FMEA & Control Plan

FMEA is an integral part of any QS 9000 compliant quality system.
Figure
1 illustrates the role of FMEA in a typical quality system.
Figure 1. The role of FMEA in a quality system.

This portion of the site is intended to provide the visitor with useful and
pertinent information regarding the FMEA process. It can serve as a
reference document for individuals or teams familiar with FMEAs. It is not
a comprehensive instruction guide for performing an FMEA, and should
not be used as such.
Pakistan Institute of Quality Control
Definitions:
Cause • Function
Critical Characteristics • Occurrence
• Risk Priority Number
Criticality
Current Controls • Severity
Customer • Significant Characterist
Detection
Effect • Special Process Charact
Failure Mode
• Special Product Charac
FMEA Element
Cause
A Cause is the means by which a

particular element of the design or
process results in a Failure Mode.

Critical Characteristics:
Critical Characteristics are Special

Characteristics defined by Ford Motor
Company that affect customer safety
and/or could result in non-compliance
with government regulations and thus
require special controls to ensure 100%
compliance.

Criticality:
The Criticality rating is the mathematical

product of the Severity and Occurrence
ratings. Criticality = (S) × (O). This
number is used to place priority on items
that require additional quality planning.

Current Controls:
Current Controls (design and process) are

the mechanisms that prevent the Cause of
the Failure Mode from occurring, or
which detect the failure before it reaches
the Customer.

Customer:
Customers are internal and external

departments, people, and processes that
will be adversely affected by product
failure.

Detection:
Detection is an assessment of the

likelihood that the Current Controls
(design and process) will detect the Cause
of the Failure Mode or the Failure Mode
itself, thus preventing it from reaching the
Customer.

Effect:
An Effect is an adverse consequence that

the Customer might experience. The
Customer could be the next operation,
subsequent operations, or the end user.

Failure Mode:
Failure Modes are sometimes described as
categories of failure. A potential Failure
Mode describes the way in which a
product or process could fail to perform
its desired function (design intent or
performance requirements) as described
by the needs, wants, and expectations of
the internal and external Customers.

FMEA Element:
FMEA elements are identified or analyzed
in the FMEA process. Common examples
are Functions, Failure Modes, Causes,
Effects, Controls, and Actions. FMEA
elements appear as column headings in
the output form.

Function:
A Function could be any intended
purpose of a product or process. FMEA
functions are best described in verb-noun
format with engineering specifications.

Occurrence:
Occurrence is an assessment of the
likelihood that a particular Cause will
happen and result in the Failure Mode
during the intended life and use of the
product.

Risk Priority Number:
The Risk Priority Number is a
mathematical product of the numerical
Severity, Occurrence, and Detection
ratings. RPN = (S) × (O) × (D). This
number is used to place priority on items
than require additional quality planning.

Severity:
Severity is an assessment of how serious
the Effect of the potential Failure Mode is
on the Customer.

Significant Characteristics:
Significant Characteristics are Special
Characteristics defined by Ford Motor
Company as characteristics that
significantly affect customer satisfaction
and require quality planning to ensure
acceptable levels of capability.

Special Process
Characteristics:
Special Process Characteristics are
process characteristics for which variation
must be controlled to some target value to
ensure that variation in a Special Product
Characteristic is maintained to its target
value during manufacturing and
assembly.

Special Product
Characteristics:
Special Product Characteristics are
product characteristics for which
reasonably anticipated variation could
significantly affect a product’s safety or
compliance with governmental standards
or regulations, or is likely to significantly
affect customer satisfaction with a
product.

Acronyms:
8-D Eight Disciplines of Problem Solving ISO International Organization for

Standardization
AIAG Automotive Industry Action Group
APQP Advanced Product Quality Planning QFD Quality Function

Deployment
ASQC American Society for Quality Control QOS Quality Operating System
DOE Design of Experiments RFTA Reverse Fault Tree Analysis
FMEA Potential Failure Mode and Effects RPN Risk Priority Number
Analysis
FTA Fault Tree Analysis SPC Statistical Process Control

The FMEA discipline was developed in the United States Military.
Military Procedure MIL-P-1629, titled Procedures for Performing a
Failure Mode, Effects and Criticality Analysis, is dated November 9,
1949. It was used as a reliability evaluation technique to determine
the effect of system and equipment failures. Failures were classified
according to their impact on mission success and
personnel/equipment safety. The term "personnel/equipment",
taken directly from an abstract of Military Standard MIL-STD-
1629, is notable. The concept that personnel and equipment are
interchangeable does not apply in the modern manufacturing
context of producing consumer goods. The manufacturers of
consumer products established a new set of priorities, including
customer satisfaction and safety. As a result, the risk assessment
tools of the FMEA became partially outdated. They have not been
adequately updated since.

In 1988, the International Organization for Standardization issued
the ISO 9000 series of business management standards. The
requirements of ISO 9000 pushed organizations to develop
formalized Quality Management Systems that ideally are focused
on the needs, wants, and expectations of customers. QS 9000 is the
automotive analogy to ISO 9000. A Task Force representing
Chrysler Corporation, Ford Motor Company, and General Motors
Corporation developed QS 9000 in an effort to standardize supplier
quality systems. In accordance with QS 9000 standards, compliant
automotive suppliers shall utilize Advanced Product Quality
Planning (APQP), including design and process FMEAs, and
develop a Control Plan.

Advanced Product Quality Planning standards provide a
structured method of defining and establishing the steps
necessary to assure that a product satisfies the
customer’s requirements. Control Plans aid in
manufacturing quality products according to customer
requirements in conjunction with QS 9000. An
emphasis is placed on minimizing process and product
variation. A Control Plan provides "a structured
approach for the design, selection, and implementation
of value-added control methods for the total system."
QS 9000 compliant automotive suppliers must utilize
Failure Mode and Effects Analysis (FMEA) in the
Advanced Quality Planning process and in the
development of their Control Plans.
The Automotive Industry Action Group (AIAG) and the
American Society for Quality Control (ASQC) copyrighted industry-
wide FMEA standards in February of 1993, the technical equivalent
of the Society of Automotive Engineers procedure SAE J-1739. The
standards are presented in an FMEA Manual approved and
supported by all three automakers. It provides general guidelines
for preparing an FMEA.
This site is dedicated to overcoming some deficiencies of the

Potential Failure Mode and Effects Analysis (FMEA), as it is
currently being deployed in the U.S. automotive industry. An
FMEA is commonly defined as "a systematic process for identifying
potential design and process failures before they occur, with the
intent to eliminate them or minimize the risk associated with
them." Pakistan Institute of Quality Control
In the progression of time, a Failure
Mode comes between a Cause and an
Effect. One of the most confusing issues
for new practitioners of FMEA is that any
Cause that itself has a Cause might be a
Failure Mode. Any Effect that itself has
an Effect might also be a Failure Mode. In
different contexts, a single event may be
a Cause, an Effect, and a Failure Mode.
Consider for example Figure 2, a series of
events that could occur during the life of
a disposable penlight.
In an analysis of the exterior casing of a penlight, "Allows excess
moisture" would be a Failure Mode. One of the intended functions of the
penlight case is to protect the internal components from excess moisture
during normal operation. A failure to prevent moisture during normal
operation is a Failure Mode since protective casings and other design
features are intended to prevent moisture. Causes appear above the Failure
Mode in Figure 2. Effects appear below.
In the analysis of the penlight bulb, a different Function and Failure

Mode(s) must be considered. The penlight bulb is intended to provide light
of specific intensity when the device is activated during its expected
lifetime. This is one of its Functions, or intended purposes. A dim bulb is a
failure to provide the specified intensity of light and is therefore a Failure
Mode of the penlight bulb. This example illustrates that Causes, Effects,
and Failure Modes can change depending on the Function being analyzed.
Functions change depending on the object of the analysis, either product
or process. Therefore, an early, important step in an FMEA is to clearly
define the scope: the component, system, or process that is to be analyzed.

Most real-world systems do not follow the simple Cause-
Effect model. A single Cause may have multiple Effects. A
combination of Causes may lead to an Effect, or they may
lead to multiple Effects. Causes can themselves have Causes,
and Effects can have subsequent downstream Effects. The
Failure Mode must also be considered in all of these models.
Figure 3 illustrates the relationship between a Function, a
Failure Mode, Potential Causes, and Effects. In the FMEA
model presented in this document, Causes do not
automatically result in the Failure Mode. The term ‘Potential’
is used to describe Causes, to indicate this uncertainty. The
model also assumes that all Effects will result given that the
Failure Mode has occurred. Therefore, ‘Potential’ is not used
to describe Effects.

Figure 3. FMEA Relationships
In Figure 3, A pentagon is used to represent the
Failure Mode for two reasons. First, Failure
Modes can be grouped into one of five
categories of failure. Secondly, the
asymmetrical pentagon is mirrored to
indicate that Failure Modes can also be
described as anti-Functions.
FMEA Elements are the building blocks of related
information that comprise an analysis. The team
approach is almost essential in identifying FMEA
elements. Although actual document preparation is
often the responsibility of an individual, FMEA input
should come from a multi-disciplinary team. The team
should consist of knowledgeable individuals with
expertise in design, manufacturing, assembly, service,
quality, and reliability. The responsible engineer
typically leads the FMEA team. Members and leadership
may vary as the system, product, and process designs
mature.
Once the object of the analysis has been established, the next step
in the FMEA process is to identify Functions. A Function is an
intended purpose of the product or process being analyzed. If a
system is being considered, Functions of individual subsystems
should also be identified. Potential Failure Modes, or categories
of failure, can then be identified by describing the way in which
the object fails. Failure Modes fall into 1 of 5 possible failure
categories:
complete failure.
partial failure.
intermittent failure.
failure over time.
over-performance of Function.

In the penlight example, suppose "Provide Light at
3 ± .5 candela" is defined as a Function. The
following Failure Modes could be identified:
no light.
dim light.
erratic blinking light.
gradual dimming of light.
too bright.

The purpose of these five Failure Mode groupings is to assist the
FMEA team identify all possible Failure Modes. Looking for Failure
Modes in these groupings may reveal some unusual failure
possibilities that otherwise would not have been considered. Poorly
defined Functions may also be revealed. In this example, a light that
does not turn off (over-performs its Function) is a product failure,
even though the Function "Provide light at 3 ± .5
candela" does not fail. This implies the need for an additional
Function, such as "Default to off when not in use", which
may have been overlooked when Functions were originally identified.
The original Function is rephrased as: "Provides light at 3 ±
.5 candela when on." A partial, intermittent, gradual or over-
performance type failure of one Function may be a complete failure of
another unidentified Function. Use of the Failure Mode categories
can help reveal these Functions.

After Functions and Failure Modes have been established, the next
step in the FMEA process is to identify potential downstream
consequences when the Failure Mode occurs. This should be a team
brainstorming activity. After consequences have been identified,
they must be fit into the FMEA model as Effects. In the FMEA
model presented by the Haviland Consulting Group, it is assumed
that Failure Mode Effects always occur when the Failure Mode
occurs; there is no representation for the likelihood that a Failure
Mode will result in an Effect. The Procedure for Potential
Consequences is applied to account for unlikely or remote
consequences. The Procedure explicitly associates Effects with the
circumstances under which they occur through the identification of
additional Failure Modes.

The Procedure for Potential
Consequences:
• Begin with a Failure Mode (referred to as FM-1), and a list of all its potential
consequences.
•
Separate the consequences that can be assumed to result whenever the
Failure Mode FM-1 occurs. Identify these as Effects of FM-1.
•
Write additional Failure Modes for the remaining consequences
(consequences which could result when FM-1 occurs, depending on the
circumstances under which FM-1 occurred).
The new Failure Modes imply that unlikely consequences will result by
including the circumstances under which they occur.
• Separate the consequences that can be assumed to result whenever the
additional Failure Modes and their special circumstances occur. Identify these
consequences as Effects of the additional Failure Modes.

Consider this example, which illustrates the Procedure for Potential
Consequences. During the Effects brainstorm, the team may tend to
identify very severe consequences and the unlikely circumstances under
which they occur. When analyzing the penlight bulb, a team member
may observe that the bulb could prematurely burn out when being used
as a flashlight, the resulting darkness causing the user to trip, fall, and
be injured. Another member may observe that atmospheric pressure
variation could cause the bulb to explode while being used for an eye
examination, resulting in injury. Such extraneous predicaments are
typical of a brainstorm and can be expected. But rather than write a
new Failure Mode for every bizarre situation recorded by the team, the
events should be grouped into a broad Effect category, such as "injury
or death". Ultimately, Effects are categorized into one of ten groups,
according to Severity. It is advantageous to write Failure Modes that
encompass all the Effects in a Severity grouping, such as "Fails to
provide 3 ± .5 candela of light under critical
conditions". All product failures that lead to injury or death are
automatically included; there is no need to attempt to identify all the
circumstances under which injury or death could result. The tradeoff
for this convenience is that the likelihood of failure under any critical
situation mustPakistan Institute
be factored into theofOccurrence
Quality Control
rating.
The first step in analyzing risk is to quantify the Severity of the
Effects. Effects are rated on a scale of 1 to 10, 10 being the most
severe. The team should agree on consistent evaluation criteria and
a sensible ranking system. The design and process ranking systems
presented in Table 1 and Table 2 are based on AIAG standards.
Effects are evaluated as a group when assessing risk, even though
they are assigned Severity values individually. It is assumed that all
Effects will result if the Failure Mode occurs. Therefore, the most
serious Effect takes precedence when evaluating risk potential. This
model accounts for Causes that have multiple Effects. Issuing
design and process changes can reduce Severity ratings.
Notes of interest:

The scales do not discriminate between failures that
results in catastrophic death, minor injury, or
government regulation violation.
A defect noticed by most customers is less than halfway
up the Severity scale.
"No effect" has a ranking of 1. There is no zero.
Note: These tables differ slightly from those published
by the AIAG. Specific references to motor vehicles have
been removed. The tables are similar to AIAG tables in
that they are suggested ranking systems. Because these
tables are suggested, the actual criteria used to prioritize
risk should be documented with the FMEA.
Criteria: Severity of Effect for
Effect
DFMEA
Hazardous –no Failure affects safe product operation or involves noncompliance with
warning government regulation without warning.
Hazardous – Failure affects safe product operation or involves noncompliance with

with warning government regulation with warning.
Very High Product is inoperable with loss of primary Function.
High Product is operable, but at reduced level of performance.
Moderate Product is operable, but comfort or convenience item(s) are inoperable.

Product is operable, but comfort or convenience item(s) operate at a reduced
Low
level of performance.
Fit & finish or squeak & rattle item does not conform. Most customers notice
Very Low
defect.
Fit & finish or squeak & rattle item does not conform. Average customers
Minor
notice defect.
Fit & finish or squeak & rattle item does not conform. Discriminating
Very Minor
customers notice defect.
None No effect
Table Suggested evaluation criteria and ranking system for the Severity of
1. Effects for a design FMEA

Criteria: Severity of Effect for R
Effect
PFMEA ank
May endanger machine operator or assembly operator. Failure affects
Hazardous –
safe product operation or noncompliance with government 10
no warning
regulation. Failure will occur without warning.
May endanger machine operator or assembly operator. Failure affects

Hazardous –
safe product operation or noncompliance with government 9
with warning
regulation. Failure will occur with warning.
Major disruption to production line. 100% of product may have to be

Very High 8
scrapped. The product is inoperable with loss of primary Function.
Minor disruption to production line. Product may have to be sorted

High and a portion scrapped. The product is operable, but at a reduced 7
level of performance.
Minor disruption to production line. A portion of the product may

Moderate have to be scrapped (no sorting). Product is operable, but some 6
comfort / convenience item(s) are inoperable

Minor disruption to production line. 100% of the product may have to
Low be reworked. Product is operable, but some comfort / convenience 5
items operate at a reduced level of performance.
Minor disruption to production line. Product may have to be sorted

Very Low and a portion reworked. Fit & finish or squeak & rattle item does not 4
conform. Most Customers notice the defect.

Minor have to be reworked on-line but out-of-station. Fit & finish or squeak 3
& rattle item does not conform. Average customers notice the defect.

have to be reworked on-line but in-station. Fit & finish or squeak &
Very Minor 2
rattle item does not conform. Discriminating customers notice the
defect.
None The Failure Mode has no Effect. 1
Table 2. Suggested evaluation criteria and ranking system for the Severity of Effects in
a process FMEA
After Effects and Severity have been addressed, the next step is to
identify Causes of Failure Modes. This is another team activity.
Identification should start with Failure Modes that have the most severe
Effects. In a design FMEA, design deficiencies that result in a Failure
Mode are Causes of failure. Design deficiencies that induce a
manufacturing or assembly error are also included in design FMEAs as
Causes. The design FMEA assumes that manufacturing and assembly
specifications are met, and only seeks to identify failures resulting from
product design.
In a process FMEA, Causes are specific errors described in terms of

something that can be corrected or controlled. The process FMEA
assumes that the product is adequately engineered, and will not fail
because of a design deficiency. This does not imply that all inputs to the
process meet engineering specifications. Variation in purchased parts
and material used in the process should be considered in the process
FMEA.
Causes are rated in terms of Occurrence. Occurrence is the likelihood that that a
particular Cause will occur and result in the Failure Mode during the intended life
and use of the product. This definition is distinctly different from the definition
published by the AIAG. In the AIAG FMEA model, Occurrence is simply the likelihood
that a Cause or mechanism of failure will occur. It is assumed that the failure itself
could occur, but not necessarily. Since Occurrence is defined only as the likelihood the
Cause will occur, there is no way of quantifying the likelihood that the Failure Mode
and subsequent Effects will result. The Occurrence definition preferred by The
Haviland Consulting Group, used in combination with the
Procedure for Potential Consequences, accounts for the fact that Causes do not always
lead to Failure Modes and subsequent Effects. When applicable, the Procedure for
Potential Consequences isolates severe Effects from the group by definition of a new
Failure Mode with special circumstances. The Causes of the new Failure Mode are
assigned Occurrence values. The new Occurrence values represent the remote
likelihood that the customer will experience the Effect. In the AIAG model, there is no
risk-prioritizing advantage to writing additional Failure Modes because Causes and
Failure Modes are not necessarily linked by Occurrence.

The Ford Motor Company has added a Cause-Failure Mode condition to the AIAG
model, stating that if the Cause occurs, the Failure Mode always results. This
condition effectively links Occurrence with Failure Modes, but Failure Mode-Effect
causality in the Ford model is not mentioned in their FMEA handbook. If the Ford
model assumes that Effects do not always occur when the Failure Mode occurs, then
Occurrence has no real bearing on whether the customer will experience the Effect. If
the Ford model assumes that Effects always occur when the Failure Mode occurs,
then the FMEA team is forced to assume that a Cause will automatically lead to every
possible Effect. This is generally untrue, leading to overestimated risk. In the FMEA
model presented in this thesis, the Procedure for Potential Consequences and a new
Occurrence definition are used to handle this Cause-Failure Mode-Effect causality
problem. The Ford and AIAG models do not include the Procedure for Potential
Consequences, or a similar solution.
Unlike Effects, Causes are not evaluated as a group when assessing risk. Separate
values are assigned to each Cause of the Failure Mode. Current Controls sometimes
prevent the Cause of failure, the Failure Mode itself, or its Effects. Such Controls,
designated Type (1), are most desirable and can reduce initial Occurrence ratings.

Table 3 and Table 4 are based on AIAG standards. Most
failure rates will fall between two numbers on the scale.
The standard practice is to round to the higher of the
two Occurrence values. For example, a failure that
occurs every 14,000 parts would be assigned an
Occurrence value of 4, even though 1/14000 is closer to
1
/15000 (Occurrence = 3) than it is to 1/2000 (Occurrence =
4). For cases where the failure rates are completely
unknown, assume that Occurrence = 10. Occurrence
ratings can be based information from similar products
and process when available.

Notes of Interest:
•The probabilities represent the likelihood that the Cause will
occur and result in the Failure Mode, not just the chances that it
will occur.
•The scales are not linear.
•An Occurrence of 10 does not discriminate between failures that
occur over half the time and failures that occur every time.
•An Occurrence of 1 does not discriminate between remote and
zero chance of failure.
Note: These tables differ slightly from those published by the

AIAG. Specific references to motor vehicles have been removed.
The tables are similar to AIAG tables in that they are suggested
ranking systems. Because these tables are suggested, the actual
criteria used to prioritize risk should be documented with the
FMEA.
R
Probability of Failure Failure Rates
ank
≥ 1 in 2 10
Very High: Failure is almost inevitable
1 in 3 9
1 in 8 8
High: Repeated failures
1 in 20 7
1 in 80 6
Moderate: Occasional failures 1 in 400 5
1 in 2000 4
1 in 15,000 3
Low: Relatively few failures
1 in 150,000 2
Remote: Failure is unlikely ≤ 1 in 1,500,000 1
Table Suggested evaluation criteria and ranking system for the Occurrence
3. of Failure in a design FMEA

Cpk R
Probability of Failure Failure Rates
ank
≥ 1 in 2 < 0.33 10
Very High: Failure is almost inevitable
1 in 3 ≥ 0.33 9
High: Generally associated with processes similar 1 in 8 ≥ 0.51 8

to previous processes that have often failed 1 in 20 ≥ 0.67 7
Moderate: Generally associated with processes 1 in 80 ≥ 0.83 6

similar to pervious processes which have
experienced occasional failures, but not in major 1 in 400 ≥ 1.00 5
proportions
1 in 2000 ≥ 1.17 4
Low: Isolated failures associated with similar
1 in 15,000 ≥ 1.33 3
processes
Very Low: Only isolated failures associated with
1 in 150,000 ≥ 1.50 2
almost identical processes
Remote: Failure is unlikely. No failures ever
≤ 1 in 1,500,000 ≥ 1.67 1
associated with almost identical processes
Table Suggested evaluation criteria and ranking system for the Occurrence of
4. Failure in a Process FMEA

Current Control
Design and Process controls are grouped according to their
purpose.
Type (1): These controls prevent the Cause or Failure Mode from occurring, or
reduce their rate of occurrence.
Type These controls detect the Cause of the Failure Mode and lead to
(2): corrective action.
These Controls detect the Failure Mode before the product reaches the
Type
customer. The customer could be the next operation, subsequent
(3):
operations, or the end user.
The distinction between controls that prevent failure (Type 1) and controls that detect
failure (Types 2 and 3) is important. Type 1 controls reduce the likelihood that a Cause or
Failure Mode will occur, and therefore affect Occurrence ratings. Type 2 and Type 3
Controls detect Causes and Failure Modes respectively, and therefore affect Detection
ratings.

Detection values are associated with Current Controls. Detection is a measurement of the
ability of Type (2) Controls to detect Causes or mechanisms of failure, or the ability of
Type (3) Controls to detect subsequent Failure Modes. One Detection value is assigned to
the system of Current Controls, which represents a collective ability to detect Causes or
Failure Modes. Controls can be grouped and treated as a system when they operate
independently, as each individual Control increases overall detection capabilities. The
design and process ranking systems presented in Table 5 and Table 6 are based on AIAG
standards.
Notes of Interest:
•High values indicate a lack of detection ability.
•The tables are not quantitative; relative terms are used.
•The adjectives used to describe the likelihood of Detection indicate a generally linear
relationship.
•A Detection value of 1 does not imply 100% detection.
Note: These tables differ slightly from those published by the AIAG. Specific references to
motor vehicles have been removed. The tables are similar to AIAG tables in that they are
Pakistan
suggested ranking systems. BecauseInstitute of Quality
these tables Control
are suggested, the actual criteria used to
R
Detection Criteria: Likelihood of Detection by Design Control
ank
Absolute
Design Control does not detect a potential Cause of failure or subsequent
Uncertaint 10
Failure Mode; or there is no Design Control
y
Very Very remote chance the Design Control will detect a potential Cause of
9
Remote failure or subsequent Failure Mode
Remote chance the Design Control will detect a potential Cause of failure
Remote 8
or subsequent Failure Mode
Very low chance the Design Control will detect a potential Cause of failure
Very Low 7
or subsequent Failure Mode
Low chance the Design Control will detect a potential Cause of failure or
Low 6
subsequent Failure Mode
Moderate chance the Design Control will detect a potential Cause of
Moderate 5
failure or subsequent Failure Mode
Moderatel Moderately high chance the Design Control will detect a potential Cause of
4
y High failure or subsequent Failure Mode
High chance the Design Control will detect a potential Cause of failure or
High 3
subsequent Failure Mode
Very high chance the Design Control will detect a potential Cause of
Very High 2
failure or subsequent Failure Mode
Almost Design Control will almost certainly detect a potential Cause of failure or
1
Certain subsequent Failure Mode
Table 5. Suggested evaluation criteria and ranking system for the Detection of a Cause of failure or
Failure Mode in a design FMEA.
R
Detection Criteria: Likelihood of Detection by Process Control
ank
Almost
No known Controls available to detect Failure Mode or Cause 10
Impossible
Very remote likelihood current Controls with detect Failure Mode or
Very Remote 9
Cause
Remote Remote likelihood current Controls with detect Failure Mode or Cause 8
Very Low Very low likelihood current Controls with detect Failure Mode or Cause 7
Low Low likelihood current Controls with detect Failure Mode or Cause 6
Moderate Moderate likelihood current Controls with detect Failure Mode or Cause 5
Moderately Moderately high likelihood current Controls with detect Failure Mode or
4
High Cause
High High likelihood current Controls with detect Failure Mode or Cause 3
Very High Very high likelihood current Controls with detect Failure Mode or Cause 2
Almost Current Controls almost certain to Failure Mode or Cause. Reliable
1
Certain detection controls are known with similar processes.
Table 6. Suggested evaluation criteria and ranking system for the Detection of a
Cause of failure or Failure Mode in a process FMEA
A tabular FMEA documentation form has been
standardized by the AIAG. All input data must be
organized on the output form in the spaces and columns
provided. Some companies compile FMEA data on
worksheets, and then transfer the information to the form.
Other companies with electronic versions of the form can
fill in the table as FMEA elements are identified. FMEA
Facilitator collects the input data through an organized
and intuitive interface and places it on the form
automatically.

The fundamental purpose of the FMEA is to
recommend and take actions that reduce risk.
Actions taken often result in a lower Severity, Occurrence,
or Detection rating. Adding validation or verification
controls can reduce Detection. Design or process revision
may result in lower Severity and Occurrence ratings. The
revised ratings are documented with the originals on the
tabular FMEA form. If no action is recommended, the
decision not to act should also be noted. Effective follow-up
programs are also necessary, as the purpose of the FMEA is
defeated if any recommended actions are left undressed.

The Risk Priority Number (RPN) is a mathematical product of the
seriousness of a group of Effects (Severity), the likelihood that a Cause
will create the failure associated with those Effects (Occurrence), and an
ability to detect the failure before it gets to the customer (Detection). In
equation form, RPN = S • O • D. This number is used to help identify the
most serious risks, leading to corrective action. Inspection of the
equation reveals that the RPN method for assessing risk is an
oversimplification. Severity, Occurrence, and Detection are not equally
weighted with respect to one another in terms of risk. The distortion is
compounded by the non-linear nature of the individual ranking scales.
As a result, some S-O-D scenarios produce RPNs that are lower than
other combinations, but more risky.
Furthermore, the RPN scale itself has some non-intuitive statistical
properties. The initial and correct observation that the scale starts at 1
and ends at 1000 often leads to incorrect assumptions about the middle
of the scale. Table Pakistan
7 contains some common
Institute of Qualityfaulty assumptions.
Control
Incorrect Assumption Actual Statistical Data
The average of all RPN

The Average RPN value is 166.
values is roughly 500.
Roughly 50% of RPN values
6% of all RPN values are above
are above 500. (The
500. (The median is 105.)
median is near 500.)
There are 1000 possible
There are 120 unique RPN values.
RPN values.
Table 7. RPN Scale Statistical Data

The 1000 RPN numbers generated from all possible combinations of
Severity, Occurrence, and Detection are plotted on this histogram.
High Severity values merit special attention, particularly when coupled
with high Occurrence values. The term Criticality was developed to call
attention to these combinations. Criticality is defined as the mathematical
product of Severity and Occurrence. This definition does not fully correct
the problem. Severity and Occurrence are still unequal in terms of risk,
and their ranking scales are still non-linear. The contour plot of Figure 4
compares Criticality with an expert risk assessment of the actual S-O
combination, with 5 chosen as an arbitrary Detection value. Deep blue
signifies a strong correlation between Criticality and risk, while red
indicates a large discrepancy.
The discrepancy between RPN and expert risk assessment of the 1000 S-
O-D combinations is even more prominent. Despite the shortcomings of
RPN and Criticality, they are used and misused regularly for risk
assessment.

Figure 4. Criticality and Risk Discrepancy Contour
Plot
This contour plot represents the estimated discrepancy
between Criticality and actual risk for a system with average
failure detecting controls (Detection = 5). Notice the
dramatic discrepancy at [Severity = 10, Occurrence = 2]. In
this situation, a failure with potentially catastrophic
consequences is expected to occur (eventually), and can
therefore also pose great risk. Based on the Criticality scale,
this situation is assigned a value of 20 (out of a possible
maximum of 100), and may consequently be overlooked.

The AIAG defines a Special Product Characteristic as a product characteristic for which reasonably anticipated
variation could significantly affect a product’s safety or compliance with governmental standards or regulations,
or is likely to significantly affect customer satisfaction with a product. Ford Motor Company divides Special
Characteristics into two categories: Critical Characteristics and Significant Characteristics
Critical Characteristics are defined by Ford as product or process requirements that affect compliance with
government regulation or safe product function, and which require special actions or controls. In a design
FMEA, they are considered Potential Critical Characteristics. A Potential Critical Characteristic exists for any
Severity rating greater than or equal to 9. In the process FMEA, they are referred to as Actual Critical
Characteristics. Any characteristic with a Severity of 9 or 10 which requires a special control to ensure
detection is a Critical Characteristic. Examples of product or process requirements that could be Critical
Characteristics include dimensions, specifications, tests, assembly sequences, tooling, joints, torques, welds,
attachments, and component usages. Special actions or controls necessary to meet these requirements may
involve manufacturing, assembly, a supplier, shipping, monitoring, or inspection.
Significant Characteristics require special controls because they are important to customer satisfaction. Severity
ratings between 5 and 8 coupled with an Occurrence rating greater than 3 indicate Significant Characteristics. In
a design FMEA, they are Potential Significant Characteristics. In the process FMEA, if a special control is
required to ensure detection then an Actual Significant Characteristic exists.
Companies have not standardized a method for grouping and denoting Special Product Characteristics.
Nomenclature and notation will vary.

Contents
 What is Control Plan?
 Why Control Plan?
 Process without Control plan…. example
 Linkage between flow charts, process FMEA,
control plans, Proc. Doc. and other documents
 Description and usage of Columns of Control
Plan
 Changing Control Plan
 Expectations
 Practice session

What is Control Plan ?
APQP Manual definition…
 The Control Plan describes the actions that are

required at each phase of the process to ensure that
all process outputs will be in state of control
 Control plan is a living document, reflecting the
current methods of control, and measurement
systems used
 Accessible at work station

Why Control Plan ?
Why do we need Control Plan?
 Communicates what do we have to check and control
throughout the process
 Helps new people to understand the process and its
control steps
 Control plan is needed to document and communicate the
process & Product parameters, process controls, Check
methods & Reaction plans.
 It standardize the manufacturing process.
 Helps to produce consistent and predictable Quality.
 Enhance the Customer confidence.
 It is a requirement of the TS 16949 standard
Without Control Plan ?
What will happen………
Don’t know what to check, how to check and when to

check to control process
Product quality depends on individual’s discretion
Don’t know what to do when some thing goes wrong.
Result in inconsistent and unpredictable product quality.
Low confidence level of customer.

Control Plan - Example
Example : Polish Crankshaft
Product /
Process / Process / Special Process
Operation operation Characteristic characteristic specification /
number description Product Process class tolerance
Surface Proc. Doc.

090- Polish journals finish 3800 -090
How important it is …?
What to check ?
Control Plan - Example
Example : Polish Crankshaft
Evaluation /
measurement Sample
technique Size Freq. Control Method Reaction Plan
100 % inspection of
SPC (X bar-R
every previous 5
chart), operator
Surf tester 5 5th crankshaft,replace
verification of
(Tylor hobson) journals cranks belts/readjust
belt and
haft machine, notify line
machine setup
leader
How many and when to check ?

How to check ? What to do when some thing is wrong ?
Linkage with Key Docs.
• Graphic description of
Linkage FLOW CHART the process flow
• Each operation listed
• Describes what can go

PFMEA wrong at each operation
• Pro-active tool
• How to control each

CONTROL PLAN factor affecting quality
• What to do if something
is wrong
• Detailed process steps

PROC DOC • Gauges, tools, methods
• Specifications, limits,
acceptance criteria
Other Docs. Or Activities
Gauging Mistake proofing
Training SPC Control chart
CONTROL PLAN
Proc. docs.
Non conformance reports

Control Plan - Columns
Description
Control Plan Columns’ description and usage
1. Category : Prototype,Pre launch or production
2. Control Plan number : Control plan number should be linked
with Flow chart and Process documentation for each station /
operation
3. Part name / latest change level : verify the part name, latest change
level indicates the number of times document is changed
4. Operation description : Indicates the name of particular operation.
5. Supplier Plant : Name of the plant preparing and using control Plan.
6. Key contact : Person responsible for control plan
7. Core team : indicates the name of individuals of cross functional team
responsible for latest revision.
8. Supplier approval: Check for the sign and date of approving authority.
9. Date (Orig.) : is the date of compilation of original control Plan
10. Date (Rev) : is the latest revision date
11. Customer / other approvals : approvals from customers
12. Process / operation number : this item number is referenced from the
Process Flow chart
Pakistan and Process
Institute FMEA. Control
of Quality
Control Plan - Columns
Description
Control Plan Columns’ description and usage
13. Process name/ operation description : this column indicates all
important operational steps
14. Machine, device,Jig,Tools : For each operation the processing
equipment e.g. machine, jig or other tools are identified
15. Product characteristics : are the features or the properties of a part that
are described on drawing or engineering specifications e.g. journal
diameter, deck height, surface finish e.t.c.
16. Process characteristics : are the process variables that have a cause and
effect relation with identified product characteristic e.g. concentration
of chemical, washer temperature and cycle time are process
characteristics in washing operation and they have cause and effect
relation with cleanliness (product characteristic).
17. Special characteristic class : referenced from customer drawings,
specifications, non conformance and warranty data, and FMEA.
COER uses “Critical/safety” and “major” class

Control Plan –
Columns Description
Control Plan columns’ description and usage
18. Specification / tolerances :Product and process characteristics are required
to be controlled, check the specifications of these characteristics in Spec./
tolerance column. If specs. are referred to Proc doc.,check the related proc.
doc.
19. Evaluation/ measurement technique :Identifies the measurement system
e.g. gages, fixtures or test equipment. Make sure that the indicated gage is
available at your station, also check for valid calibration
20. Sample size / frequency :Follow the sample size and frequency indicated in
the control plan for inspection.
21. Control method column gives the brief description of how the operation
will be controlled. For example : Operations may be controlled by SPC-
control charts, 100% inspection, sampling inspections or mistake proofing
in tooling etc. Use the mentioned control.
22. Reaction plan specifies the corrective actions/ Steps to be initiated when
nonconformance is observed. Reaction may be Scrap, Hold, Rework,
Notify supervisor, reset machine e.t.c.

Updating Control Plan
Changing Control Plan :
 Control Plan is a living document and should be updated

to reflect the changes in product / process characteristics,
control methods and characteristic measurements
 If something is wrong in your Control Plan, it MUST be
changed
 Take a copy of the Control Plan and note the changes
 Give the copy with changes to your Team Leader,
Supervisor or Quality Assurance
 Changes will be reviewed and incorporated .New
document will be issued in 1 or 2 weeks.

Control Plan -
Expectations
Expectations
 We need to review existing control plans and create

new Control Plan where ever necessary by the end of
July’2003
 1 or 2 volunteers are required per team to help
 Team volunteers will have to help Quality Engineer to
review measurement techniques, gauges, frequency of
checking, control methods and reaction plans.
 Team volunteers will work in Cross functional team to
formalize the Control Plan

Control Plan
?
Control Plan –
Practice Session
Practice Session :
Make groups and create control plan for any

process or operation.
Must indicate the Process/ operation name, product /
process characteristic, Evaluation/ measurement
techniques, frequency of checking, control method and
reaction plan.

FMEA &amp; Control Plan

Enviado por

Dados do documento

Descrição original:

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

FMEA &amp; Control Plan

Enviado por

Direitos autorais:

Formatos disponíveis

FMEA is an integral part of any QS 9000 compliant quality system.

Figure 1. The role of FMEA in a quality system.

A Cause is the means by which a

Pakistan Institute of Quality Control

Critical Characteristics are Special

Pakistan Institute of Quality Control

The Criticality rating is the mathematical

Pakistan Institute of Quality Control

Current Controls (design and process) are

Pakistan Institute of Quality Control

Customers are internal and external

Pakistan Institute of Quality Control

Detection is an assessment of the

Pakistan Institute of Quality Control

An Effect is an adverse consequence that

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

8-D Eight Disciplines of Problem Solving ISO International Organization for

APQP Advanced Product Quality Planning QFD Quality Function

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

This site is dedicated to overcoming some deficiencies of the

In the analysis of the penlight bulb, a different Function and Failure

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Hazardous – Failure affects safe product operation or involves noncompliance with

Very High Product is inoperable with loss of primary Function.

High Product is operable, but at reduced level of performance.

Moderate Product is operable, but comfort or convenience item(s) are inoperable.

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

May endanger machine operator or assembly operator. Failure affects

Major disruption to production line. 100% of product may have to be

Minor disruption to production line. Product may have to be sorted

Minor disruption to production line. A portion of the product may

Pakistan Institute of Quality Control

Minor disruption to production line. Product may have to be sorted

Minor disruption to production line. A portion of the product may

Minor disruption to production line. A portion of the product may

None The Failure Mode has no Effect. 1

In a process FMEA, Causes are specific errors described in terms of

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Pakistan Institute of Quality Control

Note: These tables differ slightly from those published by the

Pakistan Institute of Quality Control

High: Generally associated with processes similar 1 in 8 ≥ 0.51 8

Moderate: Generally associated with processes 1 in 80 ≥ 0.83 6

FMEA & Control Plan

FMEA & Control Plan