FMEA: Method

RPN, Action Priority and MIL-STD-1629A Criticality

What an FMEA is

A failure mode and effects analysis is a bottom-up, inductive review of a design or a process: for every item (a component, a function, a process step) the team lists the ways it can fail (the failure modes), what each failure does to the next level and to the end user (the effects), why it would happen (the causes or mechanisms) and what in the present design or process would prevent or detect it (the controls). MIL-STD-1629A (1980) formalised the method for defence hardware as Task 101 and added the criticality analysis as Task 102; the automotive industry's AIAG manual (4th ed., 2008) added the three 1–10 ratings and the risk priority number; the harmonised AIAG-VDA handbook (2019) kept the ratings but replaced the RPN by the Action Priority lookup. This tool takes a worksheet in any of these conventions and produces the ranking, the priorities, the before-and-after comparison and the criticality numbers.

The worksheet

One failure mode (strictly, one failure mode–cause pair) per line, cells separated by vertical bars or tabs because the free-text cells contain commas. Without a header line the columns are item | failure mode | effect | cause | S | O | D | controls | S2 | O2 | D2, the last four optional. A header line may name the columns in any order (item, failure mode, effect, cause, S / severity, O / occurrence, D / detection, controls, S2 / O2 / D2 for the ratings after the recommended actions) and add the MIL-STD-1629A quantities beta, alpha, lambda_p and t, a severity class (I–IV), and M and N for the TM 5-698-4 redundancy adjustment. A line starting with # is a comment. Rows with a rating outside 1–10 are listed as not read and the rest are analysed.

The three ratings

Severity S rates the worst credible effect of the failure mode on the customer, the plant or the people exposed, 1 for no discernible effect to 10 for a safety or regulatory consequence without warning (9 with warning). Occurrence O rates how likely the cause is to occur over the design life or the production run, 1 for failure eliminated by prevention to 10 for a cause that is almost inevitable. Detection D rates how likely the current controls are to fail to find the cause or the mode before it reaches the customer, 1 for a control that is almost certain to detect to 10 for no control at all. The scales are ordinal; the AIAG and AIAG-VDA handbooks publish anchor tables for design and process FMEAs, TM 5-698-4 Tables 4-2 to 4-4 publish an equivalent set for facilities. A rating must be read against its anchor table, never as a probability.

Risk priority number

RPN = S × O × D ranges from 1 to 1,000. The tool ranks the modes by RPN (ties by S, then O, then D) and flags those at or above an entered threshold; 100 is a common company convention but no handbook prescribes one. The RPN has well-known defects (Bowles 2003): the three ratings are weighted equally although a severity of 10 is a safety issue and a detection of 10 is a missing inspection; the product of ordinal scales is not itself a scale (120 cells of the 1,000-point range are unreachable, and 60 = 10 × 3 × 2 = 2 × 5 × 6 = 3 × 4 × 5); a team can lower a mode's RPN by adding an inspection without touching the cause. The ranking table shows the Action Priority beside each RPN so that the disagreements are visible.

Action Priority (AIAG-VDA 2019)

The AIAG-VDA handbook replaces the RPN by a lookup table that reads severity first, occurrence second and detection last. The ratings are grouped in bands, S 1 / 2–3 / 4–6 / 7–8 / 9–10, O 1 / 2–3 / 4–5 / 6–7 / 8–10 and D 1 / 2–4 / 5–6 / 7–10, and each of the 100 band cells is assigned High, Medium or Low (22, 16 and 62 cells). High means the team must identify an action to improve the prevention or detection controls, or justify and document why the current controls are adequate; Medium means it should, or document why not; Low means it could. A severity of 9–10 with an occurrence of 2 or more is High for all but the best-detected cells; an occurrence of 1 or a severity of 1 is always Low; detection matters most in the middle of the table. The tool prints the table it uses with the worksheet rows marked in their cells, so the reader can check every lookup. The handbook keeps S, O and D as separate numbers and does not recommend computing an RPN at all, so the AP is reported even when the analyst's company still ranks by RPN.

Before and after

After the recommended actions are defined, the team re-rates each mode: the severity changes only if a design change alters the effect itself; an action on the cause lowers O; an added or improved control lowers D. The tool computes the RPN and the AP after the actions, the change of each and the totals over the revised rows. A blank revised rating keeps the value before the action. A mode still at High after the actions needs further work or a documented justification.

Pareto chart and risk matrix

The Pareto chart orders the modes by RPN and plots each mode's share of the total RPN as a bar with the cumulative share as a line; the modes whose cumulative share first reaches the entered cut (80 % by default, Juran's vital few) are reported. The severity × occurrence matrix places every mode by S and O with the count in each cell; the cell colour is the worst Action Priority among the modes in it, and the faint background colour is the priority that the S, O pair would receive at the worst detection band (D 7–10), the priority a mode cannot escape without detection controls. Both figures are read together with the AP table: a mode in the top-right of the matrix is High whatever its RPN.

MIL-STD-1629A criticality analysis (Task 102)

The standard offers two approaches. In the qualitative approach (3.1), used when failure rate data are not available, the probability of occurrence of each mode is placed in a level defined by its share of the item's overall probability of failure during the operating time interval: A frequent (more than 0.20), B reasonably probable (0.10 to 0.20), C occasional (0.01 to 0.10), D remote (0.001 to 0.01), E extremely unlikely (less than 0.001). The tool reads a letter in the O column as this level. In the quantitative approach (3.2) each failure mode receives a criticality number

C_m = β α λ_p t

where β is the conditional probability that the effect results in the identified severity category given that the mode occurs (1.00 actual loss, more than 0.10 to 1.00 probable loss, more than 0 to 0.10 possible loss, 0 no effect; 3.2.1.2), α the failure mode ratio, the fraction of the part's failure rate that falls in this mode so that the α of an item's modes sum to one (3.2.1.3), λ_p the part failure rate from MIL-HDBK-217 or another agreed source with its application, environment and quality factors applied (3.2.1.4), and t the operating time in hours or cycles of the mission phase (3.2.1.5). The standard notes that λ_p is usually in failures per million hours and that C_m may be multiplied by 10⁶ so that the worksheet carries 1.08 rather than 1.08 × 10⁻⁶; the tool makes no such conversion and C_m takes the unit of λ_p t as entered. The item criticality number under a severity category is the sum of the C_m of the item's modes in that category, C_r = Σ C_m (3.2.1.7): the expected number of system failures of that category over the mission phase due to the item. The Appendix A example of the standard (λ_b = 0.10 per million hours, π_A = 1.5, π_E = 40, π_Q = 1.2, so λ_p = 7.2; β = 0.5, t = 1 h; α = 0.3 and 0.2 for two Category II modes) gives C_m = 1.08 and 0.72 and C_r = 1.80, which the tool reproduces from the selector. The standard adds that criticality numbers rest on subjective judgments and are indicators of relative priority, not absolute rates.

Severity categories and the criticality matrix

MIL-STD-1629A (4.4.3) classifies the worst potential consequence of each failure mode in four categories consistent with MIL-STD-882: I catastrophic (death or system loss), II critical (severe injury, major property or system damage, mission loss), III marginal (minor injury or damage, delay, degradation or loss of availability), IV minor (unscheduled maintenance or repair only). The worksheet may give the category in a class column; when it does not, the tool assigns it from the 1–10 severity by its own convention, S 9–10 → I, 7–8 → II, 4–6 → III, 1–3 → IV, and says so in a note. The criticality matrix of Figure 102.2 places each mode by its severity category (increasing to the right) and its criticality number or occurrence level (increasing upward); the further along the diagonal from the origin, the more urgent the corrective action. The tool tabulates both forms: modes by category in descending C_m, and levels A–E against the categories.

Redundancy adjustment (TM 5-698-4)

The Army manual for mission-critical facilities ranks occurrence for the loss of the function rather than of the component, and for N installed units of which M are needed it adjusts the component's occurrence to O′ = O M/(N − 1) (eq. 4-12), so that one spare leaves the ranking unchanged and two spares with two required reduce it by a third (its example: O = 9, M = 2, N = 4 → O′ = 6). When a header names M and N, the tool computes O′, rounds it to the nearest whole rating and uses it in the RPN and the AP. The manual also notes that for facilities the detection rating is often folded into the severity (its RPN is S × O, eq. 4-10); the tool always needs the three ratings for an RPN.

Limits

The tool evaluates a worksheet; it does not write one. The quality of an FMEA lies in the completeness of the failure modes and causes and in the honesty of the ratings, which the team settles at the table with the anchor tables in hand. The RPN threshold and the Pareto cut are conventions, not criteria. The Action Priority table is encoded as the 2019 handbook prints it (see the References folder record); companies that use their own variant must read their table. The criticality numbers assume independent failure modes and constant failure rates, the assumptions of MIL-HDBK-217. Fault trees, common-cause analysis and functional hazard assessment are separate methods.