Failure mode and effects analysis (FMEA)

A failure mode and effects analysis (FMEA) lists the specific ways a process or product could fail, then scores each one on three dimensions: severity (how bad the effect would be), occurrence (how likely the cause is), and detection (how likely current controls are to catch it before it matters) — each 1 to 10. Severity comes first: a failure mode scored 9 or 10 on severity (someone could get hurt, or a legal or regulatory requirement is broken) needs a recommended action, or a written reason why the current controls are already enough, whatever its other scores. Multiplying the three scores gives a risk priority number (RPN), from 1 to 1,000, and this tool shows it as a secondary ranking for everything else. Be careful with it: very different risks can share the same RPN, and a severe failure that's rare and well detected can score lower than a trivial one that happens often. That's why the 2019 FMEA handbook from the Automotive Industry Action Group (AIAG) and the Verband der Automobilindustrie (VDA), the German automotive industry association, stopped ranking by RPN and replaced it with Action Priority: a lookup table that rates each failure mode high, medium, or low from its severity, occurrence, and detection scores, weighting severity most, then occurrence, then detection. If your customer or industry works to that handbook, use its Action Priority table to decide what to act on. Sources: AIAG & VDA FMEA Handbook, first edition (2019); AIAG Potential FMEA reference manual, fourth edition (2008), which already advised against using an RPN threshold to decide whether action is needed.

Process / product

What process, product, or system is this analysis covering?

Failure modes

For each item: what could go wrong, its effect, your severity score, the likely cause, your occurrence score, current controls, and your detection score. The risk priority number is computed from your three scores, never entered directly.

Narrative

Drafted from the items actually scored: any severity 9 or 10 item first, then the vital-few highest risk priority number items.

The example below analyzes a newly-designed changeover procedure before it goes live — four failure modes scored on severity, occurrence, and detection. It checks severity first (nothing scores 9 or 10, so nothing jumps the queue on severity alone), then names the single highest risk priority number item as the vital-few risk to fix first, not just added to a long list.

• Ranking purely by risk priority number and ignoring a high-severity failure mode because its number is low.

  A failure that could hurt someone but rarely happens can score lower than a nuisance that happens every week. Severity 9 or 10 gets an action, or a written reason the controls are enough, regardless of the number — the same reason the 2019 handbook's Action Priority table weights severity most.

• Setting a risk priority number cut-off, such as "act on anything over 100".

  The number isn't a true measure of risk — the scales aren't evenly spaced and many different score combinations give the same product. A fixed cut-off invites nudging a score down by one to get under the line instead of reducing the risk.

• Scoring severity, occurrence, and detection from a rough overall impression instead of thinking through each dimension separately.

  A failure mode that's severe but well-detected needs a different fix than one that's mild but invisible until it's too late — collapsing the three dimensions into one gut-feel number erases exactly the distinction that makes the risk priority number useful.

• Treating every item on the list as equally worth fixing.

  Same vital-few discipline as every other artifact in this catalogue — a long list of scored risks with no ranking just moves the prioritization problem downstream instead of solving it.

• Writing a recommended action that doesn't actually change severity, occurrence, or detection.

  "Communicate more clearly" or "be more careful" doesn't move any of the three numbers — a real recommended action targets one of them specifically (a physical control, a gate the process can't skip, a check that catches the failure earlier).