Two opposite directions of reliability thinking — and why safety-critical industries insist on doing both.
Put an FMEA worksheet next to a fault tree diagram and, at a glance, they can look like two ways of writing down the same information. They aren't. FMEA starts at the smallest scale — one component, one failure mode — and works upward, asking what would happen to the system if that specific part failed that specific way. Fault Tree Analysis starts at the largest scale — one specific, already-chosen catastrophe — and works downward, asking exactly which combination of lower-level failures would have to happen together to cause it. Same underlying failures, opposite direction of reasoning, and each method is structurally blind to something the other one catches.
FMEA — Failure Mode and Effects Analysis.Bottom-up and inductive. Analysts work down a parts list, and for every component ask: in how many distinct ways could this specific part fail, and if it failed that way, what would be the effect on the overall system? Each failure mode gets scored for severity, how often it's expected to occur, and how likely it is to be detected before it causes harm — combined into a Risk Priority Number (RPN) that ranks which failure modes deserve attention first. It is exhaustive by design: every component, every plausible failure mode, evaluated on its own, one row at a time.
Fault Tree Analysis (FTA). Top-down and deductive. Analysts start from one specific, already-chosen undesired top event — a system-level failure, such as "loss of hydraulic power" — and work backward, asking: what combination of lower-level failures could cause exactly this? The answer is built as a tree of intermediate events connected by logic gates — an OR gate means either input alone is enough, an ANDgate means both inputs must happen together — down to basic events: the same component-level failure modes FMEA catalogs. FTA doesn't sweep through every possible failure the way FMEA does; it starts from one target and works down to find the combinations that reach it.
FMEA's structure — one component, one failure mode, one upward question — is exactly what makes it exhaustive: nothing on the parts list gets skipped. But that same structure means it doesn't naturally show how multiple simultaneous failures might combine to cause a specific system-level disaster; a bearing failure and an undetected sensor drift are each scored on their own, never as a pair. Fault Tree Analysis is built to answer exactly that question — for one chosen top event, it reveals precisely which combinations of lower-level failures, tied together through AND/OR logic, would produce it. Its limitation is the mirror image of FMEA's strength: FTA requires you to already know or choose which top-level event to analyze, and it does not systematically sweep through every possible component failure the way FMEA does. This is exactly why aerospace, nuclear, and automotive functional-safety programs commonly use both together— FMEA to systematically catalog and rank every conceivable component-level failure mode, and FTA to deeply analyze the specific combinations of events that could cause the most severe system-level top events that FMEA's ranking flagged as worth that closer look.
No — they analyze reliability from genuinely opposite directions and answer different questions. FMEA systematically sweeps through individual component failure modes bottom-up, which makes it excellent for exhaustive component-level risk ranking but structurally blind to failure-combination scenarios. FTA deductively works top-down from one chosen catastrophic event to reveal exactly which failure combinations — via AND/OR logic — could cause it, but it requires already knowing which top event to analyze; it can't discover candidate top events on its own. Treating them as interchangeable means picking up one method's strength while keeping the other method's blind spot wide open.That's exactly why safety-critical system design commonly runs both — FMEA first (or in parallel) to find and rank the failure modes worth worrying about, then FTA on the worst of those to see how they could combine into a system-level disaster.
FMEA (Failure Mode and Effects Analysis) and Fault Tree Analysis (FTA) are complementary but opposite reliability methods. FMEA is bottom-up and inductive: it works through a parts list one component and one failure mode at a time, asking what effect each specific failure would have on the system, and ranks the results with a Risk Priority Number (RPN). FTA is top-down and deductive: it starts from one chosen system-level top event and builds a tree of AND/OR logic gates down to basic component failures, revealing exactly which combinations of failures would cause that event. FMEA is exhaustive at the component level but can miss multi-failure combinations; FTA reveals those combinations but only for the top event you chose to analyze.
FMEA asks, for every component and every plausible failure mode: "if this fails this way, what happens to the system?" It works upward from the smallest scale and does not require the analyst to know in advance which system-level failures matter most — it discovers and ranks them via severity, occurrence, and detection scores combined into an RPN. FTA asks the reverse question, for one specific system-level event chosen in advance: "what combination of lower-level failures could cause exactly this?" It works downward through intermediate events and logic gates (AND = both required, OR = either sufficient) to basic events — the same component-level failure modes an FMEA would catalog individually.
FMEA's one-failure-mode-at-a-time structure is what makes it exhaustive, but it also means FMEA does not naturally surface scenarios where two or more failures occurring together — rather than any single failure alone — cause a system-level disaster; common-cause and combination failures can slip through. FTA is purpose-built to reveal exactly those combinations, but only for the specific top event an analyst has already selected to investigate; it does not systematically sweep through every possible component failure mode the way FMEA does, so a critical failure mode that was never chosen as a top event may never get a fault tree built around it at all.
Aerospace, nuclear power, and automotive functional-safety programs (e.g., ISO 26262, IEC 61508, ARP4761) commonly require both analyses on the same system for exactly this reason. FMEA runs first, or in parallel, as a systematic sweep that catalogs and ranks every conceivable component-level failure mode. The highest-severity or highest-RPN failure modes it surfaces then become candidate top events for one or more fault trees, which are built to test whether — and how easily — those failures could combine with other, seemingly unrelated failures to produce the worst system-level outcomes. Neither analysis substitutes for the other; together they cover both the exhaustive-sweep and the combination-of-failures views of the same system.
Not quite. FMECA (Failure Mode, Effects, and Criticality Analysis) is FMEA with an added formal criticality ranking step — typically plotting severity against probability of occurrence on a criticality matrix — rather than (or in addition to) the RPN used in a standard FMEA. The failure-mode cataloging step is the same; FMECA just adds a more rigorous criticality classification on top of it.
No. Building a full fault tree for every single failure mode an FMEA identifies would be impractical and largely redundant, since FMEA already ranks them. In practice, FTA is reserved for the highest-severity or highest-RPN failure modes — and especially for system-level top events where the concern is that multiple failures might need to combine to produce the worst outcome.
An OR gate below an event means any one of its inputs occurring is enough, on its own, to cause that event — the inputs are alternative causes. An AND gate means all of its inputs must occur simultaneously (or in the required sequence) for the event above it to occur — the inputs are a required combination. Reading a fault tree means tracing, gate by gate, which minimal combinations of basic events (called "minimal cut sets") are sufficient to reach the top event.
FMEA is typically done first, or in parallel with early design. It has no prerequisite — it can be run directly from a parts list and a bill of failure modes. FTA typically follows, once FMEA (or engineering judgment) has identified which system-level events are severe enough to deserve the deeper, combination-focused analysis a fault tree provides.
No — a single fault tree is built for exactly one top event. Analyzing a second undesired system-level event requires building a second, separate fault tree, even if some of the same basic events (like a shared bearing or sensor failure) appear as inputs in both trees.
Try our Industrial & Systems Engineering Studio
More calculators, simulators, and guides for this discipline.