End-to-End Industry Examples

Theory earns its keep when it survives contact with a real machine. This chapter takes eight systems, one from each industry the platform serves, and works the reliability question on each of them: what fails, how often, what the structure does with those failures, and what the answer tells a designer to change.

The eight systems are the same in every concept topic of this row. The aircraft electrical system worked here for reliability is the one worked in maintainability for its repair times, in availability for its dispatch, in safety for its catastrophic failure condition and in testability for its built-in test coverage. Read a column and you learn one property across eight industries; read a row and you watch one machine reveal its five RAMS faces. All numbers are invented for teaching, chosen to be plausible and to make the arithmetic legible; none is field data from any real product.

Defence and aerospace: aircraft electrical power

Two engine-driven integrated drive generators, an auxiliary power unit generator, a ram air turbine, two generator control units and the contactors that tie the buses together. The reliability question is not "how often does a generator fail" but "how often does the aeroplane lose all of them", and the gap between those two questions is the whole design.

Summed without redundancy credit the two main generation channels (two IDGs, two GCUs and the two bus tie contactors in their path) run at 730 failures per 10⁶ flight hours, which sounds alarming until the structure is applied: one channel's unreliability over a 5-hour flight is about 1.7 × 10⁻³, and the aeroplane needs all of its sources to fail, not one. The series product law is what makes the raw sum frightening and redundancy is what makes the mission survivable, but only because the sources are genuinely different machines driven by different engines. The reliability lesson here is that the λ table is the least interesting part of the analysis: swap the two IDGs for units half as likely to fail and the loss-of-all-power number barely moves, because it is dominated by the events that take out several sources at once.

Wear-out matters too, and in a specific place. The IDG's constant-rate assumption holds for its electronics and fails for its drive, which is a mechanical assembly with a genuine ageing mechanism. Treating the whole unit as exponential understates late-life removals and overstates early ones, which is why hard-time limits exist for the drive while the electronics run to failure.

The APU generator's 300 per 10⁶ flight hours deserves a note of its own, because at first glance it is the worst item in the table and on reflection it is not. That rate is quoted per flight hour of the aircraft, but the APU generator does not run for most of them: it earns its rate on the ground and in the minority of flights where it is called on. A rate whose exposure differs from the exposure of everything around it cannot be summed with them without conversion, and mixing per-flight-hour and per-running-hour figures in one column is one of the most common arithmetic errors in a prediction review. The mission-profile discipline exists precisely to keep the clocks straight before the addition happens.

Railway: level-crossing controller

A crossing is a small system with an unusually clear reliability story, because its failures divide into two populations with completely different consequences and completely different economics.

Total crossing failure rate is 1,940 per 10⁶ hours, dominated by the barrier drives and the lamp units: the mechanical and the consumable, which is the usual finding when electronics have matured and moving parts have not. At 8,760 hours a year that is about 17 failures per crossing-year, and across the 40-crossing reference fleet, roughly 680 maintenance events a year.

The important reliability observation is the split. Of that 1,940, only 6 per 10⁶ hours are failures that could leave the crossing showing clear to road traffic with a train approaching, and the vital 2oo2 architecture drives even those down by three orders of magnitude. Everything else fails the other way: barriers down, signals to danger, road traffic stopped and trains delayed. The design has deliberately converted almost its entire failure rate into the expensive-but-harmless direction, which is a reliability decision taken for safety reasons and paid for in delay minutes. Failure direction, not failure rate, is the axis this system is optimised on.

There is a second observation the crossing offers that most systems hide. Four lamp units at 200 per 10⁶ hours contribute 800 between them, more than 40% of the total, and yet a single failed lamp does not take the crossing out of service: the arrangement tolerates it. Counting the crossing as a pure series chain therefore overstates its outage rate substantially, and the correction is not a better lamp but a better model. This is the everyday form of the structure-before-rates lesson: the same component table produces wildly different answers depending on how faithfully the redundancy and the tolerated-degradation rules are represented, and arguing about the λ values before the structure is agreed is arguing about the wrong number.

Space systems: satellite attitude control

Four reaction wheels of which three are needed, two star trackers, three magnetorquers and an onboard computer with a cold spare. Seven years, no repair, and every reliability decision made before launch.

Space-qualified rates are two orders of magnitude below the terrestrial figures elsewhere in this chapter, which is not optimism but selection: these are screened, derated, single-lot parts in a benign thermal-vacuum environment, and the programme paid for every decimal place.

Over a 61,320-hour mission the three-out-of-four wheel arrangement delivers 0.87 reliability and the whole attitude control subsystem 0.81. Two things about those numbers are worth a designer's attention. First, they are mission reliability with no repair term at all, which makes this the purest application of the survival mathematics in the foundations chapter: there is no MTBF-versus-MTTR trade to make, only the area under the survival curve.

Second, the wheels are not constant-rate items. Their bearings wear, and the fitted Weibull shape of 2.2 with a characteristic life of about 15 years means the hazard is climbing steadily through exactly the period the mission occupies. An exponential model fitted to the same mean would be optimistic late and pessimistic early, and the whole spare-wheel argument depends on getting that shape right: with β > 1, the fourth wheel is most valuable in the last two years, not the first.

The cold-spare computer adds the third lesson. Held unpowered at a tenth of its active rate, it accumulates almost no risk while waiting, which is exactly the standby argument at its most favourable: no wear, no exposure, and a full replacement waiting. What the arithmetic does not contain is whether the switchover works. On a spacecraft the changeover is a sequence of commands executed autonomously or from the ground, on a bus that must itself be healthy, into a spare that has not been exercised for years. The failure mode that ends missions is not the spare failing while dormant; it is the spare being fine and the transfer not completing, which is why flight software exercises redundancy on a schedule rather than trusting the paperwork.

Automotive: electric vehicle brake system

Two brake ECUs, an electro-hydraulic actuator, four wheel-speed sensors and an independent backup hydraulic path, at a fleet scale that turns small rates into large numbers.

The series sum is 410 per 10⁶ hours. At 500 operating hours per vehicle-year that is 0.205 failures per vehicle-year before any redundancy credit, and this is where automotive reliability differs from every other row in this chapter: multiply by a fleet of 200,000 vehicles and the programme is looking at tens of thousands of warranty events a year from a rate that would be unremarkable on a single machine. Fleet scale converts a reliability number into a business case, which is why the automotive industry pushes component rates far below what a single-unit analysis would justify.

The actuator dominates at 180 of the 410, so it is where improvement money goes first, exactly as the Pareto logic in the systems chapter predicts. The dormant backup path contributes only 20, but its contribution is misleading on its own: a dormant item's real reliability question is not its rate but whether anyone would know it had failed, which is a question this chapter hands to testability.

The automotive row also shows what happens to reliability practice when the population is large enough to be measured rather than predicted. At 200,000 vehicles the programme does not need to argue about whether the actuator's 180 per 10⁶ hours is right: within two years the warranty database will say, with precision no handbook can offer, and the fitted life distribution will show whether the mechanism is random or ageing. Prediction here is a bridge to be crossed before the data arrives, not the final word, and the programmes that do this well are the ones that plan the transition deliberately: predict to set the targets, measure to correct them, and never let the prediction outlive its usefulness by being quoted after the field has spoken.

Energy and resources: gas compressor train

A gas turbine driver, a centrifugal compressor, a lube oil system with a duty and standby pump, vibration monitoring and a voted emergency shutdown.

Production-affecting failures total 1,180 per 10⁶ hours. The interesting reliability content is that this train contains all three hazard regimes from the bathtub discussion at once, and each needs a different countermeasure. The lube oil pumps are near-constant-rate items where redundancy and fast changeover are the answer. The turbine hot section is a strongly wear-out item, Weibull shape around 3.1, where the answer is condition monitoring and planned intervention before the hazard climbs. The instrumentation is a mixed population where the answer is voting, because the sensors' own failures must not trip the train.

That last point is the reliability trade this industry lives on: the 2oo3 vibration arrangement exists because a single sensor failing high would shut down a machine whose unplanned stop costs more than the sensor's entire lifetime service. Voting buys protection against spurious trips at the cost of a slightly higher chance of failing to trip when the machine really is in trouble, and which way to lean is decided by the safety analysis rather than by the reliability one.

The lube oil pair repays a closer look because it is the clearest case in this chapter of redundancy whose value depends on something outside the reliability model. Two pumps at 500 per 10⁶ hours, one running and one standing by, look like a textbook standby pair. Whether they behave like one depends entirely on the changeover: whether the standby starts, whether it starts fast enough to keep oil pressure above the trip threshold, and whether anyone knew the standby was healthy before it was asked. A standby pair with an unexercised spare and a slow start is a single pump wearing a redundancy diagram, which is why this arrangement is auto-tested on a schedule in every plant that takes it seriously.

Medical devices: infusion pump fleet

A pumping mechanism, an occlusion sensor, an air-in-line detector, a dose controller and a battery, multiplied by the six hundred pumps a hospital actually owns.

Pump failure rate totals 1,460 per 10⁶ hours, or 3.65 failures per pump-year at 2,500 operating hours, which across the fleet is roughly 2,190 failures a year arriving at one biomedical department. The battery dominates by a wide margin, and it is the clearest example in this chapter of a wear-out item masquerading as a random one: its 800 per 10⁶ hours is an average over a population being replaced on a two-year cycle, and the underlying hazard climbs steeply with charge cycles. Manage the replacement interval and the number moves; treat it as a constant rate and it will not.

The reliability lesson the medical row adds is about what the number does not cover. This pump's dominant safety hazard is over-infusion, and the safety analysis finds that device failures cause a minority of it: most over-infusion events begin with a correctly functioning pump programmed wrongly. A reliability improvement programme aimed at the 1,460 would leave four fifths of the harm untouched, which is the sharpest illustration this book has of why safety is not reliability.

There is also a fleet effect here that differs from the automotive one. Six hundred pumps producing 2,190 failures a year means roughly six failures every working day arriving at one department, and at that arrival rate the department is a queue rather than a workshop. Reliability improvements change the arrival rate, and the operational consequence of changing it is nonlinear: shaving 20% off the failure rate does not shave 20% off the backlog, it shortens the queue disproportionately, because the department was operating near its service capacity. This is the point at which a reliability number stops being a property of the device and becomes an input to an operations model, which is where the availability column picks it up.

Electronics and high tech: storage array controller pair

Two active-active controller boards, dual power supplies, drive shelves and a lithium backup unit protecting the write cache, quoted in the units this industry actually uses.

FIT arithmetic is the local dialect: 3,000 FIT is three failures per million hours, and a single controller with a four-hour response gives an unavailability of 1.2 × 10⁻⁵. Put two in parallel with independent repair and the pair's unavailability is around 1.4 × 10⁻¹⁰, a number so small that it is obviously not the real answer. That is the point of including this row. When redundancy arithmetic produces an absurdly good number, the model has stopped describing the system: what will actually take this array down is the shared backplane, the shared firmware build, the shared power feed and the shared operator, none of which appear in the q² calculation.

The drives tell the other half of the story. An annualised failure rate of 0.4% is a small number per drive and a certainty across a populated array, so drive failure is treated not as a fault but as an expected event that the redundancy scheme absorbs continuously. Designing for a component whose failure is routine rather than exceptional is a genuinely different exercise, and it is the direction most large-scale systems have moved.

The lithium backup unit at 900 FIT is the item that does not belong to the same conversation as the rest of the table, and including it is deliberate. Its rate is unremarkable; its failure mode is not, because one of its ways of failing releases stored energy rather than merely stopping a function. Nothing in a reliability roll-up distinguishes a controller board that stops working from a cell that overheats, which is precisely the blindness the safety column exists to correct. When a component's worst outcome is qualitatively different from its neighbours', a failure-rate table is the wrong instrument for deciding how much attention it deserves.

Nuclear: emergency diesel generator train

A standby machine, demanded rarely, whose entire reliability characterisation is expressed in units the rest of this chapter barely uses.

Over a 24-hour mission one train's unreliability is the start failure plus the run failure: 3.0 × 10⁻³ plus 2.37 × 10⁻², about 2.67 × 10⁻². Two trains treated as independent would give 7.1 × 10⁻⁴, and this is where the row earns its place in the chapter. Split the single-train figure with a common-cause fraction of β = 0.05 and the pair separates into two terms: an independent part, (0.95 × 2.67 × 10⁻²)² = 6.4 × 10⁻⁴, and a common-cause part, 0.05 × 2.67 × 10⁻² = 1.3 × 10⁻³, for a realistic pair unreliability of about 2.0 × 10⁻³. The common-cause term is roughly twice the independent one, and the honest pair value is three times worse than the naive multiplication claimed. The second diesel is worth having, and it is worth considerably less than the arithmetic of independence promises.

The other lesson is about units. This item has a per-demand probability and a per-hour rate at the same time, because it can fail to start and it can fail while running, and these are different physical populations measured different ways. Collapsing them into a single MTBF, as an unwary analyst might, destroys the distinction that the whole standby-system mathematics depends on. The foundations chapter's warning about one-shot devices applies here in its most consequential form.

The last observation is about where these numbers come from, and it is the reason this row closes the chapter. A failure-to-start probability of 3.0 × 10⁻³ is not a handbook prediction; it is an observed frequency, accumulated from thousands of surveillance starts across a fleet of similar machines over decades. The nuclear industry can quote per-demand reliability with confidence because it tests these machines relentlessly and records every result, which is the same loop FRACAS describes and the same argument the reliability foundations make about chi-square bounds: the number is only as good as the exposure behind it. Every other row in this chapter would be more trustworthy if its owners tested and recorded as thoroughly.

What the eight rows have in common

Read down the column and a pattern emerges that no single example shows. In every one of these systems the raw failure-rate table was the easy part and the least decisive: what determined the answer was the structure the rates were poured into, the direction the items fail in, whether the redundancy was genuinely independent, and whether the model's assumptions matched the physics. The aircraft's answer came from redundancy topology, the crossing's from failure direction, the satellite's from Weibull shape, the vehicle's from fleet scale, the compressor's from three coexisting hazard regimes, the pump's from what the number does not cover, the array's from the limits of q², and the diesel's from common cause and units.

That is the argument for reading the other four columns. A reliability number that is correct in isolation can still be the wrong number to have improved, and the properties in maintainability, availability, safety and testability are where that judgment is actually made.