See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/336077211
Analysis of the Reliability of a Starter-Generator Using a Dynamic Bayesian
Network
Article in Reliability Engineering [?] System Safety · September 2019
DOI: 10.1016/j.ress.2019.106628
CITATIONS
READS
18
937
2 authors, including:
Dooyoul Lee
Korean National Defense University
26 PUBLICATIONS 70 CITATIONS
SEE PROFILE
Some of the authors of this publication are also working on these related projects:
ROKAFA 17-P-7 View project
GLARE Composite Repair View project
All content following this page was uploaded by Dooyoul Lee on 19 February 2020.
The user has requested enhancement of the downloaded file.
Analysis of the Reliability of a Starter-Generator Using a Dynamic
Bayesian Network
Dooyoul Lee, Dongsu Choi
Aero Technology Research Institute, 352 Ayang-Ro, Daegu, 41,052, Republic of Korea
Abstract
The reliability of a starter-generator in transport aircraft was assessed. Using the process of
reliability-centered maintenance (RCM), necessary decisions were made not only to satisfy the
reliability requirement but also to reduce the maintenance load. Failure data have indicated
that the life of a starter-generator is limited by the reliability of a bearing. The degradation of
the bearing was represented by a dynamic Bayesian network (DBN). Parameters were learned
by using the EM algorithm given failure data. The DBN model yielded more conservative risk
projection than traditional survival analysis due to the limited number of failure data. The DBN
model can make up for the lack of data records by knowledge of experts. Using a calibrated
model, the time for inspection was determined to maintain reliability over a prescribed amount
of time.
1. Introduction
Risk and reliability based inspection planning (RBI) is a strategy to reduce the total cost (sum
of the cost of risk and maintenance), through optimization of the inspection schedule. The risk
cost includes the cost of aircraft downtime (due to failure), damage, or loss of the aircraft. RBI
procedures have been developed and implemented for aircraft since the 1980s, largely to inspect
the fatigue deterioration of structural elements [1, 2, 3]. Aircraft structures are designed with a
damage tolerance approach that is suitable for RBI, because the assumption of the initial crack
size is relatively conservative. With methods of conventional initial crack size assumption, it is
likely that a crack could grow unrealistically fast, thus requiring frequent inspection. With field
inspection data, the initial crack size distribution can be calibrated and validated [4, 5, 6]. After
calibration, inspections with no-detection generally yield smaller initial crack size distributions,
and the risk of fracture is lowered. Inspections can be conducted whenever the resulting risk is
equal to or below the allowable level.
RBI has brought great flexibility to inspection planning [7, 6]. By setting the allowable risk,
which generally results in an increased cost of risk, the cost of maintenance is decreased. As a
result, the total cost is minimized [8]. The methods used to set safe lives or inspection intervals
are generally based on one or more internationally recognized airworthiness standards such as
DEFSTAN 970 [9] or the Joint Services Specification Guide (JSSG) [10]. DEFSTAN 970 specifies
safety limits in terms of a total probability of failure of 1 × 10−3 for an aircraft, whereas the JSSG
2006 specifies an acceptable level of 1 × 10−7 per flight hour.
Quantitative risk assessment ability is a key factor of RBI implementation. Risk quantification
requires that models accurately assess the risk due to degradation, inspection ability (probability
of detection), and environmental factors (load, contamination, humidity etc.) [2]. Due to limited
knowledge of the input parameters for such models, a probabilistic consideration is necessary,
and advanced statistical methods such as the Bayesian Network (BN) are commonly used to
model the deterioration data [11]. Degradation mechanisms such as fatigue crack propagation
(usage-dependent) or stress corrosion cracking (time-dependent) can be modeled using the BN
[5, 6, 11]. Much of the popularity of the BN can be attributed to the existence of efficient and
robust procedures for learning parameters from observations [12]. It is quite common that the
2
data available for calibrating the probabilistic model is incomplete. For example, missing data
can occur, during an aircraft inspection, where the results generally include binary detection data
without the intensity of signal and noise. The expectation and maximization (EM) algorithm
enables parameter estimation for probabilistic models with incomplete data [12].
As with aircraft structures, the service life of a bearing is mostly limited by its fatigue strength.
Due to uncertainties in determining the material constants for life prediction, a probabilistic
approach of life estimation was applied as early as the 1920s [13]. The L10 life, which is the
amount of time that 90 % of a group of bearings will complete or exceed (without failing due to
rolling-element fatigue), is the basis for calculating bearing life and reliability.
Although the life of a bearing is affected by many factors, it is predicted using only the
dynamic load capacity and applied load on the bearing. The concept of rolling bearing rating life
and basic load rating (load carrying capacity) were introduced by A. Palmgren in 1937 [14]. The
1952 Lundberg and Palmgren report on ‘Dynamic Capacity of Rolling Bearings’ is still the basis
for all bearing life calculations [15]. At the time of Palmgren, the dominant failure mode was
subsurface cracks initiated at voids and inclusions [16]. The basic rated life and the dynamic load
rating represent the subsurface fatigue performance of the bearing. The improvements in bearing
fabrication techniques significantly reduced the risk of subsurface cracks. Instead, lubrication and
contamination are now the two most important modes of failure [17].
In principle, the same dynamic load rating is obtained for bearings with the same internal
geometry, although they may have different surface microgeometry, waviness, raceway, rolling
element profilometry, shape, internal precision tolerances, material fatigue strength, and type of
heat treatment [16]. Thus, ISO 281:2007 introduced a life modification factor, aISO , which is a
function of the lubrication regime, contamination, and fatigue stress limit. Further, aISO is a
nonlinear life modification factor, and may result in an infinitely long bearing service life. The
benefit of introducing this factor is that it considers environmental effects such as lubrication and
contamination, which are the two dominant failure modes of bearings. The use of aISO has been
extensively debated, especially for the existence of the fatigue load limit [18, 13, 16]. However,
evidences of the benefits of the ISO life modification factor has been accrued over many years
[16].
3
A
B
C
Figure 1. Simple BN
In this study, the RBI was developed for a starter-generator using the process of reliabilitycentered maintenance (RCM), and the modified rating life model provided in ISO 281:2007. Field
inspection records were used for calibration and validation, and the assumed inspection capability
was considered for risk assessment. Suitable actions were recommended to solve operational
difficulties.
2. Theoretical Background
2.1. Bayesian Network
In the following, a brief introduction to BN is given, limited to the case of discrete random
variables, i.e., random variables that are defined in a finite space.
The BN is a directed acyclic graph (DAG), which is described by nodes and edges [19]. Nodes
represent random variables and edges denote dependencies among them [20]. Fig. 1 shows a
simple BN, where node A is the parent of node B and C, and both B and C are the children of A,
A node with no parent has its own probability distribution, and a node with parents has a joint
probability distribution of itself and its parents. The joint probability mass function (PMF) of
this network (Fig. 1) is given by the probability chain rule.
Pr (a, b, c) = Pr (a) Pr (b | a) Pr (c | a)
(1)
where Pr (b | a) is the conditional PMF of B given A, and so is Pr (c | a).
Evidence update the BN. For example, when the state B in the network in Fig. 1 is observed
to be e, this information propagates through the network and the joint PMF of A and C changes
according to Bayes rule to
Pr(a, c | e) =
Pr(a, e, c)
Pr(a) Pr(e | a) Pr(c | a)
= P
Pr(e)
a Pr(a) Pr(e | a)
4
(2)
As a result, marginal posterior probabilities of A and C are also updated. Note that without
having any information about A, B and C are dependent. Provided that A is known, B and C
are independent because communication between B and C is blocked by A. For a given set of
evidence, it is possible to infer the dependence assumptions encoded in the graphical structure
using the rules of d-separation [19].
A dynamic Bayesian network (DBN) is a special class of BN, which represents stochastic
processes. A group of BNs (slices) consists the DBN, each of which represents the state of ith
time step. From i to i + 1, slices are connected by acyclic edges. A DBN is called homogeneous
as far as the model structure and the conditional probability tables are unchanged. A number of
inference algorithms for DBN were developed [21], and software packages are also available.
2.2. Expectation Maximization Algorithm
The EM is used to estimate parameters in probabilistic models with incomplete data. The
EM algorithm alternates between the steps of guessing a probability distribution over completions
of missing data given the current model (known as E-step) and then re-estimating the model
parameters using these completions (known as the M-step) [12]. During E-step, one does not
usually need to form the probability distribution over completions explicitly, but rather need
only to compute ‘expected’ sufficient statistics over these completions. E-step makes the objective
function has one global maximum that can be computed in closed form. M-step comes from the
fact that model re-estimation can be thought of as ‘maximization’ of the expected log-likelihood
of the data.
More formally, the EM algorithm augments the observed data, D, with latent data, Z, so that
the augmented posterior distribution p(θ | Z, D) is simple [22]. In the most general setting, the
E-step consists of computing
Q θ, θ
i
Z
=
log [p (θ | Z, D)] p Z | θi , D dZ
(3)
Z
where p(θ | Z, D) denotes the augmented posterior, and p(Z | θi , D) is the conditional predictive
distribution of the latent data which is conditional on the current guess of the posterior mode.
The Q function is the expectation of log[p(θ | Z, D)] with respect to p(Z | θi , D). In the M-step
the Q function is maximized with respect to θ to obtain θi+1 .
5
As with most optimization methods for nonconcave functions, the EM algorithm comes with
guarantees only of convergence to a local maximum of the objective function (except in degenerate
cases). Running the procedure using multiple initial starting parameters is often helpful; similarly,
initializing parameters in a way that breaks symmetry in models is also important [12].
2.3. Rolling Bearing Life Prediction
The Lundberg and Palmgren theory [15] developed the basis for the calculation of the dynamic
load rating and equivalent dynamic load of rolling bearings as it is applied today in the ISO 281
[23] basic rating life equation:
L10 =
C
P
p
(4)
where L10 is the rated fatigue life, at 90 % reliability in million revolutions, C is the basic dynamic
load rating or capacity, P is the standardized dynamic equivalent load or applied load, and p is
the life equation exponent. The basic dynamic load rating, C, is defined as a calculated constant
radial load which a group of identical bearings can theoretically endure for a rating life of one
million revolutions. The standardized dynamic equivalent load, P , is defined as the equivalent
radial load on the bearing which will result in the same life as the actual load and rotation
conditions. The variable C can be viewed as the strength of a bearing, and P is the applied load.
Eq. (4) is suitable for bearings with extremely high load C/P ∼ 2. However, its predictability
decreases under normal operation conditions with much lower load and an extended amount of
time [16].
ISO 281:2007 introduced life modification factor, aISO , which is the function of lubrication
regime, contamination, and fatigue stress limit.
eC Cu
,κ
aISO = f
P
(5)
κ is the lubrication regime, which is the ratio of the actual viscosity of the lubricant in the bearing
to a “reference viscosity”, ec is the contamination, which is the ratio of the maximum internal
stress in a clean contact to the stress in contaminated contact, and Cu is the fatigue stress limit,
the load where the fatigue limit of the bearing material is just reached. aISO is a highly nonlinear
function as shown in Fig. 2. The modified rating life is shown below.
Lnm = a1 aISO L10
6
(6)
1500
aISO
1000
500
0
30
4
20
2
10
C/P
0
0
Figure 2. ISO life modification factor, aISO , given C = 13.5 kN, eC = 1
where a1 is the modification factor for reliability, equal to unity with 90 % reliability and less
than unity with reliability higher than 90 %.
2.4. Reliability Centered Maintenance
The RCM process is used to determine what must be done to ensure that any physical asset
functions the way its users want it to do in its present operating context [24]. The RCM process
entails asking seven questions about the asset or system under review, as follows:
1. What are the functions and associated performance standards of the asset in its present
operating context? (function)
2. In what ways does it fail to fulfill its functions? (functional failure)
3. What causes each functional failure? (failure mode)
4. What happens when a failure occurs? (failure effects)
5. In what way does a failure matter? (failure consequences)
6. What can be done to predict or prevent a failure?
7. What should be done if a suitable proactive task cannot be found?
The most important task of RCM is to find a suitable proactive measure by assessing the risk of
the system of interest.
7
3. Starter-Generator and Electrical System Fault Tree Analysis
The first five questions (function, functional failure, failure mode, failure effects, and failure
consequences) of the RCM process must be answered before developing methods to predict or
prevent failures.
The starter-generator is an important part of aircraft electrical systems. The role of the
starter-generator is to start the engine and to generate electricity during flight. Modern aircraft
have a high electrical power requirement due to their multiple avionic systems, and each engine
usually has at least one starter-generator. In general, an aircraft has multiple starter-generators
and batteries to provide backup. If a single starter-generator fails, another generator should
supply power to the system. Generator malfunction is quickly detected by the pilot, because a
warning light is triggered as soon as the voltage drops below a specified level. Multiple backup
batteries can also supply electricity for a certain amount of time in case all the starter-generators
have failed. Even without electrical power from a starter-generator or batteries, an aircraft can
fly and land safely under visual flight rules (VFR). However, aborting the mission is inevitable
in such cases.
The starter-generator (Fig. 3) studied in this paper is from the Hawker 800XP aircraft
operated by the Republic of Korea Air Force. The Hawker 800XP has two engines, each with
a starter-generator. The starter-generator in the Korean Hawker 800XP has a higher capacity
than similar aircraft to supply electrical power to additional equipment, and is thus assigned as a
time change item (TCI). Although it is not uncommon to designate a starter-generator as a TCI,
some equivalent starter-generators are designated as on condition items (OCI). Originally, the
replacement interval for the starter-generator was 1000 h. However, due to the high failure rate
during its initial operation, this interval was reduced by 300 h, resulting in significantly higher
costs. After switching from steel to hybrid ceramic bearings (ceramic rolling elements on steel
races), a new time interval of 600 h was set. However, the new interval is still too short for a
transport aircraft.
Table 1 shows the performance standard of the starter-generator. When an asset is unable to
fulfill its function to an acceptable standard of performance, a functional failure occurs [24]. For
a starter-generator, a functional failure occurs when it cannot provide enough electrical power
8
Figure 3. Starter-generator for Hawker 800XP
Table 1. Starter-generator performance standard
Characteristics
Requirement
Voltage/Current
30 V/550 A
Speed Range
7800 to 12,000RPM
Overload Capability
825 A for 2 min
Efficiency
70 % Minimum at 550 A and 12,000RPM
Weight
24.72 kg Maximum
Drive Shaft Shear Torque
180.78 Nm
to start the engine and power the avionics. Failure modes are events that are reasonably likely
to cause a failed state [24]. By examining the maintenance records, which have been collected
since 2004, 166 cases of starter-generator failure were found (Table 2). Within these 166 cases,
24 starter-generators required replacement, and of these 24 cases, 21 starter-generators were
exchanged due to bearing defects. Thus, it is reasonable to conclude that the failed state is
largely caused by bearing failure.
There are two bearings in the starter-generator, both of which are hybrid ceramic bearings
with ceramic balls. An equivalent bearing with steel balls has a basic dynamic load rating of
13.5 kN and a fatigue load limit of 0.28 kN (www.skf.com). Ceramics have a higher modulus of
9
elasticity than high carbon steel. Therefore, in the ceramic bearings, the smaller deformation of
the rolling elements (balls or rollers) generates a higher stress at the contact point between the
rolling elements and the raceway, when compared to a steel bearing. Because the life a bearing
is inversely proportional to stress, it will generally be lower for a hybrid bearing than for a full
complement steel bearing, as the elastic modulus of ceramic is greater than that of steel in most
cases [25]. The dynamic load rating of hybrid ceramic bearings with rolling elements made of
silicon nitride is approximately 70 % that steel bearings [25].
There are four types of failure consequences: hidden failure consequences, safety and environmental consequences, operational consequences, and non-operational consequences [24]. The
failure of the starter-generator affects operations. The starter-generator is not a flight safetycritical part. The only consequence of its failure is an aborted mission.
The aircraft electrical system consists of two starter-generators and four batteries. If both
starter-generators fail, the two main batteries can provide electrical power for 30 min. Additionally, there are two backup batteries, which can power the stand-by flight instruments for 30 min
when both main batteries are discharged. However, the backup batteries have a smaller electrical
capacity than the main batteries; hence, the malfunction of a single backup battery will fail to
power the stand-by instruments. The failure of the entire electrical system can be described by
Fig. 4. In the fault tree, all nodes are connected by AND gates except for the backup batteries
(Batt3 and Batt4 ). The probability of failure (POF) can be calculated as:
Pr (Sys. Fail = T ) = Pr (SG Fail = T ) Pr (Batt. Fail = T )
(7)
Because the stand-by flight instruments can only be operated with both backup batteries, an OR
gate connects both backup batteries.
Pr (B/U Fail = T ) = 1 − Pr (Batt3 Fail = F ) Pr (Batt4 Fail = F )
(8)
where B/U stands for backup battery. Reliability and POF are mutually exclusive.
Reliability = 1 − POF
(9)
To evaluate the reliability of the electrical system, the POF of both the starter-generator and the
battery are required.
10
Table 2. Starter-generator inspection data with the detection of failure indications
Year
Time
Type
Year
Time
Type
Year
Time
Type
2004
2004
2004
2004
2004
2004
2005
2006
2006
2006
2007
2006
2006
2006
2006
2007
2007
2007
2007
2007
2007
2008
2008
2009
2008
2008
2009
2009
2009
2009
2010
2010
2010
2011
2010
2011
2010
2011
2011
2011
2011
2012
2012
2012
2012
2013
2013
2012
2013
2013
2013
2013
2014
2014
2014
2014
408.43
599.92
596.85
599.27
597.85
593.28
595.13
598.67
118.47
590.68
596.42
294.92
597.47
267.35
596.45
591.42
594.45
426.18
590.72
576.22
587.43
599.20
595.78
110.53
492.05
593.45
593.50
586.47
575.73
582.62
321.47
592.42
592.77
597.83
592.63
595.67
587.60
598.50
593.45
556.00
593.45
497.40
567.10
597.67
589.18
468.25
595.65
597.65
594.65
596.53
593.75
595.05
598.53
595.05
596.05
593.88
Failed
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Failed
Returned
Failed
Returned
Returned
Returned
Failed
Failed
Returned
Returned
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
2004
2004
2004
2004
2004
2004
2005
2006
2006
2006
2007
2007
2006
2006
2006
2006
2007
2007
2007
2007
2007
2008
2008
2008
2008
2008
2009
2009
2009
2009
2009
2009
2010
2011
2010
2010
2011
2011
2010
2011
2011
2012
2012
2012
2012
2012
2013
2013
2013
2013
2014
2014
2014
2014
2014
591.18
599.23
596.18
485.22
596.45
596.32
589.28
498.35
591.07
596.10
598.15
598.48
605.98
594.85
595.85
578.13
423.75
588.98
585.33
556.07
588.53
591.17
594.60
588.80
595.07
589.00
599.63
590.68
593.98
577.85
583.80
590.00
372.15
599.37
592.63
593.55
592.05
590.73
592.97
560.20
592.35
590.58
581.43
592.15
593.42
565.58
597.00
590.97
251.42
594.55
586.18
595.28
371.55
417.80
598.02
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Failed
Failed
Returned
2004
2004
2004
2004
2004
2004
2005
2006
2005
2006
2006
2007
2006
2007
2006
2007
2006
2007
2007
2007
2007
2008
2008
2008
2008
2008
2009
2009
2009
2009
2009
2010
2010
2010
2011
2011
2011
2011
2011
2011
2011
2012
2012
2012
2012
2012
2012
2013
2013
2013
2013
2014
2014
2014
2014
600.97
595.55
185.02
595.62
591.57
599.82
595.27
595.17
595.45
586.57
596.43
5.12
597.05
283.33
598.95
253.32
590.98
591.37
581.57
588.62
589.58
590.03
588.33
596.60
536.98
590.45
580.12
591.30
595.02
588.62
588.60
595.33
254.45
592.75
586.28
586.67
594.42
594.27
594.80
560.20
580.63
575.45
591.72
595.30
589.82
591.85
597.65
589.15
590.00
599.05
593.13
595.33
594.62
593.77
598.28
Returned
Returned
Failed
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Failed
Returned
Failed
Returned
Failed
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Failed
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Failed
Returned
Failed
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
Returned
11
Sys.
F ail
SG1
SG
Batt
F ail
F ail
SG2
Batt1
M ain
B/U
F ail
F ail
Batt2
Batt3
Batt4
Figure 4. Fault tree of electrical system for risk analysis
12
Maintenance records indicate that the bearing is the weakest link of the starter-generator.
Thus, a bearing life model was utilized to estimate the life of the starter-generator. There was
no record of battery replacement due to failure. Considering no field failure has ever occurred,
the POF of the battery was conservatively assumed to be 1 %.
4. Field Inspection Data and Survival Analysis
The starter-generator of the Hawker 800XP is inspected at every 300 h of operation. The
inspection is conducted to detect abnormal vibration or sound, and signs of wear. The inspection
procedures are described in technical orders. The starter-generator is returned to the contractor
before 600 h of operation for an overhaul. Each aircraft flies about 100 h per month; thus, the
starter-generator needs to be replaced every 6 months. Within 166 cases which have been collected
since 2004, 24 starter-generators required replacement due to failures or damages. Of these 24
cases, 21 starter-generators were exchanged due to bearing defects, and the remaining 3 were
non-bearing-related cases. The failure data belong to two categories, post-failure and pre-failure.
The post-failure is a failure occurred during flight or pre-flight inspections via warning light. The
pre-failure is damage found during a scheduled inspection.
Failure data were plotted on a Weibull probability plot as shown in Fig. 5. The data fitted
well on the Weibull probability plot with a shape parameter of 1.44 and a scale parameter of
2150. The shape parameter which is the slope of the Weibull probability plot represents the
characteristics of failure rate. The shape parameter greater than the unity indicates that the
failure rate increases with time. The scale parameter referred to as the characteristic life is the
time at which 63.2 % of the units will fail. An extreme value distribution such as the Weibull
distribution can represent a system of which the strength strongly depends on the strength of its
weakest link. The life of a starter-generator depends on the life of bearings (the weakest link);
therefore, the Weibull distribution showed good fit with failure data. An estimated mean time
between failures (MTBF) is 1950 h with a 95 % Wald confidence interval of 1031 h and 3689 h.
The collected data were also analyzed by survival analysis. Survival analysis is a method of
getting an expected time when an event occurs, and it is especially good to analyze right censored
data, in which failure time is unknown, as is the case for the starter-generator. The Kaplan-Meier
13
Probability
0.96
0.90
0.75
Failure Data
Weibull CDF
0.50
0.25
0.10
0.05
0.02
10
1
10
2
Time (h)
Figure 5. Weibull probability plot of starter-generator failure time
estimator is a method of modeling the survival curve. It amounts simply to calculating the survival
probability for each time interval t based on the event occurrences at that time [20]. From the
data, the survival probabilities are estimated as follows,
S (t) =
Y ni − di
,
ni
(10)
ti ≤t
where ni is the number of subjects at risk at the beginning of the time interval ti , and di is the
number of subjects who have not survived during the time interval ti . In a Kaplan-Meier plot as
shown in Fig. 6, the survival after 600 h of operation is 85.42 %, and the upper and lower limit
values are 79.16 % and 90.04 %. The survival probability was compared with the results obtained
by a probabilistic model using Bayesian network.
5. Probabilistic Modeling Using Bayesian Network
The weakest link theory. i.e. the life of the shortest-lived component of the system is the life
of the system, was applied for the estimation of the starter-generator life. Because bearings are
the weakest link of the starter-generator, it was assumed that the life of the starter-generator is
proportional to the life of the bearing described in Eq. (6).
LSG ∝ L10
14
(11)
Probability of Survival
1
0.95
0.9
0.85
0
200
400
600
800
Time (h)
Figure 6. Kaplan-Meier survival analysis of starter-generator failure time
Sensitivity analysis has been conducted to choose significant variables of the starter-generator
life estimation model. Variance-based methods using Sobol’s variance decomposition approach
and an estimated procedure was employed for this analysis [26]. Probable ranges for each variable
are listed in Table 3. It was assumed that the dynamic load capacity of the equivalent steel ball
bearing is the maximum, and the minimum is 70 % of the maximum dynamic load capacity [25].
The ratio of the dynamic load capacity and the applied load is ranged from 2 [16] to 20. The
maximum ratio of 20 yields about 10 times longer basic rating life than targeted time of operation
(1000 h at 12,000 RPM).
The bearing of the starter-generator is lubricated by grease. The accepted view of grease
behavior is that it acts as a reservoir releasing oil into the rolled track and thus replenishing
the contact [27]. The main problem of grease lubrication is that the degradation of the film
thickness occurs much earlier than the life of a bearing [28]. κ is the ratio of the viscosity of
grease base oil and the reference kinematic viscosity. In general, the kinematic viscosity of grease
base oil is higher than the reference kinematic viscosity. However, considering the degradation of
the film thickness, it was assumed that κ yields aISO less than the unity given ranges of P , eC ,
and Cu . Because grease in sealed and shielded bearings can provide an effective barrier against
dust and dirt, it was assumed that the contamination level maintains at least normal cleanliness.
15
Table 3. Probable ranges of variables
Name
Variable
Unit
Probable range
Dynamic load capacity
C
kN
9.45-13.5
Capacity load ratio
C/P
-
2-20
Viscosity ratio
κ
-
0.1-0.4
Contamination factor
eC
-
0.5-1
Fatigue load limit
Cu
kN
0.25-0.31
1
Main
Total
Sensitivity Index
0.8
0.6
0.4
0.2
0
C
P
eC
Cu
Figure 7. Global sensitivity analysis
This condition is typical of bearings greased for life and shielded. According to ISO 281:2007,
therefore, eC is ranged from 0.5 (normal cleanliness) to 1 (extreme cleanliness). The fatigue load
limit is the material parameter, and in general has the minimum variance. In this study, 10 %
variation was assumed.
Fig. 7 shows the result of the sensitivity analysis for the starter-generator life, and the
applied load (P ) has the highest sensitivity indices. In the probabilistic modeling, the dynamic
load capacity (C) and the viscosity ratio (κ) also need to be considered. Other variables, the
contamination factor (eC ) and the fatigue load limit (Cu ) were considered to be constant.
To predict the life of a starter-generator correctly, it was required to obtain the accurate
16
measurements of both the dynamic load capacity and the applied load, which show variation
due to factors like measurement error and the inhomogeneity in materials. Because few aircraft
were in operation, it was impossible to measure the capacity and the load experimentally. Prior
distributions with best guesses were used instead, to get the life distribution using the DBN
model. Those priors were updated with the field inspection data. A calibrated model was used
to obtain the life distribution and the reliability of the starter-generator.
We represent the starter-generator life as a DBN model (Fig. 8). Similar models were used
by the authors to predict stress corrosion crack and fatigue crack length [5, 6]. Nodes (circles) in
Fig. 8 represent variables, and each node has its own conditional probability distribution (CPD).
In the DBN model, each slice is the snapshot of the system at a given time. The subscript N
for each node denotes that the node belongs to Nth slice. CPN node represents the ratio of the
dynamic load capacity and the applied load. κN is the node for the viscosity ratio, and eC,N node
represents the contamination factor. The life of the starter-generator is denoted by LSG,N node,
which contain all the possible states of it at Nth slice. ZN and RN are nodes for the inspection
and the reliability respectively. Among nodes, LSG,N and RN are query nodes. Inspection
node, ZN , is the only observable node. The probability distributions of the time-invariant model
parameters, CPN , κN , and eC,N , are updated with the observations. The posterior distributions
of query variables were obtained from Bayes’ theorem (Eq. (2)).
The inspection node, ZN , has two state: “detected” and “not detected”. Each inspection process is characterized by its probability to detect flaws of different sizes so that, given a particular
flaw, there is some probability of detection (POD) uniquely defined for that process [29]. Because
the life of a component is affected by the occurrence of flaws, it was assumed that the size of
the flaw shows a negative correlation with the life of the component. At a current inspection
opportunity, the starter-generator with shorter life expectancy is more likely to have flaws than
starter-generator with longer life expectancy.
Given a particular time of operation, RevN , the POD can, therefore, be expressed as the
function of the life of the starter-generator. RevN was represented explicitly in the DBN model
to emphasize that the POD curve depends on the time of operation. The POD was expressed
using the cumulative distribution function (CDF) of the standard normal distribution. Thus, two
17
CP0
CP1
CP2
CP3
---
CPN
κ0
κ1
κ2
κ3
---
κN
eC,0
eC,1
eC,2
eC,3
---
eC,N
LSG,1
LSG,2
LSG,3
---
LSG,N
Rev1
Rev2
Rev3
---
RevN
Z1
Z2
Z3
---
ZN
R1
R2
R3
---
RN
Rev0
Figure 8. Dynamic Bayesian network for the starter-generator reliability analysis
18
Probability of Detection
0.999
0.997
0.99
0.98
0.95
0.90
Conventional
Improved
tinsp=300h
0.75
For conventional insp.
(t ) = t insp
POD insp
0.50
POD
= 100
For improved insp.
(t ) = t insp+30
POD insp
0.25
0.10
0.05
0.02
0.01
0.003
0.001
POD
0
200
400
600
= 75
800
1000
Life of Starter-Generator (h)
Figure 9. Inspection effectiveness used for the analysis
parameters, a mean and a standard deviation, completely define an inspection system.
LSG − µPOD (tinsp )
POD = 1 − Φ
σPOD
(12)
where Φ is the CDF of the standard normal distribution, LSG is the life of the starter-generator,
tinsp is the time of operation at the inspection, µP OD (tinsp ) is the location parameter of the
normal distribution function at tinsp , and σPOD is the standard deviation of the POD model. In
Eq. (12), the POD increases as the life of the starter-generator decreases, because the occurrence
of flaws is more likely for the starter-generator has a shorter life. The POD given a particular time
of operation at an inspection is the same for all inspection process so that, the location parameter,
µP OD , is a linear function of tinsp . In general, two parameters in Eq. (12) need to be estimated
using the data collected from designed experiments [30]. Because there’s no data available to
evaluate the effectiveness of inspection, the two parameters were calibrated to match the POF at
600 h of operation from calibrated model to the POF from the survival analysis (Fig. 6). Fig. 9
shows the POD model for the analysis, and a possible improvement was also described. It was
assumed that the mean is equal to tinsp , and the σPOD is 100 for the conventional inspection.
The reliability node, RN , is the binary variable (0: failure; 1: no-failure). As shown in Eq.
(9), POF is the complement of reliability. In node RN , the POF and the reliability are calculated
19
consecutively. The event of failure was determined by the limit state function.
g = LSG (t) − tc
(13)
where tc is the current time of operation. The limit state is defined as g = 0. This is the boundary
between the failure domain and the no-failure domain in the starter-generator life space. The
POF of the starter-generator is the area of the life distribution up to the current time of operation.
tc
Z
LSG (t) dt
POF =
(14)
0
The prior distributions for each node are summarized in Table 4.
Posterior starter-generator life distributions were obtained using the probabilistic model depicted in Fig. 8. A “forward-backward” algorithm was utilized to conduct exact inferences.
Murphy’s Bayesian Network Toolbox [21] was used as an inference engine. Inference problems
in temporal models for deterioration processes can be distinguished as filtering, prediction, and
smoothing [11]. Filtering (or monitoring) is the task of computing the posterior distribution over
the state of time t given evidence up to time t, and was conducted in this work.
To take advantage of the exact inference algorithm for the DBN model, the distribution of
each node needs to be discretized [31]. Static discretization introduces an unknown error, which
would be zero in the limit as the size of the discretization intervals approaches zero. Despite
increasing use of a dynamic discretization method, static discretization was used in this work for
simplicity. To verify the appropriateness of the discretization scheme (Table 4) used in this work,
the inference using Monte Carlo simulation (MCS) was compared with the DBN result, as shown
in Fig. 10. As can be seen in the figure, both results match well, so the current discretization
scheme was reasonably accurate.
6. Calibration and Validation
Even with non-informative priors, the DBN model provides meaningful information by updating posteriors with data. Because of the limited number of failure data, predictions were weighted
averages of subjective opinion (priors) and evidence (inspection results). As the number of updates increases, the calibrated and uncalibrated posteriors approach each other. It is, however,
20
Table 4. Discretization scheme where nstate is the number of states.
Variable
Distribution
nstate
Interval boundaries
LSG
-
82
0, exp(log(0.01) : (log(200) − log(0.01))/79) : log(200)), ∞
C
Uniform(9.45, 13.5)
22
0, 9.45 : 4.05/19 : 13.5, ∞
C/P
Uniform(2, 20)
22
0, 2 : 18/19 : 20, ∞
κ
Uniform(0.1, 0.4)
22
0, 0.1 : 0.3/19 : 0.4, ∞
eC
Deterministic
1
0.5
Cu
Deterministic
1
0.28
0.8
DBN Model
MCS
Reliability
0.7
0.6
0.5
0.4
0
100
200
300
400
500
600
Time (h)
Figure 10. Reliability index calculated from both the DBN model and Monte Carlo simulation (MCS)
still important to obtain more appropriate priors to make a more accurate initial prediction.
Calibration was carried out to acquire prior distributions of the nodes, C0 , CP0 and κ0 , in the
DBN model using field inspection data including the no detection cases as explained in Section
4.
There are two types of inspection data, detected and not detected. For each case, the posterior
starter-generator life distribution was calculated. With detected failure, the posterior startergenerator life distribution is calculated as
f (LSG | Z = D) ∝ f (Z = D | LSG ) f (LSG ; N )
21
(15)
1
1
L
0.8
0.8
SG, after
POD
tinsp=300h
0.6
0.6
0.4
0.4
0.2
0.2
0
0
200
400
600
800
Life of Starter-Generator (h)
Probability of Detection
Normalized Density
L SG, before
0
1000
Figure 11. The effect of the probability of detection on the starter-generator life distribution
where f (Z = D | LSG ) is the POD. In the other case, the posterior distribution is calculated as
f (LSG | Z = N D) ∝ f (Z = N D | LSG ) f (LSG ; N )
(16)
where f (Z = N D | LSG ) is the probability of no-detection (PND).
Fig. 11 shows the numerical example of the effect of inspection on the distribution of the
life of the starter-generator. In the example, the inspection was conducted at 300 h of operation.
Because no failures are detected, the area of the life distribution under the POD curve was diminished. As a result, the reliability has been increased after the inspection. Improved inspection
capability or implementation of the better inspection methods move the life distribution more
to the right. For the calibration of the starter-generator life model, it was also assumed that all
returned starter-generators function properly, and they were inspected by the contractor with the
same POD as in-service inspection.
The field inspection data only provide information for node ZN . Due to incomplete data, an
EM algorithm was utilized for parameter inference. It was assumed that the priors of the three
variables (C0 , CP0 , κ0 ) are uniformly distributed. Fig. 12 show the mass functions of the two
variables (CP0 , κ0 ) of Eq. (6)before and after the calibration. Another variable (C0 ), showed
almost the same mass function after the calibration. The priors in Fig. 12 yielded shorter MTBF
22
0.3
8
Prior
Posterior
0.25
Prior
Posterior
Probability
Probability
6
0.2
0.15
0.1
4
2
0.05
0
5
10
15
0
0.1
20
0.15
0.2
0.25
0.3
0.35
0.4
C/P
(a)
(b)
Figure 12. Calibrated (a) CP0 and (b) κ0 for starter-generator life prediction
than the data shown in Fig. 5. The calibration updates priors to match predicted values with
maintenance data. Thus, both the load ratio (CP0 ), and the viscosity ratio (κ0 ), were shifted
right to increase the life of the starter-generator.
As discussed earlier, a prediction made by the DBN model is the weighted average of subjective
opinions (priors) and evidence (maintenance records). Fig. 13 shows reliability projections using
various models. The uncalibrated model yielded an initial sharp decrease in the reliability. After
calibration, posterior reliabilities approach curves calculated by the Kaplan-Meier model and the
Weibull model. However, the value is still under the reliabilities by both models. This is because
the effect of priors was still influential in the calibrated model. In other words, the number
of data for the calibration was not enough to overcome the effect of priors. Because both the
Kaplan-Meier model and the Weibull model are data-driven models, the quality of prediction is
largely affected by the number of data available. When there are not enough data records to learn
from, data-driven models’ estimates provide poor quality of survival prediction [20]. However, the
DBN model can make up for the lack of data records by knowledge of experts. From engineering
perspective, the conservative prediction by the DBN model is more appropriate.
Validation tests the confidence that can be placed on the calibrated model. Following Sankararaman et al. [4] the calibrated model was validated using a Bayes factor. The Bayes factor is the
ratio of the likelihoods of the two hypotheses for the correctness of the model: H0 that the model
23
1
Reliability
0.8
0.6
K-M
Weibull
Uncalibrated
Calibrated
0.4
0.2
0
200
400
600
800
1000
Time (h)
Figure 13. Comparison of reliability predictions by the Kaplan-Meier (K-M) model, the Weibull model, and the
DBN model (calibrated and uncalibrated)
is correct, and H1 that the model is incorrect:
B=
Pr (D | H0 )
Pr (D | H1 )
(17)
If B is greater than unity, the null hypothesis (H0 ) can be accepted, and the model has been
validated. The numerator of Eq. (17) is proportional to the integration of the not normalized
posterior distribution of crack length given measurement data. For example, with a perfect
prediction, the starter-generator life distribution (prior distribution) at rotation N is the same as
the updated distribution (posterior distribution) obtained by inspection data. In this case, the
unnormalized posterior distribution has the maximum integration value when compared to other
cases, because the likelihood does not change the shape of the prior crack length distribution.
In this work, k-fold cross-validation was used, which partitions the original data into k equally
sized sets, and then in each iteration, one partition is held as test data, and all the remaining sets
train a model. Before the partition, the inspection data was shuffled randomly, and divided by n.
There are also two cases for validation data. The first case is that the failure was not detected.
Z
Pr (D | H0 ) ∝
∞
f (Z = N D | LSG ) f (LSG ; N ) dLSG
0
24
(18)
The second case is that the failure was detected.
Z ∞
Pr (D | H0 ) ∝
f (Z = D | LSG ) f (LSG ; N ) dLSG
(19)
0
The denominator of Eq. (17) was obtained using Eqs. (18) and (19). We have, however, no
prior knowledge of the distribution of crack length under H1 . Thus, a uniform distribution for
f (LSG ; N ) was used as a non-informative prior for H1 .
Assuming that the inspections were conducted in a timely manner and the result of each
inspection is Di , then maintenance data D consists of D1 , D2 , D3 , ..., Dn . Provided that
each inspection was conducted independently, an event observing inspection result (D) is the
intersection of data (Di ). The Bayes factor for each inspection data (Di ) is Bi . The total Bayes
factor can then be calculated using the independence of the inspections as follows:
Pr (D | H0 )
Pr (D | H1 )
Pr (D1 ∩ D2 . . . ∩ Dn | H0 )
=
Pr (D1 ∩ D2 . . . ∩ Dn | H1 )
Pr (D1 | H0 ) Pr (D2 | H0 ) . . . Pr (Dn | H0 )
=
Pr (D1 | H1 ) Pr (D2 | H1 ) . . . Pr (Dn | H1 )
B=
= B1 B2 . . . Bn
(20)
The total Bayes factors calculated by Eq. (20) using 8-fold cross-validation are shown in Fig. 14
The confidence of the calibrated model can be tested from the posterior probability of the null
hypothesis, which determines if “the model is correct”, and is as follows:
Pr (H0 | D) =
Pr (D | H0 ) Pr (H0 )
B
=
Pr (D | H0 ) Pr (H0 ) + Pr (D | H1 ) Pr (H1 )
B+1
(21)
The higher the posterior probability, the more likely it is that the calibrated model is correct. For
example, if the total Bayes factor is equal to the unity, the posterior probability of the calibrated
model is 50 %, which indicates that both hypotheses are equally likely. In this context, confidence
is not the same as confidence intervals in statistical hypothesis testing. Because the calculated
total Bayes factor is a big number, the confidence of the calibrated model were above 80 %.
7. Recommended Action
Two remaining RCM questions are as follows:
25
1
Confidence
0.9
0.8
0.7
0.6
0.5
1
2
3
4
5
6
7
8
8-fold Cross-validation
Figure 14. Result of model validation obtained using 8-fold cross-validation
6. What can be done to predict or prevent a failure?
7. What should be done if a suitable proactive task cannot be found?
There are two options for the first of the remaining questions. They are scheduled restoration/discard tasks and on-condition tasks [24]. Considering the cost and difficulties to implement
an on-condition maintenance scheme, a scheduled restoration (scheduled maintenance) is a reasonable action for the starter-generator.
An inspection needs to be conducted when the reliability approaches a control level, Rctrl . In
this work, the decision maker wants to extend the time of operation up to 1000 h. The reliability
of the starter-generator was 83 % with the current change interval of 600 h. Given the reliability
of the starter-generators and the batteries, the risk of the electrical system can be obtained using
the fault tree shown in Fig. 4. As mentioned in the previous section, the POF of batteries was
assumed to be 1 % due to the lack of failure data. The POF and the reliability for each node
are shown in Table 5. Using the Eqs. (7) and (8), the calculated POF of the electrical system
was 5.75 × 10−8 . In general, the probability of occurrence less than 10−6 can be interpreted as
“improbable”.
Even with the shut down of the whole electrical system, aircraft can land safely under VFR.
26
Table 5. Tabular probabilities of each node for risk analysis
Node name
POF
Reliability
Starter-Generator (SG1 , SG2 )
17 %
83 %
Main Batt. (Batt1 , Batt2 )
1%
99 %
Backup Batt. (Batt3 , Batt4 )
1%
99 %
In this case, however, loss of communication can occur, and visible ranges may be limited due
to bad weather. The severity can be categorized as “Critical” or “Catastrophic”. According to
the risk assessment matrix provided by MIL-STD-882E “System Safety” [32], the risk due to the
failure of the starter-generator and subsequent electrical system shut down is “Medium”, which
is the second lowest among possible risk levels. Considering the very low probability of failure of
aircraft electrical system, it was determined that the starter-generator reliability of 83 % is the
reasonable value to decide when to inspect.
Using the calibrated model, the reliability of the starter-generator was predicted for the time of
operation over 600 h. It was assumed that inspections will be conducted if the predicted reliability
reaches the control level. Fig. 15 indicates that with conventional inspections at 300 h, 600 h and
800 h, the targeted reliability can be achieved. Jumps in reliability do not mean an improvement
of the physical condition of the starter-generator, but the update of prior knowledge (model based
life prediction) by data information (inspection data). Using inspection methods with improved
POD, a higher reliability jump can be achieved, and a longer inspection interval may be applied.
In Fig. 15, the starter-generator inspected by methods with the improved capability (Fig. 9)
clearly shows the extended inspection interval. The last question related to is not applicable,
because there exists a suitable proactive task.
8. Conclusion
Based on the procedure of the RCM scheme, the possibility of extending the replacement interval of the starter-generator of the Hawker 800XP was examined. Because the starter-generator
was not a flight safety-critical part, it was concluded that the extension was possible with a
suitable inspection plan. Failure of the weakest link (bearings) caused malfunction of the starter27
1
w/o Inspection
w/ Conventional Inspection
w/ Improved Inspection
Reliability
0.95
0.9
0.85
Rctrl
0.8
0.75
0.7
0
200
400
600
800
1000
Time (h)
Figure 15. Changes of reliability with or without inspection
generator. The life of a starter-generator was estimated based on the bearing life model. The DBN
model was utilized to consider uncertainties in model parameters and the conditional probability
of inspections, and the life distribution was obtained. The model was calibrated and validated
using maintenance data obtained since 2004. A calibrated model was used to get reliability for
600 h which was the current change interval. With inspections at 600 h and 800 h, maintaining a
targeted reliability level was shown to be possible.
[1] Lincoln, J. W., 1980. Method for Computation of Structural Failure Probability for an
Aircraft. Tech. Rep. ASD-TR-80-5035, Aeronautical Systems Division Wright-Patterson
AFB.
[2] Gallagher, J. P., Babish, C. A., and Malas, J. C., 2005. “Damage Tolerant Risk Analysis
Techniques for Evaluating the Structural Integrity of Aircraft Structures”. In Proceedings
of 11th International Conference on Fracture 2005, Curran Assciates, Inc., pp. 71–76.
[3] White, P., 2006. Review of Methods and Approaches for the Structural Risk Assessment of
Aircraft. Tech. Rep. DSTO-TR-1916, Defense Science and Technology Organisation.
[4] Sankararaman, S., Ling, Y., and Mahadevan, S., 2011. “Uncertainty Quantification and
28
Model Validation of Fatigue Crack Growth Prediction”. Engineering Fracture Mechanics,
78(7), pp. 1487–1504.
[5] Lee, D., Huang, Y., and Achenbach, J. D., 2016. “Probabilistic Analysis of Stress Corrosion Crack Growth and Related Structural Reliability Considerations”. Journal of Applied
Mechanics, 83(2), p. 021003.
[6] Lee, D., and Achenbach, J. D., 2016. “Analysis of the Reliability of a Jet Engine Compressor
Rotor Blade Containing a Fatigue Crack”. Journal of Applied Mechanics, 83(4), p. 041004.
[7] Torng, T. Y., Edwards, R. M., and Morgan, J., 2007. “B-1 Maintenance Schedule Impact
Based on Risk Assessment Results”. In Proceedings of the Aircraft Structural Integrity
Program Conference, pp. 1–28.
[8] Straub, D., Goyet, J., Sorensen, J. D., and Faber, M. H., 2006. “Benefits of Risk Based Inspection Planning for Offshore Structures”. In Proceedings of 25th International Conference
on Offshore Mechanics and Arctic Engineering, pp. 59–68.
[9] U.K. Ministry of Defense, 1983. DEFSTAN 00-970 Design and Airworthiness Requirements
for Service Aircraft.
[10] U.S. Department of Defense, 1998. JSSG-2006 Aircraft Structure.
[11] Straub, D., 2009.
“Stochastic Modeling of Deterioration Processes through Dynamic
Bayesian Networks”. Journal of Engineering Mechanics, 135(10), pp. 1089–1099.
[12] Do, C. B., and Batzoglou, S., 2008. “What is the expectation maximization algorithm?”.
Nature Biotechnology, 26(8), pp. 897–899.
[13] Zaretsky, E. V., 2013. Rolling Bearing Life Prediction, Theory, and Application. Tech. Rep.
NASA/TP2013-215305, NASA Glenn Research Center.
[14] Palmgren, A., 1937. “On the Carrying Capacity and Life of Ball Bearings”. The Ball Bearing
Journal(3), pp. 34–44.
29
[15] Lundberg, G., and Palmgren, A., 1952. “Dynamic Capacity of Roller Bearings”. Acta
Polytechnica Mechanical Engineering Series, 2(4).
[16] Gabelli, A., Doyer, A., and Morales-Espejel, G., 2015. “The Modified Life Rating of Rolling
Bearings: A Criterion for Gearbox Design and Reliability Optimization”. Power Transmission Engineering(March), pp. 46–54.
[17] Glantz, W., 1993. “Contamination in Lubricaiton Systems for Bearings in Industrial Gearboxes”. Ball Bearing Journal(242), pp. 20–26.
[18] TLT, 2010. “ISO 281:2007 bearing-life standard-and the answer is?”. Tribology & Lubrication
Technology, 66(7), pp. 34–36,38–43.
[19] Jensen, F. V., and Nielsen, T. D., 2007. Bayesian Networks and Decision Graphs. Springer
Science+Business Media, LLC.
[20] Kraisangka, J., and Druzdzel, M. J., 2014. “Discrete Bayesian Network Interpretation of the
Cox’s Proportional Hazards Model”. In PGM 2014: Probabilistic Graphical Models, Vol. 11,
pp. 238–253.
[21] Murphy, K. P., 2002. “Dynamic Bayesian Networks: Representation, Inference and Learning”. PhD thesis, University of California, Berkeley.
[22] Tanner, M. A., 1993. Tools for Statistical Inference. Springer-Verlag New York, Inc., New
York, NY.
[23] International Organization for Standardization, 2010.
ISO 281:2007 Rolling Bearings–
Dynamic Load Ratings and Rating Life.
[24] Moubray, J., 1997. Reliability Centered-Maintenance. Industrial Press Inc., New York, NY.
[25] Zaretsky, E. V., Chiu, Y. P., and Tallian, T. E., 2013. “Ceramic Bearings for Use in Gas
Turbine Engines”. Journal of Materials Engineering and Performance, 22(10), pp. 2830–
2842.
30
[26] Saltelli, A., Ratto, M., Andres, T., Campolongo, F., Cariboni, J., Gatelli, D., Saisana, M.,
and Tarantola, S., 2008. Global Sensitivity Analysis: the Primer. John Wiley & Sons.
[27] Cann, P. M., 1999. “Starved grease lubrication of rolling contacts”. Tribology Transactions,
42(4), pp. 867–873.
[28] Svoboda, P., Kostal, D., Kunak, J., and Krupka, I., 2014. “Study of Grease Behaviour in a
Starved Lubricated Contact”. MM Science Journal, pp. 465–469.
[29] Committee on Nondestructive Testing of Aerospace Systems, 1977. Economic and Management Aspects of Nondestructive Testing, Evaluation, and Inspection in Aerospace Manufacturing. Tech. rep., National Materials Advisory Board.
[30] Lee, D., Yang, S., Park, J., Baek, S., and Kim, S., 2017. “Investigation of Detectable Crack
Length in a Bolt Hole Using Eddy Current Inspection”. Transactions of the Korean Society
of Mechanical Engineers A, 41(8), pp. 729–736.
[31] Fenton, N. E., and Neil, M. D., 2012. Risk Assessment and Decision Analysis with Bayesian
Networks. The CRC Press, Boca Raton, FL.
[32] U.S. Department of Defense, 2000. MIL-STD-882E System Safety.
31
View publication stats