Degree of Fault Tolerance as a Comprehensive Parameter for Reliability Evaluation of Fault Tolerant Electric Traction Drives

This paper describes a new approach and methodology of quantitative assessment of the fault tolerance of electric power drive consisting of the multi-phase traction electric motor and multilevel electric inverter. It is suggested to consider such traction drive as a system with several degraded states. As a comprehensive parameter for evaluating of the fault tolerance, it is proposed to use the criterion of degree of the fault tolerance. For the approbation of the proposed method, the authors carried out research and obtained results of its practical application for evaluating the fault tolerance of the power train of an electrical helicopter.


I. INTRODUCTION
With the constant growth of complexity of modern engineering systems it becomes more complicated to achieve the required level of sustainable and safety operation.The task of implementing the specified requirements is closely related to the problem of the most accurate assessment of indicators of sustainable operation of the system, shown in Fig. 1.Particularly important is to assess the required reliability and security for the safety-critical systems correctly.In safetycritical applications such as vehicle propulsion systems, the fault tolerance of all the equipment is obligatory.According to the plans for the electrification of various types of vehicles based on the electric energy generated by renewable sources, the tasks of a quantitative estimation of fault tolerance in creating of the safety-critical systems have now become very topical.

Fig.1. Indicators for sustainable operation
One of the most important requirements for the vehicle's propulsion system is the level of fault tolerance.In other words, the vehicle's propulsion system should operate and continue its sustainable functioning even if one or more of its components have failed.
To implement this requirement, all components included in the system should be fault tolerant.As an example of practical use of the proposed method the fault tolerance of a two main parts of the vehicle's propulsion system -traction multi-phase permanent magnet synchronous motor (PSM) of electrical helicopter and electric inverter in conventional and multilevel versions were evaluated.In this case, according to the specified requirements of a safe flight of the designed electrical helicopter, the total failure rate for the entire traction drive of designed electrical helicopter should be less than 10 -9 /h [1].
Due to the constant need of traction electrical machines for special application, there are many publications describing the comparison or analysis of different fault tolerant electric machines and electric inverter topologies for different vehicle applications [1]- [7] and [8]- [12].Thus, it should be noted that the authors generally have studied various aspects of the fault tolerance, and in most cases only a qualitative assessment was performed.For example in [1] a qualitative method for the fault tolerance evaluation is proposed, which results are given in Table I.Modern methods for determining the degree of fault tolerance of electrical machines, power electronics, and the computer network topology are presented in [13]- [15] and [28]- [31].The proposed methods have one typical common disadvantage -the lack of universality.Each of them allows solving a local specific problem for a particular object.
The authors have proposed a new universal approach and developed the methodology of assessing the degree of fault tolerance (DOFT) of safety-critical systems as a whole, as well as the DOFT of their components.

A. Degree of Fault Tolerance
Considering the definition of the fault tolerance of a technical system as an ability to maintain the required functional level of the system in case of one or more failures of its components, DOFT can be defined as the amount of time which the system may remain in a degraded state without irreversible changes in its functionality.Mathematically, in general form this can be written by ( 1): (1) where WR and WN -reduced and nominal values of performance of technical system; t i , tN -respectively, duration of functioning after i-number of failures and without failure.
As the value of the performance W can be considered the productivity, power, energy, quantity of information, etc.The value of t i is defined by overload capability of the system after i-number of failures.
In the case when the required level of WR has been predetermined by project requirements, it is useful to determine DOFT for each corresponding level of performance in accordance with (2): (2) tN is determined depending on the type of electric vehicles and is largely depending on the specifics of its operation (aircraft, ships, trains, cars).For example, for the electric helicopter 30 minutes are needed for sustainable and safety completion of its function "search and rescue".t i is determined by the overload capacity of system and its thermal stability.t i indicates the duration time during which the system may operate in a critical failure mode without irreversible changes in the quality and functional inability to further use. Evaluation of degree of reduction of the system's functionality;  Estimation of an acceptable level of performance reducing in accordance with the requirements;  Evaluation of the ratio between the performance and demand for each failure operational mode;  In the cases when the demand is greater than the required performance, the analysis and evaluation of system's overloading state is carried out, and the value of t i is calculated for the appropriate level of performance reduction;  Based on the calculated data the DOFT can be computed.
On the Figure 2 and Figure 3 the values of DOFT, respectively of traction multi-phase electric motor and electric power inverter are equal to the area below the degradation curves.The "grey" area above the curve of the degradation of 9-phase motor is equal to probability of the transition of this motor in the next degraded state following the critical failure.
The number of "steps" in Fig. 2 corresponds to the number of degraded states of the electric machine after each critical failure until the moment of time when the motor losses completely their functional ability.For multi-phase electric motor, this corresponds to the next critical phase failure.Thus, multi-phase traction motor can be regarded as multi-state-system, which will be given special attention in the section II.B.Quantitative assessment of the total duration of the electric motor operations in all degraded states allows a quantitative comparative analysis of various possible topologies and design of the machine, considering their lifetime.Additionally to the critical failures, the effect of small (noncritical) failures on the fault tolerance value of traction electric motor and electric power inverter, leading to partial or temporary loss of system functionality, can also be investigated using DOFT, as can be seen in Figure 4.A distinctive feature of the proposed methodology of quantitative assessment of technical systems in comparison with existing techniques is its universality, i.e. the possibility of its use for different types of technical systems.As an example of its practical use, figure 5 shows the evaluation of the fault tolerance and transition probabilities of electric helicopter traction drive with multi-phase motors and multilevel inverters.

B. MSS Markov Models and Transition Probabilities
Considering the above requirements on the probability of total failure of electrical helicopter, as well as statistical data on the reliability of traction electric motor and electric inverter it was determined that the optimal model for an analysis of fault tolerance in such conditions is a MSS Markov Model (MSS-MM), with K states, as shown in general form in Fig. 5. Theoretical base of this method is well known and described in [16]- [18] and examples of application in [25]- [27].Fig. 5. Multi-State Markov model of electric traction drive [16] The first state corresponds to a completely failure-free operation of the system.The second and other states (before state K) are the states of degradation and correspond to failure cases -phase open-circuit failure, respectively, of the one, two or more phases.The state K of the model corresponds to the completely failed system when the helicopter's drive completely loses the ability to operate.Thus, every following state of the degradation corresponds to one critical failure with a corresponding partial functionality loss of the traction drive.
At the same time, the number of the degraded state of the MSS-MM determined in accordance with the requirements of the project on the fault tolerance defines the technical capabilities of the system to continue functioning with reduced performance level as a result of the critical failure.
The most important and most difficult point for simulations using Markov models is to determine the transition probabilities and the number of states with a reduced level of functionality.
The values of the transition probabilities , Kare derived from the results of calculations of Degree of Fault Tolerance (DOFT) for the states 1, 2 and K respectively: Here R is the value of reduced performance level according to the project requirements and inumber of critical failures.The values of transition probabilities are affected by a large number of different factors, from design and environmental parameters to the using types of maintenance strategies, monitoring, and diagnostics.
As can be seen from ( 3), for the calculation of the transition probabilities the main importance is the correct calculation of DOFT for a given project required performance levels.Application cases of proposed methodology for the estimation reliability features of electric traction drive of helicopter will be presented in the next section.

A. Electric Traction Drive
The power part of the traction drive of electric vehicles includes a source of electrical energy (battery, fuel cell, etc.), an electric energy converter/inverter, and a traction electric motor, as can be seen from Figure 6.In the present study, the electric power source was not considered, but will be considered at the next stage of research.

B. Critical Failures
In the paper [6] has been demonstrated that the vast majority of elements failures of the system "power invertertraction electric motor" can be reduced to four basic types of failures of electric traction drive:  open-circuit and short-circuit of the electric motor's phase;  open-circuit and short-circuit of the inverter submodule.
In the development of an electric motor scheme is usually provided such a connection of the each inverter submodule with the protection system, which disconnects the electrical circuit of the failed submodule.This solution allows the failure "short-circuit" of the inverter's submodule to lead to the failure "open-circuit" of submodule.
The failure type "phase short-circuit" of electric motor can be reduced to the failure of "phase open-circuit" based on special design options of the stator winding performance, improve the quality of insulation materials and advanced production technology.
Excluding the possibility of failure type "short-circuit" on the basis of their reducing to the failures of the type "opencircuit" is one way to keep a functionality of multi-phase electric motors in failure cases.Thus, in the simulation of functioning of electrical traction drive in failure conditions, as the critical failures will be considered the motor's "phase opencircuit" and inverter's "submodule open-circuit".

C. Multi-Phase Electric Motor
The results of a previous study by the authors [1] indicate that for the 3-phase PSM the specified requirements on the reliability for the entire power drive of a designed helicopter is not achievable without a functional and/or structural redundancy, and/or other activities that improve the indicators of reliability to the required value.
One way to create the fault tolerant traction electric motors of high reliability is to increase the number of motor phases without changing the value of the motor's power.This allows to reduce the current value in each phase's open winding and to perform the power electronics unit integrally fabricated.
Based on the diversity of various schemes, connection methods of power supplies and inverters as well as switching algorithms of the stator phases of electric motor, it is possible to implement the system using automatically changed structures and parameters, resp., depending on the purpose and functioning conditions.
At the same time, independent performance of each phase's switching channels provides increased reliability of the electric machine based on the principle of functional redundancy.
Unlike an electrical machine with a small number of phases in which the majority of critical elements failures leads to a complete failure of the machine, the multi-phase electrical machine remains in operation up to a certain level of degradation and a corresponding change in the output characteristics.This allows realizing so called functional redundancy.
Thus, on the one hand, increasing the number of phases of the electric motor reduces the impact of each failure in power electronics control channel or in the phase of the motor, on the characteristics of the whole traction drive.
On the other hand, increasing the number of phases leads to an increase of the failure probability in one of phases.In this context, it is necessary to find an optimal compromise solution, based on the design requirements, the possibility of redundancy, and the reliability indices of the electrical machine and power electronics.
On the basis of the known values for the failure probability of each phase of the electric motor the optimal number of phases can be calculated, at which the required reliability and fault tolerance indicators of electric motor can be implemented, taking into account the possibility of one or more critical failures.The use of this redundancy method has its own features that must be considered in the study of physical processes and the design of the traction electric drive as a whole.
As shown in [1] the optimal electric machine for the safety-critical electric drives, considering system approach techniques, is a multi-phase PSM with distributed stator windings and internal v-shaped arrangement of permanent magnets on the rotor.For a detailed study 5-, 6-, 7-and 9phase PSM were selected.
For the traction electric motor of the helicopter considering high requirements on the drive safety and fault tolerance, the overload capability in the fail operational modes is especially important.In such operating conditions, a stable operation for a specified time on the modes of reduced power without critical asymmetry of PSM's parameters is also extremely important.
Considering a normal, i.e. failure-free, operational mode, the electric motor can endure a short-term overload because the thermal capacity is sufficiently large, whereas for failure cases the situation is changing dramatically.As known from operating experience, the largest numbers of operational failures are caused by technological overloads [19] - [21].
Most of the total failures of traction electric motors (more than 80%) occur because of stator windings faults and bearings failures, so that these components play a crucial role in the overall reliability value of the motor.Their lifetime and fault tolerance significantly affect the operating temperature, developed inside the motor.The overheating causes quickly deterioration of the motor winding insulation and bearing.
The causes for overheating of electrical machines can be technological overload of the motor as well as the occurrence of different failure modes.The main of them are the various types of short circuits, unbalanced work at the loss of one or several phases, jamming of the rotor of electric machine.Technological overload leads to an increase in temperature of the motor windings to a higher level, a gradual deterioration and finally to its total failure.
In the case of a short circuit in the stator windings, the current value exceeds the nominal value to a multiple.Thus, the rate of rise of the stator winding temperature reaches 7-10°C per second and after 10-15 seconds the motor temperature is out of limits.
The unbalanced mode (phase loss) occurs in the case of burned out fuse in the phase, wire breakage, faults in contacts or in the case of protection operation.Thus there is a redistribution of the currents, the magnitude of current in the remaining phase's increases, which leads to overheating and total failure of the electrical machine.
According to recent research [20], long-term operation of the electric motor with an overcurrent by only 5% of the nominal reduces its lifetime by 10 times.
Most of the overcurrent failures of electric motors are associated primarily with damages inside the motor, leading to an asymmetric overcurrent and, as a consequence, to overheating.The main types of failures that lead to dangerous overheating of the stator windings and to a total failure of the electric motor (without system of protection) are the short circuit faults:  between turns;  between coils;  between phases;  between wires and the housing of the motor.
Their effects are described in detail in the literature.These effects lead to dramatic increasing of the current in one or more phases of the motor and ultimately to the motor's overheating.At an effective system of protection against emergency situations, each of the above-discussed failures can be reduced to an embodiment of the loss of failed phases (or automatic shutdown).
When it is required to maintain the load at a given level, which is a common requirement for safety-critical systems, such as a helicopter traction drive, it is necessary to increase the phase currents in the remaining phases of the electric motor.This will result in a certain level of the motor's overheating and severely limited, in terms of reliability, duration of operation in this mode of load.
For the traction drives of the electric helicopter the given levels of maintain load in the failed operation are: 65% of the nominal load (long time operation) and 85% of the nominal load (short time operation).To estimate the level of overheating of the windings of multi-phase traction motors and respective conclusions on its thermal stability in the case of failure in one or two phases, it is proposed to use the overheating factor KT, which shows how many times the motor windings temperature exceeds the nominal value: (3) where Ti and TN -, respectively, describe the windings temperature in failed operational mode in i-phases and in the nominal failure-free operational mode.Overheating factor is graphically presented in Fig. 7.
Table II shows the results of a preliminary assessment of the overload capability of multi-phase traction motors in case of an open-circuit failure of one or two phases.++ -there is no overload; + -overload is less than 15%; 0 -overload is greater than 15%.
The main goal of the preliminary analysis of the presence (or absence) of overload modes of a traction electric motor at various critical failures, is to find the critical points in terms of thermal stability and overload capacity.
Conditional separation of considering multi-phase motors on the level of overload capability into three groups was carried out based on the analysis of the thermal stability of the motor windings for different thermal load conditions.
From the operating experience of electrical machines with appropriate power [20] it is known that when the phase current has insignificant excess (10-15% of the nominal value), the electric motor can be operated a certain time without critical deterioration of insulation of the stator windings.Therefore, such failure operational overloads modes can be considered as partially acceptable.Considering the low rates of overload capability and thermal stability of the 5-phase traction motor, as can be seen from Fig. 7, this version was excluded from further analysis.
When current overloads are larger than the above mentioned values, this operational mode has been regarded as critical.
The consequences of the large overload in failure operational mode are overcurrent and overheating of PSM, which lead to a reduction of reliability indices and decrease lifetime of the motor, as can be seen in Fig. 8. Fig. 8. Lifetime of the parts of electric drive [22] The main characteristic of the load modes of PSM for evaluation of DOFT is the thermal characteristics, estimated by formulas [20]: where tN -describes the time of achievement of acceptable motor temperature value, K -the rate of exceeding the nominal value of the phase current, Athe heat irradiation of the motor, and C -the thermal capacity of the electrical machine.Schedule of DOFT at 65%, 85% and 113% of nominal load, on the number of critical dangerous failures is shown in Fig. 10, a, b, c, respectively.Based on the constructed graphs a comparative analysis of DOFT for considered variants of the electric motors can be carried out quite easily.However, according to the authors, more informative and convenient for practical use are the dependencies of DOFT on the value of a given load maintenance level, as shown in Fig. 11.Thus, it is possible to assess the compliance of parameters of fault tolerance for each compared alternative to design requirements.

D. Electric Inverter
Considering the current developments in the field of power electronics, for the comparative analysis of the fault tolerance has been considered two options of electrical power inverter: conventional and multilevel.Voltage Source Inverter (VSI) is the most commonly used power converter between the seriesparallel-configured batteries and the electric motor in electrical mobility applications.
It is well known that multilevel inverters offer several advantages compared to their two-level counterparts [12]: smaller power filters, smaller voltage ratings for semiconductors, lower switching frequencies and less power losses.They offer also more modularity and are more reliable.
Currently, mainly three types of electric multilevel inverters are used: Neutral Point Clamping (NPC), Flying Capacitors (FC), and Cascaded H-Bridge (CHB).Considering [8], [10], [11], and [12], CHB inverters need the lowest number of components.NPC and FC inverters need more components than CHB and have less modularity, due to the central storage unit.
Thus, CHB inverters are constructed on a series connection of single-phase inverters supplied by isolated DC electric energy sources.This kind of inverters gives a high modularity degree and consequently high reliability and fault tolerance.An approach based on the full inverter's power control could optimize the implementation and the reliability of the inverter while offering optimized operational behavior.
It should also be noted that CHB is an interesting inverter's topology for the electrical vehicle because of its possibility to work with unbalanced or faulty DC sources.This in turn can increase the life time of battery packs and the autonomy of the vehicle.In the case of using CHB inverters with appropriate control strategies, state of charge unbalances can be managed as well as state of health allowing to optimize the access to the electrical energy and electric vehicle autonomy.
Based on the reqired design parameters of the traction drive of electric helicopter, the preferred inverter option is a topology 17-Level CHB inverter.So, in each phase there are 8 submodules, as shown in Fig. 12.
Figure 12 shows the basic topology of one phase of a CHB using batteries on the DC side.Each battery module is connected to a H-bridge with 4 MOSFETs.The use of MOSFETs enhances the efficiency of the CHB inverter, because of the low conduction losses.For the fault tolerant operation in failure case either the inverter module must be shut down or switched to a possibly existing redundant inverter leg/module.Each of these modes leads to a rapid increase of the current at the emergency site and an overload of the semiconductors.At overload, power losses occur in the p-n-transition and its temperature increases dramatically, due to the low heat capacity.In the case of exceeding a certain critical temperature of p-n-transition, the semiconductor device fails.Hence, overheating temperature is the main parameter characterizing the overload capability of semiconductor devices, as it is shown in Fig. 8.
The graph presented in Fig. 13 has been plotted based on the data regarding the standard overload capability of the power electronics.Qualitative analysis of the data presented in the Tables shows that the 17-level inverter significantly exceeds the level of fault tolerance of the inverter with a conventional topology.

IV. SIMULATION RESULTS ON THE MARKOV MODEL
For more accurate assessment of fault tolerance of each comparable traction motor and electric inverter, and for compliance (or non-compliance) with design requirements, MSS Markov Models of reliability were built, which theoretical base is described in [16] and [17].
To construct such models the multi-phase PSM as well as the multilevel inverter can be considered as a system with a loaded functional redundancy and consequently, with an appropriate reserve of fault tolerance.The transition probabilities for MSS Markov Models were calculated using the above mentioned DOFT method.
As was discussed above, the phase open-circuit failure has been considered as the main dangerous failure for electric motor's stator, i.e. it is the most severe kind of failure, to which less dangerous failures can be summarized.For the electric inverter, the MOSFET's submodule open-circuit failure was considered to be the worst case.
Considering the above requirements on the fault tolerance of safety-critical drives as well as statistical data on the reliability of the multi-phase PSM and electric power inverter from [1], [23], [24], and [27], it was determined that the optimal model structure for the analysis of fault tolerance in such conditions is a MSS Markov Models with four states for traction motor and five states for electric power inverter, respectively, as shown in Fig. 14 and Fig. 15.
The number of states of the MSS Markov Model is determined by the probability of failure-free operation of the system in the failure-free mode and fault tolerance requirements established by the design documentation.The fourth state of the motor's model (Fig. 14) corresponds to the completely failed electric motor when the helicopter's drive completely loses the ability to operate.Thus, every following state of the degradation corresponds to one emergency phase loss with a corresponding loss of the part of functionality of the motor.
The fifth state of the inverter's model (Fig. 15) corresponds to the completely failed conventional inverter when the traction motor does not receive the necessary power for a safe flight.Thus, every following state of the degradation corresponds to the worst case -a loss of an inverter's submodule.For the multilevel CHB inverter the fifth state of the model means the loss of one complete phase of the electric motor.
The proposed assessment approach for transition probabilities in the MSS Markov reliability model is well formalized and suitable for practical application in reliability engineering to assess fault tolerance indices of multi-phase traction motors considering the aging process under the influence of operating conditions.
Regarding the design requirements on fault tolerance of an electric helicopter, the reliability of the traction electric motor at reduced power of 65% or 85% of the nominal value as well as at 113% of nominal value was analyzed using the MSS MM.Corresponding graph for 6-, 7-and 9-phase PSM at the 113% load level are presented in Fig. 16.The horizontal axis indicates operational time in hours and vertical axis -probability of total failure of traction motor.The simulation results of two consecutive critically dangerous failures allow of quantifying the reliability indices degree of the fault tolerant multi-phase electric motor, which is one important part in the traction drive of electric helicopters, and of estimating the compliance of calculated values with design requirements.
The obtained results confirm the results of the studies presented in [5] and [6], that 7-phase electric traction motors can be operated after the loss of two phases during a limited time, at nominal load (limitation because of thermal stability), and for a long time with a reduced load.
For the simulation the worst case and critically dangerous variant of failure has been considered, i.e. the submodule failures occur in the same phase.In case of a simulation of a not safety-critical failure, as well as the possibility of partial recovery of the power drive's operating ability in the degraded state, the value of the fault tolerance will be significantly higher.
Regarding the design requirements on fault tolerance, the reliability of the inverter was analyzed using the above MSS Markov Models, in case of emergency reducing the power to 113% of the nominal value.The corresponding graphs for a different number of phases and inverter topologies are presented in Fig. 17    The results of the probability calculations of a failurefree operation of the electric inverter during one operational hour at 113% of nominal load for two inverter's topologies are summarized in Table IV.The results of simulation of three consecutive critically dangerous failures allow quantifying the degree of fault tolerance of a 17-level inverter, which is one of the important parts of the traction drive of helicopters.The 7and 9-phase options have shown the maximum compliance with the requirements relating to the safety-critical drives.

V. CONCLUSION
The paper presents a new approach and methodology for assessing the degree of fault tolerance of a safety-critical technical system, such as a vehicle's electric traction drive.The suggested assessment of the reliability of fault tolerant topologies of electric traction drives is well formalized and suitable for practical application in reliability engineering to assess fault tolerance indices of multi-phase traction motors as well as an electric power inverter, considering the aging process under the influence of operating conditions.
As an example of practical use of the proposed method the fault tolerance of two important parts of a vehicle's electric propulsion system -traction motor and electric inverter -were evaluated.
Results of comparative analysis allow to conclude that for given project requirements on the level of reliability and fault tolerance of helicopter's electric traction drive in the real flying conditions only 9-phase motors in combination with 17-level inverters completely fulfill the design requirements without any restriction.
More broadly, the proposed method can be used as a universal tool for evaluation and optimization of the degree of fault tolerance in safety-critical technical systems, considering all the possibilities of its increasing, such as redundancy, monitoring, predictive control and type of maintenance strategy.
Based on the considerations above, the procedure for determining the DOFT is following:  Determination of all possible failures on the basis of Fault-Tree Analysis (or Failure Mode and Effects Analysis);  Classification of all failures on critical dangerous and non-dangerous failures;  Definition of opportunities and complexity (if recovery is possible) of the failure elimination;  Definition of development and the consequences of each non-repairable failure (if the recovery is not possible);

Fig. 2 .
Fig.2.Graphical DOFT representation of different multi-phase motors as multi-state systems

Figure 3
Figure 3 is a graphical representation of the qualitative comparison's results of the DOFT of conventional and multilevel inverter for 6-phase traction motors.The figure shows that DOFT of the multilevel inverter is much superior to the conventional version.

Fig. 6 .
Fig.6.Schematic graphical system definition for a multi-phase traction motor (a) and for the whole traction drive (b)

Figure 9
Figure9shows graphically the results of calculating the thermal behavior of the electric motor in overload conditions, as a result of one or two critical failures considering thermal stability of the stator windings.The values of Ndeg and Nnom in Fig.9correspond to the values of traction drive performance (driving power) in degraded and nominal modes, respectively.

Fig. 11 .
Fig.11.DOFT of a given load level in fail operations, (a) -one failed phase, (b) -two failed phases

Fig. 16 .
Fig.16.Probability function of total failure of PSM at the 113% load and Fig.18, respectively.

Fig. 17 .
Fig.17.Probability function of a total motor failure with conventional inverter at the 113% load

Fig. 18 .
Fig.18.Probability function of a total failure of one motor phase with multilevel inverter at the 113% load

TABLE II .
COMPARISON OF OVERLOAD CAPABILITY

Table II
has the following designations: Table III and Table IV.

TABLE III .
OVERLOAD OF CONVENTIONAL INVERTER IN FAILURE MODES

TABLE IV .
OVERLOAD OF MULTILEVEL INVERTER IN FAILURE MODES

Table III and
IV have the following designations:

TABLE III .
PROBABILITIES OF COMPLETE FAILURE OF PSM

TABLE IV .
PROBABILITIES OF COMPLETE FAILURE OF INVERTER