Testability's mathematics is bookkeeping over the failure-mode inventory: which modes each test sees, to what group of suspects each symptom points, and how often the tests speak when nothing is wrong. The quantities are simple ratios; the craft is in the weighting, the denominators, and the honesty of the underlying mode list. This chapter builds the measures, shows why failure-rate weighting changes everything, lays out the test layers that generate the coverage, prices ambiguity, and ends with the dependency-model machinery that computes it all before hardware exists.
The coverage measures
| Measure | Definition | The trap |
|---|---|---|
| Fault detection coverage (FFD) | The failure-rate-weighted fraction of failures detected by the stated test means | Quoted mode-counted, or against a censored mode list, it flatters |
| Fault isolation coverage (FFI to n) | Of detected failures, the fraction isolated to an ambiguity group of ≤ n replaceable units | FFI to 1 and FFI to 3 are different worlds for the technician |
| False alarm rate | Indications of failure when none exists, per operating hour | Rarely specified, always paid for; the credibility budget |
| Cannot duplicate (CND) | Field indications that maintenance cannot reproduce | The false-alarm rate as the field actually experiences it |
| Retest OK (RTOK) | Removed units that test good at the next level | The isolation shortfall as the supply chain experiences it |
| Undetected fraction (1 − FFD) | The failures nothing announces | The latent ledger: availability's λT/2 arithmetic runs on exactly this subset |
Every number in the table is conditional on three declarations that belong in the same sentence as the value: which test means (continuous monitors only? plus initiated tests? plus shop equipment?), which failure universe (the full FMEA mode list, weighted by rate), and which replaceable-unit level (isolation to an LRU at the flight line is not isolation to a card in the shop). A coverage claim without its conditions is unfalsifiable, exactly as a reliability claim without a mission profile is.
Coverage is failure-rate-weighted
The single most consequential convention in testability arithmetic: coverage is weighted by failure rate, not counted by mode. The definition of detection coverage is
FFD = Σλ(detected modes) / Σλ(all modes)
because the fleet does not experience modes with equal probability; it experiences them in proportion to their rates. A worked pair on an invented five-mode unit makes the point brutally. Let the modes carry rates 200, 120, 60, 40, 30 per 10⁶ hours (Σλ = 450), with four of the five detected. Mode-counted coverage is 80% in both of the following worlds. If the undetected mode is the 30 (a rare contactor mechanism), weighted coverage is 420/450 = 93.3%: the blind spot is real but small. If the undetected mode is the 200 (the dominant power-module mechanism), weighted coverage is 250/450 = 55.6%: nearly half the failures the fleet will actually have arrive unannounced, behind a proudly quoted "80% of failure modes covered". The weighting rule has two immediate corollaries: the failure-rate prediction is a load-bearing input to every testability number, and the highest-rate modes deserve detection design attention out of all proportion to their count.
The test layers
Coverage is generated by a stack of test means, each with its own trigger, reach, and cost, and a coverage claim is meaningless until it names its layers:
| Layer | When it runs | What it catches | What it costs |
|---|---|---|---|
| Continuous BIT (CBIT) | Always, in the background | Failures with observable signatures in normal operation | Sensors, processing margin, and the false-alarm exposure of always-listening |
| Power-up BIT (PBIT) | At start-up | Failures accumulated since last use; readiness gating | Start-up time; only as fresh as the last power cycle |
| Initiated BIT (IBIT) | On command, with stimulus | Failures needing injected test signals; deeper paths CBIT cannot exercise | Function interruption; operator or maintainer action |
| External test equipment | At the shop or depot | Isolation inside the removed unit; the SRU-level verdict | The test-programme development and the pipeline it lives in |
| Periodic proof test | On the maintenance schedule | Dormant functions nothing else exercises | The test-interval economics of the latent ledger |
The layers trade against each other by design. What CBIT does not watch, PBIT may catch a mission too late; what no BIT can stimulate waits for IBIT or the shop; and the dormant fraction that only a proof test exercises is precisely the population whose unavailability grows as λT/2 between tests. A testability architecture is the deliberate assignment of every significant failure mode to the cheapest layer that catches it soon enough for that mode's consequences, and the assignment table (mode by mode, from the FMEA) is the design artefact everything else audits against.
Ambiguity and its price
Isolation coverage is stated against ambiguity groups: the set of replaceable units a symptom cannot distinguish between. Requirements follow a standard pattern (a large fraction isolated to a single unit, nearly all to a small group, the remainder conceded to manual troubleshooting), and the group size converts to time and money mechanically. With equal priors over a group of n, sequential swap-and-retest resolves the fault after (n+1)/2 attempts on average: a 20-minute interchange inside a three-unit group becomes 40 minutes of expected swapping plus the extra verification cycles, before counting the deeper cost: every wrongly pulled unit enters the retest-OK pipeline, consuming transport, shop time, and stock, and depositing a false data point in the failure records. The maintainability systems chapter carries the same arithmetic from the repair-time side; here the point is attribution: ambiguity is not a maintenance problem, it is a design output, fixed by partitioning and test placement decisions, and no amount of technician skill can isolate what the design made indistinguishable.
False alarms and the no-fault-found family
The measures that decide whether a testability design survives contact with the field are the honesty measures. A false alarm is the test speaking when nothing is wrong; in the field it matures into a cannot duplicate (the crew saw the indication; maintenance cannot reproduce it) or, one step later, a retest OK (the removed unit tests good at the next echelon). The three form one pipeline, and its economics are vicious: each event consumes a full diagnostic and often a removal, and the stream's real product is erosion of trust. A crew that has been burned learns to ignore the annunciation, at which point the detection coverage so carefully engineered is worth exactly nothing; the boy-who-cried-wolf failure mode is the terminal state of dishonest BIT.
The engineering countermeasures are threshold and time discipline: persistence filters (an indication must survive n samples before latching), condition gating (suppress monitors in regimes where they are known to trip falsely), voting across redundant sensors, and richer signatures over single thresholds. Each filter trades a sliver of detection latency against false-alarm mass, and the trade must be designed, not defaulted, because the intermittent failure that a persistence filter smooths away is often the very fault the crew reported. The field data closes the judgment loop: CND and RTOK rates per unit, tracked through FRACAS, are the measured truth of the false-alarm budget, and a unit at the top of the RTOK Pareto is either a BIT threshold problem or an ambiguity problem wearing maintenance's uniform.
How coverage is computed: dependency modelling
Before hardware exists, every number above comes from a model with a stubbornly simple shape: a dependency matrix between failure modes and tests. Each row is a failure mode from the FMEA, carrying its rate from the prediction; each column is a test or monitor; each cell records whether that test responds to that mode. From this matrix the whole measure family falls out mechanically: detection coverage is the rate-weighted share of rows with at least one responding test among the claimed layers; isolation follows from the response signatures (two modes with identical signatures are indistinguishable, and the set of units hosting them is the ambiguity group); and the marginal value of any proposed test point is computable as the signatures it splits.
The modelling discipline matters more than the algebra. The mode list must be the honest FMEA inventory, not the subset the BIT designer remembered; the dependency entries must reflect real signal reach (a monitor two connectors away from the mode may see nothing at the flight line); and the claimed layers must match the operational scenario being quoted. Run honestly, the dependency model is the testability twin of the reliability prediction: a design-stage forecast, auditable line by line, of numbers the field will eventually measure: FFD against the announced-failure share, FFI against the first-swap success rate, and the false-alarm budget against the CND/RTOK Pareto. The method topic walks the analysis itself; the point here is that testability is computable early, while the test points are still cheap.