FMEA — failure mode, effect, severity, detection, RPN: Exercises

Related: Reliability Engineering · Redundancy and Fault Tolerance · Risk Management in Spacecraft Design · Mission Assurance.

Warm-up: picture the RPN before you compute it

Before any exercise, build the mental image the whole page leans on. Two pictures do all the work.

Picture 1 — why multiply, not add

Figure — FMEA — failure mode, effect, severity, detection, RPN

Look at the left panel (sum, $S + O + D$ ): the equal-risk lines are straight and parallel — being great on one axis is exactly cancelled by being bad on another, unit for unit. Now the right panel (product, $S \times O \times D$ ): the equal-risk contours bend into the corners. Sitting near any axis (any one factor small) throws you into the deep-blue safe region even if the other two are maxed out. That curvature is the "one shut gate protects you" intuition, drawn.

Picture 2 — where the action bands live

Definition Action bands

An action band is a range of RPN values mapped to a required engineering response. They are a triage convention, not a law of physics — different agencies pick slightly different cutoffs. The set used on this page:

Band	RPN range	Required action
Monitor band	$RPN < 50$	Watch it, no redesign
Review band	$50 \leq RPN < 150$	Design review, test-then-decide
Redesign band	$150 \leq RPN < 500$	Redesign or add [[Redundancy and Fault Tolerance
Unacceptable band	$RPN \geq 500$	Must fix before flight

Intuition Why

these cutoffs, and why round numbers? The cutoffs are percentile-like breaks on the $1$ – $1000$ scale, chosen so each band is a rough order-of-magnitude of concern, not derived from an equation. Read them as: $500$ is half of the worst possible $1000$ — anything above that means at least two of the three gates are wide open at once, so it cannot fly. $150$ is roughly the score of an item that is serious on every axis at a middling level (e.g. $\sim 5 \times 5 \times 6$ ), the point where "keep an eye on it" turns into "change the design". $50$ is about where a failure stops being able to reach mission-critical territory even in a bad combination. The exact numbers are an industry heritage convention (see Mission Assurance and Risk Management in Spacecraft Design) calibrated against historical anomaly data — the parent note cites that missions leaving many $> 500$ items unfixed show markedly higher in-flight anomaly rates. Treat the bands as agreed traffic-light thresholds, and always pair them with the severity override you'll meet in L3 and L5.

The figure is a slice through the S–O–D cube at a fixed $S$ : the horizontal axis is $O$ , the vertical axis is $D$ , and colour = which action band the point lands in. The curved boundaries between colours are exactly the RPN cutoffs $50, 150, 500$ . Two things to notice: (1) the bands are curved, because equal RPN means $O \times D$ = constant (a hyperbola); (2) sliding to a higher $S$ (the second slice) shoves every boundary toward the origin — the same $(O, D)$ point that was "monitor" at low $S$ becomes "redesign" at high $S$ . That is the whole game of mitigation drawn as moving between coloured regions.

Level 1 — Recognition

L1.1 — Name the element

For each phrase, say which of the five FMEA elements it describes: Failure Mode, Effect, Severity, Occurrence, Detection.

(a) "Propellant valve sticks open." (b) "Thruster fires uncontrollably, tumbling the spacecraft." (c) "Scored 9 out of 10 because it means mission loss." (d) "Happens roughly once per 1000 operating hours." (e) "Pressure sensor flags it within one second."

Recall Solution

(a) Failure Mode — the specific way a component fails ("valve sticks open").
(b) Effect — the consequence on the system ("tumbling").
(c) Severity (S) — magnitude of impact, on the 1–10 scale.
(d) Occurrence (O) — how often it happens (a rate/probability).
(e) Detection (D) — but careful: fast, reliable detection is a low D score ( $1$ – $2$ ), because $D$ measures how likely the failure escapes us. Fast detection = low D = good.

L1.2 — Read the direction of the scale

Which is better (safer) in each pair?

(a) $S = 3$ or $S = 8$ ? (b) $O = 2$ or $O = 9$ ? (c) $D = 2$ or $D = 9$ ?

Recall Solution

Lower is always safer for all three.

(a) $S = 3$ (minor impact) beats $S = 8$ (major).
(b) $O = 2$ (rare) beats $O = 9$ (almost certain).
(c) $D = 2$ (we catch it early) beats $D = 9$ (undetectable until disaster). All three point the same way, which is exactly why multiplying them is meaningful: a small number in any factor pulls the whole RPN down (that's the corner-hugging curvature in Picture 1).

Level 2 — Application

L2.1 — Compute an RPN

A star-tracker has $S = 7$ , $O = 3$ , $D = 4$ . Compute its RPN and place it in the action bands.

Recall Solution

$RPN = 7 \times 3 \times 4 = 84$ $84$ falls in the review band ( $50 \leq RPN < 150$ ) → design review, test-then-decide. Not an emergency, not ignorable. On Picture 2's $S = 7$ slice, $(O, D) = (3, 4)$ sits in the middle-coloured region.

L2.2 — Re-score after mitigation

A battery cell internal short is scored $S = 9, O = 4, D = 3$ . Engineers add a fuse to isolate the failed cell (severity drops to $S = 6$ ), extra cell testing (occurrence drops to $O = 3$ ), and a redundant voltage monitor (detection improves to $D = 2$ ). Compute the old and new RPN and the percent reduction.

Recall Solution

Old: $RPN_{old} = 9 \times 4 \times 3 = 108$ New: $RPN_{new} = 6 \times 3 \times 2 = 36$ Reduction: $\frac{108 - 36}{108} \times 100% = 66.7%$ The RPN fell by two-thirds — the fuse (cutting $S$ ) did the heaviest lifting because $S$ was the largest factor. In Picture 2 language, we crossed from the review band into the monitor band and shifted to a lower- $S$ slice at the same time.

L2.3 — Which factor to attack?

A component sits at $S = 8, O = 2, D = 8$ , RPN $= 128$ . You can only afford one mitigation this cycle, and each option halves one factor (rounding down): halve $S$ to $4$ , or halve $O$ to $1$ , or halve $D$ to $4$ . Which gives the biggest RPN drop?

Recall Solution

Try each:

Halve $S$ : $4 \times 2 \times 8 = 64$
Halve $O$ : $8 \times 1 \times 8 = 64$
Halve $D$ : $8 \times 2 \times 4 = 64$

All three land on $64$ — a tie! Because RPN is a pure product, halving any single factor halves the product, regardless of which one. So the tie-breaker is not arithmetic: pick the one that is cheapest, most reliable, or that also helps other failure modes. (In practice, cutting $S$ via redundancy often protects many failure modes at once, so it usually wins on engineering grounds.)

Level 3 — Analysis

L3.1 — Rank a table

Four failure modes on a lander:

Mode	S	O	D
A Leg latch fails to deploy	9	2	5
B Radar altimeter noise	6	6	3
C Thermal blanket tear	3	7	6
D Engine throttle valve stiction	10	3	4

Rank them by RPN, highest first. Which get flagged for redesign (redesign band, RPN ≥ 150)?

Recall Solution

A: $9 \times 2 \times 5 = 90$
B: $6 \times 6 \times 3 = 108$
C: $3 \times 7 \times 6 = 126$
D: $10 \times 3 \times 4 = 120$

Ranked: C (126) > D (120) > B (108) > A (90). None reach $150$ , so none are in the redesign band — but see the next mistake box, because that verdict is dangerous.

L3.2 — Back out a hidden score

A subsystem's RPN is $210$ . You know $S = 7$ and $D = 5$ . Find $O$ . Is it a legal score?

Recall Solution

$O = \frac{RPN}{S \times D} = \frac{210}{7 \times 5} = \frac{210}{35} = 6$ $O = 6$ is a legal integer in $[1, 10]$ . Consistent.

L3.3 — Detection can't save a catastrophe alone

A pyrotechnic bolt has $S = 10$ (mission loss if it misfires) and $O = 2$ . Currently $D = 9$ (misfire only known after it fails to separate). Perfect monitoring would push $D$ to $1$ . Compute both RPNs. Does perfect detection make this "safe"?

Recall Solution

Now: $10 \times 2 \times 9 = 180$ . After: $10 \times 2 \times 1 = 20$ . RPN drops from $180$ (redesign band) to $20$ (monitor band) — a huge paper improvement.

But: detection only tells you the bolt will misfire; for a one-shot pyro at separation there may be nothing to do about it once fired. Cutting $D$ lowers the RPN but doesn't lower the real-world consequence of an $S = 10$ event you can't reverse. This is why redundancy (dual bolts) — which attacks $S$ — is preferred for irreversible catastrophic modes over monitoring alone.

Level 4 — Synthesis

L4.1 — Full FMEA of a reaction wheel

A reaction wheel's bearing can seize from lubricant depletion.

Local effect: torque → 0 on one axis.
Mission effect: attitude drift → panels misalign → safe mode → science downtime (spacecraft survives).
Data: documented after ~5 yr in heritage missions; wheel-current telemetry shows drag rising weeks ahead.

(a) Assign $S, O, D$ with one-line justifications and compute RPN. (b) You add a 4th redundant wheel (any 3 give full 3-axis control) and predictive current-vs-speed trending. Re-score and recompute. (c) State which factor each mitigation moved and why $O$ stays the same.

Recall Solution

(a) Before:

$S = 8$ — major mission impact (science loss) but spacecraft survives, not catastrophic.
$O = 5$ — documented in heritage after ~5 years: real, moderate.
$D = 4$ — telemetry trend gives warning, but requires watching; not instantaneous. $RPN = 8 \times 5 \times 4 = 160 (redesign band, \geq150)$

(b) After:

$S = 4$ — with a spare wheel we degrade gracefully instead of losing the mission.
$O = 5$ — unchanged: adding a spare doesn't stop any one wheel from seizing.
$D = 2$ — predictive alarms now give weeks of reliable warning. $RPN_{new} = 4 \times 5 \times 2 = 40 (monitor band)$

(c) Redundancy attacked $S$ (we survive the failure); predictive monitoring attacked $D$ (we see it coming). $O$ is untouched because the physical failure rate of an individual bearing is unchanged — you didn't make the lubricant last longer, you just made the failure survivable and visible. Accepting $O = 5$ is fine precisely because the mode is now manageable.

L4.2 — Software memory leak

A flight-software memory leak: heap fills over days → allocator fails → watchdog reboot → loss of attitude knowledge → safe mode (recoverable). Leaks are common in complex C; the slow leak is invisible until the crash (no runtime profiler).

(a) Score and compute RPN. Which band? (b) Propose two mitigations and predict which factor(s) they move.

Recall Solution

(a)

$S = 7$ — mission impact but recoverable via reboot (not catastrophic, not trivial).
$O = 6$ — memory leaks are common in complex flight code.
$D = 8$ — slow leak undetected until the crash; no memory profiler at runtime. $RPN = 7 \times 6 \times 8 = 336 (redesign band: 150-500, unacceptable to fly as-is)$

(b) Sensible moves:

Add 1 Hz memory-usage telemetry + ground alarms → attacks $D$ (the leak becomes visible as heap trends upward; $D$ might fall from $8$ to ~ $3$ ). See Quality Assurance and Testing.
Static analysis (Coverity/Valgrind) + code review during build → attacks $O$ (fewer leaks ship; $O$ might fall from $6$ to ~ $3$ ).
Periodic scrub/reset of non-critical tasks → attacks $S$ (a controlled reset instead of a crash; $S$ might fall). Illustrative combined result: $S = 7, O = 3, D = 3 \Rightarrow RPN = 63$ — back into the review band.

Level 5 — Mastery

L5.1 — Design to a budget

A subsystem starts at $S = 9, O = 6, D = 7$ (RPN $= 378$ ). Program rule: flight-eligible only if RPN ≤ 40. You have three mitigation options, each usable at most once, each changing exactly one factor:

R (redundancy): $S \to 4$
T (testing/process): $O \to 3$
M (monitoring): $D \to 2$

(a) Does applying all three meet the budget? (b) If you could apply only two, which pair(s) meet RPN ≤ 40? Show all three pairs.

Recall Solution

Start RPN $= 9 \times 6 \times 7 = 378$ (redesign band).

(a) All three: $4 \times 3 \times 2 = 24 \leq 40$ ✓.

(b) Pairs (the untouched factor keeps its original value):

R+T (drop M, keep $D = 7$ ): $4 \times 3 \times 7 = 84$ ✗
R+M (drop T, keep $O = 6$ ): $4 \times 6 \times 2 = 48$ ✗
T+M (drop R, keep $S = 9$ ): $9 \times 3 \times 2 = 54$ ✗ None of the pairs meets $\leq 40$ . Only the full trio works, so all three mitigations are mandatory. This is the honest lesson: when every factor starts high, you cannot buy your way to safety by touching just one or two — this is a systemic weak spot needing end-to-end design change.

L5.2 — The severity override

Two candidate items compete for one review slot:

Item X: $S = 4, O = 8, D = 8$
Item Y: $S = 10, O = 2, D = 2$

(a) Compute both RPNs. Which does raw RPN pick? (b) A "critical items" policy says any $S \geq 9$ item is reviewed regardless of RPN. Under real mission-assurance practice, which do you review, and defend it in one sentence.

Recall Solution

(a) X: $4 \times 8 \times 8 = 256$ . Y: $10 \times 2 \times 2 = 40$ . Raw RPN picks X (256 ≫ 40).

(b) You review both, but Y is non-negotiable: an $S = 10$ mode is a loss-of-mission (or loss-of-crew) event, and RPN's low $O$ and $D$ only mean it's rare and visible — not that its outcome is acceptable. RPN ranks the workload; severity governs what you are never allowed to skip. Compressing catastrophe and inconvenience onto the same $1$ – $1000$ line is exactly the blind spot Mission Assurance guards against. See also Risk Management in Spacecraft Design.

Recall Self-test: one-line reveals

RPN formula ::: $RPN = S \times O \times D$ , each factor $1$ – $10$ , product $1$ – $1000$ . Why multiply and not add? ::: The three factors are gates in series — one small factor must be able to save you, which only a product (corner-hugging contours) does. A fast, reliable alarm gives what Detection score? ::: A low one ( $D = 1$ – $2$ ) — low D is good. Adding a redundant unit moves which factor? ::: Severity $S$ (we survive), not Occurrence. Adding a sensor moves which factor? ::: Detection $D$ (we see it sooner), not Occurrence. Occurrence only changes when… ::: you change the physics/process so the part is less likely to break. What are the action bands? ::: monitor <50, review 50–150, redesign 150–500, unacceptable ≥500. Why can a low-RPN item still demand review? ::: Because an $S = 9$ / $10$ (catastrophic) mode is unacceptable regardless of how the product turns out.