MoMA Algorithm: A Bottom-Up Modeling Procedure for a Modular System under Environmental Conditions

Abstract

The functioning of complex systems relies on subsystems (modules) that in turn are composed of multiple units. In this paper, we focus on modular systems that might fail due to wear on their units or environmental conditions (shocks). The lifetimes of the units follow a phase-type distribution, while shocks follow a Markovian Arrival Process. The use of Matrix-Analytic methods and a bottom-up approach for constructing the system generator is proposed. The use of modular structures, as well as its implementation by the Modular Matrix-Analytic (MoMA) algorithm, make our methodology flexible in adapting to physical changes in the system, e.g., incorporation of new modules into the current model. After the model for the system is built, the modules are seen as a ‘black box’, i.e., only the contribution of the module as a whole to system performance is considered. However, if required, our method is able to keep track of the events within the module, making it possible to identify the state of individual units. Compact expressions for different reliability measures are obtained with the proposed description, optimal maintenance strategies based on critical operative states are suggested, and a numerical application based on a k-out-of-n structure is developed.

1. Introduction

In practice, a large number of systems require the availability of different subsystems to function. For instance, in an artificial satellite, two major subsystems are distinguished: one concerns the life of the vehicle and its position in orbit, and includes batteries, solar panels, the set of sensors, etc., and the other is responsible for radio communications and comprises antennas, central stations, and such [1]. In the same way, the electronic control system of a car consists of a group of sensors (S), a control unit (ECU), and a group of actuators (A). The sensors collect measurements related to the operation of the engine, which are sent to the control unit, which processes the received information and consequently instructs the actuators to execute their functions [2]. Likewise, modern power energy systems are made up of generation, transmission, and distribution subsystems; the generation subsystem includes turbines and generators, which are usually arranged in redundant structures and distributed in separated areas [3]. A floating offshore wind turbine, for example, is comprised of several subsystems; in [4,5], the authors distinguish four functionally divided subsystems, namely, the wind turbine, tower and transition piece, floating foundation, and mooring system.

Under these considerations, practical applications show that several features can be integrated into the system design: the components can be grouped attending to specific goals, e.g., performing a task or mission within the system, for redundancy purposes, spacial location-based strategies, and more. For instance, as discussed in [6], in certain systems it might be of interest to encapsulate elements with protective casings or spatially separate them into groups in order to avoid simultaneous failures. This action can lead to groups of units or subsystems being differently and independently exposed to random shocks. For other reasons, devices may contain many very small parts that are considered as a block for maintenance purposes, e.g., multi-chips.

In this paper, we focus on these types of systems, that is, complex systems with multiple subsystems that in turn are composed of multiple components or units. We refer to a K modular system (KMS), meaning that the operation of the system is carried out by means of K independent modules, where $K\ge 1,$ and a $module$ is a multicomponent subsystem. When the failure of any module leads to system failure, this is equivalent to a series connection among the modules of the system. If the failure of the system only occurs when all the modules fail, this is equivalent to parallel connection of the modules of the system. These are the two extreme cases of a k-out-of-n configuration. Studies on the reliability k-out-of-n subsystems have been conducted by many researchers under different scenarios, approaches, and methodologies. Common objectives are the evaluation of system reliability and finding solutions to cost optimization problems, both of which are often solved by numerical methods. Various authors have worked on phased mission systems ([3,7]), allocation problems ([8,9,10]), multi-state systems ([11,12]), reliability growth models [13], and Markov models [14], among others.

To the best of our knowledge, shock models have been little addressed in the context of modular systems (KMS), and have been mainly developed on single or n-systems (i.e., KMS with K = 1). Traditionally, shock models have mainly been classified into cumulative shock models and extreme shock models (see [15]), with subsequent generalizations, as in [16,17,18]. In recent years, many scholars have focused on different types of shocks, magnitudes, sizes, functions, or effects, including the number of components in the system affected by successive shocks ([6,19,20,21]). Several models incorporate phase-type distributions (PH) for inter-arrival times ([22,23,24,25]) or Markovian arrival processes (MAPs), extending the usual Poisson process. In [26], a batch Markovian arrival process (BMAP) was used for the arrival of shocks presenting different sizes. The system fails when the cumulative number of shocks reaches a previously fixed threshold. In [27], the system withstands several types of shocks that can cause deterioration or failure. These shocks can be repairable or not, and are as well modeled by a MAP. Works studying shock and wear n-systems under MAPs include [28,29]; in the latter work, the authors consider an n-component system withstanding shocks that arrive following an exponential distribution that can cause damage or failure of several components simultaneously. The Poisson processes assumed for the system are extended in [30], focusing on systems in a k-out-of-N structure. In [31], the authors performed a reliability and cost analysis of an N warm standby system under both, shocks and inspections, by MAPs; such inspections detect the number of downed units, and their replacement is carried out if there is a minimum of K failed units according to the $(K,N)$ policy.

When K modular designs (KMS) are considered, the modules take part in the system according to a specific configuration and role, as mentioned before. It is clear that the entire system reliability is a function of the reliabilities of its modules. In turn, it seems reasonable that the reliability of an individual module depends on both, the lifetime of its components and the environmental conditions. In many real systems, particular designs entail that each module is made of components that share common causes of failure, which can be due to either internal or external factors, or both; for example, see ([4,5]). For instance, components inside a module performing a common function in the system are exposed to the same working conditions. Moreover, when each module performs a specific function in the system, or when modules are located in separate/distinct areas, they can be independently exposed to external conditions. Consider the following examples. (1) Sensors comprising the engine control unit of a car can be classified as mechanical, electrical, or electronic; the occurrence of an overvoltage shock may damage the resistors in electrical sensors. (2) In a railway control system, the arrival of an earthquake may cause the failure of sensors installed on the tracks in the impact area, while sensors installed on tracks in other locations are not affected by the incident.

This paper studies a modular system comprising K independent modules (KMS). Each module is composed of units that are independent and not necessarily equal, with lifetimes following phase-type distributions. As modules can be independently exposed to environmental conditions, different random shock processes are considered to be governed by MAPs. When a shock reaches a module, it may affect the module, either causing its failure or not with a certain probability. The evolution of the system is described by a multidimensional process in which states are provided by vectors of a very large size. A bottom-up procedure is presented for the construction of the infinitesimal generator, from which probabilities and reliability measures of interest can be obtained. As the system evolves over time, it may fail, and even when operational, it may be in unsatisfactory operating conditions. System maintenance then becomes essential to avoid its failure and the associated costs. For this system, we propose a maintenance strategy where preventive and/or corrective actions are performed when required at inspection times. The optimal inspection interval is determined based on the probability (q) that the system reaches a critical operating state, that is, a state in which the system, though operational, is not performing at optimal conditions.

The contributions of this work are highlighted throughout the paper. The model we present is general, and many multi-state complex systems can be derived from it, even those with a non-modular structure. Modular systems have been little treated in reliability modeling or in shock modeling. Nevertheless, the use of this type of design is growing. Many engineering and industrial systems, such as computers, automobiles, and others, have a modular architecture. Apart from the possible economic advantages, the application of the modular principle can be useful in extending, upgrading, or replacing system functions by means of separate modules. Failure analysis and bulk maintenance can be more cost-effective than component-by-component actions. Moreover, for reliability reasons, the lifetime of the system can be extended, e.g., by incorporating redundancy through the use of modular structures.

When using the Markovian methodology and the Matrix-Analytic Method (MAM) a high-dimensional complex system is mathematically tractable, allowing for compact expressions. The use of MAPs in the model generalizes the shock processes most frequently used, such as the Poisson process and the non-homogeneous Poisson process; in addition, shocks modeled by MAPs involve non-independent inter-arrival times. For each of the modules, the external source of failure is modeled by a different and independent MAP, which adds to the probability of internal failure due to unit wear. A considerable number of complex systems can be studied using the proposed model. An algorithmic procedure is provided to facilitate and foster practical implementation.

The remainder of this paper is organized as follows. In Section 2, we define the fundamental concepts that play an important role in this work. In Section 3, the description of the model and notation are presented. Section 4 describes the maintenance strategy proposed for the system. Section 5 displays a numerical application. Finally, Section 6 provides our conclusions and future research prospects.

2. Preliminaries

Phase-type distributions (PH-distributions), Markovian arrival processes (MAPs), and Kronecker operations play an important role in this paper. They are the basic elements in the application of Matrix-Analytic Methods (MAMs), and are formally defined below to provide a better understanding of this work. For further details, readers are referred to ([32,33,34]).

Definition 1.

PH-distribution

Consider a finite Markov chain with m transient states and one absorbing state with the infinitesimal generator Q partitioned as

$$Q=\left(\begin{array}{cc}\hfill T& T^0\\ \hfill 0& 0\end{array}\right)$$

where T is a matrix of order m and $T^0$ is a column vector such that $Te+T^0$. The vector e is a column of ones. For eventual absortion into the absorbing state, starting from the initial state it is necessary and sufficient that T be nonsingular. Suppose that the initial state of the Markov chain is chosen according to the probability vector $(\alpha ,a_{m+1})$. Let X denote the time until absorption; then, X is a random variable taking non-negative values, with the probability distribution function $F\left(x\right)$ provided by $F\left(x\right)=1-\alpha e^{Tx}e,$ for $x\ge 0.$

We can then denote X as following a $PH(\alpha ,T)$-distribution of order m.

Definition 2.

Markovian arrival process (MAP)

Suppose that $D=\left(d_{ij}\right)$ is the generator of an irreducible Markov chain with m states. At the end of a sojourn time in state i that is exponentially distributed with parameter ${\lambda }_i$, one of the following two events could occur: with probability $p_{ij}^{\left(1\right)}$, the transition corresponds to an arrival and the underlying Markov chain is in state j with $1\le i,j\le m$, while with probability $p_{ij}^{\left(0\right)}$ the transition corresponds to no arrival and the state of the Markov chain is $j,j\ne i$. We can define matrices $D_0=\left(d_{ij}^{\left(0\right)}\right)$ and $D_1=\left(d_{ij}^{\left(1\right)}\right)$ such that $d_{ii}^{\left(0\right)}=-{\lambda }_i,$$d_{ij}^{\left(0\right)}={\lambda }_i{p}_{ij}^{\left(0\right)},$ for $j\ne i$ and $d_{ij}^{\left(1\right)}={\lambda }_i{p}_{ij}^{\left(1\right)},$$1\le i,j\le m$. By assuming $D_0$ to be a nonsingular matrix, the inter-arrival times are finite with a probability of one, and the arrival process does not terminate. Hence, it can be seen that $D_0$ is a stable matrix. The generator D is then provided by $D=D_0+D_1$. Let α be the initial probability vector of the underlying Markov chain.

Then, $D_0$ governs the transitions corresponding to no arrival and $D_1$ governs those corresponding to an arrival. It can be shown that MAP is equivalent to Neuts’ versatile Markovian point process. The point process described by the MAP is a special class of semi-Markov processes with their transition probability matrix provided by

$${\int }_0^x{e}^{D_{0}t}dt{D}_1=\left[I-e^{D_{0}x}\right]{(-D_0)}^{-1}{D}_1,x\ge 0$$

This MAP is represented by the MAP $(D_0,D_1)$ of order m.

Definition 3.

Kronecker product of matrices

If A and B are rectangular matrices with dimensions $m_1\times m_2$ and $n_1\times n_2$, respectively, their Kronecker product $A\otimes B$ is a matrix with the dimensions $m_1{n}_1\times m_2{n}_2$, which can be written in compact form as $\left(a_{ij}B\right).$

Definition 4.

Kronecker sum of matrices

If A and B are square matrices with dimensions $m_1$ and $n_1$, respectively, their Kronecker sum, denoted by $A\oplus B$, is a matrix defined by $A\otimes I_{n_1}+I_{m_1}\otimes B$, where $I_{m_1}$, $I_{n_1}$ are identity matrices with dimensions $m_1$ and $n_1$, respectively.

3. The Model

A system formed by N units grouped in K modules is considered here. The failure of each module can be due to wear on its units or to a shock that affects the module. The lifetime of each unit follows a PH-distribution. Shocks arrive at the module (system) following an MAP.

A bottom-up approach is adopted to build the system-structure model, starting with the description of a unit within a module, then the internal functioning of a module, and finally a description of the full functioning of the system.

The description of the system is generic in the sense that different types of modular and non-modular systems can be studied considering the proposed model. Additionally, the PH-distributions are dense on the positive real halfline and can approximate known probability distributions as well as failure data. Furthermore, MAPs are used to model the arrival of shocks that are not independent.

3.1. Model Assumptions

• The ith module is formed by $n_i$ units. The lifetime of a unit j in the module follows a PH-distribution $PH({\alpha }_{j,i},T_{j,i})$ with $m_{j,i}$ phases, where $i=1,2,\cdots ,K$, $j=1,2,\cdots ,n_i$, and $N={\sum }_{i=1}^K{n}_i$. The units within a module are considered independent.
• Shocks arrive to module i following an MAP $(D_{0,i},D_{1,i})$ of order $b_i$, where $D_i=D_{0,i}+D_{1,i}$ is the infinitesimal generator. Matrix $D_{0,i}$ governs the inter-arrival times between shocks that affect the module. The entries of matrix $D_{1,i}$ contain the transition rates between the phases of the MAP when a shock arrives.
• The MAP process affecting module i is independent of the other MAP processes affecting the rest of the modules.
• A shock may or may not cause the failure of a module. Let $p_{1,i},i=1,\cdots ,K$ be the probability that a shock causes the failure of module i, and $p_{0,i}$ be the probability that the module does not fail when the shock arrives. Furthermore, $p_{0,i}+p_{1,i}=1$.
• The system might fail even though individual modules remain operational.

3.2. Module Description: Internal Operation

This section describes the internal operation of a given module in terms of how the module might fail. For this purpose, we define the states of the module taking into account the units that are operational or failed, i.e., we consider the $n_i$ units in module i and establish an order among them. If all of them are operational, the state of the module is described by $\langle 1,2,3,\cdots ,n_i\rangle$. If unit h has failed, this is be described by $\langle 1,2,3,\cdots ,\overline{h},\cdots ,n_i\rangle$, that is, the specific unit appears with a bar over it to indicate that it has failed.

Considering this definition and the fact that no simultaneous changes can occur in the units, i.e., if a unit changes its state, then the rest of the units remain unchanged, we now describe the transitions between all the possible module states.

• From $\langle 1,2,3,\cdots ,n_i\rangle$ to $\langle 1,2,3,\cdots ,n_i\rangle$: all units are operational and remain this way. While any unit might change its operational phase, none of them fails. This transition is described by

  $$T_{1,i}\oplus T_{2,i}\oplus \cdots \oplus T_{n_i,i}.$$

  (1)
• From $\langle 1,2,3,\cdots ,h,\cdots ,n_i\rangle$ to $\langle 1,2,3,\cdots ,\overline{h},\cdots ,n_i\rangle$: all units are operational, then unit h fails. This transition is described by

  $$I_{m_{1,i}}\otimes I_{m_{2,i}}\otimes \cdots I_{m_{h-1,i}}\otimes T_{h,i}^0\otimes I_{m_{h+1,i}}\cdots I_{m_{n_i,i}},$$

  (2)

  where $I_{m_{j,i}}$ represents the identity matrix of order $m_{j,i}$ for $j=1,\cdots ,n_i$ and $i=1,\cdots ,K$.
  The rest of the transitions from this state are not possible because two units cannot fail at the same time.
  In fact, from any state it is only possible to transition to a state where a failure occurs or to the same state, given that at present we are not considering maintenance in the system. That is, from a state where s out of $n_i$ units have failed, the module can either stay in this state or change to a state where $s+1$ units have failed. These units do not have to be consecutive.
  Let us describe the transitions in this case. For simplicity, we consider $s=2$, i.e., two units of the module have failed. Let us say that the failed units are $h_1$ and $h_2$, where $h_1$ and $h_2$ can refer to any two units in $\{1,\cdots ,n_i\}$ and $h_1<h_2$.
• From $\langle 1,\cdots ,{\overline{h}}_1,\cdots ,{\overline{h}}_2,\cdots ,n_i\rangle$ to $\langle 1,\cdots ,{\overline{h}}_1,\cdots ,{\overline{h}}_2,\cdots ,n_i\rangle$: in this case, after transition the same two units are failed, the rest of the units continue functioning, and one of them changes phase:

  $$T_{1,i}\oplus \cdots \oplus T_{h_1-1,i}\oplus T_{h_1+1,i}\oplus \cdots \oplus T_{h_2-1,i}\oplus T_{h_2+1,i}\oplus \cdots \oplus T_{n_i,i}.$$

  (3)
• The second possibility is that a unit fails due to wear; let us say that this is unit l. In this case, l is in the set of units that were operational before transition, i.e., $\{1,\cdots ,h_1-1,h_1+1,\cdots ,h_2-1,h_2+1,\cdots ,n_i\}$. Therefore, unit l can be placed before, after, or in between $h_1$ and $h_2$.

  $$I_{m_{1,i}}\otimes \cdots \otimes I_{m_{l-1,i}}\otimes T_{l,i}^0\otimes I_{m_{l+1,i}}\otimes \cdots \otimes I_{m_{n_i,i}}.$$

  (4)
  Remark 1.

  Given that unit l is non-consecutive to any of the previously failed units.

We now describe the generator of a module while considering the transitions between the given states. For this purpose, we denote as $Q_{n_i-s}$ the matrix that describes the transitions when $n_i-s$ units are functioning and none of them fails, while ${\tilde{Q}}_{n_i-s}$ is the matrix that describes the transitions from $n_i-s$ operational units to $n_i-(s+1)$ operational units.

• Transitions in matrix $Q_{n_i-s}$ have to consider all possible combinations of s units out of $n_i$ that have failed. For example, if a module has $n_i=2$ units and $s=1$, i.e., one unit has already failed, the transitions that are described in matrix $Q_{n_i-s}$ are the transitions among the states $(1,\overline{2})$ and $(\overline{1},2)$.
  To describe these transitions, the matrix $Q_{n_i-s}$ is comprised of $\left(\genfrac{}{}{0pt}{}{n_i}{s}\right)\times \left(\genfrac{}{}{0pt}{}{n_i}{s}\right)$ blocks of matrices. In the diagonal, we have the transitions within the same state, i.e., from the state where s specific units have failed to the state where exactly the same units have failed. The matrices in the diagonal blocks are akin to the following one:

  $$T_{1,i}\oplus \cdots \oplus T_{h_1-1,i}\oplus T_{h_1+1,i}\oplus \cdots \oplus T_{h_s-1,i}\oplus T_{h_s+1,i}\oplus \cdots \oplus T_{n_i,i}.$$

  (5)
  Out of the matrix diagonal we have matrices of zeros of appropriate dimensions, as these transitions mean that a different set of s units have failed and that is not possible.
  For example, if module i is formed by three units $n_i=3$, and one of them has failed, that is, $s=1$, matrix $Q_{n_i-s}$ is provided as follows:

  $$Q_{n_i-s}=\left[\begin{array}{ccc}{T}_{1,i}\oplus T_{2,i}& 0& 0\\ 0& T_{1,i}\oplus T_{3,i}& 0\\ 0& 0& T_{2,i}\oplus T_{3,i}\end{array}\right].$$
  Remark 2.

  Considering that the transitions are between the states $(1,2,\overline{3})$, $(1,\overline{2},3)$ and $(\overline{1},2,3)$, in this order.
• On the other hand, ${\tilde{Q}}_{n_i-s}$ is a matrix that has to consider all the possibilities of a unit failing out of $n_i-s$. This matrix is formed by $\left(\genfrac{}{}{0pt}{}{n_i}{s}\right)\times \left(\genfrac{}{}{0pt}{}{n_i}{s+1}\right)$ blocks of matrices that describe the transitions when the unit fails out of all the remaining ones. The transitions when we consider s failed units to $s+1$, where the previously failed s units remain fixed, are provided by matrices such as the one described in Equation (4). The rest of the transitions are provided by matrices of zeros of appropriate dimensions.
  Following the previous example, if module i is formed by three units $n_i=3$, and one of the units has failed, $s=1$, we can consider the transitions from the states $(1,2,\overline{3})$, $(1,\overline{2},3)$ and $(\overline{1},2,3)$ to the states $(1,\overline{2},\overline{3})$, $(\overline{1},2,\overline{3})$, and $(\overline{1},\overline{2},3)$. Then,

  $${\tilde{Q}}_{n_i-s}=\left[\begin{array}{ccc}{I}_{m_{1,i}}\otimes T_{2,i}^0& T_{1,i}^0\otimes I_{m_{2,i}}& 0\\ I_{m_{1,i}}\otimes T_{3,i}^0& 0& T_{1,i}^0\otimes I_{m_{3,i}}\\ 0& I_{m_{2,i}}\otimes T_{3,i}^0& T_{2,i}^0\otimes I_{m_{3,i}}\end{array}\right].$$

In summary, we have

$\left[\begin{array}{cc}{Q}_{n_i-s}& ||{\tilde{Q}}_{n_i-s}\end{array}\right]=$

$$=\left[\begin{array}{ccccccc}{T}_{1,i}\oplus T_{2,i}& 0& 0& & I_{m_{1,i}}\otimes T_{2,i}^0& T_{1,i}^0\otimes I_{m_{2,i}}& 0\\ 0& T_{1,i}\oplus T_{3,i}& 0& & I_{m_{1,i}}\otimes T_{3,i}^0& 0& T_{1,i}^0\otimes I_{m_{3,i}}\\ 0& 0& T_{2,i}\oplus T_{3,i}& & 0& I_{m_{2,i}}\otimes T_{3,i}^0& T_{2,i}^0\otimes I_{m_{3,i}}\end{array}\right].$$

Now, the generator of the module can be provided in terms of the failed units, as follows:

$$Q_i^{*}=\left[\begin{array}{cccccc}{Q}_{n_i}& {\tilde{Q}}_{n_i}& 0& 0& \cdots & 0\\ 0& Q_{n_i-1}& {\tilde{Q}}_{n_i-1}& 0& \cdots & 0\\ 0& 0& \ddots & \ddots & \cdots & 0\\ ⋮& ⋮& & \ddots & \ddots & ⋮\\ 0& 0& 0& 0& Q_{n_i-(n_i-1)}& {\tilde{Q}}_{n_i-(n_i-1)}\\ 0& 0& 0& 0& 0& 0\end{array}\right].$$

(6)

Depending on how the units are organized within the module, the operational and failure states of the module are different. For example, if the module is a series module, as soon as one of the units fails, the whole module fails. If it is a parallel module, all the units must fail for the module to fail. If it is a $k_i$-out-of-$n_i$ module, then $n_i-k_i$ units must fail for the module to fail.

3.3. System Description: Independent MAPs Affecting the Modules

The system is formed by K modules with operational and failure states given in terms of the number of failed units while taking into account how these units are arranged. The system states are described by the number of operational modules.

For the system, we need to consider both the failure of the module due to wear on its units as well as failure due to the arrival of shocks. Shocks represent external conditions that can affect the system operation and make it fail. Here, shocks arrive to a module i following an MAP $(D_{0,i},D_{1,i})$ for $i=1,2,\cdots ,K$.

To simplify, we describe the generator that depicts the internal operation of module i, $Q_i^{*}$ in terms of the macro-state U when the module is operational and the macrostate D when the module has failed due to wear. We define matrix $Q_i$, the matrix that represents the internal changes in the module that do not cause its failure, and ${\tilde{Q}}_i$, the matrix that represents the transitions to a failure state in the module. Matrices $Q_i$ and ${\tilde{Q}}_i$ depend on whether the module is a series, parallel, or $k_i$-out-of-$n_i$ module. For example, for the two extreme cases, i.e., series and parallel, the corresponding expressions are provided below.

• If the module is a series module:

  $$Q_i=Q_{n_i}\mathrm{and}{\tilde{Q}}_i={\tilde{Q}}_{n_i}$$

  where the rest of the blocks in matrix $Q_i^{*}$ are given by matrices of $0s$ of apropriate dimensions.
• If the module is a parallel module:

  $$Q_i=\left[\begin{array}{ccccc}{Q}_{n_i}& {\tilde{Q}}_{n_i}& 0& \cdots & 0\\ 0& Q_{n_i-1}& {\tilde{Q}}_{n_i-1}& \cdots & 0\\ 0& 0& \ddots & \ddots & \cdots \\ ⋮& ⋮& & \ddots & {\tilde{Q}}_{n_i-(n_i-2)}\\ 0& 0& 0& 0& Q_{n_i-(n_i-1)}\end{array}\right],$$

  and

  $${\tilde{Q}}_i=\left[\begin{array}{c}0\\ 0\\ ⋮\\ 0\\ {\tilde{Q}}_{n_i-(n_i-1)}\end{array}\right].$$

In any case, matrix $Q_i^{*}$ can be described as follows:

$$Q_i^{*}=\left[\begin{array}{cc}{Q}_i& {\tilde{Q}}_i\\ 0& 0\end{array}\right].$$

(7)

However, as module i can fail due to the arrival of a shock, matrix $Q_i^{*}$ needs to incorporate this as well. Therefore, we call $Q_i^{s*}$ the generator of module i that takes into account the arrival of shocks. In this case,

$$Q_i^{s*}=\left[\begin{array}{ccc}{Q}_i\oplus (D_{0,i}+p_{0,i}{D}_{1,i})& {\tilde{Q}}_i\otimes I& I\otimes p_{1,i}{D}_{1,i}\\ 0& 0& 0\end{array}\right],$$

(8)

where I denotes an identity matrix of convenient dimension.

From this, we define the matrices

$$Q_i^s=Q_i\oplus (D_{0,i}+p_{0,i}{D}_{1,i}),$$

(9)

and

$${\tilde{Q}}_i^s=\left[\begin{array}{cc}{\tilde{Q}}_i\otimes I& I\otimes p_{1,i}{D}_{1,i}\end{array}\right].$$

(10)

Therefore,

$$Q_i^{s*}=\left[\begin{array}{cc}{Q}_i^s& {\tilde{Q}}_i^s\\ 0& 0\end{array}\right].$$

(11)

Now, we can describe the generator of the system in the same way we did with the module, i.e., in terms of the number of modules that have failed:

$$Q_{sys}=\left[\begin{array}{cccccc}{Q}_K^{\prime }& {\tilde{Q}}_K^{\prime }& 0& 0& \cdots & 0\\ 0& Q_{K-1}^{\prime }& {\tilde{Q}}_{K-1}^{\prime }& 0& \cdots & 0\\ 0& 0& \ddots & \ddots & \cdots & 0\\ ⋮& ⋮& & \ddots & \ddots & ⋮\\ 0& 0& 0& 0& Q_{K-(K-1)}^{\prime }& {\tilde{Q}}_{K-(K-1)}^{\prime }\\ 0& 0& 0& 0& 0& 0\end{array}\right].$$

(12)

• $Q_{K-l}^{\prime }$ is a matrix describing the transitions when l out of K modules have failed. Similarly to the previous section, this matrix is composed of $\left(\genfrac{}{}{0pt}{}{K}{l}\right)\times \left(\genfrac{}{}{0pt}{}{K}{l}\right)$ blocks of matrices. Its diagonal contains the transitions to the same state, i.e., the same l modules are failed and there are no changes in the rest. The off-diagonal matrices are matrices of zeros of appropriate dimensions.
  The matrices in the diagonal blocks are akin to the following one:

  $$Q_1^s\oplus \cdots \oplus Q_{h_1-1}^s\oplus Q_{h_1+1}^s\oplus \cdots \oplus Q_{h_l-1}^s\oplus Q_{h_l+1}^s\oplus \cdots \oplus Q_K^s.$$

  (13)

  with $h_r$ in $(1,2,\cdots ,K)$ and $r=1,\cdots ,l$.
• ${\tilde{Q}}_{K-l}^{\prime }$ is a transition matrix that contains blocks of matrices describing all the possibilities of a module failing out of $K-l$ modules. In an equivalent way to a module, this matrix is formed by $\left(\genfrac{}{}{0pt}{}{K}{l}\right)\times \left(\genfrac{}{}{0pt}{}{K}{l+1}\right)$ blocks of matrices that describe the transitions when a module fails out of the remaining operational ones. The transitions from $K-l$ specific operational modules to $K-(l+1)$, where l of the modules are the previously failed ones, can be described by matrices such as the one below:

  $$I_{{\sum }_{j=1}^{n_1}{m}_{j,1}}\otimes \cdots \otimes I_{{\sum }_{j=1}^{n_{p-1}}{m}_{j,p-1}}\otimes \left({\tilde{Q}}_p^{s}e\right)\otimes I_{{\sum }_{j=1}^{n_{p+1}}{m}_{j,p+1}}\otimes \cdots \otimes I_{{\sum }_{j=1}^{n_K}{m}_{j,K}},$$

  (14)

  where e is a column vector of ones with the appropriate dimension. The rest of the transitions in matrix ${\tilde{Q}}_{K-l}^{\prime }$ are given by matrices of zeros of appropriate dimension.
  Remark 2.

  In this case, module p fails out of the remaining operational modules, being non-consecutive to any of the previously failed ones.
  Finally, depending on how the modules are arranged in the system, the macro-states that represent the failure of the system in matrix $Q_{sys}$ (provided in Equation (12)) are different, i.e., if the system is a series system, when one of the modules fails the whole system fails. If it is a parallel system, the system fails only when all the modules fail. If it is a k-out-of-K system, then $K-k$ modules must fail for the system to fail.

3.4. System Description: An MAP Affecting the System as a Whole

Another scenario considered in the paper is the arrival of shocks that affect the system as a whole and can make it fail. Again, a system formed by K modules is considered, except that the modules can now only fail due to wear. The system might fail due to the failure of modules or due to a shock. Shocks arrive to the system following an MAP. Therefore, Assumptions 2–4 in Section 3.1 are replaced by the following ones, while the rest of Assumptions are the same.

(2bis)

Shocks arrive to the system following an MAP $(D_0,D_1)$, of order b where $D=D_0+D_1$. Matrix $D_0$ governs the inter-arrival time between shocks. The entries of matrix $D_1$ contain the transition rates between the phases of the MAP when a shock arrives.

(3bis)

A shock may or may not cause the failure of the system. Let $p_1$ be the probability that a shock causes the failure of the system and $p_0=1-p_1$ be the probability that the shock does not make the system fail.

We need to consider, on the one hand, the aforementioned matrix that describes the operational and failure states of module i when the module fails due to wear, i.e., the matrix provided by $Q_i^{*}$ in Equation (7), and on the other hand, the shocks that arrive to the system, as both can cause system failure.

Let us first describe the generator of the system in terms of the number of operational modules, i.e., the generator that depicts the internal operation of the system, $Q_{sys}^{*}$. This generator is similar to the one provided in Equation (12); however, in this case the failure of the modules is only due to wear.

• $Q_{K-l}^{\prime }$ is a matrix that represents the transitions when l modules out of K modules have failed due to internal failure. This matrix is composed of $\left(\genfrac{}{}{0pt}{}{K}{l}\right)\times \left(\genfrac{}{}{0pt}{}{K}{l}\right)$ blocks of matrices. Its diagonal contains the transitions to the same state and the same l failed modules. The off-diagonal matrices are matrices of zeros of appropriate dimensions.
  The matrices in the diagonal blocks are akin to the following one:

  $$Q_1\oplus \cdots \oplus Q_{h_1-1}\oplus Q_{h_1+1}\oplus \cdots \oplus Q_{h_l-1}\oplus Q_{h_l+1}\oplus \cdots \oplus Q_K.$$

  (15)
• ${\tilde{Q}}_{K-l}^{\prime }$ is a matrix made up of $\left(\genfrac{}{}{0pt}{}{K}{l}\right)\times \left(\genfrac{}{}{0pt}{}{K}{l+1}\right)$ blocks of matrices that describe the transitions when a module fails due to an internal failure. Here, l module has failed, and after the transition the system has $l+1$ failed modules. Only one module changes in this transition from operational to failed; the rest of the modules are unchanged and remain in the state they were before the transition. This transition is described by a matrix such as the one below:

  $$I_{{\sum }_{j=1}^{n_1}{m}_{j,1}}\otimes \cdots \otimes I_{{\sum }_{j=1}^{n_{p-1}}{m}_{j,p-1}}\otimes \left({\tilde{Q}}_{p}e\right)\otimes I_{{\sum }_{j=1}^{n_{p+1}}{m}_{j,p+1}}\otimes \cdots \otimes I_{{\sum }_{j=1}^{n_K}{m}_{j,K}}.$$

  (16)

The rest of the transitions are given by matrices of zeros of appropriate dimension. As in Section 3.3, the operational and failure states of the system in terms of the number of failed modules is different depending on whether it is a series system, a parallel system, or a k-out-of-K system. For example, if the system is a k-out-of-K system,

$$Q_{sys}^{\prime }=\left[\begin{array}{ccccc}{Q}_K^{\prime }& {\tilde{Q}}_K^{\prime }& 0& \cdots & 0\\ 0& Q_{K-1}^{\prime }& {\tilde{Q}}_{K-1}^{\prime }& \cdots & 0\\ 0& 0& \ddots & \ddots & \cdots \\ ⋮& ⋮& & \ddots & {\tilde{Q}}_{k+1}^{\prime }\\ 0& 0& 0& 0& Q_k^{\prime }\end{array}\right],$$

and

$${\tilde{Q}}_{sys}^{\prime }=\left[\begin{array}{c}0\\ 0\\ ⋮\\ 0\\ {\tilde{Q}}_k^{\prime }\end{array}\right].$$

Therefore, we can describe matrix $Q_{sys}^{*}$ in a compact way as follows:

$$Q_{sys}^{*}=\left[\begin{array}{cc}{Q}_{sys}^{\prime }& {\tilde{Q}}_{sys}^{\prime }\\ 0& 0\end{array}\right].$$

(17)

If we now introduce the failure of the system due to an MAP, then the generator of the system that also considers possible failure due to shocks is provided by

$$Q_{sys}=\left[\begin{array}{ccc}{Q}_{sys}^{\prime }\oplus (D_0+p_0{D}_1)& {\tilde{Q}}_{sys}^{\prime }\otimes I& I\otimes p_1{D}_1\\ 0& 0& 0\end{array}\right].$$

(18)

3.5. MoMA Algorithm

Figure 1 displays the description of the algorithm that we have developed to construct the generator matrix governing the system behavior, called the Modular Matrix-Analytic (MoMA) algorithm. We use the following notation: $M_j$ represents the jth module in the system and $u_i^j$ represents the unit i inside the module j for $j=1,\dots ,K$, and $i=1,\dots ,n_j$. We have taken into account the two cases explained above for shocks acting both independently on the modules and on the whole system. We describe a general situation where several of the modules in the system might be isolated from environmental conditions. In that case, for these modules no MAP is defined, and we represent them with $D_k=$ NA and denote the number of modules in the system that are affected by external shocks as R; thus, $D_k\ne$ NA. Then, $R=K$ indicates the case of shocks arriving independently and individually to each module regardless of the number of modules with $D_k=$ NA, which in fact could be 1 or $K-1$. On the other hand, $R=1$ is the case of a single MAP affecting the whole system and $R=0$ is the case in which no shocks arrive.

Functions $Ps{i}_j$, where $j=1,2,3$, represent different operators that are applied over a set of arguments that can be either a sequence of module generators and/or the elements of the corresponding MAPs of shocks. More specifically, an operator of type ${\Psi }_1$ combines the generators of the PH-distributions that define the units, as detailed in Section 3.2. An operator of type ${\Psi }_2$ returns the combination of the module generators in order to describe the behavior of the system, as described in Section 3.3, where the MAP is not considered, and in Section 3.4, where the MAP is already taken into account. An operator of type ${\Psi }_3$ returns the generator matrix of the process that combines the processes of wear and external shocks at the module level, as in Section 3.3), as well as at the system level, as in Section 3.4).

4. Maintenance Strategy of Modular Systems Based on Critical Values

Industry spends huge amounts of money to repair failures of machines and products. With systems becoming more and more complex, it is vital to master optimal maintenance strategies that can help to reduce the number of complete machine breakdowns, thereby minimizing machine downtime and associated costs. Many approaches have been developed recently in the literature. For instance, in [35] the authors proposed a model to determine inspection and opportunistic maintenance strategies for floating offshore wind turbines. In [36], a new procedure based on criticality analysis was proposed to improve the maintenance of solar tower power plants. In [31], the authors proposed maintenance plans based on inventory theory, in which replacement is carried out only if there is a minimum of failed units.

In the above paper, the system is supposed to degrade with time, meaning that we can consider a range of system performance levels. In general, we can split the state space into two subsets such that $E=U\cup D$, where U contains all the operational states, D represents all down states, and the up and down states are determined in terms of the number of operational modules.

In this paper, we do not distinguish between down states; therefore, we can assume for simplicity that D is a unitary set indicating the failure of the system and is considered an absorbing state. When the system reaches state D it is correctively maintained and restored to a state in the set U chosen according to a vector of probabilities. Between inspections, the system can only progress to a higher degradation level, though not necessarily the following one. Using m to denote the size of the set U, there are a total of $m+1$ states in the system.

The system is inspected at regular intervals to detect any problems and intervene if necessary. A maintenance policy is proposed for this system based on the estimated probability that the system is visiting a certain subset of states at the n-th inspection.

The cost of the intervention depends on the degradation level reached by the system, with corrective maintenance being the most expensive one.

4.1. Preventive Maintenance Based on the Critical State Probability Criterion (CSPC)

Following a similar strategy as in [37], we consider preventive maintenance criteria based on a critical state probability criterion (CSPC). Roughly speaking, a preventive maintenance action is carried out when the system enters a subset of operational states that are considered critical in some sense. For a better picture of the situation, we can illustrate it with the following example.

Consider a system with two modules that works as long as at least one module is operational (i.e., a parallel structure). Let us assume that the two modules are identical and the system evolution is modeled by a Markov chain with state space defined in terms of the number of down modules, $E=\{0,1,2\}$; the set of up states is $U=\{0,1\}$, and the down-state set is then $D=\left\{2\right\}$. State 1 can be seen as critical in comparison with state 0.

In general, we assume that $U=U_1\cup U_2$, where the set of up states can be split into two subsets such that states in $U_2$ are critical to the system’s performance. Let us assume that $card\left(U_2\right)=m_2$, for a $m_2<m=card\left(U\right)$. Notice that, as we do not distinguish modes of failure, the total number of states in the system is $m+1=m_1+m_2+1$. Accordingly, let us consider the following partition of the generator matrix:

$$Q_{sys}=\left(\begin{array}{ccc}{Q}_{U_1{U}_1}& Q_{U_1{U}_2}& Q_{U_1}^0\\ Q_{U_2{U}_1}& Q_{U_2{U}_2}& Q_{U_2}^0\\ 0& 0& 0\end{array}\right)$$

where

$$Q=\left(\begin{array}{cc}{Q}_{U_1{U}_1}& Q_{U_1{U}_2}\\ Q_{U_2{U}_1}& Q_{U_2{U}_2}\end{array}\right)$$

(19)

and

$$Q^0=\left(\begin{array}{c}{Q}_{U_1}^0\\ Q_{U_2}^0\end{array}\right)$$

(20)

The preventive maintenance action is undertaken as soon as the subset $U_2$ is reached with a prespecified probability. More specifically, we can denote as ${\tau }_2$ the first time the system hits subset $U_2$ directly from subset $U_1$, that is, without visiting the state of failure D. The probability distribution of this time is

$$\begin{array}{ccc}\hfill F_2\left(t\right)& =& P(X_t\in U_2;X_s\in U_1,0\le s<t)\hfill \\ & =& {\alpha }_{U_1}{Q}_{U_1{U}_1}^{-1}\left(exp\left\{Q_{U_1{U}_1}t\right\}-I_{m_1}\right)Q_{U_1{U}_2}{e}_{U_2}\hfill \end{array}$$

for $t\ge 0$, where $\alpha =({\alpha }_{U_1},{\alpha }_{U_2},0)$ is the initial probability vector, ${\alpha }_{U_i}$ is the initial probability of subset $U_i$, $i=1,2$, and $e_{U_2}$ is a column vector of ones of the same dimension as $U_2$. As long as transitions from $U_1$ to D are allowed, there are non-zero elements in the sub-vector $Q_{U_1}^0$, meaning that $F_2(+\infty )<1$. Let $F_2^{*}\left(t\right)=\frac{F_2\left(t\right)}{F_2(+\infty )}$ for all $t\ge 0$. A preventive maintenance action is carried out at time

$${\tau }^{*}\left(q\right):=inf\{t\ge 0:F_2^{*}\left(t\right)\ge q\},$$

(21)

with q a critical probability value $0<q<1$, that is, the quantile of order q of the distribution $F_2^{*}$.

After the action is finished, the system is restored to a non-critical state. Then, by the memoryless property, a new preventive maintenance action is scheduled following the rule just defined. Note that with this rule we can decide when to carry out the preventive action; we do not yet decide how the system is to be maintained.

4.2. Maintenance Strategy Expected Cost

A maintenance cost depending on the state of the system at the moment of the intervention is considered in this subsection. A system failure is followed by a corrective maintenance action which involves a cost equal to $C_{CM}$. Preventive maintenance is carried out in the system following the CSPC rule. Specifically, a probability of system failure is fixed, i.e., q, meaning that the time between two consecutive PM actions is ${\tau }^{*}\left(q\right)$, as provided in (21). The cost associated with a PM intervention depends on the operative state of the system at the moment of inspection. We define a vector of costs ${\mathbf{C}}_{PM}={(c_1,\dots ,c_m)}^{\prime }$ as follows:

• $c_j=0$, for $j=1,\dots ,m_1$
• $0<c_{m_1+1}<c_{m_1+2}<\dots <c_m$, where $m=m_1+m_2$, as above
• $c_m\le C_{CM}$

Let ${\mathbf{C}}_q\left(t\right)$ denote the total cost associated with a potential maintenance action at a fixed time t. If the system is found failed at that time, then a CM action is undertaken; on the other hand, a PM action is only carried out if $t={\tau }^{*}\left(q\right)$. The expected cost at time t can be obtained as follows:

$${\displaystyle E\left[{\mathbf{C}}_q\left(t\right)\right]={\mathbf{1}}_{\{t={\tau }^{*}\left(q\right)\}}\sum _{i\in U_2}P(X_t=i)C_{PM,i}+P(X_t\in D)C_{CM},}$$

(22)

where $C_{PM,i}=c_{m_1+i}$ for $i=1,\dots ,m_2$ and ${\mathbf{1}}_{\left\{A\right\}}$ is an indicator function taking a value of 1 if condition A is true and 0 otherwise.

Let us assume that the system is allowed to operate for a prespecified period of time ${\tau }_0$ and that the only inspections are carried out at times $t_k=k{\tau }^{*}\left(q\right)$ for $k=1,2,\dots$, as represented in Figure 2. Each time a PM action is carried out, the system is returned to a functioning state in the subset $U_1$ chosen with a probability provided by the vector ${\alpha }_{U_1}$, that is, the initial law $\alpha$ restricted to the elements of $U_1$. The following transitions are governed by the matrix Q. Starting at the specified time, a new inspection of the system is carried out at time ${\tau }^{*}\left(q\right)$ later, and so forth. This behavior continues until time ${\tau }_0$ is reached. The total number of PM actions developed is equal to r, which can be written as ${\tau }_0=r{\tau }^{*}\left(q\right)+\overline{\tau }$. The total expected cost involved in the interval $(0,{\tau }_0]$ is then

$$\begin{array}{ccc}\hfill E\left[C_q\left({\tau }_0\right)\right]& =& {\displaystyle \sum _{i\in U_2}}P(X_{\tau *\left(q\right)}=i)C_{PM,i}+P(X_{{\tau }^{*}\left(q\right)}=D)C_{CM}+\hfill \\ \hfill & & +(r-1)\left(\beta \left({\tau }^{*}\left(q\right)\right){\mathbf{C}}_{PM}+\gamma \left({\tau }^{*}\left(q\right)\right)C_{CM}\right)\hfill \\ \hfill & & +\beta \left(\overline{\tau }\right)C_{CM},\hfill \end{array}$$

where

$$\beta \left(t\right)=P(X_{t_0}\in U_1,X_{t_0+t}\in U_2)={\alpha }_{U_1,0}exp\left\{Qt\right\}{1}_{U_2}$$

and where $1_{U_2}={(\stackrel{m_1}{\overbrace{0,\dots ,0}},\stackrel{m_2}{\overbrace{1,\dots ,1}})}^{\prime }$; ${\alpha }_{U_1,0}={({\alpha }_{U_1},\stackrel{m_2}{\overbrace{0,\dots ,0}})}^{\prime }$; furthermore,

$$\gamma \left(t\right)=P(X_{t_0}\in U_1,X_{t_0+t}\in D)={\alpha }_{U_1,0}exp\left\{Qt\right\}{Q}^0.$$

where Q and $Q^0$ are defined in Equations (19) and (20).

5. An Application Example: A Two-out-of-Three Voting Scheme for a Surveillance System

As stated in [38], many industrial processes require tight control and are so critical that such control cannot rely on just one surveillance transmitter, given that a transmitter failure might cause nuisance, a false trip, or a process upset involving unnecessary costs. This is why in industry it is very common to introduce redundancy in surveillance systems; two-out-of-three ($2oo3$) voting schemes are particularly common ([38]). Let us consider some machinery that is monitored by a system composed of three sensors. If one sensor fails or malfunctions and emits a failure signal when this is not the case, then the system does not send a false trigger, as the other two sensors are working properly. Thus, with a $2oo3$ strategy in the system of sensors, these situations involving false positives do not occur and faulty instruments (sensors) can be repaired or replaced without interrupting the process.

5.1. Description of the System

Let us consider a three-modular system with the following specifications:

• Internal degradation
  For each $i=1,2,3$ module i, $M_i$, is a sub-system with $n_i=2$ identical and independent units in series. Each unit has a PH-distribution according to $({\alpha }_{j,i},T_{j,i})$, which are

  $$T_{j,i}=\left(\begin{array}{cc}-3& 2\\ 2& -3\end{array}\right)\mathrm{and}{\alpha }_{j,i}=(0.8,0.2)$$

  for $j=1,2$ and modules $M_1$ and $M_2$, and

  $$T_{j,i}=\left(\begin{array}{cc}-5& 4\\ 4& -4\end{array}\right)\mathrm{and}{\alpha }_{j,i}=(0.8,0.2)$$

  for $j=1,2$ in module $M_3$. For any unit in any module, we denote the operative phases as $\{0,1\}$ and the absorbent phase representing the failure of the unit as 2.
• External shocks
  Independently, each module receives shocks that arrive following an MAP with parameters $(D_0,D_1)$ such that

  $$D_0=\left(\begin{array}{cc}-2& 1\\ 0& -3\end{array}\right);\mathrm{and}{D}_1=\left(\begin{array}{cc}1& 0\\ 3& 0\end{array}\right).$$
  The MAPs governing the shocks arriving at the modules are identical and independent. Moreover, when a shock occurs in module $M_i$ this can affect the module, producing its complete failure, with probability $p_i$; otherwise, it does not affect the module at all, which occurs with probability $1-p_i$. We take $p_i=0.1$ for all $i=1,2,3$
• System regime
  We assume a $2oo3$ architecture for the system behavior, which means that the system is working when at least two out of three modules are working. Then, the $UP$ states of the system can in general be written as

  $$<(a_1,b_1;f_1),(a_2,b_2;f_2),(a_3,b_3;f_3)>,$$

  when all modules in the system are working, where $a_i,b_i\in \{0,1\}$; for $i=1,2,3$, we refer to the internal phase of the units inside the module $M_i$, and $f_i\in \{1,2\}$ denotes the phase of the MAP affecting module $M_i$. The up states when one module of the system is down are described as

  $$<(a_1,b_1;f_1),(a_2,b_2;f_2),(DOWN;f_3)>,$$

  when module $M_3$ is not working,

  $$<(a_1,b_1;f_1),(DOWN;f_2),(a_3,b_3;f_3)>,$$

  when module $M_2$ is not working, and

  $$<(DOWN;f_1),(a_2,b_2;f_2),(a_3,b_3;f_3)>,$$

  when module $M_1$ is not working. We denote the whole set of working states of the system by U.
  The $DOWN$ state of the system can be reached as soon as any two modules fail; within this macro-state, we can consider any of the following configurations as

  $$<(a_1,b_1;f_1),(DOWN;f_2),(DOWN;f_3)>,$$

  when only $M_1$ is working,

  $$<(DOWN;f_1),((a_2,b_2;f_2),(DOWN;f_3)>,$$

  when only $M_2$ is working, and,

  $$<(DOWN;f_1),(DOWN;f_2),(a_3,b_3;f_3)>,$$

  when only $M_3$ is working, with $a_i,b_i\in \{0,1\}$, $f_i\in \{1,2\}$, and finally

  $$<(DOWN;f1);(DOWN;f_2),(DOWN;f3)>,$$

  when none of the modules is functioning.
  With this specification, the size of the set of up states U is $m=704$. We can split the set of up states $U=U_1\cup U_2$ into two subsets. In the first subset, $U_1$, we consider the case where all the three modules are occupying any of their operative phases, while and in the second, $U_2$, we consider the states where there is one module down. We call this subset the critical set.

5.2. Reliability and Maintenance of the $2oo3$-Voting System

• Reliability
  Dependability measures are displayed in Figure 3, with the reliability function presented on the left panel and the hazard function shown on the right. The expected lifetime of the system is obtained as 0.357 u.t. On the other hand, the hazard rate presents a very fast increasing tendency at the beginning of the system lifetime until it reaches a maximum around $t=1$, after which it stabilizes and presents an almost constant hazard rate above 4 (u.t.)${}^{-1}$.
  Figure 3. Voting system. (Left panel): Reliability function with mean time to failure. (Right panel): Hazard function.

  Figure 3. Voting system. (Left panel): Reliability function with mean time to failure. (Right panel): Hazard function.
• Maintenance
  In this case, we consider that the system is inspected periodically to perform preventive maintenance (PM). The interval of inspection is determined according to Section 4. We determine the optimal inspection time ${\tau }^{*}\left(q\right)$ depending on a critical probability criterion, that is, we perform system inspection every time the probability that the system is in an operational but critical state exceeds a prespecified value q. We assume that the cost involved in a PM action is half the cost that is implied by a CM action. In particular, we take $C_{PM}=1$ for restoring the system from any critical state to a state in the set $U_1$ chosen according to ${\alpha }_{U_1}$, and we take $C_{CM}=2$.
  The results are presented in Figure 4 and Figure 5. In Figure 5, it can be observed that the maintenance cost increases as the critical probability increases, reaching its peak close to the critical probability value of $q=0.8$. after that, the cost decreases rapidly, which could mean that after a certain value of q it is better in terms of cost to let the system fail and perform maintenance correctively.
  Figure 4. $2oo3$ voting system. (Left panel): Optimal time to PM. (Right panel): Optimal maintenance cost.

  Figure 4. $2oo3$ voting system. (Left panel): Optimal time to PM. (Right panel): Optimal maintenance cost.

  Figure 5. $2oo3$-voting system with a maximum operation time before replacement.

  Figure 5. $2oo3$-voting system with a maximum operation time before replacement.
  In Figure 5, we illustrate the situation described in Section 4.2, with the system allowed to operate for a prespecified period of time ${\tau }_0=2$ u.t. As can be seen, the expected cost of maintenance decreases as the critical probability increases. However, for probabilities above $q=0.8$ the situation becomes unstable. For higher values of q the optimal inspection time for PM is very long, meaning that at the time of inspection the system is likely to have failed, at which point it has to be correctively maintained. With the parameters selected in this particular case for the vector of cost (PM and CM), it seems more convenient to let the system fail.

6. Conclusions and Future Work

In the present paper, we have described a modular system by means of Matrix-Analytic methods. The description of the system has been made based on the relationship between the functioning of the units within a module and the functioning of the system as a whole. We have considered that system failure can occur due to internal wear or due to external shocks representing the surrounding environmental conditions. The description here presented is generic, allowing different types of modular and non-modular systems to be represented by our model. Finally, for the considered type of system, we have proposed a maintenance strategy that involves preventive maintenance actions when the system is inspected at regular intervals of time. The time of inspections is determined based on the probability of reaching critical states in system operation at a given time. We have showcased the model by means of a numerical application.

In this work, we do not consider any differences in the type of failure that affects the system when it fails due to wear or shock, nor do we consider different ways in which maintenance intervention can recover the system to a previous state of (non)degradation depending on the type of intervention and how well it is performed (maintenance efficiency). However, we have obtained clues pertaining to these two questions. The next steps are to incorporate maintenance efficiency into the model and consider the effect of decision-making related to different types of failure. The model used here assumes that no more than one module can fail simultaneously after the occurrence of a shock; however, in real systems this may not be the case. Therefore, we plan to relax this assumption in our future work. Another issue to be dealt with concerns common cause failures, both internal and external.

Other important extensions of our work that could be considered in future research involve incorporating empirical data. Specifically, based on a sample of lifetimes from a system that fits a modular structure similar to the one presented in this paper, we aim to build a model that can explain the evolution of the system over time from a parametric and/or a nonparametric perspective (see [39] for a recent monograph on statistical analysis of reliability data).