FMEA — failure mode, effect, severity, detection, RPN: Exercises

3.6.29 · D4 · Physics › Spacecraft Structures & Systems Engineering › FMEA — failure mode, effect, severity, detection, RPN

Related: Reliability Engineering · Redundancy and Fault Tolerance · Risk Management in Spacecraft Design · Mission Assurance.

Warm-up: compute karne se pehle RPN ka mental image banao

Kisi bhi exercise se pehle, woh mental image build karo jis par poora page tikaa hai. Do pictures saara kaam karti hain.

Picture 1 — multiply kyun, add kyun nahi

Intuition Multiply = "series mein gates", add = "side-by-side wounds"

Socho ek failure ko mission ko hurt karne ke liye teen gates se guzarna padta hai: woh buri honi chahiye (S), woh honi chahiye (O), aur woh hamare detection se bach jaani chahiye (D). Agar koi bhi gate almost band ho, toh almost kuch bhi nahi guzarta — yahi multiplication karta hai: ek chhota factor poore product ko zero ki taraf kheench leta hai. Addition yeh nahi kar sakta. Agar tum add karte, toh ek truly catastrophic-par-impossible item ( $S = 10, O = 1, D = 1$ ) ka score $12$ hota, waisa hi jaise ek trivial nuisance ( $S = 1, O = 10, D = 1$ ) — yeh bakwaas hai. Multiplication deta hai $10$ vs $10$ ... phir bhi barabar? Figure ko dhyan se dekho: do scoring rules ki shape bilkul alag hai. Sum flat diagonal slabs banata hai; product curved sheets banata hai jo axes ke saath chipke rehte hain, toh kisi bhi axis par low value tumhe rescue kar leti hai.

Figure — FMEA — failure mode, effect, severity, detection, RPN

Left panel dekho (sum, $S + O + D$ ): equal-risk lines seedhi aur parallel hain — ek axis par great hona doosre par bura hone se exactly cancel ho jaata hai, unit for unit. Ab right panel dekho (product, $S \times O \times D$ ): equal-risk contours corners mein bend karte hain. Kisi bhi axis ke paas rehna (koi bhi ek factor chhota) tumhe deep-blue safe region mein phek deta hai, chahe baaki dono maxed out hon. Woh curvature hi "ek band gate tumhe bachata hai" wali intuition hai, drawn.

Picture 2 — action bands kahan hain

Definition Action bands

Ek action band RPN values ka ek range hai jo ek required engineering response se map hota hai. Yeh ek triage convention hai, physics ka law nahi — alag-alag agencies thodi alag cutoffs choose karti hain. Is page par use kiya gaya set:

Band	RPN range	Required action
Monitor band	$RPN < 50$	Observe karo, koi redesign nahi
Review band	$50 \leq RPN < 150$	Design review, test-then-decide
Redesign band	$150 \leq RPN < 500$	Redesign karo ya [[Redundancy and Fault Tolerance
Unacceptable band	$RPN \geq 500$	Flight se pehle fix karna zaroori

Intuition Yeh cutoffs

kyun, aur kyun round numbers? Cutoffs $1$ – $1000$ scale par percentile-like breaks hain, choose kiye gaye taaki har band concern ka rough order-of-magnitude ho, kisi equation se derive nahi kiye gaye. Inhe padhlo: $500$ yaani worst possible $1000$ ka half — koi bhi cheez usse upar matlab kam se kam teen mein se do gates ek saath wide open hain, isliye yeh fly nahi kar sakta. $150$ roughly woh score hai jab ek item har axis par middling level par serious ho (jaise $\sim 5 \times 5 \times 6$ ), woh point jahan "nazar rakhna" "design badlo" mein badal jaata hai. $50$ roughly woh jagah hai jahan ek failure mission-critical territory tak pahunch paana band kar deta hai even buri combination mein. Exact numbers ek industry heritage convention hain (dekho Mission Assurance aur Risk Management in Spacecraft Design) jo historical anomaly data se calibrate ki gayi hain — parent note cite karta hai ki missions jinmein kai $> 500$ items unfixed rehte hain unhe in-flight anomaly rates bahut zyada dikhti hain. Bands ko agreed traffic-light thresholds samjho, aur inhe hamesha severity override ke saath pair karo jo tumhe L3 aur L5 mein milega.

Figure ek slice hai S–O–D cube ke through ek fixed $S$ par: horizontal axis $O$ hai, vertical axis $D$ hai, aur colour = point kaun sa action band pe land karta hai. Colours ke beech curved boundaries exactly RPN cutoffs $50, 150, 500$ hain. Do cheezein notice karo: (1) bands curved hain, kyunki equal RPN matlab $O \times D$ = constant (ek hyperbola); (2) higher $S$ (doosri slice) par slide karna har boundary ko origin ki taraf dhakelta hai — wahi $(O, D)$ point jo low $S$ par "monitor" tha woh high $S$ par "redesign" ban jaata hai. Yahi mitigation ka poora game hai coloured regions ke beech move karna.

Level 1 — Recognition

L1.1 — Element pehchano

Har phrase ke liye, batao yeh FMEA ke paanch elements mein se kaun sa describe karta hai: Failure Mode, Effect, Severity, Occurrence, Detection.

(a) "Propellant valve sticks open." (b) "Thruster fires uncontrollably, tumbling the spacecraft." (c) "Scored 9 out of 10 because it means mission loss." (d) "Happens roughly once per 1000 operating hours." (e) "Pressure sensor flags it within one second."

Recall Solution

(a) Failure Mode — woh specific tarika jis mein ek component fail hota hai ("valve sticks open").
(b) Effect — system par consequence ("tumbling").
(c) Severity (S) — impact ki magnitude, 1–10 scale par.
(d) Occurrence (O) — yeh kitni baar hota hai (ek rate/probability).
(e) Detection (D) — lekin dhyan rakho: fast, reliable detection ek low D score hai ( $1$ – $2$ ), kyunki $D$ measure karta hai failure kitni likely hamare se bach jaati hai. Fast detection = low D = achha.

L1.2 — Scale ki direction samjho

Har pair mein kaun sa better (safer) hai?

(a) $S = 3$ ya $S = 8$ ? (b) $O = 2$ ya $O = 9$ ? (c) $D = 2$ ya $D = 9$ ?

Recall Solution

Teeno ke liye lower hamesha safer hai.

(a) $S = 3$ (minor impact) beats $S = 8$ (major).
(b) $O = 2$ (rare) beats $O = 9$ (almost certain).
(c) $D = 2$ (hum ise jaldi catch kar lete hain) beats $D = 9$ (disaster tak undetectable). Teeno same direction mein point karte hain, yahi reason hai ki inhe multiply karna meaningful hai: kisi bhi factor mein chhota number poora RPN neeche kheench leta hai (yahi Picture 1 ki corner-hugging curvature hai).

Level 2 — Application

L2.1 — RPN compute karo

Ek star-tracker ka $S = 7$ , $O = 3$ , $D = 4$ hai. Iska RPN compute karo aur action bands mein place karo.

Recall Solution

$RPN = 7 \times 3 \times 4 = 84$ $84$ review band mein aata hai ( $50 \leq RPN < 150$ ) → design review, test-then-decide. Emergency nahi, ignore bhi nahi kar sakte. Picture 2 ki $S = 7$ slice par, $(O, D) = (3, 4)$ middle-coloured region mein baithta hai.

L2.2 — Mitigation ke baad re-score karo

Ek battery cell internal short ko $S = 9, O = 4, D = 3$ score kiya gaya hai. Engineers ek fuse add karte hain failed cell isolate karne ke liye (severity $S = 6$ ho jaati hai), extra cell testing (occurrence $O = 3$ ho jaata hai), aur ek redundant voltage monitor (detection $D = 2$ ho jaati hai). Old aur new RPN compute karo aur percent reduction bhi.

Recall Solution

Pehle: $RPN_{old} = 9 \times 4 \times 3 = 108$ Baad mein: $RPN_{new} = 6 \times 3 \times 2 = 36$ Reduction: $\frac{108 - 36}{108} \times 100% = 66.7%$ RPN do-thirds se giraa — fuse ( $S$ cut karte hue) ne sabse zyada kaam kiya kyunki $S$ sabse bada factor tha. Picture 2 language mein, hum review band se monitor band mein cross kar gaye aur saath hi lower- $S$ slice par shift bhi ho gaye.

L2.3 — Kaun sa factor attack karein?

Ek component $S = 8, O = 2, D = 8$ par hai, RPN $= 128$ . Tum sirf ek mitigation is cycle mein afford kar sakte ho, aur har option ek factor ko half karta hai (rounding down): $S$ ko $4$ karein, ya $O$ ko $1$ karein, ya $D$ ko $4$ karein. Sabse bada RPN drop kaun deta hai?

Recall Solution

Har ek try karo:

Halve $S$ : $4 \times 2 \times 8 = 64$
Halve $O$ : $8 \times 1 \times 8 = 64$
Halve $D$ : $8 \times 2 \times 4 = 64$

Teeno $64$ par land karte hain — tie! Kyunki RPN ek pure product hai, kisi bhi single factor ko halve karna product ko halve kar deta hai, regardless of which one. Toh tie-breaker arithmetic nahi hai: woh choose karo jo sabse sasta ho, sabse reliable ho, ya jo doosre failure modes mein bhi help kare. (Practice mein, redundancy se $S$ cut karna often bahut saare failure modes ko protect karta hai, isliye yeh usually engineering grounds par jeet jaata hai.)

Level 3 — Analysis

L3.1 — Ek table rank karo

Ek lander par chaar failure modes:

Mode	S	O	D
A Leg latch fails to deploy	9	2	5
B Radar altimeter noise	6	6	3
C Thermal blanket tear	3	7	6
D Engine throttle valve stiction	10	3	4

Inhe RPN se rank karo, highest pehle. Kaun se redesign ke liye flag hote hain (redesign band, RPN ≥ 150)?

Recall Solution

A: $9 \times 2 \times 5 = 90$
B: $6 \times 6 \times 3 = 108$
C: $3 \times 7 \times 6 = 126$
D: $10 \times 3 \times 4 = 120$

Ranked: C (126) > D (120) > B (108) > A (90). Koi $150$ tak nahi pahunchta, toh koi bhi redesign band mein nahi hai — lekin agla mistake box dekho, kyunki yeh verdict dangerous hai.

L3.2 — Ek hidden score pata karo

Ek subsystem ka RPN $210$ hai. Tum jaante ho $S = 7$ aur $D = 5$ . $O$ find karo. Kya yeh ek legal score hai?

Recall Solution

$O = \frac{RPN}{S \times D} = \frac{210}{7 \times 5} = \frac{210}{35} = 6$ $O = 6$ $[1, 10]$ mein ek legal integer hai. Consistent.

L3.3 — Detection akele ek catastrophe nahi bachaa sakta

Ek pyrotechnic bolt ka $S = 10$ hai (mission loss agar yeh misfire kare) aur $O = 2$ hai. Currently $D = 9$ (misfire sirf tab pata chalta hai jab yeh separate hone mein fail hota hai). Perfect monitoring $D$ ko $1$ push kar degi. Dono RPNs compute karo. Kya perfect detection ise "safe" banata hai?

Recall Solution

Abhi: $10 \times 2 \times 9 = 180$ . Baad mein: $10 \times 2 \times 1 = 20$ . RPN $180$ (redesign band) se $20$ (monitor band) tak girta hai — ek bada paper improvement.

Lekin: detection sirf yeh batata hai ki bolt misfire karega; separation par ek one-shot pyro ke liye actually kuch bhi nahi kiya ja sakta iske fire hone ke baad. $D$ cut karna RPN toh lower karta hai lekin real-world consequence ek $S = 10$ event ka nahi karta jo tum reverse nahi kar sakte. Yahi reason hai ki redundancy (dual bolts) — jo $S$ attack karta hai — monitoring alone ke over irreversible catastrophic modes ke liye prefer ki jaati hai.

Level 4 — Synthesis

L4.1 — Reaction wheel ka full FMEA

Ek reaction wheel ki bearing lubricant depletion se seize ho sakti hai.

Local effect: torque → ek axis par $0$ .
Mission effect: attitude drift → panels misalign → safe mode → science downtime (spacecraft survive karta hai).
Data: heritage missions mein ~5 yr baad documented; wheel-current telemetry drag rise weeks ahead dikhata hai.

(a) $S, O, D$ assign karo ek-line justifications ke saath aur RPN compute karo. (b) Tum ek 4th redundant wheel add karte ho (koi bhi 3 poora 3-axis control dete hain) aur predictive current-vs-speed trending. Re-score karo aur recompute karo. (c) State karo kaun sa factor har mitigation ne move kiya aur kyun $O$ same rehta hai.

Recall Solution

(a) Pehle:

$S = 8$ — major mission impact (science loss) lekin spacecraft survive karta hai, catastrophic nahi.
$O = 5$ — heritage mein ~5 years baad documented: real, moderate.
$D = 4$ — telemetry trend warning deta hai, lekin watching chahiye; instantaneous nahi. $RPN = 8 \times 5 \times 4 = 160 (redesign band, \geq150)$

(b) Baad mein:

$S = 4$ — spare wheel ke saath hum gracefully degrade karte hain mission lose karne ke bajaye.
$O = 5$ — unchanged: spare add karna kisi bhi ek wheel ko seize karna band nahi karta.
$D = 2$ — predictive alarms ab weeks reliable warning dete hain. $RPN_{new} = 4 \times 5 \times 2 = 40 (monitor band)$

(c) Redundancy ne $S$ attack kiya (hum failure survive karte hain); predictive monitoring ne $D$ attack kiya (hum ise aate dekhte hain). $O$ unchanged hai kyunki ek individual bearing ki physical failure rate unchanged hai — tumne lubricant longer last nahi karaaya, tumne failure ko sirf survivable aur visible banaya. $O = 5$ accept karna bilkul theek hai kyunki mode ab manageable hai.

L4.2 — Software memory leak

Ek flight-software memory leak: heap days mein fill hota hai → allocator fail → watchdog reboot → loss of attitude knowledge → safe mode (recoverable). Leaks complex C mein common hain; slow leak crash tak invisible rehta hai (koi runtime profiler nahi).

(a) Score karo aur RPN compute karo. Kaun sa band? (b) Do mitigations propose karo aur predict karo kaun sa factor(s) move honge.

Recall Solution

(a)

$S = 7$ — mission impact lekin reboot se recoverable (catastrophic nahi, trivial bhi nahi).
$O = 6$ — complex flight code mein memory leaks common hain.
$D = 8$ — slow leak crash tak undetected; koi memory profiler runtime par nahi. $RPN = 7 \times 6 \times 8 = 336 (redesign band: 150-500, as-is fly karna unacceptable)$

(b) Sensible moves:

1 Hz memory-usage telemetry + ground alarms add karo → $D$ attack karta hai (leak visible ho jaata hai jaise heap trend karta hai; $D$ $8$ se ~ $3$ tak fall ho sakta hai). Dekho Quality Assurance and Testing.
Build ke dauran static analysis (Coverity/Valgrind) + code review → $O$ attack karta hai (fewer leaks ship karte hain; $O$ $6$ se ~ $3$ tak fall ho sakta hai).
Non-critical tasks ka periodic scrub/reset → $S$ attack karta hai (crash ke bajaye controlled reset; $S$ fall ho sakta hai). Illustrative combined result: $S = 7, O = 3, D = 3 \Rightarrow RPN = 63$ — waapas review band mein.

Level 5 — Mastery

L5.1 — Budget ke liye design karo

Ek subsystem $S = 9, O = 6, D = 7$ par start karta hai (RPN $= 378$ ). Program rule: flight-eligible sirf tab agar RPN ≤ 40. Tumhare paas teen mitigation options hain, har ek zyada se zyada ek baar usable, har ek exactly ek factor change karta hai:

R (redundancy): $S \to 4$
T (testing/process): $O \to 3$
M (monitoring): $D \to 2$

(a) Kya teeno apply karna budget meet karta hai? (b) Agar tum sirf do apply kar sako, kaun si pair(s) RPN ≤ 40 meet karti hain? Teeno pairs show karo.

Recall Solution

Start RPN $= 9 \times 6 \times 7 = 378$ (redesign band).

(a) Teeno: $4 \times 3 \times 2 = 24 \leq 40$ ✓.

(b) Pairs (untouched factor apni original value rakhta hai):

R+T (M drop karo, $D = 7$ rakho): $4 \times 3 \times 7 = 84$ ✗
R+M (T drop karo, $O = 6$ rakho): $4 \times 6 \times 2 = 48$ ✗
T+M (R drop karo, $S = 9$ rakho): $9 \times 3 \times 2 = 54$ ✗ Koi bhi pair $\leq 40$ meet nahi karti. Sirf poora trio kaam karta hai, isliye teeno mitigations mandatory hain. Yahi honest lesson hai: jab har factor high start karta hai, tum sirf ek ya do touch karke safety nahi khareed sakte — yeh ek systemic weak spot hai jisken liye end-to-end design change chahiye.

L5.2 — Severity override

Do candidate items ek review slot ke liye compete karte hain:

Item X: $S = 4, O = 8, D = 8$
Item Y: $S = 10, O = 2, D = 2$

(a) Dono RPNs compute karo. Raw RPN kaun choose karta hai? (b) Ek "critical items" policy kehti hai koi bhi $S \geq 9$ item regardless of RPN review hota hai. Real mission-assurance practice mein, kaun sa review karte ho, aur ek sentence mein defend karo.

Recall Solution

(a) X: $4 \times 8 \times 8 = 256$ . Y: $10 \times 2 \times 2 = 40$ . Raw RPN X choose karta hai ( $256 ≫ 40$ ).

(b) Tum dono review karte ho, lekin Y non-negotiable hai: ek $S = 10$ mode ek loss-of-mission (ya loss-of-crew) event hai, aur RPN ka low $O$ aur $D$ sirf yeh matlab hai ki yeh rare aur visible hai — yeh nahi ki iska outcome acceptable hai. RPN workload rank karta hai; severity govern karta hai ki tumhe kya kabhi skip nahi karna allowed. Catastrophe aur inconvenience ko same $1$ – $1000$ line par compress karna exactly woh blind spot hai jis se Mission Assurance guard karta hai. Dekho bhi Risk Management in Spacecraft Design.

Recall Self-test: one-line reveals

RPN formula ::: $RPN = S \times O \times D$ , har factor $1$ – $10$ , product $1$ – $1000$ . Multiply kyun, add kyun nahi? ::: Teen factors series mein gates hain — ek chhota factor tumhe bachaa sakna chahiye, jo sirf ek product (corner-hugging contours) karta hai. Ek fast, reliable alarm Detection score kya deta hai? ::: Ek low wala ( $D = 1$ – $2$ ) — low D achha hai. Ek redundant unit add karna kaun sa factor move karta hai? ::: Severity $S$ (hum survive karte hain), Occurrence nahi. Ek sensor add karna kaun sa factor move karta hai? ::: Detection $D$ (hum ise jaldi dekhte hain), Occurrence nahi. Occurrence sirf tab badalta hai jab… ::: tum physics/process badlate ho taaki part break hone ki likelihood kam ho. Action bands kya hain? ::: monitor <50, review 50–150, redesign 150–500, unacceptable ≥500. Ek low-RPN item phir bhi review kyun demand kar sakta hai? ::: Kyunki ek $S = 9$ / $10$ (catastrophic) mode unacceptable hai regardless of product ka result kaisa bhi ho.