# Reliability Model of the Fly-By-Wire System Based on Stochastic Petri Net

Authors: Zhong Lu; Zhiwen Zhang; Lu Zhuang; Jia Zhou
Journal: International Journal of Aerospace Engineering
 (2019)

---

## Abstract

The fly-by-wire system plays an important role in modern civil aircraft. As a typical safety-critical system, its reliability will affect the safety of aircraft significantly. In the paper, stochastic Petri nets are applied in the reliability modeling and analysis for the fly-by-wire system to represent its dynamic (time-dependent) failure behaviors. Stochastic Petri net-based reliability models are established for all kinds of architectures including series, parallel,m-out-of-n, warm standby, cold standby, and load-sharing architectures, which are commonly used in the fly-by-wire system. A Monte Carlo simulation method is proposed for the stochastic Petri net-based reliability models to generate system lifetime samples, and the system reliability parameters can be calculated in terms of the lifetime samples. Finally, a fly-by-wire system is used as a case study to illustrate the application and effectiveness of our proposed approaches. The results show that the error of the reliability value in a flight duration obtained by our Monte Carlo simulation method is less than 1×10−4 compared with the analytical equation.


---

## Body

## 1. Introduction

The flight-control system is a typical safety-critical system whose reliability will affect the safety of aircraft significantly. The failure or malfunction of the flight-control system will lead to an unsafe flight path or structural failure preventing continued safe flight and landing, which are considered as catastrophic top level failure conditions of the aircraft. In the modern transport category airplanes, fly-by-wire systems have been widely used to replace hydromechanical ones. By utilizing the fly-by-wire system, pilots’ commands are converted to electronic signals transmitted by wires to flight-control computers, and control commands are calculated by flight-control computers based on control laws to determine the movements of the actuators at each control surface. Therefore, the mechanical circuits consisting of rods, cables, and pulleys are not required anymore, and the weight of the airplane can be reduced.In order to improve the reliability of the fly-by-wire system, redundancy architectures including parallel, majority, standby, and load-sharing have been widely used in the design of the fly-by-wire system. As there are dynamic or state-dependent behaviors in the standby or load-sharing systems, the failure of the systems depends not only on the combinations of its component failures but also on the occurrence order of the component failures [1, 2]. At present, fault tree analysis (FTA), dependence diagram analysis (DDA), and Markov analysis (MA) are the most widely used tools for reliability modeling and safety analysis of airborne systems. FTA is a deductive failure analysis that focuses on one particular undesired event and provides a method for determining causes of this event. DDA, which is equivalent to reliability block diagram (RBD) in reliability engineering, provides an alternate pictorial representation of combinations of failures for the purpose of probability analysis. In MA, Markov chains are used to represent various system states and relationships among them. The states can be either operational or nonoperational. The transition rate from one state to another is a function of the failure rate or repair rate. The state probabilities are derived by solving a set of differential equations that are derived from the Markov chain [3, 4]. Among all the three methods, FTA and DDA are both static tools; they cannot capture the state-dependent behavior of system failure mechanisms [5]. Although MA can cope with state-dependent behaviors, it will be faced with the infamous state space explosion problem when the system is large and complex. What is more, the solution of the differential equations for the Markov chains is a cumbersome work and MA can only deal with the system whose components are following exponential distributions [6].As a tool for discrete event system simulation, Petri nets have been widely applied in reliability engineering since three decades ago. One of the important applications is focusing on system reliability modeling by using Petri nets instead of traditional reliability tools [7–11]. Hura and Atwood [7] presented a method to represent fault trees with Petri nets, which they thought can provide more insight into failure behaviors. Malhotra and Trivedi [8] studied to construct the reliability models by using stochastic Petri nets and stochastic reward nets, and different kinds of repair scenarios are also considered in these models. Liu and Chiou [9] used Petri nets to denote different kinds of logic operations, and a trapezoidal graph method is applied to account for failure scenarios. Schneeweiss [10] developed the Petri net models for many reliability scenarios, and maintenance cost and benefit are considered in their research. Volovoi [11] applied aging tokens in the Petri net-based reliability model, and the advantages of their method have been illustrated by comparing with classical reliability tools. Katsigiannis et al. [12] presented a new methodology for reliability modeling-based fluid stochastic Petri nets for small isolated power systems. Robidoux et al. [13] presented an algorithm that automatically converts the RBD model into a colored Petri net, and a case study is used to illustrate the effectiveness of the method. Wu et al. [14] established the reliability model for a solar array mechanical system by using fault tree and fuzzy reasoning Petri nets, and their method can be applied to find the fault mechanisms. Chu et al. [15] built a reliability model for the jet pipe servo valve by using generalized stochastic Petri nets, and the effectiveness of their method is illustrated by comparing with the Markov model. In recent years, the application of Petri nets has been extended to many other fields of reliability and safety engineering, which include the reliability analysis of integrated modular avionics [16], the reliability modeling of multimission phased mission system [17], the formal model-based safety analysis [18], and the dependability analysis of safety-critical real-time systems [19].The Petri nets have displayed a powerful ability in reliability and safety modeling; thus, a stochastic Petri net-based reliability model will be proposed for the fly-by-wire systems in this study. The rest of this paper is structured as follows. In Section2, a brief description of the stochastic Petri net is presented. In Section 3, the Petri net-based reliability models are constructed for both static and dynamic architectures including series, parallel, m-out-of-n, warm standby, cold standby, and load-sharing architectures, and the substitution transitions are applied in the hierarchical reliability model to simplify complex net structures. In Section 4, a Monte Carlo simulation method is proposed for the stochastic Petri net-based reliability models to generate system lifetime samples, and the system reliability parameters can be calculated in terms of the lifetime samples. In Section 5, a fly-by-wire system is used as a case study to illustrate the application and effectiveness of our proposed reliability approaches. In Section 6, concluding remarks are presented.


## 2. Definitions Related to the Stochastic Petri Net-Based Reliability Model

### 2.1. Definitions of the Stochastic Petri Net-Based Reliability Model

According to the definition of the stochastic Petri net [20, 21], the stochastic Petri net-based reliability model can be defined as a 7-tuple ∑=P,T,F,K,W,M0,Λ such that
(i)
P=p1,p2,⋯,pn is the set of places which are used to denote the states of components or systems
(ii)
T=t1,t2,⋯,tm is the set of transitions including timed transitions and immediate transitions; the timed transitions are used to denote the failure process of each component and the immediate transitions are used to denote the relationship among different states
(iii)
F⊆P×T∪T×P is the set of arcs which build the links between places and transitions
(iv)
K:P⟶1,2,3,⋯ is the capacity function which indicates the number of states for a specific component or system
(v)
W:F⟶1,2,3,⋯ is the weight function of arcs; the weights contain the imformation about how a transition can be fired and how the state can be changed after the transition has been fired
(vi)
M:P⟶0,1,2,⋯ is the marking of the net, ∀p∈P:Mp≤Kp, and M0 is the initial marking; markings reflect the states of all components and the system simultaneously
(vii)
Λ=λ1,λ2,⋯,λm is the set of firing rates. The firing rate of the timed transition is the failure rate of the corresponding component, while the firing rate of the immediate transition is an infinite value that means the transition will be fired instantaneously


### 2.2. Enabled and Fired of Transitions

∀x∈P∪T, •x is called the preset of x and x• is called the postset of x such that
(1)•x=y∣y∈P∪T∩y,x∈F,x•=y∣y∈P∪T∩x,y∈F.A transitiont∈T is enabled if and only if
(2)∀p∈•t:Mp≥Wp,t,∀p∈t•−•t:Mp+Wt,p≤Kp,∀p∈t•∩•t:Mp+Wt,p−Wp,t≤Kp.Equation (2) illustrates the prerequisite of the component or system state changing.When a transition is enabled, it does not imply that it will be immediately fired. Among all the enabled transitions, only the transition that has the minimum firing time will be fired. If several transitions have identical minimum firing time, one of them will be selected randomly to be fired. After the transitiont is fired, the markings of the net will be changed according to the following rule:
(3)∀p∈P:M′p=Mp−Wp,t,p∈•t‐t•,Mp+Wp,t,p∈t•‐•t,Mp+Wt,p−Wp,t,p∈•t∩t•,Mp,otherwise.Equation (3) illustrates how the states will change after the transitions have been fired.


## 2.1. Definitions of the Stochastic Petri Net-Based Reliability Model

According to the definition of the stochastic Petri net [20, 21], the stochastic Petri net-based reliability model can be defined as a 7-tuple ∑=P,T,F,K,W,M0,Λ such that
(i)
P=p1,p2,⋯,pn is the set of places which are used to denote the states of components or systems
(ii)
T=t1,t2,⋯,tm is the set of transitions including timed transitions and immediate transitions; the timed transitions are used to denote the failure process of each component and the immediate transitions are used to denote the relationship among different states
(iii)
F⊆P×T∪T×P is the set of arcs which build the links between places and transitions
(iv)
K:P⟶1,2,3,⋯ is the capacity function which indicates the number of states for a specific component or system
(v)
W:F⟶1,2,3,⋯ is the weight function of arcs; the weights contain the imformation about how a transition can be fired and how the state can be changed after the transition has been fired
(vi)
M:P⟶0,1,2,⋯ is the marking of the net, ∀p∈P:Mp≤Kp, and M0 is the initial marking; markings reflect the states of all components and the system simultaneously
(vii)
Λ=λ1,λ2,⋯,λm is the set of firing rates. The firing rate of the timed transition is the failure rate of the corresponding component, while the firing rate of the immediate transition is an infinite value that means the transition will be fired instantaneously


## 2.2. Enabled and Fired of Transitions

∀x∈P∪T, •x is called the preset of x and x• is called the postset of x such that
(1)•x=y∣y∈P∪T∩y,x∈F,x•=y∣y∈P∪T∩x,y∈F.A transitiont∈T is enabled if and only if
(2)∀p∈•t:Mp≥Wp,t,∀p∈t•−•t:Mp+Wt,p≤Kp,∀p∈t•∩•t:Mp+Wt,p−Wp,t≤Kp.Equation (2) illustrates the prerequisite of the component or system state changing.When a transition is enabled, it does not imply that it will be immediately fired. Among all the enabled transitions, only the transition that has the minimum firing time will be fired. If several transitions have identical minimum firing time, one of them will be selected randomly to be fired. After the transitiont is fired, the markings of the net will be changed according to the following rule:
(3)∀p∈P:M′p=Mp−Wp,t,p∈•t‐t•,Mp+Wp,t,p∈t•‐•t,Mp+Wt,p−Wp,t,p∈•t∩t•,Mp,otherwise.Equation (3) illustrates how the states will change after the transitions have been fired.


## 3. Petri Net-Based Reliability Model of Typical Architectures for the Fly-By-Wire Systems

A fly-by-wire system usually consists of three subsystems, which are the sensor subsystem, the flight-control-computer subsystem, and the servo-control subsystem. The sensor subsystem usually has a majority architecture, such asm-out-of-n architecture, which means the subsystem will be failed at least m+1 of the total n sensors or transducers are failed. The flight-control-computer subsystem usually applies standby architecture, especially the warm standby or hot standby (parallel) architectures. Hence, the uninterruptible command calculation and monitoring can still be provided when part of the redundant channels in the computer is failed. The servo-controls usually have a load-sharing architecture. When one of the redundant actuators is failed, the failure rate of other actuators will increase. To the overall flight-control system, it can be treated as a series system composed of sensing units, flight-control computers, and servo-controls. In this section, the reliability models of all the abovementioned architectures will be presented based on the stochastic Petri net.


### 3.1. Petri Net-Based Reliability Model of Static Architectures

Failures of the static system are completely decided by the combinations of its component failures. The reliability model of a static system can be expressed by either a dependence diagram (RBD) with series, parallel, andm-out-of-n architectures, or a fault tree with AND, OR, and Voting gates.In this study, a unified Petri net-based reliability model is proposed to express all static architectures including the series, parallel (hot standby), andm-out-of-narchitectures. To a system composed of n components, the unified Petri net-based reliability model is shown in Figure 1.Figure 1
The model of the static architecture.In Figure1, the place Pk.upk=1,2,⋯,n denotes the operating state of the ith component, and their capacity functions are all equal to 1, namely,
(4)KPk.up=1.When there is a token inPk.up, the component k is in the operating state; otherwise, the component kis in the failed state. The place Ps.down denotes the failed state of the system, and its capacity function is decided by the system architecture. To the series architecture, the capacity function of Ps.down is equal to 1, and the system will be failed when there is one token in Ps.down. To the parallel architecture, the capacity function of Ps.down is equal to n, and the system will be failed when there are n tokens in Ps.down. To the m-out-of-n architecture, the capacity function of Ps.down is equal to n−m+1, and the system will be failed when there are n−m+1 tokens in Ps.down. The capacity function of the three types of static architectures can be expressed as follows:
(5)KPs.down=1,series,n,parallelhotstandby,n−m+1,m‐out‐of‐n:G.The timed transitionTki=1,2,⋯,n denotes the failure of the kth component, and its firing time equals the time to failure of the kth component.The weight of the arc originating fromPs.down is equal to n−m+1, and the weights of all other arcs are equal to 1.


### 3.2. Petri Net-Based Reliability Model of Standby Architectures

A standby system consists of an active component and one or more standby ones. A sensing and switching mechanism is used to detect failures of the active component and activate the standby ones immediately when a failure of the active one occurs. There are three types of standby architectures including hot standby, warm standby, and cold standby. The hot standby is just the parallel architecture, and the standby components have the same failure rate as if it was operating in the system. The standby component cannot fail in a cold standby system which is usually assumed for spare or shelf items, whereas the standby component has a lower hazard rate than the operating component in a warm standby system and this is usually a realistic assumption [22]. Additionally, the flight-control system does not have individual sensing and switching mechanisms, whose function will be fulfilled by the monitor module in each channel of the flight-control computers.The stochastic Petri net-based reliability model of a warm standby system composed ofn components is expressed by Figure 2.Figure 2
The model of the warm standby system.In Figure2, Pk.active, Pk.down, and Pk.standbyk=1,2,⋯,n denote the active state, the failed state, and the standby state of the kth component, respectively. Their capacity function is equal to 1. Hence,
(6)KPk.active=1,KPk.down=1,KPk.standby=1.When there is a token inPk.active, Pk.down, or Pk.standby, it means the component k is in the active, failed, or standby state, respectively. The place Ps.down denotes the failed state of the system, and its capacity function is equal to n, namely,
(7)KPs.down=n.The system will be failed when there aren tokens in Ps.down.The timed transitionTkk=1,2,⋯,n denotes the failure of the kth component in its active state, and its firing time is also equal to the time to failure of the kth component. The time transition Tk.standbyk=2,3,⋯,4 denotes the failure of the kth component in the standby state, and its firing time is equal to the time to failure of the kth component in the standby state. Transitions Ti1 to Tin are immediate transitions. Each Tik connects all Pl.downl<k by a dual-arrow arc, which means the failures of component 1 to component k−1 are the prerequisite to enable transition Tik, and place Pl.downl<k will still hold a token after Tik have been fired.The weight of the arc originating fromPs.down is equal to n, and the weights of all other arcs are equal to 1. The arcs connecting places Pk.down or Ps.down with transitions are bidirectional. It means the number of tokens in these places will not change after the pertinent transitions have been fired. As the state of a failed component or system will not change in the flight duration.The stochastic Petri net-based reliability model of a cold standby system composed ofncomponents is given in Figure 3, which is simplified based on Figure 2. In the cold standby system, the place Pn.down is just the place Ps.down.Figure 3
The model of the cold standby system.


### 3.3. Petri Net-Based Reliability of Load-Sharing Architectures

In a load-sharing architecture, there is a dependency between the components. If one component fails, the failure rate of the other components increases as the result of the additional load placed on it. The servo-control with a load-sharing architecture usually has two or three redundant components. The Petri net-based reliability model of a load-sharing architecture with three components can be expressed by Figure4.Figure 4
The model of a load-sharing architecture with three components.In Figure4, Pi.upi=1,2,3 denotes the operating state of the ith component when all the three components are operating. Pi′.upi=1,2,3 denotes the operating state of the ith component when one of the other two components is failed. Pi".upi=1,2,3 denotes the operating state of the ith component when the other two components are failed. And the capacity functions of Pi.up, Pi′.up, and Pi".up are equal to 1; we have
(8)KPi.up=1,KPi".up=1,KPi".up=1.Ps.down denotes the failed state of the load-sharing system. The load-sharing system will be failed if and only if all the three components are failed; therefore, there will be three tokens in Ps.down when the system is failed. The capacity function of Ps.down is equal to 3. Hence, we have
(9)KPs.down=3.Tii=1,2,3 denotes the failure of the ith component when all the three components are operating. Ti′i=1,2,3 denotes the failure of the ith component when one of the other two components is failed. Ti"i=1,2,3 denotes the failure of the ith component when the other two components are failed. The firing times of Ti, Ti′, and Ti" are equal to the time to failure of the ith component in the case that all the three components are operating, one of the other two components is failed, and the other two components are failed, respectively. Ti1 to Ti6 are all immediate transitions.The weight of the arc originating fromPs.down is equal to 3; the weights of the arcs between Ti2 and Ps.down, Ti4 and Ps.down, and Ti6 and Ps.down are all equal to 2; and the weights of all other arcs are equal to 1.To a load-sharing architecture with two components, the Petri net-based reliability model can be simplified. Figure5 illustrates the model of a load-sharing architecture with two components.Figure 5
The model of a load-sharing architecture with two components.


### 3.4. Petri Net-Based Hierarchical Reliability Model

Creating the Petri net-based reliability model of a large system can be a cumbersome task. A Petri net-based hierarchical reliability model is proposed to simplify the reliability modeling of large systems in this section, and the state space explosion problem can be avoided to some extent.In our model, a transition is used to represent an entire piece of net architecture or a branch of the Petri net. Such a transition is a substitution transition. Thus, a large Petri net can be simplified by replacing its small pieces of net or branches by substitution transitions. In this study, we use a square to denote the substitution transition. When the substitution transition is used to represent the pieces of net or branch architectures, two immediate transitions should be added. One is connected to thePs.down place, and the other is connected to the places that have tokens in the initial markings. Take the static architecture given in Figure 1 as an example; the corresponding piece of the net architecture represented by the substitution transitions is shown in Figure 6.Figure 6
The static architecture represented by the substitution transition.


## 3.1. Petri Net-Based Reliability Model of Static Architectures

Failures of the static system are completely decided by the combinations of its component failures. The reliability model of a static system can be expressed by either a dependence diagram (RBD) with series, parallel, andm-out-of-n architectures, or a fault tree with AND, OR, and Voting gates.In this study, a unified Petri net-based reliability model is proposed to express all static architectures including the series, parallel (hot standby), andm-out-of-narchitectures. To a system composed of n components, the unified Petri net-based reliability model is shown in Figure 1.Figure 1
The model of the static architecture.In Figure1, the place Pk.upk=1,2,⋯,n denotes the operating state of the ith component, and their capacity functions are all equal to 1, namely,
(4)KPk.up=1.When there is a token inPk.up, the component k is in the operating state; otherwise, the component kis in the failed state. The place Ps.down denotes the failed state of the system, and its capacity function is decided by the system architecture. To the series architecture, the capacity function of Ps.down is equal to 1, and the system will be failed when there is one token in Ps.down. To the parallel architecture, the capacity function of Ps.down is equal to n, and the system will be failed when there are n tokens in Ps.down. To the m-out-of-n architecture, the capacity function of Ps.down is equal to n−m+1, and the system will be failed when there are n−m+1 tokens in Ps.down. The capacity function of the three types of static architectures can be expressed as follows:
(5)KPs.down=1,series,n,parallelhotstandby,n−m+1,m‐out‐of‐n:G.The timed transitionTki=1,2,⋯,n denotes the failure of the kth component, and its firing time equals the time to failure of the kth component.The weight of the arc originating fromPs.down is equal to n−m+1, and the weights of all other arcs are equal to 1.


## 3.2. Petri Net-Based Reliability Model of Standby Architectures

A standby system consists of an active component and one or more standby ones. A sensing and switching mechanism is used to detect failures of the active component and activate the standby ones immediately when a failure of the active one occurs. There are three types of standby architectures including hot standby, warm standby, and cold standby. The hot standby is just the parallel architecture, and the standby components have the same failure rate as if it was operating in the system. The standby component cannot fail in a cold standby system which is usually assumed for spare or shelf items, whereas the standby component has a lower hazard rate than the operating component in a warm standby system and this is usually a realistic assumption [22]. Additionally, the flight-control system does not have individual sensing and switching mechanisms, whose function will be fulfilled by the monitor module in each channel of the flight-control computers.The stochastic Petri net-based reliability model of a warm standby system composed ofn components is expressed by Figure 2.Figure 2
The model of the warm standby system.In Figure2, Pk.active, Pk.down, and Pk.standbyk=1,2,⋯,n denote the active state, the failed state, and the standby state of the kth component, respectively. Their capacity function is equal to 1. Hence,
(6)KPk.active=1,KPk.down=1,KPk.standby=1.When there is a token inPk.active, Pk.down, or Pk.standby, it means the component k is in the active, failed, or standby state, respectively. The place Ps.down denotes the failed state of the system, and its capacity function is equal to n, namely,
(7)KPs.down=n.The system will be failed when there aren tokens in Ps.down.The timed transitionTkk=1,2,⋯,n denotes the failure of the kth component in its active state, and its firing time is also equal to the time to failure of the kth component. The time transition Tk.standbyk=2,3,⋯,4 denotes the failure of the kth component in the standby state, and its firing time is equal to the time to failure of the kth component in the standby state. Transitions Ti1 to Tin are immediate transitions. Each Tik connects all Pl.downl<k by a dual-arrow arc, which means the failures of component 1 to component k−1 are the prerequisite to enable transition Tik, and place Pl.downl<k will still hold a token after Tik have been fired.The weight of the arc originating fromPs.down is equal to n, and the weights of all other arcs are equal to 1. The arcs connecting places Pk.down or Ps.down with transitions are bidirectional. It means the number of tokens in these places will not change after the pertinent transitions have been fired. As the state of a failed component or system will not change in the flight duration.The stochastic Petri net-based reliability model of a cold standby system composed ofncomponents is given in Figure 3, which is simplified based on Figure 2. In the cold standby system, the place Pn.down is just the place Ps.down.Figure 3
The model of the cold standby system.


## 3.3. Petri Net-Based Reliability of Load-Sharing Architectures

In a load-sharing architecture, there is a dependency between the components. If one component fails, the failure rate of the other components increases as the result of the additional load placed on it. The servo-control with a load-sharing architecture usually has two or three redundant components. The Petri net-based reliability model of a load-sharing architecture with three components can be expressed by Figure4.Figure 4
The model of a load-sharing architecture with three components.In Figure4, Pi.upi=1,2,3 denotes the operating state of the ith component when all the three components are operating. Pi′.upi=1,2,3 denotes the operating state of the ith component when one of the other two components is failed. Pi".upi=1,2,3 denotes the operating state of the ith component when the other two components are failed. And the capacity functions of Pi.up, Pi′.up, and Pi".up are equal to 1; we have
(8)KPi.up=1,KPi".up=1,KPi".up=1.Ps.down denotes the failed state of the load-sharing system. The load-sharing system will be failed if and only if all the three components are failed; therefore, there will be three tokens in Ps.down when the system is failed. The capacity function of Ps.down is equal to 3. Hence, we have
(9)KPs.down=3.Tii=1,2,3 denotes the failure of the ith component when all the three components are operating. Ti′i=1,2,3 denotes the failure of the ith component when one of the other two components is failed. Ti"i=1,2,3 denotes the failure of the ith component when the other two components are failed. The firing times of Ti, Ti′, and Ti" are equal to the time to failure of the ith component in the case that all the three components are operating, one of the other two components is failed, and the other two components are failed, respectively. Ti1 to Ti6 are all immediate transitions.The weight of the arc originating fromPs.down is equal to 3; the weights of the arcs between Ti2 and Ps.down, Ti4 and Ps.down, and Ti6 and Ps.down are all equal to 2; and the weights of all other arcs are equal to 1.To a load-sharing architecture with two components, the Petri net-based reliability model can be simplified. Figure5 illustrates the model of a load-sharing architecture with two components.Figure 5
The model of a load-sharing architecture with two components.


## 3.4. Petri Net-Based Hierarchical Reliability Model

Creating the Petri net-based reliability model of a large system can be a cumbersome task. A Petri net-based hierarchical reliability model is proposed to simplify the reliability modeling of large systems in this section, and the state space explosion problem can be avoided to some extent.In our model, a transition is used to represent an entire piece of net architecture or a branch of the Petri net. Such a transition is a substitution transition. Thus, a large Petri net can be simplified by replacing its small pieces of net or branches by substitution transitions. In this study, we use a square to denote the substitution transition. When the substitution transition is used to represent the pieces of net or branch architectures, two immediate transitions should be added. One is connected to thePs.down place, and the other is connected to the places that have tokens in the initial markings. Take the static architecture given in Figure 1 as an example; the corresponding piece of the net architecture represented by the substitution transitions is shown in Figure 6.Figure 6
The static architecture represented by the substitution transition.


## 4. Stochastic Petri Net-Based Monte Carlo Simulation for Reliability Evaluation

A Monte Carlo simulation method is proposed for the stochastic Petri net-based reliability model, and the lifetime samples can be obtained via the Monte Carlo simulation. In this way, the reliability parameters can be calculated in terms of the lifetime samples.


### 4.1. Procedure of Stochastic Petri Net-Based Monte Carlo Simulation

The input of our Monte Carlo simulation procedure includes as follows:(1)
The input incidence matrixW−=Wpi,tj
(2)
The output incidence matrixW+=Wtj,pi
(3)
The initial markingM0
(4)
The capacity function of each placeK•
(5)
The set of firing rateΛ=λ1,λ2,⋯,λm or the firing time distribution of each transition
(6)
The maximum number of Monte Carlo simulationsNmaxThe flowchart of the Monte Carlo simulation procedure is given in Figure7. We can get one sample of the system lifetime from one simulation.Figure 7
The Monte Carlo simulation procedure of the stochastic Petri net.The detailed procedure of the Monte Carlo simulation is as follows.Step 1.
LetN=1 and start the Nth simulation.Step 2.
Variable initialization. LetMcurrent=M0, πcurrent=0, and πj=0 for all j j=1,2,⋯,m. Mcurrent is the current marking of the model, πcurrent is the current time, and πj is the firing time of the transition tj.Step 3.
Decide whether theNth simulation can terminate. The Nth simulation will terminate when MPs.down=KPs.down, namely, the number of tokens in Ps.down reaches the value of its capacity function. If MPs.down=KPs.down, the simulation will go to Step 10; otherwise, the simulation will go to Step 4.Step 4.
Determine the enabled transitions. A Boolean variableEj is used to denote whether the transition tj is enabled or not. When Ej equals 1, tj is enabled; otherwise, tj is not enabled. We let Ej=0 for all j=1,2,⋯,m. We can determine which transitions are enabled by Equation (2). If tj is enabled, let Ej=1.Step 5.
Update the firing time for all transitions. For each nonenabled transition (Ej=0), let its firing time equal 0 (πj=0). For each enabled transition (Ej=1), if its original firing time is 0 (πj=0), a random variable will be generated as its new firing time according to its firing rate λj; otherwise, its firing time will not be changed. Additionally, the random variable of the firing time that does not follow exponential distribution (the firing rate is not a constant value) will be generated in terms of their firing time distributions. And the random variable of the substitution transitions’ firing time can be obtained via the Monte Carlo simulation of the corresponding piece of net architecture.Step 6.
Determine the fired transition. Among all the enabled transitions, the transition that has the minimum firing time (πmin) will be fired. If several transitions have identical minimum firing time, we can select one of them randomly to be fired. A Boolean variable Fj is used to denote whether the transition tj is enabled or not. If Fj equals 1, tj is enabled; otherwise, tj is not enabled.Step 7.
Update the current time. The current timeπcurrent will be updated by πcurrent+πmin, i.e., let πcurrent=πcurrent+πmin.Step 8.
Update the firing time for all enabled transitions. The firing time of the enabled transitiontj (πj) will be updated by πj−πmin, i.e., let πj=πj−πmin.Step 9.
Update the markings. The markings will be updated by the state function of the Petri net, i.e., letM=M+C×F. The jth element of F is the Boolean variable Fj. And go back to Step 2.Step 10.
Obtain a sample of system lifetime. The current timeπcurrent will be a sample of the system lifetime.Step 11.
Decide whether all simulations have been finished. IfN=Nmax, it means all simulations have been finished, and the procedure will end; otherwise, we let N=N+1, and the next simulation will start (go back to Step 2).


### 4.2. Reliability Parameter Calculation Based on Lifetime Samples

Lets1,s2,⋯,sNmax denote the Nmax ordered lifetime samples, i.e., s1≤s2≤⋯≤sNmax; the estimate of reliability can be expressed as follows:
(10)R^si=Nmax−iNmax.In this way, we can get a corresponding reliability valueR^si for each lifetime sample si. By treating the Nmax pairs of si and R^si as training samples, we can get the regression curve of reliability function by using the backpropagation (BP) neural network. The method we used here is a kind of nonparametric regression; we do not make the assumption that the lifetime follows a specific distribution such as exponential distribution, lognormal distribution, or Weibull distribution. This is reasonable that the lifetime of a complex system may not follow a specific distribution.The BP neural network we used has three layers, which are the input layer, the hidden layer, and the output layer. Both the input layer and the output layer only have one unit (neuron); the input unit denotes the lifetime samplesi and the output unit denotes the corresponding estimate of reliability function R^si. The neural network we used is shown in Figure 8.Figure 8
The BP neural network structure used for reliability regression.According to the structure of the BP neural network, the reliability function can be expressed as follows:(11)Rt=11+exp−∑i=1nw2i/1+exp−w1it,where w1i and w2i are weights, and we can get the optimal values of weights by backpropagation algorithm.


## 4.1. Procedure of Stochastic Petri Net-Based Monte Carlo Simulation

The input of our Monte Carlo simulation procedure includes as follows:(1)
The input incidence matrixW−=Wpi,tj
(2)
The output incidence matrixW+=Wtj,pi
(3)
The initial markingM0
(4)
The capacity function of each placeK•
(5)
The set of firing rateΛ=λ1,λ2,⋯,λm or the firing time distribution of each transition
(6)
The maximum number of Monte Carlo simulationsNmaxThe flowchart of the Monte Carlo simulation procedure is given in Figure7. We can get one sample of the system lifetime from one simulation.Figure 7
The Monte Carlo simulation procedure of the stochastic Petri net.The detailed procedure of the Monte Carlo simulation is as follows.Step 1.
LetN=1 and start the Nth simulation.Step 2.
Variable initialization. LetMcurrent=M0, πcurrent=0, and πj=0 for all j j=1,2,⋯,m. Mcurrent is the current marking of the model, πcurrent is the current time, and πj is the firing time of the transition tj.Step 3.
Decide whether theNth simulation can terminate. The Nth simulation will terminate when MPs.down=KPs.down, namely, the number of tokens in Ps.down reaches the value of its capacity function. If MPs.down=KPs.down, the simulation will go to Step 10; otherwise, the simulation will go to Step 4.Step 4.
Determine the enabled transitions. A Boolean variableEj is used to denote whether the transition tj is enabled or not. When Ej equals 1, tj is enabled; otherwise, tj is not enabled. We let Ej=0 for all j=1,2,⋯,m. We can determine which transitions are enabled by Equation (2). If tj is enabled, let Ej=1.Step 5.
Update the firing time for all transitions. For each nonenabled transition (Ej=0), let its firing time equal 0 (πj=0). For each enabled transition (Ej=1), if its original firing time is 0 (πj=0), a random variable will be generated as its new firing time according to its firing rate λj; otherwise, its firing time will not be changed. Additionally, the random variable of the firing time that does not follow exponential distribution (the firing rate is not a constant value) will be generated in terms of their firing time distributions. And the random variable of the substitution transitions’ firing time can be obtained via the Monte Carlo simulation of the corresponding piece of net architecture.Step 6.
Determine the fired transition. Among all the enabled transitions, the transition that has the minimum firing time (πmin) will be fired. If several transitions have identical minimum firing time, we can select one of them randomly to be fired. A Boolean variable Fj is used to denote whether the transition tj is enabled or not. If Fj equals 1, tj is enabled; otherwise, tj is not enabled.Step 7.
Update the current time. The current timeπcurrent will be updated by πcurrent+πmin, i.e., let πcurrent=πcurrent+πmin.Step 8.
Update the firing time for all enabled transitions. The firing time of the enabled transitiontj (πj) will be updated by πj−πmin, i.e., let πj=πj−πmin.Step 9.
Update the markings. The markings will be updated by the state function of the Petri net, i.e., letM=M+C×F. The jth element of F is the Boolean variable Fj. And go back to Step 2.Step 10.
Obtain a sample of system lifetime. The current timeπcurrent will be a sample of the system lifetime.Step 11.
Decide whether all simulations have been finished. IfN=Nmax, it means all simulations have been finished, and the procedure will end; otherwise, we let N=N+1, and the next simulation will start (go back to Step 2).


## 4.2. Reliability Parameter Calculation Based on Lifetime Samples

Lets1,s2,⋯,sNmax denote the Nmax ordered lifetime samples, i.e., s1≤s2≤⋯≤sNmax; the estimate of reliability can be expressed as follows:
(10)R^si=Nmax−iNmax.In this way, we can get a corresponding reliability valueR^si for each lifetime sample si. By treating the Nmax pairs of si and R^si as training samples, we can get the regression curve of reliability function by using the backpropagation (BP) neural network. The method we used here is a kind of nonparametric regression; we do not make the assumption that the lifetime follows a specific distribution such as exponential distribution, lognormal distribution, or Weibull distribution. This is reasonable that the lifetime of a complex system may not follow a specific distribution.The BP neural network we used has three layers, which are the input layer, the hidden layer, and the output layer. Both the input layer and the output layer only have one unit (neuron); the input unit denotes the lifetime samplesi and the output unit denotes the corresponding estimate of reliability function R^si. The neural network we used is shown in Figure 8.Figure 8
The BP neural network structure used for reliability regression.According to the structure of the BP neural network, the reliability function can be expressed as follows:(11)Rt=11+exp−∑i=1nw2i/1+exp−w1it,where w1i and w2i are weights, and we can get the optimal values of weights by backpropagation algorithm.


## 5. Case Study

In the case study, a rudder control system of a commercial aircraft is used to illustrate the application and effectiveness of our proposed approach.


### 5.1. System Description

The rudder control system also consists of the sensor subsystem, the flight-control-computer subsystem, and the servo-control subsystem. Figure9 shows the architecture of the rudder control system.Figure 9
The architecture of the rudder control system.The sensor subsystem consists of the pedal position transducers, the inertial measurement units (IMUs), and the rudder position transducers. The pedal position transducer subsystem has a 2-out-of-4 architecture, and both the IMU subsystem and the rudder position transducer subsystem have a 2-out-of-3 architecture, namely, the triple modular redundancy (TMR).The flight-control-computer subsystem has three independent channels. Each channel has an input signal monitor, a set of control laws, and a cross-channel monitor. The three channels can become any one of these three channels: the command channel, the standby channel, and the monitor channel. The command channel transmits its command output signals to the servo-control subsystem. It also has a channel monitoring function to find and isolate failures in the standby and monitor channels. The standby channel transmits test data only, and it becomes the command channel and transmits its command output signals to the servo-control subsystem when a failure causes the command channel to shut down. It also performs monitoring functions to find and isolate failures in the command and monitor channels. The monitor channel also transmits test data only. Its command output signals are used internally to find failures in the command and standby channels. The monitor channel becomes the standby channel when the command channel shuts down. The reliability model of the flight-control-computer subsystem has the characteristics of both the standby and the 2-out-of-3 architectures. The command channel is the active state; both the standby and monitor channels are in the warm standby state. The subsystem will be failed if and only if at least two of the three channels are failed.The hydraulic actuation is achieved by the servo-control subsystem composed of two electrohydraulic servo-controls for the rudder. Each servo-control has two kinds of operation modes, which are the active mode (state) and the damping mode. Both the servo-controls are in the active mode initially, and they have identical failure rate in this situation. When one of the servo-controls is failed, the failed servo-control will be in the damping mode and the other one will be in the active mode. And the failure rate of the servo-control in the active mode will increase.


### 5.2. Petri Net-Based System Reliability Model

The Petri net-based reliability model of the pedal position transducer subsystem can be expressed as Figure10(a), and both the IMU subsystem and the rudder position transducer subsystem can be expressed as Figure 10(b).Figure 10
Petri net-based reliability model of the sensor subsystem.
(a)
(b)The Petri net-based reliability model of the flight-control-computer subsystem is shown in Figure11.Figure 11
Petri net-based reliability model of the flight-control-computer subsystem.The Petri net-based reliability model of the servo-control subsystem is shown in Figure12.Figure 12
Petri net-based reliability model of the servo-control subsystem.The Petri net-based reliability model of the rudder control system is given in Figure13.Figure 13
The Petri net-based reliability model of the rudder control system.In Figure13, the place P1.up to P5.up denote the operating state of the pedal position transducer subsystem, the IMU subsystem, the rudder position transducer subsystem, the flight-control-computer subsystem, and the servo-control subsystem, respectively. T1 to T5 are all substitution transitions which are used to denote the failure of the abovementioned subsystems.


### 5.3. Results and Discussion

The component failure rates of the rudder control system are given in Table1.Table 1
Component failure rates of the rudder control system.
Pedal position transducer
IMU
Rudder position transducer
Flight-control-computer channel
Servo-control
λP=10−6/h
λI=10−7/h
λR=10−7/h
λF=2×10−7/h
λS=10−6/h
λF−=0.6×10−7/h
λS+=1.5×10−6/hIn Table1, λP, λI, λR, λF, and λS are the failure rates in the active state of pedal position transducers, IMUs, rudder position transducers, flight-control-computer channels, and servo-controls, respectively. λF− is the failure rate of the flight-control-computer channels operating as the standby or monitor channels. λS+=1.5×10−6 is the increased failure rate the sever-control when the other one is failed. We let Nmax=1000, and 1000 lifetime samples of the system can be obtained. The reliability curve calculated by Equation (10) is shown in Figure 14. The analytical reliability function and the regression curve of the reliability function obtained by the BP neural network are also shown in Figure 13. The BP neural network used in this case study has ten neurons in the hidden layer.Figure 14
The reliability curves obtained by different methods.The analytical expression of the system reliability function can be expressed as follows:(12)Rt=RPtRItRRtRFtRSt,where RPt, RIt, RRt, RFt, and RSt are the reliability function of the pedal position transducer subsystem, the IMU subsystem, the rudder position transducer subsystem, the flight-control-computer subsystem, and the servo-control subsystem, respectively.RPt, RIt, and RRt can be calculated by RBD, and RFt and RSt can be calculated by the Markov process as all failure rates are constant values. They can be expressed as follows:
(13)RPt=∑i=24C4ie−λPti1−e−λPt4−i,RIt=∑i=23C3ie−λIti1−e−λIt3−i,RRt=∑i=23C3ie−λRti1−e−λRt3−i,RFt=λF+2λF−λF−e−λF+λF−t−λF+λF−λF−e−λF+2λF−t,RSt=e−2λSt+2λS2λS−λS+e−λS+t−e−2λSt,where Cnm is the combination formula which can be expressed as follows:
(14)Cnm=n!m!n−m!.Figure15 shows the error between the analytical reliability function and the regression reliability function. And the maximum value of the error is 0.0174 when the lifetime is 723154 hours.Figure 15
The error between the analytical function and the regression function.To the system of a civil aircraft, we usually care about the reliability in a flight duration which varies from a few hours to a dozen hours. We set the flight duration as 15 hours arbitrarily; the results obtained by both the analytical method and our Monte Carlo simulation-based regression method show that the reliability of the fly-by-wire system in a flight duration is greater than 99.99%.Figure16 shows the error between the analytical reliability function and the regression reliability function in the flight duration. The maximum error is 8.28×10−5 and the minimum error is 8.10×10−5 which illustrate that the error in a flight duration is negligible, although the error is greater than 0.01 in the whole life as shown in Figure 14.Figure 16
The error between the two methods in a flight duration.


## 5.1. System Description

The rudder control system also consists of the sensor subsystem, the flight-control-computer subsystem, and the servo-control subsystem. Figure9 shows the architecture of the rudder control system.Figure 9
The architecture of the rudder control system.The sensor subsystem consists of the pedal position transducers, the inertial measurement units (IMUs), and the rudder position transducers. The pedal position transducer subsystem has a 2-out-of-4 architecture, and both the IMU subsystem and the rudder position transducer subsystem have a 2-out-of-3 architecture, namely, the triple modular redundancy (TMR).The flight-control-computer subsystem has three independent channels. Each channel has an input signal monitor, a set of control laws, and a cross-channel monitor. The three channels can become any one of these three channels: the command channel, the standby channel, and the monitor channel. The command channel transmits its command output signals to the servo-control subsystem. It also has a channel monitoring function to find and isolate failures in the standby and monitor channels. The standby channel transmits test data only, and it becomes the command channel and transmits its command output signals to the servo-control subsystem when a failure causes the command channel to shut down. It also performs monitoring functions to find and isolate failures in the command and monitor channels. The monitor channel also transmits test data only. Its command output signals are used internally to find failures in the command and standby channels. The monitor channel becomes the standby channel when the command channel shuts down. The reliability model of the flight-control-computer subsystem has the characteristics of both the standby and the 2-out-of-3 architectures. The command channel is the active state; both the standby and monitor channels are in the warm standby state. The subsystem will be failed if and only if at least two of the three channels are failed.The hydraulic actuation is achieved by the servo-control subsystem composed of two electrohydraulic servo-controls for the rudder. Each servo-control has two kinds of operation modes, which are the active mode (state) and the damping mode. Both the servo-controls are in the active mode initially, and they have identical failure rate in this situation. When one of the servo-controls is failed, the failed servo-control will be in the damping mode and the other one will be in the active mode. And the failure rate of the servo-control in the active mode will increase.


## 5.2. Petri Net-Based System Reliability Model

The Petri net-based reliability model of the pedal position transducer subsystem can be expressed as Figure10(a), and both the IMU subsystem and the rudder position transducer subsystem can be expressed as Figure 10(b).Figure 10
Petri net-based reliability model of the sensor subsystem.
(a)
(b)The Petri net-based reliability model of the flight-control-computer subsystem is shown in Figure11.Figure 11
Petri net-based reliability model of the flight-control-computer subsystem.The Petri net-based reliability model of the servo-control subsystem is shown in Figure12.Figure 12
Petri net-based reliability model of the servo-control subsystem.The Petri net-based reliability model of the rudder control system is given in Figure13.Figure 13
The Petri net-based reliability model of the rudder control system.In Figure13, the place P1.up to P5.up denote the operating state of the pedal position transducer subsystem, the IMU subsystem, the rudder position transducer subsystem, the flight-control-computer subsystem, and the servo-control subsystem, respectively. T1 to T5 are all substitution transitions which are used to denote the failure of the abovementioned subsystems.


## 5.3. Results and Discussion

The component failure rates of the rudder control system are given in Table1.Table 1
Component failure rates of the rudder control system.
Pedal position transducer
IMU
Rudder position transducer
Flight-control-computer channel
Servo-control
λP=10−6/h
λI=10−7/h
λR=10−7/h
λF=2×10−7/h
λS=10−6/h
λF−=0.6×10−7/h
λS+=1.5×10−6/hIn Table1, λP, λI, λR, λF, and λS are the failure rates in the active state of pedal position transducers, IMUs, rudder position transducers, flight-control-computer channels, and servo-controls, respectively. λF− is the failure rate of the flight-control-computer channels operating as the standby or monitor channels. λS+=1.5×10−6 is the increased failure rate the sever-control when the other one is failed. We let Nmax=1000, and 1000 lifetime samples of the system can be obtained. The reliability curve calculated by Equation (10) is shown in Figure 14. The analytical reliability function and the regression curve of the reliability function obtained by the BP neural network are also shown in Figure 13. The BP neural network used in this case study has ten neurons in the hidden layer.Figure 14
The reliability curves obtained by different methods.The analytical expression of the system reliability function can be expressed as follows:(12)Rt=RPtRItRRtRFtRSt,where RPt, RIt, RRt, RFt, and RSt are the reliability function of the pedal position transducer subsystem, the IMU subsystem, the rudder position transducer subsystem, the flight-control-computer subsystem, and the servo-control subsystem, respectively.RPt, RIt, and RRt can be calculated by RBD, and RFt and RSt can be calculated by the Markov process as all failure rates are constant values. They can be expressed as follows:
(13)RPt=∑i=24C4ie−λPti1−e−λPt4−i,RIt=∑i=23C3ie−λIti1−e−λIt3−i,RRt=∑i=23C3ie−λRti1−e−λRt3−i,RFt=λF+2λF−λF−e−λF+λF−t−λF+λF−λF−e−λF+2λF−t,RSt=e−2λSt+2λS2λS−λS+e−λS+t−e−2λSt,where Cnm is the combination formula which can be expressed as follows:
(14)Cnm=n!m!n−m!.Figure15 shows the error between the analytical reliability function and the regression reliability function. And the maximum value of the error is 0.0174 when the lifetime is 723154 hours.Figure 15
The error between the analytical function and the regression function.To the system of a civil aircraft, we usually care about the reliability in a flight duration which varies from a few hours to a dozen hours. We set the flight duration as 15 hours arbitrarily; the results obtained by both the analytical method and our Monte Carlo simulation-based regression method show that the reliability of the fly-by-wire system in a flight duration is greater than 99.99%.Figure16 shows the error between the analytical reliability function and the regression reliability function in the flight duration. The maximum error is 8.28×10−5 and the minimum error is 8.10×10−5 which illustrate that the error in a flight duration is negligible, although the error is greater than 0.01 in the whole life as shown in Figure 14.Figure 16
The error between the two methods in a flight duration.


## 6. Conclusion

In this study, stochastic Petri net-based reliability models are established for series, parallel,m-out-of-n, warm standby, cold standby, and load-sharing architectures, which are commonly used in the fly-by-wire system. And a reliability evaluation approach is proposed by using Monte Carlo simulation in terms of the stochastic Petri net-based reliability models.Compared with the traditional reliability modeling tools such as RBD (DDA), FTA, and MA, our proposed approaches have the following advantages:(1)
The time-dependent failure characteristics can be expressed by stochastic Petri net-based reliability models, and the model can be simplified by using the substitution transitions to construct a hierarchical reliability model. In this way, the state space explosion of the Markov model can be reduced to some extent
(2)
Our stochastic Petri net-based Monte Carlo simulation is suitable for all kinds of lifetime distributions; the limits of the Markov model that all component lifetimes should follow exponential distributions can be overcome
(3)
By using our proposed Monte Carlo simulation method, the cumbersome work of solving the differential equations for the Markov chains can be avoided. Meanwhile, the error of the reliability value in a flight duration obtained by our simulation method is less than1×10−4 that is negligible



---

*Source: 2124836-2019-11-12.xml*