As the primary purpose of an FMEDA is to predict a set of reliability metrics for use in safety function verification, it is critically important that the impact of design choices within the device are properly reflected in the FMEDA analysis. Perhaps the most critical design choice impacting FMEDA is the response of the device when an automatic diagnostic detects an internal failure. In the early evolution of safety devices, automatic diagnostics were used to force the safety output to its safe state whenever an internal failure of the device was detected. Later, probabilistic modeling showed that other options could be much better depending on the intended applications.
