The analysis produces three numbers and two lists, and the lists are the useful part. A testability report that contains only percentages has thrown away everything a designer can act on.
The two numbers, and the one that must travel with them
| Figure | What it is | Base |
|---|---|---|
FDR | Fault detection: the rate-weighted share of failure rate some test responds to | All modes |
FIR(1), FIR(≤2) | Fault isolation: the share resolved to one item, or to two or fewer | Detected modes only |
FARr | FA ÷ (FA + TA): the share of indications raised with nothing wrong | Needs a spurious rate per test |
The base matters and is routinely mixed. Isolation quoted over all faults instead of over detected ones flatters a design with poor detection, because the faults nothing sees are quietly excluded from the denominator of one figure and included in the other. State both bases in the report.
The third figure needs an input the dependency model does not contain, a spurious-indication rate per test, and the report is incomplete without it. A diagnostic system is believed or ignored on its false alarm ratio, and detection and isolation describe a system nobody is using if the answer is wrong a quarter of the time. Watch the coupling in both directions: every test added for isolation raises FA, and every improvement in detection raises TA, so two of the three figures move whenever any one of them is worked on.
The undetected list
Every all-zero column, with its rate. This list is read by three people for three reasons: the designer, who decides whether to add an observation; the safety engineer, who checks whether any of them is a dangerous undetected mode feeding a safety case; and the maintenance planner, who now knows which faults will be found by a scheduled check rather than by the equipment.
An undetected fault is not automatically a finding. A benign mode that nothing sees and nothing needs to see is fine, provided somebody has said so.
The ambiguity list
Every group larger than one, with its members, its combined rate and its cost in removals. Sorted by rate, not by group size: a five-way group of parts that never fail matters less than a two-way group carrying a fifth of the equipment's failures.
Each entry has one of four dispositions, and only the first two are analysis work:
| Disposition | What it means |
|---|---|
| A test that splits it | The measurement exists or can be added; the analysis says which members it separates |
| Partition the hardware | Make the members separately replaceable so the group costs one removal each |
| Accept it | Recorded with its removal cost, and carried into the spares and turnaround estimates |
| A redrawn boundary | Replace the group as a single unit; the group vanishes because the items do |
What the result feeds
| Consumer | What it takes |
|---|---|
| Built-in test design | Which tests, in which order, and which ones can be deleted |
| Maintainability prediction | Isolation time and the removals per fault, which drive MTTR |
| Spares and support | The removal rate, which is higher than the failure rate wherever a group survives |
| Safety | Which dangerous modes are undetected, and therefore what the proof-test interval has to cover |
| The maintenance manual | The diagnostic strategy, derived rather than written |
| The demonstration | The predicted figures a seeded-fault trial is scored against, mode by mode |
What the numbers do not support
- A comparison across levels of repair. Isolation to one LRU and isolation to one card are different measurements. Two programmes quoting 90 per cent may not be within twenty points of each other.
- A comparison across bases. See above: isolation over all faults against isolation over detected faults.
- Anything about intermittents. The matrix is binary and the intermittent fault is the one that dominates real no-fault-found rates.
- An item-level claim. Detection computed over items rather than modes is an upper bound: on the worked example it reads 95.1 per cent against a true 85.3.
- A prediction of what the technician will actually do. The strategy is optimal for the model. Whether it is followed depends on the manual, the training and whether the last three alarms were false.