FMECA GSFC-HDBK-8004.pdf

GODDARD TECHNICAL

HANDBOOK

GSFC-HDBK-8004

Goddard Space Flight Center Approved: TBD Greenbelt, MD 20771 Revalidation Date: TBD

GODDARD SPACE FLIGHT CENTER

GUIDELINE FOR FAILURE MODES AND EFFECTS ANALYSIS

AND RISK ASSESSMENT

January 2024

This official draft has not been approved and is subject to modification.

DO NOT USE PRIOR TO APPROVAL.

NASA GODDARD SPACE FLIGHT CENTER

Greenbelt, Maryland 20771

PUBLIC RELEASE APPROVED 2/14/24

GSFC-HDBK-8004

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

Prepared By:

Nancy J Lindsey Subject Matter Expert, Reliability Maintainability, and Availability (Code 370) Goddard Space Flight Center

Endorsed By:

Charles Knapp Branch Head, Reliability Maintainability, and Availability Assessment (Code 371)

Approved By:

Tristram T. Hyde Thomas V. McCarthy Chief Engineer Director of Engineering and Technology Goddard Space Flight Center Goddard Space Flight Center

Cathleen M. Richardson Deirdre Healey Director of Flight Projects Director of Safety and Mission Assurance Goddard Space Flight Center Goddard Space Flight Center http://standards.gsfc.nasa.gov/

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for

DOCUMENT HISTORY LOG

Status Document Revision

Approval Date Description

Baseline Initial Release

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

FOREWORD

This handbook is published by the Goddard Space Flight Center (GSFC) to provide uniform engineering and technical implementation guidance for processes, procedures, practices, and methods that have been endorsed as standard for NASA programs and projects, including mission assurance methodologies.

This handbook defines a consistent approach for performing Failure Modes Effects and Criticality Analysis (FMECA) on GSFC missions for risk assessment.

Requests for information, corrections, or additions to this handbook should be submitted via “Contact Us” on the GSFC Technical Standards website at http://standards.gsfc.nasa.gov.

Michael J. Viens Technical Standard Program Manager

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

TABLE OF CONTENTS

SECTION PAGE

DOCUMENT HISTORY LOG

FOREWORD

TABLE OF CONTENTS

LIST OF FIGURES

LIST OF TABLES

1. SCOPE

1.1 Purpose

1.2 Applicability

1.3 Safety

2. APPLICABLE DOCUMENTS

2.1 General

2.2 Order of Precedence

3. ACRONYMS AND DEFINITIONS

3.1 Acronyms and Abbreviations

3.2 Definitions

4. FAILURE MODES EFFECTS AND CRITICALITY ANALYSIS (FMECA)

4.1 General

4.2 Roles and Responsibilities

4.3 Analysis Methodology

4.3.1 FMECA Approaches……………………………………………………………… 18

4.3.2 Failure Mode Analysis …………………………………………………………… 19

4.3.3 Critical Item and SPF Identification ……………………………………………... 33

4.3.4 Risk Assessment …………………………………………………………………. 36

4.4 Data Incorporation

4.4.1 Legacy Analysis ………………………………………………………………….. 38

5. COMMUNICATION, MONITORING, AND REPORTING

5.1 Communication/Monitoring

5.2 Reporting

APPENDIX A – RECOMMENDED RELIABILITY PROGRAM PLAN WORDING

APPENDIX B – FAILURE RISK CONTROL PLANS

APPENDIX C – FMECA CREDIBILITY DETERMINATION ASSISTANT

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for

LIST OF FIGURES

FIGURE PAGE

Figure 1: FMECA Process and Data Flow Diagram Figure 2: Failure Modes, Effects, and Criticality Analysis Worksheet Example Figure 3: Failure Mode Cause Identification Process Example Figure 4: FMECA Causal Data Capturing from Legacy/Subordinate FMECAs Figure 5: FMECA Effect-Correlation from Superior FMECAs and Additional Sources Figure 6: Occurrence Value Documentation Formatting Examples Figure 7: FMECA Effect D/P Capturing from Legacy/Subordinate FMECAs Figure 8: CIL and SPF Table Templates Figure 9: Summary Failure Modes, Effects, and Criticality Analysis Worksheet Example Figure 10: Threat Criticality Matrices Figure 11: RPN Criticality Matrices Figure 12: D/P Criticality Matrices Figure 13: D/P Matrix Figure B-1: Failure Risk Control via FMECAs and CRM Integration Figure B-2: Failure Risk Prevention and Consequence Reduction Figure B-3: Examples of Forms for Control Plans Figure B-4: Example of Control Plan & Tracking in a Risk Database Figure B-5: Example of Control Plan & Tracking in a Spreadsheet Figure B-6: Example of Control Plan, Tracking, and Communication via Monthlies

LIST OF TABLES

TABLE PAGE

Table 1: GSFC FMECA Risk Priority Number (RPN) Table Table 2: Potential Data Incorporation Flows

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

1. SCOPE

1.1 Purpose

This handbook provides a uniform approach for performing FMECA concurrently with development efforts as a living risk assessment document for GSFC missions and infrastructure.

It also conveys methods for updating of FMECAs as designs, materials, operational parameters, processes, and operations are refined or additional knowledge is attained.

FMECA is an inductive analysis performed to identify failure modes and their likelihood, effects, and mitigations, throughout a system's life and provides the following project benefits:

• Identifies where there is the potential for irreversible physical and/or functional damage/change (locally and globally) or risk within a system.

• Assesses risk/impact of a failure and creates a composite picture of the system’s susceptibilities, including Single Point Failures (SPFs), Critical Items (CIs), propagation risks, and mitigation effectiveness.

• Assists with Fault Detection, Isolation, and Recovery (FDIR) design definition and sufficiency evaluation.

• Identifies the need for and recommends/verifies recovery/mitigation strategies (e.g., safing, exception handling, FDIR).

• Verifies predictive monitoring (or detection) designs/strategies.

• Verifies redundancy (switching/independence/cross-strapping) effectiveness and robustness

• Supports design-trades, testing, and operations planning.

• Provides testing and operations anomaly diagnosis and recovery data.

A proper FMECA greatly reduces the risk of a failure impacting mission success and/or inducing lengthy downtimes in test/operations. It also enables designers and system stakeholders to adjust hardware/software designs, operations, and maintenance; prepare for exigency operations; and extend or modify operational concepts with confidence while optimizing fault tolerance and system sustainment.

1.2 Applicability

The guidance set forth in this document provides the baseline approach for FEMCAs on all missions, infrastructure, spacecraft, instruments, ground systems, systems, subsystems, and components developed by, contracted by, or manufactured by GSFC and/or any subsidiary entity/organization.

This handbook may be cited in contract, program, project, and other Agency documents to provide technical guidance. This handbook was developed mainly with the intent of improving the reliability of flight systems. It can be tailored to be as quantitative as necessary (4.3.2.3 - likelihood subsection).

1.3 Safety

Failure modes identified as affecting safety should be reported to the cognizant project safety manager for inclusion in the appropriate safety analysis.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

2. APPLICABLE DOCUMENTS

2.1 General

Documents listed in this section contain provisions that constitute underlying requirements related to the implementation guidance provided in this handbook. When imposed, it is expected that the latest issuances of the cited documents will be used unless otherwise approved by the applicable Technical Authority. The applicable documents are accessible via the NASA Technical Standards System at http://standards.nasa.gov, directly from the standards developing organizations, or from other document distributors.

GPR 7120.4 Goddard Procedural Requirements for Risk Management

GPR 8705.4 Risk Classification Guidelines And Risk-Based SMA Practices GSFC Payloads and Systems

N/A GSFC Single Point Failure (SPF) Policy

SAE J1739 Potential Failure Mode and Effects Analysis in Design (Design FMEA), Potential Failure Mode and Effects Analysis in Manufacturing and Assembly Processes (Process FMEA), and Potential Failure Mode and Effects Analysis for Machinery (Machinery FMEA)

NPR 8000.4 Agency Risk Management Procedural Requirements

NASA-STD-8729.1 Reliability and Maintainability (R&M) Standard for Spaceflight and Support Systems

MIL-STD 1629 Military Standard: Procedures for Performing a Failure Mode, Effects, and Criticality Analysis

2.2 Order of Precedence

When applied internally or imposed by contract on a program or project, the technical requirements in NASA and GSFC directives (or other requirements documents) take precedence over implementation guidance provided in this handbook.

http://standards.nasa.gov/

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

3. ACRONYMS AND DEFINITIONS

3.1 Acronyms and Abbreviations

CDR Critical Design Review CI Critical Item CSO Chief SMA Officer D/P Detection/Prevention FDIR Fault Detection, Isolation, and Recovery FMEA Failure Modes and Effects Analysis FMECA Failure Modes, Effects, and Criticality

Analysis GOLD Goddard Open Learning Design GSFC Goddard Space Flight Center GPR GSFC Procedural Requirement HDBK Handbook I&T Integration & Test

LRU Line Replaceable Unit NPR NASA Procedural Requirement ORU Operational Replaceable Unit PDR Preliminary Design Review Pf Probability of Failure PSA Part Stress Analysis SEEA Single Event and Effects Analysis SPF Single Point Failure SMA Safety and Mission Assurance STD Standard TRL Technical Readiness Level WI Work Instruction WCA Worst Case Analysis

3.2 Definitions

Scope The breadth of systems/processes considered in the analysis (e.g., observatory, spacecraft, instrument, subsystem, component, capture, launch).

Credible Failure modes that represent a plausible risk or have likelihood of failure greater than 0.1% (PF > 0.001 or occurrence rating = 1-5) per 300-PG-7120.4.2.

Criticality Rating

A relative measure of risk from Very Very Low to Very High (0-5) derived for each failure mode’s technical consequence (derived from failure severity/type), likelihood of occurrence, and D/P provisions.

Critical Item

(CI)

Items (parts, components, units, logic, procedures, etc.) that have a failure mode that is assessed with having failure type labels – 1, 1SC, 1S or 2 (See Table 1).

Design Maturity

The level to which the concept of an object, code, or process has solidified and has proven its ability to meet performance expectations. See also NASA TRL levels

Detection Means or methods by which a failure mode can be discovered (or symptoms/signatures that would trigger mitigations or action (flight operations, software, hardware, etc.));

captured in the FMECA as part of D/P value/rating and description.

Detection/ Prevention Value

A quantitative criticality rating of the identified detection/prevention provision, ranging from 1 to 5.

https://www.nasa.gov/wp-content/uploads/2017/12/458490main_trl_definitions.pdf

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

Failure Effect

The consequence(s) a failure mode has on the operation, function, or status of an item.

Failure effects should consider redundancy and are classified at the local, next higher, and system levels.

Failure Cause

The physical or chemical processes, design (hardware or software) defects/features, quality defects, part misapplication, or other processes that are the basic reason for failure, or that initiate the mechanism that proceeds to failure.

Mechanism

The means (e.g., open, short) through which the failure induces the failure mode.

Mode

The manner (or observable state) of failure or undesired outcome that occurs within a system or operation.

Failure Type The classification (e.g., Critical and SPF, Critical, Significant, Minor) and qualitative label (e.g., 1, 1SC, 1S, 2, 3, 4, 4T, and 5) assigned to the failure mode based on the worst potential consequences resulting from the failure

Indenture Level

The degree of system or process decomposition/hierarchy/segmentation (e.g., black box, first active component, piece-part, task) being analyzed (aka the depth of the analysis).

Mission Success

The achievement of a system’s/process’ desired purpose regardless of whether it is for a space-mission, support system, or infrastructure.

Mitigation An action (e.g., impact lessening/preventative measure, FDIR, but not redundancy since that is already considered in consequence) taken to reduce the cause or effect of a failure mode; captured in the FMECA as the D/P rating and description.

Non- Credible

Failure modes that are Highly Implausible or have likelihood of failure of less than or equal to 0.1% ( PF ≤ 0.001 or Occurrence Rating = 0)

Occurrence Value

The probability or likelihood that a failure mode and its effects will transpire based on qualitative assessment, failure rate data, or test/performance data; captured in the FMECA as Likelihood of Occurrence Rating/Value.

Occurrence Rating

A quantitative criticality rating of the identified failure mode likelihood, ranging from 1 to 5, based occur occurrence value captured in the FMECA as Likelihood of Occurrence Rating/Value.

Prevention An action taken to reduce the likelihood of a failure mode/cause (e.g., preventative measure, fault avoidance); captured in the FMECA as part of D/P rating and description.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

Retention Rationale

Justification for keeping a failure mode or item that includes information on mitigation steps taken/planned (e.g., design, tests, inspections) and their effectiveness, as well as mission need, design margins, and failure/operational history.

Risk

The combination of 1) the probability (qualitative or quantitative) that an organization will experience an undesired event such as cost overrun, schedule slippage, or failure to achieve a required outcome; and 2) the worst-case consequences or impact of the undesired event were it to occur.

Severity Value

A quantitative criticality rating of the identified failure mode severity, ranging from 1 to 5, based on failure type (e.g., 1 and 1S are mapped to a rating of 5; 1S and 2 are mapped to a rating of 4; 3 is mapped to a rating of 3; 4 and 4T are mapped to a value of 2; and 5 is mapped to a value of 1).

Single Point

(SPF)

The failure of an item that would prevent achievement of required functionality of the system/process (failure types - 1SC and 1) and is not compensated for by redundancy, alternative operational procedure, or other means.

Subordinate Analysis

Analysis that provides source data for the FMECA. It can take the form of a vendor/legacy FMECA, a specific system, scenario, or lower indenture level FMECA;

or other reliability or design analysis.

Success Criteria

The minimum set of measures that establish the accomplishment of predefined goals and objectives for a given activity or undertaking. Within the practice of risk management, it usually refers to the establishment of goals and objectives for risk mitigation activities.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

4. FAILURE MODES EFFECTS AND CRITICALITY ANALYSIS

(FMECA)

4.1 General

Failure mode identification and risk assessment is begun during the design and development phases by reliability engineering (at GSFC) together with design engineering and software/parts engineering. A FMECA identifies system, component, part, or process failure modes that could lead to adverse consequences. The goal of the analysis is to determine how any single failure can impact a system’s or any associated system’s functionality and performance, while identifying likelihood, detection, mitigations, and causes. To provide the best value, a FMECA is best performed collaboratively in early design or conceptualization and is updated throughout a process/system’s development and test/operations phases, reflecting the current performance, status, and operational usage of the process/system and its constituent pieces.

The FMEA/FMECA process (See Figure 1) and its resulting failure modes (with likelihood, causes, severity, effects, detection and mitigation assessments), critical item identification, and single point failure modes highlighting provide product insights and risks assessments that promote improved product robustness throughout its life by identifying:

• the potential for irreversible physical and/or functional damage;

• how/if damage/failures propagate;

• how damage/failures impact the system (locally and globally);

• the means available for failure detection, isolation, and compensation;

• the symptoms and causes of failure for anomaly investigation;

• predictive monitoring and redundancy strategy validity and viability;

• recovery strategies (determination and optimization of contingency operations and autonomous recovery/safing plans) prior to failures;

• the risk/effectiveness of corrective action implementation plans;

• the risks to mission success and safety architectures;

and inspiring concurrent/subsequent design/operations changes (e.g., predictive monitoring, exigency procedures, optimized FDIR). In addition, FMECAs support product operational robustness with anomaly diagnostic and recovery strategy data for the development/execution of corrective actions and increasing maintenance/servicing optimization.

A FMECA also assists in verification of the following requirements and objectives:

• GOLD Rules (GSFC-STD-1000):

1.05: Single point failures (SPF) items that prevent the ability to fully meet minimum mission success requirements shall be identified, and the risk associated with each shall be characterized, managed and tracked and the system trades necessary to determine the need and effectiveness of mitigation efforts (e.g., redundancy, selection of robust parts, etc.) commensurate with mission class shall be conducted and documented.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

• GPR 8705.4

Table 1 Follow guidance from NASA-STD-8729.1 for Class A – D. For Ground System: Focus on availability and maintainability of ground system from NASA-STD-8729.1 based on mission classification; For 7120.8 Follow guidance from NASA-STD-8729.1 for Class D;

For Do No Harm (DNH) - Tall pole/criticality analysis guides focused reliable design efforts. Reliability analysis should help delineate between high value-added requirements and those that do not entail credible risk. Interface FMEA; For Hosted Payloads: Host practices and demonstrated reliability

• NPR 8705.4

Goal: Fault tolerance and graceful degradation designed and implemented addressing all critical items or processes whose failure would result in failure to meet mission objectives, injury to personnel, or collateral damage.

Obj: The top-level objective of R&M activities in NASA support systems programs and projects is to ensure that systems perform as required over their lifecycles to satisfy mission objectives including safety, reliability, maintainability, and quality assurance requirements as defined in the references listed in Appendix D. Programs and projects are expected to address this objective by conducting analysis and testing activities and making the necessary design and operational choices to limit the likelihood of faults and failures, and to provide mitigation and restoration capabilities as needed to maintain an acceptable level of functionality considering those safety, performance, and reliability objectives. Accordingly, the top-level objective is decomposed into the following four subobjectives: The system conforms to the design intent (interfaces and/or functions) and performs as planned under nominal and failed conditions.

The system and its elements remain functional for the intended lifetime, environment, operating conditions, and usage. The system is tolerant to faults, failures, and other anomalous internal and external events.

• NASA-STD-8729.1A:

2.A.2 System or its elements are not susceptible to common-cause failures, subobjective a:

The system and its elements remain functional for the intended lifetime, environment, operating conditions, and usage.

3.A.1 System has multiple means of accomplishing functions that are critical to mission objectives including safety, subobjective a:

Provide similar or dissimilar functional redundancy

3.A.2 Separate redundant paths functionally and physically. subobjectives a-c:

Separate redundant paths functionally and physically Isolate and contain faults

Evaluate and control shortest path to worst-case effects (e.g., hazardous events) 3.A.3 System is able to recover from anomalies affecting functions that are important to top-level expectations, subobjective a:

Provide fault management (detection, active isolation, recovery) capabilities

3.A.4 System can degrade or lose functions without significantly impacting top-level expectations (through contingency operations), subobjective a:

Plan contingency or other off nominal operations

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

4.2 Roles and Responsibilities

Development of FMECAs requires a detailed understanding of the parts/elements, components, systems, functions, and functional dependencies that are utilized within the system/process for operational success. FMECA development is a process (See Figure 1) of investigating potential failures, consequences, and proposed mitigations, which are refined/updated based on design/operations improvements made during or implemented based on the investigation. This process requires the involvement of not only all Product Design Leads (PDLs) but also Safety and Mission Assurance (SMA) personnel, systems engineering, and Integration and Test (I&T) project team members to ensure failure implications are understood and mitigations are implemented appropriately. It is important for these members of the project to have a good understanding of what items are associated with failure risks and knowledge of the item’s management and risk control plan so that continuous risk management of failure risks is accomplished.

Roles and responsibilities are as follows:

Responsible Engineer (RE) [Reliability Engineer for GSFC analyses]:

a. Has overall responsibility for the FMECA(s) (See Appendix A for recommended reliability program plan wording).

b. Assesses or calculates likelihood of a failure mode being realized.

c. Provides summary and itemized (worksheets) failure analysis results with failure modes, causes (direct or from subordinate FMECAs or other analyses), consequences, detection-signatures, mitigations, and FDIR-responses.

d. Performs, integrates vendor/subordinate analyses, and documents the analysis.

e. Communicates the risks (e.g., candidate risk statements, risk matrices) and recommendations (e.g., mitigations, testing, sensor optimization, redundancy, FDIR, operational changes) identified in the analysis.

f. Provides critical item and single point failure identification with retention rationale and control information.

g. Recommends actions for fault tolerance improvement and re-analysis update opportunities.

h. Provides analysis results as inputs to safety, systems engineering, and other reliability analyses.

i. Keeps the analysis, risks, and recommendations up-to-date with design, implementation (e.g., FDIR/mitigation verifications or non-verifications, build/integration variations from design), safing, compliance, testing issues/results, and performance/operational changes.

j. Utilizes FMECA results when supporting operations/testing and anomaly examinations.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for

Design/Systems Team:

a. Provides (and updates) the necessary design information (e.g., block diagrams, design-elements, element functions, mechanical/circuit/code design, exception-handling, safing/operational needs) and dependencies (e.g., data, mechanical, power, thermal) to the RE.

b. Assists in the identification of failure modes, causes, consequences, detection-signatures, mitigations, and FDIR-responses.

c. For items being life or performance tested, provides the test reports/data.

d. Reviews and concurs with FMECA.

e. Works with the RE to determine which failure mode, SPF, and critical item risks should be formally proposed to/managed by the project risk management board.

f. Uses analysis data and results to formulate tests and design/operational compensations to mitigate identified risks.

g. Uses analysis data and results to diagnose and mitigate the consequences of issues that occur during operations and testing, while sharing issues with RE.

h. Incorporates analysis results into any maintenance/refurbishment planning.

Chief Safety and Mission Assurance Officer (CSO) or Mission Operations Assurance:

a. Reviews and concurs with the FMECAs.

b. Shares vendor-provided FMECA-deliverables with RE for use/incorporation and acceptability determination.

c. Facilitates direct communication with FMECA providers, including vendor analysts.

d. Ensures that processes are in place to facilitate and verify failure preventions and mitigations.

e. Works with the RE to determine which failure mode, SPF, and/or Critical Item, risks should be formally proposed to the project risk management board as risks.

f. Uses analysis data and results to assist with quality/non-compliance disposition decisions (e.g., Use-As-Is) and ensures sharing of those decisions with RE.

g. Uses analysis data and results to diagnose and mitigate the consequences of issues

(including operational condition exceedances) in operations and testing, while ensuring those issues are shared with RE.

I&T Team:

a. Uses analysis data and results to diagnose and mitigate the consequences of issues (including operational condition exceedances) in testing, while sharing issues with

RE.

b. Uses analysis data and results to formulate and prepare for tests by incorporating warnings, mitigations, and controls/monitors relative to failure mode consequence avoidance.

c. Shares testing issues/results with the CSO and RE for potential FMECA updates.

d. Incorporates analysis results into any maintenance/refurbishment planning.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for

Operations Team:

a. Uses analysis data and results to diagnose and mitigate the consequences of issues during operations (including exceedances in usage or operational conditions), while sharing issues with RE.

b. Uses analysis data and results to formulate and prepare for operations and contingency operations by incorporating warnings, mitigations, and/or controls/monitors relative to failure mode consequence avoidance.

c. Shares operations issues/results with the CSO/MOA for potential RE FMECA updates.

d. Incorporates analysis results into maintenance/refurbishment planning.

Quality Assurance:

a. Assists with and verifies that processes/systems/hardware are generated and operated in accordance with designs/specifications, including pertinent conditions and parts/material inclusion, while sharing issues with RE.

b. Identifies quality/non-compliance issues and makes disposition decisions (e.g., Use-As-Is) and shares those decision with RE.

c. Uses analysis data and results to assist with quality/non-compliance disposition decisions (e.g., Use-As-Is).

d. Uses analysis data and results to verify FDIR, detection, and mitigations provisions are implemented, as documented in the FMECAs.

Software Assurance:

a. Assists with and verifies software are implemented and operated in accordance with designs/specifications, while sharing issues with RE.

b. Identifies software quality/non-compliance or performance issues and makes disposition decisions (e.g., Use-As-Is) and shares those decision with RE.

c. Uses analysis data and results to assist with quality/functionality non-compliance disposition decisions (e.g., Use-As-Is).

d. Uses software failure mode criticality data to assist with and refine safety-critical software determination and assurance in accordance with NASA-HDBK-2203 and NASA-STD-8739.8.

e. Uses analysis data and results to verify FDIR, exception handling, detection, and mitigations provisions are implemented, as documented in the FMECAs.

System Safety:

a. Informs RE of the existence/addition of hazards, inhibits, controls so that updated mission success and inhibit failures (and inhibit configuration fault tolerance) can be assessed and characterized.

b. Reviews and uses failure modes identified as affecting safety (Failure types – 1S and 1SC) for inclusion in appropriate safety analysis and procedural control development.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for

Collaboratively Consider Failure Modes and Compensations:

Are Failure Modes Defined and

Characterizations Up-to-Date with all parameters and data? Identify/ Update Causes/ Effects

Ascertain/ Update likelihood/ occurrence

Determine available preventions/ mitigations for mode and causes

Determine available detection capabilities for mode and causes

Rate Failure Mode L, C, D/P (and calculate total RPN)

Document Failure Mode Assessment in Worksheet

Identify opportunities to further mitgate failure risks

Formulate a FMECA strategy (e.g., scope/ indenture, approach, periods/phase) based on an understanding of the system’s purpose and mission/system assessment and/or risk assessment desired, and data available

Tailor/Update GSFC RPN definitions with project/system specific performance requirements AND Add project specific performance exclusions and assumptions to GSFC-FMECA ground rules

Verify that FMECA approach, scope, analysis-specific-RPN definitions, and assumptions conform to system and stakeholder needs

Identify and Communicate Critical Item, Single Point Failures, and Risks

Document and Share FMECA Report, CIL, SPF

List

Conduct/Integrate Additional or Subordinate Analysis and Test/Operations Data

Make Concurrent/Subsequent Design/Operations Changes (e.g., predictive monitoring, exigency procedures, adaptive FDIR, exception handling, additional inhibits/controls) to mitigate failure risks

• System Performance Requirements/Criteria

• Ops Procedures

• Maintenance Plans

• System Design

Receives/ Monitors for and

Responds to

• Life Test Data

• Subordinate

Analyses

• Quality/non-compliance disposition decisions

• Successful/ Unsuccessful Use data

• FDIR Gaps/ Verifications

Yes

Add final flags/labels, comments, and recommendations

Figure 1: FMECA Process and Data Flow Diagram (Black Boxes – RE, Green Boxes Design/Systems/Ops Team, Orange Boxes – SMA Team)

Yes

Add final flags/labels, comments, and recommendations

Receive/ Monitor for and Respond to

Collaboratively Identify and Consider Failure Modes and Compensations:

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

4.3 Analysis Methodology

4.3.1 FMECA Approaches

There are five general approaches to FMECAs, which differ by mode-type and/or design-penetration that can be applied to hardware or software systems:

(i) Functional (Usage) FMECA – An analysis of the loss, degradation, or erroneous performance of each system-element, that characterizes the impacts to itself up-through the system/mission, while identifying detection and mitigation provisions.

(ii) Detailed (Design) FMECA - An analysis of the loss, degradation, or erroneous performance of each piece-part of a system-element that characterizes the impacts to itself up-through the system/mission, while identifying detection and mitigation provisions.

(iii) Interface (Compatibility) FMECA - An analysis of the loss/degradation of required or expected interactions (e.g., mechanical, logical, power, data) of each system-element or erroneous interactions with coincident system-elements or support systems, that characterizes the impact to itself up-through the system/mission, including coincident systems, while identifying detection and mitigation provisions. This can be performed from the functional or piece/detailed part perspective to assess connection/ propagation risks and element/input/output compatibility.

(iv) Process (Procedural) FMECA - An analysis of potential failure issues (including human error contributions) with each procedural (e.g., manufacturing, assembly, integration, maintenance/service, inspection) step or test/operational action/sequence, that characterizes the impact to itself up-through the system/mission while identifying detection and mitigation provisions, including human error controls.

(v) Do No Harm (DNH) FMECA – An analysis of the loss/degradation of required or expected functionality or interactions (e.g., mechanical, logical, power, data, thermal, maintenance/service) of each system-element with coincident elements, that characterizes the impact to itself and looks for propagations/impacts to coincident-systems, while identifying detection and mitigation provisions. This can be performed from the functional, process, interface, or piece/detailed part perspective to assess propagation risks.

Desired assessment or risk determination, design maturity, variations in process or design complexity, and data availability will dictate the analysis type/scope that is used. In some cases, this may necessitate that the analysis be performed with combined approaches (e.g., interface and functional) to evaluate risks/failures effectively. In other cases, initial analysis findings or uncertainties may elicit or dictate the need for use of one of the other FMECA approaches or additional reliability analysis, to fully characterize risks. Additionally, if a legacy FMECA exists for the desired system/element/process that has the appropriate analysis type/scope it can be updated as described in Section 4.4 (and 5).

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

To provide the best value, a FMECA is best performed as early in the design or conceptualization as possible but must have the appropriate data/design definitions to support the FMECA approach undertaken. Normally, there is sufficient data to perform functional, interface, or process FMECAs prior to PDR, while detailed FMECAs can be supported prior to CDR. Additionally, a FMECA provides continued fault-tolerance insights only if it is updated with design changes, operational changes (e.g., duty cycle, environment, movement, maintenance/refurbishment), test results (cause/mode additions or eliminations based on issues/verifications), and subordinate FMECAs or other reliability analysis (See Section 4.4 and 5).

4.3.2 Failure Mode Analysis

4.3.2.1 Formulate Failure Mode Analysis Strategy

Failure mode analysis (See Figure 1) begins with defining a FMECA strategy based on an understanding of the mission/system assessment and/or risk assessment desired.

FMECA strategies are established by the RE by selecting a FMECA approach (or approaches):

(I) Functional (Usage) FMECA – Assesses system-robustness-to-failure (internal or externally induced) and mission success risks (and improves FDIR/exception handling).

(II) Detailed (Design) FMECA – Assesses detailed design-feature failures (internal or externally induced) for mission success risks and to identify design susceptibilities (and improves FDIR/exception handling).

(III) Interface (Compatibility) FMECA – Assesses system-to-system compatibility, safety, and failure propagation risks (and improves FDIR/exception handling).

(IV) Process (Procedural) FMECA – Assesses production quality risks (defective/ unreliable units) and damage risks to systems involved in the process and assesses fabrication/maintenance or operational/use procedures or sequences for error susceptibility to enable improvement quality controls, exception handling, and exigency operations planning.

(V) Do No Harm (DNH) FMECA – Assesses system-to-system (nominally, system to system-to-be-protected, but could be bidirectional if desired) safety and failure propagation risks and assesses the potential for adverse interactions.

and analysis scope (i.e., the breadth of systems/processes included) and indenture/segmentation level:

(i) Black-box – Covers the assessment of failure modes of elements/units of hardware (e.g., LRUs, ORUs), software, or processes (set of procedural steps) and their characterization, while failures in internal design attributes and steps are considered as mode causes not modes on their own.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

(ii) First active component – Extends failure analysis to cover the assessment and characterization of the failure modes to the first active component on either side of an interface. For mechanical systems, these are components that move or rotate themselves or other components (e.g., pumps, valves, wheels, gears, hinges, toggle, non-explosive actuators); for electrical/electronic systems, these are those that are enabled by power and control or modify electrical signals/data for downstream use (e.g., integrated circuits, EEEE-parts, switch/relay); for software these are the first logic/code that performs a decision or initiatives a course of action (this includes exception-handling but not set-up, loading, transmission-only or counting logic/code); and for processes, these robotic/human interface steps that initiate hardware or software action (e.g., opening, closing, deploying, powering on/off, rebooting/reloading).

(iii) Piece-part (physical, logical, or procedural) – Covers the failure assessment and characterization of internal failures of design attributes and steps, while associated impacts to elements/units of hardware (e.g., LRUs, ORUs), software, or processes (set of procedural steps) will be captured as effects/impacts and not modes or causes on their own.

(iv) Task (procedural or logic) – Covers the assessment and characterization of failure modes of logic/code or procedural steps (e.g., errors, incomplete/over execution, mistimed or non-actions), while associated hardware/software or system performance impacts are captured as effects and not modes or causes on their own (but may provide detection/ prevention provisions as well).

(v) Other analyst-specified level.

and operational periods/phase(s):

(a) Testing – The interval of system or unit-level usage for performance, compatibility.

and specification verification.

(b) Fabrication/Integration – The interval or specific situations associated with manufacturing and joining system components.

(c) Flight/Operations – The interval of nominal and extended system usage (duration, environment, and operations required) to meet success criteria.

(d) Servicing/Maintenance – The interval or specific situations associated with refurbishing, replacing, and upkeeping system components.

(e) Specific Operation(s) – The interval for a specific subset of nominal and extended system usage (scenario, environment, and operations required).

based on the performance and risk insights desired. Note: subordinate or more detailed analysis may be inspired by any strategy chosen.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for

Some examples (Project concern => recommended FMECA strategy) are:

Is it safe to test with specific GSE? => Perform an interface (GSE-to-test-article) FMECA or GSE DNH FMECA, at black box level or first active component, during testing.

Can the system harm host-system? => Perform an interface FMECA or DNH FMECA, at black box level, during operations (all or specific).

Is there a failure of an instrument that can end the mission or cause loss of success? => Perform an instrument functional & interface (Instrument-to-spacecraft/host) FMECA, at black lox level, during operations (all or specific).

Could the planned process/action lead (operations/maintenance) to system or infrastructure harm? => Perform a process FMECA at task level, and/or interface FMECA (or update existing analysis) between systems involved in process/action, at black box level, during operations (specific or all) or servicing/maintenance.

Is the system single fault tolerant? => Perform functional or detailed FMECA, at box or piece-part level (stopping at the lowest level at which redundancy is implemented), during any period of interest.

Can the system perform mission (meet requirements) for planned life (or extended life)? => Perform functional & interface FMECA between all mission systems, at black box level, during any/all periods of interest.

Is there risk of using a particular component or design? => Perform detailed FMECA if possible, at piece part level during any/all periods of interest; or fallback to functional FMECA if detailed design data is unavailable, at black box level, during any/all periods of interest.

Can software induce a hardware failure and vice versa? => Perform functional & interface FMECA between all hardware-to-software interfacing systems, at black box level, during any/all periods of interest.

4.3.2.2 Define Failure Mode Analysis Ground Rules and Assumptions

The analyst will use the GSFC FMECA RPN definitions (See Table 1) and begin to define the analysis-specific assumptions and ground rules by using the GSFC-FMECA ground rules:

1. Only one failure mode exists at a time. Failures, degradations, and excessive performance are assumed to only happen one at a time and their effects and likelihood are not considered collaboratively (but may be duplicative). However, failure modes may be causes of other failure modes based on effects.

2. All consumables are present and in sufficient quantities for use-case of the analysis.

3. FMECA indenture level remains constant within an analysis. Therefore, redundancy will only impact a failure mode’s consequence not its likelihood or detection/prevention.

4. Failure mode effects are listed specifically, individually, and at three levels starting at the element itself.

5. Interface or input/output signal impacts to other hardware are considered as individual impacts or causes not as stand-alone failure modes.

6. Actions on the system that are not considered are sabotage, misuse, infrastructure/ weather issues, or other non-credible scenarios.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

7. Severity, likelihood, and D/P are assessed (and reassessed until all are considered, and their interactions are reflected in findings/values) as specified in the FMECA RPN Table (Table 1), which will have had each consequence level clarified with performance criteria and acceptable system unavailability at a minimum by the RE.

For example:

o Technical Consequence-3, ‘Moderate impact to full mission success criteria.

Minimum mission success criteria are achievable with margin’ is appended and becomes ‘Moderate impact to full mission success criteria. Minimum mission success criteria are achievable with margin: All Threshold Science is still achievable; Not all Baseline Science is achievable;’ and Technical Consequence-4, ‘Minor impact to higher priority full mission success criteria’ is appended and becomes ‘Minor impact to higher priority full mission success criteria: Degradation of Threshold Science Measurements or loss of all science data for one orbit period or less.’

o In addition, others like Likelihood-3, ‘0.15 < PF ≤ 0.25’ can also be enhanced/clarified if desired and appended as follows ‘0.15 < PF ≤ 0.25 or

5.9 x10-6 <λ< 1.03 x10-5 for constant failure rate items and a mission duration of 3 years 60 days.’

In addition, the RE will add explicit operational period inclusions/exclusions (e.g., launch is included, or launch is excluded) and performance exclusions and assumptions (including but not limited to what is degradation versus loss and temporary versus prolonged), not covered in RPN clarifications, to these ground rules to formulate analysis-specific assumptions and ground rules so that consistent consequence assessments can be made during failure mode characterization. For example, if a mission says, ‘Strong spots are considered the most critical to science,’ the analyst will assess a higher severity to the loss of a strong spot than the loss of a weak spot. Similarly, impacts to non-success related elements (e.g., student instrument) would have their severity assessed very low, or these could be excluded by an added ground rule.

It is prudent to review the FMECA approach (or combined approaches), scope, analysis-specific- RPN definitions, and assumptions with system stakeholders before beginning an analysis to ensure results meet their needs.

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

Table 1: GSFC FMECA Risk Priority Number (RPN) Table

Cr iti ca lit y Ra tin g Likelihood of

Occurrence Technical

Consequence Failure Type Failure Severity Detection/Prevention

(Mitigations)

Ve ry H ig h

0.50 < PF

Minimum mission success criteria are not achievable.

Cr iti ca l an d

SP

F 1SC

Failures that could cause a catastrophic event such as the loss of life, permanently disabling injury to personnel, or facility loss/destruction.

None - Failure will not be detected and will not be prevented or mitigated.

Failures (and failures with failure recoveries) that could result in mission loss or minimum mission success criteria not being achievable.

Hi gh

0.25 < PF ≤

0.50

Major impact to full mission success criteria.

Minimum mission success criteria are achievable.

Cr iti ca l

1S

Failures that could prevent detection of or operations during a hazardous condition resulting in 1SC conditions, eliminate a hazard inhibit, or cause severe injury or occupational illness or major property damage.

Remote - Unlikely failure will be detected or prevented or mitigated.

Failures (and failures with failure recoveries) that could result in loss of one or more mission objectives, including the substantial loss of data, loss of functionality, or reduction in life of the mission but minimum mission success criteria are still achievable.

M od er at e

0.15 < PF ≤

0.25

Moderate impact to full mission success criteria. Minimum mission success criteria are achievable with margin.

Si gn ifi ca nt

Failures (and failures with failure recoveries) that could result in loss of one mission objective, including the significant loss of data, loss of data, loss of functionality, or reduction in life of the mission but minimum mission success criteria are still achievable.

Low to Moderate - Failure may be detected and may be prevented or mitigated.

Lo w

0.02 < PF ≤

0.15

Minor impact to higher priority full mission success criteria.

M in or

Significant failures that could cause degradation to full mission objectives and still meet minimum mission.

Moderate to High - Failure is likely to be detected before occurrence and has a good chance of being prevented or mitigated.

4T

Failures that cause a temporary 1, 1S, and 2 consequence conditions until of identical or equivalent provisions are used to resolve and with no more than degradation to mission success.

Ve ry

Lo w

0.001 <PF

≤ 0.02

Minor impact to lower priority full mission success criteria.

Minor failures that could result in insignificant or no loss to mission objectives.

Certain - failure will be detected and prevented or mitigated.

O V er y

Ve ry

L ow

PF ≤ 0.001 N/A – Highly Implausible or Noncredible

Check the GSFC Technical Standards Program website at http://standards.gsfc.nasa.gov or contact the Executive Secretary for the GSFC Technical Standards Program to verify that this is the correct version prior to use.

Figure 2: Failure Modes, Effects, and Criticality Analysis Worksheet Example Project_Name Failure Modes, Effects, and Criticality Analysis Worksheet

Project: Analyst: Organization:

System/Subsystem: Name (ABC)[Acronym] Date: Version:

FMECA-

Mode

Identifier (Unique Ref. No.)

Element Name

Element Function or

Purpose

Potential Failure Mode

Potential Failure Causes

Likelihood of

Occurrence…