FMEA and FTA in Functional Safety

Engineering likes simple answers, but functional safety rarely offers them. When you start assessing risk, it quickly becomes clear that one analysis method is not enough. In practice, two tools are used most often: FMEA and FTA. One looks at the world deductively, from failure to cause, and the other inductively, from cause to failure. Both try to answer the question: why can something go wrong and what can we do about it?

To understand why these analyses are so different and at the same time so complementary, let’s go through how they work, their strengths, limitations and typical uses.

Two ways of looking at a failure

FMEA – bottom up analysis

FMEA (Failure Modes and Effects Analysis) is an inductive method. You start from a component, signal, function or system element and check what happens if it malfunctions. In simple terms: you take a list of possible failures and consider their consequences.

This method works well when the system and its components are already known and the design is advanced enough to describe failure modes of individual parts.

FTA – top down analysis

FTA (Fault Tree Analysis) works the opposite way. It is a deductive method. You start with the problem, a specific undesired event. Then you analyse which combinations of causes could lead to it.

This approach breaks the effect into logical blocks and helps identify what must fail for the undesired event to occur.

Where in the design process are FMEA and FTA used?

FMEA

FMEA is best used during detailed design or component integration. It helps detect construction weaknesses, material issues, diagnostic gaps and other problems before testing.

Example: You design a brake control system. FMEA lets you analyse the effect of a stuck proportional valve, a failed pressure sensor or a leaking hydraulic line.

FTA

FTA is used when the undesired event is already defined. It can come from a risk assessment or from a real failure. FTA builds the logical structure of the issue and shows which combinations of faults lead to danger.

Example: A robot hits a human. FTA breaks it down into incorrect human position detection, missing protective barrier, insufficient diagnostics or a configuration error.

Who needs to be involved?

FMEA needs people who know the components

It requires knowledge of components, failure modes, reliability data and effects of malfunctions. The analysis usually involves designers, technologists and technical experts familiar with the details of the system.

FTA needs people who understand system logic

FTA focuses on functional dependencies, signal flow and safety mechanisms. Experts in functional safety often participate because the logical structure must reflect how the system should react to faults.

What can be obtained from FMEA and FTA?

What FMEA provides

• Identification of failure modes of individual components
• Assessment of their impact on the system
• Prioritisation of actions (e.g. RPN)
• Indications for diagnostics or design improvements

What FTA provides

• A logical structure leading to the undesired event
• Qualitative and quantitative analysis
• Knowledge of fault combinations that cause danger
• Possibility to calculate event probability
• Evaluation of safety measures and redundancy

Differences in functional safety

High integrity systems (SIL, ASIL, PL)

Functional safety standards often require FTA as part of the argumentation that a system meets architectural safety requirements. It helps model diagnostics, redundancy and logic of protections.

FMEA, on the other hand, covers risk on the component level. It shows how a part can fail but does not model interactions between elements.

Deduction vs induction

FMEA asks: what happens if this fails?

FTA asks: what must fail for this to happen?

When FMEA fails

• When an undesired event comes from a rare combination of multiple causes
• When the order of events is important
• When interactions between components are nonlinear
• When evaluating redundancy or effectiveness of safety measures

When FTA fails

• At very early design stages
• When the system is so large that the tree becomes unmanageable
• When you need a list of component failure modes
• When construction details of individual parts matter

Strengths of both methods

Advantages of FMEA

• Good at detecting weaknesses in design
• Simple to perform
• Clear risk priorities
• Useful in design and upgrades

Disadvantages of FMEA

• No system-wide perspective
• Hard to capture interactions between components
• Not suitable for modelling redundancy

Advantages of FTA

• Identifies combinations of faults
• Shows the structure of causes
• Supports quantitative analysis
• Evaluates protections and diagnostics

Disadvantages of FTA

• Requires strong understanding of the whole system
• Can be time consuming
• Becomes impractical for extremely large systems
• Too detailed when only component-level faults are needed

How it works in practice in functional safety

Modern systems include hardware, software, redundancy and diagnostics. To assess them according to SIL, ASIL or PL, both methods are required.

Typical process:

1. FMEA – identify component failure modes.
2. FTA – model undesired events and logic.
3. Compare results and evaluate safety architecture.
4. Implement mitigation both on component and system level.

Without FMEA you don’t know what can fail. Without FTA you don’t know which failures matter.

Summary

FMEA and FTA look at risk from different angles. FMEA shows how components fail. FTA shows how the system behaves and how causes interact. They complement each other. One shows what can break. The other shows what that leads to. Together they give a full picture of risk.