Successful Operation—Repairable Systems

The measurement reliability requires that a system be successful for an interval of time. While this probability is a valuable estimate for situations in which a system cannot be repaired during a mission, something different is needed for an industrial process control system where repairs can be made, often with the process operating. 

Mean Time To Restore (MTTR)—MTTR is the expected value of the random variable restore time (or time to repair). The definition includes the time required to detect that a failure has occurred as well as the time required to make a repair once the failure has been detected and identified. Like MTTF, MTTR is an average value. MTTR is the average time required to move from unsuccessful operation to successful operation. 

In the past, the acronym MTTR stood for Mean Time To Repair. The term was changed in lEC 61508 because of confusion as to what was included. Some thought that Mean Time To Repair included only actual repair time. Others interpreted the term to include both time to detect a failure (diagnostic time) and actual repair time. The term Mean Dead Time (MDT) is commonly used in some parts of the world and means the same as Mean Time To Restore. 

Mean Time To Restore (MTTR) is a term created to clearly include both diagnostic detection time and actual repair time. Of course, when actually estimating MTTR one must include time to detect, recognize, and identify the failure time to obtain spare parts time for repair team personnel to respond actual time to do the repair time to document aU activities, and time to get the equipment back in operation. 

Reliability engineers often make the assumption that the probability of repair is an exponentially distributed function in which case the restore rate is a constant. The lower case Greek letter mu is used to represent restore rate by convention. The equation for restore rate is  

---

Availability—The reliability measurement was not sufficiently useful for engineers who needed to know the average chance of success of a system when repairs are possible. Another measure of system success for repairable systems was needed. That metric is "Availability." Availability is defined as "the probability that a device is successful at time t when needed and operated within specified limits." No operating time interval... 

There is 0.00005707 probability that the system will move to State 4 (P-IOIA fails, but P-IOIB successfully operates). There is a 0.899994 probability that the system will remain where it is, i.e., that both pumps will operate as required. Probability values for repair times are also shown. There is a 0.333333 chance that P-101 B will be repaired (State 2 to State 1), and a 0.02000 chance that P-IOIA will be repaired (State 4 to State 1). 

Unavailability—a measure of failure that is used primarily for repairable systems. It is defined as "the probability that a device is not successful (is failed) at time t." Different metrics can be calculated, including steady state unavailability and average unavailability over an operating time interval. Unavailability is the one s complement of availability therefore. 

Figure 2.50 shows an example MA model for a two component parallel system with no repair. The RBD indicates that successful system operation only requires successful operation of either component A or B. Both components must fail to result in system failure. 

This mathematical model represents a system composed of n independent and identical vehicles operating in parallel. At least one vehicle must work normally for the system success. Whenever a vehicle fails, it is towed to the repair workshop for repair. The fully repaired vehicle is put back into operation. The system state-space diagram is shown in Figure 6.8. The numerals and a single letter in boxes and circles denote system states. 

In some systems, especially safety instrumented systems, the repair situation is not constant. In safety instrumented systems the situation occurs when failures are discovered and repaired during periodic inspection and test. For these systems, steady state availability is NOT a good measure of system success. Instead, average availability is calculated for the operating time interval between inspections. NOTE - This is not the same measurement as steady state avaUability. 

In low demand safety instrumented system applications, the restore rate is NOT constant. For failures not detected until a periodic inspection and test, the restore rate is zero imtU the time of the test. If it is discovered that the system is operating successfully, then the probability of failure is set to zero. If it is discovered that the system has a failure, it is repaired. In both cases, the restore rate is high for a brief period of time. Dr. JuUa V. Bukowski has described this situation and proposed modeling repair as a periodic impulse function (Ref. 1). This method is described in Appendix G. 

Markov models are generally considered more flexible than other methods. On a single drawing, a Markov model can show the entire operation of a fault tolerant control system including multiple failure modes. Different repair rates can be modeled for different failure situations. If the model is created completely, it will show full system success states. It will also show degraded states where the system is still operating successfully but is vulnerable to further failures. The modeling technique provides clear ways to express failure sequences and can be used to model time dependent probabilities. 

Markov models can show redundancy with different levels of redimdant components. Figure D-2 shows a system with two subsystems where only one is required for successful system operation. All failures are immediately recognized and the repair probability is modeled as a constant. 

ABSTRACT We consider coherent systems subject to common-cause failures described by multiple failure rates. After giving the generalized expression of the failure frequency v as a function of the failure rates and the derivatives of the system reliability TZ, we expand ft, and v in terms of the covariances of the components probabilities of correct operation. Assuming multiple repair rates also, we show that the evolution of the coupled populations of system states may be solved quite generally in successive steps. When all the failure and repair rate are constant, we give the analytical expressions of the steady-state populations for an arbitrary number of dependent components. 

ABSTRACT In the case of cyclical systems, a characteristic is that a sequence of the system s activities repeats regularly. This is called mission collectively. Typical representatives of these systems are transport systems which deliver a regular public transport service. In these cases the mission represents a vehicle operational task, i.e. providing transport capacity (defined mileage) with prescribed maintenance resources. If a vehicle failure occurs and is not possible to repair it with the maintenance resources, then the vehicle cannot complete the mission and it is necessary to replace it with a reserve vehicle. The probability of a successful mission completion is an integral quantitative indicator, which has a relationship to the number of reserve vehicles as an availability coefficient. A random vector is used for the description of mission completion probability. 

In fact, the sodium leak that occurred at Monju involved the secondary heat transport system, which means that the leaked sodium was not radioactive. Therefore, no radioactive material was released to the environment by the sodium leak and the safety facilities were not affected. Knowledge about sodium fire has been accumulated through operation experiences. So far, there have been about 150 sodium leak events in the UK, France, Germany, and the former Soviet Union. However, no reports have been released of safety facility damage due to the sodium leak or combustion, and the reactors that experienced the sodium leakage were repaired and successfully resumed their operations. 

Often the success of a decontamination operation is expressed in terms of a cost-benefit analysis, i. e. a comparison of the expenses incurred during execution of the total procedure to the cumulative dose exposure (man-rems) which can be expected to be saved as a consequence of the reduced radiation levels. The problem with such an analysis, which is mainly in use in the USA, lies in the difficulty in translating radiation dose exposures saved into an equivalent amount of money. The result of such an analysis, therefore, depends highly on the equivalent assumed. On the basis of such cost-benefit analyses, substantial radiation exposure savings to the staff have been calculated, in particular when decontamination was carried out prior to inspection, repair or replacement work. As was shortly mentioned above, the initial concerns of the plant owners with regard to the costs, the potential success and the potential hazards of such an action have been largely dissipated and, at many plants, decontamination of particular systems has become a standard technique. However, as the measures taken for reduction of plant contamination buildup (see Sections 4.4.3. and 4.4.4.) will prove to be more and more successful in the future, the need of operational decontamination in the plants is expected to decrease. 

Based on the aforementioned findings, a pilot project was implemented, set up by the Ministry of Public Works and Waterways in cooperation with the Royal Dutch Meteorological Institute (KNMI) for operational prediction of the occurrence of seiche events in the Port of Rotterdam, using parameter values derived from operational numerical weather prediction models. This pilot project has shown that the system has sufficient predictive skill for operational use. Such a system has since been implemented on an operational basis. Experience shows that all major seiche events (above the seiche-amplitude threshold) have been successfully predicted. However, in some cases a false prediction was made in the sense that a warning was issued while no significant seiches occmred. This is a drawback that needs repair, but even as it is, the system has merit because it does not miss significant events. 

---