Reliability, Safety, Governance, and Future Trends

Introduction

Sensors and actuators are the physical interface between a mechatronic system and the world. A faulty temperature sensor can cause thermal damage; an incorrect position signal can produce an unsafe robot motion; a compromised networked actuator can become a cybersecurity hazard. Consequently, sensor and actuator engineering extends beyond selecting accuracy, range, and response time. It requires systematic management of failure, risk, evidence, data, lifecycle cost, environmental stress, and social responsibility.

Reliability asks whether equipment performs its required function for a specified time and environment. Safety asks whether hazards are controlled so that people and assets are protected. Governance establishes who may make decisions, what evidence is required, how changes are controlled, and how accountability is maintained. These concerns are interdependent: a highly reliable but poorly secured actuator may still be unsafe, while a safe design that cannot be maintained may become unreliable in service.

This chapter develops practical methods for applying redundancy, diagnostics, functional safety, cybersecurity, verification, qualification, standards, responsible data practices, procurement analysis, sustainability, and emerging technologies to mechatronic systems.

Learning objectives

By the end of this chapter, the reader should be able to:

1. distinguish reliability, availability, maintainability, safety, and security;
2. analyse simple series and redundant sensor architectures;
3. design basic fault-detection and fail-safe strategies;
4. explain the purpose of functional-safety lifecycle activities and standards;
5. integrate cybersecurity and responsible data governance into sensor systems;
6. plan verification, validation, and environmental qualification;
7. evaluate procurement using total cost of ownership and obsolescence risk; and
8. assess sustainability, ethics, and emerging technologies in autonomous mechatronic systems.

1. Reliability concepts and quantitative models

Reliability is the probability that an item performs its required function under stated conditions for a stated period. Availability is the proportion of time that a repairable system is operational. Maintainability describes how readily a system can be restored after failure. These are different properties. A device can be reliable but difficult to repair, or frequently repairable but inherently unreliable.

For a non-repairable component with a constant failure rate λ, the exponential model gives:

Here, R(t) is reliability at time t, λ is the constant failure rate in failures per unit time, and e is the base of natural logarithms. The model assumes statistically independent failures, a constant hazard rate, and operation within the specified environment. It is often reasonable during the useful-life period, but not during early manufacturing defects or wear-out.

The mean time to failure under this model is:

For a repairable item, a simple steady-state availability approximation is:

where MTBF is mean time between failures and MTTR is mean time to repair. This approximation assumes stable failure and repair processes and excludes logistical delays unless they are included in MTTR.

Series and redundant systems

In a series system, every element must operate. If failures are independent, system reliability is:

Thus, adding components in series generally reduces reliability. A simple parallel-redundant system works if at least one of two independent channels works:

Redundancy improves reliability only if the channels are sufficiently independent. Shared power, a common connector, common software, electromagnetic interference, or a common environmental cause can defeat both channels. This is called a common-cause failure.

A 1oo2 architecture means “one out of two” channels is sufficient for the function. A 2oo3 architecture requires agreement from at least two of three channels and can tolerate one disagreeing channel while reducing the effect of a single erroneous measurement. Voting does not automatically provide safety: a systematic design error affecting all channels remains possible.

Worked example: redundant position sensing

Two independent position sensors each have reliability 0.98 over the required mission. If either valid sensor can support a safe degraded mode, then:

R_parallel = 1 − (1 − 0.98)(1 − 0.98) = 1 − 0.0004 = 0.9996

The idealized reliability is 0.9996. However, if both sensors share a power converter whose failure disables both, the actual system reliability is lower. The calculation is therefore a design estimate, not proof of safety.

2. Fault detection, diagnosis, and graceful degradation

A dependable system must detect unacceptable behaviour and respond predictably. Typical fault classes include:

• hard failure: open circuit, short circuit, seized actuator, or loss of supply;
• drift: gradual change in calibration;
• intermittent failure: behaviour that appears and disappears with vibration, temperature, or wiring movement;
• stuck-at fault: a signal remains constant despite changing conditions;
• outlier or spike: an implausible transient value;
• latent fault: a failure not revealed until a protective function is demanded; and
• systematic fault: a design, software, specification, or manufacturing error repeated across units.

Useful diagnostic methods include range checks, rate-of-change checks, plausibility checks against physical models, watchdog timers, loop-current monitoring, communication error detection, built-in test routines, and comparison of independent sensors. A diagnostic should have a defined response: alert the operator, substitute a validated estimate, move to a safe state, limit energy, or shut down.

A sensor estimate may be checked using a residual:

where y_measured is the measured output and y_model is a predicted value. A fault flag may be generated when the residual exceeds a threshold, but the threshold must account for noise, model error, latency, and changing operating conditions. A fixed threshold that is suitable at low speed may be inappropriate at high speed.

Graceful degradation means retaining a restricted, explicitly safe function after a fault. For example, a mobile robot may reduce speed and disable autonomous operation after losing one ranging sensor. Degradation is acceptable only when the resulting risk has been analysed and communicated.

3. Functional safety and risk reduction

Functional safety concerns the behaviour of safety-related control systems when faults occur. It is not identical to general product safety. A mechanically strong guard addresses one hazard; a safety-rated position sensor and a monitored emergency-stop circuit address control-system contributions to risk.

A common lifecycle is:

1. define the intended function and operating context;
2. identify hazards and foreseeable misuse;
3. estimate risk using severity, exposure, and possibility of avoidance;
4. specify safety functions and required integrity;
5. design hardware, software, diagnostics, and independence;
6. verify each requirement and validate the integrated system;
7. commission, operate, maintain, modify, and decommission under controlled procedures.

Risk assessment should be evidence-based rather than a numerical exercise performed without engineering judgement. A risk matrix can support prioritisation, but matrix categories are not universal measures of probability.

A safety function is a defined response to a hazardous event, such as “when overspeed is detected, remove drive torque within the specified time.” Its specification should include initiating conditions, safe state, response time, diagnostic coverage, reset rules, foreseeable faults, and proof-test or maintenance requirements.

Standards commonly encountered include IEC 61508 for functional safety of electrical, electronic, and programmable electronic safety-related systems; ISO 13849 and IEC 62061 for machinery control systems; ISO 10218 for industrial robots; ISO 26262 for road-vehicle functional safety; IEC 62443 for industrial automation and control-system cybersecurity; and ISO/IEC 27001 for information-security management. Standards must be applied according to their scope and current edition. Certification to a standard does not make every application safe; the integrator remains responsible for the actual system and operating context.

Safety integrity and independence

Safety integrity is the likelihood that a safety-related function performs when required. Higher integrity demands stronger architecture, diagnostics, development controls, competence, and evidence. Independence is especially important: two sensors are not genuinely independent if they share the same flawed algorithm, power supply, installation error, or environmental vulnerability.

The preferred hierarchy of risk reduction is normally:

1. eliminate the hazard through inherently safer design;
2. reduce energy, speed, force, or access;
3. add guards and protective devices;
4. use monitored control functions;
5. provide warnings, training, and personal protective equipment.

Warnings alone are weak controls because they depend on human attention and correct interpretation.

4. Cybersecurity of connected sensors and actuators

Connectivity expands capability and attack surface. Threats include unauthorised commands, altered measurements, denial of service, credential theft, malicious firmware, insecure update mechanisms, and attacks through maintenance laptops or cloud services. The physical consequences can include unexpected motion, disabled protection, incorrect process control, or unsafe overheating.

Security should be designed in rather than added after deployment. Core practices include:

• asset identification and a current system inventory;
• threat modelling and trust-boundary analysis;
• least privilege and role-based access;
• unique device identities and strong authentication;
• encryption and integrity protection for sensitive communications;
• signed, authenticated, and recoverable firmware updates;
• secure boot where appropriate;
• network segmentation and controlled gateways;
• logging, time synchronisation, monitoring, and incident response;
• vulnerability management and coordinated disclosure; and
• a secure end-of-life process that revokes credentials and protects stored data.

Security and safety must be coordinated. A security update that changes timing or control logic requires safety impact assessment, regression testing, configuration control, and possibly revalidation. Conversely, a safety shutdown must not be so easy to trigger remotely that it becomes a denial-of-service mechanism.

5. Verification, validation, and environmental qualification

Verification asks, “Was the system built according to its specified requirements?” Examples include calibration checks, timing measurements, code reviews, interface tests, and tolerance analysis. Validation asks, “Does the system satisfy the real operational need in its intended context?” A sensor can pass laboratory accuracy tests yet fail validation because its field of view is blocked, its maintenance procedure is impractical, or operators misunderstand its alarm.

A requirements traceability matrix links each requirement to design elements, test methods, results, and approval records. Good requirements are measurable, unambiguous, feasible, and configuration-controlled. Test evidence should identify equipment, calibration status, software version, environmental conditions, acceptance criteria, deviations, and responsible personnel.

Environmental qualification should reflect the intended service profile. Relevant stresses include temperature range and cycling, humidity, condensation, vibration, shock, dust, water or chemical ingress, corrosion, electromagnetic compatibility, radiation, pressure, and mechanical loading. Testing should distinguish:

• design qualification: demonstrates that the design can meet requirements;
• production qualification: demonstrates that manufactured units are consistent; and
• acceptance testing: checks the supplied unit or installation.

Accelerated testing can reveal weaknesses earlier, but acceleration must be physically justified. For example, raising temperature may accelerate a chemical reaction, but it may not correctly represent vibration-induced connector failure. Over-testing can also create unrealistic failure mechanisms.

Calibration is part of lifecycle control. A calibration interval should be based on stability evidence, risk, usage, and manufacturer information—not merely habit. Traceability to a recognised measurement standard supports comparability, but traceability does not guarantee that the instrument is suitable for the application.

6. Procurement, total cost of ownership, and obsolescence

The purchase price of a sensor is often a small fraction of lifecycle cost. A useful total-cost model is:

where C_acq is acquisition cost, C_int integration and commissioning cost, C_oper operating cost, C_maint maintenance and calibration cost, C_downtime expected downtime cost, and C_disposal end-of-life cost. All terms should refer to the same currency, time basis, and lifecycle boundary. If costs occur at different times, a discounted cash-flow method may be appropriate.

Procurement specifications should cover performance, interfaces, diagnostics, environmental ratings, cybersecurity, documentation, spare parts, calibration, repairability, firmware support, change notification, and evidence of compliance. A low-cost component may be unsuitable if it has poor documentation, uncertain supply, proprietary software, or no migration path.

Obsolescence includes discontinued components, unavailable software tools, unsupported communication protocols, and loss of specialist knowledge. Mitigation includes approved alternates, form-fit-function compatibility, inventory policy, last-time-buy analysis, open interfaces, version-controlled source and configuration data, and planned redesign triggers. Critical systems should not depend on a single undocumented supplier.

7. Governance, data responsibility, and ethics

Sensor data may reveal worker activity, location, health status, production performance, or household behaviour. Responsible governance requires purpose limitation, data minimisation, accuracy management, retention limits, access control, transparency, and lawful processing. Data collected for machine protection should not automatically be repurposed for employee surveillance.

Governance questions include:

• Who owns the data, and who is accountable for its accuracy?
• Which measurements are necessary for the stated purpose?
• How long should raw and derived data be retained?
• Can individuals access, correct, or challenge consequential decisions?
• Are automated decisions explainable and reviewable?
• How are consent, workplace power imbalance, and vulnerable users addressed?
• What happens when data are transferred across organisations or countries?

Machine-learning models introduce additional risks. A predictive-maintenance model may perform well in laboratory data but fail after a sensor replacement, seasonal change, or new operating regime. Model performance should therefore be monitored for drift, false negatives, false positives, and unequal impacts. Human override, uncertainty reporting, and a safe fallback are essential where errors can cause harm.

Ethical engineering also includes accessibility, honest communication of uncertainty, avoidance of misleading reliability claims, respect for worker autonomy, and consideration of electronic waste and mineral supply chains. Compliance is a minimum obligation, not a substitute for professional judgement.

8. Sustainability and circular design

Sustainable sensor and actuator design considers the complete lifecycle: extraction, manufacturing, transport, operation, maintenance, reuse, and disposal. Design opportunities include low-power operation, energy harvesting where technically justified, modular replacement, repairable packaging, recyclable materials, reduced standby consumption, and long service life.

The environmental benefit of a new sensor must be evaluated against its total impact. A self-powered sensor may eliminate battery replacement but require rare materials or frequent replacement of a fragile harvester. Digital monitoring can reduce energy consumption in a factory, but additional networking and data-centre loads should be included in the assessment.

Life-cycle assessment can compare alternatives using a defined functional unit, system boundary, inventory, and impact categories. Results are sensitive to assumptions; claims should therefore disclose boundaries and uncertainty rather than presenting a single number as universal truth.

9. Future trends

Self-powered and energy-aware sensors

Energy harvesting from vibration, light, temperature gradients, or radio frequency fields can support low-power sensing. The harvested energy is usually intermittent and application-dependent. Designers must budget energy for sensing, processing, communication, storage, and startup, while ensuring that loss of harvested energy produces a safe and diagnosable state. Energy harvesting does not remove the need for maintenance or cybersecurity.

Flexible and printed electronics

Flexible substrates, printed conductors, and stretchable sensors enable wearable systems, soft robots, conformal structures, and smart packaging. Their challenges include hysteresis, drift, mechanical fatigue, moisture sensitivity, calibration variation, and complex manufacturing qualification. A flexible sensor should be evaluated under realistic bending, stretching, skin contact, and cleaning conditions rather than only on a flat bench.

Robotics and autonomous systems

Autonomous systems combine perception, estimation, planning, and actuation. Reliability must be considered at system level: a highly accurate camera does not compensate for an unhandled blind spot or an actuator that cannot brake safely. Operational design domains should define where and under what conditions autonomy is valid. Outside that domain, the system should slow, request assistance, or transition to a verified minimal-risk condition.

Sensor fusion can improve robustness, but fusion may also hide disagreement. Systems should retain sensor-health information, estimate uncertainty, detect out-of-distribution conditions, and record sufficient event data for investigation. Autonomous decisions affecting people require accountability, contestability, cybersecurity, and human-centred design.

Digital twins and edge intelligence

Digital twins connect physical assets with models and operational data. They can support diagnosis, what-if analysis, and predictive maintenance, but model validity must be maintained as equipment ages or changes. Edge computing can reduce latency and bandwidth, while creating additional software, update, and security obligations.

10. Illustrative case: safeguarding an autonomous warehouse vehicle

Background

A warehouse vehicle uses wheel encoders, lidar, cameras, an inertial unit, and motor drives to transport materials among workers and storage racks.

Problem

Near-miss events occur when reflective packaging causes lidar dropouts. A single camera is also occasionally blinded by direct sunlight. The original design treats each sensor as equally trustworthy and has no controlled degraded mode.

Analysis

The hazard is unintended vehicle motion or failure to detect a person. The risk assessment identifies sensor obstruction, common power loss, software faults, wireless interference, and malicious command injection. Simply adding a second identical lidar would not address common environmental effects or shared software defects.

Approach

The revised design uses diverse sensing: lidar and camera data are checked against wheel odometry and inertial estimates. Residual and plausibility checks identify disagreement. If confidence falls below the validated operating threshold, speed is limited; if the required perception function is unavailable, the vehicle applies a controlled stop. Independent power monitoring detects loss of a sensing branch. Safety-related commands are separated from ordinary diagnostics, authenticated, logged, and protected by network segmentation. Verification includes sunlight, reflective surfaces, dust, vibration, low battery, communication loss, and sensor replacement. Operators receive a clear fault indication and recovery procedure.

Outcome

The vehicle is not claimed to be fail-operational in every circumstance. Instead, its operating domain is explicit, failures are detected earlier, and the response is predictable. Maintenance records show which sensor, software version, and environmental condition preceded each event.

Learning points

1. Redundancy must address independence and common-cause failure.
2. Safety is a system property, not a component label.
3. Degraded modes require validation, not informal assumptions.
4. Cybersecurity, maintenance, and safety evidence must be integrated.
5. Operational data are valuable only when governed and interpreted responsibly.

Best-practice checklist

Before approving a sensor or actuator subsystem, an engineer should be able to answer:

• What function is required, under which conditions, and for how long?
• What happens when the device gives an incorrect but plausible value?
• Are redundancy and diagnostics independent enough for the hazard?
• What is the defined safe state and response time?
• Which standards apply, and what evidence demonstrates conformity?
• How are firmware, credentials, logs, and updates protected?
• Has the design been verified, validated, and environmentally qualified?
• What are the total lifecycle cost and obsolescence assumptions?
• Are data collection, retention, access, and automated decisions justified?
• Can the product be maintained, repaired, reused, and responsibly disposed of?

Chapter Summary

Reliable mechatronic systems require more than accurate sensors and powerful actuators. Reliability models quantify performance assumptions; redundancy and diagnostics manage faults; functional safety defines risk-reducing control behaviour; and cybersecurity protects connected physical processes. Verification demonstrates conformity to requirements, while validation demonstrates suitability in the real operating context. Environmental qualification, calibration, configuration control, and traceability provide evidence that performance will persist in service.

Procurement decisions should use total cost of ownership, supportability, supply continuity, and obsolescence planning. Governance must protect data subjects, clarify accountability, control changes, and ensure that automated decisions remain reviewable. Sustainability requires lifecycle thinking, and emerging technologies—including self-powered sensors, flexible electronics, edge intelligence, and autonomous robotics—create opportunities alongside new failure modes and ethical responsibilities. The central professional principle is to design the complete lifecycle and failure response, not merely the nominal measurement or motion function.

Key Terms

Reliability: Probability that a required function operates for a specified time and condition.

Availability: Proportion of required time that a repairable system is operational.

Maintainability: Ease and speed with which a failed system is restored.

Failure rate: Frequency of failure under specified conditions, often denoted λ.

Redundancy: Provision of additional elements so a function can tolerate some failures.

Common-cause failure: One cause that disables multiple supposedly redundant channels.

Fault detection: Identification that behaviour is outside acceptable limits.

Residual: Difference between a measured value and a predicted or reference value.

Graceful degradation: Continued operation with reduced, controlled capability after a fault.

Functional safety: Safety achieved through correct operation of safety-related control systems.

Safety function: Defined control response that reduces a specified hazard.

Verification: Evidence that specified requirements have been met.

Validation: Evidence that the system fulfils its intended real-world purpose.

Environmental qualification: Demonstration of performance under representative stresses.

Total cost of ownership: Acquisition, operation, maintenance, downtime, and disposal costs over the lifecycle.

Obsolescence: Loss of technical, commercial, or support viability of a component or system.

Threat modelling: Structured analysis of assets, vulnerabilities, threats, and consequences.

Data minimisation: Collection of only the data necessary for a legitimate purpose.

Operating domain: Conditions and boundaries within which an autonomous function is validated.

Digital twin: A maintained digital representation linked to a physical asset.

Review Questions

Short Answer Questions

1. Distinguish reliability from availability and maintainability.
2. Why can redundancy fail to improve safety?
3. What is the difference between verification and validation?
4. List four cybersecurity controls for connected actuators.
5. Why should total cost of ownership include downtime and disposal?

Long Answer Questions

1. Explain how a functional-safety lifecycle manages risk from hazard identification through operation and modification.
2. Compare 1oo2 and 2oo3 sensing architectures, including their advantages and limitations.
3. Discuss how environmental qualification and calibration contribute to trustworthy sensor data.
4. Explain responsible governance of sensor data in a workplace monitoring application.
5. Evaluate the sustainability and engineering challenges of self-powered and flexible sensors.

Analytical / Application Questions

1. Two independent sensors each have reliability 0.97 over a mission, and either can support a safe degraded mode. Calculate the ideal parallel reliability and identify two reasons why the real value may be lower.
2. Design a fault-response strategy for a robotic actuator whose position sensor becomes intermittent during high-speed motion. State detection methods, safe state, diagnostics, and validation tests.
3. A manufacturer proposes replacing a supported industrial sensor with a cheaper cloud-connected alternative. Analyse the proposal using safety, cybersecurity, TCO, obsolescence, data governance, and sustainability criteria.

Multiple Choice Questions with Answers

Question 1

For a component with a constant failure rate λ, which expression gives reliability at time t?

A. R(t) = 1 − λt

B. R(t) = e^(−λt)

C. R(t) = λ/t

D. R(t) = t/λ

Correct Answer: B. R(t) = e^(−λt)

Question 2

What is the principal purpose of a safety function?

A. To maximise production speed

B. To reduce a specified hazard through a defined control response

C. To replace all mechanical guards

D. To eliminate the need for maintenance

Correct Answer: B. To reduce a specified hazard through a defined control response

Question 3

Which condition most directly creates a common-cause failure?

A. Two sensors use separate power supplies and different technologies

B. Two channels share a power converter that fails

C. A system has a documented maintenance interval

D. A sensor has a calibrated output

Correct Answer: B. Two channels share a power converter that fails

Question 4

Verification primarily determines whether:

A. The system meets specified requirements

B. Operators prefer the product interface

C. The product has the lowest purchase price

D. A business has selected its supplier

Correct Answer: A. The system meets specified requirements

Question 5

If MTBF is 900 hours and MTTR is 100 hours, the approximate steady-state availability is:

A. 0.10

B. 0.50

C. 0.90

D. 1.00

Correct Answer: C. 0.90

Question 6

Which practice best supports secure firmware updates?

A. Using one shared default password

B. Allowing unsigned updates from any network

C. Using authenticated and integrity-protected updates

D. Disabling all event logging

Correct Answer: C. Using authenticated and integrity-protected updates

Question 7

Which item is normally included in total cost of ownership?

A. Only the purchase price

B. Acquisition, maintenance, downtime, and disposal costs

C. Only the advertising cost

D. Only the sensor’s measurement range

Correct Answer: B. Acquisition, maintenance, downtime, and disposal costs

Question 8

What is data minimisation?

A. Collecting every available measurement indefinitely

B. Collecting only data necessary for a legitimate purpose

C. Deleting all calibration records

D. Allowing unrestricted access to raw data

Correct Answer: B. Collecting only data necessary for a legitimate purpose

Question 9

Why may a second identical sensor fail to provide effective redundancy?

A. Identical sensors always have different interfaces

B. They may share the same environmental or systematic failure

C. Redundancy is useful only for actuators

D. A second sensor necessarily reduces sampling rate to zero

Correct Answer: B. They may share the same environmental or systematic failure

Question 10

What is the main significance of an autonomous system’s operational design domain?

A. It defines the conditions in which the autonomy has been validated

B. It guarantees correct operation in every environment

C. It removes the need for human oversight

D. It specifies only the purchase price

Correct Answer: A. It defines the conditions in which the autonomy has been validated