The error models been specified, their effects on system harm risk have to be studied. To handle this activity, we tuned the FMECA array [10] (originally devoted to functional analysis). This section proposes to introduce the following elements into the FMECA array for a message failure mode analysis (see figure 7): the interaction or the message name, the failure modes or the errors identified thanks to the previous error models, the causes of those failure modes, the effects at a local, higher or system level, the **data** to estimate the risk (severity is the harm seriousness, and failure mode occurrence is noted as probability), the on-line means to detect failure modes and their effects, the possible means for risk prevention and protection and other pieces of information.