7.11 Types of Risk and Failure Mode and Effects Analysis
Key Takeaways
- The risk types named in the Body of Knowledge are enterprise, operational, supplier, security, product, and cyber-security.
- RPN is severity times occurrence times detection, each rated 1 to 10, giving a range of 1 to 1000.
- Severity can only be reduced by design change; occurrence by process or design change; detection by improved controls.
- Any failure mode with severity of 9 or 10 requires action regardless of its RPN.
- DFMEA analyzes failure modes of a product design and is completed before production drawings are released; PFMEA analyzes failure modes of a manufacturing or transactional process.
Types of risk
The Body of Knowledge asks Black Belts to identify, assess, and prioritize risk at the Analyze level, naming six categories.
| Risk type | What it covers | Typical Six Sigma exposure |
|---|---|---|
| Enterprise | Strategic, financial, reputational, regulatory risk to the organization | A project that changes a validated process, or that touches a regulated claim |
| Operational | Failure of people, processes, or systems in day-to-day execution | Process changes, control plan gaps, capacity constraints |
| Supplier | Input quality, delivery, financial viability, single sourcing, geography | Tolerance changes passed upstream; sole-source components |
| Security | Physical security, personnel safety, asset protection | Changes to access, guarding, or material handling |
| Product | Safety, liability, recall, field performance, warranty | Any change to a safety-critical characteristic |
| Cyber-security | Data integrity, availability, confidentiality, connected equipment | Changes to MES or SCADA systems, new data flows, IoT sensors |
Assessment is conventionally a two-dimensional judgment of likelihood and impact, plotted on a risk matrix, with a third dimension of detectability added in FMEA. Prioritization follows the product, and treatment follows the standard four options: avoid (do not do it), mitigate (reduce likelihood or impact), transfer (insure or contract out), or accept (document and monitor).
FMEA
Failure mode and effects analysis is a systematic, bottom-up method for identifying how something can fail, what happens when it does, why it happens, and what controls exist to catch it.
DFMEA versus PFMEA
| Design FMEA (DFMEA) | Process FMEA (PFMEA) | |
|---|---|---|
| Subject | The product or system design | The manufacturing or transactional process |
| Failure mode | A way the design fails to meet its intent | A way the process step fails to produce conforming output |
| Cause | Design deficiency: material choice, tolerance stack, geometry | Process deficiency: setup, tooling, method, input variation |
| Timing | During design, before production drawings are released for tooling | During process design and before launch; revisited at every change |
| Controls | Analysis, simulation, prototype and design verification testing | Error-proofing, SPC, inspection, standard work |
| Typical owner | Design engineering | Manufacturing or process engineering |
The timing point is tested: the DFMEA must be complete before production drawings are released for tooling, because after tooling is committed the cost of a design change escalates sharply.
The rating scales
Each failure mode is rated on three 1-to-10 scales.
| Rating | Severity (S) -- effect on the customer | Occurrence (O) -- likelihood of the cause | Detection (D) -- ability of current controls to catch it |
|---|---|---|---|
| 1 | No discernible effect | Failure eliminated by design | Certain detection; error-proofed |
| 2-3 | Minor annoyance | Very low, isolated | High chance of detection |
| 4-6 | Moderate; customer dissatisfied, some function lost | Occasional | Moderate chance |
| 7-8 | High; primary function impaired | High, repeated failures | Low chance |
| 9-10 | Hazardous, or violates a regulation, possibly without warning | Very high; failure is almost inevitable | Cannot detect, or no control exists |
Note that detection is inverted: a high detection rating means poor detection ability. Reversing this is the single most common FMEA error.
The risk priority number
The range is 1 to 1000. RPN ranks failure modes for action, but three rules govern its use:
- Severity 9 or 10 requires action regardless of RPN. A safety or regulatory failure mode rated $S=10$, $O=1$, $D=1$ has an RPN of 10, which would sit at the bottom of any ranked list, and it still requires action. Many organizations therefore also compute criticality, $S \times O$, and screen on severity first.
- RPN is ordinal, not ratio. An RPN of 200 is not twice as bad as 100, because the underlying scales are ordinal. Comparing RPNs across different FMEAs with different rating conventions is invalid.
- RPN gaps are lumpy. Because it is a product of integers, RPN takes only 120 distinct values in the 1-1000 range, and threshold rules such as "act on everything above 100" create arbitrary cliffs. Newer practice (including AIAG-VDA) replaces the RPN threshold with an action priority table that evaluates S, O, and D jointly.
Reducing each component
| To reduce | You must | Example |
|---|---|---|
| Severity | Change the design or the system so the effect is less harmful | Add a mechanical stop so failure cannot injure; fail-safe circuit |
| Occurrence | Change the design or the process so the cause happens less often | Error-proof the setup; tighten an upstream tolerance; supplier development |
| Detection | Improve the controls that catch the failure | Add SPC on the characteristic; automated vision check; 100% test |
Only a design or system change reduces severity. Adding inspection never reduces severity and never reduces occurrence -- it only improves detection. Teams that respond to a high RPN by adding inspection are treating the cheapest number to move rather than the risk, and it is the least effective of the three. The preference order is always: eliminate the failure mode, then reduce occurrence, then improve detection.
The resulting RPN
The Body of Knowledge is specific on timing: the resulting RPN is calculated after corrective actions have been identified and completed. Re-rating before the action is verified records intent, not result. In practice the FMEA carries both the initial and the resulting ratings so the effect of the action is visible.
Worked example
A PFMEA line for a torque-controlled fastening operation:
| Field | Entry |
|---|---|
| Process step | Fasten bracket to housing |
| Failure mode | Under-torqued fastener |
| Effect | Bracket loosens in service; potential loss of function |
| Severity | 8 |
| Cause | Tool calibration drift |
| Occurrence | 5 |
| Current control | Operator visual check of torque wrench display |
| Detection | 7 |
| Initial RPN | $8 \times 5 \times 7 = 280$ |
| Action | Torque transducer with automatic reject and 30-day calibration interval |
| Resulting O | 3 |
| Resulting D | 2 |
| Resulting RPN | $8 \times 3 \times 2 = 48$ |
Severity remains 8 because the consequence of an under-torqued fastener in service is unchanged; only a design change -- for example a self-locking fastener that cannot loosen -- would reduce it.
Running an FMEA well
- Do it with a cross-functional team; a single engineer produces a document, not an analysis.
- Work from the process map or design structure, step by step, so nothing is skipped.
- Rate against a written, agreed scale, not intuition, or the numbers are not comparable between team members.
- Treat the FMEA as a living document: revisit it at every process change, every new failure mode found in production, and every customer complaint.
- The FMEA's real output is the action list with owners and dates, not the spreadsheet.
A failure mode is rated severity 10, occurrence 1, detection 1, giving an RPN of 10. A team's rule is to act on any RPN above 100. What should happen?
A team responds to a high RPN by adding a 100% end-of-line inspection. Which rating does this change, and why is it the least preferred response?
When must a design FMEA be completed?