Intuition The One Core IdeaFMEA turns the vague worry "something might break" into a single number for every part, so engineers can rank thousands of possible failures and fix the worst ones first. That number is built from three honest questions — how bad? how likely? how blind are we? — multiplied together.
Before you can read the parent note FMEA — failure mode, effect, severity, detection, RPN , you must own every word and symbol it throws at you. This page builds them one at a time, from nothing, each resting on the one before it.
Forget the rocket picture. For risk work a spacecraft is just a stack of boxes that each do a job , and those boxes are wired together. If one box misbehaves, its neighbours feel it. That "feeling spreads through wiring" idea is the whole reason FMEA exists.
Definition System, Subsystem, Component
Component — the smallest part you name and worry about (one battery cell, one bearing, one line of code's allocator). Picture: a single small box.Subsystem — a group of components doing one function (the whole battery, the whole attitude-control unit). Picture: a big box holding small boxes.System — the whole spacecraft. Picture: the biggest box.
Why the layers? Because a tiny box failing can push a bigger box, which pushes the biggest box. FMEA needs this ladder so it can trace consequences upward .
A component doesn't just "fail"; it fails in a specific way . A battery cell can short, leak, or go open-circuit — three different failure modes of the same part.
Failure Mode = one specific manner in which a component stops doing its job.
Picture: a single box with several labelled "exit doors", one door per way it can break.
Intuition Why not just say "it broke"?Because the fix depends on which door it went out. A cell that shorts needs a fuse; a cell that leaks needs a seal. "It broke" tells you nothing to design against. The failure mode is the actionable unit.
Once a component takes an exit door, the trouble travels up the ladder from Section 0.
Effect = the consequence of a failure mode, described at each level of the ladder:
Local — what happens at the component itself.Subsystem — what the enclosing box notices.System — what the whole spacecraft does.Mission — what the humans on the ground lose.
Picture: an arrow climbing the nested boxes, getting scarier as it rises.
Notice the same event is "minor" at the bottom and "fatal" at the top. That is exactly why we trace upward and never stop at the local level.
To rank failures we must measure them. Words like "bad" can't be sorted; numbers can. FMEA uses a 1-to-10 integer scale for three separate qualities.
Intuition Why 1 to 10, and why integers?A short, familiar range that a human can assign by judgement. It is deliberately coarse and roughly logarithmic — the jump from 9 to 10 feels like a whole category change (mission-lost → crew-lost), not a tiny +1. We want the scale to match how humans perceive escalating danger.
S S 1 ≤ S ≤ 10 effect is.
S = 1 S = 10 Picture: a thermometer of consequence — cool = harmless, red-hot = catastrophic.
O O 1 ≤ O ≤ 10 likely the failure is over the mission's life.
O = 1 O = 10 Picture: a stack of dice — few dice = rare, many dice = you will roll it.
This is the sneaky one. D not measure how well you detect — it measures how well you fail to.
D D 1 ≤ D ≤ 10 hard the failure is to catch in time .
D = 1 D = 10 Picture: a fog dial — clear = we see it coming, thick fog = it hits with no warning.
Common mistake The Detection scale runs "backwards"Low D good (we catch it), high D bad (blind).
This trips up beginners because for S O meaning of D D blindness ".
Now three honest numbers exist for each failure. We fold them into one so we can sort.
Intuition Why multiply and not add?Multiplication makes the factors gang up . If any single factor is tiny (say O = 1 drags the whole product down — a rare failure is low priority even if it's severe. Addition can't do that: 10 + 10 + 1 = 21 10 × 10 × 1 = 100 "a chain is only as dangerous as its factors let it be — one safe factor rescues the product."
S everity, O ccurrence, D etection — say it aloud: "How S ad, how O ften, how D ark."
A raw number like 108 do with it. FMEA maps RPN bands to actions.
RPN band
Meaning
Action
< 50 trivial
just monitor
50 – 150 notable
design review, test, decide
150 – 500 serious
redesign or add redundancy
> 500 unacceptable
must fix before flight
Intuition Why re-score after fixing?A fix (a fuse, a spare wheel, a new sensor) changes one or more of S , O , D living document : fix → recompute → check the new band. You are literally watching the danger number fall.
Thresholds and mitigation
Each foundation feeds exactly the next: you cannot score Severity (S
These foundations plug into the wider vault:
Risk Management in Spacecraft Design — FMEA is one tool inside it.Reliability Engineering — supplies the failure-rate data behind Occurrence.Redundancy and Fault Tolerance — the classic way to lower Severity.Quality Assurance and Testing — feeds Detection scores.Systems Engineering V-Model — where in the lifecycle FMEA happens.Mission Assurance — the umbrella that demands FMEA.Mars Climate Orbiter — the failure mode nobody wrote down.
Cover the answer and test yourself before opening the parent note.
A component is... the smallest named part you worry about (one cell, one bearing, one allocator).
A failure mode is... one specific way that component can break — its "exit door".
An effect is... the consequence of a failure mode, read at local, subsystem, system, and mission levels.
Severity S how bad the effect is, 1 10
Occurrence O how likely the failure is over the mission, 1 10
Detection D how hard to catch the failure is (blindness), 1 10
The RPN formula is... RPN = S × O × D 1 1000
Why multiply instead of add? so one safe factor (e.g. O = 1
What does D = 10 bad — totally undetectable until the disaster strikes.
After a mitigation you must... re-score S , O , D