FMEDA Overview
Overview
FMEDA (Failure Modes, Effects, and Diagnostic Analysis) is one of the core activities of ISO 26262 hardware safety.
It provides a structured method to:
- identify failure modes
- evaluate their effects
- determine diagnostic coverage
- quantify residual FIT
- verify compliance with ASIL hardware metrics (SPFM, LFM, PMHF)
FMEDA is both a design tool and a verification artifact, linking architecture, diagnostics, and quantitative safety metrics.
Figure 1: FMEDA in the Safety Lifecycle
FMEDA links architecture, failure modes, diagnostics, and quantitative safety metrics. It determines diagnostic coverage, residual FIT, and compliance with ASIL hardware requirements.
Purpose of FMEDA
FMEDA provides:
- Failure mode identification for each block
- Safety impact classification (safe, detected, latent, single‑point)
- Diagnostic coverage calculation
- FIT contribution estimation
- Residual FIT and PMHF evaluation
- Traceability between architecture, diagnostics, and safety goals
It is the quantitative backbone of hardware safety.
FMEDA Structure
A typical FMEDA includes:
- block description
- failure modes
- failure effects
- safety classification (SPF, LFM, safe, detected)
- diagnostic mechanisms
- diagnostic coverage
- FIT values (intrinsic and residual)
- PMHF contribution
- assumptions of use (AoU)
- verification notes
FMEDA is both a design artifact and a certification deliverable.
Failure Mode Classification
ISO 26262 classifies hardware failures into:
- Safe faults — no safety impact
- Detected faults — detected by diagnostics
- Single‑point faults (SPF) — directly lead to a hazard
- Residual faults — undetected dangerous faults
- Latent faults — hidden faults in redundant paths
- Multiple‑point faults — combinations of faults
FMEDA quantifies each category.
Diagnostic Coverage (DC)
Diagnostic coverage is defined as:
DC=\frac{\mathrm{Detected\ Dangerous\ Faults}}{\mathrm{Total\ Dangerous\ Faults}}
DC determines:
- SPFM
- LFM
- residual FIT
- PMHF compliance
Diagnostics include:
- ECC
- CRC
- watchdogs
- LBIST / MBIST
- monitors
- plausibility checks
- redundancy cross‑checks
FIT and PMHF Evaluation
FMEDA uses FIT values to compute:
- dangerous FIT
- residual FIT
- PMHF contribution
ISO 26262 PMHF limits:
- ASIL D → ≤ 10 FIT
- ASIL C → ≤ 100 FIT
- ASIL B → ≤ 300 FIT
FMEDA ensures the architecture meets these limits.
Why FMEDA Must Be Done Early
FMEDA influences:
- architecture
- redundancy
- diagnostic mechanisms
- safe‑state feasibility
- timing constraints
- component selection
- DFT strategy
If FMEDA is done late:
- PMHF limits may not be met
- diagnostics may be impossible to add
- redesign becomes unavoidable
FMEDA is a design‑time activity, not a post‑processing step.
