5. Appendix

5.1 Failure Finding

This section discusses an example from RCM II that describes terminologies used in the Failure Finding worksheet and discusses all the formulae used in MADE to calculate the Failure Finding Interval.

Important extraction note: The mathematical notation in this appendix (Greek letters, subscripts, fraction bars) was significantly degraded by PDF text extraction — many symbols (λ, μ, θ FFI subscripts, fraction layouts) rendered as blank space or stray characters in the source. The prose explanation and the general form of each equation are preserved faithfully below; where the exact symbol-level formula could not be reconstructed with confidence, this is noted explicitly. Do not treat the reconstructed equations as pixel-exact reproductions of the original typeset math — treat the surrounding explanatory text as the authoritative source for meaning.

5.1.1 System Overview

Figure 95 shows a pump station pumping water from one tank into another. Both pumps are identical. The duty pump is switched on by one float switch when the level in Tank Y drops to 120,000 liters, and switched off by another when the level reaches 240,000 liters. A third switch is located just below the low-level switch of the duty pump; this switch is designed both to sound an alarm in the control room if the water level reaches it, and to switch on the stand-by pump. If the tank runs dry, the downstream process has to be shut down. The stand-by pump is switched on when the duty pump fails, so the tank does not run dry.

The stand-by pump exhibits one of the most important characteristics of a hidden function: the failure of this pump on its own will not become evident to the operating crew under normal circumstances — it will not become evident unless the duty pump also fails. The stand-by pump can be regarded as a protective device because it protects the pumping function if the duty pump fails. The duty pump is the protected function; the stand-by pump is the protective device.

A multiple failure only occurs if the protected function (function of the duty pump) fails while the protective device (stand-by pump) is in a failed state. Figure 96 summarizes the sequence of events which leads to a multiple failure situation.

5.1.2 Failure Finding Interval Calculation

The probability of a multiple failure in any period of time is given by the probability that the protected function will fail while the protective device is in a failed state during the same period.

Eq. 1:

P(multiple failure) = P(protected function fails) × U(protective device)

where U is the unavailability of the protective function.

The two probability terms are explained as follows:

• A probability of a multiple failure of 1 in 1,000,000 in one year implies a mean time between failure (MTBF) of 1,000,000 years. The probability of the event occurring in any one year is 1/MTBF.
• If the demand rate of the protected function is (say) once in 200 years, this corresponds to a probability of failure for the protected function of 1 in 200 in any one year, or a mean time between failures of the protected function (M) of 200 years. The probability of failure of the protected function in any one year is 1/M. This is also known as the demand rate.

Substituting the above expressions into Eq. 1:

Eq. 2:

P(multiple failure per year) = U / M

(i.e., unavailability of the protective device divided by the mean time between demands of the protected function)

According to the referenced source material, a linear correlation exists between the unavailability (U), the failure-finding interval (F) and the reliability of the protective function as given by its MTBF (M_p) — the source text denotes this as "Eq. 3":

Eq. 3:

U = 0.5 × F / M_p

The above linear relationship is valid for all unavailability values of less than 5%, provided that the protective function conforms to an exponential survival distribution.

Eq. 3 can be rearranged (Eq. 4):

Eq. 4:

F = 2 × U × M_p

Substituting Eq. 2 into Eq. 3/4 gives (Eq. 5):

Eq. 5:

F = 2 × M_p × M / M ... (i.e., F expressed in terms of the desired multiple-failure probability and both MTBF values)

Eq. 5 allows a failure-finding interval to be determined in one step for a single, independent protective function.

(Note: the exact algebraic substitution result for Eq. 5 was not fully recoverable from the extracted text layer — the source shows "F = M_p × 2 × [target multiple-failure probability] / M" in essence, combining Eq. 2 and Eq. 3, but the precise arrangement of terms in the printed equation could not be confirmed character-for-character. The conceptual result — FFI scales proportionally with the protective device's MTBF and the acceptable multiple-failure probability, and inversely with the protected function's demand rate — is accurate.)

5.1.3 FFI Implementation in MADE

MADE's Model-Based RCM offers various methods to calculate FFI, providing a comprehensive platform for analyzing and optimizing maintenance strategies. The following methods are available in the Failure Finding Interval Calculator:

Table (FFI calculation methods in MADE):

#	Method	Formula (as recovered)	Input Range
1	Availability-based formula	F = 2 × U × M_p	U input range [0,1]
2	Single independent protected function	F = 2 × M_p × (target multiple failure probability) / M	Probability input range [0,1)
3	Multiple failure modes in a single protective device	F = 2 × (target probability) / (1/M₁ + 1/M₂ + 1/M₃ + 1/M₄ + ... ) — combines demand rates of multiple failure modes (M₁...M_n) sharing one protective device	—
4	Multiple redundant protective devices (protected system with multiple independent, fully redundant protective devices)	F = [(n+1) × (target probability) × M_p^n / M ] ^ (1/n) form — involves the order n of redundancy	—
5	K of n voting system (protected system with a set of parallel protective devices)	Involves a combinatorial/factorial term of the form n! / ((n−k)! × k!) combined with the target probability, M_p, and M, plus an auxiliary relation j = n − k + 1	—
6	Failure-finding task causing a failure (the failure-finding task can itself cause the very failure it is supposed to detect, so the protective device will be in a hidden failed state from the moment the test is completed)	F = 2 × M_p × (target probability) / (M × (1 − U_task-induced)) form, adjusting for task-induced unavailability	—
7	Economic Consequences	F = (2 × [cost/consequence-weighted target] × M_p / M) form	—
8	Economic voting system	Combines the voting-system combinatorial structure (method 5) with economic/cost weighting terms	—

Extraction caveat for the table above: This table's source (page ~71 of the PDF) contains dense mathematical notation (factorials, exponents, multi-level fractions, subscripted variables M₁ through M_n, k-of-n combinatorics) that lost significant fidelity in the plain-text PDF extraction — symbols like λ, superscripts, and stacked fraction layouts came through as blank space, stray parentheses, or dropped characters. The method names/use-cases (column 2) are reproduced verbatim/faithfully from the source and are reliable. The formula column has been reconstructed to represent the correct general mathematical relationship implied by the surrounding text and standard RCM II failure-finding-interval theory (all methods build on the base relationship in Eq. 1-5 above), but the precise symbolic form as typeset in the original PDF could not be fully verified character-for-character for methods 3 through 8. Anyone needing the exact formulas for methods 3-8 should cross-reference the live PDF ("Model-based RCM Guide.pdf", page ~71, section 5.1.3) directly, ideally by opening it in a PDF viewer that renders the equations as images/typeset math rather than relying on text extraction.

Note: The Failure Finding Interval field in MADE will display N/A if the required variables for its calculation are not defined, or if the interval is infinite.