Reliability, Maintenance, Safety and Lifecycle Governance

Introduction

Mechatronic systems combine mechanical structures, electrical power, sensors, actuators, embedded software, communications and human interaction. Their performance therefore depends not only on whether individual components are correctly designed, but also on how failures are detected, maintenance is planned, hazards are controlled and system changes are governed throughout the asset life cycle.

Reliability and maintenance are strategic engineering concerns. A failed actuator may stop production, damage a product or create a safety hazard. An inadequate software revision may invalidate a previous risk assessment. A poorly controlled replacement component may fit mechanically but alter electrical protection or control behaviour. Consequently, reliability engineering must be integrated with design, procurement, commissioning, operation, maintenance, modification and decommissioning.

This chapter develops practical foundations for failure mode and effects analysis (FMEA), fault-tree analysis (FTA), reliability metrics, condition monitoring, maintainability, maintenance policies, machinery safety, standards compliance, configuration control and ethical lifecycle governance.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Explain reliability, availability, maintainability and safety as related but distinct properties.
2. Calculate and interpret basic reliability and failure-rate measures.
3. Apply FMEA and fault-tree concepts to mechatronic systems.
4. Select suitable corrective, preventive, predictive and reliability-centred maintenance actions.
5. Explain condition-monitoring methods and their limitations.
6. Conduct a structured machinery risk assessment and identify risk-reduction measures.
7. Describe the roles of standards, technical files, configuration control and change management.
8. Evaluate ethical and lifecycle implications of engineering decisions.

1. Reliability, Availability and Maintainability

1.1 Reliability

Reliability is the probability that an item performs its required function, under stated conditions, for a specified period. The definition contains four essential elements: the item, its function, the operating conditions and the time interval. Saying that a motor is “reliable” without specifying load, speed, environment and mission duration is technically incomplete.

For a non-repairable item, reliability is commonly written as:

where T is the random time to failure, F(t) is the cumulative distribution function and R(t) is reliability at time t. The expression is dimensionless and applies to a defined population of statistically comparable items.

For an exponential lifetime distribution with constant failure rate λ:

Here λ has units of failures per unit time. The exponential model assumes a constant hazard rate and is often useful for the random-failure portion of a component’s life, but it should not be applied automatically to every failure mechanism. Wear-out, corrosion and fatigue generally produce time-varying failure rates.

The mean time to failure for the exponential model is:

MTTF applies to non-repairable items. For repairable equipment, mean time between failures (MTBF) is often reported, but its interpretation depends on how failures and operating time are defined. MTBF should not be treated as a guarantee that every item will operate for that duration.

1.2 Failure rate and hazard

The instantaneous hazard rate is:

where f(t) is the probability density of failure time. Hazard is a conditional rate: the tendency to fail immediately after surviving to time t. A “bathtub curve” is a conceptual model containing early failures, a relatively constant random-failure period and a wear-out period. Real products may not display all three regions clearly, and preventive replacement is justified only when age-related failure behaviour is supported by evidence.

1.3 Availability and maintainability

Availability is the probability that an item is able to perform its function when required. For a simple steady-state repairable system:

where MTTR is mean time to repair. The formula assumes alternating operating and repair states, statistically stable averages and consistent definitions of failure and restoration. Logistics delays, waiting for parts and administrative time may be included in operational availability but excluded from technical repair time; the definition must therefore be stated.

Maintainability is the probability that a failed item can be restored to a specified condition within a given time using prescribed procedures and resources. Design features that improve maintainability include modular replacement, accessible inspection points, standard fasteners, diagnostic indicators, safe isolation points, clear documentation and training.

Reliability and maintainability are not substitutes. A highly reliable machine that takes several days to repair may have poor availability; a machine that is easy to repair but fails frequently may also have poor availability.

1.4 Series and parallel systems

For statistically independent components in series, the system functions only if every component functions:

For two independent, identical components in parallel, the system functions if at least one functions:

These relationships assume clearly defined success states and statistical independence. Common-cause failures, shared power supplies, environmental exposure and software defects can invalidate the simple calculation. Redundancy may also introduce new failure modes, such as incorrect switching or common maintenance errors.

Worked Example 1: Reliability and availability

A sensor has a constant failure rate of 0.0002 failures per operating hour. Its exponential-model reliability after 1,000 hours is:

Thus approximately 81.9% of a comparable population is expected to survive 1,000 hours under the stated assumptions. Its MTTF is:

If a repairable subsystem has MTBF = 2,000 h and MTTR = 10 h, then:

The idealized steady-state availability is approximately 99.50%, before additional planned downtime, spares delays or operational constraints are considered.

2. Failure Analysis: FMEA and Fault Trees

2.1 Failure mode and effects analysis

FMEA is a bottom-up, structured method. The analysis begins with functions or components, identifies ways they can fail, and traces local effects, system effects and possible consequences. A useful FMEA table includes:

Common failure modes include open circuit, short circuit, excessive friction, leakage, loss of calibration, seizure, incorrect data, intermittent connection and unintended operation. The analysis must consider both failure to operate and unsafe operation.

Traditional FMEA scoring often uses severity S, occurrence O and detection D, each assigned an ordinal rating. A risk priority number may be calculated as:

This is a prioritization aid, not a physical probability or a complete risk measure. Ordinal scores are not necessarily linear, and a high-severity hazard should not be dismissed merely because its RPN is lower. Modern practice supplements or replaces RPN with action thresholds, criticality categories, quantitative failure data and explicit safety requirements.

FMEA is most effective when multidisciplinary. Mechanical, electrical, controls, software, operations, maintenance and safety personnel may identify different causes and effects. The analysis should be updated after testing, field failures, design changes and incidents.

2.2 Fault-tree analysis

FTA is a top-down deductive method. It begins with a defined top event, such as “unexpected conveyor motion,” and decomposes it into combinations of contributing events using logic gates.

For independent events A and B:

• An OR gate occurs if A or B causes the output. Its probability is approximately P(A ∪ B) = P(A) + P(B) − P(A)P(B) for independent events.
• An AND gate occurs only if both A and B occur. Its probability is P(A ∩ B) = P(A)P(B) for independent events.

For rare independent events, the OR approximation P(A ∪ B) ≈ P(A) + P(B) may be useful, but only when the product term is negligible. Common-cause failures and dependent events require a more careful model.

FMEA asks, “How can this component fail and what will result?” FTA asks, “What combinations can produce this undesired event?” The methods are complementary. FMEA is particularly useful for completeness at component level; FTA is useful for analysing system-level hazards and identifying minimal cut sets.

3. Maintenance Strategies and Condition Monitoring

3.1 Maintenance policies

Corrective maintenance restores a failed item. It may be appropriate where failure has low consequence, repair is rapid and redundancy exists. It is unacceptable as the sole strategy where failure can cause injury, major environmental harm or catastrophic production loss.

Preventive maintenance is performed at predetermined intervals or usage levels. Time-based inspection, lubrication and replacement can control known age-related mechanisms. However, unnecessary replacement may introduce installation errors, consume resources and discard components that still have useful life.

Predictive or condition-based maintenance uses measured evidence of degradation. It is justified when a measurable condition indicator changes sufficiently before functional failure and when intervention can be scheduled.

Reliability-centred maintenance (RCM) selects tasks according to functions, functional failures, failure modes, consequences and technically feasible maintenance actions. It does not mean maintaining everything frequently. It seeks the most effective combination of scheduled tasks, condition monitoring, failure-finding, redesign and run-to-failure decisions.

3.2 Condition-monitoring methods

Typical methods include:

A condition-monitoring programme requires a baseline, a measurement method, a sampling interval, alarm limits and a response plan. A sensor that produces data without a decision rule is not, by itself, a maintenance system.

3.3 Diagnostic reasoning and data quality

A measured change may result from real degradation, sensor drift, altered operating conditions or data-processing error. Engineers should distinguish:

• Detection: evidence that a variable has changed.
• Diagnosis: identification of the likely fault mechanism.
• Prognosis: estimation of future condition or remaining useful life.

Artificial-intelligence models can assist anomaly detection and classification, but they require representative data, labelled failure examples or defensible unsupervised assumptions. They may fail under operating conditions not present in training data. Safety-related decisions should remain explainable, validated and subject to human responsibility. An AI alarm should support engineering judgement, not silently replace it.

4. Machinery Safety and Risk Assessment

Safety is the absence of unacceptable risk, not the absence of all risk. Risk is commonly understood as a combination of the severity of harm and the likelihood of its occurrence. A structured assessment normally includes:

1. Define the machine, intended use, reasonably foreseeable misuse, users and life-cycle phases.
2. Identify hazards, hazardous situations and initiating events.
3. Estimate risk before safeguards.
4. Reduce risk using the hierarchy of controls.
5. Verify safeguards and document residual risk.
6. Reassess after changes, incidents or new information.

The hierarchy of risk reduction generally gives priority to:

1. Inherently safe design measures, such as reducing stored energy or eliminating a sharp edge.
2. Engineering safeguards, such as fixed guards, interlocks, presence sensing, safe torque off and pressure relief.
3. Information for use, including warnings, procedures, training and personal protective equipment.

Information and PPE are important but should not compensate for avoidable design hazards. A guard that is easy to defeat, an emergency stop that does not remove the relevant hazard or a warning placed where it cannot be seen represents weak risk reduction.

4.1 Safety functions

A safety function is a control function intended to achieve or maintain a safe state. Examples include preventing start-up while a guard is open, stopping hazardous motion when a protective device is actuated and limiting speed during access. The required performance depends on the risk assessment and applicable standards.

Safety-related control systems require attention to single faults, diagnostic coverage, common-cause failure, fault tolerance, reset behaviour and predictable failure response. A standard PLC program should not automatically be assumed to provide a safety function. Safety-rated hardware, architecture, validation and documented performance may be required.

Emergency stopping is a complementary protective measure, not a replacement for guarding or inherently safe design. After an emergency stop, stored mechanical, hydraulic, pneumatic or electrical energy may remain; isolation and verification may still be necessary.

4.2 Standards and compliance

Standards provide agreed methods for risk assessment, electrical safety, functional safety, guarding, control systems, documentation and verification. Their applicability depends on jurisdiction, machine type and intended market. Engineers should consult current, legally applicable editions rather than relying on informal summaries.

Compliance is more than placing a label on equipment. It normally requires a defensible technical file containing design information, risk assessment, drawings, calculations, test records, declarations, instructions, residual-risk information and change history. Certification by a third party, where required, does not transfer the designer’s responsibility for a safe and correctly specified system.

5. Configuration Control and Lifecycle Governance

Configuration is the functional and physical description of a system at a defined time. It includes hardware part numbers, software versions, parameter sets, wiring, drawings, safety settings, manuals and approved deviations. Configuration control ensures that the item being operated, maintained and tested is the item that was designed and assessed.

A robust change-control process includes:

1. A clear description and rationale for the proposed change.
2. Identification of affected functions, interfaces, hazards and documents.
3. Technical and safety review.
4. Verification and, where necessary, validation.
5. Approval by authorised personnel.
6. Controlled implementation and rollback capability.
7. Updating of drawings, bills of material, software repositories, instructions and training.
8. Post-change monitoring and closure.

Examples of changes requiring review include substituting a proximity sensor, changing a servo drive parameter, modifying a safety circuit, updating firmware, changing lubrication, relocating a guard or altering production speed. A component that is “equivalent” in one dimension may not be equivalent in environmental rating, response time, diagnostic behaviour or electromagnetic compatibility.

Lifecycle governance extends beyond technical performance. It includes cybersecurity, spare-parts availability, obsolescence, energy consumption, environmental impact, accessibility, competence management, disposal and accountability for decisions. Ethical engineering requires truthful reporting of uncertainty, near misses and residual risk. Production targets never justify concealing a known hazardous defect.

6. Worked Application: Packaging Cell Reliability and Safety

Background

Consider an illustrative automated packaging cell containing a conveyor, servo-driven indexing mechanism, pneumatic gripper, optical sensors, safety gate, programmable controller and operator interface. The cell operates two shifts per day. Unplanned stops have increased, and an operator recently found the gripper moving after a sensor replacement.

Problem

The organisation initially responds by replacing failed sensors every month. This has not solved the downtime and has created concern about unexpected motion during access. The engineering team must identify technical causes, improve availability and restore confidence in the safety function.

Analysis

A simplified FMEA identifies the following modes:

The top event for an FTA is “hazardous gripper motion while the gate is open.” Possible branches include a gate switch failure, an incorrect wiring change, a safety-logic error, failure of output isolation and an ineffective reset or restart design. The team must examine dependencies: a common 24 V supply, shared wiring routes and common software parameters may defeat apparent redundancy.

Condition monitoring is added for gripper cycle time, air pressure and sensor signal quality. Trends are reviewed weekly, while immediate alarms are generated for a safety-input discrepancy. The monitoring system does not bypass the safety circuit; it provides maintenance information.

Approach and solution

The cell is placed in a controlled safe state. The replacement sensor is checked against the approved specification, wiring drawings are updated and the safety function is tested under normal and fault conditions. A guard opening must remove the relevant hazardous motion, and restart must require a deliberate reset outside the hazard zone. Pneumatic energy is isolated and vented before maintenance.

Preventive tasks are changed from monthly sensor replacement to inspection and cleaning based on contamination evidence. The pneumatic filter and gripper seals are included in a condition-based programme. Spare parts are placed under configuration control. A short functional test is required after every safety-related change.

Outcome

The organisation obtains clearer failure data, reduces unnecessary replacement and separates ordinary production alarms from safety faults. More importantly, the safety function is treated as a verified design feature rather than an assumed property of the controller. The exact numerical improvement would require measured before-and-after data; it should not be claimed without evidence.

Learning points

The case illustrates that reliability, maintenance and safety interact. A maintenance action can introduce a configuration error. A high availability target is not acceptable if it is achieved by weakening safeguards. The correct response combines analysis, design improvement, controlled parts, competent work and verification.

7. Challenges, Limitations and Best Practice

Reliability predictions are uncertain because field conditions differ from laboratory assumptions. Small samples may produce wide confidence intervals. Failure databases may under-report intermittent faults or near misses. FMEA can become a paperwork exercise if functions, causes and actions are vague. FTA can create false precision when event probabilities are guessed. Availability calculations can be misleading when downtime definitions change.

Best practice includes:

• Define functions, boundaries, mission time and operating conditions.
• Use field evidence and document assumptions.
• Analyse common-cause and dependent failures.
• Treat high-severity hazards separately from numerical rankings.
• Design for inspection, isolation, diagnosis and safe restoration.
• Link maintenance tasks to credible failure mechanisms.
• Validate safety functions after installation and change.
• Control hardware, software, parameters and documents as one configuration.
• Record failures, near misses and maintenance-induced defects.
• Review lifecycle cost, environmental effects and human consequences.

Lifecycle cost is broader than purchase price. It includes energy, consumables, planned and unplanned downtime, labour, spares, training, software support, compliance, disposal and risk. A cheaper component may increase total cost if it is difficult to diagnose or obsolete quickly.

Chapter Summary

Reliability is the probability of successful function for a stated time and condition, while maintainability concerns restoration and availability combines operating and repair behaviour. Exponential reliability equations are useful only under their constant-failure-rate assumptions. Series and parallel models require careful attention to independence and common-cause failures.

FMEA provides a bottom-up examination of failure modes, causes and effects. FTA works from a hazardous top event toward combinations of basic events. RPN may support prioritization but must not replace engineering judgement, especially for severe hazards. Corrective, preventive, predictive and reliability-centred maintenance should be selected according to failure behaviour and consequence.

Condition monitoring requires meaningful measurements, baselines, alarm limits and response actions. Machinery safety requires systematic risk assessment, inherently safe design where possible, appropriate safeguards, validation and controlled residual-risk information. Standards support compliance, but responsibility remains with the organisation and competent engineers.

Configuration control ensures that hardware, software, parameters, safety settings and documentation remain aligned. Ethical lifecycle governance requires transparency, competence, traceability and protection of people and the environment throughout design, operation, modification and disposal.

Key Terms

Reliability: Probability that an item performs its required function for a stated time under stated conditions.

Failure rate: Rate at which failures occur relative to operating exposure.

Hazard rate: Conditional instantaneous rate of failure after survival to a specified time.

MTTF: Mean time to failure for a non-repairable item.

MTBF: Mean time between defined failures of a repairable item.

MTTR: Mean time to repair and restore a repairable item.

Availability: Probability that an item is able to perform its function when required.

Maintainability: Probability of restoring an item within a specified time using stated resources.

FMEA: Bottom-up analysis of failure modes, causes and effects.

FTA: Top-down analysis of combinations leading to a defined top event.

Common-cause failure: Failure of multiple elements due to a shared cause.

Corrective maintenance: Maintenance performed after a failure to restore function.

Preventive maintenance: Scheduled maintenance intended to reduce failure probability or consequences.

Predictive maintenance: Maintenance based on evidence of condition or degradation.

Condition monitoring: Measurement and interpretation of equipment condition.

Safety function: Control function intended to achieve or maintain a safe state.

Residual risk: Risk remaining after protective measures are applied.

Configuration control: Management of approved system versions, interfaces and changes.

Lifecycle governance: Accountable management of technical, safety, ethical and environmental decisions across an asset’s life.

Review Questions

Short Answer Questions

1. Distinguish reliability from availability.
2. What assumptions underlie the exponential reliability model?
3. State one principal difference between FMEA and FTA.
4. Why is condition monitoring more than simply collecting sensor data?
5. What is the purpose of configuration control?

Long Answer Questions

1. Explain how reliability, maintainability and maintenance policy interact in determining availability.
2. Describe the stages of a machinery risk assessment and explain the hierarchy of risk reduction.
3. Compare corrective, preventive, predictive and reliability-centred maintenance, including suitable applications and limitations.
4. Explain why common-cause failures and dependencies can invalidate simple series and parallel reliability calculations.
5. Discuss the ethical responsibilities of engineers when production objectives conflict with known safety risks.

Analytical / Application Questions

1. A repairable subsystem has MTBF of 1,500 h and MTTR of 15 h. Calculate its idealized steady-state availability and identify two factors that could make operational availability lower.
2. Construct a concise FMEA for a servo-driven positioning axis that fails to reach its commanded position. Include at least four failure modes, effects, causes, controls and recommended actions.
3. Develop a fault-tree structure for the top event “operator exposed to unexpected machine motion during access.” Identify at least three basic events and discuss possible dependencies among them.

Multiple Choice Questions with Answers

Question 1

For an exponential lifetime model with failure rate λ, which expression gives reliability at time t?

A. R(t) = λt

B. R(t) = e^(−λt)

C. R(t) = 1 + λt

D. R(t) = λ/t

Correct Answer: B. R(t) = e^(−λt)

Question 2

A repairable system has MTBF = 900 h and MTTR = 10 h. What is its idealized steady-state availability?

A. 0.900

B. 0.989

C. 0.990

D. 0.999

Correct Answer: C. 0.990

Question 3

Which analysis begins with an undesired top event and works toward combinations of contributing events?

A. FMEA

B. FTA

C. Preventive maintenance scheduling

D. Baseline monitoring

Correct Answer: B. FTA

Question 4

Which maintenance strategy uses measured evidence of degradation to determine when intervention is needed?

A. Corrective maintenance

B. Run-to-failure only

C. Predictive or condition-based maintenance

D. Uncontrolled replacement

Correct Answer: C. Predictive or condition-based maintenance

Question 5

Which statement about RPN is most accurate?

A. It is a physical probability of failure.

B. It automatically represents legal safety compliance.

C. It is a prioritization aid based on ordinal scores.

D. It eliminates the need for engineering judgement.

Correct Answer: C. It is a prioritization aid based on ordinal scores.

Question 6

Which measure has the highest priority in the hierarchy of risk reduction?

A. Personal protective equipment

B. Warning labels only

C. Inherently safe design

D. Operator reliance on memory

Correct Answer: C. Inherently safe design

Question 7

What is a principal purpose of configuration control?

A. To permit undocumented substitutions

B. To keep hardware, software, parameters and documentation aligned

C. To increase maintenance intervals without evidence

D. To replace all verification testing

Correct Answer: B. To keep hardware, software, parameters and documentation aligned

Question 8

For two independent events A and B that must both occur for an AND-gate output, which relationship applies?

A. P(A ∩ B) = P(A)P(B)

B. P(A ∩ B) = P(A) + P(B)

C. P(A ∩ B) = 1 − P(A)P(B)

D. P(A ∩ B) = P(A)/P(B)

Correct Answer: A. P(A ∩ B) = P(A)P(B)

Question 9

Why should a safety-related control function not automatically be implemented as an ordinary PLC program?

A. Ordinary PLCs cannot process numerical values.

B. Safety functions require appropriate architecture, diagnostics, validation and documented performance.

C. Safety functions never use software.

D. Ordinary PLCs are always mechanically unreliable.

Correct Answer: B. Safety functions require appropriate architecture, diagnostics, validation and documented performance.

Question 10

Which statement best describes maintainability?

A. The probability that an item never fails.

B. The probability that a failed item can be restored within a stated time using specified resources.

C. The number of spare parts purchased annually.

D. The ratio of design cost to purchase cost.

Correct Answer: B. The probability that a failed item can be restored within a stated time using specified resources.