FMEA
Artifact
Topic overview
Quick facts
FMEA works upward from the parts: for each component or function, the team lists the ways it can fail, the local and system-level effects of each failure mode, the causes, and the controls that prevent or detect it. Design FMEA addresses product design failure modes; Process FMEA addresses manufacturing and assembly escapes; system-level FMEAs address functions and interfaces.
Each line is typically scored for severity, occurrence, and detection, and the scores prioritize corrective actions, with modern automotive practice (the AIAG-VDA handbook) using action priority tables rather than the older multiplied risk priority number.
In functional safety the FMEA serves two distinct purposes. Qualitatively, it demonstrates that single faults have been systematically considered and that the design's fault reactions are adequate, evidence assessors expect at any integrity level.
Quantitatively, it is often extended to an , where each failure mode also receives a failure rate and a safe/dangerous, detected/undetected classification, producing the hardware metrics the standards require.
The method's known blind spot is combinations: FMEA examines one failure at a time, so multi-fault scenarios and common-cause effects need the complementary top-down view of fault tree analysis. Standards for higher integrity levels expect both perspectives.
The case for FMEA
The FMEA is usually the first analysis a customer safety team or assessor asks to see, and its quality signals the maturity of the whole engineering organization.
Done early, it is the cheapest way to find single points of failure while they can still be designed out; done late, it becomes documentation theater that discovers problems after tooling and certification testing are paid for.
In automotive and machinery supply chains a credible FMEA is contractually required, and its severity ratings feed directly into which requirements become safety requirements with all the attendant cost.
FMEA in practice
Safety lifecycle
A cross-functional team, design owner, safety engineer, test, manufacturing where relevant, works through the structure systematically during detailed design, before design freeze, using the drawing tree or function tree as the backbone. Inputs are the requirements, schematics or CAD, interface definitions, and field failure history from similar products.
Each failure mode gets effects, causes, current controls, and ratings; actions are assigned for high-priority items and tracked to closure, with the FMEA updated as the design changes.
Assessors look for coverage (all safety-relevant components and interfaces present), honest effects analysis that traces to hazard level, actions actually closed rather than perpetually open, and revision history proving the FMEA lived alongside the design rather than being written for the audit.
Where teams get FMEA wrong
FMEA and its standards
IEC 61508 sets the requirements that FMEA work has to satisfy: the umbrella functional safety standard defining the safety lifecycle, sil levels, and requirements for electrical, electronic, and programmable systems.
Assessors evaluate FMEA against ISO 26262, automotive functional safety standard defining asil levels and the automotive safety lifecycle.
FMEA ownership and review
| Aspect | Detail |
|---|---|
| Produced by | Cross-functional team led by design/quality engineer |
| Inputs | Architecture, block diagrams, requirements, field history |
| Outputs | Failure modes, effects, S/O/D ratings, actions |
| Reviewed by | Safety engineer, customer auditors, assessor |
| Distinct from FMEDA | Qualitative; no failure-rate quantification |
Industries where FMEA applies
In industrial machinery, FMEA comes up in nearly every certification conversation: fixed and mobile machinery, packaging lines, and manufacturing equipment.
FMEA shapes how autonomous systems teams argue safety - autonomous mobile equipment, off-highway autonomy, and driverless platforms.
Ask our team about FMEA
Ben TwomblyFounder & CEOLeads CSA's functional-safety, certification, and engineering programs for safety-critical products and organizations. His assessor-side background informs practical programs that connect standards, engineering work, and credible evidence.
Tom CyrPrincipal Safety Engineer, IFSPSupports industrial and rail functional-safety programs with safety analysis, requirements, lifecycle planning, and certification-readiness guidance.Terms related to FMEA
How each connects to FMEA:
FMEDA appears in the same lifecycle work as FMEA and is usually produced or reviewed alongside it.
Fault Tree Analysis appears in the same lifecycle work as FMEA and is usually produced or reviewed alongside it.
IEC 61508 connects the two: FMEA and Functional Safety are assessed against the same lifecycle.
SIL is governed by IEC 61508 as well, which is why the two show up together in audits.
Both FMEA and ASIL sit under ISO 26262, so evidence for one usually references the other.
HARA is governed by ISO 26262 as well, which is why the two show up together in audits.
Safety Function is governed by IEC 61508 as well, which is why the two show up together in audits.
IEC 61508 connects the two: FMEA and Safe Torque Off are assessed against the same lifecycle.
Verification and Validation is governed by IEC 61508 as well, which is why the two show up together in audits.
IEC 61508 connects the two: FMEA and Safety Management System are assessed against the same lifecycle.
Functional Safety Plan is governed by IEC 61508 as well, which is why the two show up together in audits.