Modern Statistical And Mathematical Methods in Reliability (Quality, Reliability and Engineering Statistics)

Modern 5tatistical and Mathematical Methods in Reliabilitu SERIES IN QUALITY, RELIABILITY & ENGINEERING STATISTICS Se...

Author: Sallie Keller-McNulty

101 downloads 1447 Views 18MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

Modern 5tatistical and Mathematical Methods in Reliabilitu

SERIES IN QUALITY, RELIABILITY & ENGINEERING STATISTICS Series Editors: M. Xie (National University of Singapore) T. Bendell (Nottingham Polytechnic) A. P. Basu (University of Missouri)

Published Vol. 1:

Software Reliability Modelling M. Xie

Vol. 2: Recent Advances in Reliability and Quality Engineering H. Pham

Vol. 3:

Contributions to Hardware and Software Reliability P. K. Kapur, R. B. Garg & S. Kumar

Vol. 4:

Frontiers in Reliability A. P. Basu, S. K. Basu & S. Mukhopadhyay

Vol. 5:

System and Bayesian Reliability Y. Hayakawa, T. Irony& M. Xie

Vol. 6:

Multi-State System Reliability Assessment, Optimization and Applications A. Lisnianski & G. Levitin

Vol. 7: Mathematical and Statistical Methods in Reliability B. H. Lindqvist & K, A. Doksum Vol. 8 :

Response Modeling Methodology: Empirical Modeling for Engineering and Science H. Shore

Vol. 9: Reliability Modeling, Analysis and Optimization Hoang Pham

Series on Quality, Reliability and Engineering Statistics

vo 1. 10

Modern Statistical and Mathematical Methods in Reliabilitu

editors

Alyson Wilson, Sallie Keller-McNulty

Yvonne Armijo Los Alamos National Laboratory, USA

Nikolaos Limnios Universit6 de Technologie de CompiBgne, France

KsWorld Scientific N E W JERSEY

*

LONDON

SINGAPORE

-

EElJlNG * SHANGHAI

HONG KONG * TAIPEI

CHENNAI

Published by

World Scientific Publishing Co. Pte. Ltd. 5 Toh Tuck Link, Singapore 596224

USA ofice: 27 Warren Street, Suite 401-402, Hackensack, NJ 07601 U K oflce: 57 Shelton Street, Covent Garden, London WC2H 9HE

British Library Cataloguing-in-PublicationData A catalogue record for this book is available from the British Library.

MODERN STATISTICAL AND MATHEMATICAL METHODS IN RELIABILITY Copyright 0 2005 by World Scientific Publishing Co. Pte. Ltd. All rights reserved. This book, orparts thereoJ may not be reproduced in any form or by any means, electronic or mechanical, including photocopying, recording or any information storage and retrieval system now known or to be invented, without written permission from the Publisher.

For photocopying of material in this volume, please pay a copying fee through the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, USA. In this case permission to photocopy is not required from the Publisher.

ISBN 981-256-356-3

Printed in Singapore by World Scientific Printers (S)Pte Ltd

PREFACE

This volume is published on the occasion of the fourth International Conference on Mathematical Methods in Reliability (MMR 2004). This bi-annual conference was hosted by Los Alamos National Laboratory (LANL) and the National Institute of Statistical Sciences (NISS), June 21-25, 2004, in Santa Fe, New Mexico. The MMR conferences serve as a forum for discussing fundamental issues on mathematical methods in reliability theory and its applications. They are a forum that bring together mathematicians, probabilists, statisticians, and computer scientists from within a central focus on reliability. This volume contains a careful selection of papers, that have been peer-reviewed, from MMR 2004. A broad overview of current research activities in reliability theory and its applications is provided with coverage on reliability modeling, network and system reliability, Bayesian methods, survival analysis, degradation and maintenance modeling, and software reliability. The contributors are all leading experts in the field and include the plenary session speakers, Tim Bedford, Thierry Duchesne, Henry Wynn, Vicki Bier, Edsel Peiia, Michael Hamada, and Todd Graves. This volume follows Statistical and Probabilistic Models in Reliability: Proceedings of the International Conference on Mathematical Methods in Reliability, Bucharest, Romania (D. C. Ionescu and N. Limnios, eds.), Birkhauser, Series on Quality, Reliability and Engineering Statistics (1999); Recent Advances in Reliability Theory, Methodology, Practice, and Inference, Proceedings of the Second International Conference on Mathematical Methods in Reliability, Bordeaux, France (N. Limnios and M. Nikulin. eds.), Birkhauser, Series on Quality, Reliability and Engineering Statistics (2000); Mathematical and Statistical Methods in Reliability, Proceedings of the Third International Conference on Mathematical Methods in Reliability, Trondheim, Norway (B. Lindqvist and K. A. Doksum, eds.), World

V

vi

Preface

Scientific Publishing, Series on Quality, Reliability and Engineering Statistics 7 (2003). The editors extend their thanks to Hazel Kutac for the formatting and editing of this volume.

A. Wilson Los Alamos National Laboratory Los Alamos, N M , USA N. Limnios Universite' de Technologie de Compiggne Compi&gne, France

S. Keller-McNulty Los Alamos National Laboratory Los Alamos, N M , USA Y. Armijo Los Alamos National Laboratory Los Alamos, N M , USA

CONTENTS

Preface

V

1 Competing Risk Modeling in Reliability Tim Bedford Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . Independent and Dependent Competing Risks . . . . . . . Characterization of Possible Marginals . . . . . . . . . . . Kolmogorov-Smirnov Test . . . . . . . . . . . . . . . . . . Conservatism of Independence . . . . . . . . . . . . . . . . 1.6 The Bias of Independence . . . . . . . . . . . . . . . . . . 1.7 Maintenance as a Censoring Mechanism . . . . . . . . . . 1.7.1 Dependent copula model . . . . . . . . . . . . . . . 1.7.2 Random clipping . . . . . . . . . . . . . . . . . . . 1.7.3 Random signs . . . . . . . . . . . . . . . . . . . . . 1.7.4 LBL model . . . . . . . . . . . . . . . . . . . . . . . 1.7.5 Mixed exponential model . . . . . . . . . . . . . . . 1.7.6 Delay time model . . . . . . . . . . . . . . . . . . . 1.8 Loosening the Renewal Assumption . . . . . . . . . . . . 1.9 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . .

1 3 5 7 8 9 10 11 11 12 12 13 13 13 15 15

Game-Theoretic and Reliability Methods in Counter-Terrorism and Security Vicki Bier

17

2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Applications of Reliability Analysis to Security . . . . . . 2.3 Applications of Game Theory to Security . . . . . . . . . .

17 18 19

1.1 1.2 1.3 1.4 1.5

2

1

vii

viii

3

Modern Statistical and Mathematical Methods in Reliability

2.3.1 Security as a game between defenders . . . . . . . . 2.4 Combining Reliability Analysis and Game Theory . . . . . 2.5 Directions for F’uture Work . . . . . . . . . . . . . . . . . . 2.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21 23 24 25 25 26

Regression Models for Reliability Given the Usage Accumulation History Thierry Duchesne

29

3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.1 Definitions and notation . . . . . . . . . . . . . . . 3.1.2 Common lifetime regression models . . . . . . . . . 3.2 Other Approaches to Regression Model Building . . . . . . 3.2.1 Models based on transfer functionals . . . . . . . . 3.2.2 Models based on internal wear . . . . . . . . . . . . 3.3 Collapsible Models . . . . . . . . . . . . . . . . . . . . . . 3.3.1 Two-dimensional prediction problems . . . . . . . . 3.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Bayesian Methods for Assessing System Reliability: Models and Computation Todd Graves and Michael Hamada 4.1 Challenges in Modern Reliability Analyses . . . . . . . . . 4.2 Three Important Examples . . . . . . . . . . . . . . . . . . 4.2.1 Example 1: Reliability of a component based on biased sampling . . . . . . . . . . . . . . . . . . . . 4.2.2 Example 2: System reliability based on partially informative tests . . . . . . . . . . . . . . . . . . . 4.2.3 Example 3: Integrated system reliability based on diverse data . . . . . . . . . . . . . . . . . . . . . . 4.3 YADAS: a Statistical Modeling Environment . . . . . . . . 4.3.1 Expressing arbitrary models . . . . . . . . . . . . . 4.3.2 Special algorithms . . . . . . . . . . . . . . . . . . . 4.3.3 Interfaces, present and future . . . . . . . . . . . . 4.4 Examples Revisited . . . . . . . . . . . . . . . . . . . . . .

29 30 31

32 33 34 36 36 38 38 38

41 42 42 43 44 45 46 46 48 48 49

Modern Statistical and Mathematical Methods i n Reliability

ix

4.4.1 Example 1 . . . . . . . . . . . . . . . . . . . . . . . 4.4.2 Example 2 . . . . . . . . . . . . . . . . . . . . . . .

49 49 50 51 54

4.4.3 Example 3 . . . . . . . . . . . . . . . . . . . . . . . 4.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

6

Dynamic Modeling in Reliability and Survival Analysis Edsel A . Pe6a and Elizabeth H Slate

55

5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Dynamic Models . . . . . . . . . . . . . . . . . . . . . . . 5.2.1 A dynamic reliability model . . . . . . . . . . . . 5.2.2 A dynamic recurrent event model . . . . . . . . . 5.3 Some Probabilistic Properties . . . . . . . . . . . . . . . 5.4 Inference Methods . . . . . . . . . . . . . . . . . . . . . . 5.4.1 Dynamic load-sharing model . . . . . . . . . . . . 5.4.2 Dynamic recurrent event model . . . . . . . . . . 5.5 An Application . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

55 59 60 61 63 64 64 65 68 70

.

. . .

. .

End of Life Analysis

73

6.1 The Urgency of WEEE . . . . . . . . . . . . . . . . . . . . 6.1.1 The effect on reliability . . . . . . . . . . . . . . . . 6.1.2 The implications for design . . . . . . . . . . . . . . 6.2 Signature Analysis and Hierarchical Modeling . . . . . . . 6.2.1 The importance of function . . . . . . . . . . . . . 6.2.2 Wavelets and feature extraction . . . . . . . . . . . 6.3 A Case Study . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.1 Function: preliminary FMEA and life tests . . . . . 6.3.2 Stapler motor: time domain . . . . . . . . . . . . . 6.3.3 Lifting motor: frequency domain . . . . . . . . . . . 6.4 The Development of Protocols and Inversion . . . . . . . . Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

74 74 75 75 76 76 76 77 77 78 79 86 86

H . Wynn. T. Figarella. A . Di Bucchianico. M . Jansen. W. Bergsma


X

7 Reliability Analysis of a Dynamic Phased Mission System: Comparison of Two Approaches Man: Bouissou. Yves Dutuit. Sidoine Maillard

87

7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 87 7.2 Test Case Definition . . . . . . . . . . . . . . . . . . . . . 91 7.3 Test Case Resolution . . . . . . . . . . . . . . . . . . . . . 93 7.3.1 Resolution with a Petri net . . . . . . . . . . . . . 93 7.3.2 Resolution with a BDMP . . . . . . . . . . . . . . 96 7.3.3 Compared results . . . . . . . . . . . . . . . . . . . 97 7.4 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . 100 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 8

Sensitivity Analysis of Accelerated Life Tests with Competing Failure Modes Cornel Bunea and Thomas A Mazzuchi

105

8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2 ALT and Competing Risks . . . . . . . . . . . . . . . . . . 8.2.1 ALT and independent competing risks . . . . . . . 8.2.2 ALT and dependent competing risks . . . . . . . . 8.3 Graphical Analysis of Motorettes Data . . . . . . . . . . . 8.4 A Copula Dependent ALT - Competing Risk Model . . . . 8.4.1 Competing risks and copula . . . . . . . . . . . . . 8.4.2 Measures of association . . . . . . . . . . . . . . . . 8.4.3 Archimedean copula . . . . . . . . . . . . . . . . . 8.4.4 Application on motor insulation data . . . . . . . . 8.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

106 107 107 109 110 112 112 113 114 114 116 117

Estimating Mean Cumulative Functions From Truncated Automotive Warranty Data S . Chukova and J . Robinson

121

9.1 Introduction . . . . . . . . . . . . 9.2 The Hu and Lawless Model . . . . 9.3 Extensions of the Model . . . . . . 9.3.1 “Time” is age case . . . . . 9.3.2 “Time” is miles case . . . . 9.4 Example . . . . . . . . . . . . . . . . 9.4.1 The “P-claims” dataset . . .

121 123 124 124 127 130 130

.

9

............. ............. ............. . . . . . . . . . . . . . ............. ............ .............

xi

Modern Statistical and Mathematical Methods an Reliability

10

9.4.2 Examples for the “time” is age case . . . . . . . . . 9.4.3 Examples for the “time” is miles case . . . . . . . . 9.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

131 133 133 134

Tests for Some Statistical Hypotheses for Dependent Competing Risks-A Review Isha Dewan and J V Deshpande

137

. .

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . Locally Most Powerful Rank Tests . . . . . . . . . . . . Tests for Bivariate Symmetry . . . . . . . . . . . . . . . Censored Data . . . . . . . . . . . . . . . . . . . . . . . . Simulation Results . . . . . . . . . . . . . . . . . . . . . . Test for Independence of T and b . . . . . . . . . . . . . 10.6.1 Testing HO against H i . . . . . . . . . . . . . . 10.6.2 Testing HO against H i . . . . . . . . . . . . . . 10.6.3 Testing HO against HA . . . . . . . . . . . . . . Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

10.1 10.2 10.3 10.4 10.5 10.6

11

137

. 139 . 140

. . . .

Repair Efficiency Estimation in the A R I l Imperfect Repair Model Lavrent Doyen 11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 11.2 Arithmetic Reduction of Intensity Model with Memory 1 11.2.1 Counting process theory . . . . . . . . . . . . . . 11.2.2 Imperfect repair models . . . . . . . . . . . . . . 11.3 Failure Process Behavior . . . . . . . . . . . . . . . . . . 11.3.1 Minimal and maximal wear intensities . . . . . . 11.3.2 Asymptotic intensity . . . . . . . . . . . . . . . . 11.3.3 Second order term of the asymptotic expanding . 11.4 Repair Efficiency Estimation . . . . . . . . . . . . . . . . 11.4.1 Maximum likelihood estimators . . . . . . . . . . 11.4.2 Explicit estimators . . . . . . . . . . . . . . . . . 11.5 Empirical Results . . . . . . . . . . . . . . . . . . . . . . 11.5.1 Finite number of observed failures . . . . . . . . . 11.5.2 Application to real maintenance data set and perspective . . . . . . . . . . . . . . . . . . . . . .

144 145 147 148 149 150 151 151

153 153 154 154 155 156 156 157 159 160 161 163 164 164 165

xii


11.6 Classical Convergence Theorems . . . . . . . . . . . . . . 166 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

12

On Repairable Components with Continuous Output

169

12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 12.2 Asymptotic Performance of Repairable Components . . 12.3 Simple Systems . . . . . . . . . . . . . . . . . . . . . . . . 12.4 Imperfect Repair . . . . . . . . . . . . . . . . . . . . . . . 12.5 Concluding Remarks . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

169 171 173 174 175 176

M . 5'. Finkelstein

.

13 Effects of Uncertainties in Components on the Survival of Complex Systems with Given Dependencies 177 Axel Gandy 13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 13.2 System Reliability with Dependent Components . . . . . 13.3 Bounds on the Margins . . . . . . . . . . . . . . . . . . . 13.3.1 Uniform metric . . . . . . . . . . . . . . . . . . . 13.3.2 Quantiles . . . . . . . . . . . . . . . . . . . . . . 13.3.3 Expectation . . . . . . . . . . . . . . . . . . . . . 13.4 Bayesian Approach . . . . . . . . . . . . . . . . . . . . . . 13.5 Comparisons . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

14

Dynamic Management of Systems Undergoing Evolutionary Acquisition Donald Gaver. Patricia Jacobs. Ernest Seglie 14.1 Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14.1.1 Preamble: broad issues . . . . . . . . . . . . . . . 14.1.2 Testing . . . . . . . . . . . . . . . . . . . . . . . . 14.2 Modeling an Evolutionary Step . . . . . . . . . . . . . . . 14.2.1 Model for development of Block b 1 . . . . . . . 14.2.2 Introduction of design defects during development and testing . . . . . . . . . . . . . . . . . . . . . .

+

177

179 181 182 183 184 186 188 188

191 192 192 194 195 195

196 14.2.3 Examples of mission success probabilities with random K O . . . . . . . . . . . . . . . . . . . . . 197 14.2.4 Acquisition of Block b 1 . . . . . . . . . . . . . 198

+

xiii


+

14.2.5 Obsolescence of Block b and Block b 1 . . . . 14.3 The Decision Problem . . . . . . . . . . . . . . . . . . . . 14.4 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 14.5 Conclusion and Future Program . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

15

.

Reliability Analysis of Renewable Redundant Systems with Unreliable Monitoring and Switching Yakov Genis and Igor Ushakov Introduction . . . . . . . . . . . . . . . . . . . . . . . . . Problem Statement . . . . . . . . . . . . . . . . . . . . . Asymptotic Approach . General System Model . . . . . Refined System Model and the FS Criterion . . . . . . Estimates of Reliability and Maintainability Indexes . . Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . Heuristic Approach . Approximate Method of Analysis of Renewal Duplicate System . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15.1 15.2 15.3 15.4 15.5 15.6 15.7

16

. 199

205 205 206 . 207 . 207 . 209 210

. 214

Planning Models for Component-Based Software Offerings Under Uncertain Operational Profiles Mary Helander and Bonnie Ray 16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 16.2 Mathematical Formulation as an Optimal Planning Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16.3 Stochastic Optimal Reliability Allocation . . . . . . . . . 16.3.1 Derivation of the distribution for Go . . . . . . . 16.3.2 Solution implementation . . . . . . . . . . . . . . 16.4 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 16.5 Summary and Discussion . . . . . . . . . . . . . . . . . . Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

17 Destructive Stockpile Reliability Assessments: A Semiparametric Estimation of Errors in Variables with Validation Sample Approach Nicolas Hengartner 17.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . .

199 200 203 204

218

221 221 223 224 226 228 228 230 232 233

235 235

xiv

18

19


17.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . 17.3 Estimation . . . . . . . . . . . . . . . . . . . . . . . . . . 17.4 Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17.4.1 Regularity conditions . . . . . . . . . . . . . . . . 17.4.2 Proof of Theorem 17.2 . . . . . . . . . . . . . . . Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

237 238 240 240 241 244 244

Flowgraph Models for Complex Multistate System Reliability Aparna Huzurbazar and Brian Williams

247

18.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 18.2 Background on Flowgraph Models . . . . . . . . . . . . . 18.3 Flowgraph Data Analysis . . . . . . . . . . . . . . . . . . 18.4 Numerical Example . . . . . . . . . . . . . . . . . . . . . 18.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

247 250 255 257 260 261

Interpretation of Condition Monitoring Data Andrew Jardine and Dmgan Banjevic

263

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . The Proportional Hazards Model . . . . . . . . . . . . . . Managing Risk: A CBM Optimization Tool . . . . . . . . Case Study Papers . . . . . . . . . . . . . . . . . . . . . . 19.4.1 Food processing: use of vibration monitoring . . . 19.4.2 Coal mining: use of oil analysis . . . . . . . . . . 19.4.3 Nuclear generating station . . . . . . . . . . . . . 19.4.4 Gearbox subject to tooth failure . . . . . . . . . . 19.5 Future Research Plans . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

263 265 270 272

19.1 19.2 19.3 19.4

20

Nonproportional Semiparametric Regression Models for Censored Data Zhezhen Jin

272

273 274 276 277 277

279

20.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 279 20.2 Models and Estimation . . . . . . . . . . . . . . . . . . . 280 20.2.1 Accelerated failure time model . . . . . . . . . . . 280 20.2.1.1 Rank-based approach . . . . . . . . . . 281


20.2.1.2 Least-squares approach . . . . . . . 20.2.2 Linear transformation models . . . . . . . . . 20.3 Remark . . . . . . . . . . . . . . . . . . . . . . . . . . . . Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

xv

. . 284 . . 286

21 Binary Representations of Multi-State Systems Edward Korczak

289 290 290 293

21.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 293 21.2 Basic Definitions . . . . . . . . . . . . . . . . . . . . . . . 294 21.3 Binary Representation of an MSS and Its Properties . . . 296 21.4 Examples of Application . . . . . . . . . . . . . . . . . . 301 21.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . 305 Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . 306 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 22

Distribution-Free Continuous Bayesian Belief Nets D . Kurowicka and R . Cooke

309

22.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 309 22.2 Vines and Copulae . . . . . . . . . . . . . . . . . . . . . . 311 22.3 Continuous bbns . . . . . . . . . . . . . . . . . . . . . . . 315 22.4 Example: Flight Crew Alertness Model . . . . . . . . . . 318 22.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . 321 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 23

Statistical Modeling and Inference for Component Failure Times Under Preventive Maintenance and Independent Censoring Bo Henry Lindqvist and Helge Langseth 23.1 23.2 23.3 23.4

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . Notation. Definitions. and Basic Facts . . . . . . . . . . . The Repair Alert Model . . . . . . . . . . . . . . . . . . . Statistical Inference in the Repair Alert Model . . . . . . 23.4.1 Independent censoring . . . . . . . . . . . . . . . 23.4.2 Datasets and preliminary graphical model checking . . . . . . . . . . . . . . . . . . . . . . . 23.4.3 Nonparametric estimation . . . . . . . . . . . . . 23.4.4 Parametric estimation . . . . . . . . . . . . . . .

323 323 325 326 328 328 329 331 332

xvi


23.5 Concluding Remarks . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

24 Importance Sampling for Dynamic Systems Anna Ivanova Olsen and Arvid Naess

25

339

24.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 24.2 Problem Formulation . Reliability and Failure Probability 24.3 Numerical Examples . . . . . . . . . . . . . . . . . . . . . 24.3.1 Linear oscillator excited by white noise . . . . . . 24.3.2 Linear oscillator excited by colored noise . . . . . 24.4 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

340 341 343 343 348 350 351 351

Leveraging Remote Diagnostics Data for Predictive Maintenance Brock Osborn

353

25.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 25.2 Accounting for the Accumulation of Wear . . . . . . . . . 25.3 Application to Inventory Management of Turbine Blades 25.4 Developing an Optimal Solution . . . . . . . . . . . . . . 25.5 Application . . . . . . . . . . . . . . . . . . . . . . . . . 25.6 Formulating a Generalized Life Regression Model . . . . 25.7 Concluding Remarks . . . . . . . . . . . . . . . . . . . . Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

335 337

From Artificial Intelligence to Dependability: Modeling and Analysis with Bayesian Networks Luigi Portinale. Andrea Bobbio. Stefania Montani 26.1 26.2 26.3 26.4 26.5

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . Bayesian Networks . . . . . . . . . . . . . . . . . . . . . . Mapping Fault Trees to Bayesian Networks . . . . . . . . Case Studies: The Digicon Gas Turbine Controller . . . . Modeling Issues . . . . . . . . . . . . . . . . . . . . . . . 26.5.1 Probabilistic gates: common cause failures . . . . 26.5.2 Probabilistic gates: coverage . . . . . . . . . . . . 26.5.3 Multi-state variables . . . . . . . . . . . . . . . .

353 354 356

357 360 361 362 362 362

365 366 366 367 368 371 372 372 373


27

28

xvii

26.5.4 Sequentially dependent failures . . . . . . . . . . 26.6 Analysis Issues . . . . . . . . . . . . . . . . . . . . . . . . 26.6.1 Analysis example . . . . . . . . . . . . . . . . . . 26.6.2 Modeling parameter uncertainty in BN model . . 26.7 Conclusions and Current Research . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

374 375 376 378 380 380

Reliability Computation for Usage-Based Testing S . J Prowell and J . H . Poore

383

27.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . 27.2 Characterizing Use . . . . . . . . . . . . . . . . . . . . . . 27.3 Computing Reliability . . . . . . . . . . . . . . . . . . . . 27.3.1 Models . . . . . . . . . . . . . . . . . . . . . . . . 27.3.2 Arc reliabilities . . . . . . . . . . . . . . . . . . . 27.3.3 Trajectory failure rate . . . . . . . . . . . . . . . 27.4 Similarity to Expected Use . . . . . . . . . . . . . . . . . 27.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

383 384 387 387 388 389 390 392 392

K-Mart Stochastic Modeling Using Iterated Total T i m e on Test Transforms h n c i s c o Vera and James Lynch

395

.

28.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 395 28.2 Generalized Convexity, Iterated TTT. K-Mart . . . . . . 397 28.3 Mixture Models . . . . . . . . . . . . . . . . . . . . . . . 400 28.4 A Binomial Example . . . . . . . . . . . . . . . . . . . . . 403 28.5 Construction of “Most Identical” Distribution . . . . . . 407 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409

This page intentionally left blank

CHAPTER 1 COMPETING RISK MODELING IN RELIABILITY

TIM BEDFORD Department of Management Science Strathclyde University Glasgow, UK E-mail: tim.bedford@strath. ac.uk

This paper gives a review of some work in the area of competing risk applied to reliability problems, focusing particularly on that of the author and co-workers. The results discussed cover a range of topics, starting with the identifiability problem, bounds and a characterization of marginal distributions with given competing risk information. We discuss the way in which the assumption of independence usually gives an optimistic view of failure behavior, possible models for maintenance, and generalizations of the competing risk problem to nonrenewal systems.

1.l. Introduction The competing risk problem arises quite naturally in the reliability context. Maintenance logs often track the history of events occurring at a particular socket. The events can be failure mode specific, incipient failures, maintenance actions, etc. Where the cost of critical failure is large, the maintenance policy will ensure that the whole system is as good as new. Hence we can regard the data as arising from a renewal process in which we only see the “first” possible event occurring after renewal and we know what that event is. The different events can be regarded as competing risks. The “competing risk problem” is that we cannot identify the marginal distributions of the time t o each event without making untestable distributional assumptions. Competing risk information is, at least implicitly, used in reliability databases such as the Center for Chemical Process Safety (CPSS) and European Industry Reliability Data (EIREDA) generic 1

T.Bedford

2

databases amongst several others. These databases give data-failure rates or on-demand failure probabilities as appropriatefor each failure mode of the component. In order to derive this information it is necessary to have used a competing risk statistical model to interpret the underlying failure data. A discussion of the way in which such databases are built up and the role that the competing risk problem arises there is given in Cooke and Bedford. The paper gives an overview of competing risk work, specifically in the reliability context, with which I and co-workers have been associated. It does not attempt to give a general overview of competing risk. For a more general view we refer the reader to Crowder’s recent book’ and Deshpande’s overview paper.3 The issues we cover are:

0 0 0 0

a 0

Independent and dependent competing risks Characterization of possible marginals Kolmogorov Smirnov Test The bias of independence Maintenance as a censoring mechanism Loosening the renewal assumption

In considering these issues we shall largely take a probabilistic modeling viewpoint, although one could equally well take a more statistical view or an operations research view. The competing risk problem is a part of the more general issue of model identifiability. We build models in order to gain an understanding of system behavior. In general terms, the more tightly we specify the model class, the more likely we are to be able to identify the specific model within the class. If we define the model class too tightly though, the model class may not capture all the features contained in the data. However, our intuition about defining model classes more tightly does not always correspond to the functional constraints that imply identifiability or lack thereof. We shall give an example of this in Sec. 1.8. In competing risk applications to reliability the model-identifiability issue means that we do need to specify “tight” families of models to apply in specific application situations. To do this we need a better understanding of the engineering context, particularly for applications to maintenance censoring.

Competing Risk Modeling in Reliability

3

1.2. Independent and Dependent Competing Risks In general there may be several different processes going on that could remove a component from service. Hence the time to next removal, Y , is the minimum of a number of different potential event times Y = min(X1 , . . . ,Xn). For simplicity assume that the different events cannot occur together and, furthermore, just consider a single nonfailure event, for example unscheduled preventive maintenance. Hence there is a failure time XI, which is the time (since the previous service removal) that the equipment would fail, and a single PM time X2, which is the time at which the equipment would be preventively maintained. We only observe the smallest of the two variables but also observe which one it is, that is, we know whether we have observed a failure or a PM. Hence the observable data is of the form Y = (min(X1, X2), l,yt t , X1 < X2), which is equal to P(X1 < X,) - Gl(t). The normalized subsurvivor function is the quantity S%l(t)/S%l(0) normalized to be equal to 1 at t = 0. The final important quantity that can be estimated directly from observable data is the probability of a censor after time t , @ ( t )= P(X2 < XllY > t ) . The shapes of these functions can play a role in model selection. The classical competing risks problem is to identify the marginal distributions of the competing risk variables from the competing risk data. It is well known4 that the marginal and joint distributions of (XI,X2) are in general “nonidentifiable,” that is, there are many different joint distributions which share the same subdistribution functions. Is it also well k n o ~ n ~ ?that ~ ’ ’ if X1 and X2 are independent, nonatomic and share essential suprema, their marginal distributions are identifiable. Given a pair of subsurvivor functions we can assume an underlying independent model, but may have to accept that one of the random variables has a degenerate distribution, that is, an atom at infinity.8 In any case, if we are prepared to assume independence then-subject to some technical conditions-we can identify marginals. For the moment we shall concentrate on general bounds that make as few assumptions as possible, and explain the source of nonidentifiability.

4

T.Bedford

Figure 1.1 shows the (X1,X2) plane and the events whose probabilities can be estimated from observable data. For example, given times tl < t2 we can estimate the probability of the event tl < XI 5 t2, XI < X2 which corresponds to the vertical hatched region on the figure, while given times t3 < t4 we can estimate the probability of the event t3 < X2 I t4, XZ< XI, which corresponds to the horizontal hatched region on the figure.

Fig. 1.1. (L) Events whose probabilities can be estimated by competing risk data; (R)Geometry of events determining the upper and lower bounds.

We are able to estimate the probability of any such region, but we cannot estimate how the probability is distributed along such a region. Now we can see why the distribution of X1 is not identifiable; varying the mass within the horizontal region changes the distribution of XI without changing the distribution of the observable quantities. Considering the “extreme” ways in which that probability mass could be distributed leads to upper and lower bounds on the marginal distribution function of XI. The Peterson boundsg are pointwise upper and lower bounds on the value of the marginal distribution function. They say that for any t 2 0 we have Gl(t) 5 Fl(t) 5 F y ( t ) . A functional bound was found by Crowder’O who showed that the distance between the distribution function F1 and the Peterson lower bound, F1 ( t ) - GI ( t )is nondecreasing. A simple proof of these bounds is possible through considering the geometry of the events in the (XI,Xz)-plane. Figure l.l(R) shows, for a given t, three events marked A , B and C. The probability of event A is the lower bound probability in the Peterson bound, Gl(t). This is clearly less than or equal to the probability of event A U B , which is just Fl (t).This in turn is less than or equal to the probability of event A u B u C, which is just FY (t).

5


This shows that the lower and upper Peterson bounds hold. To get the functional lower bound of Crowder just note that the difference Fl(t)-Gl(t) is the probability of the event {XI 5 t,X2 < XI}, that is, the region marked B on the figure. Clearly as t increases, we get an increasing sequence of events whose probabilities must therefore also be nondecreasing. This demonstrates the functional bound. Both Peterson and Crowder make constructions to show when there is a joint distribution satisfying the bounds. A result in Bedford and Meilijsonll however improved these results slightly while giving a very simple geometric construction, which we now consider. 1.3. Characterization of Possible Marginals

The characterization tells us exactly which marginal distributions are possible for given subdistribution functions. To simplify things in this presentation we assume that we are only going to deal with continuous (sub)distributions and the reader is referred to Bedford and Meilijsonll for the details of the general case of more than 2 variables, which may have atoms and could have ties. The key idea here is that of a co-monotone representation. We have already seen that the Crowder functional bound writes the distribution function as a sum of two monotone functions: the subdistribution function and the nondecreasing “gap.” More generally we define a co-monotone representation of a continuous real-valued function f as a pair of monotone nondecreasing continuous functions f1 and f 2 such that f = f1 f2. The characterization result will show when we can find a pair of random variables compatible with the observable subdistribution functions. It is therefore necessary to define abstractly what a pair of subdistribution functions is without reference to a pair of random variables. We define a pair of functions GI, G2 to be a lifetime subdistribution pair if

+

(1) Gi : [0, m) -+ IR, i = 1,2. (2) They are nondecreasing continuous real-valued functions with Gl(0) = Gz(0) = 0. (3) limt-.+oo Gl(t) = pl and limt+oo G2(t) = p2 with pl p2 = 1.

+

Suppose we are given such a pair of functions. (As stated above, the subdistribution functions can be estimated from competing risk data.) Consider the unit strip [0, co)x [0,1] and subdivide it into two strips of heights pl and p2, respectively as shown in Fig. 1.2. In the lower and upper strips we plot

T.Bedford

6

the functions G l ( t ) and Gz(t),respectively. In the same strips we choose, arbitrarily, two nondecreasing right continuous functions whose graphs increase from the bottom to the top of the strip, while lying under the graphs of the functions we have already drawn. For reasons that will become clear we call these new functions F2 - G2 and Fl - GI, respectively. See Fig. 1.3. The notion of “lying under” will be made clear in the statement of the theorem below.

Fig. 1.2.

Co-monotone construction - 1

Fig. 1.3. Co-monotone construction

- 2.


7

Theorem 1.1:

l 1 (i) Let X1 and X2 be lifetime random variables. Then, using the notation established above,

+

(1) Fi = Gi (Fi - G , ) is a nonnegative co-monotone representation of a nondecreasing continuous function, for i = 1,2. (2) Fi(t) 5 G l ( t ) G z ( t ) for all t , and the Lebesgue measure of the range set {(Fi- Gi)(t)lFi(t)= G l ( t ) G 2 ( t ) }is zero, for i = 1 , 2 . (3)(a) Fi(0) = 0 and Fi(cm)= 1, for i = 1,2. (b) G i ( w ) G2(00) = 1 .

+

+

+

(ii) If nondecreasing right continuous functions F1, Fp, GI, and G2 satisfy the conditions (1)-(3) of (i) then there is a pair of random variables ( X I ,Xp) for which Fi and Gi are the distribution and subdistribution functions respectively (i = 1,2). The construction of the random variables ( X I, X2) can be done quite simply and is shown in Fig. 1.3. Draw a uniform random variable U . If it is in the lower strip (that is, U < p1) then we can invert U through the functions drawn in the lower strip. Define X I = G , ’ ( U ) and Xp = (F2 - G 2 ) - l ( V ) . The ordering of these two functions implies that X1 5 Xp, and furthermore that X1 = X2 with probability 0. If U is in the upper strip then a similar construction applies with the roles of X1 and X , reversed. See Fig. 1.3. This geometrical construction shows that the conditions of the theorem are sufficient for the existence of competing risk variables. Condition 1 is necessary as it is Crowders functional bound. Condition 3 is an obvious necessary condition. The first part of Condition 2 is the Peterson upper bound, while the second part is a rather subtle “light t o u c h condition whose proof is fairly technical and for which we refer the reader to Bedford and Meilijson.

1.4. Kolmogorov-Smirnov Test The complete characterization described above was used to produce a statistical test based on the Kolmogorov-Smirnov statistic in which a hypothesized marginal distribution can be tested against available data. The functional bound tells us that, given a dataset, the difference between the empirical subdistribution and the unobserved empirical marginal distribution function should be nondecreasing. A little thought shows that the distances can be computed at the “jumps” of these functions, which of course occur at the times recorded in the dataset. Recall that the Kolmogorov-Smirnov test takes a hypothesized distribution and uses the asymptotic relation that the

8

T.Bedford

functional difference between true population distribution and empirical distribution converges, when suitably normalized, to a Brownian bridge. Extremes of the Brownian bridge can then be used to establish classical confidence intervals. Although in our competing risk situation we cannot estimate the maximal difference between empirical distribution function and hypothesized distribution function (as we are not able to observe the empirical distribution function), the functional bound can be used to give lower bound estimates on that maximal difference, thus enabling a conservative Kolmogorov-Smirnov test to be developed. A dynamic programming algorithm can be used to determine the maximum difference. Theoretical details of the test are in Bedford and Meilijson" with more implementation details about the dynamic programming and application examples given in Bedford and Meilijson.12

1.5. Conservatism of Independence

As we noted at the beginning, commercial reliability databases make use of competing risk models in interpreting and presenting data. Common assumptions are that underlying times to failure from different failure modes are exponential and that the censoring is independent. Clearly, assumptions need to be made, but one can ask whether or not these assumptions are going to bias the numerical results in any consistent way. It turns out that the functional bounds can be used to show that the assumption of independence tends to give an optimistic assessment of the marginal of XI. It was shown in Bedford and Meilijson13that any other dependence structure would have given a higher estimate of the failure rate; the "independent" failure rate is the lower endpoint of the interval of constant failure rates compatible with the competing risk data. This result, which is generalized to a wider class of parametric families (those ordered by monotone likelihood ratio), is essentially based on a constraint implied by differentiating the functional bound at the origin. Consider the following simple example from Bedford and Mei1ij~on.l~ Suppose that the lifetime Y of a machine is exponentially distributed, there are two failure modes with failure times Xi, X2, and its cause of failure I = 1 , 2 is independent of Y . Suppose also that the failure rate of Y is 0 and let P ( I = 1) = pl. The unique independent model (X1,Xz) for this observed data joint distribution makes Xi and X2 exponentially distributed with respective failure rates plB and (1 - pl)0. Suppose now that we believe that XI has a marginal exponential


9

distribution, but we are not sure about possible dependence. What is then the range of possible values of its failure rate A? Since the subdistribution function of X1 is G l ( t ) = (1 - e-et)pl and X must satisfy F { ( t ) = (1 - edXt)’2 G i ( t ) for all t > 0, we have that p l 8 5 X 5 8. The upper Peterson bound tells us that A 5 8. However, the “light touch” condition discussed above shows that equality is not possible thus giving a range of feasible X values as

5x

e.

(1)

This shows that the lowest, most optimistic, failure rate compatible with the general competing risk bounds is that obtained from the independence assumption.

1.6. The Bias of Independence

As a further illustration of the potential bias created by assumption of independence when it is not clearly appropriate we consider an example from reliability prediction discussed in Bedford and C00ke.l~This gives the theoretical background to work carried out for a European Space Agency project. Four satellites were due to be launched to carry out a scientific project, which required the functioning of all satellites throughout the mission period of 2 years post launch. A preliminary assessment of the satellite system reliability using a standard model (independent exponentially distributed lifetimes of subsystems) indicated a rather low probability of mission success. The study included discussions with mission engineers about the mechanisms of possible mission failure which suggested that, in contrast to the assumptions made in the standard reliability modeling, mission risk was highly associated to events such as vibration damage during launch and satellite rocket firing, and to thermal shocks caused by moving in and out of eclipses. A new model was built in which the total individual satellite failure probability over the mission profile was kept at that predicted in the original reliability model. Now, however, a mission phasedependent failure rate was used to capture the engineering judgement associating higher failure rates to the abovementioned mission phases, and a minimally informative copula was used to couple failure rates to take account of residual couplings not captured by the main effects. The effect of positive correlation between satellite lifetimes is to improve system lifetime. This may seem counter intuitiveespecially to those with an engineering risk background used to thinking of common cause effects as being a “bad thing.” However, it is intuitively easy to understand. For

10

T.Bedford

if we sample 4 positively correlated lifetime variables all with marginal distribution F then the realizations will tend to be more tightly bunched as compared t o the 4 independent realizations from the same marginal distribution F . Hence the series system lifetime, which is the minimum of the satellite lifetimes, will tend to be larger when the lifetimes are more highly correlated. This is illustrated in Fig. 1.4, taken from Bedford and Cooke,14 which is based on simulation results.

-

Fig. 1.4. Cluster system survival probability depending on correlation.

1.7. Maintenance as a Censoring Mechanism One very interesting and practical area of application of competing risk ideas is in understanding the impact of maintenance on failure data. There is a lot of anecdotal evidence to suggest that there can be major differences in performance between different plant (for example nuclear plant) that are not caused by differences in design or different usage patterns, and that are therefore likely to be related to different maintenance practices and/or policies. Theoretical models for maintenance optimization require us to know the lifetime distribution of the components in question. Therefore it is major significance to understand the impact that competing risk has in masking


11

our knowledge of that distribution due t o current maintenance (or other) practices that censor the lifetime variable of interest.

1.7.1. Dependent copula model The sensitivity of predicted lifetime t o the assumptions made about dependency between P M and failure time was investigated in Bunea and Bedford15 using a family of dependent copulae. This is based on the results in Zheng and Klein" where a generalization of the Kaplan-Meier estimator is defined that gives a consistent estimator based on an assumption about the underlying copula of ( X I ,X z ) . To illustrate this in an optimization context, the interpretation given was that of choosing an age-replacement maintenance policy. Existing data, corresponding t o failure and/or unscheduled P M events, is taken as input. In order to apply the age replacement maintenance model we need the lifetime distribution of the equipment. Hence it is necessary t o "remove" the effect of the unscheduled P M from the lifetime data. The objective was t o show what the costs of assuming the wrong model would be, if one was trying to optimize an age replacement policy. The conclusion of this paper is that the costs of applying the wrong model can indeed be very substantial. The costs arise because the age replacement interval is incorrectly set for the actual lifetime distribution when the lifetime distribution has been incorrectly estimated using false assumptions about the form of censoring. See Fig. 1.5, taken from Bunea and Bedford.15

1.7.2. R a n d o m clipping This is not really a competing risk model, but is sufficiently close t o be included here. The idea, due t o Cooke, is that the component life time is exponential, and that the equipment emits a warning at some time before the end of life. That warning period is independent of the lifetime of the equipment, although we only see those warnings that occur while the equipment is in use. The observable data here is the time at which the warning occurs. An application of the memoryless property of the exponential distribution shows that the observable data (the warning times) has the same distribution as the underlying failure time. Hence we can estimate the MTBF just by the mean of the the warning times data. This model, and the following one, is discussed further in Bedford and C00ke.l~

12

T. Bedford

Fig. 1.5. Optimizing to the wrong model: effect of assuming different correlations.

1.7.3. Random signs

This model" uses the idea that the time at which PM might occur is related to the time of failure. The PM (censoring time) X2 is equal to the failure time X1 plus an a random quantity [, X2 = X I - 6. Now, while [ might not be statistically independent of X I , its sign is. In other words PM is trying to be effective and t o occur round about the time of the failure, but might miss the failure and occur too late. The chance of failure or P M is independent of the time a t which the failure would occur. This is quite a plausible model, but is not always compatible with the data. Indeed, Cooke has shown that the model is consistent with the distribution of observable data if and only if the normalized subsurvivor functions are ordered. In other words, this model can be applied if and only if the normalized subsurvivor function for X I always lies above that for X2. 1.7.4. LBL model

This model, proposed in Langseth and L i n d q ~ i s t , 'develops ~ a variant of the random signs model in which the likelihood of an early (that is, before failure) intervention by the maintainer is proportional to the unconditional

Competing Risk Modeling i n Reliability

13

failure intensity for the component. Maintenance is possibly imperfect in this model. The model is identifiable.

1.7.5. Mized exponential model

A new model capturing a class of competing risk data not previously COVered by the above was presented in Bunea et a1.” The underlying model is that X I is drawn from a mixture of two exponential distributions, while X 2 is also exponential and independent of X I . This is therefore a special case of the independent competing risks model, but in a very specific parametric setting. Important features of this model that differ from the previous models are: (1) The normalized subdistribution functions are mixtures of exponential distribution functions, (2) The function @(t)increases continuously as a function o f t . This model was developed for an application to OREDA data in which these phenomena were observed.

1.7.6. Delay time model The Delay time modelz1 is well known within the maintenance community. Here the two times X1 and X2 are expressed in terms of a warning variable and supplementary times, X1 = W+X1’, X z = W + X z ’ , where W,Xl’,XZ’ are mutually independent life variables. As above we observe the minimum of X1 and X2. In the case that these variables are all exponential it can be shown (see Hokstadt and Jensen”) that (a) The normalized subdistribution functions are equal and are exponential distribution functions, (b) The function @(t ) is constant as a function oft. 1.8. Loosening the Renewal Assumption

The main focus of the paper is on competing risks, and this implies that when we consider a reliability setting we are assuming that the data can be interpreted as though generated by a renewal process. In practice this is not always a good assumption. In general, the higher the risk is that is potentially caused by failure of the equipment and the lower the cost of repair, the more likely it is that maintenance crew will try to get the system back to a “good as new state.” As discussed in the introduction, the competing risk identifiability question is part of the general issue of model identifiability. It is natural therefore to consider loosening the renewal assumption. In the context of a series

14

T.Bedford

system it is quite natural to think about three types of maintenance programs. The first is “good as new,” that is, when one component fails, all components are restored to as good as new, thus enabling us to make an assumption of a renewal process. The second is partial renewal: only the component that fails is restored to as good as new. The fact that the other component(s) are not new may lead to extra stress being placed on all components. The third possibility is “as bad as old"" where a minimal repair is applied to the failed component that restores it to the functioning state but leaves the failure intensity for the whole system in the same state as just before the failure. This situation is discussed by Bedford and L i n d q v i ~ where it is assumed that each component has a failure intensity depending on the components own lifetime plus another term that depends on the age of each component. In this context, identifiability means that we can estimate the failure intensities of the components using data from a single socket. This means that we start off with a single unit and replace the components according to the maintenance policy that was determined, recording failure times as we go. As stated above, the “good as new” policy essentially means that we are in the classical competing risk situation. Our model class is sufficiently general that it is not identifiable. The least “intensive” maintenance policy, the “bad as old” policy is also not identifiable (indeed, from a single socket data we never revisit any times, so cannot possibly make estimates of failure probabilities). The partial repair policy, however, is rather different. Here, at least under some quite reasonable technical conditions, we are able to identify the model. The reason for this is enlightening. We can consider the vector valued stochastic process, which tells us the current ages of the components at each time point. This process has no renewal properties whatsoever in the minimal repair case. In the full and partial repair cases however it can be considered as a continuous time continuous state Markov process. However, in the full repair case there is no mixing, whereas the partial repair case (under suitable technical, but weak, conditions) the process is ergodic. This ergodicity implies that a single sample path will (with probability 1) visit the whole sample space, thus enabling us to estimate the complete intensity functions.

Competing Risk Modeling an Reliability

15

1.9. Conclusion

(Dependent) competing risk models are increasingly being developed to sup port the analysis of reliability data. Because of the competing risk problem we cannot identify the joint distribution or marginal distributions without making nontestable assumptions. The validation of such models on a statistical basis is therefore impossible, and validation must therefore be of a “softer” nature, relying on assessment of the engineering and organizational context. This is particularly so in the area of maintenance policy. Clearly, there is a whole area of modeling that can be developed.

Acknowledgments I would like to thank my various collaborators over the last few years including Isaco Meilijson (Tel Aviv University) , Bo Lindqvist (NTNU Trondheim), Cornel Bunea (George Washington University), Hans van der Weide (TU Delft), Helge Langseth (NTNU Trondheim), Sangita Karia Kulathinal (National Public Health Institute, Helsinki), Isha Dewan (IS1 New Delhi), Jayant Deshpande (Pune University) , Catalina Mesina (Free University, Amsterdam) and especially Roger Cooke (TU Delft) who introduced me to the area. References 1. R. Cooke and T. Bedford, Reliability Databases in Perspective, IEEE Transactions on Reliability 51, 294-310 (2002). 2. M. Crowder, Classical competing risks, Chapman and Hall/CRC (2001). 3. J. V. Deshpande, Some recent advances in the theory of competing risks, Presidential Address, Section of Statistics, Indian Science Congress 84th Session (1997). 4. A. Tsiatis, A nonidentifiablility aspect in the problem of competing risks, Proceedings of National Academy of Science, USA 72,20-22 (1975). 5. E. L. Kaplan and P. Meier, On the identifiability crisis in competing risks analysis, Journal of American Statistical Association 53,457-481 (1958). 6. A. NBdas, On estimating the distribution of a random vector when only the smallest coordinate is observable, Technometrics 12,923-924 (1970). 7. D. R. Miller, A note on independence of multivariate lifetimes in competing risk models, Ann. Statist. 5,576-579 (1976). 8. J. A. M. Van der Weide and T. Bedford, Competing risks and eternal life, Safety and Reliability (Proceedings of ESREL’98), S. Lydersen, G.K. Hansen, H.A. Sandtorv (eds), Vol. 2, 1359-1364, Balkema, Rotterdam (1998). 9. A. Peterson, Bounds for a joint distribution function with fixed subdistribution functions: Application to competing risks, Proc. Nat. Acad. Sci. USA 73, 11-13 (1976).

16

T. Bedford

10. M. Crowder, On the identifiability crisis in competing risks analysis, Scand. J . Statist. 18,223-233 (1991). 11. T. Bedford and I. Meilijson, A characterization of marginal distributions of (possibly dependent) lifetime variables which right censor each other, Annals of Statistics 25, 1622-1645 (1997). 12. T. Bedford and I. Meilijson, A new approach to censored lifetime variables, Reliability Engineering and System Safety 51,181-187 (1996). 13. T. Bedford and I. Meilijson, The marginal distributions of lifetime variables which right censor each other, in H. Koul and J. Deshpande (Eds.), I M S Lecture Notes Monograph Series 27 (1995). 14. T. Bedford and R. M. Cooke, Reliability Methods as management tools: dependence modelling and partial mission success, Reliability Engineering and System Safety 58, 173-180 (1997). 15. C. Bunea and T. Bedford, The effect of model uncertainty on maintenance optimization, IEEE Transactions in Reliability 51,486-493 (2002). 16. M. Zheng and J. P. Klein, Estimates of marginal survival for dependent competing risks based on an assumed copula, Biometrika 82,127-138 (1995). 17. T. Bedford and R. Cooke, Probabilistic Risk Analysis: Foundations and Methods, Cambridge University Press (2001). 18. R. Cooke, The total time on test statistic and age-dependent censoring, Stat. and Prob. Let. 18 (1993). 19. H. Langseth and B. Lindqvist, A maintenance model for components exposed to several failure mechanisms and imperfect repair, in B. L. K. Doksum (Ed.), Mathematical and Statistical Methods in Reliability, pp. 415-430. World Scientific Publishing (2003). 20. C. Bunea, R. Cooke, and B. Lindqvist, Competing risk perspective over reliability databases, in H. Langseth and B. Lindqvist (Eds.), Proceedings of Mathematical Methods in Reliability, NTNU Press (2002). 21. A. Christer, Stochastic Models in Reliability and Maintenance, Chapter A review of delay time analysis for modelling plant maintenance, Springer (2002). 22. P. Hokstadt and U. Jensen, “Predicting the failure rate for components that go through a degradation state,” Safety and Reliability, Lydersen, Hansen and Sandtorv(eds) Balkema, Rotterdam, pp. 389-396, (1998). 23. T. Bedford and B. H. Lindqvist, The Identifiability Problem for Repairable Systems Subject to Competing Risks, Advances in Applied Probability 36, 774-790 (2004).

CHAPTER 2 GAME-THEORETIC AND RELIABILITY METHODS IN COUNTER-TERRORISM AND SECURITY

VICKI BIER Center for Human Performance and Risk Analysis University of Wisconsin-Madison Madison, Wisconsin, USA E-mail: [email protected] The routine application of reliability and risk analysis by itself is not adequate in the security domain. Protecting against intentional attacks is fundamentally different from protecting against accidents or acts of nature. In particular, an intelligent and adaptable adversary may adopt a different offensive strategy to circumvent or disable protective security measures. Game theory provides a way of taking this into account. Thus, security and counter-terrorism can benefit from a combination of reliability analysis and game theory. This paper discusses the use of risk and reliability analysis and game theory for defending complex systems against attacks by knowledgeable and adaptable adversaries. The results of such work yield insights into the nature of optimal defensive investments in networked systems to obtain the best tradeoff between the cost of the investments and the security of the resulting systems.

2.1. Introduction After the September 11, 2001, terrorist attacks on the World Trade Center and the Pentagon, and the subsequent anthrax attacks in the United States, there has been an increased interest in methods for use in security and counter-terrorism. However, the development of such methods poses two challenges t o the application of conventional statistical methods-thehe relative scarcity of empirical data on severe terrorist attacks and the intentional nature of such attacks. In dealing with extreme events, for which empirical data is likely t o be sparse, classical statistical methods have been of relatively little use.' 17

18

V. Bier

Instead, methods such as reliability analysis are used to break complex systems down into their individual components (such as pumps and valves) for which larger amounts of empirical failure-rate data may be available. Risk analysis2i3 builds on the techniques of reliability analysis, adding consequence-analysis models to allow for estimation of health and safety impacts. Quantification of risk-analysis models generally relies on some combination of expert judgment4 and Bayesian statistics to estimate the parameters of interest in the face of sparse data.5 Zimmerman and Bier‘ argue that “Risk assessment in its current form (as a systems-oriented method that is flexible enough to handle a variety of alternative conditions) is a vital tool for dealing with extreme events.” However, the routine application of reliability and risk analysis by itself is not adequate in the security domain. Protecting against intentional attacks is fundamentally different from protecting against accidents or acts of nature (which have been the more usual focus of engineering risk analysis). In particular, an intelligent and adaptable adversary may adopt a different offensive strategy to circumvent or disable protective security measures. Game theory7 provides a way of taking this into account analytically. Thus, security analysis can benefit from a combination of techniques that have not usually been used in tandem. This paper discusses approaches for using risk and reliability analysis and game theory to defend complex systems against intentional attacks.

2.2. Applications of Reliability Analysis to Security

Early applications of engineering risk analysis to counter-terrorism and security include Martz and Johnson’ and COX.^ More recently (following September ll), numerous risk analysts have proposed its use for homeland security.10-13 Because security threats can span such a wide range, the emphasis has been mainly on risk-based decision making (i.e., using the results of risk analyses to target security investments at the most likely and most severe threats). Much of this work has been directed specifically towards threats against critical infrastructure14- l9 Levitin and colleagues have by now amassed a large body of work applying reliability analysis to security problems.20-22 Risk and reliability analysis have a great deal to contribute to ensuring the security of complex engineered systems. However, unlike in applications of risk analysis to problems such as the risk of nuclear power accidents, the relationship of recommended risk-reduction actions to the dominant risks

Game- Theoretic and Reliability Methods in Counter- Terrorism and Security

19

emerging from the analysis is not straightforward. In most applications of risk analysis, the decision maker can review a list of possible actions, ranked based on the magnitude of risk reduction per unit cost, and simply choose the most cost-effective actions. This does not work so well in the security context (especially if the potential attacker can readily observe system defenses), since the effectiveness of investments in defending one component can depend critically on whether other components have also been hardened. Risk and reliability analysis are clearly important in identifying the most significant security threats, particularly in complex engineered systems (whose vulnerabilities may depend on networks of interdependencies that cannot be readily identified without detailed analysis). However, in the security context, the results of such analyses do not lead in a straightforward manner to recommended improvements. In particular, risk and reliability analysis generally assumes that the threat or hazard is static, whereas in the case of security, the threat is adaptive and can change in response to the defenses that have been implemented. Therefore, simply rerunning an analysis with the same postulated threat, but assuming that some candidate security improvements have been implemented, will in general significantly overestimate the effectiveness of the candidate improvement^.^^ For example, installing anthrax sterilization equipment in every post office in the country (if publicly known) might just cause future attackers to deliver anthrax by Federal Express, United Parcel Service, or even bicycle courier. Game theory provides a natural way of taking this into account.

2.3. Applications of Game Theory to Security

Due to its value in understanding conflict, game theory has a long history of being applied to security-related problems, beginning with military application^.^ It has also been extensively used in political science; e.g., in the context of arms control.24 Recently, there have also been exploratory applications of game theory and related ideas to computer security.25- 27 With respect to applications of game theory to homeland security, there is a large body of work already, much of it by economist^.^^-^^ Much of the work in this area until now has been designed to provide policy insights; e.g., into the relative merits of deterrence versus other protective measure^.^' However, there has also been interest in using game theory in support of operational-level decisions; e.g., determining which assets to protect. For example, the Brookings Institution31 has recommended that

20

V. Bier

“policy-makers should focus primarily on those targets at which an attack would involve a large number of casualties, would entail significant economic costs, or would critically damage sites of high national significance.” The Brookings recommendation constitutes a reasonable ‘LzerO-order”suggestion about how to prioritize targets for investment. Under this type of “weakest-link model, defensive investment is allocated only to the target(s) that would cause the most damage if attacked. However, such weakestlink models tend to be unrealistic. For example, Arce and Sandler28 note that the extreme solutions associated with weakest-link models “are not commonly observed among the global and transnational collective action problems confronting humankind.” Instead, real-world decision makers will generally want to “hedge” by investing in defense of additional targets, to cover contingencies such as whether they have failed to correctly estimate which targets will be most attractive to the attackers. Moreover, it is important to go beyond the zero-order heuristic of protecting only the most valuable assets, to also take into account the success probabilities of attacks against various possible targets. This can be important, since terrorists appear to take the probability of success into account in their choice of targets; for example, Woo32 has observed that “al-Qaeda is.. .sensitive to target hardening,” and that “Osama bin Laden has expected very high levels of reliability for martyrdom operations.” Models that take the success probabilities of potential attacks into account include Bier et al.,33 Major,34 and Woo.32 The results by Bier et aL8 still represent weakest-link models, in which at equilibrium the defender invests in only those components that are most vulnerable. By contrast, the models proposed by Major34 and Woo32 achieve the more realistic result of hedging at optimality. In particular, Major34 assumes that the defender allocates defensive resources optimally, but that the attacker does not know this, and randomizes the choice of targets to protect against the possibility that the allocation of defensive resources was suboptimal. The result is that the attacker’s probability of choosing any particular target is “inversely proportional to the marginal effectiveness of defense...at that target.” Moreover, since the attacker randomizes in choosing which asset to target, the optimal defensive investment involves hedging (i.e., positive defensive investment even in assets that are not LLweakest links”). The basic game analyzed by Major34 and Woo32 involves simultaneous play by attackers and defenders, so the assumption that the attacker cannot readily observe the defender’s investment makes sense in that context. However, many types of defenses (such as security guards) are either pub-

Game- Theoretic and Reliability Methods in Counter-Terrorism and Security

21

lic knowledge or readily observable by attackers; moreover, some defenses involve large capital outlays, and hence would be difficult to change in response to evolving attacker strategies. In such situations, it seems counterintuitive to assume that the attacker can observe the marginal effectiveness of defensive investments in each possible target, but cannot observe which defenses the defender has actually implemented. Presumably, in sequential play, those defenses that have actually been implemented should be easier to observe than the hypothetical effectiveness of defenses that have not been implemented. Since the basic premise underlying the models of Major34 and Woo32is of questionable applicability for sequential play, recent work by the author and colleagues35achieves the same goal (i.e., an optimal defensive strategy that allows for hedging in equilibrium) in a different manner. In particular, in this model, attackers and defenders are assumed to have different valuations for the various potential targets. This is reasonable given the observation by Woo32 that “If a strike against America is to be inspirational [to al-Qaeda], the target should be recognizable in the Middle East.” In addition to allowing attacker and defender valuations to differ, the proposed model assumes that attackers can observe defensive investments perfectly (which is conservative, but perhaps not overly so), but that defenders are uncertain about the attractiveness of each possible target to the attackers. This model has several interesting features, in addition to the possibility of defensive hedging at equilibrium. First, it is interesting to note that hedging does not always occur. In particular, it will often be optimal for the defender to put no investment at all into some targets, even if they have a nonzero probability of being attacked-especially when the defender is highly budget constrained, and when the various potential targets differ greatly in their values to the defender. Moreover, in this model, if the allocation of defensive resources is suboptimal, defending one set of targets could deflect attacks to alternative targets that are simultaneously less attractive a priori to the attackers (e.g., more costly or difficult to attack), but also more damaging to the defenders. This could be important, in light of past substitution effects documented by Enders and Sandler.2g

2.3.1. Security as a game between defenders The work discussed above views security primarily as a game between an attacker and a defender, focusing on anticipating the effects of defensive actions on possible attackers. However, it also makes sense to consider the

22

V . Bier

effects of defensive strategies adopted by one agent on the incentives faced by other defenders. Some defensive actions (such as installation of visible burglar alarms or car alarms) can actually increase risk to other potential victims. This can lead to overinvestment in security when viewed from the perspective of society as a whole, because the payoff to any one individual or organization from investing in security is greater than the net payoff to the entire society. Conversely, other types of defensive actions-such as vaccination, fire protection, or use of anti-virus protection s o f t w a r e decrease the risk to other potential victims. This can be expected to result in underinvestment in security, since defenders may attempt to “free ride” on the investments of others. Recently, Kunreuther and Heal36 proposed a model of interdependent security where agents are vulnerable to “infection” from other agents. For example, consider supply-chain partners who share access t o each other’s computer systems, and hence are vulnerable to the computer security vulnerabilities of their partners. In this context, it may be extremely costly or difficult for agents to defend their own systems against infections from their partners, and they may therefore need to rely on their partners to protect them against such threats. Kunreuther and HEal36 consider in particular the case where even a single successful attack can be catastrophic. In this case, they show that failure of one agent to invest in security can make it unprofitable for other agents to invest in security, even when they would normally find it profitable to do so. Moreover, they show that this game can have multiple equilibrium solutions (e.g., an equilibrium in which all players invest, and another in which none invest). Kunreuther and H e a P discuss numerous possible coordinating mechanisms that can help to ensure that all players arrive at the socially optimal level of defensive investment. Recent work by the author and colleague^^^^^^ has extended these results to the case of attacks occurring over time (according to a Poisson process), rather than the static model assumed in the original analysis. In this model, differences in discount rates among agents can lead some agents with low discount rates not to invest in security when it would otherwise be in their interests to do so, if other agents choose not to invest in security. Thus, heterogeneous time preferences can complicate the task of achieving security. Differences in discount rates can arise for a variety of reasons, ranging from participation in different industries with different typical rates of return, to risk of impending bankruptcy, to myopia. As in the simpler static model, coordinating mechanisms can be important in ensuring that the socially optimal level of investment is achieved


23

2.4. Combining Reliability Analysis and Game Theory

Many recent applications of risk and reliability analysis to security do not explicitly model the response of potential attackers to defensive investments, and hence may overstate the effectiveness and cost-effectiveness of those investments. Similarly, much of the existing game-theoretic security work focuses on nonprobabilistic games. Moreover, even models that explicitly consider the success probabilities of potential attacks (e.g., Major,34 Woo,32 Kunreuther and Heal36) usually consider individual assets or components in isolation, and fail to consider the effect that disabling one or several components can have on the functionality of a larger system. Combining risk and reliability analysis with game theory could therefore be a fruitful way of protecting against intentional threats to complex systems. Hausken3’ has integrated probabilistic risk analysis and game theory (although not in the security context), by interpreting system reliability as a public good. In particular, he elucidates the relationships between the series or parallel structure of the system and several classic games. Rowe40 presents a simple game-theory framework for evaluating possible protective actions in light of terrorists’ ability to “learn from experience and alter their tactics.’’ Finally, Banks and Anderson41 apply similar ideas to the threat of intentionally introduced smallpox, embedding risk analysis (quantified using expert opinion) into a game-theoretic formulation of the defender’s decision problem. They conclude that this approach “captures facets of the problem that are not amenable to either game theory or risk analysis on their own.” Recent results by Bier et a1.33>42 use game theory to explore the nature of optimal investments in the security of simple reliability systems, as a building block to the analysis of more complex systems. The results suggest that defending series systems against informed and determined attackers is an extremely difficult challenge. In a series system, if the attacker knows about (or can observe) the system’s defenses, the defender’s options for protecting a series system are extremely limited. In particular, the defender is deprived of the ability t o allocate defensive investments according to their cost-effectiveness; rather, if potential attackers know about the effectiveness of defensive measures, defensive investments in series systems must essentially equalize the strength of all defended components in order to be economically efficient. This is consistent with the observation by Dresher7 that, for optimal allocation of defensive resources, “each of the defended targets [must] yield the same payoff to the attacker.”

24

V . Bier

This emphasizes the value of redundancy as a defensive strategy. Essentially, redundancy reduces the flexibility available t o the attacker (since the attacker must now disable multiple redundant components in order t o disable a system), and increases the flexibility available to the defender (since the defender can now choose which of several redundant components to defend). Traditional design considerations such as spatial separation and functional diversity can also be important in defensive strategy, to help ensure that redundant components cannot all be disabled by the same type of attack.

2.5. Directions for Future Work

It is clearly important in practice to extend the types of security models described above to more complicated system structure. Recent work by the author and colleagues42has begun t o address this challenge, at least under particular assumptions. However, achieving fully general results (say, for arbitrary system structures, and for more general assumptions about the effects of security investments on the costs and/or success probabilities of potential attacks) is likely to be difficult, and may require heuristic approaches. In addition, for reasons of mathematical convenience, the models developed until now have generally assumed that the success probability of an attack on a particular component is a convex function of the resources invested to defend that component. While in many contexts this is a reasonable assumption (for example, due to declining marginal returns to defensive investments), it is clearly not fully general. In fact, certain types of security improvements (such as relocating a critical facility to a more secure location) are “inherently discrete,”30 in the sense that they require some minimal level of investment in order to be feasible. This will tend to result in step changes in the success probability of an attack as a function of the level of defensive investment. Similarly, if security investment beyond some threshold deters potential attackers from even attempting an attack, then the likelihood of a successful attack could decrease rapidly beyond that threshold. Such effects can result in the success probability of an attack being a nonconvex function of the defensive investment, at least in certain regions (for example, when the level of investment is not too large). This makes the problem of identifying the optimal level of defensive investment more complicated, and can change the nature of the optimal solutions-increasing the likelihood that there will be multiple local optima,


25

for example, the likelihood that not investing in security may be the global optimum strategy. Moreover, historical experience suggests that secrecy and even deception can be important strategies for improving security and/or reducing defensive investment costs. Understanding when such strategies are likely to be desirable will require departing from the assumptions of common knowledge used in most applications of game theory. Finally, it would of course be worthwhile t o extend our models to include the dimension of time, rather than the current static or %napshot” view of system security. This would allow us to model imperfect attacker information (including, for example, Bayesian updating of the probability that an attack will succeed based on the past history of successful and failed attacks), as well as the possibility of multiple attacks over time.

2.6. Conclusion

As noted above, protecting engineered systems against intentional attacks is likely to require a combination of game theory and reliability analysis. Risk and reliability analysis by itself will not be sufficient to address many security challenges, since it does not take into account the attacker’s response to the implementation of improvements. However, most applications of game theory to security deal with individual components in isolation, and hence could benefit from the use of reliability analysis to model the risks to complex networked systems. Approaches that embed reliability models in a game-theoretic framework may make it possible to take advantage of the strengths of both approaches.

Acknowledgments This material is based upon work supported in part by the US. Army Research Laboratory and the U.S. Army Research Office under grant number DAAD19-01-1-0502, by the U.S. National Science Foundation under grant number DMI-0228204, by the Midwest Regional University Transportation Center under project number 04-05, and by the United States Department of Homeland Security through the Center for Risk and Economic Analysis of Terrorism Events (CREATE) under grant number EMW2004-GR-0112. Any opinions, findings, and conclusions or recommendations expressed herein are those of the author and do not necessarily reflect the views of the sponsors.

26

V. Bier

References 1. V. M. Bier, Y. Y. Haimes, J. H. Lambert, N. C. Matalas, and R. Zimmerman, Assessing and managing the risk of extremes, Risk Analysis 19, 83-94 (1999). 2. V. M. Bier, An overview of probabilistic risk analysis for complex engineered systems, in Fundamentals of Risk Analysis and Risk Management (V. Molak, editor), Boca Raton, FL: Lewis Publishers (1997). 3. T. Bedford and R. Cooke, Probabilistic Risk Analysis: Foundations and Methods, UK: Cambridge University Press (2001). 4. R. M. Cooke, Experts in Uncertainty: Opinion and Subjective Probability in Science, Oxford, UK: Oxford University Press (1991). 5. V. M. Bier, S. Ferson, Y. Y. Haimes, J. H. Lambert, and M. J. Small, Risk of extreme and rare events: Lessons from a selection of approaches, in Risk Analysis and Society: Interdisciplinary Perspectives (T. McDaniels and M. J. Small, editors), Cambridge, UK: Cambridge University Press (2004). 6. R. Zimmerman and V. M. Bier, Risk assessment of extreme events, Columbia-Wharton/Penn Roundtable on “Risk Management Strategies in an Uncertain World,” http://www.ldeo.columbia.edu/CHRR/Roundtable/ZimmermanWP.pdf (2003). 7. M. Dresher, Games of Strategy: Theory and Applications, Englewood Cliffs, NJ: Prentice-Hall (1961). 8. H. F. Martz and M. E. Johnson, Risk analysis of terrorist attacks, Risk Analysis 7,35-47 (1987). 9. L. A. Cox, A probabilistic risk assessment program for analyzing security risks, in New Risks: Issues and Management (L. A. Cox and P. F. Ricci, editors). New York: Plenum Press (1990). 10. E. Pate-Cornell and S. Guikema, Probabilistic modeling of terrorist threats: A systems analysis approach to setting priorities among countermeasures, Military Operations Research 7, 5-20 (December 2002). 11. B. J. Garrick, Perspectives on the use of risk assessment to address terrorism, Risk Analysis 22, 421-424 (2003). 12. E. Zebroski, Risk management lessons from man-made catastrophes: Implications for anti-terrorism risk assessments using a simple relative risk method, American Nuclear Society Topical Meeting on Risk Management, San Diego, CA (June 2003). 13. R. A. Zilinskas, B. Hope, and D. W. North, A discussion of findings and their possible implications from a workshop on bioterrorism threat assessment and risk management, Risk Analysis 24, 901-908 (2004). 14. Y. Y. Haimes, Strategic responses to risks of terrorism to water resources, Journal of Water Resources Planning and Management 128,383-389 (2002). 15. Y. Y. Haimes and T. Longstaff, The role of risk analysis in the protection of critical infrastructure against terrorism, Risk Analysis 22, 439-444 (2002). 16. Y. Y. Haimes, N. C. Matalas, J. H. Lambert, B. A. Jackson, and J. F. R. Fellows, Reducing vulnerability of water supply systems to attack, Journal

Game- Theoretic and Reliability Methods in Counter-Terrorism and Security

27

of Infrastructure Systems 4,164-177 (1998). 17. B. C. Ezell, J. V. Farr, and I. Wiese, Infrastructure risk analysis model, Journal of Infrastmcture Systems 6,114-117 (2OOOa). 18. B. C. Ezell, J. V. Farr, and I. Wiese, Infrastructure risk analysis of municipal water distribution system, Journal of Infrastructure Systems 6,118-122 (2000b).

19.

D.M. Lemon and G. E. Apostolakis, A Methodology for the Identification of

Critical Locations in Infrastructures, Massachusetts Institute of Technology, working paper ESD-WP-200401 (2004). 20. G. Levitin, Optimal allocation of multi-state elements in linear consecutively connected systems with vulnerable nodes, European Journal of Operational Research 150,406-419 (2003). 21. G.Levitin and A. Lisnianski, Optimizing survivability of vulnerable seriesparallel multi-state systems, Reliability Engineering and System Safety 79, 319-331 (2003). 22. G. Levitin, Y. Dai, M. Xie, and K. L. Poh, Optimizing survivability of multi-state systems with multi-level protection by multi-processor genetic algorithm, Reliability Engineering and System Safety 82,93-104 (2003). 23. I. Ravid, Theater Ballistic Missiles and Asymmetric War, The Military Conflict Institute, http://www.militaryconflict.org/Publications.htm (2002). 24. S. J. Brams and D. M. Kilgour, Game Theory and National Security, Oxford: Basil Blackwell (1988). 25. R. Anderson, Why information security is hard: An economic perspective, Presented a t the 18th Symposium on Operating Systems Principles, October 21-24, Alberta, Canada; also the 17th Annual Computer Security Applications Conference, December 10-14, New Orleans, Louisiana; http://www.ftp.cl.cam.ac.uk/ftp/users/rjal4/econ.pdf. f (2001). 26. F. Cohen, Managing network security: Attack and defense strategies, Technical Report 9907, Fred Cohen and Associates (1999). 27. B. Schneier, Managed security monitoring: Network security for the 21st century, Counterpane Internet Security, Inc., http://www.counterpane.com/msm.pdfdf (2001). 28. D. G.Arce M. and T. Sandler. Transnational public goods: Strategies and institutions, European Journal of Political Economy 17 (3),493-516(2001). 29. W.Enders and T. Sandler, What do we know about the substitution effect in transnational terrorism? in A. Silke and G. Ilardi (editors), Researching Terrorism: Trends, Achievements, Failures. London: Frank Cass (2004). 30. N. 0.Keohane and R. J. Zeckhauser, The ecology of terror defense, Journal of Risk and Uncertainty 26,201-229 (2003). 31. M. O'Hanlon, P. Orszag, I. Daalder, M. Destler, D. Gunter, R. Litan, and J. Steinberg, Protecting the American Homeland, Washington, DC: Brookings Institution (2002). 32. G.Woo, Insuring against Al-Qaeda, Insurance Project Workshop, National Bureau of Economic Research, Inc. http://www.nber.org/~confer/2003/insurance03/woo.pdf(2003). 33. V. M. Bier, A. Nagaraj, and V. Abhichandani, Protection of simple series

28

34. 35.

36. 37.

38.

39. 40.

41.

42.

V. Bier and parallel systems with components of different values, Reliability Engineering and System Safety 87, 313-323 (2005). J. Major, Advanced techniques for modeling terrorism risk, Journal of Risk Finance 4, 15-24 (2002). V. M. Bier, S. Oliveros, and L. Samuelson, Choosing what t o protect: Strategic defensive allocation against an unknown attacker, submitted t o Journal of Risk and Uncertainty (2005). H. Kunreuther and G. Heal, Interdependent security, Journal of Risk and Uncertainty 26, 231-249 (2003). A. Gupta and V. M. Bier, Myopia and interdependent security risks: A comment on “Interdependent Security” by Kunreuther and Heal, draft manuscript (2005). J. Zhuang and V. M. Bier, Subsidized security and stability of equilibrium solutions in an N-player game with errors, submitted t o ZIE Transactions (2005). K. Hausken, Probabilistic risk analysis and game theory, Risk Analysis 22, 17-27 (2002). W. D. Rowe, Vulnerability t o terrorism: Addressing the human variables, Risk-Based Decision Making in Water Resources X , pp. 155-159. Reston, VA: American Society of Civil Engineers (2002). D. Banks and S. Anderson, Game-theoretic risk management for counterterrorism, Office of Biostatistics and Epidemiology, US.Food and Drug Administration (2003). N. Azaiez and V. M. Bier, Optimal resource allocation for security in reliability systems, submitted t o European Journal of Operational Research (2005).

CHAPTER 3 REGRESSION MODELS FOR RELIABILITY GIVEN THE USAGE ACCUMULATION HISTORY

THIERRY DUCHESNE De‘partement de mathLmatiques et de statistique Pavillon Alexandre- Vachon Universite‘ Lava1 QuLbec, QC, G1K YP4, Canada E-mail: [email protected] In this paper we survey a few common and less common approaches to lifetime regression model building when the covariate of interest is the usage accumulation history. Classical models for lifetime regression with timevarying covariates based on the hazard function and on transformations of the time variable are first considered. Less common, but potentially interesting, regression models are then derived using other modeling approaches based on the notions of transfer functionals and internal wear. The class of simple regression models known as “collapsible models” is discussed, along with its potential applicability to tackle two-dimensional prediction problems involving time and cumulative usage at failure. Ideas for future research are also discussed.

3.1. Introduction In many reliability applications, the lifetime distribution of the devices under consideration will strongly depend on the usage accumulation pattern of these devices. One obvious example is the reliability of automobiles: failures will usually happen much earlier on cars that accumulate mileage at a high rate than on similar cars that are seldom used. For this reason, it is clear that usage accumulation measures should be incorporated as much as possible in the forecast of time to failure, for they are likely to be quite predictive. In order to include usage information in reliability forecasts, a regression model for lifetime given the usage accumulation history is needed. 29

T.Duchesne

30

In this paper, we will survey several approaches to building such models. Throughout, we will assume that a single measure of usage is available. We also suppose that the notion of LLusage” is clear and that a measure of usage accumulation is readily defined. Unfortunately, this might not be the case in every application. For instance, when modeling the lifetime of certain automobile parts, cumulative mileage is the obvious manner in which to measure usage.’ However, for the reliability of factory equipment, there might not be a single trivial way in which to measure usage accumulation. Coming up with a formal definition of usage accumulation measure is beyond the scope of this paper. As a matter of fact, ways to define suitable usage measures could be the basis of several research projects! For the remainder of this paper, we focus on applications for which usage accumulation can be measured with a single time-varying covariate that can be clearly identified.

3.1.1. Definitions and notation Let T be the random variable of time to failure for the device under study. We suppose that T follows a continuous distribution on the positive real line. Let e ( t ) denote the usage rate of the device at time t and Bt = {B(u), 0 I u L t } be the usage accumulation history up to time t . For convenience, we drop the subscript t from 8t to denote the entire potential (if the device never failed) usage accumulation history, i.e., 8 = limt,, Ot. Finally, y(t) = B(u) du denotes the usage accumulated from time 0 up to time t. For example, if the device under consideration is an automobile, T represents its time of failure, B ( t ) is its speed at time t and y(t) is the cumulative mileage on this car at time t. Following Duchesne and Rosenthal,2 we make mild assumptions on the usage rate process {B(t), t 2 0 ) . Let 0 be the space of all possible usage histories. Then for all 8 E 0,we suppose that B ( t ) is a nonnegative and piecewise smooth function, i.e., for each 8 E 0,there exists a countable set of time points 0 5 t l < tz < ... with ti + 03 such that e(t) = a i ( t ) , ti < t < ti+l, where cci(.) is continuous and smooth over [ti,t i + l ] , i = 1 , 2 , . . . Moreover, we assume that the process { 8 ( t ) , t 2 0 ) is external in the sense that its trajectories are determined independently of T . Note that this family of usage accumulation histories is broad enough to include stepwise continuous usage histories (on-off, low intensity-high intensity, smooth acceleration-smooth deceleration-off, etc.) and thus covers a wide range of potential applications. Our goal in this paper is to survey different approaches to building

Jl

Regression Models for Reliability Given the Usage Accumulation History

31

regression models for lifetime given the usage history. Mathematically, we want models for

P[T > tie], vt 2 0,

e E e.

(1)

In this context, usage is nothing more than a time-varying covariate. We will therefore devote the remainder of this section to a short survey of the more classical survival regression models with time-varying covariates. In Sec. 3.2, we will survey other lifetime regression modeling approaches that are not as common but that might be especially appropriate for building regression models for lifetime given usage. We devote Sec. 3.3 to the class of collapsible models and illustrate how they can be convenient to tackle two-dimensional prediction problems involving both time to failure and cumulative usage at failure, such as preventive maintenance schedules or warranty cost calculations. A short discussion as well as ideas for future research are given in Sec. 3.4.

3.1.2. Common lifetime regression models The effect of the usage accumulation history 8 on the conditional distribution of lifetime (1) can be modeled in several ways. One classical approach to regression for lifetime in the presence of time-varying covariates is to model the effect of the covariates on the hazard function (2)

One such model is the proportional hazards model of COX,^ where X(tl0) = Xo(t)exp{PO(t)},

W 2 0, 8 E 0,

(3)

where Xo(t) is a “baseline” hazard function that only depends on t and not on the usage history. Banjevic et d 4use this model to derive optimal condition-based maintenance strategies. Another hazard-based regression model is the additive hazards model:5 x(t1e) = x,(t)

+ p q t ) , w 2 0, e E o,

(4)

where X,(t) is, again, a “baseline” hazard function that only depends on t and not on the usage history. This model is particularly convenient mathematically when the joint distribution of T and Y = y(T) is needed, as is the case with two-dimensional warranty and maintenance calculations. Examples of such calculations in the case of warranty pricing are given by Singpurwalla and Wilson.‘

T. Duchesne

32

Another common approach t o regression model building consists in measuring the age of the device in an operational time scale or general time transformation7 that takes into account its usage history. There is a vast literature on time-scale based models and different authors seem t o be using different terminology for the same concepts. In this paper, we use the terminology of Duchesne and Lawless' who define an ideal time-scale as a functional 4 : R x 0 -+ R such that

P[T > tiel = G[+(t,e)l,

vt 2 0, e E 0,

(5)

where G(.) is some continuous survival function. This notion of ideal time -scale is equivalent t o the concepts of intrinsic scale of Cinlar and O ~ e k i c cumulative exposure of Nelson," load invariant scale of Kordonsky and G e r t ~ b a k h , ' ' ~ virtual '~~~~ age ~ ~of~Finkelsteinl' and is closely related t o the notion of transfer functional of BagdonaviEius and Nikulin.16 From (5), we see that the age in the ideal time -scale at chronological time t contains all the information necessary to obtain the conditional probability of survival past that time given the usage history. From Eqs. (3)-(5) of Ref. 8, we have that the conditional probability P[T > tie] can be equivalently specified via the hazard function (2) or through an ideal time-scale as in (5). However, models that tend to have a simple form for (2) tend to have complex expressions for (5) and vice versa. One model defined through a time-scale change is the basic cumulative exposure model given in Sec. 10.3 of Ref. 10. Suppose that if e(t) = 0 V t , then P[T > tie] = G [ t / v ( e ) ]Then . for a general usage history 8 E 0, we have P[T > t ( O ] = G [ 4 ( t , 8 ) ]with , +(t,0) = d x / v ( B ( x ) ) .Nelson" uses this model to analyze oil breakdown data. The accelerated failure time model with time-varying covariate is a generalization of this varying-stress model. It does not suppose that the usage rate only affects the conditional survival probability through a scale parameter, but it poses P[T > tie] = G[$(t,e)] with

s,"

1 t

d(t,e)=

G ( x , q x ) )dz,

vt 2 0,

8 E 0,

(6)

where ?1, is a functional that is usually specified up to a finite-dimensional vector of parameters. Robins and Tsiatis17 derive inference procedures for this model with +(x,O(s))= exp{pe(x)}. 3.2. Other Approaches to Regression Model Building

Though the methods of Sec. 3.1 can be used in many situations where timevarying covariates are available, perhaps other classes of regression models


33

could also be useful when the covariate in question is usage. The classes that we consider in this section are especially appropriate in situations where information on how usage impacts lifetime is available in the form of differential equations that specify the rate of "consumption" of the time in the ideal time-scale or that specify the rate of increase in "internal wear" of the device.

3.2.1. Models based on transfer functionals BagdonaviEius and Nikulin" define a transfer functional as a functional fe : R x 0 -+ R such that

f e ( t ) = H-~(P[T > t i e ] ) , v t L 0, 8 E 0,

(7)

where H ( . ) is some specified survivor function. Note that if H ( . ) in (7) is equal to G ( . ) in (5), then the transfer functional and the ideal time-scale are the same. Hence both quantities are in one-to-one correspondence to the conditional quantiles of the lifetime distribution given usage. BagdonaviEius and Nikulin" also define the H-resource at time t as the value,of f e ( t ) and the H-resource used up to failure random variable as R = f e ( T ) . The transfer functional can thus be viewed as a tool to transfer the lifetime measured in chronological time for different devices with different usage h i s tories into a lifetime that is measured in a scale whose lifetime distribution has survivor function H ( . ) for all devices, regardless of their usage history. An interesting interpretation of this model is as follows: each device is created with a random initial amount of resource R, whose distribution has survivor function H(.). The usage accumulation history dictates how this amount of resource is consumed via the transfer functional. When all the resource has been consumed, the item fails. BagdonaviEius and Nikulin" use this approach to define new classes of lifetime regression models by specifying the effect of usage on the rate of resource consumption, d f e ( t ) / & , through a differential equation. For instance their Model 4 is given by (8)

with initial condition fo(0) = fe(0) = H-'(l) and where f o ( t ) = H-l(Fo(t)} for some baseline survivor function Fo. From (8), the conditional survivor function of interest is given by (9)

T.Duchesne

34

Obviously, a wide class of regression models can be generated by changing the form of the differential Eq. (8) according to how usage influences the rate of resource use. Note that the common models of Sec. 3.1 are special cases of (8). For example, if H ( t ) = e - t , u { e ( t ) } = 0, r{B(t)}= exp{@(t)} and X o ( t ) = -dlnFo(t)/dt, then Model 4 reduces to the proportional hazards model (3). The additive hazards model (4), the cumulative damage model of Nelsonlo and the accelerated failure time model (6) are also special cases of (8). 3.2.2. Models based on internal wear

It is common in the reliability l i t e r a t ~ r e to ’ ~model ~ ~ ~the ~ ~lifetime ~ of a device as the first time at which the internal wear (“cumulative damage,” LLdegradation7’) of the device crosses a certain threshold value. Mathematically, let { X ( t ) , t 2 0) be a real-valued stochastic process and X* be a positive real-valued random variable independent of { X ( t ) ,t 2 0). Assume that X ( 0 ) = 0 and that { X ( t ) , t 2 0) has right-continuous paths with finite left-hand limits with probability 1. Then the time to failure random variable, T , of the device can be defined in terms of { X ( t ) , t 2 0 ) and X* as T = inf{t : X ( t ) 2 X*).With T so defined, a model of the effect of usage 8 on the internal wear process { X ( t ) , t 2 0) will lead to a model for the conditional probability of interest P[T > tie].There are several models for the distribution of { X ( t ) } given covariates available in the literature: many references are given in the survey on survival in dynamic environments presented in Ref. 18; Chapter 21 of Ref. 7 is devoted to regression models for degradation; BagdonaviEius and Nikulin” propose a method to regress degradation on time-varying covariates, such as usage, to model tire reliability. Some regression models for internal wear given a covariate will yield a simple form for the conditional probability P[T > tie]. Duchesne and Rosentha12 have studied the class of internal wear models given by rt

rt

(10)

where {y(t), t 2 0) is a stochastic process with nonnegative increments. They have derived the conditional probability P[T > tlO] under different forms for the functions p and u and have been able to recover the accelerated failure time model (6) as well as the collapsible models of Sec. 3.3 under some conditions. A simple interpretation of (10) is that the internal wear accumulated on a device increases at every time instant. This increment


35

in wear can be split into a deterministic increase due to time and usage equal to p[s,8,X ( s ) ] d sand a stochastic increase, whose distribution may be influenced by time and usage as well, that is equal to u[s,8,X(s)]dy(s). For example, if the deterministic increase in wear at time s is proportional to the time interval ds and to the usage rate at that time and if the stochastic increase is not influenced by the usage rate or the level of internal wear, then (10) can be written as X ( t ) = Ji[p1 +,BzO(s)]ds s,” a [ s ] d y ( s ) ,which yields P[T > ti81 = G[,&t+P2y(t)], where G is some survivor function that does not depend on 8 and y(t) = O(s)ds is the total usage accumulated up to time t. BagdonaviEius and Nikulin” model the effect of usage on internal wear in a completely different manner. Rather than letting usage modify the increment in wear at a given time, they suppose that the trajectory of the internal wear process is a stochastic process that does not depend on USage, but rather that usage will influence the value of the time index of the process. With this approach, each device randomly draws an internal wear accumulation trajectory, but travels more slowly or rapidly along this trajectory, depending on how intensely it is used. This approach via subordinated processes is relatively new in reliability, although it has been used extensively in other Disciplines.21,22 Mathematically, suppose that each device draws an internal wear trajectory { X ( t ) , t 2 0 ) with X ( t ) = a 2 y ( t ) ,where {y(t), t 2 0 ) is the same nondecreasing process as in (10). Models similar to those presented in Ref. 16 can then be applied to modify the time index of the processes { X ( t ) }and {y(t)}. For instance under the modeling approach of model (8) and (9) with a { e ( t ) }= 0, the amount of internal wear at time t for a device with usage history 8 is given by X ( t ) = exp{pO(s) ds}). This model leads to P[T > tie] = G[Jl exp{pO(s) d s } ] . These models can all be extended to cases where failure is not caused solely by internal wear reaching a threshold, but also by external (traumatic) events such as accidents, overheating, etc. In this regard, internal wear can also be viewed as “failure rate determining”18~19J~20 in the sense that the hazard that the device will succumb in the advent of an adverse event increases with the amount of internal wear of the device. In this setup, time to failure is defined as U = min(T, K ) where T = inf{t : X ( t ) 2 X * } , as before, and K is the time at which a traumatic event that could “kill” the device occurs. Modeling of the distribution of time to failure is then typically done by assuming that the process {y(t)} and K are independent

+

a2y(Jl

T.Duchesne

36

and that K has hazard function (11)

Several a ~ t h ~haver found ~ the ~ additive ~ * hazards ~ ~ formulation ~ ~ n XK(tl6, X ( t ) ) = XO ,BX(t) to be particularly mathematically convenient in this framework. Once again, under some conditions on the hazard function (11) and on the internal wear process { X ( t ) } ,it is possible to obtain some of the regression models described in Sec. 3.1 or Sec. 3.320J as special cases.

+

3.3. Collapsible Models Collapsible models are the family of simple lifetime regression models that can be written as

P[T > tiel

=

~ [ 4 {y(t))l, t, vt 2 0, e E o,

(12)

i.e., models for which the ideal time-scale only depends on time, t , and the amount of accumulated usage at that time, y(t), not on the entire usage accumulation history between times 0 and t. The term "~ollapsibilit seems to have been introduced by O a k e ~ , 'but ~ models of the collapsible form (12) have been used in reliability for a much longer time.25~11~'2 Kordonsky and G e r t ~ b a k h " * ' ~ >have ~ ~ >used ' ~ the linear time-scale version of these models, with 4 { t , y ( t ) } = @ I t ,&y(t), to analyze aircraft reliability data and fatigue life of steel specimens. Duchesne and Lawless' have shown that this linear time-scale model provided a better fit to the steel specimen data than the traditional accelerated failure time model. Model selection and parametric inference for these models are discussed in Refs. 24, 14, 8, while semiparametric ( 4 specified up to a vector of parameters, G arbitrary) is considered by Kordonsky and Gertsbakh14 as well as Duchesne and Lawless.26 D u c h e ~ n eillustrates ~~ how it is possible to estimate level curves of the form C, = {(z,y) : +(z,y} = a } nonparameterically. As shown in Sec. 3.2, collapsible models can arise in setups where failure is caused by excessive internal wear when this internal wear process satisfies certain conditions.

+

3.3.1. Two-dimensional prediction problems In several applications, predictions are based on the joint distribution of time to failure and cumulative usage at failure. Conditional distributions


37

of time to failure given the usage history of the collapsible form can potentially simplify some of these calculations. Here are a few examples of two-dimensional prediction problems: 0

0

0

For a typical North American automobile warranty, coverage has both time and cumulative usage (mileage) limitations. As shown by several authors, e.g., Singpurwalla and Wilson,6 evaluation of the cost of such a warranty will therefore involve an expectation with respect t o the joint distribution of T and Y = y(T). Moreover, warranty data are censored in both time and cumulative usage;' a warranty period which would be parallel t o an age curve C, would bring this censoring problem back t o a single dimension. Though such a warranty would be difficult t o sell, it would represent a fair warranty since every user would have the same probability t o see his device fail within the warranty period, regardless of how the device is used. Kordonsky and GertsbakhZ8 and, more recently, Frickenstein and Whitake~ consider ~~ the problem of optimizing preventive maintenance operations when usage has a strong influence on the distribution of time t o failure and there is a lot of variability in the usage histories of different items. Again in this case, the joint distribution of T and Y is a central element of the calculations. Kordonsky and GertsbakhZ8 use a collapsible model with a linear time-scale to minimize the average cost per life cycle of a fleet of items with different usage histories. Many modern devices are equipped with sensors that measure all sorts of environmental and usage rate information in real time. Engineers want to use this information t o monitor the state of the device and propose condition-based maintenance in real time. Conditioned-based maintenance decisions a t a given time t are usually based on the hazard of failure at that time.4 Data storage capabilities and the necessity for instantaneous calculations suggest that collapsible models could be useful for this type of application, since the hazard of failure does not depend on the entire usage history but only on time, cumulative usage and usage rate a t that time: d d A(t(0) = -- l n P [ T > tls]= -- lnG[c${t,y(t))] dt dt = XG[d{t,Y(t))l [d(i){t,Y ( t ) ) -k d(z){t,Y(t))e(t)] where AG(z)

4 ( 2 ) kY l

=

-dlnG(x)/ds,

= W { Z , Y)/dY.

,

4(1){x,y} = a$(x,y}/az and

T. Duchesne

38

3.4. Discussion

We have looked at various approaches to construct regression models for the conditional distribution of lifetime given a usage accumulation history. While some of these models have been thoroughly investigated and have proven their worth for lifetime regression based on time-varying covariates, several new models can be derived using the construction approaches outlined in this paper. Of course this review is not exhaustive, as there exists a vast literature on lifetime regression models. Numerous semi- and nonparametric hazard based models are considered in the biostatistics and econometrics literature; some of these models might also be useful in reliability applications. Moreover, specific regression models based on chemical and physical theory have been described in the reliability literature and have not been explicitly mentioned here. Since usage can be viewed as a stress factor or a catalyst, perhaps these chemical/physical regression models could be used to model the distribution of lifetime given usage. There are still many open problems when we consider the approaches of Sec. 3.2. The class of models given by Eqs. (8) and (9) is very broad. Nonparametric inference methods to eliminate some models from this class would be very helpful for model selection. Perhaps such a test could lead to an omnibus test of the collapsibility assumption (12). Regression models for reliability data tend to be specified via a time transformation. This suggests that the subordinated process approach to internal wear/degradation modeling could be a more natural way to proceed when regressing internal wear or degradation on usage. This avenue requires further study.

Acknowledgments

I would like to thank the numerous researchers who provided me with interesting feedback after I presented this article at the MMR 2004 meeting in Santa Fe in June 2004; many of their comments are reflected in this paper. I also wish to thank an anonymous referee for useful comments and the Financial support of this work by the Natural Sciences and Engineering Research Council of Canada and the Fonds qu6b6cois de la recherche sur la nature et les technologies is gratefully acknowledged.

References 1. J . F. Lawless, J. Hu, and J. Cao, Methods for the estimation of failure distributions and rates from automobile warranty data, Lifetime Data Anal.


39

1, 227-240 (1995). 2. T. Duchesne and J. S. Rosenthal, On the collapsibility of lifetime regression models, Adv. Appl. Prob. 35,755772 (2003). 3. D. R. Cox, Bayes estimates for the linear model, J. R. Statist. SOC.B 34, 187 (1972). 4. D. Banjevic, A. K. S. Jardine, V. Makis, and M. Ennis, A control-limit policy and software for condition-based maintenance optimization, INFOR 39,32-50 (2001). 5. D. Y. Lin and Z. Ying, Additive hazards regression models for survival data, in Proceedings of the First Seattle Symposium in Biostatistics: Survival Analysis, Eds. D. Y. Lin and T. R. Fleming, Springer-Verlag, New York (1997). 6. N. D. Singpurwalla and S. P. Wilson, Warranty problem: its statistical and game theoretic aspects, SIAM Review 35,17-42 (1993). 7. W. Q. Meeker and L. A. Escobar, Statistical Methods for Reliability Data, Wiley, New York (1998). 8. T. Duchesne and J. Lawless, Alternative time scales and failure time models, Lifetime Data Anal. 6, 157-179 (2000). 9. E. Cinlar and S. Ozekici, Probability in the Engineering and Informational Sciences, Prob. Eng. Inf. Sci. 1, 97-115 (1987). 10. W. Nelson, Accelerated Testing: Statistical Models, Test Plans, and Data Analyses, Wiley, New York (1990). 11. K. B. Kordonsky and I. Gertsbakh, Choice of the best time scale for system reliability analysis, Europ. J. Oper. Res. 65, 235-246 (1993). 12. K. B. Kordonsky and I. Gertsbakh, System State Monitoring and Lifetime Scales, Reliability Engineering System Safety 47, 1-14 (1995). 13. K. B. Kordonsky and I. Gertsbakh, System State Monitoring and Lifetime Scales 2, Reliability Eng. Sys. Safety 47, 145-154 (1995). 14. K. B. Kordonsky and I. Gertsbakh, Multiple time scales and the lifetime coefficient of variation: engineering applications, Lifetime Data Anal. 2, 139156 (1997). 15. M. S. Finkelstein, Wearing-out of components in a variable environment, Reliability Engineering System Safety 66, 235-242 (1999). 16. V. B. BagdonaviEius and M. S. Nikulin, Transfer functionals and semiparametric regression models, Biometrika 84, 365-378 (1997). 17. J. Robins and A. A. Tsiatis, Semiparametric Estimation of an Accelerated Failure Time Model with Time-Dependent Covariates, Biometrika 79,321334 (1992). 18. N. D. Singpurwalla, Survival in Dynamic Environments, Stat. Sci. 10, 86103 (1995). 19. D. R. Cox, Some remarks on failure-times, surrogate markers, degradation, wear, and the quality of life, Lifetime Data Anal. 5, 307-314 (1999). 20. V. B. BagdonaviEius and M. S. Nikulin, Estimation in degradation models with explanatory variables, Lifetime Data Anal. 7, 365 (2001). 21. M. L. T. Lee and G. A. Whitmore, J. Appl. Prob. 30, 302-314 (1993). 22. P. Hougaard, M. L. T. Lee, and G. A. Whitmore, Analysis of overdispersed

40

23. 24. 25. 26. 27.

28. 29.

T. Duchesne

count data by mixtures of Poisson variables and Poisson processes, Biometrics 53, 1225-1238 (1997). N. P. Jewel1 and J. D. Kalbfleisch, Marker processes in survival analysis, Lifetime Data Anal. 2 , 15-29 (1996). D. Oakes, Multiple time scales in survival analysis, Lifetime Data Anal. 1, 7-18 (1995). N. A. Miner, Cumulative damage in fatigue, J. Appl. Mechanics 12, A159 (1945). T. Duchesne and J. Lawless, Semiparametric inference methods for general time scale models, Lifetime Data Anal. 8, 263-276 (2002). T. Duchesne, Semiparametric Methods of Time Scale Selection in Recent Advances in Reliability Theory: Methodology, Practice and Inference, Eds. N. Limnios and M. S. Nikulin, Birkhauser, Boston, (2000). K. Kordonsky and I. Gertsbakh, Best time scale for age replacement, Int. J. Reliab. Safety Eng. 1, 219 (1994) S. G. Frickenstein and L. R. Whitaker, Age replacement policies in two time scales, Naval. Res. Logist. 50, 592-613 (2003).

CHAPTER 4 BAYESIAN METHODS FOR ASSESSING SYSTEM RELIABILITY: MODELS AND COMPUTATION

TODD L. GRAVES Statistical Sciences Group Los Alamos National Laboratory Los Alamos, N M 87545 USA E-mail: [email protected]

MICHAEL S. HAMADA Statistical Sciences Group Los Alamos National Laboratory Los Alamos, NM 87545 USA E-mail: [email protected] There are many challenges with assessing the reliability of a system today. These challenges arise because a system may be aging and full system tests may be too expensive or can no longer be performed. Without full system testing, one must integrate (1) all science and engineering knowledge, models and simulations, (2) information and data at various levels of the system, e.g., subsystems and components, and (3) information and data from similar systems, subsystems and components. The analyst must work with various data types and how the data are collected, account for measurement bias and uncertainty, deal with model and simulation uncertainty, and incorporate expert knowledge. Bayesian hierarchical modeling provides a rigorous way to combine information from multiple sources and different types of information. However, an obstacle to applying Bayesian methods is the need to develop new software to analyze novel statistical models. We discuss a new statistical modeling environment, YADAS, that facilitates the development of Bayesian statistical analyses. It includes classes that help analysts specify new models, as well as classes that support the creation of new analysis algorithms. We illustrate these concepts using several examples.

41

42

T . Graves and M. Hamada

4.1. Challenges in Modern Reliability Analyses

There are many challenges with assessing the reliability of a system today. First, full system testing may be prohibitively expensive or even prohibited. For this reason and others, it is important to be able to make use of expert opinion and information in the form of physics/engineering/material science based models (deterministic and stochastic) or simulation and account for model bias and uncertainty. Results from multiscale science/engineering experiments also need to be incorporated. One must be able to handle complex system reliability models, including reliability block diagrams, fault trees and networks. One must incorporate data at various levels (system, subsystem, component), and properly account for how higher level event data inform about lower level data. In this context, models for subsystems or even components can be nontrivial. The effects of aging and other covariates including those that define subpopulations, are often of interest. Efficient analysis entails combining information and data from similar systems, subsystems and components. Reliability data can come in various flavors, including binomial counts, Poisson counts, failure times, degradation data, and accelerated reliability data. Such data may be nontrivial to analyze in their own right. How such data are collected must also be considered. For example, measurement error (bias and precision) from destructive or nondestructive evaluation techniques may be too large to ignore. These challenges go beyond that addressed in the system reliability literature (Cole,’ Mastran,’ Mastran and Singp~rwalla,~ Natvig and Eide,4 Martz, Waller, and Fickas,’ Martz and Waller‘) which mostly consider binomial data. This literature also predates the advances made in Bayesian computation in the 1990s and resorts to various approximations. Such approximations will be hard to generalize for these challenges. An outline of this paper is as follows. First we consider three examples which illustrate these challenges. Next we discuss a statistical modeling environment which can support the needs of modern reliability analyses. Then we return to the three examples and present results of their reliability analyses. Finally, we conclude with a discussion. 4.2. Three Important Examples

We discuss three examples of challenging statistical problems that arise in reliability estimation. First, even the analysis of a single component can require development of new techniques. Consider the case in which there are indications that a component’s manufacturing lot impacts its reliability, and

Bayesian Methods for Assessing S y s t e m Reliability

43

some of the test data are obtained in ways that might favor the sampling of (un)reliable items. Second, we discuss the estimation of the reliability of a system based on (1)system tests, where failures provide partial information about which components may have failed, and (2) specification tests, which measure whether components meet specifications that relate imperfectly t o system success. Finally, we present an ambitious approach to integrating many sorts of component data into a system reliability analysis.

4.2.1. Example 1: Reliability of a component based o n biased sampling Our first example, which deals with reliability estimation for a single component, is discussed in Graves et al.7 Of interest is the prevalence of a certain feature in an existing population of items. Some items have already been destructively tested and removed from the population. There is reason t o believe that the probability that an item has the feature is related t o the lot in which it was manufactured, but it is not obviously appropriate to assume that the feature is confined to a small number of lots. We handle this situation with a Bayesian hierarchical model, pi N Beta(a, b ) , where pa is the probability that an item in lot a was manufactured with the feature, and where a and b are given prior distributions, so that a test on an item in one lot is informative about the prevalence of the feature in the other lots, but more informative about its own lot. A further complication is we are not willing to assume that the process by which items were selected for sampling was done so that items with and without the feature were equally likely to be sampled. (We do also have some truly random samples along with these “convenience samples.”) Naive estimation is therefore in danger of systematically over- or under-estimating the prevalence. We use the extended hypergeometric distribution (see Graves et al.7 and its references) to allow for the possibility of biased sampling; using this distribution for this purpose was new, so software did not exist for using it. Finally, the unknown quantities of most interest are the actual numbers of items with the feature in each of the lots (which were of known finite size), so the software must be able to sample posterior distributions of quantities which take on finitely many values. Before introducing the statistical models, we begin with some notation. The finite population consists of M lots. Let the ith lot size be denoted by Ni and the unknown number of systems in the ith lot with the attribute be denoted by Ki. The sample sizes and numbers of sampled features in

44

T. Graves and M. Hamada

the convenience and random samples for the i lot are denoted respectively by n,i, yci, n,i and yri. Because the convenience sample is assumed t o be taken first, the ith lot size for the random sample is N,., = Ni - n,i and K,.i = Ki - yci is the number of components with the attribute remaining in the ith lot after the convenience sample has been taken. We assume

Ki

N

BinorniaZ(N,,pi).

(1)

and (2)

Now we consider statistical models for the data. For the convenience sample data, we want t o account for the potential bias of sampling too many or too few components with the attribute. To do this, we use the extended-hypergeometric distribution for yci which has probability function

+

for y = max(0, n,i - Ni K i ) , . . ., min(n,i, Ki). When the biasing parameter 0 is equal to one, the extended-hypergeometric reduces to the hypergeometric which arises from a completely random sample in which there is no biasing. When 0 is greater than one, the sampling favors components with the attribute. The randomly sampled data yri are assumed to follow hypergeometric distributions. 4.2.2. Example 2: System reliability based o n partially

informative tests Another reliability problem involves synthesizing two different types of data, neither of which is standard for reliability analysis. First, the system test data provide complicated information; for notational clarity, consider a single system test. If the set of components in the system is denoted by C , there is a subset of components C1 that we know to have worked, another subset of components Co that we know to have failed, and a third subset of components Cz, at least one of which must have failed. (The test provides no information at all about the success or failure of the remaining components.) The system is a series system. The likelihood function for this single

45

Bayesaan Methods f o r Assessing System Reliability

test, assuming that the system is of age t , is (3)

where the first two products are defined to be one if empty, while the last is zero. Here p i ( t ) is the probability of success of component i at age t; we used p i ( t ) = @ {(of ~ ? ) - l / ~ ( a iPit - &)},where @ is the Gaussian distribution function. One reason for this choice of p i ( t ) (in particular, the seemingly redundant parameterization) is the other type of data we use; certain of the components were tested to assure that they met specifications, and these tests generate continuous data. If one assumes that the specification measurement Si on component i satisfies Si N(cri+&t, $), specification data can be incorporated naturally. Then if one assumes that, conditionally on its specification measurement Si , the component would succeed in a system test with probability @ {a2-'(Si - &)},it follows that unconditionally, the component's success probability is @ { (of ~ ? ) - ' / ~ ( a i Pit - ei)}. More generally, suppose ni specification measurements Sill. . . ,Sin; a p ply to component i, that Sij N ( q + &t,T$), and that the success probability given the specs is @{oijl(Sij - &)}. Then the unconditional success probability, or the likelihood function for the system tests, is ~ { ( a i+j ~ij)-'/'(aij + Pijt - eij)}.We also generalize to multiple covariates; they need not be the same for different specs. A final complication, but one that is trivial to handle, is that the system is built in several different configurations; not all components are present in all configurations. This formulation enables us t o use specification data to help make inferences on parameters relevant to system tests. It also requires specialpurpose software.

+

+

-

+

+

-

n;:,

nyLl

4.2.3. Ezample 3: Integrated system reliability based on diverse data A fundamental problem of system reliability is estimating the reliability of a system whose components are combined in series and parallel subsystems, and where data relevant to the component qualities take on general (not necessarily binomial) forms. (The case of binomial data is discussed in Johnson et a1.8) As a simple example, consider a three component series system. Binomial data are available on Component 1 at various ages, and the success probability at age t satisfies log(pl(t)/{l - p l ( t ) } ) = a0 - alt.

46

T . Graves and M . Hamada

for Component 2 is defined in terms of its lifetime which is distributed Weibull; a lifetime 77 equates t o a component success a t time t if t < 77, and data on Component 2 are a collection of possibly right-censored lifetimes. Component 3 is required to generate a desired amount of power T on demand; the distribution of power is lognormal, with a logged mean that decreases linearly in age. Data are (power, age) pairs. Finally, we have binomial system test data, where the success probability is the age-dependent success probability of Component 1, multiplied by the reliability of Component 2, multiplied by the age-dependent probability of sufficient power generation by Component 3. The full data likelihood contains terms for each of the four types of tests, and other information can be captured in prior distributions. It is necessary that the software analyze likelihood functions with each of these terms, and ideally it would support the integration of components into (sub)systems in arbitrary parallel/series combinations. As described above, the Component 1 data yl, at time tl, follow Binomial(nl,,pl,) where log(pl,/(l -PI,)) = a0 a l t l , . The Component 2 data y2, follow WeibulZ(X,P) for scale X and shape P. The Component 3 data y3, at time t3, follow Lognorrnal(p3,, g2)7where p3, = 70 7 t 3 , . Finally, the system data yszat time t,, follow Binomial(n,,,p,,), where p,, = Rl(tS2)R2(t,2)R3(tS2) and R l ( t S Z ) = exp(ao + aot.9Z)/(1 + exp(ao + a o t S 2 ) ) , R ~ ( L= ) eXp(-@,) and R3(tsz) = 1 - a{(log(T) - (70 rtsz>)/g).

+

+

+

4.3. YADAS: a Statistical Modeling Environment YADAS is a software environment for performing arbitrary Markov chain Monte Carlo (MCMC) computations, and as such it is very useful for defining and analyzing new, nonstandard statistical models. Its source code and documentation, several examples, and supporting technical reports are available for download a t yadas . l a d . gov (Gravesg?lo).Its software architecture makes it easy to define new terms in models and make small adjustments t o existing models. MCMC algorithms often suffer from poor autocorrelation, and YADAS provides an environment for exploring and fixing these problems. YADAS is written in Java and generally requires additional Java code to work a new problem, but work continues on alternative interfaces. We discuss all these issues in this section.

4.3.1. Expressing arbitrary models Defining a model in YADAS is as simple as specifying how to calculate the unnormalized posterior distribution evaluated at an arbitrary parameter

Bayesian Methods for Assessing System Reliability

47

value. This is an advantage of a Bayesian approach, as well as being one of the benefits of the design decision to emphasize the Metropolis-Hastings algorithm instead of Gibbs sampling as in WinBUGS (Spiegelhalter et a1.l'). In the Gibbs sampler, each time the model is changed, the sampling algorithm must be changed accordingly. In YADAS, however, the model definition is decoupled from the algorithm definition. Provided the acceptance probabilities are generated correctly, the distribution of the samples will converge to the desired posterior distribution. Since the acceptance probabilities are determined by the unnormalized posterior density function, this happens automatically when the new model is defined. The definition of a model is a collection of objects called bonds. Each bond is a term in the posterior distribution. Bonds are defined in the software in such a way as to make it easy to make the sort of small changes to an analysis that are common in the model-building phase. Examples include changing a parameter from fixed to random, or changing a distributional form. In particular, analyzing the sensitivity of conclusions to the choice of prior is natural. The ease of defining new models was particularly evident in the analysis of the reliability of the component manufactured in lots and sampled nonrandomly. The analysts needed to write code to calculate the extended hypergeometric density function, but after this trivial exercise was complete, it could be plugged in as any other density would be. Without YADAS, time constraints would have forced the analysts to make use of a more convenient but less appropriate analysis. In our second example, the critical step was to compute (3) after first computing the p i ( t ) ' s . This was also straightforward, and the handling of specification data just required adding another bond (with the familiar normal linear model form) to the existing list. The third example, in which various forms of component test data are combined with system test data, is an excellent example of the usefulness of the YADAS model definition strategy. The component test data are as easy to include as in an application where they are the only data source. We make use of YADAS's general code that reads in a system structure and integrates component success probabilities in any series or parallel combination, in order to incorporate the system test data.

48

T . Graves and M . Hamada

4.3.2. Special algorithms While it is true that defining an MCMC algorithm for a new problem is as easy as specifying how to compute the unnormalized posterior distribution, it is also true that these first attempts at algorithms may fail to perform adequately. However, YADAS turns this to a strength by helping users to improve algorithms by adding steps to the existing algorithm; Metropolis-Hastings-based software is much better suited to this goal than Gibbs-based software. The most common MCMC performance problem is high posterior correlation among parameters; this generates high autocorrelation in consecutive MCMC samples, because parameters are reluctant to move individually. YADAS’s typical approach is the “multiple parameter update”; one proposes simultaneous moves to parameters in a direction of high variability. For example, in our second example (as happens in many generalized linear model examples), the intercept and slope parameters for some components were highly correlated, and the algorithm was improved with new steps that proposed the addition of a random amount to the intercept while simultaneously subtracting a multiple of the same amount from the slope. The naturalness of defining algorithms in YADAS was also exhibited in the biased sampling problem, where the numbers of items in each lot with the feature of interest needed to be sampled; this was handled with YADAS’s general approach for sampling parameters that take on finitely many values.

4.3.3. Interfaces,present and future YADAS is written in Java, and that provides portability advantages beyond its encouragement of generality that helped YADAS become as ambitious as it is. However, few Bayesian statisticians use Java as their language of choice, so this limits its popularity. An area of active YADAS development is providing additional interfaces to its capabilities. One such interface is the interface with the R package (www.R-pro j e c t .org), a very popular, free statistics computing environment that is very similar to S-Plus. This interface will facilitate the handling of both input to and output from MCMC algorithms, including examining output for adequate convergence to the limiting distribution and rapid mixing. One application is the use of genetic algorithms for experiment design; each candidate design selected by the genetic algorithm will generate data, which will then be analyzed using YADAS, and the analysis results will be

49


examined for “fitness” and fed back to determine the next genetic algorithm generation. System reliability is an application of particular interest. For a given budget, which system, subsystem or component data should be collected to reduce the uncertainty of system reliability the most? (See Hamada et a1.12 for an example involving a fault tree.) The R-YADAS interface is possible thanks to the SJava package of the omegahat project (www .omegahat.org). Another interface that will particularly help with reliability problems is the interface with a new graphical tool for eliciting defining system structure and its relationship to data (Klamann and Koehler13). 4.4. Examples Revisited

4.4.1. Example 1

We illustrate the problem with convenience and random samples from the stratified population with a simulated data set; the data from the real application are proprietary. The simulated data set features a total population of 5000 items in 230 lots (100 lots of size 10, 100 of size 25, and 30 of size 50). Total sample sizes were 100 for the convenience sample and 50 for the random sample, with 18 lots being sampled in both ways, 21 only randomly sampled, and 57 only sampled by convenience. A total of 513 components had the feature; individual lot feature proportions p , were drawn from the Beta(l,9) distribution, and the true value of B was 2, representing mild biasing. In the convenience sample, 16 (16%) had the feature, while 6 features appeared in the random sample (12%). A naive estimate for the feature prevalence would then be 22/150 = 0.147. Ten percent of the unsampled items had the feature, so the feature was overrepresented in both samples. We used the following prior distributions: Beta(0.3,1.7), a + b Gamma(2,5), and log 8 N ( 0 , l ) . Posterior medians for these quantities were then 0.13, 5.5, and (for 0) 1.32. The posterior median for p * , the fraction of unsampled items with the feature, was 0.13, different from the naive estimate and closer to the random sample fraction than the convenience sample fraction, as it should be. A 90% posterior interval for this quantity is (0.073,0.209).Posterior density estimates for ./(a a + b ) , a b, 0, and p* are shown in Fig. 4.1.

-

-

N

+

4.4.2. Example 2

The system we studied in Example 2 had a total of 23 components. Thirteen of these had no related specification measurements, five had a single

T. Graves and M . Hamada

50

Fig. 4.1. Plot of Example 1 parameter posteriors. Dotted curves represent priors. The four plots are for ./(a a b ) , a + b, 0, and p'.

+

specification, and five had between two and four. Roughly 1000 system tests were available, with a proprietary number of failures. The 20 specification measurements generated a total of roughly 2000 data points. We studied the effects of six covariates, and the posterior distribution involved 294 unknown parameters. Using YADAS t o analyze these data required us t o write code t o handle the system test data in the form of successes, failures, and partial successes. We needed t o calculate the likelihood for each system test, and all the covariates affected the success probabilities for each component in a novel way. Also, many combinations of the 294 unknown parameters were highly correlated due to shortcomings in the completeness of the data, and this led to poorly performing algorithms. However, YADAS made it possible to improve these algorithms using multiple parameter updates. Results are shown in Fig. 4.2; these are reliability posterior distributions for four different versions of the system. The axes are not shown because of the sensitivity of the data. 4.4.3. Ezample 3

The system pass/fail data consisted of 15 tests at each of 0, 5, 10, 15 and 20 years. The Component 1 pass/fail data consisted of 25 tests a t each of 0, 2, 4, 6, 8, 10, 15 and 20 years. The Component 2 consisted of 25 lifetimes.


51

Reliability posterior distributions for four system configurations

Rellabllity

Fig. 4.2. Density estimates for four different versions of the system described in Example 2 and for one value of the covariates. The axes are omitted due t o proprietary concerns.

Finally, the Component 3 data consisted of 10 destructive observations a t each of 0, 2.5, 5, 7.5, 10, 15 and 20 years. Note that some of the system and component data are collected at different rates. Analyzing these data provide the system reliability median and 95% credible interval over time as displayed in Fig. 4.3. The component model parameter posteriors are given in Figs. 4.4 and 4.5. Note that the posteriors plotted as dotted lines did not use the system data. Those posteriors plotted as solid lines that use the system data are tighter and therefore more informative. The system data provided little additional information for the Component 3 model parameters as displayed in Fig. 4.5. Figure 4.6 displays the system reliability 95% credible interval over time when both the system data are used and when they are not used. The solid lines display the results when the system data are used. Note that the solid lines are higher and closer together than the dotted lines. 4.5. Discussion

In this paper we have attempted t o communicate some of the excitement of working on modern system reliability assessments. New methodology is important for dealing with such issues as nonrandom sampling and analyzing test results that utilize different levels of the system and generate different data distributions. Though we have not illustrated them in this

52


Fig. 4.3. Plot of Example 3 system reliability posterior median and 95% credible interval.

Fig. 4.4. Plot of Example 3 component models 1 and 2 parameter posteriors (with system data (solid line) and without system data (dotted line)).

paper, other forms of information such as expert judgment, more detailed engineering models, and simulation models also need to be integrated with traditional data, and there are opportunities for research into good methods for doing this. Appropriate new models require new computational meth-


53

Fig. 4.5. Plot of Example 3 component model 3 parameter posteriors (with system data (solid line) and without system data (dotted line)).

Fig. 4.6. Plot of Example 3 system reliability posterior posterior 95% Credible intervals (with system data (solid line) and without system data (dotted line)).

ods, and an extensible modeling environment makes it practical to work with new models, even in a deadline-driven scientific environment. Finally, complex system models with automatic analysis software are amenable to exciting research on using genetic algorithms to guide resource allocation

54


a n d experimental design.

Acknowledgments We t h a n k Dee Won for her encouragement of this work. References 1. P. V. Z. Cole, A Bayesian reliability assessment of complex systems for binomial sampling, ZEEE Transactions o n Reliability R-24,114-117 (1975). 2. D. V. Mastran, Incorporating component and system test data into the same assessment: a Bayesian approach, Operations Research 24, 491-499 (1976). 3. D. V. Mastran and N. D. Singpurwalla, A Bayesian estimation of the reliability of coherent structures, Operations Research 26, 663-672 (1978). 4. B. Natvig and H. Eide, Bayesian estimation of system reliability, Scandznavian Journal of Statistics 14,319-327 (1987). 5. H. F. Martz, R. A. Waller, and E. T. Fickas, Bayesian reliability analysis of series systems of binomial subsystems and components, Technometrics 30, 143-154 (1988). 6. H. F. Martz and R. A. Waller, Bayesian reliability analysis of complex series/parallei systems of binomial subsystems and components, Technometrics 32,407-416 (1990). 7. T. Graves, M. Hamada, J. Booker, M. Decroix, C. Bowyer, K. Chilcoat, and S. K. Thompson, Estimating a proportion using stratified data arising from both convenience and random samples, Los Alamos National Laboratory Technical Report LA-UR-03-8396 (2004). 8. V. Johnson, T. Graves, M. Hamada, and C. S. Reese, A hierarchical model for estimating the reliability of complex systems (with discussion), Bayesian Statistics 7,Oxford University Press, 199-213, J. M. Bernardo, M. J. Bayarri,

J. Berger, A. P. Dawid, D. Heckerman, A.F.M. Smith, and M. West (Eds.) (2003). 9. T. L. Graves, A framework for expressing and estimating arbitrary statistical models using Markov chain Monte Carlo, Los Alamos National Laboratory

Technical Report LA-UR-03-5934 (2003a). 10. T. L. Graves, An introduction to YADAS. yadas .lanl.gov (2003b). 11. D. Spiegelhalter, A. Thomas, and N. Best, WinBUGS Version 1.3 User Manual (2000). 12. M. Hamada, H. F. Martz, C. S. Reese, T. Graves, V. Johnson, and A. G.

Wilson, A fully Bayesian approach for combining multilevel failure information in fault tree quantification and optimal follow-on resource allocation, Reliability Engineering and System Safety 86, 297-305 (2004). 13. R. Klamann and A. Koehler, GROMIT: Graphical Modeling Tool for System Statistical Structure, Los Alamos National Laboratory, Los Alamos, NM (2004).

CHAPTER 5 DYNAMIC MODELING IN RELIABILITY AND SURVIVAL ANALYSIS

EDSEL A. PENA Department of Statistics University of South Carolina Columbia, SC 29208 USA E-mail: [email protected]. edu

ELIZABETH H. SLATE Department of Biostatistics, Bioinformatics and Epidemiology Medical University of South Carolina Charleston, S C 29425 USA E-mail: [email protected]

Dynamic models are important, realistic, and more appropriate than static models in many settings, notably reliability, engineering, survival analysis, and also in biomedical settings. General classes of dynamic models are described. Some probabilistic properties of these models are presented, parameter estimation methods are indicated, and their applicability is demonstrated through an illustrative data set.

5.1. Introduction Consider a situation where a recurrent event of interest is being monitored over some observation period. This could occur, for example, in a reliability or engineering setting when a pcomponent coherent system (cf., Barlow and Proschanl) with structure function 4 is being followed and the events of interest are component failures and eventually system failure. Or, it could be in a biomedical study and of interest are successive occurrences of some recurrent event, such as, for example, hospitalization due to a chronic disease, onset of depression, occurrence of migraine headaches, tumor occurrence, etc. Additional examples of the recurrent event situation we study include 55

56

E. Pe6a and E. Slate

monitoring a married couple in a sociological study of divorce and of interest are recurrences of major disagreements in the marriage; a drop of 200 points during a trading day in the Dow Jones Industrial Average in an economic context; and the commission of a terrorist act in the United States. In developing stochastic models for event occurrences in such systems, dynamic models become highly appropriate and more realistic. In such models the impact of actions or interventions, which are undertaken as the monitoring progresses, with such actions possibly dictated by the accrued history of the system, can be incorporated in the model. Dynamic models could also incorporate the possible effects of an increasing number of event occurrences and take into account the impact of possibly time-varying covariate processes. When dealing with coherent structures in reliability and engineering settings, component failures may have the effect of increasing the load on the remaining functioning components arising from the change in the effective structure function. This is illustrated by considering the bridge structure in the first picture in Fig. 5.1. In this picture, the initial load that each component is receiving is indicated. After the failures of component 2, and then component 4, the resulting loads of the remaining functioning components may change as demonstrated by the second and third pictures in Fig. 5.1 because of the change in the effective structure function. The usual static modeling approach, which is characterized by a specification of the failure density model at time s in response to the question posed at the time origin: “What is the probability that an event will occur in the infinitesimal time interval [s,s ds)?,” encounters difficulties in modeling such dynamic changes in the component loads, or the impact of performed interventions after each event occurrence. Dynamic models are best specified through failure intensities, and so are often stated in terms of hazard rate functions. The underlying dynamic modeling approach is conditional in that one asks the question: “Given the history of the system just before time s, what is the conditional probability that an event will occur in the infinitesimal time interval [s,s ds)?” This leads to a specification of the hazard or failure intensity at time s, say a ( s ) ,with the interpretation that a(s)ds is approximately the probability of an event occurring in [s,s ds), given the history up to time S. If a ( s ) is deterministic, then through the product-integral representation of the survivor function (cf., Andersen, Borgan, Gill and Keiding,’ p. 57), the

+

+

+

Dynamic Modeling i n Reliability and S u m i d Analysis

57

After Compoxient 2 Has Failed: Series-Paralkl

After Components 2 arid 3 Have Failed: Series

Fig. 5.1. A bridge structure with structure function $ J ( T ~ , x z , z ~ = , ~(1114) ~ , z ~V (111315) V ( 1 2 1 5 ) V (121324), with the initial component loads indicated in the first picture, and the consequent component loads indicated in the second and third pictures after component 2, then component 4 fail.

58

E. Peiia and E. Slate

system life S survivor function becomes

n S

P{S > S} =

[l - a(v)dv].

(1)

v=o

A simple, but not rigorous, way of seeing the validity of this formula is that if the unit is to survive the period [0, s] so S > s, then for a partition 0 = S O < s1 < sz < . . . < SM = s of [0,s ] , we have by the multiplication rule M that P{S > s } = n,=, P{S > sjlS 2 s j - 1 ) . But as rnaxlljSM(sj - sj-1) becomes small, then P{S > s j ( S 2 sj-1) % 1 - a ( s j - l ) ( s j - s j - ~ ) , so letting rnaxlSjg4(sj - sj-1) --+ 0 as M + oa,formula (1) obtains. Because the approach is conditional, the resulting model is able to incorporate the impact of performed actions and interventions, as well as the situational and environmental changes, that dynamically occur during the monitoring of the system. A pictorial depiction of these static and dynamic modeling approaches is given in Fig. 5.2. Much work in the reliability and engineering settings adddressing dynamic models has dealt with the modeling aspect and the determination of the stochastic and probabilistic properties of such models. There has been a dearth of work dealing with statistical inference issues for such dynamic models. In the survival analysis setting, where dynamic models are typically associated with biomedical studies and clinical trials, there has been work dealing with inference issues for such models, though for general dynamic models, inference procedures are still incomplete. In this paper, aside from discussing dynamic models and their properties, focus will also be on methods for making inference about the model parameters, with the inference to be based on data arising from the monitoring of a sample of study systems or units. We outline the major portions of this paper. In Sec. 5.2 we present the mathematical setting that will facilitate the formal description of dynamic models and describe three specific dynamic models. In Sec. 5.3 we provide some properties of the dynamic models described in Sec. 5.2, and in Sec. 5.4 we indicate inference issues regarding dynamic model parameters. As the primary intent of this paper is to call attention and to encourage the study and use of dynamic models, mathematical technicalities will be confined to a minimum. Instead we refer the reader for technical details to the relevant papers. The applicability of the models will be illustrated in Sec. 5.5.

Dynamic Modeling i n Reliability and Survival Analysis

59

Fig. 5.2. Pictorial depiction of the static (top) and dynamic (bottom) modeling approaches.

5.2. Dynamic Models

To formally describe the dynamic models of interest, given a system or unit under study, let I = [O,T] be the monitoring period, with T possibly random. Define the processes { ( N t ( s ) , Y t ( s ) ): s E I} according t o N t ( s ) = number of events that occurred in [0, s], and Y t ( s ) = I{the system is under observation at s}, where I { A } is the indicator function of event A. (We remark that the use of the superscript t simplifies notation since no new letters are needed when we convert to doubly-indexed processes later.) We also define on an appropriate probability space (a,3,P ) a filtration {.Fs: 0 5 s 5 T } such that .FSrepresents the cT-field containing all

60

E. Pefia and E. Slate

information about the system that has accrued over the time period [O, s] (cf., Sec. 11.2 in Andersen, et d 2 ) In . particular, N t and Yt are adapted to this filtration. A dynamic model is specified by providing the intensity process of N t defined for every s E I via

a ( s )= l i m -1P { N t ( ( s + h ) - ) - N t ( s - ) 2 l l F s - } . hi0 h

(2)

We describe two general classes of dynamic models. The first one, which is relevant for coherent systems in reliability and engineering, was introduced in Hollander and Pefia;3 while the second one, which perhaps is more relevant in biomedical and public health settings, was introduced in Peiia and

Hollander. 5.2.1. A dynamic reliability model Consider a coherent system with p components and structure function 4. Let 2, = {1,2,. . . , p } , and denote by P the power set of 2,. Let &, P be the collection of minimal cut sets of 4. A set J E P is defined to be &absorbing if there exists a K E K$ with K C J. Let Q$ be the collection of &absorbing sets of q51 and by Q$ = P \ Q b the collection of &nonabsorbing sets of 4. We now describe the first dynamic model. Let XO(.) be a hazard rate function, and for each J E Q:, let {ai[J],i E Jc} be a set of nonnegative real numbers. For each s 2 0, denote by F ( s ) the set of component indices that are nonfunctioning at time s-. With Y t ( s ) = I{‘ 2 s}, the intensity process of the dynamic model is specified according to

r

1

J

C I { F ( s )= J} C aj[J]XO(S).

JE 2 !;

j € J=

(3)

An important property that this intensity specification induces is that the process { M t ( s )= N t ( s ) - 1; a(v)dv : s 2 0} becomes a zero-mean martingale, which means that E{Mt(s t)lFs}= M ( s ) for every s,t >_ 0 (cf., Sect. 11.3 of Andersen, et d 2 )This . allows for the representation

+

Nt(s) =

I”

a(v)dv

+M(s),

s 2 0,

where the first-term on the right-hand side could be interpreted as the ‘signal’ component, while the martingale term is the ‘noise’ component. Through this martingale property, important results about martingales

Dynamic Modeling in Reliability and Survival Analysis

61

such as Kurtz’s Lemma and Rebolledo’s martingale central limit theorem could be employed to examine properties of resulting inference procedures. The model in (3) is a special case of the general model introduced in Hollander and Peiia3. If the system is a pcomponent parallel system so Q 4 = 2, and for any state vector ( ~ 1 ~ ~. .2,yp) , . E {O,l}P, $(yl,y2, . . . , y p ) = Vj”=lyj, and if o l j [ J ] = ~ 1 . ~ 1where IJI is the cardinality of set J and { ~ =j ~ [ j: j] = 0,1,. . . , p - 1) are nonnegative reals with 70 = 1, then (3) simplifies to

(4) which is the equal load-sharing model for a parallel system considered in Kvam and Pe17a.~ 5.2.2. A dynamic recurrent event model

Next we describe a general dynamic model for recurrent events which takes into account the impact of performed interventions after each event occurrence, the effects of accumulating event occurrences and relevant covariate processes, and the effect of an unobserved latent variable, called a frailty, which induces association among the inter-event times. This model was proposed in Peiia and H ~ l l a n d e r and , ~ further studied in Peiia, Slate and Gonzalez.‘ To specify the intensity process for this model, we suppose that a vector of predictable covariate processes {X(s) : s 2 0 ) is observed, and we also require an observable and predictable effective age process { E ( s ) : s 2 0 } , which is possibly specified dynamically. For the notion of predictability, see for instance Sec. 11.3 of Andersen, et aL2 Conditional on the frailty variable 2, which is assumed to follow a distribution H(+) where E is an unknown parameter vector, the intensity process is given by Z y t (s)Ao[E(s)1 dNt(s-); a1 %‘@’X(S)],

(5) where A,(.) is a hazard rate function, p(.; a ) is a nonnegative function with p ( 0 ; a ) = 1, and $(.) is a nonnegative link function. In this model, the effective age process encodes the impact of performed interventions after each event occurrence. To illustrate the importance of this notion, Fig. 5.3 depicts the evolution of this effective age process as events are occurring and based on certain interventions that are performed after each event occurrence. If minimal repair or intervention is performed after each event occurrence, this effective age process takes the form E ( s ) = s, which is exemplified in Fig. 5.3 at the first event, whereas if perfect repair or intervention is performed after each event occurrence, then this is the backward a(SIz)

=

E. Per‘ia and E. Slate

62

Effective Age, E(s)

Illustration: Effective Age Process “Possible Intervention Effects”

Fig. 5.3. Illustration of a possible effective age process.

recurrence time given by E ( s ) = s - S N t ( s - ) , where 0 5 SO< S1 < Sz < . . . are the successive calendar times of event occurrences, with this situation demonstrated in Fig. 5.3 at the second event. Many other forms of €(.) are possible such as that induced by the minimal repair model of Brown and Proschan7 and Block, Borges, and Savits.8 The effect of accumulating event occurrences is contained in the p(.;cr) function, and a simple form for this is p ( k ; c r ) = ak;whereas the covariate effect is encoded in the link function $J(.), which is usually taken to be $J(v) = exp(w). The frailty distribution IT(.; 'and ~ ? 'of ~ the so-called BDMP (Boolean logic Driven Markov Process) approach, recently published.1 6 7 1 7

7.2. Test Case Definition The system to be studied is a hypothetical example of phased mission system, as shown in Fig. 7.1. It consists of two main nonrepairable components A and B, and five switches that are used for protection or reconfiguration functions in different configurations over two consecutive phases as described hereafter:

Fig. 7.1. System structure of the studied test case.

Phase 1 0

0

T1 (the duration of phase 1) is exponentially distributed with a mean value equal to E(T1) = 1 / X 1 = 100 hours. Switches K1, K2, K3, and K4 are normally closed.

92

0

0

0

M . Bouissotl, Y. Dutuit, and S. Maillard

Switch K5 is normally open. Components A and B work in parallel. Their (constant) failure rate is XA = X B = X = 10-4h-1. A failure of A or B is considered as a short-circuit between the input and output of the component. Possible reconfigurations: - In case of failure of one component, some switches (K2 and K 4 on a

failure of A, K 1 and K 3 on a failure of B) must be opened, in order to avoid short circuit of the system, with a probability of failure on demand equal to y = 5.10-3. - Inadvertent opening of switches can also occur, with a failure rate xs = x = 1 0 - ~ h - l . Phase 2 T2 (the duration of phase 2) is exponentially distributed with a mean value equal to E(T2) = 1 / X 2 = 50 hours. At the beginning of phase 2, the positions of some switches are changed to enable the two active components to work in series. More precisely: in the nominal procedure, K 1 and K4 are open, then K5 is closed ( o p erations must be done in this order to avoid creating a short circuit). But some alterations due to unwanted opening of K 1 or K4 during phase 1 may occur. If component A or B has failed during phase 1, the system cannot be used on the second phase.

Note that the reconfiguration of the system (change of structure from parallel to series) is scheduled by an independent process. Comments on the test case : 0

This test case may seem simple at first sight, because it involves only 7 components. However the number of elementary failure modes to be taken into account is 12, including 5 failures on demand, which can happen at various times, depending on the system evolution. What makes this example really tricky is the omnipresent dependencies between components, and between the system behaviors in the two phases. For example, in Phase 1, if A fails, K2 and K4 are supposed to open. If at least one of the switches opens, the system can still work until the end of Phase 1, but if both refuse to open, the system is lost at once. If K4 opens inadvertently during Phase 1 it cannot refuse to open during the reconfiguration at phase change. A real system would involve many more components, but its reconfiguration would probably be simpler than the one we are studying in the present test case.

Reliability Analysis of a Dynamic Phased Mission System

0

93

Another criticism that this test case could suffer from is the fact that all distributions are exponential. This assumption is very common about the times to failures of components, but what may seem strange is the fact that the phases durations are exponentially distributed. We have deliberately chosen this assumption in order to be able to use the FIGSEQ tool (which works only on Markov models) and to show the advantages brought by the original method implemented in this tool. The other solving method we used, i.e. Monte-Carlo simulation would have worked as well with any other distributions.

7.3. Test Case Resolution

7.3.1. Resolution with a Petri net To model in a concise way the behavior of the system during its phased mission, by using the P N formalism, a system-based approach has been chosen instead of the usual component-based approach. The symmetrical configuration of the system has been exploited (symmetrical structure and same characteristics of the switches and components) and an aggregation procedure has been carried out to obtain the P N shown in Fig. 7.2. Two main subnets make it up. The first one (on the right side) models both all the possible states (aggregated states) in which the system could be during its first mission phase (places 1to 10 representing these lumped states) and the transitions between them. I t was obtained by transposing a Markov chain model of the system in this first phase. The second subnet (on the left side) consists in two parts: one to model the behavior of the system during its second mission phase (places P14 for success and place P15 for system failure), and the other is used to manage the phase sequence (places P11 and P12 for the phase 1 and phase 2, and place P13 signifying the end of the whole mission time). A link like 0‘ inhibits the transition it is tied to whenever the origin place contains tokens. The rate of each transition is explicitly written on the figure. Some transitions are marked with special signs: ?M notifies that the transition needs the Boolean variable M to be in state TRUE to be fired. This variable is initially set to TRUE and when the transition between P12 and P13 is fired (i.e. at the end of Phase 2), it changes to FALSE. Therefore, the meaning of the variable M is ‘(missionis in progress.” To make the P N of Fig. 7.2 more understandable, each place of the right subnet corresponds to a state of a Markov graph, which is explicitly defined hereafter:

M. Bouissou, Y. Dutuit, and S. Maillard

94

0

0

0

0

0

0

0

0

Place 10 corresponds to the initial state of the system, i.e. A and B are working and all Ki except K5 are closed. Place 1: one of the components A and B has just failed. This state is instantaneous, because some switches are required to open. Place 4: A (resp. B) is failed and at least one of its associated switches K2 and K4 (resp. K1 and K3) has opened on demand (probability (1- Y2N. Place 2: only one of the switches K1 and K4 has inadvertently opened. This place corresponds to a degraded functioning state of the system. Its whole mission can still be performed. Place 3: only one of the switches K2 and K3 has inadvertently opened. This failure does not prevent success of phase 1, but it will induce the failure of both phase 2 and the whole mission. Place 5: A (resp. B) is still working and (K1 and K3) (resp. K2 and K4) opened inadvertently. From the initial state, the state corresponding to place 2 can be reached via place 3 or via place 2. The consequences with regards to the mission are the same as for place 3. Place 6 is reached from place 2 because of a failure of either A or B. The reaction of the corresponding switch K2 (resp. K3) does not play any role for the remainder of the mission. Place 8 is reached from place 3 because of a failure of either A or B. The reaction of the corresponding switch K 4 (resp. K1) has no impact on the remainder of the mission. Place 7 is reached from place 5 because of a failure of either A or B. The states of all other components remain unchanged in this transition. Place 9 corresponds to the system failure during Phase 1. It is an absorbing state. It can be reached from each of the places 2, 3, 4, 5, 6, 7 and 8 because of the failure of one of the 3 components of the remaining operating path (A-K2-K4 or Kl-K3-B). This is why the corresponding failure rate equals to 3X. Place 9 can also be reached from the initial state (place lo), after only one timed transition, via one of the two following sequences: (A fails and both K2 and K4 refuse to open) or (B fails and both K1 and K3 refuse to open).

A qualitative analysis of the P N enables us to identify the sequences of component failures which result in the failure of each phase. This step-bystep procedure can be done manually with the interactive simulator of KB3 or by using the FIGSEQ tool.is7i9720~21

Reliability Analysis of a Dynamic Phased Massaon System

95

96


7.3.2. Resolution with a BDMP

The second resolution was done with the BDMP formalism. The bulk of the BDMP depicted in Fig. 7.4 (directly copied and pasted from the KB3 too119>20921) is self-explanatory. The advantage of this formalism is that it looks like fault-trees. It has the same ability to progressively breakdown a global event into more elementary events, in a top-down approach. Because of the lack of space, we cannot give all the formal definition of BDMP; it is available in Refs. 16 and 17. Instead, we are going to show on a very simple example how a BDMP with 3 leaves can specify a Markov model with 16 states representing a system with a standby redundancy. Let us suppose we wish to model a system with the structure given in Fig. 7.3 (left). The second line of the system is a standby redundancy. Therefore, when C1 works, C2 and C3 can only be in a standby or failed state, whereas when C1 is failed, C2 and C3 can only be in a working or failed state (this explains the 16 states of the Markov model). This behavior is precisely specified by the BDMP of Fig. 7.3 (right).

Fig. 7.3. A simple system with a standby redundancy and a BDMP modeling it.

For a better readability of Fig. 7.4, let us now introduce the meaning of the unusual symbols of this model in a few simple words. First of all, symbols such as and simply represent a split link: the names of the origin and target of the link are below the symbols. Split links are here just to avoid some disgraceful crossings of links in the drawing. Secondly, red dotted arrows represent the ”triggers” of the BDMP; their role is to transform what seems to be a standard fault-tree into a fully dynamic model. As long as the event at the origin of a trigger is FALSE, the trigger maintains all the elements in the subtree under its target in a “nonrequired”

0 ‘

*

97


KI

mode. In this mode, the leaves representing failures in function: cannot change from state FALSE to state TRUE. Besides the failures of A and B, the inadvertent openings are represented by such leaves (with names beginning with 10- ).

El

The leaves representing on-demand failures: react to a mode change. When their mode changes from “not required” to “required,” they instantaneously can become TRUE with a given probability. All on-demand failures of the system are represented in this way, with names beginning with ROfor ”refuse to open” and RC- for LLrefuse to close.” When a mode change occurs at the same time for several components of that kind, it is possible to specify constraints on the order in which their reaction must be taken into account. This is done with grey dotted links. Two of these links specify that the outcome of the opening demands on K1 and K4 must be determined before the attempt to close K5. The last symbol we must explain is the phase indicator leaf, represented with a clock. The behavior of this leaf is as follows: if no trigger points at it (like for phase- l), it is initialized in the TRUE state and becomes FALSE after an exponentially distributed time. If a trigger points at it (like for p h a ~ e - 2 ) it ~ is initialized in the FALSE state and when the origin of the trigger changes from the TRUE to the FALSE state, the leaf instantaneously becomes TRUE. It goes back to the FALSE state after an exponentially distributed time. This kind of behavior makes it easy to link an arbitrary number of phases. It is even possible to define a cyclic chain of phases; this is consistent with the general theory of BDMP. 7.3.3. Compared results

By animating the P N model by means of a Monte-Carlo simulation technique, one can obtain interesting quantitative information such as the success probability of each phase, the mean of the time of the first system failure, the mean sojourn time of the system in its different states, etc. The obtained result for the probability of mission success was p = 0.92396 after 40s of calculation (time needed to perform lo7 trials) using the software MOCA-RP,I4 and p = 0.92402 after about 4 min with YAMS (for lo7 trials). YAMS22is a Monte-Carlo simulator able to process any model written in the FIGARO modeling language, and therefore, any model built with KB3. The mission success corresponds to the fact that the place P14, see Fig. 7.2, contains one token at the end of the trial (simulated duration

98



99

of each trial: 3000 hours; this time is large enough to ensure that the end of the whole mission is reached in each trial). We have also solved the PN with the tool FIGSEQ, which is based on sequence exploration and quantification of the Markov graph specified by the PN. FIGSEQ uses an analytical quantification of sequences leading to a specified set of state^,^^^^^ and is able to process any markovian model written in the FIGARO language. FIGSEQ instantly solved the model and gave the following result for the probability of mission success: p = 0.92394. We do not report the sequences output by FIGSEQ in this article, because the aggregation of the states prevents them from being legible. We solved the second model (the BDMP) with the two evaluation tools FIGSEQ and YAMS (MOCA-RP is dedicated to PNs and cannot be used to solve a BDMP). The Monte Carlo simulation gave in 6 min for lo7 trials of 3000 hours a probability of success p = 0.92380. The BDMP was solved instantly with FIGSEQ. This solution yielded p = 0.92392 as the probability of mission success, and two sets of sequences sorted by decreasing probability: one for the sequences leading to loss of mission and the other leading to success. The results tables in the appendix are directly those created by FIGSEQ. They display the list of transitions for each sequence, with their own rate and class (EXP for exponential distribution, INS for instantaneous), the probability of the sequence at mission time 3000 hours (Proba MT), the average duration after initiator (Aver. Dur. After init) and the Contribution to the probability of the whole event. The contributions of the 12 first sequences decrease from 11.9% to 5.96% of the mission failure probability; subsequent sequences have much lower contributions (45 sequences). The 12 first sequences are listed in Table 7.3. We could also obtain the three only success sequences, corresponding to the nonoccurrence of the top event (UE-1) and the end of phase 2 (see Table 7.2). The cross results are summed up in Table 7.1. Note that the MonteCarlo simulations results are given with a confidence interval of 1.6410-4 and are therefore consistent with the analytical results given by FIGSEQ. The FIGSEQ results are exact because the sequences have been exhaustively explored and quantified in both models. The differenceof 210W5 between the results obtained with FIGSEQ from the P N and the BDMP is due to subtle differences between the behaviors d e picted by the two models. Here is the main one: the BDMP allows switches K1 and K4 to open inadvertently in phase 1 and then to refuse to open at the phase change. In fact these failure modes are mutually exclusive. The BDMP formalism has now been extended with the notion of “inverted trig-

M. Bouissou, Y.Dutuit, and S. Maillard

100

Table 7.1. Cross results of the different models.

MODEL PN BDMP

I Processing Tools I

I

CPU Time I Pr(success) MOCA-RP (MC) I 40s. lo7 trials I 0.92396 YAMS (MC) 3min549, lo7 trials 0.92402 FIGSEQ c 1s 0.92394 FIGSEQ c 1s 0.92392 YAMS Gmin, lo7 trials 0.92380

ger” in order to cope with this kind of modeling problem, but it would be too long to explain this extension here, and it will be done in a forthcoming publication. 7.4. Conclusions

The results obtained with quite different methods are practically the same, which constitutes a good cross validation. Since both models are Markovian, any solving method valid for Markov processes could have been used to solve the two models. Therefore, the only significant difference between the two approaches resides in the model construction. Whereas the BDMP construction has been straightforward and produced a self-explaining, easy-to-validate model, the P N required in this case some further work to result in a concise graphical representation. The size of the P N could be limited thanks to a careful exploitation of all the symmetries of the system (structure of the installation and features of components). However, if we had to model a system with the same behavior, but made of components having all different characteristics, the P N size would obviously increase, while the BDMP would remain exactly the same. The same remark would apply if we wanted to introduce repairs. But the most spectacular advantage of the BDMP formalism is probably the following: thanks to its hierarchical structure, all we would have to do in order to replace the simple components A and B by subsystems would be to replace the leaves FailureOfA and FailureOfl3 of the BDMP of Fig. 7.4 by sub-BDMP. For example, if A and B were subsystems with the characteristics of the system of Fig. 7.3 (left) the replacement of the leaves FailureOfA and FailureOfEi by two BDMP like the one of Fig. 7.3 (right) would solve the problem. Whereas we would of course have to rebuild the PN from scratch, and it would be a hard work. Another interesting result of this study is the illustration of the interest of the sequence exploration and quantification method used by FIGSEQ, which allows a quick and precise quantification of a large Markov model and


101

gives interesting qualitative results: the most probable sequences leading to the mission failure. Table 7.2. Sequences leading to mission success. Transition Name [end OF phase- 11 [start OF phase-21 [OK OF RO-K1, OK O F RO-K4] [OK OF RC-K5] [end OF phase-21 [Fail. O F IO-K4] [end O F phase- 11 [start OF phase-21 [OK O F RO-K1, OK OF RO-K4] [OK OF RC-KS] [end O F phase-21 [Fail. OF 10-K11 jend OF phase-i] [start OF phase-21 [OK O F RO-K1, OK OF RO-K4] [OK OF RC-K5] [end O F phase-21

Proba MT

Aver. Dur. After init.

Contribution

9.0665e-01

4.8780e+01

9.8131e-01

8.6348e-03

1.4402e+02

9.3458e-03

8.6348e-03

1.4402e+02

9.3458e-03

Table 7.3. Sequences leading to loss of mission.

end O F phase- 1

end O F phase-1

102

M. Bouissou, Y. Dutuit, and S. Maillad Transition Name [start OF phase-21 [Fail O F RO-K1, OK O F RO-K4] [end O F phase- 11 [start O F phase- 21 [OK OF RO-K1, Fail OF RO-K4) [end O F phase- 11 [start O F phase-21 [OK OF RO-K1, OK OF RO-K4] [Fail O F RC-K5] [end O F phase- 11 [start O F phase- 21 [OK OF RO-K1, OK O F RO-K4] [OK OF RC-K5] [Fail O F FailureOfB] [end O F phase- 11 [start O F phase-21 [OK O F RO-K1, OK O F RO-K4] [OK OF RC-K5] [Fail O F IO-K2] [end OF phase- 11 [start O F phase- 21 [OK O F RO-K1, OK O F RO-K4] [OK O F RC-K5] [Fail O F IO-K5] [end O F phase- 11 [start O F phase-21 [OK OF RO-K1, OK OF RO-K4] [OK OF RC-K5] [Fail OF FailureOfA] [end OF phase- I] [start OF phase-21 [OK O F RO-K1, OK O F RO-K4] [OK OF RC-K5] fFail O F IO-K31

Proba M T

Aver. Dur. After init.

Contribution

4.6934e-03

0.000e+000

6.1712e-02

4.6934e-03

0.000e+000

6.1712e-02

4.6699e-03

0.0000e+00

6.1403e-02

4.5332e-03

4.8780e+01

5.9606e-02

4.5332e-03

4.8780e+01

5.9606e-02

4.5332e-03

4.8780e+01

5.9606e-02

4.5332e-03

4.8780e+01

5.9606e-02

4.5332e-03

4.8780et01

5.9606e-02


103

References

1. M. Alam and U. M. Al-Saggaf, Quantitative Reliability Evaluation of Repairable Phased-Mission Systems Using Markov Approach, IEEE Tmnsactions on Reliability, Vol. R-35 (5), 498-503 (Dec. 1986). 2. G. R. Burdick, J. B. Fussell, D. M. Rasmusson, and J. R. Wilson, Phased Mission Analysis, a Review of New Developments and an Application, IEEE Tbnsactions on Reliability, Vol. 26 ( l ) , 43-49 (1977). 3. J. B. Dugan, Automated Analysis of Phased Mission Reliability, IEEE Transactions on Reliability, Vol. 40, 45-52 (1991). 4. A. Pedar and V. V. S. Sarma, Phased-Mission Analysis for Evaluating the

5.

6.

7. 8.

9.

10.

11.

12. 13.

14.

15.

16.

Effectiveness of Aerospace Computing-Systems, IEEE Transactions on Reliability, Vol. R-30 (5), 429-437 (Dec. 1981). J. K. Vaurio, Fault tree analysis of phased mission systems with repairable and non-repairable components, Reliability Engineering and System Safety, Vol. 74, 169-180 (2001). A. Bondavalli, S. Chiaradonna, F. Di Giandomenico and I. Mura, Dependability modeling and evaluation of multiple-phased systems using DEEM, IEEE Dansactions on Reliability 53(4), 509-522 (2004). V. Volovoi, “Modeling of system reliability Petri nets with aging tokens,” Reliability Engineering and System Safety, Vol. 84 (2), 149-161 (May 2004). A. Bondavalli, I. Mura, and M. Nelli, Analytical Modeling and Evaluation of Phased-Mission Systems for Space Applications, Proceedings of IEEE High Assurance System Engineering Workshop (HASE) (1997). A. K. Somani, Simplified Phased-Mission System Analysis for Systems with Independent Component Repairs, Proceedings of ACM SIGMETRICS ( 1996). L. Xing, Reliability and sensitivity analysis of static phased mission systems with imperfect coverage, M.S. Thesis, Electrical Engineering, University of Virginia (January 2000). L. Xing and J. B. Dugan, Analysis of generalized phased mission system reliability, performance and sensitivity, IEEE Transactions on Reliability, Vol. 51 (2), 199-211 (June 2002). J. D. Esary and H. Ziehms, Reliability analysis of phased missions, in Reliability and Fault Free Analysis, p. 213-236, SIAM Philadelphia (1975). A. Bondavalli and I. Mura, Markov Regenerative Stochastic Petri Nets t o Model and Evaluate Phased Mission Systems Dependability, IEEE narisactions on Computers, Vol. 50 (12) (December 2001). Y. Dutuit, E. Chatelet, P. Thomas, and J. P. Signoret, Dependability Modelling and Evaluation by Using Stochastic Petri Nets: Application to Two Test-Cases, Reliability Engineering and System Safety 55 (2), 117-124 (1997). D. C. Ionescu, E. Zio, and A. Contantinescu, Availability Analysis of a Safety System of a Nuclear Reactor, Proceedings of KONBIN’03 Conference, Vol. 2, p. 225-233 (2003). J. L. Bon and M. Bouissou, A new formalism that combines advantages

104

17.

18.

19.

20. 21.

22.

23.

24.

M. Bouissou, Y.Dutuit, and S. Mailland

of fault trees and Markov models: Boolean logic Driven Markov Processes, Reliability Engineering and S y s t e m Safety, Vol. 82 (2), 149-163 (November 2003). M. Bouissou, Boolean logic Driven Markov Processes: a powerful new formalism for specifying and solving very large Markov models, PSAM6, Puerto Rico (June 2002). M. Bouissou, H. Bouhadana, M. Bannelier, and N. Villatte, Knowledge modeling and reliability processing: presentation of the FIGARO language and associated tools, Proceedings of SAFECOMP’91, Trondheim (Norway) (November 1991). M. Gallois and M. Pilliitre, Benefits expected from automatic studies with KB3 in PSAs at EDF, Proceedings of the PSA99 conference, Washington (August 1999). The KB3 and FIGSEQ tools: detailed information, software download at http://rdsoft.edf.fr. M. Bouissou, S. Humbert, S. Muffat, and N. Villatte, KB3 tool: Feedback on knowledge bases, Proceedings of Lambda Mu 13 / ESREL 2002, European Conference, Lyon (France), p. 754759 (March 2002). M. Bouissou, H. Chraibi, and S. Muffat, Utilisation de la Simulation de Monte-Carlo pour la rksolution d’un benchmark (MINIPLANT), 148me congrb de fiabilith et maintenabilitk, Bourges, France (October 2004). J. L. Bon and M. Bouissou, Fiabilitk des grands systbmes skquentiels: rksultats thkoriques et applications dans le cadre d u logiciel GSI, Revue de Statistique applique‘e XXXX (2), p. 45-54 (1992). M. Bouissou and Y. Lefebvre, A path-based algorithm t o evaluate asymptotic unavailability for large Markov models, Annual Reliability and Maintainability Symposium Proceedings, Seattle (2002).

CHAPTER 8 SENSITIVITY ANALYSIS OF ACCELERATED LIFE TESTS WITH COMPETING FAILURE MODES

CORNEL BUNEA School of Engineering and Applied Science George Washington University 1776 G ST N W Washington, DC 20052 USA E-mail: [email protected]

THOMAS A. MAZZUCHI School of Engineering and Applied Science George Washington University 1776 G ST N W Washington, DC 20052 USA E-mail: [email protected] Most of the Accelerated Life Tests (ALT) ignore the possibility of competing modes of failure. The literature that attempts to address this problem often does so by assuming independence among the competing failure modes. Rather, the failure modes often display a highly dependent structure, which is usually influenced by the applied stress. The dependent ALT-competing risks models available are based on multivariate distributions with specified marginals. However, multivariate exponential and Weibull distributions-dominant in literature-have properties not suited for all applications. This paper investigates the applicability of the existent models on a couple of data sets, and presents a new ALT model with dependent competing failure modes. The dependence structure is modeled by a copula given the rank correlation. The effects of the dependence degree of the competing failure modes are also studied.

105

106

C. Bunea and

T.A . Mazzuchi

8.1. Introduction

Accelerated life tests are applied on long-life components in order to obtain failure data in a reasonable time interval and are performed at higher stress levels that exceed the normal use conditions. The goal is to make inference about the life distribution of the component under use conditions using failure data obtained under more severe environment. To be valid, an accelerated life test must not alter the basic modes and/or mechanism of failure or their relative prevalence. In real experiments all these problems may occur if the stresses become too high. Many authors took into account the change in failure mechanism and proposed distributional or Bayesian models that allow all data t o be taken into account. However, when more failure modes are present, their relative prevalence as the stress increases has not yet been considered, even if this is indicated by accelerated life data. Multiple failure modes or competing failure modes are often present in industrial accelerated life experiments. Classical and Bayesian models available in the literature usually assume independent failure modes. Little work has been done for dependent competing failure modes, and it resumes to multivariate models with positively correlated lives of failure modes, or to upper and lower bounds for the component life distribution. All these models do not take into account the change in the relative prevalence of the failure modes and the change in the dependence structure as the stress increases. The purpose of this paper is to study the influence of the dependence structure of competing failure modes, as their relative dominance changes with the increase of the applied stress. This is obtained by integrating the results of competing risk theory into the ALT procedure, and by using graphical technics in model selection. Since the mottorets data (Nelson') presents a strong change of the relative prevalence of competing failure modes, it will be used as a support application throughout the paper. Section 8.2 presents several step-stress ALT models, with independent and dependent competing failure modes. Empirical distribution functions based on competing risk data are used in Sec. 8.3 to illustrate the change of the relative dominance of the competing failure modes and to select the appropriate model to interpret ALT data. An ALT model with dependent failure modes is presented in Sec. 8.4. The dependence structure is modeled by a copula given the rank correlation coefficient for each stress level. The impact of the independence assumption on the estimated life time of the

Analysis of Accelerated Life Tests with Competing Failure Modes

107

component under use conditions is studied as well.

8.2. ALT and Competing Risks We consider a m-constant stress level ALT. At each stress level 1, 1 = 1,.. . m, a number of items are tested until a failure or a censored time occur. The failure is assumed to occur due to k competing failure modes, X I ,X 2 , . . . xk. In a competing risks context, we observe the shortest of X i , i = 1 , . . . k, and observe which failure mode it is. In many cases we can reduce the problem to the analysis of two competing risks classes, described by two random variables X1 and X2, and we call X2 the censoring variable. Competing risk data will only allow us to estimate the subsurvival functions,

S $ , ( t ) = PT(X1 > t , X 1 < X 2 } , and

s;,(t)= PT(X2 > t , x2 < X l } , but not the true survival functions of X1 and X2. Hence, we are not able to estimate the underlying failure distributions without making additional, nontestable, model assumptions. The conditional subsurvival function is the subsurvival function, conditioned on the event that the failure mode in question is manifested. Assuming continuity of S21 and S;2 at zero:

< X2} = s;l (t)/S;l (O), CS>,(t) = PT(X2 > t , x 2 < XlIX2 < X , } = S;,(t)/S;,(O).

cs;, ( t )= PT(X1 > t ,x1 < X2lXl

Closely related to the notion of the subsurvival functions is the probability of censoring beyond time t ,

This function seems to have some diagnostic value, enabling us to choose the competing risk model which fits the data. 8.2.1. ALT and independent competing risks

The presence of independent competing risks in ALT has been widely studied in the literature. McCoo12 presented a technique for calculating estimate intervals for Weibull parameters of a primary failure mode when a secondary failure mode having the same (but unknown) Weibull shape parameter is

108

C. Bunen and T.A . Mazzuchi

acting. Klein and Basu3,4 presented the analysis of ALT when more than one failure mode is acting. Assuming independence among competing failure modes for each stress level, the authors obtained maximum likelihood estimators when the lifetimes are exponentially or Weibull-with common or different shape parameter-distributed. Nelson' presented graphical and analytical (maximum likelihood) methods to analyze data on a failure mode, to estimate a product life distribution when failure modes act, and to estimate a product life distribution with certain failure modes eliminated. Nelson indicated that complete data sets are usually analyzed with standard least-squares regression analysis. Such analysis may be misleading for data with competing failure modes. The analysis should consist in a separate Arrhenius model for each failure mode and a series-system model for the relationship between the failure times of each failure mode and the failure time of the component. Examples of products which have multiple causes of failure are given, including insulation systems, ball bearings and industrial heaters. A large sample data is considered by Nelson' (pg. 393) and is collected from a temperature-accelerated life test of motor insulation (the Turn, Phase, or Ground insulation can fail). The experiment was conducted to observe a greater number of failures for each failure mode. When the specimen fails by a specific failure mode, that insulation is isolated and the motorette is kept on test and runs to a second or third failure. In actual use, the first failure from any cause ends the life of the motor. This fact conducts to a pseudo-competing risk data. Nelson analysis of motorettes data consists in a separate Arrheniuslognormal model for each failure mode, and a competing risk (series system) model for the relationship between the failure times of different failure modes and the failure time of a specimen. The assumptions made in the Arrhenius-lognormal model are: - for temperature T, life has a lognormal distribution - the log standerd deviation c k is constant - the mean log life as a function of z = 1000/T is pk(z) = a k

+ pkz,

where Q k , p k and c k are the parameters characteristic for the failure mode k, product and test method. For units run at stress 1 the probability that failure mode k survives time t is: Rk(t) = @{-[log(t) - p k ( x ) I / c k ) .

The competing risk model assumes that each unit has k competing fail-

Analysis of Accelerated Lzfe Tests with Competing Failure Modes

109

ure modes, which concur to terminate the service life of the component. The k competing risks (times to failure) are considered statistically independent. Graphical analysis of data with multiple failure modes involves the usual two plots for each failure mode: a hazard plot of the multiple censored data and a relationship plot (relationship between estimated life of a failure and temperature/stress). Figure 8.la shows the hazard plot of the Turn data, and Fig. 8.lb shows the Arrhenius plot of median times to (Turn) failure against test temperature. A straight line fitted to the medians estimates the Arrhenius relationship of Turn failures.

I

101

10

r*.

Fig. 8.1. Graphical analysis of Turn failures: (a) lognormal hazard plot and ( b ) Arrhenius plot of median times to failure.

8.2.2. ALT and dependent competing risks

Simple empirical upper and lower bounds of the system life distribution can be found when the lives of competing failure modes are positively correlated. The lower limit corresponds to the most pessimistic case, when independent failure modes are considered. The upper limit is the lowest life distribution for a single failure mode. These bounds may give some insights with respect to the true distributional form, especially when these bounds are translated to time-average failure rate bounds. Other technics in dealing with dependent failure modes in ALT are based

110

C. Bunea and T.A . Mazzuchi

on multivariate distributions. The multivariate log-normal distribution used by Nadas5 has satisfactory properties. However, multivariate exponential and Weibull distributions-dominant in literature-have properties not suited for all applications. Klein and Basu4 proposed a bivariate Weibull distribution as the joint survival function of two competing risks both Weibull distributed with same shape parameter a. They considered two competing risks XI and X2, both Weibull distributed with shape parameter a and scale parameter Xi(T,Pi) X12(T, P12), i = 1 , 2 , at each temperature (stress) level T (01, 02, ,812 are time transformation parameters). The joint survival function of (XI, X2)is given by

+

S(z1, z2) = exp(-Xl(T, P1)z: - X2(T, 02)~:- X12(T, P12) max(z1, z d a ) . To estimate the parameters of X1 and Xp at use conditions, classical methodology of ALT is applied. They illustrated this procedure on the motorette data. However, as it will be shown in Sec. 8.3, simple plots of data will reject the applicability of exponential and Weibull multivariate models to this specific data set. More elaborate dependent competing risks models based on the use of copula have been presented by Hougaard' and Bunea and B e d f ~ r dThese .~ models will be discussed in Sec. 8.4. 8.3. Graphical Analysis of Motorettes Data Cooke' presented several independent and dependent competing risks models. These models have been further investigated by Bedford and Cooke: Langseth and Lindqvist,lo Bunea et al.ll Nevertheless, the choice of the most appropriate model to fit the competing risk data remains an open debate. All the above authors gave some guidelines for model selection. An important indicator for model selection is the probability of censoring after time t , @(t),together with the conditional subsurvival functions CS;, ( t ) and CS;2 ( t )(see Bunea et a1.l') Note, that empirical version of these functions can be directly obtained from a competing risk data set. The model selection guidelines for the most well-known competing risk models-independent exponential model, random signs model, conditional independence model, mixture of exponentials model-are:

If the risks are exponential and independent, then the conditional subsurvival functions are equal and correspond to exponential distributions. Moreover, @(t)is constant.


0

0

Under random signs censoring, @ ( O ) for all t > 0.

111

> @ ( t )and CS;,(t) > CS;,(t)

If the conditional independence model holds with exponential marginals, then the conditional subsurvival functions are equal and @(t)is constant.

0

If the mixture of exponentials model holds, then @(t)is strictly increasing and CS;* ( t )5 CS;, ( t ) for all t > 0.

In addition to the above statements, one can easily show that Klein and Basu’s model requires equal conditional subsurvival function. Simple calculations give the subsurvival and conditional subsurvival functions: s;l(t)= x lx++Al x z ~ exp(-(h ~lz + A2 + X12)t), SG2(t)= 0

x 1A+ 2+Ax z ~ ~ 1 exp(-(h 2 + A2 + X12)t),

CS;(l ( t )= CS;, ( t ) = exp(-(X1

+ A2 + X12)t).

Note that the conditional subsurvival function should be equal at each stress level in order to have a valid ALT-competing risks model. Figure 8.2 shows the empirical conditional subsurvival functions for motorettes data, with failure modes grouped in two competing risk classes: risk 1 - turn failure modes, risk 2 - phase and ground failure modes. One can see a strong change in the failure mechanism as the stress level increases. At the first stress level the dominant failure mode is risk 2, with its conditional subsurvival function laying entirely above the conditional subsurvival function of risk 1. A random signs model may be appropriate for this case (risk 1 being censored). The conditional subsurvival functions are more or less equal for stress level 2 and 3, indicating that an independent exponential model may apply. Data obtained from stress level 4 indicates a dominant conditional subsurvival functions for risk 1, thus a random signs model may be selected (risk 2 being censored). The change in relative prevalence of the failure modes do not allow a classical ALT-competing risk model to analyze data. Since the conditional subsurvival function are not equal for each stress level, the assumption of independent exponential or Weibull with same shape parameter failure modes is clearly rejected by motor insulation data. Based on model selection criteria presented at the beginning of this section, the random signs model and the multivariate exponential (or Weibull with same shape parameter model) are also rejected. Next section will present a more complex dependent model and will investigate the influence of the degree of dependence on the estimated distribution functions at use conditions.

112

C. Bunea and T.A . Mazzucha

Fig. 8.2. Empirical conditional subsurvival functions for motorettes data, at each temperature (stress) level.

8.4. A Copula Dependent ALT

- Competing Risk Model

8.4.1. Competing risks and copula

We assume that the dependence structure between X I and Xp is given by a copula. The copula of two random variables X1 and Xp with distribution functions Fx,(X1)and Fx,(Xp), is the distribution C on the (XI), Fx,(Xp)). The functional form of unit square [0,112 of the pair (Fxl C : [0,112 4 R is C(u,v) = H(Fi:(u), Fi:(v)),where H is the joint distribution function of (X1,Xp) and Fj: and FG: are the right-continuous inverses of Fxland Fxz. Under the assumption of independence of X1 and X2,the marginal distribution functions of X I and X2 are uniquely determined by data. Zheng and Klein12 showed the more general result that, if the copula of (XI, X2)is known, then the marginal distributions functions of X1 and Xp are uniquely determined by the competing risk data. More precisely, the marginal distributions functions Fx, and FxZ are solutions of the following system of ordinary differential equations:


113

with initial conditions Fx1(O)= Fx2(0)= 0, where CU(Fxl(t), Fx2(t)) and C,(Fx,( t ) Fx2 , ( t ) )denote the first order partial derivatives &C(u, w ) and $C(u, w) calculated in (Fxl( t ) ,Fx2(t)). ( t ) and F;, ( t ) are the subdistribution functions of X1 and Xp (see Bunea and Bedford7). 8.4.2. Measures of association

We now discuss the problem of choosing a copula. There are many measures of association for the pair ( X , Y ) , which are symmetric in X and Y . The best known measures of association are Kendall’s tau and Spearman’s rho. Kendall’s tau for a vector ( X ,Y ) of continuous random variables with joint distribution function H is defined as follows: let ( X I ,Yl)and ( X z ,Y2) be i.i.d. random vectors, each with joint distribution H , then Kendall’s tau is defined as the probability of concordance minus the probability of discordance:

T ( X , Y )= P T ( ( x 1 - x2)(Y1- &) > 0) - PT((x1- xp)(fi - &) < 0). The other measure of association (Spearman’s rho) is defined as follows: let X and Y be continuous random variables then the Spearman’s rho is defined as the product moment correlation of F x ( X ) and F y ( Y ) :

Simple formulae relating the measures of association to copula density are:

- 3.

Since the measure of association is to be treated as a primary parameter, it is necessary to choose a family of copulae which model all possible measures of association in a simple way. Meeuwissen and Bedford13 proposed to use the unique copula with the given Spearman’s rho that has minimum information with respect to the independent distribution, and also they gave a method to calculate numerical this copula. Prior knowledge or subjective information to obtain values for the measure of association is needed. Expert judgment is used to model the uncertainty over the measure of association (see Bunea and Bedford7).

114

C. Bunea and T . A . Mazzuchi

Work of Zheng and Klein" suggests that the important factor for an estimate of the marginal survival function is a reasonable guess at the strength of the association between competing risks and not the functional form of the copula. For this reason we will choose a class of copula which it is easy t o work with from the mathematical point of view. Such a class is the Archimedean copula. 8.4.3. Archimedean copula

Let X1 and X2 be continuous random variables with joint distribution H and marginal distribution F x l and FxZ.The Archimedean copula is defined as:

'p(H(3AI4)= 'p(FXl(21))+ 'p(FX,(~2)), or in terms of copula

'p(C('IL'v)) = 4 .)+ 'p(v>. The function 'p is called an additive generator of the copula. If 'p(0) = 00, 'p is a strict generator and C ( u ,v) = ~-'(p(u)+'p(v))is a strict Archimedean copula. For our goal we choose a one-parameter family of copulae which has a strict generator. The Gumbel family is defined as follows: Ca(u,v) E exp(-[(-logu)"

+ (-logv)

]

a l/cY

)

for a E [I,00). The generator is the function 'pa(t) = (- logt)a. Using the relation between Kendall's tau and copula, we can write a as a function of Kendall's tau, a, = 1/(1- 7 ) . 8.4.4. Application on motor insulation data

Let U1 and U2 be two random variables associated with the conditional subsurvival functions of X1 and X2.The ALT-competing risk model proposed consists of a separate Arrhenius-lognormal model for each random variable U1 and U2,and of a dependence structure of X1 and X2 modeled by a copula, with the rank correlation coefficient given as a primary parameter. The Arrhenius-lognormal model applied to conditional subsurvival functions enables us to find the conditional subsurvival functions at use conditions and to estimate the distributional parameters. Elicitation of the rank correlation coefficient at each stress level and at use conditions using experts opinion allows us t o fully specify the copula. Further, applying Zheng


115

and Klein’s result at each stress level and at use conditions, one can obtain the distribution functions of X1 and X2. Table 8.1 presents the estimated parameters of the lognormal distribution (for U1 and U2) at each stress level and at use conditions. These distributions, together with the values in point zero of the subsurvival functions of X1 and X2, and with the elicitated rank correlation coefficients, constitute input factors in the system of equations presented in Sec. 8.4.1.

Table 8.1. Estimated parameters of the lognormal distribution (for U1 and U2) at each stress level and at use conditions (motorcttes data). 180 190 220 240 260

C C C C C

uU1 1.4061 1.36863 1.2453 1.1540 1.0535

TU1 0.0201 0.0208 0.0236 0.0259 0.0287

I

uU2 1.46601 1.4165 1.2506 1.2243 1.1508

TU2 nu2 0.028 0.0206 0.0321 0.1026 0.1334

Figure 8.3 shows the distribution functions of X1 and X2 at each stress level. One can see a shift to the left of the plots as the stress increases, indicating a shorter time to failure as the stress is higher. Figure 8.4 presents the distribution functions of X1 and X2 at use condition, for different degrees of dependence between failure modes: from independence in the upper-left corner to strong dependence in the lower-right corner. Even if a logarithmic scale is used, one can see the difference that the degree of dependence makes in estimating the true distribution functions at use conditions. A more clear visualization of the above results may be obtained by analyzing the industrial heaters data presented by Nelson’ (pg. 420). This data is collected from a temperature-accelerated life test of industrial heaters, which have two failure modes-open and short. A Bayesian Arrheniusexponential model for random variables U1 and U2 is used (see Bunea and Ma~zuchi’~) and the dependence structure is modeled by an Archimedean copula, given the rank correlation coefficient. Table 8.2 presents the estimated failure rates of U1 and U2 at each stress level and at use condition. Figure 8.5 shows the distribution functions at use conditions of X1 and X , . The sensitivity of the estimated distributions with respect to the degree of dependence is more obvious in this case.

116

C. Bunea and T. A . Mazzuchi

Fig. 8.3. Distribution functions for each failure mode, at each temperature (stress) level (motorettes data). Table 8.2. Estimated failure rates of Ui and Uz at each stress level and at use conditions (industrial heaters data). 1150 F 1600 F 1675 F 1750 F 1820 F

YU1 YU2 4.1075E-04 6.0985E-05 6.528e7-04 6.85953-04 8.0000E-04 7.40483-04 1.0865E-03 1.33333-03 3.9393E-03 4.000E-03

8.5. Conclusions

Several ALT-competing risks models have been studied in this paper. Classical independent and dependent models failed to suit all types of ALT data. Simple plots of experimental data rejected the applicability of such models, especially when the relative dominance of competing failure modes changes as the applied stress increases. A new dependent model based on copula


117

Fig. 8.4. Distribution functions for each failure mode, at use conditions (motorettes data); different degree of dependence are considered.

has been proposed. The results showed a high sensitivity with respect to the degree of dependence between competing failure modes. Thus, the LLindependent failure modes" assumption can conduct to wrong results, when the risks are actually highly correlated. The disadvantage of this method consists in the large number of measures of association that need t o be estimated by experts (one for each stress level and one for use conditions).

References 1. W. Nelson, Accelerated Testing, John Wiley and Sons, New York, USA (1990).

2. J. I. McCool, Competing risk and multiple comparison analysis for bearing fatigue tests, ASLE Transactions 21, 271-284, (1978). 3. J. P. Klein and A. P. Basu, Weibull accelerated life tests when there are competing causes of failure, Communications i n Statistical Methods and Theory, A10,2073-2100 (1981). 4. J. P. Klein and A. P. Basu, Accelerated life testing under competing expo-

118

C. Bun-

and T. A. Mazzucha

Fig. 8.5. Distribution functions for each failure mode, at use conditions (industrial heaters data); different degrees of dependence are considered. nential failure distribution, ZA P Q R Transactions 7, 1-20 (1982). 5. A. Nadas, A graphical procedure for estimating all parameters of a life distribution in the presence of two dependent death mechanisms, each having a lognormally distributed killing time, personal communication (1969). 6. P. Hougaard, Analysis of Multivariate Survival Data, Springer, New York (2000). 7. C. Bunea and T. J. Bedford, The Effect of Model Uncertainty on Maintenance Optimization, ZEEE Ransaction on Reliability 51 (4), 486-493 (December 2002). 8. R. M. Cooke, The design of reliability databases Part I and 11, Reliability Engineering and System Safety 51, 137-146 and 209-223 (1996). 9. T. J. Bedford and R. M. Cooke, Probabilistic Risk Analysis: Foundations and Methods, Cambridge University Press (2001). 10. H. Langseth and B. Lindqvist, A maintenance model for components exposed to several failure mechanisms and imperfect repair, Mathematical and Statistical Methods in Reliability, Series on Quality, Reliability and Engineering Statistics, pp, 415-430, World Scientific (2003). 11. C. Bunea, R. M. Cooke and B. Lindqvist, Competing risk perspective on

Analysis of Accelerated Lzfe Tests with Competing Failure Modes

119

reliability databases, Mathematical and Statistical Methods in Reliability, Series on Quality, Reliability and Engineering Statistics, pp. 355-370, World Scientific (2003). 12. M. Zheng and J. P. Klein, Estimates of marginal survival for dependent competing risks based on an assumed copula, Biometrika 82, 127-138 (1995). 13. A. M. H. Meeuwissen and T. Bedford, Minimally informative distribution with given rank correlation for use in uncertainty analysis, Journal of Statistical Computation and Simulation 57, 143-174 (1997). 14. C. Bunea and T. A. Mazzuchi, Bayesian Accelerated Life Testing under Competing Failure Modes, RAMS Conference Proceedings, Alexandria, USA (January 2005).


CHAPTER 9 ESTIMATING MEAN CUMULATIVE FUNCTIONS FROM TRUNCATED AUTOMOTIVE WARRANTY DATA

S . CHUKOVA School of Mathematics, Statistics and Computer Science, Victoria University of Wellington, New Zealand E-mail: Stefanka. [email protected]

J. ROBINSON General Motors R B D Center Warren, Michigan USA E-mail: jeffrey. a.robinson@gm. com This article deals with a type of truncation that occurs with typical automotive warranties. Warranty coverage and the resulting claims data are limited by mileage as well as age. Age is known for all sold vehicles all the time, but mileage is only observed for a vehicle with a claim and only at the time of the claim. Here we deal with the univariate case, taking either age or mileage as the usage measure. We evaluate the mean cumulative number of claims or cost of claims and its standard error as functions of the usage measure. Within a nonparametric framework, we extend the usual methods in order to account for the fact that the odometer readings are available only for a vehicle with a claim and only at the time of the claim. We illustrate the ideas with real data on four cases based on whether the usage measure is age or miles and whether the results are adjusted for withdrawals from warranty coverage. We also note that these adjustments can be further refined by taking into account the effects of reporting delay.

9.1. Introduction

Data from warranty systems are of interest t o manufacturers for several reasons. Paid claims are a cost of doing business and a liability incurred by the manufacturer at the time of sale. For these reasons forecasting warranty 121

122

S. Chukova and J . Robinson

expenses is of interest. Also, warranty data provide information about the durability of products in the field and, therefore, is of interest t o engineers. Furthermore, warranty coverage can be regarded as a product attribute that affects buying decisions. Manufacturers may wish t o change warranty coverage t o attract more buyers, and they would want to estimate how much the changes would cost. See Robinson and McDonald’ for more discussion on these points. Here we emphasize automotive warranties as they are typically done in the U.S.A. The warranty guarantees free repairs subject to both age and mileage limits. The most common limit is now thirty-six months or thirty-six thousand miles, whichever comes first. Age is known all the time for all sold vehicles because sales records are retained. But odometer readings are only collected in the dealership at the time of a claim. So automotive warranties are a case where two usage measures are of interest and information on one of them is incomplete. Automobiles are repairable systems, and warranty claims can be thought of as recurrent events associated with the system. We take this approach although for a small enough range of warranty labor operations, the likelihood of duplicate claims on the same vehicle is small enough that methods based on lifetimes (time to first warranty claim) may be appropriate. We also prefer a nonparametric approach because sample sizes are large. We wish t o consider two usage measures, one of which is incompletely observed. Finally, we want t o deal explicitly with the fact that the events are coming from a warranty plan with specific restrictions, i.e. repair events that occur outside the limitations of the warranty plan will not be included in the database. Even considering these restrictions there is some relevant past literature. The model and estimation procedure we discuss later is an extension of the “robust estimator” presented by Hu and Lawless.2 Their approach extends the “standard” estimator as reported in Nelson3 to account for, in our case, the probability of a vehicle not being eligible t o generate a warranty claim because it has exceeded its warranty coverage limits. Lawless, Hu and Cao4 also explicitly deal with our censoring problem and specify a simple linear automotive mileage accumulation model, which we use here to estimate the current mileage of a vehicle for which we have a previous odometer reading. They also present a family of semi-parametric models t o relate event times t o mileage accumulation. Lawless5 presents a survey and some extensions including dealing with the bias caused by the reporting delay of warranty claims. This issue was also previously discussed in Lawless and Nadeau‘ and in Kalbfleisch, Lawless and R o b i n ~ o n . ~

Estimating Mean Cumulative Functions

123

A finite sample population correction to the variance estimate is discussed in Robinson.8 In addition to their other work mentioned, Hu and Lawlessg also developed a general framework for handling the type censoring considered here making use of supplementary information. Other relevant methods applicable to warranty are also found in Blischke and Murthy.1° 9.2. The Hu and Lawless Model For the most part we utilize notation from Hu and Lawless’ and adopt the generally reasonable assumption that at the beginning of their lifetime, cars accumulate mileage approximately linearly with their age. Let nz(t)be the number of claims (or cost associated with those claims) at time t for vehicle i. It will be convenient and not restrictive to think of time as discrete, i.e. t = 1 , 2 , .... Let N,(t) be the accumulated number of claims (or cost) up through and including time t for vehicle i. “Time” here will be either age or mileage of the vehicle, not the calendar time. Suppose M such vehicles have been under observation, and their records are part of the warranty database. Sometimes it will be convenient to think of these M vehicles as a sample from a larger population of vehicles, some of which have not yet been sold. Let 7%be the“time” that unit i has been under observation. The exact definition of the 7’s will depend on whether time is age or mileage. We obtain an estimator A(t)of the population mean cumulative function A(t) = EN,(t). For the discrete time case, the incremental rate function is X ( t ) = A ( t ) - A(t - 1) with the initial condition A(0) = 0. Let & ( t )= I(.% 2 t ) be the indicator of whether car i is under observation at time t . Then M

is the total number of claims (or cost) observed at time t for all M vehicles. We note that &(t)may be unknown for some of the cases we discuss later, but the product &(t)ni(t) is always known. If the observation times are independent of the event process, the rate function is estimated by X(t) =

n.(4 MP(t)

~

(!)

where P ( t ) is the probability that a vehicle of age t is eligible to generate a claim. This is the “robust estimator” stated in Hu and Lawless.’ Their

124


P ( t ) is a right-hand tail probability of an age distribution and it is assumed known. We will need to estimate P ( t ) . It will be more convenient to think in terms of M ( t ) = M P ( t ) , the expected number of vehicles eligible to generate a claim at time t. Denote its generic estimator by k ( t )= M p(t).Then we replace (1)by (2)

The associated mean cumulative function estimator is t

(3)

Under mild conditions, Hu and Lawless2show asymptotic normality of A(t) (assuming known M ( t ) )with a standard error given by the square root of (4)

We will compute &(t) from the warranty data itself and substitute this estimate into (4) to obtain our standard errors. For the general cases considered next the ri’s are also unknown and estimated from the data, although it will not always be necessary to write down the estimators explicitly. 9.3. Extensions of the Model 9.3.1. rrTime”is age case

First, we consider “time” to be the age of the vehicle. If we ignore withdrawals from coverage due to mileage, then the number of vehicles eligible to generate a claim at age t is simply the number of vehicles age t or older, i.e., M i= 1

where ai = ri is the age of vehicle i. This estimator correctly characterizes how warranty claim rates and costs actually accrue as a function of age, and it may be useful for prediction. However, it is influenced by two factors. The first one is the inherent claim rate as a function of age. The second one is the rate of accumulation of mileage because this affects how long vehicles remain in warranty coverage. To illustrate the point, suppose hypothetically that warranty claims occur


125

due to age and not miles, and suppose that drivers begin to drive more. The inherent reliability of the population of vehicles would not change, but the warranty claim rate would go down because more vehicles would drop out of coverage sooner due to the mileage limit. To get at this “true” warranty claim rate, we will adjust for the fact that some vehicles leave coverage by exceeding the mileage limit. Here and later the adjustment will always be to k(t). To capture this rate the “time” under observation is now defined as ri = min(ai,yi), where yi is the age in days at which the vehicle exceeds (or would exceed) the mileage limit of ,I = 36,000 miles and ai is its current age. Subsequently, it will be necessary to differentiate between vehicles that have had warranty claims from those that have had no claims. Denote by M I the number of vehicles that have had at least one claim (and therefore some reported mileage history) and by M2 the number of vehicles that have had no claims, where

Mi

+ M2 = M .

Since odometers are not monitored continuously, yi is not known even for vehicles that have had a claim. Based on our assumption that the accumulation of miles is approximately linear with age, for a vehicle that has had at least one claim, we will simply extrapolate linearly using the age and mileage at the time of the most recent claim. For vehicles with claims, let ~i = oi/ci, where ci and oi are the age and mileage of vehicle i at the time of the latest claim. Then ~i is the mileage accumulation rate in miles per day for vehicle i. For a target age t , vehicle i counts in k(t) if it is old enough and if its mileage at age t is estimated to have been within the mileage limit .,I Its contribution to k(t) is I(ai 2 t ) I(ri 5 %). Figure 9.la illustrates this graphically. It depicts a miles (in thousands) by age (in months) grid. The large square represents the warranty coverage limits. The little stars represent the mileages and ages for the most recent claim for four hypothetical vehicles. The small squares at the end of each line are the extrapolated current mileages of the vehicles at their current age. Two of the vehicles are older than the target age t l , but one of them is estimated to have left warranty coverage due to mileage just prior to reaching age tl , and would not be counted when computing M ( t ) adjusted for withdrawals due to the mileage limit. This accounts for the vehicles that have had a claim, but we must also account for the ones that have not had a claim. In practice there may be thousands of vehicles that have experienced at least one claim, so we make use of the empirical distribution function of the mileage accumulation rates.

126

S. Chukova and J. Robinson

Fig. 9.1. (a) “Time” is age. (b) “Time”is mileage.

Denote this distribution by

and take it to be an estimate for the mileage accumulation rates for vehicles that have not yet experienced a claim. The probability of a typical vehicle remaining in coverage at age t is F (+) and its contribution to k(t) is as shown in the second row of Table 9.1. We note here that using the mileage accumulation distribution in this way amounts to assuming that vehicles with one or more claims have similar mileage accumulation rates as vehicles that have not experienced a claim. Early in the model year, particularly, selection bias could cause this assumption to be violated, say if high mileage vehicles are more likely than the general population to generate a claim. Fbrthermore, for vehicles that never experience a warranty claim, the assumption cannot be checked without resorting to external (nonwarranty) data sources. Such sources exist, e.g. quality surveys and maintenance records, but they must be cross referenced with the warranty database in order to be useful. We have not attempted to use supplementary mileage information in this article, but later we do examine the impact of using mileage data from a previous model year as well as trends over time with evolving mileage records. From our limited studies, these effects appear to be small. Reporting delays occur with warranty data when there is a delay between when a warranty event occurs in the dealership and when the claim is


127

posted to the database. Rejected claims that are later resolved is one reason for these delays. Such delays result in undercounting claims and their corresponding claim rates and costs. An adjustment for removing the effects of reporting delays was reported by Lawless and Nadeau‘ and Kalbfleisch, Lawless, and R ~ b i n s o n Like . ~ the case for withdrawals from coverage due to mileage, the adjustment is to k f ( t ) .Furthermore, this adjustment can be used in combination with the adjustment for mileage. When a claim is posted to the database, the date that it was posted as well as the date of the repair order in the dealership are known. The difference between these two dates is the claim delay (perhaps zero), and every posted claim has associated with it a delay. Thus we can compute from the claims database an empirical distribution function, 1 Nc G(d) = I(dj 5 d), Nc j = 1

where d j is the delay in days for claim j and Nc is the total number of claims in the database. As with the mileage accumulation distribution, we may in some situations want to compute this empirical cumulative distribution function from a previous model year. If we consider the eligibility of vehicle i, now of age ai, to have generated a claim at age t 5 ai, then such a claim, if it occurred, has had d = ai - t days to have been posted. The estimated probability that a claim is posted in that length of time is G(ai - t ) . Here we are assuming independence between the process generating the claim delays and that generating the mileage accumulation, which is reasonable. To adjust f i ( t ) for claim delay we multiply the contributions of vehicle i by these probabilities. Note that this reduces f i ( t ) and increases the rate function, which is the expected effect. Table 9.1 summarizes the details of the contributions to f i ( t )for all cases.

9.3.2. “Time” is miles case If warranty claim rates are more closely related to mileage than age, then we may wish to analyze by miles. This could occur in some engineering applications where we would expect warranty incidents to occur more as a result of usage than of age, for example suspension parts, bearings and other components that cycle with mileage. On the other hand corrosion and paint deterioration are generally treated as age-related. In general it is difficult to identify the dominant damage parameter for a particular subsystem due to widely varying customer usage patterns.

128


Table9.1 Contribution to for vehicle i at traget age t. A vehicle with at least one claim

CaSeS

A vehicle with no claims

Unadjusted Adjusted for Mileage Adjusted for Claim Delay Adjusted for Mileage and Claim Delay

I(aa

2 t ) I(Ti 5

I(ai

I(ai

+)

t ) G(ai - t )

2 t ) I(ri 5

%) G ( a i - t )

I(a1 2 t )

I(ai

F(+)

2 t ) G(a, - t )

I(ai2 t ) $(%) &(ai - t )

Throughout the remainder of the paper we will use the argument “m” for mileage. The fact that the exact mileage is unknown except at the time of a claim complicates the calculation of h’(m), but the same linear extrapolation model and mileage accumulation distribution used in the previous subsection can produce reasonable results. The numerators in (2) are available because they are the number of claims or cost for vehicle i at mileage m and are available in the database. For the unadjusted case the “time” under observation for vehicle i is ~i = mi, the current mileage. As before it will be convenient to think of mileage as a discrete variable. The current mileage is not known exactly, even for vehicles with claims, but it can be estimated by airi, where ai is the current age and ri is the mileage accumulation rate based on the most recent claim. So for a typical vehicle having at least one claim, the contribution to k ( m )at a target mileage m is estimated to be I ri 2 .

0 ($

Similarly for a vehicle without any claims, the contribution is 1 - F , representing the likelihood that the vehicle has attained m miles. To adjust k ( m ) for vehicles leaving coverage due to age, we want to assure that the target mileage m is reached before the warranty age limit, say I,. Thus, we replace ai in the unadjusted case by min(a,, l a ) . These ideas are illustrated graphically in Figure 9.lb, where two vehicles are estimated to have exceeded target mileage ml, but one of them did SO after leaving coverage due to age. The contributions to k ( m ) are summarized in the second row of Table 9.2. The calculations for incorporating reporting delay are more cumbersome

129

Estimating Mean Cumulative finctions

Table 9.2. Contribution to *(m) for vehicle i at target mileage m.

Cases

A Vehicle with

A Vehicle with no claims

at least one claim Unadjusted

I

Adjusted for

Ace

adjusted for Claim Delay Adjusted for age and Claim Delay

for the miles case, but still straightforward. If vehicle i, now of age ai, has experienced a claim, its age at mileage m is estimated by . If a claim

):(

0 0

had occurred on that day, it has had ai -

days to be posted. Therefore,

we multiply the previous contributions by G a, delay.

to account for claim

If the vehicle has not had a previous claim, no mileage rate is available, and we must consider all previous ages. If mileage m was achieved at age j , where j I a,, then the mileage accumulation rate is (S). The corresponding empirical probability mass distribution function of the mileage accumulation is for

f ( m , j ) = P ( z ) -&(?),

for j = 2 , 3 ,....

If a claim had occurred at vehicle age j , it has had (ai - j ) days to be posted. Thus, the contribution to k ( m ) for vehicle i is as shown in the third row of Table 9.2. To adjust for withdrawals due to age as well as reporting delay, the sum is restricted to j 5 min(ai, la), the minimum of the vehicle current age and the warranty age limit, as shown in the last row of Table 9.2.

130


9.4. Example 9.4.1. The L‘P-claims77 dataset

We illustrate the methods on a set of actual warranty data with 44,890 records taken from model year 2001 vehicles sold mainly in calendar years 2000 and 2001. We examine the warranty claims on one major system of the vehicle, which is not identified. It will be referred to as “System P”. Table 9.3 summarizes the dataset. To illustrate our points we created versions of the dataset as it would have existed at four different “cuts” in time: Jan. 1, 2001; Jan. 1, 2002; Jan. 1, 2003; and the actual “cut” date for our original dataset, Oct. 24, 2003. These are displayed in Table 9.3 along with Table 9.3. Summary of 2001 warranty file.

the descriptive statistics of the datasets up through the respective dates. For proprietary reasons a few vehicles were randomly selected, and their records were deleted from the original dataset. Also, the costs have been re-scaled. These precautions do not affect the authentic nature of the data. Note that the median reporting delay is around 11 days. Fewer than half of the vehicles generate one or more claims (of any type), even for the final cut when the median age is 982 days. At the first cut only 6% of the vehicles have had a claim. The median mileage accumulation rate is around 40 miles per day, and declines slightly over calendar time. This is more than the rate of 33 miles per day, which corresponds roughly to exhausting the 36,000-mile limit in exactly three years. So most cars leave coverage due to mileage. Also, we should emphasize that we use mileage information from any claim, not just those from System P.


131

9.4.2. Examples for the %me” is age case

In this section and the next, we illustrate the calculations for cost per car. The results are similar for the number of claims per car.

Fig. 9.2. (a) Unadjusted A(t) and adjusted for mileage A(t). ( b ) Unadjusted A(t) with 95% CL and adjusted for mileage A ( t ) .

Figure 9.2a illustrates the effect of the adjustment for withdrawals from coverage due to mileage, shown for the most recent time cut. Without further analysis, the bend in the unadjusted curve could be attributed t o a decline in warranty claim rates with age. But the adjusted curve indicates that the “true” rate is not declining; the bend is caused by vehicles leaving coverage due to mileage. Figure 9.2b superimposes 95% confidence limits on the unadjusted curve, roughly indicating that the differences due to the adjustment are statistically significant. Figure 9.3a shows the adjusted curves for all four time cuts to illustrate how the results would unfold over calendar time. We see few differences despite the fact that the mileage accumulation distribution trends slightly toward lower rates over calendar time. To investigate the impact of the mileage accumulation rate distribution, F ( r ) , its estimate $(r) was computed using data from 2000 and again using data from 2001. Figure 9.3b contrasts the adjustments at the third time cut, Jan. 1, 2003, using these two estimates of @(r).The differences are small.

132

S. Chukowa and J. Robinson

B

Fig. 9.3. (a) Adjusted for mileage A(t) at four time cuts. (b) T h e impact of adjusted for mileage A(t).

P(T)on

The adjustment for claim delay is not substantial for our dataset except for the first time cut, Jan. 1, 2001, when vehicles are relatively young, and a typical claim has had little time to be posted. Figure 9.4a illustrates the impact.

I

Fig. 9.4. (a) Unadjusted A ( t ) with 95% CL and adjusted for claim delay A(t). (b) Unadjusted A@) with 95% CL and adjusted for age A(m).

Also, the adjustment for mileage has little impact early in the model year because few vehicles have left coverage, so we are not able to demonstrate the effects of adjusting simultaneously for mileage and claim delay.


133

9.4.3. Ezamples for the “time” is miles case

Figure 9.4b shows the cumulative cost per car by mileage for the unadjusted case (with 95% confidencelimits) along with the adjustment for withdrawal from coverage due to age. Unlike the “time” is age case, the adjustment is essentially indistinguishable. Moreover, the simultaneous adjustment for age withdrawals and claim delay, also makes almost no difference (not shown). The reason is that in our dataset relatively few vehicles, only about 38%, leave coverage due to age. Also, the age limit adjustment does not begin until the oldest car reaches the age limit of warranty coveragethree years from the first sale for our dataset. This is in contrast to the mileage adjustment for the “time” is age case, where the adjustment begins to have an effect when the oldest car might possibly reach the mileage limit. Our mileage accumulation rate distribution has 2% of the vehicles reaching 36,000 miles in one year, and 10% reach the limit in a year and a half. Other calculations for the mileage case are similar to the age case and are not shown here. 9.5. Discussion

We have discussed extensions to the Hu and Lawless2 “robust” estimator for the mean cumulative function and its associated standard error. In particular, without requiring any supplemental source of data for mileage accumulation, we deal with the problem of incomplete information for mileages as it typically occurs in automotive warranty data. We also discussed how to combine these methods with previously reported methods for dealing with reporting delay. We have been motivated primarily by practical concerns and concentrated on stating and computing on real data various “adjustments” to the rate function and its standard error. In all cases the adjustments are with respect to the number of cars at risk. We have viewed the problem from a sampling perspective even though it could more precisely be described as a prediction problem. That is the first vehicles sold are treated as a sample from the “population” of vehicles that eventually will be sold. Also, the population is taken here as infinite, but it would be straightforward to apply a finite population correction, as in Robinson,8 to the standard error calculation. There are many issues related to the adjustments of k(t)(or &(m) respectively). Hu and Lawless2 demonstrate asymptotic normality and provide a consistent estimator of the asymptotic variance under appropriate

134

S. Chukova and J. Robinson

conditions. The key assumption is that the process that determines the time under observation is independent of the event process. Here the time under observation is determined by the process of mileage accumulation. It is difficult to justify or test this independence assumption in practice, so we recommend caution due to the possibility of bias. Using mileage data from the previous model year is one precaution that we have employed, and for our data so far it makes little difference. Also, we conjecture that proper asymptotic results can be developed for the estimators described here under L'rea~~nable7' conditions, but we have made no attempt to do that. The simple linear mileage accumulation model used here is convenient, but it is a first approximation. It only uses the last observed claim to calculate mileage accumulation rates, and it does not account for changes in rates as vehicles age. Also, we do not distinguish a mileage rate calculated from an older vehicle from one calculated from a younger vehicle, even though the one from the older vehicle should be less variable. In our example calculations we excluded rates from claims with vehicle ages less than 30 days to deal with this issue. Certainly more elaborate models for mileage accumulation are possible if the data to support them are available. We end on a technological note. It is certainly feasible now for vehicles to be equipped with sensors that would transmit milage and other relevant information to the manufacturer at all times. Interestingly, the additional mileage information would eliminate the need for some of the approximations that were discussed in this paper. The primary obstacles are cost and privacy issues, not technology.

References 1. J. Robinson and G. McDonald, Issues related to field reliability and warranty data, in Data Quality Control: Theory and Pragmatics, Ed. G. E. Liepins and V. R. R. Uppuluri, p. 69, Marcel Dekker, New York (1991). 2. X. Hu and J. Lawless, Estimation of rate and mean functions from truncated recurrent event data, J . Amer. Statist. Assoc. 91, 300 (1996). 3. W. Nelson, Recurrent Events Data Analysis f o r Products Repairs, Disease Recurrences, and Other Applications, ASA-SIAM, Philadelphia (2003). 4. J. F. Lawless, J. Hu, and J. Cao, Methods for the estimation of failure distributions and rates from automobile warranty data, Lifetime Data Anal. 1, 227-240 (1995). 5. J. Lawless, Statistical analysis of product warranty data, Int. Stat. Rev. 66, 41 (1998). 6. J. Lawless and J. Nadeau, Some simple robust methods for the analysis of recurrent events, Techometrics 37, 158 (1995).

Estimating Mean Cumulative hnctions

135

7. J. Kalbfleisch, J. Lawless, and J. Robinson, Methods for the analysis and prediction of warranty claims, Technometrics 33,273 (1991). 8. J. Robinson, Standard errors for the mean number of repairs on systems from a finite population, in Recent Advances in Life-Testing and Reliability, Ed. N. Balakrishnan, p. 195, CRC Press, Boca Raton, London, Tokyo (1995). 9. X. Hu and J. Lawless, Estimation from truncated lifetime data with supplementary information on covariates and censoring times, Biometrika 83, 747 (1996). 10. W. R. Blischke and D. N. P. Murthy, Product Warranty Handbook, Marcel Dekker, New York (1996).


CHAPTER 10 TESTS FOR SOME STATISTICAL HYPOTHESES FOR DEPENDENT COMPETING RISKS-A REVIEW

ISHA DEWAN Indian Statistical Institute New Delhi - 110016, India E-mail: [email protected]

J. V. DESHPANDE Statistics Department Poona University, Pune,. India E-mail: [email protected]

Competing risks data consists of time to failure and cause of failure. Suppose that the underlying risks are dependent. We review distribution-free tests for bivariate symmetry against alternatives involving dominance of cause specific hazard rate, subdistribution functions and subsurvival functions. We also review tests for independence of time to failure and cause of failure. Many of the statistics that were originally proposed in the context of independent risks continue to be useful for testing similar hypotheses regarding dependent risks.

10.1. Introduction The competing risks situation arises in life studies when a unit is subject t o many, say k, modes of failure and the actual failure, when it occurs, can be ascribed to a unique mode. These k modes are also called the k risks t o which the unit is exposed, and as they all seemingly compete for the life of the unit, the term ‘competing risks’ is used to describe it. Suppose that the continuous positive valued random variable T represents the lifetime of the unit and S taking values 1 , 2 , . . . , k represents the risk which caused the failure of the unit. The joint probability distribution of (T,S) is specified by the set of k 137

138

Isha Dewan and J. V. Deshpande

subdistribution functions F ( i ,t ) = P[T 5 t ,6 = 21, or equivalently by the subsurvival functions S(i,t ) = P[T > t , 6 = i], i = 1,2,. . .,k. Let H ( t ) and S ( t ) , respectively, denote the distribution function and the survival function of T . Let f ( i , t ) denote the subdensity function corresponding to ith risk. Then the density function of T is h(t) = C t l f(i,t ) , H ( t ) = E f = , F ( i ,t ) , S ( t ) = Ef=lS ( i ,t ) and pi = F ( i ,00) is the probability of failure due t o the ith risk. A commonly used description of the competing risks situation is the latent failure time model. Let XI, Xz, . . . ,xk be the latent failure times of any unit exposed to Ic risks, where Xi represents the time to failure if cause i were the only cause of failure present in the situation. The observable random variables are still the time to failure T = min(X1, Xa,. . . ,X,) and the cause of failure 6 = j if Xj = min(X1, Xa, . . . ,X k ) . If X I ,XZ,. . . , X k are independent, then their marginal distributions carry all the probabilistic information regarding the model with k risks. It is easily seen that the marginal and hence the joint distribution is identifiable from the probability distribution of the observable random variables (T,6). However, in general when the risks are not independent, neither the joint distribution of X's nor their marginals are identifiable from the probability distribution of (T,6) (Tsiatis' , Chowder2). Hence, the independence or otherwise of the latent lifetimes (XI,X z , . . . , X,) cannot be statistically tested from any data collected on ( T ,6). The independence of (XI,Xz, . . . , x k ) has to be assumed on the basis of a priori information, if any. Also, the marginal distribution functions may not represent the probability distribution of lifetimes in any practical situation. Also, elimination of one or more of the risks may change the environment in such a way that the marginal distributions under the remaining risks are not really an appropriate probability model any more. In view of the above considerations, unless one can assume independence, it is necessary to suggest appropriate models, develop methodology and carry out the data analysis in terms of the observable random variables (T,6)alone. Kalbfleisch and Prentice3y4 proposed methods for analyzing competing risks data in terms of cause specific hazard rates X ( i , t ) = limAt+o &P(t
t ) s(t) =M. Dewan and Kulathina15 have considered parametric models for subsurviva1 functions by assuming a suitable parametric form for cause-specific hazard rates. Aly et a1.,6 K ~ c h a r and , ~ Sun and Tiwari' have consid-

Tests for Some Statistical Hypotheses for Dependent Competing Risks-A Review 139

ered the problem of testing for equality of cause-specific hazard functions. De~hpande,~ Aras and Deshpande,lo Deshpande and Dewan'' have considered the problem of analyzing competing risks data by using the subdistribution functions and subsurvival functions. Recently Dewan et a1.12 have proposed tests for testing independence of T and 6.

10.2. Locally Most Powerful Rank Tests Suppose 5 = 2, that is, a unit is exposed to two risks of failure denoted by 1 and 0. When n units are put to trial, the data consists of (Ti,S;), a = 1,.. . ,n where 6* = 2 - 6. Suppose we wish to test the hypothesis HO : F ( 1 , t ) = F(2,t),for all t. First we look at tests based on likelihood theory. Under the null hypothesis the two risks are equally effective at all ages in the prevailing environment. However, the alternative hypothesis is that the two risks are not equally effective at least at some ages. The likelihood function is given by (see, Aras and Deshpande") n

(!) a=1

where T = ( T I , . . . , Tn),K= (ST,.. . , 6;). If F ( i , t ) depends upon the parameter 8, then inference about it can be based on the above likelihood function. When T and 6' are independent then Deshpandeg proposed the model F ( 1 , t ) = BH(t), F ( 2 , t ) = (1 - B)H(t). Here 8 = P[6* = 11. Then the likelihood reduces to

fi

q 8 T 6*) = eE7=16z*(1 - ~)C7="=,1-6z*) h(ta). 7-7-

(2)

a=1

Testing of the hypothesis F ( 1 , t ) = F(2,t) reduces to testing that 8 = 1 / 2 . Then the obvious statistic is the sign statistic (3) i= 1

nU1 has B(n, 0) distribution and there exist optimal estimation and testing procedures based on it. However, if F(1,t ) and F(2,t ) depend on a parameter 8 in a more complicated manner, then one needs to look at locally most powerful rank tests. Let f ( l l t ) = f ( t , B ) , f ( 2 , t ) = h(t)- f ( t ,8) where h(t) and f ( t , O ) are known density functions and incidence density such that f ( t , 80) = i h ( t ) . Let T(1)i T(2)i . . . I T(n)denote the ordered failure times. Let 1 if T(i) corresponds to first risk, 0 otherwise.

(4)

140

Isha Dewan and J . V. Deshpande

Let Rj be the rank of Tj among TI,. . . ,Tn. Let &' = (RI, Rz,. . . ,&), = (Wl,Wz,.. . ,Wn) denote the vector of ranks and indicator functions corresponding t o ordered minima. The likelihood of ( & W )is given by

w'

P(e,R'W)= J ... J

n

n[f(tz' B)]"'[h(ti)- f ( t i ,8)]1-wti

O < t l < . . . 0 and g ( t , 8) is the logistic e(=-~) then the LMPR test is based on the density function g ( t , 8) = [,l+e(z-8 statistic W+ = Cr=lWiRi, which is the analogue of the Wilcoxon signed rank statistic for competing risks data. (iii) In case of Lehmann type alternative defined by F ( 1 , t ) = [HT ( t )I 6, F(2,t) = H(t) the LMPR test is based on scores ai = E(E(,.))where E ( j )is the j t h order statistic from a random sample of size n from the standard exponential distribution. But for more complicated families of distributions, e.g., Gumbel,13 the scores are complicated and need to be solved using numerical integration (see Aras and Deshpande").

[TIe,

10.3. Tests for Bivariate Symmetry

Suppose that the latent failure times X and Y are dependent with their joint distribution given by F ( z ,y). On the basis of n independent pairs (Ti,65) we want to test whether the forces of two risks are equivalent against the alternative that the force of one risk is greater than that of the other. That is, we test the null hypothesis of bivariate symmetry

Ho : F ( z ,y) = F ( y , z) for every (z,y).

(6)

Before we formulate the alternatives of interest let us consider the following theorem which is easy to prove.

Tests for Some Statistical Hypotheses for Dependent Competing Risks-A Review 141

Theorem 9.3.1: Under the null hypothesis of bivariate symmetry we have (i)F(l,t) = F ( 2 , t ) for all t , (ii)S(l,t) = S(2,t) for all t , (iii) X(1, t ) = X(2, t ) for all t , (iv) P[d* = 11 = P[d* = 01 (v) T and 6* are independent. In view of the above theorem, the following alternatives to the null hypothesis are worth considering.

H i : X(1,t)

< X(2,t);

H2 : F(1,t)

< F ( 2 , t ) ; H3 : S(1,t) > S(2,t). (7)

All these alternatives say that risk I1 is more potent than risk I at all ages t in some stochastic sense. Sen14 considered fixed sample and sequential tests for the null hypothesis of bivariate symmetry of the joint distribution of ( X ,Y ) .The alternatives are expressed in terms of nl(t) = P[S*= 1IT = t ] ,the conditional probability that the failure is due to first risk, given that failure occurs at time t. He derived optimal score statistics for such parametric situations. But the statistics cannot be used without the knowledge of the joint distribution F(X, Y). We look at various distribution-free test procedures for testing HO against above alternatives. For testing HO against HI consider rt

S(t)[A(l, u ) - X(2, u)]du.

$J(t)= F(1,t ) - F ( 2 ,t ) =

(8)

I0

H1 holds iff the above function is nonincreasing in t. Consider the following measure of deviation between HO and H I ,

A=

J

o<x 0, V t 3 tl,

TN,- 2 t o . (8) By using the differential martingale writing of N , there is almost surely, for all t 2 tl: (9)

(10

Corollary 11.1(see appendix) can be applied and then,

loX, t l

dMs "2. o(

1;

ds)

+ 0(1)=

t to T) -

O(

+ O(1)= o(t).

(11)

That result remains true by replacing t by TN,-. Then, since ~ ( T N ), -= o(t), lemma 11.1 is proved. 0 11.3.2. Asymptotic intensity

The failure intensity of an ARIl model can be rewritten as: At = (1 - p ) A ( t )

+ p [ A ( t ) - A(TN,_)].

-

(12)

But, thanks to lemma 11.1, it can be proved under additional sensible assumption that: A(TN,-) = A(t - (t - TN,-)) A(t). Then, the failure intensity is asymptotically equivalent to (1 - p)X(t) (see proposition 11.1 below), called asymptotic intensity and denoted by A,(t). (y) That result is true for an initial intensity that is a regular variation function:17

L . Doyen

158

0

A2:30 E IR+, Vx > 0 ,

limt,,

X(x t ) / A ( t ) = xo.

Regular variation functions with /3 = 0 are slow variation functions. Powers of logarithm functions ( A ( t ) = a,B(Zn(l+ t))o-', a > 0,p > 1) and constant functions ( X ( t ) = a,Q > 0) are slow variation functions. Increasing power functions ( X ( t ) = crpto-l, (Y > 0 , p > 1) are not slow variation functions. However, there are regular variation functions. Nonregular variation functions for the initial intensity correspond to quick divergent initial intensity, for example: X ( t ) = e z p ( t P ) with p > 0. That kind of initial intensity seems not to be realistic for reliable industrial systems.

Proposition 11.1: Under assumptions A 1 and AZ, the failure intensity is asymptotically equivalent to the asymptotic intensity: At "2 X,(t) (t) o(Xm ( t ) ) .

+

Proof: Lemma 11.1 implies that, almost surely: (13)

Then, Eq. (12) implies, for all t 2 M I , that:

I&

IIpI [X,(t)

- A,(t)I

-

L((1

+ e l ) t ) ] (a.s.).

(14)

In addition, the initial intensity is a regular variation function: Vt2

> 0 , 3M2 > 0 , V t 2 M2,

This is equivalent to:

I X,((l

+ € l ) t )- (1

+El)%&)

)I€ZX,(t).

(15)

By using this result in Eq. (14) it can be deduced that, almost surely:

vt 2 max(M1,M2), I At And the result is proved.

-A @ ,)

IL IPI [ 11 - (1 + E 1 ) O + €21 L ( t ) . (16) 0

Figure 11.1 shows the failure intensity in the case of efficient repair ( p = 0.3), in solid thin line, and harmful repair ( p = -0.3), in solid bold line. The initial intensity, X ( t ) = 3t2, is in dashed line. The asymptotic intensity is represented by the doted line in the case of efficient repair and by the dashed-dotted line in the case of harmful repair. It appears that the difference between the failure intensity and the asymptotic intensity is decreasing. Proposition 11.1 only proves that the difference is negligible with regards to the asymptotic intensity.

159

Repair Eficiency Estimation in ARIi Model

351

Fig. 11.1. Failure intensity for p

O such that 2," d h , is finite for all t 2 0 (it is automatically true if 2, and A, are bounded over [0,t]).Then, s," 2, dM, is a local square t integrable martingale with predictable variation process: 2,"dAs.

so

Theorems 11.2 and 11.3 are two convergence results,20the first one is a consequence of the law of large numbers, and the second one of the central limit theorem.

Theorem 11.2: For {(M)+m< +w}, Mt converges almost surely to a finite random variable as t grows to infinity. For { ( M ) + m= +w}, and for all E > 0: M,/(M);.~+' Z 0. Theorem 11.3: Let 2 be a locally bounded predictable process. Then under the following assumptions:

167

Repair Eflciency Estimation in ARIi Model

0

there exists ct

> 0 and u such that:

s,” Z:Xs

ds/c;

5 u2,

> 0 s,” Z ~ U ~ l ~ a l , ~ cdslc? , ~ X , + 0 (it is automatically true if Zt is almost surely finite and ct grows to the infinity), the random variable: s,” 2, dM,/ct converges in distribution to a Gaussian centered variable with standard deviation u. 0

P

for all b

In particular, theorems 11.1 and 11.2 imply the first following corollary and theorems 11.2 and 11.3 imply the second following corollary. Both deal with martingale asymptotic behavior. Corollary 11.1: Let Z be a bounded predictable process. If the failure intensity i s bounded for all t 2 0 , then: 2, dM, “2 o(s,” 2,”dA,) O(1).

s,”

+

Corollary 11.2: If there exists a positive, nondecreasing, divergent function A,(t) such that the cumulative failure intensity satisfies almost surely: At = A,(t) o(A,(t)), then for all 6 > 0: Mt “2‘ o(A,(~)’.~+‘) and

+

M t / d m -% N(o,1). References 1. H. Pham and H. Wang, Imperfect maintenance, European Journal of Operational Research 94, 452-438 (1996).

2. M. Brown and F. Proschan, Imperfect Repair, Journal of Applied Probability 20, 851-859 (1983). 3. M. Kijima, Some Results for Repairable Systems with General Repair, Journal of Applied Probability 26, 89-102 (1989). 4. M. A. K. Malik, Reliable preventive maintenance scheduling, AZZE Z’ransactions 11, 221-228 (1979). 5. T. J. Lim, Estimating System Reliability with Fully Masked Data under Brown-Proschan Imperfect Repair Model, Reliability Engineering and System Safety 59, 277-289 (1998). 6. H. Langseth and B. H. Lindqvist, A Maintenance Model for Components Exposed to Several Failure Mechanisms and Imperfect Repair, Mathematical and Statistical Methods in Reliability, World Scientific Publishing Co. p. 415430 (2004). 7. J. H. Lim, K. L. Lu, and D. H. Park, Bayesian Imperfect Repair Model, Communications in Statistics - Theory and Methods 27, 965-984 (1998). 8. I. Shin, T. J. Lim, and C. H. Lie, Estimating Parameters of Intensity Function and Maintenance Effect for Repairable Unit, Reliability Engineering and System Safety 54, 1-10 (1996). 9. W. Y. Yun and S. J. Choung, Estimating Maintenance Effect and Parameters of Intensity Function for Improvement Maintenance Model, 5th. ISSAT International Conference Reliability and Quality in Design, p. 164-166, Las Vegas (1999).

168

L . Doyen

10. M. P. Kaminskiy and V. V. Krivtsov, G-Renewal Process as a Model for Statistical Warranty Claim Prediction, Annual Reliability and Maintenability Symposium, p. 276-280, Los Angeles (2000). 11. M. Yafiez, F. Joglar and M. Modarres, Generalized renewal process for analysis of repairable systems with limited failure experience, Reliability Engineering and System Safety 77, 167-180 (2002). 12. S. Gasmi, C. E. Love, and W. Kahle, A general repair, proportional-hazards, framework to model complex repairable systems, ZEEE Transactions o n Reliability 54, 26-32 (2003). 13. L. Doyen and 0. Gaudoin, Classes of Imperfect Repair Models Based on Reduction of Failure Intensity or Virtual age, Reliability Engineering and System Safety 84, 45-56 (2004). 14. P. K. Andersen, 0. Borgan, R. D. Gill, and N. Keiding, Statistical Models Based on Counting Processes, Springer-Verlag (1993). 15. M. Kijima, H. Morimura, and Y . Suzuki, Periodical Replacement Problem Without Assuming Minimal Repair, European Journal of Operational Research 37, 94-203 (1988). 16. P. BrBmaud, Point processes and queues: Martingale Dynamics, SpringerVerlag (1981). 17. J. Karamata, Sur un mode de croissance rbguliitre, ThCoritmes fondamentaux, Bulletin de la Socie'te' de Mathe'matique de France 61, 55-62 (1933). 18. P. Embrechts, C. Kliippelberg, and T. Mikosch, Modeling extremal events, Springer, p. 567 (1997). 19. D. N. P. Murthy, M. Xie, and R. Jiang, Weibull Models, Wiley Interscience, p. 314 (2004). 20. C. Cocozza-Thivent, Processus Stochastiques et FiabilitC des Systkmes, Springer (1997).

CHAPTER 12 ON REPAIRABLE COMPONENTS WITH CONTINUOUS OUTPUT

M. S. FINKELSTEIN Department of Mathematical Statisticsj University of the Free State PO Box 339, 9300 Bloemfontein, Republic of South Africa E-mail: [email protected]. ac.za

An output of a component’s performance is characterized by a monotone deterministic function or by a stochastic process with monotone sample paths. A stationary expected output and the probability of exceeding the given level of an output are derived for perfectly repaired components. Simple systems of components with the continuous output are considered. The case of imperfect repair is discussed. Several examples are considered.

12.1. Introduction The state space of a binary component is {O,l}. When a component is “on,” its state is 1 and when a component is “off,” its state is 0. Reliability theory of engineering systems is mostly devoted t o this case, although the multistate components and systems were also considered rather extensively (see Lisniansky and Levitin’ for references). Less attention was paid to the continuous case, when the state space is e.g., [O,w) or some other interval. In this note we shall consider some simple approaches that can help to analyze main stationary characteristics of repairable components and elementary systems with continuous state space. Define an output of a continuous state component a t some time t as the state of a component a t this instant of time. Let the output of this component, which characterizes its performance level, be a positive, decreasing ) the corresponding stochastic (increasing) function of time Q(t) ( @ ( t )or process Q t , t 2 0 ( @ t , t 1 0 ), showing monotonic deterioration of the 169

170

M. 5’. Finkelstein

components’ performance level. Monotonicity assumption is quite natural in many applications. The main objective of this paper is to obtain for repairable components simple formulas for the expected output at time t and for the probability of exceeding (nonexceeding) of a given level of output at this instant of time. As the renewal reward processes methodology will be used, the focus will be on asymptotic results for t 00. We shall consider three important settings describing components with continuous output: --f

a. Let a system consist of two independent components in series. The first component is binary with the Cdf F(t) and the second is a continuous state component which state is defined by the decreasing Q(t)(Qt,t 2 0 ) . Usual reliability reasoning for the series system results in the following: when the first component is operating (its state is l), the output of a system is defined as Q(t)(Qtrt 2 0 ) and when the first component is “off’ (failed), the output of the whole system is 0. In other words: an output of a system is a product of a binary random variable and a random output of a continuous part. Example: an onboard navigation system consisting of a binary part, which failure leads to the failure of the whole system, and the continuous output part with a degrading between corrections performance level (accuracy of navigation parameters). It is clear that, as two components are independent, the expectation of the output of this system is given by Q E @ ) = F(t)Q(t) ( Q E ( ~= ) F(t)E[Qtl),

(1)

where we assume that E[Qt]exists and that the criterion of failure with respect to the level of Q(t)(Qt,t2 0) is not defined (as usually: F ( t ) = 1- F ( t ) ) . b. There is only one component with increasing output @ t , t 2 0 and the failure is defined as exceeding some deterministic level PO.Obviously the corresponding first passage time for this process is its stopping time. Consider a stochastic process &, t 2 0, which is equal to zero when the initial process exceeds PO: Et

= @tI(cpo

-

at),

(2)

where I ( t ) is the corresponding indicator. Therefore, the expectation of an output at time t is @ E ( t ) = E[Jt].Without losing generality, assume that = @ ( O ) = 0 as in the case of accumulated damage (degradation).


171

c. The same as in b. but the critical level p o is a random variable \Eo (with the Cdf Fo(cp) ) independent of @(t). All three settings describe continuous state components and, as it was mentioned, the renewal reward methodology will be used for all of them when considering the repairable case. The difference is in defining a failure. In the first setting the failure is defined via the failure of the binary component, and in the second and the third settings a failure time is defined as the first passage time for the corresponding stochastic process. 12.2. Asymptotic Performance of Repairable Components

a. Let each failure of the component be instantaneously perfectly repaired a t failures. This means that all inter-failure times are i.i.d. with distribution functions F ( t ) , whereas the output after each failure is ideally ‘refreshed.’ Denote by Q ( t ) a random value of the output at time t . Therefore, it can be easily seen:

1 t

E[Q(t)l

Q E ( ~= )

F ( t ) E [ Q t+ ]

0

h ( x ) F ( t- x)E[Qt-,]dx,

(3)

where h ( z ) is the renewal density function for the ordinary renewal process governed by the distribution function F ( t ) . Applying the key renewal theorem2 to Eq. 3 , the stationary value (as t 4 m) of the expected output is obtained in a usual way: (4)

where T is the mean time to failure. The probability that the output exceeds some acceptable level qo > 0 is also of interest. Similar to ( 3 ) and (4),the following stationary probability can be obtained: (5

where F ( x ,4 0 ) is the distribution function of the first passage time for the decreasing stochastic process Qt, t 2 0. Example 12.1: Let, firstly, Q ( t ) be deterministic and consider the exponential case: F ( t ) = 1 Q ( t ) = ePat,LY > 0. Then (6)

M. S. Finkelstein

172

For the simplest stochastic process: Qt(Z) = 1- e - z t , where Z is uniformly distributed in [0,a ] a , > 0, the straightforward calculations give: (7)

where d = -(In qo)/a. b. Denote by &(cp) the pdf of at for the fixed t. It is clear that it can be easily defined for processes for which the distribution of the first passage time can be obtained. Then: (8)

Assume that this mean exists for W 2 0. The perfect repair is instantaneously performed each time @ t reaches PO.Therefore, the inter-arrival times of the renewal process are just the corresponding i.i.d. first passage times with the Cdf F ( t ,9 0 ) and the mean Tv0.It can be shown that E[&]is decreasing in t and that its integral from 0 to infinity is finite. This means that the key renewal theorem can be applied, which leads to the following stationary value:

1

l o o @ES(PO) = TVO

E[Ct]dt.

(9)

A similar result can be obtained for the stationary probability for the output values to be in the interval [cp', 901 for some 0 < cpl < cp. Example 12.2: Let

Qt

= Pt, where ,f3 is a positive random variable. Then @ES(PO) =

PO 2

1

and this simple result does not depend on the Cdf of p. c. Let now PO be random with the Cdf Fo(cp) and consider firstly deterministic @(t).As this function is increasing, the inter-arrival times are defined by the following distribution

@(U= Fo(W)>

P(P0 I

(10)

and, eventually: (11)

Example 12.3: Let Fo(t) = 1- exp{-At}, @(t)= Pt,P > 0. Then @ E S = and, as in the previous example, the stationary value does not depend on P.

173


For the random process, Eq. 11 is modified to: @ES =

L To

1

00

EIFo(@z)@z]dx,

(12)

0

where E[Fo(@,)]is the inter-arrival time distribution and TOis its mean.

12.3. Simple Systems The above reasoning can be generalized to systems of components of the described type. We shall consider the setting ''a." and stationary characteristics, but the following is valid for other settings and for V t 0 as well. Let h(z1,5 2 , ..., z), be an ordinary structure function of a coherent system of n binary components. Assume now that each component of this system is non-binary anymore, but a repairable continuous state, one with an output defined by relations (4) and (5). Let the following rule be applied to the output of our ~ y s t e m : ~

>

(13)

where Qi(t), is an output of the ith component i = 1,2...,n and 01,022,..., 01 are the corresponding minimal path sets. It is clear that the parallel continuous output system is defined by: Q(t) = maxls,Qi(t), whereas relation Q(t) = mini 0 and consider stationary characteristics for the parallel system of identical components. It is clear that (14) turns to 1 - (1 - PS(q0))" and the upper limit of integration in (15) is 1. Then (compare with a nonredundant structure in Example 1):

Ps,n(qo)= 1 - (qo)??

7

Q E S , ~=

nX

nX

+ LY'

Remark 12.1: Different components can have different 'output supports' (output range). This means that the structure function can be different for different values of qo, which can lead to changing with the level of qo system structure.

M. S. Finkelstein

174

Remark 12.2: Definition 13 is the simplest one for the output of a coherent system. Some other approaches can be considered as well. For instance, the cumbersome relations, when the output of the entire system is the sum of outputs of components, can be derived (‘parametrical convolution’). 12.4. Imperfect Repair

The results of previous sections were derived under the usual assumption that repair is ideal, thus returning the system to ‘as good as new’ state. We shall consider here only one type of imperfect repair and apply it to Model “c.” This approach applied to Model “b” results trivially in the corresponding delayed renewal process. Another type of imperfect repair, which is defined for binary components as the combination of the perfect repair and the minimal repair4i5i6can be easily generalized to the case of the continuous output in Model Assume that after each repair the process at,t 2 0 is restarted from the same initial level, but the critical level of the output, which is a random variable and defines a failure (end of a cycle), is stochastically decreasing with each repair. This kind of imperfect repair is relevant in various applications. Specifically, let QQ, i = 1 , 2 , ... be the critical output at the end of the ith cycle. For the perfect repair all !Po,%,i = 1,2, ...,Q o , E ~ QO are i.i.d. Let the sequence Q o , ~i ,= 1 , 2 , ... be stochastically decreasing: Qo,2+1 I s t

Qo,2

@ FO,r+l(cp)

I Fo,z((P), = 172, ..., VcP E [O, 001,

(16)

where, F ~ , ~ + l ( cis p )the Cdf of Q o , and ~ Fo,l(ip) = Fo(p). The simplest example of a stochastically decreasing sequence Q o , ~i , = 1 , 2 , ... is the following geometric process:

FO,*((p)= Fo(wz-lcp), i = 1 , 2 , ..., w > 1,

(17)

where w is a constant scale transformation parameter. It follows from (17) that the mean length of a cycle tends to 0 as i -+ m. A more interesting situation would be, if the cycle duration Cdf tends, as i -+ 00 , to some limiting Cdf. In this case asymptotic relation (12) is true, where Fo(cp) is substituted by this limiting distribution l$ (cp). Consider the following specific model, which meets these requirements. It is clear, that the duration of the first cycle is defined by the Cdf Fo,l((p=) Fo((p),whereas Q0,I QO (and, of course, by the stochastic process at, t 2 0 itself). Let the next cycles be governed by the distribution Fo,%((p) = E[Fo(cpl@,,)] where @$ is a random starting value, and

=


175

Assume, specifically,that the starting age of this conditional distribution is the decreased output at the end of the previous cycle. FO,i+l(Cp)= ~[Fo(cplq~o,i)l, = 1,2,

.-.

(18)

where 0 5 q < 1 shows 'the extent' of the repair action. The value q = 0 corresponds to the perfect repair and it is clear that there is no analogue of the minimal repair6 in this case. Therefore, this setting is similar to the Model 1 of Kijima.8 It can be provedg that if Fo(9) is IFR, then (16) holds and the limiting distribution f i ( c p ) exists (for the latter result the IFR assumption is not required). Therefore, relation (12) for the stationary output value (with mentioned above substitution Fo((P)by 4 (9)) holds.

Remark 12.3: There can be different ways of modelling the initial increasing process at,t 2 0. Assume, for instance, that it has independent increments. A good candidate for this is the gamma process Wt,t 2 0, WO= 0, which, according to the definition, has stationary independent increments and an increment Wt - W,, (t > s), has a gamma density with scale 1 and shape (t - s). The Levy process, as a more general one, is often suitable for this purpose as well. The increment in [t,t + h] can be also defined in a following natural way:"

+

@t+At - @t = a ( @ t ) & ( A t ) b(@t)At,

(19)

where &(At) is a random variable with a positive support and finite first two moments, and a ( . ) , b ( . ) are continuous positive functions of their arguments. Letting At -+ 0, we arrive at the continuous version of (19) in the form of the Ito stochastic differential equation:

+

d@t = a(@'t)dv(t) b(@t)dt,

(20)

where v ( t ) , t L 0 is, for instance, a gamma process, if &(At)has a gamma density with scale 1and shape (At). Integrating Eq. (20) €or O0 = 0 results in

12.5. Concluding Remarks

The continuous outputs (deterministic and stochastic) for repairable components have been studied in this note and simple relations for stationary characteristics were obtained. It is easy to use the formulas of Sec. 12.2 and Sec. 12.3 in practical calculations.

M. S. Finkelstein

176

Only one method of describing continuous output systems of continuous output components, based on t h e structure function of Barlow and W U was considered. The described approach can be easily generalized to the model, which takes into account the possibility of relevant maintenance actions. The new type of imperfect repair, discussed in Sec. 12.4, characterizes imperfect repair actions via stochastically decreasing sequence of random variables defining the corresponding critical values (and, therefore, the failures at each cycle). It seems t h a t this topic needs further attention in the future.

References 1. A. Lisniansky and G. Levitin, Multi-State System Reliability. Assessment,

2. 3. 4. 5. 6. 7. 8. 9. 10.

Optimization, and Application, World Scientific. New Jersey, London, Singapore, Hong Kong (2003). A. Hoyland and M. Rausand, System Reliability Theory, John Wiley and Sons, New York (1994). A. Barlow and A. Wu, Coherent systems with multistate components, Math. Oper. Research 4, 275-278 (1978). F. Beichelt and K . Fischer, General failure model applied to preventive maintenance policies, I E E E Transactions o n Reliability 29 (1980). H. W. Block, T. H. Savits, and W. Borges, Age dependent minimal repair, J. Appl. Prob. 22,370-386 (1985). M. S. Finkelstein, Some notes on two types of minimal repair, Adw. Appl. Prob. 24,226-229 (1992). M. S. Finkelstein, The performance quality of repairable systems, Quality and Reliability Engineering International 19,67-72 (2003). M. Kijima, Some results for repairable systems with general repair, J . Appl. Prob. 26,89-102 (1989). M. S. Finkelstein, A restoration process with dependent cycles, Automat. Remote Control 53, 1115-1120 (1992). N. D. Singpurwalla, Survival in dynamic environment, Statistical Science 10,86-108 (1995).

CHAPTER 13 EFFECTS OF UNCERTAINTIES IN COMPONENTS ON THE SURVIVAL OF COMPLEX SYSTEMS WITH GIVEN DEPENDENCIES

AXEL GANDY Institut fur Angewandte Mathematik und Statistik, Universitat Hohenheim 70593 Stuttgart, Germany E-mail: agandyauni-hohenheim.de When considering complex systems (i.e. systems composed of multiple components) in practice, the failure behavior of the components is usually not known precisely. This is particularly true in early development phases of a product. We study the influence of uncertainties in the marginal distributions of the components' lifetimes on one-dimensional properties of the system's lifetime (e.g. expectation, quantiles). We do not assume that the components are independent; instead we require that their dependence is given by a known copula. We consider two approaches. In the first approach, we assume that the margins are within a fixed distance from known distributions. This approach leads to bounds on the one-dimensional properties and requires the solution of a nontrivial optimization problem. We provide solutions for some special cases. The second approach is Bayesian and assumes some prior distribution on the marginal distributions. For example, one may assume that the margins belong to parametric classes and that distributions on the parameters are given. Monte-Carlo simulation can be used to obtain the distribution of one-dimensional properties of the system's failure time.

13.1. Introduction We consider a classical complex system allowing just two states: working (coded as 1) and failed (coded as 0). We assume that t h e system consists of n binary components and that t h e states of the components determine the state of the system, i.e. we have a structure function @ : (0, l}" -+ (0, l}. In this paper, we assume @ to be monotone, meaning that @ is monotone in each component, @ ( O , . . . ,0) = 0 and @ ( l ,..,.1) = 1. The nonnegative random lifetimes of the components are denoted by T I , .. . ,T,, with joint 177

178

A . Gandy

cumulative distribution function (cdf) H . Let X i ( t ) = l{Ti>t) be the state of the ith component at time t , where 1 denotes the indicator function. The probability that the system has failed up to a given time t is

(1) For further discussion of complex systems see Aven and Jensen.’ If F = (F1,. . . , F,) denotes the marginal distributions of the lifetimes TI, . . . ,T, then, by Sklar’s theorem, there exists an n-copula C such that H ( t 1 , .. . ,t,) = C ( F l ( t l ) ., . . , F,(t,)) for all t l , . . . , t,. This can be written as H = C o F . Recall that an n-copula is an n-variate cdf with margins that are uniform distributions on [0, 11. If F I ,. . . ,F, are continuous then C is uniquely determined. If T I ,. . . ,T, are independent then C can be chosen as the product copula II(z1,.. . ,z,) = z1z2 . . . z,. Further details can be found in Nelsen2 and In practice, H is usually not known precisely. This is particularly true in early development phases of a product. Often, one is interested in onedimensional properties of the system’s lifetime distribution S*,H like the expectation or quantiles. These properties are defined by mappings from the space D of cdfs of nonnegative random variables, into R = R U ( - 0 0 , 0 0 ) . Say q : D -+ is one of these mappings. We want to study how imprecise knowledge of H influences q ( S @ , H ) . To simplify this task, we confine ourselves to uncertainties about the marginal distributions F1 , . . . , F, and assume that the dependence structure of H is given by a known copula C. We consider two approaches. In the first approach, we assume that there are known GI , . . . , G, E D such that di(Fi,G,) 5 for some E , 2 0 where d l , . . . , d , are functions measuring distances in the space D. To derive the resulting bounds on q ( S + , H ) we have to solve a nontrivial optimization problem. We consider this approach in Sec. 13.3. The second approach is Bayesian in nature. We assume that the marginal distributions Fl , . . . , Fn depend on some parameter 8 E RP. We assume that some (prior) distribution on 0 is given. In Sec. 13.4 we consider this approach and give an example. In Sec. 13.5 we will compare aspects of the two approaches. Before starting with the two approaches, we show in Sec. 13.2 how the marginal distributions F1, . . . , F, can be separated from the structure function @ and the copula C in the lifetime distribution S+,Hof the system.

Effects of Uncertainties in Components on the Survival of Complex Systems

179

13.2. System Reliability with Dependent Components We will introduce a function G*,c and show how, together with the marginal distributions, it determines the cdf S ~ , H of the system's lifetime. Let @ : { O , l } " + { 0 , 1 } be a monotone structure function and let C be an n-dimensional copula. Let be the probability measure on (R", B(R")) induced by C , where B(Rn)is the Borel-cT-algebra on R". Note that 11") = 1. For t E R,let @, := (-m, t ] and BI := ( t ,cm). Let G+,c : [0, 11" + [0,1]be given by

c

c([O,

C

G a , c ( t l , . . . ,tn):= 1 -

@(x)C

PE{O,l)"

Lemma 13.1: Let @ : ( 0 , 1)" -+ { 0 , 1 } be a structure function, let C be an n-copula and let F = (F1,. . . ,F,) E D". Then for all t 2 0, S + , C ~ F == ( ~G+,c(Fl(t),... ) ,Fn(t)), where S ~ , C is ~ given F by ( 1 ) .

Proof: Let (TI,. . . ,Tn) be a random vector with cdf C o F . For t X i ( t ) := l { ~ ~ ,F~ o r}t .2 0 ,

2 0 let

l{+(e)=O}P(Xi(t)= ZiVi)

S+,CoF(t) = PE{0,1}"

=

1-

c

( P ( X ) P ( X i ( t )= ZiVi).

ecE{O,l)"

Let U = ( U I , . . . , Un) C and for i = 1 , . . . ,n, let FL1 be a generalized d inverse of Fi.Then (Fcl(U1),. . . ,FL1(Un))= ( T I , . . ,Tn). Hence, for t 2 0 and x E (0, l}", N

P ( X i ( t )= ZiVi) = P(T2 E Bk;Vi) = P(FC1(U,) E BkiVi)

E) P(UiE @)yq

=6

("npxt)) xi

,

i= 1

To see the validity of (I),one can argue as follows. Let the at most countable set of discontinuities of FL1 be denoted by Ai. If u $ Ai then u 5 Fi(t) iff FL1(u) I t (see Witting4 p. 20) and hence u E B E ( t ) iff FF1(u) E B4,. Since each Ui is uniformly distributed on [0,1], P(UZ1{ UiE Ai})5 P(Ui = x) = 0. Hence, (I) holds. 0

cz,czEAi

The following lemma is a consequence of properties of copulas and the assumption that is monotone.

A . Gandy

180

Lemma 13.2: G+,c is nondecreasing and continuous. Proof: To prove that G+,c is nondecreasing we show that G+,c is nondecreasing in each component. Without loss of generality, we consider the last component. Let s = (sl,.. . ,)s, E [0, lIn such that s, 5 t 5 1. We show that for any z E (0, l},-',

(2) where @(z,y) = @(XI,.. . ,zn-l,y). If @(z,O) = @(z, 1) = 0 then (2) is trivial. If @(z,0) = @(z,1) = 1 then (2) holds because B:" Bin = BA BE = R and 6 is additive. Since @ is nondecreasing the only remaining case is @(z, 0) = 0 and @(z, 1) = 1. Since (s, co)3 ( t ,co),

+

+

The continuity of G+,cis a consequence of the continuity of the copula C. In fact, G ~ , c ( is t )just a linear combination of the values of C a t certain points that depend continuously on t E [0,11,. These points are the elements of n;=&ti, 1). 0

Example 13.1: For a parallel system with n components, i.e. the system fails when all components have failed, @(XI,.. . ,z), = 1 - fl:==,(l- 5 , ) and hence G+,c = C. In the case of a serial system, i.e. the system fails when a single component fails, @(XI,. . . , z), = xi. If there are just n = 2 components then G+,c(tl,tz)= tl t2 - C(t1,ta). Fig. 13.1 illustrates G+,c for n = 2 components.

+

nYZl

Example 13.2: If the product copula components are independent, then

n(u) = ny=lui

is used, i.e. the


181

Fig. 13.1. Illustration of G + , c in the case n = 2. The copula C induces a measure on 10,112. The value of G g , c ( t l ,t2) is the measure of the shaded area in the case of a parallel/serial system (from left to right).

13.3. Bounds on the Margins In this section, we want to study how one-dimensional properties of the system's lifetime cdf behave if only bounds on the margins are known. More formally, let @ be a monotone structure function, let C be an n-copula and suppose we know that the marginal distributions F = (F1,. . . ,F,) E D" of the failure times satisfy di(Fi,Gi)5 f i ti = 1,.. . ,n, where GI , . . . ,G, E D are known cdfs, ~i 2 0 and di : D x D + [0,m] measure distances between cdfs. Examples for di are the uniform metric

d,(F,H)

:= sup

IF(t) - H ( t ) l ,

tE[O,m)

L,-distances on the cdfs

d,(F,H) :=

(1"

1lP

IF(t) - H(t)IPdt)

(for some p > 0),

and L,-distances on the inverse cumulative distribution function

(For some P < 0 ). The distance d z l is called Mallow's metric. We are interested in a one-dimensional property of the system's lifetime cdf which we assume t o be given by a function q : D -+ E.Examples for q include the expectation E ( F ) := - F ( t ) ) d t and quantiles Q p ( F ):= inf{t E [0,m) : F ( t ) 2 p } (for some O < p 5 1). In practice, it is often interesting to be able to give guarantees for these properties of a system. In mechanical engineering, for example, the requirement specifications often include a 10% quantile for the system's lifetime.

som(l

A. Candy

182

For the properties we mentioned above, a smaller value is “worse.” Therefore, to guarantee a certain behaviour, we are interested in the minimal possible value of the property. In the following, we shall consider the minimal possible value of q(S+,CoF)given the restrictions on the margins. For this, the following optimization problem over F = ( F I ,. . . ,F,) has to be solved.

i

Q ( S + , C o F ) + min

(*> F E Dn di(Fi,Gi)5 ~ i ,=i 1,.. . ,n We are not aware of a general solution of (x). However, for some important special cases solutions can be given. A related problem would be to consider the maximal value given the restrictions. We will not discuss this problem here. 13.3.1. Uniform metric For the following, we use the usual stochastic ordering5>‘on D , i.e. F 5 , G iff F ( z ) 2 G(z) for all z E [ O , c o ) . If q is monotone with respect to “5,” then a solution of (*) in the case of the uniform metric is given in the following proposition. For applications, note that the functions E and Q p are nondecreasing.

Proposition 13.1: If q is nondecreasing with respect to the usual stochastic order ‘Y,” on D and if di = d,,i = 1,.. . , n, then Fo given by

F,O(t):= (Gi(t)+ ~ is a solution of

(*)1

i A )

1, i

=

1,.. . , n

(3)

where a A b = min{a, b } .

Proof: Clearly, Fo E D” and d,(Gi, F!) 5 ~i for all i. Let H E D” with d,(Gi,Hi) 5 ~i for all i. For i E (1,.. . , n } and t 2 0, we have Hi(t) 5 (H,(t) - Gi(t)( Gi(t) 5 &i Gi(t) and Hi@)5 1. Hence, Hi(t) 5 F!(t) for all i and t . Since G+,c is nondecreasing by Lemma 13.2, S+,CoH(t) = G+,c(Hi(t),. . . , & ( t ) ) I GQ,c(F:(t),. . . , F:(t)) = SQ,CoFO(t).Hence, S ~ , C ~2,HS Q , C ~ FSince O. 0 q is nondecreasing, Q ( S + , C o H ) >_ q(S+,CoFO).

+

+

Remark 13.1: Note that (3) does not depend on q.

Remark 13.2: Instead of using Lemma 13.2 in the proof of Proposition 13.1 one could also employ a remark on p. 240 of Muller and Stoyan.‘ In


183

our notation the remark states the following. If @ is a monotone structure function, C is an n-variate copula, F 1 = ( F t ,. . . ,F i ) , F 2 = (F;, . . . ,F:) fi D” and F: IsF;,i = 1,.. . ,n,then S + , C o FIs ~ S+,CoF1.

13.3.2. Quantiles Next, we consider (*) if q = Qp,that is if we are interested in quantiles. In the following we use the notation a V b := max{a, b}. Proposition 13.2: Suppose that for i = 1,.. . ,n, the distance di has the property that for Ho, H I ,H2 E D ,

IHo(t) - Hl(t)JI JHo(t)- H2(t)lVt 2 0 implies di(H0,H I ) I di(H0,H z ) . Let G;”(t) := Gi(t)V ~ l [ ~ , ~ zi(s) ) ( t ):= , sup{z E [0,1] : di(Gi,Gi’”)5 t i } and G” := (GS,’z’(s), . . . ,G$””(”). If q = Qp for some 0 < p 5 1 then a lower bound for the optimal target value of (*) is given by

to

.

:= inf{t E [ O , c o ) : G+,c(Gi(t),. . ,Gk(t))2 p } .

Proof: Let H E D” such that d(H,,G,) 5 e,,i = 1,.. . , n . Let v := Qp(G+,co H ) . We will show to 5 v. Define K E D n by K , := G7H‘(”). Note that this implies K,(v)2 H,(v), i = 1,. . . , n. The assumption on d implies that d(G,, K,) I d(G,, H,) I 6,. Hence By the monotonicby the definition of G”, we have G,”(v) 2 K,(v). ity of G+,c (see Lemma 13.2) it follows that G+,c(G’;(v), . . . ,GK(v)) G+,c(Hl(v), . . . , Hn(v)). Furthermore, the right-continuity of H and the continuity of G+,c imply that Ga,c(Hl(v),. . . , H n ( v ) ) L p . Hence, G+,c(G’;(v),. . . ,GK (v)) 2 p which implies to 5 v.

>

To actually compute to, often one has to resort to numerical methods.

Example 13.3: Gto need not be a solution of (*). Let n = 1, d l ( F , H )= l { F ( 0 ) Z H ( O ) ) , € 1 = 0.5 and G ( t ) = t for t E [0,1]. As a consequence of CP being monotone we have @(O) = 0 and @(1)= 1. If p = 1 then z ~ ( s )= 1 for s > 0 and zl(0) = 0. Clearly, G+,c(Gt(t))= G+,c(l)= 1 for t > 0 and G@,c(Go(0)) = 0. Hence, to = 0. But Q1(G@,co Go) = 1 > 0.5 = Qi(G+,c0

A . Gandy

184

13.3.3. Expectation

Solutions for the expected system lifetime (i.e. q = E ) in the special cases of parallel and serial systems with independent components when di(F, H). = IF(x) - H(z)I dx are also possible.

so"

Proposition 13.3: Suppose that di(F,H ) = IF(z) - H(x)I dx,i = 1 , . . . ,n, that q ( F ) = F ( s ) ) d z and that C(z) = n(z) = xi. If q(Gi) < 00, i = 1 , .. . ,n then the following holds.

s,"(l-

n:=,

(1) Suppose that @ i s the structure function of a parallel system, i.e. @(x) = 1- xi). For i = 1,. . . ,n, let & := inf{q E [O,oo) : Jv"(l -

n;.,(l

Gi(z))dz 5 ~ i }a n d P i ( z ) := G i ( z ) l ~ , , b } + l ~ , ~ t }T. h e n ( P I , . . .,fin) i s a solution of (*). (2) Suppose that @ is the structure function of a serial system, i.e. @(z) = n;=,xi. For i = 1,..., n, let 6i := sup{^ E [Gi(O),l] : Jo"(~ - Gi(z))+dz 5 ~ i } and fii(x) := Gi(z) V 6 i . T h e n (Fl,... ,pn)i s a solution of (*). Proof: First, we consider the case of a parallel system. We will show that for any H E D n satisfying di(Hi,Gi) 5 ~i for all i the following holds. For -i each i E { l , . . , n } , H := ( H I , .. . , H i _ l , F i , H i + l , .. . , H n ) satisfies (4)

Using this result sequentially we get q(S+,noF) 5 q(Sa,noH)which is what we want. Due to the symmetry of C = Il and @ it suffices to show (4) for i = 1. Note that G+,n(tl,.. . , tn) = ti. With h ( z ) := Hi(z) and using Lemma 13.1,

nZ1

nZ2


Splitting the integral at

61

185

we can use that h is nondecreasing t o get

) J,"(l - Gl(z))dz. I f f ( & ) = €1 then where f ( ~ :=

(L

00

A

I h(J1)

IHl(z) - Gl(z)ldz - €1) I h(E1)(~1- €1) = 0.

Iff(&) < €1 then since f is decreasing and continuous, & = 0. Hence,

A 5 h(tl) (Lrn(H1(z)- G1(z))+dx -

1

Im(l

- G1(r))dz)

00

I h ( h ) (Lm(l- Gl(z))+dz -

(1 - G ~ ( z ) ) c h )= 0.

This finishes the proof of (4) and as discussed above the proof for the parallel system. Next, we consider the serial system. By the same arguments as for the parallel system, it suffices t o show Y(S?p,nofi4 i d S * , I I o H ) ,

(5)

where H a := (Hll . . . l H ~ - l l F a , H a + l , . . . l Hand n ) H E D n such that d3(H3,G3)5 c3 for all j . Again we may assume i = 1. Note that now Go,n(tl,.. . , t n ) = 1 - t a ) . With h(z) := - Ha(z)),

nz1(l

n;="=,l

A . Gandy

186

If 61 = 1 then F1 (z) = 1 which implies H l ( z ) V Gl(z) - Fl(z) 5 0 and thus A 5 0. If 61 < 1 one can proceed as follows. Since Gl(z) V Hl(z) is nondecreasing and Gl(z) V H l ( z ) -+ 1 as z 00, there exists p E R+ such that Gl(z) V Hl(z) < 61 for all z < p and Gl(z) V H1(z) 2 61 for all 3: 2 p . Hence, G1 (z) V H1(z) < (z) for all z < p and G1(z) V H I (z) 2 fil(z)for all z 2 p . Since h is nonincreasing, -+

where f(.) := som(~-G1(z))+dz.The function f ( ~ is ) increasing and continuous. Indeed, continuity follows from f ( 6 ) = 1 { , > ~ ~ ( ~ ) ) d=~ d a : l{,,G,(,)}dzdu. Since 61 < 1 this implies f(&) = G. Thus,

:s :s

soo0

13.4. Bayesian Approach

The second approach is Bayesian in nature. We assume that the marginal distributions Fe = (Ff, . . . F f ) depend on a parameter 6 = (01,. . . , O P ) E RP. We assume that the parameter 6 is random and follows a known distribution T . Since 6 is random, the quantity of interest q(S@,CoFe)is random as well. We denote the distribution of q ( s * , C o F e ) by G. Explicit formulas for G in the general case cannot be expected. However, in many cases Monte-Carlo simulations be used as follows to obtain an approxmation of G. Let 6(l),. . . , 6 ( k ) be independent random vectors with distribution T . Based on this sample one can compute ai := q(S+,CoFe(;))using numerical methods. Let G ( t ) = l { , i s t )be the empirical distribution based on a l , . . . ,ak. The Glivenko-Cantelli theorem ensures that G(t) converges uniformly to G as k tends to infinity. This approach can be generalized to incorporate uncertainties in the copula. Indeed, one only has to choose a suitable class of parametric copulas

xF=l


187

and assign a distribution to the parameters of the copula. After that, one can use the obvious modification of the above simulation approach.

Example 13.4: Consider a 2-component serial system. Assume that the joint distribution of the failure times is a Marshall-Olkin distribution, i.e. TI = min(21,212), T2 = min(Z2,212), where 2 1 , 2 2 , 2 1 2 are independent and exponentially distributed with rates XI, X2, X l z . The copula of the joint distribution of TI and T2 is a generalized Cuadras-Auge'copulaCa,p(u, v) = min(u'-av,uwl-P) where CY = X12/(X1 X12) and j 3 = X12/(X2 Xl2). Details of this can be found in Chap. 3.1.1 of Ref. 2. Assume that we know that c o . 5 , 0 . 5 is the copula of our system and that TI and T2 are exponentially distributed with rates 61 and 62, where 61 and 8 2 are i.i.d. following a uniform distribution on [0.005,0.015].Then the cdf of the 0.1-quantile and the 0.2-quantile of the system are shown in Fig. 13.2.

+

+

Fig. 13.2. Cdf of Qo.i(FS) and Q o . 2 ( F S ) of a 2-component serial system with copula c0.5,O.S.

If we replace c0,5,0,5by the FrBchet-Hoeffding lower bound copula W(u,v) = max(u w - l , O ) , the product copula ll(u,v) = uw or the Frdchet-Hoeffding upper bound copula M ( u ,w) = min(u, v) the cdf of the 0.2-quantile of the system is as shown in Fig. 13.3. The plots in Fig. 13.2 and Fig. 13.3 are based on the simulation approach sketched at the beginning of this section.

+

188

A . Candy

Fig. 13.3. Cdfs of Qo.z(FS) of a 2-component serial system with copulas (from left to right) W , n, c 0 . 5 , 0 . 5 and M .

13.5. Comparisons

A problem of the approach of Sec. 13.3 is that it only yields a bound. This bound may be too pessimistic. Furthermore, in order to compute this bound one has to solve a nontrivial optimization problem. The advantage is that one does not only consider marginal distributions within a certain parametric class as in the approach of Sec. 13.4. The advantage of the Bayes approach is that it yields a distribution of properties of the system’s failure behavior which may be more realistic than just a fixed bound. Since this distribution can be evaluated using simulation, the Bayes approach is relatively straightforward to apply.

Acknowledgments Support of the “Deutsche Forschungsgemeinschaft” is gratefully acknowledged. I would like to thank Uwe Jensen for his valuable comments.

References 1. T. Aven and U. Jensen, Stochastic Models in Reliability, Springer (1999). 2. R. B. Nelsen, An Introduction to Copulas, Lecture Notes in Statistics, Vol. 139, Springer (1999). 3. H. Joe, Multivariate Models and Dependence Concepts, Chapman and Hall (1997). 4. H. Witting, Mathematische Statistik. I, B. G. Teubner, Stuttgart (1985).


189

5. M. Shaked and J. G . Shanthikumar,Stochastic Orders and Their Applications,

Academic Press (1994). 6. A. Miiller and D. Stoyan, Comparison Methods for Stochastic Models and

Risk, Wiley (2002).


CHAPTER 14 DYNAMIC MANAGEMENT OF SYSTEMS UNDERGOING EVOLUTIONARY ACQUISITION

DONALD P. GAVER Operations Research Department Naval postgraduate School Monterey, C A 93943 USA Email: [email protected]

PATRICIA A. JACOBS Operations Research Department Naval Postgraduate School Monterey, C A 93945 USA Email: [email protected]

ERNEST A. SEGLIE Ofice, Director Operational Test and Evaluation The Pentagon, Washington D C 20301 USA Email: [email protected] Procurement of modern military systems is made timely and effective by invoking evolutionary acquisition and spiral development. This process is dynamic: an initial system version (Block 1) is designed, manufactured, tested, and fielded while next generation’s (Block 2) altered improved subsystems are simultaneously developed (along an upward technological spiral of effectiveness and suitability). Developmental and operational tests determine when Block 2 provides a measurable and operationally significant improvement over, or complement to Block 1. Inferred cost and capability of Block 2 dictates its introduction time, and so on to Block 3, etc. Enemy adaption to the capabilities of current blocks accelerates the transitions to new versions and concepts of operations (CONOPS); otherwise the current Block eventually becomes technically obsolete. Concepts of effectiveness and suitability growth, and

191

192

D. P . Gaver, P. A. Jacobs, and E. A. Seglie

mutation, must be encouraged and quantified, initially using exploratory models, but later tested against challenging but realistic opposition and environments. Such exploratory models are furnished.

14.1. Setting The new US. Department of Defense (DoD) acquisition regulations state that “the primary mission of Defense acquisition is to acquire quality products that satisfy user needs with measurable improvements to mission capability and operational support, in a timely manner and at a fair and reasonable price” (DoD Directive 5000.1). “Evolutionary acquisition is the preferred DoD strategy for rapid acquisition of mature technology for the user. An evolutionary approach delivers capability in increments, recognizing up front the need for future capability improvements” (DoD Instruction 5000.2). Thus, a military system is fielded in a series of Blocks (partial or total system upgrades), each Block desirably being more capable and suitable than the previous ones. The improvement should be testable and adequately tested in a field environment. Modeling and Simulation (M&S) techniques are to be used to plan, preview, and rehearse such tests, but not to substitute for them.

14.1.1. Preamble: broad issues The types of systems involved are one-shot/destructable (missiles), vehicles (land, sea, amphibious in groups), C4ISR systems; all in end-to-end operation. The time to develop and test a new block is typically several nominal one-year budget cycles, but can also be event-driven-sequential. There can be many reasons to initiate design of a new Block, b + 1, say, given Block b is in some stage of testing or field employment. Anytime such a block initiation starts, it typically encounters engineering/technical problems that will take time to resolve, and also incurs unpredictable and somewhat uncontrollable costs; these two features are inter-related and are generally categorized as project (Block b 1) risk. At present, such risk is put into broad categories by “expert judgment,” so choices are made subjectively, and it is assumed that mistakes can be corrected subsequently, either by within-Block b modification, or after a new block is fielded. The latter is apt to be especially costly, time-consuming, and even unsafe, so alternative options are important; the evolving planning tool Real Options (see Glaros’) is being examined as a systematic way to study this entire life-cycle process.

+

Dynamic Management of Systems Undergoing Evolutionary Acquisition

+

193

Timing the start of a new block (the ( b l)st)is an important decision problem: a relatively long time between blocks may, and is desired to mean, that upon introduction, the new ( ( b + l)St) Block is considerably more capable than is Block b, where capability is a composite of performance and Effectiveness and Suitability, which includes Reliability, Availability, Maintainability, and Safety (RAMS); RAMS is a crucial aspect of Suitability. However, there is a tendency for a new ( ( b + l)St) Block to have undesirable features such as too much weight and to cost more than Block b unless vigilance is strongly exercised; unfortunately, such undesirable features often have shown up undesirably late in the acquisition cycle (during Operational Test (OT) or even field experience). This surprise may negate the promise of the new Block, at least temporarily for certain missions and concepts of operations (CONOPS). Also, if Block b is in place too long, opponent adaptation to its initial capability may greatly degrade that capability; this may be called operational obsolescence. These issues argue for built-in dynamic flexibility and operational effectiveness tracking; unexpected field modification can sometimes be essential, but is better avoided by careful early design and testing. Generally, design modifications are most cost-effective if made early in an acquisition evolution. A relatively short time between issuance of successive blocks may provide for quick response to surprises, either from opponent action or from unanticipated misbehavior of the system itself. Actual large losses (attrition) of the systems in Block b may be tolerable if Block b 1 is nearly ready, or its development can be accelerated. On the other hand, a short between-Block time interval can mean that more modest increases in capability are likely, and that there must be more frequent developmental testing (DT) and operational testing (OT) to validate the quicker succession of new Blocks. A compromise must be sought and justified. Tradeoffs can best be understood by systematic not-excessively-detailed end-to-end preview modeling. Real Options should be defined and compared, initially by M&S. Real Options refer to maintenance of future flexibility in program deployment, e.g., the option to (a) defer investment in a technology using one of several alternatives, (b) to contract differently, at a different pace, (c) to change scale/level/pace of acquisition, (d) to plan to operate in the field differently, or any combination thereof.

+

194

D . P. Gaver, P. A . Jacobs, and E. A . Seglie

14.1.2. Testing Consider a system that is undergoing evolutionary development; it will be fielded in successive blocks. Each Block will undergo DT, OT, and eventually fielding. DT is testing at the component-subsystem level, and is the optimum period in which to rectify Design Defects or Failure Modes. OT is intended to closely imitate field operational actions, e.g., using military (“soldier”) operators and maintainors, thus revealing different Failure Modes for removal. They can well be coordinated much more nearly “in parallel,” or combined, than is current practice. Efforts in that direction are encouraged. This should include total system testing in scenarios that include “Red Team” opposition. In this initial simple discussion we combine both developmental and operational testing into one test phase. Similar results can be obtained for the more general situation. Suppose Block b 1 is starting development. We assume there are D(b 1) design defects (DDs) that can be discovered and removed from Block b 1 design, and copies thereof during testing (the number is unknown but characterized by a probability distribution). Those DDs not removed by testing can activate in the field, leading to costly repairs and decreased system availability for missions. Tests should be designed to reveal those DDs most likely to occur under realistic field environments. Inevitably, some DDs will remain in each block; they are candidates for later correction. In this chapter, we consider a model for the development of a oneshot destructable system, e.g., a missile. Although such systems realistically function in a nearly sequential fashion, so that later stages (e.g., the warhead) can only be tested if early stages (e.g., initial propulsion, booster, guidance, etc.) function properly (any existing early stage DDs do not activate and cause early failure, inhibiting the test of later stages, see Gave?), we postpone treatment of this real issue for the present. We assume a version of the system (Block b ) has been fielded at time 0. A new version of the system (Block b + 1) is presumed, (arbitrarily) starting development at time 0. Time and money spent on the development and testing of Block b + 1 should ultimately result in a system which is more capable than Block b but which may have a number of new different DDs. Alternatively, Real Options will possess their own virtues and faults to be discovered by test. Once Block b 1 is deemed sufficiently capable and sufficiently free of DDs, it will be appropriate to field it to conduct missions in place of Block 6. Naturally, if too much of the budget has been committed to development and testing, then little will remain to purchase units of the improved Block

+

+

+

+


195

b + 1 in order to conduct missions. An appropriate balance must be struck. A modeling, analysis, and evaluation scheme such as we propose should guide this evolution. In Sec. 14.2 we introduce the model and in Sec. 14.3 we present numerical examples. 14.2. Modeling an Evolutionary Step 14.2.1. Model for development of Block b 4-1

+

The ultimate probability of mission success for Block b 1 after development and testing depends in part on the funding allocated to development and its rate of expenditure. The development process should not only increase the effectiveness of Block b + 1, but can also introduce DDs which can be removed by testing. Let Td(b 1) be the total time to develop and test the design and manufacture of Block b 1. Let M(Td(b + 1)) be the total funds spent to develop and test Block b 1; m ( T d ( b 1)) = M(Td(b l ) ) / T d ( b 1) is the average rate of that expenditure. A parametric model for the conditional probability of mission success after expenditure of M(Td(b+ 1))at a rate m(Td(b 1))given no remaining DDs activate during the mission, is of the form

+

+

+

+

+

+

+

Pd

= p*(b

( b + 1; T d ( b + 1); M (Td(b + 1)))

+ 1)Gd [b+ 1; M (Td(b + 1)); m (T’(b + l))],

(1) where p * ( b 1) is the maximum achievable probability of mission success (summarizing operational effectiveness) and Gd[b + 1; M ( T d ( b + 1)); m ( T d ( b l))] is the fraction of the maximum achieved as a result of the development process. The specific parametric example used for illustration is

+

+

Gd

[b+ 1; M (Td(b + 1)) ; m (Td(b

+

+

+ I))]

= [ I - exp {-alM (Td(b 1))=’}] exp {-a2 [m(Td(b I))=*]}, (2) for a, > 0, ai > 0 €or i = 1, 2. Of course (1) and (2) are hypothetical and speculative, but are plausible, and certainly subject to revision and/or refinement. Note that the fraction of the maximum effectiveness achieved, Gd, increases as the funding expended on development, M ( .), increases; while the overall fraction of possible success G d achieved decreases as the time-rate of expenditure increases (the “haste makes waste” effect). Other parametric forms are possible, but the present is illustrative, and can be sequentially estimated parametrically (ai > 0, ai > 0 for i = 1, 2 can at least

196

D. P . Gaver, P. A . Jacobs, and E. A . Seglie

be block-dependent) . It is presumed that performance level should increase at an eventual decreasing (saturating) rate with development budget ( M ) , but can be penalized by a too-rapid attempted rate of improvement (rate of expenditure, m).

14.2.2. Introduction of design defects during development

and testing We assume the number of DDs introduced during initial development has a Poisson distribution with (conditional) expected value (3)

where a2 is not necessarily = a3 > 0 above; both (2) and (3) are illustrative and subject to change as test data accumulates. K Omay be partially random, but also allowed a deterministic regression component, introduced to represent between-copy and environmental variability in Block b 1. In this model, the expected number of DDs introduced during the development process increases as the rate of expenditure for development increases. Less extreme variation can, of course, also be represented, and the growth function G d should be sequentially re-estimated as the b lStdevelopment progresses. It is assumed that at least some of the DDs introduced during development can be found during testing and removed; this is a costly and timeconsuming process. In this chapter, we will mingle/pool DT and OT; such intermingling is a proposed current trend. Each remaining DD can be activated during a test with probability 1- 8, more generally, each &value can be chosen at random and held fixed; such more complex analysis is avoided here. More than one DD may be activated during a test and, desirably, removed. Here DDs activated during a test are presumed to be successfully removed (an optimistic simplifying assumption that can and should be relaxed). The testing policy is to allocate ~ T d ( b 1) DT/OT tests: The decision parameter T is an average number of DT/OT tests conducted per time unit of development. Each test uses/expends one copy of Block b 1 at a unit cost of c,(b+ 1).Additionally, each test costs c t ( b + l ) .Each DD discovered during a test is removed at a cost of cT(b 1). By results for the present simple Poisson/binomial model, the conditional distribution of the number of DDs remaining after development and testing, given K O ,is represented

+

+

+

+

+

197


by a Poisson distribution with mean (hasty expenditure induces more DDs):

+

+

+

E [ D( b 1; M (Td(b 1)) ; Td(b 1); 7)I K o ] = K , , ( ~~ ~+(1))"3 b eTTd(b+l).

(4)

We assume that DDs remaining in Block b + 1 after fielding have the potential of causing mission failure if activated during a mission. Let OF be the probability a DD remaining in Block b + 1 after fielding does not activate during a mission. The conditional probability of mission success for Block b 1 after completion of development and testing given the number, D ( . ) , of remaining DDs is

+

+ 1lD ( b + 1; kf(Td(b + 1 ) ) ; T d ( b + 1 ) ; D(bt-1; M ( T d ( b + l ) ) ; T d ( b + l ) ; ~+ 1); ( M b ( ~ ~+ ( 1))) b eF (b

pF

= pd ( b

+ 1; ~

T)) 7).

(5)

Note that all fielded copies of Block b+ 1will have the same remaining DDs since they all are constructed according to the currently evolved design. This is a simplification that does not hold for certain system types, e.g., copies of a particular Navy ship design. Nor is manufacturing and environmental variation represented here.

14.2.3, Examples of mission success probabilities with random K O a) Suppose first that KO = k, a constant; then the probability that, after fielding, no remaining DDs activate during a mission is D ( b + l ; M(Td(b+l));Td(b+l); [eF

= exp

"I

{ -km (Td(b + 1 ) ) Q 3O r T d ( b + l ) ( l

-OF)}.

(64

b) Alternatively, assume K Ois random with a gamma distribution, scale v > 0, shape parameter 0 < P, and Laplace transform E [e-sKo] = [l (s/v)]-'. This is the classical modification of the Poisson that leads to the negative binomial.

+

[e,

D ( b + l ; M ( T d ( b + l ) ) ; Td(b4-1);

=

[I+[

m (T&

"I

(6b)

+ 1))03 v

eTTd(b+l)

(l-eF)ll-p.

Further randomization is possible and mathematically tractable (e.g., randomization of 0 in the above exponent).

D. P. Gaver, P. A . Jacobs, and E. A. Seglae

198

c) Assume next that K Ois a random variable with a standard positive stable law distribution with scale u > 0 and order 0 < P < 1 and Laplace transform E [e-saO] = exp { -(s/v)O}; see Feller.3 Assume KO is the minimum of the stable random variable and a truncating exponential random variable having mean l / ~in;this case the Laplace transform of K Ois E [ e - s K o ] = K / ( K s ) S / ( K s) exp - ( ( s K ) / V ) ’ ) and

+ +

[1

{

+

+

1

E[Ko]= (l/n) - e-(n/v)P . The probability that no remaining DDs activate during a mission is

(6c)

where

+ 1) = m ( ~ d ( +b 1))*”e T T d ( b + l )

(1 - O F ) . Such auxiliary randomizations have been called “double stochasticity” (c.f. D. R. COX,^ M. S. B a ~ - t l e t tM. , ~ S. Bartlett,‘ and D. R. Cox;’ they can usefully represent environmental variation between (within) missions and/or manufacturing or configuration variability between manufactured copies. Its introduction is a form of sensitivity analysis. If K = 0, then the probability of field success is simply s(b

[e,

D(b+l; h f ( T d ( b + l ) ) ; T d ( b + l ) ;

= exp

{

-

[YIJ + s(b

I

T)

1)

(6d)

14.2.4. Acquisition of Block b 4-1

+ +

+

Let B(b 1) be the total budget to develop, test, and procure Block b 1. Let c,(b 1) be the cost per copy of Block b 1; ct(b 1) be the cost per test; c,(b+l) be the average cost to remove a discovered DD. The expected budget remaining after development and testing is

+

+

+ 1) = B(b + 1)- M ( T d ( b+ 1)) - [cm(b+ 1) + ct(b + l)]T T d ( b + 1) -c,(b + l)E [DR( b + 1; T d ( b + 1); , (7) where D R( b + 1; T d ( b + 1); is the number of DDs removed as a result B#(b

T)]

T)

of testing. After development and testing, the mean number of copies of


+

199

+

Block b+ 1that can be fielded is N F ( ~ 1) + = (B#(b l)/c,(b 1)). Each of these copies has the same remaining DDs in this initial model, and hence has the same probability of field reliability/suitability. This simplification is a strong candidate for relaxation.

14.2.5. Obsolescence of Block b and Block b

+1

Operational (and physical) obsolescence (i.e., the loss of effectiveness due t o enemy countermeasure adaptation, and/or physical aging, dearth of spare parts, etc.) is to be anticipated, and is a powerful reason for Block upgrading. Assume in advance that Block b will become obsolete after an independent exponential time having mean l/w(b); a statistical test for obsolescence, (i.e., a run of f 2 3, say, failures) can signal a need for change, e.g., in Block design or CONOPS. After obsolescence, the probability of mission success for Block b is p o ( b ) < p ( b ) ; p o ( b ) may be close to zero. Assume a fielded Block b + 1 can also become obsolete after an independent exponential time having mean l / w ( b 1). After obsolescence, the probability of mission success for Block b 1 is p o ( b 1) < p ( b 1).If Block b becomes obsolete before the completion of development and testing for Block b 1, then a decision can be made to continue to field Block b, or to field the current Block b 1 prematurely. We defer discussion of this possibility; see Gaver.8 In this chapter we will assume that Block b is completely ineffective after obsolescence; that is, p o ( b ) = 0; we also assume that Block b 1 is completely ineffective after obsolescence. Sequential real-time detection of obsolescence is an open problem, well worthy of attack.

+ +

+

+

+

+

+

14.3. The Decision Problem Suppose for the present (one special case} that Block b does not become obsolete before the end of development and testing of Block b 1. The decision is whether to use the budget remaining after development and testing of Block b 1 to purchase copies of Block b 1, or to use it to purchase more copies of Block b. Suppose that each mission uses one copy of a Block. DDs remaining in Block b 1 after fielding can cause mission failure. The decision criterion will be to maximize the expected number of successful missions. The decision is to allocate that amount of the budget, B(b l), to upgrade Block b 1 so the expected number of successful missions by the copies of Block b + 1 procured with the remaining budget is maximized. Assume that missions arrive according to a stationary Poisson process

+

+

+

+

+

+

D. P. Gaver, P. A . Jacobs, and E. A . Seglae

200

having rate A. Let N F ( ~be ) the number of copies of Block b that can be purchased using B ( b 1). The number of mission successes if Block b is purchased exclusively is denoted by Sg ( N F ( ~ )Then ).

+

(8)

There is a similar expression for the conditional expected number of successful missions given the remaining number of DDs if N F ( + ~ 1) copies of Block b 1 were fielded; that number of successful missions is S b + l ( N F ( ~ 1)).It is seen that

+

+

E

[Sbfl

+

( N F ( ~ 1)) ID ( b

= [h+w(b+l)

+ 1; M (%(b 4- 1)) ; T d ( b

1); T ) ]

lNF(b+l)

+ 1lD ( b + 1; M (%(b

1)); T d ( b

+

+

x N F ( b $- 1)PF ( b

+

+ 1);

T))

(9)

The distribution of D(b 1; M ( T d ( b 1)); T d ( b 1); T ) can be Poisson ( K O= k), or Gamma-Poisson (negative binomial), or (Truncated) Stable Poisson.

14.4. Examples The parameters for the numerical examples appear in Table 14.1. The total budget for development, testing, and procurement of Block b + 1 is $2000K. Development budgets $100K, $200K, and $400K are considered. Each of these budgets can be spent over an integer time interval length T d of 1 time period, or alternatively, 5 time periods. The rate of DT/OT testing ranges in integer values from 1 to 100 tests per time period. The proportionality constant, K O is constant with value 0.0002. Table 14.2 summarizes the gains made by an appropriate choice of time for development and testing. If Block b 1 is not developed and units of Block b are bought with the budget, then the expected number of mission successes is 120 (so developing

+


201

+

and buying Block b 1 is advantageous in this case; our model provides useful quantitative support for such decisions). Table 14.1. Parameters. Total budget Development budget Development (spiral) time Rate of development expenditure Mean number of tests per unit time Cost per copy Block b Cost per copy Block b + 1 Cost of a test Cost removing each DD found during test Mission arrival rate Probability mission success Block b Utopian requirement: Probability mission success Block b + 1 Parameters of effectiveness growth

Parameter for introduction of DD Rate of obsolescence Block b Rate of obsolescence Block b 1 Probability DD survives test Probability DD survives mission Proportionality constant for effectiveness

+

+

B ( b 1) M Td(b + 1) m = M / T d ( b 1)

+

7

Cm (b) cm(b 1 ) ct(b 1) cr(b 1)

+ + +

x P(b) P*(b 1)

+

2000 variable variable variable variable 1 1.2 1 3

100 0.4 0.85

a1

0.05 2

a2

0.002

a2

0.8 2 0.33 0 .2 0.85 0.8 0.0002

a1

03

4) w(b

+ 1)

e

OF

KO

Table 14.2 displays the number of tests that maximizes the expected number of successes for Block b + 1 once it is fielded; also displayed are the expected number of mission successes for Block b 1. Discussion: It is noticeable that for the situations presented above, the optimum expected number of mission successes occurs for a 5% budget (B) expenditure on Development and Testing, and for (tabulated) minimum rate of development expenditure. This leads to significantly less testing than do other options, and to a noticeable gain in successful missions. Of course, different parameterizations can lead to quite different outcomes. It is important to expand the above analysis to dynamic conditions. Study of sequential parameter estimates is strongly endorsed and is in progress. Tables 14.3 and 14.4 display the expected probabilities of mission success after development and testing according to the policies of Table 14.2 for

+

D. P. Gaver, P. A . Jacobs, and E. A . Seglae

202

+

Table 14.2. Maximum expected number of successes for Block b 1 after development and testing; [maximizing number of tests]; total budget = $2000K.

M / T : rate of expenditure of development budget M / B : fraction of total budget used for development 0.2 = 400/2000

20 = 40 = 80 = 100 = 200 = 400 = 10015 20015 40015 10011 20011 40011

366 [301

0.1 = 200/2000

301 [481

347 PSI

386

~ 5 1 0.05 = 100/2000

397

373

[35

[15]

different distributions of K O .In Table 14.3, the distributions considered are K O= 0.0002; K Ohaving a gamma distribution with shape parameter 0.5 and mean 0.0002; KO having a positive stable law distribution with order equal to the shape of the gamma and scale the same as the gamma; K O having a truncated stable law distribution with the same scale and order as the stable and the exponential truncation rate K. chosen so that the mean is equal to 0.0002. In Table 14.4 the distributions of K Oare the same except the shape of the gamma and the order of the stable law are 0.1. The policies in Tables 14.3 and 14.4 are for K O= 0.0002. Table 14.3. Expected probability of mission success for Block b + 1 after develop ment and testing; constant K O= 0.0002; [gamma K Oshape parameter 0.5 and mean 0.00021; {stable KOwith order (scale) equal to shape (scale) of gamma); (truncated stable K O ) .

M / T : rate of expenditure of development budget M I B : fraction of total budget used for development 0.2 = 400/2000

20 = 100/5

40 = 200/5

80 = 400/5

100 = 100/1

200 =

200/1

0.80 [0.79] 70.75)

0.67 [0.66] f0.62) i0.67j

io.soj 0.82 [0.81] (0.78)

0.1 = 200/2000

0.74 [0.73] (0.74) (0.74)

(0.82)

0.05 = 100/2000

0.83 [0.83] (0.79) (0.83)

400 = 400/1

0.78

[o.m] (0.75) (0.78)


203

Discussion: The expected probabilities of mission success are nearly equal for the moment and shape matched versions of constant, gamma, and truncated stable K O except , for stable with ,O small (0.1). This may be due to the very exaggerated shape of the pure stable law with this shape parameter; there can be many small values versus a few very large. The mean number of DDs introduced when K Ohas a pure (untruncated) positive stable law is infinite and the expected probability of mission success after development and testing is much less than the others; the smallest expected probabilities of mission success occur for the stable law of order 0.1. This suggests the need for a sequential stopping rule, a problem under current investigation. Table 14.4. Expected probability of mission success for Block b + 1 after development and testing; constant KO = 0.0002; [gamma K Oshape parameter 0.1 and mean 0.0002]; (stable K Owith order (scale) equal to shape (scale) of gamma}; (truncated stable KO

M / T : rate of expenditure of development budget M / B : fraction of total budget used for development 0.2 = 400/2000

20 = 100/5

80 = 400/5

100 = 100/1

200 = 200/1

0.79 [0.79] (0.41) (0.80)

0.1 = 200/2000

0.05 = 100/2000

40 = 200/5

0.67 [0.66] (0.33) (0.67)

0.82 [0.81] (0.43) (0.82) 0.83 [0.83] (0.43) (0.83)

400 = 400/1

0.74 [0.73] (0.38) (0.74) 0.78 [0.78] (0.41) (0.78)

14.5. Conclusion and Future Program The problem discussed is simple and generic, and widely encountered in defense acquisition. In subsequent work we propose to more extensively explore the above models, conditions and issues, and to provide more refined operational tools to guide the timing of evolutionary cycles; Bayesian methods and sequential success run criteria suggest themselves. We will also consider elsewhere the development and testing of systems consisting of subsystems in series. As stated above, we also plan to consider TestAnalyze-Fix-Test (TAFT) testing policies with a sequential stopping rule

204

D. P. Gaver, P. A . Jacobs, and E. A. Seglie

based on first occurrence of a run of successful (no DDs activating) operational tests; see Gaver.2 Simulation and more analysis will be designed to assess the procedure’s robustness. Application to Interim Armored Vehicle, IAV (STRYKER) acquisition and testing is underway. References 1. G.

Glaros, http://www.oft.osd.mil/library/library-files/trends-205 -transformation-trends-9-june% 202003-issue.pdf (June 4,2003). 2. D. P. Gaver, P. A. Jacobs, K. D. Glazebrook, and E. A. Seglie, Probability models for sequential-stage system reliability growth via failure mode removal, Znt. J. Rel., Qual., and Safety Eng. 10 ( I ) , 15-40(2003). 3. W. Feller, An Introduction t o Probability Theory and Applications, Vol. 11, Wiley, New York (1966). 4. D. R.Cox, Some Statistical Methods Connected with Series of Events, JRSS B 17,129-164 (1955). 5. M.S.Bartlett, Discussion of paper by D. R. Cox, JRSS B 17,159-160(1955). 6. M. S. Bartlett, Inference and Stochastic Processes, JRSS A 130, 457-477 (1967). 7. D.R.Cox and V. Isham, Point Processes, Chapman and Hall, London (1980). 8. D. P.Gaver, P. A. Jacobs, K. D. Glazebrook, and E. A. Seglie, System reliability growth through block upgrade, to appear (2005).

CHAPTER 15 RELIABILITY ANALYSIS OF RENEWABLE REDUNDANT SYSTEMS WITH UNRELIABLE MONITORING AND SWITCHING

YAKOV GENIS Borough of Manhattan Community College City University of New York New York, New York 10007 USA ygenis@bmcc. cuny. edu

IGOR USHAKOV Canadian Training Group San Diego, CA USA iushakov2000@yahoo. com Two methods of approximate evaluation of probability of no-failure operation and maintainability of renewable redundant system is suggested. The model takes into account incomplete monitoring of units state and not absolutely reliable switching device. Fast restoration, fast unit failure detection, and fast standby switching are assumed. A comparison of approximate estimates of reliability indexes with exact calculated results and simulation results shows practical applicability of suggested methods.

15.1. Introduction

Delays in unit failure detection due to inadequate testing, belated switching in of standby units in case of standby redundancy (SR) as a result of unreliable operation of switching and testing devices, and the introduction of additional faults and “false” failure during periodic testing (PT) substantially reduce the reliability of redundant systems. To find the actual system reliability, one must take into account all factors associated with incomplete testing, unreliable operation of test and switching devices, and also the effect of periodic testing on system performance. 205

206

Yakov Genis and Igor Ushakov

The reliability of certain particular systems was calculated in Handbook of Reliability Engineering and Gnedenko and Ushakov2 assuming that the no-failure operation and unit restoration times as well as the standby unit switching time and the time between two consecutive tests have exponential distribution functions (DF). These works indicate that even if the system behavior can be described by a Markov process, exact calculation of reliability is possible only for relatively simple systems. For more complex systems, some heuristic methods are suggested in Handbook of Reliability Engineering,' and Gnedenko and Ushakov.2 In the present paper the ideas proposed in Genis3 and G e n i ~are , ~ further developed and more precisely stated, and the domain where they can be used in practice for approximate evaluation of the reliability is defined.

15.2. Problem Statement A renewable redundant system contains n units and r repair facilities (RF). The DF of time to failure for each unit is assumed exponential. A unit might be in one of the two states: operational or nonoperational (failed). The unit serviceability testing is incomplete; that may delay detection of a unit failure. Accordingly, a nonoperational unit can be in a state of detected or undetected failure. In systems with SR, the units are divided into active and standby ones. If an active unit fails, its functions are performed by a standby unit. Switching device itself is not absolutely reliable; switching device can delay switching and thus reduce efficient utilization of standby resources of the system. As soon as a unit is detected as failed (real or false), the renewal of this unit should begin. Every unit has at least one RF which is capable to restore it. One RF can simultaneously restore not more than one unit, and one unit can be simultaneously restored by not more than one RF. Unit restoration is complete and restoration begins if there is an available RF. No constraints are imposed on unit restoration time DF. There are no restrictions to the structure of the system. The system is said to be failed if the domain of the states of its units belongs to a specified set of states. The system is assumed to be provided with fast servicing (FS). This concept is defined more accurately in Sec. 15.4. Its practical meaning is that the unit restoration time, the unit failure detection time, and the standby unit switching time are negligible in comparison with the time between any two unit failures including those taking place during PTs. This also means that the probability of events directly responsible for an

Reliability Analysis of Renewable Redundant Systems

207

SR system failure as a result of noninstantaneous standby unit switching or of noninstantaneous detection of an active unit failure is low. Thus, FS entails fast restoration (see Genis3), fast and mostly instantaneous detection of unit failure, fast and mostly instantaneous standby unit switching, and a low rate of additional failures occurring during periodic tests. The problem is to estimate the reliability and serviceability indexes of a system under FS conditions. 15.3. Asymptotic Approach. General System Model The state of system units is assumed to belong t o a malfunction interval (MI) if even one of its units is in a state of detected, undetected, or false failure and to a serviceable interval (SI), otherwise. An MI is called a failure MI if system failure occurs within this interval. It means that in this MI at least once the system will exhaust its reliability reserve. The system can fail in some MI more than once. System behavior is described by an alternating random process in which MIS and SIs follow each other. The behavior of such systems has been analyzed in G e n i ~ . ~ Let us assume that the system operating conditions and the units nofailure operation time and restoration time DF do not change with time. The system to be discussed is assumed to be highly reliable. Since the probability of failure of such a system in its nonstationary operation region can be made small enough, its behavior in the stationary operation region becomes of primary importance. The results of Genis3 indicate that in such a case the DF of the time to first failure converges to an exponential function if the product of the rate of occurrence of MIS by the maximum mean duration of the malfunction interval T as well as the probability of system failure q in the MI interval tends to zero. If also the probability q* of more than one system failure taking place in the MI tends to zero, the DF of the time between two system failures converges to an exponential function. The FS criterion defined below ensures conditions in which AT -+ 0, q 3 0 and q* -+ 0. 15.4. Refined System Model and the FS Criterion

In the following we discuss one possible model of a system with incomplete testing and unreliable unit switching. Other models of such systems can be analyzed by a similar technique. The important condition for such systems is that the FS criterion should ensure small T , q, and q*. The systems to be discussed are systems with SR. Let Fi(z)and mi be

208

Yakov Genis and Zgor Ushakov

respectively the DF and the mean operating time of the i-th unit and let Fi(x) be fixed. The probability of instantaneous detection of the i-th active unit failure is p l i and that of the i-th standby unit is p2i. When a failure of an i-th active unit is detected, the probability of instantaneous switching to a standby unit is psi; let Hi(z) denote the DF of switching time to the standby when a failure of the i-th active unit is detected and the switching is not instantaneous. An undetected failure of an i-th unit can be found in the course of periodic tests with a probability p4i; the distribution function, mean time between two PTs, and its second moment are denoted by a(.), mpt,and m$) respectively. The DF of the time from the beginning of an MI to the first PT after the MI begun is given by

and

r

Here and below = 1 - r for all r. The DF of the time to detect the failure of i-th unit under the condition of no instantaneous detection of this failure is Bi(z),and its mean is given by

The probabilities of a false signal being generated to indicate a no existing failure of a serviceable active and standby unit are psi and psi respectively. Let G,(z) be the DF of the restoration time of the i-th failed unit and Gli(z)an analogous function when a false failure of the i-th unit is indicated. In addition, let s be the minimum number of units whose failure causes system failure; G(z) = mazG,(z , ~ ( z=) maxZ,(z),B(z) = mazBi(z), where i E 1,n; m?), mg), m$, and m f ) are the j-th moments of the (1) DF G(z),Gl(z), H ( z ) ,and B ( z ) ;and let m, = rn?),ml, = m,, ,m, = 1) (1) m, ,mk = mk . Under stationary system operating conditions the rate of occurrence of MIS is estimated as n

n

i= 1

k l

209


In practically important cases m(j)5 C(m)j (subscripts omitted), and the FS condition Genis3 can be written as

a1 = imaz(m,, ml,, m,,

m k ) + 0.

For systems with SR an additional condition is a2 =

max j j l i + 0,

lsisn

a3 =

max jj3i lsisn

+ 0.

The obtained reliability estimates are valid when a = m a z ( a l , a 2 ,a3) I 0.1 since their error is of the same’order as a. 15.5. Estimates of Reliability and Maintainability Indexes

A failure in which a system persists for a t least a time z is called an z-

failure, and let fiz denote the rate or z-failures taking place in the system under stationary conditions. It can be shown that the desired reliability indexes can be found in terms of the fiz. Under FS conditions the distribution functions of system operating time to first failure, of the time between two failures, and of the no-failure operating time are nearly exponential. The mean time t o failure and the mean time between failures can be assumed to be approximately equal t o the mean no-failure operating time of the system. Then, assuming in ,& z = 0, we will receive the system failure rate = /?o, the estimation of no-failure operating time T M l/p, the estimation of DF of no-failure operatin$ time 1-exp{ -fix}, the estimation of DF of system restoration time 1-&/p, and the estimation of mean system restoration time in the form of ,hz,drc/p). Under FS conditions fiz is found as the sum of x-failure rates of the system along monotonous paths G e n i ~ i.e., , ~ paths along with no single restoration can be completed during the time from the beginning of the MI until system failure on this interval plus the time rc; SR system requires in addition that no single standby switching can be completed and no single active unit failure is not instantaneously detected during that time. The rate of rc-failures along some monotonous path is defined as the product of the rate of occurrence of MIS at which a given path can start and the probability of z-failure along this path. The obtained estimates are then simplified in accordance with the results obtained in G e n i ~ . ~ To simplify the calculation of estimates only minimal monotonous paths are used on which the probability of system failure is substantially greater than on nonminimal paths. Other conditions being equal, the number of failed units that cause system failure is the least along minimal paths.

a

(s,”

210

Yakov Genis and Zgor Ushakov

Thus, in case of instantaneous switching of standby units and instantaneous detection of active unit failures, one only takes into account those paths along which system failure takes place with the failure of minimal number of units. In case of noninstantaneous standby switching or noninstantaneous active unit failure detection, only those paths are taken into account along which the noninstantaneous switching or noninstantaneous detection takes place with failure of the first unit in this MI. If only the system reliability indexes are needed, then the ,6 can be found immediately. It should be also noted that the rate of x-failures of a system can be used to estimate the reliability indexes of systems with time redundancy. The obtained results can be probably extended to the case when the DF Fi(z) are absolutely continuous. In this case the rate of the occurrence of MIS in stationary system operation can be estimated by value n

n

where ci is the value at the zero of density of Fi(x), ci = F,(O). The above method is illustrated with the following examples in which the approximate estimates have been found to be close to either exact values or to values obtained by simulation.

15.6. Examples Unloaded Duplication with Nonreliable Switching. The system consists of two identical units, one active and one standby, and a switch. The standby unit is unloaded. As soon as the active unit fails, the switch substitutes for it the standby unit. A unit is said to be active from the instant it is put into operation until it is replaced with another unit. During this time the second unit is said to be a standby unit. Let F ( x ) , c, and m be the distribution function, density at zero, and the mean no-failure operating time of the active unit. The distribution function of the time of switching the standby unit in place of the active unit is L ( t ) = p3+jj3H(t), 0 I p3 i 1, j j 3 = 1-p3, where H ( t ) is the distribution function of some random quantity with a mean m,. Switching takes place when the active unit fails, provided the standby unit is serviceable. Restoration of the failed unit begins as soon as switching is completed. The system has a single RF. The unit restoration time distribution function is G(x) with a mean m,. After restoration, the unit acts as a new one.


211

The system fails when the active unit fails, the standby unit is not yet restored or when unit switching is not instantaneous. At the beginning both the active and standby components were serviceable and new. Here we obtain an approximate solution and compare it with the exact one. Let us estimate fiz = fiL1) where ,&') is due to x-failures of the system caused by no instantaneous standby switching and ,6i2)is x-failures rate because of that, that in the moment of failure of the active unit the restoration of the standby unit was not yet finished. Then,

+ fii2',

A = 2b3R(x) + p3 m

s,

W

q t + x) d F ( t ) ] ,

and the FS conditions have the form

max(mT, m,) * max(1 / m , c ) The approximate estimate of

-+

0,

p3 4 0.

6 under FS conditions is given by

If T o is the mean time between system failures and T 1is the mean time to the first system failure, the exact solution has the form

i.e., agrees well with ,8. To estimate Tr we have

M

b3m, + 0.5p3cm?)]/[Tj3 + p 3 ~ m r I r

which also agrees well with the exact solution. It should be noted that the coincidence of approximate estimations of and T, with the exact solutions is excellent over a wide range of p3. But the condition FS p3 --f 0 must be observed to ensure that the DF of the no-failure operating time of the system is exponential. Loaded Reserve, No Instantaneous Standby Switching, and No Instantaneous Detection of Standby Component Failure. The standby redundancy

212

Yakov Genis and Igor Ushakov

system described in Sec. 15.5 is discussed. The system has one RF, 1 active and one standby units. The reserve is loaded. Since all components are of the same type the subscript a denoting the unit number in Sec. 15.4 is omitted. The failure of an active unit is detected instantaneously. Since, only the state of the standby component is checked during periodic testing, p5 = 0. System failure occurs when at least one active unit fails and cannot be replaced because of one of the events: or if the standby switching is not instantaneous, or if no serviceable standby unit is available. FS conditions are satisfied. To estimate ,& we consider that under stationary conditions the DF of the residual no-failure operating time has the form of an integral of F ( u ) / m , where u E [0,z]. Let

m,(z) =

I"- ,&:+ G(u

z) du, m, = m,(O).

Let us estimate the terms of 1) one of 1 active units failed, standby switching is not instantaneous:

/32) = p3 1E(z)/ m; 2) one of 1 active units failed, standby switching is instantaneous; before restoration is completed one more active unit failed and standby switching is instantaneous (noninstantaneous switching is only taken into account in the estimate of :

Bi'))

3) the standby unit fails, failure is detected, and before restoration is completed one active unit fails, the switching is instantaneous:

,8i3)M

1"- + 1

G(t z) 1 p3 F(t)dt / m2 M

p2

p2 p 3

1 m,(z) / m2;

4) the standby unit fails, failure is not detected, and before failure is detected one active unit fails, the switching is instantaneous: 00

,8i4)M P2

B(t)1 p 3 F ( t )c(z)dt / m2 M pz p3 1 c(x) mk / m2;

5 ) the standby unit fails, failure is not detected, one of active units fails after failure of the standby unit is detected but before its restoration is completed, standby switching is instantaneous:

dB(t1)c(t2- tl

+ z) l p 3 F(t2)dt2 / m 2 =


‘jj2 p3 1 m

213

~ ( z/)m2;

6 ) a false failure of the standby unit is indicated and during its restoration an active unit fails, standby switching is instantaneous:

Hence 6

p?)

=

M

1E3Z(Z)

4- (1p3 -!- 1 ) p 3 m ~ ( X ) / m +

i=l

M 1$3

+ ~2 p3 c(z)mk / m + ~ 3 miT(z) ~ 6 / m p t l / m, + (1p3 + I)P3mT/m + P2p3mk/m + P3p6mlT/mpt]/mi fizdx/p lp3m, + ( I p s + I ) p ~ m Y ) / ( 2 m ) S

1

00

TT

+P2p3

m~mk / m

f p3pS

mg) / (2mpt)]/ (mb).

The obtained estimates are practically the same as the exact estimates for the case when undetected component failures are detected during the next PT, no false failures are indicated, and all continuous random quantities have an exponential distribution. The general case has been computer simulated using the GPSS language. In particular, we have simulated the case with 1 = 1 and p6 = 0. In this case

b

$3

mk TT

E3m3

+ 1)?’3mr/m + P,p3mk/m]/m, = [m$)/ ( 2 ( m ~ t + ) ~P4) / ~ 4 mpt ]

f (p3

+ (p3 + 1 ) p 3 m ? ) / ( 2 m ) +

P2p3mTmk/m]/(mb).

Certain results of simulation for the case p4 = 1 are listed in Tables 15.1, T,?,,, and usim are the simulation results of the mean time between failure, the mean system restoration time, and the standard deviation of system full operating time; TT,caiand Tcaiare calculated by the described method(s) values of mean system restoration time and the mean system full operating time, Tcai= 1 / $; n is the number of observed system failures; T , T ~ T,,, and ~~t are component no-failure operating time, the component restoration 15.2, and 15.3, where the following notation is used: T,i,,

214

Yakov Genis and 1gor Ushakov Table 15.1. The reliability and maintainability indexes’ dependence from p3 and p 2 .

p3 p2 tcal Tsim sim Tr,cal Trsim n

0.990 0.950

59856 60466 643; 64 20.00 20.47

1474

1 213; 1 1 1:; I

I

0.995 0.990

I

0.900 0.950

16

26859 20.00 17.42

186

16154 11’ 19.50 19.52

308

I 0.001

I 0.001 202 2018

1976

20.00 20.66

2334

time, the standby switching time, and the time between two periodic tests; ( A * E X P ) , ( A ;B ) , or ( A c * N R M ) denote that the respective random quantity is exponentially distributed with a mean A, or uniformly distributed in the interval (A - B, A + B), or has a normal distribution with a mean A and standard deviation 0, truncated at 3u. In Table 15.1, pp and p3 were varied and T , r,., T,, and TPt are exponentially distributed with means 2000, 20, 20, and 150. Table 15.2 shows the effect of the T~ and 7., distribution functions on Tsim.In this case, r and rPt are exponentially distributed with means 2000 and 150, p3 = 0.990, p2 = 0.950, and Teal = 59856. Table 15.3 shows the effect of r and rPt distribution functions on Tsimand Tr,,im.The values rr and T~ are exponentially distributed with the means 20 and 40; and p3 = 0.970, p z = 0.950.

+

Table 15.2. The dependence of Tsim and usim from rs and r,.. 7s Tr

Tsim gsim

n

20 20

* EXP * EXP 60466 64864 147

20; 0 20; 0 60874 58128 146

20; 20 20; 20 57362 59984 86

20 20

+ 6 * NRM + 6 * NRM 56198 60576 88

The tables indicate that Tsimand Tr,,imagree well with the calculated values over a wide range of p z and p 3 for different forms of distribution functions of all random quantities; the similarity of Tsim and Usim shows that if FS conditions are observed the distribution functions of the system no-failure operating time is nearly exponential. 15.7. Heuristic Approach. Approximate Method of

Analysis of Renewal Duplicate System The idea of approximate method is based on the Renyi Theorem that states the following. Consider a recurrent point process with distribution function


215

Table15.3 The dependence of Tsim and Tr,sim from

tpt. r TPt

Tca~ Tsim maim

Tr, cat Tr,sim

n

200 * EXP l00*EXP 38809 34958 34608 31.64 35.69 266

2000; 1500 100*EXP 38809 32973 33536 31.64 35.20 302

2000

+ 600 * N R M 100; 0 39744 38847 37616 31.92 32.70 255

of time between events D(t). Determine a “sifting procedure” to this process, i.e. with probability p one independently excludes current event. The Renyi Theorem states that with infinite continuation of the sifting procedure, the resulting limit point process converges to a Poisson process. In our case for each system unit, we consider a recurrent alternative process consisting of “on-intervals” with DF F ( t ) and the mean T , and “down-intervals” with DF G ( t ) and the mean T. In our case, considering highly reliable systems, we take T >> T. Let us call a unit failure an “alarm,” if it can be developed into a system failure if another failure (or other failures) will occur. Notice that such a situation exists for a very short time, since we assume that T >> I-. So, in limit, we can consider pure recurrent point process of “alarms” instead of alternating one. Sometimes these alarms might develop into system failures, sometimes not. Lets now return to the analysis of investigated renewable system. Consider a general renewable duplicate system with loaded redundancy ( “hot” redundancy). Both units are identical with distribution function of time to failure F ( t ) and distribution function of renewal time G ( t ) .Denote corresponding mathematical expectations of these distributions by T and T , respectively, and assume again that T >> T . The state of a standby unit is monitored periodically with the period 0, assume that 0 0.5, the boundary of the feasible region is convex, and appears to be approximately piecewise linear. When 11, = 0.5, the boundary of the feasible region coincides with that for the deterministic solution. Interestingly, the feasible region appears to be concave for 11, < 0.5. However, recall that 11, denotes the chance that the overall reliability target will be met. Thus, from a practical standpoint, restriction to 11, > 0.5 to achieve a convex feasible region does not unduly limit the formulation. From (17), we also see that F G ~ ( O ;..., X ~ A,,) takes value 1/2 when X i = A, for each i = 1 , . . . n. This implies that, for any 11,, the boundary of the feasible region always goes through the point X i = A,, which forms an inflection point (under varying 11,) for the boundary of the feasible region corresponding to the system reliability constraint.

228

M. Helander and B. Ray

Given that we have not definitively determined the quasi-convexity of (17), it is possible that the solution to (14) obtained using numerical optimization techniques may not provide the global optimal solution. While this is not entirely satisfying, a “close-to-optimal” solution may still provide significant gains over the deterministic solution when uncertainty in the usage profile is large. We provide examples to illustrate the effects of allowance for uncertainty in Sec. 16.4.

16.3.2. Solution implementation To obtain a solution to (14)-(17), the fmincon function of Matlab’s Optimization Toolbox (v. 6.2, Release 13) was used to directly minimize (14) subject to the constraints (15)- -(17). The function (17) was evaluated numerically using adaptive Simpson quadrature methods, with the Matlab function quad. We note that several parameters of fmincon and quad affect the quality of the obtained solution. First, the precision tolerance (tol) of the quad function can result in differences in the optimal solution obtained. Decreasing the tolerance to a very small value usually provided good results, at the cost of increasing the solution computation time or exceeding the maximum number of allowed function evaluations. However, making the tolerance value too small sometimes resulted in singularity and nonconvergence. Second, several parameters of the fmincon function affect the quality of the solution. These are a) tolx, the required change in A, for continued iteration, b) tolfun, the required change in the objective function for continued iteration, and c) t o l c o n s t r , the required distance of the solution from the active constraint. Matlab documentation recommends staying with the default values, although we found it necessary to experiment with smaller values in order to achieve algorithm convergence. While these algorithm parameters impacted the achieved solution, the choice of starting point for finding the solution seemed to have the greatest effect. We found that starting at a value a small step into the feasible region from the deterministic solution generally proved an effective strategy.

16.4. Examples In this section, we graphically illustrate the effect of uncertainty on the allocation problem specified by (l), (2), and (3), by extending the n = 2 component example from Helander3 to allow variation in assumed usage. Specifically, the input parameters of the model in the deterministic case

Planning Models for Component-Based Software O@rings

are: ? =I2

p = .99

m=2

~

=

1

p"

I;[ [;:I

i;=

[

229

=

Pl1 P 1 2 1121 P 2 2

]

0.6 0.4 =

[o.o L O ] .

The cost of each component is assumed to be inversely proportional to the achieved reliability, following an inverse power law of the form C(X) = P (X-6)" ' A > S. The InvPow cost parameters are taken as

The total cost is simply the sum of the individual component costs, ie., f ( x l , A2)

=CP~,a~,61

+CP~,a2,62(~2).

Figure 16.1 shows the solution for the deterministic version of the model, as in Helander,3 which corresponds to the stochastic solution for any choice of Dirichlet parameters wi when the chance of meeting the reliability target, $, is 0.5. Using a Dirichlet distribution with w1 = 7 , v 2 = 3 to characterize uncertainty in p i , Fig. 16.2 shows the effect on the feasible region of increasing $, while Fig. 16.3 shows the cost contours and resulting solution, respectively. Table 16.1 gives the precise values of XI, A2 and the resulting Total Cost to achieve the specified reliability under the Inverse Power cost function given above. As expected, the Total Cost increases with $. The four plots of Fig. 16.4 show the effect of varying wi over the values v1 = 0 2 = 0.5 (top left), 1 (top right), 2 (bottom left), and 16 (bottom right) for values of 1c, varying from 0.2 to 0.8, where the Dirichlet distributions corresponding to the w1 values are shown in Fig. 16.5. We see that decreased uncertainty in the usage, as specified through decreased variability in p i , results in less variation from the 1c, = 0.5 case (also corresponding to the deterministic boundary). Depending on the objective function, the stochastic optimization algorithm may converge toward the common failure intensity solution as $ approaches one, ie. XI = A2 = . . . = An = A, = - log(p)/r. When this happens, FG~(O; XI, ..., An) is exactly 0.5, which forces the Lagrangian multiplier, d, to be zero so that (19) can hold. In this case, there is no feasible solution to the stochastic optimization problem under the Dirichlet distribution assumption. In practice, convergence toward the common failure intensity solution may make it difficult to terminate with an acceptable

230

M . Helander and B. Ray

exit condition from a procedure like fmincon,as was the case for values of 0.85 < $J < 1 in this two component example.

Fig. 16.1. Solution t o the deterministic model for the 2 component example.

Table 16.1. Component reliability solutions for two-component system under varying probabilistic constraints and resulting total cost. Deterministic Stochastic Stochastic Stochastic Stochastic

I $ J I I

-

0.50 0.65 0.75 0.85

I

XI

0.03654 0.03654 0.03419 0.03335 0.03144

I I

XZ

0.02606 0.02606 0.02742 0.02788 0.02946

I 1

cost 1884.10 1884.10 1888.58 1890.98 1893.06

16.5. Summary and Discussion In this paper, we have formulated and solved the optimal reliability allocation problem for a system of software components when uncertainty in the operational profile is quantified using probability distributions. In other work, we plan to make more explicit the relationship between the stochastic formulation of the problem, as outlined in this paper, and other

Planning Models for Component-Based Software Offerings

231

.

Fig. 16.2. Feasible region changes with varying

+.

Fig. 16.3. Solutions to the stochastic model for the two component example with varying

+.

232

M. Helander and B. Ray

0.03

0.03

0.02

0.02

0.01

0.01

0

0

0.02

0.06

0.04

0 0

0.02

0.04

0.06

0.04

0 03

0.03

0 02

0.02

0 01

0.01

0

0

002

004

006

0

0

0.02 004 0.06 0.08

Fig. 16.4. Behavior of the feasible region boundary formed by the system reliability for the two component example with varying from 0.2,. . . ,0.8and v1 = 0.5 (top left), 1 (top right), 2 (bottom left), 16 (bottom right). $J

“robust” deterministic approaches to the same problem, such as that given in Leung4 Here, we have assumed that the parameters in the cost function being optimized are known. If these parameters are subject to uncertainty which can be characterized through a probability distribution on f ( A ) for a specified A, several approaches may be taken for incorporating this additional source of uncertainty into the proposed modeling framework. For example, the optimization problem could be solved to minimize the expected cost, or to minimize the the pth percentile of the cost distribution, with p = 0.95 for example. We leave exploration of the sensitivity of the solution to uncertainty in both cost and operational profile to future research. Additionally, we will consider how the present formulation can be made relevant to application areas having attributes other than reliability as the system attribute of interest.

Acknowledgments The authors wish to thank Samer Takriti and Giuseppe Paleologo for extensive discussions concerning stochastic optimization methods and tools.

Planning Models for Component-Based Software Offerings V

233

v= 1

= 0.5

1

0

0.2 0.4

0.6

0.8

Fig. 16.5. Illustration of the Dirichlet distribution for vi = 0.5 (top left), 1 (top right), 2 (bottom left), 16 (bottom right).

References 1. J. D. Musa, Operational Profiles in Software Reliability Engineering, I E E E Software, Vol. 10 (2), 14-32 (1993). 2. J. H. Poore, H. D. Mills, and D. Mutchler, Planning and certifying software system reliability, I E E E Software, Vol. 10 ( l ) ,88-99 (1993). 3. M. E. Helander, M. Zhao, and N. Ohlsson, Planning models for software reliability and cost, I E E E Transactions on Software Engineering, Vol. 24 (6), 420-434 (1998). 4. Y. W. Leung, Software reliability planing models under an uncertain operational profile, Journal of the Operational Research Society, Vol. 48, 401-411 (1997).

5. B. W. Boehm, Software Engineering Economics, Prentice-Hall: New Jersey (1981). 6. P. Kall and S. W. Wallace, Stochastic Programming, John Wiley and Sons: New York (1994). 7. S. Kotz, N. Balakrishnan, and N. Johnson, Continuous Multivarite Distributions, Volume 1: Models and Applications, John Wiley and Sons: New York (2000). 8. S. B. Provost and Y . H. Cheong, On the distribution of linear combinations of the components of a Dirichlet random vector, The Canadian Journal of Statistics, Vol. 28, 417-425 (2000).


CHAPTER 17 DESTRUCTIVE STOCKPILE RELIABILITY ASSESSMENTS: A SEMIPARAMETRIC ESTIMATION OF ERRORS IN VARIABLES WITH VALIDATION SAMPLE APPROACH NICOLAS W. HENGARTNER Statistical Sciences Group, M S F600 Los Alamos National Laboratory Los Alamos, NM 87545 USA E-mail: [email protected] This paper extends the methodology of parameter estimation for errors in variables with validation sample to the problem of assessing the reliability of a stockpile from different types of destructive testing. Our contribution is a generalization of the methods introduced by Pepe and Fleming' for discrete covariates and surrogate variables to their continuous counterparts. We show that our proposed semiparametric estimator is asymptotically Gaussian and efficient.

17.1. Introduction

Integrating different destructive tests to assess the reliability of items in a stockpile is a challenging statistical problem. Consider the following example. To assess the reliability of rocket engines in a stockpile of missiles, we perform two different types of testing: The first type of testing consists of firing the missile and recording 2,the status of the engine. Pass if it worked, and fail if not. The second type of testing consists of firing the engine in a laboratory and monitoring and recording the performance X of the engine, such as thrust, heat, and burn time. This second type of testing data is informative for the overall engine reliability when the conditional distribution p ( z l z ) of the status Z given the performance X is known. Since

p = P[Z = 11 = E[P[Z= llX]],

235

236

N. W . Hengartner

the stockpile reliability can be estimated from a sample XI, . . . ,X formance measurements by

n of per-

l n

?j = - C P [ Z = llXi]. n i= 1

More typically, the engineers know the conditional distribution p ( z J z ) up to some unknown parameter 9, which needs to be estimated from data. Unfortunately, the two independent samples (one of performances and the other of status) do not in themselves allow the estimation of that parameter. To make the estimation of 9 possible, we link the two samples by introducing a covariate W , observed on all the test units, which is related to both the status and the performance. Further, we will assume that this additional covariate W does not contain information about the status that is not already contained by the performance. Thus W acts as a surrogate for the performance measurements. The concept of surrogate variables was introduced by Prentice2 and r e fined by Pepe3 in the context of medical studies, where it is also called non-differential measurement error by Caroll et al.4 Pepe and Fleming.' Wang and Pepe5 call this data structure errors in variables with validation sample and have considered estimation of 0 when both the surrogate W and performance X are discrete random variables taking on finitely many values. Extensions to continuous performance and surrogate variables is straightforward if a parametric model for the conditional distribution of X given W is available. However, given the complexity of the relationship between the performance and the surrogate variables, such distributions may be hard to specify. Jiang and Turnbulls and Jiang and Turnbul17 consider estimating 9 without specifying the joint distribution of performance and surrogate variables by a generalization of the method of moments. While their estimators are consistent and asymptotically Gaussian, it is unlikely that they are efficient. For a discussion on the challenges of estimating 9 in this semiparametric model, we refer the interested reader to Caroll and Wand' and Stephanski and Lee.g In this paper, we consider efficient estimation of the 0 without specifying explicitly the relationship between performance and surrogate. Our approach to produce efficient estimates for 9 is similar in spirit to Pepe3 and rests on the idea of estimating the score function. This paper is organized as follows. Section 17.2 lays the groundwork by introducing the notation and giving sufficient conditions for the parameter 8 to be identifiable. Section 17.3 defines the estimation procedure and states our main result, which is

Destmctive Stockpile Reliability Assessments

237

proven in Sec. 17.4. We wish to mention that Wang et a1.I0 have studied a similar problem arising in econometrics and have produced efficient semiparametric estimates using an empirical likelihood approach. However, we do prefer our estimator over their estimator/estimators because of its simplicity and its ease of computation. Finally, to help keep the notation as simple as possible, this paper will focus on univariate parameter estimation as the extension to multivariate parameter estimation is straightforward.

17.2. Preliminaries

+

+

Let {(Zi,Xi, Wi),i = 1,.. . ,n m}, be n m independent copies of (2,X, W ) ,where 2 is a binary status variable, X the performance variable and W the surrogate that satisfies the surrogacy assumption

P [ Z = llX,W] = P [ Z = 11x1.

(1) Consider the parametric model for the conditional distribution of the status variable given the performance variable

~

( e) =~ p S [1 z= zlx ~ = 4, ~

and denote by d F(x1w) = P [ X 5 xlw] and f(xlw) = --F(xlw),

ax

the conditional probability distribution function and related density function of the performance variable given the surrogate. Finally, one gets to observe the two independent samples 271 = ((22,W2);i = 1 , . . . , n}

(2)

and

l , ..., n + m } . (3) In light of the surrogacy assumption, the conditional probability function of the status variable given the surrogate variable W = w is v2 = {(Xz,W,);i =n f

p(zlw;0 ) = Pe[Z = zIW = W] = IE [ P S [ Z= tlX, w = w] I

e)lw= 4 =

J

w = W]

R(.+; e)f(xlw)dw. (4) Both p ( z ) w , B )and f(olw) can be estimated from the data (2) and (3). Hence a necessary condition for identifiability of the parameter 6 is that kernel of the functional =IE[R(~IX;

N. W.Hengartner

238

be trivial, that is, if for any function H ( z ) z )

T [ H ] ( z , w= ) 0

* H ( z l z ) = 0.

It is easy t o see that this condition fails to hold if, for example, the performance X and surrogate W are independent, in which case, the parameter 0 is not identifiable. Theorem 17.1 below gives a sufficient condition for identifiability of nonparametric specification of the conditional probability of status given status.

Theorem 17.1: If {f(.Is)}is a complete family of densities, then the reliability function R(zlz) is identifiable. Theorem 17.1 proves identifiability of arbitrary conditional probability functions R(zlz).Thus under the conditions of the theorem, if the parameter 0 is identifiable in the (unobserved) model R(zls,e),then it is also identifiable in the errors in variable with validation sample model.

Proof: Suppose t o the contrary that there exists two conditional probability functions Rl(zlz) # R ~ ( Z ~ such Z ) that

However, the assumed completeness of the family of densities {f(.ls)}implies that Rl(zlz) - Rz(zls) = 0, contradicting the ansatz. 17.3. Estimation

To gain insight into the proposed estimation method, let us first consider the case of known conditional distribution of X given W . This may be seen as a limiting case of unlimited validation samples (X, W). Then p(+,

e) = JR(+,

e)f(zIw)ds = I E [ R ( ~ (e)lw X, =

4,

and the maximum likelihood estimators for 8 are solutions of the estimating equation

c" aea

- logp(ziIwi,6 ) = 0.

i= 1

Under mild regularity assumptions to justify interchanging derivatives and integrals, the score function can be expressed as

Destructive Stockpile Reliability Assessments

-

IE[&R(~)X e)lw ; =W] IE[R(zJX;6)(W = w] '

239

(5)

which is easily verified to be also the minimizer with respect of a of

(6) h

We propose to estimate the score function S ( z ,w; 0) by minimizing, with respect to a, n+m

i=n+l

an empirical counterpart of (6), where K ( u ) is a symmetric smoothing kernel of sufficiently high order, and h denotes the bandwidth that goes to zero as the validation sample size m increases. Armed with an estimate for the score function, we estimate the parameter 6 as solutions of n

(7) i=l

The following theorem states that the resulting estimator has good statistical properties.

Theorem 17.2: Let 8 be a solution of (7). Under suitable regularity conditions detailed in Sec. 17.4.1, we have that

fi(4

- 00)

A N(0,I-l(eo)),

where

is the Fisher information matrix for estimating 6 from independent replications of (2,W ) when the conditional distribution of X given W is known. Several remarks are in order. (1) The estimator 8 is efficient as its asymptotic variance is the same as if we would have known the joint distribution of X and W .

N. W.Hengartner

240

(2) The asymptotic distribution of the estimator 5 is not sensitive to the choice of the smoothing parameter h which can be chosen to be in

(A)

1-&

5h5

(+:)''

for small E > 0. Hence there is little need to discuss bandwidth selection for first order asymptotics. We note however that the choice of the bandwidth does impact the second order properties of the estimator, and thus, for finite samples, there may still be some benefit in identifying good choices for h. (3) The size m of the validation sample can be much smaller than n. In particular, the conclusions of the theorem hold provided that 1 m 2 n%-& for small E > 0. This shows that the smoother the joint densities f(z,w) are, the smaller validation samples need to be. 17.4. Proofs 17.4.1. Regularity conditions The proof of Theorem 17.2 requires that the following set of assumptions hold. A1 The parameter in 6 is identifiable. A2 The joint density f(z,w) is T times continuously differentiable in w. A3 The smoothing kernel K ( . ) is bounded with compact support and satisfies a J K ( u ) d u= 1

-

b K ( . ) is of order A4 Both n,m

T

00.

A5 The bandwidth h satisfies 6 h Z r A6 Let Mh(2,W) =

The functions

have finite expectations.

sup

-

0 and 6

h

-

m.


24 1

17.4.2. Proof of Theorem 17.2

The idea of the proof is to write the semiparametric estimator 4 as a Ustatistic. Unfortunately, the standard convergence results for U-statistics (as in Grams and Serfling") do not directly apply because of the smoothing we do in estimating the score function. Let the estimator t? be a solution of

A

-

A Taylor expansion of Jh(t9) about the true parameter value & implies that

B - eo = -[v&(e*)~-~T~(e~), - eoll < 116 - doll. A central limit theorem for e^ follows by

for some IlO* showing that &(do) is asymptotically Gaussian and that V&(e*) converges in probability to some nonnegative definite matrix C. Denote by

and write

w ;e,) +

= Sh(z,

N . W . Hengartner

242

- P

with the remainder rm 0 as m 00. Set u i = (zi, Xi),5 = (Xn+kWn+j).In light of Equation (8), we approximate the objective function Jh(e0) by the U-statistics

with kernel

The Hoffding decompostion of the later kermel is

where

Standard calculations reveal that

(9 with the remainder bounded by


243

Identity (9) further implies that

(10 Using the fact that for all 8

we get that

+

/ B(z,

' O ) p ( z , W + hu; &)f(z,W + hu)K(u)dudz + hu; hu;8 0 ) = Ee,[S(Z,W ;eo)l + $-J u ~ ~ ( u ) dE u~ .( xw), , (11)

'("

W

with integrable remainder E2. By construction, the random variables {A(U2,V,), i = 1,.. . ,n j = 1,.. . ,m ) are uncorrelated. Furthermore, since VCZT(A(U~, V,)) = O(h-l), it follows that

1 n y p ( nm 2=1

-

Combining (9),

Qe0)

=o,(m). 1

m ~

2

j=1

1

V

,

)

(12)

(lo), (11) and (12), we conclude that n v,; eo>i+ -nl C{Bo,,[H(u2, v,; e0)iv,i

= Ee,[H(U2,

2=1

-Eeo[H(UZlV,; O O ) ] } +-ml r n v,; Q,)IU,I - Eeo[H(Ut,V , ; ~ ~ ) I I j=1

C{E[H(U,,

Hence if both m , n

-

00,

nh2T-+ 0 and mh

-

00,

then

N. W. Hengartner

244

with

Finally, since

aae

--Jh(O*)

aae

= -J h ( e o )

+op(1)

and

we get t h e desired conclusion.

Acknowledgments

I wish t o thank Alyson Wilson for helpful discussions and an anonymous referee for comments that have improved the presentation of this paper.

References 1. M. S. Pepe and T. R. Fleming, A general nonparametric method for dealing with errors in missing or surrogate covariate data, JASA 86, 108-113 (1991). 2. R. L. Prentice, Surrogate endpoints in clinical trials: definition and operational criteria, Statistics in Medicine 8, 431-440 (1989). 3. M. S. Pepe, Inference using surrogate outcome data and a validation sample, Biometrika 75, 237-249 (1992). 4. R. J. Caroll, D. Ruppert, and L. A. Stephanski, Measurement error in nonlinear models, Chapman and Hall, London (1995). 5. C. Y. Wang and M. S. Pepe, Expected estimating equations to accommodate covariate measurement errors, Journal of the Royal Statistical Society, Series B, 62, 509-524 (2000). 6. W. Jiang and B. W. Turnbull, The indirect method: Inference based on intermediate statistics-A synthesis and examples, to appear in Statistical Review (2004). 7. W. Jiang and B. W. Turnbull, The indirect method: Robust Inference based on intermediate statistics, Technical Report No 1377, School of Operations Research, Cornell University, Ithaca, New York, http://www.orie.cornell.edu/trlist/trlist.html (2003). 8. R. J. Caroll and M. P. Wand, Semiparametric estimation in logistic measurement error models, Journal of the Royal Statistical Society, Series B, 53, 652-663 (1991).


245

9. J. H. Stephanski and L. F. Lee, Semiparametric estimation of nonlinear errors-in-variables models with validation study, Journal of Nonparametric Statistics 4, 365-394 (1995). 10. Q. Wang, K. Yu, and W. Hiirdle, Likelihood-based kernel estimation in semiparametric errors-in-variables models with validation data, Technical report, Humboldt Universitat zu Berlin (2002). 11. W. F. Grams and R. J. Serfling, Convergence rates for U-statistics and related statistics, Annals of Statistics 1, 153-160 (1973).


CHAPTER 18 FLOWGRAPH MODELS FOR COMPLEX

MULTISTATE SYSTEM RELIABILITY

APARNA V. HUZURBAZAR Department of Mathematics and Statistics University of New Mexico Albuquerque, NM 87131 USA E-mail: [email protected]. edu BRIAN J. WILLIAMS

Statistical Sciences Group Los Alamos National Laboratory Los Alamos, NM 87545 USA E-mail: [email protected] This chapter reviews flowgraph models for complex multistate systems. The focus is on modeling data from semi-Markov processes and constructing likelihoods when different portions of the system data are censored and incomplete. Semi-Markov models play an important role in the analysis of time to event data. However, in practice, data analysis for semi-Markov processes can be quite difficult and many simplifying assumptions are made. Flowgraph models are multistate models that provide a data analytic method for semi-Markov processes. Flowgraphs are useful for estimating Bayes predictive densities, predictive reliability functions, and predictive hazard functions for waiting times of interest in the presence of censored and incomplete data. This chapter reviews data analysis for flowgraph models and then presents methods for constructing likelihoods when portions of the system data are missing.

18.1. Introduction Multistate models are used to describe longitudinal, time-to-event data. They model stochastic processes that progress through various stages. Today’s complex systems make the analysis of multistate models very im247

248

Aparna V. Huzurbazar and Brian J . Williams

portant in reliability. Flowgraph models are one type of multistate model. Flowgraphs model potential outcomes, probabilities of outcomes, and waiting times for the outcomes to occur. They can be used to model complex system behavior, time to total or partial system failure, time to repair of components or the entire system, and to predict system reliability. Examples of processes include the internal mechanisms of cellular telephone networks, stages in the maintenance and repair of aircraft, or improving stages of assembly and rework in a manufacturing process. For example, modeling the stages of the cellular telephone network begins with a fully functioning network that proceeds through a series of degradations to a partially functioning network and eventually to a fully failed network. The network itself may be a local network composed of only a few cells or it may be composed of subsystems that comprise a network over an entire state or country. In aircraft maintenance, the macro level process can be represented by five main systems. However, each system consists of subsystems with thousands of elements that represent tasks involved in repair and maintenance. Data may be available in detail for the entire process or, more realistically, data may be available only partially at the component, subsystem, or system level. Combining such information across various levels of a system has become increasingly important with today’s complex systems. Current methods in reliability for complex systems require that all the component waiting times be from the same distributional family such as the Weibull so that information may be easily combined. In addition, some methods for complex systems such as fault trees restrict themselves to binomial data so that large amounts of information may be easily aggregated. Flowgraphs allow each component or set of components to have its own distribution and flowgraph algebra provides a way to combine these varied distributions. The examples of the previous paragraph involve modeling the time until the occurrence of some event or events. Our interest is in modeling large, complex systems or subsystems of such systems. This chapter reviews data analysis for flowgraph models when the data are complete and possibly censored and then presents methods for handling systems where portions of the system data are incomplete. We extend the work of Williams and Huzurbazar3 who perform posterior simulation based on one constructed likelihood for an entire system flowgraph. The problem considered here requires the construction of several different likelihoods for portions of missing data in the system flowgraph. Flowgraph models can be viewed as a type of semi-Markov multistate

Flowgmph Models for Complex Multistate System Reliability

249

model. The theory underlying multistate models for event history analysis was formalized by the work of Aalen4 who showed that such models may be analyzed within the framework of counting processes. In terms of data analysis, multistate models have been restricted to the realm of Markov models. Let X n denote the state of the process at stage n, let T n denote the time of transition to X n , and let a h j ( . ) denote the transition intensity of the process for the h t j transition. In a Markov multistate model, given the current state of the process, the transition time to a future state does not depend on the past history of the process. In a Markov multistate model, the transition intensity a h j ( . ) reduces to the hazard function. At the initial state of a Markov process, the transition time is a minimum of the waiting time distributions corresponding to all possible transitions from the initial state. Hence, in practice, for tractability and analytical convenience, exponential distributions are assumed. Occasionally, with appropriate parametric restrictions, Weibull distributions are used, exploiting the fact that the minimum of independent and identically distributed Weibulls is again a Weibull distribution. A semi-Markov multistate model allows the transition time to a future state to depend on the duration of time spent in the current state so that P[Xn+1= j , Tn+1 E [t,t

+ fit) I {(xk,~ k ) } E c g l , (Xn = h, Tn),Tn+1 L t] = a h j ( t - Tn)bt, for h , j E S ,

where S = { 1 , 2 , 3 , ...,m} is the finite state space of the multistate process. In practice, it is quite difficult to analyze data for semi-Markov multistate models. One method of analysis for multistate models consists of combining independent submodels for each transition intensity, a method that restricts the analysis to models with unidirectional or progressive flow.5 In fact, Hougaard‘ states that for nonunidirectional or nonprogressive multistate models, it is impossible to obtain general formulas for transition probabilities for models where the hazard is allowed to depend on the history in any way. Flowgraph models circumvent this difficulty by working in the moment generating function domain. Another method is the use of the proportional hazards model and its many extensions. The proportional hazards model as used in medical statistics was developed by Cox;’ however, the idea of assuming proportional hazards to fit more parsimonious models dates back to the operations research literature.’ Cox’s model is semi-parametric and assumes that the intensity of the counting process is a product of a parametric function of the covariates and an arbitrary function of time. In practice, this method

250

Aparna V. Huzurbazar and Brian J . Williams

is also restricted to a unidirectional or progressive multistate model. The obvious restriction of the proportional hazards model is that hazards are not always proportional. In both methods, the key approach for analyzing such multistate models is based on modeling the hazard function, a quantity that is not directly observable. The end result is a hazard function model based on a set of covariates, which can be converted to a reliability function if required. However, if our interest is in predicting the overall waiting time especially when state-to-state transitions times are not from the same distributional family, this method is also limited due to the complexity of the convolutions and finite mixtures involved. For example, the convolution or a finite mixture of a Weibull waiting time with an inverse Gaussian is not analytically tract able.

18.2. Background on Flowgraph Models

A flowgraph is a graphical representation of a stochastic system in which possible outcomes are connected by directed line segments. Modeling concerns probabilities of the outcomes, the waiting time distributions of the outcomes, and manipulating the flowgraph to access waiting time distributions for total or partial passage through the system. Flowgraphs model semi-Markov processes and allow for a variety of distributions to be used within the stages of the multistate model. They also easily handle reversibility. This means that a failed component can be repaired. Flowgraphs model the observable waiting times rather than the hazards and as such, they do not directly make any assumptions about the shape of the hazard. The end results from a flowgraph analysis are Bayes predictive densities, CDFs, reliability functions, and hazard functions of the waiting times of interest. Figure 18.1 shows a complex system consisting of outcomes in series and cascaded in parallel with feedback loops. The system is an assembly line for a manufacturing process for car stereos. The system flowgraph was originally presented in Huzurbazarg but without data or analysis. State 0 represents an initial detection of a problem with a stereo. The problem is categorized into one of two types of severity. If the severity is of type I, the system is in state 1 for repair of the item. Eventually, the problem is fixed and the item moves to state 3 where it is specifically inspected to make sure that the type I problem is fixed. If the problem is not fixed, the item is returned to state 1, otherwise, it passes inspection and moves to state 5. Similarly, if the severity is of type 11, the system is in state 2 for repair. Eventually, the problem is fixed and the item moves to state 4 where it is


251

specifically inspected to make sure that the type I1 problem is fixed. If the problem is not fixed, the item is returned to state 2, otherwise, it passes inspection and moves to state 5.

Severity type 11, repair

Inspection of Type I1

Fig. 18.1. Flowgraph model for manufacturing system.

While block diagrams and signal flowgraphs are widely used to represent engineering systems, they do not incorporate probabilities, waiting times, or data analysis. The literature on nonstatistical flowgraph methods in engineering is vast beginning with Mason." Introductions to these methods are contained in most circuit analysis or control systems textbooks.l1?l2 Statistical flowgraph models are based on flowgraph ideas but unlike their antecedents, flowgraph models can also be used to model and analyze data from complex stochastic systems. Flowgraphs are also distinct from graphical models in that the states represent outcomes rather than variables. For example, while feedback loops are an integral part of flowgraph models, they are redundant in a graphical model. Huzurbazar13 is a recent book on statistical flowgraph models. In a flowgraph model, the states, representing outcomes, are connected by directed line segments called branches. These branches are labeled with transmittances, called branch transmittances. A branch transmittance consists of the transition probability multiplied by the moment generating function (MGF) of the waiting time distribution in the previous state. The

252

Apama V. Humrbazar and Brian J. Williams

waiting times on the branches can be any parametric distributions that admit moment generating functions. Hence, the model is quite general in that exponential assumptions or assumptions that the waiting time for the various branches be from the same family of distributions are not made. For example, in Fig. 18.1, the branch waiting time for state 0 to state 1 could be inverse Gaussian and for state 0 to state 2 could be gamma. The overall waiting time from state 0 to state 5 is a complicated combination of finite mixtures and convolutions of all of the branch transition distributions weighted by the branch probabilities. Flowgraphs are simplified by solving them for the MGF of the waiting time distribution of interest. The branch transmittances of a flowgraph model are used along with flowgraph algebra to solve for the MGF of the distribution of the waiting time of interest. This can be done by reducing the series, parallel, and feedback loop components of the flowgraph or by using an automated procedure implemented with symbolic algebra. Both of these procedures are described in the statistical flowgraph literature. The system of Fig. 18.1 is an example of a combination of a series and parallel system with feedback. States 0, 1, and 3 are connected in series. States 1 and 2 are in parallel, as are states 1 and 5 if the system is in state 3. The transitions 1 3 -+ 1 and 2 + 4 + 2 constitute feedback loops. These basic components can be used to reduce the flowgraph to just two states 0 and 5 labeled with one transmittance, M ( s ) ,the MGF of the distribution of the total time required for successful inspection of the part. In general, for complex systems, the procedure of reducing flowgraphs can become tedious and a technique from graph theory is used to automate the process. Mason" developed a rule in the context of graph theory for solving systems of linear equations. In its original implementation, Mason's rule did not involve probabilities or MGFs. However, flowgraph models can be solved by applying Mason's rule to the branch transmittances. This provides a systematic procedure for computing the transmittance of a flowgraph from any state i to any state j. It requires computing the transmittance for every distinct path from the initial state to the end state and adjusting for the transmittances of various loops. When a system is certain to pass from state i to state j , this transmittance is the MGF of the transition time distribution. Mason's rule requires the following definitions. A path from state i to state j is any possible sequence of states from i j that does not pass through any intermediate state more than once. In Fig. 18.1, there are two paths from 0 to 5 : 0 + 1 -+ 3 + 5 and 0 -+ 2 + 4 --+ 5. A path transmittance is the product of all the branch transmittances for that --+

--+


253

path. The transmittances of these paths are p01p35Mo1(s)Ml~(s)M35(s) and po2p45Mo2(s)M24(s)M45(s). A first-order loop is any closed path that returns to the initiating state without passing through any state more than once. In Fig. 18.1, 1 --f 3 + 1 and 2 + 4 + 2 are first-order loops. A second-order loop consists of two nontouching first-order loops. In Fig. 18.1 there is one second order loop since the two first-order loops do not touch. A j t h - order loop consists of j nontouching first-order loops. The transmittance of a first-order loop is the product of the individual branch transmittances involved in the path. The transmittance of a higher-order loop is the product of the transmittances of the first-order loops it contains. There are no loops of order three or more in this flowgraph. The general form of Mason's rule gives the overall transmittance, i.e. the MGF from input to output, as (1)

where Pi(s)is the transmittance for the i t h path, L j ( s ) in the denominator is the sum of the transmittances over the jth-order loops, and Li(s)is the sum of the transmittances over jth-order loops sharing no common nodes with the ith path. For this system, PI(s) = p01p35Mo1(s)M13(s)M35(~), P~(s) = po2p45M02(s)M24(s)M45(s) so that (1) for the overall waiting time from 0 to 5 is M ( s ) = {pOlp35MOl(S)M13(S)M35(S)[l - Ll(S)

M45(s)[1 - L:(s)l}/{l

- L:(s)]

+ L2(s)}

+ p02p45M02(s)M24(s)

x

1

where

L:(s) = p42M24(s)M42(s) L?( s ) = p3 1M 1 3 (s)M31 ( s ) 1(s)

= p 3 1 M 1 3 ( s )M 3 1 ( s )

+ p42M24 ( s )M 4 2 ( s )

L2(s) = p31p42M13(s)M31(s)M24(s)M42(s)

.

In general, for systems with many states, paths, and loops, (1) is programmed using symbolic algebra. When the interest is in partial passage from state i to state j , (1) must be modified for the event of interest conditional on the occurrence of the event of interest. The conditional MGF in this case is

Mj(4/Mij(O), for partial passage from i + j .

254

Aparna V. Huzurbazar and Brian J. Williams

While such flowgraph algebra provides the MGF of interest, it must be converted to a waiting time density, reliability or hazard function in order t o be useful. One class of methods for numerically converting MGFs to densities is saddlepoint approximation^.'^ This method applies to a wide range of complex flowgraphs. The approximation is summarized as follows: Let K ( s ) = log { M ( s ) }be the cumulant generating function (CGF) of the waiting time T . Let c1 and c2 be constants such that c1 < 0 < c2. Suppose that M ( s ) exists for s E (c1,cz). Then the saddlepoint approximation to the density of T is (2

where K“(s) = d 2 K ( s ) / d s 2 and

K’(i) = t ,

(3)

where K’(s) = d K ( s ) / d s . In practice, (2) is normalized by its numerical integral over the support of T . The quantity i is called the saddlepoint and it is the solution to the saddlepoint equation (3). With flowgraphs, i is a complicated implicit function of both t and the parameters of the branch distributions. In practice, c1 and c2 are found numerically. These quantities are used to bound the solution to the saddlepoint equation (3). Practically, the upper bound c2 is the smallest positive root of (3). The saddlepoint is unique and it is a monotonically increasing function of t , a property that can be exploited in its computation. The saddlepoint is a highly accurate second order approximation that works well with flowgraphs. For further details on the saddlepoint approximation see Jensen,15 Kolassa,16 or Reid. l7 Although other transform inversion techniques such as those based on characteristic functions18~’9~20 are available, they do not work well with complex systems such as those modeled by flowgraphs. This is due to the complex nature of the convolutions, finite mixtures and feedback of a variety of nonstandardized distributions present in flowgraph models. In addition to allowing a variety of distributions to be used within the stages of the multistate model, the flowgraph methodology also easily handles reversibility. This means that a failed component can be repaired. Flowgraphs model the observable waiting times rather than the hazards and as such, they do not directly make any assumptions about the shape of the hazard. Quantities of interest include predicting the distribution of the total time to testing and repair, 0 -+ 5 ; predicting the waiting time to repair, say, 3 + 1; or predicting the number of times the component failed

Flowgraph Models for Complex Multistate System Reliability

inspection of type 11, 4 data.

-+

255

2, all in the presence of censored and incomplete

18.3. Flowgraph Data Analysis Data analysis using flowgraph models can handle both censored and incomplete data. The basic data types are called complete data, incomplete data and unrecognizably incomplete data. Complete data on a flowgraph model consists of having every intermediate transition for each observation. The associated waiting time for the transitions may be censored; however, the transition information is complete. In Fig. 18.1, complete data consists of observations such as 0 -+ 1 -+ 3 + 1 -+ 3 -+ 5. Incomplete data consists of data that have complete information on observed waiting times but incomplete information on the associated transitions. For example, in Fig. 18.1, if we observe a waiting time such as 0 4 4 we know that the transition is 0 -+ 2 -+ 4 but that the transition 2 is incomplete. Unrecognizably incomplete data are data that appear to have complete information on the transitions and waiting times but in reality are incomplete with respect to transition information. For example, suppose that we observe 0 -+ 2 -+ 4, we might assume that the data are complete. But perhaps the true observation transitions were 0 2 +4 2 4 4. Currently, there are no good methods for dealing with such data in the semi-Markov case. The end result(s) from a flowgraph analysis are Bayes predictive densities, CDFs, reliability functions, and hazard functions of the waiting times of interest. The Bayes predictive density of a future observable 2 given data D is -+

-+

Giq.o{fz(4e)),

(4)

where 2 has density f z ( z l 0 ) and r(0 ID) is the posterior distribution of 8. The predictive cumulative distribution function (CDF) is defined analogously as F z ( z ( D )= EelD{Fz(z(8)}. The flowgraph model provides the MGF of the density fz(zl8).For computational purposes, (4) can be written as

fz(zlD) 0:

/ fz(zP)

L(elD0).(el d e ,

(5)

where L(0lD) is the likelihood function of the data and r(8) is the prior distribution of 8. The integration can be performed using any of the many available methods for posterior simulation including Markov chain Monte

256

Aparna V. Huzurbazar and Brian J . Walliams

Carlo (MCMC). We use the MCMC based slice sampling method due to Neal.21 Slice sampling is convenient because it requires minimal tuning, which is also true of equally viable alternatives such as the random walk Metropolis algorithm with automatic step size selection.22 Parametric assumptions about the flowgraph allow us to spec@ the likelihood function for complete data. The flowgraph models a semi-Markov processl so that conditional on the observed transitions, the branch waiting times are i n d e ~ e n d e n t .Parametric ~ ~ ? ~ ~ models for the branch waiting times are chosen using exploratory data analysis such as histograms or censored data h i ~ t o g r a m s .Sometimes, ~ ~ ? ~ ~ theoretical considerations lead to a parametric model; for example, if the flowgraph is modeling a queuing system, then the queuing assumptions are applied to derive the parametric model. When data are incomplete, we use an approximate likelihood for the data. This approximate likelihood is constructed from the saddlepoint approximation applied to the MGF of the incomplete data path in the underlying flowgraph model. Suppose TI, . . . l T, are n independent and identically distributed random variables representing the total waiting time in a flowgraph model. For example, in the flowgraph of Fig. 18.1, our data would consist only of observations on the waiting time 0 -+ 5. We do not observe any intermediate transitions that may have been made. Since we do not observe the intermediate transitions, we cannot easily specify the likelihood function involving the associated waiting time distributions. However, we can construct an approximate likelihood (6)

where f ~ ( t j(0)is the normalized saddlepoint density approximation (2). The flowgraph model gives the MGF of the total waiting time. The saddlepoint approximation converts this MGF to a density function, giving an approximate likelihood. Thus, we are using the saddlepoint approximation to construct an approximate sampling distribution from the individual branch models in the flowgraph. Note that this likelihood construction depends on the entire flowgraph parameterization. Incomplete data can also occur on portions of the flowgraph and the treatment is the same as (6) but using only the relevant portion of the flowgraph. In general, observations contribute different amounts of data. Most observations will be complete, allowing specification of their full likelihood; while others will be incomplete, requiring likelihood construction. The over-

FIowgmph Models for Complex Multzstate System Reliability

257

all likelihood function is given by

(7)

The likelihood can involve several flowgraph MGFs associated with the incomplete data cases.

18.4. Numerical Example

Consider the system of Fig. 18.1. In the following discussion,the exponential density Ezp(X) has mean 1/X, the gamma density Gamma(cr, ,O) has mean cr/,O, and the inverse Gaussian density I G ( p 1 ,p~g)is parameterized as

$.

1-d

and has MGF given by M I G ( S )= exp [p1p2 , for s < Complete and incomplete data were simulated as follows. Transition probabilities pol, p31, and p42 were taken to be 0.6, 0.3, and 0.5 respectively. The branch waiting time distributions used were Exp( 118) for 0 -+ 1, Ezp(lO/3) for 0 4 2, IG(5,4/5) for 1 43, IG(2,4) for 2 -+ 4, Gamma(5,4) for 3 4 1, Gamma(7,3) for 4 42, E z p ( 2 ) for 3 -+ 5, and Ezp(1/4) for 4 -+ 5. The simulated data had complete uncensored information for 45 transitions on 0 -+ l , 42 transitions on 0 -+ 2, 47 transitions on 1 + 3, 70 transitions on 2 4, 14 transitions on 3 -+ 1, 42 transitions on 3 -+ 5, 38 transitions on 4 2, and 32 transitions on 4 4 5. In addition, there were 3 observations censored in state 0, 12 observations censored in state 1, and 1 observation censored in state 3. We also created incomplete data such that there were 10 incomplete transitions observed on 0 -+ 3 and 10 incomplete transitions observed on 2 -+5. The overall likelihood function is given by (7) where the incomplete data likelihood consists of two incomplete portions for 0 3 and 2 -+ 5. The --f

-+

-+

Aparna V. Huzurbazar and Brian J. Williams

258

complete data likelihood function is

j=l

i=l

j=l

i=l

i=l

nr(1- P ~ ~ ) ~ ~ ~ ( z ~[p31~31(~;3~e31) ~ ~ I ~ ~ ~ ) I n;

n35

JJci

i=l

+(I

-

j=l

- ~ ~ ~ ) ~ ~ ~ ( x tx. j * ~ 1 e ~ ~ ) 1 )

n4z

1245

GI ~~ ~ ~~

nb42f42( i=l

> I p42)f45 (5i45 -

,

(8)

i=l

where no1 = 45, no2 = 42, nt, = 3, 7235 = 42, n: = 1, n42 = 38, and summarized in Table 18.1.

n13 = 724.5 =

47, nI; = 12, n24 = 70, r t 3 1 = 14, 32. The notation used in (8) is

Table 18.1. Notation used in (8)

ngh

Number of uncensored transitions from g -+ h

xigh

i t h uncensored observation from g + h

n;

Number of observations censored in state g

X f

j t h observation censored in state g

P9h

Transition probability from g

39

-+

h

fgh(.)

Density function of the waiting time g

Fgh(')

CDF of the waiting time g + h

4

h

Parameter vector for the g -+ h branch model

*Sh

1 - Fgh(')

Contribution of observation censored in state g when transition is only possible to state h

+

1 - [ P g h F g h ( . ) (1 - p g h ) F g k ( . ) ] Contribution of observation censored in state g when transition is possible to state h or state k

The incomplete data likelihood for 0 + 3 is constructed using the MGF Mo3(S)/MO3(0). Note that this MGF is normalized by its value at 0 because it is conditional on taking the path 0 -+ 3. The relevant MGF is -M03(s) POlMOl(S)M13(S) 1 - P31 (9) M03(0)

1 -p31M13(S)M31(S)

PO1

'

Flowgraph Models for Complex Multistate System Reliability

The MGF for the 2 M25(0)1

+

5 incomplete data likelihood is just

259

M25(~)since

(10

The MGFs (9) and (10) are used with the saddlepoint approximation to construct the incomplete data likelihood of ( 6 ) and used to give the second term in (7). The resulting Bayes predictive density (5) and hazard functions computed using slice sampling to obtain posterior samples with the constructed likelihood of (7) are given in Fig. 18.2. The first 1,000 samples were discarded and 15,000 samples were used for the analysis. Table 18.2 gives

Fig. 18.2. Density and hazard function for manufacturing system. Pointwise 95% confidence bands (dashed lines) for the density and hazard functions are essentially indistinguishable from the estimate.

the quantile values for the predictive density estimate. The column labeled “Complete Sample Estimate” refers to the estimate based on the full sample of 15,000 iterates. The column labeled “Batch Mean” refers to the estimate calculated from the mean of 30 batch estimates, each based on 500 samples. The confidence intervals on the hazard function and the quantiles apply variance estimates calculated from the batch method, while everything else uses variance estimates based on “effective sample size” due to Carlin and Louis.27 For a description of these methods for constructed likelihoods, see Williams and H u ~ u r b a z a r . ~ The slight bump in the density is reflective of the manner in which the

260

Aparna V . Huzurbazar and Brian J . Williams Table 18.2. Quantile values for predictive density estimate. Quantile 0.25 0.50 0.75 0.90 0.95 0.99

Lower Bound 5.753893 10.33510 16.87805 24.79846 30.57338 43.69914

Batch Mean 5.762913 10.34666 16.89889 24.83618 30.62560 43.79044

Complete Sample Estimate 5.762881 10.34661 16.89877 24.83612 30.62578 43.79202

Upper Bound 5.771934 10.35821 16.91974 24.87390 30.67782 43.88174

finite mixture and convolution distributions were chosen. Specifically, there were some “fast” times through 0 + 2 -+ 4 + 5. This is also reflected in the hazard. Flowgraph modeling focuses on modeling the observed state-tostate waiting times and then converting the resulting overall distribution to a hazard. This approach has an advantage over assuming an a priori model for the hazard function in that only observable quantities are modeled directly.

18.5. Conclusion Flowgraph models are useful for modeling data arising from complex multistate systems that can be represented by semi-Markov processes. Such data can be censored, incomplete, or unrecognizably incomplete. The case of complete data which includes censoring is the most straightforward. In the case of incomplete data inference becomes more challenging and likelihoods must be constructed. Incomplete data often provide information relevant to the likelihood in addition to the complete data, and thus methods for incorporating such data into the likelihood are necessary in practice. Future work concerns developing analogous methods for unrecognizably incomplete data. For example, in Fig. 18.1, we may have an unrecognizably incomplete transition such as 0 -+ 2 -+ 4. In this case, we could create a type of count variable for the loop and allow it to be taken a finite number of times. This would contribute to the appropriate constructed likelihood. Flowgraph models with slice sampling provide a novel method for inference that has performed effectively in situations where data are incomplete. The method can be used with flowgraphs having arbitrarily large numbers of parameters with additional computational complexity. Future work will consider analysis of flowgraph data using random walk Metropolis MCMC with automatic step size selection as in Graves.” This approach has the benefit of automatically tuning multiple parameter updates, which can improve mixing in some applications.


261

References 1. M. Hamada, H. Martz, C. S. Reese, T. Graves, V. Johnson, and A. Wilson, A fully Bayesian approach for combining multilevel failure information in fault tree quantification and optimal follow-up resource quantification, Reliability Engineering and System Safety 86, 297-305 (2004). 2. V. Johnson, T. Graves, M. Hamada, and C. S. Reese, A hierarchical model for estimating the reliability of complex systems (with discussion), Bayesian Statistics 7.Edited by Bernardo, J., Bayarri, M., Berger, J., Dawid, A., Smith A., and West, M. Oxford: Oxford University Press, 199-213 (2003). 3. B. J. Williams and A. V. Huzurbazar, Posterior sampling with constructed likelihood functions, Los Alamos National Laboratory Technical Report LAUR-046833 (2004). 4. 0. 0. Aalen, Nonparametric inference for a family of counting processes, Annals of Statistics 6, 701-726 (1978). 5. P. K. Andersen and N. Keiding, Multi-state models for event history analysis, Statistical Methods for Medical Research 11, 91-115 (2002). 6. P. Hougaard, Multi-state models: a review, Lifetime Data Analysis 5 , 239-264 (1999). 7. D. R. Cox, Regression models and life tables (with discussion), Journal of the Royal Statistical Society Series B 34, 187-220 (1972). 8. W. R. Allen, A note on conditional probability of failure when hazards are proportional, Operations Research 11,658-659 (1963). 9. A. V. Huzurbazar, Flowgraph models: A Bayesian case study in construction engineering, Journal of Statistical Planning and Inference 129,181-193 (2005). 10. S. J. Mason, Feedback theory-Some properties of signal flow graphs, Proceedings of the Institute of Radio Engineers 41, 1144-1156 (1953). 11. R. Dorf and R. Bishop, Modern control systems, Reading, Mass.: AddisonWesley (1995). 12. Z. Gajic and M. Lelic, Modern control systems engineering, New York: Prentice Hall (1996). 13. A. V. Huzurbazar, Flowgmph Models for Multistate Time-to-Event Data, New York: Wiley (2005). 14. H. Daniels, Saddlepoint approximations in statistics, Annals of Mathematical Statistics 25, 631-650 (1954). 15. J. L. Jensen, Saddlepoint Approximations, New York: Clarendon Press (1995). 16. J. E. Kolassa, Series Approximation Methods in Statistics, New York: Springer-Verlag (1997). 17. N. Reid, Asymptotics and the theory of inference, Annals of Statistics 31, 1695-1731 (2003). 18. H. Bohman, Numerical inversions of characteristic functions, Scandinavian Actuarial Journal, 121-124 (1975). 19. L. A. Waller, B. W. Turnbull, and J. M. Hardin, Obtaining distribution functions by numerical inversion of characteristic functions with applications, American Statistician 49, 346-350 (1995).

262

Aparna V . Huzurbazar

and Brian J. Williams

20. C. Zhang, Fourier methods for estimating mixing densities and distributions, Annals of Statistics 18, 806-831 (1990). 21. R. Neal, Slice Sampling, Annals of Statistics 31, 705-767 (2003). 22. T. Graves, Automatic step size selection in random walk Metropolis algorithms, Los Alamos National Laboratory Technical Report LA-UR-05-2359 (2005). 23. S. Karlin and H. Taylor, A First Course in Stochastic Processes, New York: Academic Press (1975). 24. N. Limnios and G. Oprisan, Semi-Markov Processes and Reliability, Boston: Birkhauser (2001). 25. 0. Barnett and A. Cohen, The histogram and boxplot for the display of lifetime data, Journal of Computational and Graphical Statistics 9, 759-778 (2000). 26. A. V. Huzurbazar, A censored data histogram, Communications in Statistics: Simulation and Computation 34(1), 113-120 (2005). 27. B. Carlin and T. Louis, Bayes and Empirical Bayes Methods for Data Analysis, 2nd edition, Boca Raton: Chapman & Hall (2000).

CHAPTER 19 INTERPRETATION OF INSPECTION DATA EMANATING FROM EQUIPMENT CONDITION MONITORING TOOLS: METHOD AND SOFTWARE

ANDREW K. S. JARDINE C B M Laboratory Department of Mechanical and Industrial Engineering University of Toronto, Toronto, Canada E-mail: [email protected]. ca

DRAGAN BANJEVIC CBM Laboratory Department of Mechanical and Industrial Engineering University of Toronto, Toronto, Canada E-mail: [email protected]. ca This chapter focuses on current industry-driven research that blends together risk estimation, using a PHM, along with economic considerations to establish optimal condition-based maintenance decisions. Recent results of the research program are described including development of the EXAKT software and its successful application to the interpretation of inspection data emanating from vibration monitoring in the food processing industry, oil analysis in an open pit mine, seal failure data in a nuclear generating station, and vibration signal data from gearboxes subject to tooth failure.

19.1. Introduction Much research and product development in the area of condition-based maintenance (CBM) focuses on data acquisition and signal processing. However, the focus of this chapter of t h e book is to examine what might be thought of as t h e final step in the CBM process-optimizing t h e decisionmaking step. Jardine' provides an overview of the following procedures being used to 263

264

Andrew

K. S. Jardine and Dmgan Banjevic

assist organizations make smart CBM decisions: physics of failure; trending; expert systems; neural networks and optimization models. Possibly the most common approach to understand the health of equipment is through trending various measurements and comparing them to specified standards, such as illustrated in Fig. 19.1 where measurements of iron deposits in an oil sample are plotted on the Y-axis and compared to warning and alarm limits. The maintenance professional then takes remedial action when deemed appropriate. Many software vendors addressing the needs of maintenance have packages available to assist in interpreting condition monitoring (CM) measurements, with the goal of predicting failure through trending. This method usually works well if the variables used for trending (in engineering sometimes called features, or parameters) are directly linked to the physics of failure, or used to define the failure, such as the total amount of wear, thickness, sometimes the level of vibration, and amount of cracks (e.g. the total length, or total area with cracks on turbine blades). It is also necessary that features show clear trend (increasing or decreasing) with relatively small variations in successive values around the trend line so that it is possible to give reliable predictions (using extrapolation) of oncoming failures (that is, of crossing alarm and/or failure levels). But, in many other cases when the variables are only indirectly linked to failures, and/or “contaminated” by maintenance (temporarily reduced by certain minor maintenance actions, such as an oil change), and also prone to large sampling errors, the trending method is not very useful. A typical example (from our experience) for this situation is oil analysis, in which simple trending may not be very successful. A consequence observed when the trending approach is undertaken is that the maintenance professional is often too conservative in interpreting the measurements. In work undertaken by Anderson et a1.’ on using PHM (proportional-hazards model, which will be discussed in some details in Sec. 19.2), it was observed that 50% of aircraft engines that were removed before their design life, due to information obtained at the oil sampling of engine oil, were identified by the engine manufacturer to still be in a state that would have enabled them to remain on the 4-engined aircraft. Christer3 has made the same point where he reported that since condition monitoring of gearboxes had been introduced, gearbox failures within an organization had fallen by 90%. As Christer said: “Thisis a notable accolade for CM.” Christer also reported that it transpired that when reconditioning “defective” gearboxes, in 50% of occasions there was no evident gearbox fault. He then concluded: “Seemingly, CM can be at the same time very

Interpretation of Condition Monitoring Data

265

Fig. 19.1. A classical approach to condition monitoring.

effective, and rather inefficient.” Clearly there is a need to focus attention on the optimization of condition monitoring procedures. In this chapter we will present an approach that estimates the hazard (risk of failure), where the hazard depends on the age of equipment and condition monitoring data, using a PHM. We will then examine the optimization of the CM decisions by blending in with the hazard calculation the economic consequences of both preventive maintenance, including complete replacement, and equipment failure. 19.2. The Proportional Hazards Model

Cox4 in the Sec. 19.4. “Dependence of failures on wear” of his well-known book introduced the idea of deciding on the replacement time of an item (component) based not only on its age, but also on its physical properties, which may be called by Cox “wear.” If Z(z) (in the Cox’s notation Zs), multidimensional, is the value of the wear of the component of age z, Cox defines “the age wear-specific failure rate” as lim P(z < X 5 z h(z,z ) = As-O+

+ A z ( X > z, Z(z) = z ) / A z ,

(1)

(in the Cox’s notation h ( z ,z ) = $ ( z , z)). As Cox states: “When {Zs}is a stochastic process of specific structure and the function $ ( z , z) is given, we have a probabilistic model of wear and failure.” He then considers some special cases of the “wear” process (including the case when wear is a perfect predictor of failure, as already discussed above). In Sec. 19.4. “Strategies involving wear” of the book, Cox4 discusses some replacement strategies that

266

Andrew K . S. Jardine and Dmgan Banjevic

depend on the level of wear. This idea seemed to be a real novelty at that time since Cox provided only two references to this method. Gertsbakh5 proposed a similar idea and applied it in maintenance, but without reference to Cox. The idea was also included in the book Gertsbakh16that was a translation of the 1969 Russian edition, so the idea should not be unknown to the reliability community. Still the idea didn’t get much attention until Cox7 introduced the proportional-hazard model approach to estimate the risk of failure of an item, taking into account concomitant information, by specifymg the form of the function 4(z, x) in more detail. Even then, it was mainly applied in lifetime data analysis in the biomedical field and only in the early 1980s in reliability (Anderson et a1.2). Cox’ also introduced the proportional-intensity model (an equivalent of PHM for recurrent events, such as for repairable systems) directly suggesting applications in reliability, but this paper remained almost ignored for some years. This situation might be explained by the fact that condition monitoring was not extensively used in industry at that time (as a new and often expensive technique) and/or the inclination of practitioners to use simple age-based mathematical models. It might have happened at that time also, as Ushakovg stated regarding the problem of preventive maintenance, “due to a lack of consistent field data.” Nowadays “consistent field data” is much more available (still not always in a satisfactory state). The work reported in this chapter is a direct outcome of Cox’s insight that PHM can be applied in the reliability field. In particular we demonstrate its power in assisting reliability and maintenance professionals to efficiently interpret signals they obtain when using condition monitoring, where the objective is to obtain the maximum useful life, along with economic considerations, from each physical asset before taking it out of service for preventive maintenance. Cox7 introduces PHM so that the conditional hazard rate of a unit is the product of a baseline hazard rate and a functional term, (2)

with ho(t) being the baseline hazard rate depending on time only and . Z ( t ) ) being an adjusting functional term that models the effect of the particular unit characteristics, with y a vector of regression coefficients and Z ( t ) a vector of concomitant factors (covariates) that may include condition monitoring data and other useful available information about the unit collected up to time t. Covariates can be also diagnostic variables that describe the state of the unit. If the baseline hazard is left unspecified, the model in (2) is usually called the semiparametric Cox PHM. The


267

functional term may have various forms, the most common being the ex. Z ( t ) )= exp(y’ . Z ( t ) ) .Cox7 suggested a method which he ponential, called conditional likelihood and later partial likelihood for estimating the parameters of the functional term, without specifying a form of the baseline hazard term. This makes the semiparametric model very flexible, but then requires nonparametric estimation of the baseline hazard term. For additional details about the semiparametric model and earlier references and applications, see Kumar and K1efsjo.l’ The PHM is now commonly used in reliability. For some more recent applications, see e.g. Gasmi et al.,” Krivtsov et a1.,12 Vlok et al.,I3 Le Gat and Eisenbeis,14 Percy et al.,15 Kobbacy et a1.,l6 Luxhoj and Shyur,l’ and Kumar and Westberg.18 There is a tendency in reliability applications to use the parametric model, in which the baseline hazard ho(t)has a specified functional form, up to unknown parameters that should be estimated from the data, along with the regression parameter y. A common model is a “Weibull PHM” in which

(9) 0-1

the baseline hazard is of the power-law form, that is ho(t) = (f) , a model used in the case studies described in this chapter. Information that may be included in the PHM can come from various sources. In practice covariates may be measurements obtained from condition monitoring (and then usually internal, time-dependent variables, such as from oil or vibration analysis, or mounted sensors that provide various types of information, e.g. from diesel engines, such as oil pressure and temperature, crankcase pressure, exhaust gas temperature and pressure, etc), or from working conditions (external variables, such as environment, humidity, work-load, temperature, rotating speed), or events specific (number of startups, number of previous preventive maintenances (PMs) and/or failures, accumulated downtime, servicing frequency, maintenance strategy, total money spent on repair and maintenance actions). Time variables such as global and local working age, and often the number of previous failures/PMs, are typically not considered as covariates, and they are preferably included in the baseline intensity, which provides more flexibility. It should be noted that “time variables” should be interpreted as appropriate “working age” variables of the unit, such as the working hours, mileage, total accumulated work load, etc., usually not the same as calendar time. The “working age” may be adjusted to “effective age” that may, for example, incorporate maintenance interventions, or changes in LLload77 that affect aging, when the load is not considered as a covariate. A classical method to incorporate effective age is to use the virtual age concept, as defined by Kijima.lg An overview of differ-

268


ent methods to incorporate usage factors into survival models can be found in Duchesne and Lawless,20i21and references therein related to reliability. See also Lugtigheid et al.,” and Pena and Slate,23 in this volume. A main goal of applying PHM in reliability is to combine condition monitoring data and working history of a unit with its age for optimizing maintenance/replacement decisions. The typical intention of maintenance professionals, as they usually state, is to “prevent failures,” but also to run the unit as long as possible, without false alarms. These two requirements are obviously contradictory, unless the failures can be predicted accurately, because the first one requires that more money is spent on maintenance and preventive repairs/replacements, and the second one increases the risk of failures. If cost of operation is the criterion for decisions, an optimal balance should be found between the cost of maintenance and the cost consequence of failures. An obvious extension of the classical age replacement policy (replace/repair the unit at a predetermined fixed age, or at failure, whichever comes first) is the policy to replace the unit when covariates reach some predetermined “alarm” values, where the alarm values may depend on the current age of the unit (so, the “age specific” levels), and at failure. If the hazard rate function has an increasing trend, the optimal (or near to optimal) policy has a very simple form: replace/repair the unit when the hazard rate (not particular covariates!) reaches the predetermined (fixed) risk level (Aven and BergmanZ4).It simply means that the hazard rate function captures all information contained in the data needed for optimal decisions. Obviously, it also means that in real applications of this result the hazard rate function should be properly established. This will be a main task in creating optimal decision policies, as it will be seen from the reported case studies. Makis and JardineZ5developed a methodology based on stochastic dynamic programming to optimize the risk and economic trade-off, i.e. to calculate the optimal threshold “risk level.” This approach is illustrated in Fig. 19.2 where it is assumed that as the equipment ages there is an increasing risk associated with a unit failing in the next moment in time. The reliability specialist can select a risk cut-off level at which to intervene and replace the deteriorating equipment. Each possible risk level has an associated expected cost made up of the cost of preventive replacement and the cost consequence of an equipment failure. The key is to identify the optimal risk level d* at which the equipment should be replaced. Thus the plan is to monitor risk, using a PHM, and once the risk hits the specified value d*, then it is optimal to perform a preventive replacement. It is


269

Fig. 19.2. Risk level and optimal policy.

important to understand that the suggested moment of preventive replacement is not at a fixed age (as it is in age-based models), but depends on the particular “hazard history” influenced by the measurements and other information included in the hazard rate function. In typical situations, if covariates show “nice” behavior, the preventive replacement will be postponed, but eventually the age will become the most dominant factor in the risk of failure, and the unit will be replaced. Of course, if the equipment fails it has to be replaced under failure conditions. There exist cases (not uncommon) in which the hazard rate function does not directly depend on the age of the unit, but only on the condition monitoring variables, in which case the policy may be reduced to the situation similar to the “classical approach,” illustrated in Fig. 19.1, with fixed alarm limits on covariates. It should be noted that the ‘Lreplacement77 may not be a physical replacement of the unit (which may be typical for certain components), but also an appropriate major maintenance/repair (more typical for systems and larger components) that returns the unit to, practically, “as-good-as new” conditions. If this is not the case, the methodology still could be applied by including certain measures of repair in the hazard function, or flexible “initial” conditions that affect the baseline hazard, as discussed above. We will not consider this more complicated situation in greater detail in the following, but we will mention it in the last section of this chapter, about future research plans.

270

Andrew K . S. Jardine and Dragan Banjevic

Technically, the optimal risk level d* is calculated to minimize the expected average cost per unit time of the decision policy, @(d), as a function of the risk level d , which is given by, (3)

where C is the preventive replacement cost and C + K the failure replacement cost. Q ( d ) represents the probability that failure will occur before the hazard reaches the level d, so that the replacement will be at failure. Then, 1 - Q ( d ) is the probability that the hazard will reach the level d before the failure occurs, and then the replacement will be preventive. W ( d ) is the expected time until replacement, either preventive or at failure. For details of the calculation, see Banjevic et a1.26 The costs C and C K in practice are almost never constant, but the average values can be used, unless the variations in the costs are very high. In the latter case it may appear that significantly different failure modes and/or failure consequences exist, which would require another approach to the modeling of the hazard rate function and the decision procedure. This is also another research topic, quite significant for applications.

+

19.3. Managing Risk: A CBM Optimization Tool

Subsequent to the Makis and Jardine25 paper a research group was formed to take the theory and make it work in practice. To achieve this goal a number of companies supported in 1995 the creation of the ConditionBased Maintenance Laboratory at the University of Toronto (CBM Lab) (www.mie.utoronto.ca/cbm). As a consequence, the EXAKT software was developed, along with addressing challengingtheoretical issues that resulted from close collaboration with the consortium members (numbering 11 in 2005). There are a few main components to EXAKT (see Banjevic et a1.26):

(1) Creation of a convenient and flexible database by extracting the event (maintenance) and condition (inspection - condition monitoring) information from external databases. (2) Data checking, analysis and preprocessing (including transformations), using graphical and statistical tools. (3) Estimating and testing parameters of the PHM and Markov process probabilistic model for covariates.

(4) Computation, analysis, validation and saving of the optimal replacement policy (decision model).

271


(5) Using an already saved decision model t o make decisions for current inspection records stored in the database. The decision recommendation, and some other useful information, such as the expected remaining life (in the case of “don’t replace” recommendation) is stored in the database for the user’s convenience.

Fig. 19.3. Inspections records and events data.

Figure 19.3 is a screen shot of condition monitoring data that is obtained from equipment that is monitored through oil analysis, combined with event data that provides information about the timing of equipment installations (B), removals (whether preventive and so treated as a suspension time, or due to failure) and any maintenance action that is recorded, such as oil changes (OC) (an illustration for points 1 and 2 above). Both types of data are then used to build the PHM for the hazard function. Combining the inspection records and the event data enables the following Weibull PHM to be obtained:

(

h ( t , z )= 5.007 t 38,988 38,988 ~

e(0.2626~ Iron+1.0522x Lead) 7

(4)

where Iron and Lead are the values obtained from the measurement at time t , and z = (Iron,Lead) (an illustration for point 3 above). Incorporating cost data then enables the optimal decision chart to be obtained from the PHM, as shown in Fig. 19.4 (an illustration for points 4 and 5 above). The decision chart actually presents a more convenient equivalent form of the stopping decision rule h(t,z ) 2 d*, in a form 2 A* - ( p - 1) ln(t), which

272

Andrew K . S. Jardane and h g a n Banjevic

Fig. 19.4. Optimal decision chart.

can be easily obtained by taking logarithm of the both sides of the first form, once the optimal threshold level d* is calculated. y’z is reffered to as the “composite covariate” in the following. The Weibull PHM for the hazard function is buit by maximizing the full likelihood. The important (significant) covariates are selected combining the backward and forward selection procedure The same method is used in all case studies presented in Sec. 19.4. Further details on the theory and its application to the CBM optimization work can be found in Banjevic et a1.,26and Vlok et a l l 3 19.4. Case Study Papers

Readers interested in further applications of the CBM optimization work can find details about pilot studies undertaken in the food processing industry in Jardine et al.,27 open pit mining in Jardine et a1.,28 in nuclear power generation, Jardine et al.,” and in testing gearbox tooth failures, Lin et aL3’ A summary of these studies follows. 19.4.1. Food processing: use of vibration monitoring

A company undertook regular vibration monitoring of a critical shear pump bearings. At each inspection, 21 measurements were provided by an accelerometer. Using the theory described in the previous section, and its


273

embedding in the software EXAKT, it was established that of the 21 measurements there were 3 key (significant) vibration measurements: Velocity in the axial direction in both the first band width and the second band width, and velocity in the vertical direction in the first band width. In the plant the consequence of a bearing failure was 9.5 times greater than replacing the bearing on a preventive basis. After calculating the optimal hazard level, as explained in Sec. 19.3, and comparing it with the data, it was clear that through following the decision optimization approach total cost due to maintenance and failures could be reduced by 35%. The Optimal Decision Chart used for interpreting the appropriate action to take at inspection of the bearing is shown in Fig. 19.5.

Fig. 19.5. Shear pump bearing decision chart.

19.4.2. Coal mining: use of oil analysis

Electric wheel motors on a fleet of haul trucks in an open-pit mining operation were subject to oil sampling on a regular basis. Twelve measurements resulted from each inspection and compared to warning and action limits to decide whether or not the wheel motor should be preventively removed. These measurements were: Al, Cr, Ca, Fe, Ni, Ti, Pb, Si, Sn, Visc 40, Visc 100 and Sediment. Applying a PHM to the data set it was identified that there were only

274


two key risk measurements, correlated to the cause of the wheel motor failure being monitored by oil analysis; these measurement were iron (Fe) and Sediment. The cost consequence of a wheel motor failure was estimates three times greater than when replacing it preventively. The economic advantage of following the optimal replacement strategy would be a cost reduction of 22%. The Optimal Decision Chart used for interpreting the appropriate action to take at inspection of the wheel motor is shown in Fig. 19.6. "

10 1

_

P 2 r

x I1

N

II

9 'C

>

8

.9 Lo a

5

0

0

Don't replace

0 0

5000

I0000

15000

20000

Working Age = 11587 [hr] Z = 0.002742'Fe + 5.3955e-005'CorrSed

Fig. 19.6. Electric wheel motor decision chart.

19.4.3. Nuclear generating station Hydro-dyne seals perform an important function in CANDU type reactors. During refueling, they seal the connection between the fueling machine and the end fitting of the reactor fuel channels, preventing the leakage of heavy water from the reactor. At a nuclear plant, 4 reactors employ 8 hydro-dyne sealed refueling machines. Keeping track of the condition of each seal poses a particular challenge to site engineers, and safety and environmental considerations have prompted a 100% inspection regimen. That is, prior to each use, after having positioned the refueling machine adjacent to the target reactor tube, the operators check for leakage by measuring the pressure drop in the seal


275

over a fixed time interval. If the seal fails the test, the operators abort the intended operation and perform the required maintenance. As a consequence of failure, the plant will have incurred the costs of setting up for the canceled refueling operation, some loss in energy efficiency due to the delay in refueling, and some organizational disruption due to lack of planning of the resulting emergency maintenance work in addition to the direct cost of seal replacement. Engineers desire to perform timely preventive seal replacements in an attempt to minimize the overall costs due to failure and maintenance. After applying a PHM to the inspection and event data (the leak rate and records of working cycles) from the refueling operations at the nuclear plant over an 11-year period, the optimal decision chart was created. The leak rate shows clear increasing trend, but with large variations in subsequent measurements, an example of a “feature” directly linked to the definition of the failure, as mentioned in the introduction. Also, the “alarm” level curve is almost flat (parameter ,8 close to one) because the leak rate “dominates” the working age. The Optimal Decision Chart used for interpreting the appropriate action to take at inspection of the hydro-dyne seals is shown in Fig. 19.7.

0

Fig. 19.7. Hydro-dyne seal decision chart.

Andrew K . S. Jardine and Drngan Banjevic

276

19.4.4. Gearbox subject to tooth failure

Gearboxes are run to failure on the mechanical diagnostic test-bed. The condition vibration signal was collected and processed to calculate the “fault growth parameter” (FGP) and its revised version FGPl from the residual error signal. Some other variables were also calculated and all were used to calculate the risk of gear-box tooth failure using a PHM. The initial torque was increased or alternated differently for different pumps. The examined failure mode was “gear tooth fracture.” Since the gearboxes operated under varying loads, it was not appropriate to use simple “calendar time” as a working age variable (see a comment in Sec. 19.2). Instead, the integral of the product of actual running time and instantaneous torque was used as a measure of the working age. Several models were tested and the variables FGPl and RFM (mean of the power spectrum of the residual error signal) appeared to be the best to predict oncoming gear tooth failure. Using an estimate of the cost ratio of the failure replacement to the preventive replacement of 5:1, the model with FGPl showed decision results similar to model with the both variables. The Optimal Decision Chart used for preventing the gear-tooth failure is shown in Fig. 19.8.

C-Y

0

m u? 7

II

N

a

c

.-Q

b>

s a, c .v)

g E

s

Working Age = 3470.22 [in-lb-day]

Z = 0.38843*FGPI Fig. 19.8. Gearbox tooth decision chart.


277

19.5. Future Research Plans

Some of the research topics that are in future plans, or are already in development in the CBM Lab are: relaxation of a common assumption in the literature that at the maintenance intervention the item is returned to the statistically as good-as-new condition; inclusion of different failure modes or multicomponent systems in the model; variable costs at failure and preventive maintenance; inclusion of the cost of the condition monitoring in the decision optimization model and planning of the next inspection; calculation of the remaining useful life (Banjevic and Jardine31), and modeling of complex repairable systems (Lugtigheid et a1.22)Of great importance also are the problems related to the statistical estimation of model parameters from incomplete or sparse data, particularly with a small number of failures, such as for a new type of equipment. In that area, combining expert knowledge with Bayesian approach is the main approach.

References 1. A. K. S. Jardine, Optimizing condition based maintenance decisions, Annual Reliability and Maintainability Symposium, Seattle, USA, 90 (2002). 2. M. Anderson, A. K. S. Jardine, and R. T. Higgins, The use of concomitant variables in reliability estimation, Modeling and Simulation 13, 73 (1982). 3. A. H. Christer, Developments in delay time analysis for modelling plant maintenance, Journal of the Operational Research Society 50, 1120 (1999). 4. D. R. Cox, Renewal Theory, Methuen, London (1962). 5. I. B. Gertsbakh, Engineering Cybernetics 1,54 (1967). 6 . I. B. Gertsbakh, Models of Preventive Maintenance, North-Holland, Amsterdam (1977). 7. D. R. Cox, Regression Models and Life-Tables, Journal of the Royal Statistical Society B34, 187 (1972). 8. D. R. Cox, The statistical analysis of dependencies in point processes, in Stochastic Point Processes, Ed. P. A. Levis (Wiley, New York, 1972), p. 55. 9. I. Ushakov, Reliability: past, present, future, in Recent Advances i n Reliability Theory, Ed. N. Limnios and M. Nikulin (Birkhauser, Boston, 2000), p. 3. 10. D. Kumar and B. Klefsjo, Reliability Engineering and System Safety 44, 177 (1993). 11. S. Gasmi, C. Love, and W. Kahle, A general repair, proportional-hazards, framework to model complex repairable systems, I E E E Transactions on Reliability 52, 26 (2003). 12. V. V. Krivtsov, D. E. Tananko, and T. P. Davis, Regression approach to tire reliability analysis, Reliability Engineering and System Safety 78, 267 (2002). 13. P. J. Vlok, J. L. Coetzee, D. Banjevic, A. K. S. Jardine, and V. Makis,

278

14.

15.

16.

17.

18.

19. 20. 21. 22.

23. 24. 25. 26.

27.

28. 29. 30.

31.

Andrew K. S. Jardine and Dragan Banjevic Optimal component replacement decisions using vibration monitoring and the proportional-hazards model, Journal of the Operational Research Society 53, 193 (2002). Y.Le Gat and P. Eisenbeis, Using maintenance records to forecast failures in water networks, Urban Waters 2, 173 (2000). D. F. Percy, K. A. H. Kobbacy, and H. E. Ascher, Using proportionalintensities models to schedule preventivemaintenance intervals, ZMA Journal of Mathematics Applied in Business and Industry 9, 289 (1998). K. A. H. Kobbacy, B. B. Fawzi, D. F. Percy, and H. E. Ascher, A full history proportional hazards model for preventive maintenance scheduling, Quality and Reliability Engineering International 13, 187 (1997). J. T. Luxhoj and H. Shyor, Comparison of proportional hazards models and neural networks for reliability estimation, Journal of Intelligent Manufacturing 8,227 (1997). D. Kumar and U. Westberg, Proportional hazards modeling of timedependent covariates using linear regression: a case study, ZEEE IPransactions in Reliability 45,386 (1996). M. Kijima, Further results for dynamic scheduling of multiclass queues, J. Appl. Probab. 26,89 (1989). T. Duchesne and J. Lawless, Superparametric inference methods for general time scale models, Lifetime Data Analysis 8, 263 (2002). T. Duchesne and J. Lawless, Lifetime Data Analysis 6,157 (2000). D. Lugtigheid, D. Banjevic, and A. K. S. Jardine, Modelling repairable system reliability with explanatory variables and repair and maintenance actions, I M A Journal of Management Mathematics 15,89 (2004). E. A. Pena and E. H. Slate, Modern Statistical and Mathematical Methods in Reliability, Chap. 25, pp. 347-362 (2005). T. Aven and B. Bergman, Optimal replacement times-a general set-up, Journal of Applied Probability 23, 432 (1986). V. Makis and A. K. S. Jardine, Optimal replacement in the proportional hazards model, INFOR 30, 172 (1992). D. Banjevic, A. K. S. Jardine, V. Makis, and M. Ennis, A control-limit policy and software for condition-based maintenance optimization, INFOR 39, 32 (2001). A. K . S. Jardine, T. Joseph, and D. Banjevic, Optimizing condition-based maintenance decisions for equipment subject to vibration monitoring, Journal of Quality in Maintenance Engineering 5, 192 (1999). A. K. S. Jardine, D. Banjevic, M. Wiseman, S. Buck, and T. Joseph, Journal of Quality in Maintenance Engineering 7, 286 (2001). A. K. S. Jardine, K. Kahn, D. Banjevic, M. Wiseman, and D. Lin, Proceedings of COMADEM 2003, Sweden, 175 (2003). D. Lin, M. Wiseman, D. Banjevic, and A. K . S. Jardine, An approach to signal processing and condition-based maintenance for gearboxes subject to tooth failure, Mech. Syst. Signal Proc. 18,993 (2004). D. Banjevic and A. K. S. Jardine, to appear in ZMA Journal of Management Mathematics, (2005).

CHAPTER 20 NONPROPORTIONAL SEMIPARAMETRIC REGRESSION MODELS FOR CENSORED DATA

ZHEZHEN JIN Department of Biostatistics Mailman School of Public Health Columbia University 722 West 168th Street New York, NY 10032 USA E-mail: [email protected]. edu In lifetime or censored data analysis, the accelerated failure time (AFT) model and the linear transformation models are attractive nonproportional semiparametric regression models. The AFT model is of the same form as the usual linear regression models for noncensored data, and the linear transformation models include the popular Cox proportional hazards model and proportional odds model as special cases. In this paper, we review recent development on the estimation and inference methods for these two types of models. The development provides effective and reliable means of estimating the regression parameters in the AFT and linear transformation models, which makes these models available for practitioners.

20.1. Introduction Censored d a t a are common in many fields, such as economics, business, industrial engineering and biomedical studies. T h e right-censored data usually consist of ( X i ,y Z , hi), i = 1,. . . , n, where X is a pdimensional covariate, Y = min{T,C}, with T being t h e response variable and C being the censoring variable, and b = 1{T 5 C} being the indicator of censoring. With t h e censored data ( X i ,y Z , & ) , the Cox proportional hazards model is often used t o examine the covariate effects.' The Cox model is semiparametric and is easy t o fit with many existing statistical software. Its asymptotic properties can be justified by elegant martingale theory.2 However, 279

280

Zhezhen Jzn

the validity of this approach depends on the proportional hazards assump tion which can be violated in many important practical occasions. The Cox model is also difficult to interpret when the response variable is not related to the concept of “time to event.” A number of alternative semiparametric regression models to the Cox model have also been proposed and studied, particularly, the accelerated failure time model,3-18 the proportional odds model,19-24 the linear transformation m ~ d e l , ~ ~and - ~the ’ accelerated hazards mode1.31i32These models do not require proportional hazards assumption. The accelerated failure time model is of the same form as the usual linear regression model and easy to interpret. The proportional odds model is particularly useful in modeling converging hazards with time in two or more groups. The linear transformation model includes the Cox proportional hazards model and the proportional odds model as special cases. The accelerated hazards model includes the accelerated failure time model and the Cox proportional hazards model as special cases. Unlike the Cox model, however, these models are seldom used in practice due to the lack of practically feasible estimation methods. Finding numerically feasible estimation methods is critical to the application of these models. We refer readers to Refs. 3, 33-35 for further discussion on these models. In this paper, we focus on and review recent new development in the estimation and inference for the accelerated failure time m0de1’~t’~and the linear transformation models.30 As mentioned above, these two types of models do not require proportional hazards assumption. They are also applicable when the response variable is not related to the concept of “time to event The new development provides numerically effective and reliable means of estimating regression parameters in the two models. In Sec. 20.2, the accelerated failure time model and the linear transformation models are described and recent development on estimation and inference on these models is presented. Some concluding remarks are given in Sec. 20.3.

20.2. Models and Estimation 20.2.1. Accelerated failure time model

A way to study the covariate effects on the response is to use the semiparametric linear regression model that is of form

Ti = X,Tpo + ei,

(1)

Nonproportional Semipammetric Regression Models for Censored Data

281

where PO is the unknown true p x 1 parameter of interest and G (i = 1,.. ,n) are unobservable independent random errors with a common but completely unspecified distribution function. (Thus, the mean of E is not necessarily 0). In survival analysis in which the response is the logarithm transformation of the survival time, the model (1) is called the accelerated failure time (AFT) model. As usual, it is assumed that Ti and Ci are independent conditional on X i . In the absence of censoring, there are many well-developed semiparametric estimation and inference methods for the model (l),particularly rank-based approach and least-squares approach. On the other hand, there are few practically useful estimation and inference methods for the model when the response Ti may not be observed accurately due to censoring. The presence of censoring creates a serious challenge for the semiparametric analysis of the model. Extensions of rank-based or least-squares approaches were proposed and studied.4- l6 Despite theoretical advances, these methods have rarely been used in practice due to their computational difficulty. 20.2.1.1. Rank-based approach In this section, we present inference procedure developed recently by Jin, Lin, Wei, and Ying.17 Let e,(P) = Y , - X,'P, i = 1,..., n. The original rank-based approach uses estimating function for PO that takes the form

c n

U+(P) =

M P ; ez(P)){X*- S1(P;ez(P))ISo(P;et(P>),

(2)

a=1

where S,(p;t) n-l

=

n-'C:==lXd(ek(P)

2

t ) , and so(P;t)

=

C;=,I ( e k ( P ) 2 t ) ,and (b is a weight function, see Refs. 4 and 5. For the

two-sample problem, in which X is a single dichotomous variable, U+(O)is the weighted logrank statistic. The weights q5 = 1 and 4(0;t ) = So(0;t ) give the usual logrank test statistic and the Gehan test statistic, respectively. It is easy to observe that the rank-based estimating function U+(p) is neither differentiable nor continuous in terms of regression parameters. The exact roots to the equation Ub(p)= 0 seldom exist and U+ can also be nonmonotone and lead to multiple solutions. Consequently,the resulting estimators may not be well-defined, especially when the number of covariates is large. Furthermore, it is shown that the covariance matrices of the estimators involve nonparametric estimation of the underlying unknown density function for 6 , which are rather difficult to obtain. In summary, although theoretically a consistent and asymptotically normal estimator of POcan be

282

Zhezhen Jzn

obtained by solving the estimating equation: U+(P)= 0, approaches along this line are numerically complicated and difficult to implement for both in point estimation and in covariance matrices estimation. The general weighted logrank estimating function (2) for PO can be reexpressed in counting process notation: (3)

x(P,t)

where @ ; t ) is a weight function, Ni(P,t)= biI(ei(P) 5 t ) , = Sl(P,t)/So(P,t). The key of the newly developed method of Jin et a1.17 is the use of following modified estimating function

(4)

,&

where $(P; t ) = q5(@; t)/So(P;t ) and is an initial consistent estimator of PO. Note that UM(.,,&) is closely related to but not equivalent to the original estimating function U&(.).Let ,& be the solution to U M ( P , = 0, then the new estimating function with /$ as the initial value is U M ( ~ , , & At the lcth step, let the solution to UM(P,,&-~)= 0 be denoted by b k . It is important to note that the estimating function U M ( ~pk-1) , is monotone in and is the gradient of the following objective function

61)

n

n

- ej(P)}-,

G & ( p l B k - l )=

2=1 j = 1 (5) where { a } - =I a I I ( a < 0) for a real number a. Therefore, the p k can be obtained by minimizing G & ( P , p k - l ) .It is easy to see that G + ( P , b k - l ) is a convex function of 0, and the minimization of G+(P,&l) can be implemented through the standard linear programming technique. If the ,& converges, the limit is the solution of the original estimating equation U&3) = 0 in (3). Under regularity conditions, it can be shown that each b k , k = 2 , . . . , is consistent and asymptotically normal if the initial estimator ,& is consistent and asymptotically n0rma1.l~Thus, the approach provides a class of legitimate estimators. If G+(p,P k ) , k = 1,. . . , is minimized repeatedly until two consecutive estimates are close enough, then the limit is the estimator for PO based on the original rank estimating function (2). A consistent and asymptotically normal initial estimator can be obtained by choosing the Gehan-type weight $(P; t ) = SO@;t ) in ( 2 ) . In this

Nonproportional Semipammetric Regression Models f o r Censored Data

case, as shown by Fygenson and Ritovlg the component of P. It can be reexpressed as n

283

U+(P)is monotone in each

n

(6)

Let (7) i=l j Z 1

Then (6) is the gradient of a convex function G(P) of ,8 whenever it exists. Let ,& be the minimizer of G(P). Since G(P) is a convex function, ,& is well-defined for any sample size. Again, the minimization of G(P) can be carried out by linear programming techniques, i.e. , minimizing the objective function C;=, biwij under linear constraints w i j = e j ( 0 ) - e i ( P ) and w i j 2 0, for i , j = 1,.. . , n. It is also not difficult to see that minimizing G(P) is equivalent to minimizing n

n

n

n

(8 k = l 1=1

a=1 j=l

where Yn+l is an extremely large number. This minimization can be implemented with the algorithm of Barrodale and Roberts36 and Koenker and D ’ o r e ~ which , ~ ~ is available in statistical software packages, such as s-PLUS. The asymptotic variance of resulting P k , however, involves the unknown density and its derivative functions of c, which is difficult to estimate in practice. To overcome this difficulty, Jin et ~ 1 . ’ also ~ proposed a resampling method to estimate the variance of by modifying the resampling approach of Jin, Ying, and Wei.38 Specifically, the objective function G,#,(P, b k - 1 ) is perturbed by independent and identically distributed known positive random variable V , (i = 1 , 2 . . . , n ) satisfying E(V,) = Var(V,) = 1. That is,

&

n

n

4(ea (0; - 1 )) s~

G; (P, pi -1) =

- 1 i ez (pi- 1

)8, { ea (P)-ej

(PI }- V ,

,

a=1 j = 1

(9) Note that G;(P, &-,) is a convex function of P. Again, the minimization can be done through the standard linear programming technique. The initial value can be obtained by minimizing perturbed Gehan-type objective function n

n

(10

Zhezhen J i n

284

Conditional on observed data ( Y , , d i , X i ) (i = l , . . ., n ) , the {K} are the only random components in G; and G*. Let Pi be the minimizer of G;(P,P;-,). Under regularity conditions, it can be shown that the distribution (conditional on the data) of n'I2(& - b k ) is asymptotically equivalent to that of n1I2(fik- pO).l7Therefore, one may generate a large number of realizations for through { K} and use them to estimate the variance-covariance matrix of The perturbation random variable V , can be generated from known distributions, such as exponential distribution, beta distribution, and lognormal distribution, satisfying E ( K ) = V a r ( K )= 1. In summary, the use of linear programming technique and resampling method provides a practically useful method for the estimation and inference on the AFT model. A S-PLUS program is available from the author for implementing the new procedure.

a.

20.2.1.2. Least-squares approach

In the absence of censoring, the classical least-squares estimate defined as a solution vector /3 to the minimization problem

b of PO is (11

with respect to (a,,BT),where a0 = E E and Fn,o(.)is the empirical distribution constructed from { e i ( p ) } . Equivalently, the least-squares estimate is the solution of the estimating equations

i=l

i= I

In particular, the estimate of PO can be obtained by solving the estimating equation n

C ( X i - X)(Ti - XTp)= 0 ,

(12)

i= I

where X = C,=lXi. Miller" extended the least-squares approach to the censored data by replacing the Fn,o(.)in (11) with the Kaplan-Meier estimate $,,p(.) based on { e i ( p ) , & } . As noted by Mauro3' and Lai and Ying,40 this approach often leads to inconsistent estimate of PO. Alternative extensions of least-squares estimate to the censored data were proposed by modifying the estimating equation (12). n

Nonproportional Semiparametric Regression Models for Censored Data

285

In particular, Buckley and James12 modified (12) and introduced an estimate of PO as a solution of the estimating equation S ( p ) = 0, where

(13 This is equivalent to replace T, in (12) with E[TilY,,&I which is estimated by y,*(p), where (14)

The theoretical properties of this approach were investigated by many people, see Refs. 16 and 41. Despite theoretical advances, the method is seldom used in practice due to numerical complexity. Note that the estimating function (13) is neither monotone nor continuous and its roots may not exist.15 The numerical difficulty increases as the dimension of p increases. Also, the variance of resulting estimates may not be easy to obtain because it involves the unknown hazard function of the error term E . Generally, with censored data this function may not be well estimated nonparametrically. On the other hand, Koul, Susarla, and Van Ryzin13 proposed a different modification of the least-squares method by estimating the distribution of censoring variable C. Unfortunately, the approach has often found to be unsatisfactory in practice since its validity depends on the independence assumption between censoring variable C and covariate X.14 Next, we present a new implementation procedure that was developed by Jin, Lin, and Ying.18 Let p1 be a known consistent estimate of 0 0 , for example, the Gehantype estimate & in Sec. 20.2.1.1. Define

]'

L(b) = - y ( X Z- X)@2 [a:,

X, [$(

1

- X ) ( x * ( b )- Y*(b)) ,

(15)

where a@'' = aaT, Y ( b ) is defined in (14) as the estimate of E[T,IY,,ha],and Y * ( b ) = $ CZ1Y,*(b). Then the estimate of PO is updated by ,& = L(p1). At the kth Step, k t b k = L(jk-1). If ,&Satisfies certain convergence criteria, then the b k is the solution of the original estimating equation Q(p) = 0. Now, it is important to note that Buckley and James12 originally considered the iterative procedure, but they were not able to provide initial values that are consistent. The use of the Gehan-type estimate exactly

b~

286

Zhezhen Jzn

overcomes this difficulty. Jin, Lin, and Ying18 showed that for each fixed k = 1,.. . , /3k is consistent and asymptotically normal under mild conditions. As mentioned before, the asymptotic covariance matrix of ,&,however, is difficult to estimate directly because it depends on the unknown hazard function of the error terms. To overcome this difficulty, we also developed a resampling method. Although the resampling shares the same spirit as that in Refs. 17 and 38 in the sense that the perturbation is done by independent and identically distributed known positive random variable V, (i = 1,. . . , T I ) , E(V,) = Var(V,)= 1, there is a major difference. Specifically, at the kth step with the perturbed estimate obtained at k - l t h step, the ,Bi is obtained by L*(p,*-,), i.e., 0;= L*(/?;-,), where

1

V , ( X , - X)(e(b) - Y * * ( b ) ) , (16)

(!7

@;,b(t) is the Kaplan-Meier estimate based on the perturbed data {Viei(b),Vi&}and Y**(b)) = Cy=l It is easy to see that the perturbation scheme in (16) is quite different from that in (9) and (10). If the Gehan-type estimate ,& is used as the initial estimate in (15), then the corresponding initial perturbed estimate 0;can be obtained by minimizing the perturbed Gehan-type objective function (10). Under regularity conditions, it can be shown that, for each fixed k , the distribution (conditional on the data) of T Z ' / ~ ( / ? ;- ,&) is asymptotically equivalent to that of n1/2(,&-&J).'~ Thus, one can generate a large number of realizations for through {V,} and use them to estimate the variancecovariance matrix of ,&. Moreover, extensions to marginal linear models for multivariate failure time data can also be readily developed, we refer readers to Ref. 18 for more details.

e(b).

20.2.2. Linear transformation models

The linear transformation model assumes

g(Ti)= x

T ~ O

+ Ei.

(18)

It is assumed that the g ( . ) is an unknown monotone increasing function and Q is an unobservable random error with completely known distribution

Nonproportional Semipammetric Regression Models for Censored Data

287

function. This type of model has been studied extensively in the literature, see Refs. 1, 19-29. It becomes the Cox proportional hazards model if 6 follows the extreme-value distribution with density f(t) = exp{-et t}. It also becomes the proportional odds model if 6 follows the standard logistic exp{t})2, see Refs. 19-24. distribution whose density is f(t) = exp{t}/(l Cheng, Wei, and Ying27 proposed a general estimation method for linear transformation models with censored data and justified their inference procedure. The method was further investigated and extended, see Refs. 28, 29, and 42. A key step of the approach is the estimation of the survival function for the censoring variable by the Kaplan-Meier estimator. Its validity relies on the assumption that the censoring variable is independent of the covariates. Thus, unlike the Cox’s partial likelihood approach, the method of estimation might fail when the assumption is violated. Moreover, the method is numerically unstable and difficult to implement.23 In the following, we present a new estimation and inference method that was developed by Chen, Jin, and Ying.30 The method overcomes the shortcomings of the above methods. Let X ( t ) be the hazard function and h(t)= f , X(t)dt be the cumulative hazard function of the error term E . Note that X ( t ) and h(t)are known since the error distribution is completely specified. Let Ni(t) = &I{yZ 5 t } and Ri(t)= I{yZ 2 t ) . Motivated by the fact that Ni(t)- s,” Ri(t)dA(-XTPo g(t)) is a martingale process, the following unified estimating equations are proposed:30

+

+

+

(19 n

C [dNi(t)

-

Ri(t)dA(-X’P

+ ~ ( t ) )=] 0,

t 2 0.

(20)

a= 1

In the special case of the Cox model, in which X ( t ) = h(t)= exp(t), the estimating equation (19) becomes the Cox partial likelihood score equation. This can be seen from (20) that n

n

i= 1

i=1

and pIug it in equation (19), one can obtain

the Cox partial likelihood score equation.

Zhezhen Jin

288

Thus, the method can easily be implemented as in the Cox proportional hazards model. Let tl < . . . < t K < 00 denote the observed distinct failure times. Then the computation can be done with the following simple iterative algorithms:30

Step 0: Choose an initial value of 0,denoted by ,do). S t e p 1: With the initial estimate of ,do), obtain g(O) at t l , . . . ,t K as follows: First obtain g ( ' ) ( t l ) by solving n

(21 i=l

Then, obtain g(O)(tk),k

c

= 2, ..., K , one-by-one

c

by solving the equation

n

n

R i ( t k ) A { X T P+ 9 ( t k ) ) = 1 +

i= 1

Ri(tk)A{X?P

+ g(tle->).

(22)

i=l

(If there is tied failures at t k , the value 1 in (21) and (22) should be replaced by the number of ties.)

Step 2: Obtain new estimate of p = P(l) by solving (19) with g = g(O). Step 3: With ,dl),repeat Steps 1 and 2 untiI some convergence criteria are met. The resulting estimate is b. An alternative implementation of Step 1 can also be found in Ref. 30. It is shown that the asymptotic variance of has a closed form which can be easily estimated by plug-in rules.30 Specifically, under mild conditions,

p

n1/'(p- PO)

-+

N { O ,~

,l~*(~sl)~)

(23)

in distribution, as n + 00, where C, and C* can be consistently estimated bv 00

c, = -nl cn /

O0

{Xi- X ( t ) ) @ 2 X { X T p+ g ( t ) ) R i ( t ) d g ( t ) ,

{ X i - X ( t ) } X T X ( X T f i + g(t)}Ri(t)dg(t),

i=l 0 respectively. Here i ( t ) is the first derivative of X(t), and

Nonproportional Sernipammetric Regression Models f O T Censored Data

289

The proposed method is numerically stable and valid even when the censoring variable depends on the covariates. It is noted that the implementation of the method depends on the full specification of the error distribution. A possible choice is the class of distribution functions whose hazard functions are specified by

The class of distribution functions are closely related to the Box-Cox transformation. As T varies, A ( ~ ; T varies ) and gives various distribution functions. In particular, when T = 0, it gives the extreme value distribution and the model is the Cox proportional hazards model, and when T = 1, it gives standard logistic distribution and the model is the proportional odds model.

20.3. Remark In this paper, we have reviewed recent development on the AFT model and linear transformation models. For the AFT model, newly developed rank-based and least-squares a p proaches are presented. If the unobserved error follows extreme value distribution, then the logrank-based method should yield the efficient estimator among the weighted rank estimators. If the unobserved error follows Gaussian distribution, then least-squares based method should yield the efficient estimator. It should be noted that the essence of the new rank-based method for the AFT model is the construction of a class of monotone estimating functions which approximates the weighted logrank estimating functions around the true values of the regression parameters. The corresponding estimators are consistent and asymptotically normal with covariance matrices being readily estimated by a simple resampling technique. More importantly, linear programming technique can be used for both the parameter estimation and variance-covariance estimation. In a technical report, we extended the approach to marginal accelerated failure time models for multivariate failure time data including multiple events, recurrent events and clustered data. However, it is noted that the procedure is not a straightforward generalization. The resampling approach in Ref. 17 is not valid and a different resampling method is developed.43The modification of resampling method entails considerable new technical challenges. For details, we refer readers to Ref. 43.

290

Zhezhen Jin

For linear transformation models, the essence of the new development is the construction of t h e mean zero estimating functions based on t h e martingale process. It appears t h a t the approach can be readily generalized to deal with multivariate failure time data along the line of Ref. 44. We also would like t o point out that there are still many interesting and important research topics, such as model checking and selection. Moreover, t h e effects of censored covariate or measurement error need to be addressed.

Acknowledgments This work is partially supported by New York City Council Speaker’s Fund and National Science Foundation Career Award DMS-0134431.

References 1. D. R. Cox, Regression models and life-tables (with discussion), J. R. Statist. SOC.Ser. B 34, 187-220 (1972). 2. P. K. Anderson and R. D. Gill, Cox’s regression model for counting processes: a large sample study (Com: p. 1121-1124), Ann. Statist. 10, 11001120 (1982). 3. D. R. Cox and D. Oakes, Analysis of Survival Data, London: Chapman and Hall (1984). 4. A. A. Tsiatis, Estimating regression parameters using linear rank tests for censored data, Ann. Statist. 18, 354-372 (1990). 5. L. J. Wei, Z. Ying, and D. Y. Lin, Linear regression analysis of censored survival data based on rank tests, Biometrika 77, 845-851 (1990). 6. T. L. Lai and Z. Ying, Linear rank statistics in regression analysis with censored or truncated data, Journal of Multivariate Statistics 40, 13-45 (1992). 7. J. M. Robins and A. A. Tsiatis, Semiparametric estimation of an accelerated failure time model with time-dependent covariates, Biometrika 79, 311-319 (1992). 8. Z. Ying, A large sample study of rank estimation for censored regression data, Ann. Statist. 21, 76-99 (1993). 9. M. Fygenson and Y. Ritov, Monotone estimating equations for censored data, Annals of Statist. 22, 732-746 (1994). 10. M. P. Jones, A class of semiparametric regressions for the accelerated failure time model, Biometrika 84, 73-84 (1997). 11. R. G. Miller, Least squares regression with censored data, Biometrika 63, 449-464 (1976). 12. I. V. Buckley and I. James, Linear regression with censored data, Biometrika 66, 429-436 (1979). 13. H. Koul, V. Susarla, and J . Van Ryzin, Regression analysis with randomly right-censored data, Ann. Statist. 9, 1276-1288 (1981).

Nonproportional Semiparametric Regression Models for Censored Data

291

14. R. G. Miller and J. Halpern, Regression with censored data, Biometrika 69, 521-531 (1982). 15. I. R. James and P. J. Smith, Consistency results for linear regression with censored data, Ann. Statist. 12, 590-600 (1984). 16. T. L. Lai and Z. Ying, Large sample theory of a modified Buckley-James estimator for regression analysis with censored data, Ann. Statist. 19, 13701402 (1991). 17. Z. Jin, D. Y. Lin, L. J. Wei, and Z. Ying, Rank-based inference for the accelerated failure time model, Biometrika 90, 341-353 (2003). 18. Z. Jin, D. Y. Lin, and Z. Ying, On least-squares regression with censored data, submitted (2004). 19. A. N. Pettitt, Inference for the linear model using a likelihood based on ranks, J . R. Statist. SOC.Ser. B 44, 234-243 (1982). 20. S. Bennett, Analysis of survival data by the proportional odds model, Statist. in Med. 2, 273-277 (1983). 21. A. N. Pettitt, Proportional odds model for survival data and estimates using ranks, Appl. Statist. 33,169-175 (1984). 22. D. M. Dabrowska and K. A. Doksum, Estimation and testing in a twosample generalized odds-rate model, J. A m . Statist. Assoc. 83, 744-749 (1988a). 23. S. A. Murphy, A. J. Rossini, and A. W. Van der Vaart, Maximum likelihood estimation in the proportional odds model, J. A m . Statist. Assoc. 92, 968976 (1997). 24. S. Yang and R. L. Prentice, Semiparametric inference in the proportional odds regression model, J. A m . Statist. Assoc. 94, 125-136 (1999). 25. D. M. Dabrowska and K. A. Doksum, Partial likelihood in transformation models with censored data, Scand. J. Statist. 15, 1-23 (1988b). 26. J. Cuzick, Rank regression, Ann. Statist. 16, 1369-1389 (1988). 27. S. C. Cheng, L. J. Wei, and Z. Ying, Analysis of transformation models with censored data, Biometrika 82,835-845 (1995). 28. S. C. Cheng, L. J. Wei, and Z. Ying, Predicting survival probability with semi-parametric transformation models, J . A m . Statist. Assoc. 92, 227-235 (1997). 29. J. Fine, Z. Ying, and L. J. Wei, On the linear transformation model for censored data, Biometrika 85, 980-986 (1998). 30. K. Chen, Z. Jin, and Z. Ying, Semiparametric analysis of transformation models with censored data, B i o m e t ~ k a89, 659-668 (2002). 31. Y. Q. Chen and M. C. Wang, Analysis of accelerated hazards model, J. A m . Statist. Assoc. 95, 608-618 (2000). 32. Y. Q. Chen and N. P. Jewell, On a general class of semiparametric hazards regression model, Biometrika 88, 687-702 (2001). 33. J. D. Kalbfleisch and R. L. Prentice, The Statistical Analysis of Failure Time Data, 2nd edition. New York: Wiley (2002). 34. J. F. Lawless, Statistical Models and Methods f o r Lifetime Data, 2nd edition. New York: Wiley (2003). 35. P. Andersen, 0. Borgan, R. Gill, and N. Keiding, Statistical Models Based

292

Zhezhen Jzn

on Counting Processes. New York: Springer-Verlag (1993). 36. I. Barrodale and R. Roberts, An improved algorithm for discrete L1 linear approximations, SIAM J. Numerical Analysis 10, 839-848 (1973). 37. R. Koenker and V. D’Orey, Computing regression quantiles, Applied Statist. 36, 383-393 (1987). 38. Z. Jin, Z. Ying, and L. J. Wei, A simple resampling method by perturbing the minimand, Biometrika 88, 381-390 (2001). 39. D. W. Mauro, A note on the consistency of Kaplan-Meier least squares estimators, Biometrika 70, 534-535 (1983). 40. T. L. Lai and Z. Ying, A missing information principle and M-estimators in regression analysis with censored and truncated data, Ann. Statist. 22, 1222-1255 (1994). 41. Y . Ritov, Estimation in linear regression model with censored data, Ann. Statist. 18, 303-28 (1990). 42. T. Cai, L. J. Wei, and M. Wilcox, Semiparametric regression analysis for clustered failure time data, Biometrika 87, 867-878 (2000). 43. Z. Jin, D. Y. Lin, and Z. Ying, Rank regression analysis of multivariate failure time data based on marginal linear models, submitted (2003). 44. L. Chen and L. J. Wei, Analysis of multivariate survival times with nonproportional hazards models, in Proceedings of the First Seattle Symposium in Biostatistics: Survival Analysis, Editors Lin, D.Y. and Fleming, T.R., 23-36 (1997).

CHAPTER 21 BINARY REPRESENTATIONS OF MULTI-STATE SYSTEMS

EDWARD KORCZAK Telecommunications Research Institute ul. Poligonowa 90, 04-051 Warsaw, Poland E-mail: [email protected]

A new definition of binary representation of a multi-state structure func-

tion is formulated, and its main properties are presented. The definition may be applied to both monotone and nonmonotone structures. Several forms of binary representation and its factoring are discussed. Applicability of the results is illustrated by two examples.

21.1. Introduction Although the theory of binary systems has many practical applications, it is being replaced by the theory of multi-state systems (MSS). In fact, many modern systems (and their elements as well) are capable of assuming a whole range of performance levels, varying from perfect functioning to complete failure. Since the performance level of a system depends on element performance levels, the binary model is often over-simplification and insufficient for describing multi-state systems. The present state-of-art and historical overview of the theory and practice of MSS may be found in a recent book by Lisnianski and Levitin.l Reliability analysis of MSS is usually more difficult than the analysis of binary systems. Indeed, the number of states of an MSS may be quite big, and the relation between the system state and the states of its elements (i.e. the structure function) may be very complicated. Therefore some effort has been made in applying existing binary methods to MSS. In particular, Block and Savits2 introduced two equivalent binary representations of a multi-state monotone system (MMS) , each decomposing the multi-state monotone structure into a sequence of binary monotone structures of binary 293

294

E. Korczak

variables. Similar approach was considered independently in Refs. 3-6. The binary variables used in this approach are threshold indicators, i.e. they indicate whether or not an element or a system is in a state with performance rate higher or equal to a given performance level. See also Refs. 7-13 for applications of this decomposition to MMS. The Block-Savits decomposition is based on the assumption that the system is monotone and has totally ordered state space. However, there are multi-state systems that are not monotone, for which the state spaces of the system and/or its elements are partially ordered14J5J6J7 or even u n ~ r d e r e d For . ~ the ~ ~latter ~ ~ case, ~ ~ C~a ~l d ~a r ~~ l a l *proposed >~~ an alternative binary representation method, which does not require the state ordering and is based on a special Boolean algebra. In his method, the binary variables indicate whether or not the element or system is in a particular state. In this paper a new definition of a binary representation of an MSS is formulated and its main properties are obtained. The definition is given in terms of conditions to be satisfied, and is applicable to any multi-state structure, monotone or nonmonotone. Several forms of the binary representation are discussed. Problem of variables' relevance is also addressed. Furthermore, two different types of factoring of the binary representation are introduced, which can be used to simplify the corresponding binary structures. Finally, the application of the binary representation to the calculation of the reliability indices is illustrated by two examples.

21.2. Basic Definitions Let (C,K , K1, . . . ,K,, 'p) be a multi-state system (MSS) consisting of n multi-state elements with the index set C = { 1 , 2 , . . . ,n } , where K = { 0 , 1 , . . . , M } is the set of the system states, Ki = {0,1,. . . ,Mi} is the set of the states of element i E C, and p: V ---t K is the system structure function, where V = K1 x Kz . . . x K , is the space of element state vectors. The state of the system is determined by the element state vector and the structure function: p(x) is the system state when the element state vector is x = ( q , x 2 , . . . ,xn),where xi E Ki represents the state of element i. The state spaces of MSS and its elements are considered as totally ordered sets, each with usual order induced by state indexing (numbering). This order need not be consistent with performance rates or other features corresponding to the states. Without any loss of generality we assume that the system states 0 and M are essential, i.e. the sets p-l(O) and pV1(M)are

h

nonempty. If a , b E V and a L. b, then the set [a,b]= {x E V : a I x I b} is called an interval of V ,or a box. We use standard notation: a 5 b iff ai 5 bi for each i E C, and a < b iff a 5 b and ai < bi for some i E C. For any j E K \ {0}, let V<j = {x E V : cp(x) < j} and V2j = {x E V : cp(x) 2 j}. According to our assumption, these sets are nonempty. A box is called an upper (lower) box to level j if it is contained in V2j (V<j).An upper (lower) box to level j is maximal if it is not properly contained in another upper (lower) box to level j. A collection of maximal upper (lower) boxes to level j is named an upper (lower) base to level j if their union is the whole set V>j (V<j).Of course, the collection of all maximal upper (lower) boxes to level j is an upper (lower) base to level j . An upper (lower) base to level j is irredundant if it ceases to be an upper (lower) base to level j after deletion of any of its members. General MSS may have many irredundant upper and/or lower bases. Let Uj ( C j ) be any upper (lower) base to level j. Then: M

M

max l(x E [a,b])

l(x E V&) =

~ ( x=) j=1 M

=

j=1

[a,b]E U j

max min l(zi E [ai,b i ] ) ,

j=1

[a,b]EUj a E C

M

M

min maxl(xi 2$ [ a i , b i ] ) ,

= j=l

(1)

[a,b]Etj aEC

(2

where 1(.. . ) is the indicator function. An MSS is said to be a multi-state monotone system (MMS) if its structure function 'p is nondecreasing in each argument, ~ ( 0 = ) 0 and 'p(M) = M , where 0 = (O,O,. . . ,O), M = ( M I ,M2,. . . ,Mn). It is easy to see that for any MMS, each upper box to level j has the form [y,M],and the lower bound y of this box is called a path vector to level j . A path vector to level j is minimal if [y,M] is maximal upper box to level j. Similarly, each lower box to level j of an MMS has the form [O,z], and the upper bound z of this box is called a cut vector to level j . A cut vector to level j is minimal if [0, z]is maximal lower box to level j. Alike for general MSS, for an MMS the set of all maximal upper (lower) boxes to level j is the only irredundant upper (lower) base to level j.

E. Korczak

296

For monotone systems, it is usually assumed that the states of the system (element i) represent successive levels of performance ranging from the perfect functioning level M (Mi) down to the complete failure level 0. In other words, the states of the system and its elements are totally ordered with respect to the performance level, and the state numbering is consistent with this order. In this paper, in order to keep full generality, we do not assume that. The state ordering is considered formally, as the natural order between integers representing the states of a system and its elements. The dual structure ' p D is given by 'pD(x)= M - 'p(M - x). If 'p is monotone, then so is cpD. 21.3. Binary Representation of an MSS and Its Properties Let JiiT(xi)= l(xi 2 r ) , xi E Ki, i E C , r E Ki \ (0). Define vector-valued functions Ji: Ki 4 (O,l}M' = Fi (i E C ) and J : V -+ {O,l}M1 x ... x ( 0 , l}Mn = F = F1 x . . . x F,:

Ji(xi) = (Ji;l(xi),J i ; Z ( Z i ) , . . .

7

(3)

Ji;M;(xi)),

J(x) = (Ji(xi),J 2 ( ~ 2 ) ,. . . ,Jn(xn)) = ( J i i r ( x i ): i E C,r E Ki \ (0)). (4) Elements of the set Fi are denoted as vectors with single underlying: -2 x . = ( q 1 , x ~ ,. .., xi;^;), where xi;,.E (0,1}. Elements of the set F are denoted as vectors with double underlying: x - = (x,,x,,. . . ,s,) = { x i i T } . For notational convenience, we set xi;o = 1 and x i ; ~ ~ = + 0. l F . We have: Let Ai = Ji(Ki) Fi and A = J ( V ) = A, x . . . x A,

Ai = {xi = ( X i i l , Z i ; z , .. . , S ~ ; M ;:)1 2 Ziil 2 Zi;z 2 . . . 2 2 = (Ci(T): r E

i ; ~2 ;

o}

Ki},

-- - -

where gi(r)= (l(a 5 r ) : a E Ki

\ (0))

= J i ( r ) , i.e.

.

ei(r) = (1,.. . , 1 , 0 , . . . ,O), ~ ~ ( =0 (0,. ) . , O ) , gi(M,) = (1,.. . ,1). r

M ; -r

(5)

Mi

(6)

Mi

Hence J(x) = (gi(r): a E Ki) is the binary image of element state vector x, and J establishes a one-to-one correspondence between V and A. Definition 21.1: Let f : V -+ (0,1} be a binary function on V and f B : F -+ Z an integer-valued function of binary variables 1~= {xiir}.We say that f~ is a binary representation (BR) of f if Vx E V : f ( x ) = fl3

(J(x)).

Binary Representations of Multi-State Systems

297

For example, let f(x) = l(x E [a,b]), a,b E V , a 5 b. Let us consider two functions fB1,fB2: + defined by:

v z

n

n

fBl(E) = nxi;a,(l -xi;b;+l), fE2(&

= n ( % ; a ; -Zi;bi+l).

i= 1

(7)

i= 1

These functions are not equivalent on the whole space F . Indeed, substi- = 0 and tuting xiiai = 0 and Zi;b,+l= 1, i = 1,.. . ,n, we have f~l(5) ~ E ~ ( J= C )(-l)n. However, they are equivalent on A, and both are binary representations of f.

Definition 21.2: Let cpj : F -+ Z, j E K \ {0}, be integer-valued functions of binary variables x = {xi;,.}.We say that the sequence { c p j } is a BR of an MSS with the structure cp if V j E K \ {0}, cpj is a BR of l(cp(x) 2 j ) , i.e. if l(cp(x) 2 j) = cpj(J(x)) for x E V. Such a representation exists. Indeed, since

l(cp(x) 2 j ) =

C

1(x = a) =

a€Vzj

c

n

n l ( . i = )i.

a€V2j i=l n

(8)

then clearly n

(9) aEVZj i=l

is a binary representation of l(cp(x) 2 j ) . The following proposition summarizes the basic properties of a BR of an MSS.

Proposition 21.1: Let {cp} is a BR of an MSS with the structure p. (i)

{cpj}

are nontrivial binary functions on A.

(ii) if the system is MMS, then { c p j } are nontrivial binary monotone functions on A. (aii) 1 2

cp1

(iv) cp(x) =

2

cp2

2 . . . 2 ( P M 2 0 on A.

C,"=, cpj(J(x)) f o r each x E V

(v) The binary representation is determined uniquely on A, i.e. if { c p j } and { $ j } are two binary representations of an MSS, then cpj = $ j on A f o r each j E K \ ( 0 ) .

E. Korczak

298

: j = 1 , . . . ,M } be integer-valued functions defined o n F . If satisfy (iii), then +(x) = C,"=, +j(J(x))is the structure function of an MSS and { + j } is its binary representation. If {q$} also satisfy the conclusion of (ii), then +(x) is monotone. (vii) A binary representation {$} of the dual structure cpD can be obtained from a binary representation { ' p j } of 'p as follows: (1) obtain the pseudo-dual functions 'p;l({xii,.}) = 1 - 'pj({l - xi;,}); (2) obl algetain functions {Cpj"'}, by replacing each xi;, with x i ; ~ ~ - , +in braic expressions defining functions {'pjdl}; (3) set 'py = 'p$-j+l, j = l , . .., M .

(vi) Let

{+j

{+j}

The function ' p j may be written in several forms equivalent on A, but not necessarily on F \ A. Some of these forms are direct generalizations of the forms known from the binary system theory. The algebraic expression defining the function ' p j may be treated as in the binary system theory, using techniques and tools known from this theory. Moreover, due to the restrictions on xi;, imposed by (5), we may use several additional simplification rules which do not alter the function ' p j on the set A. The basic rules are: xi;rxi;s = xi;r A

- -

xi;s

xi;, V

-

= xi;max(,,s), xi;,xi;s = xi;, A -

xi;s = xi;min(r,s)i

xt;, V

zi;s

3i;S

= zi;min(,,s)i

= Fi;max(r,s)l

(10) (11) (12)

where, as usual, a A b = min(a, b) = ab, a V b = max(a, b) = a + b - ab and a = 1 - a for any binary a and b. Block and Savits' defined binary representations of an MMS using socalled it minimal path vector and minimal cut vector forms: (13)2 (14) 0

where M P , and M C j are the sets of minimal path vectors and minimal cut vectors to level j respectively. Both functions 'p(iMP) and 'p(iMC) satisfy Definition 21.2. Indeed, by the definition of minimal path vectors to level j , V2j = U y E M P[y, j MI, hence l(cp(x) 2 j ) = l(x E V>j) = max min l(xi 2 yi) = y E M P j iEC:y;>O

max

min

y E M P j iEC:yi>O 'piMc).

~ i ; ~ ~ ( x=i )( p i M P ' ( ~ ( X ) ) . Similar arguments apply to

BY Proposition 21.1(v), P I M P ) = PIMC) on A.

299


For general MSS, the corresponding forms use upper and lower bases to level j, Uj and C j :

(15)

(16)0

where min 0

= 1 and rnax = 0. 0

By applying the inclusion-exclusion principle to (15) and then reduction rules (10) to each term, we obtain a generalized Sylvester-PoincarL’s form of an MSS:

(17)

where for any nonempty set of boxes D , wi(D) = max

ai, w i ( D ) =

[a,bjE D

min b,, i E C , v(D) = ( v l ( D ) ,. . . ,wn(D)),w(D) = (wi(D), . . . ,wn(D>),

la,bl . .E D

ID/ = card(D). By convention, a sum (product) over the empty set equals zero (one). In case of MMS, the above form simplifies to the well known formula:

vj ( S P )(22)

=

c

(-l)lD1+l 0#D&MP,

[ g:..:.l]

7

(18) (18)

u,(D)>O

where for any 0 # D 2 V, u,(D) = max a,, i E C . a€D

Among many other forms, there is a pseudo-polynomial form:

(19) Hk(&

=

n

k= 1

Zi;ak,iZi;bk,i

=A

iEC

where cu are integer coefficients 0 5 a k , i means equality on A, and the products

n(Zi;ak,i

- %;bk,i),

(20)

iEC

< b k , i I Mi t’1 for all i and k, = A are nontrivial, i.e. 0 < a k , i or

Hk

E. Korczak

300

bk,i

I Mi for some i E C.Observe that J-'(Hi'(l))

= [ak,b k - 11,.where

ak = (a,', . . . , ~ k , ~bk) = , & , I , . . . ,b k , n ) and 1 = ( 1 , . . . , 1). Two products Hk(x)and Ht(x)are orthogonal if H k ( x ) H l ( s ) = 0 on A, i.e. when the corresponding boxes are disjoint. If in (E),a 6 two products are disjoint, a0 = 0 and a k = 1 (Ic = 1,. . . ,m), then the pseudo-polynomial form is called the orthogonal form, or SDP form. It corresponds to a partition of V>j into disjoint nonempty boxes. A particular case of the orthogonal form is the canonical disjunctive normal form, in which the products correspond to single-point boxes, see (9). Let us now consider the problem of variable relevance. We say that variable xi;,.,r E Ki\{O}, is relevant for the function cpj if there exists x -E A

such that (O(i;,.),X) - E A, P(i;,.),Z) E A and cpj(O(i;,.,,g)# cpj(l(i;,.), where (d(i,,),s) is equal to ZI - with xi;,.replaced by d. Other equivalent conditions are7 (a) there exists x ), - E A such that c p j ( g i ( r-) , ~#) cpj(ei(r - l ) -, ~where ( ~ i ( rg) ) ,= ( X I 7 . . .,xi-1 7 g i ( r ) ,xi+', . . . > ~ n ) . (b) there exists x E V such that l(p(r(i),x)2 j ) # l(cp((r- l)(q,x)2 j),where (r(i),x) = ( 2 1 , .. . , x i - l , r , x i + l , . . . ,xn). The functions cpj may have several irrelevant variables. However, in many practical cases the algebraic expressions defining these functions contain relevant variables only. For example, all variables in the expressions in (13)-(18) are relevant. Proposition 21.2: For a n y upper (lower) base Uj ( C j ) of a n MSS, at

holds: {relevant variables of

cpj}

> 0, [a,b] E U j } U { q b i + l : i E C,bi < Mi, [a,b] E Uj} {xiia,: i E C,ai > 0, [a,b] E Lj}

= {xi;ai: i E C,ai -

u {xi;bi+l : i E c,bi < Mi, [a,b] E cj} . (21) I n particular, for MMS, {relevant variables of

cpj}

> 0,y E MPj} {xi;*i+l: i E c,zi < M i , 2 E M C j } . (22)

= {xiiyi: i E C , y i -

Factoring is a popular technique for analyzing complex binary systems. There are two kinds of factoring (pivotal decomposition) of the function cpj: with respect to the entire vector siE A (or the state of element i),

301


and with respect to a single variable xiiT.Considering all possible values of vector xiE A, we obtain the factoring formula with respect to the state of element i:

l(xi = e i ( T ) ) ’ p j ( c i ( T ) ,-X ) =

’p.(x) 3 = = TEKi

=

C

xi;TZi;T+l

‘pj(ci(T)lg)

TEK~

(23)

( 5 i ; r - x i ; r + l )v j ( c i ( T ) > g )

rEKi

for x E A. The factoring with respect to a single variable Xi;r is given by: ’ ~($j

- + ~ i ;‘ r~(O(i;r) X) j g) xi;r ~ j ( ( l ( i ;: ~1 )I s I T ) ,E)

=zi;T =A

~ p(l(i;r) j

+ T i ; r p j ( ( O ( i ; s ): T

7

Is I Mi),g).

(24)

The second equality in (24) follows from the fact that on A, the condition xiir = 1 means x i i s = 1 for all 1 5 s 5 T , and the condition xi;,, = 0 means xi;s = 0 for all T 5 s I Mi. It can be seen that recursive application of (24) with respect to xi;^^, x i ; ~ > - l.,. .,x i ; l successively leads to (23). 21.4. Examples of Application

Suppose that the states of elements 1,. . . n of an MSS are represented by s-independent random variables X I , . . . ,X,. Then the state of the MSS is cp(X), where X = (XI,. . . ,X n ) . These variables may be time-dependent, but we omit, for brevity, the time-parameter t. It is clear that for any fmed i E C the random variables Xi;,. = J i i T ( X i ) T, E Ki \ { 0 } , are s-dependent, as XiiT _> Xi;,for T < s. However, the random vectors Xi= Ji(Xi) = (Xt;T: T E Ki \ { 0 } ) ,i E C, are s-independent. Let R ( j ) = P{cp(X) 2 j } = E(cpj(J(X))]and R ~ ( T=) P{Xi 2 T } = E[Xi,,.].Under the assumptions that { R i ( r ) }are known, and that the function ‘pj is given in the form (19), the calculation of R ( j ) is very easy: m

(25)0

where clearly Ri(0) = 1, Ri(Mi

{Xi;r

T

E

Ki \ {O},i E

C}.

+ 1 ) = 0, and X- = J(X) = (Xi: i E C) =

302

E. Korczak

For example, if A C K, then

P{(P(X>E A ) = C(R(j) - R(j

+ 1))

(26)

*

jEA

This shows that the choice of a suitable binary representation of an MSS overcomes difficulties with the dependence of random variables belonging to the same element. Now consider the general case when the random variables XI,. . . , X, representing states of system’s elements may be s-dependent. We show that (25) can be extended to this case. Let pxl ,..,,X, (c1, . . . ,G)= p ~ ( cbe ) the joint probability mass function (pmf) of X I , . . . , X, defined by: PXl,...(X,(Cl,. . . , C n ) = P{Xl = c1,. . . ,x, = c n } ,

(27)

or in compact form: p x ( c ) = P{X = c } , c E

v.

(28)

Since Hk(J(X)) = 1 iff X E [arc,b k - 11, we have: E[Hrc(J(X))] = P { a k

I X < h}=

PX(C).

(29)

ak F,y(t) for all t > 0. (6) This property can be used in a graphical check of plausibility of a repair alert model for a dataset by plotting empirical estimators of Fx and Two examples are given in Fig. 23.1.

Fz.

(a)

(b)

Fig. 23.1. Empirical subdistribution functions p z ( t ) (thick line) and p x ( t ) (thin line) for the VHF data (a) and OREDA data (b).

The ordering (6) between FX and FZ holds whenever Z is a random signs censoring of X (C00ke4). In fact, Cooke4 proved that this ordering is also sufficient for the existence of a joint distribution of X and Z satisfying the requirements of random signs and having a given set of subsurvival functions consistent with px and Fz. As a strengthening of Cooke’s result it was shown in Lindqvist et al.3 that whenever (6) holds, there is an essentially unique repair alert model having a given set of subsurvival functions for X and 2 consistent with Fx and Pz.A precise formulation of this is given by the following result:

Theorem 23.1: Let K1,K2 be a subdistribution pair such that K2 is differentiable. Suppose furthermore that

Then there exists a pair ( X ,Z ) of life variables which satisfy the requirements of the repair alert model and which are such that

F;(t) = K l ( t ) , F;(t) = K2(t) for all t 2 0.

B. H. Lindqvist and H. Langseth

328

Moreover, for any such pair (X, 2 ) we have Fx(t) = Kl(t)/Kl(co),q = KZ(oa), while the cumulative repair alert function G is uniquely (modulo a multiplicative constant) given by

(7) (8) for all t > 0, where t o

> 0 is a fixed, arbitrary constant.

The theorem is proved in Lindqvist et al.3 Note that the expression (7) for G is obtained from equations (3)-(4) which imply that

A simple example of a cumulative repair alert function is G(t) = to where P > 0 is a parameter. Then g(t) = ptov1 so = 1 means a constant repair alert function, while ,f3 < 1 and P > 1 correspond to, respectively, a decreasing and increasing repair alert function. It follows, furthermore, that for this repair alert function we have

(9) Thus cost efficient PM performance corresponds to large values of /3, since this implies that PM can be expected to be close to the potential failure time.

23.4. Statistical Inference i n the Repair Alert Model 23.4.1. Independent censoring Let (Y,6) be the result of a competing risk case between failure time X and PM-time 2 of a component. Suppose now that observations of (Y,b)may be right censored by a random variable C which is independent of (X, 2 ) and hence of (Y,6). Then by considering the competing risk case between Y and C it follows by independence that the marginal distributions of Y and C are identifiable. However, in order to identify the underlying repair alert model we need to have identifiability of the distribution of the pair (Y,6 ) . Fortunately, this is the case. To see this, note first that the probabilities P ( y I Y 5 y+dy, 6 = 0, Y < C) and P ( y 5 Y 5 y dy,6 = 1,Y < C) are identifiable from observation

+

Failure Data Censored by Preventive Maintenance

329

of the competing risk case between X , Z and C.But these probabilities can be written as, respectively, f:(y)P(C c > y)dy and fi(y)P(C > y)dy by independence of Y and C. Thus, assuming that P(C > y) > 0 for all y, the subdistribution functions of X and 2 are identifiable since the distribution of C is. Hence the underlying repair alert model can be identified as well.

23.4.2. Datasets and preliminary graphical model checking

Let there be N independent right-censored observations as described in the previous subsection. By extending the notation of Bedford and Cookello Sec. 23.5, we may let these observations be represented on the form XI,... ,x m , zl,.. . , z,, c1,. . . ,cr, which are, respectively, the observed times to failure, the observed times to PM, and the observed times to censoring. For practical illustration we use two datasets. The first one, from Mendenhall and Hader,‘ gives failure times for ARC-1 VHF communication transmitter-receivers of a single commercial airline. They will later be referred to as the VHF-data. Failed units were removed from the aircraft for maintenance. However, in some cases the apparent failures were unconfirmed upon arrival at the maintenance center, as the unit exhibited satisfactory operation when tested there. Thus, the failure times can be divided into two groups, unconfirmed, 2, and confirmed failures, X . There are m = 218 observations of X , and n = 107 observations of 2. The data were censored at time r = 630, and there are r = 44 such censored observations. This gives a total of N = 369 observations in the dataset. The second dataset was prepared by Langseth and Lindqvist.8 These data are failure times of a single mechanical component taken from the OREDA database17and will be referred to as the OREDA data. The component under study could fail due to several different failure modes. In the present data study we will focus on failures of type “2,” and treat the other failures as independent censorings of the failure times. The component failures are either “criti~a1,’~ X , or ‘ L n ~ n ~ r i t i(degraded ~al” or incipient), 2. We will only use data starting from the tenth event, that is, after the first critical failure was repaired. This gives us m = 12 observations of X , n = 29 observations of 2,and r = 37 censored observations, a total of N = 78 cases. The resulting data are given in Table 23.1. Suppose we want to fit a repair alert model to the data. By (6) we need to have Fz(t) > py.(t) for all t > 0. For a graphical verification of this, we use nonparametric estimators of the conditional distribution functions fix and F.z as derived by Lawless,ll Sec. 23.2. We then start by computing the

330

B. H. Lindquist and H. Langseth Table 23.1. OREDA data. The first line contains the observed failure times xi; the second line contains the observed P M times z j ; the two last lines contain the censoring times C k .

xi: ~ j : Ck:

1,1,5,8,10,11,11,13,25,80,85,117 1,1,1,1,1,1,1,1,3,3,3,3,4,5,7,8,10,12,12,14,17,18,24,24,28,28,28,32,36 1,1,2,2,2,2,2,2,3,3,4,4,4,5,6,6,6,7,7,7,10,12,12,12,12,13,19,30,31,32, 32.47.49.61.65.76.97

Kaplan-Meier estimator S ( t ) based on the right-censored sample of Y s , i.e. the union { y i } of the xi and the z j with the Ck being censorings. This leads tn

where R ( t ) is the total number of units (components) which are a t risk just before t , while d ( t ) is the number of observed events (failure or PM) at time t. The subdistribution functions can next be estimated using equation (9.2.5) in Lawless," which in our notation can be written as

(10) (11) Recall that the conditional distribution functions are given by Fx ( t )=

Fi(t)/Fi(co) and likewise for F z . Moreover, recall that F;(co)+F;(co) = 1. The natural estimators of Fx and p' are obtained by dividing (10)-(11) by I';;(co) and fi;(co), respectively. However, the estimates k;(co)and k;(co)do not necessarily add t o 1, so Lawless" suggests t o normalize them to have sum 1. Thus, defining

(12) we obtain the estimators (13) (!4) Figure 23.1 shows the plots of &(t) and @ Z ( t ) obtained in this way for the two datasets. The required inequality (6) is apparently satisfied for the estimated functions, and we conclude that it is indeed meaningful to fit repair alert models t o both datasets. Formal tests for investigations of this kind are considered by Dewan et a1.12

331


23.4.3. Nonparametric estimation In this subsection we suggest simple nonparametric estimators of q, Fx and G for the repair alert model. First, a natural estimator for q will be the $ defined by (12). For the VHF-data this equals q = 0.33, and the OREDA data gives q = 0.71. Next, by (1) we may estimate FX by Fx given in (13) and depicted in Fig. 23.1. It remains therefore to estimate G. Following Lindqvist et al.3 we start from the definition of G ( t ) in (8), repeated here for ease of reference,

G ( t ) = exp

{

dy L t r :Y - Fx(&'(y))

}.

We then proceed by substituting the estimator &(t) for F x ( t ) . It follows from (10) and (13) that

fix

is constant on intervals [ze,xe+l), with value

P x ( z ~ )Thus . F x ( ~ ~ l ( y=) jx(xe) ) for ~z(xe) Iy

< ~z(se+l),e = 1,.. . , m - 1.

By selecting to = x1 and t = xi in (8), we obtain

Since G(t) is only determined modulo a constant, we can define

G(x1) =

1. Finally, substituting f i z ( t ) from (14) for Fz(t), we obtain the nonparametric estimator for G ( t ) defined at the points t = xi:

(15) We have tacitly assumed that F z ( t ) > Fx (&'(t)) for all C in this development. This assumption is theoretically justified by ( 6 ) , but in practice it may still happen that fiz(se)

I Fx (kgl(xe)) for some C.

In this case

we suggest to put the corresponding factor of (15) equal to 1. Figure 23.2 shows the described estimator of G for the two datasets with logG(si) plotted against logxi. The motivation for these plots is to check whether the parametrization G ( t ) = to is plausible. In that case we

332

B . H. Lindqvist and H. Langseth

will have log G(t) = log t , so we would expect plots of log G(xi) against log xi to be approximately a straight line with slope ,8. This is roughly true in Fig. 23.2. Based on the plots, we may estimate the slopes of the curves to be around 5 (VHF-data), and 0.7 (OREDA-data). These estimates are therefore our first guesses of p.

5

Fig. 23.2. Nonparametric estimate logG(ri) plotted against logzi for the VHF data (a) and the OREDA data (b).

23.4.4. Parametric estimation

In this section we assume the special parametric model where X is exponentially distributed with fx(z) = Xe-xz, while G ( t ) = t P . For notational simplicity, we recall the definition of the incomplete Gamma function, I?($, t ) = Jt" wQ'-le-"'dw. Note that the integral converges for all real $ when t > 0, and for all $ > 0 when t = 0. Following Crowder,2 the contributions to the likelihood from an uncensored observation is given by the subdensity function at the observed time. Thus, (1)-(5) imply that the likelihood contribution from an zi is f/F(xi) = (1 - q ) f x ( z i ) = (1 - q)Xe-Azi; the contribution from a z j is f ; ( z j ) = q . g ( z j ) Jz'[fx(t)/G(t)]dt = qXp(Xzi)P-lI'(l - p,Xzi), and finally the contribution from a censoring Ck is P(min(X,Z) > ck) = 1- ( F ; ( c ~ + ) F ; ( c ~ )= ) e-'Q - q ( X c k ) P . r(i - p, X C ~ ) . The total likelihood for the data is obtained as the product for each

333


data point. Taking the logarithm we obtain the log-likelihood function

l(A, p, q ) = mlog(1 - q ) m

+ nlogq + (n+ m) log x + n1ogp

1

2=

n

n

2=1

2=1

r

+ Clog[exp(--Xck) - q ( A c k ) P . r(i - P,

(16)

AC~)].

k=l Maximum likelihood estimates of the parameters A, P and q can be found by maximizing (16), which needs t o be done numerically. It turns out that the E M - a l g ~ r i t h m 'is~ useful here. The general idea is t o augment the data artificially in order t o obtain a more tractable likelihood function, for which there may exist simple expressions for the maximum likelihood estimators. This is the so-called M-step (maximization step) of the EMalgorithm. The M-step alternates in an iterative manner with the E-step (expectation step), in which we compute the conditional expectation of the augmented likelihood function conditional on the observed data. During the M-step we shall assume that we have always observed X and 6, while 2 was observed only when 6 = 1. Furthermore, we assume that none of these observations are censored by C. It is practical t o change slightly the meaning of the x, and z3. We now assume that there are N triples (z,, z,, 6,). Here 6, = 0 if x, < z,, in which case we observe only x,,6,, and 6, = 1 if z, < x,, in which case we observe the whole triple (x,,z,, 6,). The augmented likelihood now becomes

which by taking the logarithm gives the augmented log-likelihood, N

I A ( x , P, 4) = N

log

-

xi

+ Nlog(1

N -

4) - bg(1 - q)

i= 1

6i a=

N

N

N

N

i=l

i= 1

i=l

i=l

1

(17)

We consider the M-step first, where we find the maximum likelihood estimators from (17). Then we consider the E-step where we replace the unobserved terms of the log-likelihood by their expected values, conditional on the observed data and the current parameter estimates.

334

B. H. Lindqvist and H . Langseth

M-step: Maximization of (17) gives us explicit expressions for the maximum likelihood estimators:

(18) E-step: In this step we compute the expected value of (17) given our data 51,. . . ,x,, 21,. . . ,z,, c1,. . . ,c,.. For the observations where the failure time xi is observed, we have Si = 0 and the value of zi is not needed. For the observations where the PM-time zi is observed we have bi = 1 while xi is not observed. Hence, we need to replace the corresponding xi and log xi in (17) by their conditional expectations. These are computed by first noting that the conditional density of X given (2 < X, 2 = z } is

f(zl2 < x,z = 2) =

5- P e-

x1:

x P - q i - p, xz)

for x > z ,

and hence that E[XIZ < X, 2 = z] = r(2 - p,Xz)/(X . r(l - p,Xz)) and E[log(X)JZ< X, 2 = z ] = log(w)w-P exp(-w)dw/I'(l - p, Xz) 1% (XI. Finally, we consider the observations where the censoring time C = c is observed. In this case we do not observe bi, and hence from (17) we need to compute E [ X l m i n ( X , Z ) > c ] , E[bImin(X,Z) > c ] , E [bX1 min (X, 2 ) > c], and E [blog X 1 min ( X ,2 ) > c]. After some algebraic manipulations, we find that

JE

P ( Z < XI min(X, 2 ) > c) = -

f(zl min(X, 2 ) > c, 2 < X)= -

f(xl min(X, 2 ) > c, X < 2) =

f(zl min(X, 2 ) > c, 2 < X) = -


335

From these conditional densities we find the desired expectations. The EMalgorithm now proceeds by using the augmented dataset to re-estimate the parameters using (18), using these new estimators to generate a new augmented database, and so on until convergence. The resulting estimates for the VHF and OREDA-data are given in Tables 23.2 and 23.3, respectively. We also include bounds for approximate 95% confidence intervals based on standard log-likelihood theory. We see that p appears to be larger for the VHF data than for the OREDA data. This is in correspondence with Fig. 23.1, where the sub-distribution functions for the VHF data are closer together than those of the OREDA data. It is also interesting to note that = 1.00 for the OREDA data. This corresponds to choosing g ( t ) proportional to the hazard rate of the failure times, as in the class of models investigated by Langseth and Lindqvist.’ Finally, we note that the confidence interval for 0in the VHF data extends all the way to infinity. The meaning of using 0 = 00 should be seen in relation to (9), and indicates that when an unconfirmed failure ( 2 )was observed, it occurred immediately before a failure (X)would have been realized. Table 23.2. Maximum likelihood estimates and approximate 95% confidence intervals for parametric repair alert model for the VHF-data. Parameter A

P 4

Estimate Lower bound 3.10. 10-3 2.73. lo-’ 4.44 2.08 0.318 0.270

Upper bound 3.51. lo-’ 00

0.369

Table 23.3. Maximum likelihood estimates and approximate 95% confidence intervals for parametric repair alert model for the OREDA-data. Parameter

x P 4

Estimate 1.80. lo-‘ 1.00 0.621

Lower bound 1.04. lo-’ ,553 0.461

Upper bound 2.86. lo-’ 2.74 0.771

23.5. Concluding Remarks In this chapter we have considered the repair alert model, which describes

a specific dependence structure between failures (X) and preventive maintenance (2).We extend our previous work3 by including the possibility of

336

B. H. Lindqvist and H . Langseth

independent censoring due to an external source. The use of our model is exemplified by analyzing two different datasets: The VHF data are type I censored at a given time T but have previously been analyzed3 without taking this into account. The OREDA dataset describes several different failure modes, and we handle this situation by focusing on one particular failure mode and consider all other failure modes as external censorings. In general this may lead to dependent censoring, thus violating the assumption of independent external censoring. Independent censoring may, however, be justified in the example from physical properties of the involved failure mechanisms. Otherwise, an assumption of independent censoring may be forced by mathematical convenience or the lack of knowledge of the underlying failure mechanisms. Next, it may be noted that the OREDA dataset is rather heavily censored, which may lead to less confidence in the nonparametric curves (right panes of Figs. 23.1 and 23.2). In fact, these curves are based on the Kaplan-Meier estimator which may behave poorly in the presence of heavy ~ens0ring.l~ We will not pursue this further here, but only note that this motivates the use of parametric models in such cases. We finally comment on the choice of the exponential distribution for X in the parametric modeling of Sec. 23.4.4. By the memoryless property of the exponential distribution it seems likely that preventive maintenance would not be appropriate in this case. However, random signs censoring and the repair alert model still have meaning for the exponential distribution since they impose a strong dependence between the P M time 2 and the failure time X . Recall the intuitive content of random signs censoring being that the component emits a signal before failure. It is inherent in the model that the time from this signal to the failure would occur, is not distributed as X as one might believe from the memoryless property. In an extreme case the signal may be emitted immediately before the failure, in which case 2 , when observed, is always approximately equal to X. On the other hand, a main reason for choosing the exponential distribution in our parametric model is for ease of exposition. In principle, any parametric model for X may of course be used, the Weibull distribution being a natural choice. Still, for maintained components it is well known that failure times often appear to be nearly exponentially distributed since there are usually few observations in the tail of the distribution.


337

Acknowledgment Comments from an anonymous referee are greatly acknowledged.

References 1. A. Tsiatis, A nonidentifiability aspect of the problem of competing risks, Proceedings of the National Academy of Sciences, USA 72, 20-22 (1975). 2. M. J. Crowder, Classical Competing Risks, Chapman and Hall/CRC, Boca Raton (2001). 3. B. H. Lindqvist, B. Stove, and H. Langseth, Modelling of dependence between critical failure and preventive maintenance: The repair alert model, to appear in Journal of Statistical Planning and Inference, Special Issue on Competing Risks (2005). 4. R. M. Cooke, The total time on test statistics and age-dependent censoring, Statistics and Probability Letters 18,307-312 (1993). 5. R. M. Cooke, The design of reliability databases, Part I and 11, Reliability Engineering and System Safety 51,137-146 and 209-223 (1996). 6. W. Mendenhall and R. J. Hader, Estimation of parameters of mixed exponentially distributed failure time distributions from censored life test data, Biometrika 45, 504-520 (1958). 7. OREDA, Offshore Reliability Data Handbook, 4th ed. Distributed by Det Norske Veritas, P.O. Box 300, N-1322 Hovik, Norway, http://www.oreda.com/ (2001). 8. H. Langseth and B. H. Lindqvist, Competing risks for repairable systems: A data study, to appear in Journal of Statistical Planning and Inference, Special Issue on Competing Risks (2005). 9. H. Langseth and B. H. Lindqvist, A maintenance model for components exposed to several failure mechanisms and imperfect repair, in Mathematical and Statistical Methods in Reliability, Series on Quality, Reliability and Engineering Statistics, Vol. 7,Eds. B. H. Lindqvist and K. A. Doksum (World Scientific Publishing, Singapore, 2003), pp. 415-430. 10. T. Bedford and R. M. Cooke, Probabilistic risk analysis: Foundations and methods. Cambridge University Press, Cambridge (2001). 11. J. F. Lawless, Statistical models and methods f o r lifetime data, 2nd ed., WileyInterscience, Hoboken, NJ. (2003). 12. I. Dewan, J. V. Deshpande, and S. B. Kulathinal, On testing dependence between time to failure and cause of failure via conditional probabilities, Scandinavian Journal of Statistics 31,79-91 (2003). 13. A. P. Dempster, N. M. Laird, and D. B. Rubin, Maximum likelihood from incomplete data via the EM algorithm, Journal of the Royal Statistical Society, Ser. B 39,1-38 (1977). 14. R. G. Miller, Jr., What price Kaplan-Meier? Biometrics 39,1077-1081 (1983).


CHAPTER 24 IMPORTANCE SAMPLING FOR DYNAMIC SYSTEMS BY APPROXIMATE CALCULATION OF THE OPTIMAL CONTROL FUNCTION

ANNA IVANOVA OLSEN CeSOS, NTNU, Otto Nielsens v. 10 NO-7491, Trondheim, Norway E-mail: [email protected] Web: http://www. cesos. ntnu.no/N ivanova

ARVID NAESS Dept of Mathematical Sciences €3 CeSOS, NTNU, A . Get2 vei 1 NO-7491, Trondheim, Norway E-mail: [email protected] An iterative method for estimating the failure probability for timedependent reliability problems has been developed. The system response has been modeled by a diffusion process, solution of an It6 stochastic differential equation. On the first iteration a simple control function has been built using a design point weighting principle for a reliability problem. After time discretization, two points were chosen to construct the compound deterministic control function. It is based on the time point when the first maximum of the homogenous solution has occurred and on the end point of the considered time interval. An importance sampling technique is used in order to estimate the failure probability functional on a set of initial values of state space variables and time. On the second iteration, the concept of optimal control function developed by Milstein has been implemented to construct a Markov control which provides better accuracy of the failure probability estimator than the simple control function. On both iterations, a concept of changing the probability measure by the Girsanov transformation is utilized. As a result the lower variance of estimates is achieved by fewer samples and the CPU time is reduced by order of 10 compared with the crude Monte Carlo procedure.

339

340

A . Ivanova Olsen and A . Naess

24.1. Introduction The evaluation of system performance is one of the objectives of mathematical modeling and numerical analysis in structural mechanics. Therefore, the first passage characteristics play an important role in structural reliability. The first passage failure occurs when the response of the structure first reaches a prescribed tolerance level. Unfortunately, the general solution of this problem is not available in closed analytical form. Therefore, by now, there is only the Monte Carlo method which is a universal procedure for estimating the system failure probability. However, since such failure probabilities are often rather small, the standard implementation of the Monte Carlo method requires an immense number of samples to secure acceptably accurate estimates. Therefore, as in the time-independent reliability, the methods of variance reduction, also referred to as importance sampling techniques, are desirable to be used for dynamic problems. In this paper we investigate the use of methods from the theory of stochastic control for developing a practical importance sampling method for dynamical systems. It is considered that the dynamic response is modeled by a diffusion process, solution of an It6 stochastic differential equation. The importance sampling density is obtained by successive implementation of the Girsanov transformation of probabilistic measures.' Though this theorem is applicable to a wide class of dynamic systems, the scope of this paper is oscillatory systems with single degree of freedom excited by white and colored noise. Recently, several author^'>^>^ applied the First Order Reliability Method (FORM)5 to the randomly excited dynamic systems. The so-called design point excitations lead the response of the structure to the failure domain while the unlikeliness of such paths is taken into account by a correction process. This procedure creates a deterministic control for the dynamic system. However, the analytical expression is obtainable only in the linear case for one degree of freedom systems. For the nonlinear and multidimensional problems special optimization algorithms have to be applied to assess the control function for each time step and, in some cases, the evaluation of failure probability is restricted only to the stationary regime. Herein, it is shown how the Markov control function can be designed for a linear oscillator in the transient regime. Furthermore, it is assumed that this procedure may be used for nonlinear systems which can be suitably linearized. This method might be applied to seismic structural design, estimation of a nuclear plant reliability, as well as, forecasting some economic

Importance Sampling for Dynamic Systems

341

strategies such as, for instance, values of American options. 24.2. Problem Formulation. Reliability and Failure

Probability Performance and design requirements of a dynamical system restrain the acceptable values of the response to the safe domain Ds E R", where D s is some given Bore1 set. The probability (1)

ps(T) = P{ES), where

Es

= {w : X ( t ) = X ( t ,w ) E

Ds for every0 < t 5 T }

(2) is the probability that the response X ( t ) will stay inside the safe domain throughout the time interval (0,TI. For simplicity it has been assumed that X ( 0 ) = 0 E Ds.p s ( T ) is referred to as the reliability of the system. Thus the probability of failure ~ F ( Tcan ) be defined as ~ F ( T=) 1 - ps(T). The response is represented by a continuous stochastic process X ( t , w ) : (0,T ] x il + W" defined on a (complete) probability space (il,F,P ) and for the time interval (0, TI, where il is a space of elementary events, F is a aalgebra of measurable sets of il and P : F + [0,1]is a probability measure.6 Thus the probability of failure ~ F ( T=)1 - P ( E s } , where Es f F by the assumptions made, is given as P F ( T ) = 1-

/

Es

dP(w) =

/

I [ g ( X ( .">,)I

d P ( w ) = E ( I [ g ( X ) ] ) , (3)

n

where g ( X ) is a limit state function and I [ g ( X ) ]is an indicator function defined as follows: 0 : WEE^ (4) I[g(X)1= 1 : otherwise.

{

The dynamic response of the system is assumed to be given by an It6 stochastic differential equation (SDE)

d X ( t ) = rn(t,X)dt4-( T ( t , X ) d W ( t ) , 0 5 s 5 t 5 T , X ( s ) = 5, (5) where X ( t ) = ( X I @ )X,(t), , . . . , X n ( t ) ) T E W" and W ( t )E W is a standard Wiener process with respect to the measure P. m(t,X ) , a(t,X ) E R" are drift and diffusion coefficients, respectively, which satisfy suitable Lipschitz and growth conditions.6 The mean value estimator of the failure probability by the Monte Carlo method is . N

(6)

342

A . Ivanova Olsen and A . Naess

where zi (i = 1,. . . ,N ) are N realizations of the process X ( t ) . The standard error of this estimator7 is approximately By the Girsanov theorem' the Wiener process W ( t )in Eq. ( 5 ) may be substituted with another stochastic process @(t)defined as

l/dm.

(7) where U ( T , W ) is a real nonanticipative bounded process.6 Thus, @(t)becomes a standard Wiener process on ( s , T ] with respect to a new measure p , which is defined below. Then the SDE (Eq. 5) takes the form (0 5 s 5 t 5 T ) d X ( t ) = m(t,X ) d t

+ g ( t ,X)v(t, X ) d t + ~ ( Xt ), d W ( t ) ,

X ( s ) = x, (8)

where the control function u ( ~ , w = ) v ( t , z ( t , w ) )is given below in Eq.(13). This transformation of measures may be done according to the RadonNikodym theorem.8 By the Novikov conditioq6 the Radon-Nikodym derivative (dP/dP)-l is integrable. Hence we can write

(9) where E denotes expectation with respect to P , and

(10 The reliability problem is now considered on the time interval (s,T ]with initial condition X ( s ) = z, and ~ F ( T s,x) ; denotes the associated failure probability. The Monte Carlo estimator of the failure probability based on the measure is then by Eq. (9)4

(11) In the terms of stochastic control t h e ~ r ythe , ~ Radon-Nikodym derivative depends on the control process for the system (5). Usually four types of control may be distinguished.6 However, for the method proposed in the present paper, only two of them are used, namely, a deterministic control v(t) (also called open-loop control) and a Markov control v ( t ,2). Analyzing Eqs. 3 and 9, it is obvious that the failure probability is independent on the choice of controller, whereas the variance does depend


343

on v. Invoking again the theory of stochastic control, it can be shown that there exists an optimal control function7 for minimizing the functional

J = E 12"9()1)] --=

,

(12)

viz.. (13) .

.

From Eq. (13) it follows that the optimal control function depends on the failure probability ~ F ( T s,x), ; which has to be known for all values of the arguments (s,x)E (O,T]x Rn. But, of course, if the answer is known, there is no need in controlling the system. On the other hand, if the failure probability can be calculated approximately on a suitable finite grid in (O,T]x Rn, then it is possible to construct a control function that may provide a more accurate estimation of the failure probability. 24.3. Numerical Examples

24.3.1. Linear oscillator excited by white noise

A very wide class of engineering systems can be modeled, to a first approximation, in terms of linear differential equation, if the amplitude of motion is relatively small. Thus, the considered numerical example is linear oscillations of a light damped spring-mass system. The motion of this linear oscillator excited by white noise N ( t ) follows the second order differential equation: X ( t ) + 2 [ w o X ( t ) W i X ( t ) = yN(t) (14) X ( s ) = 2, X ( s ) = k. Under standard assumptions, Eq. (14) can be written as a SDE (Eq. 5). Let X I = X and X , = X , then in matrix form

+

d X ( t ) = AX(t)dt +ybdW(t), where W ( t )is a standard scalar Wiener process" and

(15)

(16)

The considered safe domain is given by D s = ( 2 : x < x c , x E R}, where x, is some critical threshold for the displacement response. By replacing the Wiener process W ( t ) by W(t) as explained in the previous section, Eq. (15) takes the form d ( t )= A r i ( t ) d t+ y b v ( t , j ( t ) ) d t + y b d @ ( t ) .

(17)

344

A . Zvanova Olsen and A . Naess

-

On the first iteration it is assumed, that the control function is a deterministic open loop control, ie., w ( t , X ( t ) ) = w(t), then Eq. (14) has an explicit analytical solution (18)

where 1

h(t) = -e--Ewot

sinwdt,

wd

Wd

=w g J m l

(19)

is an impulse response function and (20)

is an homogenous solution for the displacement X ( t ) . Using the forward Euler approximation, Eq. (18) can be approximated by the difference scheme: ()21)

+

where s < (is 1)At < . . . < j . At, is = [s/At] ( [ a ] denotes the largest integer smaller than or equal to a), j 5 m = [ T / A t ] ,t j = j . At, wi = v ( i .A t ) , hji = h ( ( j- i) . A t ) , V i a = W ( i. At) - W ( ( i- 1).At) are the increments of the Wiener process. Ui are independent standard Gaussian variables with zero mean and unit standard deviation. In accordance with the definition of Ds,the limit state function is given as:

-

g ( X ) = z, -

x,

(22)

where zc is a preassigned critical threshold. Then the mapping to the finite standard Gaussian space becomes possible because the number of random variables is finite due to the time discretization. Thus, the FORM-like procedure can be applied to design a deterministic controller. The idea was developed by Ref. 2. In Ref. 3 the method is called the design point oscillations. Hence the mapping is a standard procedure given (23)

i=i,+l

i=i,+l

The excitations leading to out-crossing of the safety margin gu(V) = 0


345

at time t j are obtained then as

(24)

and the design point index is given

pj

= p(tj) =

4c

uf.

(25)

i = i . +1

Unless the control function is known, assume that the design point of the system (Eq. 17) is at the origin of the standard Gaussian space, then the simple control function" is given as zc - F( t j - S,5,k ) (26) vi = hji.

c j

7

Let At

--+

h5kAt

k=i,+l

0, then (26) in integral form is given

(27)

Note that the design point index at a time expressed as

tj

of the system (14) can be

(28)

The corresponding m-dimensional sampling importance sampling density function3 is given as the sum of Gaussian distributions weighted at each time step by the coefficient (29)

where a(.) is the normal Gaussian distribution, p ( t j ) is the design point index at ti. Let t ( j )be the time where the first passage is assumed to happen for the given control function. For some cases, where a single passage time is dominant, one time point t* : {p(t*) = min p(t)} is enough to estimate the failtE(O,TI

ure probability accurately as for instance in the case of fatigue fracture. For an oscillatory system such an approach would lead to an underestimation of the failure probability." In this case considering zero initial conditions, the

346

A. Iuanoua Olsen and A . Naess

domain near the end of the time interval T contributes most to the failure probability, whereas for nonzero conditions the area near tmax,which is the time of the first maximum of the homogenous solution F ( t - s, z, k ) , is the most probable failure interval. Taking into account these features and keeping the number of samples low, two time points are suggested to use, t ( l ) = T and t ( 2 )= tmax,weighted according to their contributions. Simulations with the given deterministic control functions (Eq. 27) are performed for the set of the initial values of z, 3 and s in order to compose the approximate data for the Markov control (Eq. 13). The plot of 3D data is shown in Fig. 24.1. This surface corresponds t o an initial time s = 0. The consequent surfaces for following initial times will be deeper at the origin, and tend to 1 at the distant regions.

Fig. 24.1. Results of the first iteration-approximate failure probability in R2 smoothed by B-spline.

On the second iteration, the value of the Markov control function at each time step is estimated from 3D data calculated on the first iteration, ie. wi = v ( t i - l , Z l ( t i - l ) , Z ~ ( t i - l ) ) .After the sample path crosses the critical threshold zc, the control function is set to zero. If this is not done, the control will keep the oscillations on the threshold level. The examples of

347


the sample paths and control functions are shown in Fig. 24.2. In the upper figure (a) the original paths (Eq. 14) are plotted, in the middle (b) the system is controlled by the deterministic function w ( t ) and in the bottom figure (c) the final Markov control v ( t , q , z 2 ) is active. The time axis is normalized by the natural period T, = of the free oscillations, while the ordinate is divided by the stationary standard deviation of the response X ( t ) , 00 = where Go = y 2 / n is one-sided spectral density of the input noise.

m,

I

I

I

I

I

I

I

I

0

1

2

3

4

5

6

7

8

0

1

2

3

4

5

6

7

8

0

1

2

3

4

5

6

7

8

-4'

t l Tn Fig. 24.2. Examples of the samples a) (*) z ( t ) and (0)k ( t ) for the original Eq. (14), b) (*) z ( t ) and ( 0 ) k ( t ) for the transformed Eq. (17) with deterministic control (0 v ( t ) and c) (*) z ( t ) and (0)k ( t ) for the transformed Eq. (17) with Markov control (0 v(t,zl, Q); critical threshold zJuo = 5.3.

Calculated by (ll),the failure probability estimates are compared with

A . Ivanova Olsen and A. Naess

348

the crude Monte Carlo results in Fig. 24.3 for various threshold values. The results from the crude Monte Carlo method are obtained with different number of samples (> lo3) by the convergency criterium that standard error equals E = 0.05, otherwise the number of samples is N = lo6, if e has not converged to 0.05. Whereas N used by the importance sampling procedure in the two steps is about lo4.The standard error of the estimates is varying between 0.05 and 0.2. However, the method converges to the chosen value E = 0.05 if the number of samples used at the second step is increased, although not more than by a factor of 10. This will not affect the total calculation time very much, because most of the computational burden is associated with the first step.

lo-z

'

......

1o4

lo" PF 10-8

'

i o * I _. . . . . . . . . .]. . . . . . . . . _].. . . . . . . . ,;. . . . . . . . . . I . . . . . .o..j.*. ;

1o-lO

10-12

-. . . . . . . . .

. . . . . . .;. . . . . . . . . .] *

.:. . . . . . . . . .:. . . . . . . . . . ; . . . . . . . . . .:. . . . . . . . . . . .:O .........

; I . . . . . . . . ..:

1 0 5 -.

........

.I . . . . . . . . . I . . . . . . . . .

j

.........

.I..

.......

.I.

:

.......

*

;

.o: . . . . . . . . . .: : o

: I

-

Fig. 24.3. Failure probability for the linear oscillator excited by white noise.

24.3.2. Linear oscillator excited

by colored noise

To exploit the quality of the proposed procedure, another application is suggested. In this example we shall assume that the excitation process of


349

the linear oscillator is a white noise that has passed through a linear, second order filter. Hence, the following model is obtained X(t)

Z(t)

+ 2&JoX(t)+ WZX(t)= Z(t),

+ 2J,w,Z(t) +

(30)

= yN(t),

(31) where X ( s ) = 0, X ( s ) = 0, Z ( s ) = 0,Z(s) = 0. N ( t ) denotes standard Gaussian white noise, and the parameter y determines the intensity of the noise term. Equations (30-31) are interpreted in such a manner that they can be recast into the form given by (5) in terms of the state space vector ( X ( t ) ,X ( t ) ,Z ( t ) ,Z ( t ) ) .The parameters of the system are chosen such that the filter is broad banded, i.e. & = 0.5, whereas the system response is assumed to be a narrow banded process in the sense of small damping, specifically 6 = 0.05. The safe domain to be considered in this section is of the similar type Ds = {(z,x,z , i.)T : z < z, (i, z , i )E R3}. Consider the auxiliary system W,2Z(t)

X(t)

+ 2 ~ ~ o X (+t ~) i X ( t=) y e N ( t ) ,

-2

-2 I

(32) where a corresponding parameter ye is evaluated from the criterium that the spectral density $/(2x) of the equivalent white noise is the same as the contribution from the colored noise Z ( t ) ,namely

_ ‘e -

(33) 2x 2x( (W; - u p 4E;W;W;). Then on the first iteration the same procedure is used (Sec. 24.3.1) to estimate the approximate failure probabilities. According to the Girsanov transformation, the control for the original system should be added as a drift to the white noise N ( t )

+

X ( t ) + 2&doX(t) + W i X ( t ) = Z ( t )

(34)

Z ( t ) + 2[,w,Z(t) + W , 2 Z ( t ) = y(vz(t,F) + N ( t ) ) , - - - -

(35)

where F = (X,X, 2,2)T.However, from the previous step the approximation of the failure probability is obtained only as a function of two space variables, X ( t ) , X ( t ) and time. Using the linear property of the differential operator, it is appropriate to use this controller in the first system Eq. (34)

+ Z ( t ) + 2 ~ The present chapter is aimed at exploring the capabilities of the BN formalism in the modeling and analysis of dependable systems. Starting from the work described in Bobbio, Portinale, Minichino, and Cian~amerla,~ we compare the use of BNs with the use of FTs and the modeling and the decision power of the FTA and BN methodologies in the area of dependability. We show that any FT can be algorithmically mapped into a BN and how the results obtained from FTA can be cast in the BN setting. The major shown advantage is that, by using BN, some additional power can be obtained, both at the modeling (where several restrictive assumptions implicit in FTA can be removed) and at the analysis level (where classical probabilistic computation of FTA can be generalized). The comparison of the two methodologies is carried on through the analysis of a case study, represented by the controller of the gas turbine of the ICARO co-generative plant.6

26.2. Bayesian Networks

A Bayesian Network ( B V 2 is a pair N = ( ( V , E ) , P )where ( V , E ) are the nodes and the edges of a Directed Acyclic Graph (DAG), respectively, and P is a probability distribution over V . Discrete random variables V = {Xi,X 2 , . . . Xn}are assigned to the nodes, while the edges E represent the causal probabilistic relationships among the nodes.a aExtensions are possible where nodes represent continuous random variables

From Artaficial Intelligence to Dependability

367

In a BN, we can then identify a qualitative part (the topology of the network represented by the DA G') and a quantitative part (the conditional probabilities). The qualitative part represents a set of conditional independence assumptions that can be captured through a graph-theoretic notion called d-separation.2 This notion has been shown to model the usual set of independence assumptions that a modeler assumes when considering each edge from variable X to variable Y as a direct dependence (or as a causeeffect relationship) between the events represented by the variables. The quantitative analysis is based on the conditional independence assumptions modeled by the net. Because of these assumptions, the quantitative part is completely specified by considering the probability of each value of a variable conditioned by every possible instantiation of its parents. These local conditional probabilities are specified by defining, for each node, a Conditional Probability Table (CPT). Variables having no parents are called root variables and marginal prior probabilities are associated with them. According to that, the joint probability distribution P of a BNhaving variables X I . . . Xn can be factorized as in Equation 1:

n n

P [ x ~ .,. x. ,xn] ~ ,=

a=

~[~i\~arent(~,)].

(1)

1

The basic inference task of a BN, consists of computing the posterior probability distribution on a set of query variables Q, given the observation of another set of variables E called the evidence, (i.e. P(Q1E)).In Sec. 26.6 we will return to this issue. 26.3. M a p p i n g Fault Trees to Bayesian Networks In standard FTA methodology we have the following basic assumptions: (i) events are binary events (working/not-working); (ii) events are statistically independent; (iii) relationships between events and causes are represented by logical AND and OR gates. We usually adopt the following convention: given a generic binary component C we denote with C = 1 the component failure and with C = 0 the component working. The quantification of the FT requires the assignment of a probability value to each leaf node. Since the computation is performed at a given mission time t , the failure probabilities of the basic components at time t should be provided. In the usual hypothesis, the component failures are exponentially distributed, the probability of occurrence of the primary event (C = 1 = faulty) is P(C = 1,t) = 1- e-xct, where XC is the failure rate of component C.

368

Luigi Portinale, Andrea Bobbio, and Stefania Montani

We first show how a FTcan be converted into an equivalent BNand then we show, in Sec. 26.5,how assumptions (i), (ii) and (iii) can be relaxed in the new formalism. First of all it should be clear that deterministic AND/OR gates can be translated through CPTs with extreme probabilities (e.g. equal to 0 or 1).For instance if the output event of an OR gate is C and the inputs events are A and B , Pr[C = 1IA = 0,B = 0) = 0 while Pr[C = 1JA= z , B = y ] = 1 in case z = 1 V y = 1. In a dual way id the gate is an AND gate PT[C= 1 J A= l , B = 1) = 1 and P T [ C = 1JA= z , B = y] = 0 in case z = 0 V y = 0. Similarly, any kind of boolean function (like for instance the usual implicit ( k : n ) gates of a FT13) can be made explicit in the BN, by only modifying the corresponding CPT. According to the translation rules for the basic gates, it is straightforward to map a FT into a binary BN, i.e. a BN with every variable V having two admissible values: false corresponding t o a n o m a l or working value and true (V) corresponding to a faulty or not-working value. The conversion algorithm proceeds along the following steps:

(v)

for each leaf node (i.e. primary event or system component) of the FT, create a root node in the BN; however, if more leaves of the F T represent the same primary event (i.e. the same component), create just one root node in the BN, assign to root nodes in the BN the prior probability of the corresponding leaf node in the F T (computed at a given mission time t ) ; for each gate of the FT, create a corresponding node in the BN, connect nodes in the BN as corresponding gates are connected in the F F for each gate ( O R , AND or k:n) in the F T assign the equivalent CPT to the corresponding node in the BN. Due to the very special nature of the gates appearing in a FT, non-root nodes of the BN are actually deterministic nodes and not random variables and the corresponding CPT can be assigned automatically. The prior probabilities on the root nodes are coincident with the corresponding probabilities assigned to the leaf nodes in the FT. 26.4. Case Studies: The Digicon Gas Turbine Controller

This case study concerns the controller of the PGT2 Gas Turbine of the ICARO co-generative plant.6 For what concerns the safety and dependability assessment, the structure of the system can be summarized as follows:

From Artificial Intelligence to Dependability

369

( i ) Digicon PGT2 controller, composed by two subsystems: the "main controller" (MC) that provides control and shutdown functions; the "back-up" (BU) unit that provides only protection function (related to two critical parameters, only: temperature and rotational speed); ( i i ) "watchdog" relays associated to each hardware circuit board. The Digicon controller carries out two main functions: Control: to ensure dependability (reliability and availability); Protection: to ensure safety. The hardware structure of the main controller is depicted in Fig. 26.l(a)

Fig. 26.1. Hardware structure of the main controller and backup unit.

where: DI - Digital input; A1 - Analog input; CPU - 32-bit microprocessor; MEM - Memory; 1/0 - 1/0 bus; DO - Digital output; A 0 - Analog input; WD - Watchdog relay; PS - Power Supply inlet; S11.r~- Supply circuit of the main controller. The back-up unit provides a redundant protection with respect to two critical events only: overspeed and over temperature. The back-up unit has a CPU independent from the main controller and uses a separate power supply circuit (operating from the same supply inlet). The back-up unit shares the following transducer signals: 2 thermocouples and 1 speed probe. The hardware structure of the back-up unit is depicted in Fig. 26.l(b). The labels appearing on the blocks of Fig. 26.l(b) have the same meaning as for the MC, and: RO- Relay output; Therm - Thermoucouple signal; Speed - Speed probe. The elementary blocks of the Digicon Controller are assumed to have constant failure rates whose values are reported in Table 26.1. We adopt as TE the occurrence of a safety critical behavior. The Fault Tree representation of the T E is reported in Fig. 26.2. According to the

Luigi Portinale, Andrea Bobbio, and Stefania Montana

370 Table 26.1. troller.

Failure rates for the elementary blocks of the DIGICON con-

Component IObus S P d DO

RO A1 SMC

CPU

Failure Rate (f/h) X i 0 = 2.0 10-9 A s p = 2.0 10-9 10-7 x D 0 = 2.5 10-7 xRO = 2.5 10-7 = 3.0 10-7 xsrn= 3.0 10-7 xcpu = 5.0 10-7

Component Therm. Memory

AO DI

Ps sBU

WD

Failure Rate (f/h) XTh = 2.0 lo-’ AM = 5.0 10-8 x A O = 2.5 10-7 xDr = 3.0 1 0 - ~ xps = 3.0 10-7 x s b = 3.0 10-7 x W D = 2.5 10-7

Fig. 26.2. The FT for the safety critical failures.

translation algorithm presented in Sec. 26.3 the BN derived from the F T of Fig. 26.2 is reported in Fig. 26.3.

Fmm Artificial Intelligence to Dependability

371

Fig. 26.3. The Bayesian network translating the FT of Fig. 26.2

In the BN of Fig. 26.3, gray ovals represent root nodes (corresponding to the basic events in the FT) while white ovals represent non-root nodes. Every node in the BN is a binary node, since the variable associated to it is a binary variable. The binary values of' the variables associated t o the nodes represents the presence of a failure condition (true value) or an operational condition (false value). The only chance (pTobobzhstac) nodes of the BN are the roots (gray nodes). All the other nodes in the BN (white ovals) are deterministic nodes. To make Fig. 26.3 more self-consistent, we have labeled the non-root nodes with the corresponding boolean function (from which the CPT can be obtained straightforwardly). 26.5. Modeling Issues

The mapping procedure described in Sec. 26.3 shows that each F T can be naturally described as a BN. However, BNs are s more general formalism than FTs; for this reason, there are several modeling aspects underlying BNs that may make them very appealing for dependability analysis. In

372

Luigi Portinale, Andrea Bobbio, and Stejania Montana

the following sections, we examine a number of modeling extensions to the standard FT methodology, that can be exploited into a BN framework. 26.5.1. Probabilistic gates: common cause failures

Differently from FT, the dependence relations among variables in a BN are not restricted to be deterministic. This corresponds to being able to model uncertainty in the behavior of the gates, by suitably specifying the conditional probabilities in the CPT entries. Probabilistic gates may reflect an imperfect knowledge of the system behavior, or may avoid the construction of a more detailed and refined model. A typical example is the incorporation of Common Cause Failures (CCF). CCFs are usually modeled in FT by adding an OR gate, directly connected to the TE, in which one input is the system failure, the other input the CCF leaf to which the probability of failure due to common causes is assigned. In the BN formalism, such additional constructs are not necessary, since the probabilistic dependence is included in the CPT. Fig. 26.4 shows an AND gate with CCF and the corresponding BN. The value LCCFis the probability of failure of the system when one or both components are up due to common causes. R[A=l]

Pr(C=IIA=O,B=O)=Lccp Pr(C=lIA=O,B=I ]=km Pr( C=l IA=l ,B=O]=Lcff Pr(C=lIA=l,B=I ]=1

B

-

FAULT TREE AND Gate With Common Cause Failures

Pr(B=l]

BAYESIAN NETWORK AND Node With Common Cause Failures

Fig. 26.4. The CCF representation in BN.

26.5.2. Probabilistic gates: coverage

An important modeling improvement in redundant systems is the consideration of a coverage factor.’ The coverage factor is defined as the probability that a single failure in a redundant system entails a complete system failure. Coverage accounts for the fact that the recovery mechanism can be inac-

Fkom Artijicial Intelligence to Dependability

373

curate and the redundancy may become not operative even in the presence of a single failure. A coverage factor may be also included in combinatorial and FT model^;^)^ however, it finds a very natural application in BN by resorting to the possibility of defining probabilistic gates. The coverage c is defined as the probability that the reconfiguration process is able to restore the system in a working state when a redundant element fails. Figure 26.5 reports an excerpt of Fig. 26.3 related to the AND gate labeled Function. The figure shows a probabilistic AND gate and the corresponding CPT modeling the coverage factor, In the standard AND gate, the event Function is failed with probability 1 only when both inputs MC and WD-M are down. Conditional Probabiliry Table

OR

Pr(Function=l IMC=O, WD-M=l)=(I-c)

Fig. 26.5. An AND gate with coverage and the corresponding CPT

In the coverage case, the node Function may be down with a small probability equal to (1 - c ) , being c the coverage factor, even when only one of the inputs is down. As it can be seen, the coverage factor modifies only the CPT and not the structure of the model (as in Doyle, Dugan, and Patterson-Hine7). To show the effect of the coverage factor on the dependability measures of the system, we have run the following numerical case. We have included a coverage factor c in the AND gates labeled Function, Protec and TE and we have calculated the TE unreliability for a coverage factor c = 0.9, 0.95, 0.99. The results are in Fig. 26.6. For the sake of comparison also the curve with no coverage (i.e. coverage factor c = 1) is reported in Fig. 26.6. 26.5.3. Multi-state variables

All the above considerations concerned binary variables. The use of multistate or n-ary variables can be very useful in many application^^^^ where it is not sufficient to restrict the component behavior to the dichotomy

374

Luigi Portinale, Andrea Bobbio, and Stefania Montani 0.07 0.06 0.05

.0 -

2.--

0.04

3 w

0.03

e

I-

0.02 0.01

0 1.Oe+05

Fig. 26.6.

2.0e+05 3.0e45 Time (h)

4.0e+05

5.0e+05

Unreliability of TE as computed by BN with different coverage factors.

working/not-working. Typical scenarios are possible that require the incorporation of multi-state components: the possible presence of various failure modes7 (short vs open, stuck at 0 vs stuck at 1, covered vs uncovered), the different effect of the failure modes on the system operation (e.g. failsafe/fail-danger) , or various performance levels between normal operation and failureg (Sec. 26.5.4). By dealing with variables having more than two values, BNs can allow the modeler to represent a multi-valued component by means of different values of the variable representing the component itself. 26.5.4. Sequentially dependent failures

Another modeling issue that may be quite problematic to deal with using F T is the problem of components failing in some dependent way. For instance, the abnormal operation of a component may induce dependent failures on other ones. Suppose that, in our case study, the component Power Supply (PS) has actually different behavioral modes: when PS is in state working or failed the behavior of the overall system is the same as the BN of Fig. 26.3 translated from the FT. When PS is in state degraded it induces an anomalous behavior also in the supply equipment (SMC) of the main controller (MC) and (SBU) the back-up unit (BU). The BN, that models the described situation, is reported in Fig. 26.7,

From Artificial Intelligence t o Dependability

375

Fig. 26.7. Portion of the BN showing the influence of a PS degradation.

where only the relevant part of the BN of Fig. 26.3 is reconsidered. The PS node has three states denoted by W for worhng, deg for degraded and F for failed. The prior probabilities of the PS node in the three different states is also reported on the figure. The arcs connecting node PS with both nodes SMC and SBU indicate a possible influence of the parent node PS on the children nodes SMC and SBU. This influence is quantified in the CPTs reported in Fig. 26.7, where it is shown that a degradation in PS induces a failure also in SMC and SBU with probability 0.9. The degradation of the power supply PS does not have a direct effect on the system dependability, but its effect originates from a negative influence of the degradation on other components of the system. 26.6. Analysis Issues Typical analyses performed on a FT involve both qualitative and quantitative aspects. In particular, any kind of quantitative analysis exploits the basics of the qualitative analysis, thus the minimal cut-sets (prime implicants of the TE) computation. Usual quantitative analysis involves: ( i ) the computation of the overall unreliability of the system corresponding to the unreliability of the TE (i.e. P(Fault));(ii) the computation of the unreliability of each identified subsystem, corresponding to the unreliability of each single gate; (iii) the importance of each minimal cut-set, corresponding to the prior probability of the cut-set itself by assuming the statistical independence among components. Any analysis performed on a FT can be performed on the corresponding BN, moreover, other interesting measures can be obtained from the BN that cannot be evaluated in a FT. Let us first consider the basic analyses of a FT and how they are performed in the corresponding BN: (i) unreliability of the T E this corresponds to computing the prior probability of the variable TE=Fault, that is P(Q1E) with Q = Fault and E = 0; (ii) unreliability of a given subsystem; this corresponds to computing the prior probability

376

Luigi Portinale, Andrea Bobbio, and Stefania Montana

of the corresponding variable Si, that is P(Q1E) with Q = S, and E = 8. Differently from the computations performed on a FT, the above computations in a BN do not require the determination of the cut-sets. Concerning the computation of the cut-set importance, it is worth noting that BNs may directly produce a more accurate measure. Indeed, posing a query having the node Fault as evidence and the root variables R as queried variables allows one to compute the distribution P(RI Fault); this means that the posterior probability of each mode of each component (just working and faulty in the binary case) can be obtained. Related to the above issue is another aspect that is peculiar to the use of BN wrt FT: the possibility of performing diagnostic problem-solving on the modeled system. Classical diagnostic inference on a BN involves: (i) computation of the posterior marginal probability distribution on each component; (ii) computation of the posterior joint probability distribution on sets of components; (iii) computation of the posterior joint probability distribution on the set of all nodes but the evidence ones.

26.6.1. Analysis example Consider again the Digicon controller case study. Given the failure rates of Table 26.1, we can evaluate the unreliability of the TE at different mission times from t = 1 . 105h to t = 5 . 105h, by computing the probability of node TE in the BN of Fig. 26.3, given a null evidence. The TE unreliability at the considered time points is plotted in Fig. 26.6 in solid line with label Coverage 1.0 (see Sec. 26.5.2). Concerning posterior analysis, Table 26.2 reports the posteriors of each single component computed at time t = 5 . 105h. These values have been obtained by using the SPI analysis tool.'' Table 26.2. Posterior Probabilities for single components. Component

Posterior

Component

Posterior

Component

Posterior

WDb

1 0.34525986 0.2333944 0.19425736 0.16387042 0.00167474

WDm

1 0.30848555 0.19688544 0.19425736 0.03443292 0.00139391

CPUb Alb

0.37063624 0.2333944 0.19425736 0.16387042 0.00247744 0.00100097

PS

SBU

SMC DOm I/Ob

CPUm

Rob Dlm Mem I/Om

Alm AOm Speed

Thl. Th2

We can notice that the two watchdogs WDm and WDb have a criticality 1, since their failures are necessary in order to have a system failure (as

From Artificial Intelligence to Dependability

377

it could have been easily deduced from the structure of the FT as well). Moreover, the probability of a CPU failure in case of TE occurrence is about 30% for the CPU-M of the main controller and about 37% for the CPU-B of the backup unit. Notice that these posterior values are different, even if the failure rate of both CPUs is the same, because of the different role they play in the overall system dependability. In fact, the failure both of the main controller M C and of the backup unit BU are provided by the failure of the corresponding CPU in boolean OR with the failure of the PER sub-system, but the failure of PER-M follows a different sequence of events than the failure of PER-B, resulting in different posterior probabilities also for the two CPUs. Table 26.3 reports the top 9 configurations of the components having the highest posterior probabilities. The configurations reported in Table 26.3 have to be read by assuming as faulty the mentioned components and operational all the other ones; so for instance the most probable configuration of the components, explaining the occurrence of the TE, is that assuming the power supply inlet and the two watchdogs faulty and all the other component working properly (and the probability of occurrence of such a situation is 0.06597642).

Table 26.3. rations.

Most probable posterior configu-

Faulty Components

Posterior Prob.

PS WDb W D m CPUb CPUm WDb WDm Dlm CPUb WDb WDm SM CPUb WDb W D m Aim CPUb WDb WDm SB CPUm WDb WDm PS CPUm WDb WDm PS CPUb WDb W D m Alb CPUm WDb W D m

0.06597642 0.03288764 0.01873898 0.01873898 0.01873898 0.01873898 0.01873898 0.01873898 0.01873898

As it can be expected, the failure of the watchdog is present in every posterior configuration, since their failure is necessary for the occurrence of the TE. The diagnostic information provided by Table 26.3 is in general more precise (both qualitatively and quantitatively) than the set of MCS with their unreliability.

378

Luigi Portinale, Andrea Bobbio, and Stefania Montani

26.6.2. Modeling parameter uncertainty i n B N model

As a final example about the flexibility of using BN models in dependability analysis, we give a closer look to the problem of parameter uncertainty and sensitivity analysis. In the BN framework, parameters may be considered as random variables, and their uncertainty modeled more appropriately by probability distributions. To illustrate this point, we have carried on the following experiment by considering the Digicon controller case study and assuming again the PS as the exemplificative node. The input parameter is, in this case, the failure rate q5ps of the PS node. In order to compare the present results with those obtained from the FT analysis, we have assumed that q5ps is a random variable uniformly distributed between a minimum and a maximum of Table 26.1: around the value Xps = 3.0

Xminps = (1 - 0.1) Xps

Xmasps

=

+

(1 0.1) Xps

For the sake of simplicity, we have discretized the uniform distribution of q5ps with three values (Xminps, Xps, Xmasps) with equal prior probability. In this new framework, the node PS becomes a non-root node and a child of a new root node which is the multistate variable q5ps. Figure 26.8 reports an excerpt of the overall BN, representing the new situation. Pr{Ops=hps min ]=1/3 Pr@ps=hps )=1/3

hps min=

0.9 hps

hps max=l. 1 hps Pr{PS=F I $ps=hps min)=l- exd- Ops t ) Pr{PS=F I $ps=hps )=Iexp(- Ops t)

Fig. 26.8. The failure rate of component PS is modeled as a discrete random variable.

The CPT associated to the node PS provides the failure probability of PS conditioned to the particular value assumed by its failure rate q5ps. A forward analysis of the modified BN provides the TE unreliability, when

379

h m Artificial Intelligence to Dependability

the failure rate of the component PS is a random variable rpps distributed according to prior probability shown in Fig. 26.8. The obtained results are reported in Fig. 26.9, but they do not change significantly with respect to the original case.

0.02 0.018 0.016 0.014 =.. g

.-m

z

5 w I-

0.012

0.01 0.008 0.006

0.004 0.002 0

1.Oe+O5

2.Oe+05

3.0e+05

4.0e45

5.0~05

l-nne (h)

Fig. 26.9. Unreliability of TE when the failure rate of component PS is uniformly distributed.

A more interesting computation is the posterior analysis, whose aim is to compute the backward probabilities of the various instantiations of the random variable + p s (the PS failure rate) given the TE. The results are reported in Table 26.4. It is interesting to note that while the prior Table 26.4. time

(h)

100000 200000 300000 400000 500000

Posterior probabilities of the PS failure rate values versus time.

4ps

= Aminps

0.314908014710765 0.320016853038519 0.322778441634621 0.324592747846168 0.325920367975634

Posterior Probabilities 4 P S = XPS 0.333351749430096 0.333359939607828 0.333364950369460 0.333368225472299 0.333370305037643

~ P = S Amazps 0.351740235859138 0.346623207353651 0.343856607995917 0.342039026681531 0.340709326986721

probabilities of the three failure rate values have been chosen to be equal, the posterior probabilities result in a higher criticality for the higher failure rate values.

380

Luagi Portinale, Andrea Bobbio, and Stefania Montani

26.7. Conclusions and Current Research Bayesian Networks provide a robust probabilistic method of reasoning with uncertainty and are rather interesting for dependability analysis of safety critical systems. Here, we have dealt with BN versus FT, a very popular technique for hardware dependability analysis. BN versus F T can address interesting questions allowing both forward and backward analysis; moreover, BN are more suitable to represent complex dependencies among components, to include uncertainty in modeling, and to generalize the probabilistic analysis. Several extensions of the BN formalism appear to be of great interest in dependability analysis; among them Dynamic Bayesian Networks for dealing with dynamic system behavior as assumed in Dynamic Fault Trees" and first-order representations for dealing with parametric representations5?l2)as dealt with in Parametric Fault Trees.13 We are currently working towards the use of such formalisms for the definition of a more powerful and flexible dependability framework based on BNs.

References 1. N. G. Leveson, Safeware: System Safety and Computers. Addison Wesley (1995). 2. F. V. Jensen, Bayesian Networks and Decision Graphs. Springer (2001). 3. A. Bobbio, L. Portinale, M. Minichino, and E. Ciancamerla, Improving the analysis of dependable systems by mapping fault trees into Bayesian networks, Reliability Engineering and System Safety 71,249-260 (2001). 4. J. Solano-Soto and L. E. Sucar, A methodology for reliable system design, in Lecture Notes in Computer Science, Vol. 2070, 734-745. Springer (2001). 5. H. Langseth, Bayesian networks with application in reliability analysis, Technical Report PhD Thesis, Dept. of Mathematical Sciences, Norvegian University of Science and Technology (2002). 6. A. Bobbio, G. Franceschinis, R. Gaeta, L. Portinale, M. Minichino, and E. Ciancamerla, Sequential application of heterogeneous models for the safety analysis of a control system: a case study, Reliability Engineering and System Safety, 82(3), 269-280 (2003). 7. S. A. Doyle, J. Bechta Dugan, and A. Patterson-Hine, A combinatorial approach to modeling imperfect coverage, IEEE Transactions on Reliability 44, 87-94 (1995). 8. S. Amari, J. Dugan, and R. Misra, A separable method for incorporating imperfect fault-coverage into combinatorial models, ZEEE Transactions on Reliability 48, 267-274 (1999). 9. A. P. Wood, Multistate block diagrams and fault trees, I E E E Transactions o n Reliability 34,236-240 (1985).

h m Artajicial Intelligence to Dependability

381

10. B. D’Ambrosio, Local expression languages for probabilistic dependence, Znternational Journal of Approximate Reasoning 11, 1-158 (1994). 11. J. Bechta Dugan, K. J. Sullivan, and D. Coppit, Developing a low-cost highquality software tool for dynamic fault-tree analysis, IEEE Zhnsactions on Reliability 49( 1), 49-59 (2000). 12. A. Bobbio, S. Montani, and L. Portinale, Parametric dependability analysis through Probabilistic Horn Abduction, in Proc. 19th Conference on Uncertainty in Artificial Intelligence, Acapulco (2003). 13. A. Bobbio, G. fianceschinis, R. Gaeta, and L. Portinale, Parametric Fault Tree for the dependability analysis of redundant systems and its high-level Petri net semantics, IEEE Transactions on Software Engineering 29(3), 270287 (2003).


CHAPTER 27 RELIABILITY COMPUTATION FOR USAGE-BASED TESTING

S. J. PROWELL Department of Computer Science The University of Tennessee 203 Claxton Complex, 1122 Volunteer Blvd. Knoxville, T N 37996-3450 USA E-mail: [email protected]

J. H. POORE Department of Computer Science The University of Tennessee 203 Claxton Complex, 1122 Volunteer Blvd. Knoxville, T N 37996-3450 USA E-mail:[email protected]. edu Markov chains have been used successfully to model system use, generate tests, and compute statistics about anticipated system use in the field. A few reliability models are in use for Markov chain-based testing, but each has certain limitations. A reliability model that is gaining support in field use is presented here, along with a modification of a common stopping criterion. While the presentation of the reliability model has been given previously,' a discussion of the underlying assumption of independence has not.

27.1. Motivation Not all system failures are equal; some failures are a nuisance, and some result in failure of mission, loss of revenue, or even loss of life. For this reason the central focus of testing should not be simply t o find bugs, but instead t o gain sufficient confidence that system release will not be harmful. The failures t o find are: 383

384

S. J. Prowell and J. H. Poore

(1) those failures that occur most frequently under anticipated operational use, and

(2) those failures that are most serious, by some measure. In order to find the failures which occur most frequently, the system should be tested as it is expected to be used. To find the failures that are most serious, testing should be biased toward critical functionality, but in the context of expected use. This latter part is significant; simply testing critical functions under artificial conditions does not necessarily provide evidence of the reliability of these functions when the system is in operational use. These observations provide the motivation for usage-based testing. To perform usage-based testing, one needs to characterize use in a form that is adequate for testing, and then to select a sample of tests that is representative (in some way) of expected use. The ideas of selection, confidence, and prediction point the way to performing testing as a statistical experiment. Treating software testing as a statistical experiment has the additional advantage that it allows making quantitative assertions about one’s confidence in the system. Other approaches to software testing, such as code, branch, and path coverage can lead to increased confidence in the software, but this experience is not necessarily relevant to field use, and is very hard to quantify. As Healy2 notes: In a metrics mentality, the goal is to find quantities that can be calculated easily. This metrics mentality leads to the calculation of meaningless quantities. The user thinks he has useful information, but is mistaken. A statistical mentality defines parameters, collects data, and applies statistical procedures using the data to estimate parameters. The results are meaningful, useful estimates. This paper discusses statistical testing of systems (not necessarily software-only) based on a Markov chain usage model, an approach which has gained acceptance in industry, and been applied to a variety of different a p p l i c a t i o n ~ . ~Tools > ~ > exist ~ > ~ to support these technique^.^ Section 27.2 of this paper discusses how Markov chain usage models can be used to characterize use of systems. Section 27.3 discusses an approach to computing reliability based on experience during testing, and Sec. 27.4 discusses a method of comparing test experience to expected field use. 27.2. Characterizing Use

The population under study is the set of all relevant tests, where a test is a sequence of usage events to apply to the system under test. Given

Reliability Computation for Usage-Based Testing

385

some initial conditions and a sequence of events, the choice of next event is governed by a probability distribution; the next event selection is stochastic. While there are many classes of stochastic models, finite (first-order, discrete parameter) Markov chains are a well-studied class of stochastic models. Additionally, they are appealing because of their simple structure: such a chain is a state transition diagram, where the outgoing arcs from a given state have probabilities summing to one. The current state thus determines a probability distribution on the outgoing arcs, each of which is labeled with a usage event. Additionally, nearly any statistic of interest for such a model is c ~ m p u t a b l e . ~ ? ~ The structure of a usage model represents what is possible; the probabilities are intended to capture what is believed (or in some cases, known) to be likely in field use, for some particular stratum of use. There may be many usage models developed for a particular product; one for each different stratum of expected users, uses, and environments. A usage model can be characterized by a transition matrix. Let P = [p2,3]be the n x n matrix of conditional next-state probabilities. That is, the probability that the next state of a long realization XI, Xz, . . . , X,. is j, given that the current state is i, is Pr[X,.+1 = j 1 X,. = i] = P ~ , If~ there . is no arc from state i to state j, then p2,J= 0. If there is just one arc leaving state i, and the arc terminates at state j , then p z , j = 1. For any state i one n = 1. These probabilities need not be explicitly set; one can has C3=1p2,.1 use mathematical programming techniques to specify just what is believed about use, and then generate feasible transition probabilities which honor these constraints." Usage models must be developed consistent with a clear definition of use. Such a definition defines a single test (or demand, or use) of the system by stating precisely and verifiably the initial conditions for the test and the conditions under which the test terminates. Given this, one has a clear notion of what constitutes a single test, and one is further able to argue that tests are independent and identically distributed, because all tests begin with the same verifiable initial conditions. If more than one set of initial conditions is relevant, one has more than one definition of use, and consequently more than one model. This more general case is an example of partition testing and is not discussed here. For a discussion of partition testing and Markov chain usage models, see Ref. 11. A trajectory is any path in the usage model. The initial conditions are represented in the Markov chain by a unique state called the source. The final conditions are represented by a unique state called the sink. A test (or

386

S. J. Prowell and J.

H. Poore

use, or demand) is any trajectory which begins in the source and terminates upon reaching the sink. For convenience, the source and sink will always be represented herein as the first and last state, respectively, in the matrix. If one is interested in long-run behavior, one can make the chain ergodic by setting pn,l = 1. If one is interested in the single-use characteristics, one can make the sink absorbing by setting pn,n = 1. For the rest of this paper, we assume the chain is ergodic. Figure 27.1 shows an example model of a simple telephone. The source is the state On Hook, the sink is the state Done. The definition of use begins with the phone on-hook and not ringing, and terminates when the phone goes on hook after being connected exactly once in a call. Note that relative weights are shown instead of probabilities. These are easily converted to probabilities by normalizing them.

Fig. 27.1. The phone model.


387

The generation of test cases and their execution and evaluation are beyond the scope of this ~ a p e r . ~ ~ ? ~ 27.3. Computing Reliability 27.3.1. Models

The singleuse reliability is the probability that the system will not fail on a use, given some definition of use. In terms of the usage model, it is the probability that, given the system is started in the source, one reaches the sink without encountering a failure. Several reliability models have been proposed for use with Markov chain usage models. 0

0

0

Bernoulli sampling model. One can treat each test as a Bernoulli trial, and use the binomial distribution to compute reliability and confidence.l 3 This approach is statistically conservative, but it does not take into account variation among tests and assigns equal weight to both long and short test cases. Failure state model. One can make a copy of the Markov chain usage model called the testing model and introduce failure states into the model where failures are detected.l4y9 This model makes strong assumptions about transition reliabilities and does not give a useful estimate of reliability when no failures are observed, which limits the utility of the model in the short run. Arc-based model. If one views traversing an arc (a usage event) as a single trial, one can compute arc reliabilities using any suitable model. One can then apply simulation techniques to aggregate these into an overall single-use reliability estimate. l 1

This paper focuses on the arc-based model. Success or failure of each arc is, observed and recorded and used to produce a reliability estimate associated with the arc. When arc reliabilities are computed using a model such as that provided by Miller, et useful reliability estimates are obtained even when no failures are observed. Computing the single-use reliability via simulation is complicated by the need to generate many random test cases. Depending on the structure of the usage model a simulation could take considerable time to converge to a useful estimate, even when models are small (fewer than 10,000 states). Usage models specify the use of the system, answering the question “what do we expect the user to do,” rather than specifying the behavior of the

S. J. Prowell and J. H. Poom

388

system, answering the question "what should the system do in response to some event." As a result, Markov chain usage models are seldom large, and an analytical solution for the reliability and its variance is often faster and more precise than simulation. Further, by investigating an analytical solution other results are revealed, such as the probability of failure given any starting state.

27.3.2. An: reliabilities Let 0 I f i , j I 1 be a random variable called the transition failure rate, which counts the fraction of failed transitions from state i to state j. For the purpose of this paper, we assume the f i , j are governed by the beta distribution with parameters a i , j and b i , j . Let a i , j - 1 and b i , j - 1 be the counts of successful and unsuccessful transitions, respectively. Given this information, the moments E [f g ]can easily be computed. For convenience, let r i j = 1 - f i , j . The f i , j will be assumed to be independent. Some transition failure rates are truly independent. In other cases, it is likely that transition failure rates will be positively correlated (a failure on one transition increases the likelihood of a later failure). Since we are only concerned with the first failure encountered, this will lead to a conservative estimate because the end-to-end probability of failure is less for the positively-correlated failures than for independent failures. It is also possible that transition failures can be negatively correlated, where a failure on one transition increases the likelihood of success on a subsequent transition. This is regarded as less likely in general, and its effect is not considered. Each individual transition from state i to state j in a test will be considered independent and identically distributed . Consider running many tests and recording success or failure for each. Let denote the random variable counting the fraction of tests which encounter a failure prior to reaching the sink, given that one starts in state i. The single-use reliability is thus E[1 - f;]. The method of first-passage gives the equation:

fz

k

k

It is tempting to replace every f i , k with its known expectation, and then solve for all the expectations E[f;]. Unfortunately, this will not work in general, because the random variables f : are not independent. The error can grow quite large, as one is effectively substituting E"[4 for E [ z m ] , because of loops in the usage model.


389

27.3.3. !@rajectory failure rate

To avoid the problem encountered above, the single-use failure rate will be derived by appealing to fixed-length trajectories and basic definitions of expectation. The derivation is only sketched here; for complete details, see Ref. 1. Let 0 5 f i m ) 5 1 be a random variable called the m-step failure rate, counting the fraction of tests on which the first failure is observed on the mth step, given that the realization started in state i. Let F(t) denote the probability that a trajectory t executes without failure up to the last step, which then fails. That is, F(t) is the probability that trajectory t fails for the first time at the last step. Let T, be the set of all trajectories on length m. Then, by definition:

c 1

1

E[f,!")]=

Pr[t]

Pr[F(t)= f]f df.

(1)

0

tET,

The integral of Eq. 1 gives the expected failure rate for the trajectory t , and the summation is thus the expected value of the m-step failure rate. Rewriting t as the sequence of state visits s1,s2,. . . ,s,+1 allows factoring and reorganizing Eq. 1, to obtain:

s2

s2

This gives an equation for E[f,("'] in terms of E[f,("-')]. The base of the recursion is m = 1. s2

Solving for the expected value of the single-use failure rate is now a matter of summing all failure rates from m = 1 up. This gives: (2) m==l

Let ?'& denote the matrix whose i , j t h element is pi,j(1 - E [ f & ] )for , 1 I a < n and 1 5 j < n (note that the row and column for the sink are , discarded). Let F1 denote the matrix whose i, j t h element is p i , j E [ f i , j ]for 1I i < n and 1 I j I n. Let U denote a vector of ones of the proper size. Then the vector F*= [ft]can be obtained with the equation:

F* = ( I - &l)-'FiU.

390

S. J. Prowell and J. H. Poore

By a similar process, the following equation can be derived for the variance of the single-use failure rate.

c 00

E

[(f:),]=

E

j=1

[(f?))'] + 2 2

2

E

[f!"'f,'")] .

(3)

m=l n=m+l

The significant term in Eq. 3 is the last expectation. Again, by looking at the term over all trajectories and factoring, the following is obtained, where F(min)=

if m > 1.

(4)

Using induction and Eq. 4,one can show the following for n > m 2 1.

F(m,n)= 7im-1

(7il - ?L2)7iy-m-131u.

(5)

Combining Eq. 5 with Eq. 3 one can obtain the vector of second moments F2+ from the equation:

F,*

=

( I - 7?2)-'F2V

+2(I-

%!2)-'(7?.1

- 7&)F*.

This allows the variances to be obtained. 27.4. Similarity to Expected Use

Let X be a random variable governed by the true distribution p. A statistical model is constructed to approximate p, and this model uses the approximating distribution q. It is reasonable to ask how closely the model resembles the true distribution. One way to measure this is to compute the relative entropy of distribution p with respect to distribution q. This number can be thought of as the number of bits which are wasted by encoding observations of X using the not-quite-right distribution q. Let lga = log, a. Whenever outcome x E X is observed, it is encoded using - lg q ( x ) bits. This outcome is observed with the true probability p(x), so on average - EXEX p(z) lg q(z) bits are used to encode an outcome of X. If the statistical model precisely matched the true distribution, the minimum average of - CIEXp(x)lgp(x) bits would be used to encode the outcome. The number of bits wasted is the difference between the encoding used and the minimum, and can be written as follows:


391

This quantity is known as the Kullback-Leibler number or sometimes just the discrimination, and is denoted K[p,q].16 Note that the discrimination is not a true metric: it is not symmetric. As testing experience grows, it will come to more and more closely approximate the distribution given by the usage model. The difference between the “true” distribution given by the usage model and the approximating distribution given by the ensemble of test cases can be measured by the discrimination. The matrix T = [ t i , j ] ,where t i , j simply counts the number of transitions from state i to state j , can be normalized to obtain a Markov chain, and the discrimination between this testing chain and the original usage chain can be computed. For this reason the discrimination has been recommended as a stopping criterion.14717 As testing experience grows to more closely resemble expected use, KIp, q] approaches zero. There are many different entropies for a model; the one commonly used is the source entropy. For the usage model given by transition matrix P = [pij], the source entropy is given by the equation: n.

n.

i=l

j=1

where 7ri is the stationary distribution of the ergodic chain. For the testing chain given by the matrix Q = [ q i , j ] obtained from T , the equation is: n

n

i=l

j=1

A problem with the discrimination is that it is measured (when one uses the logarithm base two) in bits. It is not intuitively appealing. The discrimination is defined as the difference between the approximating entropy and the model’s source entropy, with the latter always being smaller. If the source entropy is ten bits, then a discrimination of one bit is small. If the source entropy is 0.1 bits, then a discrimination of one bit is large. A better measure may be the relative discrimination, given by the percentage difference between the testing experience and the expected use.

Ht - Hu Hu . Thus if the source entropy is ten bits and the discrimination is one bit, the relative discrimination is 10%. If the source entropy is 0.1 bits and the discrimination is one bit, the relative discrimination is l,OOO%. These two cases are clearly differentiated, and it is possible to establish a target value for the relative discrimination during testing. K,[p,q] = 100 x

392

S. J. Prowell

and

J. H. POOR

27.5. Conclusion Statistical testing based on a usage model directly addresses the goal of gaining confidence that system release will not be harmful. Usage models can be constructed to capture expected use, a n d testing experience can be quantified in terms of reliability and the discrimination with respect to expected use.

References 1. Stacy J. Prowell and Jesse H. Poore, Computing system reliability using markov chain usage models, Journal of Systems and Software 7 3 ( 2 ) , 219225 (September 2004). 2. John D. Healy, Commentary software: Metrics mentality versus statistical mentality, IEEE Transactions on Reliability 4 9 ( 3 ) , 319-321 (September 2000). 3. David P. Kelly and Jesse H. Poore, From good to great: Lifecycle improvements can make the difference, Cutter I T Journal 1 3 ( 2 ) , (February 2000). 4. David P. Kelly and Robert Oshana, Improving software quality using statistical testing techniques, Information and Software Technology 42( 1 2 ) , 801-807 (2000). 5. Kirk D. Sayre, Testing dynamic web applications with usage models, in International Conference on Software Testing, Analysis and Review (STAR West), Software Quality Engineering (October 2003). 6. Kirk D. Sayre, Automated API testing: A model-based approach, in International Conference on Software Testing Analysis and Review (STAR East), Software Quality Engineering (May 2004). 7. Stacy J. Prowell, JUMBL: A tool for model-based statistical testing, in Proceedings of the 36th Annual Hawaii International Conference on System Sciences (HICSS’03), IEEE Computer Society Press (January 2003). 8. J. G. Kemmeny and J. L. Snell, Finite Markov Chains. Springer-Verlag, New York, NY (1976). 9. Stacy J. Prowell, Computations for Markov chain usage models, Computer Science Technical Report UT-CS-03-505, The University of Tennessee, Knoxville, TN (2003). 10. Gwendolyn H. Walton and Jesse H. Poore, Generating transition probabilities to support model-based software testing, Software Practice and Experience 30(10), 1095-1106 (August 2000). 11. Kirk D. Sayre, Improved Techniques for Software Testing Based on Markov Chain Usage Models, PhD thesis, The University of Tennessee, Knoxville, T N (December 1999). 12. Stacy J. Prowell, Carmen J. Trammell, Richard C. Linger, and Jesse H. Poore, Cleanroom Software Engineering: Technology and Process, AddisonWesley, Reading, MA (1999). 13. Jesse H. Poore, Harlan D. Mills, and David Mutchler, Planning and certifying software system reliability, IEEE Software 10(1),88-99 (1993).


393

14. James A. Whittaker and Michael G. Thomason, A Markov chain model for statistical software testing, IEEE %insactions on Software Engineering 20(10), 812-824 (October 1994). 15. Keith W. Miller, Larry J. Morell, Robert E. Noonan, Stephen K. Park, David M. Nicol, Branson W. Murriel, and Jeffrey M. Voas, Estimating the probability of failure when testing reveals no failures, IEEE Transactions on Software Engineering 18(1), 33-44 (January 1992). 16. R. B. Ash, Information Theory, Dover Publications, Inc., New York, NY, (1990). 17. Kirk D. Sayre and Jesse H. Poore, Stopping criteria for statistical testing, Infornation and Software Technology 42( 12), 851-857 (September 2000).


CHAPTER 28 K-MART STOCHASTIC MODELING USING ITERATED TOTAL TIME ON TEST TRANSFORMS

FRANCISCO VERA Department of Statistics University of South Carolina Columbia, S C 29208 USA E-mail: [email protected]

JAMES LYNCH Department of Statistics University of South Carolina Columbia, SC 29208 USA E-mail: [email protected] Over-dispersion of a population relative to a fitted baseline model can be accounted for in various ways. For example, one way is by using a mixture over the family of baseline models. Another is via a martingale structure if the Total Time on Test (TTT) Transform of the population “dominates” that of the baseline model. Here these latter ideas are extended to iterated T T T comparisons and related to a martingaletype of structure, called a k-mart, between the population and the baseline model. These ideas are illustrated for a binomial baseline model using the Saxony 1876-85 sibship census for families with 12 siblings. In addition the construction of a “most identical” distribution in the case of 1-mart is presented.

28.1. Introduction

A principle objective of stochastic model building is to choose a simple baseline model that describes the salient features of the population. One possibility is to construct a stochastic model so that Y = X + q 395

(1)

396

h n c i s c o Vera and James Lynch

where Y is the population, X is the baseline model and E is an error term. Two features that one might require of X in (1) are to be “fair” and uncorrelated with the error term E . Formally,

E ( Y ) = E ( X ) and Cov(X,c) = 0, (2) A stronger and more satisfying requirement is that the construction of the joint distribution of ( X ,Y ) result in a martingale i.e. E(Y1X)= X . (3) The martingale structure quantifies overdispersion of the population relative to the baseline model. As we shall see below this is related to Y being a dilation of X , i.e., both random variables have finite means and E(c(Y))2 E ( c ( X ) ) ,

(4)

for every convex function c. An operational way to verify (4) is through the use of Total T i m e o n Test (TTT) comparisons. Let F denote a cumulative distribution function (cdf) with nonnegative support and finite mean /I (i.e. p = J d F ( z ) ) . Then the TTT transform is

li

T F ( YE ) 1- -

PY

(1 - F ( z ) ) & .

(5)

It is well known that (4) holds if and only if

E ( Y ) = E ( X ) and T G I T F (6) where G and F denote the distribution functions of Y and X , respectively (e.g. Ross1 or Shaked and Shantikumar2). Moreover, ( 6 ) holds if and only if there exists a joint distribution for Y and X such that (3) holds, i.e., ( X ,Y ) has a martingale structure (e.g., B l a ~ k w e l l ,S~ t>r~a ~ s e n Meyer6 ,~ and the references there in). Dilations can arise quite naturally when fitting mixture models where the means of the population and the fitted model are the same (Shaked7). Consequently, the joint distribution ( X , Y ) can be constructed to have a martingale structure. However, as we shall see, higher order mixture models can oftentimes be fitted in a hierarchical way where the k-point fitted model and the population mixture have a k-mart structure rather than a martingale structure. For k-marts, the analog of dilations is that of balayages. Balayage is a generalization of dilation defined here in terms of generalized convex function. Vera and Lynch8 introduce the concept of Iterated TTT transforms

K-mart Stochastic Modeling Using Iterated TTT ‘Pmnsjonns

397

and prove its relationship with balayages. They also introduce the notion of k-marts, which are martingales when k = 1, and determine its relationship with balayages. The details of this relationship are given in Sec. 28.2. In Sec. 28.3 the application of these ideas to mixture problems is presented, where method of moments is used to match the fitted model to the population. These ideas are illustrated in Sec. 28.4 for the Saxony 1876-85 sibship census for families with 12 siblings from Sokal and RohlP (see also Shaked7). In Sec. 28.5 the construction of the “most identical” distribution in the case of a 1-mart is given.

28.2. Generalized Convexity, Iterated TTT, K-Mart To generalize the notion of dilation we need the following definitions. Definition 28.1: A family ofreal functions U = {UO,~ 1 , ... ,U r n } is called a Tchebycheff system (or T-system) if det [ui(xj);i, j = 0,. . . , m] > 0 whenever xo < x1 < ... < 2,. Definition 28.2: Let U = { u o , ul,.. . , u r n } be a system. We say that a function c, defined on X , is U-convex or convex with respect to U if and only if

(7)

for every xo < x1 < . . . < xm+l. If the inequality is strict (>), then we say that the function is strictly convex.

As a special case of U-convexity we have the following definition. Definition 28.3: Under the conditions of Definition 28.2, if U = (1, z,.. . ,xZk-l},then any U-convex function is called k-convex. In the next theorem

c ( j ) denotes

the j-th derivative of c.

Theorem 28.1: Under the conditions of Definition 28.3, if c is a differentiable function then c is k-convex if and only if c ( ~ 2~ 0) Next, we define the concept of a balayage in terms of the class of kconvex functions.

398

Francisco Vera and James Lynch

Definition 28.4: Let G and F be two cdf. We say that G is a balayage of

5 F ) if

F (denoted by G

(8)

for every k-convex function c. If G and F have densities g and f respectively, g

k

k

> f denotes G > F .

Notice that in the above definition a dilation is a balayage with k = 1. Also notice that if the inequality is strict in the case of strictly k-convex functions then F and G are different on a set with positive probability. Another important notion is that of Iterated TTT transforms.

Definition 28.5: Let F be the cdf of a nonnegative random variable X . The j-order TTT transform, T g ) , is defined recursively as follows: TS 5 F 2

(94

where

s

m

(j)

Pj=PF

= -

T- F ( A( t ) d t ; T - (FA = 1

- T F ( j ); j. = 0 , 1 , 2 , ...

(9b)

0

The relationship between iterated TTT transforms and balayages is given in the next theorem. k

Theorem 28.2: Let G and F be two distribution functions. G > F if and -(2k-1) ) j = 1 , . .. , 2 k - 1 . only if TG 2 TP-')and J z j d G ( z ) = ~ j d F ( zfor Proof: See Vera and Lynch8 for details.

0

The relationship given in Theorem 28.2 suggests a diagnostic tool to check when the population is a balayage of the fitted model, or in terms of mixtures, if a higher order mixture should be fitted. Let F2 denote the fitted distribution and let F1 denote the distribution of the population. If k

F1 > F2 then the first 2k- 1 moments of Fl and Fz are the same. Moreover, the moments pj defined in (9b) for j = 0, . . . ,2k- 2 are also the same, since from Vera and Lynch' formula (3.5), (j)

P j = PF

=

EF

(

x~+I)

(10) ( ~ + I ) E F ( X ~ ) '

399

K-martStochastic Modeling Using Iterated TTT T h n s f o m s

7

Hence

[Fp)(t)- F$)(t)]dt= 0

(11)

0

for j = 0,.. . ,2k - 2. Now, the function x Z k is strictly k-convex. Therefore, if F1 and F2 are different, then E 1 ( X z k )> E 2 ( X Z k ), and by (lo),

or equivalently, by (9b), 00

(12) 0

Summarizing the above we have the following lemma. k

Lemma 28.1: Let Fl > F2 with F1

# F2. Then, (12) holds if and only if

E F (X2‘) ~ > E F (~X z k ) .

(13)

Another important notion is that of k-marts.

Definition 28.6: Let (Y,X I , .. . ,xk) be jointly distributed random variables with X I ,. . . ,xk independent and identically distributed (i.i.d.). We say that (Y,X I ,. . . , xk) have a k-mart structure if (!4)

for j = 1,. . . ,2k - 1. The following theorem gives the relationship between k-marts and balayages analogous to the one between martingales and dilations. k

Theorem 28.3: Let G and F be two distribution functions. G > F if and only if there exists jointly distributed random variables (Y,X1 , . . . ,x k ) having a k-mart structure with Y N G and X1 F . N

Proof: See Vera and Lynch8 for details The next theorem gives a sufficient sign change condition on G - F for k

verifying when G > F .

Theorem 28.4: Let F and G be two distribution functions with the same first j moments and with respective densities f and g (with respect to some

400

h n c i s w Vera and James Lynch

+

measure v). If g - f has at most j 1 sign changes then T$) - T:) has at most j - i sign changes for i = 1, , .. , j . In particular, if the last sign of g - f is then T$.O”- $.O” 2 0.

+

Proof: See Vera and Lynch8 for details

0

Remark 28.1: Meyer‘ gives a thorough presentation on balayages defined in terms of a class of functions and the consequent representation results akin to the k-mart representation given here. A useful reference on generalized convexity can be found in Roberts and Varberg.”

28.3. Mixture Models In this section we consider mixtures over the family {Fe : 6 E @}.For v a distribution on 9, let F,(z) = Fe(z)dv(O).Assume that Fe has a density with respect to a measure A. So the mixed density is f,,(z) = J fe(z)dv(8). Also denote the j t h moment of Fe by mj(0) = J d d F e ( s ) . The following theorem characterizes balayages between mixtures in terms of balayages between the mixing distributions. Theorem 28.5: Let

v1

and

v2

be distributions on 9 with

points of mass. Assume that fe is totally positive. If a polynomial of degree at most j for j

=

v1

having k

k

v2

> v1 and m j ( 0 ) is

1 , . . . , 2 k - 1, then F2

k

> F1.

Proof: First notice that Theorem 28.2 implies that

and, therefore, J m j ( 0 ) d v 2 ( 8 )= J’mj(0)dvl(O) since mj is a polynomial of degree at most j. Thus

J

z j d F ~ ( z=)

J

~jdF2(~= ) , 1,. j . . , 2 k - 1.

(15)

K-mart Stochastic Modeling Using Iterated TTT ’Ifamforms

401

1

(16)

since

=

x3dF2(x),

for j = 1,.. . ,2k - 1. Now, duz(f9) - du1(O) has at most 2k sign changes since u1 has k points in its support. This implies that f2

- fi =

J fe(dY2(0)

- dvi(8))

has at most 2k sign changes because fe has a totally positive kernel (see the Variation Diminishing Theorem in Karlin”). Thus, by Theorem 28.4, j i ( 2 k - 1 ) - ,ji(2k-1) 2 0. Fz Fi The desired result follows now from Theorem 28.2

0

As an application of Theorem 28.5 we consider mixed binomial distributions. For this let fe(z) = P(1- O)”-, be the binomial density with respect to the measure X that places mass on the points x = 0,1,. . . , n. Since the binomial distribution is an exponential family, it has a totally positive kernel (Karlin”). To obtain an explicit expression for the jthmoment of Fe, mj(O),denote the “falling” powers (Graham, Knuth and Patashnik12) by zi = z(x - 1). . . (x - j 1).It is straight forward to prove, via probability generating functions, that if X bin(n, O ) , then the “falling” moments of the binomial are E(X2) = &j,j = 1 , 2 , . . . (17) It is immediate from (17) that mi(€’), j = 1 , 2 , .. . is a polynomial of degree j . Hence, by Theorem 28.5, whenever fitting a k-point mixed binomial, F1, to a population coming from a higher order mixture, F 2 , where the first

(z)

+

2k

-

k

1 moments are matched, F 2 > F1. The following lemma specifies the polynomial m j (0).

-

Lemma 28.2: Let X

-

bin(n, 0). Then (18)

402

h n c a s c o Vera and James Lynch

Proof: To determine the polynomial m j ( 0 ) for the case of the binomial, we can proceed as follows. Regular and “falling” powers are related by the expression j

(19) i= 1

where

{f} denotes the number of ways to partition a set of j

elements into

i nonempty subsets (Stirling numbers of second kind, Graham, Knuth and Patashnik12). These numbers are defined recursively as follows:

{:}

= O ; n = 1 , 2 , ...

(3 {L}

= 1;n = 0 , 1 , 2 , .. . = k{

I,I} + { L Ii};n = 1 , 2 , . . . ;k = 1 , . . . ,n

The proof now follows from (17) and (19).

0

Let (XI, . . . ,X,,) be a sequence of independent identically distributed (iid) random variables with distribution F2. We close this section with some asymptotics regarding the behavior of

$

n

X,“k- El (X2k)which in some 1

sense measures how well the k-point model, F1, fits the population model, F2. This is given as a corollary of the following theorem.

Theorem 28.6: Let (XI, . . . ,Xn) be a sequence of iid random variables, n

with distribution

F2.

Let Sn =

C X:k.

Then

i= 1

(20

where 2k

E Z ( X ? ~=)

{ 23! } d / 0 j d v 2 ( 0 ) j=l

Proof: Direct consequence of Lemma 28.2 and central limit theorem.

0

K-mart Stochastic Modeling Using Iterated TTT !l??unsfonns

403

Corollary 28.1: If El (X") = Ez (X2k),then

Fl = F 2 , and

1

A,, = J;;(-Snn

- E1(X;k))

If Ez (XZk)> El (X") then A,

(214

-% N(O,Varl(X?')).

(21b)

P

-.+ 00

-(2k-1) - ji(2k-1) - F2

Proof: To see 21a, note that TFl

rom Theorem 28.2 and from (12) . Thus, from (ga), the same argument can be applied recursively to get F1 = F2. Then, (21b) follows from Theorem 28.6. Note that A, 5 00 when E2(XZk) > E I ( X ~ by ~ ) the law of large numbers. 0

Remark 28.2: In a statistical inference problem, the parameters in El(Xfk) and Varl(Xfk) would have to be estimated. The required asymptotics would be more delicate and are not considered here. 28.4. A Binomial Example

The ideas discussed in Sec. 28.3 are illustrated in this section with a data set from Sokal and RohlP, where the frequencies are given for the number of males in 6115 families with 12 siblings each in Saxony from 1876 through 1885. A binomial with n = 12 is a natural baseline model for this data with p equal to the probability of a male. For a binomial fit, the method of moments (MOM) gives p = .5192. Shaked7 observed that the difference between the observed and expected frequencies for this data had a sign sequence -, (Fig. 28.l(a)). He also proved that for a one-parameter exponential family (90,8 E €I with }, a mixing distribution p, the difference in densities f2 - f1 exhibit such a sign change pattern, where = J 8dp(8), f2 = Jgedp(B), and f1 = gg. He also proved that likelihood ratio is convex and that f2 is a dilation of f1. These two features show up in the data, and are seen in the likelihood ratio plot (Fig. 28.l(b)) and in the TTT comparison plot (Fig. 28.l(c)). All these graphs thus confirm that the distribution on (0,1 , 2 , .. . ,12} defined by this data, F , is more dispersed than the fitted binomial. Lindsey13 also considered this data and fitted a mixed binomial model. He proved that the likelihood ratio is log-convex and developed gradient plots to find the maximum likelihood estimator (MLE) of the mixing

"+, +"

e

2

2

404


Fig. 28.1. One-point mixed binomial.

distribution. In particular, he showed that the MLE for this data set, has 4 points in its support. Here we fit, via MLE and MOM, mixed binomial distributions, Fk, with k points in the support for k = 1,2,. . . ,5. The results of this are shown in Table 28.1. As it can be seen, except for k = 1, the MOM and MLE procedures do not necessarily result in the same fitted models. It can also be seen that the MLE in the case of the 4-point mixture has 1 in its support. Also, the 5-point mixture has two points in its support that are very close together, suggesting that it is actually a 4-point mixture. For the 4-point mixture, there was no solution by the method of moments, which means that F is not a mixed binomial with four or more points in the support of the mixing distribution, since, if it were, then F moments would match up.

4

> F4 and the first seven

K-mart Stochastic Modeling Using Iterated TTT lhnsforms

405

Table 28.2 shows the moments of F and of the different MOM fitted mixed binomials. In the case of the 1-point mixture it is seen that, while the first moments are the same, the second moment of F is bigger. For the 2-point mixture, the first three moments match up, but the fourth moment of F is bigger. In the 3-point mixture, the first five moments are the same, but the sixth moment of F is smaller. This indicates that F is more “spread-out” than the 1-point and 2-point mixtures, but is less “spread-out” than the 3-point mixture. From this one might conclude that 3

1

2

that F3 > F > F2 > FI. As we now shall see the last two comparisons are correct but not the first. Table 28.1. Fitted mixing distributions.

k=l k=2 k=3

k=4

k=5

Maximum Likelihood Mass Support points ( p ) 1 0.519215 0,7200452 0.4814297 0.2799548 0.6163991 0.2250591 0.0072224 0.8174521 0.4952738 0.1753255 0.6429582 0.2220664 0.0068421 0.4943468 0.8088673 0.6391686 0.1841744 1 0.0001162 0.2220664 0.0068421 0.3885243 0.4943467 0.4203429 0.4943469 0.1841744 0.6391686 0.0001162 1

Method of Momemts Mass Support points ( p )

1 0.6509593 0.3490407 0.0016216 0.7771662 0.2212122 0.0008227 0.3100417 0.45189 0.2372455 0.2924128 0.0949093 0.064388 0.4245071 0.1237829

0.519215 0.4744328 0.6027337 0.0853183 0.4886285 0.6298527 5e-07 0.4849806 0.4876126 0.6259495 0.4478722 0.5209143 0.5263 0.5281071 0.6523147

Table 28.2. Moments of MOM mixing distributions. moment 1

9

Fdata

6.2306 42.3094 307.1117 2354.5671 18904.141 157899.12 1364938.1 12159637 111248741

k=l 6.2306 41.8157 297.7493 2227.2933 17379.229 140686.56 1176451.1 10126711 89467145

k=2 6.2306 42.3094 307.1117 2353.7153 18880.079 157462.58 1358401.2 12071120 110115825

k=3 6.2306 42.3094 307.1117 2354.5671 18904.141 157904.55 1365132 12163734 111315075

k=4 6.2306 42.3093 307.112 2354.598 18904.184 157895.71 1364893 12159372 111247672

k=5 6.2307 42.3074 307.1214 2354.7494 18904.752 157888.63 1364731.9 12157551 111235712

406


The iterated TTT plots are given in Fig. 28.2 for the different MOM fitted distributions. As seen from Figs 28.2(a) and 28.2(b) the first and third order iterated TTT for the 1 and 2 point fitted mixed distribution, 2

1

respectively, are dominated by F . Consequently, F > F2 > F1, where the second comparison follows from Theorem 28.5. Fig. 28.2(c) shows partial domination of the 5th order iterated TTT for F3 over F , however there is a small interval where F dominates F3 slightly. This demonstrates that the F3 is not a balayage of F .

(a) Comparison of first order TTT (b) Comparison of third order TTT

(c) Comparison of fifth order TTT Fig. 28.2.

Iterated TTT comparison

Figure 28.3 graphs the difference of the various MOM fitted mixed binomials and indicates that the higher order fits more than half the maximum error. The higher order fits also exhibit (with some nu-, +) for merical error) the higher order sign change pattern (+, -, the 2-point mixture, (+, -, -, -, +) for the 3-point mixture, and

+, +,

+,

K-mart Stochastic Modeling Using Iterated TTT ’Pmnsforms

(+, -,

407

+, -, +, -, +, -, +), which is a generalization akin to Shaked’s sign

change result (see Lynch,14 Theorem 3.2).

.-x 0

x 3. 359

. . .~~

,......:.%:-r .....i..... 5 7-_-. ir_

-.7

..

0 N

P 4

2

O

6

6

1

0

1

0

2

2

4

6

(b) Estimated survival functions

(a) Fitted probabilities Fig. 28.3.

8 1 0 1 2

X

X

Comparison of fitted probability and survival comparisons.

28.5. Construction of “Most Identical” Distribution

If

k

>

then the existence of a joint distribution with marginals F1 and F2 having a k-mart structure is given by Theorem 28.3. Such a joint distribution is not necessarily unique. In this section a construction is given F2

F1,

1

for a 1-mart ( X , Y ) , (F2 > Fl),such that X is “most identical” to Y . The ideas presented are related to Sethuraman.l5 For two densities fl and f 2 , with respect to some measure A, define P

1

= (fl - fd+& = -2

If1

- fzldp,

P = 1- p .

Also define the following densities: 9 cc f1 A f 2 ,

hl c( ( f l

- f 2 ) + 7 h2

c( (f1

- f2)-.

The next Lemma gives a representation of f i in terms of g and hi. Lemma 28.3:

-

f i = p g + p h i ; i = 1,2

(22)

Proof: Let X fi and let W = I(fl(X) > f z ( X ) ) ,where I denote the indicator function. Then, by the law of total probabilities, fl(2)

= P(I = O)fl(ZlI = 0)

+ P(I = l)fl(SlI = 1) = P g ( 2 ) +Phl(S).

h n c i s c o Vem and James Lynch

408

A similar proof holds for f 2 .

0

Notice that (22) implies that k

f2

k

> f 1 if and only if h2 > h l ,

(23)

since

] c ( z ) ( f z ( z )- f 1 b ) ) d z = / C (Z )(h 2 (4 - hl(z))dZ, for any function c. The following result from Lemma 2.1 and (2.5) in Sethuraman15 is needed to prove the main result.

Lemma 28.4: inf P(X

# Y )= p

where the infimum is over all joint distributions ( X ,Y ) having marginals f 1 and f z . 1

Theorem 28.7: Given two densities, f1 and f 2 , with f 2 > fi, there exists jointly distributed random variables ( X , Y ) with marginals f i and f 2 respectively having a 1-mart structure such that P ( X # Y ) = p . Proof: Let 21 hl and 2 2 ha, where, by (23), we choose (21,Zz) to have a 1 - mart structure. Let 2 g be independent of 2 1 and 2 2 and let J be an auxiliary random variable independent of 2, 21 and 2 2 , with P ( J = 1) = p = 1 - P ( J = 0 ) . Set N

N

N

Y

=JZ+

JZ2, X = J Z + JZ1.

Note that

E ( Y I X ) = E(E(YlZ,21,J)lX) (24) since o ( X ) c a(Z,Z1,J ) . Now E (Y )Z , Z 1 , 1 )= E(JZ + JZzlZ,Z1,J) = J Z JE(Z212,21,J ) = J Z JE(22lZ1) = J Z + JZ1= X where the third equality follows since 2 1 and 2 2 are independent of 2 and J and the fourh since (21,Zz) is a 1-mart. Thus, from (24) and (25),

+ +

E(Y1X) = E ( X I X ) = X .

0

K-mart Stochastic Modeling Using Iterated TTT l h n s f o m s

409

Acknowledgments Research partially supported by NSF Grant DMS 0243594. References 1. S. M. Ross, Stochastic Processes, John Wiley, New York (1983). 2. M. Shaked and J. G. Shanthikumar, Stochastic Orders and Their Applications. Academic Press, San Diego, CA (1984). 3. D. Blackwell, Comparison of experiments, in Proc. Second Berkeley Symp. Math. Statist. pp. 93-102 (1951). 4. D. Blackwell, Equivalent comparisons of experiments, Ann. Math. Statist. 24, 265-272 (1953). 5. V. Strassen, The existence of probability measures with given marginals, Ann. Math. Statist. 36, 423-439 (1965). 6. P. A. Meyer, Probability and Potentials, Blaisdell, London (1966). 7. M. Shaked, On mixtures from exponential families, J. R. Statist. SOC.42, 192-198 (1980). 8. F. Vera and J. Lynch, Iterated total time on test transforms comparisons, Submitted (2004). 9. R. R. Sokal and F. J. Rohlf, Introduction to Biostatistics, Freeman and Company, San Fkancisco, CA (1973). 10. A. W. Roberts and D. E. Varberg, Convex Functions, Academic Press, New York (1973). 11. S. Karlin, Total Positivity, Stanford University Press, Stanford (1968). 12. R. L. Graham, D. E. Knuth, and 0. Patashnik, Concrete Mathematics. Addison-Wesley Publishing Company (1990). 13. B. G. Lindsay, Mixture models: Theory, geometry and applications, Institute of Mathematical Statistics, Hayward California, American Statistical Association, Alexandria Virginia (1995). 14. J . Lynch, Mixtures, generalized convexity and balayages, Scand. J. Statist. 15, 203-210 (1988). 15. J. Sethuraman, Some extensions of the Skorohod representation theorem, Sankhya, Series A 64, 884-893 (2002).

Modern Statistical And Mathematical Methods in Reliability (Quality, Reliability and Engineering Statistics)

Modern Statistical And Mathematical Methods in Reliability (Quality, Reliability and Engineering Statistics)

Mathematical and Statistical Methods in Reliability

Recent Advances in Reliability and Quality Engineering (Series on Quality, Reliability & Engineering Statistics, V. 2)

Quality Engineering Handbook (Quality and Reliability)

Ensuring Software Reliability (Quality and Reliability)

Reliability and statistics in geotechnical engineering

Reliability and Quality Management

Life-time Data: Statistical Models And Methods (Quality, Reliability and Engineering Statistics)

Mathematical methods in survival analysis, reliability and quality of life

Applied Reliability and Quality: Fundamentals, Methods and Procedures (Springer Series in Reliability Engineering)

Reliability Physics and Engineering

Statistical Methods for Reliability Data

Statistical Methods for Reliability Data

An Introduction to the Basics of Reliability and Risk Analysis (Series on Quality, Reliability and Engineering Statistics) (Series on Quality, Reliability and Engineering Statistics)

Distribution Reliability and Power Quality

Mathematical and Statistical Models and Methods in Reliability: Applications to Medicine, Finance, and Quality Control (Statistics for Industry and Technology)

Integrated circuit quality and reliability

Accelerated quality and reliability solutions

Engineering reliability

Engineering Reliability

Quality and Reliability in Analytical Chemistry

Quality and Reliability in Analytical Chemistry

Response Modeling Methodology: Empirical Modeling for Engineering and Science (Series on Quality, Reliability and Engineering Statistics) (Series on Quality, Reliability and Engineering Statistics)

Reliability Engineering: Theory and Practice

Reliability Engineering: Theory and Practice

Fatigue and Fracture Reliability Engineering

Applied Nonparametric Statistics in Reliability

Reliability (Understanding Statistics)

Reliability Engineering and Risk Analysis: A Practical Guide (Quality and Reliability, 55)

Modern Statistical And Mathematical Methods in Reliability (Quality, Reliability and Engineering Statistics)