ISACA COBIT 5 – Measure (BOK V) Part 13

- By
- January 27, 2023

**43. Poisson Distribution **

Earlier we said that there are three main types of distribution normal distribution which was for the continuous data and binomial and poison for discrete data we talked about normal earlier, we talked about binomial distribution and we talked about other distributions which are related to binomial. Now coming to this poison distribution, poisone is also for discrete data just like binomial. Here when we talk of poisoned distribution, let’s compare this with binomial.

So just like in binomial there was success or failure. So in flipping a coin we said that if head is the one which we are interested in, then the head was the success and the tail was the failure. Just like that in poison also the outcome is success or failure. So this is similar to binomial. The average number of successes is mu that occurs in a specific region which is already known. So we already know beforehand what’s the average number of successes and when we say specific region, this could be for a specific time frame, for a specific location. We will understand that once we look at some of the examples here.

Outcomes of poison distribution are random and occurrence of one outcome doesn’t influence the chance of another outcome. This is exactly similar to what happens in binomial. Also in binomial also the outcome of each time you flip the coin was random and one was not affecting another. So this is also similar to binomial. Key difference here is that here outcomes are rare relative to possible outcomes. When we were talking of flipping a coin earlier, the outcome of success and failure were relatively equal or it was not at least rare. Here we are talking of rare events. Rare events. For example on Monday, number of accidents occurring in the city.

So when you compare to the actual number of time vehicles are moving around, accidents are rare. So these sort of things we are looking at when we are looking at poisoned distribution. So how do we calculate probability in case of poisoned distribution? That is done using this formula which is here p x MU is equal to e to the power minus mu to the power x divided by factorial x. So the first thing here is this is probability, this is poison probability x. Here is something which we are looking for. X is the number of successes in a specific region which we are looking for and the mu is the mean which we already know which are the mean number of successes. E is a constant, the value of E is 2. 718 to eight which is written here. E is a constant.

So if you look at this, the probability depends on two main things. One is what is the mean number of successes and number two, what is the successes we are looking for which is x and mu. So earlier when we were talking about binomial distribution we said that how to find out mean and the standard deviation of binomial distribution. And if you remember, we calculated the mean of binomial distribution as N multiplied by P and there when we took an example of ten coins flipping, the N was 1010 times, we flipped the coin and the probability was zero five and we found out the expected value or the mean to be five. Here in poison distribution, when we talk about poison distribution, the mean of the distribution is equal to Mu, which is the average number of incidences which we have earlier talked about on the previous slide and variance is also Mu.

So here in the exam, like if you get a question that which distribution you have mean and variance as equal, this is the distribution where you have a mean and variance where both of these are equal to Mu. And here is one example of poison distribution. So in this example we have a booking counter and on the average we get 3. 6 people coming every 10 minutes on the weekend. So the question is what is the probability of getting seven people in 10 minutes? So 3. 6 is the average and we are looking for the probability of getting seven people in 10 minutes. When you are attending poison distribution, the first thing you need to do is make sure that these units are same. So if we have every 10 minutes here and every 10 minutes here, these should be same and if these are not same, make it same.

So once they have the same unit, you can put here that mu is equal to 3. 6 people every 10 minutes. And X what you are looking for, the probability is seven people in 10 minutes. You can put that in the formula which we have here. E to the power Mu and Mu to the power x divided by factorial X. So E to the power -3. 6 because 3. 6 is Mu here and this is x here seven is the X. You put all these values and once you use the calculator, this gets converted to which is zero point 424 and that is 4. 24%. So there is a 4. 24% chance that you will have seven people coming in 10 minutes. So that’s how you solve your poison distribution.

**44. Process capability indices – Part 1 (BOK V.F.1) **

Earlier. Also we have talked that in any process there is variation. You cannot have two things similar. So there will be some variation or another. Same is the case with the processes. So any process will produce variation. Whether that variation is acceptable within the range the customer is expecting from us, that is the question which will be solved by process capability indices. So there is some set of expectations from customer and there is some level of variation in the process. So matching these two gives you a ratio which is process capability. So let’s put it in a simple term. Process capability is voice of customer, voice of customer, what customer is expecting divided by voice of process. So if we are looking at variation, if the process is producing less variation than what customer is expecting, then this ratio will be greater than one.

So greater than one means this is going to satisfy customer. And if this is just is equal to one, then we can say we are just meeting what customer is expecting from us. So going back to the definition here, this is the ratio of the spread between the process specification. So this is the ratio between the process specification to the spread of the process value. So there is something called specification. Specification is something which is decided by customer, customer or your design group based on what customer is expecting from your product. So specification is what customer is looking for. And then the second part of this is spread of the process value. The spread of the process is here. Now talking about your process. If your process is producing something which is normally distributed, if this is the outcome of your process which is producing things which are normally distributed, then if you look at six sigma deviation or the six standard deviations so you have three sigmas or three standard deviation on the right side and three standard deviation on the left side. This is considered to be the spread of your process. So if you draw the distribution curve of your process which is normally distributed, you will see that 99. 7% things are within this range. So this is considered to be the process range. This is the upper limit of the process and this is the lower limit of the process.

On the next slide we will learn about few definitions. Upper specification, lower specification, upper control limit, lower control limit. Let’s see that on the next slide. On this slide let us understand these four definitions or these four terms. Lower specification limit, upper specification limit, lower control limit and upper control limit. These two things which are the specification limits, these are something which are decided by the customer. So this is customer driven and if you look at the control limits, these are your process driven things. What’s the specification limit? Suppose you are delivering pizza and you declare to your customers that you will be delivering pizza within 30 minutes. So anything between zero minutes to 30 minutes after placing the order, that is your specification limit. Another example of specification limit could be suppose you are making a shaft and this shaft has to go in a bearing. So this shaft has a dimension of let’s say 10 mm plus minus zero one millimeters. Because this tolerance plus -0. 1 millimeter is required to make sure that this fits well in the bearing. So if it is less than this, this might not fit into the bearing tightly, this shaft might be loose.

Or if this dimension is more then this might not go at all in the bearing. So this is your specification limit. Your specification limit to ensure that your customer gets the right product. So specification limit is either decided directly by customer or your design group, the people who are designing the product or designing the process. So this is what your specification limit is. This specification limit has got nothing to do with your process variation. Your process variation is defined by these bottom two things which are the lower control limit and the upper control limit. So for example, let’s take this example of this shaft and forget about the specification for now. And let’s look at the production. When the production is ongoing, you pick up 100 pieces of these shafts, you measure the diameter of that and you plot that as a histogram. So let’s say we draw a histogram of this. So this is your 10 mm, which was supposed to be the center point of that. So you have a lot of sharps which have this ten millimeter diameter. So this will be your 10. 00 110. 002 and till you reach 10. 01 and here you have 9. 99 on the lower side.

And if you draw the histogram and draw a normal curve on that distribution curve on that, something like this might come. This is what will decide your control limit. So these are 100 pieces. So you will find out the mean of that. In very ideal condition, the mean of this will be x bar is equal to let’s say ten millimeter, which is what we expected. So your mean is 10. You find out that your standard division, standard division here is 0. 3 mm. So if you look at this distribution, which is your normal distribution, you will see that most of these pieces are fitting within plus three standard division and minus three standard division. And as you saw in our example, if sigma is 0. 3, so then this three sigma will be 0. 9, which is roughly is equal to 0. 1.

So your process is meeting the specification requirement. So going back here, in this case, your upper specification limit, your upper specification limit was something which was decided by the design group. So your upper specification limit will be 10. 1. So this is your upper specification limit and your lower specification limit is 9. 99. And this is coming from the tolerance. These two were your specification limits. And what were your control limits? Your upper control limit was 10 mm plus three sigmas. And your three sigmas are 0. 9 which is coming to be 10. 9 and your lower control limit was ten -0. 9 which comes out to be 9. 991. So now in this process if you see your process is just being able to meet customer requirements. So if I draw it here on this, this is my central value which is ten specification limit USL is 10. 1, lower specification limit is 9. 99.

And what about my process that is shown by your lower control limit and upper control limit. Upper control limit was 10. 9 and lower control limit was 9. 99 one. So your control limits are within the specification limit. That means you are meeting the customer requirement. So when we talk about process capability indices, we talk about two indices. One is CP and another is CPK. So CP is here and another one is CPK which we will be talking later. So let’s take our old example of that shaft production which was supposed to be prepared in manufactured in ten plus -0. 0 1 we took sample out of that a few sample. And we found out that the x bar of that was 10 standard deviation of that 0. 3. And on the previous slide we talked about the lower and upper specification limit, lower control limit and upper control limit. So let’s put that back here.

So this is my graph. I have 10 center and I have the upper specification limit. Specification limit is 10. 1 and the lower specification limit is 9. 99. So these are my LSL and upper specification limit. And the graph which came out from those 100 pieces was something like this which was a normal distribution having the average of ten, the mean of ten and having a standard deviation of 0. 3. So if I take three sigma on this side and three sigma other side, I will get here 10. 9 as a upper control limit and I will get the lower control limit as 9. 991 as the lower control limit. So now how do I calculate CP? CP is calculated by upper specification limit minus lower specification limit at the top. So I have upper specification limit here and lower specification limit here. And if I minus these two then CP will equal to CP will be equal to 10. 1 minus 9. 99 which is upper specification limit minus lower specification limit divided by six sigmas and six sigmas are six multiplied by 0. 3.

And these six sigmas you can also call this as upper control limit minus lower control limit. We are looking at this zone and this gives me 0. 02 divided by 0. 018 and which is 20 by 18. And this gives me one point eleven. So if CP is greater than one then you are okay. You are okay for now. But you don’t have a little bit of margin here. So what is assumed is if you have a CP of greater than 1. 3. That is good. But where is the problem here? Suppose if there is a shift in the process, a shift in the mean, let’s say you find out that the mean has shifted from ten to let’s say 10. 3. So if your mean has shifted, let’s draw the same curve here. So instead of ten, if your mean has shifted, you have slightly shifted out of this. Here is your lower specification limit and here is your upper specification limit. Now, if your mean has shifted, you will see that now you have rejections here.

This area is your rejection area which is higher than the specification limit. But with the shift of mean if you calculate CP, your CP will still be one point eleventeen only. So even if your mean has shifted, you would see that you have not considered mean anywhere in the formula which is CP here. So CP gives a good indication as long as your mean is centered. But if your mean gets shifted, then your CP doesn’t give you the reliable result. So for that we have CPK. CPK considers the mean as well. So let’s look at the CPK on the next slide. So let’s go back to the same example which we took when calculating CP here we were expecting a shaft to be made with a diameter of 10 plus -0. 1 millimeter. So let me draw that what we did earlier. And with this we calculated CP and CP we calculated by USL minus LSL which came out to be 0. 2. That means 10. 1 minus 9. 99. So this comes out to be 0. 2 divided by six multiplied by sigma and sigma was 0. 3. And if I put additional zero here, this comes out to be one point eleven. So that was the CP which we had in the previous example. Now consider because of production, the value of your mean in the production gets shifted by 0. 2. So instead of ten now we are getting x bar is equal to 10. 2. So there has been slight shift in the mean and which means that now this is our new mean which is 10. 2. Because of this slight shift, now we will see that there are more rejections. Because what was happening earlier was this was the curve earlier when the process was centered. When the process is not centered now the process moved a little bit on the right.

Once it moved a little bit on the right, you will see that some of the items are falling above the upper specification limit and that is leading to rejection. But in both these cases, whether the x bar or the mean was ten or the mean was 10. 002, CP will remain the same because CP is not taking care of the mean here. That is the drawback of CP. Whereas in CPK what we do is in CPK we take the minimum of CPU which is upper and Cpl which is lower. So we calculate two CP’s here lower and upper and how do we calculate that? This is the formula which is process mean minus LSL. So with this shift let’s see what happens here. The process mean now is 10. 2 and the lower specification limit lower specification limit is still 9. 99 and I can put additional zero here that won’t make any change. Divided by three into sigma and sigma is again the same which is 0. 3.

This gives me 0. 2 divided by 0. 9 and which is equal to twelve by nine and twelve by nine is is equal to one three. So this gives me the lower Cpl is equal to 1. 33. And now let’s calculate the upper one. Upper one we can calculate by us L which is here is again 10. 01 because that was the upper specification limit minus the process mean. With this change the process mean is 10. 2 because the mean has shifted towards the right. That’s what we said. Divided by three into standard division zero three and this comes out to be 0. 8 divided by 0. 98 by nine and which gives me zero point 88. Now let’s look at both CP, L and CPU and lower of these is zero point 88. So zero point 88, that means CPK is zero point 88 which is less than one. Less than one will definitely produce defects.

We need it preferably to be more than 1. 3 but one also we can live with that for a short term but then once it is less than one then it is a problem because it is producing defects and that we can see here itself on the diagram which we have produced here. So this was CPK and when you see sigma within here, this is the sigma which makes the difference between CP and PP because after this you will be looking at PP and PPK. After CP and CPK the only difference between CP and PP which is CP and PP or CPK and PPK the only difference is with the sigma. How would we calculate sigma when we are calculating process capability we are using sigma within, sigma within or the short term sigma. So sigma within is short term sigma. Sometimes this is represented by sigma hat as well which is estimated sigma and many times you calculate this estimated sigma from range.

You will look at that once we go to control chart in control chart when we calculate sigma we will be calculating sigma using the formula which is sigma is equal to r bar by d two. We will look at that once we look at the control chart. But R bar is this is related to the range and this is a constant. D two is a constant depending on the sample size. So this is sigma estimated sigma or sigma within or the short term sigma. But once we look at the PP and PPK we will be looking at the actual sigma and or the long term sigma. We will talk about.

**45. Process capability indices – Part 2 (BOK V.F.1) **

Why do we need process capability study? Why we are doing this? I could have taken this topic before we started explaining CP and CPK, but I deliberately kept it later because I just wanted to give you an idea what we are calculating. And now once we know what we are calculating, now let’s look at that. That why we are doing that. What’s the purpose of doing process capability studies? Number one here is to understand the behavior of new repaired or adjusted equipment. So in this, once you have adjusted the center point of the machine, the standard deviation, what this machine is giving, based on that, you know that whether your machine will be able to meet the specification or not, whether your machine is new or whether you are repairing the machine or whether you are adjusting the equipment. When you are adjusting the equipment, you need to make sure that your adjustment is at the center of upper and lower specification LSL and USL. So once the mean or the average of your production is at the center, there’s a good chance that your products will be less rejected. Most of your products will be within the specification range. And of course for that you need standard division to be less. And the other purpose of this is to review the tolerance.

Now, in the previous example, when I said that the tolerance for this shaft is 0. 1, you know your machine, whether your machine is able to produce that or not. Because if the sigma of your machine was zero three and the tolerance was plus minus zero one, you knew that somehow you were able to manage that. So here you need to consider whether you need to revise the tolerance, whether your tolerances are too tight and do you really need that tolerance or do you need a machine which has a better consistency, which has a less standard deviation?

That’s something for you to look at. Once you have gone through this study, study of process capability of the machine and in the company you might have different machines with the different capabilities, different variation, different standard deviations. Based on these studies, you can decide that what machine you can allocate to what manufacturing, the places where there are tight tolerances, you will have machine which has less standard deviation, or where there’s a chance that you can have flexibility, you can have machine which is giving you more standard deviation.

So that’s the whole purpose of doing this process capability study. And what are the conditions which need to be met to find out the process capability indices? The first thing is that the sample should be representative of the population. That is true because whatever sample you are choosing, maybe 2030 pieces which you are picking. And based on that you are doing the calculation, you are finding out the mean and the standard deviation. And based on that you are finding the process capability. Those 2030 samples should be the true representative, true representative of the overall production. Another thing here is that your distribution of the data should be normal distribution.

As you have seen that in all the cases we have drawn this chart, when we were calculating the process capability, we put here lower specification, upper specification, lower control limit, upper control limit. This was all based on normal distribution of data. What will happen if your data is not normal? There is another lecture on that which tells what do you do when your data is not normal? What you do is you actually make that normal. You transform your data to normal. We will be talking about that later in this section. Another thing is that the process must be in statistical control. Because if it is not, then you cannot use the process capability. Because if there is some special cause, you need to find that out. You need to find out the special cause. Eliminate that. Once you have eliminated, once your process is stable, then only go for process capability study. And the fourth point here is that the sample size must be sufficient. You cannot find out the process capability just based on 1015 pieces. There is at least you need to have 2030 pieces to find out the sample mean and the sample standard deviation. And based on that, you can find out the process capability indices.

This slide tells you when your upper and lower specification limit are, let’s say within six sigma. So let me draw that to make things clear. Let’s take this example. In this example, the upper specification limit and lower specification limits are covering the six sigmas. So if they are covering six sigma so this is your upper specification limit, this is your lower specification limit. And if I draw the normal chart or the normal curve on this, this will be fitting like this. These are three sigmas here and three sigmas on the left. And this is the center in this case where US L and SL covers six sigmas. Then your CP will be CP will be as in the formula USL minus LSL, which is six sigma divided by six sigma.

That was the formula. So this will give you CP is equal to one. So when CP is equal to one, you get 99. 73% data within this plus minus three sigma. So your 99. 73% information or data is within plus minus three sigma. You still have zero point 27% on both sides. This side and that side together makes zero point 27% repairs or the rejections. If you can fit more sigmas into your upper and lower specification limit, then your CP gets increased. So again, in this case, your CP will be upper specification limit minus lower specification limit. If that is eight sigmas. If eight sigmas can fit into that, divided by six sigma will give you 1. 33 as your CP. And in this case, using the normal distribution, you can find out that the rejection rate will be 64 parts per million and so on for ten sigma and twelve sigma. So this table is just given here for reference that if you have various numbers of sigmas you can fit within upper and lower specification limit what is going to be the rejection rate.

- Category: Uncategorized

Comments

* The most recent comment are at the top
Interesting posts

CompTIA CYSA+ CS0-002 – Enumeration Tools Part 1

1. Enumeration Tools (OBJ 1.4) Enumeration tools. In this lesson, we’re going to talk about some of the enumeration tools that we’re going to experience as we’re trying to enumerate our networks. Now, what exactly is enumeration? Well, enumeration is the process to identify and scan network ranges and hosts that belong to the target… Read More »

CompTIA CYSA+ CS0-002 – Vulnerability Scanning Part 3

6. Scheduling and Constraints (OBJ 1.3) Scheduling and constraints. In this lesson, we’re going to talk about scheduling and constraints. So the first question I have for you is, how often should you scan? Well, this is going to be determined based on your internal risk management decisions of your organization. If you have a… Read More »

CompTIA CYSA+ CS0-002 – Vulnerability Scanning Part 2

4. Scanner Types (OBJ 1.3) Scanner types. In this lesson, we’re going to talk about the different ways you can configure your scanner. Now, different scanners have different capabilities. Some are going to be passive, some are going to be active, and some are going to be active with particular configurations that we’re going to… Read More »

CompTIA CYSA+ CS0-002 – Vulnerability Scanning Part 1

1. Identifying Vulnerabilities (OBJ 1.3) Identifying vulnerabilities. In this lesson, we’re going to talk about the importance of identifying vulnerabilities. And the way we do this is through a vulnerability assessment. Now, it is really important to identify vulnerabilities so that you can then mitigate those vulnerabilities. Remember, every vulnerability in your system represents a… Read More »

CompTIA CYSA+ CS0-002 – Mitigating Vulnerabilities Part 2

4. Hardening and Patching (OBJ 1.3) Hardening and patching. In this lesson we’re going to talk about two key terms. And I know I’ve used these words before, but we’ve never really defined them. These are hardening and patching. Now, when I talk about system hardening, this is the process by which a host or… Read More »

CompTIA CYSA+ CS0-002 – Mitigating Vulnerabilities Part 1

1. Mitigating Vulnerabilities (Introduction) In this section of the course, we’re going to cover how to analyze output from vulnerability scanners. We’re going to stay in domain one in this section of the course, but we are going to cover multiple objectives this time, including objective 1213 and one four. Now, objective one two states… Read More »