Reliability — FMECA with computed criticality

// A FMECA, not an FMEA: every mode carries a criticality computed from
// the failure rate of the item it sits on, as well as the risk priority
// number the team scored.
//
// The system is the disinfection stage of a municipal water treatment
// works. RPN is severity x occurrence x detection and is derived here, not
// typed, because a scoring workshop that revises one number and forgets
// the product is the normal way an FMEA goes stale between revisions.
//
// Mode criticality follows MIL-STD-1629A: Cm = beta x alpha x (t / MTBF),
// with beta the conditional probability that the mode produces the effect
// and alpha the share of the item's failures that take this mode. It ranks
// differently from RPN, and where they disagree the disagreement is the
// finding — RPN rewards a mode that is easy to detect, criticality does
// not care.

fmea chlorination_fmeca {
  title: "Disinfection stage FMECA — sodium hypochlorite dosing"
  system: "Final disinfection, 42 Ml/d surface water works"
  team: "Process engineer, works operator, MEICA technician, water quality scientist"
  revision: "Rev 4, 2026-02-18"
}

failure_mode dosing_pump_prime {
  component: "Duty hypochlorite dosing pump"
  mode: "Loses prime after a bulk tank changeover"
  cause: "Air drawn into the suction leg while the tank is switched"
  effect: "Free chlorine at the works outlet falls below the 0.2 mg/L operating floor within 40 minutes"
  severity: 9
  occurrence: 4
  detection: 3
}

failure_mode analyser_drift {
  component: "Amperometric residual chlorine analyser"
  mode: "Reads high as the membrane fouls"
  cause: "Calibration interval exceeded; manganese deposition on the membrane"
  effect: "Under-dosing is masked — the control loop trims dose against a false residual"
  severity: 8
  occurrence: 5
  detection: 6
}

failure_mode hypo_decay {
  component: "Bulk hypochlorite storage"
  mode: "Solution strength decays in the tank"
  cause: "Storage above 25 C and dwell beyond 30 days; catalytic decomposition on metal ions"
  effect: "The dose set-point no longer delivers the target residual; operators chase the set-point up"
  severity: 6
  occurrence: 6
  detection: 4
}

failure_mode contact_tank_short {
  component: "Chlorine contact tank"
  mode: "Short-circuiting between inlet and outlet"
  cause: "Baffle curtain torn at the third pass; sludge accumulation at the turn"
  effect: "Contact time credit not achieved — the log-inactivation claim is unsupported although the residual reads correctly"
  severity: 10
  occurrence: 2
  detection: 8
}

failure_mode kiosk_power {
  component: "Dosing kiosk supply"
  mode: "Loss of supply to the dosing kiosk"
  cause: "Incoming feeder fault with no automatic changeover"
  effect: "Complete loss of disinfection while water continues to leave the works"
  severity: 10
  occurrence: 2
  detection: 2
}

failure_mode flow_signal {
  component: "Raw water magnetic flow meter"
  mode: "Flow signal fails low"
  cause: "Earthing fault on the sensor cable"
  effect: "Flow-paced dose collapses while flow continues — a severe under-dose that reads as normal on the dose display"
  severity: 9
  occurrence: 3
  detection: 5
}

// Criticality is kept in its own blocks so the scored FMEA columns stay
// exactly the columns the team filled in, and the computed ranking sits
// beside them rather than inside them.
criticality crit_dosing_pump {
  mode: dosing_pump_prime
  rpn: = dosing_pump_prime.severity * dosing_pump_prime.occurrence * dosing_pump_prime.detection
  item_mtbf: 8760 h
  operating_time: 8760 h
  alpha: 0.30
  beta: 0.90
  mode_criticality: = beta * alpha * (operating_time / item_mtbf)
  action_priority: "high"
}

criticality crit_analyser {
  mode: analyser_drift
  rpn: = analyser_drift.severity * analyser_drift.occurrence * analyser_drift.detection
  item_mtbf: 26280 h
  operating_time: 8760 h
  alpha: 0.35
  beta: 0.80
  mode_criticality: = beta * alpha * (operating_time / item_mtbf)
  action_priority: "high"
}

criticality crit_hypo {
  mode: hypo_decay
  rpn: = hypo_decay.severity * hypo_decay.occurrence * hypo_decay.detection
  item_mtbf: 4380 h
  operating_time: 8760 h
  alpha: 0.60
  beta: 0.50
  mode_criticality: = beta * alpha * (operating_time / item_mtbf)
  action_priority: "medium"
}

criticality crit_contact_tank {
  mode: contact_tank_short
  rpn: = contact_tank_short.severity * contact_tank_short.occurrence * contact_tank_short.detection
  item_mtbf: 87600 h
  operating_time: 8760 h
  alpha: 0.80
  beta: 1.00
  mode_criticality: = beta * alpha * (operating_time / item_mtbf)
  action_priority: "high"
}

criticality crit_power {
  mode: kiosk_power
  rpn: = kiosk_power.severity * kiosk_power.occurrence * kiosk_power.detection
  item_mtbf: 43800 h
  operating_time: 8760 h
  alpha: 1.00
  beta: 1.00
  mode_criticality: = beta * alpha * (operating_time / item_mtbf)
  action_priority: "medium"
}

criticality crit_flow_signal {
  mode: flow_signal
  rpn: = flow_signal.severity * flow_signal.occurrence * flow_signal.detection
  item_mtbf: 35040 h
  operating_time: 8760 h
  alpha: 0.40
  beta: 0.90
  mode_criticality: = beta * alpha * (operating_time / item_mtbf)
  action_priority: "medium"
}

mitigation analyser_duty_standby {
  mode: analyser_drift
  action: "Second analyser on the same sample line with a 0.05 mg/L divergence alarm, and a fortnightly DPD comparison logged against it"
  owner: "MEICA technician"
  target_severity: 8
  target_occurrence: 5
  target_detection: 2
}

mitigation contact_tank_survey {
  mode: contact_tank_short
  action: "Tracer test at commissioning and every five years; baffle curtain inspection at each drain-down, with t10/T recorded"
  owner: "Process engineer"
  target_severity: 10
  target_occurrence: 2
  target_detection: 3
}

mitigation pump_prime_interlock {
  mode: dosing_pump_prime
  action: "Changeover interlock: standby pump starts and proves flow before the duty suction is broken; low-flow switch on the suction leg"
  owner: "Works manager"
  target_severity: 9
  target_occurrence: 1
  target_detection: 3
}

mitigation flow_signal_validation {
  mode: flow_signal
  action: "Cross-check raw water flow against the clear water outflow meter; dose holds at the last good rate and alarms on divergence over 10%"
  owner: "MEICA technician"
  target_severity: 9
  target_occurrence: 3
  target_detection: 2
}

cite mil1629 {
  key: "mil-std-1629a"
  title: "MIL-STD-1629A — Procedures for performing a failure mode, effects and criticality analysis"
  publisher: "United States Department of Defense"
  year: 1980
  type: "guideline"
  of: chlorination_fmeca
}

note rpn_versus_criticality {
  text: "The two rankings disagree, and every disagreement is a finding. The contact tank is SECOND on RPN at 160 and LAST on criticality at 0.08: severity 10 and a five-yearly tracer test lift the RPN, but the item MTBF of 87600 h is ten times the operating year, so Cm = 1.00 x 0.80 x (8760 / 87600) and MIL-STD-1629A puts it sixth of six. The hypochlorite tank runs the other way — third on RPN at 144, first on criticality at 0.60 — because its MTBF is half the operating year, so t / MTBF is 2 before alpha and beta are applied at all. The kiosk supply is last on RPN at 40, flattered by a detection score of 2, and third on criticality, because every loss of supply produces the effect and beta is therefore 1. The analyser tops the RPN table at 240 and sits fourth on criticality. Detection ratings reward a mode that is easy to see; criticality does not care whether you can see it. Read the gap between the two columns, not either column alone."
  anchor: chlorination_fmeca
}

view risk: fmea_table