GE Mark VIe System Manual page 50

1.7.2 Mean Time Between Forced Outage (MTBFO)
MTBFO is a measure of system availability, which includes the effects of any fault tolerance that may exist. This average
time between failures causes the loss of system functions.
The engineer must be very aware of MTBF and MTBFO when designing a reliable continuous system. To maximize the
MTBFO, Mark VIe control systems undergo evaluation of all system component MTBF values. The effects of failures and
contingency operation are then analyzed to maximizing MTBFO.
To continue operation after a critical system component has failed, a control must have one or more backups in place
(redundancy) to improve the MTBFO significantly above that of a simplex control. The simplest method is adding a second
component that takes over the critical function when a fault is detected.
The redundancy in the system can be either active or standby. The Mark VIe control uses active redundancy and has all
components operating simultaneously. Standby redundancy activates backup systems after a failure is detected.
Realizing the full benefits of redundancy, a system failure must be detectable for the control to bypass it. In a dual control,
gross failures are readily detectable while subtle failures are more difficult to detect. TMR controls, using two out of three
voting, are always able to select a valid value when presented with any single failure.
Depending on the equipment, the time required to detect the fault and switch to the new component may be
hours/minutes/seconds/milliseconds. In the case of fuel-flow control to a turbine, this is required to be done in milliseconds.
When a redundant control bypasses a failure, it is required that the system annunciate the presence of the failure and that
repairs be completed in a timely fashion. The term, mean time to repair (MTTR), refers to the time it takes to identify and
repair a given failure. The Mark VIe control is designed to support a MTTR of four hours. This preserves the MTBFO
benefits of redundancy resulting in unequaled system reliability. A control is used to run the system as well as detect system
failures. In a dual control, configured for one out of two to run, it is often necessary to add dedicated tripping controls for
each critical trip system. This is done to yield running reliability while maintaining required tripping reliability.
A TMR control normally configures the control for two out of three selection. This yields high running and tripping reliability
from the primary control. Additional dedicated tripping controls can be used to achieve even higher tripping reliability, but
they must also be TMR to preserve running reliability.
50 GEH-6721_Vol_I_BP GEH-6721_Vol_I Mark VIe and Mark VIeS Control Systems Volume I
Public Information