Florent Brissaud

Dominique Charpentier

Anne Barros

Christophe Bérenguer

Design of complex safety-related systems

est destinée au dépôt

INTRODUCTION & IEC 61508

Safety instrumented systems (SIS) play a major part in industrial risk management as risk reduction measures. The main European standard for functional safety of SIS, denoted electrical / electronic / programmable electronic (E/E/PE) safety-related systems, is the IEC 61508 (IEC, 2005a). The second edition will soon be adopted in 2009 (IEC, 2009). Objectives are to enable the design of SIS, and the development of application sector standards. Such examples are IEC 61511 (IEC, 2004) for process industry, and IEC 62061 (IEC 2005b) for machinery. One of the main contributions of IEC 61508 is to consider the overall system and software safety life cycle. The standard framework, with the corresponding normative parts and subclauses, is: 1 development of the overall safety requirements (SR): concept, scope definition, hazard and risk analysis, overall SR specification (Part 1: 7.2-7.5); 2 SR allocation to the designated SIS or other risk reduction measures (Part 1: 7.6); 3 SR specification for each SIS in order to achieve the required functional safety (Part 1: 7.10); 4 realisation phase for SIS design and development in accordance with SR specification, for system (Part 2) and software (Part 3); 5 installation, commissioning, safety validation, including planning (Part 1: 7.8-7.9 and 7.13-7.14); 6 operation, maintenance, modification, and decommissioning (Part 1: 7.7 and 7.15-7.18).

Other requirements, regarding all phases, are about documentation (Part 1: 5); management of functional safety (Part 1: 6); functional safety assessment (Part 1: 8); and verification (Part 1: 7.18). Part 4 gives definitions and abbreviations. The other parts are informative: guidelines to determine overall SR (Part 5), guidelines for realisation phase (Part 6), and an overview of techniques and measures (Part 7). Safety requirements (SR) refer to safety function and safety integrity. A safety function has to be implemented by a SIS or other risk reduction measures to achieve or maintain a safe state of the equipment under control (EUC). The probability of a SIS satisfactorily performing the specified safety function is the safety integrity. Safety integrity values are arranged in four discrete levels, denoted safety integrity levels (SIL), according to target failure measures. For example, Table 1 applies to safety functions operating in low demand mode.

According to IEC, 2009, a safety-related system is regarded as low complexity if the failure modes of each individual component are well defined, and the behaviour of the system under fault conditions can be completely determined. This paper focuses on SIS to which this definition does not apply.

The realisation phase is investigated in Section 2. Some issues linked to the system complexity are discussed in Section 3, and a fault tree based approach is proposed. An intelligent transmitter is used as an example in Section 4, for both failure rates and behaviour uncertainty analyses. Finally, discussions are given in Section 5.

Design of complex safety-related systems in accordance with IEC 61508 F. Brissaud & D. Charpentier

Institut National de l'Environnement Industriel et des Risques (INERIS), Verneuil-en-Halatte, France

A. Barros & C. Bérenguer

Université de Technologie de Troyes (UTT) -Institut Charles Delaunay (ICD) -FRE CNRS 2848, Troyes, France

ABSTRACT: According to IEC 61508, a safety-related system is regarded as type B if it presents a high complexity (i.e. the failure mode of at least one component is not well defined, or the behaviour under fault conditions cannot be completely determined), or if there is insufficient data to support claims for failure rates. This paper proposes a modelling method adapted to the evaluation of failure probabilities for systems with uncertain behaviour under fault conditions. To this aim, weighted "continuous gates" are introduced in a fault tree framework. By acting on weight values, it is then allowed to continuously graduate system part architectures between series and parallel structures. An intelligent transmitter is used as example. Probabilities of failure on demand are assessed, with both failure rates and behaviour uncertainty analyses. Results tend to show that the lack of knowledge in system behaviour can be partially handled by this kind of approach. Before starting the SIS realisation phase, the overall safety requirements have been previously developed, as well as the SR allocation and specification. The following inputs are then available:  the safety functions to carry out by the SIS;  the mode of operation of each safety function;  the target failure measures with associated SIL. In the present paper, only the low demand mode of operation is assumed (i.e. the safety function is only performed on demand, and not more than one per year). The target failure measure is then defined by the average probability of dangerous failure on demand of the safety function (PFD avg ), and the associated SIL is determined by Table 1. Note that these definitions stem from IEC 61508, 2009 revision, which are more precise than in the first edition.

The objective of the realisation phase is then to create the SIS conforming to the specification, especially in terms of safety functions and allocating SIL. This paper focuses on system requirements (Part 2), and does not develop software aspects (Part 3). The realisation phase consists of design requirement specification (for subsystems and elements), design and development, integration (software integration refers to Part 3), operation and maintenance, validation, modification, and verification.

In the following sections, the SIS design and development is detailed, according to hardware, systematic, and other safety requirements.

Hardware safety integrity requirements

The requirements for hardware safety integrity contain architectural constraints and random hardware failure quantification. The former are based on:  the hardware fault tolerance (HFT), equal to N if N+1 is the minimum number of faults that could cause a loss of the safety function;  the safe failure fraction (SFF), defined by the ratio of the average failure rates of safe or detected failures by diagnostic tests, to the total failures. These two parameters are then used to determine the maximum allowable SIL for the safety function, according to system type A or B. For example, Table 2 applies to type B systems. Low complexity systems with available significant feedback data are regarded as type A. Conversely, type B systems are defined by at least one of these properties:  the failure mode of at least one constituent component is not well defined;  the behaviour of the system under fault conditions cannot be completely determined;  there is insufficient dependable failure data to support claims for rates of failures for detected and undetected dangerous failures. More insight into architectural constraints is provided by Lundteigen, 2009. SFF has been especially questioned by [START_REF] Innal | An attempt to understand better and apply some recommendations of IEC 61508 standard[END_REF][START_REF] Langeron | Architectural constraints in IEC 61508: Do they have the intended effect?[END_REF]. As a general conclusion, SFF is not an appropriate indicator for safety integrity. An alternative "route" is then proposed by the second edition of IEC 61508. It is based on reliability feedback data from end users, and does not consider SFF (see Table 2, "Route 2 H "). In that case, a special requirement for type B systems is a diagnostic coverage (i.e. proportion of average dangerous failure rates detected by diagnostic tests) equal to or greater than 60%.

Requirements for quantifying the effect of random hardware failures consist of a list a parameters to be taken into account: system architecture, dangerous failure rates which are detected or not by diagnostic tests, diagnostic test coverage and interval, common cause failures, proof tests interval and effectiveness, repair times (if EUC is not maintained in a safe state during repair), and random human error effects. Methods for the target failure measure evaluation are mentioned (e.g. fault trees, reliability block diagrams, Markov models, and Petri nets), and guidelines are given in Part 6, but for information only. Discussions about type B system issues for the evaluation of the average probability of dangerous failure on demand are proposed in Section 3.

Systematic safety integrity requirements

To prevent the introduction of faults during the design and development of the SIS hardware and software, requirements for the avoidance and control of systematic faults (i.e. related in a deterministic way to a certain cause) are introduced. Techniques and measures are given in Part 2: Annexes A and B.

The systematic safety requirements can also be fulfilled by demonstrating that the system is proven in use. Such criteria are discussed by [START_REF] Beurden | Proven-in-use' criteria for safety instrumented systems[END_REF]

Other requirements

Other requirements refer to system behaviour upon detection of a fault (basically, specified actions have to achieve or maintain a safe state of the EUC when a dangerous fault is detected); data communication processes (taking into account transmission errors, repetitions, delays etc.); and special architectures for integrated circuits with on-chip redundancy, if relevant (Part 2: Annex E).

MODEL FOR COMPLEX SYSTEMS

Type B safety-related system issues

The lack of data to support claims for failure rates is an issue which is widely investigated by data uncertainty analyses. For example, [START_REF] Hauptmanns | The impact of reliability data on probabilistic safety calculations[END_REF] compares the use of reliability data stemming from different sources on probabilistic safety calculations, and tends to prove that results do not differ substantially. [START_REF] Wang | The impact of data uncertainty in determining safety integrity level[END_REF] discusses and identifies the inputs that may lead to SIL estimation changes. Propagation of error, Monte Carlo, and Bayesian methods [START_REF] Guérin | Reliability estimation by Bayesian method: definition of prior distribution using dependability study[END_REF] are quite common. Fuzzy set theory is also often used to handle data uncertainties, especially into fault tree analyses [START_REF] Tanaka | Fault-tree analysis by fuzzy probability[END_REF], Singer, 1990). Other approaches are based on evidence, possibility, and interval analyses [START_REF] Helton | An exploration of alternative approaches to the representation of uncertainty in model predictions[END_REF].

The non-low complexity properties, used to describe type B systems (i.e. not well defined failure modes; undetermined system behaviour), are much less investigated in literature. However, research work is focusing on microprocessor or software based safety systems and aims to identify unknown hazards (Garrett, 2002), or evaluating parameters for SIL calculation (Camargo, 2001).

Models used to quantify probabilities of failure require setting the system responses to events (e.g. the choice of gates into fault trees, the state boundaries into Markov diagrams). The behaviour of the system under fault conditions therefore must be completely determined in most of the models, maybe apart from a few fuzzy approaches [START_REF] Pan | Fault Tree Analysis with Fuzzy Gates[END_REF]. Moreover, it is difficult to analyse the impact of model architecture (e.g. fault tree gates, Markov diagram states and transitions) on results in a coherent manner, as it is common to do with input data. In fact, these constraints are usually of a discrete nature and are very significant, since architecture changes could often yield unrealistic configurations.

The next section aims to define a reliability approach which fits the properties of type B systems, and allows both input data (i.e. failure rates) and behaviour uncertainty analyses.

Continuous gate for fault tree

Fault trees, which are equivalent to reliability block diagrams, are common in industry. Moreover, they provide an efficient tool for SIL calculations, under some quantification warnings [START_REF] Signoret | High Integrity Protection Systems (HIPS): Methods and tools for efficient Safety Integrity Levels (SIL) analysis and calculations[END_REF]. A fault tree based approach is therefore chosen in the present paper.

To deal with the uncertain behaviour of systems under fault conditions, a continuous fault tree gate, denoted C-gate, is introduced, and depicted in Figure 1. N basic events E i are given with attributing weights p i . The top-event gate then occurs if at least one of these options is fulfilled:  option 1: any basic event E i occurs and causes, with a probability equal to p i , the top-event gate occurrence;  option 2: all the basic events E i occur. By introducing fictitious events P i which occur with constant probability equal to p i , a C-gate is equivalent to the fault tree given by Figure 2. The "direct" or-gate refers to option 1, and the "logic" and-gate to option 2. Assuming all events independent, let:  F i (t) be the probability that the basic event E i occurs at time t;  p i be the constant probability that the fictitious event P i occurs at time t. The top-event gate probability of occurrence at time t, denoted F top (t), can then be expressed as follows (see proof in Appendix):

               N i i i N i i i top t F p t F p t F 1 1 ) ( ) 1 ( ) ( 1 1 ) ( (1)
Figure 3 plots results of Equation ( 1) with N=3, F i (t)=1-e -0.001•t for i=1,…,N, and the weights p i reported in Table 3.

Note that when all the weights are equal to 0, a Cgate is equivalent to an and-gate (i.e. parallel structure); and when all the weights are equal to 1, a Cgate is equivalent to an or-gate (i.e. series structure). Any coherent system reliability is comprised between parallel (for the most reliable case) and series (for the least reliable case) structure function [START_REF] Rausand | System reliability theory; models, statistical methods, and applications[END_REF]. By acting on the weights, a C-gate then allows continuous graduation of the system architecture (i.e. its behaviour under fault conditions). Moreover, the system analyses can be performed by classical tools, using equivalent fault trees. A transmitter can be described as "intelligent" according to its ability to modify its internal behaviour to optimize data collection and communicate them in a response manner to a host system [START_REF] Brignell | The future of intelligent sensors: A problem of technology or ethics?[END_REF]; and to the bi-directional communication for sending measurement and status information and receiving and processing external commands (IEC, 2006). Moreover, intelligent transmitters take advantage of digital technologies to allow specific functionalities [START_REF] Brissaud | Capteurs intelligents : nouvelles technologies et nouvelles problématiques pour la sûreté de fonctionnement[END_REF]: error measurement correction, selfadjustment, self-diagnosis and validation, on-line reconfiguration, and digital bidirectional communication. Such transmitters integrate programmable units and software, then the consequences of faults or failures on functions are difficult to predict. Intelligent transmitters are therefore examples of type B systems according to their behaviour under fault conditions which cannot be completely determined.

A transmitter for gas concentration measurement by infrared absorption is used as a case study. It is made up of two infrared units: the working unit sends a ray with a proportional wavelength to the gas concentration to be measured; and the reference unit sends a ray which does not respond to the gas. Through a wavelength ratio of the two receiving rays, the gas concentration quantity is obtained with a correction of the optics clogging up (mirror and plane), and power fluctuation of sending rays, if both are in acceptable ranges. Heating elements aim to prevent steam from building up on optics. Temperature is an important gas concentration influencing quantity. Two redundant sensors are therefore used for digital compensation of temperature while being in acceptable ranges. Finally, a data processing unit carries out all processing and calculations.

The safety function analysed in this paper is to measure gas concentration. It consists of obtaining measuring data (rays from working and reference infrared units, through the optics, and temperature) and processing them with appropriate digital corrections. This last function requires off-set and gain drift parameters which are defined by self-adjustments.

Fault tree for intelligent transmitter

A fault tree for the infrared gas transmitter example, using C-gates, is given by Figure 4. To deal with interactions between functions and material elements, a "3-step" approach is proposed [START_REF] Brissaud | Capteurs intelligents : nouvelles technologies et nouvelles problématiques pour la sûreté de fonctionnement[END_REF]. That is, the safety function to be evaluated (measure gas concentration) is broken up into subfunctions (obtain measuring data and process measuring data) and supporting functions (self-adjustment) which impact the former (self-adjustment aims to define parameters which are then used by the measuring data processing).

The second step of the fault tree represents the material elements which are required by the functions. Some elements are more critical than others for function fulfilments (attributed weights in C-gates differ). For example, temperature sensors are almost always essential to self-adjustment (this property is due to the algorithm of off-set and gain drift definition, which requires temperature as a main parameter), whereas in some cases, a failure of these sensors still allows obtaining of efficient measuring data (e.g. when temperature compensation is not significant). Similarly, depending on the failure of the data processing unit, it can yield a direct malfunction of the measuring data processing, or only an error in selfadjustment, which may also impact the measuring data processing as an indirect relationship.

The last step is a list of all potential faults and failures that the system may experience. Failures can be independent (i.e. impact only one element), or common to several material elements. Note that some faults or failures may have undetermined consequences on material elements, for example, due to not well defined failure modes (e.g. the degree of clogging up leading the optics into a failed state), or environmental constraints which are difficult to predict at any time (the loss of optic heating may have no impact on the system if, at that moment, the temperature and humidity are suitable).

Fault tree analyses

The weight values used for the C-gates are given in Table 4 (column "Base value"). The probability of fault or failure i at time t (i.e. occurrence of basic event D i , see Figure 4), with i=1,…,9, is equal to F i (t)=1-e -λi•t with λ i being the rate of fault or failure i, given in Table 5 (column "Base value").

The following assumptions are made:  only dangerous failures which are not detected by online diagnostic test are taken into account;  no maintenance action is performed in time interval [0, 12 months];  at the end of the 12 th month, test and maintenance actions are performed in such a way that the system is restored to an as good as new condition. The fault tree analyses are performed using equivalent fault trees (see Figure 2), and SimTree, the fault tree module of the Aralia WorkShop software tool, distributed by Dassault Systemes. 249 minimal cut sets (MCS) have been obtained and are arranged by orders in Table 6. Probability of failure on demand of the safety function measure gas concentration (i.e. occurrence of the top-event gate MGC, see Figure 4) at time t, denoted PFD(t), is depicted in Figure 5. The average value on time interval [0, 12 months], denoted PFD avg , is equal to 8.73•10 -3 and is also reported in Figure 5. According to Table 1, the safety function therefore fulfils SIL 2. 4.0•10 -7 log-Normal 4.0•10 -7 3.2•10 -14 λ 2

1.0•10 -7 log-Normal 1.0•10 -7 2.0•10 -15 λ 3 4.0•10 -7 log-Normal 4.0•10 -7 3.2•10 -14 λ 4

1.0•10 -6 log-Normal 1.0•10 -6 2.0•10 -13 λ 5

3.0•10 -6 log-Normal 3.0•10 -6 1.8•10 -12 λ 6 5.0•10 -7 log-Normal 5.0•10 -7 4.9•10 -14 λ 7

1.5•10 -7 log-Normal 1.5•10 -7 4.5•10 -15 λ 8 5.0•10 -7 log-Normal 5.0•10 -7 4.9•10 -14 λ 9

5.0•10 -7 log-Normal 5.0•10 -7 4.9•10 -14 __________________________________________________ * the parameters {µ,σ} of the log-Normal distributions are equal to {ln(mean)-σ 2 /2,ln(EF)/1.645}, with EF=5

Uncertainty analyses

System behaviour uncertainty can be translated into uncertainties in C-gate weight values (see Section 3.2). Uniform distributions are used to represent the uncertainties in weight values, according to weight type (i.e. low, medium, high), as reported in Table 4 (column "Uncertainty analysis"). It is assumed that extreme values (i.e. low and high weights) are more uncertain than the middle value (i.e. medium weight), as shown by the variances. Note also that these distributions are defined in such a way that the expectancies are equal to the base values.

To represent the uncertainties in failure rates, log-Normal distributions are more common. The parameters are defined in order to have a mean value equal to the base value, and an error factor equal to 5 (i.e. the lower and upper bounds of the 90% centred confidence interval are obtained by dividing and multiplying the median value by 5, respectively).

The uncertainty analyses are performed by Monte Carlo simulations. To make calculations faster, it is assumed that the PFD(t) is a linear function according to time, in interval [0, 12 months] (see Figure 5, the coefficient of determination has been computed at one minus 1.39•10 -5 ). The PFD avg can therefore be obtained by the following approximation: (2)

The three uncertainty configurations which are described in Table 7 are analysed. For each of them, 1,000,000 draws of Monte Carlo simulations have been performed to obtain several PFD avg results by Equation (2). The resulting probability density functions of PFD avg are depicted in Figure 6. The means and variances are given in Table 8 with the probability of being in SIL 2 or SIL 1, according to Table 1.

Note that in all of these configurations, the means are nearly equal to the PFD avg value obtained in Section 4.3. The variances are of 10 -5 to 10 -6 order, and the probabilities of SIL fulfilments are very close among the configurations. Moreover, assuming the uncertainties in failure rates, the addition of system behaviour uncertainties does not have a significant effect. The previous analyses have shown that taking system behaviour uncertainties into account leads to an average probability of failure on demand with a relatively small variance (orders of magnitude lower than any of the weight variances). These results therefore tend to show that the uncertainties in inputs have not been increased through the proposed model but, on the contrary, are even sometimes partially mitigated. To give some explanations, the two operators used in the fault tree analyses (relating to an and-gate and to an or-gate) are investigated in this section, according to the expectancies E [.], and the variances V [.].

Let p a and p b be two independent random variables (in accordance with the hypotheses given in Section 3.2), then:

      b a b a p E p E p p E    (3)               b a a b b a b a p V p V p V p E p V p E p p V        2 2 (4)       b a b a p E p E p p E    (5)                   b a a b b a b a p V p V p V p E p V p E p p V         2 2 1 1  (6)
With the following operator:

) 1 ( ) 1 ( 1           (7)
Equations ( 3) and ( 5) explain that the mean values of PFD avg obtained in Section 4.4 are nearly equal to the value obtained in Section 4.3. Moreover, the following statements can be deduced from Equations ( 4) and ( 6), (see proof in Appendix):

                      1 , max 1 , min 2 2       b a b b a a b a b a p V p V p V p E p V p E p V p V p p V (8)                           b a b b a a b a b a p V p V p V p E p V p E p V p V p p V , max 1 1 1 , min 2 2        (9)
Equations ( 8) and (9) give the necessary and sufficient conditions on two input random variables so that the corresponding operation gets a lower variance than any of the inputs. Because these conditions are often fulfilled by the random variables of Tables 4 and5, resulting variances of PFD avg are relatively small. Due to dependencies between MCS, it is, however, difficult to recursively apply Equations ( 4) and ( 6) to obtain PFD avg variance by calculations.

CONCLUSION

This paper has presented safety requirements for the SIS design in accordance with IEC 61508. Special issues of type B systems are discussed. While several research works have been undertaken to deal with uncertainties in failure rates for reliability evaluation, modelling the uncertain behaviour of the system under fault conditions has been less investigated. This paper therefore proposes a modelling method adapted to the evaluation of failure probabilities for these complex systems.

Within the fault tree modelling framework, the key feature of the method is the use of weighted "continuous gates". By acting on the weight values, it is possible to continuously graduate the system part architecture between parallel and series structures. The behaviour of the system under fault conditions is therefore parameterised so that the uncertainty on the system architecture can be translated into a parametric uncertainty. Moreover, such analyses can be performed by classical fault tree tools using equivalent fault trees with classical gates and fictitious events.

An intelligent transmitter is used as example. The probability of failure on demand is assessed, and both failure rates and behaviour uncertainty analyses are performed by Monte Carlo simulations. The resulting average probabilities of failure on demand are used to determine the probability of safety integrity level (SIL) fulfilment, according to IEC 61508, and taking the undetermined system behaviour under fault conditions into account. The resulting uncertainties in probabilities of failure are orders of magnitude lower than the uncertainties in any of the input weights, as shown by the variance results. Some discussions are proposed to give some explanations of this property. These analyses therefore tend to show that the lack of knowledge in system behaviour can be accounted for and partially compensated for by this kind of fault tree, in order to evaluate probabilities of system failure on demand. ) ( And, according to notations given in Section 3.2:

               N j i N i i N i i i top p t F t F p t F 1 1 1 ) 1 ( ) ( ) ( 1 1 ) (                N i i i N i i i top t F p t F p t F 1 1 ) ( ) 1 ( ) ( 1 1 ) (

Proof of (8)

According to (7):

              1 1 2 2       b b b a a a b a p V p E p V p V p E p V p p V               1 1 2 2       b b a a a p b a p V p E p V p V p E p V p p V Then:                       1 , max 1 , min 2 2       b a b b a a b a b a p V p V p V p E p V p E p V p V p p V

Figure 1 .

 1 Figure 1. C-gate for fault tree

Figure 2 .

 2 Figure 2. Equivalent fault tree for C-gate

Figure 6 .

 6 Figure 6. Probability density function of PFD avg according to the configurations given inTable 8, obtained by Monte Carlo simulations, after smoothing

Table 1 .

 1 SIL and corresponding target failure measures for a safety function operating in low demand mode

	______________________________________________
	SIL	Average probability of dangerous failure
	of the safety function on demand (PFD avg ) ______________________________________________ SIL 4 10 -5 ≤ PFD avg < 10 -4 SIL 3 10 -4 ≤ PFD avg < 10 -3 SIL 2 10 -3 ≤ PFD avg < 10 -2 SIL 1 10 -2 ≤ PFD avg < 10 -1 ______________________________________________
	2 DESIGN IN ACCORDANCE WITH IEC 61508
	2.1 Inputs and objectives of the realisation phase

Table 2

 2

	. Maximum allowable SIL for a safety function
	carried out by a type B safety-related system ______________________________________________
	Safe failure fraction (SFF) Hardware fault tolerance (HFT) ________________________
	0 ______________________________________________ 1 2
	SFF < 60%	-	SIL 1	SIL 2
	60% ≤ SFF < 90%	SIL 1	SIL 2	SIL 3
	90% ≤ SFF < 99%	SIL 2	SIL 3	SIL 4
	99% ≤ SFF ______________________________________________ SIL 3 SIL 4 SIL 4
	Route 2 H * ______________________________________________ SIL 1-2 SIL 3 SIL 4
	*Alternative route proposed by IEC, 2009

Table 4

 4

	. Weight values __________________________________________________
	Type*	Name Base value	Uncertainty analysis _________________________
	law** __________________________________________________ mean variance low p L 0.10 U[0.0, 0.2] 0.10 3.3•10 -3 medium p M 0.50 U[0.2, 0.8] 0.50 3.0•10 -2 high p H 0.90 U[0.8, 1.0] 0.90 3.3•10 -3 __________________________________________________
	* see Figure 4 caption
	** U[a, b] is a uniform distribution between a and b
	Table 5. Failure rates __________________________________________________
	Name __________________________________________________ Base value Uncertainty analysis _____________________________ [hour -1 ] law* mean variance
	λ 1

Table 6 .

 6 Minimal cut sets (MCS) arranged by orders

	__________________________________________________
	Order __________________________________________________ Number of MCS Cumulative number of MCS
	1	000	000
	2	000	000
	3	007	007
	4	038	045
	5	050	095
	6	100	195
	7	042	237
	8 __________________________________________________ 012 249
	Table 7. Uncertainty analysis configurations __________________________________________________
	Configuration __________________________________________________ Uncertainty analysis on
	Config.1		Failure rates only
	Config.2		System behaviour (i.e. weight values) only
	Config.3 __________________________________________________ Failure rates and system behaviour

Table 8 .

 8 Uncertainty analysis results, obtained by 1,000,000

	Monte Carlo simulations __________________________________________________
	Configuration __________________________________________________ Mean Variance P[SIL2] P[SIL1] Config.1 8.69•10 -3 1.5•10 -5 0.74 0.26 Config.2 8.73•10 -3 2.9•10 -6 0.78 0.22 Config.3 8.68•10 -3 2.0•10 -5 0.74 0.26 __________________________________________________

Figure 5. Probability of dangerous failure on demand at time t, PFD(t), and on average, PFD avg

Table 8 ,

 8 obtained by Monte Carlo simulations, after smoothing


Florent Brissaud

Probability of Failure of Safety-Critical Systems Subject to Partial Tests

Keywords: full tests, partial tests, probability of failure on demand, proof tests, safety instrumented systems

A set of general formulas is proposed for the probability of failure on demand (PFD) assessment of MooN architecture (i.e. k-out-of-n) systems subject to proof tests. The proof tests can be partial or full. The partial tests (e.g. visual inspections, partial stroke testing) are able to detect only some system failures and leave the others latent, whereas the full tests refer to overhauls which restore the system to an as good as new condition. Partial tests may occur at different time instants (periodic or not), up to the full test. The system performances which are investigated are the system availability according to time, the PFD average in each partial test time interval, and the total PFD average calculated on the full test time interval.

Following the given expressions, parameter estimations are proposed to assess the system failure rates and the partial test effectiveness according to feedback data from previous test policies. Subsequently, an optimization of the partial test strategy is presented. In the 2oo6 system given as example, an improvement of about 10% of the total PFD average has been obtained, just by a better (non-periodic) distribution of the same number of partial tests, in the full test time interval.

INTRODUCTION

The safety instrumented systems (SIS) play a major part in industrial risk management as safety barriers. A SIS aims at performing at least one safety function to achieve or maintain a safe state of equipment under control (EUC), in respect of a specific hazardous event. Due to the critical role of SIS for health, environment, and goods, functional safety standards have been developed as, for example, the IEC 61508 [START_REF]IEC 61508 Functional safety of electrical / electronic / programmable electronic safety-related systems[END_REF] and the ANSI/ISA S84.00.01-2004 [START_REF]Functional safety: Safety Instrumented Systems for the Process Industry Sector[END_REF]. A framework is then introduced to consider the overall system and software safety lifecycle and some requirements aim at avoiding the systematic failures. In the realization phase, the safety integrity level (SIL) is determined with respect to the random hardware failures. For a SIS operating in a low demand mode (i.e. the safety function is only performed on demand, and not more than once per year), the used criterion is the average probability of system failure to perform its safety function on demand. It corresponds to the mean system unavailability, calculated on the full test time interval, and denoted PFDavg.

According to IEC 61508 [START_REF]IEC 61508 Functional safety of electrical / electronic / programmable electronic safety-related systems[END_REF] and to the assumptions given afterwards, different characteristics have to be taken into account for PFDavg assessment: system architecture, failure rates, proof test intervals and effectiveness. In the present paper, a proof test is described as "partial" if it is imperfect, that is, it is able to detect only some system failures and leave the others latent. Visual inspections and partial stroke testing are examples of such partial tests. When a proof test is perfect (i.e. its effectiveness is equal to one), it is described as "full" and refers to overhauls which restore the system to an as good as new condition. Even if partial tests are less effective, they can be preferred to the full tests for several reasons:  Full tests are generally physical (e.g. stimulation of sensing elements), costly and time consuming. They may sometimes be substituted by electronic tests (e.g. electronic simulation) but do not cover all the failures.  Full tests often imply stopping production (e.g. power supply cut, flow stop by safety valves), sometimes unacceptable for industrialists. Partial tests (e.g. quarterturn valve closure) are therefore preferred.  Some safety devices cannot be fully tested without degradations or destructions (e.g. one shot devices).  Only real conditions testing can pretend to be full and, in many cases, may provoke more hazards than prevention (e.g. fire, toxic gas, or overpressure detection). Methods for PFDavg assessment are mentioned in [START_REF]IEC 61508 Functional safety of electrical / electronic / programmable electronic safety-related systems[END_REF] (e.g. fault trees, reliability block diagrams, Markov models) but none of them is prescribed. These techniques are compared and discussed in [START_REF] Rouvroye | New quantitative safety standards: different techniques, different results?[END_REF]- [START_REF] Bukowski | A comparison of techniques for computing PFD average[END_REF]. For example, a Markov model is used in [START_REF] Zhang | Availability of systems with self-diagnosis components-applying Markov model to IEC 61508-6[END_REF] and reliability block diagrams in [START_REF] Guo | A simple reliability block diagram method for safety integrity verification[END_REF], but both of them ignore the partial tests. The use of such tests can be regarded as a kind of imperfect preventive maintenance. Various methods and optimal policies for imperfect maintenance have been discussed in [START_REF] Pham | Imperfect maintenance[END_REF]. For example, some approaches set a constant probability that a preventive maintenance is perfect or imperfect [START_REF] Brown | Imperfect repair[END_REF]- [START_REF] Nakagawa | Optimal policies for a system with imperfect maintenance[END_REF].

More specifically, a probability that a failure remained undiscovered after testing is assumed in [START_REF] Badía | Optimal inspection and preventive maintenance of units with revealed and unrevealed failures[END_REF], but only for a single unit. References [START_REF] Rouvroye | New quantitative safety standards: different techniques, different results?[END_REF]- [START_REF] Rouvroye | Comparing safety analysis techniques[END_REF] claim that enhanced Markov analyses cover most aspects relevant for safety quantification. The use of Markov models is also defended in [START_REF] Bukowski | A comparison of techniques for computing PFD average[END_REF]. Because partial and full tests usually occur at deterministic time instants (e.g. periodically), basic Markov models are not appropriate [START_REF] Bukowski | Modeling and analyzing the effects of periodic inspection on the performance of safety-critical systems[END_REF] and extended Markov models have been developed [START_REF] Bukowski | Modeling and analyzing the effects of periodic inspection on the performance of safety-critical systems[END_REF]- [START_REF] Kumar | Modeling demand rate and imperfect proof-test and analysis of their effect on system safety[END_REF]. Similar approaches have been used for cost optimization [START_REF] Wang | Determining the optimal production maintenance policy with inspection errors: using a Markov chain[END_REF].

In the present paper, a set of general formulas, given in a neat form and easy to compute, has been obtained by analytical approaches. These expressions are proposed to assess the availability of MooN architecture (i.e. k-out-of-n) systems made up by homogeneous components (i.e. components with identical failure rates), and subject to partial and full tests. The partial tests may occur at different time instants (periodic or not), up to the full test. Section 2 presents the assumptions, notations, and formulas. An application is then given in Section 3 for parameter estimations, PFDavg assessment, and optimization of the partial test distribution.

PFD ASSESSMENT

General Assumptions

 All failures taken into account are dangerous and only detected by partial or full tests.  The system is made up by N components which are independent and have identical and constant failure rates.  The system has a MooN architecture i.e. it is made up by N components and it is able to perform its safety function if any M or more components among N are in an operating state (i.e. M-out-of-N system).  The N components of the system are in an operating state at time t 0 .  The partial tests are able to detect only some specific failures of each component of the system.  The full tests are able to detect all the failures of each component of the system.  All components are tested together during any test.  When a failure is detected by a partial or a full test, it is repaired immediately. During test and maintenance actions, measures are performed to maintain the EUC in a safe state in such a way that any test or maintenance duration is not included in the analyses.  After each full test, the system is restored to an as good as new condition. The PFDavg can therefore be assessed according to the full test time interval.

Notations

MooN system architecture, with M ≤ N λ failure rate of any of the N components which compose the system A e (t) availability function of any of the N components which compose the system i.e. probability that the component is in an operating state at time t A(t) availability function of the system i.e. probability that the system is able to perform its safety function at time t U(t) unavailability function of the system i.e. U(t)=1-A(t) t i time instant of the i th test (which can be partial or full), with the initial condition t 0 =0 T i time interval between the (i-1) th and the i th test i.e. 1. A system is defined by the set {M, N, λ}, and a test policy can be either defined by the set {E, t 1 , t 2 , …, t n } or by the set {E, T 1 , T 2 , …, T n }.

T i =t i -t i

General Formulas

For each component, a part with a failure rate equal to E•λ is testable by any partial or full test, and another part with failure rate equal to (1-E)•λ is only testable by the full tests. The corresponding reliability block diagram (RBD) is then given in Figure 2, and (see proof in Appendix):

t t E e e e t A i          1 ) ( for   i i t t t , 1   (1)
The availability function of the system is therefore, (see proof in Appendix):

                  N M x t x t E x e e x N M S t A i   1 ) , , ( ) ( for   i i t t t , 1   (2)
With the following time-independent sum (see Table I): The average probabilities of the system failure to perform its safety function on demand, in the time interval between the (i-1) th and the i th test, and in the full test time interval, are therefore (see proof in Appendix):

                               x M k k x k x x N x N M S 1 ) , , ( for N M x ,...,  (3)
                              N M x i T x t E x i T x e e x N M S PFD i i    1 ) , , ( 1 1 1 (4)
                                      N M x n i T x t E x avg x e e x N M S PFD i i 1 1 1 ) , , (
1 1     (5)
When λ•τ is small (i.e. λ•τ << 10 -2 ), the following approximations can be done, using the Taylor's theorem:

t t E t A i e          1 1 ) ( for   i i t t t , 1   (6)   1 1 1 1 1 ) (                     M N i M N t E t M N t A  for   i i t t t , 1   (7)         2 1 2 1 1 1 1 2 1                             M N i M N i i i M N i E t t E t T M N M N PFD  (8)                                       n i M N i M N i i M N avg E t t E t M N M N PFD 1 2 1 2 1 1 1 1 2 1   (9)

Special Case: Without Partial Test

Without partial test, (2), ( 7), [START_REF] Bukowski | A comparison of techniques for computing PFD average[END_REF], and (9) become: 2), ( 7), [START_REF] Bukowski | A comparison of techniques for computing PFD average[END_REF], and (9) therefore become:

       N M x t x w e x N M S t A  ) , , ( ) ( ) ( for    , 0  t (10)   1 ) ( 1 1 ) (                M N w t M N t A  for    , 0  t (11)                  N M x x w avg x e x N M S PFD     1 ) , , ( 1 )
( (12)   2 1 1 ) (                 M N M N PFD M N w avg   (13) N=1 N=2 N=3 N=4 M=1 1 2 / -1 3 / -3 / 1 4 / -6 / 4 / -1 M=2 1 3 / -2 6 / -8 / 3 M=3 1 4 / -3 M=4 1 Table 1 -S(M,
               N M x t x T i E x p e e x N M S t A   0 1 ) ( ) , , ( ) ( for     0 0 , 1 T i T i t     (14)     1 0 1 ) ( 1 1 1 ) (                      M N M N p T i E t M N t A  for     0 0 , 1 T i T i t     (15)                                         N M x n i T i E x T x p avg e n T x e x N M S PFD 1 1 1 0 ) ( 0 0 1 1 ) , , ( 1
   (16)                                            1 0 2 2 1 0 ) ( 1 1 1 1 2 1 n j M N M N M N p avg E j E j n M N T M N PFD  (17)

APPLICATION

Case Study

A system for oxygen concentration measurement is used as case study. It takes part of an inerting system which aims to reduce the oxygen level in atmospheric air by introducing nitrogen in controlled amounts. The oxygen concentration is maintained below a high level which does not allow the fire breaking out, and above a low level which remains the place accessible to people. To control the oxygen concentration, six oxygen transmitters are used. Because the nitrogen is quickly and heterogeneously distributed into the air space, these six transmitters are assumed redundant. The safety function then consists in detecting a low or a high oxygen level, according to a 2oo6 architecture. Two transmitter test procedures are recommended by the manufacturer:  Every year: control of the measurements and, if required, followed by adjustment i.e. full test.  Occasionally: visual inspections and some electronic checks i.e. partial test.

For cost reasons, all the six transmitters are tested together during any test. The basic test policy consists of a full test every year and a partial test every three months.

Figure 3 -PFD for the case study, according to the basic test policy

The first step of the application uses feedback data from the partial and full tests, in order to estimate the transmitter failure rates, and the partial test effectiveness. Then, the probabilities of system failure are assessed according to this basic test policy. Subsequently, the partial test distribution is optimized in order to reduce the PFDavg.

Parameters Estimation and PFD Assessment

During the i th test of each transmitter, the probability to observe a failure is, according to the RBD given in Figure 2:

i i T E Obs     for   1 ,..., 1   n i (18)             E T E Obs i i 1 for n i  (19)
Moreover, because a number of components k i among K have been observed in a failed state during the i th test, an intuitive and empirical estimator of Obs i is:

K k Ôbs i i  for n i ,..., 1  (20)
The following estimators for the failure rate λ and the partial test effectiveness E can be deduced from ( 18)-(20):

           n i i k K 1 1 ˆ  (21)               n i i n i i n k k t Ê 1 1 1 1  (22)
The observations k i follow a binomial distribution. Confidence intervals for the estimations given by ( 21) and ( 22) can therefore be obtained using Fisher distributions [START_REF] Rausand | System Reliability Theory: Models, Statistical Methods, and applications -Second Edition[END_REF].

Assuming four installations, each of them using six oxygen transmitters, for a time period equal to four years, the equivalent total number of transmitters observed during each test is thus K=4•6•4=96. A total number of k 1 +k 2 +k 3 =16 transmitter failures have been observed during the partial tests, and k 4 =35 transmitter failures during the full tests. According to (21) and ( 22), the transmitter failure rate λ is estimated at 6.1•10 -5 hour -1 , and the partial test effectiveness E at 0.42.

According to [START_REF] Rausand | System Reliability Theory: Models, Statistical Methods, and applications -Second Edition[END_REF], equivalent to (5) for periodic partial tests, the PFDavg is then equal to 2.06 •10 -3 . For the present case study, the partial tests have reduced the PFDavg by a factor of five, compared to the result without partial test given by [START_REF] Bukowski | Modeling and analyzing the effects of periodic inspection on the performance of safety-critical systems[END_REF]. The probabilities of system failure, according to this basic test policy, are depicted in Figure 3.

Optimization of the Partial Tests Distribution

An optimization of the test policy consists in distributing the same number of partial tests, inside the full test time interval, in order to minimize the PFDavg. When the costs related to the partial tests are independent of the time instants, this approach may improve the system safety without additional cost, provided that the test times are optimally chosen.

The optimal partial test time instants are denoted t i * with i=1,…,(n-1), and the optimal partial test time intervals are denoted

T i * with T i * =t i * -t i-1 *
. The optimized test policy is then obtained by solving the following equation:

    avg t t t n PFD t t t n 1 2 1 ... * 1 * 2 * 1 min arg , ... , ,       (23)
With the PFDavg as defined by [START_REF] Bukowski | A comparison of techniques for computing PFD average[END_REF]. For the present case study, the optimal partial test time instants and the corresponding partial test time intervals, obtained by solving (23), are reported in Table 2 (last row).

Using this optimized test policy, and according to (5), the PFDavg is now equal to 1.87 •10 -3 , that is a reduction of about 10% compared to the result with the basic (periodic) test policy. Moreover, further analyses show that the maximum system unavailability in the full test time interval has been reduced by more than 25%. The probabilities of system failure, according to this optimized test policy, are depicted in Figure 4. By introducing general formulas for the probability of failure on demand (PFD) assessments of MooN architecture systems subject to partial and full tests, the proposed work provides practical tools for risk management. The neat form of the proposed exact and approximate expressions allows the system and test policy performances to be estimated and optimized quite simply and directly. It has been particularly shown that the average probability of system failure to perform its safety function on demand (PFDavg) can be reduced, just by a better (non-periodic) distribution of an appointed number of partial tests. Thus offering good prospects are for safety improvement without additional cost.

Test

Most of the general assumptions given in Section 2.1 are easily fulfilled when measures are performed to maintain the EUC in a safe state during test and maintenance actions. However, some other aspects should be generalized in order to be applicable to a wider field of applications, as for example:  Systems with heterogeneous components (i.e. components with different failure rates).  Systems subject to common cause failures.  Systems with extended MooN architectures (e.g. MooN architecture parts into each other, capacitated systems).  Aging systems.  Stochastic test policies, etc.

Most of these previous cases can be solved using a similar reasoning as proposed in this paper (see Appendix), but make the general formulas sometimes much more difficult to grasp. Another prospect for development concerns the staggered tests which allow for reducing probabilities of system failure by testing the system components at different time instants [START_REF] Rouvroye | Minimizing costs while meeting safety requirements: Modeling deterministic (imperfect) staggered tests using standard Markov models for SIL calculations[END_REF].

APPENDIX

The following results are for t i-1 ≤ t < t i with i=1, …, n.  Proof of (1): according to the RBD given in Figure 2:

    t t E t E t t E e e e e e t A i i                       1 1 1 ) ( (24)
 Proof of (2): according to [START_REF] Rausand | System Reliability Theory: Models, Statistical Methods, and applications -Second Edition[END_REF]:

                       N M k k N e k e t A t A k N t A ) ( 1 ) ( ) ( (25)                                          N M k k N t t E t k t E k e e e e k N t A i i     1 1 1 ) ( (26)
Using the Newton's binomial theorem:

                                                                                      N M k k N l t l k N t E l k N l k N t k t E k e e l k N e e k N t A i i 0 1 1 1 ) (     (27)                                                        N M k k N l t l N t E
                               x M k k x k x x N x N M S 1 ) , , ( (32)
 Proofs of (4):

           i i i i t t i t t i i dt t A T dt t U T PFD 1 1 ) ( 1 1 ) ( 1 (33)

Figure 1 -

 1 Figure 1 -Notation, example with n = 4

Figure 2 -

 2 Figure 2 -Reliability Block Diagram (RBD) for any of the N components which compose the system

  N,M) / S(M,N,M+1) / … / S(M,N,N) values for some MooN architectures 2.5 Special Case: With Periodic Partial Tests Partial tests are periodic if T i =T 0 for i=1,…,n, then t i =i•T 0 for i=1,…,n. Formulas (

Figure 4 -

 4 Figure 4 -PFD for the case study, according to the optimized test policy

Table 2 -

 2 Results summary

BIOGRAPHIES


Florent Brissaud
email: florent.brissaud@ineris.fr

Anne Barros

Christophe Bérenguer

Improving availability and safety of control systems by cooperation between intelligent transmitters

Keywords: Availability, Distributed Control Systems, Networked Control Systems, Intelligent Transmitters

Intelligent transmitters" taking part in distributed and networked control systems are considered. Such sensor systems are able to perform internal data processing, advanced functionalities (e.g. self-diagnoses, online reconfiguration), and to exchange information. A control system made up of cooperating transmitters is therefore presented, using procedures which aim to improve system availability and safety. Taking advantage of the information exchanged between transmitters, two algorithms are proposed in order to i) retain the most confident values for transmitter processing, and ii) perform diagnoses by result comparisons. The control system is modelled by stochastic and coloured Petri nets, and dependability evaluations are performed by Monte Carlo simulations. Availability and safety can be put in balance through the use of the proposed algorithms, and both criteria can be improved under some conditions, notably according to diagnostic coverage of failures.

INTRODUCTION

Continuous progress in microelectronics and micromechanics is enabling systems to integrate more and more abilities into smaller and smaller packages. Industrial examples are the sensor systems: primarily used to collect data from the physical world, they are now also able to perform internal data processing and other functionalities like error measurement corrections, self-adjustment, selfdiagnoses, online reconfigurations, and digital bidirectional communication [START_REF] Brissaud | Dependability Issues for Intelligent Transmitters and Reliability Pattern Proposal[END_REF]. These systems therefore appropriately refer to "transmitters" instead of "sensors," because the latter simply pertain to an ability to convert quantities. The use of such transmitters with "embedded intelligence" in control systems then allows the spatial relocation of some operations previously performed by a central controller, throughout the system, forming a distributed control system (DCS). In addition, in a networked control system (NCS), the elements of a DCS (transmitters, actuators, controllers, etc.) are interconnected by a real-time communication network [START_REF] Wang | Networked Control Systems -Theory and Applications[END_REF]. Network protocols and fieldbuses for industrial control include Controller Area Network (CAN), Profibus, Foundation Fieldbus, and Device-Nets [START_REF] Tipsuwan | Control methodologies in networked control systems[END_REF]. A special kind of NCS involves wireless sensor networks (WSN) [START_REF] Akyildiz | A survey on sensor networks[END_REF][START_REF] Yick | Wireless sensor network survey[END_REF], but such systems introduce specific issues which are outside the scope of the present paper.

The defining feature of an NCS is that information (e.g. references, measurements, control signals) is exchanged using a network among control system elements (transmitters, actuators, controllers, etc.) [START_REF] Zhang | Stability of Networked Control Systems[END_REF][START_REF] Gupta | Overview of Networked Control Systems[END_REF], by contrast with the traditional point-to-point connections. The use of a network also enables remote control and data transfers [START_REF] Gupta | Overview of Networked Control Systems[END_REF][START_REF] Tipsuwan | Control methodologies in networked control systems[END_REF]. NCS then provide many advantages, such as lower system complexity, reduced wiring cost, ease of maintenance, and flexibility, which bring these systems into several applications such as manufacturing, automobile, and aircraft [START_REF] Gupta | Overview of Networked Control Systems[END_REF]. On the other hand, drawbacks are the network-induced delays and packet dropouts, which may cause instability and affect NCS performance [START_REF] Hespanha | A Survey of Recent Results in Networked Control Systems[END_REF][START_REF] Zhang | Stability of Networked Control Systems[END_REF][START_REF] Ge | Survey on the stability of networked control systems[END_REF][START_REF] Lian | Network Design Consideration for Distributed Control Systems[END_REF][START_REF] Tipsuwan | Control methodologies in networked control systems[END_REF][START_REF] Branicky | Stability of Networked Control Systems: Explicit Analysis of Delay[END_REF]. The time delays come from the time sharing of the communication medium as well as the computation time required for communication processing [START_REF] Lian | Network Design Consideration for Distributed Control Systems[END_REF][START_REF] Ge | Survey on the stability of networked control systems[END_REF]. Packet dropouts are data lost while in transit through the network, typically resulting from transmission errors or buffer overflows [START_REF] Hespanha | A Survey of Recent Results in Networked Control Systems[END_REF]. Many research works therefore focus on NCS stability in order to guarantee constant transmission times, minimize or compensate delays, and analyse the effects on system performances [START_REF] Zhang | Stability of Networked Control Systems[END_REF][START_REF] Ge | Survey on the stability of networked control systems[END_REF][START_REF] Branicky | Stability of Networked Control Systems: Explicit Analysis of Delay[END_REF].

In the context of industrial risk management, the most relevant NCS (or DCS) performance criteria relate to dependability. A generic framework on communication network dependability is provided by an international standard still under study [12]. An overview of the dependability constraints related to fieldbuses (problems of temporal coherence and traffic characteristics) can be found in the literature [START_REF] Cauffriez | Design of intelligent distributed control systems: a dependability point of view[END_REF]. Corresponding failure modes and effects analyses (FMEA) have been also proposed [START_REF] Cauffriez | Design of intelligent distributed control systems: a dependability point of view[END_REF]. Several other dependability analyses focus particularly on CAN protocol, for example to study the response time under transmission errors, using deterministic [START_REF] Tindell | Calculating controller area network (CAN) message response times[END_REF] or stochastic [START_REF] Navet | Worst-case deadline failure probability in real-time applications distributed over controller area network[END_REF] models; or to study the effects of errors [START_REF] Pérez | Stability of Networked Control Systems: Explicit Analysis of Delay[END_REF], using fault injection techniques. The electromagnetic interferences are the most common (transient) faults taken into account. Assuming both transient and permanent faults, a dependability evaluation of fieldbus networks has been also proposed [START_REF] Portugal | A framework for dependability evaluation of fieldbus networks[END_REF], using stochastic Petri nets (SPN). With consideration for an application, the network behaviour under transmission errors has been likewise modelled by stochastic activity networks (SAN), a flexible extension of SPN, to evaluate NCS dependability [START_REF] Ghostine | Dependability evaluation of networked control systems under transmission faults[END_REF]. The quantitative analyses are then performed by Monte Carlo simulations. Notice that, in these previous works, the focus is only given on the network, and failures of NCS (or DCS) elements such as transmitters and actuators are not assumed.

More global dependability analyses consider both the communication network and the NCS (or DCS) elements. For example, scenarios leading to NCS failures are analysed taking probabilities of message losses into account [START_REF] Barger | Safety analysis and reliability estimation of a networked control system[END_REF]. To this end, coloured Petri nets (CPN) followed by Monte Carlo simulations are used. However, except for the communication, the transmitters and actuators modelled in the latter work cannot really be described as "intelligent". For example, only two functions are assumed for a transmitter: to measure and to communicate; and the only failure mode consists in the transmission of an error message instead of the measurement, according to a constant probability. Similar limitations of the "intelligent features" of transmitters and actuators are considered in other non-Petri-based approaches for NCS (or DCS) dependability analyses [START_REF] Dai | A study of service reliability and availability for distributed systems[END_REF][START_REF] Conrard | Distributed system design based on dependability evaluation: a case study on a pilot thermal process[END_REF]. On the other hand, the reliability of "intelligent transmitters" has been analysed [START_REF] Brissaud | Reliability Study of an Intelligent Transmitter[END_REF][START_REF] Brissaud | Reliability analysis for new technology-based transmitter[END_REF], but without regard to networked systems, and relating interactions between control system elements are thus ignored.

Finally, NCS (or DCS) dependability studies can be found in the literature with respect to the fault tolerant control (FTC) strategies [START_REF] El-Farra | Fault-Tolerant Control of Process Systems Using Communication Networks[END_REF][START_REF] Mao | Fault identification and fault-tolerant control for a class of networked control systems[END_REF], which aim at guaranteeing the system goal to be achieved in spite of faults, especially in order to improve system reliability and safety [START_REF] Campelo | Hierarchical reliability and safety models of fault tolerant distributed industrial control systems[END_REF], and for example under cost constraints [START_REF] Wattanapongsakorn | Reliability Optimization Models for Fault-Tolerant Distributed Systems[END_REF]. In addition, fault diagnoses (FD) [START_REF] Fang | Fault diagnosis of networked control systems[END_REF] aim at detecting, isolating, and estimating the faults, which is sometimes required by FTC strategies. Notice that Petri nets are, here again, often used to model fault tolerant NCS (or DCS), for example by means of SPN [START_REF] Pimentel | Dependability of Distributed Control System Fault Tolerant Units[END_REF] or SAN [START_REF] Campelo | Hierarchical reliability and safety models of fault tolerant distributed industrial control systems[END_REF].

In the present paper, "intelligent transmitters" as elements of NCS (or DCS) are analysed from a dependability point of view. Special features of such systems, other than the particularity of communicating on a network, are taken into account. These characteristic, enabled by "embedded intelligence," consist in operations such as data processing, self-diagnoses and online reconfiguration. The contribution of this paper can therefore be appreciated as a link between reliability analyses of "intelligent transmitters" [START_REF] Brissaud | Reliability Study of an Intelligent Transmitter[END_REF][START_REF] Brissaud | Reliability analysis for new technology-based transmitter[END_REF], and previous works on NCS (or DCS) dependability [START_REF] Barger | Safety analysis and reliability estimation of a networked control system[END_REF]. Although the proposed model does not take the communication network dependability into account, some related works [START_REF] Ghostine | Dependability evaluation of networked control systems under transmission faults[END_REF] can be easily integrated. The real-time communication is, however, used to make a network of transmitters which are allowed to implement operations by exchanging information. Such a control system made up of cooperating transmitters is introduced in Section 2, using procedures which aim at improving system availability and safety, based on two proposed algorithms. This control system is then modelled by stochastic and coloured Petri nets, and dependability evaluations are performed by Monte Carlo simulations in Section 3. Finally, the effects of the proposed algorithms on system availability and safety are discussed according to input parameters such as diagnostic coverage of failures.

CONTROL SYSTEM OF COOPERATING TRANSMITTERS ON A NETWORK

Basic Control System of Redundant Transmitters

A basic control system (CS), made up of three redundant transmitters, is firstly considered. That is, all three of the transmitters monitor the same quantities. An overview of this CS architecture can be seen in Figure 1, ignoring the communication network (in purple). Each transmitter involves both measurand (physical quantity to be measured) and influencing factor (quantities which impact the measurand evaluation) monitoring, using main and auxiliary transducers, respectively. The measurement result, as a function of measurand and influencing factors, is then performed by a processing unit. In addition, self-diagnoses are available for each transmitter element (main transducer, auxiliary transducer and processing unit), according to a given failure diagnostic coverage. Finally, the measurement result is transmitted to the CS main controller, using a communication interface. The signal transmission can be digital (e.g. using fieldbuses or wireless communication) or analogue (e.g. using the main communication standard in the process industry, that is, a 4-20 mA analogical signal). If at least one transmitter element failure is detected by self-diagnosis, an error signal (e.g. for an analogical signal: over 20 mA or under 4 mA) is transmitted instead of a signal which represents a measurement result. If at least one transmitter element failure has occurred but no failure has been detected by self-diagnosis, a signal which corresponds to a normal operation of equipment under control (e.g. non-detection of a hazardous event) is assumed to be transmitted; that is, only "dangerous" failures are assumed (and thus, no spurious mode). The CS main controller is then able to command a safety function to be performed by actuators (outside the scope of the present paper), if at least the majority of its non-error received signals provide an accurate measurement result. That is, the voting logic of the CS main controller is 2-out-of-3 if all of the transmitters are diagnosed as "operating" (according to their self-diagnoses), 1-out-of-2 if two and only two transmitters are diagnosed as "operating," 1-out-of-1 if one and only one transmitter is diagnosed as "operating," and finally, if no transmitter is diagnosed as "operating" then the CS provides a failure information.

Each transmitter therefore has three functional states: operating, if all of its elements are operating; detected failure, if at least one element failure has occurred and has been detected by self-diagnosis; and undetected failure, if at least one element failure has occurred and none has been detected by selfdiagnosis. According to these functional states of the three transmitters, the functional state of the CS is summarised in Figure 2. Due to the CS voting logic introduced previously, the CS is in operating state if at least two transmitters are in operating state, or only one is in operating state but at least another one is in detected failure state; the CS is in detected failure state if all three of the transmitters are in detected failure state; and the CS is in undetected failure state in all other cases.

From Basic Control System to Networked Control System

For the present study, a communication network is assumed between the transmitters of the CS (in purple in Figure 1). This communication may, for example, be provided by an additional wireless communication interface, independently of the communication between each transmitter and the CS main controller. If the communication between the transmitters is not independent of the communication with the CS main controller, then specific issues have to be taken into account (cf. Section 1). This latter case is, however, not considered for the present study. The assumed communication module then allows the transmitters to exchange several kinds of information between them: transmitter identification, value of measurand (just as obtained in output from the main transducer), value of main transducer self-diagnosis, value of influencing factors (just as obtained in output from the auxiliary transducer), value of auxiliary transducer self-diagnosis, measurement result (obtained in output from the processing unit), value of processing unit self-diagnosis, and a diagnosis compilation result which is computed by the processing unit according to the three values of selfdiagnoses. The result of this diagnosis compilation determines the signal transmitted to the CS main controller. It is either "confident," if the signal transmitted would represent the measurement result, or "not confident," if the signal transmitted would be an error signal.

A transmitter may be triggered according to two demand types. When a transmitter is triggered alone following a cyclic process (each transmitter is triggered in turn after a delay time), the corresponding demand type is denoted cyclic. When more than one transmitter is triggered at the same time, the corresponding demand type is denoted parallel. Because only one transmitter may use the communication network at once in order to prevent system instability (cf. Section 1), a transmitter is allowed to transmit information to the other transmitters only if it is triggered according to a cyclic demand type.

Alternately, each transmitter therefore performs its own evaluations (values of measurand and influencing factors, measurement result, values of self-diagnoses, diagnosis compilation result) according to a cyclic demand type, and transmits all of its information to the other transmitters of the network which, in turn (and after a tempo time), perform their own evaluations, according to a parallel demand type. Moreover, each time a transmitter is triggered (either according to a cyclic or parallel demand type), it transmits a signal to the CS main controller (either a signal which represents a measurement result or an error signal, according to the diagnosis compilation result). This demand process may be applied to CS made up of any number of transmitters. For the present study, the CS is made up of three transmitters, and the corresponding demand process is reported in Table 1.

Table 1: Demand Process for the Control System made up of Three Transmitters

Algorithms for Cooperating Transmitters

Based on two proposed algorithms, procedures are used to improve CS dependability by taking advantage of cooperation between transmitters. The two algorithms are denoted Backup Algorithm and Contrast Algorithm. The first refers to the measurand and influencing factor monitoring, performed by the main and auxiliary transducers. The second refers to the diagnosis compilation, performed by the processing unit. These algorithms are functionally independent and may or may not be used together. When a transmitter is triggered, it may therefore perform one or both of these algorithms. The algorithms use received information from other transmitters, and are based on self-diagnoses of transmitters' elements in order to compare, assess, or replace values used in transmitter processing. Finally, these algorithms can be performed regardless of the number of transmitters on the network.

The first algorithm, denoted Backup Algorithm, is used to replace a value which has been obtained for measurand (respectively for influencing factors) for the corresponding value from received information (originated from another transmitter triggered according to a cyclic demand type), if the latter is assumed more confident, according to the self-diagnoses of the main transducers (respectively the auxiliary transducers). In addition, a memorize process is used to select the assumed most confident values (for measurand and influencing factors), according to the self-diagnoses, among the last information received from other transmitters. The procedure based on Backup Algorithm is then as follows:

Backup Algorithm -When a transmitter is triggered:

Step 1: Perform transmitter evaluations (values of measurand and influencing factors, values of selfdiagnoses of the main and auxiliary transducers), independently of the information received from other transmitters.

Step 2: Read the last information received from other transmitters.

Step 3: Read the last information memorized by the transmitter.

Step 4: Replace the last memorized information for the last received information, if the two transmitter identifications are the same, or if the values of measurand and/or influencing factors are assumed more confident, according to the corresponding self-diagnoses.

Step 5: The processing unit of the transmitter performs the measurement result by using the values of measurand and influencing factors which are assumed the most confident, according to the self-diagnoses, among the transmitter evaluations and the last memorized information. etc. etc. *delay is the time between two transmitter triggers according to a cyclic demand, and tempo < delay Two versions of this algorithm are proposed: Backup Algorithm with Algo 1 and Backup Algorithm with Algo 2. Using Backup Algorithm with Algo 1, the transmitter is able to replace values which have been obtained for measurand or influencing factors only if the demand type is parallel (that is, when no information is then transmitted to the other transmitters), in order to avoid that the transmitter performs Backup Algorithm by using information which can itself depend on the transmitter. That is, Step 5 of Backup Algorithm with Algo 1 is performed only if the demand type is parallel. Using Backup Algorithm with Algo 2, the demand type is not considered and the previous situation is therefore not prevented. That is, Step 5 of Backup Algorithm with Algo 2 is always performed.

The second algorithm, denoted Contrast Algorithm, is used to replace the result of the diagnosis compilation computed by the processing unit, for a diagnosis result obtained by comparisons of measurement results. When a transmitter is triggered according to a parallel demand type, it performs its own evaluations and then compares its measurement result to the corresponding value from received information (originated from another transmitter triggered according to a cyclic demand type). If two consecutive comparisons of measurement results, which are performed using information from different sending transmitters providing measurement results assumed confident according to the diagnosis compilation, have deduced that the measurement results are the same (respectively not the same), then the result of the diagnosis compilation is replaced for "confident" (respectively "not confident"). The procedure based on Contrast Algorithm is then as follows:

Contrast Algorithm -When a transmitter is triggered:

Step 1: Perform transmitter evaluations (measurement result, values of self-diagnoses, diagnosis compilation result), independently of the information received from other transmitters.

Step 2: Read the last information received from other transmitters.

Step 3: Compare the measurement result from the transmitter evaluations with the measurement result from the last received information, and memorize the transmitter identification from the last received information with a label which represents the match between the two measurement results ("positive match" if the results are the same, "negative match" otherwise), if the diagnosis compilation result from the last received information is "confident." Step 4: Replace the diagnosis compilation result from the transmitter evaluations for "confident" (respectively "not confident"), if the two last memorized transmitter identifications with different names both have a "positive match" (respectively a "negative match") label, and if the demand type is parallel.

MODELLING AND EVALUATING COOPERATING TRANSMITTERS

Stochastic and Coloured Petri Nets

Petri nets are both graphical and mathematical tools. In particular, it is possible to set up state equations and mathematical models governing system behaviours [START_REF] Murata | Petri Nets: Properties, Analysis and Applications[END_REF]. An "ordinary" Petri net is made up of places (circles) and transitions (rectangles). Connections (directed arcs) may link a place to a transition (input arc) or vice-versa (output arc), and may be "valued" (otherwise the value is assumed to be one). These place-transition nets are therefore bipartite directed graphs. Places may contain tokens (small filled circles) which are "moved" through the enabled transitions when the latter are fired. A transition is enabled when each of its input places (linked to the transition by an input arc) contains a number of tokens equal to or greater than the corresponding input arc value. Firing an enabled transition then consists in two steps: first, removing, in each input place, a number of tokens equal to the corresponding input arc value; second, depositing, in each output place, a number of tokens equal to the corresponding output arc value. More details about these definitions and rules, examples, and Petri net properties may be found in the literature [START_REF] Peterson | Petri Net Theory and the Modeling of Systems[END_REF][START_REF] Murata | Petri Nets: Properties, Analysis and Applications[END_REF].

Usually, the places of a Petri net represent objects or conditions, the tokens specify the values of these objects or conditions, and the transitions model the system activities. To allow the modelling of complex systems, several extended Petri nets have been developed, which notably include coloured, timed, and stochastic properties. In coloured Petri nets (CPN) [START_REF] Jensen | Coloured Petri Nets: basic concepts, analysis methods and practical use[END_REF], different types (colours) of tokens are represented in the same graph, improving the modelling facilities and clarity. More generally, labels (values) may be assigned to each token, and may be changed when firing transitions or staying in places (ageing tokens [START_REF] Volovoi | Modeling of system reliability Petri nets with aging tokens[END_REF]). Firing policies may also depend on token labels. The time-dimension is introduced in timed Petri nets (TPN) by the use of sojourn times of tokens into places, and/or time delays for firing transitions. In stochastic Petri nets (SPN) [START_REF] Bause | Stochastic Petri Nets -An introduction to the theory[END_REF], these delays are random variables. A flexible extension of SPN is the stochastic activity networks (SAN) [START_REF] Meyer | Stochastic activity networks: structure, behaviour and application[END_REF]. When a Petri net includes both immediate and timed transitions, it is also denoted generalized Petri net (GPN) or generalized stochastic Petri net (GSPN).

"Ordinary" and extended Petri nets then provide a very interesting tool for describing and studying information processing systems that are characterized as being concurrent, asynchronous, distributed, parallel, nondeterministic and/or stochastic [START_REF] Murata | Petri Nets: Properties, Analysis and Applications[END_REF]. Nevertheless, a major weakness of Petri nets is the complexity problem: the more general the model, the less amenable it is to analysis [START_REF] Murata | Petri Nets: Properties, Analysis and Applications[END_REF]. For example, under some conditions, SPN may be analysed through the use of Markov Chains [START_REF] Bause | Stochastic Petri Nets -An introduction to the theory[END_REF]. For more complex and generalized problems, the Petri nets may be directly used for qualitative analyses, but quantitative analyses often require Monte Carlo simulations which can be very time-consuming.

Comprehensive information on Petri nets may, for example, be found on the Petri nets World website [START_REF]Petri Nets World[END_REF].

Modelling Framework

To model the CS by taking into account the cooperation between transmitters on the network, and then to assess dependability criteria, the stochastic and coloured Petri nets are claimed to be an intuitive and powerful tool. For example, Petri nets have already been used in several related studies [START_REF] Portugal | A framework for dependability evaluation of fieldbus networks[END_REF][START_REF] Ghostine | Dependability evaluation of networked control systems under transmission faults[END_REF][START_REF] Barger | Safety analysis and reliability estimation of a networked control system[END_REF][START_REF] Pimentel | Dependability of Distributed Control System Fault Tolerant Units[END_REF][START_REF] Campelo | Hierarchical reliability and safety models of fault tolerant distributed industrial control systems[END_REF] (cf. Section 1). While the stochastic properties are required to model random failures and imperfect self-diagnoses, the coloured characteristics provide a useful way to represent several kinds of information (e.g. values of measurand and influencing factors, measurement results, values of selfdiagnoses, diagnosis compilation result) and properties (states of transmitter's elements, values' accuracy). CPN Tools [START_REF]CPN Tools[END_REF] has then been chosen to model the CS. It is a free computer tool developed by the University of Aarhus for editing, simulating and analysing coloured Petri nets [START_REF]CPN Tools[END_REF]. Among other interesting characteristics, CPN Tools supports coloured and both timed and untimed Petri nets. Although stochastic aspects are not directly available, the declaration possibilities for variables and expressions allow the inclusion of these properties [START_REF] Jensen | Coloured Petri Nets: basic concepts, analysis methods and practical use[END_REF]. In addition, hierarchical Petri nets can be created by assigning a separate Petri Net to a transition, or by creating fusion places, which is very interesting to model systems made up of any number of similar elements. On the practical side, the user interface, graphical editor, syntax checking and contextual error messages offer facilities for use [START_REF] Ratzer | CPN Tools for Editing, Simulating, and Analysing Coloured Petri Nets[END_REF]. Finally, to perform quantitative analyses, Monte Carlo simulations are required.

The stochastic and coloured Petri net for the main transducers is depicted in Figure 3. It is proposed as an example, and used for the modelling framework discussion. The Petri net for the auxiliary transducers is similar to the Petri net of Figure 3, except for some parameters and names of places, and it is therefore not depicted in another figure. Other Petri nets have also been designed to model the processing units, the whole transmitters (which hierarchically includes Petri nets for main transducers, auxiliary transducers and processing units, plus the communication interfaces), and to model the CS (which hierarchically includes three Petri nets for whole transmitters), but are not depicted in the present paper. The hierarchy between Petri nets is given by labels attached to the bottom left of places (sky blue rectangles in Figure 3). For example, the "out" label on the "SubInformation" place represents an output link, the "in" label on the "Demand" place represents an input link, and both are associated with places of another Petri net. "I/O" labels represent both input and output links, and other labels such as "ExDigitInfo" are assigned to places which are common to several Petri nets (fusion places).

Figure 3: Stochastic and Coloured Petri Net for Main Transducers

In Figures 3, the measure chain is in blue (the tokens represent values for measurand, and are next associated with values of self-diagnoses); the states of the transducer elements and self-diagnoses are in red (tokens represent "ok" or "failed" states, and "diagnosed" or "undiagnosed" failure); the (random) failure aspects are in brown (a failure occurs when the "ToFail" transition is fired, changes the element states, and is detected by self-diagnosis according to a failure diagnostic coverage); the management of the demand process is in green (tokens represent either the demand occurrences for elements, or the demand types); the exchanged information between transmitters and the management of the procedure based on Backup Algorithm (the only relevant algorithm for Figure 3) are in purple (tokens represent values of exchanged information, and variables used by the algorithm).

The number of tokens in a non-empty place is given in an attached green filled circle, and the token values are given in the green rectangle close to it. The notation "1`" specifies a number of one token, and may be extended to any number. A place is able to contain only one kind of token defined by the colour type specified in capital letters, below each place. The initial number of tokens in each place is defined by the initial token values in lower-case, above each place. For example, the "State" place in Figure 3 contains one token of colour type "STATE" (which corresponds to integer numbers), and the token value is "100", which corresponds to the initial token value "StateIsOk". Other colour types may be "uncoloured", for example the "InitFail" places contain tokens of type "FAILURE" which are only represented by the symbol "()"; may be defined by a subset, for example the "DemandType" places contain tokens of type "TYPEofDEMAND" which may have either "c" value (associated with cyclic transmitter demand type) or "p" value (associated with parallel transmitter demand type); or may be associated with multiple variables, for example the "Exchanged DigitInfo" places contain tokens of type "DIGITINFO" which groups together seven integer variables. When a colour type is timed, the corresponding token values are given with the symbol "@" followed by an integer value which represents the instant in time the token becomes available (before this instant in time, a token cannot be handled, that is, it cannot be used to fire transition).

An input arc (from a place to a transition) specifies the number of tokens ("1`" by default) to remove in the input place, with an input variable which takes the value of the removed token. An output arc specifies the number of tokens to deposit in the output place, with an output variable which gives the value to the deposited token. This latter variable may be a function of input variables (these functions are reported in black in Figures 3). For example, the token which is deposited in the "Measurement" place in Figure 3 takes the value of the input variable "MeasureValue" if the input variable "StateValue" is equal to "StateIsOk", and the value "MeasureIsBad" otherwise. Using bi-directed arcs (e.g. between the "Measurand" place and the "ToMeasure" transition), the token is unchanged in the input place after firing the transition, but the token value may, however, be used as input variable in functions for output arcs. For timed tokens, the time delay may also be changed by output arcs. For example, when firing the transition "ToIntiFail", the token deposited in the "Failure" place has a time delay increased by a random variable which follows an exponential distribution of mean equal to "MTTFMainTrans". Input parameters used for random functions are given in Table 2. Notice that a cold standby has been assumed for the processing units of each transmitter. That is, when the first failure of a processing unit occurs, there is a probability equal to "DCProcUnitStBy" that it still operates, for a time which follows an exponential distribution of mean equal to "MTTFProcUnitStBy." Mean times to failure of main transducers, auxiliary transducers, and processing units, respectively, used for failure simulations according to exponential distributions

time units

MTTFProcUnitStBy Mean times to failure of processing units in cold standby 2.500 time units DCMainTrans DCAuxTrans DCProcUnit Failure diagnostic coverage of main transducers, auxiliary transducers, and processing units, respectively, that is, probabilities to detect a failure when it occurs 0.00, 0.25, 0.50, 0.75, or 1.00

DCProcUnitStBy

Probabilities of success of processing unit cold standby 0.75

Availability and Safety Analyses

The times to failure of each transmitter element (main transducers, auxiliary transducers, processing units) follow exponential distributions with means specified in Table 2 (in time units). Since Monte Carlo simulations are used for the analyses, any other distribution can also be used. When a failure of an element occurs, it is detected by self-diagnosis according to a constant probability equal to the diagnostic coverage. The failure diagnostic coverage is assumed to be the same for each transmitter element, and five values are used in order to analyse the impact of this parameter on the CS dependability, and according to the use of the proposed algorithms. Because no maintenance action is assumed, the criterion used to assess the CS availability and safety is the percentage of time that the CS spends in each functional state during the first 10,000 time units. The availability is then computed as the probability (percentage of time) that the CS is in operating state, and the safety is computed as the probability (percentage of time) that the CS is not in undetected failure state.

Six cases are analysed, according to the use (or not) of Backup Algorithm (with Algo 1 or Algo 2) and/or Contrast Algorithm (cf. Section 2). For each case, different failure diagnostic coverage of each transmitter element is used: all diagnostic coverage equal to "0.00" in the "DC00" configurations, all equal to "0.25" in the "DC25" configurations, and etcetera up to "1.00" in the "DC100" configurations. Evaluations have been performed by 500 draws of Monte Carlo simulations for each configuration, which provides results with an estimated 95% confidence interval at plus or minus 3% around the averages. The average results obtained for each configuration are reported in Figure 4. According to the results reported in Figure 4, the following remarks can be made: ▪ Backup Algorithm globally increases the CS availability, but decreases the CS safety. ▪ These previous gaps are increasing according to the failure diagnostic coverage, and are even more significant through the use of Backup Algorithm with Algo 2 than with Algo 1.

▪ Contrast Algorithm globally increases both availability and safety when the failure diagnostic coverage is very low, but decreases both of them when the failure diagnostic coverage is greater.

▪ The diagnostic coverage threshold between these previous effects of Contrast Algorithm is greater through the use of Backup Algorithm with Algo 2 than with Algo 1.

When using Backup Algorithm, an element which is diagnosed as "failed" may be functionally replaced by another element which is diagnosed as "operating." Nevertheless, an element diagnosed as "operating" may, in fact, be "operating," but may also be "undetected failed." Therefore, although Backup Algorithm increases availability (when an unavailable function becomes available), it also decreases safety (when an unavailable function, diagnosed as such, stays unavailable, but undiagnosed as such), and especially when the failure diagnostic coverage is low. On the other hand, when the failure diagnostic coverage is high, the diagnosis obtained by the use of Contrast Algorithm is less confident that the diagnosis compilation based on self-diagnoses. It is therefore recommended that:

▪ The use of Backup Algorithm should depend on the balance between availability and safety. ▪ The use of Backup Algorithm with Algo 2 instead of Algo 1 could be more justified when the failure diagnostic coverage is very high.

▪ Contrast Algorithm should be used when the failure diagnostic coverage is very low, or a bit less low according to the use of Backup Algorithm.

By using coloured and stochastic Petri nets, it has been possible to model a CS made up of "intelligent transmitters" and then to evaluate dependability criteria using Monte Carlo simulations. Two algorithms, namely Backup Algorithm and Contrast Algorithm, have been proposed in order to take advantage of the cooperation between transmitters to improve CS dependability. According to the percentage of time that the CS spends in each functional state during 10,000 time units, it has been shown that the CS availability and safety can be improved under some conditions (notably, according to the failure diagnostic coverage of transmitter elements) and, at least, can be put in balance by the use of the proposed algorithms. As a main conclusion, the results of the present study provide an indication that the new technologies inside transmitters, when appropriately used, not only provide practical advantages but may also be used to improve dependability criteria.

Figure 1 :Figure 2 :

 12 Figure 1: Control System Architecture

Figure 4 :

 4 Figure 4: Average Percentage of Time the Control System spends in each Functional State, during the Fist 10,000 Time Units

Table 2 : Input Parameters for Modelling and Evaluating the Control System

 2

	Name	Description	Values
	MTTFMainTrans
	MTTFAuxTrans
	MTTFProcUnit

Acknowledgements

We would like to thank the French Ministry of Higher Education and Research, and the French Ministry of Ecology, Energy, and Sustainable Development for supporting our research work.