Worked examples — FMEA — failure mode, effect, severity, detection, RPN

Everything below only uses ideas the parent note already built. If you have not read it, do that first — this is the practice arena, not the lecture. See also the parent topic.

The scenario matrix

Before solving, let's list every class of case an FMEA problem can throw at you. Each of the three scores can be low (1–3), middle (4–6), or high (7–10). What actually matters is not the exact number but the shape of the answer it produces. Here are the distinct shapes:

The RPN scale itself, from the parent note:

Look at the map of RPN space below before you start — it shows where each case class lands.

Example 1 — Case A: all-low (trivial risk)

Forecast: guess before reading — will this end up above or below the 50 line?

1. Score Severity. Peeling decal affects nothing that flies the spacecraft. $S=1$ (from the parent scale: 1 = None). Why this step? Severity always comes first because it asks "if this fails, how bad is the outcome?" — a decal's worst outcome is a blemish.
2. Score Occurrence. Adhesives are flight-proven; peeling is very unlikely. $O=2$. Why this step? Occurrence asks "how often?" — independent of how bad it is.
3. Score Detection. We'd only ever notice from a camera image, but since it doesn't matter, detection is easy relative to impact. $D=3$. Why this step? Detection asks "would we catch it before it hurts us?" Here there's nothing to hurt.
4. Multiply. $\text{RPN}=1\times 2\times 3=6$. Why this step? RPN combines all three into one comparable number.

Verify: $6<50$ → "monitor, no action" band. Also a sanity check: with $S=1$, no product can exceed $1\times 10\times 10=100$, and this one is far below. A decal cannot be a priority — matches intuition. ✅

Example 2 — Case B: all-high (existential threat)

Forecast: how close to 1000 can this get?

1. Severity. No power = total mission loss. $S=10$. Why this step? This is the catastrophic ceiling — array never opens, spacecraft dies.
2. Occurrence. New, unproven pyro design → high failure likelihood. $O=8$. Why this step? "Known weakness / limited testing" sits high on the O scale.
3. Detection. No confirmation sensor → we only learn it failed when power never comes. $D=10$. Why this step? $D=10$ is the "undetectable until catastrophe" ceiling.
4. Multiply. $\text{RPN}=10\times 8\times 10=800$.

Verify: $800\ge 500$ → unacceptable, must fix before flight. Sanity check on the ceiling: the absolute maximum RPN is $10\times 10\times 10=1000$, and $800$ is $80\%$ of it — this is exactly the kind of single-point failure FMEA exists to catch. ✅

Example 3 — Case C: high S, low O·D (survivable)

Forecast: high-S usually feels urgent — will the RPN agree?

1. Severity. Rupture destroys the propulsion feed → mission loss. $S=9$. Why this step? We honestly record the worst case; we do not shrink S just because it's rare.
2. Occurrence. 4× margin, flight heritage → $O=2$. Why this step? Occurrence is where the huge safety margin pays off.
3. Detection. Continuous pressure telemetry → $D=2$. Why this step? Early, automated detection lets us safe the system before rupture.
4. Multiply. $\text{RPN}=9\times 2\times 2=36$.

Verify: $36<50$ → monitor only, despite $S=9$. This is the whole point of multiplying: a high severity that is both rare and visible gets damped by the small $O\times D=4$ factor. Compare to Ex 2 where $O\times D=80$. ✅ This links directly to Redundancy and Fault Tolerance and Reliability Engineering — margins and monitoring are how you buy down risk without touching severity.

Example 4 — Case D: low S, high O·D (death by a thousand cuts)

Forecast: each event is trivial — can the RPN still demand action?

1. Severity. One rejected sample = negligible. $S=2$. Why this step? Per-event impact is genuinely small.
2. Occurrence. Frequent in the belts. $O=9$. Why this step? Frequency is high even though each event is minor.
3. Detection. No corruption flag → glitches can accumulate unseen. $D=8$. Why this step? Detection captures the invisibility, not the size, of the problem.
4. Multiply. $\text{RPN}=2\times 9\times 8=144$.

Verify: $144$ lands in the $50$–$150$ design-review band — action needed even though $S=2$! The lesson: a small severity is not a free pass; the $O\times D=72$ term drags it up. Contrast with Ex 3 ($S=9$ but RPN $36$). ✅

Example 5 — Case E: degenerate floor, $D=1$

Forecast: what does the smallest possible $D$ do to a product?

1. Severity. Propellant loss risks the mission. $S=7$.
2. Occurrence. Valves are reliable but not perfect. $O=3$.
3. Detection. "Almost certain, automated, pre-failure" is $D=1$ — the floor of the scale. Why this step? $D=1$ is the ideal: we always catch it early.
4. Multiply. $\text{RPN}=7\times 3\times 1=21$.

Verify: $21<50$ → monitor. The degenerate insight: multiplying by 1 leaves the other factors untouched — perfect detection collapses the RPN to just $S\times O$. This is why $D$ can never be $0$: a zero would erase all risk, which is dishonest — even perfect sensors get the floor value $1$, never $0$. ✅

Example 6 — Case F: degenerate ceiling, $S=10$

Forecast: the numbers look small… does that settle it?

1. Severity. Loss of crew → $S=10$ by definition. Why this step? $S=10$ is reserved for loss of life or a flagship mission — the non-negotiable ceiling.
2. Occurrence. Mature design → $O=2$.
3. Detection. Triple-redundant sensors → $D=1$.
4. Multiply. $\text{RPN}=10\times 2\times 1=20$.

Verify — and the twist: $20<50$ by the raw scale, yet any $S=10$ item is reviewed regardless of RPN. Real programs apply a severity override: catastrophic hazards get special scrutiny even when the product is low, because RPN alone can hide a single-point loss-of-crew behind a small number. So the checkable arithmetic is $20$, but the decision is escalated. This override policy is core to Mission Assurance and Risk Management in Spacecraft Design. ✅

Example 7 — Case G: the mitigation loop (before → after)

Forecast: which factor will move the RPN the most — S, or D?

1. Before — Severity. Total downlink loss → $S=9$.
2. Before — Occurrence. $O=5$.
3. Before — Detection. Only noticed when the link dies → $D=7$.
4. Before — RPN. ${\text{RPN}}_{\text{before}}=9\times 5\times 7=315$ → redesign band. Why this step? $150\le 315<500$ demands adding redundancy.
5. After — re-score. Redundancy cuts severity: $S=4$. BIT cuts detection: $D=3$. Occurrence is unchanged — a spare doesn't make the primary less likely to fail: $O=5$. Why this step? Each mitigation targets a specific factor; be honest about which one it touches.
6. After — RPN. ${\text{RPN}}_{\text{after}}=4\times 5\times 3=60$.
7. Reduction. Drop $=315-60=255$. Percent $=\frac{255}{315}\times 100\approx 81\%$.

Verify: $60$ sits in the design-review band (down from redesign) — a genuine, defensible improvement. Sanity check: $S$ fell by a factor $9/4=2.25$ and $D$ by $7/3\approx 2.33$, so RPN should fall by $\approx 2.25\times 2.33\approx 5.25\times$; indeed $315/60=5.25$. ✅ This is FMEA as a living document — every design change re-enters the loop. See Redundancy and Fault Tolerance.

Example 8 — Case H: real-world word problem

Forecast: which phrases in the story map to which score?

1. Find Severity. "the mission ends" → mission loss, but electronics survive up to a limit → $S=8$ (major, mission success at risk). Why this step? Hunt for the worst outcome wording.
2. Find Occurrence. "seen on most long missions after several years" → common aging effect → $O=6$. Why this step? Hunt for how often / how likely wording.
3. Find Detection. "trend upward for months before any limit is exceeded" → excellent early warning → $D=2$. Why this step? Hunt for how early we'd notice wording.
4. Multiply. $\text{RPN}=8\times 6\times 2=96$.

Verify: $96$ is in the $50$–$150$ design-review band. Sanity check on the mapping: high-O (common) but rescued by low-D (months of warning) — exactly the pattern from Case C, just told as a story. If you instead misread "months of warning" as $D=8$, you'd get $384$ and wrongly panic — so the detection phrase is doing real work. ✅

Example 9 — Case I: the exam twist (equal RPN, unequal priority)

Forecast: the numbers are identical — is the risk?

1. Compute both. $3\times 5\times 8=120$ and $8\times 5\times 3=120$. Equal. Why this step? Multiplication is commutative — it cannot tell $S$ apart from $D$.
2. Read the severities. Item Y has $S=8$ (major, could lose the mission). Item X has $S=3$ (minor). Why this step? Severity is the one factor you can never "manage around" — a low-detection annoyance is not a lost mission.
3. Decide. Fix Item Y first. A high-severity item that also happens to have low detection ($D=3$) still risks the mission if it fires; Item X's high $D=8$ only exposes a minor consequence. Why this step? This is the standard severity tie-break: equal RPN → prioritise higher $S$.

Verify: Both products equal $120$ (checkable). The lesson, which every FMEA course tests: RPN is a screening tool, not the final word. Because $S\times O\times D$ hides the individual factors, tables always keep the raw $S$, $O$, $D$ columns and break ties on $S$. This is a known criticism of RPN in Quality Assurance and Testing and Reliability Engineering, and it's exactly the class of oversight behind the Mars Climate Orbiter loss — the dangerous mode wasn't even in the table. ✅

Recall