Failure mode, effects and criticality analysis is an extension of failure mode
and effects analysis. FMEA is a bottom-up, inductive
analytical method which may be performed at either the functional or piece-part
level. FMECA extends FMEA by including a criticality analysis, which is used to
chart the probability of failure modes against the severity of their
consequences. The result highlights failure modes with relatively high
probability and severity of consequences, allowing remedial effort
to be directed where it will produce the greatest value. FMECA tends to be
preferred over FMEA in space and North Atlantic Treaty Organization military
applications, while various forms of FMEA predominate in other industries.
History FMECA was originally developed in the
1940s by the U.S military, which published MIL–P–1629 in 1949. By the
early 1960s, contractors for the U.S. National Aeronautics and Space
Administration were using variations of FMECA under a variety of names. In 1966
NASA released its FMECA procedure for use on the Apollo program. FMECA was
subsequently used on other NASA programs including Viking, Voyager, Magellan, and
Galileo. Possibly because MIL–P–1629 was replaced by MIL–STD–1629 in 1974,
development of FMECA is sometimes incorrectly attributed to NASA. At the
same time as the space program developments, use of FMEA and FMECA was
already spreading to civil aviation. In 1967 the Society for Automotive
Engineers released the first civil publication to address FMECA. The civil
aviation industry now tends to use a combination of FMEA and Fault Tree
Analysis in accordance with SAE ARP4761 instead of FMECA, though some helicopter
manufacturers continue to use FMECA for civil rotorcraft.
Ford Motor Company began using FMEA in the 1970s after problems experienced
with its Pinto model, and by the 1980s FMEA was gaining broad use in the
automotive industry. In Europe, the International Electrotechnical
Commission published IEC 812 in 1985, addressing both FMEA and FMECA for
general use. The British Standards Institute published BS 5760–5 in 1991
for the same purpose. In 1980, MIL–STD–1629A replaced both
MIL–STD–1629 and the 1977 aeronautical FMECA standard MIL–STD–2070.
MIL–STD–1629A was canceled without replacement in 1998, but nonetheless
remains in wide use for military and space applications today.
Methodology Slight differences are found between the
various FMECA standards. By RAC CRTA–FMECA, the FMECA analysis procedure
typically consists of the following logical steps:
Define the system Define ground rules and assumptions in
order to help drive the design Construct system block diagrams
Identify failure modes Analyze failure effects/causes
Feed results back into design process Classify the failure effects by severity
Perform criticality calculations Rank failure mode criticality
Determine critical items Feed results back into design process
Identify the means of failure detection, isolation and compensation
Perform maintainability analysis Document the analysis, summarize
uncorrectable design areas, identify special controls necessary to reduce
failure risk Make recommendations
Follow up on corrective action implementation/effectiveness
FMECA may be performed at the functional or piece part level. Functional FMECA
considers the effects of failure at the functional block level, such as a power
supply or an amplifier. Piece part FMECA considers the effects of individual
component failures, such as resistors, transistors, microcircuits, or valves. A
piece part FMECA requires far more effort, but provides the benefit of
better estimates of probabilities of occurrence. However, Functional FMEAs
can be performed much earlier, may help to better structure the complete risk
assessment and provide other type of insight in mitigation options. The
analyses are complementary. The criticality analysis may be
quantitative or qualitative, depending on the availability of supporting part
failure data. = System definition =
In this step, the major system to be analyzed is defined and partitioned into
an indentured hierarchy such as systems, subsystems or equipment, units or
subassemblies, and piece parts. Functional descriptions are created for
the systems and allocated to the subsystems, covering all operational
modes and mission phases. = Ground rules and assumptions =
Before detailed analysis takes place, ground rules and assumptions are usually
defined and agreed to. This might include, for example:
Standardized mission profile with specific fixed duration mission phases
Sources for failure rate and failure mode data
Fault detection coverage that system built-in test will realize
Whether the analysis will be functional or piece part
Criteria to be considered System for uniquely identifying parts or
functions Severity category definitions
= Block diagrams = Next, the systems and subsystems are
depicted in functional block diagrams. Reliability block diagrams or fault
trees are usually constructed at the same time. These diagrams are used to
trace information flow at different levels of system hierarchy, identify
critical paths and interfaces, and identify the higher level effects of
lower level failures. = Failure mode identification =
For each piece part or each function covered by the analysis, a complete list
of failure modes is developed. For functional FMECA, typical failure modes
include: Untimely operation
Failure to operate when required Loss of output
Intermittent output Erroneous output
Invalid output For piece part FMECA, failure mode data
may be obtained from databases such as RAC FMD–91 or RAC FMD–97. These
databases provide not only the failure modes, but also the failure mode ratios.
For example: Each function or piece part is then
listed in matrix form with one row for each failure mode. Because FMECA usually
involves very large data sets, a unique identifier must be assigned to each
item, and to each failure mode of each item.
= Failure effects analysis = Failure effects are determined and
entered for each row of the FMECA matrix, considering the criteria
identified in the ground rules. Effects are separately described for the local,
next higher, and end levels. System level effects may include:
System failure Degraded operation
System status failure No immediate effect
The failure effect categories used at various hierarchical levels are tailored
by the analyst using engineering judgment.
= Severity classification = Severity classification is assigned for
each failure mode of each unique item and entered on the FMECA matrix, based
upon system level consequences. A small set of classifications, usually having 3
to 10 severity levels, is used. For example, When prepared using
MIL–STD–1629A, failure or mishap severity classification normally follows
MIL–STD–882. Current FMECA severity categories for
U.S. Federal Aviation Administration, NASA and European Space Agency space
applications are derived from MIL–STD–882.
= Failure detection methods = For each component and failure mode, the
ability of the system to detect and report the failure in question is
analyzed. One of the following will be entered on each row of the FMECA matrix:
Normal: the system correctly indicates a safe condition to the crew
Abnormal: the system correctly indicates a malfunction requiring crew action
Incorrect: the system erroneously indicates a safe condition in the event
of malfunction, or alerts the crew to a malfunction that does not exist
= Criticality ranking = Failure mode criticality assessment may
be qualitative or quantitative. For qualitative assessment, a mishap
probability code or number is assigned and entered on the matrix. For example,
MIL–STD–882 uses five probability levels:
The failure mode may then be charted on a criticality matrix using severity code
as one axis and probability level code as the other. For quantitative
assessment, modal criticality number is calculated for each failure mode of each
item, and item criticality number is calculated for each item. The
criticality numbers are computed using the following values:
Basic failure rate Failure mode ratio
Conditional probability Mission phase duration
The criticality numbers are computed as and . The basic failure rate is usually
fed into the FMECA from a failure rate prediction based on MIL–HDBK–217, PRISM,
RIAC 217Plus, or a similar model. The failure mode ratio may be taken from a
database source such as RAC FMD–97. For functional level FMECA, engineering
judgment may be required to assign failure mode ratio. The conditional
probability number represents the conditional probability that the failure
effect will result in the identified severity classification, given that the
failure mode occurs. It represents the analyst's best judgment as to the
likelihood that the loss will occur. For graphical analysis, a criticality matrix
may be charted using either or on one axis and severity code on the other.
= Critical item/failure mode list = Once the criticality assessment is
completed for each failure mode of each item, the FMECA matrix may be sorted by
severity and qualitative probability level or quantitative criticality
number. This enables the analysis to identify critical items and critical
failure modes for which design mitigation is desired.
= Recommendations = After performing FMECA, recommendations
are made to design to reduce the consequences of critical failures. This
may include selecting components with higher reliability, reducing the stress
level at which a critical item operates, or adding redundancy or monitoring to
the system. = Maintainability analysis =
FMECA usually feeds into both Maintainability Analysis and Logistics
Support Analysis, which both require data from the FMECA.
= FMECA report = A FMECA report consists of system
description, ground rules and assumptions, conclusions and
recommendations, corrective actions to be tracked, and the attached FMECA
matrix which may be in spreadsheet, worksheet, or database form.
Risk priority calculation RAC CRTA–FMECA and MIL–HDBK–338 both
identify Risk Priority Number calculation as an alternate method to
criticality analysis. The RPN is a result of a multiplication of
detectability x severity x occurrence. With each on a scale from 1 to 10, the
highest RPN is 10x10x10 = 1000. This means that this failure is not
detectable by inspection, very severe and the occurrence is almost sure. If
the occurrence is very sparse, this would be 1 and the RPN would decrease to
100. So, criticality analysis enables to focus on the highest risks.
Advantages and disadvantages Strengths of FMECA include its
comprehensiveness, the systematic establishment of relationships between
failure causes and effects, and its ability to point out individual failure
modes for corrective action in design. Weaknesses include the extensive labor
required, the large number of trivial cases considered, and inability to deal
with multiple-failure scenarios or unplanned cross-system effects such as
sneak circuits. According to an FAA research report for
commercial space transportation, Failure Modes, effects, and Criticality
Analysis is an excellent hazard analysis and risk assessment tool, but it suffers
from other limitations. This alternative does not consider combined failures or
typically include software and human interaction considerations. It also
usually provides an optimistic estimate of reliability. Therefore, FMECA should
be used in conjunction with other analytical tools when developing
reliability estimates. See also
Integrated logistics support Risk assessment
Reliability engineering Safety engineering
System safety FMEA
RAMS Further reading
"FMEA and FMECA Examples" "FMEA and FMECA: An Overview of Basic
Concepts" "FMEA Info Centre"
"FMEA and FMECA / RCM : Integration to SAP EAM"
References