Failure Modes and Effects Analysis

Why Failure Modes and Effects Analysis Matters for the CSP Exam

Failure Modes and Effects Analysis (FMEA) sits squarely within the BCSP Certified Safety Professional (CSP) blueprint under Program Management and overlaps heavily with Risk Management and Hazard Identification domains. The CSP exam expects you to do more than recite a definition. You must be able to recognize when FMEA is the right tool, distinguish it from other system safety techniques such as Fault Tree Analysis (FTA), HAZOP, and Job Safety Analysis (JSA), calculate and interpret a Risk Priority Number (RPN), and explain how FMEA findings drive corrective action using the hierarchy of controls.

FMEA is important in practice because it is proactive. Rather than waiting for an incident and investigating afterward, FMEA forces a team to ask, before anything fails, how each component or process step could fail, what would happen if it did, and what should be done about it. For safety professionals managing programs that involve equipment design, process changes, new products, or complex systems, FMEA is one of the most widely adopted structured hazard analysis methods in the world. Its use is embedded in standards such as MIL-STD-1629A, SAE J1739, AIAG and VDA FMEA Handbook, IEC 60812, and ISO 14971 for medical devices, which is why it appears regularly on professional certification exams.

What FMEA Is

FMEA is a systematic, inductive, bottom-up hazard analysis technique used to identify potential failure modes of a system, subsystem, component, or process; determine the effects of each failure on the system and its users; rank those failures by risk; and prioritize actions to eliminate or reduce the most significant risks.

Key definitions you should memorize:

Failure mode: The specific manner in which an item or process step could fail to perform its intended function. Examples include fractured, corroded, open circuit, leaking, stuck open, operator skips step, wrong material loaded.

Failure effect: The consequence of the failure mode on the system, product, process, environment, or people. Effects are often examined at the local level, the next higher level, and the end-item or system level.

Failure cause: The underlying mechanism or reason the failure mode occurs, such as fatigue, inadequate lubrication, software bug, insufficient training, or procurement of out-of-spec parts.

Severity (S): A rating of how serious the effect would be if the failure occurred, typically on a 1 to 10 scale where 10 is catastrophic (death, major regulatory violation, total loss of function without warning).

Occurrence (O): A rating of how likely the cause and resulting failure mode are to occur, typically 1 (remote) to 10 (almost certain).

Detection (D): A rating of how likely current controls are to detect the cause or failure mode before it reaches the customer, user, or produces harm. Note the reverse logic: 1 means almost certain detection, 10 means detection is virtually impossible. Many candidates miss exam questions because they invert this scale.

Risk Priority Number (RPN): The product S x O x D, ranging from 1 to 1,000. Higher RPN means higher priority for corrective action.

Criticality: When FMEA is extended with a formal criticality analysis, it becomes FMECA (Failure Modes, Effects, and Criticality Analysis). Criticality combines severity with probability of occurrence to rank items, and is the approach emphasized in MIL-STD-1629A.

Historical Context

FMEA was developed by the U.S. military in the late 1940s (MIL-P-1629, 1949) to evaluate reliability of equipment and weapon systems. NASA adopted it heavily during the Apollo program in the 1960s. The automotive industry, led by Ford in the 1970s after the Pinto fuel tank litigation, formalized Design and Process FMEA, and the Automotive Industry Action Group (AIAG) standardized it in the 1990s. Today FMEA is used in aerospace, automotive, healthcare (Healthcare FMEA promoted by the Joint Commission and the VA National Center for Patient Safety), chemical processing, electronics, and food safety.

Types of FMEA

System FMEA (SFMEA): Performed early in concept development to analyze interactions among subsystems and interfaces.

Design FMEA (DFMEA): Analyzes a product or equipment design to identify how components could fail because of design deficiencies, material selection, tolerances, or environmental stress. Performed before the design is released to production.

Process FMEA (PFMEA): Analyzes manufacturing, assembly, maintenance, or operational processes to identify how each process step could fail (wrong part, missed step, incorrect torque, contamination) and affect product quality, worker safety, or downstream operations.

Healthcare FMEA (HFMEA): A variant used for clinical processes such as medication administration, often using a hazard scoring matrix rather than a traditional RPN.

Software FMEA and Service FMEA: Adaptations for software functions and service delivery processes.

For exam purposes, the most frequently tested distinction is Design FMEA versus Process FMEA, and the distinction between FMEA and FMECA.

How FMEA Works: Step by Step

Step 1: Define scope and assemble the team. FMEA is a team-based activity. The team should be cross-functional, typically including design engineers, process engineers, maintenance, operations, quality, and safety. Define the system boundaries, the level of analysis (component, subsystem, process step), and the ground rules and assumptions.

Step 2: Break the system or process down. Use a functional block diagram for DFMEA or a process flow diagram for PFMEA. List each component or process step and its intended function. A failure mode is always defined relative to a function, so functions must be clearly stated first.

Step 3: Identify potential failure modes. For each function, brainstorm every credible way it could fail: no function, partial or degraded function, intermittent function, unintended function, or function at the wrong time. Use historical data, warranty data, incident reports, maintenance records, and expert judgment.

Step 4: Identify effects of each failure mode. Describe what the user, operator, downstream process, or system would experience. Consider local effects, next-level effects, and end effects. Safety effects such as injury, fire, toxic release, or regulatory noncompliance drive the severity rating.

Step 5: Assign Severity. Rate the most serious effect of each failure mode. Severity is tied to the effect, not the cause, and generally cannot be reduced except by a design change that eliminates or lessens the consequence.

Step 6: Identify causes and assign Occurrence. List potential root causes or mechanisms for each failure mode. Rate how often each cause is expected to produce the failure mode, considering any prevention controls already in place.

Step 7: Identify current controls and assign Detection. Document existing prevention controls (design standards, poka-yoke, procedures) and detection controls (inspections, tests, alarms, sensors). Rate how likely the detection controls are to catch the problem before harm or escape.

Step 8: Calculate RPN. Multiply S x O x D for each failure mode and cause combination. Rank the results.

Step 9: Prioritize and recommend actions. Address the highest RPNs first, but also address any item with a very high severity (often 9 or 10) regardless of RPN, because a catastrophic effect with low probability is still unacceptable. Recommended actions follow the hierarchy of controls: eliminate the failure mode through design change, substitute, add engineering controls or redundancy, improve detection, then administrative controls and PPE.

Step 10: Assign responsibility and target dates. Every recommended action should have an owner and a completion date. FMEA is a living document, not a one-time exercise.

Step 11: Implement actions and recalculate. After actions are taken, re-rate S, O, and D and compute the revised RPN to verify risk reduction. Document the results.

Step 12: Review and update. Revisit the FMEA whenever the design, process, materials, suppliers, or operating conditions change, and after incidents or near misses.

Worked RPN Example

A pressure relief valve on a compressed air receiver is analyzed. Failure mode: valve fails closed (does not open at set pressure). Effect: receiver over-pressurizes, potential rupture, serious injury or fatality. Severity = 10. Cause: corrosion and scale buildup from moisture in the air system. Occurrence = 4. Current detection control: annual visual inspection only. Detection = 7 (a stuck valve is not easily seen without functional testing).

RPN = 10 x 4 x 7 = 280.

Recommended action: install an automatic drain to remove moisture (reduces Occurrence to 2) and implement quarterly lift testing of the relief valve with documented results (reduces Detection to 3). Severity remains 10 because the consequence of a rupture is unchanged.

Revised RPN = 10 x 2 x 3 = 60.

Notice the important lesson: Severity did not change. Only eliminating the hazard (for example, redesigning to a system that cannot reach rupture pressure) would lower Severity. This is a classic exam concept.

Strengths of FMEA

It is systematic and thorough, forcing consideration of every component or step. It is proactive and can be applied early in design when changes are cheapest. It produces a prioritized action list that management can understand. It documents the reasoning behind design and process decisions, which is valuable for regulatory compliance and product liability defense. It improves cross-functional communication.

Limitations of FMEA

FMEA is primarily a single-point failure technique; it examines one failure mode at a time and does not handle combinations of simultaneous failures well. Fault Tree Analysis is better for analyzing how multiple events combine to produce a top-level undesired event. FMEA can be very time-consuming and labor-intensive for complex systems. RPN rankings are subjective and ordinal; an RPN of 200 is not exactly twice as risky as an RPN of 100, and different S-O-D combinations can produce the same RPN with very different real-world meaning (for example, 10 x 2 x 5 = 100 and 2 x 5 x 10 = 100). FMEA tends to focus on hardware and process steps and may under-represent human error and organizational factors unless the team deliberately includes them. Newer approaches such as the 2019 AIAG-VDA handbook replace RPN with an Action Priority (AP) table of High, Medium, Low that weights severity more heavily to address the equal-RPN problem.

FMEA Compared to Other Hazard Analysis Tools

FMEA vs. Fault Tree Analysis (FTA): FMEA is inductive and bottom-up, starting with component failures and reasoning forward to effects. FTA is deductive and top-down, starting with an undesired top event and reasoning backward using AND and OR logic gates to find combinations of causes. FTA handles multiple concurrent failures; FMEA generally does not. They are complementary and often used together.

FMEA vs. HAZOP: HAZOP (Hazard and Operability Study) uses guide words such as No, More, Less, Reverse, Other Than applied to process parameters like flow, pressure, temperature, and is the preferred method for continuous chemical processes under OSHA Process Safety Management. FMEA focuses on equipment and component failure modes and is more common in discrete manufacturing and product design. OSHA 1910.119 lists FMEA as one of the acceptable Process Hazard Analysis methods, along with What-If, Checklist, What-If/Checklist, HAZOP, and Fault Tree Analysis.

FMEA vs. Event Tree Analysis (ETA): ETA is inductive like FMEA but starts with an initiating event and maps the success or failure of successive safety barriers to determine possible outcomes.

FMEA vs. Job Safety Analysis (JSA) or Job Hazard Analysis (JHA): JSA breaks a job into steps and identifies hazards to the worker at each step. It is simpler, task-focused, and does not rank risk numerically. Process FMEA is more rigorous and quantified.

FMEA vs. Preliminary Hazard Analysis (PHA): PHA is a broad, early-stage qualitative screen used before detailed design information exists. FMEA requires detailed design or process information and is performed later.

FMEA vs. Bow-Tie Analysis: Bow-tie combines fault tree (left side, causes) and event tree (right side, consequences) around a central top event and emphasizes barriers. FMEA does not visualize barriers in this way.

How to Answer FMEA Questions on the CSP Exam

CSP questions on FMEA tend to fall into predictable categories. Learn to recognize each.

Category 1: Identify the technique from a description. If the stem describes a method that examines each component to determine how it could fail and what the effect would be, the answer is FMEA. If it describes starting with a top event and working backward through logic gates, the answer is FTA. If it mentions guide words or deviations from design intent, the answer is HAZOP. Keywords to watch for: bottom-up, inductive, single-point failure, component level, and RPN all point to FMEA.

Category 2: Calculate or interpret RPN. You may be given S, O, and D values and asked for the RPN, or given several failure modes with their ratings and asked which should be addressed first. Multiply carefully and remember the range is 1 to 1,000. When two items have similar RPNs, the one with higher Severity typically takes priority.

Category 3: Which factor can or cannot be changed. Severity is tied to the consequence and is reduced only by design changes that eliminate or mitigate the effect. Occurrence is reduced by prevention controls that address the cause. Detection is improved by adding inspection, testing, sensors, or alarms. A question asking what adding a redundant sensor accomplishes is testing Detection; a question about changing to a corrosion-resistant alloy is testing Occurrence.

Category 4: Detection scale direction. Remember that a Detection rating of 1 means the failure is almost certain to be detected, and 10 means it is almost impossible to detect. If a question says a new inspection makes detection more likely, the Detection number goes down, and RPN goes down.

Category 5: Limitations and appropriate use. If a question asks which technique is least suited to analyzing the combined effect of two simultaneous failures, the answer is FMEA. If it asks which technique is most appropriate for a new mechanical assembly in the design stage, the answer is Design FMEA. If it asks which PHA method is acceptable under OSHA PSM, FMEA is one of the listed methods.

Category 6: FMEA versus FMECA. The C adds criticality analysis, which formally ranks failure modes by severity and probability. MIL-STD-1629A is the reference most associated with FMECA.

Category 7: Program management integration. Questions may ask when FMEA should be performed (as early as possible in design, and again when changes occur), who should participate (a cross-functional team, not a single engineer), and how results should be managed (documented, assigned owners, tracked to closure, periodically reviewed). The living-document principle and management of change linkage are frequent themes.

Exam Tips: Answering Questions on Failure Modes and Effects Analysis

Tip 1: Memorize the formula RPN = Severity x Occurrence x Detection and the 1 to 1,000 range. Practice a few multiplications so you are fast and accurate under time pressure.

Tip 2: Lock in the direction of each scale. Higher Severity is worse. Higher Occurrence is worse. Higher Detection is worse because it means harder to detect. All three scales run in the same direction, so a higher RPN is always higher risk.

Tip 3: Remember that Severity is the hardest number to change. If an answer option claims that adding an inspection reduced Severity, it is wrong. Inspection affects Detection.

Tip 4: Associate FMEA with the words bottom-up, inductive, forward-looking, component or step-based, and single failure. Associate FTA with top-down, deductive, logic gates, Boolean, and multiple failures. Most FMEA questions are really FMEA versus FTA discrimination questions in disguise.

Tip 5: Know the FMEA family: System, Design, Process, and the FMECA extension. A question about a manufacturing line or maintenance procedure points to Process FMEA; a question about a product before it is built points to Design FMEA.

Tip 6: When a question asks for the best next step after an FMEA identifies a high-RPN item, choose the answer that applies the hierarchy of controls, starting with elimination or design change, before answers that rely on training, procedures, or PPE.

Tip 7: If asked about weaknesses of FMEA, choose answers about subjectivity of ratings, inability to analyze combined or simultaneous failures, time and resource intensity, and the misleading nature of equal RPNs from different S-O-D combinations.

Tip 8: FMEA is a team activity. Any answer option suggesting FMEA should be completed by a single engineer in isolation is a distractor.

Tip 9: Connect FMEA to program management concepts: it supports management of change, design review, risk registers, reliability-centered maintenance, and continuous improvement. Expect questions that place FMEA within a broader safety management system rather than as a standalone tool.

Tip 10: Read the stem for the stage of the life cycle. Concept stage suggests PHA or System FMEA. Detailed design suggests DFMEA or FTA. Operating process suggests PFMEA, HAZOP, or JSA. Post-incident suggests root cause analysis, not FMEA, because FMEA is predictive.

Practice Questions

Question 1: A safety professional is evaluating a new hydraulic press before installation. The team lists each component, how it might fail, and the effect on operator safety, then ranks each by the product of three ratings. Which technique is being used?
A. Fault Tree Analysis
B. HAZOP
C. Failure Modes and Effects Analysis
D. Event Tree Analysis
Answer: C. Component-by-component failure modes, effects, and a three-factor ranking describe FMEA.

Question 2: A failure mode has Severity 8, Occurrence 5, and Detection 6. After adding an automated sensor with alarm, Detection drops to 2. What is the revised RPN?
A. 240
B. 80
C. 16
D. 160
Answer: B. 8 x 5 x 2 = 80. The original RPN was 240.

Question 3: Which of the following is a recognized limitation of FMEA?
A. It cannot be used during the design phase
B. It does not readily evaluate the combined effect of multiple simultaneous failures
C. It requires quantitative failure rate data to be useful
D. It is not accepted as a Process Hazard Analysis method under OSHA PSM
Answer: B. FMEA is a single-point failure technique. Option A is false because DFMEA is used in design. Option C is false because FMEA uses ordinal ratings. Option D is false because 1910.119 lists FMEA as acceptable.

Question 4: Which action would most directly reduce the Severity rating of a failure mode?
A. Increasing the frequency of preventive maintenance
B. Adding a redundant detection alarm
C. Redesigning the system so the failure can no longer produce a hazardous energy release
D. Training operators to recognize early warning signs
Answer: C. Only eliminating or mitigating the consequence changes Severity. A affects Occurrence; B and D affect Detection.

Question 5: The primary difference between FMEA and FMECA is that FMECA adds:
A. A top-down logic diagram
B. A formal criticality ranking based on severity and probability
C. Guide words applied to process parameters
D. A review of operator job steps
Answer: B. Criticality analysis is the defining addition in FMECA.

Summary

FMEA is a structured, team-based, bottom-up method for anticipating how things can fail, understanding the consequences, ranking risk with the RPN (S x O x D), and driving prioritized corrective action. For the CSP exam, master the vocabulary, the RPN mechanics and scale directions, the distinction between Design and Process FMEA and between FMEA and FMECA, the contrast with Fault Tree Analysis and HAZOP, the limitations of the method, and its place within a comprehensive safety program. Approach every FMEA question by first identifying which of the seven question categories it belongs to, then apply the corresponding rule. With these principles firmly in hand, FMEA questions become some of the most reliable points you can earn on the exam.