Analysis of the reliability of a starter-generator using a dynamic Bayesian network

Analysis of the Reliability of a Starter-Generator Using a Dynamic Bayesian Network

Journal Pre-proof

Analysis of the Reliability of a Starter-Generator Using a Dynamic Bayesian Network Dooyoul Lee, Dongsu Choi PII: DOI: Reference:

S0951-8320(19)30251-0 https://doi.org/10.1016/j.ress.2019.106628 RESS 106628

To appear in:

Reliability Engineering and System Safety

Received date: Revised date: Accepted date:

13 February 2019 12 July 2019 31 August 2019

Please cite this article as: Dooyoul Lee, Dongsu Choi, Analysis of the Reliability of a StarterGenerator Using a Dynamic Bayesian Network, Reliability Engineering and System Safety (2019), doi: https://doi.org/10.1016/j.ress.2019.106628

This is a PDF file of an article that has undergone enhancements after acceptance, such as the addition of a cover page and metadata, and formatting for readability, but it is not yet the definitive version of record. This version will undergo additional copyediting, typesetting and review before it is published in its final form, but we are providing this version to give early visibility of the article. Please note that, during the production process, errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain. © 2019 Published by Elsevier Ltd.

Analysis of the Reliability of a Starter-Generator Using a Dynamic Bayesian Network Dooyoul Lee, Dongsu Choi Aero Technology Research Institute, 352 Ayang-Ro, Daegu, 41,052, Republic of Korea

Abstract The reliability of a starter-generator in transport aircraft was assessed. Using the process of reliability-centered maintenance (RCM), necessary decisions were made not only to satisfy the reliability requirement but also to reduce the maintenance load. Failure data have indicated that the life of a starter-generator is limited by the reliability of a bearing. The degradation of the bearing was represented by a dynamic Bayesian network (DBN). Parameters were learned by using the EM algorithm given failure data. The DBN model yielded more conservative risk projection than traditional survival analysis due to the limited number of failure data. The DBN model can make up for the lack of data records by knowledge of experts. Using a calibrated model, the time for inspection was determined to maintain reliability over a prescribed amount of time.

1. Introduction Risk and reliability based inspection planning (RBI) is a strategy to reduce the total cost (sum of the cost of risk and maintenance), through optimization of the inspection schedule. The risk cost includes the cost of aircraft downtime (due to failure), damage, or loss of the aircraft. RBI procedures have been developed and implemented for aircraft since the 1980s, largely to inspect the fatigue deterioration of structural elements [1, 2, 3]. Aircraft structures are designed with a damage tolerance approach that is suitable for RBI, because the assumption of the initial crack size is relatively conservative. With methods of conventional initial crack size assumption, it is likely that a crack could grow unrealistically fast, thus requiring frequent inspection. With field inspection data, the initial crack size distribution can be calibrated and validated [4, 5, 6]. After calibration, inspections with no-detection generally yield smaller initial crack size distributions, and the risk of fracture is lowered. Inspections can be conducted whenever the resulting risk is equal to or below the allowable level. RBI has brought great flexibility to inspection planning [7, 6]. By setting the allowable risk, which generally results in an increased cost of risk, the cost of maintenance is decreased. As a result, the total cost is minimized [8]. The methods used to set safe lives or inspection intervals are generally based on one or more internationally recognized airworthiness standards such as DEFSTAN 970 [9] or the Joint Services Specification Guide (JSSG) [10]. DEFSTAN 970 specifies safety limits in terms of a total probability of failure of 1 × 10−3 for an aircraft, whereas the JSSG

2006 specifies an acceptable level of 1 × 10−7 per flight hour.

Quantitative risk assessment ability is a key factor of RBI implementation. Risk quantification requires that models accurately assess the risk due to degradation, inspection ability (probability of detection), and environmental factors (load, contamination, humidity etc.) [2]. Due to limited knowledge of the input parameters for such models, a probabilistic consideration is necessary, and advanced statistical methods such as the Bayesian Network (BN) are commonly used to model the deterioration data [11]. Degradation mechanisms such as fatigue crack propagation (usage-dependent) or stress corrosion cracking (time-dependent) can be modeled using the BN [5, 6, 11]. Much of the popularity of the BN can be attributed to the existence of efficient and robust procedures for learning parameters from observations [12]. It is quite common that the 2

data available for calibrating the probabilistic model is incomplete. For example, missing data can occur, during an aircraft inspection, where the results generally include binary detection data without the intensity of signal and noise. The expectation and maximization (EM) algorithm enables parameter estimation for probabilistic models with incomplete data [12]. As with aircraft structures, the service life of a bearing is mostly limited by its fatigue strength. Due to uncertainties in determining the material constants for life prediction, a probabilistic approach of life estimation was applied as early as the 1920s [13]. The L10 life, which is the amount of time that 90 % of a group of bearings will complete or exceed (without failing due to rolling-element fatigue), is the basis for calculating bearing life and reliability. Although the life of a bearing is affected by many factors, it is predicted using only the dynamic load capacity and applied load on the bearing. The concept of rolling bearing rating life and basic load rating (load carrying capacity) were introduced by A. Palmgren in 1937 [14]. The 1952 Lundberg and Palmgren report on ‘Dynamic Capacity of Rolling Bearings’ is still the basis for all bearing life calculations [15]. At the time of Palmgren, the dominant failure mode was subsurface cracks initiated at voids and inclusions [16]. The basic rated life and the dynamic load rating represent the subsurface fatigue performance of the bearing. The improvements in bearing fabrication techniques significantly reduced the risk of subsurface cracks. Instead, lubrication and contamination are now the two most important modes of failure [17]. In principle, the same dynamic load rating is obtained for bearings with the same internal geometry, although they may have different surface microgeometry, waviness, raceway, rolling element profilometry, shape, internal precision tolerances, material fatigue strength, and type of heat treatment [16]. Thus, ISO 281:2007 introduced a life modification factor, aISO , which is a function of the lubrication regime, contamination, and fatigue stress limit. Further, aISO is a nonlinear life modification factor, and may result in an infinitely long bearing service life. The benefit of introducing this factor is that it considers environmental effects such as lubrication and contamination, which are the two dominant failure modes of bearings. The use of aISO has been extensively debated, especially for the existence of the fatigue load limit [18, 13, 16]. However, evidences of the benefits of the ISO life modification factor has been accrued over many years [16].

3

A

B

C

Figure 1. Simple BN

In this study, the RBI was developed for a starter-generator using the process of reliabilitycentered maintenance (RCM), and the modified rating life model provided in ISO 281:2007. Field inspection records were used for calibration and validation, and the assumed inspection capability was considered for risk assessment. Suitable actions were recommended to solve operational difficulties. 2. Theoretical Background 2.1. Bayesian Network In the following, a brief introduction to BN is given, limited to the case of discrete random variables, i.e., random variables that are defined in a finite space. The BN is a directed acyclic graph (DAG), which is described by nodes and edges [19]. Nodes represent random variables and edges denote dependencies among them [20]. Fig. 1 shows a simple BN, where node A is the parent of node B and C, and both B and C are the children of A, A node with no parent has its own probability distribution, and a node with parents has a joint probability distribution of itself and its parents. The joint probability mass function (PMF) of this network (Fig. 1) is given by the probability chain rule. Pr (a, b, c) = Pr (a) Pr (b | a) Pr (c | a)

(1)

where Pr (b | a) is the conditional PMF of B given A, and so is Pr (c | a). Evidence update the BN. For example, when the state B in the network in Fig. 1 is observed to be e, this information propagates through the network and the joint PMF of A and C changes according to Bayes rule to Pr(a, c | e) =

Pr(a, e, c) Pr(a) Pr(e | a) Pr(c | a) = P Pr(e) a Pr(a) Pr(e | a) 4

(2)

As a result, marginal posterior probabilities of A and C are also updated. Note that without having any information about A, B and C are dependent. Provided that A is known, B and C are independent because communication between B and C is blocked by A. For a given set of evidence, it is possible to infer the dependence assumptions encoded in the graphical structure using the rules of d-separation [19]. A dynamic Bayesian network (DBN) is a special class of BN, which represents stochastic processes. A group of BNs (slices) consists the DBN, each of which represents the state of ith time step. From i to i + 1, slices are connected by acyclic edges. A DBN is called homogeneous as far as the model structure and the conditional probability tables are unchanged. A number of inference algorithms for DBN were developed [21], and software packages are also available. 2.2. Expectation Maximization Algorithm The EM is used to estimate parameters in probabilistic models with incomplete data. The EM algorithm alternates between the steps of guessing a probability distribution over completions of missing data given the current model (known as E-step) and then re-estimating the model parameters using these completions (known as the M-step) [12]. During E-step, one does not usually need to form the probability distribution over completions explicitly, but rather need only to compute ‘expected’ sufficient statistics over these completions. E-step makes the objective function has one global maximum that can be computed in closed form. M-step comes from the fact that model re-estimation can be thought of as ‘maximization’ of the expected log-likelihood of the data. More formally, the EM algorithm augments the observed data, D, with latent data, Z, so that the augmented posterior distribution p(θ | Z, D) is simple [22]. In the most general setting, the E-step consists of computing
Q θ, θi =

Z

Z


log [p (θ | Z, D)] p Z | θi , D dZ

(3)

where p(θ | Z, D) denotes the augmented posterior, and p(Z | θi , D) is the conditional predictive distribution of the latent data which is conditional on the current guess of the posterior mode. The Q function is the expectation of log[p(θ | Z, D)] with respect to p(Z | θi , D). In the M-step the Q function is maximized with respect to θ to obtain θi+1 . 5

As with most optimization methods for nonconcave functions, the EM algorithm comes with guarantees only of convergence to a local maximum of the objective function (except in degenerate cases). Running the procedure using multiple initial starting parameters is often helpful; similarly, initializing parameters in a way that breaks symmetry in models is also important [12]. 2.3. Rolling Bearing Life Prediction The Lundberg and Palmgren theory [15] developed the basis for the calculation of the dynamic load rating and equivalent dynamic load of rolling bearings as it is applied today in the ISO 281 [23] basic rating life equation: L10 =



C P

p

(4)

where L10 is the rated fatigue life, at 90 % reliability in million revolutions, C is the basic dynamic load rating or capacity, P is the standardized dynamic equivalent load or applied load, and p is the life equation exponent. The basic dynamic load rating, C, is defined as a calculated constant radial load which a group of identical bearings can theoretically endure for a rating life of one million revolutions. The standardized dynamic equivalent load, P , is defined as the equivalent radial load on the bearing which will result in the same life as the actual load and rotation conditions. The variable C can be viewed as the strength of a bearing, and P is the applied load. Eq. (4) is suitable for bearings with extremely high load C/P ∼ 2. However, its predictability decreases under normal operation conditions with much lower load and an extended amount of time [16]. ISO 281:2007 introduced life modification factor, aISO , which is the function of lubrication regime, contamination, and fatigue stress limit.   eC Cu ,κ aISO = f P

(5)

κ is the lubrication regime, which is the ratio of the actual viscosity of the lubricant in the bearing to a “reference viscosity”, ec is the contamination, which is the ratio of the maximum internal stress in a clean contact to the stress in contaminated contact, and Cu is the fatigue stress limit, the load where the fatigue limit of the bearing material is just reached. aISO is a highly nonlinear function as shown in Fig. 2. The modified rating life is shown below. Lnm = a1 aISO L10 6

(6)

1500

aISO

1000 500 0 30 4

20 2

10

C/P

0

0

Figure 2. ISO life modification factor, aISO , given C = 13.5 kN, eC = 1

where a1 is the modification factor for reliability, equal to unity with 90 % reliability and less than unity with reliability higher than 90 %. 2.4. Reliability Centered Maintenance The RCM process is used to determine what must be done to ensure that any physical asset functions the way its users want it to do in its present operating context [24]. The RCM process entails asking seven questions about the asset or system under review, as follows: 1. What are the functions and associated performance standards of the asset in its present operating context? (function) 2. In what ways does it fail to fulfill its functions? (functional failure) 3. What causes each functional failure? (failure mode) 4. What happens when a failure occurs? (failure effects) 5. In what way does a failure matter? (failure consequences) 6. What can be done to predict or prevent a failure? 7. What should be done if a suitable proactive task cannot be found? The most important task of RCM is to find a suitable proactive measure by assessing the risk of the system of interest. 7

3. Starter-Generator and Electrical System Fault Tree Analysis The first five questions (function, functional failure, failure mode, failure effects, and failure consequences) of the RCM process must be answered before developing methods to predict or prevent failures. The starter-generator is an important part of aircraft electrical systems. The role of the starter-generator is to start the engine and to generate electricity during flight. Modern aircraft have a high electrical power requirement due to their multiple avionic systems, and each engine usually has at least one starter-generator. In general, an aircraft has multiple starter-generators and batteries to provide backup. If a single starter-generator fails, another generator should supply power to the system. Generator malfunction is quickly detected by the pilot, because a warning light is triggered as soon as the voltage drops below a specified level. Multiple backup batteries can also supply electricity for a certain amount of time in case all the starter-generators have failed. Even without electrical power from a starter-generator or batteries, an aircraft can fly and land safely under visual flight rules (VFR). However, aborting the mission is inevitable in such cases. The starter-generator (Fig. 3) studied in this paper is from the Hawker 800XP aircraft operated by the Republic of Korea Air Force. The Hawker 800XP has two engines, each with a starter-generator. The starter-generator in the Korean Hawker 800XP has a higher capacity than similar aircraft to supply electrical power to additional equipment, and is thus assigned as a time change item (TCI). Although it is not uncommon to designate a starter-generator as a TCI, some equivalent starter-generators are designated as on condition items (OCI). Originally, the replacement interval for the starter-generator was 1000 h. However, due to the high failure rate during its initial operation, this interval was reduced by 300 h, resulting in significantly higher costs. After switching from steel to hybrid ceramic bearings (ceramic rolling elements on steel races), a new time interval of 600 h was set. However, the new interval is still too short for a transport aircraft. Table 1 shows the performance standard of the starter-generator. When an asset is unable to fulfill its function to an acceptable standard of performance, a functional failure occurs [24]. For a starter-generator, a functional failure occurs when it cannot provide enough electrical power 8

Figure 3. Starter-generator for Hawker 800XP Table 1. Starter-generator performance standard Characteristics

Requirement

Voltage/Current

30 V/550 A

Speed Range

7800 to 12,000RPM

Overload Capability

825 A for 2 min

Efficiency

70 % Minimum at 550 A and 12,000RPM

Weight

24.72 kg Maximum

Drive Shaft Shear Torque

180.78 Nm

to start the engine and power the avionics. Failure modes are events that are reasonably likely to cause a failed state [24]. By examining the maintenance records, which have been collected since 2004, 166 cases of starter-generator failure were found (Table 2). Within these 166 cases, 24 starter-generators required replacement, and of these 24 cases, 21 starter-generators were exchanged due to bearing defects. Thus, it is reasonable to conclude that the failed state is largely caused by bearing failure. There are two bearings in the starter-generator, both of which are hybrid ceramic bearings with ceramic balls. An equivalent bearing with steel balls has a basic dynamic load rating of 13.5 kN and a fatigue load limit of 0.28 kN (www.skf.com). Ceramics have a higher modulus of 9

elasticity than high carbon steel. Therefore, in the ceramic bearings, the smaller deformation of the rolling elements (balls or rollers) generates a higher stress at the contact point between the rolling elements and the raceway, when compared to a steel bearing. Because the life a bearing is inversely proportional to stress, it will generally be lower for a hybrid bearing than for a full complement steel bearing, as the elastic modulus of ceramic is greater than that of steel in most cases [25]. The dynamic load rating of hybrid ceramic bearings with rolling elements made of silicon nitride is approximately 70 % that steel bearings [25]. There are four types of failure consequences: hidden failure consequences, safety and environmental consequences, operational consequences, and non-operational consequences [24]. The failure of the starter-generator affects operations. The starter-generator is not a flight safetycritical part. The only consequence of its failure is an aborted mission. The aircraft electrical system consists of two starter-generators and four batteries. If both starter-generators fail, the two main batteries can provide electrical power for 30 min. Additionally, there are two backup batteries, which can power the stand-by flight instruments for 30 min when both main batteries are discharged. However, the backup batteries have a smaller electrical capacity than the main batteries; hence, the malfunction of a single backup battery will fail to power the stand-by instruments. The failure of the entire electrical system can be described by Fig. 4. In the fault tree, all nodes are connected by AND gates except for the backup batteries (Batt3 and Batt4 ). The probability of failure (POF) can be calculated as: Pr (Sys. Fail = T ) = Pr (SG Fail = T ) Pr (Batt. Fail = T )

(7)

Because the stand-by flight instruments can only be operated with both backup batteries, an OR gate connects both backup batteries. Pr (B/U Fail = T ) = 1 − Pr (Batt3 Fail = F ) Pr (Batt4 Fail = F )

(8)

where B/U stands for backup battery. Reliability and POF are mutually exclusive. Reliability = 1 − POF

(9)

To evaluate the reliability of the electrical system, the POF of both the starter-generator and the battery are required. 10

Table 2. Starter-generator inspection data with the detection of failure indications Year

Time

Type

Year

Time

Type

Year

Time

Type

2004 2004 2004 2004 2004 2004 2005 2006 2006 2006 2007 2006 2006 2006 2006 2007 2007 2007 2007 2007 2007 2008 2008 2009 2008 2008 2009 2009 2009 2009 2010 2010 2010 2011 2010 2011 2010 2011 2011 2011 2011 2012 2012 2012 2012 2013 2013 2012 2013 2013 2013 2013 2014 2014 2014 2014

408.43 599.92 596.85 599.27 597.85 593.28 595.13 598.67 118.47 590.68 596.42 294.92 597.47 267.35 596.45 591.42 594.45 426.18 590.72 576.22 587.43 599.20 595.78 110.53 492.05 593.45 593.50 586.47 575.73 582.62 321.47 592.42 592.77 597.83 592.63 595.67 587.60 598.50 593.45 556.00 593.45 497.40 567.10 597.67 589.18 468.25 595.65 597.65 594.65 596.53 593.75 595.05 598.53 595.05 596.05 593.88

Failed Returned Returned Returned Returned Returned Returned Returned Failed Returned Returned Returned Returned Failed Returned Returned Returned Failed Returned Failed Returned Returned Returned Failed Failed Returned Returned Returned Returned Returned Failed Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Failed Returned Returned Returned Failed Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned

2004 2004 2004 2004 2004 2004 2005 2006 2006 2006 2007 2007 2006 2006 2006 2006 2007 2007 2007 2007 2007 2008 2008 2008 2008 2008 2009 2009 2009 2009 2009 2009 2010 2011 2010 2010 2011 2011 2010 2011 2011 2012 2012 2012 2012 2012 2013 2013 2013 2013 2014 2014 2014 2014 2014

591.18 599.23 596.18 485.22 596.45 596.32 589.28 498.35 591.07 596.10 598.15 598.48 605.98 594.85 595.85 578.13 423.75 588.98 585.33 556.07 588.53 591.17 594.60 588.80 595.07 589.00 599.63 590.68 593.98 577.85 583.80 590.00 372.15 599.37 592.63 593.55 592.05 590.73 592.97 560.20 592.35 590.58 581.43 592.15 593.42 565.58 597.00 590.97 251.42 594.55 586.18 595.28 371.55 417.80 598.02

Returned Returned Returned Failed Returned Returned Returned Failed Returned Returned Returned Returned Returned Returned Returned Returned Failed Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Failed Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Failed Returned Returned Returned Failed Failed Returned

2004 2004 2004 2004 2004 2004 2005 2006 2005 2006 2006 2007 2006 2007 2006 2007 2006 2007 2007 2007 2007 2008 2008 2008 2008 2008 2009 2009 2009 2009 2009 2010 2010 2010 2011 2011 2011 2011 2011 2011 2011 2012 2012 2012 2012 2012 2012 2013 2013 2013 2013 2014 2014 2014 2014

600.97 595.55 185.02 595.62 591.57 599.82 595.27 595.17 595.45 586.57 596.43 5.12 597.05 283.33 598.95 253.32 590.98 591.37 581.57 588.62 589.58 590.03 588.33 596.60 536.98 590.45 580.12 591.30 595.02 588.62 588.60 595.33 254.45 592.75 586.28 586.67 594.42 594.27 594.80 560.20 580.63 575.45 591.72 595.30 589.82 591.85 597.65 589.15 590.00 599.05 593.13 595.33 594.62 593.77 598.28

Returned Returned Failed Returned Returned Returned Returned Returned Returned Returned Returned Failed Returned Failed Returned Failed Returned Returned Returned Returned Returned Returned Returned Returned Failed Returned Returned Returned Returned Returned Returned Returned Failed Returned Failed Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned Returned

11

Sys. F ail

SG1

SG

Batt

F ail

F ail

SG2

Batt1

M ain

B/U

F ail

F ail

Batt2

Batt3

Batt4

Figure 4. Fault tree of electrical system for risk analysis

12

Maintenance records indicate that the bearing is the weakest link of the starter-generator. Thus, a bearing life model was utilized to estimate the life of the starter-generator. There was no record of battery replacement due to failure. Considering no field failure has ever occurred, the POF of the battery was conservatively assumed to be 1 %.

4. Field Inspection Data and Survival Analysis The starter-generator of the Hawker 800XP is inspected at every 300 h of operation. The inspection is conducted to detect abnormal vibration or sound, and signs of wear. The inspection procedures are described in technical orders. The starter-generator is returned to the contractor before 600 h of operation for an overhaul. Each aircraft flies about 100 h per month; thus, the starter-generator needs to be replaced every 6 months. Within 166 cases which have been collected since 2004, 24 starter-generators required replacement due to failures or damages. Of these 24 cases, 21 starter-generators were exchanged due to bearing defects, and the remaining 3 were non-bearing-related cases. The failure data belong to two categories, post-failure and pre-failure. The post-failure is a failure occurred during flight or pre-flight inspections via warning light. The pre-failure is damage found during a scheduled inspection. Failure data were plotted on a Weibull probability plot as shown in Fig. 5. The data fitted well on the Weibull probability plot with a shape parameter of 1.44 and a scale parameter of 2150. The shape parameter which is the slope of the Weibull probability plot represents the characteristics of failure rate. The shape parameter greater than the unity indicates that the failure rate increases with time. The scale parameter referred to as the characteristic life is the time at which 63.2 % of the units will fail. An extreme value distribution such as the Weibull distribution can represent a system of which the strength strongly depends on the strength of its weakest link. The life of a starter-generator depends on the life of bearings (the weakest link); therefore, the Weibull distribution showed good fit with failure data. An estimated mean time between failures (MTBF) is 1950 h with a 95 % Wald confidence interval of 1031 h and 3689 h. The collected data were also analyzed by survival analysis. Survival analysis is a method of getting an expected time when an event occurs, and it is especially good to analyze right censored data, in which failure time is unknown, as is the case for the starter-generator. The Kaplan-Meier 13

Probability

0.96 0.90 0.75

Failure Data Weibull CDF

0.50 0.25 0.10 0.05 0.02 10 1

10 2

Time (h) Figure 5. Weibull probability plot of starter-generator failure time

estimator is a method of modeling the survival curve. It amounts simply to calculating the survival probability for each time interval t based on the event occurrences at that time [20]. From the data, the survival probabilities are estimated as follows, S (t) =

Y ni − di , ni

(10)

ti ≤t

where ni is the number of subjects at risk at the beginning of the time interval ti , and di is the number of subjects who have not survived during the time interval ti . In a Kaplan-Meier plot as shown in Fig. 6, the survival after 600 h of operation is 85.42 %, and the upper and lower limit values are 79.16 % and 90.04 %. The survival probability was compared with the results obtained by a probabilistic model using Bayesian network. 5. Probabilistic Modeling Using Bayesian Network The weakest link theory. i.e. the life of the shortest-lived component of the system is the life of the system, was applied for the estimation of the starter-generator life. Because bearings are the weakest link of the starter-generator, it was assumed that the life of the starter-generator is proportional to the life of the bearing described in Eq. (6). LSG ∝ L10 14

(11)

Probability of Survival

1

0.95

0.9

0.85 0

200

400

600

800

Time (h) Figure 6. Kaplan-Meier survival analysis of starter-generator failure time

Sensitivity analysis has been conducted to choose significant variables of the starter-generator life estimation model. Variance-based methods using Sobol’s variance decomposition approach and an estimated procedure was employed for this analysis [26]. Probable ranges for each variable are listed in Table 3. It was assumed that the dynamic load capacity of the equivalent steel ball bearing is the maximum, and the minimum is 70 % of the maximum dynamic load capacity [25]. The ratio of the dynamic load capacity and the applied load is ranged from 2 [16] to 20. The maximum ratio of 20 yields about 10 times longer basic rating life than targeted time of operation (1000 h at 12,000 RPM). The bearing of the starter-generator is lubricated by grease. The accepted view of grease behavior is that it acts as a reservoir releasing oil into the rolled track and thus replenishing the contact [27]. The main problem of grease lubrication is that the degradation of the film thickness occurs much earlier than the life of a bearing [28]. κ is the ratio of the viscosity of grease base oil and the reference kinematic viscosity. In general, the kinematic viscosity of grease base oil is higher than the reference kinematic viscosity. However, considering the degradation of the film thickness, it was assumed that κ yields aISO less than the unity given ranges of P , eC , and Cu . Because grease in sealed and shielded bearings can provide an effective barrier against dust and dirt, it was assumed that the contamination level maintains at least normal cleanliness. 15

Table 3. Probable ranges of variables Name

Variable

Unit

Probable range

Dynamic load capacity

C

kN

9.45-13.5

Capacity load ratio

C/P

-

2-20

Viscosity ratio

κ

-

0.1-0.4

Contamination factor

eC

-

0.5-1

Fatigue load limit

Cu

kN

0.25-0.31

1 Main Total

Sensitivity Index

0.8

0.6

0.4

0.2

0 C

P

eC

Cu

Figure 7. Global sensitivity analysis

This condition is typical of bearings greased for life and shielded. According to ISO 281:2007, therefore, eC is ranged from 0.5 (normal cleanliness) to 1 (extreme cleanliness). The fatigue load limit is the material parameter, and in general has the minimum variance. In this study, 10 % variation was assumed. Fig. 7 shows the result of the sensitivity analysis for the starter-generator life, and the applied load (P ) has the highest sensitivity indices. In the probabilistic modeling, the dynamic load capacity (C) and the viscosity ratio (κ) also need to be considered. Other variables, the contamination factor (eC ) and the fatigue load limit (Cu ) were considered to be constant. To predict the life of a starter-generator correctly, it was required to obtain the accurate

16

measurements of both the dynamic load capacity and the applied load, which show variation due to factors like measurement error and the inhomogeneity in materials. Because few aircraft were in operation, it was impossible to measure the capacity and the load experimentally. Prior distributions with best guesses were used instead, to get the life distribution using the DBN model. Those priors were updated with the field inspection data. A calibrated model was used to obtain the life distribution and the reliability of the starter-generator. We represent the starter-generator life as a DBN model (Fig. 8). Similar models were used by the authors to predict stress corrosion crack and fatigue crack length [5, 6]. Nodes (circles) in Fig. 8 represent variables, and each node has its own conditional probability distribution (CPD). In the DBN model, each slice is the snapshot of the system at a given time. The subscript N for each node denotes that the node belongs to Nth slice. CPN node represents the ratio of the dynamic load capacity and the applied load. κN is the node for the viscosity ratio, and eC,N node represents the contamination factor. The life of the starter-generator is denoted by LSG,N node, which contain all the possible states of it at Nth slice. ZN and RN are nodes for the inspection and the reliability respectively. Among nodes, LSG,N and RN are query nodes. Inspection node, ZN , is the only observable node. The probability distributions of the time-invariant model parameters, CPN , κN , and eC,N , are updated with the observations. The posterior distributions of query variables were obtained from Bayes’ theorem (Eq. (2)). The inspection node, ZN , has two state: “detected” and “not detected”. Each inspection process is characterized by its probability to detect flaws of different sizes so that, given a particular flaw, there is some probability of detection (POD) uniquely defined for that process [29]. Because the life of a component is affected by the occurrence of flaws, it was assumed that the size of the flaw shows a negative correlation with the life of the component. At a current inspection opportunity, the starter-generator with shorter life expectancy is more likely to have flaws than starter-generator with longer life expectancy. Given a particular time of operation, RevN , the POD can, therefore, be expressed as the function of the life of the starter-generator. RevN was represented explicitly in the DBN model to emphasize that the POD curve depends on the time of operation. The POD was expressed using the cumulative distribution function (CDF) of the standard normal distribution. Thus, two

17

CP0

CP1

CP2

CP3

---

CPN

κ0

κ1

κ2

κ3

---

κN

eC,0

eC,1

eC,2

eC,3

---

eC,N

LSG,1

LSG,2

LSG,3

---

LSG,N

Rev1

Rev2

Rev3

---

RevN

Z1

Z2

Z3

---

ZN

R1

R2

R3

---

RN

Rev0

Figure 8. Dynamic Bayesian network for the starter-generator reliability analysis

18

Probability of Detection

0.999 0.997 0.99 0.98 0.95 0.90

Conventional Improved t =300h

0.75

For conventional insp. (t ) = t insp POD insp

insp

0.50

POD

= 100

For improved insp. (t ) = t +30

0.25

POD insp

0.10 0.05 0.02 0.01 0.003 0.001

POD

0

200

400

600

insp

= 75

800

1000

Life of Starter-Generator (h) Figure 9. Inspection effectiveness used for the analysis

parameters, a mean and a standard deviation, completely define an inspection system.   LSG − µPOD (tinsp ) POD = 1 − Φ σPOD

(12)

where Φ is the CDF of the standard normal distribution, LSG is the life of the starter-generator, tinsp is the time of operation at the inspection, µP OD (tinsp ) is the location parameter of the normal distribution function at tinsp , and σPOD is the standard deviation of the POD model. In Eq. (12), the POD increases as the life of the starter-generator decreases, because the occurrence of flaws is more likely for the starter-generator has a shorter life. The POD given a particular time of operation at an inspection is the same for all inspection process so that, the location parameter, µP OD , is a linear function of tinsp . In general, two parameters in Eq. (12) need to be estimated using the data collected from designed experiments [30]. Because there’s no data available to evaluate the effectiveness of inspection, the two parameters were calibrated to match the POF at 600 h of operation from calibrated model to the POF from the survival analysis (Fig. 6). Fig. 9 shows the POD model for the analysis, and a possible improvement was also described. It was assumed that the mean is equal to tinsp , and the σPOD is 100 for the conventional inspection. The reliability node, RN , is the binary variable (0: failure; 1: no-failure). As shown in Eq. (9), POF is the complement of reliability. In node RN , the POF and the reliability are calculated 19

consecutively. The event of failure was determined by the limit state function. g = LSG (t) − tc

(13)

where tc is the current time of operation. The limit state is defined as g = 0. This is the boundary between the failure domain and the no-failure domain in the starter-generator life space. The POF of the starter-generator is the area of the life distribution up to the current time of operation. POF =

Z

tc

LSG (t) dt

(14)

0

The prior distributions for each node are summarized in Table 4. Posterior starter-generator life distributions were obtained using the probabilistic model depicted in Fig. 8. A “forward-backward” algorithm was utilized to conduct exact inferences. Murphy’s Bayesian Network Toolbox [21] was used as an inference engine. Inference problems in temporal models for deterioration processes can be distinguished as filtering, prediction, and smoothing [11]. Filtering (or monitoring) is the task of computing the posterior distribution over the state of time t given evidence up to time t, and was conducted in this work. To take advantage of the exact inference algorithm for the DBN model, the distribution of each node needs to be discretized [31]. Static discretization introduces an unknown error, which would be zero in the limit as the size of the discretization intervals approaches zero. Despite increasing use of a dynamic discretization method, static discretization was used in this work for simplicity. To verify the appropriateness of the discretization scheme (Table 4) used in this work, the inference using Monte Carlo simulation (MCS) was compared with the DBN result, as shown in Fig. 10. As can be seen in the figure, both results match well, so the current discretization scheme was reasonably accurate.

6. Calibration and Validation Even with non-informative priors, the DBN model provides meaningful information by updating posteriors with data. Because of the limited number of failure data, predictions were weighted averages of subjective opinion (priors) and evidence (inspection results). As the number of updates increases, the calibrated and uncalibrated posteriors approach each other. It is, however, 20

Table 4. Discretization scheme where nstate is the number of states. Variable

Distribution

nstate

Interval boundaries

LSG

-

82

0, exp(log(0.01) : (log(200) − log(0.01))/79) : log(200)), ∞

C

Uniform(9.45, 13.5)

22

0, 9.45 : 4.05/19 : 13.5, ∞

C/P

Uniform(2, 20)

22

0, 2 : 18/19 : 20, ∞

κ

Uniform(0.1, 0.4)

22

0, 0.1 : 0.3/19 : 0.4, ∞

eC

Deterministic

1

0.5

Cu

Deterministic

1

0.28

0.8 DBN Model MCS

Reliability

0.7

0.6

0.5

0.4 0

100

200

300

400

500

600

Time (h) Figure 10. Reliability index calculated from both the DBN model and Monte Carlo simulation (MCS)

still important to obtain more appropriate priors to make a more accurate initial prediction. Calibration was carried out to acquire prior distributions of the nodes, C0 , CP0 and κ0 , in the DBN model using field inspection data including the no detection cases as explained in Section 4. There are two types of inspection data, detected and not detected. For each case, the posterior starter-generator life distribution was calculated. With detected failure, the posterior startergenerator life distribution is calculated as f (LSG | Z = D) ∝ f (Z = D | LSG ) f (LSG ; N ) 21

(15)

1

1 L SG, after

0.8

0.8

POD tinsp=300h

0.6

0.6

0.4

0.4

0.2

0.2

0 0

200 400 600 800 Life of Starter-Generator (h)

Probability of Detection

Normalized Density

L SG, before

0 1000

Figure 11. The effect of the probability of detection on the starter-generator life distribution

where f (Z = D | LSG ) is the POD. In the other case, the posterior distribution is calculated as f (LSG | Z = N D) ∝ f (Z = N D | LSG ) f (LSG ; N )

(16)

where f (Z = N D | LSG ) is the probability of no-detection (PND). Fig. 11 shows the numerical example of the effect of inspection on the distribution of the life of the starter-generator. In the example, the inspection was conducted at 300 h of operation. Because no failures are detected, the area of the life distribution under the POD curve was diminished. As a result, the reliability has been increased after the inspection. Improved inspection capability or implementation of the better inspection methods move the life distribution more to the right. For the calibration of the starter-generator life model, it was also assumed that all returned starter-generators function properly, and they were inspected by the contractor with the same POD as in-service inspection. The field inspection data only provide information for node ZN . Due to incomplete data, an EM algorithm was utilized for parameter inference. It was assumed that the priors of the three variables (C0 , CP0 , κ0 ) are uniformly distributed. Fig. 12 show the mass functions of the two variables (CP0 , κ0 ) of Eq. (6)before and after the calibration. Another variable (C0 ), showed almost the same mass function after the calibration. The priors in Fig. 12 yielded shorter MTBF 22

0.3

8 Prior Posterior

0.25

Prior Posterior

Probability

Probability

6 0.2 0.15 0.1

4

2 0.05 0 5

10

15

0 0.1

20

0.15

0.2

0.25

0.3

0.35

0.4

C/P

(a)

(b)

Figure 12. Calibrated (a) CP0 and (b) κ0 for starter-generator life prediction

than the data shown in Fig. 5. The calibration updates priors to match predicted values with maintenance data. Thus, both the load ratio (CP0 ), and the viscosity ratio (κ0 ), were shifted right to increase the life of the starter-generator. As discussed earlier, a prediction made by the DBN model is the weighted average of subjective opinions (priors) and evidence (maintenance records). Fig. 13 shows reliability projections using various models. The uncalibrated model yielded an initial sharp decrease in the reliability. After calibration, posterior reliabilities approach curves calculated by the Kaplan-Meier model and the Weibull model. However, the value is still under the reliabilities by both models. This is because the effect of priors was still influential in the calibrated model. In other words, the number of data for the calibration was not enough to overcome the effect of priors. Because both the Kaplan-Meier model and the Weibull model are data-driven models, the quality of prediction is largely affected by the number of data available. When there are not enough data records to learn from, data-driven models’ estimates provide poor quality of survival prediction [20]. However, the DBN model can make up for the lack of data records by knowledge of experts. From engineering perspective, the conservative prediction by the DBN model is more appropriate. Validation tests the confidence that can be placed on the calibrated model. Following Sankararaman et al. [4] the calibrated model was validated using a Bayes factor. The Bayes factor is the ratio of the likelihoods of the two hypotheses for the correctness of the model: H0 that the model

23

1

Reliability

0.8

0.6

K-M Weibull Uncalibrated Calibrated

0.4

0.2 0

200

400

600

800

1000

Time (h) Figure 13. Comparison of reliability predictions by the Kaplan-Meier (K-M) model, the Weibull model, and the DBN model (calibrated and uncalibrated)

is correct, and H1 that the model is incorrect: B=

Pr (D | H0 ) Pr (D | H1 )

(17)

If B is greater than unity, the null hypothesis (H0 ) can be accepted, and the model has been validated. The numerator of Eq. (17) is proportional to the integration of the not normalized posterior distribution of crack length given measurement data. For example, with a perfect prediction, the starter-generator life distribution (prior distribution) at rotation N is the same as the updated distribution (posterior distribution) obtained by inspection data. In this case, the unnormalized posterior distribution has the maximum integration value when compared to other cases, because the likelihood does not change the shape of the prior crack length distribution. In this work, k-fold cross-validation was used, which partitions the original data into k equally sized sets, and then in each iteration, one partition is held as test data, and all the remaining sets train a model. Before the partition, the inspection data was shuffled randomly, and divided by n. There are also two cases for validation data. The first case is that the failure was not detected. Pr (D | H0 ) ∝

Z

0

∞

f (Z = N D | LSG ) f (LSG ; N ) dLSG

24

(18)

The second case is that the failure was detected. Z ∞ Pr (D | H0 ) ∝ f (Z = D | LSG ) f (LSG ; N ) dLSG

(19)

0

The denominator of Eq. (17) was obtained using Eqs. (18) and (19). We have, however, no prior knowledge of the distribution of crack length under H1 . Thus, a uniform distribution for f (LSG ; N ) was used as a non-informative prior for H1 . Assuming that the inspections were conducted in a timely manner and the result of each inspection is Di , then maintenance data D consists of D1 , D2 , D3 , ..., Dn . Provided that each inspection was conducted independently, an event observing inspection result (D) is the intersection of data (Di ). The Bayes factor for each inspection data (Di ) is Bi . The total Bayes factor can then be calculated using the independence of the inspections as follows: Pr (D | H0 ) Pr (D | H1 ) Pr (D1 ∩ D2 . . . ∩ Dn | H0 ) = Pr (D1 ∩ D2 . . . ∩ Dn | H1 ) Pr (D1 | H0 ) Pr (D2 | H0 ) . . . Pr (Dn | H0 ) = Pr (D1 | H1 ) Pr (D2 | H1 ) . . . Pr (Dn | H1 )

B=

= B1 B2 . . . Bn

(20)

The total Bayes factors calculated by Eq. (20) using 8-fold cross-validation are shown in Fig. 14 The confidence of the calibrated model can be tested from the posterior probability of the null hypothesis, which determines if “the model is correct”, and is as follows: Pr (H0 | D) =

Pr (D | H0 ) Pr (H0 ) B = Pr (D | H0 ) Pr (H0 ) + Pr (D | H1 ) Pr (H1 ) B+1

(21)

The higher the posterior probability, the more likely it is that the calibrated model is correct. For example, if the total Bayes factor is equal to the unity, the posterior probability of the calibrated model is 50 %, which indicates that both hypotheses are equally likely. In this context, confidence is not the same as confidence intervals in statistical hypothesis testing. Because the calculated total Bayes factor is a big number, the confidence of the calibrated model were above 80 %. 7. Recommended Action Two remaining RCM questions are as follows: 25

1

Confidence

0.9

0.8

0.7

0.6

0.5 1

2

3

4

5

6

7

8

8-fold Cross-validation Figure 14. Result of model validation obtained using 8-fold cross-validation

6. What can be done to predict or prevent a failure? 7. What should be done if a suitable proactive task cannot be found? There are two options for the first of the remaining questions. They are scheduled restoration/discard tasks and on-condition tasks [24]. Considering the cost and difficulties to implement an on-condition maintenance scheme, a scheduled restoration (scheduled maintenance) is a reasonable action for the starter-generator. An inspection needs to be conducted when the reliability approaches a control level, Rctrl . In this work, the decision maker wants to extend the time of operation up to 1000 h. The reliability of the starter-generator was 83 % with the current change interval of 600 h. Given the reliability of the starter-generators and the batteries, the risk of the electrical system can be obtained using the fault tree shown in Fig. 4. As mentioned in the previous section, the POF of batteries was assumed to be 1 % due to the lack of failure data. The POF and the reliability for each node are shown in Table 5. Using the Eqs. (7) and (8), the calculated POF of the electrical system was 5.75 × 10−8 . In general, the probability of occurrence less than 10−6 can be interpreted as “improbable”. Even with the shut down of the whole electrical system, aircraft can land safely under VFR.

26

Table 5. Tabular probabilities of each node for risk analysis Node name

POF

Reliability

Starter-Generator (SG1 , SG2 )

17 %

83 %

Main Batt. (Batt1 , Batt2 )

1%

99 %

Backup Batt. (Batt3 , Batt4 )

1%

99 %

In this case, however, loss of communication can occur, and visible ranges may be limited due to bad weather. The severity can be categorized as “Critical” or “Catastrophic”. According to the risk assessment matrix provided by MIL-STD-882E “System Safety” [32], the risk due to the failure of the starter-generator and subsequent electrical system shut down is “Medium”, which is the second lowest among possible risk levels. Considering the very low probability of failure of aircraft electrical system, it was determined that the starter-generator reliability of 83 % is the reasonable value to decide when to inspect. Using the calibrated model, the reliability of the starter-generator was predicted for the time of operation over 600 h. It was assumed that inspections will be conducted if the predicted reliability reaches the control level. Fig. 15 indicates that with conventional inspections at 300 h, 600 h and 800 h, the targeted reliability can be achieved. Jumps in reliability do not mean an improvement of the physical condition of the starter-generator, but the update of prior knowledge (model based life prediction) by data information (inspection data). Using inspection methods with improved POD, a higher reliability jump can be achieved, and a longer inspection interval may be applied. In Fig. 15, the starter-generator inspected by methods with the improved capability (Fig. 9) clearly shows the extended inspection interval. The last question related to is not applicable, because there exists a suitable proactive task.

8. Conclusion Based on the procedure of the RCM scheme, the possibility of extending the replacement interval of the starter-generator of the Hawker 800XP was examined. Because the starter-generator was not a flight safety-critical part, it was concluded that the extension was possible with a suitable inspection plan. Failure of the weakest link (bearings) caused malfunction of the starter27

1 w/o Inspection w/ Conventional Inspection w/ Improved Inspection

Reliability

0.95 0.9 0.85 R

ctrl

0.8 0.75 0.7 0

200

400

600

800

1000

Time (h) Figure 15. Changes of reliability with or without inspection

generator. The life of a starter-generator was estimated based on the bearing life model. The DBN model was utilized to consider uncertainties in model parameters and the conditional probability of inspections, and the life distribution was obtained. The model was calibrated and validated using maintenance data obtained since 2004. A calibrated model was used to get reliability for 600 h which was the current change interval. With inspections at 600 h and 800 h, maintaining a targeted reliability level was shown to be possible. [1] Lincoln, J. W., 1980. Method for Computation of Structural Failure Probability for an Aircraft. Tech. Rep. ASD-TR-80-5035, Aeronautical Systems Division Wright-Patterson AFB. [2] Gallagher, J. P., Babish, C. A., and Malas, J. C., 2005. “Damage Tolerant Risk Analysis Techniques for Evaluating the Structural Integrity of Aircraft Structures”. In Proceedings of 11th International Conference on Fracture 2005, Curran Assciates, Inc., pp. 71–76. [3] White, P., 2006. Review of Methods and Approaches for the Structural Risk Assessment of Aircraft. Tech. Rep. DSTO-TR-1916, Defense Science and Technology Organisation. [4] Sankararaman, S., Ling, Y., and Mahadevan, S., 2011. “Uncertainty Quantification and 28

Model Validation of Fatigue Crack Growth Prediction”. Engineering Fracture Mechanics, 78(7), pp. 1487–1504. [5] Lee, D., Huang, Y., and Achenbach, J. D., 2016. “Probabilistic Analysis of Stress Corrosion Crack Growth and Related Structural Reliability Considerations”. Journal of Applied Mechanics, 83(2), p. 021003. [6] Lee, D., and Achenbach, J. D., 2016. “Analysis of the Reliability of a Jet Engine Compressor Rotor Blade Containing a Fatigue Crack”. Journal of Applied Mechanics, 83(4), p. 041004. [7] Torng, T. Y., Edwards, R. M., and Morgan, J., 2007. “B-1 Maintenance Schedule Impact Based on Risk Assessment Results”. In Proceedings of the Aircraft Structural Integrity Program Conference, pp. 1–28. [8] Straub, D., Goyet, J., Sorensen, J. D., and Faber, M. H., 2006. “Benefits of Risk Based Inspection Planning for Offshore Structures”. In Proceedings of 25th International Conference on Offshore Mechanics and Arctic Engineering, pp. 59–68. [9] U.K. Ministry of Defense, 1983. DEFSTAN 00-970 Design and Airworthiness Requirements for Service Aircraft. [10] U.S. Department of Defense, 1998. JSSG-2006 Aircraft Structure. [11] Straub, D., 2009.

“Stochastic Modeling of Deterioration Processes through Dynamic

Bayesian Networks”. Journal of Engineering Mechanics, 135(10), pp. 1089–1099. [12] Do, C. B., and Batzoglou, S., 2008. “What is the expectation maximization algorithm?”. Nature Biotechnology, 26(8), pp. 897–899. [13] Zaretsky, E. V., 2013. Rolling Bearing Life Prediction, Theory, and Application. Tech. Rep. NASA/TP2013-215305, NASA Glenn Research Center. [14] Palmgren, A., 1937. “On the Carrying Capacity and Life of Ball Bearings”. The Ball Bearing Journal(3), pp. 34–44.

29

[15] Lundberg, G., and Palmgren, A., 1952. “Dynamic Capacity of Roller Bearings”. Acta Polytechnica Mechanical Engineering Series, 2(4). [16] Gabelli, A., Doyer, A., and Morales-Espejel, G., 2015. “The Modified Life Rating of Rolling Bearings: A Criterion for Gearbox Design and Reliability Optimization”. Power Transmission Engineering(March), pp. 46–54. [17] Glantz, W., 1993. “Contamination in Lubricaiton Systems for Bearings in Industrial Gearboxes”. Ball Bearing Journal(242), pp. 20–26. [18] TLT, 2010. “ISO 281:2007 bearing-life standard-and the answer is?”. Tribology & Lubrication Technology, 66(7), pp. 34–36,38–43. [19] Jensen, F. V., and Nielsen, T. D., 2007. Bayesian Networks and Decision Graphs. Springer Science+Business Media, LLC. [20] Kraisangka, J., and Druzdzel, M. J., 2014. “Discrete Bayesian Network Interpretation of the Cox’s Proportional Hazards Model”. In PGM 2014: Probabilistic Graphical Models, Vol. 11, pp. 238–253. [21] Murphy, K. P., 2002. “Dynamic Bayesian Networks: Representation, Inference and Learning”. PhD thesis, University of California, Berkeley. [22] Tanner, M. A., 1993. Tools for Statistical Inference. Springer-Verlag New York, Inc., New York, NY. [23] International Organization for Standardization, 2010.

ISO 281:2007 Rolling Bearings–

Dynamic Load Ratings and Rating Life. [24] Moubray, J., 1997. Reliability Centered-Maintenance. Industrial Press Inc., New York, NY. [25] Zaretsky, E. V., Chiu, Y. P., and Tallian, T. E., 2013. “Ceramic Bearings for Use in Gas Turbine Engines”. Journal of Materials Engineering and Performance, 22(10), pp. 2830– 2842.

30

[26] Saltelli, A., Ratto, M., Andres, T., Campolongo, F., Cariboni, J., Gatelli, D., Saisana, M., and Tarantola, S., 2008. Global Sensitivity Analysis: the Primer. John Wiley & Sons. [27] Cann, P. M., 1999. “Starved grease lubrication of rolling contacts”. Tribology Transactions, 42(4), pp. 867–873. [28] Svoboda, P., Kostal, D., Kunak, J., and Krupka, I., 2014. “Study of Grease Behaviour in a Starved Lubricated Contact”. MM Science Journal, pp. 465–469. [29] Committee on Nondestructive Testing of Aerospace Systems, 1977. Economic and Management Aspects of Nondestructive Testing, Evaluation, and Inspection in Aerospace Manufacturing. Tech. rep., National Materials Advisory Board. [30] Lee, D., Yang, S., Park, J., Baek, S., and Kim, S., 2017. “Investigation of Detectable Crack Length in a Bolt Hole Using Eddy Current Inspection”. Transactions of the Korean Society of Mechanical Engineers A, 41(8), pp. 729–736. [31] Fenton, N. E., and Neil, M. D., 2012. Risk Assessment and Decision Analysis with Bayesian Networks. The CRC Press, Boca Raton, FL. [32] U.S. Department of Defense, 2000. MIL-STD-882E System Safety.

31