International Journal

on Marine Navigation

and Safety of Sea Transportation

Volume 5

Number 3

September 2011

337

1 INTRODUCTION

The risk prediction model consists of a dangerous

event (DE) module and the event consequence mod-

ule. The DE connects the two modules - it initiates

consequences of particular causes. In the case of

propulsion risk (PR), the event DE is immediate loss

of the propulsion capability by the ship, i.e. an im-

mediate catastrophic failure (ICF) of its propulsion

system (PS) (Brandowski 2005, Brandowski et al.

2007, 2008, 2009a). The event may be caused by the

PS element failures or operator errors.

It is assumed that the model parameter identifica-

tion will be based on opinions of the ship power

plant operators, hereinafter referred to as experts.

The opinions will be formulated mainly in a linguis-

tic form, supported to a minimum extent by numeri-

cal data.

The ship PS is well developed. In the example of

a simple PS presented below, it consists of 11 sub-

systems (SS) and these of 92 sets of devices (SD)

including several hundred devices (D) altogether.

The PS sizes, the expert ability to express the opin-

ions necessary to construct a propulsion risk model

and the limited number of experts that the authors

managed to involve in the study influenced the mod-

el form.

The expert investigation methods used in the PR

modelling were presented in publications (Bran-

dowski 2005; Brandowski et al. 2007, 2008, 2009a;

Nguyen 2009)

2 THE PROPULSION RISK PREDICTION

MODEL

The PR model form is determined by data that can

be obtained from experts. It is assumed that they

elicit:

− Annual numbers N of the system ICF type fail-

ures;

− System operating time share in the calendar time

of the system observation by the expert t

(a)

%.

− Linguistic estimation of the share of number of

PS fault tree (FT) cuts in the failure number N

during a year.

− Linguistic estimation of chances or chance pref-

erences of the occurrence of system ICF specific

consequences, on the condition that the event it-

self occurs.

Those opinions are a basis for the construction of

a system risk prediction model.

The following assumptions are made as regards

the system risk model:

− The system may be only in the active use or

stand-by use state. The system ICF type events

may occur only in the active use state.

− The formal model of a PS ICF event stream is the

Homogeneous Poisson Process (HPP). It is

Fuzzy–neuron Model of the Ship Propulsion

Risk

A. Brandowski, A. Mielewczyk, H. Nguyen & W. Frackowiak

Gdynia Maritime University, Poland

ABSTRACT: A prediction model is presented of the ship propulsion risk, i.e. a risk of the consequences of

loss of the ship propulsion capability. This is an expert model based on opinions elicited by the ship power

plant operators. The risk level depends, among other things, on the reliability state of the ship propulsion sys-

tem components. This state is defined by operators in a linguistic form. The formal risk model parameters are

determined by means of a neural network. The model may be useful in the ship operation decision processes.

338

a renewal process model with negligible renewal

duration time. This assumption is justified by the

expert opinions, which indicate that catastrophic

failures (CF) of some systems may occur quite

frequently, even several times a year, but in gen-

eral they cause only a relatively short break in

normal system operation. Serious consequences

with longer breaks in the system operation are

less frequent. Also the exponential time between

failures distribution, as in the case of HPP, is

characteristic of the operation of many system

classes, including the ship devices (Modarres et

al. 1999, Podsiadlo 2008). It is appropriate when

defects of the modeled object and the operator er-

rors are fully random, abrupt and no gradual,

without wear and/or ageing-type defects. This

corresponds with the situation where inspection

and renewals are regularly carried out and prevent

that type of defects.

The following assumptions were made with ref-

erence to the model:

− The HPP parameter is determined in a neural

network from data elicited by experts. The net-

work can be calibrated with real data obtained

from the system (or a similar systems) operation.

− The failure consequences are determined from

data on the chances of occurrence elicited in the

expert opinions.

− The operators perform predictions of the system

reliability condition and PR, i.e. of the system

ICF specific consequences, based on subjective

estimations of the analysed system component

condition.

For given ICF event a fault tree (FT) is construct-

ed, where the top event is an ICF type PS failure and

the basic events are the system minimum cut or cut

failures. The notion of minimum cut is generally

known. Cut is defined as a set of elements (devices)

fulfilling a specific function which loss of that func-

tion results in a system ICF. In the case of minimum

cut, failures of the same system elements may ap-

pear in more than one minimum cuts. Therefore,

they are not disjoint events in the probabilistic sense.

Besides, obtaining reliable expert opinions on the

minimum cut failures is almost unrealistic. Also in

the case of a PS ICF event cause decomposition to

the minimum cut level the number of basic events in

the FT increases considerably - the top event de-

composition is deeper. The more basic events it con-

tains, the more data are needed to tune the neural

network in a situation when the number of compe-

tent experts available is generally very limited. In

the case of cuts (not minimum cuts), they can be ar-

ranged to form a complete set of events. The failure

numbers are then easier to estimate by experts as the

cuts include more devices. Such failures are serious

events in the ship operation process, very well re-

membered by the experts. Besides, there are general-

ly fewer cuts than minimum cuts in the FTs.

Cuts have defined reliability structures (RS). If

those structures and the number of cut failures with-

in a given time interval are known, then the number

of failures of particular devices in the cuts can be de-

termined.

The diagram of a model in Figure 1 illustrates the

PR prediction within a period of time t

(p)

. The sys-

tem operator inputs estimated reliability states of the

cut elements (block (1) of the model). The elements

are devices (D) of the all system cuts. The estimates

are made by choosing the value of the linguistic var-

iable LV = average annual number of ICF events

from the set {minimum, very small, small, medium,

large, very large, critical} for the individual Ds. The

operator may be supported in that process by a data-

base.

Having the reliability states of the FT cuts and

their RS structures, average numbers N

ik

of these cut

ICF failures are determined by “operator algorithm”

(block (2)). The appropriate methods are presented

in section 3 of this paper. They are input data to the

neural network.

Data of

prediction

period

t

(p)

, τ

(a)

(5)

Reliability

states of FT cut

elements (1)

Neuron network

(3)

Consequence

probability (7)

Chances of

consequences

(8)

Process HPP (6)

System state

(4)

Risk (8)

Number of ICF

failures of FT cuts

(2)

Figure 1. Diagram of the fuzzy-neuron model of risk prediction

The neural network, performing generalized re-

gression, determines the system ICF type failure an-

nual number N in the numerical and linguistic values

(block (3)). In the first case, the network determines

the respective value of an LV variable singleton

membership function, and in the second case - a cor-

responding linguistic value of that function. In both

cases 7 values of the LV were adopted. The network

may be more or less complex depending on the

number of cuts and the FT structure.

339

The neural network is built for a specific PS, ac-

cording to its properties and size. Each cut at the FT

lowest level implies an entry to the network. The

network error decreases with the increasing amount

of data. We are interested in teaching data with er-

rors fulfilling some statistical standards and that de-

pends on the number and appropriate choice of ex-

perts.

If there is disproportion between the number of

entries and the teaching data lot size, then the system

FT may be divided at the lower composition levels

and then the component networks "assembled"

again. In the ship PR risk prediction example here

below, the ship PS was decomposed into subsystems

(SS) and those into sets of devices (SD).

The system reliability condition, according to its

operator, i.e. annual number N of its ICFs, is pre-

sented in a linguistic form by giving the LV value

determined in block (3) (block (4)).

Input to the model is risk prediction calendar time

t

(p)

[year] and the modeled PS active use time coeffi-

cient τ

(a)

. The prediction time is chosen as needed, in

connection with the planned sea voyages.

The PS active use time coefficient:

()

= (

()

100)

()

(1)

where t

(a)

% = propulsion system active use time as

a share of prediction calendar time t

(p)

(approximate-

ly equal to the share of ship at sea time).

The value of τ

(a)

coefficient is determined by op-

erator from the earlier or own estimates.

The probability of the system ICF event occur-

rence within the prediction time t

(p)

is determined by

a size K vector (block (6)):

(2)

where

()

= / [1/year] = intensity function (rate

of occurrence of failures, ROCOF) related to the ac-

tive use time, where N = number of the system ICFs

within t = 1 year of observation, with the active use

time coefficient τ determined by neural network; k =

number of ICFs.

Vector (2) expresses the probability of occurrence

of k = 1,2,…,K system ICFs within the prediction

time t

(p)

interval.

Probability of occurrence of specific consequenc-

es on the condition of the analysed system ICF oc-

currence:

{

C ICF

}

, (3)

where C = C1 ∩ C2 = very serious casualty C1 or

serious casualty C2 (IMO 2005).

This probability value is input by the operator

from earlier data obtained from expert investigations

for a specific ship type, shipping line, ICF type and

ship sailing region. The values may be introduced to

the prediction program database.

The consequences C are so serious, that they may

occur only once within the prediction time t

(p)

, after

any of the K analysed system ICFs. The risk of con-

sequence occurrence after each ICF event is deter-

mined by vector whose elements for successive k-th

ICFs are sums of probabilities of the products of

preceding ICF events, non-occurrence of conse-

quences C of those events and occurrence of the

consequences of k-th failure (block (7)):

C, t

(

)

= [P C ICF}

P{ICF

(1 PC ICF)

: x = 1,2, … , K, (4)

Risk (4) is presented in block (8).

3 OPERATOR'S ALGORITHM

3.1 Cut models

The algorithm allows processing of the subjective

estimates of numbers of device D failures, creating

FT cuts, into numerical values of the numbers of

failures of those cuts. They are the neural network

input data. The algorithm is located in block (2) of

the prediction model. The data are input to the mod-

el during the system operation, when devices change

their reliability state. Additionally, the algorithm is

meant to aid the operator in estimating the system

condition.

The numerical values of the numbers of failures

in cuts are determined by computer program from

the subjective linguistic estimates of the numbers of

failures of component devices D. The estimates are

made by the system operators and based on their

current knowledge of the device conditions. This is

simple when cut is a single-element system, but may

be difficult with complex RS cuts. The algorithm

aids the operator in the estimates. Specifically, it al-

lows converting the linguistic values of D device

ICF events into corresponding numerical values of

the cuts. The data that may be used in this case are

connected with cuts - the universe of discourse (UD)

of linguistic variables LV of the cut numbers of fail-

ures for defined RSs. These numbers are determined

from the expert investigations.

Cuts are sets of devices with specific RS - sys-

tems in the reliability sense. They may be single- or

multi-element systems. They are distinguished in the

model because they can cause subsystem ICFs and

in consequence a PS failure. Annual numbers of the

cut element (device) ICFs change during the opera-

340

tion process due to time, external factors and the op-

erational use.

The conversion problem is presented for the case

when in the system FT cuts of subsystems (CSS) are

distinguished and in them cuts of sets of devices

(CSD). The following CSD notation is adopted:

CSD

= {e

, l = 1,2, … , L

},, (5)

where CSD

ik

= k-th cut of i-th subsystem,

k =1.2,…,K, i = 1,2,…,I; e

ikl

= l-th element of k-th

CSD, l = 1,2,…, L.

The CSD cut renewal process parameters, i.e. in-

tensity functions λ (ROCOF), are determined from

the expert investigations of the system PS. In this

case, they are applied only to the ICFs causing the

loss of CSD function. Annual numbers of failures N,

whose functions are intensity functions λ, are deter-

mined. It may be assumed that the numbers elicited

by experts are average values in their space of pro-

fessional experience gained during multi-year sea-

manship. Then the asymptotic intensity function

takes the form (Misra 1992):

(

)

, (6)

where N = average number of the analysed system

failures during the observation time t; τ = active use

time coefficient; t = 1 year = calendar time that the

estimate of the number of failures is related to.

We are interested in the dependence on the num-

ber of CSD cut ICFs to the number of such failures

of the cut elements. It is determined from the formu-

las of the relation of systems, of specific reliability

structures, failure rate to the failure rates of their

components. It should be remembered that in the

case of a HPP the times between failures have expo-

nential distributions, whose parameter is the mod-

eled object failure rate, in the analysed case equals

to the process renewal intensity function λ. The for-

mulas for the ship system CSD cut reliability struc-

tures are given below.

In the case of a single-element structure, the an-

nual numbers of the cut failures and device failures

are identical.

=

, ∈

{

1,2, … ,

}

, ∈

{

1,2, … ,

}

, = 1, (7)

where N

ik

= annual number of failures of k-th cut in

i-th subsystem; N

ikl

= annual number of failures of

l-th device.

In a series RS, the number of system failures is a

sum of the numbers of failures of its components.

=

+

+ +

+ +

(8)

A decisive role in that structure plays a "weak

link", i.e. the device with the greatest annual number

of failures. The CSD cut number of failures must

then be greater than the weak link number of fail-

ures.

In a two-element parallel RS, we obtain from the

average time between failures formula (Misra,

1992):

=

(9)

If one element in that structure fails then it be-

comes a single element structure. Similar expres-

sions can be easily derived for a three-element paral-

lel structure.

In the structures with stand-by reserve, only part

of the system elements are actively used, the other

part is a reserve used when needed. The reserve is

switched on by trigger or by the operator action. The

trigger and the system functional part create the se-

ries reliability structure. When the trigger failure rate

is treated as constant and only one of the two ele-

ments is actively used (L = 2), then:

=

+

, (10)

where

= annual number of trigger failures.

In the case of a three-element structure (L = 3)

with two stand-by elements, we obtain:

=

+

. (11)

In the load-sharing structures, as the expert data

on the number of failures in the case when entire cut

load is taken over by one device are not available,

a parallel RS (equation (9)) is adopted.

In operation, the CSD cut elements may become

failure and cannot be operated. If in a two-element

RS with stand-by reserve one element is non-

operational then it becomes a single element struc-

ture. If in a three-element RS with stand-by reserve

one element is non-operational then it becomes a

two-element structure with one element in reserve. If

in that structure two elements are non-operational

then it becomes a single-element structure. Identical

situation occurs in the case of element failures in the

parallel RS systems.

3.2 Fuzzy approach to the cut failure number

estimate problem

Our variables LV are estimates of the average lin-

guistic annual numbers of ICFs failures N

ik

of cuts

CSD

ik

and N

ikl

devices D

ikl

, i = 1,2, ,I, k =

1,2,…,K, l = 1,2, …,L. We define those variables

and their linguistic term-sets LT-S. We assume sev-

en-element sets of those values: minimum, very

small, small, medium, high, very high, critical. We

assume that these values represent the reliability

state of appropriate objects.

341

From the expert investigations we obtain the uni-

verse of discourse values UD

ik

of individual cuts.

Each of those universes is divided into six equal in-

tervals. We assume that the boundary values

,

, … ,

of those intervals are singleton member functions of

the corresponding linguistic variable values LV

ik

.

The universe of discourse values UD

ik

are the var-

iability intervals of the numbers of failures of cuts

CSD

ik

appearing on the left hand sides of equations

(7) – (11). In the case of a single element RS, paral-

lel RS and with stand-by reserve composed of iden-

tical elements in terms of reliability, we can easily

determine the minimum and maximum numbers of

element failures.

,

and their universes of discourse UD

ikl

and then the

singleton seven-element member functions:

,

, … ,

.

If all the cut elements remain in the minimum

state then the cut is also in the minimum state. If all

the cut elements remain in the critical state then the

cut is also in the critical state. The situation is more

difficult when the cut elements are not identical in

terms of reliability. Then expert opinion-based heu-

ristic solutions must be applied.

4 CASE STUDY

The example pertains to the prediction of a seagoing

ship propulsion risk. Determination of the probabil-

ity of loss of propulsion capability is difficult be-

cause of the lack of data on the reliability of PS ele-

ments and of operators. This applies in particular to

the risk estimates connected with decisions made in

the ship operation phase.

The object of investigation was a PS consisting of

a low-speed piston combustion engine and

a constant pitch propeller, installed in a container

carrier operating on the Europe - North America

line.

The FT of analysed PS is shown in the Figure 2.

For reasons of huge number of SDs the structure of

fuel oil subsystem is only described within the low-

est FT level. The object was decomposed into sub-

systems (SS) (propulsion assembly and auxiliary in-

stallations necessary for the PS functioning - 11 SSs

altogether) and the subsystems into sets of devices

((SD) - 92 sets altogether). Each SS makes the CSS

cut and each SD – the SDC cut. In considered case

the system FT consists of alternatives of those cuts.

In general such FT structure doesn’t have to appear

in the case of PS.

The FT allowed the building the neural network.

The sets of input signals for the network were as-

signed.

Using the code (IMO, 2005), five categories of

ICF consequences were distinguished, including

very serious casualty C1, serious casualty C2 and

three incident categories. Consequences of the alter-

native of first two events were investigated (C = C1

∩ C2).

The consequences are connected with losses.

They may involve people, artifacts and natural envi-

ronment. They are expressed in physical and/or fi-

nancial values. Detailed data on losses are difficult

to obtain, particularly as regards rare events like the

C1 and C2 type consequences. They cannot be ob-

tained from experts either, as most of them have

never experienced that type of events. In such situa-

tion, the risk was related only to the type C conse-

quences of an ICF event.

4.1 Acquisition and processing of expert opinions

The experts in the ICF event investigation were ship

mechanical engineers with multi-year experience (50

persons). Special questionnaires were prepared for

them, containing definition of the investigated ob-

ject, SS and SD schemes, precisely formulated ques-

tions and tables for answers. The questions asked

pertained to the number of ICF type events caused

by equipment failures or human errors within one

year and the share of time at sea in the ship opera-

tion time (PS observation time by expert). These

were the only questions requiring numerical an-

swers.

Figure 2. Fault tree of a ship propulsion system ICF

Legend: PS – propulsion system; ICF – immediate

catastrophic failure;

SS

i

– subsystem, i =1 -fuel oil subsystem, 2 -sea water

cooling subs.; 3 – low temperature fresh water cooling

subs.; 4 – high temperature fresh water cooling subs.; 5 –

startig air subs.; 6 – lubrication oil subs.; 7 – cylider

lubrication oil subs.; 8 - electrical subs.; 9 – main engine

subs.; 10 – remote control subs.; 11 – propeller + shaft

line subs.

SD

1k

– set of devices; ik = 11 - fuel oil service tanks; 12

– f. o. supply pumps; 13 – f. o. circulating pumps; 14 – f.

o. heaters; 15 -filters; 16 – viscosity control arrangement;

17 - piping’s heating up steam arrangement.

D’s ICF

SD

11

ICF

SD

ik

ICF

SD

17

ICF

PS ICF

SS

1

ICF

SS

11

ICF

SS

i

ICF

....

….

……..

…….

…………...

...

...

...