Risk, failure modes and safety

A pump skid that fails to start during a flood lets a basement fill. A skid that starts and then hurts the person running it is worse. Rafael's job as test and safety officer was to make sure the team looked systematically for both kinds of failure before building anything, rather than discovering them on the test floor or, worse, in a client's hands. This lesson covers three overlapping tools: the project risk register, the design failure mode and effects analysis, and the machinery risk assessment required by safety standards. It ends with the team's duties as designers of a product that other people will use.

Project risk and product risk

Two kinds of risk run through a capstone. Project risks threaten the team's ability to deliver: a long-lead part arriving late, a member falling ill, the test loop booked by a customer job in the critical weeks. Product risks threaten the design's ability to do its job safely: a priming system that loses prime, a guard that is left off, a weld that cracks. Both are managed the same way in principle: identify, assess likelihood and consequence, decide on a response, assign an owner and review regularly. They are kept in separate registers because they have different owners and different time scales.

The team's project risk register started with nine items. The highest was the vacuum priming kit, a bought-in assembly with a five-week lead time on the critical path; the response was to order it the day after the critical design review and to identify a second supplier. The thin mass margin from embodiment appeared here too, with its fallbacks. Each risk had an owner, who reported on it at the weekly meeting, and the register was reviewed at every gate.

Design FMEA

Failure mode and effects analysis works through a design function by function or part by part, asking for each: how can it fail (the failure mode), what happens if it does (the effect), why would it fail (the cause), how is that prevented and how would we detect it before it reaches the user? Each row is rated for severity of the effect, likelihood of occurrence of the cause and detection, the chance that current controls catch it, usually on scales of 1 to 10.

The traditional way to prioritize is the risk priority number, the product of the three ratings, RPN = S × O × D. It is simple, but it has known weaknesses. A failure with severity 10, occurrence 2 and detection 3, a lifting eye that could fail and drop the skid, scores 60, lower than a nuisance failure with severity 6, occurrence 6 and detection 4 at 144. Multiplying ordinal ratings treats a severity of 10 as if it could be traded for a lower occurrence, which is not how people think about fatal hazards. The 2019 handbook jointly published by the Automotive Industry Action Group and the German automotive association VDA replaced RPN with action priority, a lookup that gives severity precedence, then occurrence, then detection, and classifies each item high, medium or low.

# Design FMEA for the TDX-150: rank by RPN and by a simplified AIAG-VDA action priority
rows = [  # (failure mode, effect, severity, occurrence, detection)
    ("air leak at suction hose coupling", "loses prime, pump runs dry", 6, 6, 4),
    ("debris blocks impeller eye", "flow drops, basement keeps flooding", 7, 5, 3),
    ("exhaust gas drawn into canopy intake", "engine overheats and stops", 6, 3, 5),
    ("operator works near exhaust in a basement stairwell", "carbon monoxide exposure", 10, 3, 6),
    ("fuel tank weld cracks in transport", "diesel spill into floodwater", 8, 2, 5),
    ("lifting eye weld undersized", "skid falls during a crane lift", 10, 2, 3),
    ("coupling guard left off after service", "contact with rotating coupling", 9, 3, 4),
    ("float valve sticks open in separator", "water carried into vacuum pump", 5, 4, 5),
    ("battery discharged after storage", "no start on call-out", 7, 5, 2),
]
def ap(S, O, D):
    """Simplified action priority: severity first, then occurrence, then detection."""
    if S >= 9 and (O >= 2 or D >= 5): return "H"
    if S >= 7 and O >= 4: return "H"
    if S >= 7 and O >= 2 and D >= 5: return "H"
    if S >= 5 and (O >= 4 or D >= 5): return "M"
    return "L"
print("RPN  AP  S O D  failure mode")
for f, e, S, O, D in sorted(rows, key=lambda r: -r[2] * r[3] * r[4]):
    print(f"{S * O * D:3d}  {ap(S, O, D)}   {S} {O} {D}  {f}")
high = [r[0] for r in rows if ap(*r[2:]) == "H"]
top_rpn = sorted(rows, key=lambda r: -r[2] * r[3] * r[4])[:3]
missed = [h for h in high if h not in [r[0] for r in top_rpn]]
print("High priority items not in the RPN top three:", missed)

RPN  AP  S O D  failure mode
180  H   10 3 6  operator works near exhaust in a basement stairwell
144  M   6 6 4  air leak at suction hose coupling
108  H   9 3 4  coupling guard left off after service
105  H   7 5 3  debris blocks impeller eye
100  M   5 4 5  float valve sticks open in separator
 90  M   6 3 5  exhaust gas drawn into canopy intake
 80  H   8 2 5  fuel tank weld cracks in transport
 70  H   7 5 2  battery discharged after storage
 60  H   10 2 3  lifting eye weld undersized
High priority items not in the RPN top three: ['debris blocks impeller eye', 'fuel tank weld cracks in transport', 'lifting eye weld undersized', 'battery discharged after storage']

The program applies a simplified version of the action priority logic. Its last line makes the point: four items rated high priority are not in the RPN top three, including the lifting eye and the fuel tank weld. A team working from the RPN ranking alone would have spent its effort on air leaks and float valves, real but minor nuisances, before the failures that could kill someone or spill diesel into floodwater. The figure places the items on a severity-occurrence grid shaded by priority.

The highest-priority items and their actions

The top item came from the firefighter's story in lesson 2: crews running the skid's engine with its exhaust near a basement stairwell, where carbon monoxide can collect to dangerous levels. Severity is 10. The design cannot stop someone placing a skid badly, but it can make the safe choice the easy one. The team's actions were a vertical exhaust stack rising above the canopy so exhaust disperses upward, 6 m of suction hose as standard so the skid can stand outside even when the water is in a basement, a bold warning label in English on the canopy beside the control panel, and a section in the quick-start card on placement. A battery-powered carbon monoxide alarm clipped to the control panel was added as an accessory, to be carried down with the suction hose.

The coupling guard came next. Every engine-driven pump has a rotating coupling between engine and pump, and a guard over it that must be removed for service. If a mechanic forgets to refit it, the next user is exposed to a rotating shaft at 1,800 rpm. The design response follows the hierarchy of safety measures that the standards set out: eliminate the hazard if possible, otherwise guard it, otherwise warn. The coupling cannot be eliminated, so the guard was redesigned as part of the canopy panel that covers the coupling, so the canopy cannot be closed without it, and the engine's start circuit was wired through a switch that detects the canopy panel is in place.

The lifting eye and the fuel tank weld are rare but severe. For the lifting eye, the team bought a rated, forged component, analyzed its mounting plate, and specified a proof test at a multiple of the working load, as lifting-equipment practice requires, with the test certificate kept with the skid. For the tank, the response was a pressure test of every tank after welding, a 100 percent visual weld inspection by Marco's inspectors, a design with baffles that reduce fuel slosh loads on the welds, and the secondary containment of R-11, which captures a leak even if the tank fails.

Machinery risk assessment

FMEA looks at how the product fails. A machinery risk assessment looks at how people can be hurt by the product even when it works as intended. In the United States, the relevant general standard is ANSI B11.0, the US general standard for safety of machinery, which, like the international standard ISO 12100, asks the designer to identify every task people perform on the machine across its life, the hazards present during each task, and the risk from each, and then to reduce risk by inherently safe design first, then safeguards, then information for use. Rafael walked through the skid's life: delivery, lifting, set-up, starting, running unattended, refueling, clearing a blocked strainer, servicing, transport and storage.

Several entries changed the design. Clearing a blocked strainer is a common job in debris-laden floodwater, and the instinct is to reach in while the engine runs. The team moved the strainer to the end of the suction hose, away from the pump, and specified a key-operated start so the operator removes the key, and with it the ability to start, before working on the suction side. The priming separator holds a vacuum, and when it is opened for service it can draw in fingers or slam a lid; a manual vent valve with an instruction to open it first was added.

Workplace law also applies. The volunteers using the skid are, in most cases, workers or are treated like workers under OSHA's general industry standards in 29 CFR 1910, and the employer, here the cooperative or its member fire services, has duties to provide safe equipment and training. The designer's duties are to make the equipment as safe as reasonably practicable and to provide the information that lets the employer use it safely. Rafael drafted the safety section of the operator's manual and a laminated quick-start card, tested on two volunteers who had never seen the skid, and rewritten twice.

Product liability and the duty to warn

If a product injures someone, its designer and manufacturer can be held liable if the design was defective, the manufacture was faulty or the warnings and instructions were inadequate. Courts and regulators in both Canada and the US ask, broadly, whether the risk was foreseeable, whether a reasonable alternative design existed, and whether the user was properly warned. Warnings do not excuse a dangerous design that could reasonably have been made safer; that is why the hierarchy puts design first. But clear warnings, in the user's language and placed where the hazard is, are part of a safe product. In the United States, labels on equipment used by the cooperative's crews should appear in English.

A capstone team is not a manufacturer, but the habits matter. The team's risk assessment, FMEA, test records and design decisions are the kind of evidence a manufacturer uses to show it took reasonable care. Farah reviewed the risk assessment and the guarding design before signing the critical design review, and asked that every safety decision cite the hazard it addressed.

Living documents

Neither the FMEA nor the risk assessment was finished at the critical design review. Both were updated after the prototype build, when the team found the separator's sight glass could not be seen from the control side, and after testing, when the noise result and a minor fuel weep at a fitting added new rows. The final versions went to Tidewater with the design, because a manufacturer taking the product forward inherits the analysis and is responsible for keeping it current.