FMEA: Failure Mode and Effects Analysis Explained

That sentence covers the method. What follows covers the part most published guidance still gets wrong: the automotive industry retired the Risk Priority Number in 2019, and much of the material online still teaches it as current practice. The arithmetic below is the reason it had to go.

The arithmetic that broke the Risk Priority Number

An FMEA produces three ratings, each on a scale of 1 to 10. Severity measures how bad the effect is, Occurrence how likely the cause is to arise, and Detection how likely current controls are to catch it. Each is defined more fully further down this page.

The Risk Priority Number was a multiplication of those three:

RPN = Severity x Occurrence x Detection

With each factor from 1 to 10, RPN ranges from 1 to 1,000. Teams set a threshold and acted on anything above it. No standard fixes that threshold; it is a local convention. ASQ’s guidance says an organization will usually establish one “for example, 100 or 125”, and 100 and 120 are both common in practice. The worked example below uses 100 because it is the figure most often taught.

Every number that follows is a plain calculation from the 1 to 10 scales. You can reproduce all of it.

Collision. Take two failure modes on the same PFMEA.

10 x 2 x 5 = 100. 2 x 10 x 5 = 100. Under a threshold of 100, these two ranked identically. One of them can hurt somebody.

How often does that happen? RPN 100 can be reached twelve ways:

(1,10,10) (2,5,10) (2,10,5) (4,5,5) (5,2,10) (5,4,5) (5,5,4) (5,10,2) (10,1,10) (10,2,5) (10,5,2) (10,10,1)

The first and the ninth of those sit at opposite ends of the harm spectrum and share a score.

The scale is mostly empty. The 1,000 possible S, O and D combinations collapse into only 120 distinct RPN values, leaving 880 of the integers between 1 and 1,000 unreachable. RPN 60, RPN 72 and RPN 120 are each produced by 24 separate combinations, while RPN 997 cannot be produced at all. A scale where 88 percent of the values are unreachable is not a scale, it is a lookup with bad manners.

Severity gets buried. Of the 1,000 combinations, 200 carry a Severity of 9 or 10, and 50 of those produce an RPN below 100. A quarter of every safety-relevant combination falls under a common action threshold. A failure rated S=10, O=2, D=3 scores 10 x 2 x 3 = 60 and gets filed, while S=5, O=6, D=6 scores 180 and gets a team.

That last figure is the whole argument for the change, and the shape of the replacement proves it.

Action Priority (AP) took the place of RPN in the 2019 AIAG-VDA handbook. Quality Digest states that “the recommended method of combining these three indices into a single composite value is no longer the risk priority number,” and describes what took its place as “a three-axis reference table” used “to assign a relative high, medium, or low need for action.” Quality-One is blunter: “the Risk Priority Number or RPN has been eliminated.”

The mechanism is the important part. Action Priority is a lookup, not a calculation. Each of the 1,000 S, O and D combinations is assigned High, Medium or Low in a published table, and the table considers Severity first, then Occurrence, then Detection, rather than weighting all three equally as multiplication does. Nothing is multiplied and no threshold is chosen locally.

Both defects above close as a result. The 880 unreachable numbers disappear, because there is no arithmetic left to produce gaps. And the 50 safety-relevant combinations that fell below a threshold of 100 cannot be buried the same way, because a high Severity is consulted before the other two ratings instead of being multiplied against them.

The three outcomes carry different obligations: High means action must be identified, Medium means it should be, Low means it could be, per Quality-One. AP is not a measure of risk. It is an instruction about priority of action, which is why the name changed.

The AP tables are copyright to AIAG and VDA and are not reproduced here. It is often stated that Severity 9 and 10 resolve to High regardless of Occurrence and Detection. Neither AIAG nor VDA asserts that in the material cited on this page, and it has not been checked here against the handbook text, so anyone relying on the rule should read the tables themselves.

The formal version of the same complaint predates the handbook. Bowles set it out in an IEEE paper, identifying the use of ordinal rankings as numeric quantities, gaps across the RPN scale, duplicate RPN values with entirely different characteristics, and inconsistent sensitivity to small changes. A Severity of 10 is worse than a Severity of 5, but it is not twice as bad in any measurable sense, and multiplying rank positions produces a number with no meaning. Wikipedia summarizes the consequence as rank reversal, “where a less serious failure mode receives a higher RPN than a more serious failure mode.”

None of that has reached the teaching material. ASQ’s own FMEA page still walks readers through the step “Calculate the risk priority number (RPN): Calculate the RPN, which equals S x O x D,” and tells them that when the RPN exceeds the threshold, “actions are required”. RPN has not been retired everywhere, only in automotive, so ASQ is not wrong for every reader. But anyone arriving from an automotive customer requirement will find the retired method taught as the current one by the nearest thing the field has to a general authority.

What is an FMEA and what is it for?

An FMEA is a preventive analysis, performed before a failure occurs rather than after one.

That boundary is the whole distinction between an FMEA and the records downstream of it. An FMEA is written about failures that have not happened. A non-conformance report is a record of one that has. An 8D report is an investigation into why. Where a quality system treats the three as interchangeable, it has a corrective system with a preventive label on it.

The American Society for Quality describes FMEA as “an early warning and preventive technique that provides designers with a methodical way of satisfying the causes and effects of failures before the system, design, process or service is finalized”. The international standard puts the purpose more plainly: IEC 60812:2018 states that the purpose of FMEA is “to establish how items or processes might fail to perform their function so that any required treatments could be identified.”

The method’s lineage is military. MIL-P-1629, “Procedures for Performing a Failure Modes, Effects and Criticality Analysis,” was published on 9 November 1949, and the technique moved through NASA’s Apollo program into aerospace and then automotive manufacturing.

One further boundary matters. An FMEA analyzes failure, and not every risk is a failure. A medical device can meet every specification and still cause harm, which is why FMEA alone does not satisfy ISO 14971.

What are the types of FMEA?

Four types are in common use, and two of them account for most of the work.

A DFMEA asks whether the design is right. A PFMEA asks whether the process can build the design right. They are different analyses with different teams, inputs and owners, and combining them into one document produces a record that serves neither purpose.

VDA states that its handbook with AIAG is “a reference manual to be used by the automotive industry suppliers as a guide to assist them in the development of Design FMEA, Process FMEA, and Supplemental FMEA for Monitoring and System Response.” System FMEA sits outside that handbook but is in general use, particularly in aerospace and in complex electromechanical products.

FMEA-MSR is the least understood of the three the handbook covers. It deals with failures in the field, where a monitoring system or the end user may detect the fault and the system may respond to it. It does not use Severity, Occurrence and Detection at all: it uses Severity, Frequency and Monitoring, because the question is not whether your factory catches the fault but whether the product catches it while someone is driving.

What are the seven steps of the AIAG-VDA FMEA process?

In June 2019 the Automotive Industry Action Group and the Verband der Automobilindustrie published a single harmonized handbook, replacing their two separate manuals. VDA records the edition as “First Edition Issued June 2019”. The method it sets out has seven steps:

1. Planning and preparation 2. Structure analysis 3. Function analysis 4. Failure analysis 5. Risk analysis 6. Optimization 7. Results documentation

Quality Digest lists these same seven steps, as does Quality-One. Steps one through three build the system model, steps four through six do the analysis and the risk reduction, and step seven communicates the result.

The seven-step structure is the part of the 2019 change that gets the least attention and does the most work, because steps two and three force a team to agree what the system is and what it is supposed to do before anyone argues about what could go wrong.

One caveat, because almost no page states it. VDA is explicit that the handbook “does not define requirements; it is intended to clarify the steps, activities, and tools related to the technical development of FMEAs.” Whether you must follow it is a matter of your customer’s requirements, not of the handbook itself.

What do Severity, Occurrence and Detection actually measure?

Three ratings, each on a scale of 1 to 10, as confirmed by Quality Digest.

Severity (S) measures how bad the effect of the failure is for the person on the receiving end. It is a property of the effect and nothing else, and no control you add changes it. A failure that can injure someone is a 9 or a 10 whether it happens once a decade or once a shift.

Occurrence (O) measures how likely the cause is to arise. It is rated against the cause, not against the failure mode and not against the effect, which is the most common scoring error in practice.

Detection (D) measures how likely your current controls are to catch the failure or its cause before it reaches the customer. The scale runs backwards against intuition: a high Detection number means detection is poor.

The published rating tables in the AIAG-VDA handbook are copyright and are not reproduced here. The structure can be stated without them: three ordinal scales of 1 to 10, producing 10 x 10 x 10, or 1,000 possible combinations.

How do other industries use FMEA?

Automotive is not the owner of the method, only its loudest user.

Aerospace works to different documents. SAE ARP5580, “Recommended Failure Modes and Effects Analysis (FMEA) Practices for Non-Automobile Applications,” was issued in July 2001 and reaffirmed on 7 August 2020. Aero engine supply chains work to AS13004A, issued on 18 September 2024, which revised the original AS13004 of 28 August 2017. It is published by SAE International and prepared by SAE’s G-22 Aerospace Engine Supplier Quality (AESQ) committee, a distinction worth getting right because the AESQ is a committee within SAE rather than a publisher in its own right.

Medical devices sit under ISO 14971, not the AIAG-VDA handbook, and the difference is not cosmetic. ISO 14971 requires the identification of hazards and hazardous situations across the product lifecycle, including risks that involve no failure at all, and requires a documented judgment on overall residual risk acceptability. An FMEA can support that process but cannot be it.

Process and general industry has a generic standard. IEC 60812:2018, edition 3.0, published 10 August 2018, is deliberately application neutral and applies to “hardware, software, processes including human action, and their interfaces, in any combination.” It offers “alternative means of calculating risk priority numbers” and a criticality matrix method, so RPN survives outside automotive.

The scales and the prioritization method come from whichever framework your customer or regulator requires, while the underlying discipline of listing failure modes, effects and causes is common to all of them.

When should an FMEA be created and reviewed?

An FMEA created after the design is frozen has already failed at its only job. A DFMEA belongs in product design and development and a PFMEA in process design and development, early enough that the findings can still change something.

An FMEA is a living record rather than a deliverable, and the review triggers are specific: a design change, a process change, a new failure mode discovered anywhere, a change to detection controls, a customer complaint or field failure, and the closure of a corrective action. A field failure that does not appear as a failure mode in the FMEA is direct evidence that the analysis was incomplete, and that loop is the connection between an FMEA and your CAPA process.

What must a completed FMEA record contain?

An FMEA that cannot be audited two years later is a workshop, not a record. A usable record holds, at minimum:

• The item, function or process step, and the requirement it must meet
• The failure mode, stated as the loss of that function
• The effect of the failure, and who experiences it
• The cause of the failure, stated at a level someone can act on
• Current prevention controls and current detection controls, distinguished from each other
• The Severity, Occurrence and Detection ratings, and the Action Priority or RPN
• The action taken, the named owner, and the target date
• The completion date, the evidence of completion, and the re-rated result
• Revision history with dates, and the team members present

The last three lines are where most FMEAs fall apart. An action without an owner, a date and evidence of completion is an opinion, not a control. Re-rating after action is what proves the risk actually moved, and where it does not move, the record needs to say why the team accepted it.

The FMEA also has to connect outward. A failure mode that occurs in production becomes a non-conformance, the investigation usually becomes an 8D report, and the corrective action should come back and change the FMEA. Where that loop is broken, the FMEA becomes a document produced for audits and consulted by nobody.

Frequently asked questions

Sources

• IEC 60812:2018, Failure modes and effects analysis (FMEA and FMECA), edition 3.0, 10 August 2018
• VDA QMC, AIAG & VDA FMEA Handbook, First Edition Issued June 2019
• AIAG, AIAG & VDA FMEA Handbook product page (FMEAAV-1)
• Quality Digest, Understanding AIAG-VDA’s FMEA Process and Approach
• Quality-One, AIAG & VDA FMEA
• ASQ, What is FMEA? Failure Mode and Effects Analysis
• ASQ, Failure Mode and Effect Analysis (FMEA)
• Bowles, An assessment of RPN prioritization in a failure modes effects and criticality analysis, IEEE
• Greenlight Guru, FMEA is not ISO 14971 risk management
• SAE ARP5580, Recommended FMEA Practices for Non-Automobile Applications
• SAE AS13004A, Process Failure Mode and Effects Analysis and Control Plans, 18 September 2024
• Relyence, AIAG-VDA FMEA-MSR
• Wikipedia, Failure mode and effects analysis
• Wikipedia, Failure mode, effects, and criticality analysis

All arithmetic in the worked example was computed from the standard 1 to 10 rating scales and is reproducible by hand or by a short script.

Related terms

• What is a non-conformance?
• CAPA explained
• 8D report
• Non-conformance report

Last reviewed: 16 September 2026

About Logincident. Logincident is a data and software company whose configurable platform captures structured evidence at the point of work and presents it in dashboards and reports, including quality records such as FMEA actions, non-conformances and corrective actions. We are not a law firm or a claims handler, and nothing on this page is legal advice.