A finished worksheet is a long document that almost nobody reads end to end, and its value is entirely in what gets extracted from it. Four extracts matter, and they are read in this order.
1. The single-point failures
Every mode whose end effect is Class I or II with no redundancy behind it. This list is read first, before any criticality number, because a single point of catastrophic failure is a design finding whatever its rate: the question it raises is whether it was intended, not whether it is likely. Each entry ends in one of three places, and "it is unlikely" is not one of them.
| Disposition | What it means |
|---|---|
| Eliminated | The design changed: redundancy, a different architecture, the function moved |
| Controlled | An independent compensating provision now stands behind it, and that provision has its own analysis |
| Accepted | Argued explicitly in the safety case, with the rate, the exposure and the reasoning recorded |
2. The criticality matrix, read in the right order
Class I first regardless of criticality, then Class II, and only within a class by the number. The worked example's card makes the reason concrete: its highest criticality anywhere is the IGBT's 4.3 × 10⁻² in Class II, and the whole safety case is four items an order of magnitude below it in Class I. Ranking the page by criticality alone would put the safety findings fifth, sixth, seventh and eighth.
| What the matrix shows | What it means |
|---|---|
| An item high in Class I | The finding. Everything else waits |
| An item high in Class II | An availability and cost problem, usually the largest failure rate on the list |
| A dense band in Class III and IV | The maintenance and spares case, not a safety input |
| An empty Class I column | Either a genuinely benign design, or an end-effect column that never left the item |
That last row is a real check. A worksheet with no Class I rows on a system that can hurt somebody has usually been written at the wrong indenture level.
3. The detection column
The detection column crosses into two other analyses and is the most reusable thing the worksheet produces.
- Which Class I and II modes are undetected. In the worked example that is all of them, which is the general shape rather than an accident: modes that announce themselves acquire compensating provisions, and what is left is what the equipment cannot see.
- What the built-in test actually covers, mode by mode, which is the honest input to a testability analysis. A BIT credited with 90 per cent coverage of an item's failure rate may cover none of its dangerous modes, and only a mode-level list can tell the difference.
- What the periodic checks are for. A mode detected only at annual service has an exposure of a year, and that exposure belongs in the criticality expression.
4. The mode rates, for everything downstream
λm = α · λp per mode is the quantity the rest of the programme consumes, and it is worth stating why nothing else can produce it. A prediction knows the item's rate; a structural model knows which items matter; only the FMECA knows which fraction of an item's rate does the thing that matters.
| Consumer | What it takes | Why the item rate will not do |
|---|---|---|
| Fault tree | A basic event's probability | The tree's event is "capacitor shorts", not "capacitor fails" |
| RBD | A block's rate | A valve that fails open and one that fails shut sit on different paths |
| Testability | Detected and undetected rate | Coverage is per mode; an aggregate hides which modes are covered |
| Safety | The dangerous fraction | λ_D is a mode-level quantity by definition |
| Maintainability | Task 103's repair data | Repair time depends on the mode, not on the item |
What the numbers do not support
- Two significant figures. β comes from a four-value scale and α is usually generic. Criticality ranks; it does not measure, and a report quoting
Cm = 3.94 × 10⁻³should be read as "about four in a thousand a year, and the fourth digit is decoration". - Comparison across severity classes. Class I at 10⁻⁴ against Class III at 10⁻¹ is not a comparison, and any single "total criticality" that adds classes together has destroyed the only ranking the analysis produces.
- A completeness claim. The worksheet is exhaustive over the modes in it. What is missing is invisible, which is why the mode library, the piece-part pass and the field-return loop matter more than any individual row.
- A statement about combinations. Every row is one failure. If the question is what two failures do together, the answer is in a fault tree or an RBD, built from these mode rates.