Florent Brissaud

Dominique Charpentier

Mitra Fouladirad

Anne Barros

Christophe Bérenguer

Safety Instrumented System reliability evaluation with Influencing Factors

published or not. The documents may come

L'archive ouverte

INTRODUCTION

Evaluating safety instrumented systems [SIS] reliability has been necessary due to societal issues and legislation. The main European standard for SIS assessment is the IEC 61508 (IEC 2005) which requires determining a probability of failure on demand [PFD] for each part of the system: detectors, logic units, and actuators. The relevance of existing models (reliability equations, reliability block diagrams, fault tree analysis, Markov processes etc.) strongly depends on the quality of input data as failure rates, maintenance characteristics, and common cause parameters.

By lack of reliability feedback data, generic failure rates from data handbooks are commonly used. They usually come from offshore, military, or nuclear power plant activities. However, the influencing factors of many systems are sometimes obviously heterogeneous and it is certainly inaccurate to assign the same failure rate to all of these systems. In this framework, predictive models have been developed, for electronic (DoD of USA 1991) or mechanical (NSWC 1998) components. Unfortunately they are too specific to be suitable for every SIS characteristic and environmental condition. Statistical models also exist, but such models require a lot of feedback knowledge. For example, some other approaches focus on organizational factors, using mainly feedback data or expert judgment.

A definition and a classification of influencing factors are proposed in the Section 2. Section 3 includes review of existing reliability models which take into account internal or external factors. Section 4 is the main part and introduces a new method for failure rate evaluation with influencing factors. The methodology is composed by seven steps and has been especially developed for SIS. An example regarding safety pressure relief valves is briefly presented and discussed in Section 5, followed by the conclusion.

INFLUENCING FACTORS

Introduction to the influencing factors

According to the IEC 60050 standard (IEC 1990), the reliability is the ability of an item to perform a required function under given conditions for a given time interval. The quantitative measurement of the reliability is usually made by a failure rate evaluation. This parameter is intrinsic to the item, its environment and conditions of use. Nevertheless, it is possible to observe failure rate realizations by a number of failures per time unit. The influencing factors denote the parameters which determine the value of the failure rate. These factors represent the "given conditions" mentioned in the reliability definition.

The following definition will be used in the present paper: the influencing factors [relating to the reliability] are the internal and external parts of an item which act on its reliability, for example by causing failure rate changes. The effects may be positive, by Safety Instrumented System reliability evaluation with Influencing Factors ABSTRACT: The relevance of reliability evaluation strongly depends on the quality of input data as failure rates. Reliability data handbooks give generic values which do not often fit system specificities. This paper deals with influencing factors in order to take into account some aspects as design, environment and use in reliability evaluations. Once a definition and a classification are proposed, a brief review of existing models is presented. This paper also introduces a new failure rate evaluation with influencing factors especially developed for safety instrumented systems. The seven-step methodology combines both qualitative and quantitative analyses to compensate for a potential lack of feedback knowledge. Some criteria are used to set a failure rate within a prior interval, according to system conditions. An application regarding safety pressure relief valves is included. The expected better argued and accurate results aim at leading to a more efficient risk management. causing a reduction of failure number per time unit, or negative, by causing a higher number of failures.

For example, mechanical equipment failures may occur due to some physical phenomena as fatigue, fissures or erosion which all depend on the equipment design, material properties, solicitations, or environmental interactions. In order to obtain influencing factor measurements, it is necessary to establish indicators e.g. type of material, solicitation frequency and load, humidity rate. A reliability modelling with influencing factors then consists in defining a failure rate evaluation according to these indicator values. Figure 1 sums up the effect of influencing factors on reliability, through the failures and their causes, and how a corresponding reliability model can be defined.

Influencing Factors

Failure causes

Failures

Influencing factors indicators

Reliability evaluation

Model

Real world

Failure rate evaluation with influencing factors

Figure 1. The influencing factors and the reliability

An influencing factors classification

The proposed influencing factors classification is made according to the system life cycle. This work takes advantage of the references which are presented in the next section.  the design factors which are intrinsic-natured to the system: type, working principle, sizes, materials, component quality etc.  the factors related to the manufacturer and the manufacture process (including the potential effect on surface finish)  the factors due to installation and activation (including access facilities)  the factors which act when the system is used: solicitation frequency and load, electrical load (voltage, intensity), environment (mechanical constraints, temperature, humidity, pollution), performance or reliability requirements etc.  the maintenance factors: the quantity and the quality of preventive and corrective actions Human and organizational factors can be added. A classification is proposed by [START_REF] References Aven | Barrier and operational risk analysis of hydrocarbon releases (BORA-Release): Part 1. Method description[END_REF] which details five groups: the characteristics of the personnel performing the tasks, the characteristics of the task being performed, the characteristics of the technical system, the administration control, and the organizational factors / operational philosophy.

FAILURE RATE EVALUATION

Reliability feedback data and data handbooks

The most efficient means to obtain a suitable failure rate value is certainly the reliability feedback data. Some industrialists have collected data from their own applications, mainly from power plants or offshore platforms. In this way, the values fit equipment characteristics, environment and conditions of use. Unfortunately, a significant equipment field, appropriate procedures and a long practice are required.

By lack of such feedback knowledge, reliability data handbooks are commonly used. They give some generic data, usually from offshore (OREDA andPDS Handbook by SINTEF 2002 &2006), military (NPRD-95 andEPRD-97 by RiAC 1995 &[START_REF] Øien | Risk Influence Analysis, A methodology for identification and assessment of risk reduction strategies[END_REF] or nuclear power plant (EIReDA by EC 1998) activities. The users of these books presume the data can be transposed to their equipment and for their applications even though technical, operational and environmental conditions are seldom detailed. However, non negligible failure rate differences from a data handbook to another let suppose that the recorded systems are very heterogeneous. Some explanations can be given:  all type of equipment have their own characteristics (intrinsic factors) i.e. for a system type, several kind of equipment with different reliability parameters exist  operational, environmental and maintenance conditions are sometimes very heterogeneous from one type of equipment to another (extrinsic factors), especially between activities  to obtain significant results and collect them in a usable data handbook, it is usually necessary to group together systems with different intrinsic and extrinsic factors Using these data handbooks without consideration may therefore yield high reliability evaluation uncertainties. These weaknesses may be offset, for example by Bayesian approaches and expert judgment [START_REF] Lanternier | Taux de défaillance bayésien pondéré à partir de données de retour d'expérience[END_REF].

Failure rate evaluation with influencing factors

Frameworks for human and organizational

factors A lot of methods have been proposed to take into account the human and organizational factors in the reliability evaluations or quantitative risk analyses: Manager (1990), MACHINE (1992), WPAM [START_REF] Davoudian | Incorporating organisationl factors into risk assessment through the analysis of work processes. The work process analysis model (WPAM-II)[END_REF]), ISM (1994), ω-factor model (1996), SAM (1996), RIA (Rosness 1998), I-Risk (1999), ORIM (Øien 2001b), ARAMIS (2004), BORA-Release (Aven et al. 2006). Five representative steps are given by Rosness (1998): 1 preparation of the analysis in order to define the field and the scope of the study 2 documents and data collection 3 qualitative analysis which aims at defining a general model, selecting the influencing factors, and set the current factor states 4 quantitative analysis to evaluate the effect of each factor and to calculate the results according to the model 5 verification and documentation which consist in validating and formalizing the results Some tools have been developed for the qualitative step, especially for the model definition and factor selection. For example, a conceptual tree is proposed in RIA, an organizational model in ORIM, and a risk influence diagram in BORA-Release. Then, in order to set the current states of factors, expert judgment is often used. Aven et al. propose a scale from A (best standard in industry) to F (worst practice). WPAM suggests the use of questionnaires and audits, while in ORIM, indicators from 1 to 5 are developed.

Starting from this point, quantitative analysis aims at formulating a final result (level of risk, probability of failure, failure rate) according to the potential changes of the influencing factors. In this scope, rating processes consist of assigning a weight to each factor in order to contrast their effects. Expert judgment is always used, except for ORIM where a Cox model is proposed. According to the model, the factors influence is added up or a Bayesian network is used to modify baseline values.

Electronic component failure rate evaluation with influencing factors

In a safety instrumented system [SIS], detectors and logic units can usually be seen as electronic equipment. The inclusion of influencing factors into the failure rate evaluation generally consists of predictive models. The first related standard is the MIL-HDBK-217. It appeared in 1960 for military applications. The 1991 revision (DoD of USA 1991) is now well known and used by industrialists.

The failure rates are given by analytical functions which depend directly on some parameters as temperature, voltage or electrical intensity. The baseline values correspond to reference conditions. Coefficients are then multiplied according to the influencing factors (part stress analysis). The failure rate of a system is obtained by adding the failure rate of all its components (part count analysis). This approach is especially useful during the design phase when no test has been done yet. Nevertheless, all the values of the influencing factors have to be well known.

A lot of similar standards have then been developed, especially for military applications: 217Plus methodology by the DoD of USA, the French FIDES (UTE 2004) and the Chinese GJB/z 299B; and for telecoms: Telcordia standard (ex-Bellcore), RDF 2000 by Union Technique de l'Électricité [UTE], HDR4 and HDR5 by British Telecommunication [BT]. Finally, the IEC 61709 standard (IEC 1996) deals with reference conditions for stress models.

Mechanical component failure rate evaluation with influencing factors

The SIS actuators are mainly mechanical equipment e.g. valves, pumps, breaks. They usually cause half the faults and failures of SIS. Moreover, due to the high diversity and conditions of use, the reliability is particularly subject to influencing factors.

Only one predictive model can be found for mechanical components, the NSWC-98/LE1 standard (NSWC 1998). The influencing factors are numerous: temperature, pressure, fluid and material properties, load, performance requirements and so forth. Unfortunately, the eighteen components which are developed are not enough for safety instrumented system analyses. Moreover, some required influencing factor values are very difficult to know (allowable leakage rate, fluid viscosity) and the reference values do not fit industrial processes. For example, the baseline valve pressure activation is 200 bars whereas in industry this value seldom exceeds 60 bars.

Without a priori knowledge about physical relations between failure rates and influencing factors, statistical approaches are briefly proposed in CCPS 1999 and [START_REF] Debray | ARAMIS D1C -Appendix 7, Frequencies data for the fault tree[END_REF]. Feedback data is used in order to observe failure rate trends which depend on influencing factors. When a lot of data is collected and the influencing factors are detailed, [START_REF] Lanternier | Failure rate model for spring loaded relief valves[END_REF][START_REF] Brissaud | Modélisation des taux de défaillance en mécanique[END_REF] propose the use of a Cox model. By using a Weibull law, this approach has the particularity to give a failure rate which depends both on influencing factors and time. Finally, Lanternier 2007 presents also the use of neuronal networks.

A NEW MODEL FOR FAILURE RATE EVALUATION WITH INFLUENCING FACTORS 4.1 A new model especially developed for SIS

A new methodology for failure rate evaluation will be proposed in the present paper. To be usable in most SIS reliability evaluations, the following particularities have been set:  the methodology should be global enough to be usable for a large number of safety systems (especially actuators) and influencing factors  a qualitative analysis has to compensate for a potential lack of data from feedback knowledge by the use of organized expert judgment  the quantitative part has to allow improvements when some feedback data is newly available  even if it is certainly not conceivable to obtain an exact reliability evaluation without much feedback data, the methodology should give argued results which logically depend on influencing factors  the prospect is for risk analyses which allow more efficient risk managements by acting both on equipment and influencing factors

General presentation of the model

The general form will be the same as the predictive models. The equipment is divided into several main component groups as a serial system i.e. the failure rate is obtained by the sum of the main component groups failure rates. To have an a priori idea of the whole equipment failure rate is usually more realistic than accurate values for all the components. Each component (i.e. main component group) baseline failure rate will therefore be expressed as a percentage of the whole system baseline failure rate.

The effects of the influencing factors will then be included by influencing coefficients. Each coefficient corresponds to one factor and vice-versa. If a component is liable to an influencing factor, the baseline failure rate is multiplied by the corresponding influencing coefficient. The coefficient values are defined according to the states of the influencing factors:  if the influencing factor is supposed to be in a medium state according to the reliability, the corresponding influencing coefficient is equal to one  if the influencing factor is supposed to be in a more suitable state (resp. a less suitable state), the corresponding influencing coefficient is smaller than one (resp. greater than one) These properties can be summed up by the formulas:

               N i J j j mean i N i i s i C 1 * , 1    (1) mean s i mean i c , ,     with 1 1    N i i c ( 2
)
where λ s and λ i are respectively the system and the components (i.e. main component groups) failure rates, according to the current states of the influencing factors; λ s,mean and λ i,mean the baseline system and components failure rates; c i the contribution (in percentage) of component i in the whole baseline system failure rate; N the number of components which compose the system; C j * the influencing coefficient which corresponds to the influencing factor j; J i the set of influencing factors indices which have an effect on component i.

In order to have coherent results with a presupposed failure rate scale, a prior interval [λ s,min ; λ s,max ] is set. The main idea of the methodology is to use some criteria to fix the failure rate inside this interval, according to the influencing factor states. The method is based on these following propositions which are summed up in Figure 2:  the system baseline failure rate λ s,mean is reached when all the influencing factors are, on average, in a medium state  the lower value λ s,min (resp. the upper value λ s,max ) of the prior interval is reached when all the influencing factors are, on average, in a defined proportion Ψ of the most suitable states (resp. the least suitable states)

A seven-step methodology

The proposed methodology is composed by seven steps. Qualitative analysis (step 1 to 3) and quantitative analysis (step 1 and 4 to 7) are combined in a framework which can be seen as an adaptation of the steps for human and organizational factors.

Step 1: functional analysis and input data

First of all, it is advisable to delimit the scope of the study: which equipment (valve, pump, detector etc.) to be applied and for which safety function and application. The failure rate has to be defined precisely. For example, only the dangerous and undetected failures can be relevant for the study, and the unit can be the number of failures per hours or per solicitations. Using available feedback data, reliability data handbooks and, if required, expert judgment, a system baseline failure rate (λ s,mean ) has to be set. It must fit as much as possible the medium conditions, according to the reliability, wherein the system can be. This baseline value is surrounded by an interval ([λ s,min ; λ s,max ]). It corresponds to the extreme failure rates which are possible to observe for this type of system, according to the worst and the most suitable influencing factor states.

A failure mode, effect, and criticality analysis [FMECA] is recommended to identify the components (i.e. main component groups) of the system which are liable to different influencing factors. Using the FMECA and, if available, some reliability data, the contribution of each component in the baseline system failure rate (c i with i=1,…,N) has to be evaluated.

Step 2: model definition and influencing fac-

tors selection A reliability influencing diagram is proposed for model definition and the selection of relevant influencing factors. Four levels are built from right to left. These levels are composed by elements (the circles), and influencing relations (the arrows):  the first level has only one element which is the system identification  the second level is composed by the main component groups of the system which have been identified in step 1. Each element of this level is linked to the system element of the previous level  the elements of the third level are the system life cycle phases which also correspond to the influencing factors categories (see table 1). When a phase is supposed to have a non negligible effect on a component reliability, an arrow is drawn between the two corresponding elements  the last level represents the selected influencing factors for each life cycle phase which is relevant for reliability An example of influencing diagram is given in Figure 4 for a safety pressure relief valve. 1 gives a sample of checklist for influencing factors selection. The choice of the influencing factors has to follow some criteria:  it is possible to measure or evaluate the states  the state measurements or evaluation has to allow making differences between systems  the selected factors are exhaustive enough to explain the observable reliability differences An influencing matrix F N,M is defined on N*M as follows: F N,M (i,j)=1 if the component i is liable to the influence of factor j, F N,M (i,j)=0 otherwise.

Step 3: indicators choice and graduation

An indicator is the means to observe the state of an influencing factor. Øien 2001a proposes some criteria for indicator choice in terms of the amount of data, available sources, relationships with observed factors, validity and repeatability.

For the model which is developed, the indicators have to be set on a numerical scale. Moreover, the effects of factors (positive or negative) will be assumed to be continuous and monotonous according to the indicator values. For qualitative indicators (e.g. manufacturer name, type of material), a scale from 0 for "very not suitable for reliability" to 5 for "very suitable for reliability" is proposed. For quantitative indicators (e.g. pressure, voltage, temperature), the values can be directly used if account for the previous conditions. Otherwise, a multiple level scale has to be defined as for qualitative indicators.

Using technical reports, operational data, feedback knowledge, measures, investigation with key staff and so on, three particular levels have to be set for each indicator: one which represents the medium influencing factor state, two which represent the extreme observable values (the least and the most suitable values for reliability).

The scale for the indicator I j of the influencing factor j is denoted [I j,lower ; I j,upper ] and the three particular levels are I j,mean for the medium value, I j,worst and I j,best for respectively the least and the most suitable values which are observable.

Step 4: influencing factors rating

A weight is given to each selected influencing factor. It represents the relative potential effect on the liable component failure rates, according to a change from the least to the most suitable value of the corresponding indicator.

A rating from 1 to 5 or from 1 to 10 is usually suitable for the model. Feedback knowledge, graduating processes, comparisons by pair, tests or expert judgment can be used to set weights. The weight of the influencing factor j is denoted W j and it is normalized using Equation (4) given in Appendix A.

Step 5: indicator functions

In order to deal with uncertainties, especially when expert judgment is required, indicator functions aims at representing the current indicator values not as fixed points, but as probability density functions. In fact, the indicators values are seldom known precisely and are sometimes subject to changes during the system life cycle (temperature, humidity, load). Three density function types are proposed:  uniform distribution when expert judgment is the main used means to evaluate the indicator value e.g. it is supposed that the influencing conditions are quite benefit or not for the reliability  triangular distribution if the indicator value is deterministic and has to be translated on a defined scale e.g. the indicator value is given on a scale from 0 to 5 according to the "degree of suitability" for the reliability  Gaussian distribution when the quantitative indicator value is directly used e.g. pressure, temperature, volume etc.

Examples of these three distributions for safety pressure relief valves are given in Figure 5 to 7. In this example, the sizes influencing factor is set on a deterministic scale with qualitative values (big, medium, small). The allowable leakage rate which represents the performance requirements is defined as restrictive or indulgent according to expert judgment. Finally, the pressure of activation (in bars) is a quantitative indicator for loading charge influencing factor. The indicator function of the influencing factor j is denoted g j (I j ) and is defined on [I j,lower ; I j,upper ].

4.3.6

Step 6: influencing functions The influencing functions aims at formulating the influencing coefficients according to the indicators values. An example of this type of function is given in Figure 3. The functions are built by setting three particular values: one which corresponds to a medium indicator value (denoted C j (I j,mean )), two which correspond to the least and the most suitable indicator values (resp. C j (I j,worst ) and C j (I j,best )). They can be obtained by the formulas given in Appendix A. They take into account the previous steps, including the influencing factor weights. Linear relations are then assumed between these particular values, as presented in Figure 3. These functions are extrapolated all over the indicator scales [I j,lower ; I j,upper ].

C j (I j,best ) I j,mean I j,best I j,worst I j,lower C j (I j,mean ) C j (I j,worst ) I j,upper C j (I j ) (3)

The final system failure rate is then obtained by using Formulas (1) and ( 2) with the input data of the first step. Note that the use of density functions for indicators in Equation (3) mitigates the potential effects of the assumptions from step 6 (about the definition of influencing functions) on results.

5 APPLICATION TO SAFETY PRESSURE RELIEF VALVES

Presentation of the application

In order to illustrate the use of the proposed methodology, an application to safety pressure relief valves is developed. The results will be compared to the real failure rates in order to assess the model accuracy. Nevertheless, it is not realistic to claim to know real failure rates. It is only possible to observe the mean time a system is functioning and to make failure rate estimations from that. This is why the following approach will be used: 1 set a fictitious panel of systems with defined influencing factor conditions 2 allocate to each system a failure rate which is set as the true value i.e. the "real failure rate". A "hidden model" is used in order to have coherent failure rates according to the influencing factors 3 by using the real failure rates, simulate times to failure for each system by Monte Carlo method 4 use the times to failure simulations as input data for the proposed methodology 5 compare the results with the real failure rates Note that the real failure rates are not used in the model which is tested, only the times to failure simulations are required and the influencing factors states.

Application results

Fourteen safety pressure relief valves are in the panel. Valve number #1 is assumed to be in the most suitable conditions for the reliability whereas numbers #6-9 correspond to medium conditions, and number #14 to the worst. Each valve is composed by a poppet assembly, a seal, and a spring (i.e. the main component groups). The respective baseline component contributions are 70%, 5% and 25%. The three selected influencing factors are the sizes with a weight of 3, the loading charge with a weight of 2, and the performance requirements with a weight of 1. Predictive models from NSWC-98/LE1 (NSWC 1998) have been used with some adaptations to set the real failure rates which are reported in Figure 8. According to a stated number of simulated times to failure per valve, two failure rate evaluations are tested: the inverse of the mean time to failure (maximum likelihood estimation [MLE]) and the failure rate evaluation with influencing factors (the proposed model, denoted frewif). For the frewif methodology, the MLE estimations of the valves #6-9, #1, and #14 have been used as input data in step 1 i.e. to assess baseline and extreme failure rate values (resp. λ s,mean , λ s,min , and λ s,max ). The results of the MLE and the frewif evaluation are given in Figure 8 and9. Low pressure Medium pressure High pressure Figure 7. Indicator functions for loading charge influencing factor (the higher is the nominal pressure of activation, the greater the uncertainty is assumed to be)

In the described conditions, the proposed methodology gives more accurate results than MLE, especially when feedback data is low (few observed times to failure). Moreover, taking into account the influencing factors yield more argued and coherent evaluations than using only feedback data.

In this example, only the quantitative part of the models is evaluated. In fact, it seems difficult to measure the quality of the functional analysis, factors and indicators selections. Nevertheless, some further analyses have shown that quality of the results for the proposed methodology is robust according to the input data (input failure rates, component contributions, influencing factors weights). To ignore the influencing factors, for example by using non-appropriate feedback data or data handbooks, therefore yields high reliability evaluation uncertainties. Specific models have been developed in order to include the human and organizational factors in quantitative risk analysis. Predictive models are also well established and allow taking into account influencing factors in failure rates of electronic components. Un-fortunately, none of these models is general enough to be usable for most of the SIS assessments, especially for the actuators which are mechanical equipments. Statistical models have been proposed in the literature but require a lot of reliability feedback knowledge and such data is seldom available.

A new methodology for failure rate evaluation, especially developed for SIS, has then been proposed in the present paper. It is general enough to be usable for a large number of safety systems and influencing factors. Because a qualitative approach is combined with a quantitative part, it can compensate for a potential lack of feedback knowledge, while allowing improvements when including data. Using density indicator functions, the model also deals with uncertainties in order to avoid dubious evaluations, particularly when expert judgment is required.

The example regarding safety valves has shown that the proposed methodology provides, in some conditions, more accurate results than a classical approach as MLE, especially when the amount of feedback data is low. Moreover, by taking into account the influencing factors, the results are more argued and coherent according to the system conditions.

There are therefore good prospects to use this methodology, notably in chemical industries, where a high variety of SIS can be found in very heterogeneous conditions, and the reliability feedback data is often low. A more efficient risk analysis and management could then be performed by taking into account both safety systems and influencing factors.

APPENDIX A: INFLUENCING FUNCTIONS

Normalized weight w j for each influencing factor j:

               N i M k k M N i N i j M N i j W k i F c W j i F c w

F

  . Brissaud & D. Charpentier Institut National de l'Environnement Industriel et des Risques (INERIS) -DCE, Verneuil-en-Halatte, France M. Fouladirad, A. Barros & C. Bérenguer Université de Technologie de Troyes (UTT) -Institut Charles Delaunay (ICD) -CNRS, Troyes, France

Figure 3 .

 3 Figure 3. Example of influencing function C j (I j )

Figure 4 .

 4 Figure 4. Reliability influencing diagram for safety pressure relief valves example

  Figure 5. Indicator functions for sizes influencing factor

Figure 8 .Figure 9 .

 89 Figure 8. Results of failure rate evaluations using 3 times to failure observed per valve (logarithm scale)

Table 1

 1

	. Sample of checklist for influencing factors selection ______________________________________________
	Category ______________________________________________ Influencing factors
	Design		System type
			Working principle
			Sizes (height, volume, weight)
			Materials
			Component quality (quality requirements
			and controls)
			Special characteristics (supply)
	Manufacture	Manufacturer
			Manufacture process (procedures, controls)
	Installation	Location (access facilities)
			Assembly/Activation (procedures, controls)
	Use	EUC*		EUC* type
				Special characteristics
		Solicitation	Type of load (cycling, random)
				Frequency of use
				Loading charge/Activation threshold
				Electrical load (voltage, intensity)
		Environment Mechanical constraints (vibration,
				friction, shocks)
				Temperature
				Corrosion/Humidity
				Pollution (dust, impurities)
				Other stresses (electromagnetism,
				climate)
		Requirements Performance requirements
				Failure modes (recorded failures)
	Maintenance	Frequency of preventive maintenance
			Quality of preventive maintenance
	Quality of corrective maintenance _____________________________________________
	* Equipment Under Control
	Table


Florent Brissaud
email: florent.brissaud@ineris.fr

Anne Barros

Christophe Bérenguer

Dominique Charpentier

Dependability Issues for Intelligent Transmitters and Reliability Pattern Proposal

Keywords: Intelligent Instrumentation, Dependability, Reliability, Availability, Maintenability, Safety. 

New technologies make way for "intelligent" transmitters by integrating new functionalities: error measurement corrections, self-adjustment, self-diagnosis for measurement and transmitter status, online reconfiguration, and digital bidirectional communication. Industrialists are taking advantage of more accurate measurements, cost reductions and facilities. For industrial risk prevention, new dependability issues are arising. Functionalities such as self-diagnosis and digital communication seem to be in favour of control systems availability. On the other hand, the high amount of electronics and programmable units implies new failure causes and modes which are usually not well known. In this paper, dependability issues for intelligent transmitters are discussed and a reliability model is proposed. By using a Goal Tree -Success Tree (GTST) technique, both functional and material aspects of an intelligent transmitter pattern are included. Material-material, material-function, and function-function relationships are then demonstrated in Master Logic Diagrams (MLD). These results are proposed as support for further case studies. For example, the impact of any material failure on any function, and the reliability of the main functions, can be assessed using this kind of model. Other dependability tools can take advantage of this reliability pattern, for example when the behavioural aspects of complex systems are undetermined.

INTRODUCTION

Sensors and detectors are key parts of safety instrumented systems (SIS). In order to respect the importance of these safety barriers for industrial risk management, dependability issues have to be analysed. The main European standard for the functional safety of SIS is the IEC 61508 (IEC, 2002). It is then necessary to assess the probabilities of failure for each part of the system, including sensors or detectors, in order to define the safety integrity level (SIL).

In the eighties, the development of micro-electromechanical systems (MEMs) led to the revolution of embedded and distributed intelligence systems. The sensors have become "intelligent" and are now able to combine data acquisition, from physical properties, and internal data processing to get the required information. Measurements with detailed results can be transmitted and, for example, certain information about sensor status. These systems are therefore appropriately referred to as "intelligent transmitters" instead of "sensors". Intelligent transmitter definitions and material architecture are presented in Section 2. Moreover, the use of digital technology enables the use of new functionalities which can benefit industrial safety. This is discussed in Section 3. Consequently, new dependability issues arise, especially as regards the possibility of including transmitter functionalities in a reliability model, while taking into account both material and functional interactions. These issues are discussed in Section 4. An example of such a reliability model is then proposed in Section 5. A pattern, which includes basic intelligent transmitter architecture and functionalities, is given as support for further dependability evaluations.

WHAT IS AN INTELLIGENT TRANSMITTER?

Definitions

First, let us suggest a definition of "smart transmitter", less restrictive than "intelligent transmitter": a transmitter is "smart" if some signal conditionings [START_REF] Smith | Considerations for the utilization of smart sensors[END_REF] or data processing [START_REF] Meijer | Concepts and focus point for intelligent sensor systems[END_REF] are carried out by an embedded microprocessor, in order to improve metrological performances [START_REF] Ciame: Bayart | Capteurs et actionneurs intelligents[END_REF].

In addition, a transmitter is "intelligent" depending on further functionalities involved in the host system functions: the ability to modify its internal behaviour to optimize data collection and communicate them in a responsive manner [START_REF] Brignell | The future of intelligent sensors: A problem of technology or ethics?[END_REF]; and the bi-directional communication for sending measurement and status information and receiving and processing external commands (IEC, 2006). This distinction between "smart" and "intelligent" transmitters is, however, not an unbreakable rule [START_REF] Ciame: Bayart | Capteurs et actionneurs intelligents[END_REF]. A transmitter is often described as "intelligent" if a microprocessor is embedded for pre-processing tasks [START_REF] Schodel | Utilization of fuzzy techniques in intelligent sensors[END_REF] or more advanced functionalities.

Material architecture

A material architecture, in accordance with IEC 60770-3 (IEC, 2006) and applicable to most of the intelligent transmitters, is presented in Figure 1. The sensor subsystem includes main transducers for converting physical or chemical quantities to be measured (i.e. measurands) into electrical signals, auxiliary transducers for the monitoring of the influencing quantities (temperature, pressure, power supply, dust, etc.), and signal conditioning units. Some active units can be added to execute certain functionalities (see Section 3.1), and memory can be added for the storage of transducer characteristics (ID, metrological parameters, etc.) to be used by the data processing subsystem.

The data processing subsystem is the "intelligent" part of the transmitter. It performs data processing (both from sensor and communication subsystems), calculations and functionalities using microprocessors, memory and software. The metrological and functional parameters storage with dates provides some functionality improvements (see Section 3.1).

The communication system is usually composed of several subsystems. The measurement transmission may be analogical (with DAC), or digital. In addition, diagnostic information such as measurement characteristics and transmitter status can be transmitted by the subsystem intended for external system communication. The 4-20mA medium, proportional to the observed quantity, is the most common in industry. For error diagnoses, an extended signal to 0-24mA can be used (for example, 0mA for a power supply error and 24mA for an out of range error). HART technology (HART, 1999) enables digital communication with a usual 4-20mA medium by a frequency coding. Measurements and diagnoses can therefore both be transmitted in parallel. Power line communication (PLC) can also be used for diagnostic information without additional wires. Field buses (Profibus, Interbus, Device Net, SafetyBus, Modbus, LonWorks, etc.) and wireless networks are also expanding. Standards have been developed to harmonize digital communication, such as OMG, 2003 andIEEE, 2007. Software tools like PACTware (PACTware, 2005) have been designed, field bus independently, for parameters, configuration and diagnostic management with external systems.

INTELLIGENT TRANSMITTER TECHNOLOGIES

Functionalities

New technologies enable the integration of new functionalities in transmitters. Five of them are presented in this section. They play a role in the generic functions, as described by Robert et al., 1993: measure, configure, validate, and communicate. A suggested overall aim is to provide a validated measurement [START_REF] Robert | Capteurs intelligents et méthodologie d'évaluation[END_REF].

Error measurement correction is one of the most common functionalities. The monitoring of external and internal parameters enables the digital compensation of measurement results in accordance with influencing factors. Storage with the dating of parameters and results can be used to correct linearity and drifts, and to take over missing or absurd measurements. Finally, digital filters may reduce noises.

Self-adjustment is the process through which a transmitter or group of transmitters is run autonomously in order to provide indications corresponding to given values of the measurand. (See IEC 2006 for adjustment, calibration, tuning, and configuring definitions.) [START_REF] Taner | Aspects of intelligent sensor reconfiguration[END_REF] describe four selfadjustment routines which use switches to apply known input signals to the transmitter. Parameters are then set digitally in order that output signals may fit the expected results. Off-set, gain drift, linearity, and temperature adjustments can therefore be done autonomously. If transmitters are redundant, it is possible to make self-adjustments by comparison. In some cases, for example when important drifts are observed through self-diagnosis, adjustments may be ordered by the transmitter itself or by external systems.

Self-diagnosis may use similar procedures as those for selfadjustment to check if expected results are reached when applying appropriate inputs. This can be applied to connections, calculation and data processing units. Internal parameters (temperature of electronics, supply voltage, etc.) and influencing factors can be monitored to check for acceptable conditions. Mathematical techniques or artificial neural networks can use these data for fault detection and isolation (FDI). (A fault is an abnormal condition that may cause a reduction in, or loss of, the capability of a functional unit to perform a required function (IEC, 2002).) The validation then consists in confirming (or not) the relevance of the transmitted information or, at least, in evaluating a confidence degree. There are different validation levels [START_REF] Staroswiecki | Intelligent sensors: A functional view[END_REF][START_REF] Ciame: Bayart | Capteurs et actionneurs intelligents[END_REF]: technological (for hardware resources), functional (for consistent results), and operational (concerning the control system). [START_REF] Moran | Probability estimation algorithms for self-validating sensors[END_REF] describe three probability estimation algorithms for selfvalidating transmitters. Finally, an intelligent transmitter is able to transmit information about measurements: qualitative or symbolic quantities, error bounds [START_REF] Staroswiecki | Intelligent sensors: A functional view[END_REF], confidence in results [START_REF] Moran | Probability estimation algorithms for self-validating sensors[END_REF]; as well as information about the transmitter status (IEC, 2006).

On-line reconfiguration is another functionality which takes advantage of self-diagnoses. Transmitter properties can be modified on-line for metrological requirements (tuning): measuring band and data acquisition frequency according to the observed phenomena and influencing factors. On-line reconfiguration can also have functional purposes: power consumption management and frequency of data transmission. Fault tolerant control (FTC) consists in maintaining transmitter abilities despite abnormal conditions (software errors, faulty components). Transmitter performances may therefore be degraded, but a fault should not develop into a failure at the system level [START_REF] Blanke | Fault-tolerant control systems -A holistic view[END_REF]. In the event of slight faults, digital compensations can be done (accommodation), similarly to error measurement corrections; otherwise, functional adaptations have to be carried out (restructuring), for example by using redundant material.

Communication between the transmitter and the external systems or the human interface is usually digital so that several types of information (measurements, diagnoses) can be transmitted. Moreover, the communication is bidirectional: transmitters send measurement and status information, and receive external commands (IEC, 2006).

Benefits

Intelligent transmitter development seems to be motivated mainly by measurement quality and cost reduction. Error correction and self-adjustment functionalities may improve measurement accuracy by reducing random and systematic errors. Self-diagnoses and on-line configuration can also take part in metrological performances. The direct costs of intelligent transmitters are probably higher due to additional electronics and software used in processing and for functionalities. Nevertheless, these costs are often quite low compared to wiring, installation, and maintenance [START_REF] Ciame | Livre Blanc, Les capteurs intelligents : Réflexion des utilisateurs[END_REF]. From this point of view, intelligent transmitters are appealing to the purchaser, due to their special functionalities. In particular, wiring costs may be reduced by field buses. Finally, digital communication and other functionalities, such as self-adjustment and on-line reconfiguration, make transmitters easier to use and save time [START_REF] Mintchell | Use Sensors Intelligently[END_REF].

Intelligent transmitters and industrial risk prevention

The main transmitter manufacturers propose intelligent systems for industrial safety. The first were differential pressure transmitters, produced since the 1980's [START_REF] Ciame | Livre Blanc, Les capteurs intelligents : Réflexion des utilisateurs[END_REF]. Nowadays, multivariable transmitters combine differential and static pressure, internal and external temperature, and flow rate measurements. A lot of measurement corrections, advanced self-diagnoses, and some reconfigurations are available. Temperature transmitters, installed in pairs, perform self-diagnoses and on-line reconfigurations when faults or failures occur. Infrared gas or flame detectors can usually make error measurement corrections according to dust accumulation, temperature (a significant influencing factor for gas concentration), climate, ageing, etc. Moreover, self-adjustments and diagnoses are also available quite often. Remote control systems for transmitter adjustment and diagnosis, using networks, have also been developed by some manufacturers.

DEPENDABILITY ISSUES

Benefits for dependability?

Although intelligent transmitter provide practical benefits, it is advisable that the effect of their functionalities on dependability be analysed. In this section, a priori advantages and disadvantages of "intelligence" in transmitters are discussed in terms of reliability, maintainability, and safety.

Reliability refers to an item's ability to perform a required function under given conditions for a given time interval (IEC, 1990). The high amount of electronics, programmable units, and software aspects implies new failure causes and modes which are usually not well known. Software errors in particular are very unpredictable (Garret, 2002) and may affect a lot of transmitted information (measurements, diagnoses). To some extent, these disadvantages can be compensated for by fault tolerant strategies, for example by using on-line reconfiguration. Moreover, some faults or failures which appear with ageing, such as drifts, can be prevented by self-adjustments. On the other hand, these functionalities can themselves be the source of additional failures if they are not run correctly, due to hardware or software faults. Digital communication gives rise to the same dilemma. Although it is suggested that wire reduction improves reliability [START_REF] Smith | Considerations for the utilization of smart sensors[END_REF], field buses transport a lot of information which implies that they play a vital role in reliability, especially in terms of common cause failures.

Maintainability takes advantage of self-diagnoses and digital communication. This refers to an item's ability to be maintained in or restored to a state within which it is able to perform a required function (IEC, 1990). Information about drifts, influencing factors, charge exceeding, power supply, etc., may be monitored over time, as well as faults and failures with corresponding circumstances. Preventive maintenance can therefore be optimized by using these data, for example, by predicting any failure occurrences. Field buses and on-line reconfiguration make corrective maintenance easier than heavy wires and non-adaptive systems [START_REF] Mintchell | Use Sensors Intelligently[END_REF].

Safety refers to the ability to avoid unacceptable harm to any given operation. Self-diagnoses allow a better fault and failure coverage which improves safety. In the event of failure detection, safe states can also be defined in more detail. Centralized data processing and digital communication may also improve the efficiency of global risk management.

Intelligent transmitter dependability evaluation

Reliability criteria are often used as input data for selfdiagnoses and validation [START_REF] Moran | Probability estimation algorithms for self-validating sensors[END_REF][START_REF] Staroswiecki | Intelligent sensors: A functional view[END_REF], on-line reconfiguration [START_REF] Guenab | Fault tolerant control system design: a reconfiguration strategy based on reliability analysis under dynamic behaviour constraints[END_REF], and in the design of intelligent transmitter networks [START_REF] Dai | A study of service reliability and availability for distributed systems[END_REF][START_REF] Bhushan | Robust sensor network design for fault diagnosis[END_REF]. However, they are seldom subject to evaluation.

The dependability of digital communication, especially using field buses, has been studied in many works. [START_REF] Cauffriez | Design of intelligent distributed control systems: a dependability point of view[END_REF] present field bus constraints regarding dependability, and failure modes and effect analyses (FMEA) are given. [START_REF] Barger | Dependability study in distributed control systems integrating smart devices[END_REF] quantify the availability of a control system made up by communication network, sensors, control units, and actuators, with coloured Petri nets. In order to take transmission faults into account in field bus availability assessments, Ghostine et al., 2006 use stochastic activity networks (SANs). In both of these approaches, results are obtained by Monte Carlo simulations. Digital communication is usually assessed regardless of the nature of the transmitter, regarded as a "black box", which can be either operational or not. The "intelligent functions" and the different failure modes are therefore not taken into account. [START_REF] Meulen | On the use of smart sensors, common cause failure and the need for diversity[END_REF] aims to analyse common cause failure issues for intelligent transmitters. Failure modes and effect analyses have been proposed in this area. New failure causes have been highlighted compared to other transmitters, which can result in new common cause failure modes.

Dependability issues

Using intelligent transmitters for industrial risk prevention requires dependability evaluations. However, the literature pertaining to these assessments is scarce and seldom includes all the intelligent transmitter particularities. This kind of dependability evaluation should deal with several issues: i. intelligent transmitters are complex systems, that is, numerous interactions exist between components, and also between functions (e.g. self-adjustment may change parameters which are then used in data processing, on-line reconfiguration can modify transmitter performances, etc.)

ii. the behaviour of certain transmitter components, such as programmable units and software, is difficult to predict when faults or failures occur, and may be heterogeneously shared between several functions iii. transmitted data are numerous (measurement, diagnoses), sometimes continuous-natured, and can all be required for control system decisions; all information that may potentially fail, including combinations (e.g. good measurement but bad state information, and vice-versa), must therefore be assessed iv. due to new technologies that are being used, few qualitative (observed failure modes) and quantitative (reliability data) dependability feedback is available.

A qualitative dependability study such as FMEA is therefore hardly exhaustive. Moreover, ii and iii make binary tools (fault trees, reliability block diagrams) inappropriate as it. Moreover, transition states approaches (Markov analysis, Petri Nets) have some difficulty in defining functional and dysfunctional states because of i and ii. A reliability pattern, proposed in the next section, will therefore aim to represent all these intelligent transmitter aspects in the same model.

RELIABILITY MODEL PROPOSAL

A model for intelligent transmitters

Two approaches may be distinguished for complex systems modelling: function-oriented (FO) and object-oriented (OO). FO models aim to analyse the system according to goals and functions which are to be met, including interactions. It is used in the design phase for requirements definitions, and in order to understand the effective operation of the system. Structural Analysis and Design Technique (SADT), as proposed by [START_REF] Robert | Capteurs intelligents et méthodologie d'évaluation[END_REF] [START_REF] Luttenbacher | Intelligent Sensor -Object Approach[END_REF] for intelligent transmitters. Several tools are then available for dependability evaluations using these approaches. Behavioural (or operational) aspects are obtained by linking together functional and material representations. If system behaviour is well-known, safe-SADT [START_REF] Benard | The Safe-SADT method for aiding designers to choose and improve dependable architectures for complex automated systems[END_REF], which has been developed for the design phase, may be used to include this property.

For the present study, the GTST-MLD model, proposed by Modaress et al., 1999 has been chosen. An attractive characteristic of this approach is to give both a functional analysis of the system, using Goal Tree (GT), and a material breaking up, using Success Tree (ST), in a similar and intuitive manner. Material-material, material-function, and function-function relationships are then included by Master Logic Diagrams (MLD), which represent behavioural aspects. This kind of model has already been applied for dependability analyses, for example by Jalashgar, 1998 to identify some complex system failures. A reliability model for an intelligent transmitter pattern is proposed in Figure 2, including basic material architecture detailed in Section 2.2, and functionalities presented in Section 3.1. The functional tree (i.e. GT) breaks the system goal up into global and basic (or physical) functions. A distinction is made between main and supporting functions. The latter have no final goal as far as users are concerned, but are required and act on main functions. For example, self-adjustment may define digital parameters which are used for data processing. In the same way, a material tree (i.e. ST) is made up of system, subsystem and unit elements, as well as main and supporting materials. Finally, MLD consist of circles in colours which represent the relationships between downstream and upstream elements. For example, to obtain diagnostic data, auxiliary transducers are always required (black dots), whereas in some cases, even if these transducers are in failed states, selfadjustment can be satisfactorily performed (grey dots). The impacts of any failures or malfunctions can then be divided among other material and functional performances, according to assumed relationships. This particularity differs from binary approaches and transition state models where states have to be strictly defined. Since Figure 2 is just a pattern, this model has to be adapted to specific case studies.

Prospects for reliability analyses

From this model, some analyses have been proposed by [START_REF] Brissaud | Intelligent Sensors: New Technologies and New Dependability issues[END_REF][START_REF] Brissaud | Reliability Study of an Intelligent Transmitter[END_REF] by translating MLD components into probabilistic values. With basic reliability formulas, it is then possible to assess the total resulting relationships between any material and any function, taking into account direct and indirect (i.e. via supporting elements) relationships. Including material unreliability functions, the probability of each main function malfunctioning can be assessed, as well as possible combinations (e.g. good measurement but false diagnosis, and vice-versa). Further discussions and prospects for quantitative analyses are given by [START_REF] Hu | Evaluating system behavior through Dynamic Master Logic Diagram (DMLD) modelling[END_REF][START_REF] Brissaud | Intelligent Sensors: New Technologies and New Dependability issues[END_REF][START_REF] Brissaud | Reliability Study of an Intelligent Transmitter[END_REF]

CONCLUSION

This paper has examined intelligent transmitters. Definitions and basic material architecture are proposed. Several functionalities may be carried out by these systems: error measurement corrections, self-adjustment, self-diagnoses, online reconfiguration, and digital bidirectional communication. The benefits for industrialists are numerous and motivate the use of these technologies for risk prevention. The intelligent transmitters' dependability therefore needs to be assessed. Reliability, maintainability and safety aspects are further discussed. Such evaluations are quite seldom in literature and usually do not include "intelligent particularities". In fact, classical dependability tools have to deal with some difficulties due to the system complexity and lack of behavioural knowledge. A reliability model is therefore proposed, using an intelligent transmitter pattern. GTST aims at representing both material and functional aspects, and the relationships between these elements are given in MLD. Basic material architecture and system functionalities are included in the model, in order to be used as support for further case studies. Some analyses can be expected, as the assessment of any material failure impact on any function, and the functions' reliability. Other dependability tools can take advantage of this reliability pattern, for example when system behavioural aspects are not well known.

Fig. 1 .

 1 Fig. 1. Intelligent transmitter material architecture

Fig 2 .

 2 Fig 2. Reliability model proposal for an intelligent transmitter pattern

  for intelligent transmitters, Functional Analysis System Technique (FAST), Multilevel Flow Modelling (MFM), and some UML or SysML diagrams as Use Case Diagram are examples of these approaches. OO models give the system structural breaking up with material interactions, such as Fault Tree and UML Class Diagram (denoted Block Definition Diagram in SysML), as proposed by


Florent Brissaud
email: florent.brissaud@ineris.fr

Anne Barros

Christophe Bérenguer

Dominique Charpentier

RELIABILITY STUDY OF AN INTELLIGENT TRANSMITTER

Keywords: Intelligent Transmitter, Reliability, Relationship Analysis, Uncertainty Analysis

An intelligent transmitter reliability study has to deal with several issues: various interactions between both material elements and functions; behaviors of components as programmable units and software which are difficult to predict when faults or failures occur, as well as the consequences on functions processing. A "3-step model" is therefore proposed to include both functional and material aspects, using Goal Tree-Success Tree (GTST), and setting faults and failures as a third full part. Then, Master Logic Diagrams (MLD) aim to represent several types of relationships between faults or failures, material elements, and functions. Probabilities are used for MLD components to take the indeterminate relationships into account. Quantitative assessments are then performed, using an infrared gas transmitter as an example: total relationships between any fault or failure and any function, probabilities of malfunction and failure modes. Moreover, uncertainty analyses show that even if input relationship data are uncertain, precise results can be obtained. These properties make the proposed model especially suitable for evaluating the reliability of intelligent transmitters. Finally, some design issues are discussed, taking advantage of the proposed model.

Introduction

A transmitter can be described as "intelligent" according to advanced functionalities involved in the host system operation:

-The ability to modify its internal behavior to optimize data collection and communicate them in response to a host system [START_REF] Brignell | The future of intelligent sensors: A problem of technology or ethics?[END_REF].

-The bidirectional communication for sending measurement and status information, and receiving and processing external commands [START_REF]IEC 60770-3 Transmitters for use in industrial-process control systems, Part 3[END_REF].

Intelligent transmitters may take advantage of digital technologies to integrate specific functionalities [START_REF] Brissaud | Intelligent Sensors: New Technologies and New Dependability issues[END_REF]: error measurement correction [START_REF] Meijer | Concepts and focus point for intelligent sensor systems[END_REF], self-adjustment [START_REF] Taner | Aspects of intelligent sensor reconfiguration[END_REF], selfdiagnose and validation [START_REF] Staroswiecki | Intelligent sensors: A functional view[END_REF], on-line reconfiguration [START_REF] Guenab | Fault tolerant control system design: a reconfiguration strategy based on reliability analysis under dynamic behaviour constraints[END_REF], and digital bidirectional communication [START_REF] Bayart | Capteurs et actionneurs intelligents[END_REF]. For example, industrialists can get more accurate measurements, cost reductions, and use facilities [START_REF] Ciame | Les capteurs intelligents : Réflexion des utilisateurs[END_REF]- [START_REF] Smith | Considerations for the utilization of smart sensors[END_REF].

The use of intelligent transmitters for industrial risk prevention requires dependability evaluations, for example in accordance with the IEC 61508 functional safety standard [START_REF]IEC 61508 Functional safety of electrical / electronic / programmable electronic safety-related systems[END_REF]. Probabilities of failure on demand have therefore to be assessed in order to determine the system safety integrity level (SIL). However, dependability studies of intelligent transmitters are quite seldom in literature, and do not often take into account the "intelligent" features [START_REF] Brissaud | Intelligent Sensors: New Technologies and New Dependability issues[END_REF]. To this end, a kind of Goal Tree-Success Tree (GTST) technique, combined with Master Logic Diagrams (MLD), as proposed in [START_REF] Modarres | Function-centered modeling of engineering systems using the goal tree-success tree technique and functional primitives[END_REF], has been used in [START_REF] Brissaud | Dependability Issues for Intelligent Transmitters and Reliability Pattern Proposal[END_REF] to model intelligent transmitters. The main advantages are to represent quite intuitively both material and functional aspects, and various interactions. Such models have been introduced in [START_REF] Brissaud | Dependability Issues for Intelligent Transmitters and Reliability Pattern Proposal[END_REF] to support further reliability studies.

In the present paper, a reliability study is proposed, using an extended GTST-MLD model which integrates faults and failures as a third full part, making a "3-Step model". This approach is described in Section 2 for an infrared gas transmitter. Relationship analyses are performed in Section 3 to evaluate the impact of any fault or failure on any material element or function. Probabilities of malfunction and failure modes (according to the main functions fulfillment) are assessed in Section 4. In Section 5, relationship uncertainty analyses tend to show the robustness of the proposed model faced with uncertainties in system behavior. Finally, some design issues are discussed in Section 6.

"3-Step model"

Infrared gas transmitter

A transmitter for measuring gas concentration by infrared absorption is used as a case study. It is made up of two infrared units: the working unit sends a ray with a proportional wavelength to the gas concentration to be measured; and the reference unit sends a ray which does not respond to the gas. Using a wavelength ratio of the two receiving rays, the gas concentration quantity is obtained with corrections of the optics clogging up (mirror and plane), and power fluctuations of sending rays. When a clogging up threshold is reached, appropriate corrections are no longer allowed and diagnosis information is transmitted. Heating elements aim to prevent steam from building up on optics. Temperature is a major influence on gas concentration, temperature sensors are therefore used for digital compensation. When the temperature is out of an acceptable range, this correction is no longer suitable and diagnosis information is transmitted. A digital card carries out processing and calculations, and controls the other units. Finally, all the transmitter material elements share the same power supply, and a converter is required by infrared units.

The following functions are investigated: measure i.e. assessing the gas concentration with appropriate digital corrections; diagnose i.e. checking the influencing quantities in acceptable ranges; self-adjustment of off-set and gain drift, used to regularly set digital parameters required by the two previous functions. Measure and diagnose functions first involve obtaining the appropriate data, then in processing them. Communication aspects with the host system are performed using an analogical card but are not included in the following analyses.

Functions-material elements-faults and failures

The model is based on Goal Tree-Success Tree (GTST), combined with Master Logic Diagrams (MLD), as proposed in [START_REF] Modarres | Function-centered modeling of engineering systems using the goal tree-success tree technique and functional primitives[END_REF]. GTST-MLD has been already used in [START_REF] Jalashgar | Identification of hidden failures in process control systems based on the HMG method[END_REF] to identify complex system failures. In the present paper, faults and failures are introduced as a third full part, making a "3-step model", as depicted in Figure 1.

The functional tree (or goal tree i.e. GT) breaks the system goal (obtain valid measurement and diagnosis) up into global functions (measure, diagnose), and basic functions (obtain data, process data). The supporting functions (selfadjustment) are given in parallel to the main functions (measure and diagnose) because of the impact on them. In the same way, the material tree (or success tree i.e. ST) breaks the system up into subsystems, units, and supporting materials. The third step contains a list of faults and failures for at least one of the material elements. This extension of the GTST model aims to include the dysfunctional aspects as a third full part. Some of these faults or failures may cause a unit failure only in some cases (e.g. the loss of optics heating may have no impact on system if, at this moment, environmental conditions are suitable); and may impact only one unit (e.g. optics clogging up) or several (e.g. common failure to infrared units).

Direct relationships between faults or failures, material elements, and functions, are given in Master Logic Diagrams (MLD), (i.e. matrices DP, DM, PM, MS, MF, and SF), and represent aspects of system behavior. The dot color of MLD components depends on the degree of relationship between downstream and upstream elements.

Relationship analysis

How to model relationships?

To model relationships which are represented by MLD components, several approaches can be proposed:

-Qualitative relationships (e.g. very low, low, medium, and high), as given in Figure 1 with dot colors, can be used for prior analyses. Nevertheless, to allow quantitative results, these values have to be quantitatively translated.

-Architectural relationships describe the deterministic requirements of material elements or functions in terms of other elements. For example, weighted component techniques assign a weight to each downstream element. The upstream element is then assumed to be able to operate if the sum of the weights of its operating downstream elements is equal to or greater than a threshold. These capacitated systems provide extensions of k-out-of-n architectures which operate if at least k among n of its elements operate.

-Stochastic relationships aim at allocating to each downstream element the probability that its failure implies upstream element failure. Indeterminate consequences of faults or failures on the rest of the system are therefore taken into account in that way. An upstream element can reach a failed state due to any downstream element failures, according to given probabilities.

One of the main dependability issues for intelligent transmitters is to deal with the complexity of some components as programmable units and software, because it is difficult to predict the consequences of faults or failures [START_REF] Brissaud | Dependability Issues for Intelligent Transmitters and Reliability Pattern Proposal[END_REF]. Moreover, these faults or failures may heterogeneously act on several material elements and functions. For this reason, a stochastic relationship approach is chosen in the present paper. By allocating probabilities between a downstream element and several upstream elements, it is possible to assess the probability that the downstream element failure implies a failure of any upstream element alone, or any combination of them. At the transmitter level, failure modes can then be defined according to the accuracy of transmitted data (e.g. measurement, diagnoses), used for host system decisions. For example, a software fault may imply a bad measurement but an appropriate diagnosis, or vice-versa. These properties can be directly deduced from the model, without defining all the component failure modes as required by binary tools or state transition approaches.

Example

According to Figure 1, the failure of main material element data processing unit (event M 5 ) directly implies the failure of supporting function self-adjustment (event S 1 ) if event MS 5,1 occurs, and the failure of main function process measuring data (event F 2 ) if event MF 5,2 occurs. That refers to "direct relationships".

In addition, the failure of self-adjustment (event S 1 ) directly implies the failure of process measuring data (event F 2 ) if event SF 1,2 occurs. The failure of process measuring data due to the failure of data processing unit, through the failure of self-adjustment, refers to an "indirect relationship". Notice that direct and indirect relationships are not incompatible.

According to Figure 1, no other event directly implies the failure of main function process measuring data (event F 2 ), (SF s,2 does not exist for s ≠ 1, and MF m,2 represent nil relationships for m ≠ 5). However, the failure of any other main material element (event M m with m ≠ 5) also directly implies the failure of supporting function self-adjustment (event S 1 ), if corresponding event MS m,1 occurs. The probability of failure of process measuring data (event F 2 ), denoted P[F 2 ], can therefore be expressed as follows:

        2 , 1 1 2 , 5 5 2 SF S MF M P F P     (1)                                      2 , 1 1 , 2 , 5 5 2 SF MS M MF M P F P m m m  (2)
The first part of (2) expresses the direct relationships between main materials m and main function 2; and the second part expresses the indirect relationships.

By pivotal decomposition around MF 5,2 , then M 5 :

                                2 , 1 1 , 2 , 5 2 , 1 5
                                   (3)
The same approach has to be taken for each probability of event M m occurrence, denoted P[M m ]. For example, according to Figure 1, the probability of failure of data processing unit (event M 5 ), denoted P[M 5 ], is equal to:

        5 , 2 2 5 , 9 9 5 PM P DM D P M P     (4)                    5 , 2 2 , 2 2 5 , 9 9 5 PM DP D DM D P M P (5)                 5 , 2 2 , 2 2 5 , 9 9 5 1 1 1 PM P DP P D P DM P D P M P         (6)

General formulas

The general formula for the probability of failure of any main function f is given by:

                 s f s s m f m m f SF S MF M P F P , , (7)
                                         s f s m s m m m f m m f SF MS M MF M P F P , , , (8)
             m f m m f MFtot M P F P , ( 9
)
with MFtot m,f the total relationship event between main material element m and main function f, taking into account all supporting functions, and expressed as follows:

           s f s s m f m f m SF MS MF MFtot , , , , (10)
From ( 9), and with a similar approach for events M m :

                                     m f m d m d d f MFtot DMtot D P F P , , (11)
with DMtot d,m the total relationship event between fault or failure d and main material element m, taking into account all supporting material elements, and expressed as follows:

           p m p p d m d m d PM DP DM DMtot , , , , (12)
Finally:

             d f d d f DF D P F P , ( 13
)
with DF d,f the total relationship event between fault or failure d and main function f, taking into account all the direct and indirect relationships, and expressed as follows:

           m f m m d f d MFtot DMtot DF , , , (14)
Notice that events given in matrices MFtot and DMtot are not independent. In fact, the same SF s,f events play a part in several rows of matrix MFtot, and the same MS m,s events in several columns (respectively for events PM p,m and DP d,p in matrix DMtot). Events given in matrix DF are therefore not independent and (13) has to be used with caution. For example, (3) has been obtained by pivotal decomposition.

To make evaluations with classical reliability software tools, equivalent fault trees to the "3-Step model" is proposed in Figure 2, for any main function f. Figure 2.a corresponds to [START_REF] Guenab | Fault tolerant control system design: a reconfiguration strategy based on reliability analysis under dynamic behaviour constraints[END_REF], and including Figure 2.c "transfer in" gate, the obtained fault tree corresponds to [START_REF] Bayart | Capteurs et actionneurs intelligents[END_REF]. Direct relationships between main material elements m and main function f correspond to the first part of ( 8) and to the "F-Direct" gate of Figure 2.a. Indirect relationships correspond to the second part of (8), and to the "F-Indirect" gate of Figure 2.a. The same approach is used for each failure of main material element m (events M m ), respectively with Figure 2.b, and Figure 2.d.

Several interactions between material elements and functions, and the conditional nature of relationship events, make the fault trees difficult to directly perform and interpret. The "3-step model" therefore aims at overcoming these qualitative issues by providing a more intuitive and global view of system material, functional, and behavior aspects. The equivalent fault trees can however be used as practical tools for common quantitative analyses.

Relationship analysis

The relationship analysis consists in evaluating the impact of any fault or failure d on any main function f. These relationship events are given in matrix DF. Even if events are not independent, from (13) it is possible to understand each probability of relationship event individually, as follows:

            d d f f d D D F P DF P   , (15)
That is, if the fault or failure d occurs (event D d ) and not any other, the failure of main function f occurs (event F f ) with a probability equal to P [DF d,f ]. This value can also be interpreted as the individual impact measure of fault or failure d on main function f. Calculating P[DF d,f ] is then quite simple by using [START_REF] Hauptmanns | The impact of reliability data on probabilistic safety calculations[END_REF] and fault trees given in Figure 2. I (second column), and Figure 1. For example, SF 1,2 represents a medium relationship event, thus P[SF 1,2 ] = 0.67. In the same way, P[MF m,2 ] = 0 for m = 1,…,4, and P[MF 5,2 ] = 1 etc. These values are then used by [START_REF] Jalashgar | Identification of hidden failures in process control systems based on the HMG method[END_REF], after compilation with [START_REF] Smith | Considerations for the utilization of smart sensors[END_REF] and [START_REF] Modarres | Function-centered modeling of engineering systems using the goal tree-success tree technique and functional primitives[END_REF]. Finally, the obtained P[DF d,f ] are graphically translated according to Table I (third column), and reported in Figure 1 ("relationship analysis results").

P[DF d,f ] are calculated according to input probabilities given in Table

For example, P[DF 8,2 ] = 0.67. According to Table I, DF 8,2 therefore represents a medium relationship event and, according to Figure 1 caption, the corresponding event dot color is dark grey. An interpretation of this result is "if a failure of temperature sensors occurs, and no other fault or failure, process measuring data will malfunction with a probability equal to 0.67".

At the system level, it is more often relevant to study the impact of each fault or failure on global functions, instead of basic functions. Then, let the following event be:

-G g = {global function g is in a failed state} For the infrared gas transmitter case study, the global functions are: measure (g = 1), and diagnose (g = 2). Corresponding fault trees are given in Figure 3. From (13):

                 d g d d j i g DG D P F F P G P , ( 16
)
with {i,j} = {1,2} if g = 1 and {i,j} = {3,4} if g = 2. DG d,g is the total relationship event between fault or failure d and global function g, taking into account all the direct and indirect relationships, and expressed as follows:

  j d i d g d DF DF DG , , ,   (17)
The individual impact measure of fault or failure d on global function g is therefore defined as follows, and obtained values are reported in Table II:

            d d g g d D D G P DG P   , (18)

Hypotheses and input data

To assess probabilities of functions being in a failed state (i.e. malfunctions), the following assumptions are made:

-Direct relationship events (i.e. events given in matrices DP, DM, PM, MS, MF, and SF) are independent (see Section 3.2.1), and corresponding probabilities are constant according to time.

-Fault or failure occurrences (events D d ) are independent and function to time.

-No maintenance action is performed during the study time.

The probability of fault or failure d occurrence at time t can therefore be denoted P[D d ≤ t]. Corresponding expressions are given in Table III and take into account the "inner architecture" of material elements (not depicted in Figure 1, according to the level of system break-up).

Fault tree based approach

Probabilities of malfunction can then be assessed by equivalent fault trees given in Figure 2 and Figure 3. Input probabilities from Table I (second column) are used for probabilities of occurrences of "basic relationship events". Expressions from Table III are used for probabilities of occurrences of "basic failure events". Probabilities of global function being in a failed state are reported in Figure 5. Failure modes can be defined according to combinations of global function states. These failure modes are described in Table IV and corresponding fault trees are given in Figure 4. For example, if the gas transmitter is able to transmit a good measurement but not a correct diagnosis, the corresponding failure mode is denoted FM1. The reverse failure mode of FM1 is denoted FM2. FM3 corresponds to the situation where neither measure nor diagnose are functioning, and FM0 when both are functioning. This last one is therefore not literally a "failure mode". The probabilities of failure modes FM1, FM2, FM3 and not-FM0, denoted ^FM0, are reported in Figure 6.

Min-max interval based on relationship analysis

A min-max interval for probabilities of global function being in a failed state is given by [START_REF] Hu | Evaluating system behavior through Dynamic Master Logic Diagram (DMLD) modeling[END_REF]. The upper bound is deduced from [START_REF] Guérin | Reliability estimation by Bayesian method: definition of prior distribution using dependability study[END_REF], and the lower bound from ( 18) by neglecting the occurrence of more than one fault or failure (events D d ). These results can be transposed to probabilities of main functions being in failed state (events F f ). [START_REF] Hu | Evaluating system behavior through Dynamic Master Logic Diagram (DMLD) modeling[END_REF] These bounds are reported in Figure 5. Notice that the lower the probabilities of fault or failure occurrence, (e.g. time t is low), the narrower the interval is.

                                      d g g d
≤ t] 1 1 -exp(-5•10 -8 •t) 2 1 -exp(-5•10 -8 •t) 3 1 -exp(-4•10 -7 •t) 4 1 -exp(-4•10 -7 •t) 5 1 -exp(-1•10 -7 •t) 6 1 -3•exp(-6•10 -6 •t) + 2•exp(-9•10 -6 •t) 7 1 -exp(-3•10 -6 •t) 8 1 -2•exp(-5•10 -7 •t) + exp(-1•10 -6 •t) 9
1 -exp(-2•10 -7 •t)

Relationship uncertainty analysis

Uncertainty issues

Input data uncertainty is a substantial issue for reliability evaluation and has been widely investigated in many references: using several data sources [START_REF] Hauptmanns | The impact of reliability data on probabilistic safety calculations[END_REF], propagation of error, Monte Carlo simulations, Bayesian methods [START_REF] Guérin | Reliability estimation by Bayesian method: definition of prior distribution using dependability study[END_REF], fuzzy set theory [START_REF] Tanaka | Faulttree analysis by fuzzy probability[END_REF], and other approaches as evidence, possibility, and interval analyses [START_REF] Helton | An exploration of the alternative approaches to the representation of uncertainty in model predictions[END_REF]. These uncertainty analyses can be basically applied to input probabilities of fault or failure occurrences given in Table III, for example by using fault trees in Figure 2 (analyses are performed on "basic failure events"). The rest of the present paper will therefore not deal with this kind of uncertainty.

However, stochastic relationships are likely to be one of the main concerns of the proposed model. In fact, it is probably quite difficult to assess the direct relationship value between two elements and, in many cases, expert judgments are required. In the present paper, uncertainty analysis will therefore focus on relationships, that is, the uncertainties of stochastic relationship values (i.e.

probabilities P[DP d,p ], P[DM d,m ], P[PM p,m ], P[MS m,s ], P[MF m,f ], and P[SF s,f ]) on total relationship values between faults or failures and global functions (i.e. probabilities P[DG d,g ]).

For example, to deal with uncertainties in GTST-MLD models, fuzzy logic has been used in [START_REF] Hauptmanns | The impact of reliability data on probabilistic safety calculations[END_REF]. In the following, a probabilistic approach (i.e. using probability density functions) is chosen. The aim is to be able to assess variances of total relationship results, and to compare them with variances of input data.

Probabilistic approach for relationship uncertainties

Stochastic relationship values are now random variables, that is, probability values are described by probability distributions. Such "distributed probabilities" will be denoted in bold (i.e. P[AB a,b ]) to distinguish them from "fixed probabilities" used in previous sections. The corresponding probability density functions (pdf) are depicted in Figure 7. Expectancies and variances are reported in Table V. Random variable notations of Figure 7 are given in Table V (second column). Notice that the more the relationship is set as an extreme value (very low or high), the lower the uncertainty (i.e. variance) is assumed to be.

Expectancies and variances of P[DG d,g ] are obtained by

Monte Carlo simulations, using [START_REF] Helton | An exploration of the alternative approaches to the representation of uncertainty in model predictions[END_REF]

Discussion

The variances obtained for total relationship results, which are reported in Table VI, are at least in the same order as variances of input data from Table V and, in many cases, orders of lower magnitude, especially for extreme values (i.e. close to 1). This property tends to show that the proposed model is robust. In fact, even if input data are quite uncertain, results can be obtained relatively precisely and, in some cases, even more precisely than inputs. *Notice that the expectancies are corrected to 2 decimal places. A relationship can therefore have a rounding off expectancy of 1.00, and even so a non-zero variance. To demonstrate this property in a general way is quite difficult due to many dependencies between events which are used to calculate total relationship results. However, to give part of explanation, two basic operations on random variables, required by [START_REF] Helton | An exploration of the alternative approaches to the representation of uncertainty in model predictions[END_REF], can be analyzed.

Let X and Y be two independent random variables which describe probability values (i.e. the sample space is [0, 1]), and with respective pdf f X (x) and f Y (y), thus:

            1 0 1 ) ( ) ( du u u z f u f z f Y X Y X (22)                   1 0 ) 1 ( ) 1 ( 1 1 1 1 ) ( ) ( du u u z u f u f z f Y X Y X (23)
In addition, the following properties can be established:

] [ ] [ ] [ Y E X E Y X E    (24) ] [ ] [ ] [ ] [ ] [ ] [ ] [ 2 2 Y V X V X E Y V Y E X V Y X V        (25) ]) [ 1 ( ]) [ 1 ( 1 )] 1 ( ) 1 ( 1 [ Y E X E Y X E          (26)     ] [ ] [ ] [ 1 ] [ ] [ 1 ] [ )] 1 ( ) 1 ( 1 [ 2 2 Y V X V X E Y V Y E X V Y X V             (27)
Examples of such operations on random variables M, L, and N (see Figure 7 and Table V) are depicted in Figure 8. Expectancies and variances are given in Table VII. Finally, (28) can be deduced from (25), and (29) from (27):

    1 ] [ , ] [ max 1 ] [ ] [ ] [ ] [ ] [ , ] [ min ] [ 2 2       Y V X V Y V Y E X V X E Y V X V Y X V (28)         ] [ , ] [ max 1 ] [ ] [ 1 ] [ ] [ 1 ] [ , ] [ min )] 1 ( ) 1 ( 1 [ 2 2 Y V X V Y V Y E X V X E Y V X V Y X V           (29)
Equations ( 28) and (29) show the necessary and sufficient conditions on two input distributed probabilities to the operation results to obtain lower variances than any of the inputs. In other words, the result is less uncertain than any of its input data. These conditions are, for example, fulfilled by the couple of random variables L and M, but only (28) is fulfilled by the couple of random variables N and M, as it is shown by Figure 8 and results reported in Table VII.

Some design issues

Importance criteria for material elements may be defined with a more global approach by using the model which is proposed in this paper. In fact, several functions are included in the analyses. It is then suitable to assess the component importance according to its impact on failure modes. For example, depending on the application, a bad measurement but a good diagnosis, or the opposite, are not equally critical, especially from a safety point of view. Moreover, these analyses can be performed by classic software tools, using equivalent fault trees.

System monitoring should take into account the "fault or failure coverage" of each function. For example, the previous analyses have shown that the loss of diagnose alone is less likely than any of the other failure modes (see Figure 6). If a checking procedure is required in order to improve system monitoring, the measure should preferably be tested because if it is functioning, a wider part of potential faults and failures is not supposed to have occurred.

The impact of "intelligent" functionalities on system reliability can be assessed. For the given example, the relevance of gas transmitter self-adjustment to reliability may be compared to other options, as for example: no selfadjustment but higher probabilities of failures of infrared units (i.e. P[D d ≤ t] for d = 1, 2, 3, see Table III).

Several kinds of transmitted data (e.g. measurement, diagnoses) may be required by control system decision rules. Optimization of these rules could take into account the system failure mode probabilities e.g. a good measurement but a bad diagnosis is less likely than the opposite for the gas transmitter example.

Conclusion

This paper proposes a reliability analysis using a "3-Step model", based on Goal Tree-Success Tree (GTST) techniques, combined with Master Logic Diagrams (MLD). This approach aims to take into account both material and functional aspects in the analyses, including various interactions. The third part of the model contains a list of faults and failures representing the dysfunctional aspects.

Probabilities are chosen to model the relationships given in MLD. Quantitative analyses are then performed for an infrared gas transmitter example. First, relationship analyses aim to evaluate the impact of any fault or failure on any system function. These results and input probabilities for fault and failure occurrences then enable probabilities of malfunction and failure modes to be evaluated, according to time. Uncertainty analyses show the robustness of the model. Even faced with quite uncertain input data, results can be assessed with at least the same degrees of confidence, and, in some cases, even more precisely. Finally, some design aspects should take many advantages from this model. As a general rule, this approach should be suitable for any reliability evaluations of systems which present at least one of these complexities: at the system level if many interactions exist between components but also between functions; at the components level if some consequences of faults or failures are difficult to predict. In addition, several system output data can be taken into account according to function fulfillments. The proposed model is therefore especially appropriate for intelligent transmitter reliability analyses. Further work will focus on the reliability of control systems using various data from several transmitters to optimize their performances.

Figure 1 . " 3 - 3 . 2 . 1 .

 13321 Figure 1. "3-Step model" (functions-material elements-faults and failures) for an infrared gas transmitter3.2. Stochastic relationships for "3-Step model"3.2.1. Notations and definitionsLet the following events be: -D d = {fault or failure d occurs} -P p = {supporting material element p is in a failed state} -M m = {main material element m is in a failed state} -S s = {supporting function s is in a failed state} -F f = {main function f is in a failed state}

Figure 2 .Figure 3 .Figure 4 . 4 .

 2344 Figure 2. Equivalent fault trees for "3-Step model"

Figure 5 .

 5 Figure 5. Probabilities of malfunction

Figure 6 .

 6 Figure 6. Probabilities of failure modes

  According to the direct relationship events AB a,b given in matrices DP, DM, PM, MS, MF, and SF, four probability laws, denoted Λ h , Λ m , Λ h , and Λ n , are proposed by expert judgments to describe random variables P[AB a,b ]: -if AB a,b represents a high relationship, then P[AB a,b ] ~ Λ h (e.g. P[MF 5,2 ] ~ Λ h ) -if AB a,b represents a medium relationship, then P[AB a,b ] ~ Λ m (e.g. P[SF 1,2 ] ~ Λ m ) -if AB a,b represents a low relationship, then P[AB a,b ] ~ Λ l (e.g. P[MS 2,1 ] ~ Λ l ) -if AB a,b represents a very low relationship, then P[AB a,b ] ~ Λ n (e.g. P[MF 1,2 ] ~ Λ n )

Figure 7 .

 7 Figure 7. Probability density functions of random variables H, M, L, and N given in Table V

  possible to define the pdf of resulting random variables of operations X•Y and 1-(1-X)•(1-Y):

Figure 8 .

 8 Figure 8. Probability density functions of random variable operations 1-(1-L)•(1-M), L•M, 1-(1-N)•(1-M), and N•M

Table

Table II

 II

	Table I. Stochastic relationship values
	Relationship	Input probability	Result translation
	full / high	1.00	0.83 ≤ x ≤ 1.00
	medium	0.67	0.50 ≤ x < 0.83
	low		0.33	0.17 ≤ x < 0.50
	nil / very low	0.00	0.00 ≤ x < 0.17
			. Relationship analysis results
	Fault or	Impact on measure	Impact on diagnose
	failure d		i.e. P[DG d,1 ]	i.e. P[DG d,2 ]
	1		1.00	0.92
	2		1.00	1.00
	3		1.00	0.76
	4		0.76	0.71
	5		1.00	0.93
	6		0.42	0.15
	7		0.65	0.21
	8		0.90	0.77
	9		1.00	1.00

Table IV .

 IV Definition of failure modes Failure mode

		State of global	State of global
		function measure	function diagnose
	FM0	functioning	functioning
		(event ^G1)	(event ^G2)
	FM1	functioning	malfunctioning
		(event ^G1)	(event G2)
	FM2	malfunctioning	functioning
		(event G1)	(event ^G2)
	FM3	malfunctioning	malfunctioning
		(event G1)	(event G2)

Table III .

 III Probabilities of fault or failure at time t

	Fault or	Probability of fault or failure d at time t
	failure d	i.e. P[D d

  and 10,000 draws for each fault or failure d. Results are given in Table VI. Expectancies differ from Section 3.3 (see Table II), because expectancies of relationship values given in Table V are not equal to input probabilities given in Table I.

Table VI

 VI

		. Relationship uncertainty analysis results
	Fault	Impact on measure	Impact on diagnose
	or	i.e. P[DG d,1 ]	i.e. P[DG d,2 ]
	failure	Expec-	Variance	Expec-	Variance
	d	tancy*		tancy*
	1	0.99	6.6•10 -5	0.93	5.7•10 -4
	2	1.00	4.4•10 -7	1.00	9.8•10 -6
	3	0.97	2.3•10 -4	0.83	2.1•10 -3
	4	0.85	2.1•10 -3	0.80	2.9•10 -3
	5	0.99	3.5•10 -5	0.94	4.8•10 -4
	6	0.74	5.0•10 -3	0.54	7.8•10 -3
	7	0.81	3.0•10 -3	0.58	6.7•10 -3
	8	0.92	8.6•10 -4	0.84	2.1•10 -3
	9	1.00	1.2•10 -6	1.00	1.1•10 -5

Table V .

 V Probability laws for distributed probabilities

	Relation-ship	Random variable	Expec-tancy	Variance