FMEA — failure mode, effect, severity, detection, RPN: Visual walkthrough

We are going to answer one question: given a component that might break, how do we turn our worry about it into a single measurable size we can rank against every other worry?

Step 1 — A failure is an event, and events have three independent handles

WHAT. Before any numbers, picture a single component — say one battery cell. It sits there doing its job. Then, at some moment, it fails. That failure is an event: a thing that either happens or doesn't.

WHY. We cannot rank "worry" directly — worry is a feeling. To rank, we need a size. So we must first ask: what makes one failure scarier than another? Not one thing. Three separate things, and they are genuinely independent — knowing one tells you nothing about the others:

How bad is it if it happens? (this is Severity, written $S$ )
How often will it happen? (this is Occurrence, written $O$ )
How blind are we to it happening? (this is Detection, written $D$ )

PICTURE. Look at the figure: one failure event in the centre, three arrows pulling on it in three completely different directions. A battery cell short is severe (arrow up is long), rare (arrow right is short), and visible (arrow down is short). These three are like the length, width, and height of a box — you cannot get one from the others.

Figure — FMEA — failure mode, effect, severity, detection, RPN

Step 2 — Turn each handle into a number on a 1-to-10 ruler

WHAT. Each handle is a feeling ("pretty bad", "fairly rare"). We stamp a number from $1$ to $10$ onto it using a fixed, agreed-upon ruler. Not a random guess — a table everyone on the team reads the same way.

WHY 1 to 10, and why not a probability? A raw probability like $0.0003$ is unreadable and does not mix with "severity" (which is not a probability at all — you can't put a probability on "loss of crew"). So we map everything onto the same $1$ – $10$ ruler. Now three unlike things speak one language and can be combined. The scale is deliberately coarse — a human can honestly tell a $7$ from a $9$ , but not a $71$ from a $73$ .

PICTURE. Three vertical rulers side by side, each marked $1$ at the bottom and $10$ at the top. On each, a red dot marks the battery-cell short: $S = 9$ high up (near-catastrophe), $O = 4$ low-ish (documented but rare), $D = 3$ low (sensors catch it fast). Read the dots — that is the failure, now in numbers.

Step 3 — Why we multiply (and never add)

WHAT. We now combine $S$ , $O$ , $D$ into one number. The parent said "multiply". Here is the reason, drawn.

WHY not add? Suppose we added: $S + O + D$ . Then a failure with $S = 10, O = 1, D = 1$ (catastrophic but essentially impossible and instantly caught) scores $12$ . A failure with $S = 4, O = 4, D = 4$ (moderate, common, half-visible) also scores $12$ . Adding says they are equally worrying — but they are not. The catastrophic one is defused by being rare and visible. Addition lets one big term hide the others.

Multiplication does the opposite: it makes each factor a gate. If any factor is near $1$ , it shrinks the whole product. A failure is only truly dangerous when it is bad and likely and blind — all three at once. That "all three at once" is exactly what multiplication encodes.

PICTURE. Think of a rectangle: width $S$ , height $O$ . Its area is $S \times O$ . Now push that rectangle into the page by depth $D$ — you get a box, and its volume is $S \times O \times D$ . The whole worry is the volume of that box. Look at the figure: shrink any one edge toward $1$ and the box collapses to a sliver — small volume, small worry. That is the multiplication doing its job.

Step 4 — Why Detection is scored backwards

WHAT. $D = 1$ means we detect the failure almost perfectly; $D = 10$ means it is invisible until disaster. This feels upside-down. Let's earn it.

WHY. The RPN is meant to measure danger, and danger grows with every factor. Severity grows danger (obvious). Occurrence grows danger (obvious). What grows danger for detection? Not good detection — bad detection. A failure you can't see coming is the scary one. So the " $D$ " ruler must measure blindness, not sight, so that large $D$ pushes the volume up, in the same direction as large $S$ and large $O$ .

PICTURE. Two identical battery failures side by side. Left: sensors watching (good detection) — we relabel that as small $D = 2$ , and the risk box is short in depth. Right: no sensor, silent leak — large $D = 9$ , and the same failure now has a deep, large-volume box. Same $S$ , same $O$ , but the blind one is objectively more dangerous, and only " $D$ = blindness" makes the volume reflect that.

Step 5 — Reading the volume: thresholds and the danger ceiling

WHAT. One number came out. Now we sort it into action bands. The box's volume ranges from the smallest possible to the largest possible.

WHY have bands? A raw volume like $108$ means nothing alone. We need "how big is too big?" The team fixes cut-lines from mission history: below $\sim 50$ just watch it; up to $\sim 150$ review and test; up to $\sim 500$ redesign or add a backup; above $500$ you are not allowed to fly.

PICTURE. A single number line from $1$ to $1000$ , split into coloured bands, with the battery-short RPN of $108$ marked as a red tick sitting in the "test-then-decide" band. You can literally see how far it is from the danger ceiling.

Step 6 — The corners: the smallest and largest possible boxes

WHAT. Every ruler runs $1$ to $10$ , so the box can never be smaller than $1 \times 1 \times 1$ nor bigger than $10 \times 10 \times 10$ . These are the two extreme corners of the whole space.

WHY show the edges? So you never meet a number you can't place. The degenerate best case: a harmless, impossible, obvious failure → $1 \times 1 \times 1 = 1$ . The degenerate worst case: a catastrophic, near-certain, invisible failure → $10 \times 10 \times 10 = 1000$ . Every real failure lives inside this box-of-boxes.

PICTURE. The full cube from the tiny corner $(1, 1, 1)$ to the far corner $(10, 10, 10)$ , with the battery short plotted as a red dot floating inside — closer to the safe corner than the deadly one.

Step 7 — Shrinking the box: what mitigation does geometrically

WHAT. Fixing a failure means shrinking one or more edges of its box, lowering the volume until it drops below a threshold.

WHY. You rarely can't change $O$ (physics is physics — the cell can still short). But you can add a fuse to cut the damage (shrink $S$ ), and add a redundant monitor to catch it sooner (shrink $D$ ). Each design change pulls an edge inward and the volume falls.

PICTURE. The tall battery box on the left ( $9 \times 4 \times 3 = 108$ ) with two red arrows squeezing the $S$ edge from $9 \to 6$ and the $D$ edge from $3 \to 2$ , producing the smaller box on the right ( $6 \times 3 \times 2 = 36$ ). Same failure — a much smaller box.

The one-picture summary

Everything above, compressed: a failure event → three independent rulers → one risk box whose volume is the RPN → sorted against a danger ceiling → shrunk by mitigation.

Recall Feynman retelling — say it back in plain words

Imagine a part that might break. Three totally separate questions decide how much I should lose sleep over it: how bad is the mess if it breaks, how likely is it to break, and how blind am I to it breaking. I score each one from one to ten on a fixed ruler everybody agrees on — and I score "blindness" not "sight", so that being unable to see it makes the number bigger, because that is genuinely more dangerous. Then I don't add the three numbers, because adding would let one huge number hide two tiny ones and pretend everything's fine. Instead I multiply them, like multiplying width, height, and depth to get the volume of a box. A failure is only truly scary when the box is big in all three directions at once — and multiplication guarantees that if any single direction is small, the whole box is small. The box's volume is the Risk Priority Number, always between one and a thousand. I line all my failures' boxes up, fix the biggest ones first by squeezing their edges down with fuses, backups, and better sensors, and re-measure. That's FMEA.

Recall Quick checks

Why multiply instead of add? ::: Multiplication makes each factor a gate — any factor near 1 shrinks the whole product, so a failure is only "big" if it is bad AND likely AND blind. Adding lets one big term mask small ones. Why is $D = 10$ worse than $D = 1$ ? ::: $D$ measures blindness, not detection quality. High $D$ = we never see it coming = more dangerous, so it must push the RPN up alongside $S$ and $O$ . What is the geometric meaning of RPN? ::: The volume of a box with edges $S$ , $O$ , $D$ . What are the smallest and largest possible RPN? ::: $1$ ( $1 \times 1 \times 1$ ) and $1000$ ( $10 \times 10 \times 10$ ). Battery short before/after mitigation? ::: $9 \times 4 \times 3 = 108$ before; $6 \times 3 \times 2 = 36$ after.

See also: parent topic · Reliability Engineering · Risk Management in Spacecraft Design · Systems Engineering V-Model · Quality Assurance and Testing · Mission Assurance · Mars Climate Orbiter