Defence and aerospace

Two engine-driven integrated drive generators, an auxiliary power unit generator, a ram air turbine, two generator control units and the contactors that tie the buses together. The safety question is a single sentence: how often can this aeroplane lose all of its alternating-current power in flight, and is the answer small enough. Everything on this page exists to make that sentence checkable.

The technique, and why this one

A combined FMECA (Task 101 and Task 102 together) to build the mode inventory and rank it by criticality, then a fault tree built from the severity-I modes, read for cut-set order before it is read for numbers. The order matters. An inductive FMECA answers "what does each failure do", which is how the inventory gets built and how nothing is forgotten. A deductive fault tree answers "what combinations produce this outcome", which is how the architecture gets tested. Running only one of them leaves a characteristic hole: FMECA alone misses the combinations, and a fault tree alone misses the mode nobody thought to put in it.

The criticality half of the FMECA, Task 102, is what turns a list into a ranking, and it is the step most often skipped. Its arithmetic is

Cm = β · α · λp · t

the mode criticality number, where α is the mode ratio, β the conditional probability that the mode produces the stated severity, λp the item failure rate and t the mission time of 5 hours. Item criticality is Cr = Σ Cm over that item's modes within a severity class.

The worksheet

Rates per 10⁶ flight hours; Cm in units of 10⁻⁶ per 5-hour flight. Severity classes are Catastrophic (I), Critical (II), Marginal (III) and Negligible (IV).

Worked for one row, so the arithmetic is visible. IDG overvoltage:

Cm = β · α · λp · t = 0.10 × 0.10 × 250 × 10⁻⁶ × 5 = 1.25 × 10⁻⁵

Item criticality for the generator control unit in class II:

Cr(GCU, II) = 5.63 + 0.90 = 6.53 × 10⁻⁶

What the ranking says

The top of the criticality ranking is IDG overvoltage at Cm = 12.50, a mode whose failure rate of 25 per 10⁶ flight hours is one of the smallest in the worksheet. Second is GCU failure to trip at 5.63, also a low-rate mode. Meanwhile the two largest failure rates in the system, IDG loss of output at 137.5 and APU loss of output at 135.0, sit near the bottom of the criticality list.

That inversion is the entire reason Task 102 exists. A Pareto ordered by failure rate would have sent the programme after the generators; the criticality ranking sends it after the protection, because a generator that stops is an inconvenience the architecture already absorbs, and a generator that pushes 200 volts into the avionics with a control unit that fails to trip is a different kind of event. The mode ratio α and the conditional probability β are where the engineering judgment lives, and they should be argued in review rather than filled in from a template.

The other thing the worksheet does is populate the tree. Six modes carry class I: the GCU internal fault, both APU modes and both RAT modes. Those, plus the channel-loss modes that must coincide, are the basic events of the fault tree below. Nothing enters the tree that did not come from the worksheet, and nothing in the worksheet with a class I effect is allowed to be absent from it. That reconciliation, run as a checklist, is the cheapest error-catching step in the whole assessment.

The fault tree

The top event is total loss of AC power in flight, classified Catastrophic, with a target below 1 × 10⁻⁹ per flight hour. Beneath it an OR gate separates two completely different ways of getting there: all four sources failing independently, and a single shared cause taking them together.

Each channel is an OR of its three contributors, so over the 5-hour flight

q_ch = (137.5 + 40.5 + 15.0) × 10⁻⁶ × 5 = 9.65 × 10⁻⁴

The APU is a demanded source with two ways of being absent:

q_APU = (120 + 135) × 10⁻⁶ × 5 = 1.275 × 10⁻³

The ram air turbine is dormant, so its unavailability is not a mission-time calculation at all. With a functional check every 500 flight hours it follows the latent-failure average from the foundations chapter:

q_RAT = λT/2 = 36 × 10⁻⁶ × 500 / 2 = 9.0 × 10⁻³

The AND gate multiplies:

q_AND = 9.65 × 10⁻⁴ × 9.65 × 10⁻⁴ × 1.275 × 10⁻³ × 9.0 × 10⁻³ = 1.07 × 10⁻¹¹ per flight

which over five hours is about 2 × 10⁻¹² per flight hour, a hundred times below the target and apparently the end of the matter.

Reading the structure before the number

It is not the end of the matter, and the reason is visible in the tree rather than in the arithmetic. Three observations, in the order a reviewer should make them.

The cut-set order is four, and that is the finding that counts. No single failure produces the top event, which is what a catastrophic classification requires in civil aviation certification practice, and the tree demonstrates it structurally rather than probabilistically. Had any branch resolved to a single basic event, no probability however small would have rescued the design.

The ram air turbine dominates the product by an order of magnitude. At 9.0 × 10⁻³ it is a thousand times less available than a channel, entirely because it is dormant and checked every 500 hours rather than because it is unreliable. Halving the check interval halves the term; improving the turbine barely moves it. That is a maintenance decision masquerading as a hardware one, and the testability page works it as a coverage problem.

The undeveloped diamond is the real answer. The assessed top-event value, with residual shared causes included, is 4.2 × 10⁻¹⁰ per flight hour, which is roughly two hundred times the independent term. Everything the AND gate computed is noise beside it. The design earns its number not from the multiplication but from what was done to make the multiplication legitimate: separate engines, separate accessory gearboxes, separated routing, dissimilar control-unit software, independent buses. Those measures are not in the tree; they are the argument that the tree is allowed to multiply, and the common cause analysis is where they get audited.

What a different technique would have given

Running the fault tree without the FMECA behind it would have produced a tidy and defensible-looking tree containing only the modes the analyst thought of. Overvoltage would very likely not have been among them: it is a low-rate mode, it does not cause loss of the channel, and it does not appear anywhere in a top event about losing power. The FMECA finds it because the FMECA asks what each failure does rather than what causes a chosen outcome, and it ranks it first because Task 102 weights by consequence. A programme that runs only the deductive analysis systematically misses the modes whose harm lies outside the top event it chose to analyse, which is precisely the class of mode that later appears in an accident report as "not considered".