Prioritizing PFMEA Actions When RPNs Tie
A cross-functional team is updating a PFMEA for a hydraulic valve body. Three failure modes are scored on 1–10 scales:
- A: O-ring cut during assembly - S=7, O=4, D=4; RPN=112.
- B: Wrong torque on bonnet bolts - S=8, O=3, D=6; RPN=144.
- C: Missing corrosion coating - S=9, O=2, D=8; RPN=144.
The team has budget for one mistake-proofing project this quarter. The plant manager argues for B because it ties for highest RPN and torque tools are cheap. The customer has had field failures from corrosion on a similar product.
1. Which failure mode should be addressed first, and why?
Read the worked answer
C should be addressed first, even though B ties its RPN.
RPN alone hides the severity difference. C has S=9 - a field corrosion failure with safety, regulatory, or major customer consequences - and D=8, meaning the current controls are unlikely to catch a missing coating. B has S=8 but D=6, so detection is better, and O=3 versus O=2.
A severity-first review changes the ranking:
- C: severity 9 with poor detection is the highest residual risk.
- B: severity 8 but better detection; still important, but lower risk of escape.
- A: severity 7 and moderate detection.
The plant manager's RPN tie-break is arithmetic, not risk logic. The customer's field history on corrosion reinforces the severity judgment. Addressing C first is the defensible risk-based choice.
2. What action should be taken for C, and how should the team verify that risk was actually reduced?
Read the worked answer
For C, the preferred action is to make the missing coating impossible or automatically detected - not to add another manual inspection step.
- Prevention: interlock the coating operation with the next process, or use a fixture that cannot accept an uncoated part.
- Detection: add automated vision or a conductivity/coating-thickness check at the line, with reject segregation.
- Re-score: if the poka-yoke makes omission essentially impossible, reduce O; if detection is automated and validated, reduce D substantially. Severity remains 9 because the effect has not changed.
Verification must be evidence-based: challenge the interlock with deliberately uncoated parts, confirm the reject gate works, review validation records, and update the control plan and work instructions. Then re-score the PFMEA and confirm residual risk is acceptable against the risk matrix. A lower RPN on paper without a challenged control is not risk reduction.
3. Why is RPN an unreliable sole prioritization method, and what governance should replace it?
Read the worked answer
RPN = S × O × D has no inherent risk weighting, and different combinations can produce the same score. A severity-9 detection problem can tie a severity-5 occurrence problem. Teams can also unconsciously lower D by claiming better inspection without evidence, or lower O without data, to move an item down the list.
Better governance:
- Use severity as a gate: high-severity items require action regardless of RPN.
- Use an action-priority approach or risk matrix that considers S, O, and D in a defined order rather than only their product.
- Require evidence for occurrence and detection changes.
- Review the PFMEA in management review and link actions to the control plan.
- Track residual risk acceptance explicitly, with customer or regulatory notification where required.
RPN can remain a communication number, but it should not be the decision rule for safety-critical or high-severity failure modes.