Indian Standard
Indian Standard
Indian Standard
Indian Standard
DEPENDABILITY MANAGEMENT —
APPLICATION GUIDE ANALYSIS TECHNIQUES FOR
DEPENDABILITY — GUIDE ON METHODOLOGY
0 BIS 2001
FOREWORD
This Indian Standard was adopted by the Bureau of Indian Standards, after the draft finalized by the Reliability
of Electronic and Electrical Components and Equipment Sectional Committee had been approved by the Electronic
and Telecommunication Division Council.
Dependability analysis techniques are used for the review and prediction of the reliability, availability,
maintainability and safety measures of a system. Dependability analyses are conducted mainly during the concept
and definition phase, the design and development phase and the operation and maintenance phase at various
system levels and degrees of detail to order to evaluate and determine the dependability measures of a system or
an installation. They are also used to compare the results of the analysis with specified requirements.
While preparing this standard, assistance has been derived from IEC 60300-3-1 (1991) ‘Dependability
management – Part 3: Application guide – Section 1: Analysis techniques for dependability: Guide on
methodology’, published by International Electrotechnical Commission.
The technical Committee responsible for preparation of this standard has reviewed the provisions of following
IEC publication and decided that it may be used in conjunction with this standard till Indian Standard on this
subject is published:
lEC 1025(1990) Fault tree analysis (FTA)
The composition of the Committee responsible for formulation of this standard is given in Annex B.
In reporting the results of a test or analysis made in accordance with this standard, if the final value, observed
or calculated, is to be rounded off, it shall be done in accordance with IS 2 : 1960 ‘Rules for rounding off
numerical values (revised)’.
lS 15036:2001
Indian Standard
DEPENDABILITY MANAGEMENT —
APPLICATION GUIDE ANALYSIS TECHNIQUES FOR
DEPENDABILITY — GUIDE ON METHODOLOGY
1 SCOPE all the possible model complexities required to evaluate
the features of practical systems (hardware and
l%is standard gives a general overview of commonly
software, complex fictional structures, etc). It may
used dependability analysis procedures. It describes
be necessary to consider several additional analysis
the usual methodologies, the advantages and
methods to ensure proper treatment of complex or
disadvantages, data input and other requirements for
multi-functional systems.
the various techniques.
This guide is an introduction to the available 5 BASIC APPROACH TO SYSTEM
methodology and is intended to provide the analyst DEPENDABILITY ANALYSIS
with the necessary information in order to choose the Specific procedures for analysis are contained in the
analysis method most appropriate to the system. standards describing each analysis method. General
procedures, approaches and requirements are
2 REFERENCES
described hereinafter.
The Indian Standards listed in Annex A are necessary
adjuncts to this standard. 5.1 General Procedure
The procedure consists of the following steps (as
3 DEFINITIONS
applicable):
For the purpose of this standard, the terms and defin-
Step 1
itions given in IS 1885 (Part 39) shall apply in addi-
tion to the following. List all system reliability and availability requirements,
characteristics and features, together with environ-
3.1 System mental and operating conditions, and maintenance .- -
requirements. Define the system to be analyzed, its .
Item on the highest level considered in the analysis. <
-,
modes of operation, the functional relationships to
!-
3.2 Component higher levels and to interfacing systems of processes. .
3.3 Allocation Define system fault, fault criteria and conditions based
on system tlmction”alrequirements, expected operation
A procedure applied during the design of an item and operating environment. Software performance
intended to apportion the requirements for should also be considered.
performance measures for an item to its sub items
according to given criteria. Step 3
1
IS 15036:2001
measure is the appropriate measure for evaluating the redundant components. If so, then repair or
influence of maintenance and repair on system replacement increase system reliability performance . ..
dependability. and availability performance.
--l
Repair of a system during operation without It is usually necessary to perform a separate analysis ,.
interruption of its function is normally possible only to evaluate repair and maintenance aspects of a system
;““i.,,
for a redundant system structure with accessible (see IS 9692 series). t ‘J
~
7
Table 1 Correspondence of Methods to General Analysis Procedure
(Clause 5.1)
2 Definition of Failure of first Undesired (top) Criteria of system Criteria of system Failure of first
system fault order functional event success (failure) success and failure order functional
level level
3 Reliability If applicable
to If applicable
to If applicable
to If applicableto sub- lf applicable to
apportionment components sub-systems sub-systems systems components
4.1 Qualitative Inductive (table) Deductive (fault Deductive (block Inductive/deductive Assume series
analysis, tree) diagram) (state transition system structure,
maintenance diagram) list and evaluate
strategy components
4.2 Quantitative Fault Calculation of Calculation of Crdculation of Calculation of
~
analysis critically/probabi1- system reliability system reliability system reliability components and ‘;
(numerical ity analysis and availtillity and availahlity and availability system failure .
evaluation) measures measures measures rates
5 Requirements Criticality of Probability of Reliability/availati Reliability/availaM1 Does estimated
met (terminate failures and fiilu~ undesired even Iity requirement ity requirements system failure rate
procedure) probabilities within met? met? meet
withhr limits requirement requirements?
5.1 Review Component failure Sub-system/ Sub-system Componenthrb- Determine highest
design, modes, failure component reliability/ system/system component failure
determine rates, etc failure modes, availability, sub- reliability and rates
weaknesses failure rates, system/ component availability,
system structure, failure rates, maintenance and
etc system stmctrrre, repair policy,
etc system structure
5.2 Develop Component System structure, System structure, System structure, Re-evrduate choke
alternative selection and redundancy redundancy redundancy of weakest
designs maintenance, etc allocation, fault allocation, allocation, components
detection, component component
maintenance, etc selection, selection, repair
maintenance, etc policy, system
reconfiguration, etc
5.3 Perform trade- Determine most Determine most Determine most Determine most Estimate cost
off studies and economical economical economical economical
cost evaluation solution solution solution solution
3
IS 15036:2001
Failure mode and effect analysis (FMEA) is an Various qualitative analysis techniques may be
inductive (bottom-up), qualitative dependability employed to construct an RBD. The first step is to
analysis method, which is particularly suited to the establish the definition of system success. The next
study of material, component and equipment faults step is to divide the system in functional blocks
and their effects and mechanisms on the next higher appropriate to the purpose of the reliability analysis.
functional system level. Iterations of the step Some blocks may represent system substructures,
(identification of single fault modes and the evaluation which in turn may be represented by other RBDs
of their effects on the next higher system level) result (system reduction).
in the eventual identification of all the system single For the quantitative evaluation of an RBD, various
fault modes. FMEA lends itself to the analysis of methods are available. Depending on the type of
systems of different technologies (electrical, structure (reducible or irreducible) simple Boolean
mechanical, hydraulic, software, etc) with simple techniques, truth tables and/or path and cut set analysis
functional structures. may be employed for the prediction of system reliability
FMECA extends the FMEA to include criticality and availability values calculated from basic
analysis by quantifying fault effects in terms of component data.
probability of occurrence and the severity of any 6.2.4 Markov Analysis
effects. Estimates of the probability of failure are
calculated directly from a reliability prediction using Markov analysis is mainly an inductive (bottom-up)
the data assessed by the FMEA (probability of analysis method suitable for the evaluation of
occurrence of a fault mode, failure rates, etc). The functionally complex system structures and complex
severity of effects is assessed by reference to a specified repair and maintenance strategies.
scale. The method is based on the theory of Markov chains.
6.2.2 Fault Tree Analysis In principle the probabilities of system elements
(components, sub-systems) being in a particular
Fault tree analysis (FTA) is a deductive (top-down) (functional) state, or events to occur, at specific points
method for analyzing system dependability. It is or intervals of time are evaluated by mathematical
concerned with the identification and analysis of models.
conditions and factors which cause, or contribute to,
4
\
Analysis I Characteristics
.Ivletnuu
...--> I
T
components ndmrt cible event varying mainte- on represen-
Stroct struc- combin- narrce of tation
failurel
Ures tures ations strategies functio-
event quao- quail-
and nal dedu- induc- quail- quan-
rates titative
depend- process tive tive tative tative titative
encies 1 1
I T
=FFF
FMEA Up to several (no) no (no) yes no no List Is 11137
thousands (Part 2)
FMECA
Fault
Up to several
thousands
tree Up to several
I (no)
yes
no
I (no)
yes no no
List
Fault tree
T c
#
c
1
high
1
medium
Is 11137
(Part 2)
IEC 1025
analysis thousands I I I
Clnc (1990)
T
Reliability Up to several yes (yes) no no Reliability c nc (c) I c I medium I medium Is 15037
block thousands I block
diagram diagram
Markov
1
2to 100$
I
yes
w System state (nc) c —
w=
+-=--t= diagram +
+
Parts count 1 to thousands (no) List —
=FFF
nclc
Cause/conse-
quence
Up to several
hundreds
yes Cause/conse
quenti chart T —
E
Event Up to several
simulation hundreds 8)
Y
System Up to several yes no (yes) Reliability nc c (nc) Clo)
medium medium —
reduction
Event tree
Truth table 3)
thousands 9)
2t050
2 to 505)
yes
yes
yes
yes
(yes)
yes 6)
block -
diagram
Event tree
Table
--1--
c
nclc
c
10)
I I I
—
—
NOTE — Forabbreviations
andremarkssee6.3.3.
IS 15036:2001
Initially all the states of interest shall be defined All these methods are capable of analyzing:
together with the probabilities of transition from one
a) series structures;
state to another (component failure or repair rates,
event rates, etc). Transition rates (failure rates, event b) reducible structures if redundant structures
rates) are normally assumed to be constant, that is are applicable;
independent of time or previous history. c) independent components (two-state model);
d) single faults;
The qualitative anaIysis requires the determination of
all the possible system states, preferably shown e) exponential distribution of times to failure;
diagrammatical Iy in a state-transition diagram. A 0 constant repair or event rates; and
major supporting analysis technique is the truth table. g) independent component repair.
The transition probabilities and the way in which the 6.3,2 Table 2 Headings
states are related, represented by the state-transition
6.3.2.1 Number of components
diagram, allow the construction of the desired
transition matrix (mathematical model) for the purpose The number of components of the system which can
of system reliability/availability calculations. The be handled by a particular analysis method is basically
evaluation of other measures of interest may also be limited by the number of combinations (system states)
accomplished. which arise from the possible component states or fault
modes considered. The number of combinations is also
6.2.5 Parts Count Reliability Prediction
heavily dependent on the specific system structure and
Parts count reliability prediction is basically an maintenance considerations.
inductive (bottom-up) method applicable mostly
6.3.2.2 Redundant structures
during the proposal and early design phases, to
estimate an approximate system failure rate. The basis capability to handling redundant system
structures.
The components of the system need to be listed and
the appropriate failure rates determined according to 6.3.2.3 Irreducible structures
their stress levels.
A structure is called irreducible if straight forward
The method is based upon the assumption that the reduction techniques are not possible.
components are logically connected in series. This is
6.3.2.4 Failure/event combinations and dependencies
often a worst case estimate. Where redundancies at
the higher levels of assembly are known, their effects The capability of the method to handle failure or event
may be taken into account. combinations. These include common cause br
A parts count reliability prediction of a system with a common mode failures, multiple failure effects and
series type of structure will yield predictions at an statistically dependent fault modes or sequential failure
acceptable precision level, provided a thorough ‘Parts effects and mechanisms, or events caused by adverse
environmental effects.
Stress Analysis’ is carried out. Use of the parts stress
analysis gives more realistic component failure rates. 6.3.2.5 Time vatying failure/event rates
6.3 Explanations to Table 2 Non-constant failure and event rates (or non-
exponential distribution of times to failure).
6.3.1 General
6.3.2.6 Complex maintenance strategies
On the left hand side of Table 2, the analysis methods
The capability of the method to handle statistically
are listed. In order to facilitate evaluation and
dependent repair and maintenance situations. These
comparison, their characteristics, attributes, flexibility, include cases where renewal processes (repair queues)
etc, are stated.
should be considered, as compared to the assumption
For each analysis method the matrix thus gives an that, for each component failure, repair begins
indication as to which additional characteristics each immediately after failure, independent of whether a
method can handle as indicated by ‘yes’ and ‘no’ component is accessible or not (independent repair).
entries, Further, the analysis methods are distinguished
by particular attributes or techniques. These are listed 6.3.2.7 Simulation of functional process
and rated on the right hand side of Table 2.
The capability of a method to simulate discrete events;
Table 2 indicates that there is no single, comprehensive that is, the failure and renewal processes are simulated
dependability analysis method. The analyst should and the particular system states evaluated according
choose the method which best fits the particular system to the influence which they exert on any higher-level
or analysis objective. system or on the total environment (interrelation).
6
,,
.—. &
-, -..
IS 15036:2001
‘,
.
..—
.-
The entries give relative estimates of the cost of a) identifies systematically the cause and effect
applying a particular analysis method to a particular relationships;
problem. The effective analysis effort is dependent on b) gives an initial indication of those fault modes
the system complexity, the depth of analysis, the skill which are likely to be critical, especially
of the analyst, the availability of basic system and single faults which may propagate;
component data, and the availability of suitable c) searches for possible outcomes not previously
computing resources. or precisely known;
6.3.3 Remarks with reference to Table 2 d) identifies outcomes arising from specific
causes or initiating events which are believed
c Capable. to be important;
Nc Not capable, or not applicable e) highlights spurious outcomes as well as
() With restrictions/exceptions deviations from normal functional
performance; and
1) With cut sets or logical reduction.
2) By event simulation, numerical integration f) useful in the preliminary analysis of new or
untried systems or components.
or renewal theory.
3) A basic, systematic method (combinatorics) 6.4.1.2 Disadvantages ..
to support qualitative system analysis, in a) the output data may be large even for -,,
particular for Markov and event simulation relatively simple systems;
to determine the possible system states. Low .
b) may become complicated and unmanageable
for event rate, high for unavailability
unless there is a fairly direct (of ‘single-
(diagrams with loops).
chain’) relationship between cause and effect,
4) Low for event rate, high for unavailability that is, cannot conveniently deal with parallel
(diagrams with loops).
or complex relationship;
5) Depends on system complexity (stochastic c) may not easily deal with time sequences,
process to be simulated) and possible restoration processes, environmental
approximations (truncation of event
conditions, maintenance aspects, etc;
sequences).
d) does not, in itself, directly produce a model
6) Especially dependent events, for example,
for quantitative evaluation; and
parallel structures with passive (standby)
e) may not easily portray multiple dependen-
components.
cies or complex interactions between faults
7) Special Erlang distribution (introduction of in different parts of the system.
virtual – ‘dummy’ states) or semi-Markov
process. 6.4.2 Fault Tree Analysis
8) System size and complexity which can be 6.4.2.1 Advantages
handled are mainly dependent on available
computing means, efficiency of event (Monte a) identifies and records systematically the
Carlo) simulation procedure and required logical fault paths from a specific effect, back
accuracy of measures to be estimated. to the prime causes;
9) Independent components at each reduction b) deals with parallel, redundant or alternative
level are assumed. Therefore, any fault paths;
7
IS 15036:2001
c) deals with most forms of combinatorial events .!9 capable of setting up models for the
and some forms of dependencies as well; evaluation of overall system reliability and
d) deals with systems which have several cross- availability in probabilistic terms; and
Iinked sub-systems; h) results in compact and concise diagrams for
e) provide for fairly easy manipulation of the a total system.
fault paths to give minimal logical models 6.4.3.2 Disadvantages
(for example by using Boolean algebra);
capable of sensitivity analysis to indicate the a) does not, in inself, provide for a specific fault
f)
items dominantly contributing to overall analysis – that is the cause-effect(s) paths or
system reliability; the effect-cause(s) paths are not specifically
highlighted;
g) capable of setting up models for the
evaluation of overall system reliability and b) requires a probabilistic model of performance
availability in probabilistic terms; and for each element in the diagram;
h) results in compact and concise diagrams for c) will not show spurious or unintended outputs
a total system. unless the analyst takes deliberate steps to
this end; and
6.4.2.2 Disadvantages d) is primarily directed towards success analy-
a) does not, in itself, provide for a specific fault sis and does not deal effectively with com-
analysis – that is the cause-effect(s) paths or plex repair and maintenance strategies or
the effect-cause(s) paths are not specifically general availability analysis.
highlighted; 6.4.4 A4arkov Analysis
b) requires a probabilistic model of performance
for each element in the diagram; 6.4.4.1 Advantages
c) wi 11not show spurious or unintended outputs a) provides a direct probabilistic model for
unless the analyst takes deliberate steps to system state behaviour based on the system
this end; and logic;
d) is primarily directed towards success analy- b) provides the probabilistic solutions for sub-
sis and does not deal effectively with com- sets of other models such as logic diagrams
plex repair and maintenance strategies or and fault trees;
general availability analysis. c) deals readily with multi-state situations and
6.4.3 Reliability Block Diagram outcomes, right down to the component level;
d) represents event sequences with a specific
6.4.3.1 Advantages pattern or order of occurrence;
a) Often constructed almost directly from the e) valuable in computing availability
system functional diagram; this has the performance measures of the system; and
further advantages of reducing constructional o deals with complex, dependent repair situa-
errors and/or systematic depiction of tions.
functional paths relevant to system reliability;
b) deals with most types of system configuration 6.4.4.2 Disadvantages
including parallel, redundant, standby and a) may become very complex for models
alternative functional paths; involving a large number of system states;
c) deals with most forms of combinational b) may not help in the logical solution of a
events and some forms of dependencies; problem;
d) capable of complete analysis of variations and c) depends normally upon the assumption that
trade-offs with regard to changes in system transition rates are constant; and
performance parameters;
d) can only represent combinatorial events
e) provide (in the two-state application) for
by creating a new state for each combi-
fairly easy manipulation of functional or non-
nation.
functional paths to give minimal logical
models (for example, by using Boolean 6.4.5 Parts Count Reliability Prediction
algebra);
6.4.5.1 Advantages
o capable of sensitivity analysis to indicate the
items dominantly contributing to over-all a) time and cost of analysis are very low;
system reliability;
8
.——
IS 15036:2001
>
b) the necessary input information and data are considered, and therefore only simple
small and suiting to the situation in the early structures lend themselves to parts count ,.
design and development phase; analysis; ,-
c) basic information on component reliability b) the precision level of the predictions is
is gained in the early design and development normally low, especially for small sub-
phase; systems, due to the wide spread in values of
d) adapted to computerized calculations; most published data;
e) little training is necessary; c) repair and maintenance cannot be considered;
f) applied to parts of any complexity, provided d) the evaluation of fault modes and
reliability data are available. mechanisms and their effects is not possible;
and
6.4.5.2 Disadvantages !
e) time-sequential failure and event behaviour
a) the functional structure (for example lower cannot be considered.
level redundancies) of a system cannot be
ANNEX A
(Clause 2)
LIST OF REFERRED INDIAN STANDARDS
1885 (Part 39) : Electrotechnical vocabulary: Part 39 (Part 8/See 2): Maintenance and maintenance
1999 Reliability of electronic and 1988 support planning, Section 2 Main- ., ..
electrical items (second revision) tenance support analysis
9692 Guide on maintainability of (Part 8/See 3): Maintenance — maintenance support
equipment 1988 support planning, Section 3
(Part 1) :1980 Introduction to maintainability Maintenance planning analysis
(Part 2) :1980 Maintainability requirements in (Part 8/See 4): Maintenance and maintenance
specifications and contracts 1988 supporting planning, Section 4
(Part 3) :1981 Maintainability programme Maintenance support resources
(Part 4) :1987 Test and diagnostic procedures requirements
(Part 5) :1985 Maintainability studies during the ll137(Part2): Analysis techniques for system
design phase 1984 reliability: Part 2 Procedure for
(Part 6) :1983 Maintainability verification failure mode and effects analysis
(Part 7) :1984 Collection, analysis and presentation (FMEA) and failure modes, effects
of data related to maintainability and criticality analysis (FMECA)
(Part 8/See 1) : Maintenance and maintenance 15037:2001 Analysis techniques for
1988 support planning, Section 1 General dependability — Reliability block
diagram method
9
IS 15036:2001
,.
i
ANNEX B
(f’oreword)
COMMITTEE COMPOSITION
Reliability of Electronic and Electrical Components and Equipment Sectional Committee, LTD 3
(’2
Organization Representative(s)
i
Indian Institute ofTechnology, Khamgpur PROFK. B. MISW(Chairman)
All India Radio, New Delhi SrrsuA.B. MAWR !,,
SsrroJ. P. Tsr.wm(Alternate)
,!
Member-Secretary
Smu I%vrmKw
Assistant Dhector (Electronicsand Telecommunication),BIS
10
Bureau of Indian Standards
BIS is a statutory institution established under the Bureau of Indian Standards Act, 1986 to promote
harmonious development of the activities of standardization, marking and quality certification of goods
and attending to connected matters in the country.
Copyright
BIS has the copyright of all its publications. No part of these publications may be reproduced in any form
without the prior permission in writing of BIS. This does not preclude the free use, in the course of
implementing the standard, of necessary details, such as symbols and sizes, type or grade designations.
Enquiries relating to copyright be addressed to the Director (Publications), BIS.
Amendments are issued to standards as the need arises on the basis of comments. Standards are also reviewed
periodically; a standard along with amendments is reaffirmed when such review indicates that no changes are
needed; if the review indicates that changes are needed, it is taken up for revision. Users of Indian Standards
should ascertain that they are in possession of the latest amendments or edition by referring to the latest issue of
‘BIS Catalogue’ and ‘Standards: Monthly Additions’.
This Indian Standard has been developed from Doc : No. LTD 3 (18 15).
... ..>