FMEA

What is FMEA?

FMEA (Failure Mode and Effects Analysis) is a structured, bottom-up analysis method in which a team determines in advance, for each component, function or process step, how it can fail, what the consequences would be and which causes lie behind it, so that the resulting risks can be prioritised and reduced. The method helps you prevent failures before they occur rather than fixing them afterwards. FMEA is used in automotive, discrete manufacturing, the process industry, pharmaceuticals, medical technology, aerospace and energy, and it is a standard part of risk management and functional safety.

FMEA helps you proactively prevent failures before they reach a product, machine or process.

🎯 What is the purpose of FMEA?

• Identify - list every conceivable failure mode of a design or process
• Analyse - record the effects and the causes of each failure mode
• Assess - score the risk on severity, likelihood of occurrence and detectability
• Prioritise - decide which risks need measures first
• Prevent - avoid quality problems, unplanned downtime, safety incidents and recalls
• Retain knowledge - capture what is known about failure behaviour so that the next design or change can build on it

🕰️ Where does FMEA come from?

FMEA originated in the US defence sector. The military document MIL-P-1629 already described a procedure for failure mode, effects and criticality analysis in 1949, followed in 1980 by MIL-STD-1629A. In the 1960s NASA contractors used the method on programmes including Apollo, and civil aviation followed with SAE ARP926 (1967).

Ford introduced FMEA to the automotive industry in the 1970s and later applied it to manufacturing processes as well (PFMEA). The US Automotive Industry Action Group (AIAG) published a first FMEA manual in 1993, and SAE issued the J1739 standard in 1994. In June 2019 AIAG and the German VDA jointly released the AIAG & VDA FMEA Handbook, which replaces the earlier American and German methods.

The generic international standard is IEC 60812:2018 (third edition, August 2018). It explains how to plan, perform, document and maintain an FMEA and FMECA for hardware, software and processes, including human actions.

🧱 How does FMEA work?

For each component, function or process step the team answers three core questions:

1. What can go wrong? - the failure mode, for example “valve does not close”
2. What happens then? - the effect, both locally and at system level
3. Why does it happen? - the cause, for example wear, moisture or a programming error

You then score each risk on three scales, usually from 1 to 10:

Traditionally you multiply the three scores into the RPN (Risk Priority Number):

RPN = Severity × Occurrence × Detection

The RPN ranges from 1 to 1,000; the higher it is, the sooner action is needed. After implementing measures you score again to demonstrate their effect. Where possible, base the occurrence score on failure data from the maintenance system and figures such as the MTBF, so that it depends less on the team’s impression.

🔄 Why is the RPN being replaced by Action Priority?

The RPN has a well-known weakness: the scores are ordinal, so multiplying them gives misleading results. A failure mode with severity 10, occurrence 2 and detection 2 (RPN 40) gets a lower priority than a cosmetic issue scoring 4 × 5 × 5 (RPN 100), even though the first one may be life-threatening. Many companies also used a fixed threshold such as “act above RPN 100”, which no standard actually prescribes.

The 2019 AIAG & VDA Handbook therefore replaces the RPN with Action Priority (AP): tables that look at severity first, then occurrence and only then detection, producing a rating of High, Medium or Low. IEC 60812:2018 also allows alternatives, such as other RPN calculations and a criticality matrix.

🧠 What does an FMEA worksheet look like?

A simplified example for a tank with overpressure protection:

After the analysis you take targeted measures: a different design, redundancy, a fail-safe default state, extra diagnostics or predictive maintenance.

🔗 What types of FMEA are there?

The FMEDA (Failure Modes, Effects and Diagnostic Analysis) matters in functional safety: manufacturers use it to determine, per component, the safe and dangerous, detected and undetected failure rates. Those figures feed the calculation of the SIL or the Performance Level under ISO 13849-1.

🛠️ How do you carry out an FMEA in seven steps?

The AIAG & VDA Handbook describes a seven-step approach that also works well outside the automotive sector:

1. Planning and preparation - define scope, team, schedule and the rating scales you will use
2. Structure analysis - break the system down into elements, for example installation, control cabinet, PLC, I/O card
3. Function analysis - record for each element what it must do and which requirements it must meet
4. Failure analysis - link failure modes, effects and causes into a failure chain
5. Risk analysis - assess existing prevention and detection controls and score S, O and D
6. Optimisation - assign measures with an owner and a due date, then score again
7. Results documentation - report to management and customers and keep the FMEA alive

In practice a multidisciplinary team of four to eight people works best: design, production, maintenance, quality and, for OT systems, an automation engineer and a security specialist. Plan several sessions of a few hours rather than one long workshop.

🏭 How does FMEA fit into an IT/OT environment?

In industry FMEA links quality, safety and maintenance:

• Process safety - FMEA complements HAZOP: HAZOP looks at process deviations, FMEA at failure modes of individual components. LOPA and bow-tie build on both
• Machine safety - during design under ISO 13849-1 and validation under ISO 13849-2 an FMEA shows which faults were considered and how many of them the diagnostics detect; the Machinery Regulation (EU) 2023/1230, which applies from 20 January 2027, requires a documented risk assessment
• Maintenance - within asset management FMEA identifies which assets are critical and which maintenance strategy fits; the CMMS records the outcome and condition monitoring lowers the detection score
• Learning from failures - root cause analysis is reactive, FMEA proactive; every RCA can add a missing failure mode to the FMEA
• Changes - every change through change management should include a check that the FMEA is still valid

Cyber threats also belong in a modern FMEA. A manipulated setpoint or a failed network switch is a failure mode with physical consequences. FMEA is less suited to deliberate attacks, however, because an attacker does not follow a probability distribution. Combine the FMEA with threat modelling and a risk assessment under IEC 62443-3-2.

✅ What are the benefits and limitations of FMEA?

For combinations of faults a fault tree analysis (FTA) is more suitable. The techniques sit side by side in IEC 31010:2019, the toolbox that accompanies ISO 31000.

❓ Frequently asked questions

Is FMEA mandatory?

FMEA is not required by law, but in many sectors it is a de facto requirement. In the automotive industry customers and IATF 16949 audits expect a DFMEA and a PFMEA. In functional safety, medical technology and pharmaceuticals, where ICH Q9(R1) and GAMP 5 name FMEA as a tool, it is a common way to demonstrate the required risk analysis.

What is the difference between FMEA and FMECA?

FMECA is an FMEA with an additional criticality analysis, in which failure modes are ranked by severity and likelihood, often in a criticality matrix. Both are described in IEC 60812:2018. FMECA is used mainly in defence, aviation and space.

What is the difference between FMEA and HAZOP?

FMEA works bottom-up per component and asks how each part can fail. HAZOP works per process section with guide words such as “more”, “less” and “no” and looks for deviations from the design intent. In the process industry the two methods are used side by side.

What RPN value is too high?

There is no universal RPN limit; thresholds such as 100 or 125 are company conventions. A severity score of 9 or 10 always needs attention, even when the RPN is low. That is why the AIAG & VDA Handbook has used Action Priority instead of the RPN since 2019.

How often should you update an FMEA?

An FMEA is a living document. Update the FMEA after design changes, process changes, new failures or complaints, and after a root cause analysis that revealed a new failure mode. A periodic review, for example once a year, keeps the document from becoming outdated.

Can FMEA be used for software and cybersecurity?

Yes, IEC 60812:2018 applies to hardware, software and processes. FMEA works well for software faults and the failure of network components. For deliberate attacks you combine the FMEA with threat modelling and a cybersecurity risk assessment.

📌 In summary

FMEA is a systematic method for determining in advance how a design, machine or process can fail, what the consequences are and which measures are needed first.

The method dates back to US defence work in 1949, is defined internationally in IEC 60812:2018 and was renewed in automotive by the AIAG & VDA Handbook and Action Priority. In the IT/OT world FMEA connects quality management under ISO 9001, compliance, functional safety under IEC 61508 and maintenance, improving reliability and safety. Keep the FMEA alive and complement it with HAZOP, root cause analysis and threat modelling.