How to carry out an FMEA: steps, example and the RPN explained

What is an FMEA and what do you use it for?

FMEA stands for failure mode and effects analysis. A failure mode is the way in which a step or component fails to fulfil its function. You look for those failure modes before they occur, assess how serious they are and take measures for the worst ones. It is therefore a preventive method and not an investigation after the fact.

You use FMEA to make the risks in a process or product concrete and step by step. ISO 9001 asks for risk-based thinking (clause 6.1) but does not prescribe a method. FMEA is one way to show this, especially where an error in a process step leads to rejects, complaints or a safety risk. You carry out a root cause analysis afterwards for a concrete problem, an FMEA beforehand.

Product FMEA or process FMEA: what is the difference?

A product FMEA, also called a design FMEA, looks at the design: how can the product or component fail in use and which design choice prevents that. A process FMEA looks at the way you make or deliver something: how can a step in production, assembly, transport or service delivery produce an error.

For most construction, installation and manufacturing companies the process FMEA is the most useful, because the errors arise in execution. Companies that design themselves often do both: first the product FMEA, then the process FMEA on the way the design is made. This guide continues with the process FMEA.

When do you use FMEA and who should be involved?

Use FMEA where an error weighs heavily or recurs often: a new process, a change in machine, material or working method, a process with recurring complaints or rejects, or a process for which a customer asks for an FMEA. Making an FMEA for every process is rarely worthwhile. Start with the processes with the greatest effect on safety, quality or delivery.

You make an FMEA with a team, not at a desk. Involve the process owner, people who carry out the step daily, someone from quality or QHSE who guides the method and, where needed, maintenance or engineering. Four to six people is workable, for example. The people doing the work know where things go wrong in practice, and that is rarely written in the procedure.

Carrying out an FMEA: the steps

Keep failure mode, effect and cause apart. The failure mode is what goes wrong in the step, for example a weld that is not fully penetrated. The effect is what that means for the customer or the next step. The cause is why it goes wrong. Anyone who mixes up those three ends up with lines from which no measure follows.

Start small: choose one process, for example the step where most errors or complaints come from, and finish it before you pick up the next one. You work in a worksheet, per process step from left to right. These are the steps in order:

• Define the scope and form the team: which process, from which step to which step, and who takes part.
• Describe the process steps and what each step should deliver.
• Name the possible failure modes per step: in what ways can the step miss its purpose?
• Describe, for each failure mode, the effect on the customer or the next step, and the cause.
• Note the current controls: what prevents the cause and what detects the error before it reaches the customer?
• Score severity, occurrence and detection and calculate the RPN.
• Choose measures for the highest risks, with an owner and a deadline.
• Carry out the measures, score again and record the residual risk and the date of reassessment.

Scoring severity, occurrence and detection and calculating the RPN

Each failure mode gets three scores, usually on a scale of 1 to 10. Severity (S) describes how serious the effect is. Occurrence (O) describes how often the cause arises. Detection (D) describes how well you notice the error or the cause before it reaches the customer. Mind the reversed direction of D: a high score means you detect the error poorly.

The RPN (risk priority number) is S times O times D and then runs from 1 to 1000. As with a risk matrix, define what each level means, and agree a threshold above which a measure is required. Many teams also set a separate rule for high severity, so that a serious effect never disappears below the threshold.

Worked example: process FMEA of a process step

Example from an installation company: the process step sealing a fire-resistant penetration. All scores and measures in this example are illustrative, on a scale of 1 to 10. For each failure mode you see the effect, the cause, the current controls, the scores with the RPN, the measure and the score afterwards.

Note two things while reading. The measures lower occurrence and detection, but not severity: an incomplete seal remains just as dangerous when it occurs. And the first failure mode has both the highest severity and the highest RPN, so that is where you start.

• Failure mode: seal not applied around the full circumference. Effect: fire and smoke can spread, S 9. Cause: time pressure and poor access, O 5. Current controls: visual check by the fitter, D 6. RPN 9 x 5 x 6 = 270. Measure: time per penetration in the planning and a check by a second person with a photo before the ceiling is closed. Afterwards O 4, D 3, RPN 108.
• Failure mode: a different sealing product used than specified. Effect: the penetration does not reach the required fire resistance and is rejected at handover, S 7. Cause: several products on site and an unclear work instruction, O 4. Current controls: none, D 8. RPN 7 x 4 x 8 = 224. Measure: work instruction per penetration type and products in labelled bins. Afterwards O 2, D 5, RPN 70.
• Failure mode: penetration not recorded in the handover file. Effect: the client cannot see which penetrations have been sealed, S 4. Cause: no fixed moment to record, O 6. Current controls: check at handover, D 5. RPN 4 x 6 x 5 = 120. Measure: record on a numbered list as part of the completion step. Afterwards O 2, D 3, RPN 24.

The pitfalls of the RPN and the AIAG and VDA Action Priority

The RPN has known weaknesses. Different combinations give the same result: severity 9, occurrence 2 and detection 5 gives 90, just like severity 3, occurrence 6 and detection 5. The first risk may affect safety, the second is a minor nuisance, and yet they get the same priority. Moreover, the scores are rankings, and multiplying them gives false precision.

Therefore look at the three scores and not only at the product, and set a separate rule for high severity. In 2019 the joint AIAG & VDA FMEA handbook for the automotive industry was published. It replaces the RPN with Action Priority: a table that derives a priority of high, medium or low from severity, occurrence and detection, with severity weighing the most.

Outside the automotive industry the RPN remains in use in many organisations, and ISO 9001 does not prescribe a calculation method. If you work for a car manufacturer or a supplier, ask which method the customer expects. If you choose yourself, record the choice and the thresholds and apply them consistently.

Common mistakes with an FMEA

Most FMEAs fail not because of the method but because of the way they are filled in. A worksheet that is completed for the audit and never opened again delivers nothing. If you recognise one of these points in your own worksheet, correct it before you continue:

• One person fills in the FMEA at a desk, without the people who carry out the process.
• The scope is too large: a whole business process in one session produces superficial lines. Split it up.
• The scales are not defined, so two people score the same failure mode differently.
• Failure mode, effect and cause are mixed up, so no measure follows from them.
• Detection is rated too favourably, for example by counting a check by the person doing the work as strong detection.
• Only the RPN is looked at and not high severity.
• Scores after the measure are adjusted without the measure having been carried out or verified.

After the FMEA: following up measures and reassessing

An FMEA is only finished once the measures have been carried out and checked. Put every measure in your action list with an owner and deadline, and verify after implementation that the score can really go down. A measure that removes the cause lowers occurrence, an extra check lowers the detection score. Also check that a new measure does not itself introduce a new failure mode.

Set a reassessment date and look again sooner after a process change, an incident, a complaint or a reject from the process. Real reports are the best test: if an error occurs that is not in the FMEA, the analysis was incomplete. Add the failure mode and decide whether the cause calls for a CAPA.

How BrydgeOne supports this

In the Process FMEA module you start a study on a process from your process structure and work out the failure modes per process step with cause and effect. The system calculates the RPN automatically from severity, occurrence and detection and requires a measure once a threshold is exceeded. After the measure you score again and see whether the residual risk falls below the threshold.

The owner of a study receives a task and a notification when the reassessment date passes. Measures become actions in Actions, the central action list with owner and deadline. An AI draft list makes suggestions for failure modes but never records anything itself. You assess broader risks in Risks & opportunities. BrydgeOne helps you collect evidence for risk-based thinking (clause 6.1 of ISO 9001) and does not guarantee that you meet the standard.