12.5 Failure Mode and Effects Analysis (FMEA) & Fault Tree Analysis (FTA)
Key Takeaways
- FMEA is inductive and bottom-up, starting from a single failure mode and asking what it causes; FTA is deductive and top-down, starting from one undesired top event and asking what combinations could cause it.
- Detection is rated inversely: a rating of 1 means the control almost certainly detects the failure, and a rating of 10 means it cannot be detected at all.
- RPN is the product of Severity, Occurrence, and Detection with a maximum of 1000, but equal RPNs can represent very different risks, which is why the 2019 AIAG-VDA handbook replaced RPN thresholds with Action Priority ratings of High, Medium, and Low.
- Prevention controls reduce Occurrence, detection controls reduce Detection, and Severity can normally be reduced only by a design change — so adding inspection never lowers Severity.
- A minimal cut set is the smallest combination of basic events that will cause the top event; a single-element cut set identifies a single point of failure.
Two Complementary Risk Tools
The problem-solving methods in section 12.2 — PDCA, 5 Whys, DMAIC — are largely reactive: something went wrong and you work back to why. FMEA and FTA are the structured risk analysis methods that sit alongside them, and they approach risk from opposite directions.
| FMEA | FTA | |
|---|---|---|
| Logic direction | Inductive, bottom-up | Deductive, top-down |
| Starting point | One failure mode of one item | One undesired top event |
| Question asked | "If this fails, what happens?" | "For this to happen, what must fail?" |
| Handles combinations | Poorly — one failure mode at a time | Well — AND gates model combinations |
| Primary output | Ranked risks and actions | Minimal cut sets and top-event probability |
| Typical form | A structured worksheet | A logic diagram |
They are complements, not competitors. FMEA is broad and catches many single-point risks; FTA is narrow and deep, and is the right tool once a specific catastrophic outcome has been identified.
Failure Mode and Effects Analysis
Types
- DFMEA (Design FMEA) analyzes failure modes of the product design — a shaft that fractures, a seal that extrudes, a circuit that opens.
- PFMEA (Process FMEA) analyzes failure modes of the manufacturing or assembly process — a hole drilled undersize, a fastener omitted, a wrong component installed. This is the FMEA a quality inspector interacts with daily, because the inspection stations on the floor exist largely as PFMEA detection controls.
- FMEA-MSR (Monitoring and System Response), introduced in the 2019 AIAG-VDA handbook, analyzes failure causes that occur in customer operation and the system's ability to detect and respond to them.
When It Is Done
FMEA is a pre-production, preventive activity. In advanced product quality planning it is developed before process validation, and it drives the control plan, which in turn drives the inspection plan. It is then a living document: it is updated when the design or process changes, when a new failure mode appears in production or in the field, and when a corrective action changes a control.
Anatomy of a PFMEA Line
| Column | Content |
|---|---|
| Process step / function | What the operation is supposed to accomplish |
| Requirement | The specific characteristic and its specification |
| Potential failure mode | How the requirement could fail to be met |
| Potential effect(s) of failure | What the customer or next operation experiences |
| Severity (S) | 1 to 10 rating of the worst effect |
| Potential cause(s) | Why the failure mode would occur |
| Occurrence (O) | 1 to 10 rating of how often the cause is expected |
| Current prevention controls | Controls that stop the cause from happening |
| Current detection controls | Controls that find the failure before it escapes |
| Detection (D) | 1 to 10 rating of how well the detection controls work |
| RPN or Action Priority | Risk ranking |
| Recommended actions, owner, due date | What will be done, by whom, by when |
| Revised S, O, D and ranking | The result after actions are implemented |
The Rating Scales
All three scales run 1 to 10, but they do not all run in the same intuitive direction, and this is the single most tested point in the topic.
- Severity (S). 1 = no discernible effect; 10 = potential failure affects safe operation or involves noncompliance with regulation, without warning. Higher is worse.
- Occurrence (O). 1 = failure is eliminated through prevention control or is extremely remote; 10 = failure is nearly inevitable. Higher is worse.
- Detection (D). 1 = the control almost certainly detects the failure; 10 = the failure cannot be detected, or there is no control at all. Higher is worse — meaning harder to detect.
Candidates routinely invert Detection, reasoning that a high number ought to mean good detection. It means the opposite. D = 10 means blind.
Risk Priority Number and Its Successor
The classic ranking is:
with a maximum of 10 x 10 x 10 = 1000.
RPN has well-known weaknesses. An RPN of 120 can arise as 10 x 4 x 3 (a safety-critical failure that is uncommon and well detected) or as 2 x 6 x 10 (a trivial failure that is common and undetectable). Those are very different risks with identical numbers. RPN is also an ordinal product, so it is not a probability and the arithmetic distance between two RPNs has no physical meaning.
For that reason the AIAG-VDA FMEA Handbook (2019) replaced RPN threshold rules with Action Priority (AP), a lookup that considers S first, then O, then D and returns High, Medium, or Low. High priority requires action or a documented justification for taking none.
The rule that survives every revision: a Severity of 9 or 10 demands attention regardless of Occurrence, Detection, RPN, or AP. A rare, well-detected safety failure is still a safety failure.
Where Actions Attack the Risk
| To reduce | Do this | Do not expect |
|---|---|---|
| Severity | Change the design so the failure's consequence is less serious, or add a design feature that contains it | Inspection to help; adding a check never changes what happens when the part fails |
| Occurrence | Prevention controls — error-proofing, process capability improvement, tooling change, material change | Inspection to help; screening does not stop the cause |
| Detection | Detection controls — inspection, gaging, automated verification, functional test | Detection improvements to reduce how often the failure occurs |
This table is the inspector's professional stake in FMEA. The inspection you perform is a detection control: it lowers D and nothing else. Prevention is always preferable, and a PFMEA that responds to every high risk by adding another inspection station is being used badly.
Worked Mini-Example
A PFMEA line for a press-fit bearing operation:
- Process step: press bearing into housing bore
- Failure mode: bearing pressed to insufficient depth
- Effect: bearing walks out under load, shaft seizes, vehicle loses steering assist. S = 9
- Cause: press stroke stop drifts out of adjustment. O = 4
- Current detection control: operator visual check for a flush face. D = 7 (visual, subjective, hard to see a 0.5 mm shortfall)
Severity 9 forces action regardless of the number. The team implements a press-force and depth monitoring system with an automatic reject — a detection control that drops D from 7 to 2 — and re-designs the stop as a hard mechanical shoulder rather than an adjustable stop, a prevention control that drops O from 4 to 2.
Severity remains 9 and always will, because the consequence of a bearing walking out has not changed. Only a design change to the assembly could reduce it. This is the point candidates most often miss.
Fault Tree Analysis
Fault tree analysis, standardized in IEC 61025, starts at a single top event — a specific, well-defined undesired outcome such as "brake system fails to apply" or "sterile barrier breached" — and works downward through Boolean logic to the combinations of lower-level failures that could produce it.
Symbols
| Symbol | Name | Meaning |
|---|---|---|
| Rectangle | Intermediate event | A fault produced by lower events through a gate |
| Circle | Basic event | A root failure requiring no further development |
| Diamond | Undeveloped event | A fault not developed further, for lack of information or significance |
| House | External / normal event | An event expected to occur normally |
| AND gate | Logic | Output occurs only if all inputs occur |
| OR gate | Logic | Output occurs if any input occurs |
| Triangle | Transfer | Links to a branch drawn elsewhere |
Reading the Gates
The gates carry the analytical meaning:
- An OR gate means the events below it are independent paths to failure. Any one of them is sufficient. OR gates propagate risk upward easily.
- An AND gate means the events below it must all occur together. AND gates represent redundancy and defense in depth — this is where a design is strong.
For independent basic events, quantification follows the logic:
- AND gate: the output probability is the product of the input probabilities. Two independent events at 0.01 each give 0.0001.
- OR gate: the output probability is approximately the sum for small probabilities. Two independent events at 0.01 each give approximately 0.02.
Minimal Cut Sets
A cut set is any combination of basic events that, occurring together, causes the top event. A minimal cut set is a cut set from which no event can be removed without breaking it.
Minimal cut sets are the practical output of an FTA:
- A single-element minimal cut set is a single point of failure — one basic event alone causes the top event. These are the findings that justify redesign.
- Cut set order (the number of events in it) indicates robustness: first-order cut sets are the most dangerous, and higher-order cut sets require more simultaneous failures.
- Cut sets that share a common event reveal common-cause vulnerability, where one root failure defeats what looks like redundancy.
Simple Example
Top event: no leak test performed on a shipped pressure vessel.
Under an AND gate: (a) the automated leak tester fails silently, and (b) the final inspector's independent verification is not performed.
Branch (a), under an OR gate: sensor drift, software verdict logic disabled, or calibration lapsed. Branch (b), under an OR gate: the traveler step was skipped, the inspector accepted the machine's green light without verifying, or the verification step was never written into the plan.
The structure immediately shows two things. First, the AND gate is the protection — both layers must fail. Second, if the inspector's practice is simply to accept the tester's green light, then branch (b) is effectively always true, the AND gate collapses, and every event in branch (a) becomes a single-point failure. That insight is exactly what FTA is for, and it is invisible in a PFMEA that examines each control separately.
Choosing Between Them
| Situation | Tool |
|---|---|
| Systematically screening every process step for risk before launch | PFMEA |
| Deciding where inspection stations belong and what a control plan should contain | PFMEA |
| Analyzing one specific catastrophic or regulatory outcome in depth | FTA |
| Finding single points of failure and verifying that redundancy is real | FTA |
| Quantifying the probability of a defined top event | FTA |
| Prioritizing many moderate risks against one another | PFMEA |
Well-run organizations use both: FMEA broadly across the process, and FTA on the handful of severity-9-and-10 outcomes the FMEA surfaces.
Common Exam Traps
- Detection is inverted. D = 1 is excellent detection; D = 10 means undetectable.
- Inspection lowers D only. It does not lower Occurrence and never lowers Severity.
- Severity is reduced by design change. No process or inspection action changes what happens when the part fails.
- Equal RPNs are not equal risks, which is why Action Priority replaced RPN thresholds in the 2019 AIAG-VDA handbook. Maximum RPN is 1000.
- FMEA is inductive and bottom-up; FTA is deductive and top-down. If the stem starts with one undesired outcome and asks what could cause it, the answer is FTA.
- AND gates multiply, OR gates approximately add.
- A single-element minimal cut set is a single point of failure.
- FMEA is preventive and pre-production. An FMEA created after a field failure to explain it is being used as documentation, not as risk analysis.
A process FMEA line has Severity 8, Occurrence 5, and Detection 2. The team proposes adding a second visual inspection station to reduce risk. What is the most significant limitation of this proposal?
A fault tree analysis of a top event yields a minimal cut set containing exactly one basic event. What does this tell the analyst?
Two process FMEA lines both compute to an RPN of 180. Line 1 is rated S=10, O=3, D=6. Line 2 is rated S=4, O=9, D=5. What does this comparison illustrate about RPN?