The System-level Failure Modes and Effects Analysis (SFMEA) Risksheet is the entry point to ARP 4761 safety assessment in the Aerospace Safety Solution.
This risksheet implements the first-level FMEA per ARP 4761 Section 5.2.3. Failure modes analyzed at the system level represent functional failures visible to external systems or mission accomplishment. System-level controls link to safety requirements allocated in the Preliminary System Safety Assessment (PSSA).
Primary key: Links to customerRequirement work item. Non-creatable (analysts do not create new requirements in Risksheet). Displays requirement ID and title.
classification
Cell formatter
SC/CC Badge: Renders orange pill for “Safety-Critical (SC)” or red pill for “Critical Characteristic (CC)”. Value inherited from linked customerRequirement. Enables instant visual identification of safety-critical requirements.
Failure Mode Description: Multi-select link to failureMode work items. Analyzer creates failure modes during SFMEA execution. Displays failure mode ID and title. Multiple modes per requirement allowed (e.g., “Loss of Power Supply” + “Signal Degradation” for a power req).
effectDescription
serverRender
Effect on System: Narrative describing the effect on aircraft operation or mission. Typically begins with “Result in…” or “Prevents…”. Calculated by Velocity formula concatenating failure mode effects.
causes
multiItemLink
Root Cause Chain: Lists contributing factors leading to the failure mode (e.g., “Sensor Malfunction”, “Circuit Fault”, “Software Bug”). Multi-select allows multiple independent causes per failure mode.
downstreamRisks
multiItemLink (backLink)
Downstream DFMEA Links: Shows failure modes from child-level DFMEA/Subsystem SFMEA documents that are caused by this system-level failure. Uses causes role in reverse (backLink=true). Implements vertical risk cascade. Typically populated during DFMEA linking phase.
riskControl
multiItemLink
Mitigation Task Reference: Links to riskControl work items (safety requirements) allocated to mitigate this failure mode. Each risk control shows ID, title, and approval status. Populated during PSSA allocation phase.
verificationStatus
enum
Verification Progress: Tracks completion status — Not Started, In Progress, Complete, Waived. Updated as mitigations are implemented and verified.
Group 3: Risk Ranking — Pre-Mitigation (4 columns)
Column
Type
Default
Purpose
fmSeverity
enum (1–5)
Unset
Failure Mode Severity: 5-level scale per ARP 4761 Section 5.2.3.1. 1 = No Effect, 2 = Minor, 3 = Major, 4 = Hazardous, 5 = Catastrophic. Severity is independent of occurrence likelihood.
fmOccurrence
enum (1–5)
Unset
Probability of Occurrence: 5-level scale per ARP 4761 guidance. 1 = Extremely Improbable (<10⁻⁹/flight hour), 2 = Extremely Remote (<10⁻⁷), 3 = Remote (<10⁻⁵), 4 = Reasonably Probable, 5 = Frequent. Domain-specific (airframe: longer life = lower probability for same root cause).
fmDetection
enum (1–5)
Unset
Detection Likelihood: Probability that the failure is detected before reaching the customer. 1 = Almost Certain, 2 = High, 3 = Medium, 4 = Low, 5 = Very Low/Undetectable. Often set to 5 for latent faults. Not used for RPN calculation at system level (see ARP 4761 guidance).
commonRpn
formula
Calculated
Pre-Mitigation RPN: Severity × Occurrence × Detection. Ranges 1–125. Color-coded: Green (≤10), Yellow (11–30), Red (>30). Threshold for safety requirement allocation: typically RPN > 30 triggers mandatory mitigation. Formula: fmSeverity * fmOccurrence * fmDetection.
Group 4: Risk Ranking — Post-Mitigation (4 columns)
Column
Type
Default
Purpose
fmOccurrenceNew
enum (1–5)
Unset
Post-Control Occurrence: Severity of failure mode after risk controls are implemented. Allows separation of inherent risk (severity/occurrence) from controlled risk. Typically set during PSSA allocation based on selected control effectiveness.
fmDetectionNew
enum (1–5)
Unset
Post-Control Detection: Detection likelihood after verification controls (monitoring, testing, redundancy) are added. Often improves from latent (5) to detected (1–3).
commonRpnNew
formula
Calculated
Post-Mitigation RPN: SeverityNew × OccurrenceNew × DetectionNew (if all three set). Calculated only when post-mitigation values are provided. Enables risk control effectiveness tracking. Formula: fmSeverity * fmOccurrenceNew * fmDetectionNew.
actionPriority
enum
Auto-set
Risk Control Priority: Automatically assigned based on post-mitigation RPN. AP-1 (RPN > 30, Red), AP-2 (11–30, Yellow), AP-3 (≤10, Green). Auto-formula: if(commonRpnNew > 30, 'AP-1', if(commonRpnNew > 10, 'AP-2', 'AP-3')). Drives task prioritization in Risk Control Plan.
Group 5: Verification / Additional Fields (2 columns)
Column
Type
Purpose
safetyRequirement
multiItemLink
Allocated Safety Requirement: Links this failure mode to the safety requirement(s) allocated in PSSA to mitigate it. Enables traceability from failure → safety req → design req → test. Populated during PSSA phase.
rowDescription
formula (auto-generated)
Summary Narrative: Auto-generated description concatenating requirement, failure mode, and cause into a single sentence. Used for report generation and audit trails. Formula: "ON REQUIREMENT: " + item_title + " FAILURE MODE: " + failureMode_title + " CAUSED BY: " + causes_titles.
Columns visible: Item, SC/CC Classification, Failure Mode, Effect Description, CausesAnalyst task: For each customer requirement, brainstorm all possible failure modes (loss of function, degradation, erroneous output, unintended output). Enter failure modes as new items or link to existing failureMode work items. Enter root causes for each failure mode.Validation: Every failure mode must have ≥1 cause and an effect description.
Columns visible: Failure Mode, Causes, Downstream Risks, Item, EffectAnalyst task: After subsystem SFMEA and DFMEA documents are created, link system-level failure modes to subsystem-level failure modes via the “Downstream Risks” column. This establishes vertical traceability: System FM → Subsystem FM → Component FM.Validation: Critical failure modes (RPN > 30) should have documented decomposition into subsystem/component-level failure modes.
ON REQUIREMENT: Flight Control Command Input from PilotFAILURE MODE: Loss of Control SignalCAUSED BY: Electrical Short, Software Timeout, Sensor Failure
System failure modes cascade to subsystem analysis:
The “Downstream Risks” column uses the causes relationship in reverse (backLink=true) to show all failure modes from child documents that contribute to this system-level failure. This enables rapid navigation and impact assessment when system-level changes are proposed.
Problem: SFMEA shows failure modes with blank “Downstream Risks” column after subsystem DFMEA documents are created.Cause: Subsystem analysts created DFMEA failure modes but did not establish causes links back to system-level modes.Resolution: In each DFMEA, use “View 3: Link Upstream SFMEA” to create causes links from DFMEA failure modes back to SFMEA failure modes. The system SFMEA will auto-populate downstream links via backLink.
Problem: commonRpnNew column shows blank or zero.Cause: Post-mitigation values (fmOccurrenceNew, fmDetectionNew) are not set.Resolution: After risk controls are implemented, populate fmOccurrenceNew and fmDetectionNew based on the effectiveness of controls (e.g., a diagnostic system improves detection from 5 to 2). Formula will auto-calculate commonRpnNew.
Problem: Requirement rows don’t show SC/CC classification badge.Cause: The linked customerRequirement work item doesn’t have the classification field set.Resolution: Navigate to the Requirements space and set the classification field on each customer requirement. Allowed values: “Safety-Critical” (SC), “Critical Characteristic” (CC), or leave blank for non-critical. SFMEA will inherit and display automatically.
Detailed configuration of SFMEA risksheet.json (column formulas, view definitions, cell decorators) is stored in the RiskTemplates module and managed through the Risksheet configuration UI. Thin source coverage exists for schema details; verify specific settings in your project’s RiskTemplates/System-FMEATemplate/attachments/risksheet.json.
