Performing an FMEA

To properly execute a Failure Mode and Effect Analysis, certain detailed data must be made available to the analyst. These data typically include, but certainly are not limited to, the following fundamental information for each system, subsystem, and their components (TAI 1989)  

After the required information has been collected, the specific nature of the FMEA must be established. A firmly defined scope of the FMEA will assist the analyst in determining direction and ensure the FMEA remains in focus with these established 

---

The solution is to perform an FMEA on the product and the process and identify the critical products, processes, and regulations. 

The application of this procedure is best seen by performing an FMEA on a simple two-phase separator. Table 14-3 lists those process upsets that can be sensed before an undesirable event leading to a source of condition occurs. For overpressure, primary protection is provided by a high pressure sensor that shuts in the inlet (PSH). If this device fails, secondary protection is provided by a relief valve (PSV). 

When performing an FMEA on mechanical, fluid or electrical system, failure modes of components such as pipes or resistors are generally understood, likely to happen and their consequences may be studied. A component is supposed to fail, due to some reason as wearing, aging or unanticipated stress. The analysis may not always be easy, but at least, the safety engineer can rely on data provided by the component manufacturer, results of tests and feedback of experience when available. 

When performing an FMEA on software, very few information or support is available. The safety engineer has to apply his own knowledge of software to set up an FMEA approach, i.e. ... 

If done early enough, the most important benefits of performing an FMEA are that it enables the system integrator to ... 

The next steps in performing an FMEA are to define the system to be analyzed and to determine the scope of the analysis. 

One part of the safety analysis is based on traditional manual techniques. The analysts perform an FMEA of the system. If the analysts are very experienced, first results from this step can be obtained very quickly. Despite these early results, the analysis based on the traditional techniques continues throughout the whole development cycle. The results are used to improve specification and design. It is our strong belief that model checking is a very effective technique if used with caution. For this reason, first models of the systems are being built in parallel with the manual analysis. 

In practice, there are three approaches to performing an FMEA ... 

The safety criticality and operational safety criticality of a failure can be identified by performing an FMEA study on the system. The values of these two parameters can be estimated subjectively using a scale of 0 tolO (0 being least critical and 10 being most critical). The values are assigned based on the probability of occurrence and severity, and are considered for four categories (personnel, environment, equipment and catch). All the other variables in Equations (8.22) and (23) will have the same values as defined in Equation (8.13) of Section 8.5.2. 

Once the variability risks, and q, have been calculated, the link with the particular failure mode(s) from an FMEA for each critical characteristic is made. However, determining this link, if not already evident, can be the most subjective part of the analysis and should ideally be a team-based activity. There may be many component characteristics and failure modes in a product and the matrix must be used to methodically work through this part of the analysis. Past failure data on similar products may be useful in this respect, highlighting those areas of the product that are most affected by variation. Variation in fit, performance or service life is of particular interest since controlling these kinds of variation is most closely allied with quality and reliability (Nelson, 1996). 

The PSM Rule requires that an FMEA be performed by a team. Multiple participants may use an FMEA prepared as blank worksheets on viewgraphs for large screen display. When the PrHA... 

Table 7.3-2 lists some objectives for performing PSA on chemical process systems. Objective 1 is to determine if a process or plant has sufficient risk to justify a detailed analysis. This scoping analysis may be performed with a HAZOP (Section 3.3.4) or an FMEA (3.3. S) with either... 

A failure modes and effects analysis is a systematic analytical technique for identifying potential failures in a design or a process, assessing the probability of occurrence and likely effect, and determining the measures needed to eliminate, contain, or control the effects. Action taken on the basis of an FMEA will improve safety, performance, reliability, maintainability and reduce costs. The outputs are essential to balanced and effective quality plans for both development and production as it will help focus the controls upon those products, processes, and characteristics that are at risk. It is not the intention here to give a full appreciation of the FMEA technique and readers are advised to consult other texts. 

Before mistake proofing can be applied, potential mistakes must first be identified. FMEA can be used for this purpose. It identifies different failure modes along with their potential causes and consequences. For each potential failure mode, a risk evaluation is performed based on the likelihood of a defect to occur, the likelihood of it being detected, and the severity of its consequences. One of the columns in an FMEA is titled Control Plan. This column must be filled out before performing the risk assessment. Both the likelihood of occurrence and likelihood of detection are affected by the controls that are currently in place. 

It has been recognized that the methods and tools used for the software development and V V, the respect of the requirements of lEC 60880, the experience of the software teams were suitable to produce software as error free as possible . This has been proven by the feedback of experience gained on similar projects that we have developed during the last 20 years. We have nevertheless been required to perform an additional analysis on the IE software, using an FMEA technique, in order to identify those parts of the... 

The safety characteristics of the SP1NL1NE3 solution and the stringent and proven safety software development process applied by the Nuclear department of the Schneider Electric company have made acceptable the principle of a design based on redundant identical processing units for this project. In addition, because of the possible consequences in case of the NIS not performing its protection fonction on demand, the licensing authority has required an FMEA oriented toward the SCCF risk as part of the safety case. 

The primary advantages of an FMEA are that critical single-point failures can be identified and that reliability can be evaluated in detail. It may identify areas or parts with poor reliability and allow early and cost-effective design changes. If it is performed functionally early in the project, it may reduce the amount of more detailed FMEA needed. 

The second and more common hardware FMEA examines actual system assemblies, subassemblies, individual components, and other related system hardware. This analysis should also be performed at the earliest possible phase in the product or system life cycle. Just as subsystems can fail with potentially disastrous effects, so can the individual hardware and components that make up those subsystems. As with the functional FMEA, the hardware FMEA evaluates the reliability of the system design. It attempts to identify single-point failures, as well as all other potential failures, within a system that could possibly result in failure of that system. Because the FMEA can accurately identify critical failure items within a system, it can also be useful in the development of the preliminary hazard analysis and the operating and support hazard analysis (Stephenson 1991). It should be noted that FMEA use in the development of the O SHA might be somewhat limited, depending on the system, because the FMEA does not typically consider the ergonomic element. Other possible disadvantages of the FMEA include its purposeful omission of multiple failure analysis within a system, as well as its failure to evaluate any operational interface. Also, in order to properly quantify the results, an FMEA requires consideration and evaluation of any known component failure rates and/or other similar data. These data often prove difficult to locate, obtain, and verify (Stephenson 1991). 

This example will develop a hardware FMEA for a proposed system that is well into the design phase of the product life cycle. For informational purposes, it is given that a Preliminary Hazard Analysis (PHA) was previously performed during the early stages of the design phase of this system. The information from the PHA will be used to assist in the development of the hardware FMEA. It should also be noted that the nature of an FMEA requires evaluation of subsystems, subassemblies, and/or components. For this reason, more detailed and specific descriptive information is provided here than that which has been supplied for previous examples discussed in this text. 

Vat Fault Hazard Analysis (FHA also referred to as the Functional Hazard Analysis, method follows an inductive reasoning approach to problem solving in that the analysis concentrates primarily on the specific and moves toward the general (TAI 1989). The FHA is an expansion of the FMEA (Stephenson 1991). As demonstrated in the previous chapter, the FMEA is concerned with the critical examination and documentation of the possible ways in which a system component, circuit, or piece of hardware may fail and that failure s effect upon the performance of that element. The FHA takes this evaluation a step further by determining the effect of such failures upon the system, the subsystem, or personnel. In fact, when an FMEA has already been completed for a given system and information on the adverse safety effect of component or human failures is desired for that system, the safety engineer can often utilize the data from the FMEA as an input to the FHA. 

The next step in the risk assessment process is to identify accident scenarios and develop the initiating events for those scenarios. A hazard analysis was performed and various hazards were identified. Of the hazards identified, the most significant were related to the uncontrolled release of cryogenic fluid or gas. With that information, a fault tree was constructed for the system with the top event designated as uncontrolled cryogenic release. An FMEA was performed on those components that were determined to be critical to the fault tree. 

The results of this propagation are formulated through Fault Trees. In case of modification of the system or software model, Safety Architect is able to perform an impact analysis that reduces the rework costs that can be very high for a FMEA. For example, the addition or modification of a function or component can be analysed for safety concern with the reuse of the previous analysis. 

Safety is defined as Attributes as well as also availability, confidentiality, integrity, performance, reliability, survivability, and maintenance. Similar considerations are in railway standards with RAMS -Approach (Reliability, Availability, Maintainability, Safety) and shows also similar ideas like (Fig. 4.28. Basic principle of FMEA) the chapter about error propagation principles. Possible measures, called means, are also similar to possible measures in an FMEA (see also Fig. 4.41) ... 

Lloyd and Tye (1995) recall that the airworthiness requirements (e.g. BCAR and FAR) of the mid-20th century were devised to suit the circumstances. Separate sets of requirements were stated for each type of system and they dealt with the engineering detail intended to secure sufficient reliability . Where the system was such that its failure could result in a serious hazard, the degree of redundancy (i.e. multiplication of the primary systems or provision of emergency systems) was stipulated. Compliance was generally shown by some sort of an FMEA. For simple, self-contained systems this approach had its merits. However, systems rapidly became more complex. Complex systems have a considerable amount of interfaces and cross/interconnections between the electrical, avionic, hydraulic and mechanical systems. In addition, there are essential interfaces with the pilot, maintenance personnel and flight performance of the aircraft. The aircraft designer is thus faced not only with the analysis of each individual system independently, but also needs to consider how these systems act in concert with other systems. 

The cost of performing the hazard identification step depends on the size of the problem and the specific techniques used. Techniques such as brainstorming, what-if analyses, or checklists tend to be less expensive than other more structured methods. Hazard and operability (HAZOP) analyses and failure modes and effects analyses (FMEAs) involve many people and tend to be more expensive. But, you can have greater confidence in the exhaustiveness of HAZOP and FMEA techniques—their rigorous approach helps ensure completeness. However, no technique can guarantee that all hazards or potential accidents have been identified. Figure 8 is an example of the hazards identified in a HAZOP study. Hazard identification can require from 10% to 25% of the total effort in a QRA study. 

A risk assessment analyses systems at two levels. The first level defines the functions the system must perform to respond successfully to an accident. The second level identifies the hardware for the systems use. The hardware identification (in the top event statement) describes minimum system operability and system boundaries (interfaces). Experience shows that the interfaces between a frontline system and its support systems are important to the system cs aluaiion and require a formal search to document the interactions. Such is facilitated by a failure modes and effect analysis (FMEA). Table S.4.4-2 is an example of an interaction FMEA for the interlace and support requirements for system operation. 

In order to perform a complete, formal FMEA of a production facility, each failure mode of each device must be evaluated. A percentage failure rate and cost of failure for each mode for each device must be calculated. If the ri.sk discounted cost of failure is calculated to be acceptable, then there arc the proper numbers of redundancies. If that cost is not acceptable, then other redundancies must be added until an acceptable cost is attained. 

---