The Distribution of Residual Life After Tolerable Faults

deposit_hagen

Publikationsserver der Universitätsbibliothek

Mathematik und

Informatik

Informatik-Berichte 70 – 05/1987

The Distribution of Residual Life

After Tolerable Faults

ABSTRACT

Fernuniversität, FB Math. & Inform.

Postfach 940 D-5800 Hagen

The probability distribution function of residual life after well- defined tolerable faults is given. Depending on the joint distribu- tion(s) of lives of (a) set(s) of components, ready-to-use formulas are derived. As a non-trivial example a cubic multicomputer tolera- ting single and some double faults is discussed under the assumption that a ring of 6 computers must be kept active. The cases of nodes consisting of small communications processors with bigger hosts and of nodes being micro computers are considered.

Key words : residual life, cube computer, fault tree, fault tolerance

CONTENTS O Notation 1 Introduction

2 A general approach using the fault tree

3 Survival of a given largest 1-FT ring of hosts in a cube network

4 Survival of any largest 1-FT ring of micros in a cube network

5 Conclusions 6 Appendix

7 References

0 NOTATION A _ AL(t,t' ,T) a,b

c. l

cdf E{R}

F · f r ' r

-

F

i,j,k,m L

l. J

M N. J

n Pr{B}

pdf

t , t ' ,t" 1T

random event as explained in (4) general random events

indicators (Boolean) component (computer) i

(cumulative) distribution function expectation of the random variable R fault tree function (Boolean);

~= -

cdf pdf of T.

l

cdf pdf of T r

- ^1-F survivor function indices

1-

<"f

residual life super set (set of residual life sets l.)

l

residual life set j (set of components all of which must fail for T to begin)

r

number of elements of L number of elements of l.

J number of system components probability of random event B probability density (function)

special probability density as explained in (7) system

times life of c.

l

life of the longest-living c. of l.

l J

residual life of S system life

unavailability of c.

l

X. i

-

X

m-out-of-n

binary state indicator variable of c.; input to fault

i

tree; X.=1 (0) for failed (functional) state

i

Boolean negation of X; also X=1-X

binary state indicator of S (fault tree output) tolerance of at least k faulty components

F(G) S fails (is ~ood) if at least m out of the given n components fail (are good)

1 INTRODUCTION

Let a fault tolerant system S (typically a FTCS) consist of n compo- nents c

1, . . . ,cn with lives T1, ... ,Tn' respectively. Fora number of reasons users of S can be interested in knowing with which probability S will fail within T units of time after a well-defined tolerable

failure state of S₁which is not followed by immediate repair. Typical reasons for postponing repairs can be the (temporal) impossibility of repairs or very high costs for such repairs. Let T be the time

. . r

from reaching the above tolerable failure state to systern failure .. Then the above probability is the probability distribution function (cumu- lative distribution function, cdf) Fr(T) of Trat T.

A trivial exarnple from [1] will illustrate what is tobe discussed here : Let two computers c

1 and c2 work in hot standby mode such that this FTCS is single fault tolerant (1-FT). Then,for stochastically independent lives T1 and Tz, if Tr starts at rnin{T1,T2},i.e. on the first computer failure, the survivor function of Tr is, obviously,

"'

Fr(T)

=

1-Fr(T) = ^f [f1 (t)F2(t+T) + f2(t)F1 (t+T) ]dt,

0

( 1 )

where f. and F. are pdf and cdf of T

1. , respectively.

l. l.

Check: To verify that Fr(0)=1, notice that in (1) t 1 (t)i\ (t) +

tz

(t)F1 (t) = - ~t

[F

₁ (t)F

2 (t)

J.

^{( 2)}

If cz is cold standby for c1, then, trivially, Tr= Tz, such that

( 3)

In section Z a general approach will be outlined. This approach is not useful for typical repairable systems but,rather, for systems

which are not repaired prior to the first systern failure. The general

approach allows for general joint cdf's of lives of groups of ^{C. 1 S}

1.

and for general redundancy structures so long as F (O)=O. (In [1]

r

slightly different assumptions are made.) In sections 3 & 4 cubic configurations of 8 computers will be discussed as non-trivial

examples. Even though in both cases the cube is the over-all system topology, there are considerable difference between the way standby is implemented for hosts and for micros, respectively.

The concepts of a residual life set l. and the residual life super J

set L are so new and important that they deserve some introductory comments. The residual life set

f.

is a set of components such that,

J

at the moment all of them are down, the system has reached a state where residual life starts. If, for instance, lj={c

1,c 2,c

3}, then in a non-reparable system, initially c

1,c 2,c

3 are good. At some point t 1 for the first time a new component failure will hit l j , i.e. c

1 or c2 or c3 will fail as the first of fj. Later on, at t

2, a second element of lj will fail, and at t

3 the last good element of lj will fail. Exactly at t 3 the residual life (with length Tr) starts, as far as l. is concerned. However, there may be more than one l . , all

J J

~ of them being elements of L, and the different

f.

need not be pair- J

wise disjoint. Furthermore, the system need not necessarily fail once all the c. of an l. have failed and one further c. has failed.

l. J l.

2 A GENERAL APPROACH USING THE FAULT TREE

Example (1) was so simple because of the independence of T

1 and T

2•

A general approach should take stochastic (s~)dependence of components into account. Due to Karpinski [1] one can define an event A depen- ding on t , t ' , and t and on the so-called residual life super-set L.

L i s a set of so-called residual life sets

t

1 , ••• ,lM of components ci such that residual system life Tr begins on the failure of the last ci of any ljEL to fail. More precisely, for a given S let

A _ AL ( t , t ' , t )

- u

M ^{[(Tl• ~ t ) n (Ts > t' + t)] i t I ~ t I}

j =1 J

( 4)

where T0 _ is the "failure time" of l . , i.e. the life of the last c.

,t.J J l

of l. to fail. Hence, in case of hot standby, if any,

J

max i:c.El.

l J

T. l ( 5)

Now, a probability density is needed such that the desired survivor function Fr of Tr is found as

-

00

F r (t)

=

J P ( L t , t t. )d 0

( 6)

The usefulness of pL(t,t) is obvious frorn the fact that at any time t the system S may enter a state where residual life begins, and i t makes sense to add (integrate) all contributions to

F (,)

originating

r

from different t, since they are (infinitesimal) probabilities of (infinitesimal) disjoint random events.

Note that pL(t,T) is not the usual probability density function (pdf) belonging to Fr(T). Rather,

PL ( t, T)

=

^{cl t P { AL (} t, t ' , T) } / •

a

t'=t

( 7)

Tiie partial differentiation produces a quantity sirnilar to the pdf of Tr. Yet, at the same time, T

5>t'+T rnust be ensured. Finally, i.e.

after the differentiation with respect t o t , the variable t' is decreased to equal t yielding Tr>T,

Note that i t would be conceptually wrang to replace (7) by _

a

0 t P { AL ( t , t , T ) } , ( 7 a)

since pL(t,,) is only a density with respect to Tl

1 , ... ,TfM' but not with respect to T

5. Hence t ' and T rnust be treated as constants in b1e (partial) differentiation of (7). An example of the non-useful- ness of ~L(t,T) is given in the appendix.

As a trivial example the 1-0UT-OF-2:G case is treated once rnore for hot standby: Here

and, by (4),

Note that here T

5 can be T

1 or T 2 .

Hence, f o r t ' ~ t , by Pr{a

u

^{b} =} Pr{a} + Pr(b) - Pr{a

n

^{b} :}

Pr{A}

=

^Pr{(T,~t) n (T2>t'+T)} + Pr{(T2;:::;t) n (T,>t'+,)}

- Pr { ( T 1 ;:::; t )

n (

T 1 > t ¹ + L )

n (

T 2 ~ t )

n (

T 2 > t' + L ) } • ( 9)

Since (T.~t )n(T.>t' t,)=~ for t'2t , the last probability of (9) is

l l -

zero. furthermore, for s-independent T 1 ,T2, by Pr{a n b}

=

Pr{a}Pr{b} :

Pr { AL ( t, t ' , , ) } - F

1 ( t )

F

2 ( t' + , ) + F

2 ( t ) F

1 ( t' + , ) , ( 10)

Finally, by (7)

( 1 2)

which, when inserted in (6), yields (1).

For cold standby the above approach must be handled with care to yield correct results. It is essential that in (7) the differentia- tion with respect t o t (i.e. the different Tf_) is executed prior to setting t ' = t . This ensures that the (partial) differentiation J

does not concern components surviving t . On the other hand, if t is the activation time of a cold standby unit whose life ends with systems life₁i t is necessary to reflect this in T

8• In the 1-0UT- OF-2:G case for cold standby of c2 for c1, instead of (10)

Pr{A}

=

^F₁ ^{( t '}

)F

2 ( , ) , which yields

and hence the correct final result

00

Fr ( , ) = F2' , )

^f f

1 ( t ) d t

= F

2 ^{(T ) •}

0

( 1 oa)

( 1 2a)

(3a)

If the primary component ci and its dedicated cold standby spare ck both belong to the same

l.,

then simply both forma new unit and the

J

pdf of the maximum of Ti and Tk is replaced by the pdf of the surn of Ti and Tk.

Systems with more than 3 different components [1] cannot be treated in an ad-hoc manner as in the above trivial example. Rather, the concepts of fault tree,or set of cut sets, or reliability block dia- sram should be applied. Here, the fault tree is preferred, being the graph of the Boolean function

xs ( t) ⁼

Cf [

^x ₁ ( t) ... , xn ( t ) ] -

r

^<t>

where

{

1 ' if c. is faulty _].

X. =

].

o,

else,

and

{

^{1 , if}

^s

is faulty xs ⁼

o,

else.

Now, let l.

=

^{c.

J J 1 c. , . . . ,c. }.

J2 JN.

J

Then, as an equation for events,

(T.e_. ~ t ) = J

N. J

[ /\ X. ( t ) =1 ] • i=1 J i

'

Furthermore, by defini tion of T 5 and

'f ,

(TS > t' + , ) = [ 'f(t'+,) = O] = [ Cf(t' +-.) = 1].

( 1 3)

( 1 4)

( 1 4a)

( 1 5)

( 1 6)

( 1 7)

By (16) and (17) the event A of (4) can be represented as follows : M

A -

V [ (

^{T .e. . ~} t ) n (T

s

> t' +,) J

j=1 J

M N.

= [ _{j=1 i=1}

V "J

^X. _Ji ^{( t r,<t'} +,)=1 ], (H / X.=1;k=1, ••• ,N.

Jk J

where

1/(t' + , )

= <f

[x

1 (t'+,), . . . ,xj

1_ 1 (t' +,) ,1,xj1+ 1 (t' +,),

X . = 1 , k= 1 , • • • , N .

Jk J

. . . xj _

1(t'+,),1,Xj +1(t'+,), . . . ,Xn(t'+,)].

Nj Nj (19)

Equation (18) is correct, since fort' ~t (and postponed repair) X. (t )=1 irnplies X. (t'+,)=1,

Ji Ji

and, by Xj(t)Xj(t)=1, Xji (t¹+L) can be replaced by 1.

As shown in detail in [2] for indicator quantities aiE{0,1}

/ \ a. = II a.

i l i l

V

_. ^a. _l ⁼

l

1- II a. a. = 1-a.

i ^{l l l}

and, as ernphasized in [3], for any indicator b Pr{ b=1} = E{ b }.

Hence, by (18) M Pr { A}

=

1 - E { II

j=1

N. J

[1- II X. ( t

i=1 Ji

'/ (t'+-r) ]}.

lx.

=1;k=1, ... ,N.

Jk J

( 20)

( 21 )

(22)

In rnany practical situations, especially those of strict^1> 1-FT, all N.

=

1 , j

=

1 , ••• ,M.

J

Then Pr{A}

M

=

1 - E { II [ 1- X . ( t )

Cf' (

^t' +,) ] } .

J. =1 J /

X. =1

J

Furtherrnore, if in that case M=n, then

1) Strict k-FT means k and only k faults are tolerated.

(22a)

n

Pr {A}

=

1- E { II [1- X.(t)

Cf

( t ' + , ) ] }

j= 1 J /X.=1

J n

=

^E

o:

^X.(t

^)Cf/

(t'+-r)}-+ . . . j=1 J 1

x

=1

n +(-1 )n+ 1 E{ II j=1

j X. ( t )

J ^~ ( t ¹ +T) }

'lx.=1

J

EXAMPLE 2.1 : 1-0UT-OF-2:G SYSTEM In the 1-out-of-2:G case

so that for L={l1 ,l2}, l1={c1}, l2={c2}:

x1 (t ⁾

'f;

(t' +·r) = X1 (t )x 2 (t'+,l, X =1

1

-

>x

1ct'+,>.

X2(t ⁾ <f;(t'+-r) = x 2 (t X =1 2

Insertion in (22) yields Pr{A} = 1- E{[1-x

1 (t

)X

2(t'+-r) ][1-X

2(t

)x.

1 (t'+r)]}

(22b)

(23)

(24)

( 2 5)

( 26)

However, in case of no repair (prior to system failure), f o r t ' ~t X. (t

)X.

(t' +,) = 0 .

l. l. (27)

Hence, as by the first term of (22b),

(28)

Now, for s-independent T

1 ,T₂ and hot standby Pr { A}

=

E { X

1 ( t ) } E {

X

₂ ( t' + T ) } + E { X

2 ( t ) } E {

X

₁ ^{( t' + T )}}

as in ( 10) .

In case of cold standby of c

2 for c

1 (28) must be specialized as follows

( 2 9)

1) In

x

₂ (t'+T) the argument must be decreased by t ' , since T

2 starts only at t .

2) For t'~t always

see figure 1.

t

^/x₁ ^x₂

1 / " '

1

I :---

0

l=========-=-:..:::!tlii _____________ ... :

² ... -.---... -;;;;.i _ _ _ _ _ _ _ ~) 0

Fig. 1

T1 t

Indicator processes for the 1-out-of-2:G system in case of cold standby of c2 for c1•

Hence, for cold standby (of c2 for c1) (29) has tobe replaced by ( 30)

Pr{A} = F

1 ^(t')F2(,), (31)

see (10a) and the discussion on its further processing.

EXAMPLE 2.2 : 2-0UT-OF-3 SYSTEM

In the 2-out-of-3:G(F) case i t is well known that

xi ( t )

Cf (

^{t, +, ) =} xi ( t ) x j ( t, +, ) xk ( t, +, ) ; i , j , k E { 1 , 2 , 3 } .

/X.=1 ifjfkfi

l

By ( 22)

Pr{A}

=

^1-E{[1-X

1(t

)X

2(t'+,)X

3(t'+,)]

[1-X2(t )X1 (t'+,)X3(t'+,)]

[ 1-x

3 (t )

x

1 (t' +,)

x

₂ (t' +,)]}.

By (27) this is readily simplified to

+E{X3 (t )X1 (t' +,)X2 (t' +,)}.

Pr{A} = F

1 (t )F\ (t' +-r)F\ (t' +,) +F

2 (t )F

1 (t' +,)F

3 (t' +,) +F3(t }F,(t'+-r)F2(t'+-r).

In an ad-hoc fashion this result follows also from

A =[(T1 ~ t } n (T2 > t'+-r) n (T3 > t'+,}]

n (T 1 > t ¹ + T} n (T 3 > t ¹ + T)]

n

^(T ₁ > t' + , )

n

^(T ₂ > t' + , )

L,

( 32)

( 33)

(34)

( 35)

( 3 6)

( 3 7}

taking into account that the events of the 3 lines of the r.h.s. of (37) are mutually exclusive.

Finally, according to (7) and (6)

i\(T)

=

J [f1 (t)F2(t+T)F'3(t+T) + f2(t)F1 (t+T)F3(t+T)

0

+ f3 (t)F1 (t+T)F2 (t+T) ]dt.

For cold standby of c

3 for c

1 and c2 (whichever fails first) {35) must be specified as follows

1) In X3 (t'+,) the pararneter t' must be deleted.

2) The last line is zero, since f o r t ' ~t always

x

₃ <t )x

1<t'+T)x2<t'+T)

= o.

Hence, here for s-independent T 1,T

2,T

3 (38) is replaced by

F ( T)

r

00

= f [f, (t)F2 (t+T)F'3 (T) + f2 (t)F, (t+T)F'3 (T)] dt

0

which is a plausible result.

Cornrnent: Exarnple 2.2 should have the sarne solution, if

were used. Obviously, then

X . { t ) CD ( t ' tT ) = X . ( t ) [ 1 -X . ( t ' + T ) - Xk ( t ' + T )

l.

Tl

^{l. J}

x.=1

l.

which equals (33), since 1-X=X.

( 38)

(39)

(40)

3 SURVIVAL OF A GIVEN LARGEST 1-FT RING OF ROSTS IN A CUBE NETWORK In this section a cubic systern of 8 computers with 1-FT is investi- gated. If one of them fails, i t is replaced by a standby unit as shown in figure 2. The single computer is supposed tobe composed of an (almost) ideally reliable communications microprocessor and a host cornputer that fails (because of electromechanical peripherals) at a considerable rate. More details of the reliability theory of such systems can be found in [4].

Fig. 2 Cubic computer system with cornputers2 and 5 as spares for cornputers 0,3,6 and 1,4,7, respectively. The ring with the fat links must work.

It is assumed that the system fails as soon as i t is no langer possi- ble to configure a ring of 6 computers or their spares. Since the system is a series system of two 2-out-of-4:F subsystems

(42)

Now, let L={l.;i=1 , . . . ,8}, l.={c.};i=1, . . . ,8, which means that Tr

i i i

starts on the first host failure. Here, for use in (22), first of all,

Cf

must be transformed to quasi-polynomial form, i.e. a poly-

- -

nomial of the literals

x

₀ ^{, ...}

,x

₇

,x

₀ ^{, ...}

,x

₇. In order to find such a form of

Cf

one could start by transforming (42) by ade Morgan for- mula. However, even then there would result a lengthy disjunctive normal form of non-disjoint terms. Hence, i t is better to use the fact that

</

is the Boolean function of the event tree (for operation) of a pair of 3-out-of-4:G systems. In detail, since in a canonical disjunctive normal form any OR (v) can be replaced by plus (+) [2]

Simplifying according to X+X=1 yields

where

and

Now,

'fix

=1 = 0

rA/

=

^{x1 x4x7}

T, X =1 5

11 '

Cf;

^{X =1}

=

2

</;X -

^{=1 =}

4

f' _{1 x}

₌₁

7

(44)

(44a)

( 4 4b)

1f

^{2 '}

( 4 5)

'Y"1 '

Obviously, since 'f1 and 12 are Boolean, so that lfi2= fi;i=1,2

{ ^{- -}

^XOX2X3X6

^{- -}

^{1f2 i,jEI1,i~j,I1}={0,2,3,6}

Cf/X.=1 C/;X.=1

=

- - - ^-

1. J

x

₁

x

₄

x

₅

x

₇ ~1 i,jEI

2,i~j;I

2:=;{1,4,5,7}. (46)

Hence, by (27), for i,jEI1, and

r

₂, respectively Xi (t )

fO/

(t' +T)X. (t

X.=1 J Y?X.=

1 (t'+T)

=

0. ^{( 4 7)}

1. _J

Furthermore, for ücI

1,jEI 2

1

7

l

⁷

1 )

P'!X.=1 So;X.=1

=

_k=O IT X _k

1f

^{11/'2 =} _k=O ^{IT Xk}

1. J k~i,j k~i,j

( 4 8)

so that for these i and j

7 Xi(t)

<//

(t'+T)X.(t

X.=1 J

$";

^{X .}

⁼

^{1 ( t' + T )}

⁼

J

X. (t )X. (t

1. J ) IT

Xk (

t ' + T ) •

1. k=O

k~i,j

( 4 9)

Obviously, because of (27) third and higher order terms vanish, i.e.

1EI Xi(t) <p/X.=1 (t'+T) = 0 1.

card(I)e::3.

Inserting the above results in (22b) yields 7

Pr{A}

= l

E [X, ( t )

r / _ (

^{t I +,:) ] - ~ • E [ xi ( t ) xj ( t}

i=1 1. Xi-1 1.EI

1,JEI 2

1) By the idempotence law

x

²

=x

this does not imply

"f

1

y

₂^=1.

(50)

7

) TI

Xk (

t' +T ) ].

k==o k;ti,j

( 51 )

Finally, for s-independent T

0 , ... ,T

7 for hot standby, using

d d

dt [E{Xi(t )}E{Xj(t )}]

=

dt [Fi(t )Fj(t )]

=

f.(t )F.(t) + F.(t )f.(t

i J i J

F (

L)

r

7 oo _(F)

= I

^{I f. (t} ~ (t+-r)dt}

i=O o ¹ l/X.=1

i

00 7

f [f.(t}F.(t}+F.(t}f.(t)][ n

i J i J k=O

where

- (F)

Cf/X.=1

i

is

k;ti,j

(.i with every X replaced by F.

T/X.=1

i

For instance, from (45) and (44a)

( 5 2)

( 5 4)

For equal computers, i.e. for

t

0= •.. =f

7=f, F

0= •.. =F

7=F (53) is readily simplified to

F ( L)

r ⁼ 8 ; f(t) [F(t+-r) J6[1+3F(t+T) ]dt - 32; f(t)F(t) [F(t+T) ]6 dt

0 0

= 8

~

f(t)[F(t+-r)]⁶[1+3F(t+T)-4F(t)]dt.

0

(55}

Check:

F

^(o)

r

00

= 8 J f(t)[F(t)] 7

dt = 1.

0

Proof : Since

f(t) [F(t) Ji

= -

i:1 ~t [F(t) Ji+1 '

obviously, (for non-negative random variables)

00

J f (t)

[F

(t) Jidt

=

0

1 i+1 .

( 56)

( 5 7)

( 58)

(55) is plausible. It means that whichever of the 8 hosts fails as the first one at t, the 3 others of the same 3-out-of-4:G group must work at t+T, and at least 3 of the other 3-out-of-4:G group

00

F (T) = 8 J f(t) [F(t+T) )3

{F(t+T)4

+ 4[F(t+T) J3

[F(t) - F(t+T) ]}dt.

r 0

00

=

⁸ J f(t) [F(t+T) J⁶[4F(t) - 3F(t+T) ]dt,

0

which equals (55) because of F=1-F.

In the exponential case,where

f(t) = \ exp(-\t), F(t)=exp(-\t), (55) yields

F ( ^{T )}

=

exp ( -6 \ ^{T ) •} r

( 55b)

(59)

( 60)

This is correct since, after the first component failure, system failure rate is 6A, and not 7A, since the non-used spare component's failure would not mean system failure.

4 SURVIVAL OF ANY LARGEST 1-FT RING OF MICROS IN A CUBE NETWORK Again the fat ring of figure 2 should be kept wo"king, and L is that of section 3. However, in case of micros (without peripherals) i t appears tobe adequate to replace a failing ci by one on a surface diagonal of the cube. For instance, in case of its failure c

0 would be replaced by c

5, including the replacing of links (4,0) by (4,5) and (1,0) by (1,5), respectively. Now,one has no longer a series system of 2 mutually independent 3-out-of-4:G systems, since after the first failure of a working (non-standby) unit and its replace- ment only one failure in the other triple of working units can be tolerated. For instance,if c

0 is the first unit to fail, i t is replaced by c5, and c1 ,and c4 will not accept any further data from c

0 . In this case c2 is a dedicated spare for c7 only. According- ly, here the Boolean function of the fault tree is

( 61 )

1 )

Since (61) is more complicated than (42) but is similar in structure, only the case of equal units (micros) will be investigated further.

If a spare is the first component to fail, this adds to p(t,T,L)

2 f(t) [F(t+T) J⁶[4F(t) - 3F(t+T) ]. ^{( 6 2)}

If a non-spare component fails first, then this contributes 6 f(t) [F(t+T) J5

{[F(t) ]2

- [F(t) - F(t+T) ]2

}, ^{( 6 3)}

1) A short disjunctive normal form of

<f

is unate and consists exclusively of terms of length 2.

where

[F(t) ]2 - [F(t) - F(t+T) ]2

= 2.F(t)F(t+T) - [F(t+T) ]2

=

Pr{At most 1 of 2 components failing after t fails between t and t+T}.

Adding up yields

CX)

F (T)

=

4 f f(t) [F(t+;) ]6

[SF(t) - 3F(t+-r) ]dt.

r 0

Check: For ,=O (65) equals (56).

In the exponential case (59)

CX)

Fr(,) = 4A f exp(-At)exp[-6A(t+,) ]{5 exp(-At)-3 exp[-A(t+-r) ]}dt

0

CX)

( 6 4)

( 65)

=

4A exp(-6A,) f exp(-7At) [5 exp(-At)-3 exp(-At)exp(-A,) ]dt

0

= ~

exp(-6A,) [5 - 3 exp(-A,) ]. ^(65a)

5 CONCLUSIONS

The examples of this paper show that the survivor function Fr(,) of residual life time after tolerable faults can be found in a systema- tic way. From F (,) stochastic parameters of interest are readily

r

derived. Typically, the mean residual life is

CO

=

^!

F

(T) d-r.

0 r

( 66)

As in many similar situations, for non too big systems, i.e. for moderaten, in case of equal components "common sense" combinatorics yields results much easier.

6 APPENDIX

Here i t is shown that,e.g. in the case of the 1-out-of-2:G system, pL(t,,) must not be replaced by pL(t,,).

From ( 10)

Pr{AL (t,t,,)}

=

F

1 (t)F

2 (t+,) + F2 (t)F

1 (t+,) Hence, by (7a)

pL(t,,)

=

f1 (t)F2(t+,) - F1 (t)f2(t+,) + f2(t) F1 (t+,) - F2(t)f1 (t+,).

Clearly, only pdf's of cornponents failing as first cornponents are useful. Hence the two negative terms must be deleted, which yields

( 1 2) •

7 REFERENCES

[1] Schneeweiss

w.,

Karpinski J.: The theory of delayed repair for all systems with 2 or 3 components. Informatikber.

12/1986. Fernuniversität Hagen.

[2] Schneeweiss W.: On a special Boolean algebra for indicator variables. ntz Archiv 3 (1981), 53-56.

[3] Barlow R., Proschan F.: Mathematical theory of reliability, New York: Wiley 1965.

[4] Schneeweiss W.: Steady State Reliability of Hypercube Multi- computers Tolerating Single or Double Faults. Proc. 1st European Workshop on Fault Diagnostics, Reliability and Related Kn0wledge-Based Approaches. Amsterdam: Reidel

1987.