FMEA — failure mode, effect, severity, detection, RPN

3.6.29 · Physics › Spacecraft Structures & Systems Engineering

FMEA Kya Hai?

Paanch Core Elements

Element	Definition	Scale	Kya Measure Karta Hai
Failure Mode	Component ke fail hone ka specific tarika	N/A	"Power supply shorts", "propellant leak", "sensor drift"
Effect	Subsystem/mission pe consequence	N/A	"Loss of attitude control", "mission abort", "data corruption"
Severity (S)	Impact ki magnitude	1-10	1 = negligible, 10 = catastrophic (crew/mission ka loss)
Occurrence (O)	Failure ki likelihood	1-10	1 = extremely unlikely, 10 = almost certain
Detection (D)	Impact se pehle failure pakadne ki ability	1-10	1 = hamesha early detect hoti hai, 10 = disaster tak undetectable

FMEA Kaise Perform Karein: Step-by-Step Derivation

Step 1: System Ko Decompose Karo

Spacecraft ko functional blocks mein toddo (power, propulsion, thermal, C&DH, etc.), phir components mein (battery cells, thrusters, thermistors, CPUs).

Kyun? "Reaction wheel fails" bahut vague hai. "Reaction wheel bearing seizes due to lubricant degradation" actionable hai.

Step 2: Failure Modes Identify Karo

Har component ke liye poochho: "Ye kitne saare tareekon se fail ho sakta hai?"

Example — Li-ion battery cell:

Internal short circuit
Electrolyte leakage
Capacity fade beyond spec
Thermal runaway
Open circuit (connector failure)

Exhaustive listing kyun? Jo failure mode aap consider nahi karte, wohi mission ko kill karta hai (Mars Climate Orbiter dekho: units mismatch FMEA mein nahi tha).

Step 3: Effects Analyze Karo (Local → Global)

Har failure mode ko system hierarchy mein upar trace karo:

Example: Battery cell internal short

Local effect: Cell voltage →0 V, current spike
Subsystem effect: Battery management system emergency disconnect trigger karta hai
System effect: Power bus minimum se neeche girta hai → spacecraft safe mode mein jaata hai (reaction wheels ruk jaate hain, transmitter off)
Mission effect: Attitude control ka loss → solar panels misaligned → power death spiral → mission loss

Upar trace kyun karte hain? Ek "minor" component failure cascade hokar mission-critical disaster ban sakti hai.

Step 4: Severity (S) Score Karo

Standardized scale use karo (example aerospace scale):

| S | Effect | Description | |---|-------------| | 1 | None | Koi impact nahi | | 2-3 | Minor | Thodi si performance degradation, mission impact nahi | | 4-6 | Moderate | Reduced capability, mission objectives partially met | | 7-8 | Major | Severe degradation, mission success at risk | | 9 | Critical | Mission failure, crew injury nahi | | 10 | Catastrophic | Crew ka loss (human spaceflight) ya flagship mission ka loss |

Battery cell short → S = 9 (mission loss) agar redundancy nahi hai.

1-10 kyun? Logarithmic-like scale human risk perception ko reflect karta hai (9→10 ek qualitative jump lagta hai, sirf +1 nahi).

Step 5: Occurrence (O) Score Karo

Mission lifetime mein failure rate estimate karo:

O	Probability	Failure Rate Example
1	< 0.01%	1 in 1,000,000 hours (design decades mein proven)
2-3	0.01-0.1%	1 in 100,000 hours
4-6	0.1-1%	1 in 10,000 hours (new design, limited testing)
7-8	1-10%	1 in 1,000 hours (known weakness)
9-10	> 10%	1 in 100 hours (almost certain to fail)

Li-ion mein battery cell short → O = 4 (rare lekin industry mein documented).

Probabilistic kyun? "Ho sakta hai" ko "Y units mein X baar hoga" mein convert karta hai, jisse Monte Carlo mission sims possible hoti hain.

Step 6: Detection (D) Score Karo

Rate karo ki aap failure ko kitni jaldi aur reliably detect kar sakte ho:

D	Detection	Description
1-2	Almost certain	Automated sensors, continuous monitoring, pre-failure warnings
3-4	High	Periodic checks mission impact se pehle detect karte hain
5-6	Moderate	Failure ke dauran detect hoti hai, lekin correctable hai
7-8	Low	Mission impact shuru hone ke baad detect hoti hai
9-10	None	Catastrophic failure tak undetectable

Battery cell short → D = 3 (voltage/current sensors seconds mein pakad lete hain, BMS disconnect karta hai).

Detection kyun matter karta hai? High-S, high-O failure jo low D ho (hum early pakad lete hain) manage ki ja sakti hai. Wahi failure agar high D ho toh ek silent killer ban jaati hai.

Step 7: RPN Calculate Karo aur Prioritize Karo

$RPN_{battery short} = 9 \times 4 \times 3 = 108$

Interpretation:

RPN < 50: Monitor karo, immediate action nahi
RPN 50-150: Design review, test-then-decide
RPN 150-500: Redesign ya redundancy add karo
RPN > 500: Unacceptable — flight se pehle fix karna zaroori

Threshold kyun? Industry data pe based: RPN > 500 items unfixed missions mein ~60% zyada in-flight anomaly rates hoti hain.

Step 8: Mitigate Karo aur Recalculate Karo

Battery short ke liye mitigation:

Failed cell isolate karne ke liye fuses add karo (Effect severity kam hoti hai → S = 6)
Cell testing badhao (O → 3 ho jaata hai)
Redundant voltage monitoring add karo (D → 2 ho jaata hai)

$RPN_{new} = 6 \times 3 \times 2 = 36 (acceptable)$

Iterate kyun karte hain? FMEA ek living document hai — har design change mein re-scoring zaroori hai.

Worked example Worked Example: Reaction Wheel FMEA

Component: Reaction Wheel (RW) for 3-axis stabilization Failure Mode 1: Bearing seizure due to lubricant depletion

Effect Analysis:

Local: Wheel ruk jaata hai, torque output → 0
Subsystem: Us axis ke along momentum desaturate nahi kar sakte
System: Spacecraft attitude drift karta hai, solar panels misalign ho jaate hain
Mission: Power loss → safe mode → science downtime

Scoring (mitigation se pehle):

S = 8 (major mission impact, science loss lekin spacecraft survive karta hai)
O = 5 (heritage missions mein ~5 saal baad documented)
D = 4 (wheel speed telemetry seizure se weeks pehle drag increase dikhata hai)

$RPN = 8 \times 5 \times 4 = 160 (action required hai)$

Mitigation:

4 reaction wheels use karo (3 + 1 redundant, koi bhi 3 full 3-axis control dete hain)
Predictive monitoring implement karo (wheel current vs. speed trend karo)
Wear balance karne ke liye wheels mein momentum management design karo

Revised Scoring:

S = 4 (degraded mode, lekin mission continue karta hai)
O = 5 (unchanged, failure still possible hai)
D = 2 (predictive alarms weeks ki warning dete hain)

$RPN_{new} = 4 \times 5 \times 2 = 40 (acceptable)$

Ye steps kyun?

Redundancy S cut karta hai (hum failure survive karte hain)
Predictive monitoring D cut karta hai (hum aata hua dekh lete hain)
Hum O = 5 accept karte hain kyunki failure ab manageable hai

Worked example Worked Example: Software Memory Leak

Component: Flight software (FSW) memory allocator

Failure Mode: Image compression routine mein memory leak

Effect Analysis:

Local: Heap dinon mein fill ho jaata hai
Subsystem: Next buffer allocate karte waqt FSW crash karta hai
System: Processor watchdog reboot trigger karta hai → attitude knowledge ka loss → safe mode
Mission: Reboot ke dauran science data loss, battery drain

Scoring:

S = 7 (mission impact, lekin reboot se recoverable hai)
O = 6 (complex C code mein memory leaks common hain)
D = 8 (slow leak crash tak undetected, koi runtime memory profiler nahi)

$RPN = 7 \times 6 \times 8 = 336 (unacceptable)$ Mitigation:

Memory usage telemetry add karo (1 Hz sampling)
Leak analysis ke liye ground-commandable memory dump implement karo
FSW ko non-critical tasks ke periodic memory scrub/reset ke saath design karo
Code review + static analysis (Coverity, Valgrind)

Revised Scoring:

S = 5 (scrub crash prevent karta hai, sirf brief performance dip)
O = 4 (static analysis pre-flight 70% leaks pakad leta hai)
D = 3 (telemetry days pehle leak trend dikhata hai)

$RPN_{new} = 5 \times 4 \times 3 = 60 (borderline, closely monitor karo)$

Common mistake FMEA Mein Common Mistakes

Mistake 1: "Ye component space-qualified hai, toh O = 1" Kyun sahi lagta hai: Part radiation testing pass kar chuka hai aur heritage hai.

Kyun galat hai: Space qualification specific failure modes test karta hai (radiation, thermal cycling), sabhi modes nahi. Ek rad-hard chip phir bhi tin whisker shorts, firmware bugs, ya supply-chain counterfeits se fail ho sakta hai.

Fix: O ko specific failure mode ke liye apne mission environment mein score karo, part ki pedigree ke hisaab se nahi. Heritage data help karta hai lekin free pass nahi hai.

Mistake 2: "Hum ise testing ke dauran detect kar lenge, toh D = 1"

Kyun sahi lagta hai: Ground testing exhaustive hai (thermal-vac, vibration, radiation).

Kyun galat hai: D in-flight detection score karta hai, ground detection nahi. Ek failure mode jo sirf 2 saal orbit mein rehne ke baad manifest hoti hai (jaise bearing wear, UV degradation), wo 3-month test campaign mein nahi dikhegi.

Fix: D = 1 ke liye continuous on-orbit monitoring with early warning chahiye. Agar ground testing pakad leta hai, achha hai — lekin wo launch rokta hai, in-flight D lower nahi karta.

Mistake 3: "RPN = 120 vs. 180, toh pehle 180 fix karo"

Kyun sahi lagta hai: Higher RPN = higher priority, yahi formula hai.

Kyun galat hai: RPN individual components ko obscure karta hai. S=10, O=2, D=9 failure (RPN=180, undetectable catastrophe) kahin zyada buri hai S=6, O=6, D=5 se (RPN=180, frequent lekin survivable). Dono ka RPN=180 hai lekin risk profiles bilkul alag hain.

Fix: Pehle high S (catastrophic failures) prioritize karo, phir high O × D. RPN ek sorting tool hai, decision algorithm nahi. Hamesha S/O/D breakdown review karo.

Mistake 4: "Hum ne mitigate kar diya, ab ho gaya"

Kyun sahi lagta hai: RPN 50 se neeche aa gaya, spreadsheet mein green hai.

Kyun galat hai: Mitigation complexity add karta hai (aur sensors, redundant paths, watchdog code), jo naye failure modes introduce karta hai. Backup thruster add karne ka matlab hai ki ab thruster-valve-controller interaction failures hain.

Fix: Mitigation ke baad, mitigation pe bhi FMEA run karo. Kya redundancy ne single-point failures introduce kiye (jaise shared power bus)? Kya watchdog ke apne failure modes hain? Tab tak iterate karo jab tak RPN reduction real ho, na ki sirf kisi aur cell mein shift hua ho.

Recall Ek 12-Saal-Ke-Bachche Ko Samjhao

Socho tum Mars pe ek science fair ke liye robot bana rahe ho. Ek baar launch karo, toh agar kuch toot gaya toh tum ja ke fix nahi kar sakte. Toh launch se pehle tum baithte ho aur ek game khelte ho jiska naam hai "Kya Galat Ho Sakta Hai?"

Tum har ek tarika likhte ho jisme har part toot sakta hai: battery khatam ho sakti hai, ek wheel jam ho sakta hai, ek wire snap ho sakta hai. Har breakdown ke liye tum sochte ho: "Theek hai, agar aisa hua, toh aage kya tootega?" Ho sakta hai wheel jam hone se robot circles mein ghoomne lage, phir wo apne solar panels charge nahi kar sakta, phir wo mar jaata hai.

Phir tum har breakdown ko score dete ho:

Ye kitna bura hai? (Severity) Kya robot bas ek second ke liye confuse hota hai, ya hamesha ke liye mar jaata hai?
Ye kitna likely hai? (Occurrence) Kya ye 10 mein se 1 robot mein hota hai, ya 1000 mein se 1 mein?
Kya tum ise aata hua dekh sakte ho? (Detection) Kya robot warning beep karta hai, ya bas suddenly band ho jaata hai?

Tum teen scores ko multiply karke ek danger number (RPN) paate ho. Sabse bade danger numbers woh problems hain jinhe tum launch se pehle fix karna zaroori hai — shayad ek backup wheel add karo, ya ek sensor jo chillaye "hey, main toone waala hoon!"

Yahi hai FMEA: ek checklist jo ensure karta hai ki tumne har tarike ke baare mein socha jisme cheezein fail ho sakti hain, aur sabse scary wali fix kar di. Kyunki ek baar robot Mars pe pahuncha, toh wo apne dam pe hai.

Connections

Risk Management in Spacecraft Design — FMEA ek broader risk framework mein ek tool hai (FMECA, fault trees, hazard analysis bhi shaamil hain)
Reliability Engineering — FMEA reliability predictions mein feed hota hai (MTBF, survival curves)
Redundancy and Fault Tolerance — High-RPN failures redundancy requirements drive karte hain (dual-string power, quad reaction wheels)
Systems Engineering V-Model — FMEA preliminary design mein shuru hota hai, testing aur flight tak update hota rehta hai
Quality Assurance and Testing — Detection (D) scores test coverage aur on-orbit monitoring pe depend karte hain
Mission Assurance — Flight readiness reviews ke liye FMEA evidence zaroori hai
Mars Climate Orbiter — Case study: unit conversion error FMEA mein nahi tha → mission loss

#flashcards/physics

FMEA kya stand karta hai aur iska purpose kya hai? ::: Failure Mode and Effects Analysis — ek systematic method jo sabhi possible component failure modes identify karta hai, system/mission pe unke effects analyze karta hai, aur Severity, Occurrence, aur Detection scores use karke risk quantify karta hai taaki launch se pehle mitigation prioritize ki ja sake.

FMEA ke paanch core elements kya hain? :::

Failure Mode (component ke fail hone ka specific tarika), 2. Effect (subsystem/mission pe consequence), 3. Severity (S, impact magnitude 1-10), 4. Occurrence (O, likelihood 1-10), 5. Detection (D, impact se pehle pakadne ki ability 1-10).

Risk Priority Number (RPN) formula kya hai aur hum multiply kyun karte hain? ::: RPN = S × O × D. Hum multiply karte hain kyunki har factor ek conditional probability gate hai: high severity tabhi catastrophic hai jab wo likely bhi ho AUR undetectable bhi. Multiplication compounding risk capture karta hai.

Spacecraft FMEA mein action thresholds ke liye kaunse RPN ranges correspond karte hain? ::: < 50: monitor karo, 50-150: review aur test karo, 150-500: redesign ya redundancy add karo, > 500: unacceptable aur flight se pehle fix karna zaroori.

Ek reaction wheel bearing fail hoti hai (S=8, O=5, D=4, RPN=160). Redundancy add karne ke baad S gir ke 4 ho jaata hai aur predictive monitoring D ko 2 kar deta hai. Naya RPN kya hai aur kya ye acceptable hai? ::: New RPN = 4 × 5 × 2 = 40. Ye acceptable hai (< 50), jo dikhata hai ki redundancy (S cuts karta hai) aur monitoring (D cuts karta hai) ne successfully ek high-RPN failure ko mitigate kiya.

Ground testing ke basis pe Detection (D) score karna mistake kyun hai? ::: Kyunki D in-flight detection capability measure karta hai, ground test detectability nahi. Failures jo sirf orbit mein kaafi saalon baad manifest hoti hain (wear, UV degradation) wo months-long ground tests mein nahi aayengi. D=1 ke liye early warning ke saath continuous on-orbit monitoring chahiye.

Dono failures ka RPN=180 hai. Failure A: S=10, O=2, D=9. Failure B: S=6, O=6, D=5. Kaun zyada dangerous hai aur kyun? ::: Failure A kahin zyada buri hai. Ye catastrophic (S=10) aur undetectable (D=9) hai, matlab jab bhi hoti hai (chahe rare hi kyun na ho), mission khatam bina kisi warning ke. Failure B frequent hai lekin survivable aur detectable hai. RPN ye chhupaata hai — hamesha pehle high S prioritize karo.

Mitigation pe khud FMEA run karne ka purpose kya hai? ::: Mitigation complexity add karta hai (redundancy, sensors, watchdog code), jo naye failure modes introduce karta hai. Tumhe verify karna hoga ki RPN reduction real hai aur kisi aur component mein transfer nahi hui (jaise shared power bus ek single-point failure ban jaaye).