Availability, redundancy and commissioning

For a process that runs continuously, the cost of an unplanned stop usually dwarfs the capital cost of the drive, and the design question shifts from performance to availability. And a design is not finished when the drawings are issued: it still has to be brought into service, tested and defended. This lesson is course sections 6.2.4 and 6.2.5.

Availability

The standard measure is

$$A = \frac{\text{MTBF}}{\text{MTBF} + \text{MTTR}} \tag{6.5}$$

where MTBF is the mean time between failures and MTTR the mean time to repair. The form of eq. 6.5 carries a lesson that is easy to overlook: availability improves just as much by reducing repair time as by extending the time between failures, and reducing MTTR is almost always cheaper. A spare drive on the shelf, a documented changeover procedure, and drive parameters backed up and version-controlled will improve plant availability more than any increase in component quality.

One driveSpare on the shelfTwo units (N+1)

MTBF

20,000 h

About 2.3 years between failures.

MTTR (order, deliver, fit, recommission)

48 h

Without a spare, the repair waits for the part.

Cost of an hour of lost production

5.0 k€/h

Availability

99.7606 %

Downtime

21.0 h/yr

Nines

2.6

Lost production

105 k€/yr

One drive: every failure costs the whole repair time. Try halving MTTR, then doubling MTBF instead: the gain is the same.

A = MTBF / (MTBF + MTTR) ; N+1: A = 1 − (1 − A₁)²

Predict first

A drive with an MTBF of 20 000 h takes 48 h to replace (order, deliver, fit, recommission). You can either buy a drive with twice the MTBF, or keep a pre-configured spare that can be swapped in 2 h. Which buys more availability?

The better driveThe spare on the shelf, by farThey are about the same

Redundancy where it is justified

Where redundancy is genuinely justified, a cement kiln destroyed by a stop, a pipeline that cannot lose flow, it takes recognisable forms:

• N+1 pump or fan sets sharing the duty, so that any one can be lost;
• a standby drive with automatic changeover;
• a bypass contactor, letting a critical motor run direct-on-line at fixed speed with the drive removed;
• for the kiln, an independent auxiliary drive on a separate supply whose only job is to keep the shell turning through an outage.

The engineering judgement lies in identifying which failures actually threaten the process, not in duplicating everything.

Commissioning and acceptance

A capstone project that leaves out commissioning has not described a deliverable system. Commissioning follows a fixed progression.

Factory acceptance testing (FAT) proves the assembled panel against its specification before it leaves the supplier, with the plant simulated. Site acceptance testing (SAT) repeats the critical tests with the real machine connected. Between them lie the loop checks: every field device verified end to end, each sensor reading correctly at the controller and each output moving the intended actuator. They are tedious, and they are where most installation errors are actually found.

Drive commissioning itself has a fixed order:

1. enter the motor nameplate data;
2. run the auto-tune, so the drive identifies the stator resistance, leakage inductance and magnetising curve its vector model depends on;
3. verify the direction of rotation, uncoupled;
4. confirm encoder direction and scaling;
5. tune the speed loop, and only then any outer process loop.

Tuning an outer loop over an untuned inner one is a guaranteed way to waste a day.

Finally, safety validation is a separate, formal exercise: every safety function is proof-tested by actually creating the demand (opening the gate, pulling the cord, breaking the light curtain), confirming the response, and recording the result. That record is a documentary requirement of the functional-safety standards, not merely good practice, and it is what makes the installation defensible.

FoundationStart here if this is new to you

A family car that rarely breaks down but waits three weeks for parts is off the road longer than an older car that breaks down twice as often but is fixed the same afternoon. Plant availability works the same way: how fast you get running again counts as much as how rarely you stop.

ExplorerGo deeper: derivations and open questions

N+1 in numbers. Two pumps, each with $A = 0.99$ and either able to carry the duty. What is the availability of the pair, and the downtime per year? What common-cause failure would break the independence the formula assumes?

Bypass. A critical fan has a bypass contactor for direct-on-line running. What does the plant lose while it runs on the bypass, and what must the control system do before closing it?