say, if i had a car in service for 30 years and had no reported failure. should i list one "imaginary" failure, say chassis break into many pieces while driving causing driver's death, as a failure mode ?
actually, we do have a product in service for more than 30 years and had no field failure reported. now a new customer wants a FMECA. i am having hard time to list the failure mode/s as each imaginary mode may cause casualty or property damage.
" i am having hard time to list the failure mode/s as each imaginary mode may cause casualty or property damage."
FMECA is not about field failures, per se, but about what a given failure could do, AND, the probability that it might happen. Your field data forms the the basis of the justification that the probability is remote. Note, however, that just because no field failure is reported does not mean there were no field failures, it only means that none were REPORTED. AND not all failures, even in a car, necessarily causes any ancillary damage. For example, if your battery dies, your car cannot start, so the battery either needs to be recharged, or the alternator needs to be replaced, or you need a new battery. In none of these cases is there any sort of damage-inducing failure. AND, in other cases, the failure doesn't even necessarily cause an inability of the car to take you from Point A to Point B; if your radio dies, the car is still driveable.
Your FMECA should simply be a listing of potential failures and potential results. In any complex system, you cannot have a FMECA with only a single entry; your company's integrity and professionalism would be called into serious doubt.
TTFN
faq731-376
Need help writing a question or understanding a reply? forum1529
Note that if your system is only part of a larger system, it's not part of your FMECA to second guess what your component failure might mean to the final system, i.e., if you are a radio, the failures of the radio would simply be, lack of output, lack of tunability, lack of bass, etc. The guy responsible for the car's FMECA would worry about driver distraction, etc., not you.
TTFN
faq731-376
Need help writing a question or understanding a reply? forum1529
look at your "car" ... is there something specific that could break that would have specific consqeuences ?
like if the actuator arm failed the door could not be opened, or if the support strut failed the door would slam shut. or if this piece failed the door would continue to function normally, but the failure would be difficult to detect (latent) and subsequent failure of another loadpath would cause the door to fail.
let's say it is a fuel valve. the (remote) possible failure mode is break apart due to say, fatigue, and fuel can catch fire and kill everyone on board. but there is no field reported failure, or say there was NO failure. how should i assign the failure rate?
a book from reliability analysis center (RCA) "analysis techniques for mechanical reliability" figure 3.23, failure mode probability. should the sum of it under one I.D. number (part) be (1) ?
thanks.
Note that 30 years, even assuming 100% operation during that time, only amounts to 263 khr, so a well-designed system might have lots of components that will not have failed in that time. Moreover, while we typically assign failure rates to mechanical components, many such components don't really have "random" failures, but, rather, they have wearout failures, which is actually not predicted with failure rate approaches.
Typically failure rates only realistically apply to electronics, but good design and benign environment can push out the random failures.
Again, the failure rate to be used is the PREDICTED, not actual, since it's strongly environment dependent. One might argue that original duty cycle for GB vs AUC was underestimated, and should be changed. Note, however, these analyses are intended for WORST-CASE, not nominal, not best. The idea is to be pessimistic, because if the predicted failure rate actually turns to be the real failure rate, someone messed up. Things being the way they are, all that pessimism is intended to protect the user and manufacturer from the corner cutting that invariable occurs.
The failure probability is that of that particular failure, which could be astronomically low, and if it's a particularly bad consequence, then the lower the probability, the better. Otherwise, you, as a manufacturer must specify and implement mitigations to minimize the effects of the critical failures, which could cost serious money or redesign.
TTFN
faq731-376
Need help writing a question or understanding a reply? forum1529
Briefly put this is what your customer wants to see. And by the way these failure modes do not have to have ever occurred they just have to be reasonable. Your customer is looking to see if you can answer his "what If...happened?" and did you consider it when designing the product.
Use a spreadsheet.
List the parts in column 1,
The ways it can fail in Column 2,
Column 3 is the cause of the failure, for mechanical it is, design flaw, misuse, defective material, end of life and such.
The next three columns will contain the effects at each higher assembly (what the failure did to the part, how the part effected the assembly, and how that assembly effected the system) note that you may not know each level. And don't guess at the higher system effects if you don't know.
Column 7 is the portion of that cause causing that failure mode. If three failure modes can cause one failure mode then they should add up to 100%. This relates to one failure cause being more common than another.
Column 8 is the probability of the failure mode happening at all.
Column 9 is the Criticality 1-10. How severe.
Column 10 is mitigating factors. This is a narration space to state what has been done to prevent this failure mode or cause. Monitoring, tests, redundancy.
Ideally you want any high severity failure modes to have a low probability. It is perfectly valid to say that any failure mode with a probability of less than some value (you determine the value) is treated as zero.
Besides what Dougt115 presents in his excellent post, I would simply add that there are some slight differences in how FMECA are structured in various industries. In the aerospace world, higher system level FMECA is begun very early in the design process since it helps define what some of the system requirements will be (such as functional fault tolerance), or also what particular materials (vacuum melt metals, forgings, etc), analysis procedures (fracture critical), and QA processes (NDI, traceability, QTP/ATP, etc) are necessary. I don't think your automotive FMECA would be quite as involved, but the principles are the same.
Take the example of your fuel valve system, where the fatigue fracture of a particular component (say a part of the valve housing subjected to cyclic loads) would initiate a catastrophic failure event like a fire resulting in loss of life. Due to the high level of criticality involved, you must show by analysis/logic that the failure of this component is not a credible event. Since there are no published reliability data for this component, your only option is to provide a detailed description of every step in the component's design, analysis, manufacture, installation and service life that demonstrates a fatigue fracture of this component will not occur. Since the part in this example would already be in service, it presents quite a challenge to demonstrate by FMECA that a fatigue fracture is not a credible failure event. It would likely require extensive redesign of the part and significant changes to the manufacturing processes used. This is the reason FMECA analyses are often performed early in the design process.
Here is a link to an aerospace technical reference for FMECA:
Mechanical parts are always an issue when looking for failure rates. Also electrical components tend to have a higher failure rate so the mechanical parts are ignored. (This can be a catastrophic assumption.)
I would recommend not using failure rates for mechanical parts. Use the design life of the part to determine the probability that the unit will meet the required operating life.
The reasons are:
Failure rates assume a distribution, usually a normal distribution, and we often plot these and call the curve shape a bathtub. We then operate in the flat region. First part of the curve (descending) is infant mortality, second (flat bottom) is the normal distribution, and the third region (ascending) is wear out. Parts should be used in the flat bottom region.
Mechanical parts only have a wear out region, often performing perfectly until failure. So your failure rate may be zero for 5 years and then the parts start to wear out and they all fail in the sixth year. Kind of like looking ahead of yourself and seeing a cliff. Now close your eyes and start walking. You estimated between 50 and 75 paces to the edge. Chances of falling in the first 50 is zero at 75 is 100% chance but what about the in between counts.
Electrical parts are more like walking across a field bear foot. First take a handful of tacks, close your eyes, throw the tacks in front of you. Now walk, every step you take from the first to the last has the same chance of causing you great pain.
So what to do.
A) over design the mechanical so that you can assume the failure rate is zero over the life of the part.
B) Use the design life of the part to backwards compute a failure rate. (Turning an orange into an apple.)
C) Use NPRD to find an approximate unit with a failure rate. Difficult to find an accurate match. (Assumes your part and application are the same as in NPRD)
D) Compute the electrical and mechanical separate.
I have seen all four methods and only feel comfortable with the first and last.
There are published reliability data for some common standardized mechanical components like ball bearings, etc. For many mechanical aircraft components, like high-performance rolling element bearings and gears, their most likely failure mode (surface pitting) is rather benign and can easily be detected long before it becomes catastrophic. Based on their conservative design approach and the way they are monitored during service, they don't have a defined service life (MTBR). Instead they are operated until they exhibit signs of fatigue failure ("on-condition").
There are a couple ways to approach your situation. One way is to look at your system design in terms of functional fault tolerance. In the aircraft world, if the failure would result in loss of the vehicle or loss of life, the system/component would need to be designed to provide dual fault tolerance. This means it would continue to safely function after two separate failure events. For example, if you had a spring function that required dual fault tolerance you would use three springs installed such that any single spring would provide continued safe function of the system.
If you cannot design your particular system to provide functional dual fault tolerance, and you cannot show by analysis that it has a calculated failure rate below the threshold where it would not be considered a credible event, another approach is to provide condition monitoring of the system and design the system so that any faults detected can be quickly and safely isolated. For example, if a leak is detected in your fuel valve you would close an isolation valve located nearby to stop the leak, and the fuel flow function would be performed by a separate circuit if required.
For some failure modes at certain system levels it is impossible to design them with the necessary degree of fault tolerance. This is why commercial aircraft use at least 2 engines, with each one capable of providing sufficient thrust to safely operate the aircraft. A commercial turbofan engine has many subsystems that are each designed to provide single/dual fault tolerance. But in the case of severe damage to the fan/compressor components from debris ingestion the only option is to shut the affected engine system down (isolate it) and continue to operate using the remaining engine(s).
With mechanical systems it is usually much easier to meet an MTBF requirement than it is to meet a functional fault tolerance requirement. Meeting a system functional fault tolerance requirement typically means adding redundant components, while meeting an MTBF requirement may only involve using a higher quality component.
one day i had a chance to meet a reliability engineer from sikorsky introduced by a former chief electrical engineer of sikorsky, basically, he told me there was no data on failure rate of 99% mechanical parts. for example, our fuel valve is a unique one, no government data, no sikorsky data, and we did not get any failure reported to us. no number of flight hours, so, MTBF is just a number pick from the sky but untold.
when we have a new customer, we are alwasy asked to provide MTBF. that is the delimma!
thanks.
Just because there is no published reliability data for a mechanical component does not mean there's no way to establish if it has an acceptable MTBF for a given application. Take the example of a transmission gear from my previous post. Based on many decades of aircraft industry experience, transmission designers know that the three most likely failure modes for gears are tooth root fractures from bending, tooth surface pitting/spalling, and tooth surface scoring/scuffing. Tooth surface scoring and tooth root fractures can quickly result in the failure of the transmission, so they can be quite serious. Tooth surface pitting/spalling usually occurs slowly and can easily be detected long before it causes failure of the transmission, so it is not as serious a problem. While there is obviously no published reliability data for the gear itself, there are substantial amounts of statistical mechanical properties data for the materials/manufacturing processes used to make the gears, and this is used for design and analysis. For example, since a tooth root fracture failure presents a greater hazard the recommended material tensile strength design limits might be based on an L2 (98%) reliability rate. But since tooth surface pitting/spalling presents a lesser hazard the recommended material contact stress design limits might be based on an L10 (90%) reliability rate. Tooth surface scoring presents a very complex analysis case, but there is an established method of calculating the probability for scoring to occur. Because there are many variables involved in a scoring analysis and each variable can have a large effect, aircraft gears are typically designed for a calculated probability of scoring well below 1%.
If you are supplying a safety critical component (like a fuel system valve) that will be used on a certified aircraft and you don't have acceptable reliability data for the design, then your customer will likely require you to perform a qualification test procedure on the device, including extended life cycle, vibration, and pressure proof testing. In fact it is quite common for several test articles to be needed for a qualification test, since a single test procedure can use up all the design fatigue life the device has and making it unsuitable for further test procedures.
In short, with most mechanical systems/components you'll need more information than just "X" number of components operated for "Y" number of hours/cycles to establish legitimate reliability data. You'll also need detailed records of the conditions the system/component was operated at for the periods the data was compiled.
when the gas nozzle still attached to the car and the driver drives off the gas station, he breaks the frangible coupling installed in the mid of the hose instead the hose. the coupling seals the gas flow and prevent gas loss and some fire hazard.
the same concept device is used on helicopter. during a hard landing or survivable crash, a frangible couple separates and seal the fuel flow and prevent after crash fire hazard.
so the coupling is under almost no stress, or very low stress due to pressure, weight, vibration … etc. only at the crash, a BIG load breaks the frangible means and separates the valve into two halves. the sealing mechanism in each half seals the valve.
there was no reported operational failure except broken when the big crew stepped on it.
heavy housings, balls, torsion springs, seals, frangible bolts…………
MTBF??
when I "imagined" some failure modes (housing corrosion, ball scratch, spring set, seal scratch, bolt fatigue), I had hard time to give a failure rate.
thanks.
