FMEA for design and process

An FMEA is not a form. It is an argument, conducted in a room, about what could go wrong with something that does not exist yet — and the form is only where the argument is recorded. Most bad FMEAs are bad because somebody filled in the form without holding the argument.

A cross functional team around a table in a meeting room working through a process FMEA projected on a screen, with a sample part and a process flow chart printed on the table in front of them and one person writing on a whiteboard divided into columns. — Six people and a part on the table. The spreadsheet is the record of the conversation, not a substitute for it.

Failure mode, effect, cause — keep them apart

This is the discipline the whole method rests on, and the place most FMEAs go wrong in the first hour.

A diagram separating cause, failure mode and effect along a horizontal chain for a worked example. On the left, three causes are listed for a bracket weld, insufficient weld length, incorrect fixture location and contaminated surface, each with its own occurrence ranking and prevention controls listed beneath. In the centre, the failure mode is stated as the weld fails to hold the bracket in position, described as the way the item fails to deliver its function. On the right, effects are listed at three levels, a noise complaint at the vehicle level, a component detachment at the system level and a loss of function with a safety consequence, each with its own severity ranking and the highest severity marked as the one used. Arrows show detection controls placed between the failure mode and the effect. Notes mark that occurrence belongs to the cause, severity belongs to the effect and detection belongs to the control, so the three rankings are properties of three different things. — Three rankings, three owners. Occurrence belongs to the cause, severity to the effect, detection to the control — which is why they cannot be traded against each other.

	Definition	Which ranking it carries
Failure mode	How the item fails to deliver its function	—
Effect	The consequence, to the customer or next operation	Severity
Cause	Why the failure mode occurs	Occurrence
Control	What prevents the cause or detects the failure	Prevention → occurrence, Detection → detection

Notice that the three rankings are properties of three different things. An occurrence number for a failure mode is meaningless, because one failure mode may have several causes of wildly different likelihood. Each cause is ranked on its own.

Severity is the number you cannot argue with

Seven steps, and the three that get skipped

Step		Commonly
1	Planning and preparation — scope, team, boundaries	Skipped
2	Structure analysis — break the item into elements	Skipped
3	Function analysis — state what each element must do	Skipped
4	Failure analysis — modes, effects, causes	Where people start
5	Risk analysis — rankings, controls, Action Priority
6	Optimisation — actions, owners, verification	Half done
7	Results documentation	Done

Steps 2 and 3 are what make the analysis complete rather than a brainstorm. You cannot enumerate the ways something fails to do its job until you have written down what its job is. Teams that start at step 4 produce a long list of the failures they happen to remember, which is not the same thing at all — and the gaps are invariably in the functions nobody articulated.

Action Priority, and why the RPN had to go

Three rows with the same RPN and nothing else in common. The Action Priority table gives severity primacy, so a high severity item cannot be multiplied down.

The RPN was the product of three rankings, and it had two fatal problems:

Very different situations came out equal. Severity 10 with low occurrence and detection scored the same as three middling rankings. They are not the same situation.
It invited manipulation. Where a threshold triggered mandatory action, teams learned to adjust occurrence or detection until the product fell below it. The FMEA then documented a decision not to act.

Action Priority replaces the multiplication with a defined lookup table in which severity always has primacy. A high severity item lands in high or medium priority regardless of the other two rankings, so it cannot be argued down.

One thing AP is often misread as: it indicates the priority for taking action, not whether the risk is acceptable. A low AP is not a statement that the risk is fine.

Design FMEA or process FMEA

	DFMEA	PFMEA
Assumes	The part is made correctly	The design is correct
Asks	Can the design fail to perform?	What can the process do wrong?
Owned by	Product engineering	Manufacturing engineering
Feeds	Design verification plan	Control plan

Mixing the two produces rows that neither function can act on — a process cause written against a design failure mode has no owner and no control that fits it.

Keeping it alive

An FMEA completed for the PPAP submission and never opened again has stopped being a risk analysis. It is a record of what was believed on one day.

Triggers for revision:

A design or process change, including a supplier or material change.
A failure in production or the field — and a field failure not in the FMEA is direct evidence the analysis was incomplete.
A new application of an existing part.
Lessons from another programme, which is what APQP phase five is for in APQP and new part introduction.

Special characteristics — the handover to the control plan

Where the FMEA identifies a characteristic whose variation significantly affects safety, fit, function or regulatory compliance, it becomes a special characteristic. It gets a symbol, and it is carried into the control plan with mandatory controls attached.

That handover is the point of the whole exercise. A special characteristic identified in the FMEA with no corresponding control plan entry is an identified risk that nothing is acting on — see control plans and process flow.

What to take away

Keep failure mode, effect and cause distinct. Everything else depends on it.
Occurrence belongs to the cause, severity to the effect, detection to the control.
No inspection reduces severity. Only a design change does.
Prevention lowers occurrence; detection lowers escape. Do not merge the columns.
Steps 2 and 3 — structure and function — are what make the list complete.
The RPN was dropped because it equated unlike situations and invited manipulation.
Action Priority gives severity primacy, and indicates priority to act, not acceptability.
DFMEA assumes good manufacture; PFMEA assumes good design. Do not mix them.
A field failure absent from the FMEA proves the analysis was incomplete.
Close actions on verified effectiveness, not on implementation.
Special characteristics must arrive in the control plan, or the FMEA achieved nothing.