Goble05.

book Page 357 Thursday, March 31, 2005 10:39 PM

Appendix G
Modeling the
Repair Process

Probability of Repair
Modeling the repair process can be complex and error prone. Fortunately,
several assumptions can be made which simplify the analysis without
serious impact on the results. However, one must understand the limits of
these assumptions and simplifications.
In many ways modeling the repair process is difficult because the repair
process is quite different from the failure process. Random failures are due
to a stochastic process and most of our modeling techniques were created
for these stochastic processes. Certain aspects of the repair process are
deterministic. Other aspects of the repair process are stochastic.
Fortunately, we can approximate the repair process more accurately with
Markov models than most other techniques.

An estimate of repair probability can be made. Consider the single

component Markov model of Figure G-1. Assume that failures are
immediately detected when they occur. One can accurately model the
repair process with a discrete time Markov model. Using a delta t of one
hour, one must estimate the probability of repair for each hour after
reaching state 1.

λ∆t
OK Fail
0 1
µ∆t
Figure G-1. Markov Model for Repairable Component

357
Goble05-AppG.fm Page 358 Thursday, March 31, 2005 11:34 PM

358 Appendix G: Modeling the Repair Process

Assume that it is estimated that the repair probability will vary with time
(non-homogeneous). Table G-1 shows a set of example repair time
statistics. These statistics indicate that the repair time of a set of 64 repairs
varied from one to six hours. Six units were repaired within one hour.
Sixteen units were repaired within two hours. Other units took longer.
Based on these numbers the average repair time is approximately 3 hours
and the probability of repair in a particular hour is shown in Figure G-2.

Table G-1. Repair Time Statistics

Repair Cumulative Total Repair
Hours Quantity Probability Probability Time
1 6 0.09 0.09 6
2 16 0.25 0.34 32
3 22 0.34 0.69 66
4 14 0.22 0.91 56
5 4 0.06 0.97 20
6 2 0.03 1.00 12
Total 64 192
Average Repair Time 3

0.40
Repair Probability

0.30

0.20

0.10

0.00
1 2 3 4 5 6
Repair Hours

Figure G-2. Probability Distribution for Repair

Using an average repair rate of 0.333 (1/3 hours), a simple steady state
availability equation (Figure G-3) gives an answer of 0.9708. Most would
agree that the simple approximation is good enough.

The effect of the approximation can be shown clearly by creating another

Markov model that provides exactly three hours of repair time. This
model is shown in Figure G-4. The probability of successful operation
(probability of being in state 0) for this model is 0.9708, the exact same
value as the simple model.
Goble05.book Page 359 Thursday, March 31, 2005 10:39 PM

Appendix G: Modeling the Repair Process 359

0.01
OK Fail
0 1
0.333
Figure G-3. Simple Approximate Markov Model

λ = 0.01
OK Fail
RT=1
0 1
1
Fail
RT=2
1 2
1
Fail
RT=3
3

Figure G-4. Alternative Simplification of Markov Model

One Repairman, Two Repairman

When multiple components are modeled in a system, the issue of
modeling multiple repairs arises. Consider a dual unit modeled by the
simple, one failure mode Markov model of Figure G-5.

The probability of moving from state 2 to state 1 has been modeled two
different ways from various reasons. If the constant repair rate for one unit
is Mu (µ), then the probability of moving from state 1 to state 0 is equal to
Mu given a delta t of one hour. The probability of moving from state 2 to
state 1 has been modeled as either 2 Mu (often called the “two repairman
model”) or Mu (often called the “one repairman model”).

One argument for using a value of 2 Mu assumes that two independent

repair crews are available (see Ref. 1). Therefore, if the failures are due to a
random, stochastic processes, then repairs can occur at the same time
increasing the repair rate to 2 Mu. The argument in favor of using the
value of Mu is that typically only one repair crew is available, and
therefore it is more conservative to use the single Mu value.
Goble05.book Page 360 Thursday, March 31, 2005 10:39 PM

360 Appendix G: Modeling the Repair Process

2P Failure PFailure

System OK
System OK System Fail
1 Unit OK
2 Units OK 2 Units Fail
1 Unit Fail
0 2
1

PRepair10 P Repair21

Figure G-5. Two Component Markov Model

An alternative argument (see Ref. 2) has been made for using the value of
2 Mu. This argument recognizes that only a single repair crew is available.
However, the second failure occurs only from state 1 where one
component is already failed and is likely under repair. Since the repair of
the first component is on average half complete, that repair will take only
half the time to complete. When that repair is complete the Markov model
is back in state 1. Therefore, the repair probability from state 2 is twice as
likely than the repair rate from state 1 to state 0. This is a reasonable
argument and justifies the use of 2 Mu in situations where all failures are
immediately detectable.

Periodic Inspection, Test and Repair

In situations where a failure is not detectable because of automatic
diagnostics or an overt indication, the modeling of repair must be done
quite differently. It must be remembered that the failure must first be
detected then repaired. Often in Safety Instrumented System applications,
detection of some failure types are done when a periodic inspection and
test is performed.

Many use an unreliability technique to model this situation since the

“mission time” is equivalent to the time period between inspections. The
probability of failure is set to zero after the inspection, test and repair if it
is assumed that the inspection and repair process is perfect. That results in
probability of failure plots that look like Figure G-6.
This situation can be modeled using probability combination techniques
or with Markov models. Consider the multiple failure state Markov model
of Figure G-7. This model shows a simplified 1oo2 system without
common cause or diagnostics. (For a complete model of a 1oo2 system, see
Appendix F.)
Goble05.book Page 361 Thursday, March 31, 2005 10:39 PM

Appendix G: Modeling the Repair Process 361

Probab ility o f Failure

PF(t)

Inspection and Test Interval

Operatin g Time Interval

Figure G-6. Probability of Failure as a Function of Operating Time Interval

2λS System Fail

Fail-
DeEnergize
2
µS λS
System OK 2λD
System OK
0
µO
Degraded λD
1 System Fail
Fail-
Energize
3

Figure G-7. Multiple Failure State Markov Model

Goble05.book Page 362 Thursday, March 31, 2005 10:39 PM

362 Appendix G: Modeling the Repair Process

This model can be solved using discrete time matrix multiplication for the
case where periodic inspection and test is done to detect failures in state 3.
The P matrix is normally:

1-(2λD +2λS) 2λD 2λS 0

µO 1-(µO +λS+λD) λS λD
µS 0 0 0
0 0 0 1

When the time counter equals the end of the inspection, test and repair
period the matrix is changed to represent the known probabilities of
failure. The P matrix (PTI matrix) used then is:

1 0 0 0
1 0 0 0
1 0 0 0
1 0 0 0

This matrix represents the probability of detecting and repairing the

failure. The use of “1” indicates the assumption of perfect inspection and
repair.

When this approach is used the plot of probability as a function of time is

shown in Figure G-8. Note that an assumption has been made that the
system provides functionality during the inspection and testing. That
assumption may not be realistic.

0.000004

0.0000035
Probability of Failure - State 3

0.000003

0.0000025

0.000002

0.0000015

0.000001

0.0000005

0
Operating Time Interval

Figure G-8. Plot of Probability for Perfect Inspection and Repair

Goble05.book Page 363 Thursday, March 31, 2005 10:39 PM

Appendix G: Modeling the Repair Process 363

Modeling Imperfect Inspection, Test and Repair

In the previous analysis two assumptions were made that are not realistic.
Both can have a significant impact on results. The assumption of perfect
inspection, test and repair can easily be changed when solving the models
using discrete time matrix multiplication with a Markov model. To include
the effect of imperfect inspection and repair, the failure rate going to the
fail-energize (absorbing) state can be split into those detected during a
periodic inspection and those that are not. The upgraded Markov model is
shown in Figure G-9.

2λS System Fail

Fail-
DeEnergize
2
µS λS
System OK 2λD System Fail

0
System OK
Degraded
ΕλD Fail-
Energize
µO 1
µP 3

System Fail
(1−Ε)λD Fail-
Energize
4

Figure G-9. Upgraded Markov Model accounting for Imperfect Periodic Proof Testing

The P matrix is normally:

D S D S
1 – ( 2λ + 2λ ) 2λ 2λ 0 0
S D S D D
µO 1 – ( µO + λ + λ ) λ Eλ ( 1 – E )λ
µS 0 0 0 0
0 0 0 1 0
0 0 0 0 1
Goble05.book Page 364 Thursday, March 31, 2005 10:39 PM

364 Appendix G: Modeling the Repair Process

When the time counter equals the end of the inspection, test and repair
period the matrix is changed to represent the known probabilities of
failure. The P matrix (PTI matrix) used then is:

1 0 0 0 0
1 0 0 0 0
1 0 0 0 0
1 0 0 0 0
0 0 0 0 1

This matrix indicates that all failures are detected and repaired except
those from state 4 where they remain failed. A plot of the PFD as a
function of operating time interval is shown in Figure G-10.

0.0000045

0.000004
Probability of Failure - State 3

0.0000035

0.000003
Test Interval
0.0000025

0.000002

0.0000015

0.000001

0.0000005

0
Operating Time Interval

Figure G-10. Plot of Probability for Imperfect Inspection and Repair

Modeling the Time Period for Inspection, Test and Repair

Periods
When a periodic inspection, test and repair procedure takes a significant
amount of time, the time period may have an effect on the probability of
failure. This is not an issue when the safety instrumented system remains
on-line and capable of responding to a demand. But if the system must be
placed in bypass for the time period when the test is run, that may be
important. Fortunately, this can also easily be modeled with a discrete
time matrix Markov model. At the beginning of the inspection, test and
repair period an alternative P matrix is used which assigns the probability
of failure in state 3 to “1.” This represents the situation where the system is
disabled during the test. The matrix used during the test period would be:
Goble05.book Page 365 Thursday, March 31, 2005 10:39 PM

Appendix G: Modeling the Repair Process 365

0 0 0 1
0 0 0 1
0 0 0 1
0 0 0 1
0 0 0 1

A plot of probability of failure in state 3 is shown in Figure G-11.

0.00001
V alue goes to 1.0 Value goes to 1.0
0.000009
Probability of Failure - State 3

0.000008
Test Interval
0.000007
0.000006
0.000005
0.000004
0.000003
0.000002
0.000001
0
Operating Time Interval

Figure G-11. Probability of Failure in State 3 with Imperfect Testing and Bypassed
Testing

Overall, more sophisticated models could be used but the effect of repair is
well approximated when the modeling includes:

• Proof test interval

• Proof test coverage

• Proof test time – bypass or no bypass

• Actual repair time

These variables are often not included in simplified equations and this can
clearly result in probabilistic verification calculations that are optimistic
leading to insufficient safety.
Goble05.book Page 366 Thursday, March 31, 2005 10:39 PM

366 Appendix G: Modeling the Repair Process

REFERENCES AND BIBLIOGRAPHY

1. Bukowski, J. V. “A Comparison of Techniques for Computing PFD

Average.” 2005 Proceedings of the Annual Reliability and
Maintainability Symposium. IEEE, 2005.

2. Bukowski, J. V. Notes during private meeting with author.

September 2004.