Reliability demonstration for complex redundant systems in railway applications

Transcription

1 WIT Press, ISBN Reliability demonstration for complex redundant systems in railway applications R. Bozzo\ V. Fazio*, P. Firpo^ S. Savio* ' Dipartimento di Ingegneria Elettrica - Universita di Genova (Italy) * Sciro s.r.l. - Genova (Italy) Abstract When high reliability requirements are set in the specification of complex, large and high investment demanding systems, the reliability demonstration, which the customer acceptance will be based on, can be a very critical task as the cumulative testing time available for the on-the-field reliability assessment is often not sufficient to ensure acceptable consumer and producer risks. In these circumstances, suitable reliability models, to be implemented and solved by means of appropriate software tools, are to be used in order to predict and assess the system reliability performances. In this paper the authors present a modelling procedure, based on Monte Carlo method, for simulating a long-term reliability test and able to fulfil the above requirements. The core of the simulation is a representation of the system behaviour, in the presence of failures, in the statespace where transitions are driven by the events generated by the Monte Carlo reliability model of the basic components. Introduction The RAM (Reliability, Availability and Maintainability) parameters are the most important elements that allow to estimate the Life Cycle Cost (LCC) of the system and to forecast performances during operating conditions. For this reason, when industrial systems, characterised by huge extension and complex functional structure, so requiring high investments, are commissioned, reliability requirements are usually set and the customer acceptance must be based on the demonstration of their fulfilment too. In this context, the demonstration may be a very critical task as the number of

2 WIT Press, ISBN Q4 Computers in Railways Vll installations commissioned is often relatively limited and the time available for the demonstration phase cannot be very long, compared to the system expected time to failure and life cycle duration. In the railway applications, for instance, where high reliability performances are usually needed and the number of items commissioned is low, the cumulative testing time available for assessing the reliability requirements fulfilment is insufficient to ensure an acceptable consumer and producer risk level. In these circumstances, given that reliability demonstration tests cannot guarantee the achievement of the required targets, suitable reliability models, to be implemented and solved by means of appropriate software tools, are to be used in order to predict and assess the system reliability performances. Ease of validation and implementation, general purpose characteristics (intended as ability to represent a wide range of situations) and availability of cheap, fast and portable tools are the features mostly desired for a good reliability model. In this paper the authors propose a new modelling procedure for simulating longterm tests, fully compliant with all the aforementioned characteristics. The procedure is based on the Monte Carlo method and it allows to simulate the system behaviour within its operative life by means of the state-space approach, where the transition from one state to another is driven by the components failure or repair events. The inputs of the model are the Mean Time To Failure (MTTF) and Mean Time To Repair (MTTR) of each basic component. Such RAM parameters can be assessed by on-the-field reliability demonstration test as, in this case, the number of samples is often great enough to achieve an effective estimation in a reasonable testing time. The system reliability parameters, as well as the relevant confidence limits, are calculated by statistical inference starting from the sample of the system times between failures collected during the simulation run on a wide time horizon. The whole model is implemented on a simple Excel sheet: it does not need any specific software engine, it allows to model systems characterised by arbitrarily distributed failure events of the basic components, thanks to the Monte Carlo simulation, and it does not set constraints on the redundancy configurations and maintenance policies, thanks to the space-state representation. At last, the description of the proposed procedure is supported by the example of an Electrical Substation (ESS) for railway systems: it represents a complex system where high reliability is achieved by means of parallel and stand-by redundancy configurations of single devices. Long-term tests simulation The reliability assessment is usually based on cumulative long-term tests: in these tests the behaviour of one or more equal items is observed during rated operating conditions for collecting information about the failure and repair events. So doing it is possible to retrieve the estimation of the interesting RAM parameters by statistical inference. At the end of the tests a decision about the acceptability of the system form the RAM point of view can be taken: the system can be rejected or can be accepted with an associated error likelihood. In

3 WIT Press, ISBN Computers in Railways VII particular, the likelihood to accept an item characterised by RAM performances lower than the required ones is called consumer risk and the likelihood to reject a good item is called producer risk. One of the best known standard methods for reliability demonstration of repairable systems [MIL ] defines a procedure based on producer (a) and consumer ((3) risks, once defined the upper (o) and lower (9i) boundaries on the Mean Time Between Failures (MTBF) to be demonstrated. This procedure refers to a fixed-length test plan where a decision is taken at the end of the testing time. Usually the duration of a reliability demonstration test is some times the specified lower MTBF and it increases when either the consumer risk or the producers risk decrease. Taking into account, for instance, an Electrical Substation for high speed railway applications, a reasonable value of MTBF could be about 3 hours. As shown in Table [O'Connor 6], even if a high consumer risk (%), a high producer risk (%) and a high design ratio (3) are chosen, the ratio between the cumulative duration of a fixed-length test Ttest and Oi is 4.3: if five items are commissioned, each sample will have to be tested for about 3 years. Decision risk (%) a Table - Acceptance criteria for fixed-length test plans P Design ratio (6/6) Test duration (T,est/6i) Acceptance (max no. of failures) Such a procedure results obviously unfeasible in these circumstances as the duration of the test is unacceptable for the customer. In order to solve the problem, the authors propose an innovative approach, based on the state-space analysis, for simulating long-term tests, once identified by Monte Carlo the occurrence of failure and repair events for each component. The procedure can be divided into four steps: > demonstration of the reliability and maintainability characteristics of the system components; > estimation of the Times To Failure (TTFs) and of the Times To Repair (TTRs) of the system components over a predefined time horizon, thanks to a simulation based on Monte Carlo method and developed through Excel ; > definition of the state-space model for analysing the behaviour of the system whenever a failure is occurred or a repair action is carried out, and implementation, on Excel sheets, of the logical relationships among components failure or repair events and the system current status; > estimation of the system TTFs and evaluation, after one or more tests, of the system RAM parameters, with associated confidence limits, by means of statistical inference methods [Wolstenholme 7]

4 WIT Press, ISBN Computers in Railways VII It is worth noting that, in order to utilise the proposed procedure, the failure events are supposed statistically independent, and the TTF and TTR distribution functions of the system components known.. Identification of basic component RAM characteristics In a complex system high reliability is usually achieved by means of redundant (parallel and stand-by) structures. It means that the reliability requirements for each basic component can be reasonably low when inserted in a redundant scheme, even if the overall system performance is very demanding. In this context, the required reliability level and the relatively wide population of basic components allow to carry out their RAM demonstration in a time acceptable for the customer. Therefore, the first step for modelling long-term tests consists of an observation of the system for a time necessary to assess the reliability of the basic components. At the end of the observation time it is possible, for any system component, to estimate its RAM features. If necessary, the test results can be combined with historical data available from the literature [IEEE,3], by means of Bayesan techniques, to improve the confidence in the measured values.. Estimation of basic component TTF and TTR by Monte Carlo The Time To Failure and the Time To Repair are random variables characterised by their relevant Probat ility Den v Functions (PDFs). The knowledge of such PDFs is mandatory for perforn ± the RAM analysis of the system, as the Cumulative Distribution Function (CDF) F(f) of a random variable can be computed starting from the relevant PDF/O as it follows: () being F(t^) the probability that the stochastic variable / is not greater than a given value / and assuming ^(, +). For each value of the random variable t in (, +) F(f) assumes a value in (, ); moreover F(t) is characterised by a uniform distribution. So, samples of the random variable t distributed according to F(t) can be obtained generating a random number in (, ) and inverting F(f). For instance, if the random variable t is exponentially distributed, the relevant can be expressed as: () where A, is a constant, and the Cumulative Distribution Function F(f) is:

5 WIT Press, ISBN Computers in Railways VII l-e"* (3) If the component TTF is characterised by such a distribution, the sample simulating the Time To Failure is obtained by solving the following equation: A (4) where A is the reciprocal of the component MTTF and F is, for any sample to be generated, a random number in (, ) get by Monte Carlo method [Gedam 4]. The aforementioned procedure can be easily implemented on an Excel spreadsheet using the Random function, that generates random numbers in (, ) following a uniform distribution function. For any component of the system, it will be necessary to repeat m times the procedure in order to collect a set of TTFs and a set of TTRs that will drive the state-space model simulating the system behaviour in the presence of basic components failures and repair actions..3 Definition of the state-space model The third step is the core of the long-term tests simulation and consists of the analysis of the RAM behaviour of the whole system by means of a state-space diagram. With such a modelling technique the effects of all the components failure and repair events on the system RAM performances can be evaluated. In particular, supposing the system in fully operating conditions, when a component /4 fails the following three basic events are possible: > the system continues to operate till another component (or more) fails before A is repaired; > the system cannot continue to operate and enters in a failed state till the failed component A is repaired; > the system continue to operate by means of a lay-out reconfiguration; the system remains in this new state till another component (or more) fails or the failed component A is repaired. Taking into account the aforementioned considerations, the state-space diagram of the system can be developed, where the transitions are driven by the failure or repair events of the basic components. The logical relationships among all these events and the current status of the system have to be implemented on Excel sheets, in order to evaluate the overall system RAM behaviour, once known the TTF and TTR data for each basic component, generated by the Monte Carlo based model previously shown. The Excel sheets are represented, in this case, by matrices which allow to correlate the operating or failed status of the system (taking into account, if present, possible reconfiguration actions too) with the status of all the system basic components.

6 WIT Press, ISBN Computers in Railways VII.4 Analysis of the test simulation results The simulation based on the state-space diagram allows to compute the number N of failures during the simulated time window as the number of times the system is entered the failed state. So, the system MTBF can be estimated as the total simulated time divided the number N of failures. The last step of the longterm test simulation is related to the analysis of the results in order to define: > the confidence level due to the extensive of the sample collected during the test simulation; > the influence of the confidence interval related to the RAM parameters of the basic components. The confidence level related to the sample size can be defined utilising the same procedure as in the long-term real test, while the influence of the confidence interval associated to the RAM parameters of the basic components can be estimated with repeated simulations. The real MTBF or MTTR of each basic component is normally distributed around the estimated MTBF or MTTR with a variance depending on the confidence interval. For this reason it is possible, with a procedure analogous to the one already shown for the TTF and TTR evaluation, to generate by Monte Carlo method a set of n values for the MTTF or MTTR of each basic component, starting from the relevant normal distribution. If n test simulations are run, each characterised by a different value of the MTTF and MTTR of the basic components, the influence of their confidence level can be analysed comparing the simulation results. 3 A case study The example analysed by the authors to show how the proposed methodology can be implemented in a real case is related to an Electrical Substation of an autotransformer supplied AC fed railway system, utilised, for instance, in France and Italy for High Speed tracks [Cosulich 5]. The analysis is limited to the high voltage section of the Electrical Substation, whose lay-out is shown in Figure. In this scheme HVC and HVC represent the high voltage connections, each including measurement equipment, an isolating switch and a breaker; HVBB and HVBB are the high voltage busbars sections, each made up of high voltage busbars and two isolating switches; HVIS - represents a couple of isolating switches which allow the reconfiguration between HVC and HVC in the case of a failure of a high voltage connection; Tl and T are the transformer groups, each including a single phase transformer equipped with a central tap secondary winding, measurement equipment and a breaker. In Table are reported the RAM characteristics of the basic components, whose failure and repair events are supposed exponentially distributed. In the following Table 3 it is shown, for the item T, the value of the Times to Failure and Times To Repair, automatically computed by Monte Carlo method.

7 WIT Press, ISBN Computers in Railways 7 5 kv 5 kv 99 Figure - ESS lay-out (high voltage section) Table - RAM Item HVC -HVC HVBB -HVBB Tl -T characteristics of the basic components MTTF [h] MTTR [h] Table 4 presents a part of the Excel matrix which describes the sequential occurrence of the failure and repair events of the basic components ( means faulted item and operating item). In the last column, a number S^ is associated to the i-th row; it identifies the system status and is computed as: 7= being n the number of the items considered and status of thej-th item in the i-th row. (5) the value associated to the

8 WIT Press, ISBN Computers in Railways VII Table 3 - TTF and TTR values for component T Failure # TTF [h] TTR [h] \ From IN To [h] Table 4 - Failure and repair events sequence Tl T HVBB HVBB HVC HVC System status It is worth noting that, in order to implement constraints related to a possible dependence of the failure and repair events for the basic components, logical relationships can be associated to each status of the system, so that the occurrence times of such events can be adjusted accordingly. At last in Table 5 the transitions matrix is presented: it is automatically computed by the program in order to define the number of transitions from one status to another status of the system.

9 WIT Press, ISBN Computers in Railways VII System status Table 5 - Transitions matrix The results of Table 5, related to a simulated testing time of h, show that, due to the RAM values of the basic components, whenever a failure is occurred, the repair action is carried out before the occurrence of a further failure. Moreover, if the mission profile of the system, for instance, requires that both Tl and T are able to feed the catenary, it is possible to compute the number of system failures by summing the transitions -> (Tl failure), -> (T failure), -»4 (HVBB failure), ->8 (HVBB failure), if the reconfiguration probability, due to HVIS-, is equal to. If the reconfiguration item is not supposed perfect, it is necessary to add also the transitions -»6 (HVC failure) and ->3 (HVC failure), weighted by the probability of a reconfiguration on-demand failure. 4 Conclusions For complex systems characterised by high reliability targets, the demonstration of the fulfilment of the RAM requirements, which is mandatory for the customer acceptance, can be a very critical task and often unfeasible with conventional testing procedures. For this reason, the authors have presented in this paper a modelling approach, based on Monte Carlo method, which allows the simulation of a long-term test in order to evaluate the behaviour of the system over a lap of time sufficient enough for demonstrating its reliability with the necessary confidence. The whole model is implemented on a simple Excel sheet: it does not need any specific software engine, it allows to model systems characterised by arbitrarily distributed failure events of the basic components, thanks to the Monte Carlo simulation, and it does not set constraints on the redundancy configurations and maintenance policies, thanks to the space-state representation of the system. Although developed for solving the problem of long-term tests, the modelling procedure can be profitably used in the design phase too for RAM verification and validation activities whenever other models, based for instance on Reliability Block Diagrams, Markov Chains or Petri Nets, are difficult to be solved or implemented.

10 WIT Press, ISBN Computers in Railways VII References []MIL-HDBK-78: Reliability Testing for Engineering Development, Qualification and Production, 996. [] IEEE Std. 493: Recommended Practice for the Design of Reliable Industrial and Commercial Power Systems, 99. [3] IEEE Std. 5: Guide to the collection and presentation of Electrical Electronic, Sensing Component and Mechanical Equipment Reliability Data for Nuclear-Power Generating Stations, 984. [4]Gedam S.G., Beaudet S.T.: Monte Carlo Simulation using Excel Spreadsheet for Predicting Reliability of a Complex System. IEEE Annual Reliability and Maintainability Symposium, Los Angeles, California, USA, 4-7 January. [5] Cosulich G, Firpo P., Savio S.: Electrical Substation Dependability Analysis for High speed Railway Systems: a simplified Approach. Fifth Int. Conf. COMPRAIL 96, Berlin, Germany, -3 August 996. [6] O'Connor P.: Practical Reliability Engineering, John Wiley & Sons, 995. [7] Wolstenholme L.C.: Reliability Modelling. A Statistical Approach, CHAPMAN & HALL/CRC, 999.