A gas turbine driver, a centrifugal compressor, a lube oil system with a duty and a standby pump, three vibration sensors voted two out of three, and an emergency shutdown valve. One machine, and three completely different reliability regimes inside it, each needing a different model and producing a different kind of decision. That coexistence is what makes this the richest modelling page in the set.
The technique, and why this one
This is the one row that needs three, and the reason is that the train contains three genuinely different regimes.
Weibull with an age-replacement optimisation for the turbine hot section, a Markov model for the repairable pump pair, and constant rates with voting arithmetic for the instrumentation. A single technique applied to the whole train would misrepresent at least two thirds of it.
| Item | Regime | Model | Parameters |
|---|---|---|---|
| Turbine hot section | wear-out | Weibull | β = 3.1, η = 52,000 h |
| Lube oil pump | random, repairable | exponential + Markov | λ = 500 per 10⁶ h each, μ = 1/6 h⁻¹ |
| Vibration sensor | random, voted | exponential + binomial | λ = 200 per 10⁶ h, 2oo3 |
| ESD shutdown valve | dormant | exponential, per-demand | λ = 40, dangerous undetected 12 per 10⁶ h |
| Trip logic solver | random | exponential | λ = 30 per 10⁶ h |
Constant λ is right for three of those rows: the solver, the sensors and the valve are screened items in their useful life, with no wear-out onset inside a four-year run. The storage array page defends exactly that choice for a whole system. It fails here because the hot section's service life outlasts its wear-out onset, and a hazard that does not move with age cannot represent cumulative damage.
Regime one: the hot section wears out
With β = 3.1 the hot section is a textbook ageing item: the hazard climbs as the cube of age, and the failure is expensive and disruptive when it arrives unplanned. This is the regime where age replacement is not only justified but optimisable, because there is a genuine trade between replacing too early and waiting too long.
Evaluated over the 4 × 8,760 = 35,040 hours the train runs between turnarounds:
R(t) = exp(−(t / 52,000)^3.1)
R(35,040) = exp(−(0.674)^3.1) = exp(−0.294) = 0.745
B10 = η(−ln 0.9)^(1/β) = 52,000 × (0.10536)^(1/3.1) = 25,200 h
One section in four is gone before the outage meant to renew it, and a tenth by 25,200 hours. The design-stage book value of 350 per 10⁶ hours implies an exponential MTBF of 10⁶ / 350 = 2,857 hours where the Weibull gives 46,500: wrong by a factor of sixteen, in the direction that inflates every plan built on it.
The classical age-replacement model balances the cost of a planned renewal Cp against the cost of a failure Cf, and the long-run cost per unit time for a replacement age T is
C(T) = [Cp·R(T) + Cf·(1 − R(T))] / ∫₀ᵀ R(t) dt
For this machine the failure-to-planned cost ratio is about 8: an unplanned hot-section failure takes the train down for the 340-hour repair that the maintainability page prices, while a planned exchange happens in a turnaround window that was going to happen anyway. Minimising C(T) with β = 3.1, η = 52,000 h and Cf/Cp = 8 puts the optimum near 0.55η ≈ 28,600 hours, roughly three and a quarter years of continuous running. Its meaning in probability is exact:
F(28,600) = 1 − exp(−(0.55)^3.1) = 1 − exp(−0.157) = 0.145
A one-in-seven chance of failing before the planned exchange, which the availability page turns into 0.145 × 0.306 = 0.044 unplanned events and 15 hours a year, against 64 hours run to failure.
Two features of that result are general. The optimum sits well below the characteristic life, because the penalty for failing is asymmetric. And the curve around the optimum is shallow, so being a few thousand hours either side costs very little, which is what makes it practical to snap the replacement to the nearest scheduled turnaround rather than chasing the exact number.
Regime two: the pumps need a state model
Two lube oil pumps, one running and one on standby, both repairable with a mean repair time of six hours. An RBD would call this a parallel pair and multiply unavailabilities, and it would be wrong, because repair couples the states: whether the standby is available when the duty pump fails depends on whether a previous repair has finished, and that is a question about transitions rather than about structure.
The Markov model has three states: both available, one failed and under repair, both failed. With λ = 500 × 10⁻⁶ per hour and μ = 1/6 per hour, the ratio λ/μ = 3 × 10⁻³ governs everything, and the steady-state probability of the both-failed state is approximately
P(both failed) ≈ 2(λ/μ)² = 2 × (3 × 10⁻³)² = 1.8 × 10⁻⁵
The pump pair is therefore not the train's problem: at 1.8 × 10⁻⁵ it contributes almost nothing to the 1,180 per 10⁶ hours of production-affecting failures. What the model also exposes is the sensitivity that matters. Halve the repair time to three hours and the both-failed probability falls by a factor of four, because it goes as the square of λ/μ. Repair speed is a quadratic lever on a repairable pair, and no static structural model shows that.
That is the hot-standby bound; the cold bound, where an idle pump cannot fail, is (λ/μ)²/(1 + λ/μ + (λ/μ)²) = 9.0 × 10⁻⁶, and the train carries 1.1 × 10⁻⁵ between them because the standby is barred and warm. One pump alone sits at (λ/μ)/(1 + λ/μ) = 3.0 × 10⁻³: 26.3 hours a year against the pair's 5.8 minutes.
There is a caveat the arithmetic hides and the design must not. All of it assumes the standby actually starts, fast enough to hold oil pressure above the trip threshold, and that somebody knew it was healthy beforehand. A standby pair with an unexercised spare is a single pump wearing a redundancy diagram.
Regime three: voting, and the trade it encodes
The three vibration sensors are voted two out of three. With each sensor at λ = 200 per 10⁶ hours the arrangement tolerates one failure, and its reliability over a mission of length t is the familiar
R_2oo3 = 3R² − 2R³
Substitute. With R(t) = e^(−200 × 10⁻⁶ t), an unattended year gives λt = 1.752 and R = 0.173, so
R_2oo3 = 3(0.173)² − 2(0.173)³ = 0.0898 − 0.0104 = 0.079
worse than one sensor. 3R² − 2R³ = R reduces to 2R² − 3R + 1 = 0, so the crossover sits at R = 0.5:
t* = ln 2 / λ = 0.693 / (200 × 10⁻⁶) = 3,466 h
A vote beats a single channel only while the channels are more likely than not to be alive, under five months here.
But the reason for the vote is not reliability in the ordinary sense. A single sensor failing high would trip a machine whose unplanned stop costs more than the sensor's entire service life; a single sensor failing low would leave a machine running into damage. Voting buys protection against the spurious trip at the cost of a slightly higher chance of failing to trip when the machine really is in trouble, and which of those two errors to prefer is a safety decision rather than a reliability one. The safety page makes it, working the shutdown function's integrity level and the proof-test arithmetic that goes with it.
Putting the train together
Summed for production-affecting failures the train runs at 1,180 per 10⁶ hours. That figure is an input to the availability page rather than an answer in itself, because for this machine the question the owner asks is not how often it fails but how much gas it did not compress, and the four-yearly turnaround loses more production than the unplanned failures do.
The five tabulated items summed in series give 2,020 per 10⁶ hours, so 1,180 already carries the credit for redundancy and voting. What it supports is
MTBF = 10⁶ / 1,180 = 847 h
events a year = 1,180 × 10⁻⁶ × 8,760 = 10.3
R(8,760) = e^(−10.34) = 3.2 × 10⁻⁵
and the last line is the point. Reliability is the wrong currency for a machine repaired ten times a year: on the availability page those events become a 6.3-hour mean downtime and an inherent availability of 0.9926.
What the analysis tells the engineer to do
Replace the hot section on age, and decide deliberately whether to snap the exchange to the turnaround. The optimum is 28,600 hours, the turnaround arrives at 35,040, and F rises from 0.145 to 0.255 across that gap: one exchange in four becomes a 340-hour unplanned outage rather than planned work.
Exercise the standby pump and prove the changeover. It carries the largest ratio on this page: 5.8 minutes a year with the standby available against 26.3 hours without it, a factor of 274 no component substitution here approaches.
Issue 21.5 per 10⁶ hours as the hot section's average rate for budgeting, never as a hazard rate. λ̄ = 1 / (η · Γ(1 + 1/β)) = 1 / 46,500 = 21.5 per 10⁶ h removes the sixteenfold error from the spares and labour plan the maintainability page rebuilds on it; as a constant hazard it implies age replacement buys nothing.
Alarm the vibration channels on disagreement, not only on vote. The array spends 90% of a four-year run beyond its 3,466-hour crossover, so its worth depends on failed channels being found between turnarounds. The testability page sets the threshold.
What a different technique would have given
Modelling the hot section as exponential at its Weibull mean (η·Γ(1 + 1/β) = 52,000 × 0.8934 = 46,500 h, so λ = 21.5 per 10⁶ h) would produce a superficially reasonable number and one catastrophic recommendation: that age replacement is pointless. It is not pointless; it is worth roughly the difference between a 340-hour unplanned outage and a task folded into a turnaround, repeated over the machine's life. The shape error shows sharpest in a life percentile: that exponential item has B10 = 0.10536 / (21.5 × 10⁻⁶) = 4,900 h against the Weibull's 25,200, right on the mean and wrong by a factor of five about the age at which the first tenth of the population goes. Meanwhile modelling the pump pair with a static RBD instead of a Markov model would have hidden the quadratic sensitivity to repair time, which is the cheapest improvement available anywhere in this train.