A coverage percentage is the easiest number in RAMS to quote and the hardest to earn. This chapter takes eight systems, one from each industry the platform serves, and works the testability question on each of them end to end: which analysis technique the system actually calls for, why that one and not another, the mode inventory, the formulas, the arithmetic, and what the answer tells a designer to change. Every page carries an undetected-λ column, because the complement of the coverage figure is the design agenda and the percentage on its own conceals it.
The eight systems are the same in every concept topic of this row. The aircraft electrical system worked here for its built-in test coverage is the one worked in reliability for its failure rates, in maintainability for its repair times, in availability for its dispatch and in safety for its catastrophic failure condition. Read a column and you learn one property across eight industries; read a row and you watch one machine reveal its five RAMS faces. Every page ends by handing you sideways to the same machine's next property, because detection and isolation always buy their value in somebody else's ledger. All numbers are illustrative, invented for teaching and chosen to make the arithmetic legible; none is field data from any real product.
The technique is a choice, not a default
The single most useful thing this chapter does is refuse to apply one method everywhere. Rate-weighted coverage is the common currency, but what generates the coverage differs completely from row to row, and so does the question worth asking: sometimes it is how much the test sees, sometimes how precisely it names the culprit, sometimes how long the silence lasts between looks. Constant failure rates weight most of these sums correctly and are wrong wherever the item wears, and a wearing item is precisely the one a monitor can watch degrade. Each page names its technique, justifies it, then says what a different technique would have given and why it was rejected.
| Industry | System | Technique this system calls for |
|---|---|---|
| Defence and aerospace | Transport aircraft AC electrical power | Dependency-matrix computation of coverage and ambiguity, years before hardware exists to demonstrate on |
| Railway | Wayside level-crossing controller | Rate-weighted FDR, plus an RCM failure-finding interval sized from a latent-unavailability allowance |
| Space systems | Satellite attitude control | Observability designed against a downlink bit budget, because telemetry is the only test access there will ever be |
| Automotive | Electric vehicle brake system | Ambiguity-group expected-swap arithmetic, reconciled against the field's measured no-fault-found rate |
| Energy and resources | Gas compressor train | Partial stroke testing as a coverage-raising device, because the honest test stops the plant |
| Medical devices | Infusion pump fleet | Power-on self test as a release-to-use gate, with a margin measurement where the item wears |
| Electronics and high tech | Storage array controller pair | Two dependency models: boundary scan against workmanship, telemetry against ageing |
| Nuclear | Emergency diesel generator train | Test-interval optimisation: λT/2 against test-induced unavailability, minimised at T = √(2·ttest/λ) |
What the eight rows have in common
Read down the column and four questions turn out to be doing the work everywhere, whatever the industry called them. What share of the failure rate, not of the mode count, does the test system see: 92%, 78%, 96%, 94%, 88%, 91%, 97%, and on the diesel nothing at all until somebody presses start. What sits in the complement, because the undetected-λ column is a different Pareto from the failure-rate list and repeatedly puts the least significant item in the reliability model near the top of the testability one. How long the silence lasts, because λT/2 turns a small rate into a probability that matters: 9.0 × 10⁻³ for the ram air turbine, 9.7 × 10⁻⁴ for the proving switch, 6.1 × 10⁻³ for the cold spare, 5.0 × 10⁻³ for the backup hydraulic path, 5.3 × 10⁻² for an unaided shutdown valve, 1.6 × 10⁻² for the diesel. And whether the announcement can be believed, which the field grades as no-fault-found: 33%, 21%, 17% and 24% in the four rows that send units back to somebody.
Each row also adds something the others cannot. The aircraft shows coverage computed rather than demonstrated. The crossing shows an interval derived from an allowance rather than a calendar. The satellite shows testability priced in bits per second and made permanent by the absence of a second look. The vehicle shows a design-stage ambiguity model reconciled against a warranty database. The compressor shows a new test invented because the obvious one was forbidden. The pump shows a gate that must measure a margin, not a state. The array shows detection latency spending an availability budget that repair time never touches. The diesel shows an optimum with costs on both sides.
That is the argument for reading the other four columns, and for treating the dependency model as the artefact that connects them. Coverage is an input to the latent-exposure arithmetic in availability, to the removal economics in maintainability, to the probability of failure on demand in safety, and to the redundancy assumptions in reliability. A coverage number that is defensible in isolation is still the wrong number to have improved if nobody checked which ledger the undetected fraction was quietly filling.