Brake-by-Wire FMECA: RPN Says One Thing, Safety Says Another

The RPN ranking is not defensible as a priority order. RPN = S x O x D treats severity as tradeable against occurrence and detection, so a severity 9 mode can be outranked by a severity 8 mode with a poorer detection score. Here A (240), B (216) and C (192) are within 25% of each other, which is inside normal rater-to-rater noise on a 1-10 scale; the ordering is effectively a tie being used to sequence engineering work.

Criticality, using Cm = beta x alpha x lambda x t with beta = alpha = 1 and t = 2,000 h:

• A: 4x10^-6 x 2,000 = 0.008 per year
• B: 1.5x10^-6 x 2,000 = 0.003 per year
• C: 12x10^-6 x 2,000 = 0.024 per year

Severity-weighted (S x Cm): A = 0.064, B = 0.027, C = 0.144.

So A is not first on either measure. C dominates by expected frequency, three times A; B dominates by consequence. The RPN ranking put A on top because of a mediocre detection score on a mid-severity mode, which is precisely the failure mode of the RPN method.

Priority order:

1. B, not because of its number but because severity 9 with a potential single-point path to loss of braking is a pass/fail safety requirement, not a ranked risk. Fix it regardless of RPN.
2. C, the highest expected rate and already confirmed twice in service.
3. A, still worth redesigning, but third.

For the review, record severity as absolute, do not allow it to be averaged away, and use a criticality or risk-matrix method per IEC 60812 rather than RPN alone.

The second channel is not independent. Same sensor type, same shared diagnostic software, and presumably common harness routing and power mean a common-cause failure defeats both channels simultaneously. For identical redundant channels a beta factor of 1-10% is typical; shared software can push it higher. If beta = 5%, the redundancy buys about a 20x reduction in the dangerous failure probability, not the 100x or more that a naive two-channel assumption implies. If the safety case claims 'two channels, therefore no single point,' that claim fails here.

Required actions:

• Diversity. Change one channel to a different sensing principle (resolver or eddy-current) or at minimum a different supplier and technology, so a design defect or manufacturing escape does not hit both. Write dissimilar diagnostic algorithms; do not reuse the same plausibility routine.
• Independence. Separate harness routing and connectors, independent power feeds, and physically separated sensor mounting where practical.
• Detection. Continuous cross-channel plausibility comparison, power-up built-in test with results latched, and open-circuit/short-to-ground monitoring that reports before the next brake demand rather than at it.
• Quantify. Update the fault tree with a beta-factor common-cause model and show that the single-failure requirement is actually met, not assumed.

Verification of the detection claim: fault injection on the bench and on the vehicle (open circuit, short to ground, signal drift, stuck signal, connector intermittency) with the detection time measured and compared to the required diagnostic test interval. Do not accept 'detection 8' as a score without evidence; diagnostic coverage needs a demonstrated fraction and a demonstrated latency. Record the results in the FMECA as the basis for the detection rating.

The model and the field disagree by orders of magnitude. Predicted rate: 12x10^-6/h x 2,000 h = 0.024 failures per unit-year, so two events would take roughly 40 unit-years. Two events in 18 months means either the fleet is very large, or the prediction is badly wrong, or both events share one systemic cause. You cannot compute an empirical rate without the fleet exposure (unit-hours in service), so the first action is to get it, then compute observed failures per unit-hour and compare with the prediction.

Interpretation. Fretting corrosion is not a random electrical failure; it indicates micro-motion at the contact interface, insufficient contact normal force, and usually inadequate plating or sealing for the vibration and humidity environment. Two occurrences in the same mode suggest a design or supplier process issue affecting the whole fleet, which is exactly what FMECA occurrence ratings are supposed to capture and did not.

Actions:

• Root-cause teardown of both failed connectors: contact force, plating thickness, fretting debris, seal integrity, harness strain relief.
• Design change to sealed, gold-plated contacts with positive locking and strain relief; qualify to the vibration and thermal-cycling profile, not just bench continuity.
• Interim mitigation: contact resistance or voltage-drop monitoring so a degrading connector is detected before it causes an uncommanded brake application. Note that uncommanded braking is itself a hazard with its own severity and must be assessed, not simply logged as a nuisance fault.
• Update the FMECA with the empirical rate and re-rank C; raise the occurrence rating to reflect field evidence and record the data source.
• Add a fleet-wide inspection or retrofit decision, and check whether other connector families in the actuator share the same contact system.