Q 306. In FMEA, organizations usually set an RPN threshold, so that they can focus on failure modes that have a relatively higher risk. However, this practice is counter-productive sometimes. 
Why is this approach counter-productive and what is now considered as a better approach for Risk mitigation?

 

Note for website visitors - Two questions are asked every week on this platform. One on Tuesday and the other on Friday.

• All questions so far can be seen here - https://www.benchmarksixsigma.com/forum/lean-six-sigma-business-excellence-questions/
• Please visit the forum home page at https://www.benchmarksixsigma.com/forum/ to respond to the latest question open till the next Tuesday/ Friday evening 5 PM as per Indian Standard Time. Questions launched on Tuesdays are open till Friday and questions launched on Friday are open till Tuesday. 
• The best answer is always shown at the top among responses and the author finds honorable mention in our Business Excellence dictionary at https://www.benchmarksixsigma.com/forum/business-excellence-dictionary-glossary/ along with the related term

FMEA (Risk priority Number)

RPN number is a numerical assessment to evaluate the risk priority level in FMEA analysis. RPN number to help in the prioritize the risk and make a corrective action to mitigation the same.

How to calculate the RPN?

RPN is calculated by multiplying Severity (S), Occurrence (O) and Detection (D). Score of Severity, Occurrence & Detection is given as per FMEA Index.

1. Severity: - The severity of the failure mode is scored on a scale from 1 to 10 based on   risk severity.

2. Occurrence: -The potential of failure occurrence is scored on a scale from 1 to10. High occurrence reflects high failure occurrence potential.

3. Detection: - The capability of failure detection is ranked on a scale from 1 to10. High detection score reflects low detection capability.

How to evaluate RPN?

RPN is used to prioritize high risk issues and determine the requirement of corrective action. Most of company prioritize risk from highest to the lowest RPN.

Team is used RPN to reduce the key risk in two following method.

FMEA RPN Threshold  

Many companies use an RPN limit to determine which failure mode required corrective action and which risks are acceptable. The RPN threshold is easy to use.

However, using RPN threshold method may cause a team member to spend excessive time trying to reduce the Detection severity & occurrence for getting the low RPN no. This situation some time put the organization in danger.

TOP RPN No.

Some organizations work on top RPN risk and try to mitigate them with corrective actions. After team reset the FMEA and get other high RPN risk, It promotes the continual improvement culture.

RPN disadvantage

Failure Mode	Severity	Occurrence	Detection	RPN
Failure Mode -1	7	4	4	112
Failure Mode -2	4	4	7	112

In above example of failure mode -1 should be provided a higher priority than failure mode-2 although they have same RPN value because of high severity

Because they have same RPN value, an inappropriate action plan for critical failure may be selected for this reason RPN should not be only index used to evaluate the risk of each failure .it is big disadvantage of RPN no.

 How to evaluate the RPN Number effectively

 Along with the RPN number team should be consider the S, O & R ranking for prioritizing the risk during the team discussion.

Team may combine the criteria for the RPN, Severity, Occurrence & detection ranking by using the a matrix as per below example of risk matrix a combination of severity and occurrence   

One of the great news of the newest version of the FMEA is the replacement of the R.P.N. by the PA. The R.P.N. has already been contested by the identification of several limitations in its application. Here are  four of these limitations and we would like to know which one would be the most significant, they are:

1. Severity with the same weight: High Severity is already of high risk, regardless of the R.P.N. value, however in the calculation of the R.P.N. Severity has the same representation of Occurrence and Detection.

 

2. Subjectivity of the R.P.N.: Since the components of the R.P.N. (Severity, Occurrence and Detection) are each formed by subjective classifications, however well elaborated the reference tables are, the value of the R.P.N. will always be subjective in nature.

 

3. Duplicate R.P.N. numbers: All possible multiplication of FMEA rankings of S, O and D include many duplicate numbers. For example, an S = 1, O = 8 and D = 8 have the same R.P.N. value as an S = 8, O = 4 and D = 2.

 

4. R.P.N. limits: It is attractive for management to use limits for R.P.N. values and require a defined action if the R.P.N. value exceeds the given limit, which is also known as a cut-off note. Generally, this is not the right approach, as FMEA easily becomes a numbers game.

FMEA (Failure mode effect analysis) is a mechanism to identify step by step all possible failure modes present in a process/design/service/software so on.

 

On the basis of three components “Severity, Occurrence and Detection” RPN (Risk Priority Number) is calculated which is product of S*O*D. Higher the RPN high is the risk involved in the step (general perception). Basis on this, there is concept of threshold RPN used by many organization.

 

Some of the common way of identification of threshold RPN:

 

Normally S,O and D are graded on a 10 scale metrics (where 1 is lowest and 10 is highest). So RPN can vary between 1 to 1000. Most common way of determining threshold RPN is:

1)     Top 20% of the RPNs

2)     Any RPN which is greater than a certain score, So on

 

At time due to the concept of threshold RPN could be counterproductive.

Eg:

Process Step	Severity Score	Occurrence Score	Detection Score	RPN
Step 1	6	4	4	96
Step 2	4	8	4	128
Step 3	2	8	6	96

 

 If we consider RPN of the process steps it seems that Step 2 has higher risk and step 1 and 3 are at same risk levels, and process will put efforts in creating Mitigation and control plans for step 2 first.

 

This is an example of disadvantages of using “threshold RPN”. But if we review closely we will find that step 1 carries highest “Severity” and miss in step 1 might leads to greater loss to organization in comparison to step 2 &3. So step 1 should proceed over step 2 &3 irrespective of lower RPN

 

Risk Mitigation approach other than FMEA

 

FMEA is currently not a part of ISO 14971:2019 (ISO standard for medical devices).

 

As at time its confusing whether PFMEA/DFMEA/SFMEA is required or how each of them is integrated. Secondly, for a process there might not be only failure mode responsible for risk, (could be others especially in Medical devices)

 

One of the better Risk Mitigation method suggested by ISO 14971 is “Risk Management System”, which is a six steps process.

• It starts with “Establishing of Risk Framework” (risk management process, RACI, creating a live document)
• 2^nd step is Risk Assessment (focusing on Risk identification, analysis and evaluation- these risks could be from  Business/Customer/Market so on)
• 3^rd step is creating Risk Control document (highlighting the control measures)
• 4^th is Risk Acceptance (there are always residual risk which the process accepts despite control plans in place, which is not a requirement in FMEA)
• 5^th is Control Plan Review (the entire process is not reviewed always rather the control plans created are reviewed periodically)
• Final 6^th step is Production Information (any misses, finding of any audits are the feeds for the risk management process)

There is an element of ambiguity when we say "RPN threshold". Because there is not any specific value and it varies industry to industry. For example, process risk in a disposable cup manufacturing company will never be same as in the parachute manufacturing company. In general practice RPN threshold value of 100 or 150 or some other value is used in organizations. And here comes the first likelihood of this practice being counter productive if organizations choose inappropriate RPN threshold. This leads to non addressing of significant risks or addressing of non significant risks.

 

Secondly, setting an RPN threshold completely restricts addressing of identified risks, For example, if RPN threshold is 100, organisation will take action against risks having RPN value of 100 or above but what about risk of RPN value 96? Since the threshold is set, this risk will not be addressed. But to note that risk having RPN 96 may be as significant as those having 100 or above.

 

Thirdly, having a set threshold may lead to biased approach and there are chances of manipulation during calculating RPN value in order to keep it below the RPN threshold and to escape action plans.

 

To address above mentioned issues associated with RPN threshold, now 80:20 principle aka Pareto principle is considered as a better approach for Risk mitigation.

Pareto principle states that for many outcomes roughly 80% of the consequences come from 20% of the causes.

 

In this approach instead of setting RPN threshold, RPN values are sorted in descending order prioritizing risks where actions needs to be taken. Now, Action should be taken first against RPNs contributing upto 80%(In descending order) of the RPN summation. For example,Sort RPNs 100, 98, 125, 150, 50, 75 to 150,125, 100, 98, 75, 50. Calculate RPN summation and cumulative percentage of RPNs. take action on 80% of cumulative % of RPN first. Allot new RPN value after action plan. 

In a process of continual improvement, where ever necessary, this process can be repeated for further Risk mitigation. 

In this way, all those significant risks can be addressed which might get missed in RPN threshold approach and also it eliminates chances of manipulation and biasness. 

 

 

 

Benchmark Six Sigma Expert View by Venugopal R

Let me start with a quick brush up of RPN as used in regular FMEA exercise. RPN stands for ‘Risk Priority Number’, which is obtained as the product of the ratings for Severity, Occurrence and Detectability

 

RPN = S x O x D, where S, O and D are the rating for Severity, Occurrence and Detection, as obtained in a FMEA exercise.

 

The ratings for these parameters are to be assigned by a cross functional team, using the rating guidelines. The RPN so calculated is based on the team’s decision for assigning the rating.

 

Despite using the rating guidelines, there is bound to have  subjectivity in deciding the ratings. Once the RPN values are worked out, they are sorted in descending order. A threshold RPN value is decided and actions are identified for all the failures whose RPNs are above the threshold value. This has been a method used to prioritize the actions. While this method is useful for a broad level of prioritization, it would not be advisable to act strictly based on this prioritization, due to the following reasons:

 

1. RPN values carry certain amount of subjectivity based on the team’s ratings for S, O and D. Hence if the exercise is carried out by another team, even with comparable competency, we are likely to get different RPNs.

 

2. There could be instances where the Severity rating could be very high, but we may get a relatively lower RPN due to low occurrence and effective detection systems, i.e. low values for O and D. We may not want to leave out such cases from being explored for improving the product design to lower the severity.

 

3. Due to above reasons, case by case decisions may have to be taken on prioritizing actions, although an elaborate exercise had been conducted by a team. This could be demoralizing for the teams and could erode the faith in FMEA exercise.

 

4. If you look at all the possibilities that an RPN number can assume, it is not any number between 1 and 1000. The possibilities reduce to only 120 options. (For example, there could be 3 situations with RPN = 360; they can be

    i)  S=8, O=5, D=9

    ii)  S=10, O=6, D=6

   iii) S=5 O=9, D=5

We end up getting the same RPN for all the above cases, indicating same priority, which would not be right.

 

To over come the above issues, one of the recommendations is to NOT to perform the FMEA horizontally. i.e. for a failure mode, do not keep moving on the row from left to right starting with Failure Mode, Failure Effect, Severity, Cause, Occurrence, Detection and RPN.

 

Instead of doing so, identify all failure modes by moving vertically on the FMEA chart and assign the severity for each failure mode.

 

Where we get high values for severity, prioritize and identify actions, without considering the Occurrence and Detection ratings. Subsequently the exercise can be completed for each failure mode to obtain the final RPN. This way, we are taking up the severity ratings in an unbiased manner and not just going about based on RPN alone.

 

The alignment of FMEA manuals by AIAG and VDA has addressed certain differences in the two approaches. The highlights of this alignment are a 7 step process and replacement of RPN with AP (Action Priority). The AP is not exactly a risk priority, but a priority for action denoted as High, Medium or Low. The level of AP is not based on the product of the S, O and D ratings, but will be dependent on combinations of the levels of S ,O and D. An extract from the Action Priority table is shown below.

 

  

The AIAG VDA continues to have the same categories, Severity, Occurrence and Detection, with ratings ranging from 1 to 10. However instead of multiplying them to obtain RPN, the AP is determined using a table that lists roughly 30 different combinations S, O and D ranges.

 

Each of the 30 S, O, D combinations are assigned H (High), M (Medium) or L (Low) priority for Action.

• For Priority “High”, action to improve prevention and / or detection controls (or justify why existing controls are adequate) MUST be taken
• For Priority “Medium”, action to improve prevention and / or detection controls (or justify why existing controls are adequate) SHOULD be taken
• For Priority “Low”, action to improve prevention and / or detection controls COULD be taken

FMEA RPN (Risk Priority Number) is the product of Severity, Occurrence and Detection that is used to assess the risk priority level of a failure mode in an FMEA analysis.

Severity Rating defines the seriousness of the effect where a numerical rating of the impact on a customers are provided by the FMEA Team(Cross Functional Team)- here, when multiple effects exist for a given failure mode, enter the worst case severity on the worksheet to calculate risk. (Sample scaling: Rated on a scale of 1-10, where 1 = not severe, 10= very severe)

Occurrence Rating defines an estimated number of frequencies or cumulative number of failures based on the experience that generally occurs in a process for a given cause.(Sample scaling: Rated on a scale of 1-10, where 1 = not likely, 10= very likely)

Detection Rating defines the effectiveness of the controls to prevent or detect the cause or failure mode before the failure reaches the customer.(Sample scaling: Rated on a scale of 1-10, where 1 = likely to detect/prevent, 10= not likely at all to detect/prevent)

 

Common way of using RPN: RPN is evaluated in the form of Pareto analysis, where it suggests when to take an action based on 80//20 rule. In most cases RPN Threshold is used to determine which failure mode requires corrective action and which risks are acceptable. Where as in some cases, in order to promote continuous improvement culture the team may address the corrective action for the top RPNs. After that, the team reset and find another top RPNs for the next improvement process

However, using only the RPN to determine the failure mode that requires corrective action can lead to severe quality problems in an organization. Also some companies face challenges to determine the detection rankings. Therefore, they do not use detection (D) in their calculation of the RPN to avoid arguments regarding the detection ranking.

 

Recommendation : In order to avoid such limitations of the RPN, the team should evaluate risk with a combination of indices, such as Severity, Occurrence, and Detection (Three Path Model)

Path 1 : Any failure mode that has an effect resulting in a severity 9 or 10 would have top priority. Severity is given the most weightage when assessing risk.

 Example

Failure Mode        Severity     Occurrence   Detection     RPN

Failure Mode 1          10                    2                            2              40

Failure Mode 2          3               10                       2            60

Hence Failure Mode 1 is an area of concern as the Severity is high though RPN is lower compared to Failure mode 2

 

Path 2 : Change the team/structure, look at the causes and the prevention methods and assign an occurrence number.

Example

Failure Mode        Severity     Occurrence   Detection     RPN

Failure Mode 1            3                    10                         2               60

Failure Mode 2           2                  5                    10           100

Hence Failure Mode 1 is an area of concern as the Occurrence is high though RPN is lower compared to Failure mode 2

 

Path 3 :  The combination of Severity and Occurrence should be considered as the same represents criticality.

(Severity X Occurrence = Criticality Number)

 

Example

Failure Mode        Severity     Occurrence   Detection    Criticality Number

Failure Mode 1          6                    5                   5                       30

Failure Mode 2         5                         7                       6                           35

Hence Failure Mode 2 is highly critical as the criticality number is high

 

 

 

 

Dimas has provided the best answer to this question by highlighting the limitations of RPN and by also suggesting the approach of Action Priority (AP) for risk assessment.

 

Also review the answer provided by Mr Venugopal R, Benchmark Six Sigma's in-house expert for more details on AP