FMEA & Control Plan

(1)

FMEA is an integral

FMEA is an integral part of any QS 9000 comppart of any QS 9000 compliant quality system. liant quality system. FigureFigure 1 illustrates the role of FMEA in a

1 illustrates the role of FMEA in a typical quality system.typical quality system.

Figure 1.

Figure 1. The role The role of FMEA of FMEA in a in a quality system.quality system.

This portion of the site is intended to provide the visitor with useful and This portion of the site is intended to provide the visitor with useful and pertinent information regarding the FMEA process. It can serve as a pertinent information regarding the FMEA process. It can serve as a

reference document for individuals or teams familiar with FMEAs. It is not reference document for individuals or teams familiar with FMEAs. It is not a comprehensive instruction guide for performing an

a comprehensive instruction guide for performing an FMEA, and shouldFMEA, and should not be used as such.

(2)

(3)

Definitions:

Cause

Critical Characteristi

Criticality

Current Controls

Customer

Detection

Effect

Failure Mode

FMEA Element

•

• _Function

_Function

•

• _Occurrence

_Occurrence

•

• _{Risk Priority Numbe}

_{Risk Priority Numbe}

•

• _Severity

_Severity

•

• _{Significant Characte}

_{Significant Characte}

•

• _{Special Process Char}

_{Special Process Char}

•

(4)

Cause

A Cause is the means by which a

particular element of the design or

process results in a Failure Mode.

(5)

Critical Characteristics:

Critical Characteristics are Special

Characteristics defined by Ford Motor

Company that affect customer safety

and/or could result in non-compliance

with government regulations and thus

require special controls to ensure 100%

compliance.

(6)

Criticality:

The Criticality rating is the mathematical

product of the Severity and Occurrence

ratings. Criticality = (S) × (O). This

number is used to place priority on items

that require additional quality planning.

(7)

Current Controls:

Current Controls (design and process) are

the mechanisms that prevent the Cause of

the Failure Mode from occurring, or

which detect the failure before it reaches

the Customer.

(8)

Customer:

Customers are internal and external

departments, people, and processes that

will be adversely affected by product

failure.

(9)

Detection:

Detection is an assessment of the

likelihood that the Current Controls

(design and process) will detect the Cause

of the Failure Mode or the Failure Mode

itself, thus preventing it from reaching the

Customer.

(10)

Effect:

An Effect is an adverse consequence that

the Customer might experience. The

Customer could be the next operation,

subsequent operations, or the end user.

(11)

Failure Mode:

Failure Modes are sometimes described as

categories of failure. A potential Failure

Mode describes the way in

Mode describes the way in which a

which a

product or process could fail to perform

its desired function (design intent or

performance requirements) as described

by the needs, wants, and expectations of

the internal and external Customers.

(12)

FMEA Element:

FMEA elements are identified or analyzed

in the FMEA process. Common examples

are Functions, Failure Modes, Causes,

Effects, Controls, and Actions. FMEA

elements appear as column headings in

the output form.

(13)

Function:

A Function could be any intended

purpose of a product or process. FMEA

functions are best described in verb-noun

format with engineering specifications.

(14)

Occurrence:

Occurrence is an assessment of the

likelihood that a particular Cause will

happen and result in the Failure Mode

during the intended life and use of the

product.

(15)

Risk Priority Number:

The Risk Priority Number is a

mathematical product of the numerical

Severity, Occurrence, and Detection

ratings. RPN = (S)

×

(O)

×

(D). This

number is used to place priority on items

than require additional quality planning.

(16)

Severity:

Severity is an assessment of how serious

the Effect of the potential Failure Mode is

on the Customer.

(17)

Significant Characteristics:

Significant Characteristics are Special

Characteristics defined by Ford Motor

Company as characteristics that

significantly affect customer satisfaction

and require quality planning to ensure

acceptable levels of capability.

(18)

Special Process

Characteristics:

Special Process Characteristics are

process characteristics for which variation

must be controlled to some target value to

ensure that variation in a Special Product

Characteristic is maintained to its target

value during manufacturing and

assembly.

(19)

Special Product

Characteristics:

Special Product Characteristics are

product characteristics for which

reasonably anticipated variation could

significantly affect a product’s safety or

compliance with governmental standards

or regulations, or is likely to significantly

affect customer satisfaction with a

product.

(20)

Acronyms:

8-D

8-D Eight Disciplines of Problem SolvingEight Disciplines of Problem Solving AIAG

AIAG Automotive Industry Action Group Automotive Industry Action Group APQP

APQP Advance Advanced Product d Product Quality PlanningQuality Planning ASQC

ASQC American Society for Quality Control American Society for Quality Control DOE

DOE Design of Design of ExperimenExperimentsts FMEA

FMEA Potential Failure Mode and Potential Failure Mode and EffectsEffects Analysis

Analysis FTA

FTA Fault Tree Fault Tree AnalysisAnalysis

ISO

ISO _{International Organization for}_{International Organization for} Standardization

Standardization QFD

QFD _{Quality Function}_{Quality Function} Deployment

Deployment QOS

QOS Quality Operating SystemQuality Operating System RFTA

RFTA Reverse Fault Tree AnalysisReverse Fault Tree Analysis RPN

RPN Risk Priority NumberRisk Priority Number SPC

(21)

The FMEA discipline was developed in the United States Military. The FMEA discipline was developed in the United States Military. Military Procedure MIL-P-1629, titled Procedures for Performing a Military Procedure MIL-P-1629, titled Procedures for Performing a Failure Mode, Effects and Criticality Analysis, is dated November 9, Failure Mode, Effects and Criticality Analysis, is dated November 9, 1949. It was used as a reliability evaluation technique to determine 1949. It was used as a reliability evaluation technique to determine the effect of system and equipment failures. Failures were classified the effect of system and equipment failures. Failures were classified according to their impact on mission success and

according to their impact on mission success and

personnel/equipment safety. The term "personnel/equipment", personnel/equipment safety. The term "personnel/equipment", taken directly from an abstract of Military Standard taken directly from an abstract of Military Standard MIL-STD-1629, is notable. The concept that personnel and equipment are 1629, is notable. The concept that personnel and equipment are interchangeable does not apply in the modern manufacturing interchangeable does not apply in the modern manufacturing context of producing consumer goods. The manufacturers of context of producing consumer goods. The manufacturers of consumer products established a new set of priorities, including consumer products established a new set of priorities, including customer satisfaction and safety. As a result, the risk assessment customer satisfaction and safety. As a result, the risk assessment tools of the FMEA became partially outdated. They have not been tools of the FMEA became partially outdated. They have not been adequately updated since.

(22)

In 1988, the

In 1988, the International Organization for StandardizationInternational Organization for Standardization issuedissued the ISO 9000 series of business management standards. The

the ISO 9000 series of business management standards. The requirements of ISO 9000 pushed organizations to develop requirements of ISO 9000 pushed organizations to develop

formalized Quality Management Systems that ideally are focused formalized Quality Management Systems that ideally are focused on the needs, wants, and expectations of customers.

on the needs, wants, and expectations of customers. QS 9000QS 9000 is theis the automotive analogy to ISO 9000. A Task Force representing

automotive analogy to ISO 9000. A Task Force representing

Chrysler Corporation, Ford Motor Company, and General Motors Chrysler Corporation, Ford Motor Company, and General Motors Corporation developed QS 9000 in an effort to standardize supplier Corporation developed QS 9000 in an effort to standardize supplier quality systems. In accordance with QS 9000 standards, compliant quality systems. In accordance with QS 9000 standards, compliant automotive suppliers shall utilize Advanced Product Quality

automotive suppliers shall utilize Advanced Product Quality Planning (APQP), including design and process FMEAs, and Planning (APQP), including design and process FMEAs, and develop a Control Plan.

(23)

Advanced Product Quality Planning standards provide a

structured method of defining and establishing the steps

necessary to assure that a product satisfies

necessary to assure that a product satisfies the

the

customer’s requirements. Control Plans aid in

manufacturing quality products according to customer

requirements in conjunction with QS 9000. An

emphasis is placed on minimizing process

emphasis is placed on minimizing process and product

and product

variation. A Control Plan provides "a

variation. A Control Plan provides "a structured

structured

approach for the design, selection, and implementation

of value-added control methods for the total

of value-added control methods for the total system."

system."

QS 9000 compliant automotive suppliers must utilize

Failure Mode and Effects Analysis (FMEA) in the

Advanced Quality Planning process and in the

development of their Control Plans.

(24)

The

The Automotive Industry Action Group Automotive Industry Action Group (AIAG) and the(AIAG) and the American Society for Quality Control

American Society for Quality Control (ASQC) copyrighted industry-(ASQC) copyrighted industry- wide FMEA standards in February of 1993, the technical equivalent wide FMEA standards in February of 1993, the technical equivalent

of the Society of Automotive Engineers procedure

of the Society of Automotive Engineers procedure SAE J-1739SAE J-1739. The. The standards are presented in an FMEA Manual approved and

standards are presented in an FMEA Manual approved and

supported by all three automakers. It provides general guidelines supported by all three automakers. It provides general guidelines for preparing an FMEA.

for preparing an FMEA.

This site is dedicated to overcoming some deficiencies of the This site is dedicated to overcoming some deficiencies of the Potential Failure Mode and Effects Analysis (FMEA), as it is Potential Failure Mode and Effects Analysis (FMEA), as it is currently being deployed in the U.S. automotive industry. An currently being deployed in the U.S. automotive industry. An

FMEA is commonly defined as "a systematic process for identifying FMEA is commonly defined as "a systematic process for identifying potential design and process failures before they occur, with the potential design and process failures before they occur, with the intent to eliminate them or minimize the risk associated with intent to eliminate them or minimize the risk associated with them."

(25)

In the progression of time, a Failure

Mode comes between a Cause and an

Effect. One of the most confusing issues

for new practitioners of FMEA is

for new practitioners of FMEA is that any

that any

Cause that itself has a Cause might be a

Failure Mode. Any Effect that itself has

an Effect might also be a Failure Mode. In

different contexts, a single event may be

a Cause, an Effect, and a Failure Mode.

Consider for example Figure 2, a series of

events that could occur during the life of

a disposable penlight.

(26)

(27)

In an analysis of the

In an analysis of the exterior casingexterior casing of a penlight, "of a penlight, "Allows excessAllows excess moisture

moisture" would be a Failure Mode. One " would be a Failure Mode. One of the intended functions of theof the intended functions of the

penlight case is to protect the internal components from excess moisture penlight case is to protect the internal components from excess moisture during normal operation. A failure to prevent moisture during normal during normal operation. A failure to prevent moisture during normal operation is a Failure Mode since protective casings and other design operation is a Failure Mode since protective casings and other design features are

features are intended intended to prevent moisture. Causes appear above the Failureto prevent moisture. Causes appear above the Failure Mode in Figure 2. Effects appear below.

Mode in Figure 2. Effects appear below. In the analysis of the penlight

In the analysis of the penlight bulb bulb, a different Function and Failure, a different Function and Failure

Mode(s) must be considered. The penlight bulb is intended to provide light Mode(s) must be considered. The penlight bulb is intended to provide light of specific intensity when the device is activated during its expected

of specific intensity when the device is activated during its expected lifetime. This is one of its Functions, or intended

lifetime. This is one of its Functions, or intended purposes. A dim bulb is apurposes. A dim bulb is a failure to provide the specified intensity of light and is therefore a Fa

failure to provide the specified intensity of light and is therefore a Failureilure Mode of the penlight bulb. This example illustrates that Causes, Effects, Mode of the penlight bulb. This example illustrates that Causes, Effects, and Failure Modes can change depending on the Function being analyzed. and Failure Modes can change depending on the Function being analyzed. Functions change depending on the object of the analysis, either product Functions change depending on the object of the analysis, either product or process. Therefore, an early, important step in an FMEA is

or process. Therefore, an early, important step in an FMEA is to clearly to clearly define the scope: the component, system, or process that is to be

(28)

Most real-world systems do not follow the simple

Cause-Effect model. A single Cause may have multiple Cause-Effects. A

Effect model. A single Cause may have multiple Effects. A

combination of Causes may lead to an Effect, or they may

lead to multiple Effects. Causes can themselves have Causes,

and Effects can have subsequent downstream Effects. The

Failure Mode must also be considered in all of these models.

Figure 3 illustrates the relationship between a Function, a

Failure Mode, Potential Causes, and Effects. In the FMEA

model presented in this document, Causes do not

automatically result in the Failure Mode. The term ‘Potential’

is used to describe Causes, to indicate this uncertainty. The

model also assumes that all Effects will result given that the

Failure Mode has occurred. Therefore, ‘Potential’ is

Failure Mode has occurred. Therefore, ‘Potential’ is not

not used

used

to describe Effects.

(29)

Figure

Figure 3.

3. FMEA

FMEA Relationships

Relationships

In Figure 3, A pentagon is used to represent the

Failure Mode for two reasons. First, Failure

Modes can be grouped into one of five

categories of failure. Secondly, the

asymmetri

asymmetrical pentagon is

cal pentagon is mirrored to

mirrored to

indicate that Failure Modes can also be

described as anti-Functions.

(30)

FMEA Elements are the building blocks of related

information

information that

that comprise

comprise an

an analysis.

analysis. The

The team

team

approach is almost essential in

approach is almost essential in identifying FMEA

identifying FMEA

elements. Although actual document preparation is

often the responsibility of an

often the responsibility of an individual, FMEA input

individual, FMEA input

should come from a multi-disciplinary team. The team

should consist of knowledgeable individuals with

expertise in design,

expertise in design, manufacturing, assembly, service,

manufacturing, assembly, service,

quality, and reliability. The responsible engineer

typically leads the FMEA team. Members and leadership

may vary as the system, product, and process designs

mature.

(31)

Once the object of the analysis has been established, the next step Once the object of the analysis has been established, the next step in the FMEA process is to identify Functions. A Function is an in the FMEA process is to identify Functions. A Function is an intended purpose of the product or

intended purpose of the product or process being analyzed. If aprocess being analyzed. If a system is being considered, Functions of individual subsystems system is being considered, Functions of individual subsystems should also be identified. Potential Failure Modes, or categories should also be identified. Potential Failure Modes, or categories of failure, can then be identified by describing the way in which of failure, can then be identified by describing the way in which the object fails. Failure Modes fall into 1 of 5 possible failure the object fails. Failure Modes fall into 1 of 5 possible failure categories: categories: complete failure. complete failure. partial failure. partial failure. intermittent failure. intermittent failure. failure over time. failure over time.

over-performance of Function. over-performance of Function.

(32)

In the penlight example, suppose "

Provide Light atProvide Light at 3 ± .5 candela

3 ± .5 candela

" is defined as a Function. The

following Failure Modes could be identified:

no light. no light. dim light. dim light.

erratic blinking light. erratic blinking light. gradual dimming of light. gradual dimming of light. too bright.

(33)

The purpose of these five Failure Mode groupings is to assist the The purpose of these five Failure Mode groupings is to assist the FMEA team identify all possible Failure Modes. Looking for Failure FMEA team identify all possible Failure Modes. Looking for Failure Modes in these groupings may reveal some unusual failure

Modes in these groupings may reveal some unusual failure

possibilities that otherwise would not have been considered. Poorly possibilities that otherwise would not have been considered. Poorly defined Functions may also be revealed. In this example, a light that defined Functions may also be revealed. In this example, a light that does not turn off (over-performs its Function) is a product failure, does not turn off (over-performs its Function) is a product failure, even though the Function "

even though the Function "Provide light at 3 ± .5Provide light at 3 ± .5 candela

candela" does not fail. This implies the need for an additional" does not fail. This implies the need for an additional

Function, such as "

Function, such as "Default to off when not in useDefault to off when not in use", which", which

may have been overlooked when Functions were originally identified. may have been overlooked when Functions were originally identified. The original Function is rephrased as: "

The original Function is rephrased as: "Provides light at 3 ±Provides light at 3 ± .5 candela when on

.5 candela when on." A partial, intermittent, gradual or over-." A partial, intermittent, gradual or

over-performance type failure of one Function may be a complete failure of performance type failure of one Function may be a complete failure of another unidentified Function. Use of the Failure Mode categories

another unidentified Function. Use of the Failure Mode categories can help reveal these Functions.

(34)

After Functions and Failure Modes have been established, the next After Functions and Failure Modes have been established, the next

step in the FMEA process is to identify potential downstream step in the FMEA process is to identify potential downstream

consequences when the Failure Mode occurs. This should be a team consequences when the Failure Mode occurs. This should be a team brainstorming activity. After consequences have been identified, brainstorming activity. After consequences have been identified,

they must be fit into the FMEA model as Effects. In the FMEA they must be fit into the FMEA model as Effects. In the FMEA model presented by the Haviland Consulting Group, it is assumed model presented by the Haviland Consulting Group, it is assumed that Failure Mode Effects always occur when the Failure Mode that Failure Mode Effects always occur when the Failure Mode occurs; there is no representation for the likelihood that a Failure occurs; there is no representation for the likelihood that a Failure Mode will result in an Effect. The Procedure for Potential

Mode will result in an Effect. The Procedure for Potential Consequences is applied to account for unlikely or remote Consequences is applied to account for unlikely or remote

consequences. The Procedure explicitly associates Effects with the consequences. The Procedure explicitly associates Effects with the circumstances under which they occur through the identification of circumstances under which they occur through the identification of additional Failure Modes.

(35)

The Procedure for Potential

Consequences:

•

• Begin with a Failure Mode (referred to as FM-1), and a list of all its potentialBegin with a Failure Mode (referred to as FM-1), and a list of all its potential consequences.

consequences. •

•

Separate the consequences that can be assumed to result whenever the Separate the consequences that can be assumed to result whenever the Failure Mode FM-1 occurs. Identify these as Effects of FM-1.

Failure Mode FM-1 occurs. Identify these as Effects of FM-1. •

•

Write additional Failure Modes

Write additional Failure Modes for the remaining consequencesfor the remaining consequences (consequences which could result when FM-1 occurs, depending on the (consequences which could result when FM-1 occurs, depending on the circumstances under which FM-1 occurred).

circumstances under which FM-1 occurred).

The new Failure Modes imply that unlikely consequences

The new Failure Modes imply that unlikely consequences will will result by result by including the circumstances under which they occur.

including the circumstances under which they occur. •

• Separate the consequences that can be assumed to result whenever theSeparate the consequences that can be assumed to result whenever the additional Failure Modes and their special circumstances occur. Identify these additional Failure Modes and their special circumstances occur. Identify these consequences as Effects of the additional Failure Modes.

(36)

Consider this example, which illustrates the Procedure for Potential Consider this example, which illustrates the Procedure for Potential Consequences. During the Effects brainstorm, the team may tend to Consequences. During the Effects brainstorm, the team may tend to identify very severe consequences and the unlikely circumstances under identify very severe consequences and the unlikely circumstances under which they occur. When analyzing the penlight bulb, a team member which they occur. When analyzing the penlight bulb, a team member

may observe that the bulb could prematurely burn out when being used may observe that the bulb could prematurely burn out when being used as a flashlight, the resulting darkness causing the user to trip, fall, and as a flashlight, the resulting darkness causing the user to trip, fall, and be injured. Another member may observe

be injured. Another member may observe that atmospheric pressurethat atmospheric pressure variation could cause the bulb to explode while

variation could cause the bulb to explode while being used for an eyebeing used for an eye examination, resulting in injury. Such extraneous predicaments are examination, resulting in injury. Such extraneous predicaments are typical of a brainstorm and can be

typical of a brainstorm and can be expected. But rather than write aexpected. But rather than write a new Failure Mode for every bizarre situation recorded by the team, t new Failure Mode for every bizarre situation recorded by the team, thehe events should be grouped into a broad Effect category, such as "

events should be grouped into a broad Effect category, such as "injuryinjury or death

or death". Ultimately, Effects are categorized into one of ten groups,". Ultimately, Effects are categorized into one of ten groups,

according to

according to Severity. Severity. It is advantagIt is advantageous to write eous to write Failure Modes Failure Modes thatthat encompass all the Effects in a Severity grouping, such as "

encompass all the Effects in a Severity grouping, such as "Fails toFails to provide 3 ± .5 candela of light under critical

provide 3 ± .5 candela of light under critical conditions

conditions". All product failures that lead to ". All product failures that lead to injury or death areinjury or death are

automatically included; there is no need to attempt to

automatically included; there is no need to attempt to identify all theidentify all the circumstances under

circumstances under which injury or which injury or death could redeath could result. sult. The tradeoff The tradeoff for this convenience is that the likelihood of failure under

(37)

The first step in analyzing risk is to quantify the Severity of the The first step in analyzing risk is to quantify the Severity of the Effects. Effects are rated on a scale of 1 to 10, 10 being the most Effects. Effects are rated on a scale of 1 to 10, 10 being the most

severe. The team should agree on consistent evaluation criteria and severe. The team should agree on consistent evaluation criteria and a sensible ranking system. The design and process ranking systems a sensible ranking system. The design and process ranking systems presented in

presented in Table 1Table 1 andand Table 2Table 2 are based on AIAG standards.are based on AIAG standards. Effects are evaluated as a group when assessing risk, even though Effects are evaluated as a group when assessing risk, even though they are assigned Severity values individually. It is assumed that all they are assigned Severity values individually. It is assumed that all Effects will result if the Failure Mode occurs. Therefore, the most Effects will result if the Failure Mode occurs. Therefore, the most serious Effect takes precedence when evaluating risk potential. This serious Effect takes precedence when evaluating risk potential. This model accounts for Causes that have multiple Effects. Issuing

model accounts for Causes that have multiple Effects. Issuing design and process changes can reduce Severity ratings.

design and process changes can reduce Severity ratings. Notes of interest:

(38)

The scales do not

The scales do not discriminate between failures that

discriminate between failures that

results in catastrophic death, minor injury, or

government regulation violation.

A defect noticed by most customers is

A defect noticed by most customers is less than halfway

less than halfway

up the Severity scale.

""

No effectNo effect

" has a ranking of 1. There is no zero.

Note:

Note: These tab

These tables differ

les differ slightly from

slightly from those publish

those published

ed

by the AIAG. Specific references to motor vehicles have

been removed. The tables are similar to

been removed. The tables are similar to AIAG tables in

AIAG tables in

that they are

that they are suggested

suggested ranking systems. Because these

ranking systems. Because these

tables are suggested, the actual criteria used to

tables are suggested, the actual criteria used to prioritize

prioritize

risk should be documented with the FMEA.

(39)

Effect

Criteria: Severity of Effect for

DFMEA

Hazardous –no Hazardous –no warning warning

Failure affects safe product operation or involves noncompliance with Failure affects safe product operation or involves noncompliance with government regulation without warning.

government regulation without warning.

Hazardous – Hazardous – with warning with warning

Failure affects safe product operation or involves noncompliance with Failure affects safe product operation or involves noncompliance with government regulation with warning.

government regulation with warning.

Very High

Very High Product is inoperable with loss of pProduct is inoperable with loss of primary Function.rimary Function.

High

High Product is operable, but at reduced level of Product is operable, but at reduced level of performance.performance.

Moderate

(40)

Low

Low Product is operable, but comfort or convenience item(s) operate at Product is operable, but comfort or convenience item(s) operate at a reduceda reduced level of performance.

level of performance. Very Low

Very Low Fit & finish or squeak Fit & finish or squeak & rattle item does not & rattle item does not conform. Most customers noticeconform. Most customers notice defect.

defect. Minor

Minor Fit & finish or squeak & rattle item does not conform. Average customersFit & finish or squeak & rattle item does not conform. Average customers notice defect.

notice defect. Very Minor

Very Minor Fit & finish or squeak Fit & finish or squeak & rattle item does not & rattle item does not conform. Discriminatingconform. Discriminating customers notice defect.

customers notice defect. None

None No effectNo effect Table

Table 1. 1.

Suggested evaluation criteria and ranking system for the Se

Suggested evaluation criteria and ranking system for the Severity of verity of Effects for a design FMEA

(41)

Effect

Criteria: Severity of Effect for

PFMEA

R

ank

Hazardous – Hazardous – no warning no warning

May endanger machine operator or assembly operator. Failure affects May endanger machine operator or assembly operator. Failure affects safe product operation or noncompliance with government

safe product operation or noncompliance with government regulation. Failure will occur without w

regulation. Failure will occur without warning.arning.

10 10 Hazardous – Hazardous – with warning with warning

May endanger machine operator or assembly operator. Failure affects May endanger machine operator or assembly operator. Failure affects safe product operation or noncompliance with government

safe product operation or noncompliance with government re

regulation. Failure will occur with warning.gulation. Failure will occur with warning.

9 9

Very High

Very High Major disruption to production line. 100% of product may have tMajor disruption to production line. 100% of product may have t o beo be scrapped. The product is inoperable with

scrapped. The product is inoperable with loss of primary Function.loss of primary Function. 88

High High

Minor disruption to production line. Product may have to be s

Minor disruption to production line. Product may have to be s ortedorted and a portion scrapped. The p

and a portion scrapped. The product is operable, but at a roduct is operable, but at a reducedreduced level of performance. level of performance. 7 7 Moderate Moderate

Minor disruption to production line. A portion of

Minor disruption to production line. A portion of the product may the product may have to be scrapped (no sorting). Product is operable, but some have to be scrapped (no sorting). Product is operable, but some comfort / convenience item(s) are inoperable

comfort / convenience item(s) are inoperable

6 6

(42)

Very Low Very Low

Minor disruption to production line. Product may have to be s

Minor disruption to production line. Product may have to be s ortedorted and a portion reworked. Fit & finish or squeak & rattle item does not and a portion reworked. Fit & finish or squeak & rattle item does not conform. Most Customers notice the defect.

conform. Most Customers notice the defect.

4 4

Minor Minor

Minor disruption to production line. A portion of the product may the product may have to be reworked on-line but

have to be reworked on-line but out-of-station. Fit & finish or squeak out-of-station. Fit & finish or squeak & rattle item does not

& rattle item does not conform. Average customers notice the defect.conform. Average customers notice the defect.

3 3

Very Minor Very Minor

Minor disruption to production line. A portion of the product may the product may have to be reworked on-line but in-station. Fit & finish or squeak & have to be reworked on-line but in-station. Fit & finish or squeak & rattle item does not conform. Discriminating customers notice the rattle item does not conform. Discriminating customers notice the defect.

defect.

2 2

None

None TThhe e FFaaiilluurre e MMoodde e hhaas s nno o EEffffeecctt.. 11 Low

Low

Minor disruption to production line. 100% of the

Minor disruption to production line. 100% of the product may have toproduct may have to be reworked. Product is operable, but some

be reworked. Product is operable, but some comfort / conveniencecomfort / convenience items operate at a reduced level

items operate at a reduced level of performance.of performance.

5 5

Table 2.

Table 2. Suggested evaluation criteria and ranking system for the Severity of Effects inSuggested evaluation criteria and ranking system for the Severity of Effects in a process FMEA

(43)

After Effects and Severity have been addressed, the next step is to After Effects and Severity have been addressed, the next step is to

identify Causes of Failure Modes. This is another team activity. identify Causes of Failure Modes. This is another team activity.

Identification should start with Failure Modes that have the most severe Identification should start with Failure Modes that have the most severe Effects. In a design FMEA, design deficiencies that result in a Failure Effects. In a design FMEA, design deficiencies that result in a Failure Mode are Causes of failure. Design deficiencies that induce a

Mode are Causes of failure. Design deficiencies that induce a

manufacturing or assembly error are also included in design FMEAs as manufacturing or assembly error are also included in design FMEAs as Causes. The design FMEA assumes that

Causes. The design FMEA assumes that manufacturing and assembly manufacturing and assembly specifications are met, and only seeks to identify failures resulting from specifications are met, and only seeks to identify failures resulting from product design.

product design.

In a process FMEA, Causes are specific errors described in terms of In a process FMEA, Causes are specific errors described in terms of something that can be corrected or controlled. The process FMEA something that can be corrected or controlled. The process FMEA assumes that the product is adequately engineered, and will not fail assumes that the product is adequately engineered, and will not fail because of a design deficiency. This does not imply that all

because of a design deficiency. This does not imply that all inputs to theinputs to the process meet engineering specifications. Variation in purchased parts process meet engineering specifications. Variation in purchased parts and material used in the process should be considered in the

and material used in the process should be considered in the processprocess FMEA.

(44)

Causes are rated in terms of Occurrence. Occurrence is the likelihood that that a Causes are rated in terms of Occurrence. Occurrence is the likelihood that that a particular Cause will occur

particular Cause will occur and and result in the Failure Mode during result in the Failure Mode during the intended lifethe intended life and use of the product. This definition is

and use of the product. This definition is distinctly differedistinctly different from the definitionnt from the definition

published by the AIAG. In the AIAG FMEA model, Occurrence is simply the likelihood published by the AIAG. In the AIAG FMEA model, Occurrence is simply the likelihood that a Cause or mechanism of failure will occur. It is assumed that the failure itself that a Cause or mechanism of failure will occur. It is assumed that the failure itself could

could occur, but occur, but not necessarily. Since Occurrencnot necessarily. Since Occurrence is e is defined only as the likelihood defined only as the likelihood thethe Cause will occur, there is no

Cause will occur, there is no way of quantifying the likelihood that the Failure Modeway of quantifying the likelihood that the Failure Mode and subsequent Effects will result. The Occurrence definition preferred by The

and subsequent Effects will result. The Occurrence definition preferred by The Haviland Consultin

Haviland Consulting Group, used in g Group, used in combination with thecombination with the Procedure for

Procedure for Potential ConsequencesPotential Consequences, accounts for the fact that Causes do not always, accounts for the fact that Causes do not always lead to Failure Modes and subsequent Effects. When applicable, the Procedure for lead to Failure Modes and subsequent Effects. When applicable, the Procedure for Potential Consequences isolates severe Effects from the group by definition of a new Potential Consequences isolates severe Effects from the group by definition of a new Failure Mode with special circumstances. The Causes of the new Failure Mode are Failure Mode with special circumstances. The Causes of the new Failure Mode are assigned Occurrence values. The new Occurrence values represent the remote assigned Occurrence values. The new Occurrence values represent the remote

likelihood that the customer will experience the Effect. In the AIAG model, there is no likelihood that the customer will experience the Effect. In the AIAG model, there is no risk-prioritizing advantage to writing additional

risk-prioritizing advantage to writing additional Failure Modes because Causes andFailure Modes because Causes and Failure Modes are not necessarily linked by Occurrence.

(45)

The Ford Motor Company has added a Cause-Failure Mode condition to the AIAG The Ford Motor Company has added a Cause-Failure Mode condition to the AIAG model, stating that if the Cause occurs, the Failure Mode always results. This

model, stating that if the Cause occurs, the Failure Mode always results. This condition effectively links Occurrenc

condition effectively links Occurrence with e with Failure Modes, but Failure Modes, but Failure Mode-EffectFailure Mode-Effect causality in the Ford model is not

causality in the Ford model is not mentioned in their FMEA handbook. If the Fordmentioned in their FMEA handbook. If the Ford model assumes that Effects

model assumes that Effects do not alwaysdo not always occur when the Failure Mode occurs, thenoccur when the Failure Mode occurs, then Occurrence has no real bearing on whether the customer will experience the Effect. If Occurrence has no real bearing on whether the customer will experience the Effect. If the Ford model assumes that Effects

the Ford model assumes that Effects alwaysalways occur when the Failure Mode occurs,occur when the Failure Mode occurs, then the FMEA team is forced to assume that a Cause will automatically lead to every then the FMEA team is forced to assume that a Cause will automatically lead to every possible Effect

possible Effect. This is . This is generally untrue, leadingenerally untrue, leading to g to overestimateoverestimated risk. In the d risk. In the FMEA FMEA model presented in this thesis, the Procedure for Potential Consequences and a new model presented in this thesis, the Procedure for Potential Consequences and a new Occurrence definition are used to handle this Cause-Failure Mode-Effect causality Occurrence definition are used to handle this Cause-Failure Mode-Effect causality problem. The Ford and AIAG models do not include the Procedure for Potential problem. The Ford and AIAG models do not include the Procedure for Potential Consequen

Consequences, or a ces, or a similar solution.similar solution.

Unlike Effects, Causes are not evaluated as a group when assessing risk. Separate Unlike Effects, Causes are not evaluated as a group when assessing risk. Separate values are assigned to each

values are assigned to each Cause of the Failure Cause of the Failure Mode. Current Controls sometimesMode. Current Controls sometimes prevent the Cause of failure, the Failure Mode itself, or

prevent the Cause of failure, the Failure Mode itself, or its Effects. Such Controls,its Effects. Such Controls, designated Type (1), are most desirable and can reduce initial Occurrence ratings. designated Type (1), are most desirable and can reduce initial Occurrence ratings.

(46)

Table 3

and

and Table 4

Table 4

are based on AIAG standards. Most

failure rates will fall

failure rates will fall between two numbers on the scale.

between two numbers on the scale.

The standard practice is to round to the higher of the

two Occurrence values. For example, a failure that

occurs every 14,000 parts would be assigned an

Occurrence value of 4, even though

11

_//

14000

is closer to

11

_//

15000

(Occurrence = 3) than it is to

11

//

20002000

(Occurrence =

4). For cases where the failure rates

4). For cases where the failure rates are

are completely

completely

unknown, assume that Occurrence =

unknown, assume that Occurrence = 10. Occurrence

10. Occurrence

ratings can be based information from

ratings can be based information from similar products

similar products

and process when available.

(47)

Notes of Interest:

••The probabilities represent the likelihood that the Cause willThe probabilities represent the likelihood that the Cause will occur

occur and and result in the Failure Mode, not just the chances that itresult in the Failure Mode, not just the chances that it will occur.

will occur.

••The scales are not linear.The scales are not linear.

•• An Occurrence of 10 does not discriminate between failures that An Occurrence of 10 does not discriminate between failures that occur over half the time and failures that occur every time.

occur over half the time and failures that occur every time.

•• An Occurrence of 1 does not discriminate between remote and An Occurrence of 1 does not discriminate between remote and zero chance of failure.

zero chance of failure.

Note:

Note: These tables diffThese tables differ slightly from er slightly from those published those published by theby the AIAG. Specific references to motor vehicles have been removed. AIAG. Specific references to motor vehicles have been removed.

The tables are similar to AIAG tables in that they are

The tables are similar to AIAG tables in that they are suggested suggested ranking systems. Because these tables are suggested, the actual ranking systems. Because these tables are suggested, the actual criteria used to prioritize risk should be documented with the criteria used to prioritize risk should be documented with the FMEA.

(48)

Probability of Failure

Probability of Failure Failure Rates Failure Rates R R

ank

Very High: Failure is almost inevitable

Very High: Failure is almost inevitable 11 iinn 22 1100

1

1 iinn 33 99

High: Repeated failures

High: Repeated failures 11 iinn 88 88

1

1 iinn 2200 77

Moderate: Occasional failures Moderate: Occasional failures

1 1 iinn 8800 66 1 1 iinn 440000 55 1 1 iinn 22000000 44

Low: Relatively few failures

Low: Relatively few failures 1 in 15,0001 in 15,000 33

1

1 iin n 115500,,000000 22 Remote: Failure is unlikely

Remote: Failure is unlikely 1 1 iin n 11,,550000,,000000 11

Table Table 3. 3.

Suggested evaluation criteria and ranking system for the Occurrence Suggested evaluation criteria and ranking system for the Occurrence of Failure in a design FMEA

(49)

P

Prroobbaabbiilliitty y oof f FFaaiilluurree FFaaiilluurre e RRaatteess C C _pk_pk R R

ank

Very High: Failure is almost inevitable

Very High: Failure is almost inevitable ≥≥ 1 1 iin n 22 < < 00..3333 1100 1 in 3

1 in 3 ≥≥00..3333 99 High: Generally associated with processes similar

High: Generally associated with processes similar to previous processes that have often failed

to previous processes that have often failed

1 in 8

1 in 8 ≥≥00..5511 88

1 in 20

1 in 20 ≥≥00..6677 77

Moderate: Generally associated with processes Moderate: Generally associated with processes similar to pervious processes which have

similar to pervious processes which have

experienced occasional failures, but not in major experienced occasional failures, but not in major proportions proportions 1 in 80 1 in 80 ≥≥00..8833 66 1 in 400 1 in 400 ≥≥ 11..0000 55 1 in 2000 1 in 2000 ≥≥11..1177 44 Low: Isolated failures associated with similar

Low: Isolated failures associated with similar processes

processes 1 in 15,0001 in 15,000 ≥≥11..3333 33 Very Low: Only isolated failures associated with

Very Low: Only isolated failures associated with almost identical processes

almost identical processes 1 in 150,0001 in 150,000 ≥≥11..5500 22 Remote: Failure is unlikely. No failures ever

Remote: Failure is unlikely. No failures ever associated with almost identical processes

associated with almost identical processes ≤≤1 in 1,500,0001 in 1,500,000 ≥≥11..6677 11 Table

Table 4. 4.

Suggested evaluation criteria and ranking system for the Occurrence Suggested evaluation criteria and ranking system for the Occurrence of of Failure in a Process FMEA

(50)

Current Control

Design and Process controls are grouped according to their Design and Process controls are grouped according to their purpose.

purpose. Type (1):

Type (1): These controls prevenThese controls prevent the Cause or Failure t the Cause or Failure Mode from occurring, orMode from occurring, or reduce their rate of occurrence.

reduce their rate of occurrence. Type

Type (2): (2):

These controls detect the Cause of the Failure Mode and lead to These controls detect the Cause of the Failure Mode and lead to corrective action. corrective action. Type Type (3): (3):

These Controls detect the Failure Mode before the product reaches the These Controls detect the Failure Mode before the product reaches the customer. The customer could be the next operation, subsequent

customer. The customer could be the next operation, subsequent operations, or the end user.

operations, or the end user. The distinction between controls that

The distinction between controls that prevent prevent failure (Type 1) and controls thatfailure (Type 1) and controls that detect detect failure (Types 2 and 3) is important. Type 1 controls reduce the likelihood that a Cause or failure (Types 2 and 3) is important. Type 1 controls reduce the likelihood that a Cause or Failure Mode will occur, and therefore affect Occurrence ratings. Type 2 and Type 3

Failure Mode will occur, and therefore affect Occurrence ratings. Type 2 and Type 3 Controls detect Causes and Failure Modes respectively, and therefore affect

Controls detect Causes and Failure Modes respectively, and therefore affect DetectionDetection

ratings. ratings.

(51)

Detection values are associated with Current Controls. Detection is a measurement of the Detection values are associated with Current Controls. Detection is a measurement of the ability of

ability of Type (2)Type (2) Controls to detect Causes or mechanisms of failure, or the ability of Controls to detect Causes or mechanisms of failure, or the ability of Type (3)

Type (3) Controls to detect subsequent Failure Modes. One Controls to detect subsequent Failure Modes. One Detection value is Detection value is assigned toassigned to the system of Current Controls, which represents a collective ability to detect Causes or the system of Current Controls, which represents a collective ability to detect Causes or Failure Modes. Controls can be grouped and treated as a system when they operate Failure Modes. Controls can be grouped and treated as a system when they operate independently, as

independently, as each each individindividual Control ual Control increases overall increases overall detection capabilitiedetection capabilities. s. TheThe design and process ranking systems presented in

design and process ranking systems presented in Table 5Table 5 andand Table 6Table 6 are based on AIAGare based on AIAG standards.

standards.

Notes of Interest: Notes of Interest:

••High values indicate a lack of High values indicate a lack of detection ability.detection ability.

••The tables are not The tables are not quantitative; relative terms are used.quantitative; relative terms are used.

••The adjectives used to describe the likelihood of Detection indicate a generally linearThe adjectives used to describe the likelihood of Detection indicate a generally linear relationship.

relationship.

•• A Detection value of 1 A Detection value of 1 does not imply 100% detection.does not imply 100% detection. Note:

Note: These tables differ These tables differ slightly from those published by slightly from those published by the AIAG. Specific references the AIAG. Specific references toto motor vehicles have been removed. The tables are similar to AIAG tables in that they are motor vehicles have been removed. The tables are similar to AIAG tables in that they are

(52)

D

Detetecectitionon CrCrititereria: ia: LiLikekelilihohood ood of Df Detetecectition on by Dby Desesigign Cn Conontrtrol ol R R

ank ank Absolute Absolute Uncertaint Uncertaint y y

Design Control does not detect a

Design Control does not detect a potential Cause of failure or subsequentpotential Cause of failure or subsequent Failure Mode; or there is no

Failure Mode; or there is no Design ControlDesign Control 1010 Very

Very Remote Remote

Very remote chance the Design

Very remote chance the Design Control will detect a potential Cause of Control will detect a potential Cause of failure or subsequent Failure Mode

failure or subsequent Failure Mode 99 Remote

Remote Remote chance the Design Control will Remote chance the Design Control will detect a potential Cause of failuredetect a potential Cause of failure or subsequent Failure Mode

or subsequent Failure Mode 88

Very Low

Very Low Very low chance the Design Very low chance the Design Control will detect a potential Cause of failureControl will detect a potential Cause of failure or subsequent Failure Mode

or subsequent Failure Mode 77 Low

Low Low chance the Design Low chance the Design Control will detect a potential Cause of failure orControl will detect a potential Cause of failure or subsequent Failure Mode

subsequent Failure Mode 66

Moderate

Moderate Moderate chance the Design Control will detect Moderate chance the Design Control will detect a potential Cause of a potential Cause of failure or subsequent Failure Mode

failure or subsequent Failure Mode 55 Moderatel

Moderatel y High y High

Moderately high chance the Design Control

Moderately high chance the Design Control will detect a potential Cause of will detect a potential Cause of failure or subsequent Failure Mode

failure or subsequent Failure Mode 44 High

High High chance the Design High chance the Design Control will detect a potential Cause of failure orControl will detect a potential Cause of failure or subsequent Failure Mode

Very High

Very High Very high chance the Very high chance the Design Control will detect a pDesign Control will detect a potential Cause of otential Cause of failure or subsequent Failure Mode

failure or subsequent Failure Mode 22 Almost

Almost Certain Certain

Design Control will almost certainly detect a potential

Design Control will almost certainly detect a potential Cause of failure orCause of failure or subsequent Failure Mode

Table 5.

Table 5. Suggested evaluation criteria and ranking system for the Detection of a Cause of Suggested evaluation criteria and ranking system for the Detection of a Cause of failure orfailure or Failure Mode in a

(53)

D Deetetectctioionn CCriritteeriria: a: LiLikkelelihihooood d of of DDeetetectctioion n bby y PrPrococeess ss CoContntroroll R R ank ank Almost Almost Impossible

Impossible NNo o kknnoowwn n CCoonnttrroolls s aavvaaiillaabblle e tto o ddeetteecct t FFaaiilluurre e MMoodde e oor r CCaauussee 1100 Very Remote

Very Remote Very remote likelihood current Controls with detect Failure Mode or Very remote likelihood current Controls with detect Failure Mode or Cause

Cause 99

Remote

Remote RReemmootte e lliikkeelliihohoood d ccuurrrreennt t CCoonnttrorolls s wwiith th ddeetteecct t FFaaiilluurre e MMoodde e oor r CCaauussee 88 Very Low

Very Low VVeerry ly loow lw liikkeelliihhooood cd cuurrrreennt Ct Coonntrtroolls ws wiitth dh deetetecct Ft Faaiilluurre Me Moodde oe or Cr Caauussee 77 Low

Low LLoow w lliikkeelliihhooood d ccuurrrreennt t CCoonnttrroolls s wwiitth h ddeetteecct t FFaaiilluurre e MMoodde e oor r CCaauussee 66 Moderate

Moderate MMoodederarate te lilikekelilihohoood cd cuurrrrenent Ct Conontrtrools ls wwitith dh deteteect ct FFaaililuure re MModode oe or Cr Caaususee 55 Moderately

Moderately High

High

Moderately high likelihood current Controls with detect Failure Mode or Moderately high likelihood current Controls with detect Failure Mode or Cause

Cause 44

High

High HHiiggh h lliikkeelliihhooood d ccuurrrreennt Ct Coonnttrroolls s wwiitth h ddeetteecct t FFaaiilluurre e MMoodde e oor r CCaauussee 33 Very High

Very High V Verery hy hiigh gh lilikekelilihohoood cd cuurrrrenent Ct Conontrtrools ls wwitith dh deteteect ct FFaaililuure re MModode oe or Cr Caaususee 22 Almost

Almost Certain Certain

Current Controls almost certain to Failure Mode or Cause. Reliable Current Controls almost certain to Failure Mode or Cause. Reliable detection controls are known with similar processes.

detection controls are known with similar processes. 11 Table 6.

Table 6. _{Suggested evaluation criteria and ranking system for the D}_{Suggested evaluation criteria and ranking system for the Detection of a}_{etection of a} Cause of failure or Failure Mode in a process FMEA

(54)

A tabular FMEA documentation form has been

standardized by the AIAG. All input data must be

organized on the output form

organized on the output form in the spaces and columns

in the spaces and columns

provided. Some companies compile FMEA data on

worksheets, and then transfer the information to the

worksheets, and then transfer the information to the form.

form.

Other companies with electronic versions of the

Other companies with electronic versions of the form can

form can

fill in the

fill in the table as F

table as FMEA element

MEA elements are identified.

s are identified. FMEA

FMEA

Facilitator collects the input data through an organized

and intuitive interface and places it on the form

automatically.

(55)

The fundamental purpose of the FMEA is to

recommend and take actions that reduce risk

recommend and take actions that reduce risk ..

Actions taken often result in

Actions taken often result in a lower Severity, Occurrence,

a lower Severity, Occurrence,

or Detection rating. Adding validation or verification

controls can reduce Detection. Design or

controls can reduce Detection. Design or process revision

process revision

may result in lower Severity and

may result in lower Severity and Occurrence ratings. The

Occurrence ratings. The

revised ratings are documented with the originals on

revised ratings are documented with the originals on the

the

tabular FMEA form. If no action i

tabular FMEA form. If no action is recommended, the

s recommended, the

decision not to act should also be noted. Effective follow-up

programs are also necessary, as the purpose o

programs are also necessary, as the purpose of the FMEA is

f the FMEA is

defeated if any recommended actions are left

(56)

The Risk Priority Number (RPN) is a mathematical product of the The Risk Priority Number (RPN) is a mathematical product of the

seriousness of a group of Effects (Severity), the likelihood that a Cause seriousness of a group of Effects (Severity), the likelihood that a Cause will create the failure associated with those Effects (Occurrence), and an will create the failure associated with those Effects (Occurrence), and an ability to detect the failure before it gets to the customer (Detection). In ability to detect the failure before it gets to the customer (Detection). In equation form, RPN = S • O • D. This number is used to help identify the equation form, RPN = S • O • D. This number is used to help identify the most serious risks, leading to corrective action. Inspection of the

most serious risks, leading to corrective action. Inspection of the equation reveals that the RPN method for assessing risk is an equation reveals that the RPN method for assessing risk is an

oversimplification. Severity, Occurrence, and Detection are not equally oversimplification. Severity, Occurrence, and Detection are not equally weighted with respect to one another in terms of risk. The distortion is weighted with respect to one another in terms of risk. The distortion is compounded by the non-linear nature of the individual ranking scales. compounded by the non-linear nature of the individual ranking scales. As a result, some S-O-D scenarios produce RPNs that are lower than As a result, some S-O-D scenarios produce RPNs that are lower than

other combinations, but more risky. other combinations, but more risky.

Furthermore, the RPN scale itself has some non-intuitive statistical Furthermore, the RPN scale itself has some non-intuitive statistical properties. The initial and correct observation that the scale starts at 1 properties. The initial and correct observation that the scale starts at 1 and ends at 1000 often leads to incorrect assumptions about the middle and ends at 1000 often leads to incorrect assumptions about the middle