FMECA — What Can Go Wrong, Will Go Wrong

Murphy’s Law — And Why It Matters Underwater

Most people have heard of Murphy’s Law. It’s that universal truth you mutter when your toast lands butter-side down, or when you pick the slowest queue at the supermarket. If something can go wrong, sooner or later it will go wrong.

On dry land, Murphy’s Law is usually just an annoyance. Underwater, it can kill you. A rebreather is a life-support system operating in an environment where you cannot breathe on your own. If a seal fails, a valve sticks, or a sensor reads incorrectly, you may have only seconds to recognise the problem and respond. There’s no pulling over to the hard shoulder. There’s no switching it off and trying again.

That’s why engineers don’t just accept Murphy’s Law — they plan for it. They have a formal, structured way of sitting down before anything gets built and asking: what could go wrong here, how bad would it be, and what can we do about it? That process has a name, and it’s the subject of this page.

What Is FMECA?

FMECA stands for Failure Mode, Effects and Criticality Analysis. It’s a structured method for thinking through everything that could go wrong with a design — component by component, failure by failure — and then doing something about it before anyone’s life depends on it working.

The concept dates back to the late 1940s, when the United States military developed it to improve the reliability of weapons systems and aerospace equipment.¹ If you’ve ever heard of NASA’s obsessive approach to safety — checklists, redundancy, triple-verifying everything — FMECA is the framework that sits underneath a lot of that thinking. It has since been adopted across virtually every engineering discipline, from automotive to medical devices to nuclear power.

Today, FMECA is formalised in international standard IEC 60812:2018,² which defines the procedures for both FMEA (Failure Mode and Effects Analysis) and the more detailed FMECA variant that adds criticality ranking. For rebreather manufacturers seeking European type-approval, FMECA is referenced as a requirement under EN 14143,³ the European standard for self-contained re-breathing diving apparatus.

But you don’t need to be a certified manufacturer to use it. FMECA is just as valuable — arguably more valuable — for someone building a one-off unit in their workshop. Because when there’s no quality assurance department looking over your shoulder, you are the quality assurance department.

The Three Questions

At its heart, FMECA is beautifully simple. For every component in your rebreather, you ask three questions:

That’s it. The power of FMECA isn’t in its complexity — it’s in forcing you to systematically consider every possible failure, rather than just the obvious ones. It’s the failures you don’t think of that tend to cause the most trouble.

Think of it like a thought experiment. You pick up a component — say, a check valve in your breathing loop — and you imagine all the ways it could misbehave. It could stick open. It could stick closed. It could crack. It could be installed backwards. The O-ring could degrade. For each of these, you then ask: what would the diver experience? And finally: how likely is this, how serious is it, and what can I do to prevent it or detect it early?

Why It Matters for Rebreather Builders

You might be thinking: this sounds like something for big companies with engineering teams, not for someone building a unit in the garage. Actually, the opposite is true. Commercial rebreather manufacturers have entire teams doing this work. When you build your own, the thinking still needs to happen — it’s just that all of it rests on your shoulders.

The Deep Life project — an open-source rebreather programme — produced a 104-page mechanical FMECA document covering every component from cylinder valves to breathing hoses, O-ring seals to flapper valves.⁴ That document analysed over 40 individual components, each with its own design decision review, risk assessment, and failure mode analysis. The level of detail is remarkable — they tested flapper valves with configurations ranging from three to eight supporting fingers, discovering that anything fewer than six could allow the valve to ripple and leak under rapid pressure changes. They found that a standard BCD dump valve could partially seal due to sideways piston movement, leading to a complete redesign. They discovered that certain EPDM O-ring compounds contained a toxic softener called Thiram, prompting them to commission a specially formulated batch.

You don’t need to produce a 104-page document. But you do need to apply the same thinking. Even a simple, one-page FMECA table for each major component will dramatically improve the safety and reliability of your build. It forces you to confront the uncomfortable questions before you’re 30 metres underwater.

How To Do a FMECA — Step by Step

FMECA might sound formal, but the process is straightforward. Here’s how to approach it for a rebreather build:

• 1List your components

  Break your rebreather down into its individual parts: scrubber canister, canister seals, breathing hoses, check valves, mouthpiece/DSV, counterlung bladders, counterlung dump valves, cylinder valves, regulators, O-rings, fittings — everything. If it’s in the breathing loop or gas supply path, it goes on the list.

• 2Identify failure modes

  For each component, brainstorm every way it could fail. Don’t censor yourself — include even unlikely scenarios. A breathing hose could be punctured, kinked, disconnected, blocked, or installed backwards. An O-ring could be missing, the wrong size, degraded, contaminated with incompatible grease, or cut during assembly. Think about manufacturing defects, wear, user error, and environmental factors.

• 3Determine the effects

  For each failure mode, describe what would happen. Be specific: “water enters the breathing loop,” “CO₂ is not removed from exhaled gas,” “the diver cannot exhale,” or “PO₂ drops below safe levels.” Think about both the immediate local effect and the knock-on effect on the whole system and the diver.

• 4Rate the severity

  How bad is this if it happens? Use a simple three-level scale:

  • Low Inconvenient but not dangerous. The dive can continue safely.
  • Medium Dive must be aborted, but the diver can reach safety using standard procedures.
  • High Potential for serious injury or death if not immediately recognised and addressed.
• 5Rate the likelihood

  How probable is this failure? Again, keep it simple:

  • Unlikely Rare — requires multiple things to go wrong simultaneously.
  • Possible Could happen with normal use, wear, or a single human error.
  • Likely Will probably happen at some point unless specifically prevented.
• 6Assess detectability

  Can the diver detect this failure before or during a dive? A gross leak that fails a pre-dive pressure test is highly detectable. A slow O-ring degradation or a partially-stuck check valve might not be obvious until it’s too late.

• 7Define mitigations

  What can you do to prevent this failure, reduce its severity, or improve its detectability? This might be a design choice (use dual O-rings), a material choice (use EPDM instead of nitrile), a pre-dive check (positive and negative pressure test), a maintenance schedule (replace O-rings annually), or a redundancy (carry bailout gas).

The Risk Matrix

Once you’ve rated the severity and likelihood of each failure mode, you can plot them on a risk matrix. This is a simple grid that helps you visualise which failures need the most urgent attention. The idea comes from IEC 60812, which describes the criticality matrix method for prioritising failure modes.²

Anything that lands in the red zone (Critical Risk) must be addressed before you dive the unit. Orange (Significant Risk) items should be mitigated or accepted with clear awareness. Even green (Low Risk) items are worth recording — because conditions change, and a low-risk failure in warm water might become a significant risk in cold water.

Worked Example: Breathing Loop Check Valves

Let’s put this into practice. Check valves (also called one-way valves or flapper valves) are the components inside your mouthpiece or breathing loop that ensure gas flows in the correct direction — out through the scrubber on your exhale, and back to you on your inhale. They’re small, simple, and absolutely critical. Here’s what a FMECA looks like for this single component:

Component: Check valve (flapper)

Ensures one-way gas flow through the breathing loop — out through the scrubber on exhale, back to the diver on inhale.

Notice how even a tiny, inexpensive component like a flapper valve produces six distinct failure modes, several of which are rated as HIGH severity. This is exactly why FMECA is so powerful — it forces you to think about things you might otherwise dismiss as “too simple to go wrong.” The Deep Life project found through testing that flapper valves with fewer than six supporting fingers could ripple under rapid pressure changes, allowing gas to bypass the seal.⁴ That’s the kind of insight you only get from systematic analysis.

The FMECA Template

You don’t need fancy software to do a FMECA — a spreadsheet works perfectly well. Below is the template structure we recommend for rebreather builds. You can copy this table into your own spreadsheet, or download the ready-made template.

Column guide