FMEA and FMECA

Failure mode and effects analysis (FMEA) looks at a system from the bottom up. Instead of asking what could go wrong with the process as a whole, it takes each component, such as a pump, valve, sensor, relay or software function, and asks how it could fail, what the effect would be and how the failure would be detected. Failure mode, effects and criticality analysis (FMECA) adds a ranking of each failure's criticality. The method was developed in the US military and aerospace industries in the 1940s to 1960s, spread to automotive manufacturing, and is now used for equipment, machinery, medical devices, products and processes. It is described in IEC 60812:2018 and in the AIAG and VDA FMEA Handbook used by the automotive industry.

For safety professionals, FMEA is useful in three main situations: reviewing the safety functions of machinery and equipment, such as interlocks, guards and emergency stops; analyzing instrumented and control systems; and examining processes step by step, where it becomes a process FMEA, close in spirit to a task analysis. It is one of the PHA methods named in the US PSM standard.

Steps in an FMEA

An FMEA starts by defining the system, its boundaries and its functions, and drawing a block diagram showing how the components connect. The team then lists each component and, for each, the ways it can fail: its failure modes. A valve can fail open, fail closed, leak through the seat, leak externally or stick in position. A pressure transmitter can read high, read low, freeze at its last value or lose signal. For each failure mode, the team records the local effect on the component, the effect on the system and the end effect on people, environment or production, followed by the causes, the current detection or prevention controls and any recommended actions.

Rating with the risk priority number

The traditional FMEA ranks each failure mode with three ratings, each on a scale of 1 to 10. Severity (S) rates the worst end effect. Occurrence (O) rates how likely the cause is. Detection (D) rates how likely the failure is to be detected before it causes harm, with 10 meaning it cannot be detected and 1 meaning it will almost certainly be detected. The risk priority number (RPN) is their product.

The RPN ranges from 1 to 1,000. Teams then work on failure modes with the highest RPNs, and re-rate after actions. The RPN is easy to understand and widely used, but it has well-known flaws. Different combinations give the same number: S=10, O=2, D=5 gives 100, and so does S=2, O=10, D=5, yet one is a fatal failure and the other a nuisance. Small changes in one rating can swing the RPN dramatically. The scales are ordinal, so multiplying them has no strict mathematical meaning, a problem similar to the risk matrix issue in Lesson 4. And a threshold such as "act on any RPN over 100" can ignore a high-severity failure with a low RPN.

Action priority

Because of these flaws, the 2019 AIAG and VDA FMEA Handbook replaced the RPN with action priority (AP). Instead of multiplying, a lookup table assigns each combination of severity, occurrence and detection to high, medium or low priority, with severity given the most weight, then occurrence, then detection. Any failure mode with severity 9 or 10 (affecting safety or regulatory compliance) and anything but the lowest occurrence is high priority, regardless of detection. Many safety teams now use action priority or simply a rule that any failure mode with high severity must be addressed, whatever its RPN.

FMECA and criticality

FMECA adds a criticality analysis. In the quantitative form used in military and aerospace standards such as MIL-STD-1629A, each failure mode's criticality is calculated from the component failure rate, the fraction of failures in that mode, the probability that the failure leads to the end effect and the operating time. In practice, many organizations use a simpler qualitative criticality matrix of severity against probability, similar to a risk matrix. FMECA is common where reliability data are available, such as aircraft systems, defence equipment and safety instrumented systems.

In this formula, \( \lambda_p \) is the part failure rate, \( \alpha \) is the fraction of failures in this mode, \( \beta \) is the probability that the failure mode causes the end effect, and \( t \) is the operating time. The result is the expected number of failures in this mode causing the effect over the time considered.

Strengths and limits

FMEA is thorough at the component level, produces a useful record for design and maintenance, and links naturally to reliability-centred maintenance. Its main limitation is that it considers one failure at a time, so it misses combinations of failures, common cause failures and human errors that are not built into the component list. It can also become very long for complex systems, and it is weaker on hazards from interactions between subsystems. For combinations, fault tree analysis (Lesson 9) is the natural partner: the FMEA identifies failure modes, and the fault tree shows how they combine to cause a top event.

In Canada, FMEA is widely used in machinery safeguarding under CSA Z432 and in the design of safety-related control systems to ISO 13849, and process FMEAs support the hazard identification element of CSA Z767 for equipment-focused reviews. Medical device manufacturers use it under ISO 14971, which Health Canada recognizes.

Rating scales in practice

FMEA ratings are only as consistent as the scales behind them. Each company or project should publish a severity, occurrence and detection table with clear descriptions for each number. Severity 10 might be "hazardous without warning, affects safe operation or involves noncompliance with law"; severity 9 "hazardous with warning"; severity 5 "loss of secondary function"; severity 1 "no discernible effect". Occurrence is often linked to failure rates or to the number of failures per thousand items, and detection to the type of control: a proven automatic detection rates low, a visual inspection rates high, no control rates 10.

Teams should rate severity for the end effect regardless of how likely it is, and should not let detection reduce severity: detecting a failure late does not make its effect less serious. A common error is to give a low detection rating because "the operator would notice", without asking whether the operator would notice in time to prevent harm.

FMEA also supports maintenance planning. Failure modes with high severity and hidden (undetected) failures are prime candidates for scheduled function tests, which is the logic behind reliability-centred maintenance.

Process FMEA applies the same logic to the steps of a manufacturing or maintenance process rather than to components. Each step is treated as a function, its failure modes are the ways the step can be done wrongly or not at all, and the effects are traced to product quality, equipment damage or injury. Used this way, FMEA overlaps with task analysis and human error methods from Lesson 3, and it is a good way to find steps where error-proofing, such as fixtures that only fit one way or sensors that confirm a part is present, can remove the opportunity for error altogether.