Performing a FMEA

In order to properly execute a failure mode and effect analysis, certain detailed data must be made available to the analyst. These data typically include, but certainly are not limited to, the following fundamental information for each system, subsystem, and its components (TAl 1989)  

After the required information has been collected, the specific nature of the FMEA must be established. A firmly defined scope of the FMEA will assist the analyst in determining direction and ensure that the FMEA remains focused on these established objectives. 

FAILURE EFFECT ON SYSTEM EFFECTONJOB CRITICALITY OR COMPONENT OR PERSONNEL LEVEL 

On completion of the FMEA worksheets, the analysis data are transferred into report format, which should include, as a minimum, the information described below (in Sections 10.2.1.1-10.2.1.7). 

2 Definitions Section TypicaUy, a FMEA report wUl contain phrases or words that are seldom associated with the everyday practice of the industrial safety professional. It is therefore important to provide definitions and explanations of terms and phrases that will be utilized in the FMEA. 

---

Performing a FMEA on the software is a mean to narrow the scope of the demonstration by finding out the software components that may, if faulty, lead to a CCF. It is then easier to show, either that those software components are error free or that the postulated component failure modes will be detected and will lead to a safe position. This analysis has been performed on the Operational System Software and on the Application Software for the new TIHANGE 1 Nuclear Instrumentation System (NIS). 

Frequency Phase 1 Perform Qualitative Study, Typically Using HAZOP, FMEA, or What-if Analysis. To perform a qualitative study you should first (1) define the consequences of interest, (2) identify the initiating events and accident scenarios that could lead to the consequences of interest, and (3) identify the equipment failure modes and human errors that could contribute to the accident... 

Figure 5 provides a blank table (eomplete with design revision seetion) used to perform a design FMEA. It forms a traeeable reeord of the design and its failure modes and assoeiated risks. 

In order to perform a complete, formal FMEA of a production facility, each failure mode of each device must be evaluated. A percentage failure rate and cost of failure for each mode for each device must be calculated. If the ri.sk discounted cost of failure is calculated to be acceptable, then there arc the proper numbers of redundancies. If that cost is not acceptable, then other redundancies must be added until an acceptable cost is attained. 

The application of this procedure is best seen by performing an FMEA on a simple two-phase separator. Table 14-3 lists those process upsets that can be sensed before an undesirable event leading to a source of condition occurs. For overpressure, primary protection is provided by a high pressure sensor that shuts in the inlet (PSH). If this device fails, secondary protection is provided by a relief valve (PSV). 

A FMEA has three steps (1) defining the process, (2) performing the analysis, and (3) documenting the results. Defining the process for study and documenting the results can be performed by a single person. The analysis itself must be performed by a team. 

The required level of resolution determines the extent of detail needed in a FMEA. The choices for the level of resolution range from the subcomponent level to the system level. To satisfy PSM Rule requirements, most FMEAs should be performed at the major component level. This level provides the best trade-off between the time necessary to perform the analysis and the usefulness of the information gained from it. 

Effects. For each identified failure mode, the PrHA team should describe the anticipated effects of the failure on the overall system or process. The key to performing a consistent FMEA is to assure that all equipment failures are analyzed using a common basis. Typically, analysts evaluate effects on a worst-case basis, assuming that existing safety levels do not work. However, more optimistic assumptions may be satisfactory as long as all equipment failure modes are analyzed on the same basis. 

The PSM Rule requires that a FMEA be performed by a team, all of whose members participate in the analysis. The most practical means of performing the FMEA is to prepare blank worksheets on viewgraphs or on a large display screen. For each equipment item, the PrHA team reaches a consensus on its failure modes and their causes, effects, detection methods, compensating provisions, severity (if desired), and any remarks or action items. 

The FTA method was originally developed to supplement a FMEA. Fault trees, in their original usage, were diagrams indicating how the data developed by FMEAs interact to cause a specific event. The FTA method is most effective in analyzing complex systems with a limited number of well-identified hazards. In most cases, FTAs are used to perform in-depth analyses of hazardous events identified by another hazard evaluation method. 

Most common risk analysis forms are mutations of the fundamental FMEA. It is easier for most companies to start initially with a more practical way of performing a risk analysis. In the future the fundamental FMEA will be more commonly applied, as companies will have gained confidence with variations of the FMEA. 

Failure Modes and Effects Analysis (FMEA) This will document a review of the effects of faiiure of the component parts of the system. This review is mainiy aimed at assessing the system hardware, interfaces and environment. This review shouid be performed on two lev-eis The first ievei reviews the possibie failure modes of each individual system and the second level assesses the possible failure modes of the combined system. The overall objective of the FMEA is to identify the potentiai weak points and then to identify how these weak points may be designed out of the system. This may be achieved by instaiiing redundancy, redesigning parts of the system, recommending procedural controls and so on. The results of this review should be documented as a FMEA Review Report or as part of a DQ Report. 

PERFORMING THE ANALYSIS. The FMEA should be performed in a deliberate, systematic manner to reduce the possibility of omissions and to enhance completeness. All failure modes for one component should be addressed before proceeding to the next component. A tabular format is recommended for recording results. A FMEA worksheet is produced by beginning at a system boundary on a reference drawing and systematically evaluating the components in the order in which they appear in the process flow path. A worksheet such as that shown in Table 4.20 should be completed for each equipment item, as follows. 

The Failure Mode and Effects Analysis (FMEA) is a systematic, bottom-up method of identifying the failure modes of a system, item, function and determining the effects on the higher level. It may be performed at any level within the system (e.g., piece-part, function, blackbox, etc,). Software can also be analyzed qualitatively using a functional FMEA approach. Typically, a FMEA is used to address failure effects resulting from single failures [1]... 

When performing an FMEA on mechanical, fluid or electrical system, failure modes of components such as pipes or resistors are generally understood, likely to happen and their consequences may be studied. A component is supposed to fail, due to some reason as wearing, aging or unanticipated stress. The analysis may not always be easy, but at least, the safety engineer can rely on data provided by the component manufacturer, results of tests and feedback of experience when available. 

Performing the FMEA for the Tihange 1 project has proved to be a good way to discuss in depth safety aspects of software-based systems with our customer and with the licensing authority. 

ABSTRACT On the strength of experience with risk analysis methodology in IT-operating enterprises, an approach has to be able to deal with limited resources. This prompts an analyst to perform a heuristic and biased approach, which is typically a questiomiaire structured by a IT security standard. The difficulty is to draw up a limited set of concise IT security related questions, which result in meaningful outcomes for IT risk analysis purposes. In the proposed approach, the Code of Practice ISO/IEC 27002 is used to structure the analysis and to restrict the number of questions. The Code s recommendations are rephrased and a Guttman scale is introduced for an IT security FMEA-like risk analysis approach. For frequency assessments it is assumed that an implemented high-level security measurement resiilts in low frequencies of imdesired events. The paper pictures the adapted IT-FMEA approach and presents the results of a feasibihty study at Switzerland s leading telecom provider. 

Critical items list (CIL) A listing comprised of all critical items identified as a result of performing the FMEA (NSTS 22254). 

The second and more common hardware FMEA examines actual system assemblies, subassemblies, individual components, and other related system hardware. This analysis should also be performed at the earliest possible phase in the product or system life cycle. Just as subsystems can fail with potentially disastrous effects, so can the individual hardware and components that make up those subsystems. As with the functional FMEA, the hardware FMEA evaluates the reliability of the system design. It attempts to identify single-point failures, as well as all other potential failures, within a system that could possibly result in failure of that system. Because the FMEA can accurately identify critical failure items within a system, it can also be useful in the development of the preliminary hazard analysis and the operating and support hazard analysis (Stephenson 1991). It should be noted that FMEA use in the development of the O SHA might be somewhat limited, depending on the system, because the FMEA does not typically consider the ergonomic element. Other possible disadvantages of the FMEA include its purposefiil omission of multiple-failure analysis within a system, as well as its failure to evaluate any operational interface. Also, in order to properly quantify the results, a FMEA requires consideration and evaluation of any known component failure rates and/or other similar data. These data often prove difficult to locate, obtain, and verify (Stephenson 1991). 

This example will develop a hardware FMEA for a proposed system that is well into the design phase of the product life cycle. For informational purposes, it is assumed that a preliminary hazard analysis was previously performed during the early stages of the design phase of this system. The information from the PHA will be used to assist in the development of the hardware FMEA. It should also be noted that the nature of a FMEA requires evaluation of subsystems, subassemblies, and/or components. For this reason, more detailed and specific descriptive information is provided here than that supplied for previous examples discussed in this text. 

The fault hazard analysis (FHA)—also referred to as the functional hazard analysis—method follows an inductive reasoning approach to problem solving in that the analysis concentrates primarily on the specific and moves toward the general (TAI 1989). The FHA is an expansion of the FMEA (Stephenson 1991). As demonstrated in the previous chapter, the FMEA is concerned with the critical examination and documentation of the possible ways in which a system component, circuit, or piece of hardware may fail and the effect of that failure on the performance of that element. The FHA takes this evaluation a step further by determining the effect of such failures on the system, the subsystem, or personnel. In fact, when a FMEA has already been completed for a given system and information on the adverse safety effect of component or human failures is desired for that system, the safety engineer can often utilize the data from the FMEA as an input to the FHA. 

---