Neal Snooke, David Pugh and Richard Joseph
Centre for Intelligent Systems,
University of Wales, Aberyswyth,
Dyfed, United Kingdom.
e-mail: nns, drp@aber.ac.uk
Abstract
Introduction
Knowing the failure characteristics of a complex electromechanical system early in the design stage is fundamental to producing failsafe and cost effective designs. One technique used to assess the quality of such a design is failure mode and effects analysis (FMEA). FMEA describes the ways in which each component in a system can fail (the failure modes), and the effect that failure has on the system; these effects can then be ranked in order of their severity and likelihood of occurrence. This process highlights which component failure modes would cause undesirable system behaviour should they occur.
In an ideal world, FMEA would be carried out as soon as a first system design has been produced; the design would then be improved to reduce the severity or likelihood of certain component failure modes. In reality, FMEAs are produced during the final stages of design, when changes are usually too costly to introduce. The reason for the discrepancy between the ideal and actual situation is that FMEAs are very time consuming and laborious to generate; thus making an iterative approach unfeasible.
To address these issues we have built Flame [3,4] a computer aided engineering tool which can generate an FMEA of an electrical circuit from a preliminary circuit design. Flame can be used during the early stages of design because qualitative modelling techniques are used to generate the state of a circuit when a failure is introduced.
The qualitative simulator within Flame, called QCAT, has an advantage over standard circuit simulators, such as Saber, in that it does not need to know as much detail about the circuit in order to perform an analysis; for example, it does not need to know about fuse ratings, motor output, wire gauge and so on [5]. Qualitative circuit simulation does not depend upon exact values for current flow in a circuit, rather, it indicates whether or not there is a current flow, or the possibility of any short circuits. This information is usually sufficient to show the behaviour of an electrical circuit when a failure is introduced.
One of the most recent developments is the ability to represent both the correct and failure mode behaviour of complex (multiinput and multioutput) components and ECUs within QCAT. This breakthrough means that we can simulate most, if not all, circuits found within modern automobiles. Thus, qualitative circuit modelling has come of age.
Qualitative circuit analysis the basics
QCAT is based upon the work of Lee and Ormsby [1]. This research provided us with a means of qualitatively simulating electrical circuits containing simple electrical components; that is, components which can be represented by a single resistive value of zero, load or infinity (represented as 0, l and ƒ). Figure 1 shows such a circuit.
The fuse (F1) and wires (labelled 1 through 8) can be represented with a resistive value of 0 as each draws so little current as to be insignificant. Both the motor and lamp will draw current and thus will be labelled with a load "l". The switch will be represented as either "0", when closed, or infinity "ƒ", when open. Figure 2 shows the network that is constructed from the circuit the analysis is performed using this network. Each of the components (white dots) are separated by connections called nodes (black dots).
The analysis takes a three step approach:
First, all nodes are labelled with the least number of loads which need to be passed through to reach both the positive and ground. These are referred to as the forward (to positive) and reverse values (to negative), or just f/r value. For example, the node below the motor will have a forward value of 1 only the motor draws a load between it and the battery and a reverse value of 0 if the switch (S1) is represented as being closed, and ƒ if the switch is represented as being open.
Second, these values are used to deduce which paths are active. Components attached to nodes which have ƒ as one of the forward or reverse values are deemed to be inactive if there is no path to either positive or negative then current cannot flow through that component.
Finally, the analysis goes on to look for short paths. These are identified by looking at each branch in the circuit to see if the forward / reverse value is the same at the start of the branch as when the branches merge again. For example, the nodes between wires 2 and 8 will be compared. If the f/r value is the same in both cases, then this implies that the branch which does not draw a load will short out the branch which does draw a load. In the case of this example the f/r values of the nodes above wires 2 and 8 are different (0/1 and 1/0 respectively), therefore implying that neither path will be shorted out. However, if the lamp had not been included in the circuit, the path on the right (which would then just contain wires) would have shorted out the path containing the motor.
Defining complex components
By complex components we mean those which have more than two terminals and cannot be considered internally as a single resistive load. All DC circuits can however be considered as a network of resistances at the simplest level, and it is therefore necessary to map each component onto a number of simple resistances. Many devices have at least one obvious resistive load, but in addition other parts of the device whose qualitative resistance might change during operation of the device must be considered. Finally the possible failure modes of the device must be represented, and this can be done either by defining changed resistive values or by adding additional connections. Typically the design of a device will not change when considering the failure modes, although where several alternative representations exist, the most appropriate can possibly be located by considering the required failure modes. The following are examples of some typical resistive elements to be considered when building components; the contacts of a switch (open and closed states), coil in a relay, the solder joint in a connector (for broken joint failures), and the winding of an electrical motor (stall and burned out failures).
Aside from the failure mode models for each component, there are other generic attributes required. Component models may include definitions for mechanical state (external state), internal interactions (eg. a relay coil/switch), and for semiconductor devices an algorithmic or logical description may be required. Each of these features is now discussed in more detail.
Input devices
For devices whose resistive configuration depends upon externally enforced states we define a modification to the internal configuration of the device for each state. For any single analysis of the circuit this external state will not change. As an example device with multiple external states, we consider a simple level sensor, figure 3, whose function is to indicate a high or low fluid level.
The internal configuration of the device has been modeled as two resistances, one for each electrical contact within the device. The default for these resistances is ƒ, with modifications specified for each state. That is; in the high state the "high contact" will be set to 0, and in the low state the "low contact" will take the 0 value.
Internal dependencies
Next we consider devices whose internal resistance values depend in some way upon another part of the device. The simplest example of this, a switching relay, (figure 4) where the coil when energised, causes a switch to close. The internal configuration is comprised of two resistances, one for the coil (a load) and one for the switch (dependent on the state of the load).
Initially it is not possible to deduce if the switch should be open or closed the circuit must first be analyzed. Therefore multiple passes are made with an initial default value for the switch state (in this case open or ƒ resistance), with subsequent changes made if the coil was found to be active.
The relationship between the switch and coil components we call an internal dependency, and in general after each circuit analysis any internal dependencies are evaluated and the states (ie resistances) of affected components are altered. The simulation is not complete until a circuit analysis is completed where none of the dependency expressions cause any components to change state. It is possible that the circuit does not converge to a stable state, and the simulation cycles repeatedly through the same circuit states. Though this situation is rare in practice it can occur when feedback loops occur in the circuit (for instance two mutually switching relays) or as an artefact of the qualitative simulation process (for instance a relay switching causes a short circuit which shorts out the relay coil causing the relay to switch off the short circuit). To detect this non convergence the simulation terminates if any previous circuit state is exactly repeated. Finding an identical state involves checking both the resistance values, and internal state variables.
Device memory and analog components
Allowing devices to have internal states is an important feature included in the device builder models. It is a mechanism for allowing devices to contain memory. Internal states are essentially variables associated with each device which can have their values set by the result of a dependency expression, or have their values interrogated in the evaluation of a dependency expression. This provides the ability to represent semiconductor devices whose output is not dependent solely upon the inputs, but also on previous operation sequences of the device.
Another use of internal states is for allowing transfer of information between devices. This could be a mechanical connection for instance, or an analog signal which cannot be modeled by the qualitative simulator. An example of this is provided by the joystick type devices used to control mirror/seat movement (figure 5).
The operation is such that different joystick positions provide different resistance values to a single ECU input. To model this type of operation we define an internal state variable for the joystick component (called position) and allow values for this representing each possible joystick position (up, down, left, right). The position variable is then set to the appropriate value for each external state. The ECU component to which the joystick is attached will then interrogate the joystick_position internal variable - if the input pin is active - to determine the actual position. Notice that the variable name is prefixed by the component to which it belongs when being accessed from another component. This mechanism requires that both components are present in a circuit, with undefined results if they are not.
Thus, by utilising this "transparent transfer" mechanism we can simulate the transfer of several discrete voltage levels on a single wire. By making the access to the internal variable dependent on the input (or output) being active, we ensure that the joystick position cannot be used by the ECU if the wire breaks, thus providing the correct failure behaviour. For a discussion of faults which cause only an incorrect voltage level rather than a complete failure see the section on 'limitations of QR'.
There is currently no distinction in the system between internal variables used to transfer values between devices within a simulation, and the use of internal variables as memory for ECU devices between separate events (simulations) during an FMEA. The possibility therefore exists for memory states to be corrupted by 'transient' states caused by the iterative nature of the QCAT algorithm itself. A solution to this is to section memory states into two types; those which are reset before each circuit simulation and those which are persistent (real memory). The persistent type should only have their values changed once the analysis has reached a stable state. Further investigation is still to be carried out on these and related time/sequence issues.
Current direction, diodes and motors
A small number of components exist whose behaviour is characterised by the direction of flow of current; for example motors, and diodes. It is clear from figure 6 that it is not always possible to deduce the direction of current flow within a qualitative model. We have found empirically however that such situations are rare in real automotive applications, allowing us to
develop an additional algorithm within the CIRQ framework to deduce current flow. It is not possible to do this within the CIRQ path traversal algorithm because paths are not always traversed in the direction of current flow. Therefore it is performed as a post process to the circuit activity marking algorithm and consists of the following steps:
€chains containing converging f/r values are marked with flow across increasing f and decreasing r values.
€flow towards the ground is marked
€flow from the source is marked
€branch nodes are checked for deducible chains, refer to figure 7. This step is then iterated until nothing more can be found.
To enable dependencies (and functional states) to access the current direction information additional keywords "FORWARD" and "REVERSE" are available (in addition to ACTIVE and INACTIVE) as valid states of each resistance following simulation, and the "connect from --- to ---" entry when creating each resistance now has significant ordering providing a definition to FORWARD and REVERSE.
Figure 8 shows the model used for a diode. As the diode must initially become active to allow direction to be deduced, the default value of the dependent resistance is set to load rather than the usual ƒ used for relay switches or ECU outputs.
Motor devices are simply defined as a load resistor, and the direction of rotation can be used when assigning functional states also by using the FORWARD and REVERSE keywords. For instance in table 1 we define functions for power window operation.
| Function | Condition |
| window up | motor1 = FORWARD |
| window down | motor1 = REVERSE |
| window active | motor1 =UNKNOWN |
The ECU model
Recently it has become more common for automobile circuits to contain ECU or CPU components, and it is necessary to provide a mechanism for simulating the behaviour of these. The approach taken was to allow device terminals to be defined as input, output or unidirectional. When a terminal is input or output an internal model for part of the device connected to this terminal is generated. Referring to figure 9, a trivial semiconductor device has been constructed with two inputs, one sinking power to the ground terminal, and the other driving the terminal from positive. Each terminal is considered ACTIVE when a circuit is made through the load resistance connected to each input.
Output terminals are constructed with a dependent resistance whose value is either 0 or ƒ controlled by a logical expression involving the state of input loads and internal states. This expression is treated simply as a dependency in a similar way to the earlier relay example. If required, more values can be included to represent finer granularity or additional information (acceleration), but this depends upon how complex the ECU operation is made. In general the idea is to define an ECU with the simplest internal ECU model which can achieve testing of the relevant inputs and outputs and combinations thereof. This approach does not detract from the analysis, as generally failure modes for an ECU are only as complex as disconnected pins, or power loss, as software FMEA would be required to analyze any more deeply.
By treating ECU components in this way the internal electrical configuration is much simplified but still provides current flow between the correct terminals of the device controlled by a simple logical expression. In this way only small parts of a larger device can be modeled if required, or a simplified version of the operation can be defined.
The complete generic device model
In the previous section we have demonstrated a number of techniques to enable qualitative simulation of complex devices, we now bring these together and describe our generic device model.
QCAT - the algorithm
Analyzing a circuit is performed by the following steps:
€The circuit netlist and component model descriptions are combined to produce:
a resistance graph
a list of dependent components
a list of internal variables
note is made of any dependencies requiring current direction.
€The external states of components are set as required, plus any failure modes. Dependency expressions are modified
accordingly.
€The CIRQ algorithm is used to mark circuit activity.
€If any dependencies require current direction then this analysis is performed.
€Dependent resistances are modified according to the expression list.
€If any changes to resistance values were made, and this circuit state has not been reached before, then these final 4 steps are repeated.
If a circuit state is arrived at more than once, and it is not stable, then we assume it is either an unstable circuit (oscillating) or cannot be analyzed by qualitative methods. The result "Unresolved - possibly oscillating" is returned, and ultimately no functional states can be assigned, resulting in failure of all expected functions on the FMEA report. This signals that further investigation then needs to be made perhaps by quantitative methods.
QCAT - the device data model
The model for each component provides all the information required to produce the resistance graph, set up external (mechanical) states, produce failure operation and finally allow the multi pass simulation.
Figure 10 shows the items of data associated with each component and how they are used.
€The internal configuration provides the basic set of resistances (each with a default value), and connection nodes to be incorporated in to the graph representing an entire circuit.
€For components with several external states there may be an alternative for any of the resistance values for each state, and dependency expressions are specified for each state.
€For each failure mode there may also be different resistance values, dependencies, or additional connections to power or ground.
€ E ac h internal state becomes a global storage location for a single symbol with its name derived from a concatenation of the components instance name and its own identifier. This is to allow other components to read its contents. References from within the defining component's dependencies are automatically expanded to the full name.
€Dependency expressions can read and set internal states belonging to any component in a circuit, read the activity state and current direction from any resistances, and set the state of any of their own dependent resistances.
Defining failure modes
Typically there are a number of possible failure modes for each device. The modification that each of these has on the device behaviour are built into each device when it is defined. This can be done in a number of ways. A failure mode can force a change to the resistance of one of the internal components of a device, for instance the `switch stuck open' failure mode will cause the switch contact resistance to be infinite regardless of the state of the device. The internal configuration can be modified by the addition of extra links, here we can have `short to battery' or `short to ground' failures. Finally, the dependencies can be redefined if necessary to allow for failures caused by the non electrical properties of the device or logical failures within semiconductors.
Limitations of QR
During our attempts to model certain types of component we have noted some limitations caused by the QR approach. This should not be a surprise as some of these limitations are as a direct result of the simplicity of analysis and compactness of results provided by QR. In the main we have overcome such modelling problems by moving the relevant problematic behaviour to the higher layers of our models. The following paragraphs describe some of the effects of this strategy.
The use of internal variables to transfer information between components (to simulate an analogue voltage, or time varying signal) is one mechanism we have utilised when the capability of the qualitative simulator has been exceeded. In the majority of situations the FMEA engineers are only interested in the extreme behaviourial cases, with other situations being considered as less severe or partial manifestations of the extreme behaviour. For example 'lamp dim' and 'lamp off' faults caused by 'corroded connector' and 'broken connector' respectively are essentially the same fault and are both covered by the 'headlamps on state not achieved' result. For this case only the extreme situation need be considered to provide the level of FMEA we require.
Returning to the joystick example where the voltage range is divided into signal ranges each of which causes the ECU to activate different parts of the system, we find the result that it not possible to provide some of the possible faults, for instance a corroded connector causing an incorrect (but not zero) voltage at the ECU input for the Joystick example. The problem appears when the effect in the situations we cannot simulate is not partial function, but a totally different functionality. In the joystick example, the failure modes of the joystick which are possible provide the correct result, (for instance if the connecting wire is disconnected, or shorts to power), however the limitation is that we cannot simulate all the possible failures of function at the qualitative circuit level.
Example circuit analysis
In this section we describe several circuits utilising a variety of devices which have been built within the framework of our generic model. We then follow through the salient parts of the analysis algorithm when applied to the circuits. From these examples, most of the techniques used to build device models can be seen. The first two examples are contrived to provide simple demonstrations of several component modelling aspects, the final one is based on a real operational system from the automotive industry.
The three example circuits are:
€'column mirror' shows the possibility for an analogue signal from a driver joystick control device via an ECU to directional motors.
€'rectifier' demonstrates diodes and relays in use.
€'wash wipe' is a real wash/wipe circuit featuring ECU control, and a wiper motor with park position sensor.
Example 1 - column mirror
The joystick device is used to present several different load resistances to a specially designed ECU. For simplicity our example has 4 possibilities (plus ƒ for the central position) to represent up, down, left and right, although adding the composites (e.g. up/right) is a simple extension. The ECU then switches on either of the tilt (up,down) or reach(left, right) motors accordingly.
The circuit is shown in figure 13, with the description of the joystick and ECU in figures 11 and 12. For the joystick we have only one resistor because this will be used to represent any of the possible values. Its default value is ƒ representing the joystick central position, and for each of the directional positions it becomes a load. In addition there is an output logic resistance in parallel with the joystick resistance. This is to enable a dependency expression to be entered to set an internal variable for the ECU to read the required joystick state from. This logic resistance has default value ƒ, and is never given another value, and therefore will always remain inactive. It can be considered as the 'variable' part of the joystick resistance, which, as it cannot be represented electrically, is represented logically.
Failure mode effects related to the joystick
It is important that the internal position state variable is only read by the ECU when the relevant pin is ACTIVE and that it is only written to by the joystick when the joystick load is ACTIVE. This is to prevent the ECU from obtaining information which would not be available due to electrical failures. For example if the joystick should become detached from the ECU then the ECU will not be able to get the value as its input load will be INACTIVE. If there is a short to battery the joystick load will be INACTIVE; and a short to ground will cause the ECU load to become INACTIVE again.
Simulation of the circuit
The main effect of each pass of the circuit simulation is now described.
€ The joystick state is set, and unless the joystick is in the off position the simulation finds a path through the joystick resistance. One of the joystick dependencies will fire to set the joystick position internal variable.
€After the second simulation, the ECU dependencies set the output resistances to 0 appropriately.
€The third pass will find a current flow through any active motors, no circuit states will change, and the simulation is complete.
In this case the second pass was only required because the ECU expressions were evaluated before the joystick expressions. If the situation had been reversed then step 2 would have occurred as part of step 1, saving one (unnecessary) circuit simulation.
Nearly all components have failure modes defined, and these simply modify resistances or add connections to the circuit as required. Setting external states and failures is performed in the following way:
€The external or default state of each component is set.
€If a failure is required for a component the resistances are modified accordingly. Note that new dependency expressions might be defined for the failure mode or dependent resistances could gain definite values.
€If a higher level of the simulation sets additional states - this is when an 'event' occurs -then these are set if the component is not also in a failure state.
Example 2 - the 'rectifier'
The circuit in figure 14 consists of two relays which are used to reverse the polarity across a simple rectifier circuit by means of a switch. A motor is connected across the rectifier output and is used to demonstrate that the output voltage is always the same polarity regardless of the input.
QCAT - diode operation
We can consider the QCAT algorithm operation for the switch in both its open and closed states. For the open state the following sequence occurs:
€After the first pass, the coil of both relays
is inactive, connecting the A relay switch to ground and the B relay switch to +V.
€Pass 2 finds the entire relay network is active, although the direction of current flow is unknown through the motor. Diodes 1 and 2 are made non conductive.
€Pass 3 finds the direction of current through the motor, the simulation is stable and the analysis is complete.
For the switch being in the closed state slightly more steps are required, because the relay coils are both active:
€After the first pass a circuit is found through the coil of relay A causing the relay switch to create a circuit through the coil of relay B.
€The second pass finds both the relay coils are active and relay B now switches to connect the A relay switch to +V and the B relay switch to ground.
€The third pass finds the entire diode network to be active, but with reversed current direction to the previous analysis. Diodes 3 and 4 are made non conductive.
€The final simulation finds the simulation in a stable state with the current flowing through the motor in the same direction as before.
It is clear from this example that the default value for the dependent components can be critical as if diodes had an initial ƒ value no current direction could be found, or if they were zero then in this example a short circuit would be caused once the relays had switched. It is also clear that a partially analyzed circuit state should not cause an incorrect direction of current flow through a diode because once it has changed into a nonconductive state it cannot change back.
Example 3 - wash wipe
The circuit in figure 15 depicts a slightly simplified wash/wipe system from a modern car. We can see that it contains a steering column stalk switch which signals the drivers wipe speed and wash selection via a multi voltage input to an ECU. This ECU then switches several relays which control the wash pump motor and wiper motor control speed. The wiper motor also contains a park switch which ceases to conduct when the wipers are in the parked position. This switch is used to maintain power to the wiper motor in fast mode should the ECU cut power mid cycle.
Rather than give a complete description of the QCAT simulation, which would be rather tedious, we will describe a typical sequence of events which might be used during an FMEA for this circuit and the resultant circuit state. The detailed operation of the FLAME effects generation system is described elsewhere [2], but the following description will provide a flavour for how the QCAT simulator is utilised within FLAME.
A typical simulation would set the initial state of the two external input devices to an inactive state, for this circuit we have stalk = off and wiper_motor = parked. We then run through a events sequence provided by the user, as follows.
€Set stalk =fast. A simulation now reveals a circuit through the fast winding of the wash wipe motor. Ultimately this will indicate the circuit is in 'fast wipe mode', the mechanism for associating function to the state of key circuit components is also described elsewhere [?] Figure 15 was taken after this simulation.
€The user is now puts the stalk in to the slow state and a simulation reveals relay_K3 switching and the slow winding becoming active, placing the circuit in 'slow wipe state'
€The wiper motor is now set to the mid_wipe state by the user (which closes the wiper motor park switch) and simulation reveals that the 'slow wipe state' remains operative.
€The user sets the stalk to off. Following simulation the wiper motor fast winding is active because the park switch feeds power back to relay_K1 thus overriding the ECU output.
€The final user event is to set the wiper_motor to parked and we see that following simulation both the wiper motor windings are inactive, indicating the 'wipers off' state.
The wash pump operation can be checked in a similar way, and typically several extra events would be required to do this. During a complete FMEA analysis, the sequence of events is carried out for each of the possible failure modes for each component, and the resultant change in functionality provides the basis for our FMEA analysis.
Further Work
There are still some devices which have proved so far impossible to model, the two obvious examples (fortunately rarely used in automotive applications) being amplifiers and capacitors. These components have time dependent behaviour, which due to the static nature of the graph analyzer cannot be modeled in a straight forward way. In the same category come certain types of circuit, which contain electrical feedback loops. Within the automotive domain however, many of the apparent feedback loops are actually interrupted by non electrical devices, and in these situations there is no problem (at any instant in time for a given set of electrical inputs there is still a static set of outputs). The fact that the outputs may subsequently change the inputs does not matter, as the effect of this change will be reflected by another simulation. As an example, we might consider a cruise control system where the input from the speed sensor could be stopped, slow, med, fast and the stored value of speed set by the driver might be one of slow, med, fast , with the ECU performing a simple comparison to decide whether to open or close the throttle. Thus after several simulations consisting of the various possible combinations of these qualitative values, all of the different types of circuit behaviour can be seen - slower than required, correct speed etc.
For certain types of components we have found that a single set of mutually exclusive component states is rather limiting and several sets of such states would prevent the necessity for many 'combination' states. For example in a joystick device we might like to define up, centre,down and left, centre, right as combination states allowing easy specification of the 9 possible positions. To allow such an enhancement without having to define internal component structure for every combination of these states values, we require that certain states only define part of a device's internal structure. Although this might be practicable, further work is required before an implementation could be attempted.
Conclusions
Through the generic device model presented here engineers can build qualitative models for a wide variety of electrical devices. This ability is crucial to the FLAME system in allowing simulation of circuits to take place for complex electrical systems found in modern vehicles. The addition of current flow, dependency, and internal states information has significantly increased the number of systems for which Flame can perform FMEA.
A graphical interface is available for the construction of components making the definition of new components a relatively simple task utilising graphical icon and configuration editors plus standard WIMPS techniques such as menus, scrolled lists, and buttons to define the textual information. An example of the process of building a two pole relay appears in figure 16, where many of the parts of the component description can be identified.
The prototype Flame system and QCAT qualitative circuit analyzer are both being used by a major motor manufacturer and has been shown to greatly improve the speed and thoroughness of the FMEA analysis. Further work is underway to develop commercial products based on these prototypes.
References
[1] M. H. Lee and A. R. T. Ormsby, Qualitative Modelling of the Effects of Electrical Circuit Faults, Artificial Intelligence in Engineering, Vol. 8, pp 293-300, 1993.
[2] C. J. Price and D. R. Pugh, Interpreting Simulation with Functional Labels, Procs. 10th annual Qualitative Reasoning Workshop, AAAI Press, May 1996.
[3] C. J. Price et al, Automating Electrical Failure Modes and Effects Analysis (FMEA), Annual Reliability and Maintainability Symposium, pp90-95, IEEE 1995.
[4] D. R. Pugh, N. A. Snooke, Dynamic Analysis of Qualitative Circuits for Failure Mode and Effects Analysis, To appear in Procs. of Annual Reliability and Maintainability Symposium, Las Vegas, IEEE 1996.
[5] J. De Kleer., How Circuits Work. In Qualitative Reasoning about Physical Syatems, ed D. G. Barrow, MIT Press, MA, USA, 1985, pp205-280.
[6] G. J. Sussman, Electrical Design : A Problem for Artifical Intelligence Research, In proc. IJCAI-77, Cambridge, MA, USA, 1977, pp894-900.
[7] E. W. Dijkstra, A note on two problems in connection with graphs, Numerishe Math, vol 1, pp269-271, 1959.