# Unavailability Analysis fork-out-of-n:G Systems with Multiple Failure Modes Based on Micro-Markov Models

Authors: Shengjin Tang; Xiaosong Guo; Xiaoyan Sun; Haijian Xue; Zhaofa Zhou
Journal: Mathematical Problems in Engineering
 (2014)

---

## Abstract

Markov models are commonly used for unavailability analysis of redundant systems. However, due to the exploding states of Markov models for redundant systems, the states need to be merged to simplify the computation, which is called micro-Markov models. However, how to derive the failure rates and repair rates of the newly developed micro-Markov models has not been studied thoroughly. Therefore, this paper proposes detailed explanations and rules to derive the static unavailability by the micro-Markov models for thek-out-of-n:G systems with multiple failure modes. Firstly, two properties about applying the Markov models to the repairable system with independent multiple failure modes are presented. Based on these two properties, two rules are proposed for implementing the micro-Markov models. The micro-Markov models provide the exact same results for the repairable k-out-of-n:G system with multiple independent failure modes and repair mechanisms and approximate results for systems with multiple hybrid failure modes. A case study of safety integrity verification for safety instrumented systems is provided to illustrate the application of the proposed method. The conceptual comparison and numerical examples demonstrate the reasonability and usefulness of the proposed micro-Markov models.


---

## Body

## 1. Introduction

Ak-out-of-n:G system (hereinafter referred to askoon system) is a redundant system where at least k out of n components (or channels) must be functional for the redundant system to be successful [1–3]. Due to the fault-tolerant ability of thekoon system, it has been widely used in process industry, oil and gas industry, nuclear industry, and so forth. Reliability analysis forkoon systems is a classic issue in reliability engineering. For thekoon system with a single failure mode, it is easy to derive the system reliability whether the system could be repaired immediately or not [4]. However, many systems have multiple failure modes [5–8], which increases the complexity of the reliability analysis. A typical system with multiple failure modes is the safety instrumented system (SIS), which has been widely used in the process industry as an important protection layer to prevent hazardous events or mitigate their consequences [3, 9–11]. Due to the self-diagnostic function of the SIS, the dangerous failure of the SIS can be divided into dangerous detected (DD) failure and dangerous undetected (DU) failure. The DD failure, which is detected by the self-diagnostic function, can be repaired immediately. However, the DU failure can only be detected and repaired in the proof test. As the static unavailability is an important value in the reliability analysis for safety systems [9–25], this paper focuses on the static unavailability evaluation forkoon systems with multiple failure modes.There are many modeling techniques for unavailability analysis ofkoon systems with multiple failure modes, for example, simplified equations [9–15], reliability block diagram (RBD) [16], fault tree analysis (FTA) [17, 18], and Markov analysis (MA) methods [19–21]. Rouvroye and Van den Bliek [22] compared these techniques and obtained the following conclusion: FTA and RBD are intuitive and easy to model; however, a new model has to be established for evaluating a new parameter by FTA and RBD. MA covers most aspects that affect reliability and can describe the dynamic transitions among different system states. Therefore, the MA method has been widely used in the unavailability analysis of complex systems [19–25]. However, the states of Markov models increase explosively as the system becomes more complex, and it is fallible and time-consuming to create Markov models manually. Knegtering and Brombacher [19] proposed micro-Markov models for quantitative safety assessment for SISs, where the RBD of the system is first developed and redefined, and then the micro-Markov models are established from the redefined RBD. However, how to derive the failure rates and repair rates of the newly developed micro-Markov models has not been presented in detail. Guo and Yang [21] presented an automatic Markov modeling method to reduce the burden of computation, where the states that have identical transition rates to common states are merged. However, the states with nonidentical transition rates have not been merged.Another issue about the micro-Markov models is to transform the nonrepairable failure into the repairable failure. If the failure modes are all nonrepairable, the system reliability can be addressed by the classical probability analysis methods, for example, RBD method [15]. Otherwise, if the failure modes are all repairable, Markov models could be used. However, many systems include repairable and nonrepairable failure modes simultaneously, which is called hybrid failure modes in this paper. Take the SIS for example; the DU failure can be regarded as the nonrepairable failure mode which is only repaired in the proof test, while the DD failure is repairable. For the hybrid failure modes, using the MA method directly could result in heavy computation to derive the analytical formulas of reliability since the system is trapped in the absorbing state of the nonrepairable failure.There are two main ways to solve this problem. The first way is regarding the repairable failure as a failure with static failure probability, and thus the system reliability can be analyzed by the FTA method [17]. However, it is complex to build the fault trees for highly redundant systems. The second way is transforming the nonrepairable failure as the repairable failure, which is called the approached MA method in [23, 24]. The approached MA method has already been applied to the low redundant system, for example, 1oo1 system, 1oo2 system, and 2oo3 system [20, 23–26], and the accuracy is satisfied. However, whether the approached MA method could be applied to the highly redundant system and how to derive the approached Markov models for a generalkoon system have not been presented in detail.From the above review of the related researches, it can be observed that there are two main issues remaining to be solved. The first is how to merge the states for thekoon systems with multiple failure modes, which is central to the micro-Markov models. The second is how to transform the nonrepairable failure as the repairable failure for the generalkoon system. In response to these two issues, a property about applying the Markov models to the repairable system with a single failure mode is first presented. Based on this property, we present a rule for transforming the nonrepairable failure to a repairable failure for the generalkoon system. This is the first contribution of this paper. Secondly, the states of thekoon system with multiple failure modes are merged, and thus thekoon system with multiple failure modes can be transformed to that with a single failure mode. A property regarding this transformation is proposed. This is the second contribution of this paper since the states can be merged reasonably. Then, two rules are proposed for implementing the micro-Markov models based on these two properties. Additionally, we present a case study about the safety integrity verification of the SIS and obtain the simplified equations. Finally, a conceptual comparison and a numerical example are presented to illustrate the application and usefulness of the proposed method.The remainder of this paper is organized as follows. Section2 introduces the associated acronyms, notations, and assumptions. Section 3 presents two properties about applying the Markov models to the repairable system and proposes the mechanism regarding how to merge the states for a generalkoon system. In Section 4, we apply the results obtained in Section 3 to a case study about the safety integrity verification for the SIS and provide a numerical example to illustrate the application and usefulness of the proposed method. Section 5 concludes the paper with a discussion.


## 2. Acronyms, Notations, and Assumptions

### 2.1. Acronyms

CCF: common cause failure
DD: dangerous detected failure
DU: dangerous undetected failure
FTA: fault tree analysis
koon:k-out-of-n:G system
MA: Markov analysis
RBD: reliability block diagram
SIL: safety integrity level
SIS: safety instrumented system.


### 2.2. Notations

C
n
k: number of combinations of size “k” from a set with “n” components
A
n
k: number of permutations of size “k” from a set with “n” components
DC
D: dangerous diagnostic coverage coefficient
F
(
t
): failure probability function,
MDT: mean down time
MRT: mean repair time
MTTR: mean time to restoration
P
j: the steady state probability of statej
PFD: probability of dangerous failure on demand
PFDavg: average probability of dangerous failure on demand
t
a: the mean time when the system failure due to the undetected failures occurs over the interval [0, T1]
t
d: the duration of time after system failure due to the undetected failures
T
1: proof test interval
λ
D: dangerous failure rate
λ
DD: dangerous detected failure rate
λ
DU: dangerous undetected failure rate
μ
DD: repair rate for dangerous detected failure
μ
j: the repair rate for akoon system from statej to state j-1
μ
j
′: the repair rate for akoon system from statej to state j-1 with considering the CCF
β: beta factor for DU failures
β
D: beta factor for DD failures.


### 2.3. Assumptions

(i)
All then components in akoon system are identical and independent.
(ii)
The failure modes in one component are identical with those in other components (i.e., with the same failure rates and repair rates).
(iii)
The failure modes in one component are independent of each other and independent of the failure modes in other components.
(iv)
The unrepairable failure mode can only be detected in a proof test (T1), and if detected it is repaired in the time of MRT (mean repair time).
(v)
The repairable failure mode can be detected and repaired immediately. If the repairable failure of a component is being repairing, the component is not functioning.


## 2.1. Acronyms

CCF: common cause failure
DD: dangerous detected failure
DU: dangerous undetected failure
FTA: fault tree analysis
koon:k-out-of-n:G system
MA: Markov analysis
RBD: reliability block diagram
SIL: safety integrity level
SIS: safety instrumented system.


## 2.2. Notations

C
n
k: number of combinations of size “k” from a set with “n” components
A
n
k: number of permutations of size “k” from a set with “n” components
DC
D: dangerous diagnostic coverage coefficient
F
(
t
): failure probability function,
MDT: mean down time
MRT: mean repair time
MTTR: mean time to restoration
P
j: the steady state probability of statej
PFD: probability of dangerous failure on demand
PFDavg: average probability of dangerous failure on demand
t
a: the mean time when the system failure due to the undetected failures occurs over the interval [0, T1]
t
d: the duration of time after system failure due to the undetected failures
T
1: proof test interval
λ
D: dangerous failure rate
λ
DD: dangerous detected failure rate
λ
DU: dangerous undetected failure rate
μ
DD: repair rate for dangerous detected failure
μ
j: the repair rate for akoon system from statej to state j-1
μ
j
′: the repair rate for akoon system from statej to state j-1 with considering the CCF
β: beta factor for DU failures
β
D: beta factor for DD failures.


## 2.3. Assumptions

(i)
All then components in akoon system are identical and independent.
(ii)
The failure modes in one component are identical with those in other components (i.e., with the same failure rates and repair rates).
(iii)
The failure modes in one component are independent of each other and independent of the failure modes in other components.
(iv)
The unrepairable failure mode can only be detected in a proof test (T1), and if detected it is repaired in the time of MRT (mean repair time).
(v)
The repairable failure mode can be detected and repaired immediately. If the repairable failure of a component is being repairing, the component is not functioning.


## 3. Modelingkoon Systems by the Micro-Markov Models

### 3.1. A Property of ModelingkoonSystems with a Single Repairable Failure Mode

In this subsection, we use the Markov models to model thekoon system with a single repairable failure mode and derive a property of the modeling process. The property is summarized in the following proposition. The proposition is based on the assumption that the failure of any component is independent of other components.Proposition 1.
For akoon system, letλ andμ be, respectively, the failure rate and repair rate of a single component and let μj be the repair rate from the state with j failed components to the state with (j-1) failed components as shown in Figure 1. (The repair rate from the state with j failed components to the state with (j-1) failed components is affected by the dependence of the repairs. If there are n repair crews existing, then μj=jμ. If only one repair crew exists, then μj=μ. To represent a general condition, we use μj to describe the failure rate.) Then the following holds.Figure 1
Markov states transition diagram for akoon system.(1)
The mean down time (MDT) of a 1oon system (
M
D
T
1
o
o
n
) is
1
/
μ
n
.
(2)
For any koon system,
μ
j
=
1
/
M
D
T
1
o
o
j
, where
M
D
T
1
o
o
j
represents the MDT of a 1ooj system.Proof.
For a 1oon system, the system fails only in state n and the MDT of the 1oon structure is 1/μn. For akoon system as shown in Figure 1, it can be observed that when the process enters state j with j faults, the repair team will start repairing and will bring the system to state j-1 after a mean repair time of 1/μj. As the j failure components are independent of the other n-j working components, the mean repair time from state j to state j-1 (1/μj) is equal to the MDT of a 1ooj system. This completes the proof.The second result of Proposition1 demonstrates the relationship between the repair rates and the MDTs of the 1-out-of-j systems. This relationship provides a reasonable way to transform the nonrepairable failure to the repairable failure or to combine the multiple failure modes to a single failure mode. Based on Proposition 1, we propose novel micro-Markov models in the following subsection.


### 3.2. Micro-Markov Models forkoon Systems with Multiple Repairable Failure Modes

As mentioned above, multiple failure modes exist widely in redundant systems. Therefore, it is necessary to combine the multiple failure modes to reduce the burden of computation. In the following, we first propose micro-Markov models forkoon systems with two repairable failure modes as illustrated in Proposition 2. The assumption of Proposition 2 is that the failure and repair of any component are independent of that of other components.Proposition 2.
For akoon system, each component has two failure modes with failure rates λ1 and λ2, and the repair rates of the two components are μ1 and μ2, respectively. The state unavailability of thekoon system with two failure modes equals a transformedkoon system with a single failure mode, whose failure rate and failure rate are λm=λ1+λ2 and μm=λmμ1μ2/(λ1μ2+λ2μ1), respectively. Moreover, the transformedkoon system has independent failure and repair rate.Proof.
As the derivation of Proposition2 changes due to the size of the system, we only give detailed derivation for a duplicate system for an illustrative purpose. The derivation for other systems, for example, one component system and triplicate system, is similar. The Markov states transition diagram for a duplicate system is shown in Figure 2.
From Figure2(a), we derive the transition matrix for the original duplicate system as follows:(1)M=[-2(λ1+λ2)2λ12λ2000μ1-λ1-λ2-μ10λ1λ20μ20-λ1-λ2-μ20λ1λ202μ10-2μ1000μ2μ10-μ1-μ20002μ200-2μ2].
Letpj(j=0,1,2,…,5) represent the steady state probability of state j for the original duplicate system; then, we have
(2)[p0p1⋯p5]M=[00⋯0],p0+p1+⋯+p5=1.
By solving the above equations, we have(3.2)p0=μ12μ22Q,p1=2μ1μ22λ1Q,p2=2μ12μ2λ2Q,p3=μ22λ12Q,p4=2μ1μ2λ1λ2Q,p5=μ12λ22Q,whereQ=(μ1μ2+μ1λ2+μ2λ1)2.
From Figure2(b), let Pj  (j=0,1,2) represent the steady state probability of state j for the transformed duplicate system; the following result can be obtained after some manipulations:
(4)P0=μm2(λm+μm)2,P1=2λmμm(λm+μm)2,P2=λm2(λm+μm)2.
Substitutingλm=λ1+λ2 and μm=λmμ1μ2/(λ1μ2+λ2μ1) into (4) yields
(5)P0=μ12μ22Q=p0,P1=2μ1μ2(μ1λ2+μ2λ1)Q=p1+p2,P2=(μ1λ2+μ2λ1)2Q=p3+p4+p5.
This completes the proof.Markov states transition diagram for a duplicate system. ((a) Original duplicate system with two failure modes; (b) transformed duplicate system with a single failure mode).
(a)
(b)Proposition2 is based on the result of Proposition 1. To transform the multiple failure modes to a single failure mode, the MDT of any 1-out-of-j system is calculated by adding the individual MDTs of the two failure modes, that is, 1/(jμ1) and 1/(jμ2), in direct proportion to each failure’s contribution to the failure probability of the system. Thus, we have
(6)MDT1ooj=λ1λmjμ1+λ2λmjμ2=1j(λ1λmμ1+λ2λmμ2)=1jMDT1oo1.Similar procedure to derive the system MDT has also been presented in Chapter  9.3 in [27]. Let 1/μm=λ1/λmμ1+λ2/λmμ2; that is, μm=λmμ1μ2/(λ1μ2+λ2μ1); the novelkoon system with a single failure mode can be derived.Proposition2 demonstrates how to transform thekoon system with two failure modes to that with a single failure mode. It can also be generalized to thekoon system with multiple failure modes, which is summarized in Proposition 3.Proposition 3.
For akoon system, each component has l failure modes with failure rates λ1,λ2,…,λl, and the repair rates of these l failure modes are μ1,μ2,…,μl. The state unavailability of thekoon system with multiple failure modes equals the transformedkoon system with a single failure mode, whose failure rate and the inverse of the failure rate are λm=∑i=1lλi and 1/μm=∑i=1lλi/λmμi, respectively. Moreover, the transformedkoon system has independent failure rates and repair rates.Proof.
Mathematical induction is used to prove Proposition3. From Proposition 2, it can be observed that thekoon system with two failure modes is equivalent to the transformed system with a single failure mode. Assume that thekoon system with l failure modes is equivalent to the transformed system with a single failure mode with failure rate λm=∑i=1lλi and repair rate, whose inverse is 1/μm=∑i=1lλi/λmμi. Therefore, thekoon system with l+1 failure modes can be transformed to the system with two failure modes. The failure rates of the two transformed modes are, respectively, λm and λl+1, and the repair rates are μm and μl+1. Based on Proposition 2, the two failure modes of the transformed system could continue to be combined, and thus the failure rate and repair rate of the final transformed system can be written as follows:
(7)λm′=λm+λl+1=∑i=1l+1λi,1μm′=λmλm′μm+λl+1λm′μl+1=∑i=1l+1λiλm′μi.
This completes the proof.Compared with Proposition1, Propositions 2 and 3, add an assumption that the repair rates are independent. In other words, Propositions 2 and 3 are correct on condition that there are n repair crews for akoon system. Although Propositions 2 and 3 may not be strictly correct when the repair rates are not independent, it provides a reasonable way to combine the multiple modes together.


### 3.3. The Rules of the Micro-Markov Models

Overall, from the above analysis of applying the Markov models tokoon systems with multiple failure modes, we obtain two rules of the micro-Markov modes.Rule 1.
For akoon system, the repair rate from the state with j failed components to the state with (j-1) failed components can be represented by the inverse of the MDT of the 1-out-of-j system.Rule 2.
For akoon system with l failure modes, it can be transformed to a novel system with a single failure mode. The failure rate and repair rate of the transformed system fit the following criteria:
(8)λm=∑i=1lλi,1μm=∑i=1lλiλmμi.Note that Rule1 is strictly correct for the repairable system and Rule 2 is strictly correct for the repairable system with multiple independent failure modes. However, whether these rules could derive satisfactory results for the system with nonrepairable failure modes or hybrid failure modes has not been demonstrated; we address this issue in the next section through a case study.


## 3.1. A Property of ModelingkoonSystems with a Single Repairable Failure Mode

In this subsection, we use the Markov models to model thekoon system with a single repairable failure mode and derive a property of the modeling process. The property is summarized in the following proposition. The proposition is based on the assumption that the failure of any component is independent of other components.Proposition 1.
For akoon system, letλ andμ be, respectively, the failure rate and repair rate of a single component and let μj be the repair rate from the state with j failed components to the state with (j-1) failed components as shown in Figure 1. (The repair rate from the state with j failed components to the state with (j-1) failed components is affected by the dependence of the repairs. If there are n repair crews existing, then μj=jμ. If only one repair crew exists, then μj=μ. To represent a general condition, we use μj to describe the failure rate.) Then the following holds.Figure 1
Markov states transition diagram for akoon system.(1)
The mean down time (MDT) of a 1oon system (
M
D
T
1
o
o
n
) is
1
/
μ
n
.
(2)
For any koon system,
μ
j
=
1
/
M
D
T
1
o
o
j
, where
M
D
T
1
o
o
j
represents the MDT of a 1ooj system.Proof.
For a 1oon system, the system fails only in state n and the MDT of the 1oon structure is 1/μn. For akoon system as shown in Figure 1, it can be observed that when the process enters state j with j faults, the repair team will start repairing and will bring the system to state j-1 after a mean repair time of 1/μj. As the j failure components are independent of the other n-j working components, the mean repair time from state j to state j-1 (1/μj) is equal to the MDT of a 1ooj system. This completes the proof.The second result of Proposition1 demonstrates the relationship between the repair rates and the MDTs of the 1-out-of-j systems. This relationship provides a reasonable way to transform the nonrepairable failure to the repairable failure or to combine the multiple failure modes to a single failure mode. Based on Proposition 1, we propose novel micro-Markov models in the following subsection.


## 3.2. Micro-Markov Models forkoon Systems with Multiple Repairable Failure Modes

As mentioned above, multiple failure modes exist widely in redundant systems. Therefore, it is necessary to combine the multiple failure modes to reduce the burden of computation. In the following, we first propose micro-Markov models forkoon systems with two repairable failure modes as illustrated in Proposition 2. The assumption of Proposition 2 is that the failure and repair of any component are independent of that of other components.Proposition 2.
For akoon system, each component has two failure modes with failure rates λ1 and λ2, and the repair rates of the two components are μ1 and μ2, respectively. The state unavailability of thekoon system with two failure modes equals a transformedkoon system with a single failure mode, whose failure rate and failure rate are λm=λ1+λ2 and μm=λmμ1μ2/(λ1μ2+λ2μ1), respectively. Moreover, the transformedkoon system has independent failure and repair rate.Proof.
As the derivation of Proposition2 changes due to the size of the system, we only give detailed derivation for a duplicate system for an illustrative purpose. The derivation for other systems, for example, one component system and triplicate system, is similar. The Markov states transition diagram for a duplicate system is shown in Figure 2.
From Figure2(a), we derive the transition matrix for the original duplicate system as follows:(1)M=[-2(λ1+λ2)2λ12λ2000μ1-λ1-λ2-μ10λ1λ20μ20-λ1-λ2-μ20λ1λ202μ10-2μ1000μ2μ10-μ1-μ20002μ200-2μ2].
Letpj(j=0,1,2,…,5) represent the steady state probability of state j for the original duplicate system; then, we have
(2)[p0p1⋯p5]M=[00⋯0],p0+p1+⋯+p5=1.
By solving the above equations, we have(3.2)p0=μ12μ22Q,p1=2μ1μ22λ1Q,p2=2μ12μ2λ2Q,p3=μ22λ12Q,p4=2μ1μ2λ1λ2Q,p5=μ12λ22Q,whereQ=(μ1μ2+μ1λ2+μ2λ1)2.
From Figure2(b), let Pj  (j=0,1,2) represent the steady state probability of state j for the transformed duplicate system; the following result can be obtained after some manipulations:
(4)P0=μm2(λm+μm)2,P1=2λmμm(λm+μm)2,P2=λm2(λm+μm)2.
Substitutingλm=λ1+λ2 and μm=λmμ1μ2/(λ1μ2+λ2μ1) into (4) yields
(5)P0=μ12μ22Q=p0,P1=2μ1μ2(μ1λ2+μ2λ1)Q=p1+p2,P2=(μ1λ2+μ2λ1)2Q=p3+p4+p5.
This completes the proof.Markov states transition diagram for a duplicate system. ((a) Original duplicate system with two failure modes; (b) transformed duplicate system with a single failure mode).
(a)
(b)Proposition2 is based on the result of Proposition 1. To transform the multiple failure modes to a single failure mode, the MDT of any 1-out-of-j system is calculated by adding the individual MDTs of the two failure modes, that is, 1/(jμ1) and 1/(jμ2), in direct proportion to each failure’s contribution to the failure probability of the system. Thus, we have
(6)MDT1ooj=λ1λmjμ1+λ2λmjμ2=1j(λ1λmμ1+λ2λmμ2)=1jMDT1oo1.Similar procedure to derive the system MDT has also been presented in Chapter  9.3 in [27]. Let 1/μm=λ1/λmμ1+λ2/λmμ2; that is, μm=λmμ1μ2/(λ1μ2+λ2μ1); the novelkoon system with a single failure mode can be derived.Proposition2 demonstrates how to transform thekoon system with two failure modes to that with a single failure mode. It can also be generalized to thekoon system with multiple failure modes, which is summarized in Proposition 3.Proposition 3.
For akoon system, each component has l failure modes with failure rates λ1,λ2,…,λl, and the repair rates of these l failure modes are μ1,μ2,…,μl. The state unavailability of thekoon system with multiple failure modes equals the transformedkoon system with a single failure mode, whose failure rate and the inverse of the failure rate are λm=∑i=1lλi and 1/μm=∑i=1lλi/λmμi, respectively. Moreover, the transformedkoon system has independent failure rates and repair rates.Proof.
Mathematical induction is used to prove Proposition3. From Proposition 2, it can be observed that thekoon system with two failure modes is equivalent to the transformed system with a single failure mode. Assume that thekoon system with l failure modes is equivalent to the transformed system with a single failure mode with failure rate λm=∑i=1lλi and repair rate, whose inverse is 1/μm=∑i=1lλi/λmμi. Therefore, thekoon system with l+1 failure modes can be transformed to the system with two failure modes. The failure rates of the two transformed modes are, respectively, λm and λl+1, and the repair rates are μm and μl+1. Based on Proposition 2, the two failure modes of the transformed system could continue to be combined, and thus the failure rate and repair rate of the final transformed system can be written as follows:
(7)λm′=λm+λl+1=∑i=1l+1λi,1μm′=λmλm′μm+λl+1λm′μl+1=∑i=1l+1λiλm′μi.
This completes the proof.Compared with Proposition1, Propositions 2 and 3, add an assumption that the repair rates are independent. In other words, Propositions 2 and 3 are correct on condition that there are n repair crews for akoon system. Although Propositions 2 and 3 may not be strictly correct when the repair rates are not independent, it provides a reasonable way to combine the multiple modes together.


## 3.3. The Rules of the Micro-Markov Models

Overall, from the above analysis of applying the Markov models tokoon systems with multiple failure modes, we obtain two rules of the micro-Markov modes.Rule 1.
For akoon system, the repair rate from the state with j failed components to the state with (j-1) failed components can be represented by the inverse of the MDT of the 1-out-of-j system.Rule 2.
For akoon system with l failure modes, it can be transformed to a novel system with a single failure mode. The failure rate and repair rate of the transformed system fit the following criteria:
(8)λm=∑i=1lλi,1μm=∑i=1lλiλmμi.Note that Rule1 is strictly correct for the repairable system and Rule 2 is strictly correct for the repairable system with multiple independent failure modes. However, whether these rules could derive satisfactory results for the system with nonrepairable failure modes or hybrid failure modes has not been demonstrated; we address this issue in the next section through a case study.


## 4. A Case Study

### 4.1. Safety Integrity Level Verification

Safety instrumented systems (SISs) are widely used in the process industry as an important protection layer to prevent hazardous events or mitigate their consequences. Safety integrity level (SIL) is proposed to measure how well a SIS performs its intended function by the safety standards: IEC 61508 and IEC 61511 [9, 10]. And SIL verification is to verify that whether the reliability of the SIS meets the required level. For the low demand mode of SIS operation, the SIL of a SIS is defined in terms of the average probability of failure on demand (PFDavg), which could be represented by the static unavailability of the system. The relation between the SIL and the PFDavg is shown in Table 1.Table 1
SIL for the low demand mode of operation.
SIL
PFDavg
4
≥10−5 to <10−4
3
≥10−4 to <10−3
2
≥10−3 to <10−2
1
≥10−2 to <10−1The PFDavg evaluation is concerned with the voting logic of the redundant systems, failure rates, diagnostic coverage, proof test interval, common cause failure (CCF), and some other factors [3]. Since the SIL verification is provided as a case study to validate the results of the micro-Markov models, we mainly consider the dangerous failure and its repair time. The dangerous failure with failure rate λD means the failure to perform the protective function when required. Due to the self-diagnostic function of SIS, the dangerous failure can be divided into DU failure and DD failure with the failure rates of  λDD and  λDU, respectively. Consider
(9)λD=λDU+λDD.Additionally, diagnostic coverage of dangerous failure (DCD), expressed as a percentage, is represented by the ratio of DD failure to the total dangerous failure.As discussed previously, the repair mechanisms of the DU failure and DD failure are different; thus it is difficult to derive the analytical PFDavg by using Markov models directly. Therefore, the simplification equations of PFDavg have been presented, for example, the typical simplified equations by IEC 61508. However, since IEC 61508 does not give detailed explanations of PFDavg calculations, which are difficult to understand for common safety engineers. Even in the IEC 61508 committee, the issues, how to calculate PFDavg and which models should be used, are controversial [4].In order to give detailed explanations to the simplified equations by IEC 61508, Zhang et al. [20] redefined the equivalent MDT of the undetected failure and derived the equivalent MDTs of 1oo1 and 1oo2 architectures. Then, the PFD value of a few typical architectures was calculated by the MA method. Guo and Yang [16] calculated the equivalent MDT by using the ratio of steady failure probability to the steady failure frequency and evaluated the PFD value for the most used architectures by the RBD method. However, these obtained results are different from the equations given by the IEC 61508 standard [9], which may confuse the safety engineers. Innal [23] explained the analytical formulas presented in the IEC 61508 by the approached Markov model. This paper attempts to solve this problem by the two rules of the micro-Markov models proposed in Section 2. The key issue of the micro-Markov models is to derive the repair rate of the states, which is handled in the next subsection.


### 4.2. Equivalent MDT

From Rule1, it can be observed that the repair rate is determined by the MDT of the 1oon system. As the DD failure is repairable, we first calculate the MDT of the DU failure, which is called equivalent MDT time for the SISs. It is assumed that the DU failure is only detected in the proof test with the interval of T1. The MDT is generated from the time of the DU failure to the proof test and the repair time, as shown in Figure 3. In the figure,t is the time when the DU failure occurs, MRT is the mean repair time if the DU failure is detected in the proof test,ta is the mean time when system failure due to the DU failures occurs over the interval [0, T1], and td is the duration of the down time.Figure 3
Failure process of the DU failure.Zhang et al. [20] gave a clear definition of the equivalent MDT for the DU failure and provided the result of the equivalent MDT for the 1oo1 system and 1oo2 system. However, it is not applicable to the case when the system size changes. Thus, we attempt to calculate the equivalent MDT for a common 1-out-of-n system.For a 1oon system, the cumulative distribution function for the DU failure is
(10)F(t)=(1-e-λDUt)n.Hence, the mean time when system failure due to the DU failures occurs over the interval [0,T1] (ta) can be formulated as
(11)ta=∫0T1tF′(t)dt∫0T1F′(t)dt=T1F(T1)-∫0T1F(t)dtF(T1)=T1-∫0T1(1-e-λDUt)ndt(1-e-λDUT1)n.Setu= λDUt andx = λDUT1; then we get
(12)ta=T1-T1∫0x(1-e-u)ndux(1-e-x)n=T1-T1∫0x(un+o(un))dux(xn+o(xn))=T1-T1(1/(n+1))xn+1+o(xn+1)xn+1+o(xn+1).Sincex = λDUT1≪ 1,ta can be approximately calculated as
(13)ta≈nn+1T1.From (13), it can be observed that the approximate value ofta is independent of  λDU.Referring to Figure3, the approximation of the equivalent MDT of DU failures for a 1-out-of-n system is
(14)MDT1oonDU=T1-ta+MRT≈1n+1T1+MRT.The DD failure is detected by the self-diagnostic function of SISs and can be repaired immediately in the time of MTTR, which denotes the mean time to restoration for the DD failure. It is assumed that the failure and repair rate of the DD failure are independent. Thus, from Proposition1, the MDT of DD failures for the 1-out-of-n system can be formulated as
(15)MDT1oonDD=MTTRn.Based on Rule2, the equivalent MDT of the combined two failure modes for the 1-out-of-n system (MDT1oon) can be calculated based on the law of total probability. It is composed of the MDT of the DU failure with a conditional probability  λDU/λD and the MDT of the DD failure with a conditional probability  λDD/λD. Then, we have
(16)MDT1oon=λDUλDMDT1oonDU+λDDλDMDT1oonDD=λDUλD(1n+1T1+MRT)+λDDλDMTTRn.After determining the component equivalent MDT for the 1-out-of-n system, the repair rate can be represented by the inverse of the equivalent MDT. Then, the PFDavg of thekoon system can be analyzed, as illustrated in the next subsection.


### 4.3. PFDavg Calculation by Micro-Markov Models

For thekoon system, the system fails when at least n-k+1 components fail. The micro-Markov state transition diagram could be represented by Figure 1. Let Pj (j=0,1,2,…,n) represent the steady state probability; from Figure 1, we derive the transition matrix as follows:(17)M=[-nλDnλD0μ1-μ1-(n-1)λD(n-1)λD⋱⋱⋱μn-k-μn-k-kλDkλD0μn-k+1-μn-k+1],where μj is inverse of MDT1ooj.LetPj  (j=0,1,2,…,n) represent the steady state probability of state j; then we have
(18)[P0P1⋯Pn-k+1]M=[00⋯0],P0+P1+⋯+Pn-k+1=1.By solving the above equations, we have(19)Pn-k+1=[1+∑j=0n-k(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDn-k+1-j]-1,Pj=(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDn-k+1-jPnforj<n-k+1.Then, the PFDkoon can be written as
(20)PFDkoon=Pn-k+1=1×(1+∑j=0n-k(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDn-k+1-j)-1.


### 4.4. PFDavg Calculation with Considering the CCF

Common cause failure (CCF) is a phenomenon which mitigates the effects of redundancy, and thus it often plays a dominating role for the unavailability of akoon system. CCF is a dependent failure when two or more redundant components fail simultaneously or within a short time interval, due to a shared cause. There are several models for quantification of CCF in SISs, such as β-factor model [9], multiple beta factor (MBF) [28, 29] model, and the PDS model [30]. The β-factor model, as suggested by IEC 61508, is the most popular CCF model due to its simplicity. The β-factor represents the fraction of the total failure rate that can cause all channels to fail. Therefore, the existence of CCF splits the DD failure and DU failure into independent failure parts and CCF parts, which can be, respectively, expressed as follows:
(21)λDU=(1-β)λDU+βλDU,λDD=(1-βD)λDD+βDλDD.If theβ-factor model is used to model CCF, the CCF part can be regarded as an independent part with the independent failures in the reliability block diagram of thekoon system and thus the CCF can be included as an add-on to the system unavailability. Then, the PFDkoon with CCF can be calculated as
(22)PFDkoonCCF≈1×(1+∑j=0n-k(k-1)!μj+1′μj+2′⋯μn-k+1′(n-j)!λD′n-k+1-j)-1+βλDU(T12+MRT)+βDλDDMTTR,
where λD′=(1-β)λDU+(1-βD)λDD and 1/μj′=((1-β)λDU/λD′)((1/(j+1))T1+MRT) + ((1-βD)λDD/λD′)(MTTR/j). The derived equations of PFDkoon in (20) and (22) can also be regarded as simplified equations for the SIL verification.


### 4.5. Conceptual Comparison

From the above derivation of the PFDkoon, it can be observed that there are two main steps of transforming the DU failure and DD failure into a single failure mode. The first is transforming the DU failure as a repairable failure. The second is combining the two failure modes to a single failure mode. In order to compare the results of the micro-Markov models with the actual results, we present a conceptual comparison in this subsection. As the unavailability equations of the CCF part are the same in different methods, we only compare the independent part of the unavailability. The numerical comparison of some typicalkoon systems is presented in the next subsection.Firstly, the results of transforming the DU failure into a repairable failure are compared with the actual results. For the DU failure, the exact results can be derived by the classic probability method, for example, the RBD method or the FTA method. To implement the comparison, the mean repair time ofλDU is assumed to be zero (i.e., MRT = 0) and the CCF is not considered (i.e.,  β = 0 and βD = 0). Then, we propose the following proposition.Proposition 4.
LetPFDkoonm and PFDkoonc represent thePFDavg calculated by the transformed Markov models and the classic probability method, respectively; then, the following holds on condition that λDUT1≪1:(1)
PFDkoonm≈Cnn-k+1(λDUT1)n-k+1/(n-k+2);(2)
PFDkoonm≈PFDkoonc.Proof.
LetPj (j=0,1,2,…,n) represent the steady state probability; from Figure 1 and (19), we can obtain that
(23)Pn-k+1=[1+∑j=0n-k(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDUn-k+1-j]-1,Pj=(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDUn-k+1-jPnforj<n-k+1,
where μj≈(n+1)/T1. Then, the PFDkoonm can be written as
(24)PFDkoonm=Pn-k+1=1×(1+∑j=0n-k(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDUn-k+1-j)-1.
For the SIS, it is generally known that(n+1)/T1≫λDU; thus μj/λDU≫1. Then, we have
(25)(k-1)!μ1μ2⋯μn-k+1n!λDUn-k+1≫1+∑j=1n-k(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDUn-k+1-j.
It follows that(26)PFDkoonm≈n!λDUn-k+1(k-1)!μ1μ2⋯μn-k+1=n!λDUn-k+1T1n-k+1(k-1)!(n-k+2)!=Cnn-k+1(λDUT1)n-k+1n-k+2.
Additionally, the exact results derived by the classic probability method could also be simplified as [27, 31]
(27)PFDkoonc≈Cnn-k+1(λDUT1)n-k+1n-k+2,
This completes the proof.Proposition4 indicates that when λDUT1≪1, the transformation of the nonrepairable failure to the repairable failure leads to satisfactory results. In the following, we demonstrate the effect of combining the DU failure and DD failure to a single failure mode. The comparison is made when only one type of failure exists. The results are summarized in Proposition 5.Proposition 5.
The results ofPFDkoon evaluated by the micro-Markov models when only one type of failure exists are consistent with the results by the classic probability when only one type of failure is considered.Proof.
For the SIS, it is generally known thatμj≫λD; thus the PFDkoon in (20) can be simplified as
(28)PFDkoon≈n!λDUn-k+1(k-1)!μ1μ2⋯μn-k+1=Ann-k+1∏j=1n-k+1[λDU(T1j+1+MRT)+λDDMTTRj].
IfλDD = 0 and MRT = 0, (28) can be simplified as
(29)PFDkoon≈Cnn-k+1(λDUT1)n-k+1n-k+2.
It is in accord with the results by the classic probability method when the DU failure is only considered; see (27).
IfλDU = 0, (28) can be simplified as
(30)PFDkoon≈Cnn-k+1(λDDMTTR)n-k+1.
It is consistent with the results by the classic probability method; see [31]. This completes the proof.From Proposition5, it can be observed that when only one type of failure exists, the results via the micro-Markov models are in accord with the results when only one type of failure is considered. We further compare the simplified equations through some typicalkoon systems when only one type of failure exists. The simplified equations are illustrated in Tables 2 and 3. The equations presented by [4] are deduced when only one type of failure is considered, which are also consistent with the equations presented by Smith [31] and Rausand and Høyland [27]. It can be observed that only the simplified equations derived in this paper are equal to the equations presented in [4].Table 2
Comparison of PFDavg equations only considering the DU failure.
System type
This paper
IEC equation
Reference [16]
Reference [20]
Reference [4]
1oo1
λ
DU
T
1
/
2
λ
DU
T
1
/
2
λ
DU
T
1
/
2
λ
DU
T
1
/
2
λ
DU
T
1
/
2
1oo2
(
λ
DU
T
1
)
2
/
3
(
λ
DU
T
1
)
2
/
3
(
λ
DU
T
1
)
2
/
9
(
λ
DU
T
1
)
2
/
4
(
λ
DU
T
1
)
2
/
3
2oo2
λ
DU
T
λ
DU
T
2
·
λ
DU
T
/
3
λ
DU
T
λ
DU
T
2oo3
(
λ
DU
T
1
)
2
(
λ
DU
T
1
)
2
(
λ
DU
T
1
)
2
/
3
3
(
λ
DU
T
1
)
2
/
4
(
λ
DU
T
1
)
2
1oo3
(
λ
DU
T
1
)
3
/
4
(
λ
DU
T
1
)
3
/
4
—a
—a
(
λ
DU
T
1
)
3
/
4
aThe PFD1oo3 equation is not given in [16, 20].Table 3
Comparison of PFDavg equations only considering the DD failure.
System type
This paper
IEC equation
Reference [16]
Reference [20]
Reference [4]
1oo1
λ
DD
MTTR
λ
DD
MTTR
λ
DD
MTTR
λ
DD
MTTR
λ
DD
MTTR
1oo2
(
λ
DD
MTTR
)
2
2
(
λ
DD
MTTR
)
2
(
λ
DD
MTTR
)
2
(
λ
DD
MTTR
)
2
(
λ
DD
MTTR
)
2
2oo2
2
λ
DD
MTTR
2
λ
DD
MTTR
2
λ
DD
MTTR
2
λ
DD
MTTR
2
λ
DD
MTTR
2oo3
3
(
λ
DD
MTTR
)
2
6
(
λ
DD
MTTR
)
2
3
(
λ
DD
MTTR
)
2
3
(
λ
DD
MTTR
)
2
3
(
λ
DD
MTTR
)
2
1oo3
(
λ
DD
MTTR
)
3
6
(
λ
DD
MTTR
)
3
—a
—a
(
λ
DD
MTTR
)
3
aThe PFD1oo3 equation is not given in [16, 20].The reason why different results are obtained by different references can be explained as follows. The equivalent MDT of a component or the group is an approximation. Different approximation assumptions could obtain different results. Take the 1oo2 system for instance; the group equivalent MDT is approximately equal to(λDU/λD)(T1/3+MRT)+(λDD/λD)(MTTR/2) (see (16)). However, the approximate results from IEC 61508 [16, 20] are (λDU/λD)(T1/3+MRT)+(λDD/λD)MTTR, (λDU/2λD)(T1/2+MRT)+(λDD/λD)(MTTR/2), and (λDU/2λD)(T1/3+MRT) + (λDD/λD)(MTTR/2), respectively. Therefore, the controversial results are obtained. However, regardless of approximation process, the results by combining the failure modes should be consistent with those when only one type of failure modes is considered. Thus, the group equivalent MDTs in these references have not been accurately approximated. This verifies the results via micro-Markov models to some extent.


### 4.6. Numerical Comparison

In this experiment, we compare the results by the micro-Markov models with some classic probability methods. Similar to the above subsection, the transformation of the DU failure to a repairable failure is first compared. For simplicity, the calculation of PFDavg by the classic probability method, the presented micro-Markov model in this paper (i.e., (20)), and the simplified equations presented by IEC 61508 are referred to as M0, M1, and M2, respectively. To compare these methods, the M0 is regarded as a basic method and the relative error is used to implement the comparison. The relative error expressed as a percentage is represented by the ratio of the difference between the result of M0 and M1 (or M2) to that of M0.We consider a triple system for an illustrative purpose. With different proof test intervals, the value ofλDUT1 changes from 0.033 to 0.263. The compared results are illustrated in Table 4, where RE1 and RE2 represent the relative error of M1 and M2, respectively. In Table 4, it can be observed that the relative error increases with the increase of the value of  λDUT1 for anykoon system and the relative error of M1 is always smaller than that of M2. This implies that M1 obtains more accuracy results than M2. When the value of λDUT1 is small (e.g., λDUT1 = 0.033), the relative error of M1 and M2 is able to meet the accuracy requirements. However, for the case that T1 = 4 years, that is, λDUT1 = 0.263, the relative error of M2 for 3oo3 system is −27.9%. In such circumstances, for M2, the methods which have more fundamental principles, for example, FTA or RBD method, should be used.Table 4
Comparison of PFDavg results by M0, M1, and M2.
λ
DU
=
7.5
E
-
0
6
/h, λDD=0, MRT = 0 h, 1 year = 8760 h, β=0
System type
T
1 (year)
M
0
M
1
M
2
RE1 (%)
RE2 (%)
1oo3
0.5
8.52
E
-
06
8.44
E
-
06
8.86
E
-
06
9.79
E
-
01
-
4.01
E
+
00
1
6.56
E
-
05
6.43
E
-
05
7.09
E
-
05
1.94
E
+
00
-
8.15
E
+
00
4
3.34
E
-
03
3.09
E
-
03
4.54
E
-
03
7.33
E
+
00
-
3.60
E
+
01
2oo3
0.5
1.04
E
-
03
1.03
E
-
03
1.08
E
-
03
8.21
E
-
01
-
4.17
E
+
00
1
3.98
E
-
03
3.91
E
-
03
4.32
E
-
03
1.64
E
+
00
-
8.48
E
+
00
4
5.03
E
-
02
4.72
E
-
02
6.91
E
-
02
6.17
E
+
00
-
3.73
E
+
01
3oo3
0.5
4.77
E
-
02
4.70
E
-
02
4.93
E
-
02
1.54
E
+
00
-
3.31
E
+
00
1
9.24
E
-
02
8.97
E
-
02
9.86
E
-
02
2.89
E
+
00
-
6.68
E
+
00
4
3.08
E
-
01
2.83
E
-
01
3.94
E
-
01
8.25
E
+
00
-
2.79
E
+
01In the following, we utilize the method presented in [17] as a basic method to perform the comparison, which has more fundamental principles for the SIS. The method presented in [17] assumes that the unavailability caused by the DD failure is a constant value denoted by q>0. However, the constant value is directly added to the instantaneous unavailability, which is an approximate value. Take the 1oo1 system for example; we have PFD(t)=q+1-e-λt. However, when t→∞, the unavailability equals PFD=q+1>1. This is not consistent with the assumption that the unavailability is less than or equal to 1. Thus, in this paper, we remedy this deficiency as follows. Essentially, the constant value q can be regarded as a static failure probability. Thus, the instantaneous unavailability can be represented as PFD(t)=1-(1-q)e-λt = 1-e-λt+qe-λt. This is consistent with the assumption. For simplicity, the method presented in [17] is referred to as M0′. Table 5 gives the compared results, where the value of DCD changes from 25% to 75%. It is shown that the relative error of M1 is always smaller than that of M2. And the maximum value of the relative error of M1 is 2.67%, which could satisfy the accuracy requirements. Overall, the presented method could obtain the desired results for the SIL verification and can be potentially applied to otherkoon systems.Table 5
Comparison of PFDavg results by M0, M1, and M2.
λ
D
=
1
E
-
0
5/h, T1=8760 h, MRT = 24 h, MTTR = 24 h, β=0, βD=0
System type
DC
D (%)
M
0
′
M
1
M
2
RE1 (%)
RE2 (%)
1oo3
25
6.63
E
-
05
6.61
E
-
05
7.33
E
-
05
2.91
E
-
01
-
1.05
E
+
01
50
2.03
E
-
05
2.04
E
-
05
2.21
E
-
05
-
5.14
E
-
01
-
8.60
E
+
00
75
2.66
E
-
06
2.71
E
-
06
2.89
E
-
06
-
1.63
E
+
00
-
8.64
E
+
00
2oo3
25
4.01
E
-
03
3.98
E
-
03
4.40
E
-
03
6.91
E
-
01
-
9.60
E
+
00
50
1.84
E
-
03
1.84
E
-
03
1.97
E
-
03
1.86
E
-
01
-
7.07
E
+
00
75
4.81
E
-
04
4.84
E
-
04
5.06
E
-
04
-
6.32
E
-
01
-
5.32
E
+
00
3oo3
25
9.28
E
-
02
9.03
E
-
02
9.93
E
-
02
2.67
E
+
00
-
6.99
E
+
00
50
6.34
E
-
02
6.23
E
-
02
6.64
E
-
02
1.79
E
+
00
-
4.74
E
+
00
75
3.27
E
-
02
3.25
E
-
02
3.36
E
-
02
8.23
E
-
01
-
2.51
E
+
00


## 4.1. Safety Integrity Level Verification

Safety instrumented systems (SISs) are widely used in the process industry as an important protection layer to prevent hazardous events or mitigate their consequences. Safety integrity level (SIL) is proposed to measure how well a SIS performs its intended function by the safety standards: IEC 61508 and IEC 61511 [9, 10]. And SIL verification is to verify that whether the reliability of the SIS meets the required level. For the low demand mode of SIS operation, the SIL of a SIS is defined in terms of the average probability of failure on demand (PFDavg), which could be represented by the static unavailability of the system. The relation between the SIL and the PFDavg is shown in Table 1.Table 1
SIL for the low demand mode of operation.
SIL
PFDavg
4
≥10−5 to <10−4
3
≥10−4 to <10−3
2
≥10−3 to <10−2
1
≥10−2 to <10−1The PFDavg evaluation is concerned with the voting logic of the redundant systems, failure rates, diagnostic coverage, proof test interval, common cause failure (CCF), and some other factors [3]. Since the SIL verification is provided as a case study to validate the results of the micro-Markov models, we mainly consider the dangerous failure and its repair time. The dangerous failure with failure rate λD means the failure to perform the protective function when required. Due to the self-diagnostic function of SIS, the dangerous failure can be divided into DU failure and DD failure with the failure rates of  λDD and  λDU, respectively. Consider
(9)λD=λDU+λDD.Additionally, diagnostic coverage of dangerous failure (DCD), expressed as a percentage, is represented by the ratio of DD failure to the total dangerous failure.As discussed previously, the repair mechanisms of the DU failure and DD failure are different; thus it is difficult to derive the analytical PFDavg by using Markov models directly. Therefore, the simplification equations of PFDavg have been presented, for example, the typical simplified equations by IEC 61508. However, since IEC 61508 does not give detailed explanations of PFDavg calculations, which are difficult to understand for common safety engineers. Even in the IEC 61508 committee, the issues, how to calculate PFDavg and which models should be used, are controversial [4].In order to give detailed explanations to the simplified equations by IEC 61508, Zhang et al. [20] redefined the equivalent MDT of the undetected failure and derived the equivalent MDTs of 1oo1 and 1oo2 architectures. Then, the PFD value of a few typical architectures was calculated by the MA method. Guo and Yang [16] calculated the equivalent MDT by using the ratio of steady failure probability to the steady failure frequency and evaluated the PFD value for the most used architectures by the RBD method. However, these obtained results are different from the equations given by the IEC 61508 standard [9], which may confuse the safety engineers. Innal [23] explained the analytical formulas presented in the IEC 61508 by the approached Markov model. This paper attempts to solve this problem by the two rules of the micro-Markov models proposed in Section 2. The key issue of the micro-Markov models is to derive the repair rate of the states, which is handled in the next subsection.


## 4.2. Equivalent MDT

From Rule1, it can be observed that the repair rate is determined by the MDT of the 1oon system. As the DD failure is repairable, we first calculate the MDT of the DU failure, which is called equivalent MDT time for the SISs. It is assumed that the DU failure is only detected in the proof test with the interval of T1. The MDT is generated from the time of the DU failure to the proof test and the repair time, as shown in Figure 3. In the figure,t is the time when the DU failure occurs, MRT is the mean repair time if the DU failure is detected in the proof test,ta is the mean time when system failure due to the DU failures occurs over the interval [0, T1], and td is the duration of the down time.Figure 3
Failure process of the DU failure.Zhang et al. [20] gave a clear definition of the equivalent MDT for the DU failure and provided the result of the equivalent MDT for the 1oo1 system and 1oo2 system. However, it is not applicable to the case when the system size changes. Thus, we attempt to calculate the equivalent MDT for a common 1-out-of-n system.For a 1oon system, the cumulative distribution function for the DU failure is
(10)F(t)=(1-e-λDUt)n.Hence, the mean time when system failure due to the DU failures occurs over the interval [0,T1] (ta) can be formulated as
(11)ta=∫0T1tF′(t)dt∫0T1F′(t)dt=T1F(T1)-∫0T1F(t)dtF(T1)=T1-∫0T1(1-e-λDUt)ndt(1-e-λDUT1)n.Setu= λDUt andx = λDUT1; then we get
(12)ta=T1-T1∫0x(1-e-u)ndux(1-e-x)n=T1-T1∫0x(un+o(un))dux(xn+o(xn))=T1-T1(1/(n+1))xn+1+o(xn+1)xn+1+o(xn+1).Sincex = λDUT1≪ 1,ta can be approximately calculated as
(13)ta≈nn+1T1.From (13), it can be observed that the approximate value ofta is independent of  λDU.Referring to Figure3, the approximation of the equivalent MDT of DU failures for a 1-out-of-n system is
(14)MDT1oonDU=T1-ta+MRT≈1n+1T1+MRT.The DD failure is detected by the self-diagnostic function of SISs and can be repaired immediately in the time of MTTR, which denotes the mean time to restoration for the DD failure. It is assumed that the failure and repair rate of the DD failure are independent. Thus, from Proposition1, the MDT of DD failures for the 1-out-of-n system can be formulated as
(15)MDT1oonDD=MTTRn.Based on Rule2, the equivalent MDT of the combined two failure modes for the 1-out-of-n system (MDT1oon) can be calculated based on the law of total probability. It is composed of the MDT of the DU failure with a conditional probability  λDU/λD and the MDT of the DD failure with a conditional probability  λDD/λD. Then, we have
(16)MDT1oon=λDUλDMDT1oonDU+λDDλDMDT1oonDD=λDUλD(1n+1T1+MRT)+λDDλDMTTRn.After determining the component equivalent MDT for the 1-out-of-n system, the repair rate can be represented by the inverse of the equivalent MDT. Then, the PFDavg of thekoon system can be analyzed, as illustrated in the next subsection.


## 4.3. PFDavg Calculation by Micro-Markov Models

For thekoon system, the system fails when at least n-k+1 components fail. The micro-Markov state transition diagram could be represented by Figure 1. Let Pj (j=0,1,2,…,n) represent the steady state probability; from Figure 1, we derive the transition matrix as follows:(17)M=[-nλDnλD0μ1-μ1-(n-1)λD(n-1)λD⋱⋱⋱μn-k-μn-k-kλDkλD0μn-k+1-μn-k+1],where μj is inverse of MDT1ooj.LetPj  (j=0,1,2,…,n) represent the steady state probability of state j; then we have
(18)[P0P1⋯Pn-k+1]M=[00⋯0],P0+P1+⋯+Pn-k+1=1.By solving the above equations, we have(19)Pn-k+1=[1+∑j=0n-k(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDn-k+1-j]-1,Pj=(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDn-k+1-jPnforj<n-k+1.Then, the PFDkoon can be written as
(20)PFDkoon=Pn-k+1=1×(1+∑j=0n-k(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDn-k+1-j)-1.


## 4.4. PFDavg Calculation with Considering the CCF

Common cause failure (CCF) is a phenomenon which mitigates the effects of redundancy, and thus it often plays a dominating role for the unavailability of akoon system. CCF is a dependent failure when two or more redundant components fail simultaneously or within a short time interval, due to a shared cause. There are several models for quantification of CCF in SISs, such as β-factor model [9], multiple beta factor (MBF) [28, 29] model, and the PDS model [30]. The β-factor model, as suggested by IEC 61508, is the most popular CCF model due to its simplicity. The β-factor represents the fraction of the total failure rate that can cause all channels to fail. Therefore, the existence of CCF splits the DD failure and DU failure into independent failure parts and CCF parts, which can be, respectively, expressed as follows:
(21)λDU=(1-β)λDU+βλDU,λDD=(1-βD)λDD+βDλDD.If theβ-factor model is used to model CCF, the CCF part can be regarded as an independent part with the independent failures in the reliability block diagram of thekoon system and thus the CCF can be included as an add-on to the system unavailability. Then, the PFDkoon with CCF can be calculated as
(22)PFDkoonCCF≈1×(1+∑j=0n-k(k-1)!μj+1′μj+2′⋯μn-k+1′(n-j)!λD′n-k+1-j)-1+βλDU(T12+MRT)+βDλDDMTTR,
where λD′=(1-β)λDU+(1-βD)λDD and 1/μj′=((1-β)λDU/λD′)((1/(j+1))T1+MRT) + ((1-βD)λDD/λD′)(MTTR/j). The derived equations of PFDkoon in (20) and (22) can also be regarded as simplified equations for the SIL verification.


## 4.5. Conceptual Comparison

From the above derivation of the PFDkoon, it can be observed that there are two main steps of transforming the DU failure and DD failure into a single failure mode. The first is transforming the DU failure as a repairable failure. The second is combining the two failure modes to a single failure mode. In order to compare the results of the micro-Markov models with the actual results, we present a conceptual comparison in this subsection. As the unavailability equations of the CCF part are the same in different methods, we only compare the independent part of the unavailability. The numerical comparison of some typicalkoon systems is presented in the next subsection.Firstly, the results of transforming the DU failure into a repairable failure are compared with the actual results. For the DU failure, the exact results can be derived by the classic probability method, for example, the RBD method or the FTA method. To implement the comparison, the mean repair time ofλDU is assumed to be zero (i.e., MRT = 0) and the CCF is not considered (i.e.,  β = 0 and βD = 0). Then, we propose the following proposition.Proposition 4.
LetPFDkoonm and PFDkoonc represent thePFDavg calculated by the transformed Markov models and the classic probability method, respectively; then, the following holds on condition that λDUT1≪1:(1)
PFDkoonm≈Cnn-k+1(λDUT1)n-k+1/(n-k+2);(2)
PFDkoonm≈PFDkoonc.Proof.
LetPj (j=0,1,2,…,n) represent the steady state probability; from Figure 1 and (19), we can obtain that
(23)Pn-k+1=[1+∑j=0n-k(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDUn-k+1-j]-1,Pj=(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDUn-k+1-jPnforj<n-k+1,
where μj≈(n+1)/T1. Then, the PFDkoonm can be written as
(24)PFDkoonm=Pn-k+1=1×(1+∑j=0n-k(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDUn-k+1-j)-1.
For the SIS, it is generally known that(n+1)/T1≫λDU; thus μj/λDU≫1. Then, we have
(25)(k-1)!μ1μ2⋯μn-k+1n!λDUn-k+1≫1+∑j=1n-k(k-1)!μj+1μj+2⋯μn-k+1(n-j)!λDUn-k+1-j.
It follows that(26)PFDkoonm≈n!λDUn-k+1(k-1)!μ1μ2⋯μn-k+1=n!λDUn-k+1T1n-k+1(k-1)!(n-k+2)!=Cnn-k+1(λDUT1)n-k+1n-k+2.
Additionally, the exact results derived by the classic probability method could also be simplified as [27, 31]
(27)PFDkoonc≈Cnn-k+1(λDUT1)n-k+1n-k+2,
This completes the proof.Proposition4 indicates that when λDUT1≪1, the transformation of the nonrepairable failure to the repairable failure leads to satisfactory results. In the following, we demonstrate the effect of combining the DU failure and DD failure to a single failure mode. The comparison is made when only one type of failure exists. The results are summarized in Proposition 5.Proposition 5.
The results ofPFDkoon evaluated by the micro-Markov models when only one type of failure exists are consistent with the results by the classic probability when only one type of failure is considered.Proof.
For the SIS, it is generally known thatμj≫λD; thus the PFDkoon in (20) can be simplified as
(28)PFDkoon≈n!λDUn-k+1(k-1)!μ1μ2⋯μn-k+1=Ann-k+1∏j=1n-k+1[λDU(T1j+1+MRT)+λDDMTTRj].
IfλDD = 0 and MRT = 0, (28) can be simplified as
(29)PFDkoon≈Cnn-k+1(λDUT1)n-k+1n-k+2.
It is in accord with the results by the classic probability method when the DU failure is only considered; see (27).
IfλDU = 0, (28) can be simplified as
(30)PFDkoon≈Cnn-k+1(λDDMTTR)n-k+1.
It is consistent with the results by the classic probability method; see [31]. This completes the proof.From Proposition5, it can be observed that when only one type of failure exists, the results via the micro-Markov models are in accord with the results when only one type of failure is considered. We further compare the simplified equations through some typicalkoon systems when only one type of failure exists. The simplified equations are illustrated in Tables 2 and 3. The equations presented by [4] are deduced when only one type of failure is considered, which are also consistent with the equations presented by Smith [31] and Rausand and Høyland [27]. It can be observed that only the simplified equations derived in this paper are equal to the equations presented in [4].Table 2
Comparison of PFDavg equations only considering the DU failure.
System type
This paper
IEC equation
Reference [16]
Reference [20]
Reference [4]
1oo1
λ
DU
T
1
/
2
λ
DU
T
1
/
2
λ
DU
T
1
/
2
λ
DU
T
1
/
2
λ
DU
T
1
/
2
1oo2
(
λ
DU
T
1
)
2
/
3
(
λ
DU
T
1
)
2
/
3
(
λ
DU
T
1
)
2
/
9
(
λ
DU
T
1
)
2
/
4
(
λ
DU
T
1
)
2
/
3
2oo2
λ
DU
T
λ
DU
T
2
·
λ
DU
T
/
3
λ
DU
T
λ
DU
T
2oo3
(
λ
DU
T
1
)
2
(
λ
DU
T
1
)
2
(
λ
DU
T
1
)
2
/
3
3
(
λ
DU
T
1
)
2
/
4
(
λ
DU
T
1
)
2
1oo3
(
λ
DU
T
1
)
3
/
4
(
λ
DU
T
1
)
3
/
4
—a
—a
(
λ
DU
T
1
)
3
/
4
aThe PFD1oo3 equation is not given in [16, 20].Table 3
Comparison of PFDavg equations only considering the DD failure.
System type
This paper
IEC equation
Reference [16]
Reference [20]
Reference [4]
1oo1
λ
DD
MTTR
λ
DD
MTTR
λ
DD
MTTR
λ
DD
MTTR
λ
DD
MTTR
1oo2
(
λ
DD
MTTR
)
2
2
(
λ
DD
MTTR
)
2
(
λ
DD
MTTR
)
2
(
λ
DD
MTTR
)
2
(
λ
DD
MTTR
)
2
2oo2
2
λ
DD
MTTR
2
λ
DD
MTTR
2
λ
DD
MTTR
2
λ
DD
MTTR
2
λ
DD
MTTR
2oo3
3
(
λ
DD
MTTR
)
2
6
(
λ
DD
MTTR
)
2
3
(
λ
DD
MTTR
)
2
3
(
λ
DD
MTTR
)
2
3
(
λ
DD
MTTR
)
2
1oo3
(
λ
DD
MTTR
)
3
6
(
λ
DD
MTTR
)
3
—a
—a
(
λ
DD
MTTR
)
3
aThe PFD1oo3 equation is not given in [16, 20].The reason why different results are obtained by different references can be explained as follows. The equivalent MDT of a component or the group is an approximation. Different approximation assumptions could obtain different results. Take the 1oo2 system for instance; the group equivalent MDT is approximately equal to(λDU/λD)(T1/3+MRT)+(λDD/λD)(MTTR/2) (see (16)). However, the approximate results from IEC 61508 [16, 20] are (λDU/λD)(T1/3+MRT)+(λDD/λD)MTTR, (λDU/2λD)(T1/2+MRT)+(λDD/λD)(MTTR/2), and (λDU/2λD)(T1/3+MRT) + (λDD/λD)(MTTR/2), respectively. Therefore, the controversial results are obtained. However, regardless of approximation process, the results by combining the failure modes should be consistent with those when only one type of failure modes is considered. Thus, the group equivalent MDTs in these references have not been accurately approximated. This verifies the results via micro-Markov models to some extent.


## 4.6. Numerical Comparison

In this experiment, we compare the results by the micro-Markov models with some classic probability methods. Similar to the above subsection, the transformation of the DU failure to a repairable failure is first compared. For simplicity, the calculation of PFDavg by the classic probability method, the presented micro-Markov model in this paper (i.e., (20)), and the simplified equations presented by IEC 61508 are referred to as M0, M1, and M2, respectively. To compare these methods, the M0 is regarded as a basic method and the relative error is used to implement the comparison. The relative error expressed as a percentage is represented by the ratio of the difference between the result of M0 and M1 (or M2) to that of M0.We consider a triple system for an illustrative purpose. With different proof test intervals, the value ofλDUT1 changes from 0.033 to 0.263. The compared results are illustrated in Table 4, where RE1 and RE2 represent the relative error of M1 and M2, respectively. In Table 4, it can be observed that the relative error increases with the increase of the value of  λDUT1 for anykoon system and the relative error of M1 is always smaller than that of M2. This implies that M1 obtains more accuracy results than M2. When the value of λDUT1 is small (e.g., λDUT1 = 0.033), the relative error of M1 and M2 is able to meet the accuracy requirements. However, for the case that T1 = 4 years, that is, λDUT1 = 0.263, the relative error of M2 for 3oo3 system is −27.9%. In such circumstances, for M2, the methods which have more fundamental principles, for example, FTA or RBD method, should be used.Table 4
Comparison of PFDavg results by M0, M1, and M2.
λ
DU
=
7.5
E
-
0
6
/h, λDD=0, MRT = 0 h, 1 year = 8760 h, β=0
System type
T
1 (year)
M
0
M
1
M
2
RE1 (%)
RE2 (%)
1oo3
0.5
8.52
E
-
06
8.44
E
-
06
8.86
E
-
06
9.79
E
-
01
-
4.01
E
+
00
1
6.56
E
-
05
6.43
E
-
05
7.09
E
-
05
1.94
E
+
00
-
8.15
E
+
00
4
3.34
E
-
03
3.09
E
-
03
4.54
E
-
03
7.33
E
+
00
-
3.60
E
+
01
2oo3
0.5
1.04
E
-
03
1.03
E
-
03
1.08
E
-
03
8.21
E
-
01
-
4.17
E
+
00
1
3.98
E
-
03
3.91
E
-
03
4.32
E
-
03
1.64
E
+
00
-
8.48
E
+
00
4
5.03
E
-
02
4.72
E
-
02
6.91
E
-
02
6.17
E
+
00
-
3.73
E
+
01
3oo3
0.5
4.77
E
-
02
4.70
E
-
02
4.93
E
-
02
1.54
E
+
00
-
3.31
E
+
00
1
9.24
E
-
02
8.97
E
-
02
9.86
E
-
02
2.89
E
+
00
-
6.68
E
+
00
4
3.08
E
-
01
2.83
E
-
01
3.94
E
-
01
8.25
E
+
00
-
2.79
E
+
01In the following, we utilize the method presented in [17] as a basic method to perform the comparison, which has more fundamental principles for the SIS. The method presented in [17] assumes that the unavailability caused by the DD failure is a constant value denoted by q>0. However, the constant value is directly added to the instantaneous unavailability, which is an approximate value. Take the 1oo1 system for example; we have PFD(t)=q+1-e-λt. However, when t→∞, the unavailability equals PFD=q+1>1. This is not consistent with the assumption that the unavailability is less than or equal to 1. Thus, in this paper, we remedy this deficiency as follows. Essentially, the constant value q can be regarded as a static failure probability. Thus, the instantaneous unavailability can be represented as PFD(t)=1-(1-q)e-λt = 1-e-λt+qe-λt. This is consistent with the assumption. For simplicity, the method presented in [17] is referred to as M0′. Table 5 gives the compared results, where the value of DCD changes from 25% to 75%. It is shown that the relative error of M1 is always smaller than that of M2. And the maximum value of the relative error of M1 is 2.67%, which could satisfy the accuracy requirements. Overall, the presented method could obtain the desired results for the SIL verification and can be potentially applied to otherkoon systems.Table 5
Comparison of PFDavg results by M0, M1, and M2.
λ
D
=
1
E
-
0
5/h, T1=8760 h, MRT = 24 h, MTTR = 24 h, β=0, βD=0
System type
DC
D (%)
M
0
′
M
1
M
2
RE1 (%)
RE2 (%)
1oo3
25
6.63
E
-
05
6.61
E
-
05
7.33
E
-
05
2.91
E
-
01
-
1.05
E
+
01
50
2.03
E
-
05
2.04
E
-
05
2.21
E
-
05
-
5.14
E
-
01
-
8.60
E
+
00
75
2.66
E
-
06
2.71
E
-
06
2.89
E
-
06
-
1.63
E
+
00
-
8.64
E
+
00
2oo3
25
4.01
E
-
03
3.98
E
-
03
4.40
E
-
03
6.91
E
-
01
-
9.60
E
+
00
50
1.84
E
-
03
1.84
E
-
03
1.97
E
-
03
1.86
E
-
01
-
7.07
E
+
00
75
4.81
E
-
04
4.84
E
-
04
5.06
E
-
04
-
6.32
E
-
01
-
5.32
E
+
00
3oo3
25
9.28
E
-
02
9.03
E
-
02
9.93
E
-
02
2.67
E
+
00
-
6.99
E
+
00
50
6.34
E
-
02
6.23
E
-
02
6.64
E
-
02
1.79
E
+
00
-
4.74
E
+
00
75
3.27
E
-
02
3.25
E
-
02
3.36
E
-
02
8.23
E
-
01
-
2.51
E
+
00


## 5. Concluding Remarks

This paper proposes micro-Markov models for the reliability analysis ofkoon systems with multiple failure modes. Two rules are proposed to implement the micro-Markov models. For the repairablekoon systems with multiple independent failures and repairs, the micro-Markov models could derive the same results with the basic Markov models. For thekoon systems with hybrid failure modes, approximated and satisfied results could be obtained by the micro-Markov models. A case study regarding the SIL verification for the SIS indicates that when only one type of failure modes exists, the results derived by the micro-Markov models are consistent with the results by the classic probability method when only one type of failure modes is considered. When the DU failure and the DD failure both exist, the results are approximately equal to the results by the methods with more fundamental principles. Additionally, simplified equations are presented for the SIL verification. In summary, the micro-Markov models can be applied to thekoon systems with multiple failure modes.In this paper, we mainly discuss how to develop the micro-Markov models for thekoon systems with multiple failure modes. However, we only use the simple beta factor model to model CCF, which could not distinguish between differentkoon systems. To improve the accuracy of modeling CCF, more advanced CCF models (e.g., the MBF model) should be used, and how to use the micro-Markov models with the MBF model needs to be further exploited. Additionally, as thekoon system normally works in a finite time zone, it obtains a pessimistic evaluation by using the static unavailability of the repairable failure to represent the average unavailability in the finite time zone. To derive a better evaluation in a finite time zone, the time independent Markov method should be used. However, for thekoon system with multiple failure modes, especially for the system with hybrid failure modes, it is different to obtain the exact and closed form solution of the system unavailability. This may encourage the research that is reducing the computation complexity of the time-independent unavailability forkoon systems.



---

*Source: 740936-2014-04-24.xml*