Safety & Reliability

The Safety & Reliability section holds two analyses of the design: the Hazard Log (system safety) and the FMECA worksheet (failure modes, effects and criticality analysis). Both work on items of the model: a hazard is caused by assets, functions or failure modes and is mitigated by requirements and design features; a failure mode belongs to an asset or a function and can lead to a hazard or a program risk.

Turn the section on

The section is a program feature. Open Home ▾ → Project Preferences… and tick Safety & Reliability under Program features. It is off in new projects and class projects and on automatically when the project's SE Process guide is DoD or NASA, until you set it. Turning it off hides the pages from the rail, ⌘K / Ctrl+K and the overviews; the hazards and failure modes stay in the project and links to them still open.

Concepts

• Hazard: a condition of the system that, with other conditions in its environment, can lead to a mishap: harm to people, damage, or loss of the mission.
• Severity (Catastrophic, Critical, Marginal, Negligible) and Likelihood (Frequent, Probable, Occasional, Remote, Improbable, Eliminated) rate the hazard before its controls; Residual Severity and Residual Likelihood rate it with the controls in place.
• Risk level: the hazard matrix maps each likelihood and severity pair to a level: High, Serious, Medium or Low, following the MIL-STD-882E pattern by default. Eliminated likelihood is its own level.
• Control: an item the hazard is mitigated by: a requirement, a function, an asset or a document. A requirement is verified through the RVTM; a test case by its result.
• Failure Mode: a way an asset or function can fail, with its cause and its local, next higher and end effects.
• RPN (risk priority number) = Severity × Occurrence × Detection, each rated 1 to 10.
• Criticality: Severity Class (I Catastrophic, II Critical, III Marginal, IV Minor), Probability Level (A Frequent to E Extremely Unlikely) and the mode criticality Cm = β · α · λp · t: failure effect probability × failure mode ratio × failure rate (per million hours) × operating time (hours), divided by one million. An item's criticality Cr is the sum of its modes' Cm per severity class.

How to use it

Hazard analysis starts once the functions and the physical architecture exist and continues through verification: each hazard gets controls, the controls become requirements, and the requirements are verified like any other. The FMECA works bottom-up from the assets and functions and feeds the Hazard Log with failure modes whose end effect is a hazard.

Record a hazard and its controls

1. Open Safety & Reliability → Hazard Log and click + New Hazard. Enter a name; the number is suggested (HAZ-001, HAZ-002, …). Click Create.
2. In the table, set Severity and Likelihood. The Risk column shows the level from the hazard matrix.
3. In the inspector's Trace section, relate what causes the hazard (caused by: an asset, a function, an item or a failure mode) and the controls (mitigated by).
4. Write each control as a requirement and verify it with a test case. The Verified column counts the controls whose verification passed, for example 1 of 2.
5. Set Residual Severity and Residual Likelihood for the hazard with its controls in place. Switch the grid to After controls to see the residual picture.
6. When the residual risk is accepted, fill in Accepted By and Acceptance Date in the inspector and set the status to Accepted, or to Closed with a Closure Rationale.

Example on the CubeSat EO-1 demo, where Safety & Reliability is already on: HAZ-001 Battery thermal runaway is caused by 1.3.2 Battery Pack, Severity Catastrophic, Likelihood Occasional (level High). Its controls are requirements 3.3 Depth of Discharge, verified by the battery capacity test, and 3.5 Battery Thermal Control, not yet verified, so Verified shows 1 of 2 and the hazard needs attention while its status says Controls Verified. With Residual Likelihood Improbable the residual level is Medium. The demo also holds three more hazards and five failure modes on the FMECA worksheet; FM-001 Cell internal short causes HAZ-001.

Run an FMECA

1. Open Safety & Reliability → FMECA and choose the Method: RPN (S × O × D) or Criticality.
2. Click + New Failure Mode, choose the asset or function that can fail (for example 1.3.2 Battery Pack), and name the failure mode (Cell internal short). It is created as caused by that item, in one undo step.
3. In the inspector, enter Failure Cause, Local Effect, Next Higher Effect, End Effect, Detection Method and Compensating Provisions.
4. Rate it: with RPN, enter Severity, Occurrence and Detection (1 to 10) in the table; with criticality, choose Severity Class and Probability Level and enter Failure Rate, Failure Mode Ratio, Failure Effect Probability and Operating Time in the inspector.
5. Relate the controls (mitigated by) and, when the end effect is a hazard, the hazard (causes). The hazard then lists the failure mode among its causes.
6. Filter RPN ≥ (or Severity class I–II) to list the failure modes that need action, and record the Recommended Action.

Tips

• Keep one failure mode per way of failing; put several causes in the description rather than one row per cause.
• Ratings are project conventions: write down what 1 and 10 mean for your project in a document, and rate consistently.
• Program risks that remain after the safety work belong in the Risk Register: relate them from the hazard (causes Risk) so both stay connected.

Hazard Log

Top bar: Hazard Matrix…, Export ▾ (Excel, CSV) and + New Hazard.

• Grid: hazards counted by likelihood (rows) and severity (columns), coloured by level. Before controls uses Severity and Likelihood; After controls uses the residual values (a hazard without them counts at its initial values). Click a cell to show only its hazards; click it again to show all.
• Level chips: High, Serious, Medium, Low, Eliminated and Not rated, with counts; click one to filter. Needs attention lists the hazards flagged below.
• Filters: status and a text search (ID, name, owner, mishap, operating phase, description).
• Columns: ID, Hazard, Status, Severity, Likelihood, Risk, Causes, Controls, Verified, Residual Severity, Residual Likelihood, Residual Risk, Owner, Program Risks (only when a hazard has one) and Accepted. Status, the four ratings and Owner are editable in place. Click a column title to sort.
• Verified: controls whose verification passed, out of the verifiable ones. Point at the cell for each control's status; a design feature or procedure shows "not verifiable by itself (verify it through a requirement)". None verifiable means the hazard has controls but none is a requirement or test case.
• Needs attention (a red ! beside the name; point at it for the reasons): No control on a hazard that is not closed or eliminated; n controls not verified when the status is Controls Verified or Closed; n controls failed; High residual risk not accepted (or Serious) when the hazard is Controls Verified, Accepted or Closed without Accepted By; No acceptance record when the status is Accepted without Accepted By.
• Click a row to show the hazard in the inspector; Esc deselects; ↑ and ↓ move between rows.

Hazard attributes: Status (Open, Controls Defined, Controls Verified, Accepted, Closed), Severity, Likelihood, Residual Severity, Residual Likelihood, Mishap, Operating Phase, Owner, Acceptance Authority, Accepted By, Acceptance Date and Closure Rationale.

Hazard matrix

Hazard Matrix… sets the level of each likelihood and severity pair with one list per cell. Apply saves it for the project (one undo step); Reset to Defaults restores the MIL-STD-882E pattern. The Risk Register's own risk scale is separate (Risk Scale… there).

FMECA

Top bar: Method (RPN or Criticality), Export ▾ (Excel, CSV) and + New Failure Mode.

• Groups: one header per item (asset or function) in number order, with its number of failure modes and, with the criticality method, its Cr per severity class. Failure modes without an item come last under "No item".
• Columns (both methods): ID, Failure Mode, Cause, Local Effect, End Effect, Detection Method, Controls, Verified, Hazards & Risks and Status (editable).
• RPN method: S, O and D (editable, whole numbers from 1 to 10) and RPN. An RPN at or above the Limit (1 to 1000, default 100) is red, and RPN ≥ n lists only those. A value outside 1 to 10 is refused with "Severity must be a whole number from 1 to 10. Enter it again."
• Criticality method: Severity Class and Probability Level (editable) and Cm. Severity classes I and II are red, and Severity class I–II lists only those. Cm shows "—" until Failure Rate, Failure Mode Ratio, Failure Effect Probability and Operating Time are all set.
• Sort: by RPN (or Cm) from highest by default; click a column title to sort by it.

Failure Mode attributes: Status (Open, Action Planned, Closed), Failure Cause, Local Effect, Next Higher Effect, End Effect, Mission Phase, Severity, Occurrence, Detection, Severity Class, Probability Level, Failure Rate, Failure Mode Ratio, Failure Effect Probability, Operating Time, Detection Method, Compensating Provisions and Recommended Action.

The method and the RPN limit are project settings (one undo step each). The criticality method is the default in projects that use the DoD process guide.

Exports

Export ▾ saves the current filtered rows as Excel or CSV with every column, including the ones hidden on screen: for hazards also Operating Phase, Mishap, Acceptance Authority, Accepted By, Acceptance Date, Closure Rationale and the attention reasons; for failure modes also Mission Phase, Next Higher Effect, Compensating Provisions, Recommended Action and, with the criticality method, Failure Rate, Failure Mode Ratio, Failure Effect Probability and Operating Time. Hazards and failure modes are also ordinary items: the Database, documents and the Traceability Matrix list them like any other class.

API and Claude

The connector's get_matrix tool returns the Hazard Log (matrix: hazards) and the FMECA worksheet (matrix: fmeca) as rows with the computed levels, RPN, criticality and control verification. The API lists and reads hazards and failure modes like other items.

Limits

• No fault tree or reliability block diagrams yet.
• Closing a hazard is not blocked by open checks; the Hazard Log shows why it is not ready.

Related pages

• Risks, Issues & Decisions
• Verification
• SE Process