1.3 Design Methodology, Risk Assessment & Safety

1.3 Design Methodology, Risk Assessment & Safety

Mechanical engineering design is an iterative decision-making process that transforms abstract operational requirements into verified, safe, and reliable physical hardware. Engineering practice demands rigorous methodologies to identify potential failure modes early, establish adequate safety margins, and model system reliability quantitatively.

---

The Engineering Design Process & Requirements Definition

Systematic design methodology (developed by Pahl & Beitz and standard engineering design frameworks) divides mechanical development into sequential phases with formal stage-gate reviews:

+-----------------------+
| 1. Requirements &     |  Define functional requirements (FRs), physical constraints,
|    Problem Definition |  regulatory standards, load envelopes, and user environments
+-----------+-----------+
            |
            v
+-----------------------+
| 2. Conceptual Design  |  Decompose functions; generate options via morphological charts;
|                       |  screen concepts using Pugh decision scoring matrices
+-----------+-----------+
            |
            v
+-----------------------+
| 3. Embodiment Design  |  Determine spatial architecture, load paths, component sizing,
|                       |  material selections, and preliminary assembly layouts
+-----------+-----------+
            |
            v
+-----------------------+
| 4. Detailed Design    |  Perform stress/fatigue analysis, thermal modeling, FEA,
|                       |  tolerance stack-ups, detailed CAD, and ASME Y14 drawings
+-----------+-----------+
            |
            v
+-----------------------+
| 5. Prototyping & V&V  |  Fabricate physical prototypes; execute design verification
|                       |  and operational validation testing
+-----------------------+

Requirements Engineering

Engineering requirements articulate design objectives without prescribing specific solutions:

• Functional Requirements (FRs): What the system must accomplish dynamically or kinematically (e.g., "Deliver $250\,\text{N}\cdot\text{m}$ of torque at $1,800\,\text{rpm}$").
• Constraints: Invariable boundaries that limit design options (e.g., maximum mass of $45\,\text{kg}$, $24\,\text{VDC}$ supply voltage, envelope dimensions).
• Performance Specifications: Quantifiable thresholds of efficiency, duty cycle, fatigue life, acoustic limits, and environmental tolerances (e.g., operating range $-40^\circ\text{C}$ to $+85^\circ\text{C}$).

Verification vs. Validation (V&V)

• Verification ("Did we build the system right?"): Confirmation by examination and provision of objective evidence that specified design output requirements have been fulfilled. Executed through analytical stress hand calculations, finite element simulations, dimensional inspections, and factory bench testing against engineering specifications.
• Validation ("Did we build the right system?"): Confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use can be consistently fulfilled. Executed through real-world operational testing, customer pilot trials, and mission-profile endurance tests under actual field conditions.

---

Failure Modes and Effects Analysis (FMEA)

Failure Modes and Effects Analysis (FMEA) is a bottom-up, inductive analytical technique used to identify potential failure modes, evaluate their system consequences, and prioritize corrective actions.

• Design FMEA (DFMEA): Focuses on product geometry, material choices, tolerances, structural interfaces, and engineering sizing.
• Process FMEA (PFMEA): Focuses on manufacturing, tooling, assembly sequence, calibration errors, and operator handling.

The Three Scoring Dimensions (1 to 10 Scale)

1. Severity ($S$): Assesses the seriousness of the failure effect on customer safety, regulatory compliance, or system operation:
   • $S = 1$: Negligible effect; customer barely notices.
   • $S = 5$: Moderate effect; partial loss of performance or secondary system degradation.
   • $S = 9\text{--}10$: Catastrophic hazard; loss of primary function or threat to human life without ($10$) or with ($9$) prior warning.
2. Occurrence ($O$): Assesses the likelihood or frequency that the root cause will occur during the product lifespan:
   • $O = 1$: Extremely remote probability (historically $< 1 \times 10^{-6}$).
   • $O = 5$: Occasional failures experienced in similar legacy designs ($1 \times 10^{-3}$).
   • $O = 10$: High failure rate almost inevitable ($> 1 \times 10^{-1}$).
3. Detection ($D$): Assesses the probability that current design verification controls, simulations, or inspection methods will detect the flaw before the component leaves the design or manufacturing stage:
   • $D = 1$: Almost certain detection (automated 100% functional test or proven simulation).
   • $D = 5$: Moderate chance of detection (standard batch testing, visual inspection).
   • $D = 10$: Undetectable; current controls cannot detect the defect prior to customer delivery.

Risk Priority Number (RPN)

$$\text{RPN} = S \times O \times D$$

RPN ranges from $1$ to $1{,}000$. Ranking by RPN alone is misleading because very different risks can share similar products: $S = 9$, $O = 2$, $D = 5$ gives $\text{RPN} = 90$, while $S = 3$, $O = 6$, $D = 6$ gives $108$. Current practice therefore looks at severity first. The AIAG–VDA FMEA Handbook (2019) replaced RPN thresholds with Action Priority (AP) tables that rate each failure mode High, Medium or Low by weighting severity first, then occurrence, then detection.

---

Fault Tree Analysis (FTA)

While FMEA is an inductive (bottom-up) analysis exploring component-level causes, Fault Tree Analysis (FTA) is a deductive (top-down) method that begins with an undesirable system-level catastrophe (the Top Event) and works backward through subsystem logic to basic physical causes.

                    +------------------------------+
                    |          TOP EVENT           |
                    |  (e.g., Catastrophic Braking |
                    |         System Failure)      |
                    +--------------+---------------+
                                   |
                                   v
                             [  OR GATE  ]
                             /           \
                            v             v
                +--------------+       +--------------+
                | Loss of Hydr |       | Mechanical   |
                |   Pressure   |       | Disc Jam     |
                +-------+------+       +--------------+
                        |
                        v
                  [ AND GATE ]
                  /          \
                 v            v
         +--------------+  +--------------+
         | Primary Pump |  | Backup Pump  |
         |   Failure    |  |   Failure    |
         +--------------+  +--------------+

Logic Gate Probability Formulations

1. AND Gate: The output event occurs if and only if all input events occur concurrently. For independent input events $E_1, E_2, \dots, E_k$:

$$P(\text{Output}) = \prod_{i=1}^k P(E_i) = P(E_1) \cdot P(E_2) \cdots P(E_k)$$

An AND gate models active redundancy or multi-barrier safety architecture.

1. OR Gate: The output event occurs if any single input event occurs:

$$P(\text{Output}) = 1 - \prod_{i=1}^k [1 - P(E_i)]$$

For small event probabilities ($P(E_i) \ll 1$), the OR gate simplifies to the first-order union:

$$P(\text{Output}) \approx \sum_{i=1}^k P(E_i)$$

An OR gate exposes single-point failure vulnerabilities.

Minimal Cut Sets (MCS)

A cut set is a combination of basic events that causes the Top Event. A Minimal Cut Set is the smallest combination of basic events that guarantees Top Event occurrence. If any single basic event forms a one-element minimal cut set, it constitutes a single-point catastrophic failure that requires immediate redesign.

---

Factor of Safety ($n$) vs. Design Margin

Deterministic Factor of Safety

In classical mechanical design, the deterministic factor of safety ($n$) buffers against unmodeled load peaks, material property variability, and mathematical idealizations:

$$n = \frac{\text{Failure Capacity}}{\text{Allowable Working Stress}} = \frac{S}{\sigma}$$

Depending on the operative failure mode:

• Static Ductile Yielding: $n_y = S_y / \sigma_{\text{equivalent}}$
• Ultimate Static Rupture: $n_u = S_{ut} / \sigma_{\text{equivalent}}$
• Dynamic Fatigue: $n_f = S_e / \sigma_a$
• Elastic Buckling: $n_b = P_{cr} / P_{\text{applied}}$

Design Margin ($DM$)

Design margin expresses the excess structural reserve normalized to working stress:

$$DM = n - 1 = \frac{S - \sigma}{\sigma}$$

• $DM > 0$: Structural reserve exists (design acceptable).
• $DM = 0$: Operating at the exact threshold of allowable capacity.
• $DM < 0$: Structural violation; yielding or failure occurs.

Factors Influencing the Selection of $n$

1. Degree of Load Certainty: Dead static gravity weights ($n \approx 1.2\text{--}1.5$) versus highly erratic aerodynamic shock or cyclic fluid transients ($n \ge 2.5\text{--}4.0$).
2. Material Uniformity: Wrought alloys exhibiting tight statistical distributions versus porous cast irons or anisotropic composite laminates.
3. Analytical Model Fidelity: Direct closed-form solutions and validated 3D FEA versus simplified lumped-parameter 1D approximations.
4. Failure Consequences: Minor maintenance annoyance versus catastrophic threat to human life or nuclear containment.

---

Deterministic vs. Probabilistic Design (Stress-Strength Interference)

Deterministic design models stress and material strength as single static values. However, both load-induced stress ($\sigma$) and material strength ($S$) exhibit natural statistical variability and are accurately modeled as continuous random variables characterized by probability density functions (PDFs).

Probability Density
      ^                      Overlap Region = Failure Zone
      |                           |
      |         Applied Stress    v     Material Strength
      |           PDF: f(sigma)           PDF: f(S)
      |              /---\                 /---\ 
      |             /     \   /-------\   /     \
      |            /       \ /         \ /       \
      |           /         X           X         \
      +----------+---------+-------------+---------+-----> Stress / Strength
                         mu_sigma      mu_S

Interference Variable Formulation

Assuming both strength $S$ and applied stress $\sigma$ follow independent normal (Gaussian) distributions: $S \sim \mathcal{N}(\mu_S, \sigma_S^2)$ and $\sigma \sim \mathcal{N}(\mu_\sigma, \sigma_\sigma^2)$.

Define the difference variable (reserve capacity) $Z = S - \sigma$. Structural failure occurs whenever $Z < 0$.

Because linear combinations of independent normal distributions remain normal, $Z \sim \mathcal{N}(\mu_Z, \sigma_Z^2)$:

$$\mu_Z = \mu_S - \mu_\sigma$$ $$\sigma_Z = \sqrt{\sigma_S^2 + \sigma_\sigma^2}$$

The Safety Index ($\beta$)

The Safety Index (or Reliability Index) $\beta$ expresses the distance of the mean margin from zero in units of standard deviation:

$$\beta = \frac{\mu_Z}{\sigma_Z} = \frac{\mu_S - \mu_\sigma}{\sqrt{\sigma_S^2 + \sigma_\sigma^2}}$$

The Probability of Failure ($P_f$) and Reliability ($R$) evaluate directly using the standard normal cumulative distribution function $\Phi$:

$$P_f = P(Z < 0) = \Phi(-\beta)$$ $$R = 1 - P_f = \Phi(\beta)$$

---

Reliability Engineering Fundamentals

Reliability $R(t)$ is the probability that a mechanical component or system will perform its intended function without failure for a specified duration $t$ under stated operating conditions.

The Bathtub Curve & Constant Failure Rate Regime

1. Infant Mortality Phase: Characterized by a decreasing failure rate over early operational hours due to manufacturing flaws, assembly defects, or substandard materials.
2. Useful Life Phase: Characterized by a constant failure rate ($\lambda$), where failures occur purely from random, unpredicted external shocks. This regime is modeled by the exponential distribution.
3. Wear-out Phase: Characterized by an increasing failure rate due to mechanical fatigue, bearing surface spalling, abrasive wear, or corrosion.

Mathematical Formulations for Constant $\lambda$

$$\text{MTBF} = \frac{1}{\lambda}$$ $$R(t) = e^{-\lambda t} = \exp\left(-\frac{t}{\text{MTBF}}\right)$$

The unreliability (cumulative probability of failure) is:

$$F(t) = 1 - R(t) = 1 - e^{-\lambda t}$$

System Reliability Topologies

1. Series System Architecture

In a series system, all $k$ components are mission-critical. If any single component fails, the entire system fails:

$$R_{\text{series}}(t) = \prod_{i=1}^k R_i(t) = e^{-\lambda_1 t} \cdot e^{-\lambda_2 t} \cdots e^{-\lambda_k t} = \exp\left(-\sum_{i=1}^k \lambda_i t\right)$$

The overall system failure rate is strictly additive:

$$\lambda_{\text{system}} = \sum_{i=1}^k \lambda_i$$ $$\text{MTBF}_{\text{system}} = \frac{1}{\sum_{i=1}^k \lambda_i}$$

2. Parallel System Architecture (Active Redundancy)

In an active parallel system with $k$ identical redundant channels, the system operates successfully as long as at least one channel remains functional:

$$R_{\text{parallel}}(t) = 1 - \prod_{i=1}^k [1 - R_i(t)] = 1 - [1 - R(t)]^k$$

For two identical units operating in parallel:

$$R_{\text{parallel}} = 1 - (1 - R)^2 = 2R - R^2$$

---

Worked Numerical Engineering Problem: Aerospace Hydraulic Actuator

Problem Statement

An electro-hydraulic aerospace flight control actuator comprises two subsystems arranged in series:

1. Control Valve Subsystem: Consists of two identical pilot solenoid valves operating in active parallel redundancy. Each solenoid valve has an independent constant failure rate of $\lambda_s = 20 \times 10^{-6}\,\text{failures/hour}$ ($\text{MTBF} = 50,000\,\text{hours}$).
2. Mechanical Actuator Cylinder: A single hydraulic piston cylinder assembly connected in series with the valve subsystem, having a failure rate of $\lambda_c = 5 \times 10^{-6}\,\text{failures/hour}$ ($\text{MTBF} = 200,000\,\text{hours}$).

Calculate:

1. The reliability of an individual solenoid valve over a mission time of $t = 2,500\,\text{hours}$.
2. The reliability of the parallel solenoid valve subsystem over the $2,500\,\text{hour}$ mission.
3. The total combined actuator system reliability over $2,500\,\text{hours}$.

Step-by-Step Solution

Step 1: Individual Solenoid Valve Reliability

$$R_s(2500) = e^{-\lambda_s t} = e^{-(20 \times 10^{-6})(2500)} = e^{-0.05} = 0.951229$$

Step 2: Parallel Solenoid Subsystem Reliability

Since either solenoid valve can supply full pilot flow to the actuator, the subsystem operates as active parallel redundancy:

$$R_{\text{valves}}(2500) = 1 - [1 - R_s(2500)]^2$$ $$R_{\text{valves}}(2500) = 1 - [1 - 0.951229]^2 = 1 - (0.048771)^2 = 1 - 0.002379 = 0.997621$$

Parallel redundancy improves subsystem reliability from $95.12\%$ to $99.76\%$, reducing subsystem failure probability by more than a factor of 20.

Step 3: Mechanical Cylinder Reliability

$$R_c(2500) = e^{-\lambda_c t} = e^{-(5 \times 10^{-6})(2500)} = e^{-0.0125} = 0.987578$$

Step 4: Overall Combined System Reliability

The redundant valve subsystem and the mechanical cylinder function in series; both must survive for the actuator to function:

$$R_{\text{system}}(2500) = R_{\text{valves}}(2500) \times R_c(2500)$$ $$R_{\text{system}}(2500) = 0.997621 \times 0.987578 = 0.985229 \quad (98.52\%)$$

The overall probability of successful mission completion is 98.52%.