23.3 Failure Modes and Effects Analysis and Fault Tree Analysis

Risk analysis and safety engineering bridge reliability calculations and executive decision-making. Industrial and systems engineers must systematically identify how components fail, evaluate the cascading consequences of those failures, and implement preventative design controls. On the FE exam, risk analysis questions focus on Failure Modes and Effects Analysis (FMEA), the Risk Priority Number (RPN), and Fault Tree Analysis (FTA).

---

1. Quantitative Risk Concepts

In engineering practice, Risk is defined as the expected negative consequence of an uncertain event. Quantitatively, it is formulated as the product of the likelihood of event occurrence and the severity of the resultant impact: $\text{Risk} = \text{Probability of Occurrence} \times \text{Severity of Consequence} = P(\text{Failure}) \times C(\text{Loss})$ When multiple independent hazards $k$ threaten a system, total expected risk is: $\text{Total Risk} = \sum_{j=1}^{k} P_j \times C_j$ Engineering risk assessment employs two complementary analytical directions:

• Inductive Analysis (Bottom-Up): Starts at the component failure level and asks, "If this specific part fails in this specific mode, what is the effect on the next assembly and the overall system?" (Exemplified by FMEA).
• Deductive Analysis (Top-Down): Starts with an undesired system-level catastrophic hazard (the Top Event) and asks, "What specific combinations of component failures, software glitches, environmental conditions, and human errors could cause this hazard to occur?" (Exemplified by FTA).

                 Inductive vs. Deductive Risk Methodologies

     INDUCTIVE (Bottom-Up)                         DEDUCTIVE (Top-Down)
   Example: FMEA / FMECA                           Example: Fault Tree Analysis

  ┌─────────────────────────┐                     ┌─────────────────────────┐
  │ System Failure Effect   │ ▲                   │   Top Event (Catastrophe│
  └─────────────────────────┘ │                   └────────────┬────────────┘
               ▲              │                                │
               │ Cascading    │ Direction                      ▼ Logic Gates
               │ Effects      │ of Logic          ┌─────────────────────────┐
  ┌─────────────────────────┐ │                   │   Intermediate Events   │
  │ Subsystem Failure Mode  │ │                   └────────────┬────────────┘
  └─────────────────────────┘ │                                │
               ▲              │                                ▼
               │ Root         │                   ┌─────────────────────────┐
               │ Causes       │                   │   Basic Events (Roots)  │
  ┌─────────────────────────┐ │                   │  (Component Failures)   │
  │ Component Failure Cause │ │                   └─────────────────────────┘
  └─────────────────────────┘

---

2. Failure Modes and Effects Analysis (FMEA / FMECA)

Failure Modes and Effects Analysis (FMEA) is an inductive, proactive, bottom-up technique originally developed by the aerospace and defense sectors (MIL-STD-1629A) and extensively standardized by automotive (AIAG-VDA) and industrial bodies (SAE J1739).

Types of FMEA

• Design FMEA (DFMEA): Examines product architecture, geometry, material compatibility, tolerances, and sub-assembly interfaces before tooling release. It assumes the manufacturing process meets all drawing specifications.
• Process FMEA (PFMEA): Examines manufacturing, assembly, packaging, and logistical operations. It assumes the product design is sound, focusing instead on machine setup, tool wear, contamination, human assembly mistakes, and environmental variances.
• FMECA (Criticality Analysis): An extension of FMEA that adds quantitative failure rate data to classify failure modes according to their severe criticality and probability coordinates.

The FMEA Cross-Functional Process

An FMEA is not an individual paperwork exercise; it is conducted by a cross-functional engineering team (Design, Manufacturing, Quality, Reliability, Safety, Field Service, and Ergonomics):

1. Deconstruct the System: Break down the product or process into hierarchical elements.
2. Identify Functions: Define what each element is designed to achieve.
3. Determine Potential Failure Modes: Identify every physical way the element could fail to perform its function (e.g., fatigue crack, electrical short, seal leakage, hydraulic clogging).
4. Identify Effects of Failure: Describe the consequences of the failure on the immediate subsystem, the total machine, and the end customer.
5. Identify Causes and Mechanisms: Pinpoint the root engineering mechanisms driving the failure mode (e.g., improper torque specification, hydrogen embrittlement, thermal cycle mismatch).
6. Identify Current Controls: Catalog existing Prevention controls (preventing the cause from occurring) and Detection controls (catching the defect before release).
7. Compute the Risk Priority Number (RPN).
8. Execute Corrective Actions: Re-engineer the design or process to reduce risk, then re-rate the RPN.

---

3. The Risk Priority Number (RPN) Mechanics and Limitations

The traditional FMEA scoring metric is the Risk Priority Number (RPN), computed as the product of three subjective ordinal scores: $\text{RPN} = S \times O \times D$ Each factor is rated on an integer scale from $1$ to $10$, producing an RPN ranging from $1$ to $1,000$:

1. Severity ($S$, Scale 1–10)

Measures the seriousness of the effect on the customer, environment, or operating personnel if the failure mode occurs:

• $10$: Catastrophic hazard affecting safe operation without warning; noncompliance with government safety regulations.
• $9$: Hazard affecting safe operation with warning.
• $7 - 8$: High loss of primary product function; inoperable system requiring towing or emergency line stop.
• $4 - 6$: Moderate impact; product operates at degraded performance; customer dissatisfied.
• $2 - 3$: Minor cosmetic blemish or slight annoyance; noticed by discriminating customers.
• $1$: No discernible effect.

2. Occurrence ($O$, Scale 1–10)

Measures the likelihood or estimated frequency that the specific failure cause will occur during the product's design life:

• $10$: Almost inevitable ($\ge 1$ in $2$ or $\ge 100$ per $1,000$).
• $7 - 8$: High failure rate ($1$ in $20$ to $1$ in $100$).
• $4 - 6$: Moderate failure rate ($1$ in $1,000$ to $1$ in $10,000$).
• $2 - 3$: Low failure rate ($1$ in $100,000$ to $1$ in $1,000,000$).
• $1$: Failure is eliminated through design preventive controls ($< 1$ in $1,500,000$).

3. Detection ($D$, Scale 1–10) — The Inverse Scale Trap

Measures the inability of current design verification or process inspection controls to detect the failure mode or cause prior to release to the customer:

• $10$: Absolute uncertainty of detection; no controls exist, or controls cannot detect the flaw.
• $7 - 8$: Poor detection; reliance on visual or manual inspection post-process.
• $4 - 6$: Moderate detection; statistical process control (SPC) or automated gauging.
• $2 - 3$: High detection; automated in-line coordinate measurement or functional testing with automated lock-out.
• $1$: Almost certain detection; physical mistake-proofing (Poka-Yoke) prevents defect release.

[!WARNING] The Detection Scale Inversion: A common exam trap is assuming that a high Detection rating means good detection. In FMEA, 10 is the worst detection (undetectable) and 1 is the best detection (flawlessly caught). A higher RPN always denotes worse total risk.

Fundamental Limitations of RPN and Modern Action Priority

While widely utilized, traditional RPN has severe mathematical and managerial drawbacks tested on the FE exam:

1. Ordinal Multiplication Fallacy: Multiplying three ordinal numbers ($S, O, D$) is mathematically unsound. An RPN of 100 does not represent twice the risk of an RPN of 50.
2. Distribution Gaps: Out of 1,000 possible RPN values ($1$ to $1,000$), only 120 unique integers can be produced due to permutations of products, leaving vast gaps in the scale.
3. Severe Risk Masking: Different permutations produce identical or deceptive RPN values that mislead prioritization:
   • Case A: $S = 10, O = 1, D = 4 \implies \text{RPN} = 40$. (A lethal safety hazard with low occurrence and moderate detection).
   • Case B: $S = 2, O = 5, D = 5 \implies \text{RPN} = 50$. (A minor squeak/rattle cosmetic defect).
   • If a management team blindly mandates a corrective action threshold of $\text{RPN} \ge 100$, neither item is addressed, leaving a catastrophic safety hazard ($S = 10$) in production!
4. Action Priority (AP) Evolution: Under the updated AIAG-VDA FMEA standard, arbitrary RPN threshold numbers are banned. Instead, risk is prioritized through a logic-driven Action Priority (High, Medium, Low) table where Severity is evaluated first. Any failure mode with $S = 9$ or $10$ mandates engineering action regardless of low Occurrence or high Detection.

---

4. Fault Tree Analysis (FTA)

Fault Tree Analysis (FTA) is a deductive, top-down failure analysis technique originated in 1962 by H.A. Watson at Bell Telephone Laboratories to evaluate the Minuteman launch control system, later adopted across aerospace (NASA), nuclear power (NRC), and chemical processing.

Fault Tree Symbology

FTA uses standard logic gate and event symbols to diagram the structural relationship between basic initiating events and the system hazard:

                          Standard Fault Tree Symbols

      EVENTS:                                LOGIC GATES:
  ┌──────────────┐                       ┌──────────────┐
  │  Top Event   │ Output Event          │   AND Gate   │ Output occurs only if
  │ (Rectangle)  │ (System Hazard)       │    ( ∩ )     │ ALL inputs occur
  └──────────────┘                       └──────────────┘
  ┌──────────────┐                       ┌──────────────┐
  │ Basic Event  │ Primary Component     │   OR Gate    │ Output occurs if
  │   (Circle)   │ Failure (Empirical)   │    ( ∪ )     │ ANY input occurs
  └──────────────┘                       └──────────────┘
  ┌──────────────┐                       ┌──────────────┐
  │ Undeveloped  │ Event not pursued     │   Inhibit    │ Output occurs if input
  │  (Diamond)   │ due to lack of info   │    (Oval)    │ occurs + condition met
  └──────────────┘                       └──────────────┘

• Rectangle: Represents the Top Event (undesired catastrophic failure) or Intermediate Events resulting from logic combinations of lower events.
• Circle: Represents a Basic Event—an initiating component failure, human error, or software glitch that cannot be broken down further and for which empirical failure probability data is available.
• Diamond: Represents an Undeveloped Event—an event that is not further decomposed because of insufficient information or minor consequence.

Logic Gate Mathematics

           AND Gate Logic                          OR Gate Logic

             ┌─────────┐                            ┌─────────┐
             │ Output  │                            │ Output  │
             └────┬────┘                            └────┬────┘
                  │                                      │
               ┌──┴──┐                                ┌──┴──┐
               │ AND │                                │ OR  │
               └──┬──┘                                └──┬──┘
            ┌─────┴─────┐                          ┌─────┴─────┐
            ▼           ▼                          ▼           ▼
       ┌─────────┐ ┌─────────┐                ┌─────────┐ ┌─────────┐
       │ Event A │ │ Event B │                │ Event A │ │ Event B │
       └─────────┘ └─────────┘                └─────────┘ └─────────┘
     P(Out) = P(A) · P(B)                   P(Out) = 1 - (1-P(A))(1-P(B))

1. The AND Gate

The output event occurs if and only if all input events occur simultaneously. For $m$ independent input events $E_1, E_2, \dots, E_m$: $P(\text{Output}) = P(E_1 \cap E_2 \cap \dots \cap E_m) = \prod_{i=1}^{m} P(E_i)$ The AND gate represents system redundancy. If inputs have small probabilities (e.g., $P_1 = 0.01, P_2 = 0.02$), the output probability is extremely small ($P = 0.0002$).

2. The OR Gate

The output event occurs if any one or more of the input events occur. For $m$ independent input events: $P(\text{Output}) = P(E_1 \cup E_2 \cup \dots \cup E_m) = 1 - \prod_{i=1}^{m} \left[1 - P(E_i)\right]$

• Rare Event Approximation: When input probabilities are small ($P(E_i) < 0.10$), the higher-order product terms in the expansion become negligible, yielding a conservative upper bound: $P(\text{Output}) \approx \sum_{i=1}^{m} P(E_i)$ On the FE exam, use the exact formula unless the problem explicitly states to use the rare event approximation.

---

5. Cut Sets and Minimal Cut Sets (MCS)

Evaluating the architecture of a fault tree requires converting Boolean gate logic into Cut Sets.

Definitions

• Cut Set: Any group of basic events whose simultaneous occurrence forces the Top Event to occur.
• Minimal Cut Set (MCS): A cut set that cannot be reduced further. If any single basic event is removed from the minimal cut set, the remaining events are no longer sufficient to cause the Top Event.

Qualitative Significance of Minimal Cut Sets

• 1-Event Minimal Cut Set: Represents a Single-Point Failure (SPF). The Top Event is vulnerable to the failure of a single basic component. In high-reliability and aerospace engineering, single-point failures causing catastrophic hazards are prohibited.
• 2-Event Minimal Cut Set: Indicates double redundancy. Two independent components must fail simultaneously to trigger the hazard.
• Structural Vulnerability: The overall structural weakness of a system is dictated primarily by the order (size) and number of its minimal cut sets. Eliminating 1-event cut sets is the highest safety priority.

Quantitative Top Event Probability Calculation

Once all $k$ minimal cut sets $C_1, C_2, \dots, C_k$ are identified, the Top Event $T$ is the Boolean union of the minimal cut sets: $T = C_1 \cup C_2 \cup C_3 \cup \dots \cup C_k$ Because different cut sets may share common basic events, the cut sets are not mutually exclusive. The exact probability is computed via the Inclusion-Exclusion Principle or bounded by the Upper Bound Approximation: $P(T) \le 1 - \prod_{j=1}^{k} \left[1 - P(C_j)\right] \le \sum_{j=1}^{k} P(C_j)$

---

6. Step-by-Step Worked Engineering Calculations

Worked Example 23.3.1: FMEA RPN Calculation and Risk Masking

Problem: A medical device manufacturing engineering team conducts a DFMEA on a portable insulin infusion pump. Two potential failure modes are evaluated:

• Failure Mode 1 (Drive motor gear tooth fracture): Leads to complete cessation of insulin delivery. The team assigns: Severity $S = 9$ (severe physiological impact), Occurrence $O = 2$ ($1$ in $20,000$ cycles), Detection $D = 8$ (internal gear hidden inside sealed housing; no telemetry sensor).
• Failure Mode 2 (Battery door latch looseness): Leads to loose door rattle during jogging. The team assigns: Severity $S = 3$ (minor customer nuisance), Occurrence $O = 7$ ($1$ in $50$ units), Detection $D = 4$ (assembly line operator feel during packing).

1. Compute the RPN for both failure modes.
2. A corporate policy requires corrective action for any failure mode with $\text{RPN} > 120$. Determine which failure mode receives action under this policy, and explain why this demonstrates the fundamental danger of blind RPN threshold management.

Solution:

Step 1: Compute RPN Values $\text{RPN}_1 = S_1 \times O_1 \times D_1 = 9 \times 2 \times 8 = 144$ $\text{RPN}_2 = S_2 \times O_2 \times D_2 = 3 \times 7 \times 4 = 84$

Step 2: Policy Evaluation and Risk Analysis

• Under the $\text{RPN} > 120$ rule, Failure Mode 1 receives corrective action ($144 > 120$), while Failure Mode 2 is ignored ($84 \le 120$).
• Now consider an alternative design for Failure Mode 1 where better quality control drops $D$ from $8$ to $3$ (automated acoustic testing). Then $\text{RPN}_1 = 9 \times 2 \times 3 = 54$. Under the blind $\text{RPN} > 120$ threshold, Failure Mode 1 would now be ignored, despite remaining a life-threatening failure ($S = 9$)! This illustrates why modern standards mandate prioritizing Severity $S \ge 9$ regardless of total RPN.

---

Worked Example 23.3.2: Quantitative Fault Tree Analysis and Minimal Cut Sets

Problem: A high-pressure chemical reactor vessel has an overpressure Top Event ($T$). Overpressure occurs if high pressure is generated ($E_{\text{HP}}$) AND the pressure relief system fails ($E_{\text{PR}}$).

• High pressure is generated ($E_{\text{HP}}$) if either the exothermic reaction runs away (Basic Event $B_1$, with $P(B_1) = 0.02$) OR the raw material feed valve sticks wide open (Basic Event $B_2$, with $P(B_2) = 0.05$). These inputs enter an OR gate.
• The pressure relief system fails ($E_{\text{PR}}$) if both the primary spring-loaded relief valve fails to lift (Basic Event $B_3$, with $P(B_3) = 0.04$) AND the emergency rupture disc fails to burst (Basic Event $B_4$, with $P(B_4) = 0.01$). These inputs enter an AND gate.

                     Fault Tree Diagram for Example 23.3.2

                             ┌────────────────────────┐
                             │   Top Event (T):       │
                             │  Reactor Overpressure  │
                             └───────────┬────────────┘
                                         │
                                      ┌──┴──┐
                                      │ AND │ G₁
                                      └──┬──┘
                        ┌────────────────┴────────────────┐
                        ▼                                 ▼
             ┌────────────────────┐            ┌────────────────────┐
             │ E_HP: High Press   │            │ E_PR: Relief Fails │
             │    Generated       │            │                    │
             └─────────┬──────────┘            └─────────┬──────────┘
                       │                                 │
                    ┌──┴──┐                           ┌──┴──┐
                    │ OR  │ G₂                        │ AND │ G₃
                    └──┬──┘                           └──┬──┘
               ┌───────┴───────┐                 ┌───────┴───────┐
               ▼               ▼                 ▼               ▼
        ┌─────────────┐ ┌─────────────┐   ┌─────────────┐ ┌─────────────┐
        │ B₁: Runaway │ │ B₂: Valve   │   │ B₃: Relief  │ │ B₄: Rupture │
        │  Reaction   │ │   Sticks    │   │ Valve Fails │ │ Disc Fails  │
        │ (P = 0.02)  │ │ (P = 0.05)  │   │ (P = 0.04)  │ │ (P = 0.01)  │
        └─────────────┘ └─────────────┘   └─────────────┘ └─────────────┘

1. Express the Top Event $T$ as a Boolean algebraic function of the basic events $B_1, B_2, B_3, B_4$.
2. Identify all Minimal Cut Sets (MCS) and their orders.
3. Compute the exact probability of the Top Event $P(T)$, assuming independent basic events.

Solution:

Step 1: Boolean Algebraic Formulation

• Gate $G_2$ (OR gate): $E_{\text{HP}} = B_1 \cup B_2$
• Gate $G_3$ (AND gate): $E_{\text{PR}} = B_3 \cap B_4$
• Gate $G_1$ (AND gate): $T = E_{\text{HP}} \cap E_{\text{PR}} = (B_1 \cup B_2) \cap (B_3 \cap B_4)$ Distributing the intersection across the union: $T = (B_1 \cap B_3 \cap B_4) \cup (B_2 \cap B_3 \cap B_4)$

Step 2: Identify Minimal Cut Sets The system has two Minimal Cut Sets, both of order 3:

• $\text{MCS}_1 = {B_1, B_3, B_4}$
• $\text{MCS}_2 = {B_2, B_3, B_4}$ There are no single-point or two-point failures; at least three basic events must occur concurrently to produce the catastrophic top event.

Step 3: Quantitative Calculation First, compute the probabilities of the intermediate events:

• Probability of High Pressure ($E_{\text{HP}}$, OR gate): $P(E_{\text{HP}}) = 1 - [1 - P(B_1)][1 - P(B_2)] = 1 - (1 - 0.02)(1 - 0.05) = 1 - (0.98)(0.95) = 1 - 0.9310 = 0.0690$
• Probability of Relief Failure ($E_{\text{PR}}$, AND gate): $P(E_{\text{PR}}) = P(B_3) \times P(B_4) = (0.04) \times (0.01) = 0.0004$
• Probability of Top Event ($T$, AND gate): Because $E_{\text{HP}}$ and $E_{\text{PR}}$ depend on completely disjoint basic events (${B_1, B_2}$ vs ${B_3, B_4}$), they are statistically independent: $P(T) = P(E_{\text{HP}}) \times P(E_{\text{PR}}) = (0.0690) \times (0.0004) = 0.0000276 = 2.76 \times 10^{-5}$

---

7. NCEES Reference Handbook Tips & Realistic Exam Traps

• Inductive vs. Deductive Directions: Remember: FMEA is inductive (bottom-up) moving from component failure cause to system effect. FTA is deductive (top-down) moving from top catastrophic hazard down to component roots.
• The Inverted Detection Rating: Always double-check your understanding of the Detection score $D$. A score of $D = 1$ is ideal (100% automated mistake-proofing); $D = 10$ means undetectable. Never invert this on an RPN problem.
• AND Gate vs. OR Gate Probabilities:
  • For independent inputs, AND gates multiply: $P = \prod P_i$. Output probability is always smaller than the smallest input.
  • For independent inputs, OR gates probabilistically add: $P = 1 - \prod (1 - P_i)$. Output probability is always larger than the largest input.
• Minimal Cut Set Independence Trap: When combining cut sets that share common basic events, you cannot simply add their probabilities without creating double-counting errors. Use Boolean reduction or the Inclusion-Exclusion principle.