1、 AEROSPACERECOMMENDEDPRACTICESubmitted for recognition as an American National StandardFAULT/FAILURE ANALYSIS PROCEDURE(Use ARP4761 for Aircraft Safety Assessment)SAE Technical Standards Board Rules provide that: “This report is published by SAE to advance the state of technical and engineering scie
2、nces. Theuse of this report is entirely voluntary, and its applicability and suitability for any particular use, including any patent infringement arising therefrom, is thesole responsibility of the user.”SAE reviews each technical report at least every five years at which time it may be reaffirmed,
3、 revised, or cancelled. SAE invites your writtencomments and suggestions.Copyright 1997 Society of Automotive Engineers, Inc.All rights reserved. Printed in U.S.A.Land Sea Air and SpaceFor Advancing MobilityThe Engineering SocietyINTERNATIONAL400 Commonwealth Drive, Warrendale, PA 15096-0001Issued 1
4、967-09Reaffirmed 1992-09Revised 1997-06Superseding ARP926AREV.ARP926 BQUESTIONS REGARDING THIS DOCUMENT: (412) 772-8510 FAX (412) 776-0243TO PLACE A DOCUMENT ORDER: (412) 776-4970 FAX (412) 776-0790INTRODUCTIONBackground:A fault and failure analysis (F/FA) is an evaluation procedure that analyzes an
5、d assesses the effects ofand documents potential failures in a system or equipment item design. It determines by analysis theeffect of failures on system operation, identifies failures critical to operational success for personnelsafety, and ranks each potential failure according to the combined inf
6、luence of its effect and itsprobability of occurring.The use of F/FA in design has grown with the expansion of technology. In the past, failure mode andeffect analysis (FMEA) has been considered and used in a possibly restricted way. Now, however,other analytical procedures should be described and t
7、heir application explained.This revision of Aerospace Recommended Practice (ARP) 926 takes into account current technologyand explains various methods of F/FA and their application. It presents fault and failure analysisprocedures in their broad scope as design analysis tools. From this perspective,
8、 specialized analysessuch as the FMEA and fault-tree analysis are considered as individual types of analyses within thebroad scope of F/FA methodology.The basic concept of the F/FA is one of determining the failure sources within a design, the modes offailure for each of the sources, and the effect
9、of each mode on the complete design or any portion of it.F/FA is a design analysis tool; thus, it relates to several technical disciplines. The emphasis in thisdocument is on what the tool is and how it can be applied to accomplish various objectives. The userdetermines how and for what purpose he/s
10、he uses it within his/her own technical discipline, such asreliability, safety, maintainability, or other associated specialty.The end objective of the F/FA will determine what type of specialized analysis must be performed andhow comprehensive the analysis must be. Considerations which will establi
11、sh the specific form of theanalysis are (a) whether qualitative or quantitative results are required, (b) the extent of the failureeffects assessment required, and (c) the amount of the design to be included. As illustrated inFigure 1, a minimum F/FA would consist only of an assessment of qualitativ
12、e effects of failure modesof one portion of a design.SAE ARP926 Revision B- 2 -FIGURE 1 - Fault and Failure Analysis Complexity FactorsSAE ARP926 Revision B- 3 -INTRODUCTION (Continued)This minimum type F/FA can be expanded to provide a more comprehensive assessment of failureeffects in terms of sev
13、erity, or further, in terms of criticality. Severity pertains to the effect of the failuremode on equipment operation or mission function, whereas criticality is a combination of its severitylevel and the rate or probability of it occurring. For example, a nuisance effect of a low-severity level,fre
14、quently-occurring failure mode might be highly critical as far as equipment availability is concerned. On the other hand, a high-severity failure mode that occurs rarely, if ever, might be classifiednoncritical under some circumstances.Failure mode probabilities, effect severities, and criticalities
15、 may be assessed qualitatively (e.g., low,medium, or high) and thus minimize the extent and cost of the analysis. If the needs of a programrequire more definitive results, the F/FA can be conducted to provide quantitative assessments for thefailure mode probabilities and the severity levels and crit
16、icality rankings. Other considerations can alsobe included such as the effects on personnel and equipment safety; mission completion success; ormaintenance, logistic, and supply support. Once the specialized form of the F/FA to be conducted isestablished, it can be applied to any or all levels of a
17、design.Approaches:There are two primary approaches for accomplishing the analysis, identified by their orientation instarting the analysis. One is the function-oriented approach. “Functional F/FA” is sometimes referredto as the “top-down” or “system” approach, since this type of analysis is frequent
18、ly initiated at the top,or system level, and then proceeds downward through the design. The Functional F/FA uses thedesign functional requirements for evaluating design performance. It proceeds from a starting point offunctional failure mode identification at a level of design where the analysis is
19、being performed. Theother is the hardware-oriented approach, “Hardware F/FA,” and is sometimes referred to as the“bottom-up” or “parts” approach, since this type of analysis is frequently initiated at the parts level andthen proceeds upward through the design. The Hardware F/FA starting point is the
20、 identification of thehardware failure modes at the design level where the analysis is being performed.The “top-down” and “bottom-up” terminologies, however, are not completely descriptive since both thefunctional and hardware analysis approaches can be initiated at any design level and then be exte
21、ndedthrough the design in either direction. The “Functional F/FA” and “Hardware F/FA” terminologies havebeen used in the revised ARP as these are considered more accurate descriptions for the twoapproaches. Both approaches, when properly extended, have the capability of identifying functionaland har
22、dware causes and effects of failures. Thus, a complete analysis by either approach may coverall aspects of the design.SAE ARP926 Revision B- 4 -TABLE OF CONTENTSINTRODUCTION11. SCOPE.62. REFERENCES.62.1 Glossary.63. GENERAL CONSIDERATIONS .93.1 Basic Purposes 93.2 F/FA Application .94. APPROACH SELE
23、CTION 104.1 General Criteria104.2 Level of Detail.114.3 Hardware Approach124.4 Functional Approach.144.4.1 System Output Level 144.4.2 Subsystem Output Level 194.4.3 Component Output Level194.5 Criticality Analysis (CA) Approach 194.5.1 Qualitative Approach 204.5.2 Quantitative or Criticality Number
24、 Approach.204.6 Fault Tree Analysis Approach.204.7 Variation of Approach.215. F/FT PROCEDURES215.1 General 215.2 F/FA Procedure Elements 245.2.1 Equipment Item Definition 245.2.2 Assumptions and Ground Rules for Failure Definition 255.2.3 Reliability Diagrams255.2.4 Documenting the F/FA255.2.5 Evalu
25、ate Criticality305.2.6 Recommended Design Improvements305.2.7 Analysis Summary305.3 FMEA Hardware and Functional Approaches.305.3.1 FMEA Hardware Approach.305.3.2 FMEA Functional Approach345.4 Criticality Analysis (CA) Procedure .345.4.1 Elements of the CA 345.4.2 Documenting the Criticality Analysi
26、s.38SAE ARP926 Revision B- 5 -TABLE OF CONTENTS (Continued)5.4.3 Criticality Analysis Summary.385.4.4 Criticality Matrix 395.5 Fault Tree Analysis Procedure .395.5.1 Fault Tree Symbols 405.5.2 Minimal-Cut Sets 405.5.3 System Definition .445.5.4 Example of Fault Tree Construction .455.5.5 Calculating
27、 Event Probability 47APPENDIX A BIBLIOGRAPHY 51APPENDIX B EXAMPLES52APPENDIX C NEW TECHNOLOGY 65FIGURE 1 Fault and Failure Analysis Complexity Factors.2FIGURE 2 Schematic Diagram of Hydraulic Power Generation System13FIGURE 3 System Functional Block Diagram .15FIGURE 4 Subsystem Functional Block Dia
28、gram16FIGURE 5 Subsystem Hardware Functional Block Design17FIGURE 6 Component Functional Block Diagram.18FIGURE 7 Component Piece-Part Functional Block Diagram .18FIGURE 8 Family of Fault and Failure Analyses .22FIGURE 9 Flow Diagram of General Fault/Failure Analysis Procedure .23FIGURE 10 Progressi
29、ve Expansion of Logic Block Diagram.26FIGURE 11 Worksheet Example for FMEA Using Hardware Approach 32FIGURE 12 Example Functional Block Diagram for Air Conditioning System35FIGURE 13 Logic Operations (Gates).41FIGURE 14 Event Representations.42FIGURE 15 Section of an Automotive Fault Tree 43FIGURE 1
30、6 Fault Tree 44FIGURE 17 Sample System45FIGURE 18 Sample System Fault Tree.46FIGURE 19 Sample Fault Tree for Probability Evaluation .49FIGURE 20 Boolean Equivalent of Sample Fault Tree Shown in Figure 19.49FIGURE B1 Sample System54FIGURE B2 .54FIGURE B3 .55FIGURE B4 Fault Tree With Primary Failures
31、.56FIGURE B5 Fault Tree With Secondary Failures.57FIGURE B6 Single Failure Point Analysis58FIGURE B7 General Format for Failure Mode and Effect Analysis59FIGURE B8 General Format for Modal Failure Rate Calculation .60FIGURE B9 General Format for Criticality Number Calculation .61FIGURE B10 Fault Tre
32、e/FMEA Combined Approach 62FIGURE B11 Fault Tree/FMEA Combined Approach (Continued) .63FIGURE B12 Fault Tree/FMEA Combined Approach (Concluded) 64SAE ARP926 Revision B- 6 -1. SCOPE:This document provides guidance in performing Failure/Fault Analyses in relatively low complexitysystems. Methodologies
33、 and processes are presented and described for accomplishingFailure/Fault Analyses.ARP4761 provides updated methods and processes for use on civil aircraft safety assessment. When analyzing these types of systems, ARP4761 should be used in lieu of this ARP.2. REFERENCES:See Appendix A.2.1 Glossary:F
34、or use with text only; readers are requested to suggest addition or deletion.CRITICALITY: A measure of the impact of a failure mode on the mission objective. Criticalitycombines the frequency of the occurrence and the level of severity of a failure mode.DEDUCTIVE: The term used to describe those ana
35、lytical approaches involving the reasoningfrom a defined unwanted event or premise to the causative factors of that event or premise bymeans of a logical methodology (the “top-down” or “how could it happen” approach).END EFFECT: The impact of the failure mode on the operation, function, or status of
36、 the nexthigher indenture level.EXPOSURE TIME: The period (in clock time or cycles) during which an item is exposed to failuremeasured from when it was last verified functioning to when it is verified again.EVENT: An occurrence which causes a change of state.EXTERNAL EVENT: Those events over which t
37、he item designer has no authority.FAILURE: The inability of an item to perform within previously specified limits.FAILURE ANALYSIS: The logical, systematic examination of an item or its diagrams to identifyand analyze the probability, causes, and consequences of potential and real failures.FAILURE C
38、AUSE: The causative agent(s) of a failure mode. Answers question “Why does partfail?”1_1Examples: Valve failed open (mode) because spring fractured (cause) resulting from stress corrosion (mechanism). Webstiffener buckled (mode) because rivets failed (cause) from corrosion (mechanism).SAE ARP926 Rev
39、ision B- 7 -2.1 (Continued):FAILURE EFFECT: The consequences of a failure mode on the item operation, function, orstatus. Failure effects are classified as “local” effect and “end” effect.FAILURE MECHANISM: The process involved in the cause of failure. Answers question “Whatis failure process?”2FAIL
40、URE MODE: The manner in which an item or function can fail. Answers question “Howdoes part fail?”2FAULT: An undesired anomaly in the functional operation of an equipment or system.FAULT TREE: A fault tree is a graphic representation of the various parallel and seriescombinations of subsystem and com
41、ponent failures which can result in a specified system fault. The fault tree, when fully developed, may be mathematically evaluated to establish the probabilityof the ultimate undesired event occurring as a function of the estimated probabilities ofidentifiable contributory events.FIRMWARE: A comput
42、er program that is stored in a fixed or “firm” way, usually in a read-onlymemory. Changes can often be made only be exchanging the memory for an alternative unit.FUNCTION: The special purpose performed by an item.HARDWARE SYSTEM: A composite, at any level of complexity, of equipment which isdesignat
43、ed to perform a specific function or mission.INDENTURE LEVELS: The item levels which identify or describe relative complexity of assemblyor function. The levels progress from the more complex to the simpler divisions.INDUCTIVE: The term used to describe those analytical approaches involving the syst
44、ematicevaluation of the defined parts or elements of a given system or subsystem to determine specificcharacteristics of interest (the “bottom-up” or “what happens if” approach).INITIAL INDENTURE LEVEL: The level of the total, overall item which is the subject of theFMEA.ITEM: The term “item” is use
45、d in this standard to denote any level of hardware assembly; i.e.,system, subsystem, unit or part.LATENT FAILURE: A failure that is not inherently revealed at the time it occurs.LOCAL EFFECT: The impact of the failure mode on the item that is being analyzed._2Examples: Valve failed open (mode) becau
46、se spring fractured (cause) resulting from stress corrosion (mechanism). Webstiffener buckled (mode) because rivets failed (cause) from corrosion (mechanism).SAE ARP926 Revision B- 8 -2.1 (Continued):LOSS FREQUENCY: The expected failure rate of a particular item or function in its operationalmode an
47、d environment.MINIMAL-CUT-SETS: A smallest set of primary events, inhibit conditions, or undeveloped faultevents all of which must occur for the top event of a fault tree to occur.MISSION: The objective or task, together with the purpose, which clearly indicates the action tobe taken.MISSION TIME: T
48、he time interval during which the item is performing its designated mission.PRIMARY EVENTS: The normal terminus of a path of fault events within a fault tree.QUALITATIVE: The term used to describe those inductive analytical approaches which areoriented toward relative, nonmeasurable, and subjective
49、values.QUANTITATIVE: The term used to describe those inductive or deductive analytical approacheswhich are oriented toward the use of numbers or symbols used to express a measurable quantity.REDUNDANCY: The existence of more than one means of accomplishing a given functionwhere all means must fail before there is an overall failure of the function. Active redundancyapplies to systems where both means are working at the same time to accomplish the task andwhen either of the systems is capable of handling the job itself in case of failure o
