FMEA — method and step-by-step example

1Qu'est-ce que l'AMDEC

L'FMEA (Failure Modes, Effects and Criticality Analysis) works at component level : for each equipment function, it systematically lists how it may fail (failure modes), their effects on the system, and their causes, and calculates a Risk Priority Number (RPN) combining three factors: severity, occurrence, and detectability.

It is the preferred tool for prioritising preventive maintenance: instead of maintaining everything identically, FMEA identifies where effort should be concentrated.

Normative reference: NF EN IEC 60812 — Failure modes and effects analysis (FMEA and FMECA). The method originated in the US military and aerospace industry (standard MIL-STD-1629A, 1949) before spreading to automotive and process industries.

2Definitions

Term	Definition
Failure	Loss of an item's ability to perform a required function (NF EN 13306—maintenance). This is the event: the component stops fulfilling its function.
Failure mode	The observable way in which a failure manifests, such as loss of flow, leakage, or stuck open. One component may have several distinct failure modes, each analysed separately.
Cause	The physical or operational origin that triggers the failure mode, such as wear, clogging, or power-supply failure.
Effect	The consequence of the failure mode on the function, system, or user, such as production shutdown or alarm activation.

A simple rule to distinguish mode from cause: the failure mode answers “ what happens? ”; the cause answers “ why? ».

3Before starting: model the system

FMEA relies on an initial breakdown of the facility into systems, functions and components —this breakdown defines the rows in the FMEA table (one component × one function × one failure mode per row). See the cross-cutting concept Facility modelling, shared by PHA, HAZOP, and Bow-Tie.

4Method steps

Break down the system into components and functions (see modelling above).
List the failure modes of each function, such as failure to start, leakage, or blockage.
Describe the effects of each mode on the system and its environment.
Identify the causes that may produce the failure mode.
Rate Severity, Occurrence, and Detectability and calculate theRPN (see the following sections).
Define corrective measures (prevention and protection) and rate the RPN again after measures.

Sorting the table by descending RPN immediately reveals which failure modes should be addressed first—the method's most direct use.

5Rate risk in FMEA

The general principles for rating risk—matrix, scales, and before/after measures—are shared by all methods. See the cross-cutting concept Rate a risk. FMEA differs by using three specific metrics, each rated from 1 to 5:

Metric	1	3	5
Severity	Minor—minor disruption, no injury	Severe—serious injury or prolonged shutdown	Catastrophic—multiple deaths or destruction
Occurrence	Very rare—less than once per 10,000 hours	Occasional—once per 100 hours	Very frequent—more than once per hour
Detectability	Very high—detection almost certain before effects	Medium—detection possible but uncertain	Very low—not detectable before occurrence

Detectability is the only inverted metric : a value of 1 is bonne (detection is almost always timely), while a value of 5 is mauvaise (no means of detection)—see the dedicated section below.

6The Detection parameter

The detectability measures the ability to detect the failure mode before it produces its effects—not the ability to detect a failure after it has occurred. This makes it specific to FMEA: neither PHA nor Bow-Tie uses it directly; they reason in terms of barriers.

Level	Sens	Typical means of detection
1 — Very high	Detection almost certain before effects	Capteur continu + alarme + redondance
2 — Haute	Probable detection	Regular automatic check
3 — Moyenne	Detection possible but uncertain	Periodic inspection
4 — Faible	Difficult to detect	Inspection visuelle manuelle
5 — Very low	Not detectable before occurrence	No means of detection

Improving detectability is often the fastest way to lower RPN: adding a sensor generally costs less and takes less time than reducing the occurrence of a mechanical failure.

7The Risk Priority Number (RPN)

L'RPN (Risk Priority Number) is calculated as a simple product:

RPN = Severity × Occurrence × Detectability

With three metrics rated from 1 to 5, RPN ranges from 1 to 125. The resulting level guides maintenance-plan prioritisation:

RPN	Level
1 – 20	Negligible
21 – 40	Mineur
41 – 60	Significatif
61 – 100	Critique
101 – 125	Inacceptable

A moderate RPN may conceal a severe scenario: Severity 5 with low Occurrence and Detectability (1 each) gives an RPN of 5, although the consequence remains catastrophic if it occurs. Many FMEA methods add a rule that every row with maximum Severity must be reviewed individually regardless of overall RPN.

8Preventive and protective measures

Type	Definition	Acts on	Category examples
Prevention	Reduces the probability that the failure mode occurs	Occurrence	Planned preventive maintenance, component redundancy, operator training, and selection of more durable materials
Protection	Limits or detects effects once the failure mode has begun	Detectability / Severity	Automatic detection (sensor and alarm), emergency-stop device, safety relief valve, and personal protective equipment (PPE)

A preventive measure acts before the failure mode appears; a protective measure acts after —the same distinction used in the Bow-Tie between barriers on the cause and consequence sides.

9Example completed in Polyodos

The Polyodos demonstration dataset for a drinking-water treatment plant covers three systems— Pumping (raw-water intake and discharge), Chemical Treatment (neutralisation, flocculation, and disinfection), and Storage (treated water and reagents)—with a five-row FMEA table rated before measures:

#	System	Component	Failure mode	Effets	Causes	G	O	D	RPN
1	Pumping	Pompe centrifuge P-101	Loss of flow	Insufficient downstream treatment, low-flow alarm	Clogged intake strainer, impeller wear	G3	O3	D2	18Negligible
2	—	Electric motor M-101	Unexpected shutdown	Pumping shutdown, interruption of treated-water production	Thermal overload, power-supply failure	G4	O2	D1	8Negligible
3	Chemical Treatment	Doseur chlore D-201	Surdosage chlore	Non-compliant water (THM), risk of mucous-membrane irritation	pH-sensor drift, dosing valve stuck open	G4	O2	D2	16Negligible
4	—	Agitateur A-201	Agitator shutdown (shaft blockage)	Poor mixing, chlorination dead zones	Foreign object in the tank, bearing failure	G2	O2	D3	12Negligible
5	Storage	Vanne de vidange V-301	Ouverture intempestive	Uncontrolled draining of the 500 m³ tank, downstream flooding	Pneumatic-actuator failure, operator error	G4	O1	D2	8Negligible

FMEA table — Polyodos demonstration dataset for a drinking-water treatment plant (before measures)

The most critical mode in this dataset is row 1 (RPN 18): Loss of flow on centrifugal pump P-101. The selected corrective measures— monthly strainer cleaning (prevention, reducing occurrence) and weekly flow measurement (protection, improving detectability)—reduce the rating to Severity 3 · Occurrence 2 · Detectability 1, giving an after-measures RPN of 6.

Section to be expanded — Polyodos screenshots showing entry of this table and the view sorted by RPN.

10Common mistakes

Mistake	Why it is a problem
Confusing failure mode and cause	The mode is what fails (e.g. leakage); the cause is why (e.g. a worn seal). Reversing them makes the table inconsistent and corrective actions poorly targeted.
Overrating detectability through optimism	Overestimated detectability conceals real risk: a hard-to-detect mode must remain rated accordingly until a detection device is actually in place.
Forgetting to rate again after measures	Without an after-measures RPN, it is impossible to verify that corrective action actually reduced criticality or justify its effectiveness in an audit.
Relying only on overall RPN	Maximum Severity combined with low Occurrence may produce a moderate RPN while remaining catastrophic if it occurs. Do not ignore high-Severity rows merely because their RPN seems acceptable.