FMEDA
Artifact
Topic overview
Quick facts
An FMEDA extends the with quantification: every failure mode of every component receives a failure rate from a recognized source, a classification as safe or dangerous for the specific safety function, and a determination of whether the design's diagnostics detect it.
Summing the columns yields the numbers the standards actually require: total safe and dangerous failure rates, diagnostic coverage, safe failure fraction under , the single-point and latent fault metrics under , and ultimately the or PFDavg of the subsystem.
The analysis is unavoidably design-specific. Whether a resistor drifting high is safe or dangerous depends on what the circuit does with that signal, and whether it is detected depends on diagnostics that must actually exist in the hardware and software, with their test intervals fast enough relative to the process safety time.
Failure rates come from sources such as SN 29500, IEC 62380 successors, or manufacturer data, adjusted for the real operating temperature and environment.
The FMEDA underpins hardware metrics such as , SFF, and hardware fault tolerance claims, and is the standard deliverable when a component is certified for use in safety systems: the certificate's headline numbers are the FMEDA's outputs, and integrators consume them in their loop-level calculations.
Why FMEDA matters to your program
For anyone selling components or subsystems into safety applications, the FMEDA is the product's safety datasheet: without credible FMEDA-derived numbers, integrators cannot include the part in their calculations and will design it out.
For system builders, the FMEDA is where architecture decisions get costed in reliability currency, revealing, for example, that claimed 2 is unreachable without adding a diagnostic channel. Errors here are expensive in both directions: pessimism forces unnecessary redundancy, optimism gets discovered by an assessor or, worse, by the field.
Working with FMEDA
Safety lifecycle
A safety or reliability engineer performs the FMEDA during hardware detailed design, working from the schematic and bill of materials, the definition of the safety function and its safe state, and the diagnostic design.
Component failure modes and mode distributions come from the chosen database; each mode is classified safe or dangerous and detected or undetected by walking the circuit behavior, often with the hardware designer in the room. Outputs feed the architecture-level calculation and are updated on every relevant design change.
Assessors and certification bodies sample the classifications, verify claimed diagnostics against the actual implementation and timing, check failure-rate sources and environmental derating, and reconcile the FMEDA against the schematic revision under assessment.
Common FMEDA mistakes
FMEDA and its standards
Assessors evaluate FMEDA against IEC 61508, the umbrella functional safety standard defining the safety lifecycle, sil levels, and requirements for electrical, electronic, and programmable systems.
In programs run to ISO 26262, FMEDA is one of the things the assessor checks first - automotive functional safety standard defining asil levels and the automotive safety lifecycle.
FMEDA ownership and review
| Aspect | Detail |
|---|---|
| Produced by | Hardware safety engineer with reliability data |
| Inputs | Schematics, BOM, failure rate handbooks, diagnostic design |
| Outputs | SFF, DC, lambda splits, PFH/PFDavg |
| Reviewed by | Independent reviewer, certification body |
| Common finding | Optimistic DC claims unverified by fault injection |
Industries where FMEDA applies
Industrial Machinery programs lean on FMEDA because the sector covers fixed and mobile machinery, packaging lines, and manufacturing equipment.
In autonomous systems, FMEDA comes up in nearly every certification conversation: autonomous mobile equipment, off-highway autonomy, and driverless platforms.
Ask our team about FMEDA
Ben TwomblyFounder & CEOLeads CSA's functional-safety, certification, and engineering programs for safety-critical products and organizations. His assessor-side background informs practical programs that connect standards, engineering work, and credible evidence.
Tom CyrPrincipal Safety Engineer, IFSPSupports industrial and rail functional-safety programs with safety analysis, requirements, lifecycle planning, and certification-readiness guidance.Terms related to FMEDA
How each connects to FMEDA:
FMEA appears in the same lifecycle work as FMEDA and is usually produced or reviewed alongside it.
PFH appears in the same lifecycle work as FMEDA and is usually produced or reviewed alongside it.
Both FMEDA and Functional Safety sit under IEC 61508, so evidence for one usually references the other.
IEC 61508 connects the two: FMEDA and SIL are assessed against the same lifecycle.
IEC 61508 connects the two: FMEDA and Safety Function are assessed against the same lifecycle.
Both FMEDA and Safe Torque Off sit under IEC 61508, so evidence for one usually references the other.
IEC 61508 connects the two: FMEDA and Fault Tree Analysis are assessed against the same lifecycle.
IEC 61508 connects the two: FMEDA and Verification and Validation are assessed against the same lifecycle.
Both FMEDA and Safety Management System sit under IEC 61508, so evidence for one usually references the other.
IEC 61508 connects the two: FMEDA and Functional Safety Plan are assessed against the same lifecycle.