International Journal
on Marine Navigation
and Safety of Sea Transportation
Volume 5
Number 3
September 2011
The risk prediction model consists of a dangerous
event (DE) module and the event consequence mod-
ule. The DE connects the two modules - it initiates
consequences of particular causes. In the case of
propulsion risk (PR), the event DE is immediate loss
of the propulsion capability by the ship, i.e. an im-
mediate catastrophic failure (ICF) of its propulsion
system (PS) (Brandowski 2005, Brandowski et al.
2007, 2008, 2009a). The event may be caused by the
PS element failures or operator errors.
It is assumed that the model parameter identifica-
tion will be based on opinions of the ship power
plant operators, hereinafter referred to as experts.
The opinions will be formulated mainly in a linguis-
tic form, supported to a minimum extent by numeri-
cal data.
The ship PS is well developed. In the example of
a simple PS presented below, it consists of 11 sub-
systems (SS) and these of 92 sets of devices (SD)
including several hundred devices (D) altogether.
The PS sizes, the expert ability to express the opin-
ions necessary to construct a propulsion risk model
and the limited number of experts that the authors
managed to involve in the study influenced the mod-
el form.
The expert investigation methods used in the PR
modelling were presented in publications (Bran-
dowski 2005; Brandowski et al. 2007, 2008, 2009a;
Nguyen 2009)
The PR model form is determined by data that can
be obtained from experts. It is assumed that they
Annual numbers N of the system ICF type fail-
System operating time share in the calendar time
of the system observation by the expert t
Linguistic estimation of the share of number of
PS fault tree (FT) cuts in the failure number N
during a year.
Linguistic estimation of chances or chance pref-
erences of the occurrence of system ICF specific
consequences, on the condition that the event it-
self occurs.
Those opinions are a basis for the construction of
a system risk prediction model.
The following assumptions are made as regards
the system risk model:
The system may be only in the active use or
stand-by use state. The system ICF type events
may occur only in the active use state.
The formal model of a PS ICF event stream is the
Homogeneous Poisson Process (HPP). It is
Fuzzyneuron Model of the Ship Propulsion
A. Brandowski, A. Mielewczyk, H. Nguyen & W. Frackowiak
Gdynia Maritime University, Poland
ABSTRACT: A prediction model is presented of the ship propulsion risk, i.e. a risk of the consequences of
loss of the ship propulsion capability. This is an expert model based on opinions elicited by the ship power
plant operators. The risk level depends, among other things, on the reliability state of the ship propulsion sys-
tem components. This state is defined by operators in a linguistic form. The formal risk model parameters are
determined by means of a neural network. The model may be useful in the ship operation decision processes.
a renewal process model with negligible renewal
duration time. This assumption is justified by the
expert opinions, which indicate that catastrophic
failures (CF) of some systems may occur quite
frequently, even several times a year, but in gen-
eral they cause only a relatively short break in
normal system operation. Serious consequences
with longer breaks in the system operation are
less frequent. Also the exponential time between
failures distribution, as in the case of HPP, is
characteristic of the operation of many system
classes, including the ship devices (Modarres et
al. 1999, Podsiadlo 2008). It is appropriate when
defects of the modeled object and the operator er-
rors are fully random, abrupt and no gradual,
without wear and/or ageing-type defects. This
corresponds with the situation where inspection
and renewals are regularly carried out and prevent
that type of defects.
The following assumptions were made with ref-
erence to the model:
The HPP parameter is determined in a neural
network from data elicited by experts. The net-
work can be calibrated with real data obtained
from the system (or a similar systems) operation.
The failure consequences are determined from
data on the chances of occurrence elicited in the
expert opinions.
The operators perform predictions of the system
reliability condition and PR, i.e. of the system
ICF specific consequences, based on subjective
estimations of the analysed system component
For given ICF event a fault tree (FT) is construct-
ed, where the top event is an ICF type PS failure and
the basic events are the system minimum cut or cut
failures. The notion of minimum cut is generally
known. Cut is defined as a set of elements (devices)
fulfilling a specific function which loss of that func-
tion results in a system ICF. In the case of minimum
cut, failures of the same system elements may ap-
pear in more than one minimum cuts. Therefore,
they are not disjoint events in the probabilistic sense.
Besides, obtaining reliable expert opinions on the
minimum cut failures is almost unrealistic. Also in
the case of a PS ICF event cause decomposition to
the minimum cut level the number of basic events in
the FT increases considerably - the top event de-
composition is deeper. The more basic events it con-
tains, the more data are needed to tune the neural
network in a situation when the number of compe-
tent experts available is generally very limited. In
the case of cuts (not minimum cuts), they can be ar-
ranged to form a complete set of events. The failure
numbers are then easier to estimate by experts as the
cuts include more devices. Such failures are serious
events in the ship operation process, very well re-
membered by the experts. Besides, there are general-
ly fewer cuts than minimum cuts in the FTs.
Cuts have defined reliability structures (RS). If
those structures and the number of cut failures with-
in a given time interval are known, then the number
of failures of particular devices in the cuts can be de-
The diagram of a model in Figure 1 illustrates the
PR prediction within a period of time t
. The sys-
tem operator inputs estimated reliability states of the
cut elements (block (1) of the model). The elements
are devices (D) of the all system cuts. The estimates
are made by choosing the value of the linguistic var-
iable LV = average annual number of ICF events
from the set {minimum, very small, small, medium,
large, very large, critical} for the individual Ds. The
operator may be supported in that process by a data-
Having the reliability states of the FT cuts and
their RS structures, average numbers N
of these cut
ICF failures are determined by “operator algorithm”
(block (2)). The appropriate methods are presented
in section 3 of this paper. They are input data to the
neural network.
Data of
, τ
states of FT cut
elements (1)
Neuron network
probability (7)
Chances of
Process HPP (6)
System state
Risk (8)
Number of ICF
failures of FT cuts
Figure 1. Diagram of the fuzzy-neuron model of risk prediction
The neural network, performing generalized re-
gression, determines the system ICF type failure an-
nual number N in the numerical and linguistic values
(block (3)). In the first case, the network determines
the respective value of an LV variable singleton
membership function, and in the second case - a cor-
responding linguistic value of that function. In both
cases 7 values of the LV were adopted. The network
may be more or less complex depending on the
number of cuts and the FT structure.
The neural network is built for a specific PS, ac-
cording to its properties and size. Each cut at the FT
lowest level implies an entry to the network. The
network error decreases with the increasing amount
of data. We are interested in teaching data with er-
rors fulfilling some statistical standards and that de-
pends on the number and appropriate choice of ex-
If there is disproportion between the number of
entries and the teaching data lot size, then the system
FT may be divided at the lower composition levels
and then the component networks "assembled"
again. In the ship PR risk prediction example here
below, the ship PS was decomposed into subsystems
(SS) and those into sets of devices (SD).
The system reliability condition, according to its
operator, i.e. annual number N of its ICFs, is pre-
sented in a linguistic form by giving the LV value
determined in block (3) (block (4)).
Input to the model is risk prediction calendar time
[year] and the modeled PS active use time coeffi-
cient τ
. The prediction time is chosen as needed, in
connection with the planned sea voyages.
The PS active use time coefficient:
= (
where t
% = propulsion system active use time as
a share of prediction calendar time t
ly equal to the share of ship at sea time).
The value of τ
coefficient is determined by op-
erator from the earlier or own estimates.
The probability of the system ICF event occur-
rence within the prediction time t
is determined by
a size K vector (block (6)):
= / [1/year] = intensity function (rate
of occurrence of failures, ROCOF) related to the ac-
tive use time, where N = number of the system ICFs
within t = 1 year of observation, with the active use
time coefficient τ determined by neural network; k =
number of ICFs.
Vector (2) expresses the probability of occurrence
of k = 1,2,…,K system ICFs within the prediction
time t
Probability of occurrence of specific consequenc-
es on the condition of the analysed system ICF oc-
, (3)
where C = C1 C2 = very serious casualty C1 or
serious casualty C2 (IMO 2005).
This probability value is input by the operator
from earlier data obtained from expert investigations
for a specific ship type, shipping line, ICF type and
ship sailing region. The values may be introduced to
the prediction program database.
The consequences C are so serious, that they may
occur only once within the prediction time t
, after
any of the K analysed system ICFs. The risk of con-
sequence occurrence after each ICF event is deter-
mined by vector whose elements for successive k-th
ICFs are sums of probabilities of the products of
preceding ICF events, non-occurrence of conse-
quences C of those events and occurrence of the
consequences of k-th failure (block (7)):
C, t
= [P C ICF}
(1 PC ICF)
: x = 1,2, , K, (4)
Risk (4) is presented in block (8).
3.1 Cut models
The algorithm allows processing of the subjective
estimates of numbers of device D failures, creating
FT cuts, into numerical values of the numbers of
failures of those cuts. They are the neural network
input data. The algorithm is located in block (2) of
the prediction model. The data are input to the mod-
el during the system operation, when devices change
their reliability state. Additionally, the algorithm is
meant to aid the operator in estimating the system
The numerical values of the numbers of failures
in cuts are determined by computer program from
the subjective linguistic estimates of the numbers of
failures of component devices D. The estimates are
made by the system operators and based on their
current knowledge of the device conditions. This is
simple when cut is a single-element system, but may
be difficult with complex RS cuts. The algorithm
aids the operator in the estimates. Specifically, it al-
lows converting the linguistic values of D device
ICF events into corresponding numerical values of
the cuts. The data that may be used in this case are
connected with cuts - the universe of discourse (UD)
of linguistic variables LV of the cut numbers of fail-
ures for defined RSs. These numbers are determined
from the expert investigations.
Cuts are sets of devices with specific RS - sys-
tems in the reliability sense. They may be single- or
multi-element systems. They are distinguished in the
model because they can cause subsystem ICFs and
in consequence a PS failure. Annual numbers of the
cut element (device) ICFs change during the opera-
tion process due to time, external factors and the op-
erational use.
The conversion problem is presented for the case
when in the system FT cuts of subsystems (CSS) are
distinguished and in them cuts of sets of devices
(CSD). The following CSD notation is adopted:
= {e
, l = 1,2, , L
},, (5)
where CSD
= k-th cut of i-th subsystem,
k =1.2,…,K, i = 1,2,…,I; e
= l-th element of k-th
CSD, l = 1,2,…, L.
The CSD cut renewal process parameters, i.e. in-
tensity functions λ (ROCOF), are determined from
the expert investigations of the system PS. In this
case, they are applied only to the ICFs causing the
loss of CSD function. Annual numbers of failures N,
whose functions are intensity functions λ, are deter-
mined. It may be assumed that the numbers elicited
by experts are average values in their space of pro-
fessional experience gained during multi-year sea-
manship. Then the asymptotic intensity function
takes the form (Misra 1992):
, (6)
where N = average number of the analysed system
failures during the observation time t; τ = active use
time coefficient; t = 1 year = calendar time that the
estimate of the number of failures is related to.
We are interested in the dependence on the num-
ber of CSD cut ICFs to the number of such failures
of the cut elements. It is determined from the formu-
las of the relation of systems, of specific reliability
structures, failure rate to the failure rates of their
components. It should be remembered that in the
case of a HPP the times between failures have expo-
nential distributions, whose parameter is the mod-
eled object failure rate, in the analysed case equals
to the process renewal intensity function λ. The for-
mulas for the ship system CSD cut reliability struc-
tures are given below.
In the case of a single-element structure, the an-
nual numbers of the cut failures and device failures
are identical.
1,2, ,
1,2, ,
, = 1, (7)
where N
= annual number of failures of k-th cut in
i-th subsystem; N
= annual number of failures of
l-th device.
In a series RS, the number of system failures is a
sum of the numbers of failures of its components.
+ +
+ +
A decisive role in that structure plays a "weak
link", i.e. the device with the greatest annual number
of failures. The CSD cut number of failures must
then be greater than the weak link number of fail-
In a two-element parallel RS, we obtain from the
average time between failures formula (Misra,
If one element in that structure fails then it be-
comes a single element structure. Similar expres-
sions can be easily derived for a three-element paral-
lel structure.
In the structures with stand-by reserve, only part
of the system elements are actively used, the other
part is a reserve used when needed. The reserve is
switched on by trigger or by the operator action. The
trigger and the system functional part create the se-
ries reliability structure. When the trigger failure rate
is treated as constant and only one of the two ele-
ments is actively used (L = 2), then:
, (10)
= annual number of trigger failures.
In the case of a three-element structure (L = 3)
with two stand-by elements, we obtain:
. (11)
In the load-sharing structures, as the expert data
on the number of failures in the case when entire cut
load is taken over by one device are not available,
a parallel RS (equation (9)) is adopted.
In operation, the CSD cut elements may become
failure and cannot be operated. If in a two-element
RS with stand-by reserve one element is non-
operational then it becomes a single element struc-
ture. If in a three-element RS with stand-by reserve
one element is non-operational then it becomes a
two-element structure with one element in reserve. If
in that structure two elements are non-operational
then it becomes a single-element structure. Identical
situation occurs in the case of element failures in the
parallel RS systems.
3.2 Fuzzy approach to the cut failure number
estimate problem
Our variables LV are estimates of the average lin-
guistic annual numbers of ICFs failures N
of cuts
and N
devices D
, i = 1,2, ,I, k =
1,2,…,K, l = 1,2, …,L. We define those variables
and their linguistic term-sets LT-S. We assume sev-
en-element sets of those values: minimum, very
small, small, medium, high, very high, critical. We
assume that these values represent the reliability
state of appropriate objects.
From the expert investigations we obtain the uni-
verse of discourse values UD
of individual cuts.
Each of those universes is divided into six equal in-
tervals. We assume that the boundary values
, ,
of those intervals are singleton member functions of
the corresponding linguistic variable values LV
The universe of discourse values UD
are the var-
iability intervals of the numbers of failures of cuts
appearing on the left hand sides of equations
(7) (11). In the case of a single element RS, paral-
lel RS and with stand-by reserve composed of iden-
tical elements in terms of reliability, we can easily
determine the minimum and maximum numbers of
element failures.
and their universes of discourse UD
and then the
singleton seven-element member functions:
, ,
If all the cut elements remain in the minimum
state then the cut is also in the minimum state. If all
the cut elements remain in the critical state then the
cut is also in the critical state. The situation is more
difficult when the cut elements are not identical in
terms of reliability. Then expert opinion-based heu-
ristic solutions must be applied.
The example pertains to the prediction of a seagoing
ship propulsion risk. Determination of the probabil-
ity of loss of propulsion capability is difficult be-
cause of the lack of data on the reliability of PS ele-
ments and of operators. This applies in particular to
the risk estimates connected with decisions made in
the ship operation phase.
The object of investigation was a PS consisting of
a low-speed piston combustion engine and
a constant pitch propeller, installed in a container
carrier operating on the Europe - North America
The FT of analysed PS is shown in the Figure 2.
For reasons of huge number of SDs the structure of
fuel oil subsystem is only described within the low-
est FT level. The object was decomposed into sub-
systems (SS) (propulsion assembly and auxiliary in-
stallations necessary for the PS functioning - 11 SSs
altogether) and the subsystems into sets of devices
((SD) - 92 sets altogether). Each SS makes the CSS
cut and each SD the SDC cut. In considered case
the system FT consists of alternatives of those cuts.
In general such FT structure doesn’t have to appear
in the case of PS.
The FT allowed the building the neural network.
The sets of input signals for the network were as-
Using the code (IMO, 2005), five categories of
ICF consequences were distinguished, including
very serious casualty C1, serious casualty C2 and
three incident categories. Consequences of the alter-
native of first two events were investigated (C = C1
The consequences are connected with losses.
They may involve people, artifacts and natural envi-
ronment. They are expressed in physical and/or fi-
nancial values. Detailed data on losses are difficult
to obtain, particularly as regards rare events like the
C1 and C2 type consequences. They cannot be ob-
tained from experts either, as most of them have
never experienced that type of events. In such situa-
tion, the risk was related only to the type C conse-
quences of an ICF event.
4.1 Acquisition and processing of expert opinions
The experts in the ICF event investigation were ship
mechanical engineers with multi-year experience (50
persons). Special questionnaires were prepared for
them, containing definition of the investigated ob-
ject, SS and SD schemes, precisely formulated ques-
tions and tables for answers. The questions asked
pertained to the number of ICF type events caused
by equipment failures or human errors within one
year and the share of time at sea in the ship opera-
tion time (PS observation time by expert). These
were the only questions requiring numerical an-