the required information. Not only that, even the usable or relevant data are not directly available or amendable to quantify the parameters of the preference relations and probabilities in the ID model. As a consequence, the ID model has been established on the basis of expert experience and knowledge in this research. However, it is difficult to consider all the possible factors that pertain to operation, maintenance, and management. Hence, to some extent, the influence factors and ID model are simplified reasonably in accordance with expert’s opinion. Taking wheel damage as the target event, the ID model is built by using the target directional method, as shown in Figure5. In this model, these four factors are independent. For instance, the limited driving ability mainly refers to the driver’s own ability, and it is independent of the other three factors. Through applying fuzzy set theory, the basic data of ID model are obtained based on expert experience and knowledge. It is expatiated in Table 7, where A1 means that event A occurs, while A0 denotes that event A does not occur.Figure 5
The general structure of the proposed ID model.Table 7
Priori and conditional possibility distributions.
Item
Condition
Probability
P
A
1
A = true
0.2086
P
A
0
A = false
0.7914
P
B
1
B = true
0.1339
P
B
0
B = false
0.8661
P
C
1
C = true
0.2316
P
C
0
C = false
0.7684
P
D
1
D = true
0.2776
P
D
0
D = false
0.7224
P
E
1
∣
A
1
A = true; E = true
0.4846
P
E
0
∣
A
1
A = true; E = false
0.5154
P
E
0
∣
B
1
B = true; E = true
0.1407
P
E
0
∣
B
1
B = true; E = false
0.8593
P
F
1
∣
B
1
B = true; F = true
0.1520
P
F
0
∣
B
1
B = true; F = false
0.8480
P
F
1
∣
G
1
G = true; F = true
0.4374
P
F
0
∣
G
1
G = true; F = false
0.5626
P
G
1
∣
C
1
C = true; G = true
0.4242
P
G
0
∣
C
1
C = true; G = false
0.5758
P
G
1
∣
D
1
D = true; G = true
0.3979
P
G
0
∣
D
1
D = true; G = false
0.6021
P
H
1
∣
B
1
B = true; H = true
0.1131
P
H
0
∣
B
1
B = true; H = false
0.8869
P
H
1
∣
E
1
E = true; H = true
0.4020
P
H
0
∣
E
1
E = true; H = false
0.5980
P
H
1
∣
F
1
F = true; H = true
0.4879
P
H
0
∣
F
1
F = true; H = false
0.5121
P
H
1
∣
G
1
G = true; H = true
0.4568
P
H
0
∣
G
1
G = true; H = false
0.5432In the proposed ID model, nodesA, B, C, and D refer to decision nodes, nodes E, F, and G refer to chance nodes, and node H refers to the value node. The objective of considering the influence factors in risk analysis is to quantify the influence degree of factors on the target events. To obtain the influence degree of the decision node on the value node, the chance node should be deleted gradually. In this study, one chance node will be deleted in each step. The sequence of deleting the chance node is designed as E, F, and G. After diagram transformation and calculation, the final result of the ID model is shown in Figures 6–8.Figure 6
The first step influence diagram.Figure 7
The second step influence diagram.Figure 8
Final influence diagram.The results of calculation have been expatiated in Table8. Obviously, the shortage of professional skills is the most important influence factor, including the probability of 19.07% for the driving skills, and the probability of 30.90% for repairing skills. According to Hain rules, the advanced technology and management system cannot replace staff’s quality and sense of responsibility. The maintenance management affects equipment safety in multiple ways, which contributes to 34.74% of the wheel damage. Moreover, the severe weather has the least influence on wheel damage, which depends on the practical situation. Severe weather implies that there would be unacceptable temperature changes. These changes induce the problem of wheel size which ultimately results in wheel vehicle damage. Thus, improving professional skills of staff can exert extraordinary positive effect on the improvement of equipment safety, which is also the physical foundation of metro operation. In the next section, discussion on how to improve metro safety according to the results of FMECA and ID analysis is presented.Table 8
Priori and conditional possibility distributions.
Item
Condition
Probability
P
A
1
∣
H
1
H = true; A = true
0.1907
P
B
1
∣
H
1
H = true; B = true
0.1532
P
C
1
∣
H
1
H = true; C = true
0.3090
P
D
1
∣
H
1
H = true; D = true
0.3474


## 4.1. Data Collection

In general, acquiring the accurate and effective data is the critical step to implement FMECA and ID analysis. In this research, a three-stage process has been designed to collect the basic data. At the beginning, a field investigation is implemented to obtain the daily statistical data on metro vehicle failure modes in Nanjing Metro Operation Company. Interviews are carried out to get further information concerning metro operation safety risk. By doing so, qualitative data are generated from nine face-to-face interviews. The managers, drivers, and workers may have rich experience and knowledge because of that they have kept their jobs here for a very long time. To maximize interviewee’s freedom, open-ended questions are designed in the interviews. In the second stage, a special meeting on the theme of failure mode, effect, and criticality is organized and implemented based on the brainstorming method. The participants include experts from NMOC and all members in our research team. The failure modes of vehicle and their influencing factors are analyzed deeply, and the potential means of improving safety management are also discussed. The basic data required by FMECA are determined in this stage. In the third stage, the ID model is established, and a questionnaire is designed. The questionnaire survey is carried out to collect the basic data in the ID model. The collected questionnaires are dealt in accordance with fuzzy set theory.


## 4.2. Metro System Decomposition

The metro system is typically a complex and giant system, covering the civil engineering, mechanical, electrical, electronic information, environmental control, transportation organization, and so on. From a system point of view, the metro system is composed of a number of completely diverse functional subsystems, including lines, vehicles, stations, electrical, operational, and signal control. Furthermore, there are also various components in every subsystem. The subsystems and main components of each subsystem are shown in Table4.Table 4
Subsystems and components.
Object
Subsystem
Main components
Metro
Vehicle system
Vehicle body, bogie system, coupler buffer device, brake device, power traction device, etc.
Power supply system
Traction substation, step-down substation, catenary system, power monitoring system, etc.
Fire extinguishing system
Gas fire extinguishing system, fire water system, emergency lighting and evacuation instructions, fire extinguishers, etc.
Track system
Rails, sleepers, track beds, ballasts, joint parts, etc.
Mechanical-electrical plant system
Environmental control system, water supply and drainage system, screen door system, elevator system, etc.
Communication system
Transmission system, wireless dispatch communication system, clock system, television system, broadcast system, etc.
Signal system
Automatic train protection system, automatic train operation system, automatic train supervision system, computer interlock, etc.
Building automatic system
Supervision, control, measurement and adjustment equipment, central control system, station control system, etc.
Automatic fare collection system
Automatic ticket vending machine, gate machine, ticket inspection machine, etc.
Civil engineering system
Station, tunnel, elevated structure, etc.Given the limitation of length in this paper, it is not feasible to analyze every type of failure mode in the metro system. According to a statistic analysis about failure of line 1, line 2, and line 3 in Shanghai metro, vehicle failure constitutes the maximum proportion, which is 37.8%, followed by signal failure with the proportion of 24.3%. As the pivotal equipment in metro operation, the quality and maintenance of the vehicle will inevitably exert a direct and significant influence on the safety level of metro operation. In consequence, a subsystem of vehicle would be chosen as an example to validate the feasibility and validity of the proposed approach. As the direct carrier in the metro transportation service, the vehicle consists of body, control and management system, traction, door, braking, auxiliary, air conditioning, and bogie. Taking the significance of components’ function into consideration, the bogie system is further utilized for empirical analysis.


## 4.3. FMECA

Bogie, as one of the key components of vehicle, is used to guide vehicle running along the track, adjust the axle load on uniform distribution, and buffer shock. In a sense, the capability of a vehicle mainly depends on the performance of bogie. According to the statistical data in NMOC, the failure modes of bogie are divided into seven types, including air spring failure, abnormal vibration, oil leakage of gear box, jib elastic node failure, damage of rubber ring, oil leakage of shock absorber, and wheel damage. Fracture, wear, and vibration are three primary causes of the bogie failure based on field investigation. Once happening, the negative effect would be reflected in the component, the bogie system, or even the vehicle system. Specifically speaking, the failure will cause relatively minor damage to the components at the first level, the effect on the second level will lead to the performance of the bogie degradation or temporarily damage, and the effect on the third level will result in the performance of vehicle safety and comfort. According to the collected data, the FMEA is shown in Table5.Table 5
FMEA.
No.
Failure mode
Failure cause
Failure effect
1
Air spring failure
Improper processing, violent vibration
Component damage
2
Abnormal vibration
Rubber elastic bushing failure, bearing deformation, excessive amplitude, severe friction
Minor component damage
3
Gear box oil leakage
Excessive wear, crack, fracture, improper processing
Poor performance or temporary damage to the bogie
4
Jib elastic node failure
Violent vibration, violent vibration
Component damage
5
Rubber ring damaged
Rubber ring is pulled out, rubber ring is broken, excessive wear
Minor component damage
6
Shock absorber oil leakage
Vibration amplitude overrun, excessive wear, crack, fracture, shock absorber position tilt
Poor performance or temporary damage to the bogie
7
Wheel damage
Poor tread contact, abnormal wear, tread foreign body, wheel internal crack, dimensional deformation
Affecting the safety and comfort of vehicleFurthermore, the severity, occurrence, and detection of each failure mode are obtained, which is expatiated in Table6. Then, the RPN could be calculated based on equation (1). The result of CA is illustrated in Figure 4.Table 6
CA.
Item
Failure mode
Severity
Occurrence
Detection
Bogie
Air spring failure
4
4
3
Abnormal vibration
4
4
4
Gear box oil leakage
5
5
4
Jib elastic node failure
3
3
4
Rubber ring damage
3
3
3
Shock absorber oil leakage
6
7
4
Wheel damage
7
7
5Figure 4
RPN of failure modes.As indicated by the RPN analysis results, the sequence of risk severity for these failure modes would be wheel damage, oil leakage of the shock absorber, oil leakage of the gear box, abnormal vibration, air spring failure, jib elastic node failure, and damage of the rubber ring. Regarding the improvement of safety level, it would be a rewarding way to prioritize maintenance resources, optimize maintenance strategies, and implement more effective maintenance measures in accordance with the characteristics of failure modes. Therefore, influence factors, which have a straightforward impact on the occurrence of failures, should be deeply and systematically analyzed at first. Wheel damage, the most dangerous failure mode, is further employed to perform influence factors analysis by using the ID model in the next section.


## 4.4. Influence Factor Evaluation

In metro operation, identifying and evaluating influence factors are the vital work to enhance the performance of the vehicle and prevent the occurrence of accidents. In the bogie system, the wheel damage is the key failure mode. The factors triggering the wheel damage can be placed into three categories, comprising organizational factors (e.g., maintenance procedure), human factors (e.g., driver and maintainer), and environmental factors (e.g., rain, snow, and temperature variation). Given the influence of different factors, a graphical representation-based approach influence diagram is adopted to evaluate the consequences of each factor.Indeed, the data extracted from the existing resources, such as literature and media, cannot cover all the required information. Not only that, even the usable or relevant data are not directly available or amendable to quantify the parameters of the preference relations and probabilities in the ID model. As a consequence, the ID model has been established on the basis of expert experience and knowledge in this research. However, it is difficult to consider all the possible factors that pertain to operation, maintenance, and management. Hence, to some extent, the influence factors and ID model are simplified reasonably in accordance with expert’s opinion. Taking wheel damage as the target event, the ID model is built by using the target directional method, as shown in Figure5. In this model, these four factors are independent. For instance, the limited driving ability mainly refers to the driver’s own ability, and it is independent of the other three factors. Through applying fuzzy set theory, the basic data of ID model are obtained based on expert experience and knowledge. It is expatiated in Table 7, where A1 means that event A occurs, while A0 denotes that event A does not occur.Figure 5
The general structure of the proposed ID model.Table 7
Priori and conditional possibility distributions.
Item
Condition
Probability
P
A
1
A = true
0.2086
P
A
0
A = false
0.7914
P
B
1
B = true
0.1339
P
B
0
B = false
0.8661
P
C
1
C = true
0.2316
P
C
0
C = false
0.7684
P
D
1
D = true
0.2776
P
D
0
D = false
0.7224
P
E
1
∣
A
1
A = true; E = true
0.4846
P
E
0
∣
A
1
A = true; E = false
0.5154
P
E
0
∣
B
1
B = true; E = true
0.1407
P
E
0
∣
B
1
B = true; E = false
0.8593
P
F
1
∣
B
1
B = true; F = true
0.1520
P
F
0
∣
B
1
B = true; F = false
0.8480
P
F
1
∣
G
1
G = true; F = true
0.4374
P
F
0
∣
G
1
G = true; F = false
0.5626
P
G
1
∣
C
1
C = true; G = true
0.4242
P
G
0
∣
C
1
C = true; G = false
0.5758
P
G
1
∣
D
1
D = true; G = true
0.3979
P
G
0
∣
D
1
D = true; G = false
0.6021
P
H
1
∣
B
1
B = true; H = true
0.1131
P
H
0
∣
B
1
B = true; H = false
0.8869
P
H
1
∣
E
1
E = true; H = true
0.4020
P
H
0
∣
E
1
E = true; H = false
0.5980
P
H
1
∣
F
1
F = true; H = true
0.4879
P
H
0
∣
F
1
F = true; H = false
0.5121
P
H
1
∣
G
1
G = true; H = true
0.4568
P
H
0
∣
G
1
G = true; H = false
0.5432In the proposed ID model, nodesA, B, C, and D refer to decision nodes, nodes E, F, and G refer to chance nodes, and node H refers to the value node. The objective of considering the influence factors in risk analysis is to quantify the influence degree of factors on the target events. To obtain the influence degree of the decision node on the value node, the chance node should be deleted gradually. In this study, one chance node will be deleted in each step. The sequence of deleting the chance node is designed as E, F, and G. After diagram transformation and calculation, the final result of the ID model is shown in Figures 6–8.Figure 6
The first step influence diagram.Figure 7
The second step influence diagram.Figure 8
Final influence diagram.The results of calculation have been expatiated in Table8. Obviously, the shortage of professional skills is the most important influence factor, including the probability of 19.07% for the driving skills, and the probability of 30.90% for repairing skills. According to Hain rules, the advanced technology and management system cannot replace staff’s quality and sense of responsibility. The maintenance management affects equipment safety in multiple ways, which contributes to 34.74% of the wheel damage. Moreover, the severe weather has the least influence on wheel damage, which depends on the practical situation. Severe weather implies that there would be unacceptable temperature changes. These changes induce the problem of wheel size which ultimately results in wheel vehicle damage. Thus, improving professional skills of staff can exert extraordinary positive effect on the improvement of equipment safety, which is also the physical foundation of metro operation. In the next section, discussion on how to improve metro safety according to the results of FMECA and ID analysis is presented.Table 8
Priori and conditional possibility distributions.
Item
Condition
Probability
P
A
1
∣
H
1
H = true; A = true
0.1907
P
B
1
∣
H
1
H = true; B = true
0.1532
P
C
1
∣
H
1
H = true; C = true
0.3090
P
D
1
∣
H
1
H = true; D = true
0.3474


## 5. Discussion and Recommendations

According to the analysis result of FMECA, wheel damage is the most serious failure mode. As the direct contact interface between the vehicle and track system, the wheel would bear various loads during the operation of vehicle. Both track and wheel are prone to deformation. Furthermore, its operational environment is relatively severe for rain, snow, and temperature change which can adversely affect the performance of wheel. As indicated from the analysis result of ID, maintenance management and professional skill of maintenance personnel are critical influence factors. At present, the majority of the metro operation companies adopt scheduled maintenance strategies in the maintenance management. The maintenance cycle is designed based on the running time of the equipment. Obviously, unreasonable planned maintenance may lead to inadequate or excess maintenance work. Insufficient maintenance could cause unpredictable safety hazards, while superfluous maintenance would result in waste of human, material, and financial resources. Consequently, the maintenance system of metro equipment should gradually change from plan maintenance mode to condition-based maintenance mode.FMECA is an inductive method to identify and analyze failure modes in various systems. In practice, the lack of basic data often hinders the smooth implementation of FMECA. Expert knowledge is a feasible and valuable alternative to get the relevant data. Therefore, based on reliable data acquisition and processing methods, FMECA is believed to be one of the most effective and reliable ways when used in sessions with a seasoned team. However, there would be several challenges in the application of FMECA. First, some failure circumstances may not be recognized in practice. For example, the collision which occurred in December, 2009, in Shanghai was caused by a failure in N11-1438 track segment coding circuit, and this failure which was not realized until this accident. Second, it would be a tough work to determine a starting point and define the failure mode in new technical equipment used in industries due to lack of practical experience. Furthermore, it is difficult to achieve an adequate understanding of failure behavior in complex system, because not only some failure modes are simultaneous but also the relationship among failure modes may be correlative and complex. FMECA cannot reflect the relevance between different failure modes.ID is a tool with enormous potential for modeling uncertain knowledge. It is not limited to provide optimal strategy for decision-making and can also be applied to generate diagnosis based on inferred posterior distribution. ID offers a clean graphical representation to experts and expects them to reason easily about the domain problem. Adding new variables or changing relations are allowed in ID by experts to produce a more detailed and refined model. For the convenience of this research, simplification of the ID model is adopted based on expert opinion. Compared with the ID model, obtaining preferences and numerical probabilities is proved to be a difficult task. Existing data about the specific domain (database, literature, etc.) do not usually include and involve all the needed information. Even if the required data exist, it is usually not directly amendable or available for quantifying the numerical probabilities and preference relations. In view of this, knowledge and experience of experts can be one of the important data sources. But it is worth noticing that the quantification of numerical parameters is considered to be difficult and subjective. Therefore, the whole process has to be designed discreetly to guarantee the reliability of acquisition and quantification based on the actual situation.Failure management is a significant elementary work for the whole systematic study of metro system. Metro operation company is directly responsible for safety management in metro operation activities. A metro failure mode database (MFMD) is recommended to build for improving failure management. In daily operations, general staff, safety officers, safety managers, and safety experts are the key participants to formulate MFMD. They are real executors and must work collaboratively. General staff should report the failure event to safety officers accurately and immediately. The safety officers will then do some statistical analysis and submit to the safety manager. With the assistance of safety expert, safety manager can estimate the risk, analyze the causative factors, and propose the corresponding and effective countermeasures more promptly and efficiently. These specific measures or solutions are carried out by general staff and safety officers. Of course, the executive process should be supervised and evaluated by safety expert and safety manager. The interactions among general staff, safety officers, safety manager, and safety expert are illustrated in Figure9.Figure 9
The interactions among general staff, safety officers, safety manager, and safety expert.To prevent failure and minimize its impact, an organizational framework is put forward, as depicted in Figure10. The metro operation company directly takes charge of metro operation safety by organizing and conducting maintenance and patrol inspection in consideration of the actual situation. Also, it can offer fundamental data (e.g., records, statistical data, and experience) to the research institution based on MFMD. What is more, with the assist of MFMD, the equipment manufacturer is capable of raising the technical design standards and optimizing the manufacturing procedure in a more systematic and scientific way. The research institution can not only act as a consultant for metro operation company and equipment manufacturer but also help them improve safety management performance and reliability of equipment. For instance, the research institution can propose pertinent suggestions for optimizing the maintenance strategies. As a consequence, it is essential to expand active cooperation with metro operation company and research institution so as to identify and analyze failure modes and their root causes. Such collaboration will be conductive to reducing equipment risk and improving metro safety. With respect to the government department, supervising the metro operation company and equipment manufacturer should be a persistent work to continuously upgrade the safety control level. Additionally, passengers should compliance with metro safety rules and regulations and cooperate and assist in case of need.Figure 10
A proposed organization framework.In the field of metro safety, the research topics are mainly derived from two research perspectives: technology-driven and management-driven. They are mutually cooperative and dependent. Various innovative technologies could be adopted to assist in safety management, such as collecting location information and environment information. With the continuous development of innovative information technology, it provides great opportunity and possibility to improving metro operation safety. Information technology should be paid more attention not only in the stage of academic research but also in the application practice. Building information modeling (BIM), internet of things (IOS), geographic information system (GIS), radio frequency identification (RFID), laser scanning, information and communication technology (ICT), virtual reality (VR), and augmented reality (AR) could be a great help in enhancing metro operation safety, such as obtaining equipment status information, promoting professional skills, and monitoring unsafe behaviors. These technologies can be combined to collect and analyze safety information and visualize the safety risk or results of safety evaluation. These can be an important area of metro operation safety research.


## 6. Conclusion

In this paper, an effective and feasible analytical framework has been proposed to study metro safety from the perspective of equipment failure. The bogie system is selected as an example to implement empirical analysis based on statistical data and expert knowledge. As indicated by the research result of FMECA, it can be found that wheel damage is the most serious failure mode, followed by oil leakage of the shock absorber and oil leakage of the gear box. Furthermore, for the purpose of identifying and evaluating the influence factors of wheel damage, an ID model has been established and analyzed from the perspective of organization, staff, and environment. According to the conclusion, professional skills would be the crucial influence factor.The research process and results are intuitively sound. It has been proven that using FMECA and influence diagram to study equipment failure may be a fruitful direction. In brief, FMECA is an effective approach to study the failure mode of the metro system, while the ID model is a powerful tool to research influence factors of the failure mode. The proposed analytical framework is a promising method to explore and improve the intrinsic safety in the metro system.The failure study can be regarded as a significant foundation for enhancing the safety level of metro operation. More precisely, it is anticipated to improve metro operation safety mainly from three aspects. First, FMECA will not only assist in discovering the serious and critical failure mode of metro equipment through the quantitative method but also provide a solid base for hierarchical management of equipment safety. The estimated RPN can help prioritize management action to prevent and control equipment failure. Second, ID is conducive to identifying and evaluating influence factors. Hence, targeted measures can be developed and implemented according to the key influence factors of different failure modes. Third, the equipment failure research can provide manufacturers with basic data to improve the performance of metro equipment and raise its reliability.In future research, some promising information technologies are worthful to collect, analyze, visualize, and monitor valuable information for assisting safety management in daily operation, such as constructing a real-time early warning system based on the precursors of failure modes. Failure prediction and maintenance strategies based on failure influence factors deserve a thorough study. Additionally, how to build a good safety climate and safety culture to support safety management is worthy of researching (e.g., reducing human error). The metro operation unit and equipment manufacturer will significantly benefit from these researches.



---

*Source: 2301276-2020-02-07.xml*