Fuzzy FMEA Application Combined with Fuzzy Cognitive Maps to Manage the Risks of a Software Project

Introduction

Information technologies have an important role in business life. To be able to compete with other companies, a company needs to have a successful information technology (IT). A successful IT construction can come true after a successful IT project. IT projects are high risky, complicated, expensive and they have uncertainty conditions. Because of these reasons IT projects have a high rate about being unsuccessful.

Companies need to manage well the risks of their IT projects under environmental conditions with high uncertainty, discrete small and incomplete data sets and lack of knowledge. There are some methods to manage the risks in literature. One of them is Failure Mode and Effect Analysis (FMEA). FMEA is an effective and highly used method to make risk assessment. FMEA uses experts’ views to make risk prioritization by finding Occurrence value (O), Severity value (S) and Not Detection value (D). FMEA calculates the Risk Priority Number (RPN) values by multiplying O, S and D values and finally sorts the RPN values by descending. This helps analysts to manage the risks of IT project. They easily realize the risks which they need to handle at first. But FMEA have some weaknesses while making risk assessment.

Fuzzy Logic is a method of reasoning that resembles human reasoning. Fuzzy logic produces acceptable but definite output in response to incomplete, ambiguous or inaccurate input. To overcome weaknesses of FMEA, there are lots of successful applications which contain fuzzy logic and FMEA together in literature. These methods aim to manage the risks of IT projects in spite of all deficiencies and uncertainty. On the other hand, this method doesn’t consider the relationships among the risks as a weakness.

Fuzzy Cognitive Maps (FCMs) is a technique that is used for modeling complicated systems and representing the cause-and-effect relationships among the components of complicated systems. In that study FCMs method is used in order to overcome the weakness of Fuzzy FMEA method. This final method calls as Fuzzy FMEA with FCMs. This new method aims to make risk management to consider the relationships among the risks in an IT project.

Literature Review and General Information

Failure Mode and Effect Analysis

FMEA is widely used in manufacturing industries in various phases of the product life cycle and is now increasingly finding use in the service industry(1). To help reliability-related problems, FMEA has been widely used in various manufacturing areas (2). In recent years FMEA has increased its scope and it is applied in service sector (3). In service sector, FMEA was offered providing the generic guidelines required applying to the service setting together with system FMEA, design FMEA and process FMEA (4). FMEA method was applied to IT Projects in service sector and they took interpretable results from it.

Moreover, FMEA is integrated to other methods in the literature. Braglia (2000) (5) extended FMEA method which is called Multi Attribute Failure Mode Analysis. Author has embedded FMEA to Analytic Hierarchy Process (AHP) in order to define importance levels of failure modes. Pillay and Wang (2003) (6) suggested a new approach and this approach covers Fuzzy logic and grey theory with FMEA. To weight the risk factor values, Chang (2009) (7) suggested the ordered geometric averaging method (OWGA) and decision-making trial and evaluation laboratory method (DEMATEL) to make prioritization the failure modes in FMEA.

FMEA is a reliability tool that is used for defining potential failures before they occur to minimize the risks’ effects (8) (9). The purpose of evaluation in FMEA method is to define the risks numerically which will occur and to prioritize them. In that stage the criticality level of each risk is defined, independently. In traditional FMEA, a risk priority number (RPN) is calculated to evaluate the risk level of a component/process (1). After RPN values are calculated, the results are sorted in by descending order. Since the higher value of RPN means that the associated risk is more critical, the resulting order helps analyst to investigate the solutions for preparedness and to determine the prevention and/or mitigation plans before risk occurrence. The RPN is obtained by finding the multiplication of three factors, as given in 𝑅𝑃𝑁= (2.1):

Representing this mathematically will give:

(2.1)

where O denotes the probability/occurrence of the failure, S denotes the severity of the failure and D denotes the probability of not detecting the failure. The process of FMEA is given in (Figure 2.1 FMEA Method).

Figure 2.1 FMEA Method

Fuzzy FMEA

There are important applications have been made in FMEA literature to overcome the shortcomings of the traditional RPN (10). Fuzzy FMEA logic uses experts’ view who describe the risk factors, and by using the fuzzy linguistic terms. To evaluate three risk factors, and the linguistic variables were used. Bowles and Pelaez described a fuzzy logic-based approach for prioritizing failures in FMEA which uses fuzzy linguistic terms to describe, S and D and the risks of failures (11). According to expert knowledge, fuzzy if-then rules were obtained and expertise provided finding the relationships between a risk and its, and values for every risk. Fuzzification process was run for crisp ratings for, and D to match the premise of each possible if–then rule. All the rules that have any truth in their premises were fired to contribute to fuzzy conclusion. The defuzzification process was finally applied to get the fuzzy conclusion the weighted mean of maximum method as the ranking value of risk priority (1).

Pillay and Wang (6) proposed a fuzzy rule base approach to avoid the use of traditional RPN. They tried to set up the membership functions of the three risk factors O, S and D. Membership functions have been developed and FMEA is applied in its traditional way with the use of brainstorming techniques. Each failure mode is assigned a linguistic term for each of the three risk factors. The three linguistic terms are integrated using the fuzzy rule base generated to produce a linguistic term representing the priority for attention. This linguistic term represents the risk ranking of the failure mode.

Fuzzy logic is a form of multi-valued that is obtained from fuzzy set theory to overcome reasoning that is approximate rather than precise (1). The fuzzy logic variable may have a membership value not only 0 or 1 but also a value inclusively between 0 and 1 (1). In fuzzy logic the degree of truth of a statement can range between 0 and 1 and is not constrained to the two truth values {true (1), false (0)} as in classic propositional logic (1). Approximate reasoning which is a made of reasoning that is not exact or very inexact is a basis provided by the fuzzy logic (1). The fuzzy logic proposes a more down to earth framework for reasoning than the traditional two-valued logic.

The name of fuzzy logic emerged by Lotfi Zadeh (12) as an outcome of the development of the theory of fuzzy sets. In 1965, Zadeh proposed fuzzy set theory (12), and later established fuzzy logic based on fuzzy sets. The process of fuzzy logic is given in (Figure 2.2 The methodology of Fuzzy FMEA) (1).

Figure 2.2 The methodology of Fuzzy FMEA

In the proposed approach, a fuzzy rule base is used to rank the potential causes identified within the FMEA, which would have identical RPN values but different risk implications. The approach then extends the analysis to include weighting factors for O, S and D using defuzzified linguistic terms.

Algorithm of fuzzy logic is as follows:

1. Calculate average O, S, D values for every risk ().

2. Find the membership functions and function levels for every input variable of risks.

3. Get the results according to membership function that is used.

4. Use Mamdani min/max method of inference mechanism and find the function levels and the minimum input value among values for every risk.

5. Find the function levels for output function by using output rules table.

6. Defuzzify the results by using center of gravity method.

Fuzzy Cognitive Maps (FCMs)

The origin of FCMs is the concept of CMs which is first proposed by Tolman (13). In order to represent the cause-and-effect relationships among the elements of a given environment in political and social sciences CMs has been applied (13) (14). Then, Axelrod claimed that CM with causality value + and - is adequate for simulating human cognition and following this decision makers don’t tend to prefer more complicated set of relationships to solve problems(14).

Kosko (15) proposed the Fuzzy Cognitive Maps (FCMs) technique in order to evolve a CMs model because of two important conditions.

Fuzzy logic can make casual relationships between nodes have different intensities. An uncertain value is more preferred rather than an exact value. Because of this reason, Kosko (16) proposed the Fuzzy Cognitive Maps (FCMs) technique in order to evolve a CMs model. A fuzzy number in that model can have a value between 0 and 1 or -1 and 1, including both (17). Each numerical value in the interval represents the grade of membership to a fuzzy set, where 0 is the non-membership and 1 the full membership (18). In addition to them, in FCMs, there is an initial vector of nodes which contains initial values at the instant 0 and the model simulate this vector at the instant t until it reaches a stable vector. So, this technique can forecast the future behaviors of a system which is working on. In addition, FCMs provide excellent mechanisms to develop forecasting exercises. Specifically, this technique enables us to develop what-if analysis, supporting the critical decision-making (19).

The nodes show dynamic variables in a dynamic system. The edges show directions and intensity of casual relationship among the variables. Each cause is assessed by its intensity , where is the pre-synaptic (causal) node and the post-synaptic (effect) node. The values are represented in the ( is the number of nodes) matrix called adjacency matrix, see 𝑨= (2.2) (17).

(2.2)

There are three possible types of causal relationships between nodes (17):

• : Positive causality between nodes and .

• : Negative causality between nodes and .

• : No causal relationship exists between nodes and .

It is possible to develop forecasting exercises, especially what-if analysis in FCMs. For this purpose, what-if scenarios at the instant are defined. In this way, the values of all nodes of FCM are entered in a initial state vector , see 𝑡 (2.3). The value of each node in the input vector can be 1 (element is activated) or 0 (element is not activated) (17).

(2.3)

where is the initial vector state (at the instant ), and is the initial value of the node (at the instant ) (17).

Subsequently, scenarios are simulated computing 𝑨= (2.2) and 𝑡 (2.3) through𝑗𝑡+1=𝑓 (2.4).

Activation functions such as the sigmoid, hyperbolic tangent, step and threshold linear can be used in the FCM inference process (20), (21), (22).

(2.4)

where is the activation function, the value of the post-synaptic (effect) node at the instant , the value of the pre-synaptic (causal) node at the instant , and indicate the intensity of the relationships between the pre-synaptic (causal) node and the post-synaptic (effect) node (17).

The nonlinear function f allows the activation to take an allowed value. In this study, we used sigmoid function.

Integrated Methodology for Risk Assessment: Fuzzy FMEA Integrated with Fuzzy Cognitive Maps

FMEA and Fuzzy FMEA processes are used for defining the importance of risks of projects but all these processes have a weakness. They don't consider the relationships among risks of projects. In order to overcome this weakness, we used Fuzzy Cognitive Maps by extending of these processes. For this extension we aimed to reach an extension coefficient to define a new Severity (S) value when the risks of a project affect each other by using Fuzzy Cognitive Maps. By this way the relationships among risks are considered to overcome the weakness of FMEA and Fuzzy FMEA. All these processes are applied after this extension.

The last value shows impact of node. At the end of FCM process every node reach an affected value. According to activation function that is chosen by practitioner, there is a sub limit of nodes. It means if the beginning value of node equals to zero, the result will be equal to sub limit. According to these values that are obtained at the end of FCM process, the coefficient value is calculated for every node. It means every risk will have a coefficient value and severity value of every risk will be calculated by these coefficient values.

(3.1)

where is the sub limit of nodes. is the last value of node . is the coefficient value of the risk . A new Severity value is obtained by 𝑗′ (3.2).

(3.2)

where is the new severity value that will be used for calculating the new importance levels by FMEA, and Fuzzy FMEA. For example, RPN value in FMEA is calculated by 𝑗 (3.3).

(3.3)

The process of FMEA is given in (Figure 2.1 FMEA Method). After FMEA process is expanded by Fuzzy Cognitive Maps the new FMEA process is given (Figure 3.1 FMEA Process by FCM).

Figure 3.1 FMEA Process by FCM

The process of Fuzzy FMEA is given in (Figure 2.2). After Fuzzy FMEA process is expanded by Fuzzy Cognitive Maps the new Fuzzy FMEA process is given (Figure 3.2).

Figure 3.2 Fuzzy FMEA Process by FCM

Case Study

Data Collection

IT software projects have risky, complex and hard-to-understand structures for managing by project managers. That’s why risk management plays an important role to achieve projects’ goals successfully.

We will investigate the risks of a real IT software project. The top management of a company needs a new software application to assign tasks, to follow users’ tasks, to watch the current situation and to have reports about these tasks. They have decided to develop an in-house project which satisfies their requirements by IT department. So, all these processes have risks and these risks need to be managed. At the end of this investigation, we will put them in order according to their importance and then we will make suggestions to managers to lead this project. In this investigation FMEA and Fuzzy FMEA were used as known methods. Risk prioritizations of these methods were compared and interpreted. In addition to this, to consider the relations among the risks we integrated Fuzzy Cognitive Maps to every method and then we compared all results to observe the changing risks’ priorities.

For this project we specified 23 risks as follows:

Table 4.1. Risks of IT Project

These risks are defined according to character of the case in point. So, for other projects, the risks need to be characterized according to conditions of the case or problem.

Application of New Method: Fuzzy FMEA Integrated with FCMs

To make prioritization we used a new method called Fuzzy FMEA and we also surveyed its stability the whether it is applicable or not. The simulation results showed us that it is a suitable method to assessment risks for projects under conditions with high uncertainty, under discrete small and incomplete data sets. After all this method still have a weakness that actually comes from nature of FMEA. This weakness is ignoring the relationships among the risks. FMEA and Fuzzy logic in that study are not enough to overcome that. As stated above in order to consider the relationships among the risks we used Fuzzy Cognitive maps.

In order to measure effects of FCMs on the other methods, we firstly applied it to FMEA and compared the results of two methods in themselves. Then secondly we applied it to Fuzzy FMEA and again compared the results of two methods in themselves. Finally Fuzzy FMEA integrated with Fuzzy Cognitive Maps is the goal that we want to reach. Comparisons in themselves of every couple methods also show that the integration process is a practicable process.

Fuzzy Cognitive Maps

This approach consists in adding the FCM drawing by each expert. A group of experts was carefully selected to participate in our study. Each expert individually designed his/her own FCM model, which represent his/her knowledge in IT projects. They thus pointed out which risks had threatened their projects’ risks. The experts also drew the interactions that exist between IT project risks nodes. That is, they specified the type and intensity of the casual relationships existing among nodes. Experts can indicate the causal connections using linguistic variables or real numbers. Those participating in the present study expressed all relations with a numerical value in a range of [-1, 1]. We thus achieved one adjacency matrix for each expert.

The Augmented FCM method finishes by adding the adjacency matrices of each one of them. This depends on if there are or are not common nodes. If there are not common risks, adjacency matrices will be solely added up. Otherwise, if there are common nodes, then the elements in the augmented matrix () are computed according to the following 𝑖𝑗𝐴𝑈𝐺 (4.1):

(4.1)

where is the number of FCMs added, one per expert, is the identifier for each FCM, and and are identifiers of the connections.

We computed the elements for the using (see Appendix A) because the experts’ FCM had common nodes.

You can reach all experts' views by this link:

https://drive.google.com/file/d/0B-OGfN4no_-TVmw4TTNmMUt0cjg/view?usp=sharing

Subsequently, we compared the FCM obtained with respect to the research conceptual framework to guarantee the logical validation. For the partial graphical representation of the model, see Appendix B.

In this way, we applied the hyperbolic tangent function Error! Reference source not found.), with a function slope () equal to 1 in the FCM simulations. The value of the FCM nodes is located within the range [0, 1] because we chose the risks according to positive causality or no causality. There is no negative causality among the nodes. In addition, this usually requires a lower number of interactions to reach a stable scenario in comparison to other activation functions.

In this study we defined the initial vector by looking RPN values of the risks. If RPN value of a risk is above 250, we set its initial value as 1 otherwise its initial value is 0 (see Appendix C).

Finally, all simulations reached a stability threshold. Appendix D also shows the results obtained at the end of each simulation.

Fuzzy Cognitive Maps end up when all simulations reached stability threshold. It means values of nodes don’t change after this stability. found. Appendix E shows every steps of simulation as a graphical notation.

These final values show how the risks were affected by the others. The findings show that these impacts are from 0.500 to 0.998. The average impact is 0.842. This indicates that the activated risks have a moderate and positive influence on the rest. The nine most highly impacted risks that their values are over 0.900 were R7 (0.998), R18 (0.996), R1 (0.995), R22 (0.990), R19 (0.988), R10 (0.986), R8 (0.948), R16 (0.948) and R4 (0.914).

R13 (0.500) has no affect because if there is no interaction, the value of node would be 0.500. This is a kind of result of the function method that we chose for application (sigmoid function). If the augmented matrix contained negative values, we would see interaction values under 0.500 as a result but as noted above while specifying the augmented matrix we just gave the values according to positive causality or no causality because when a risk occurred in a project, it will affect the project negatively and when the risk triggered another risk, this risk affected by first risk will also affect the project negatively. This makes a positive causality between two risks. All risks have been chosen in defiance of this logic. According to the function method the interactions of nodes are located within [0,1]:

Interaction value between two nodes < 0.500. It means negative causality is more than positive causality for the node that is affected by other nodes.

Interaction value between two nodes > 0.500. It means positive causality is more than negative causality for the node that is affected by other nodes.

Interaction value between two nodes = 0.500. It means there is no causality for the node.

Getting New Severity Values

To consider the relationships among the risk of project we firstly applied FCM to FMEA and compared effects on FMEA results.

Firstly, we have indicated a non-interactivity limit of nodes. This is 0.500 and it is a feature of the sigmoid function. Then we calculated the coefficient values of risks by using the non-interactivity limit 𝑗 (3.1). Finally we obtained the new Severity (S’) values and RPN (RPN') values by respectively using 𝑗′ (3.2) and 𝑗′ (3.3).

For example (For R1):

In that example, the new Severity value would be more than 10 but in FMEA O, S, D values' range is between 1 and 10. That's why we set 10 the value when the value is more than 10.

()

According to this information, for all risks, the new values () would be like in Appendix F.

In addition, if the value of a node was under 0,500 at the end all simulations, its coefficient value would be negative and it would make new severity value of the node less than old severity value.

FMEA Integrated with Fuzzy Cognitive Maps

The evaluation of the failure modes is carried out by scoring the respective risk factors of occurrence (O), severity (S), and not detection (D). For this purpose, usually 10-level scales are being used. While scoring the risk factors a variety of statistical techniques or expert opinion is referred to. In this study, all the risk factors were based on expert opinion.

In this project we have 5 experts and we asked to them O, S, D values for every risks and finally we calculated the arithmetic mean of their opinions to use them in FMEA application.

When we applied FMEA to the risks, the results are as follows in Table 4.2 as Old RPN and Old Prioritization.

According to FMEA results, while project managers consider the risks, they need to be careful R8, R2, R23, R19 and R14. If we assume that risks which their RPN value are above 300 are important, we could say that these risks has critical importance level according to FMEA method.

R17 – R22 and R3 – R7 risk groups have different risk factor values in themselves but their RPN values are same. It means they need to be evaluated in same level despite the fact that they have different values.

Table 4.2. Results of FMEA Integrated with FCM (Comparison)

While making prioritization we considered the old prioritization. Otherwise, the risks that their RPN values are equal to each other would have randomly been ordered in themselves.

According to results, there are two important effects above 100 (R8: 107,912 and R22:118,320) by means of this integration of FCM haven changed prioritization of R22. It made its prioritization from 7 to 4. It means integration of FCM have made it more important risk. There is one more risk like R22 but this time Integration of FCM have made it more unimportant risk by changing its priority from 13 to 16 (R3). These two risks have the largest changes according to other risks’ changes. That means FCM didn’t make a dramatic change.

In FMEA, R17 and R22 have same RPN values and their prioritizations are respectively 6 and 7. After integration of FCM R17 kept its place same (6) but R22 became more important risk (4) as mentioned above. There is a similar situation with a little difference for R3 and R7. In FMEA their RPN values are same and their prioritizations are respectively 13 and 14. After FCM while R7 increased its priority from 14 to 12, R3 has lost its importance a little bit and became from 13 to 16. This shows that when we considered the relationship among the risks this application could change their prioritizations. So, we can conclude that integration of FCM can affect the risks in three ways:

• FCM can increase risks’ importance levels: R22 (7→4), R16 (10→9), R5 (12→10), R7 (14→12), R1 (15→14), R6 (16→15), R10 (21→20)

• FCM can decrease risks’ importance levels: R19 (4→5), R14 (5→7), R13 (9→11), R9 (11→13), R3 (13→16), R15 (20→21)

• FCM can keep same risks’ importance levels: R8 (1→1), R2 (2→2), R23 (3→3), R17 (6→6), R21 (8→8) , R11 (17→17) , R18 (18→18), R12 (19→19), R4 (22→22), R20 (23→23)

Fuzzy FMEA Integrated with Fuzzy Cognitive Maps

A model was established for the FMEA technique having 3 inputs and 1 output variable. The RPN values were calculated by combining the associated 3 input factors. For the input variables of occurrence, severity and not detection a 5-level; and for the output variable RPN a 10-level triangular membership functions.

For input values, the 10-level scale is stated 5 regions as triangular membership functions. Input variables’ membership functions would be as below (Almost None, Low, Medium, High, Very High):

Table 4.3. Membership Functions of Input Variables

For output values, the 10-level scale is stated 10 regions as triangular membership functions. Output variables’ membership functions would be as below (None, Very Low, Low, High Low, Low Medium, Medium, High Medium, Low High, High, Very High):

Table 4.4. Membership Functions of Output Variables

How to Get Output Rules

To get output values, we have developed a new logic. In that way, every output values will have a mathematical calculation and same logic with the others.

Firstly, we have divided low, medium and high functions of input variables into two-side functions and then we have defined mathematical notations of input variables’ membership functions (as it is seen Table 4.3).

After we got the functions, we have calculated CoG values (center of gravity) of every input function.

Almost None (AN)
Low (L)
Medium (M)
High (H)
Very High (VH)

After input variables were processed we have divided out of none and very high functions of output variables into two-side functions and then we have defined mathematical notations of output variables’ membership functions (as it is seen Table 4.4).

We have calculated CoG values (center of gravity) of every output function to define ranges of output functions.

After we calculated CoGs and ranges of functions we have taken averages of every combination and then according to average values we have found fuzzy output function of every combination. Here is the Output rules table:

https://drive.google.com/file/d/12vNv3OQi4qmRefY2EmjNUcuGGpuvbjRA/view?usp=sharing

Results of Fuzzy FMEA

As to the types of failure, the fuzzy RPN values provided in the model are given in a descending order in (Table 5.5 Results of Fuzzy FMEA) in comparison with the RPN values of classical FMEA. The failure types containing the same RPN values were arranged according to the values of occurrence, severity and not detection (priority queues).

According to results the first 3 risks’ prioritizations and the last 6 risks’ prioritizations didn’t change but there are some prioritization variations for other risks but in general results show two methods have similar risk prioritizations. In Fuzzy FMEA, priorities of R17 (6 → 4), R22 (7 → 5) and R21 (8 → 6) has increased two steps according to FMEA. For R9, R19 and R14 we can say that they have the biggest changes in comparison of two methods. While R9 has increased its priority from 11 to 7, R19 and R14 have decreased their priorities four steps (R19: 4 → 8, R14: 5 → 9). In addition to that R5 has decreased its priority three steps. There is just one-step change for priorities of R13, R16, R3, R7 and R1. In general, we can say there is o an important variation.

As an example, R3 and R7 have same RPN values (126,72) while they have different risk factor values (R3:2,00*8,80*7,20=126,72, R7:6,60*4,80*4,00=126,72). According to FMEA, they need to be evaluated at same risk level and Fuzzy FMEA has set new risk levels for each risk but they still follow each other.

As a consequence, Fuzzy FMEA can keep a risk's priority stable or can decrease/increase it.

In this study we have to be careful while prioritizing the risks. For example, difference between FMEA RPN values of R19 (337,92) and R1 (120,96) is 216,96 even though they have same Fuzzy RPN values (6,00). For this study we can say it is pretty much difference. If we prioritized the risk by looking only Fuzzy RPN values, it would be a random prioritizing and consequently their priorities would take any number between 2 and 8. In response to this while prioritizing the risks we consider FMEA priorities of the risks. We firstly sort the risks according to Fuzzy RPN values and then we sort them again according to their FMEA priorities.

We have the new severity (S’) values from previous section to search how integrating FCM affects the Fuzzy FMEA results. This is just to apply Fuzzy FMEA method with new severity values. Membership functions, rule base for fuzzy output and methods in Fuzzy are same (Table 4.4 Membership Functions of Output Variables.

According to results, R8, R2, R23, R21, R16, R1, R11, R18, R12, R15 and R20 have still same Fuzzy RPN values and prioritizations. Integration of FCM to Fuzzy FMEA increased the importance levels of the risks: R22, R7, R5, R6 and R4 but however it decreased the importance levels of the risks: R17, R9, R19, R14, R13, R3, R10.

To put in a nutshell, the risk R7 has the largest dramatically variation. Its priority became from 13 to 7. That means it became much more important risk than before. Also, its Fuzzy RPN values increased to 7,000 from 6,000. However, the risk R3 has same Fuzzy RPN values in two methods but its priority has fallen back to 16 from 12. These two risks have same RPN values and same Fuzzy RPN values. But when considered the relationships among the risks they are taking different positions and behaviors.

However, we can conclude that there is no dramatically change as well as FMEA integrated with FCM.

There are some priority changes though their RPN values (Fuzzy RPN and Re-Fuzzy RPN) are equal in themselves. For example, R9 has same RPN values (7,000) but while its priority number is 7 in Fuzzy FMEA, its priority number is 8 in Fuzzy FMEA integrated with FCM. While making prioritization in Fuzzy FMEA we considered FMEA prioritization as mentioned above. This is also valid for Fuzzy FMEA with FCM. While making its prioritization we also considered prioritization of FMEA with FCM. That's why this risk's priority is different.

Conclusion

To sum up all processes, in the literature there are many methods to make risk assessment. In this study we investigated two of them: FMEA and Fuzzy FMEA. FMEA is a technique to make prioritization by descending RPN values which are taken by multiplying O, S and D values of risks.

To overcome the shortcomings of the traditional RPN, fuzzy logic is widely used in the literature. Fuzzy FMEA logic uses experts’ view who describe the risk factors O, S and D by using the fuzzy linguistic terms. In this study, we applied these two methods (FMEA and Fuzzy FMEA) to the real IT case and compared the results. Results showed us that there are some changes (not so dramatic) and the analysts can have a better and deeper method while making risk assessment.

In spite of this, these two methods have a weakness. They don’t consider the relations among the risks. That’s why we have decided to integrate Fuzzy Cognitive Maps to overcome this weakness of these methods. FCMs can make casual relationships between nodes have different intensities. The nodes show dynamic variables in a dynamic system. The edges show directions and intensity of casual relationship among the variables. In this way, we can observe when a risk happened, how affects the other risks.

After we applied these methods to the case by integrating FCM to each of them and compared the results. Results showed us that there are much more changes according to previous two methods but these changes are not so dramatic in general. That also means the new method can be used by practitioners to make risk assessment.

Table 5.5. Results of Fuzzy FMEA

Table 5.6. Results of Fuzzy FMEA Integrated with FCM

Appendix a. Augmented Matrix

Appendix B. FCM of IT Risks

Appendix C. Initial Vector

Appendix D. Steps of Simulation

Appendix E. Graphical Notation of Simulation

Appendix F. S Values and New S Values

References