The analysis is short once the inputs exist, and the inputs are where it is usually lost: a fault list that is not the FMECA's, a test list that contains only what has already been designed, and cells filled in by whoever built the spreadsheet.
1. Fix the level the analysis works at
Testability is stated at a level of repair: isolation to one line-replaceable unit means something different from isolation to one card inside it. The level decides what counts as an item, and therefore what counts as an ambiguity group. Programmes that analyse at one level and quote requirements at another produce numbers that cannot be compared with anything.
2. Take the fault list from the FMECA
Not a new list. The FMECA has already enumerated the modes and attached a rate to each through its α ratios, and those rates are what every metric is weighted by. Two disciplines here: modes, not items, because a valve that fails open and one that fails shut are different rows in the matrix; and coverage is checkable, since every mode in the worksheet either appears in the matrix or has a recorded reason for not appearing.
3. Enumerate every candidate test, including the ones nobody has built
The list is deliberately wider than the design: built-in test, an existing sensor read differently, an operator's observation, a measurement available only on the bench, a test that would need a new sensor. Including tests that do not exist is the point of doing this early: the analysis is how a new observation point earns its place, and it cannot earn anything if it was never on the list.
4. Fill the matrix from the design
One cell at a time, from a signal path, a simulation or a judgement, with the source of each judgement recorded. A cell is one only if the test responds to that fault: not if it might, not if it would with a different threshold, and not if the fault would eventually cause something else that the test sees, which is a different fault's row.
5. Read the columns
Sort the columns and the answer appears: identical columns are ambiguity groups, all-zero columns are undetected faults, and everything else is isolated. Then weight by rate to get FD, FI(1) and FI(≤2), quoting isolation as a fraction of what is detected.
6. Read the rows, and price the gaps
Each undetected fault and each ambiguity group is a finding with a candidate fix, and the fixes are not interchangeable:
| Finding | The test that fixes it | What it buys |
|---|---|---|
| An all-zero column | A measurement that responds to that fault at all | Detection |
| An ambiguity group | A measurement that responds to some of the group and not the rest | Isolation |
| A group that no available measurement splits | Partitioning: make the items separately replaceable, or accept the group | Neither; it is a design change |
| A redundant row | Nothing. Delete the test | Cost |
7. Derive the diagnostic strategy
The order tests are run is an optimisation over the same matrix: at each step, choose the test that best splits the remaining candidates, weighted by their rates and by what the test costs to run. What comes out is simultaneously the built-in test's sequence, the fault tree in the maintenance manual and the technician's procedure, and deriving it once means the three cannot disagree.
8. State the false-alarm side separately
The matrix cannot produce a false alarm rate, and a testability report that quotes detection and isolation without it is describing a diagnostic system nobody has reason to trust yet. The figure comes from test design, threshold margins and field data, and belongs beside the other two.
9. Re-run when the mode list moves
The matrix depends on the FMECA, and the FMECA moves: a mode added, an α corrected by field returns, a design change that removes a signal path. The cheapest way to keep the analysis current is to have it read the worksheet rather than a copy of it.