Late Detection of Haul-Truck Gearbox Oil Starvation

A haul truck’s gearbox does not fail the moment oil stops reaching a bearing. It fails over hours, sometimes days, as the oil film thins, asperity contact begins, and localised heating propagates through the shaft, bearing race, and eventually the casing. The failure mode is oil starvation, and its defining characteristic is that the earliest physical evidence is not vibration. It is temperature, torque signature, and the slow degradation of lubricant film thickness. Vibration arrives late, often after the damage is irreversible.

This matters because on most mine sites, the vibration protection on a haul-truck gearbox is configured as a trip function, not a diagnostic. The alarm threshold sits above the trip level, or the trip level itself is the only configured setpoint. Under IEC 61511, that configuration has a specific and predictable consequence: the diagnostic coverage for the oil-starvation failure mode is effectively zero until the point of no return.

Why vibration alarms sit above the trip level

IEC 61511 defines safety instrumented function architecture in terms of sensor, logic solver, and final element, with a specified safety integrity level derived from the required risk reduction. The standard also defines diagnostic coverage as the ratio of detected dangerous failures to total dangerous failures for a given subsystem. When a vibration sensor is configured with a single high-high trip setpoint, the diagnostic coverage for a slow-developing mechanical degradation mode is low by construction. The trip only asserts when vibration amplitude crosses a threshold that corresponds to advanced damage.

There is a practical reason for this. Haul-truck gearboxes experience high transient vibration during gear shifts, retarder engagement, and rough haul-road sections. Setting a low vibration alarm produces nuisance trips, and nuisance trips on a 240-tonne payload truck have direct production cost. So the setpoint is raised until the nuisance rate is acceptable. The unintended result is that the alarm now sits above the level at which early bearing distress would be detectable, and the trip sits at the level where the bearing has already begun to spall.

Under IEC 61511, this is a diagnostic coverage problem, not a sensor problem. The sensor may be perfectly capable of detecting the early signature. The configured architecture does not use it for that purpose.

The mechanism of oil starvation in a haul-truck gearbox

Oil starvation in a planetary or powershift gearbox typically originates from one of a small set of causes: a clogged suction strainer, a failed oil pump drive, a collapsed cooler line, a low oil level from a slow leak, or a stuck open thermal bypass valve. Each cause produces the same sequence. Oil pressure at the bearing gallery drops. The hydrodynamic film between the bearing and the shaft thins. Asperity contact begins at the loaded side of the bearing. Local temperature rises. The bearing material begins to smear, then to spall. Debris enters the oil circuit and accelerates wear at every downstream bearing.

Vibration from the failing bearing becomes measurable only after spalling has begun, because the vibration signature is generated by the defect geometry, not by the loss of film. By the time a vibration trip asserts, the gearbox is already contaminated and the shaft may already be scored. The repair is no longer a bearing replacement. It is a gearbox exchange.

Temperature and oil pressure are the earlier indicators. A rising bearing temperature trend, referenced to ambient and to load, precedes the vibration signature by a substantial margin. A falling oil pressure at the gallery, referenced to pump speed and oil temperature, precedes it further. Neither is a safety device. Both are diagnostic inputs that, when wired into a logic solver with appropriate proof-test intervals, can raise the diagnostic coverage of the oil-starvation failure mode.

Diagnostic coverage and proof-testing under IEC 61511

IEC 61511-1 Clause 11.9 addresses proof-testing of safety instrumented functions. The proof-test interval determines the probability of dangerous undetected failure. For a slow-developing mechanical mode like oil starvation, the relevant question is not whether the trip works, but whether the diagnostic path detects the degradation before the failure becomes dangerous.

A defensible architecture treats the oil-starvation mode as a separate diagnostic function with its own sensor set, its own logic, and its own proof-test procedure. The sensor set includes oil pressure at the bearing gallery, bearing temperature, and oil temperature. The logic compares these against load-referenced and speed-referenced envelopes. The proof-test procedure verifies not only that the trip asserts, but that the diagnostic path detects a simulated degradation within the specified response time.

This is where the distinction between a trip function and a diagnostic function becomes operational. A trip function with a high-high setpoint has a proof-test that verifies the setpoint. A diagnostic function has a proof-test that verifies the detection of the failure mode itself. The latter is what IEC 61511 diagnostic coverage methodology requires if the oil-starvation mode is to be credited in the safety case.

What this means for maintenance planning

For reliability engineers and maintenance planners, the implication is that vibration monitoring alone is not a sufficient diagnostic for gearbox oil starvation. It is a trip function that asserts after damage. The diagnostic function requires pressure and temperature inputs, referenced to operating conditions, with a proof-test interval short enough to bound the probability of dangerous undetected failure.

For OT and SCADA engineers, the implication is that these inputs must be available to the logic solver at a rate and resolution sufficient to detect a trend, not just a threshold. A one-minute poll of oil pressure is adequate for a trip. It is marginal for a diagnostic that must detect a slow decline over hours.

The live source for this analysis, MINING.COM’s “Geopolitical risk drives capital to private sector: analyst” (published 2026-10-12, source: live-verified), frames the current capital environment in which mining operators are being asked to justify reliability spend against production risk. The argument for tightening gearbox diagnostics is not a safety slogan. It is a diagnostic coverage argument under IEC 61511, and it is measurable.

Getting started

Identify every haul-truck gearbox on site with a vibration-only protection scheme. For each, document the current setpoint, the trip level, and the assumed diagnostic coverage for the oil-starvation failure mode. Where coverage is low, add oil pressure and bearing temperature inputs to the logic solver and define a proof-test procedure that verifies detection of the degradation, not just assertion of the trip. Set the proof-test interval from the required risk reduction, not from the maintenance calendar.

Grounded in a verified live source: Geopolitical risk drives capital to private sector: analyst (2026-10-12) — source: live-verified.

Talk to S5 System about your site

S5 System designs and manufactures ultra-low-power industrial IoT sensors for mining, agriculture, infrastructure and utilities.

Discuss your IoT monitoring project — book a call.