Equations which define the reliability of n-fold parallel systems with stand-by spares, and triply redundant, majority-voting systems with stand-by spares have been derived. The stand-by spares have been assumed to have a non-zero failure rate while in the stand-by mode. A Monte Carlo system simulation has been generated and the results compared to the theoretical reliability predictions. A comparison of these two stand-by configurations is also presented for three through six total units

Taylor, D. S.

Weatherbee, J. E.

Williams, T. G.

English

NASA Technical Reports Server

NASA CONTRACTOR
REPORT
NASA CR-61372
C A Q E F S!_f^ y? jisssa 1 I ISM
COPY
A SYSTEM RELIABILITY ANALYSIS FOR
STAND-BY SPARES WITH NON-ZERO
UNPOWERED FAILURE RATES
By D. S. Taylor, J. E. Weatherbee,
and T. Williams
Computer Sciences Corporation
Field Service Division
Aerospace Systems Center
8300 S. Whitesburg Drive
Huntsville, Alabama 35802
December 1971
Prepared for
NASA-GEORGE C. MARSHALL SPACE FLIGHT CENTER
Marshall Space Flight Center, Alabama 35812
https://ntrs.nasa.gov/search.jsp?R=19720011894 2020-03-11T19:03:32+00:00Z
TECHNICAL REPORT STANDARD TITLE PAGE
\. REPORT NO.
NASA CR-61372
2. GOVERNMENT ACCESSION NO. 3. RECIPIENT'S CATALOG NO.
4. TITLE AND SUBTITLE
A System Reliability Analysis for Stand-by Spares with
Non-Zero Unpowered Failure Rates
5. REPORT DATE
December 1971
6. PERFORMING ORGANIZATION CODE
7. AUTHOR (S)
D. S. Taylor, J. E. Weatherbee, and T. Williams
8. PERFORMING ORGANIZATION REPORT #
9. PERFORMING ORGANIZATION NAME AND ADDRESS
Computer Sciences Corporation
Field Services Division, Aerospace Systems Center
8300 S. Whitesburg Drive
Huntsville. Alabama 35802 .__
10. WORK UNIT NO.
11. CONTRACT OR GRANT NO.
NAS8-21805
12. SPONSORING AGENCY NAME AND ADDRESS
National Aeronautics and Space Administration
Washington, D. C. 20546
13. TYPE OF REPORT ft PERIOD COVERED
Contractor Report
14. SPONSORING AGENCY CODE
15. SUPPLEMENTARY NOTES
16. ABSTRACT
Equations which define the reliability of n-fold parallel systems with stand-by spares,
and triply redundant, majority-voting systems with stand-by spares have been derived.
The stand-by spares have been assumed to have a non-zero failure rate while in the
stand-by mode. A Monte Carlo system simulation has been generated and the results
compared to the theoretical reliability predictions. A comparison of these two
stand-by configurations is also presented for three (3) through six (6) total units.
17. KEY WORDS
Reliability
Probability
Stand-by Spares
18. DIS;rlJIBU/TION.,STATEMENT
<•/
B. -'
Computer Systems Division
MSFC/Computation Laboratory
Unclassified-unlimited
19. SECURITY CLASSIF. (of this report)
Unclassified
20. SECURITY CLASSIF. (of this page)
Unclassified
21. NO. OF PAGES
26
22. PRICE
$ 3,00
MSFC - Form 3292 (May 1969)
TABLE OF CONTENTS
Page
SECTION I. INTRODUCTION 2
A. Background „ „ 2
B. System Configurations 2
SECTION II. THEORETICAL ANALYSES „ 5
A. Theory of Parallel Stand-By Systems 5
B. Theory of Triply Redundant Majority-Voting
Stand-By Systems „ 6
SECTION III. SYSTEM SIMULATION 9
SECTION IV. COMPARISON OF THE TWO STAND-BY CONFIGURATIONS 12
SECTION V. CONCLUSIONS 13
ill
A SYSTEM RELIABILITY ANALYSIS FOR STAND-BY
SPARES WITH NON-ZERO UNPOWERED FAILURE'1 RATES
SUMMARY
A theoretical reliability analysis is performed for two
different stand-by system configurations. The two system configu-
rations are simulated by utilizing Monte Carlo techniques, and the
results agree within one percent of the theoritical reliability
predictions. A comparison of the two configurations is presented.
It is concluded that in order for the voting system configuration
to be competetive, it must utilize software error detection in the
final phases.
SECTION I. INTRODUCTION
The NASA unmanned interplanetary space flights in the 1975
to 1985 time frame will require a spaceborne computer that is highly
reliable and which can automatically switch in redundant hardware on
a real time basis. The computer division of the Astrionics Laboratory
at the Marshall Space Flight Center (MSFC) is developing a condidate
advanced aerospace computer called Space Ultrareliable Modular
Computer (SUMC).l In supporting this effort, several studies have
been conducted to determine the best method to configure such a system.
This paper represents the results of one of these studies.
The object of this study is to perform a theoretical reliability ana-
lysis on two different system configurations and compare the results
to a Monte Carlo simulation of the systems.
A. Background
During the past few years several papers have been published
on the reliability of parallel redundant and triply redundant majority
voting systems. 2,3,4,5, et al. However, most of these papers are con-
cerned with either system reliability approximations, 3,6,7, powered up
redundant units, 2,5 or unpowered stand-by units with a zero stand-by
failure rate. 8,9 To the authors' knowledge no one has published any
work which will:
1) Exactly predict the system reliability for parallel
redundant and triply redundant majority-voting systems,
with "n" unpowered stand-by spares which have a non-zero
failure rate while in the stand-by mode; and
2) compare the system reliabilities to each other and
analyze the results.
The purpose of this paper is to accomplish the above stated
objectives. In doing so, two basic.stand-by system configurations will
be considered
B. SYSTEM CONFIGURATIONS
The first system configuration to be considered will be
described as a parallel stand-by system and is illustrated in Figure 1.
A parallel stand-by system has the following characteristics:
1) Only one unit at a time is powered up; and
2) all units possess hardware error detecting capabilities.
UNIT 1
UNIT 2
UNITN
FIGURE I
PARALLEL STAND-BY CONFIGURATION
The second system configuration under consideration will be
described as a triply redundant majority-voting stand-by system and is
depicted in Figure 2. The characteristics of this configuration are
described below:
1) As long as there are at least three units, three
of them will be powered up and the rest will be in an
unpowered stand-by mode;
2) when all but two of the units have failed, the
voter can than only tell when these final two units
are not in agreement, (i.e. it can detect one more
failure, but cannot isolate the faulty unit.)
3) Units do not have error detecting hardware,
however, software error detection may be introduced
whenever the system is down to just two units and
one of them fails.
UNIT!
UNIT 2
UNIT 3
UNIT 4
UNITN
FIGURE 2
TRIPLY REDUNDANT MAJORITY-VOTING STAND-BY CONFIGURATION
SECTION II. THEORETICAL ANALYSIS
A. Theory Of Parallel Stand-By Systems
The reliability of a parallel stand-by system is well defined
if the unpowered units cannot fail until they have been powered up. For
example, the reliability of such a system N units, of which N-l are un-
powered spares is'
where
N = total number of units,
A = powered failure rate, and
t = time.
This simple equation becomes somewhat more, complicated if the
unpowered stand-by units have a non-zero failure rate (xVO). In order
to analyze this system, the reliability will be defined as the sum of
the probabilities of the successful paths that the system might follow
and still have an operational unit. Utilizing this approach, a system
of N units could tolerate no more than N-l failures, and the reliability
equation would consist of N terms of a similar format.
R = PQ + Pj_ + ... + Pn_l (2)
where
P0 = e
- At
t
-At f -A'ti
l =Ae J e dtxp^
, tx = o
Ml •<• iV '
!
, } -At/- -Ati^ AC2 /"-Atn_!
r j ( A + n A n e / e I e . . . l e dtidt2... dtn_i
When the integrations in Equation (3) are performed and
results substituted into Equation (2), the following expression is
obtained:
(4)
i=o
where
N = Number of units >2.
N = 1 implies that there are no spares and the reliability is simply
R = eXt.
If X' = 0 in Equation (4), i.e., the unpowered, stand-by
spares cannot fail until they become powered up, then L 'Hospital's
rule must be employed and Equation (4) reduces Equation (1) .
B. Theory of Triply Redundant Majority-Voting Stand-By Systems
Triple redundancy with a voter has been investigated by several
authors, 10,11 and even N-fold redundant systems (all units voting and powered
up) have been investigated. 12 However, to the authors' knowledge, an
analysis of a triply-redundant, majority-voting system with "N" unpowered
stand-by units, and which is allowed to degrade to a single operating unit,
has not been performed. This configuration, as illustrated in Figure 2,
is assumed to operate in the following manner.
As long as two units agree, the voter assumes the third has
failed and thus will switch in a previously unpowered spare; providing
one is available. (It is assumed that the spares can fail even though
they are unpowered.) If no spare is available, the system can still
operate as long as the two remaining units agree. However, when they
disagree, the voter cannot tell which unit is in error and for that reason
the voter is useless from this time on. Since one does not wish a system
to fail as long as one good unit remains, software error detection may be
introduced at this point to determine the faulty unit. Through the proper
use of software error detecting schemes, the final unit could then be
utilized until it fails.
The theoretical reliability analysis of a triply redundant
majority-voting system with "N" stand-by spares is much more complicated
than that of a simple parallel stand-by system. For example, one can
consider, as was done in the previous section, that the reliability of a
system is the sum of the probabilities of the successful paths which the
system might follow and still have an operational unit at time t. Under
such an analysis, the reliability of a triply redundant voting system
with "N" stand-by spares will generate N+ 2 different probablistic
terms, with no software error detection, or N + 3 terms if software
error detection is utilized. The format of these equations is illus-
trated in Equations (6) below.
/
-X't-l r -X't2
e /e ... I e dtj_ dt± ...
r x'ty -X't2 f
r r "7
where to = o and i = 1,2,3, ... ,N
t t t
* ""
 dtl
 "• »-i
(6)
,„. . At f-X'ti /*-X'tn/"Pn+1 (N) = k^! e I e l ... I e /
tn=tn-l
•i i *- /* «• V f~ /*• ^ 'f" j» _ \ f* _ \ t"
^At i A.CI / At
 n /• Ai-n+i /• Acn+2
•»• ;e /e /e /e c
tn=tn-ltn+l=tn
k0 = e , ki = k0 n ( 3 X + n X ) , i>
n=o
and N = number of stand-by units.
These equations have been writen out in detail for N = 0,1,2,3 in Table
1. Solutions for these equations are then presented in Appendix 1.
TABLE 1
ui
ce.
a.
«/>
o
P0(01= •
P,(0) = 3A^A7 «Atl dfl
'l=0f
rXt/ -
*P2(0) = 6A2 eXt/* ?Xtl/ ?Xt2 dt, dt2
'1=0 '2 = *1
P00)=
p
UJ
oe
3Xt/* ?x/n
'1=0
P2(1) = (3A+A') 3 A *
' ' '*P2 CD = (3A + A') 6A2 fXt f ?Xfl/" •M'^l fA'3 dt,
'1=0 '2 = 'l '3 ='2
PO (2) = PO (0)
P, (2) = PI (1)
P2(2) = (9A2 +
a.
cs P3(2) = (27A3+27A2A' - I -6AA'2) e2Xt/* ?X/tl J ^ 2 J X * 3 dt,dt2dt3
»1 = 0 t2 = ti t3=t2
*P4 (2).= (54 A4 + 54 A3A' + 12 A2A'2 ) JXt AX/*1/ ?X/ f2/ ;Xt3/" ?X*4 dt, dt2 dt3 dt4
P0 (3)= P0(0)
Pi (3) = PI (1)
P2 (3) = P2 (2)
P3(3)= (27A3+ 27A2A' + 6 A A ' 2 ) »3X 5 X / t * eX/»2 ?X/»3 dt l dt2 dt3
UJ
at
Q.
CO
CO P4(3)= (81 A4 + 162 A3 A'+99 A2 A'2+ 18AA / 3) 52Xt/*SX/tl/' eX/t2/* ;X/'3/*eXt4 dt, dt2 dt3
t l=0 *2=t l t 3 = t 2 t4r t3
t t
* THIS TERM IS ADDED TO THE SYSTEM RELIABILITY IF AND ONLY IF SOFTWARE ERROR DETECTION
IS INTRODUCED AFTER THE N+2nd FAILURE.
•SECTION III. SYSTEM SIMULATION
As can be seen in Appendix 1, the equations necessary to
calculate the reliability of a triply-redundant system become increas-
ingly complex as the number of unpowered stand-by units increases. In
order to verify the results obtained from these equations, a Monte Carlo
simulation model was developed which provides estimates of system relia-
bility for "M-redundant" majority-voting stand-by systems (see Figure 3).
Note that M-redundant systems include both the parallel redundant system
(see Figure 1) and the triply-redundant system (see Figure 2).
The model simulates the life of a system a specified number of
times and uses the results from these simulations to calculate estimates
of system reliability. Both powered and unpowered failures are assumed
to be exponentially distributed with mean failure rates A and A1 ,
respectively. Exponential distributions with means provided by input
data are sampled during execution of the model to find the failure times
of the various units. When a powered unit fails, it is replaced by a
spare as long as one is available.
The simulated time at which the number of operable units falls
below a preset minimum is recorded as the duration of a system's life.
System reliability, for a particular time t, is obtained by dividing the
the number of systems lasting longer than t by the total number of systems
simulated.
Naturally, the accuracy of these reliability estimates is a
function of the number of times the system life is simulated (i.e, the
sample size used). Model runs were made with sample sizes of 1000,
5000, and 10000. Table 2 shows typical results from the three model
runs when compared to the results obtained from the equations in Appendix
1. These results are for a triply-redundant system with 2 spares and
failure rates A = .75 and A' = .01. Simulator results using a sample
size of 10,000 were generally within 1% of the results from the equations
in Appendix 1. This close agreement is sufficient to verify the equations.
UNIT 1
UNIT 2
UNIT M
UNIT M+l
UNIT N
FIGURE 3: M-REDUNDANT SYSTEMS WITH SPARES
10
TABLE 2: COMPARISON OF SIMULATOR RESULTS
WITH ACTUAL RELIABILITIES
TIME
1
2
3
4 /
5
6
7
8
SIMULATOR ESTIMATES
SAMPLE SIZE
1000
.9750
.8150
.5390
.3060
.1610
.0740
. .0340
.0120
5000
.9738
.7758
.5502
.2818
.1426
.0770
.0404
.0176
10000
.9754
.7855
.5061
.2817
.1462
.0744
.0364
.0164
ACTUAL
RELIABILITY
.9746
.7842
.5049
.2816
.1449
.0715
.0345
.0165
11
SECTION IV. COMPARISON OF THE TWO STAND-BY CONFIGURATIONS
The reliability of the two stand-by configurations depicted
in Figures 1 and 2 and described mathematically by Equations (3) and
(6) respectively, depends upon four independent variables, i.e., \, X,
N and t. In order to compare these configurations fairly, the following
assumptions have been made.
(1) The parallel configuration units must contain more hard-
ware (due to error checking capabilities) than the voting units, thus
AP>AV> and for the purpose of comparison it will be assumed that
Xv = .75 Xp.
(2) It has been assumed that the reliability of the voter
and switching devices is sufficiently close to 1.0 that they can be
ignored in this initial comparison.
With these assumptions in mind, a comparison between the two
configurations is shown in Figures 4 through 7. These curves are pre-
sented in such a way that the units of time are the same as the units of
I/A-
12
SECTION V. CONCLUSIONS
Equations (3) and (6) enable one to calculate the reliabi-
lity of two distinct stand-by configurations. These equations have
been derived subject to the following assumptions:
(1) The reliability of the switching has been ignored, and
(2) If and when a unit fails, its failure can be detected,
and a spare unit (if available) can be successfully switched
into operation.
The primary conclusions that one can draw from Figures (4)
through (7) are that:
(1) The system reliability will increase as the number of
stand-by spares increases. (Actual amount of increase is
optimistic because of the assumptions mentioned above;
(2) The voting system is not as sensitive to the unpowered
failure rate (X1) of the stand-by units as the parallel
system;
(3) The voting system is not competitive unless it utilizes
some form of software error detection in the final phases;
(4) If the number of units are the same and X» X , the
parallel system yields the higher reliability, while if
X « x' » fche voting system yields the higher reliability; and
(5) In order to obtain extremely high system reliabilities,
the mission time (t) must be near the mean time between
failure (1/X) of the individual units,
Finally, it is obvious that the system reliability is very
dependent upon the powered and unpowered failure rates, X and X'
respectively. Thus, to obtain realistic numbers for estimates of system
reliability, an effort needs to be made to obtain realistic values for
these important parameters.
13
u
UI
h-
Ul
o
U
UII-
Ul
o
00
Z OS
d OS
£ U
O
»-
U
UI
£ <?t o-E
z ,
i
CO
»O
oZ
I
m
UJ
Q£
1
U_
Ainravnav
14
UJ
UJ
i
o
15
O iZ
IU
Aimavnaa
16
UJ
o
8
17
APPENDIX 1
The results of integrating the equations in Table 1 are presented
below.
P (0) = P (1) = P (2) = P (3) = e"3Xt
P (0) = 3e"3Xt (eXt - 1)
P (0) = 3e'3Xt (1 - eXt)2
e'3Xt
Xt -X't , - X ' t };x. - i^- J
P3(l) = 3(3* + X 1 ) e"JAC i 2 X + 6 X ' + I 1 " \ ~ + X *
Xt
P3(2) = 3 ( 3 X + X ' ) ( 3 A +2 A f)e"3Xt
a - e" x l t ) 2 )
e2At -
2 X l Z j
P4(2) = 3(3 A + A ' X S A . + ZA -;e ) (2 A~+ A"T(2 A +^A ') - ( 2 A + A ' ) A '
•e- A > t ) 2 2e'
+
A*- O** 1*.»— ^^ O fcALl
^ X ^  ^ 6 ^ 6 •
+ A ' ) ( A + 2A 1 ) + (A+ A1) A" i
18
V3)
Oij. (
3 ( 3 A + A ' X 3 A + 2 A 'X3A + 3 X ') e I
-2x't -3X't
(X+ X ' ) (X+ 2X')(X+ 3X1)
-X't -X' t ~2A't -/,'t
- e * ^(e X fc- e ) (1 -e A ]
6 A1
3(3 X + X ' ) ( 3 X + 2 X ' ) ( 3 X + 3X ') e-3Xt
!
2X t
e I_
(2X+X 1 )
-3Xt
(2X+ 2X') (2X+ 3X1)
X ' ) ( 2 X + 2 X ' ) X '
.
 2e-3A't
- e"A>t(l - e'^'t)2
 + (1 - e"^'"11
6 X
t3
19
REFERENCES
1. Sperry Rand, "MSFC Advanced Aerospace Computer," Report No.
SP-232-0384, July 6, 1970.
2. P. Beckmann, "Reliability of Loaded Parallel-Redundant Systems,"
IEEE Annual Symposium on Reliability. January 10-12, 1967 ,
p. 54-58.
3. D. K. Rubin, "The Approximate Reliability of Triply Redundant
Majority-Voted Systems," IEEE Computer Conference. 1st Annual,
September 6-8, 1967, p. 46-49.
4. D. E. Anderson, "Reliability of a Special Class of Redundant
Systems," IEEE Transactions on Reliability, Volume R-18, Number
1, February, 1969, p. 21-28.
5. N. Deo, "Generalized Parallel Redundancy in Digital Computers,"
IEEE Transactions on Computers, June, 1968, p. 600.
6. R. B. Coffelt, "Automated System Reliability Prediction,"
Proceedings of 1967 Annual Symposium on Reliability. Washington,
D. C., January, 1967.
7. P. A. Jensen, and M. Bellmore, "An Algorithm to Determine the
Reliability of a Complex System," IEEE Transactions on Reliability,
Volume R-18, Number 4, November, 1969.
8. I. Bazovsky, Reliability Theory and Practice. Prentice-Hall, Inc.,
Englewood Cliffs, New Jersey, 1961.
9. ARINC Research Corporation, Reliability Engineering. Prentice-Hall,
Inc., Englewood Cliffs, New Jersey, 1964.
10. R. H. Wilcox and W. C. Mann, Redundancy Techniques for Computing
Systems, Spartan, Washington, D. C., 1962.
11. W. H. Pierce and P. A. Jensen, Failure-Tolerant Computer Design,
Academic Press, New York, 1965.
12. N. Deo, "Redundancy Optimization for Space Computers" NASA, Space
Pjcogram Summary, Volume 4, Number 37-43, February, 1967.
20
MSFC—RSA, Ala


A system reliability analysis for stand-by spares with non-zero unpowered failure rates

Abstract

Similar works

Full text

Available Versions

NASA Technical Reports Server