FMEDA: Local Effects vs Global Effects

Sep 3

4 min read

Introduction

An FMEDA (Failure Modes, Effects and Diagnostic Analysis) is the quantitative sibling of the FMEA we've written about before. Doing an FMEDA on a circuit means going through every component and asking how this fail could, and what is the effect. We then need to determine the immediate effect of the failure and the overall effect on the system

We'll use one example throughout: A battery voltage monitor.

A 12 V battery feeds a resistor divider R1/R2 (see figure below, left) that scales it to a nominal 3.0 V, a low-pass filter RF/CF cleans off the alternator ripple, and the filtered node goes to the controller's ADC. The reading drives under- and over-voltage protection.

Figure: battery voltage monitor circuit

What is a local effect?

The local effect is what the failure does to the circuit itself, the immediate, electrical consequence, described in volts, currents, and signals.

If CF fails short, the local effect is that the ADC node is clamped to ground, the monitor reads ~0 V while the battery sits at a healthy 12 V. If R2 fails open, the local effect runs the other way: the divider stops dividing, and the ADC node rises toward the full battery voltage, far beyond anything the ADC is scaled to read.

Notice that the local effect says nothing yet about safety. It is an observation about the circuit, nothing more.

What is a global effect?

The global effect (the system effect) is what that circuit-level change means for the function the system performs, and it is described in the language of the vehicle or machine, where the circuit is implemented

Continuing the example: CF shorted, so the controller now reads zero battery voltage regardless of the true voltage. The global effect: a false under-voltage condition, the system believes the battery is dead and may shut down or degrade functions on a battery that is perfectly healthy. For R2's open, the reading isn't wrong-but-plausible, it's impossible, and the global effect depends entirely on how the system treats an impossible reading: caught by a limit check, it becomes a reported sensor fault; taken at face value, it becomes a false over-voltage reaction.

Same schematic, two very different system consequences, and it's the global effect, not the local one, that determines whether a safety goal is violated.

How we determine local effects

This is where most FMEDAs rely on judgment or a component library, and where SLIKWORKS uses simulation instead. The platform takes the design's actual SPICE netlist, computes each component's failure modes and their failure-rate shares from the reliability standards, injects every mode that has a circuit representation directly into the netlist, and simulates each faulted circuit alongside an unfaulted "golden" run of the same design. Comparing the two runs at the measured nodes gives the local effect as a measurement. In this campaign, that meant twelve faulted netlists, covering 100% of the document's tabulated failure rate, each judged against the golden run.

For CF short, the simulation shows the ADC node collapsing from 3.0 V to ground while the battery voltage is untouched: the monitor went blind, not the battery.

Figure: golden vs faulted (CF_short), V(adc)

For the fault, R1 drifting 50% high, the simulation shows the ADC reading settling around 2.2 V instead of 3.0 V, the divider ratio changed, so the monitor quietly under-reports the battery by more than 25%. A plausible-looking number, wrong by enough to swallow the entire protection margin, and a value no component library could predict, because it depends entirely on this circuit's resistor ratio.

Figure: golden vs faulted (R1_drift(50)), V(adc)

Some faults lead to different effect. CF failing open barely moves the DC reading at all, the divider still divides. What changes is that the 10 kHz alternator ripple, which the filter existed to remove, now arrives at the ADC at full strength.

Figure: golden vs faulted (CF_open), V(adc)

RF failing open shows a fourth kind of graph. The filter resistor breaks the path from the divider to the ADC node, but the capacitor is still there, holding its last voltage. The reading doesn't collapse and doesn't jump, but instead freezes near its last value, and the ripple that normally rides on it vanishes. A stale-but-plausible number, and it was flagged in the campaign not by its DC level but by the run that the node had gone quiet.

Figure: golden vs faulted (RF_open), V(adc)

How we determine global effects

Global effects cannot be simulated out of a netlist alone, because they depend on what the system does, which is knowledge the analyst owns. So, in SLIKWORKS the analyst defines the system effects for the item (e.g., "spurious shutdown on a false under-voltage", "loss of battery monitoring"), and each failure mode is then assessed against them, with the simulated local effect supplied as evidence.

For CF short, the assessment connects "ADC node reads zero while the battery is healthy" to "false under-voltage spurious shutdown" and matches it against the declared safety mechanisms (for instance, a range-plausibility check on the ADC reading). For R2 open, the same process connects "ADC node rises toward full battery voltage, far beyond the ADC's range" to a detected out-of-range condition, a loud failure a simple limit check catches.

The takeaway

Local effects belong to the circuit; global effects belong to the system. A trustworthy FMEDA measures the first and reasons carefully about the second, instead of guessing at both.