Reliability Engineering and System Safety 195 (2020) 106628

Contents lists available at ScienceDirect

Reliability Engineering and System Safety

journal homepage: www.elsevier.com/locate/ress

Analysis of the reliability of a starter-generator using a dynamic Bayesian T

network
⁎
Dooyoul Lee, Dongsu Choi
Aero Technology Research Institute, 352 Ayang-Ro, Daegu, 41052, Republic of Korea

A R T I C LE I N FO A B S T R A C T

Keyword: The reliability of a starter-generator in transport aircraft was assessed. Using the process of reliability-centered
Bayesian Network maintenance (RCM), necessary decisions were made not only to satisfy the reliability requirement but also to
Reliability-Centered Maintenance reduce the maintenance load. Failure data have indicated that the life of a starter-generator is limited by the
Starter-Generator reliability of a bearing. The degradation of the bearing was represented by a dynamic Bayesian network (DBN).
Bearing
Parameters were learned by using the EM algorithm given failure data. The DBN model yielded more con-
servative risk projection than traditional survival analysis due to the limited number of failure data. The DBN
model can make up for the lack of data records by knowledge of experts. Using a calibrated model, the time for
inspection was determined to maintain reliability over a prescribed amount of time.

1. Introduction
Risk and reliability based inspection planning (RBI) is a strategy to
reduce the total cost (sum of the cost of risk and maintenance), through
optimization of the inspection schedule. The risk cost includes the cost
of aircraft downtime (due to failure), damage, or loss of the aircraft. RBI
procedures have been developed and implemented for aircraft since the
1980s, largely to inspect the fatigue deterioration of structural elements
[1–3]. Aircraft structures are designed with a damage tolerance ap-
proach that is suitable for RBI, because the assumption of the initial
crack size is relatively conservative. With methods of conventional in-
itial crack size assumption, it is likely that a crack could grow un-
realistically fast, thus requiring frequent inspection. With field inspec-
tion data, the initial crack size distribution can be calibrated and
validated [4–6]. After calibration, inspections with no-detection gen-
erally yield smaller initial crack size distributions, and the risk of
fracture is lowered. Inspections can be conducted whenever the re-
sulting risk is equal to or below the allowable level.
RBI has brought great flexibility to inspection planning [6,7]. By
setting the allowable risk, which generally results in an increased cost
of risk, the cost of maintenance is decreased. As a result, the total cost is
minimized [8]. The methods used to set safe lives or inspection inter-
vals are generally based on one or more internationally recognized
airworthiness standards such as DEFSTAN 970 [9] or the Joint Services
Specification Guide (JSSG) [10]. DEFSTAN 970 specifies safety limits in
terms of a total probability of failure of 1 × 10−3 for an aircraft, whereas
the JSSG 2006 specifies an acceptable level of 1 × 10−7 per flight hour.
Quantitative risk assessment ability is a key factor of RBI im-
plementation. Risk quantification requires that models accurately assess
the risk due to degradation, inspection ability (probability of detection),
and environmental factors (load, contamination, humidity etc.) [2].
Due to limited knowledge of the input parameters for such models, a
probabilistic consideration is necessary, and advanced statistical
methods such as the Bayesian Network (BN) are commonly used to
model the deterioration data [11]. Degradation mechanisms such as
fatigue crack propagation (usage-dependent) or stress corrosion
cracking (time-dependent) can be modeled using the BN [5,6,11]. Much
of the popularity of the BN can be attributed to the existence of efficient
and robust procedures for learning parameters from observations [12].
It is quite common that the data available for calibrating the prob-
abilistic model is incomplete. For example, missing data can occur,
during an aircraft inspection, where the results generally include binary
detection data without the intensity of signal and noise. The expecta-
tion and maximization (EM) algorithm enables parameter estimation
for probabilistic models with incomplete data [12].
As with aircraft structures, the service life of a bearing is mostly
limited by its fatigue strength. Due to uncertainties in determining the
material constants for life prediction, a probabilistic approach of life
estimation was applied as early as the 1920s [13]. The L10 life, which is
the amount of time that 90 % of a group of bearings will complete or
exceed (without failing due to rolling-element fatigue), is the basis for
calculating bearing life and reliability.

⁎
Corresponding author.
E-mail address: dongsuchoi@mnd.go.kr (D. Choi).

https://doi.org/10.1016/j.ress.2019.106628
Received 13 February 2019; Received in revised form 12 July 2019; Accepted 31 August 2019
Available online 26 September 2019
0951-8320/ © 2019 Published by Elsevier Ltd.
D. Lee and D. Choi
Although the life of a bearing is affected by many factors, it is
predicted using only the dynamic load capacity and applied load on the
bearing. The concept of rolling bearing rating life and basic load rating
(load carrying capacity) were introduced by A. Palmgren in 1937 [14].
The 1952 Lundberg and Palmgren report on ‘Dynamic Capacity of
Rolling Bearings’ is still the basis for all bearing life calculations [15].
At the time of Palmgren, the dominant failure mode was subsurface
cracks initiated at voids and inclusions [16]. The basic rated life and the
dynamic load rating represent the subsurface fatigue performance of
the bearing. The improvements in bearing fabrication techniques sig-
nificantly reduced the risk of subsurface cracks. Instead, lubrication and
contamination are now the two most important modes of failure [17].
In principle, the same dynamic load rating is obtained for bearings
with the same internal geometry, although they may have different
surface microgeometry, waviness, raceway, rolling element profilo-
metry, shape, internal precision tolerances, material fatigue strength,
and type of heat treatment [16]. Thus, ISO 281:2007 introduced a life
modification factor, aISO, which is a function of the lubrication regime,
contamination, and fatigue stress limit. Further, aISO is a nonlinear life
modification factor, and may result in an infinitely long bearing service
life. The benefit of introducing this factor is that it considers environ-
mental effects such as lubrication and contamination, which are the two
dominant failure modes of bearings. The use of aISO has been ex-
tensively debated, especially for the existence of the fatigue load limit
[13,16,18]. However, evidences of the benefits of the ISO life mod-
ification factor has been accrued over many years [16].
In this study, the RBI was developed for a starter-generator using the
process of reliability-centered maintenance (RCM), and the modified
rating life model provided in ISO 281:2007. Field inspection records
were used for calibration and validation, and the assumed inspection
capability was considered for risk assessment. Suitable actions were
recommended to solve operational difficulties.
2. Theoretical Background
2.1. Bayesian network
In the following, a brief introduction to BN is given, limited to the
case of discrete random variables, i.e., random variables that are de-
fined in a finite space.
The BN is a directed acyclic graph (DAG), which is described by
nodes and edges [19]. Nodes represent random variables and edges
denote dependencies among them [20]. Fig. 1 shows a simple BN,
where node ’A’ is the parent of node ’B’ and ’C’, and both ’B’ and ’C’ are
the children of ’A’, A node with no parent has its own probability dis-
tribution, and a node with parents has a joint probability distribution of
itself and its parents. The joint probability mass function (PMF) of this
network (Fig. 1) is given by the probability chain rule.
Pr(a, b, c ) = Pr(a)Pr(b | a)Pr(c | a) (1)
where Pr(b | a) is the conditional PMF of B given A, and so is Pr(c | a) .
Evidence update the BN. For example, when the state B in the
network in Fig. 1 is observed to be e, this information propagates
through the network and the joint PMF of A and C changes according to
Bayes’ rule to
Fig. 1. Simple BN.
2
Reliability Engineering and System Safety 195 (2020) 106628
Pr(a, e , c ) Pr(a)Pr(e | a)Pr(c | a)
Pr(a, c | e ) = =
Pr(e ) ∑a Pr(a)Pr(e | a) (2)
As a result, marginal posterior probabilities of A and C are also updated.
Note that without having any information about A, B and C are de-
pendent. Provided that A is known, B and C are independent because
communication between B and C is blocked by A. For a given set of
evidence, it is possible to infer the dependence assumptions encoded in
the graphical structure using the rules of d-separation [19].
A dynamic Bayesian network (DBN) is a special class of BN, which
represents stochastic processes. A group of BNs (slices) consists the
DBN, each of which represents the state of ith time step. From i to i + 1,
slices are connected by acyclic edges. A DBN is called homogeneous as
far as the model structure and the conditional probability tables are
unchanged. A number of inference algorithms for DBN were developed
[21], and software packages are also available.
2.2. Expectation maximization algorithm
The EM is used to estimate parameters in probabilistic models with
incomplete data. The EM algorithm alternates between the steps of
guessing a probability distribution over completions of missing data
given the current model (known as E-step) and then re-estimating the
model parameters using these completions (known as the M-step) [12].
During E-step, one does not usually need to form the probability dis-
tribution over completions explicitly, but rather need only to compute
‘expected’ sufficient statistics over these completions. E-step makes the
objective function has one global maximum that can be computed in
closed form. M-step comes from the fact that model re-estimation can
be thought of as ‘maximization’ of the expected log-likelihood of the
data.
More formally, the EM algorithm augments the observed data, D,
with latent data, Z, so that the augmented posterior distribution p(θ | Z,
D) is simple [22]. In the most general setting, the E-step consists of
computing
Q (θ , θi ) = ∫Z log[p (θ | Z , D)] p (Z | θi , D) dZ (3)
where p(θ | Z, D) denotes the augmented posterior, and p(Z | θ , D) is the i
conditional predictive distribution of the latent data which is condi-
tional on the current guess of the posterior mode. The Q function is the
expectation of log [p(θ | Z, D)] with respect to p(Z | θi, D). In the M-step
the Q function is maximized with respect to θ to obtain θi + 1.
As with most optimization methods for nonconcave functions, the
EM algorithm comes with guarantees only of convergence to a local
maximum of the objective function (except in degenerate cases).
Running the procedure using multiple initial starting parameters is
often helpful; similarly, initializing parameters in a way that breaks
symmetry in models is also important [12].
2.3. Rolling bearing life prediction
The Lundberg and Palmgren theory [15] developed the basis for the
calculation of the dynamic load rating and equivalent dynamic load of
rolling bearings as it is applied today in the ISO 281 [23] basic rating
life equation:
p
C
L10 = ⎛ ⎞
⎝P⎠ (4)
where L10 is the rated fatigue life, at 90 % reliability in million re-
volutions, C is the basic dynamic load rating or capacity, P is the
standardized dynamic equivalent load or applied load, and p is the life
equation exponent. The basic dynamic load rating, C, is defined as a
calculated constant radial load which a group of identical bearings can
theoretically endure for a rating life of one million revolutions. The
standardized dynamic equivalent load, P, is defined as the equivalent
radial load on the bearing which will result in the same life as the actual
D. Lee and D. Choi Reliability Engineering and System Safety 195 (2020) 106628

Fig. 2. ISO life modification factor, aISO, given C = 13.5 kN, eC = 1.

Fig. 3. Starter-generator for Hawker 800XP.

load and rotation conditions. The variable C can be viewed as the

The starter-generator is an important part of aircraft electrical sys-
strength of a bearing, and P is the applied load. Eq. (4) is suitable for
tems. The role of the starter-generator is to start the engine and to
bearings with extremely high load C/P ∼ 2. However, its predictability
generate electricity during flight. Modern aircraft have a high electrical
decreases under normal operation conditions with much lower load and
power requirement due to their multiple avionic systems, and each
an extended amount of time [16].
engine usually has at least one starter-generator. In general, an aircraft
ISO 281:2007 introduced life modification factor, aISO, which is the
has multiple starter-generators and batteries to provide backup. If a
function of lubrication regime, contamination, and fatigue stress limit.
single starter-generator fails, another generator should supply power to
e C the system. Generator malfunction is quickly detected by the pilot,
aISO = f ⎛ C u , κ ⎞
⎝ P ⎠ (5) because a warning light is triggered as soon as the voltage drops below
a specified level. Multiple backup batteries can also supply electricity
κ is the lubrication regime, which is the ratio of the actual viscosity of
for a certain amount of time in case all the starter-generators have
the lubricant in the bearing to a “reference viscosity”, ec is the con-
failed. Even without electrical power from a starter-generator or bat-
tamination, which is the ratio of the maximum internal stress in a clean
teries, an aircraft can fly and land safely under visual flight rules (VFR).
contact to the stress in contaminated contact, and Cu is the fatigue stress
However, aborting the mission is inevitable in such cases.
limit, the load where the fatigue limit of the bearing material is just
The starter-generator (Fig. 3) studied in this paper is from the
reached. aISO is a highly nonlinear function as shown in Fig. 2. The
Hawker 800XP aircraft operated by the Republic of Korea Air Force.
modified rating life is shown below.
The Hawker 800XP has two engines, each with a starter-generator. The
Lnm = a1 aISO L10 (6) starter-generator in the Korean Hawker 800XP has a higher capacity
where a1 is the modification factor for reliability, equal to unity with 90 than similar aircraft to supply electrical power to additional equipment,
% reliability and less than unity with reliability higher than 90 %. and is thus assigned as a time change item (TCI). Although it is not
uncommon to designate a starter-generator as a TCI, some equivalent
starter-generators are designated as on condition items (OCI). Origin-
2.4. Reliability centered maintenance
ally, the replacement interval for the starter-generator was 1000 h.
However, due to the high failure rate during its initial operation, this
The RCM process is used to determine what must be done to ensure
interval was reduced by 300 h, resulting in significantly higher costs.
that any physical asset functions the way its users want it to do in its
After switching from steel to hybrid ceramic bearings (ceramic rolling
present operating context [24]. The RCM process entails asking seven
elements on steel races), a new time interval of 600 h was set. However,
questions about the asset or system under review, as follows:
the new interval is still too short for a transport aircraft.
Table 1 shows the performance standard of the starter-generator.
1. What are the functions and associated performance standards of the
When an asset is unable to fulfill its function to an acceptable standard
asset in its present operating context? (function)
of performance, a functional failure occurs [24]. For a starter-generator,
2. In what ways does it fail to fulfill its functions? (functional failure)
a functional failure occurs when it cannot provide enough electrical
3. What causes each functional failure? (failure mode)
power to start the engine and power the avionics. Failure modes are
4. What happens when a failure occurs? (failure effects)
events that are reasonably likely to cause a failed state [24]. By
5. In what way does a failure matter? (failure consequences)
6. What can be done to predict or prevent a failure?
7. What should be done if a suitable proactive task cannot be found? Table 1
Starter-generator performance standard.
The most important task of RCM is to find a suitable proactive measure
Characteristics Requirement
by assessing the risk of the system of interest.
Voltage/Current 30 V/550 A
3. Starter-generator and electrical system fault tree analysis Speed Range 7800 to 12000RPM
Overload Capability 825 A for 2 min
Efficiency 70 % Minimum at 550 A and 12000RPM
The first five questions (function, functional failure, failure mode,
Weight 24.72 kg Maximum
failure effects, and failure consequences) of the RCM process must be Drive Shaft Shear Torque 180.78 N m
answered before developing methods to predict or prevent failures.

3
D. Lee and D. Choi Reliability Engineering and System Safety 195 (2020) 106628

Table 2
Starter-generator inspection data with the detection of failure indications.
Year Time Type Year Time Type Year Time Type

2004 408.43 Failed 2004 591.18 Returned 2004 600.97 Returned

2004 599.92 Returned 2004 599.23 Returned 2004 595.55 Returned
2004 596.85 Returned 2004 596.18 Returned 2004 185.02 Failed
2004 599.27 Returned 2004 485.22 Failed 2004 595.62 Returned
2004 597.85 Returned 2004 596.45 Returned 2004 591.57 Returned
2004 593.28 Returned 2004 596.32 Returned 2004 599.82 Returned
2005 595.13 Returned 2005 589.28 Returned 2005 595.27 Returned
2006 598.67 Returned 2006 498.35 Failed 2006 595.17 Returned
2006 118.47 Failed 2006 591.07 Returned 2005 595.45 Returned
2006 590.68 Returned 2006 596.10 Returned 2006 586.57 Returned
2007 596.42 Returned 2007 598.15 Returned 2006 596.43 Returned
2006 294.92 Returned 2007 598.48 Returned 2007 5.12 Failed
2006 597.47 Returned 2006 605.98 Returned 2006 597.05 Returned
2006 267.35 Failed 2006 594.85 Returned 2007 283.33 Failed
2006 596.45 Returned 2006 595.85 Returned 2006 598.95 Returned
2007 591.42 Returned 2006 578.13 Returned 2007 253.32 Failed
2007 594.45 Returned 2007 423.75 Failed 2006 590.98 Returned
2007 426.18 Failed 2007 588.98 Returned 2007 591.37 Returned
2007 590.72 Returned 2007 585.33 Returned 2007 581.57 Returned
2007 576.22 Failed 2007 556.07 Returned 2007 588.62 Returned
2007 587.43 Returned 2007 588.53 Returned 2007 589.58 Returned
2008 599.20 Returned 2008 591.17 Returned 2008 590.03 Returned
2008 595.78 Returned 2008 594.60 Returned 2008 588.33 Returned
2009 110.53 Failed 2008 588.80 Returned 2008 596.60 Returned
2008 492.05 Failed 2008 595.07 Returned 2008 536.98 Failed
2008 593.45 Returned 2008 589.00 Returned 2008 590.45 Returned
2009 593.50 Returned 2009 599.63 Returned 2009 580.12 Returned
2009 586.47 Returned 2009 590.68 Returned 2009 591.30 Returned
2009 575.73 Returned 2009 593.98 Returned 2009 595.02 Returned
2009 582.62 Returned 2009 577.85 Returned 2009 588.62 Returned
2010 321.47 Failed 2009 583.80 Returned 2009 588.60 Returned
2010 592.42 Returned 2009 590.00 Returned 2010 595.33 Returned
2010 592.77 Returned 2010 372.15 Failed 2010 254.45 Failed
2011 597.83 Returned 2011 599.37 Returned 2010 592.75 Returned
2010 592.63 Returned 2010 592.63 Returned 2011 586.28 Failed
2011 595.67 Returned 2010 593.55 Returned 2011 586.67 Returned
2010 587.60 Returned 2011 592.05 Returned 2011 594.42 Returned
2011 598.50 Returned 2011 590.73 Returned 2011 594.27 Returned
2011 593.45 Returned 2010 592.97 Returned 2011 594.80 Returned
2011 556.00 Returned 2011 560.20 Returned 2011 560.20 Returned
2011 593.45 Returned 2011 592.35 Returned 2011 580.63 Returned
2012 497.40 Failed 2012 590.58 Returned 2012 575.45 Returned
2012 567.10 Returned 2012 581.43 Returned 2012 591.72 Returned
2012 597.67 Returned 2012 592.15 Returned 2012 595.30 Returned
2012 589.18 Returned 2012 593.42 Returned 2012 589.82 Returned
2013 468.25 Failed 2012 565.58 Returned 2012 591.85 Returned
2013 595.65 Returned 2013 597.00 Returned 2012 597.65 Returned
2012 597.65 Returned 2013 590.97 Returned 2013 589.15 Returned
2013 594.65 Returned 2013 251.42 Failed 2013 590.00 Returned
2013 596.53 Returned 2013 594.55 Returned 2013 599.05 Returned
2013 593.75 Returned 2014 586.18 Returned 2013 593.13 Returned
2013 595.05 Returned 2014 595.28 Returned 2014 595.33 Returned
2014 598.53 Returned 2014 371.55 Failed 2014 594.62 Returned
2014 595.05 Returned 2014 417.80 Failed 2014 593.77 Returned
2014 596.05 Returned 2014 598.02 Returned 2014 598.28 Returned
2014 593.88 Returned

examining the maintenance records, which have been collected since
2004, 166 cases of starter-generator failure were found (Table 2).
Within these 166 cases, 24 starter-generators required replacement, and
of these 24 cases, 21 starter-generators were exchanged due to bearing
defects. Thus, it is reasonable to conclude that the failed state is largely
caused by bearing failure.
There are two bearings in the starter-generator, both of which are
hybrid ceramic bearings with ceramic balls. An equivalent bearing with
steel balls has a basic dynamic load rating of 13.5 kN and a fatigue load
limit of 0.28 kN (www.skf.com). Ceramics have a higher modulus of
elasticity than high carbon steel. Therefore, in the ceramic bearings, the
smaller deformation of the rolling elements (balls or rollers) generates a
higher stress at the contact point between the rolling elements and the
raceway, when compared to a steel bearing. Because the life a bearing is
inversely proportional to stress, it will generally be lower for a hybrid
bearing than for a full complement steel bearing, as the elastic modulus
of ceramic is greater than that of steel in most cases [25]. The dynamic
load rating of hybrid ceramic bearings with rolling elements made of
silicon nitride is approximately 70 % that steel bearings [25].
There are four types of failure consequences: hidden failure con-
sequences, safety and environmental consequences, operational con-
sequences, and non-operational consequences [24]. The failure of the
starter-generator affects operations. The starter-generator is not a flight
safety-critical part. The only consequence of its failure is an aborted
mission.
The aircraft electrical system consists of two starter-generators and
four batteries. If both starter-generators fail, the two main batteries can
provide electrical power for 30 min. Additionally, there are two backup

4
D. Lee and D. Choi
Fig. 4. Fault tree of electrical system for risk analysis.
batteries, which can power the stand-by flight instruments for 30 min
when both main batteries are discharged. However, the backup bat-
teries have a smaller electrical capacity than the main batteries; hence,
the malfunction of a single backup battery will fail to power the stand-
by instruments. The failure of the entire electrical system can be de-
scribed by Fig. 4. In the fault tree, all nodes are connected by AND gates
except for the backup batteries (Batt3 and Batt4). The probability of
failure (POF) can be calculated as:
Pr(Sys. Fail = T ) = Pr(SG Fail = T )Pr(Batt. Fail = T )
Because the stand-by flight instruments can only be operated with both
backup batteries, an OR gate connects both backup batteries.
Pr(B/U Fail = T ) = 1 − Pr(Batt3 Fail = F )Pr(Batt 4 Fail = F )
where B/U stands for backup battery. Reliability and POF are mutually
exclusive.
Reliability = 1 − POF
To evaluate the reliability of the electrical system, the POF of both the
starter-generator and the battery are required.
Maintenance records indicate that the bearing is the weakest link of
the starter-generator. Thus, a bearing life model was utilized to estimate
the life of the starter-generator. There was no record of battery re-
placement due to failure. Considering no field failure has ever occurred,
the POF of the battery was conservatively assumed to be 1 %.
4. Field inspection data and survival analysis
The starter-generator of the Hawker 800XP is inspected at every
300 h of operation. The inspection is conducted to detect abnormal
vibration or sound, and signs of wear. The inspection procedures are
described in technical orders. The starter-generator is returned to the
contractor before 600 h of operation for an overhaul. Each aircraft flies
about 100 h per month; thus, the starter-generator needs to be replaced
every 6 months. Within 166 cases which have been collected since
Reliability Engineering and System Safety 195 (2020) 106628
Fig. 5. Weibull probability plot of starter-generator failure time.
2004, 24 starter-generators required replacement due to failures or
damages. Of these 24 cases, 21 starter-generators were exchanged due
to bearing defects, and the remaining 3 were non-bearing-related cases.
The failure data belong to two categories, post-failure and pre-failure.
The post-failure is a failure occurred during flight or pre-flight inspec-
tions via warning light. The pre-failure is damage found during a
scheduled inspection.
Failure data were plotted on a Weibull probability plot as shown in
Fig. 5. The data fitted well on the Weibull probability plot with a shape
parameter of 1.44 and a scale parameter of 2150. The shape parameter
which is the slope of the Weibull probability plot represents the char-
acteristics of failure rate. The shape parameter greater than the unity
indicates that the failure rate increases with time. The scale parameter
referred to as the characteristic life is the time at which 63.2 % of the
units will fail. An extreme value distribution such as the Weibull dis-
tribution can represent a system of which the strength strongly depends
on the strength of its weakest link. The life of a starter-generator de-
pends on the life of bearings (the weakest link); therefore, the Weibull
(7) distribution showed good fit with failure data. An estimated mean time
between failures (MTBF) is 1950 h with a 95 % Wald confidence in-
terval of 1031 h and 3689 h.
The collected data were also analyzed by survival analysis. Survival
(8) analysis is a method of getting an expected time when an event occurs,
and it is especially good to analyze right censored data, in which failure
time is unknown, as is the case for the starter-generator. The
Kaplan–Meier estimator is a method of modeling the survival curve. It
(9) amounts simply to calculating the survival probability for each time
interval t based on the event occurrences at that time [20]. From the
data, the survival probabilities are estimated as follows,
ni − di
S (t ) = ∏ ni
,
ti ≤ t (10)
where ni is the number of subjects at risk at the beginning of the time
interval ti, and di is the number of subjects who have not survived
during the time interval ti. In a Kaplan–Meier plot as shown in Fig. 6,
the survival after 600 h of operation is 85.42 %, and the upper and
lower limit values are 79.16 % and 90.04 %. The survival probability
was compared with the results obtained by a probabilistic model using
Bayesian network.
5. Probabilistic modeling using Bayesian network
The weakest link theory. i.e. the life of the shortest-lived component
of the system is the life of the system, was applied for the estimation of
5
D. Lee and D. Choi
Fig. 6. Kaplan–Meier survival analysis of starter-generator failure time.
the starter-generator life. Because bearings are the weakest link of the
starter-generator, it was assumed that the life of the starter-generator is
proportional to the life of the bearing described in Eq. (6).
LSG ∝ L10 (11)
Sensitivity analysis has been conducted to choose significant vari-
ables of the starter-generator life estimation model. Variance-based
methods using Sobol’s variance decomposition approach and an esti-
mated procedure was employed for this analysis [26]. Probable ranges
for each variable are listed in Table 3. It was assumed that the dynamic
load capacity of the equivalent steel ball bearing is the maximum, and
the minimum is 70 % of the maximum dynamic load capacity [25]. The
ratio of the dynamic load capacity and the applied load is ranged from 2
[16] to 20. The maximum ratio of 20 yields about 10 times longer basic
rating life than targeted time of operation (1000 h at 12000 RPM).
The bearing of the starter-generator is lubricated by grease. The
accepted view of grease behavior is that it acts as a reservoir releasing
oil into the rolled track and thus replenishing the contact [27]. The
main problem of grease lubrication is that the degradation of the film
thickness occurs much earlier than the life of a bearing [28]. κ is the
ratio of the viscosity of grease base oil and the reference kinematic
viscosity. In general, the kinematic viscosity of grease base oil is higher
than the reference kinematic viscosity. However, considering the de-
gradation of the film thickness, it was assumed that κ yields aISO less
than the unity given ranges of P, eC, and Cu. Because grease in sealed
and shielded bearings can provide an effective barrier against dust and
dirt, it was assumed that the contamination level maintains at least
normal cleanliness. This condition is typical of bearings greased for life
and shielded. According to ISO 281:2007, therefore, eC is ranged from
0.5 (normal cleanliness) to 1 (extreme cleanliness). The fatigue load
limit is the material parameter, and in general has the minimum var-
iance. In this study, 10 % variation was assumed.
Fig. 7 shows the result of the sensitivity analysis for the starter-
generator life, and the applied load (P) has the highest sensitivity in-
dices. In the probabilistic modeling, the dynamic load capacity (C) and
Table 3
Probable ranges of variables.
Name Variable Unit Probable range
Dynamic load capacity C kN 9.45-13.5
Capacity load ratio C /P - 2-20
Viscosity ratio κ - 0.1-0.4
Contamination factor eC - 0.5-1
Fatigue load limit Cu kN 0.25-0.31
6
Reliability Engineering and System Safety 195 (2020) 106628
Fig. 7. Global sensitivity analysis.
the viscosity ratio (κ) also need to be considered. Other variables, the
contamination factor (eC) and the fatigue load limit (Cu) were con-
sidered to be constant.
To predict the life of a starter-generator correctly, it was required to
obtain the accurate measurements of both the dynamic load capacity
and the applied load, which show variation due to factors like mea-
surement error and the inhomogeneity in materials. Because few air-
craft were in operation, it was impossible to measure the capacity and
the load experimentally. Prior distributions with best guesses were used
instead, to get the life distribution using the DBN model. Those priors
were updated with the field inspection data. A calibrated model was
used to obtain the life distribution and the reliability of the starter-
generator.
We represent the starter-generator life as a DBN model (Fig. 8).
Similar models were used by the authors to predict stress corrosion
crack and fatigue crack length [5,6]. Nodes (circles) in Fig. 8 represent
variables, and each node has its own conditional probability distribu-
tion (CPD). In the DBN model, each slice is the snapshot of the system at
a given time. The subscript N for each node denotes that the node be-
longs to Nth slice. CPN node represents the ratio of the dynamic load
capacity and the applied load. κN is the node for the viscosity ratio, and
eC,N node represents the contamination factor. The life of the starter-
generator is denoted by LSG,N node, which contain all the possible states
of it at Nth slice. ZN and RN are nodes for the inspection and the relia-
bility respectively. Among nodes, LSG,N and RN are query nodes. In-
spection node, ZN, is the only observable node. The probability dis-
tributions of the time-invariant model parameters, CPN, κN, and eC,N, are
updated with the observations. The posterior distributions of query
variables were obtained from Bayes’ theorem (Eq. (2)).
The inspection node, ZN, has two state: “detected” and “not de-
tected”. Each inspection process is characterized by its probability to
detect flaws of different sizes so that, given a particular flaw, there is
some probability of detection (POD) uniquely defined for that process
[29]. Because the life of a component is affected by the occurrence of
flaws, it was assumed that the size of the flaw shows a negative cor-
relation with the life of the component. At a current inspection op-
portunity, the starter-generator with shorter life expectancy is more
likely to have flaws than starter-generator with longer life expectancy.
Given a particular time of operation, RevN, the POD can, therefore,
be expressed as the function of the life of the starter-generator. RevN
was represented explicitly in the DBN model to emphasize that the POD
curve depends on the time of operation. The POD was expressed using
the cumulative distribution function (CDF) of the standard normal
distribution. Thus, two parameters, a mean and a standard deviation,
D. Lee and D. Choi Reliability Engineering and System Safety 195 (2020) 106628

Fig. 8. Dynamic Bayesian network for the starter-generator reliability analysis.

completely define an inspection system.

LSG − μPOD (tinsp) ⎞

POD = 1 − Φ ⎛ ⎜ ⎟

⎝ σPOD ⎠ (12)

where Φ is the CDF of the standard normal distribution, LSG is the life of
the starter-generator, tinsp is the time of operation at the inspection,
μPOD(tinsp) is the location parameter of the normal distribution function
at tinsp, and σPOD is the standard deviation of the POD model. In Eq. (12),
the POD increases as the life of the starter-generator decreases, because
the occurrence of flaws is more likely for the starter-generator has a
shorter life. The POD given a particular time of operation at an in-
spection is the same for all inspection process so that, the location
parameter, μPOD, is a linear function of tinsp. In general, two parameters
in Eq. (12) need to be estimated using the data collected from designed
experiments [30]. Because there’s no data available to evaluate the
effectiveness of inspection, the two parameters were calibrated to
match the POF at 600 h of operation from calibrated model to the POF
from the survival analysis (Fig. 6). Fig. 9 shows the POD model for the
analysis, and a possible improvement was also described. It was as- Fig. 9. Inspection effectiveness used for the analysis.
sumed that the mean is equal to tinsp, and the σPOD is 100 for the con-
ventional inspection. starter-generator is the area of the life distribution up to the current
The reliability node, RN, is the binary variable (0: failure; 1: no- time of operation.
failure). As shown in Eq. (9), POF is the complement of reliability. In
tc
node RN, the POF and the reliability are calculated consecutively. The POF = ∫0 LSG (t ) dt (14)
event of failure was determined by the limit state function.

g = LSG (t ) − tc
where tc is the current time of operation. The limit state is defined as
g = 0 . This is the boundary between the failure domain and the no-
failure domain in the starter-generator life space. The POF of the
(13) The prior distributions for each node are summarized in Table 4.
Posterior starter-generator life distributions were obtained using the
probabilistic model depicted in Fig. 8. A “forward-backward” algorithm
was utilized to conduct exact inferences. Murphy’s Bayesian Network
Toolbox [21] was used as an inference engine. Inference problems in

7
D. Lee and D. Choi
Table 4
Discretization scheme where nstate is the number of states.
Variable Distribution
LSG - 82
C Uniform(9.45, 13.5)
C /P Uniform(2, 20)
κ Uniform(0.1, 0.4)
eC Deterministic
Cu Deterministic
temporal models for deterioration processes can be distinguished as
filtering, prediction, and smoothing [11]. Filtering (or monitoring) is
the task of computing the posterior distribution over the state of time t
given evidence up to time t, and was conducted in this work.
To take advantage of the exact inference algorithm for the DBN
model, the distribution of each node needs to be discretized [31]. Static
discretization introduces an unknown error, which would be zero in the
limit as the size of the discretization intervals approaches zero. Despite
increasing use of a dynamic discretization method, static discretization
was used in this work for simplicity. To verify the appropriateness of
the discretization scheme (Table 4) used in this work, the inference
using Monte Carlo simulation (MCS) was compared with the DBN re-
sult, as shown in Fig. 10. As can be seen in the figure, both results match
well, so the current discretization scheme was reasonably accurate.
6. Calibration and validation
Even with non-informative priors, the DBN model provides mean-
ingful information by updating posteriors with data. Because of the
limited number of failure data, predictions were weighted averages of
subjective opinion (priors) and evidence (inspection results). As the
number of updates increases, the calibrated and uncalibrated posteriors
approach each other. It is, however, still important to obtain more
appropriate priors to make a more accurate initial prediction.
Calibration was carried out to acquire prior distributions of the nodes,
C0, CP0 and κ0, in the DBN model using field inspection data including
the no detection cases as explained in Section 4.
There are two types of inspection data, detected and not detected.
For each case, the posterior starter-generator life distribution was cal-
culated. With detected failure, the posterior starter-generator life dis-
tribution is calculated as
f (LSG | Z = D) ∝ f (Z = D | LSG ) f (LSG ; N ) (15)
Fig. 10. Reliability index calculated from both the DBN model and Monte Carlo
simulation (MCS).
Reliability Engineering and System Safety 195 (2020) 106628
nstate Interval boundaries
0, exp(log(0.01): (log(200) − log(0.01))/79): log(200)), ∞
22 0, 9.45: 4.05/19: 13.5, ∞
22 0, 2: 18/19: 20, ∞
22 0, 0.1: 0.3/19: 0.4, ∞
1 0.5
1 0.28
Fig. 11. The effect of the probability of detection on the starter-generator life
distribution.
where f (Z = D | LSG ) is the POD. In the other case, the posterior dis-
tribution is calculated as
f (LSG | Z = ND) ∝ f (Z = ND | LSG ) f (LSG ; N ) (16)
where f (Z = ND | LSG ) is the probability of no-detection (PND).
Fig. 11 shows the numerical example of the effect of inspection on
the distribution of the life of the starter-generator. In the example, the
inspection was conducted at 300 h of operation. Because no failures are
detected, the area of the life distribution under the POD curve was
diminished. As a result, the reliability has been increased after the in-
spection. Improved inspection capability or implementation of the
better inspection methods move the life distribution more to the right.
For the calibration of the starter-generator life model, it was also as-
sumed that all returned starter-generators function properly, and they
were inspected by the contractor with the same POD as in-service in-
spection.
The field inspection data only provide information for node ZN. Due
to incomplete data, an EM algorithm was utilized for parameter in-
ference. It was assumed that the priors of the three variables (C0, CP0,
κ0) are uniformly distributed. Fig. 12 show the mass functions of the
two variables (CP0, κ0) of Eq. (6)before and after the calibration. An-
other variable (C0), showed almost the same mass function after the
calibration. The priors in Fig. 12 yielded shorter MTBF than the data
shown in Fig. 5. The calibration updates priors to match predicted
values with maintenance data. Thus, both the load ratio (CP0), and the
viscosity ratio (κ0), were shifted right to increase the life of the starter-
generator.
As discussed earlier, a prediction made by the DBN model is the
weighted average of subjective opinions (priors) and evidence (main-
tenance records). Fig. 13 shows reliability projections using various
models. The uncalibrated model yielded an initial sharp decrease in the
reliability. After calibration, posterior reliabilities approach curves
calculated by the Kaplan–Meier model and the Weibull model. How-
ever, the value is still under the reliabilities by both models. This is
8
D. Lee and D. Choi Reliability Engineering and System Safety 195 (2020) 106628

Fig. 12. Calibrated (a) CP0 and (b) κ0 for starter-generator life prediction.

has the maximum integration value when compared to other cases,

because the likelihood does not change the shape of the prior crack
length distribution.
In this work, k-fold cross-validation was used, which partitions the
original data into k equally sized sets, and then in each iteration, one
partition is held as test data, and all the remaining sets train a model.
Before the partition, the inspection data was shuffled randomly, and
divided by n. There are also two cases for validation data. The first case
is that the failure was not detected.
∞
Pr(D | H0) ∝ ∫0 f (Z = ND | LSG ) f (LSG ; N ) dLSG (18)

The second case is that the failure was detected.

∞
Pr(D | H0) ∝ ∫0 f (Z = D | LSG ) f (LSG ; N ) dLSG (19)

The denominator of Eq. (17) was obtained using Eqs. (18) and (19).
We have, however, no prior knowledge of the distribution of crack
length under H1. Thus, a uniform distribution for f(LSG; N) was used as a
Fig. 13. Comparison of reliability predictions by the Kaplan-Meier (K-M) non-informative prior for H1.
model, the Weibull model, and the DBN model (calibrated and uncalibrated). Assuming that the inspections were conducted in a timely manner
and the result of each inspection is Di, then maintenance data D consists
of D1, D2, D3, ..., Dn. Provided that each inspection was conducted in-
because the effect of priors was still influential in the calibrated model.
dependently, an event observing inspection result (D) is the intersection
In other words, the number of data for the calibration was not enough
of data (Di). The Bayes factor for each inspection data (Di) is Bi. The
to overcome the effect of priors. Because both the Kaplan–Meier model
total Bayes factor can then be calculated using the independence of the
and the Weibull model are data-driven models, the quality of prediction
inspections as follows:
is largely affected by the number of data available. When there are not
enough data records to learn from, data-driven models’ estimates pro- Pr(D | H0 )
B =
vide poor quality of survival prediction [20]. However, the DBN model Pr(D | H1)
can make up for the lack of data records by knowledge of experts. From Pr(D1 ∩ D2…∩Dn | H0 )
engineering perspective, the conservative prediction by the DBN model =
Pr(D1 ∩ D2…∩Dn | H1)
is more appropriate. Pr(D1 | H0 )Pr(D2 | H0 )…Pr(Dn | H0 )
Validation tests the confidence that can be placed on the calibrated =
Pr(D1 | H1)Pr(D2 | H1)…Pr(Dn | H1)
model. Following Sankararaman et al. [4] the calibrated model was
= B1 B2…Bn (20)
validated using a Bayes factor. The Bayes factor is the ratio of the
likelihoods of the two hypotheses for the correctness of the model: H0 The total Bayes factors calculated by Eq. (20) using 8-fold cross-vali-
that the model is correct, and H1 that the model is incorrect: dation are shown in Fig. 14 The confidence of the calibrated model can
be tested from the posterior probability of the null hypothesis, which
Pr(D | H0)
B= determines if “the model is correct”, and is as follows:
Pr(D | H1) (17)
Pr(D | H0)Pr(H0) B
If B is greater than unity, the null hypothesis (H0) can be accepted, and Pr(H0 | D) = =
Pr(D | H0)Pr(H0) + Pr(D | H1)Pr(H1) B+1 (21)
the model has been validated. The numerator of Eq. (17) is proportional
to the integration of the not normalized posterior distribution of crack The higher the posterior probability, the more likely it is that the ca-
length given measurement data. For example, with a perfect prediction, librated model is correct. For example, if the total Bayes factor is equal
the starter-generator life distribution (prior distribution) at rotation N is to the unity, the posterior probability of the calibrated model is 50 %,
the same as the updated distribution (posterior distribution) obtained which indicates that both hypotheses are equally likely. In this context,
by inspection data. In this case, the unnormalized posterior distribution confidence is not the same as confidence intervals in statistical

9
D. Lee and D. Choi
Fig. 14. Result of model validation obtained using 8-fold cross-validation.
Table 5
Tabular probabilities of each node for risk analysis.
Node name POF Reliability
Starter-Generator (SG1, SG2) 17 % 83 %
Main Batt. (Batt1, Batt2) 1% 99 %
Backup Batt. (Batt3, Batt4) 1% 99 %
hypothesis testing. Because the calculated total Bayes factor is a big
number, the confidence of the calibrated model were above 80 %.
7. Recommended Action
Two remaining RCM questions are as follows:
6. What can be done to predict or prevent a failure?
7. What should be done if a suitable proactive task cannot be found?
There are two options for the first of the remaining questions. They are
scheduled restoration/discard tasks and on-condition tasks [24]. Con-
sidering the cost and difficulties to implement an on-condition main-
tenance scheme, a scheduled restoration (scheduled maintenance) is a
reasonable action for the starter-generator.
An inspection needs to be conducted when the reliability ap-
proaches a control level, Rctrl. In this work, the decision maker wants to
extend the time of operation up to 1000 h. The reliability of the starter-
generator was 83 % with the current change interval of 600 h. Given
the reliability of the starter-generators and the batteries, the risk of the
electrical system can be obtained using the fault tree shown in Fig. 4. As
mentioned in the previous section, the POF of batteries was assumed to
be 1 % due to the lack of failure data. The POF and the reliability for
each node are shown in Table 5. Using the Eqs. (7) and (8), the cal-
culated POF of the electrical system was 5.75 × 10−8 . In general, the
probability of occurrence less than 10−6 can be interpreted as “im-
probable”.
Even with the shut down of the whole electrical system, aircraft can
land safely under VFR. In this case, however, loss of communication can
occur, and visible ranges may be limited due to bad weather. The se-
verity can be categorized as “Critical” or “Catastrophic”. According to
the risk assessment matrix provided by MIL-STD-882E “System Safety”
[32], the risk due to the failure of the starter-generator and subsequent
electrical system shut down is “Medium”, which is the second lowest
among possible risk levels. Considering the very low probability of
failure of aircraft electrical system, it was determined that the starter-
10
Reliability Engineering and System Safety 195 (2020) 106628
Fig. 15. Changes of reliability with or without inspection.
generator reliability of 83 % is the reasonable value to decide when to
inspect.
Using the calibrated model, the reliability of the starter-generator
was predicted for the time of operation over 600 h. It was assumed that
inspections will be conducted if the predicted reliability reaches the
control level. Fig. 15 indicates that with conventional inspections at
300 h, 600 h and 800 h, the targeted reliability can be achieved. Jumps
in reliability do not mean an improvement of the physical condition of
the starter-generator, but the update of prior knowledge (model based
life prediction) by data information (inspection data). Using inspection
methods with improved POD, a higher reliability jump can be achieved,
and a longer inspection interval may be applied. In Fig. 15, the starter-
generator inspected by methods with the improved capability (Fig. 9)
clearly shows the extended inspection interval. The last question related
to is not applicable, because there exists a suitable proactive task.
8. Conclusion
Based on the procedure of the RCM scheme, the possibility of ex-
tending the replacement interval of the starter-generator of the Hawker
800XP was examined. Because the starter-generator was not a flight
safety-critical part, it was concluded that the extension was possible
with a suitable inspection plan. Failure of the weakest link (bearings)
caused malfunction of the starter-generator. The life of a starter-gen-
erator was estimated based on the bearing life model. The DBN model
was utilized to consider uncertainties in model parameters and the
conditional probability of inspections, and the life distribution was
obtained. The model was calibrated and validated using maintenance
data obtained since 2004. A calibrated model was used to get reliability
for 600 h which was the current change interval. With inspections at
600 h and 800 h, maintaining a targeted reliability level was shown to
be possible.
References
[1] Lincoln JW. Method for computation of structural failure probability for an aircraft.
Tech. Rep., ASD-TR-80-5035. Aeronautical Systems Division Wright-Patterson AFB;
1980.
[2] Gallagher JP, Babish CA, Malas JC. Damage tolerant risk analysis techniques for
evaluating the structural integrity of aircraft structures. Proceedings of 11th
International Conference on Fracture 2005. Turin, Italy: Curran Assciates, Inc.;
2005. p. 71–6.
[3] White P. Review of methods and approaches for the structural risk assessment of
aircraft. Tech. Rep., DSTO-TR-1916. Defense Science and Technology Organisation;
2006. http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&
identifier=ADA462955.
[4] Sankararaman S, Ling Y, Mahadevan S. Uncertainty quantification and model va-
lidation of fatigue crack growth prediction. Eng Fract Mech 2011;78(7):1487–504.
D. Lee and D. Choi
https://doi.org/10.1016/j.engfracmech.2011.02.017. http://linkinghub.elsevier.
com/retrieve/pii/S0013794411000865.
[5] Lee D, Huang Y, Achenbach JD. Probabilistic analysis of stress corrosion crack
growth and related structural reliability considerations. J Appl Mech
2016;83(2):021003. https://doi.org/10.1115/1.4031899. http://
appliedmechanics.asmedigitalcollection.asme.org/article.aspx?doi=10.1115/1.
4031899..
[6] Lee D, Achenbach JD. Analysis of the reliability of a jet engine compressor rotor
blade containing a fatigue crack. J Appl Mech 2016;83(4):041004. https://doi.org/
10.1115/1.4032376. http://appliedmechanics.asmedigitalcollection.asme.org/
article.aspx?doi=10.1115/1.4032376.
[7] Torng TY, Edwards RM, Morgan J. B-1 maintenance schedule impact based on risk
assessment results. Proceedings of the Aircraft Structural Integrity Program
Conference. 2007. p. 1–28.
[8] Straub D, Goyet J, Sorensen JD, Faber MH. Benefits of risk based inspection plan-
ning for offshore structures. Proceedings of 25th International Conference on
Offshore Mechanics and Arctic Engineering, Hamburg. 20060-7918-4748-9. p.
59–68. https://doi.org/10.1115/OMAE2006-92089. http://proceedings.
asmedigitalcollection.asme.org/proceeding.aspx?articleid=1598405.
[9] U.K. Ministry of Defense. DEFSTAN 00-970 Design and Airworthiness Requirements
for Service Aircraft. 1983.
[10] U.S. Department of Defense. JSSG-2006 Aircraft Structure. 1998.
[11] Straub D. Stochastic Modeling of Deterioration Processes through Dynamic
Bayesian Networks. J Eng Mech 2009;135(10):1089–99. https://doi.org/10.1061/
(ASCE)EM.1943-7889.0000024. http://ascelibrary.org/doi/abs/10.1061/(ASCE)
EM.1943-7889.0000024.
[12] Do CB, Batzoglou S. What is the expectation maximization algorithm? Nature
Biotechnol 2008;26(8):897–9. https://doi.org/10.1038/nbt1406arXiv:1011.
1669v3. https://www.nature.com/nbt/articles?type=primer.
[13] Zaretsky EV. Rolling bearing life prediction, theory, and application. Tech. Rep.,
NASA/TP2013-215305. NASA Glenn Research Center; 2013.
[14] Palmgren A. On the carrying capacity and life of ball bearings. Ball Bearing J
1937(3):34–44.
[15] Lundberg G, Palmgren A. Dynamic capacity of roller bearings. Acta Polytechnica
Mech Eng Series 1952;2(4).
[16] Gabelli A, Doyer A, Morales-Espejel G. The modified life rating of rolling bearings: a
criterion for gearbox design and reliability optimization. Power Trans Eng
2015(March):46–54. http://www.powertransmission.com/articles/0315/The_
Modified_Life_Rating_of_Rolling_Bearings:_A_Criterion_for_Gearbox_Design_and_
Reliability_Optimization.
11
Reliability Engineering and System Safety 195 (2020) 106628
[17] Glantz W. Contamination in lubrication systems for bearings in industrial gear-
boxes. Ball Bear J 1993(242):20–6.
[18] TLT. ISO 281:2007 bearing-life standard-and the answer is? Tribol Lubr Technol
2010;66(7):34–36,38–43.
[19] Jensen FV, Nielsen TD. Bayesian networks and decision graphs. Springer Science
+Business Media, LLC; 2007.
[20] Kraisangka J, Druzdzel MJ. Discrete Bayesian network interpretation of the Cox’s
proportional hazards model. PGM 2014: Probabilistic Graphical Models. 11.
20149783319114330. p. 238–53. https://doi.org/10.1007/978-3-319-11433-0_16.
http://link.springer.com/10.1007/978-3-319-11433-0_16.
[21] Murphy KP. Dynamic Bayesian networks: representation, inference and learning.
University of California, Berkeley; 2002. Ph.D. thesis. http://www.ee.uwa.edu.au/
~roberto/research/projectsbiblio/10.1.1.93.778.pdf.
[22] Tanner MA. Tools for statistical inference. New York, NY: Springer-Verlag New
York, Inc.1461240247; 1993. https://books.google.com/books?id=
CAPrBwAAQBAJ&pgis=1.
[23] International Organization for Standardization. ISO 281:2007 rolling bear-
ings–dynamic load ratings and rating life. 2010.
[24] Moubray J. Reliability centered-maintenance. New York, NY: Industrial Press Inc.;
1997.
[25] Zaretsky EV, Chiu YP, Tallian TE. Ceramic bearings for use in gas turbine engines. J
Mater Eng Perform 2013;22(10):2830–42. https://doi.org/10.1007/s11665-013-
0726-5.
[26] Saltelli A, Ratto M, Andres T, Campolongo F, Cariboni J, Gatelli D, et al. Global
sensitivity analysis: the primer. John Wiley & Sons; 2008.
[27] Cann PM. Starved grease lubrication of rolling contacts. Tribol Trans
1999;42(4):867–73. https://doi.org/10.1080/10402009908982294.
[28] Svoboda P, Kostal D, Kunak J, Krupka I. Study of grease behaviour in a starved
lubricated contact. MM Sci J 2014:465–9.
[29] Committee on Nondestructive Testing of Aerospace Systems. Economic and man-
agement aspects of nondestructive testing, evaluation, and inspection in aerospace
manufacturing. Tech. Rep.. National Materials Advisory Board; 1977. https://doi.
org/10.1360/zd-2013-43-6-1064.
[30] Lee D, Yang S, Park J, Baek S, Kim S. Investigation of detectable crack length in a
bolt hole using eddy current inspection. Trans Korean Soc Mech Eng A
2017;41(8):729–36.
[31] Fenton NE, Neil MD. Risk Assessment and Decision Analysis with Bayesian
Networks. Boca Raton, FL: The CRC Press1439809119; 2012.
[32] U.S. Department of Defense. MIL-STD-882E System Safety. 2000.