An Assessment of RPN Prioritization in a
Failure Modes Effects and Criticality Analysis
John B. Bowles • University of South Carolina • Columbia
Key Words: Risk Priority Number, FMEA, FMECA
SUMMARY & CONCLUSIONS
The Risk Priority Number methodology for prioritizing
failure modes is an integral part of the Automobile FMECA
technique. The technique consists of ranking the potential
failures from 1 to 10 with respect to their severity, probability
of occurrence, and likelihood of detection in later tests, and
multiplying the numbers together. The result is a numerical
ranking, called the RPN, on a scale from 1 to 1000. Potential
failure modes having higher RPNs are assumed to have a
higher design risk than those having lower numbers. Although
it is well documented and easy to apply, the method is
seriously flawed from a technical perspective. This makes the
interpretation of the analysis results problematic. The
problems with the methodology include the use of the ordinal
ranking numbers as numeric quantities, the presence of holes
making up a large part of the RPN measurement scale,
duplicate RPN values with very different characteristics, and
varying sensitivity to small changes. Recommendations for an
improved methodology are also given.
1. INTRODUCTION
"If you cannot measure it, you cannot improve it."
"When you measure what you are speaking about and
express it in numbers, you know something about it, but when
you cannot express it in numbers your knowledge about it is of
a meager and unsatisfactory kind."
— Sir William Thomson, Lord Kelvin (1824 – 1907) [1]
As summarized by Lord Kelvin, in any engineering or
scientific endeavor, it is necessary to be able to measure and
quantify the attributes of an item if we wish to model,
understand, and predict the behavior of the item in question.
In a Failure Modes and Effects Analysis (FMEA) the
objective is to determine how an item can fail and assess the
effect of that failure on the system of which the item is a part;
the term, “system”, in this case is used to mean not only the
specific, end-item piece of equipment, but also the users,
maintainers, and owners of the equipment. The results of the
analysis help managers and engineers to determine which
failure modes pose a hazard that must be designed out of the
product, which ones can be handled by appropriate corrective
actions and mitigation procedures, and which ones can be
safely ignored. Quantifying the effects of the failure with
respect to the severity of the effect and the failure mode’s
probability of occurrence helps in this regard.
The Automobile Failure Modes and Effects Analysis
technique, originally developed at Ford Motor Company [2]
and later standardized for the automobile industry as SAE
0-7803-7717-6/03/$17.00 © 2003 IEEE
380 2003 PROCEEDINGS Annual RELIABILITY AND MAINTAINABILITY Symposium
Ground Vehicle Recommended Practice J1739 [3], provides a
very detailed and comprehensive methodology for performing
a Failure Modes Effects and Criticality Analysis (FMECA).
Since the major automobile companies and their suppliers
constitute a large part of the US economy the procedure has
become very widespread. It is also very well documented and
serves as a model for other industries. The Ford procedure
was one of the first to extend the FMEA methodology to
potential manufacturing process induced failures as well as
design induced failures.
An integral part of the Automobile FMEA technique is the
Risk Priority Number (RPN) methodology for ranking and
assessing the design risk of potential failure modes. The RPN
is developed by assigning potential failure modes a rank from
1 to 10 with respect to the severity of the failure mode effect
(S), its probability of occurrence (O), and the likelihood of its
being detected in later design evaluation tests (D). These
ranking factors are then multiplied to give the RPN:
RPN = S × O × D
Since the three ranking factors range from 1 to 10, the
resulting RPN ranges from 1 to 1000. Higher RPNs are
assumed to be more of a design risk than those having a lower
RPN [3]. Also, multiplying the S, O, and D factors magnifies
the effect of any high risk factors. The RPN number is used to
prioritize failure modes for corrective actions and to evaluate
the improvement (change in RPN) resulting from prospective
design changes. Corrective actions should be aimed at
reducing one of the S, O, or D rankings.
From a management perspective the RPN technique is
simple, easy to understand, straight forward to use, well
documented, and with appropriate training, consistent results
can be obtained. Unfortunately, from a technical perspective
the method is seriously flawed which makes both the analysis
and the interpretation of the results problematic. The
implications of these flaws are the focus of this paper.
We begin in Section 2 with a discussion of measurement
methodologies. Section 3 examines each of the RPN scales:
Severity, Occurrence, and Detection, with respect to the types
of measurement each represents. Section 4 then examines the
formation of the RPN number itself and some of the
mathematical implications from its construction. Conclusions
and recommendations are in Section 5.
1.1. Acronyms and Notation
RPN Risk Priority Number
S Severity ranking (1 to 10)
O Occurrence Ranking (1 to 10)
D Detection Ranking (1 to 10)
 2.0. SCALES OF MEASUREMENT
The essence of measurement is that it allows us to separate
things into categories based on the property we are
measuring—as Lord Kelvin says, to “know something about
it”. But all measurements do not allow for the same level of
quantification; what we “know” and how we can use it
depends on the scale of measurement. Four types of
measurement scales are generally recognized [4].
• Nominal Measurements
• Ordinal Measurements
• Equal Interval Measurements
• Ratio Measurements
2.1. Nominal Measurements
Nominal measurements are the most basic type. The term
“nominal” refers to the names of things and nominal
measurements use the name of a property to put objects into
categories. For example, the property of shape can be
represented by such names as “square”, “rectangle”, “circle”,
“triangle”, etc. and objects can be categorized by shape in this
way. Properties, measured by nominal measurements, can
only be used to put objects into categories that are different
from each other; questions of “more” or “less” have no
meaning.
Numbers can be used as the category names, but such
numbers are only labels; they do not represent amounts and
while it is possible to do arithmetical calculations on such
numbers, the results are meaningless. For example, one
attribute of a student in a class is his or her the social security
number. These numbers can be entered into a spreadsheet and
their average can be calculated, but this “average social
security number” is meaningless. On the other hand, the
average height or weight of the students in the class is
meaningful.
Nominal measurements are important in reliability because,
although we get no quantitative information from the
measurement, the collection of such measurements provides
useful information. For example, by counting the number of
observations of a piece of equipment that fall into the
categories “working” and “failed” we can determine the
frequencies and the distributions of those states and in some
cases what caused the equipment to change from one state to
the other.
2.2. Ordinal Measurements
The term “ordinal” refers to the order of things. Ordinal
measurements specify the order in which things are to be
placed from first to last, but they do not specify how far apart
the things are. Ordinal measurements tell us how much of a
property an item has, but only relative to another item. Thus,
using ordinal measurements, we can say that one item has
more or less of some property than another, but not how much
more or how much less.
Numbers, and sometimes letters of the alphabet or words,
are often used as the symbols for ordinal measurements. Such
symbols have a natural order, which can be associated with the
amount of the property they represent. These category
numbers are not arbitrary labels as in the case of nominal
measurements; instead they serve to identify ranks, specifying
2003 PROCEEDINGS Annual RELIABILITY AND MAINTAINABILITY Symposium
which item is first, which second, and so on.
Ordinal measurement scales are frequently used. For
example, ratings on a scale of 1 to 10 for such things as
beauty, friendliness, and pain, are common applications.
Another is grades for student work where an “A” paper is
better than a “B” paper but there is no implication that the
difference in quality between an “A” paper and a “B” paper is
the same as the difference between a “C” paper and a “D”
paper.
The operations of multiplication and division are not
meaningful on ordinal numbers and addition and subtraction
while sometimes meaningful, must be carefully done since
they assume an equal interval between the category labels.
For example, even though grades are ordinal numbers, the
grade-point-average is often used as an overall measure of a
student’s performance.
2.3. Equal Interval Measurements
Equal interval measurements are ones in which the
categories are ordered by the amount of the property they have
and the intervals between the categories are the same
everywhere. The measurement of temperature on a Fahrenheit
scale is an example of an interval measurement. The
difference between a temperature of 10º F and one of 11º F is
the same as the difference between 95º F and 96º F.
Addition, subtraction, and operations such as the calculation
of an average are all meaningful operations for the numbers on
an interval scale since the differences between categories are
the same everywhere. However, the placement of the zero
point on an interval scale is arbitrary and this means that the
numbers cannot be meaningfully multiplied or divided. For
example, the average of several temperature measurements
can be easily computed but it is meaningless to say that 60º F
is twice as warm as 30º F. This becomes very apparent if
these temperatures are converted to Celsius (approximately
15.6º C and –1.1º C respectively). The Fahrenheit and Celsius
scales differ not only in the size of the degree (the distance
between the category labels), but also in the location of the
zero point. Because the zero point is arbitrary, measurements
on interval scales often have negative values.
2.4. Ratio Measurements
A ratio scale is the only scale on which the numbers can be
meaningfully multiplied and divided. Like an interval scale,
the intervals between categories are equal, but a ratio scale
also has a true zero-point indicating that absolutely none of the
property being measured is present. It is not possible to have
less than zero on a ratio scale. Since it has a true zero, it is
reasonable to multiply and divide the numbers on the scale.
The Kelvin scale for measuring temperature is a ratio scale.
The intervals are the same as on the Celsius scale but 0º K
represents no heat whatsoever and it is not possible to have a
temperature of less than 0º. A temperature of 1000º K is twice
as hot as a temperature of 500º K.
In reliability work, the time that a device has been
operational is an example of a ratio measurement. A device
that fails after 10,000 hrs of operation has lasted twice as long
as one that failed after 5,000 hrs.
2.5. Linear and Logarithmic Scales
Interval and ratio measurement results are most often
381
 reported on either a linear or a logarithmic scale.
Linear scales are most appropriately used when adding 1
unit to a value represents as big a change in the quantity being
measured regardless of its original size. Thus, on a linear
scale a change of 1 is the same regardless of whether the
original value was 1 or 1000. Linear scales often cover a
limited range of values—partly because the “equivalence of a
unit change anywhere” property may only hold over a limited
range of values and partly because the size of the scale’s
physical representation may restrict its range.
If doubling a value is just as big a change, whether it is from
1 to 2 or 1000 to 2000, a logarithmic scale is appropriate. On
a logarithmic scale proportional changes in a value appear as
the same difference. Logarithmic scales also are able to
compactly represent a very large range of values. Many
natural things have these characteristics and logarithmic scales
are used for their measurement. For example, the pH measure
of the acidity of a liquid is the negative of the logarithm of the
concentration of hydrogen ions. An acid with a pH of 3 has a
concentration of 0.001 (10-3) ions, neutral water has a pH of 7
(10-7) and a strong base might have a pH of 11 (10-11). Such a
range of values can hardly be plotted on a linear scale. As
another example, graphs of the prices of stocks are usually put
on a logarithmic scale since a doubling in the stock’s value per
share from $1 to $2 is as important as a doubling from $20 to
$40.
In reliability work the probability of failure is often
represented on a logarithmic scale. Failure probabilities often
cover a range of 10 or more orders of magnitude from less
than 10-9 to 1. Also, an order of magnitude difference in
reliability is usually needed to have a meaningful difference.
3. COMPONENTS OF THE RPN
We now examine the components of the RPN calculation,
severity, occurrence, and detection, with respect to the types
of scales on which they are measured.
3.1. Severity
Severity is a measurement of the seriousness of the effect of
the potential failure mode on the next higher assembly, the
system, or the customer. The SAE J1739 procedure
recommends that the effects of the failure mode occurrence be
described as the effect on the customer or as they would be
noticed or experienced by the customer. Common failure
effects are such things as:
• Excessive noise
• Erratic or intermittent operation
• Instability
• Impaired control
• Unpleasant odor
• Poor appearance
Table 1 shows the criteria used to rank the severity of a
failure effect.
The category descriptions for the severity scale are detailed
enough that with minimal training and a good set of examples
most people would be able to agree on which category a given
failure should be classified, or at least they would put them in
nearby categories. Whether something would be noticed by a
“discerning customer” but not by an “average customer”
382 2003 PROCEEDINGS Annual RELIABILITY AND MAINTAINABILITY Symposium
Table 1. Severity Evaluation Criteria [3, p 11]
Rank Effect Criteria: Severity of Effect
10 Hazardous Very high severity ranking when a potential failure mode
without affects safe vehicle operation and/or involves
warning noncompliance with government regulations without
warning.
9 Hazardous Very high severity ranking when a potential failure mode
with affects safe vehicle operation and/or involves
warning noncompliance with government regulation with
warning.
8 Very High Vehicle/item inoperable, with loss of primary function.
7 High Vehicle/item operable, but at reduced level of
performance. Customer dissatisfied.
6 Moderate Vehicle/item operable, but comfort/convenience item(s)
inoperable. Customer experiences discomfort.
5 Low Vehicle/item operable, but comfort/convenience item(s)
operable at reduced level of performance. Customer
experiences some dissatisfaction.
4 Very Low Cosmetic defect in finish, fit & finish/squeak or rattle
item that does not conform to specifications. Defect
noticed by most customers.
3 Minor Cosmetic defect in finish, fit & finish/squeak or rattle
item that does not conform to specifications. Defect
noticed by average customer.
2 Very Cosmetic defect in finish, fit & finish/squeak or rattle
Minor item that does not conform to specifications. Defect
noticed by discriminating customer.
1 None No effect.
might be debated and whether a vehicle running so poorly that
it is capable of going only 10 miles per hour is “inoperable” or
“operable at a reduced level of performance” might also be a
matter of individual judgment.
The numerical ranks serve to order the severity assessments
from low to high as on an ordinal scale. Things that affect
only the appearance of the vehicle are ranked lower than those
that affect its operation and those, in turn, are ranked lower
than things that affect the safety of the vehicle operation.
While this ordering seems subjective, most people would
probably agree with it: safety is more important than
operation, and operation is more important than appearance,
the severity scale does not appear to have any underlying scale
of measurement. If cost were the underlying criteria, some
cosmetic defects, such as a molted appearance that required a
vehicle to be repainted would be ranked substantially higher
than some operational defects, such as noisy brakes that could
be fixed by using a different type of brake pad.
Clearly, the scale is not an interval scale. The difference in
whether a user is warned of a hazardous condition or not
seems to be (in some sense) more important than the
difference in whether an “average” or a “discerning” customer
would notice a cosmetic defect.
Thus, the severity scale is at most an ordinal scale with the
ordering based on a subjective judgment of “severity” and
designated by the assigned ranks (1 to 10).
3.2. Occurrence
Occurrence is an assessment of the likelihood that a specific
cause or mechanism of a failure mode occurs. Some typical
failure causes and failure mechanisms are:
• Incorrect material specification
• Over-stressing
• Insufficient lubrication capability
• Inadequate maintenance instructions
 • Fatigue
• Material instability
Table 2 lists the occurrence rankings and their associated
meanings. The “Design Life Possible Failure Rates” is the
relative number of failures anticipated during the design life of
the item. Estimates of the probability of occurrence may be
based on the service history and field experience of similar
components with appropriate changes for differences in the
design or operating environment.
Table 2. Occurrence Ranking Evaluation Criteria [3, p.15].
Ranking Probability of Failure Design Life Possible Failure Rates
10 Very High: Failure is almost ≥0.5, (greater than 1 in 2)
inevitable
9 0.33, (1 in 3)
8 High: Repeated failures 0.125, (1 in 8)
7 0.05, (1 in 20)
6 Moderate: Occasional 0.0125 (1 in 80)
Failures
5 0.0025 (1 in 400)
4 0.0005 (1 in 2000)
3 Low: Relatively few failures 0.0000667 (1 in 15,000)
2 0.00000667, (1 in 150,000)
1 Remote: Failure is unlikely ≤0.000000667, (1 in 1,500,000)
The occurrence rankings clearly have an underlying
measurement of the probability of the failure mode occurring.
This can be estimated statistically from data or from a variety
of system models. Figure 1 shows the rank versus the
probability of failure from Table 2 plotted on a log scale*. If
the rank represented the log of the probability of failure, the
steps in Figure 1 would all be of uniform width. Since they
are not, it is easily observed that a change of 1 rank at the high
end of the scale (e.g., from 7 to 8) represents a proportionally
a smaller change in the probability of occurrence than a
change in rank at the low end of the scale (e.g., from 2 to 3).
Thus, the high end of the scale has a finer granularity than the
low end of the scale.
Placing a straight edge along the edge of the steps as shown
in Figure 1, shows that below rank 6 the ranks are roughly
proportional to the log of the probability of failure. Thus, the
occurrence scale provides an interval measure for the lower
ranks where a change in rank represents a constant
proportional change in the underlying probability of failure.
For the higher ranks this is not true and the scale is an ordinal
scale in which higher numbered ranks indicate a higher
probability of failure but the relative increase signified by a
unit change in rank varies.
* 2
Figure 1 interprets Table 2 such that the given probability of occurrence for
each rank is the highest permissible for that rank, i.e., rank 1 failures have a
highest probability of occurrence of 6.67x 10-7 (1/1,500,000), rank 2 failures
from 6.67x10-7 to 6.67 x 10-6, etc. This interpretation leaves a discrepancy at
rank 10, where rank 10 failures are plotted as having a probability of
occurrence of greater than 1/3 instead of greater than 1/2 as shown in the
table. If we had started with rank 10 and assumed the given probabilities were
the lower bound for each level there would have been a discrepancy at rank 1.
Still other interpretations are possible for example the values in Table 2 could
be interpreted as midpoints of the range for each rank. Nevertheless, the
particular interpretation used does not materially affect the discussion or the
conclusions reached.
2003 PROCEEDINGS Annual RELIABILITY AND MAINTAINABILITY Symposium
10 10
8
6
R
Rank
r
4
2
0 0
-77 F 10-3
10
10 10-5 r 0.1 11
Probability of Failure
Figure 1. Rank vs. Probability of Failure for the Occurrence
scale.
3.3. Detection
Detection assumes that a company has established some
kind of “design verification program” that is able to determine
whether or not an identified potential cause of failure will
actually result in the indicated failure mode. The design
controls used in such a program include those that:
• Prevent the failure cause or mechanism or the failure
mode or its effect from occurring, or reduce their rate of
occurrence.
• Detect the failure cause or mechanism and lead to
corrective actions, and
• Detect the failure mode.
Detection is an assessment of the ability of such a program
to identify a potential weakness before the part or assembly is
released to production. Examples of the types of tests used for
this purpose in the automobile industry include: road tests,
design reviews, simulations, mathematical studies, laboratory
tests, feasibility reviews, prototype tests, and fleet tests. Table
3 shows the evaluation criteria used for the detection rankings.
Table 3. Detection Ranking Evaluation Criteria [3, p. 17]
Rank Detection Criteria: Likelihood of Detection by Design Control
10 Absolute Design Control will not and/or cannot detect a potential
Uncertainty cause/mechanism and subsequent failure mode; or there
is no Design Control.
9 Very Very remote chance the Design Control will detect a
Remote potential cause/mechanism and subsequent failure mode.
8 Remote Remote chance the Design Control will detect a
potential cause/mechanism and subsequent failure mode.
7 Very Low Very low chance the Design Control will detect a
potential cause/mechanism and subsequent failure mode.
6 Low Low chance the Design Control will detect a potential
cause/mechanism and subsequent failure mode.
5 Moderate Moderate chance the Design Control will detect a
potential cause/mechanism and subsequent failure mode.
4 Moderately Moderately high chance the Design Control will detect a
High potential cause/mechanism and subsequent failure mode.
3 High High chance the Design Control will detect a potential
cause/mechanism and subsequent failure mode.
Very High Very high chance the Design Control will detect a
potential cause/mechanism and subsequent failure mode.
1 Almost Design Control will almost certainly detect a potential
Certain cause/mechanism and subsequent failure mode.
The detection ranking is clearly a subjective judgment on the
part of the designer as to how likely it is that a failure mode
will be found in subsequent tests. Although consistent
estimates might be possible with training one would expect
that there would be a great deal of variation particularly
among the middle ranks. Thus, the detection scale is an
383
 ordinal scale, ordered by the “likelihood” of the design
verification program detecting the weakness. One would
expect that similar situations might be rated quite differently
by different people or design teams.
4.0. THE RPN
As already noted the RPN is calculated as the product of the
rankings assigned to each factor: Severity (S), Occurrence (O),
and Detection (D), and the result lies on an integer scale from
1 to 1000.
4.1. Holes in the Scale
But the RPN scale is not continuous, indeed it has many
“holes”—that is, many of the numbers in the range of 1 to
1000 cannot be formed from the product of S, O, and D. This
is, perhaps, the most serious of the problems in interpreting
the RPN. While it is true that the numbers cover a range from
1 to 1000, 88% of that range is empty; only 120 of the 1000
numbers generated from the product of S, O, and D are
unique. No number having a prime factor greater than 10 can
be formed from the product of S, O, and D. Thus, the
numbers 11, 22, 33, ... 990, which are all multiples of 11
cannot be formed and are excluded. Similarly, all multiples of
13, 17, 19, etc. are excluded. 1000 is the largest number, but
900 is the second largest followed by 810, 800, 729, and 720.
Figure 2 shows the numbers formed by the RPN and the
“holes” in the scale between the numbers graphically.
To pursue this observation a little further, 4 is near the
middle of each scale; the next number after 64 (4 x 4 x 4) is
70. None of the numbers 65, 66, 67, 68, and 69 can be formed
from any combination of S, O, and D. In the RPN analysis,
high numbers are “more important” than low numbers, but the
presence of holes makes it difficult to interpret what the
differences between the numbers mean. Since 70 is the next
number after 64, a valid question is: “Is the difference between
63 and 64 the same or less than the difference between 64 and
70?” How about the difference between 900 and 1000.
Allowing an analyst to assign values between the ranks using
small fractions such as ½ or ¼ on the ranking scales (e.g., a
rank of 5½) would make the holes smaller but would not solve
the problem.
25
15
5 other factors. If D and O are both 10, a 1 point difference in
0 the severity ranking results in a 100 point difference in the
11 101 220
0 01 3 01 4
400 01 501 6
600 01 7 01 8 0 01
80
Figure 2. RPN scale showing the number of occurrences of
each number.
4.2. Duplicate RPN Numbers
Since 1000 numbers are produced from the product of S, O,
and D but only 120 of them are unique, there must be many
duplicate numbers. In general each of the rankings can be
formed in several different ways. (Only 6 RPNs are formed
by a single, unique combination of S, O, and D.) For example,
as shown in Figure 3, 64 can be formed from 10 different
combinations of S, O, and D:
The RPN numbers, 60, 72, and 120 can each be formed from
384 2003 PROCEEDINGS Annual RELIABILITY AND MAINTAINABILITY Symposium
24 different combinations of S, O, and D. Similarly, seven
RPN numbers: 24, 36, 40, 48, 80, 90, and 180, can be formed
from 21 different combinations. Figure 2 shows the number
of ways each number on the RPN scale can be formed.
It is difficult to accept that failures whose severity ranges
Severity Occurrence Detection
1 8 8
2 4 8
2 8 4
4 2 8
4 4 4
4 8 2
8 1 8
8 2 4
8 4 2
8 8 1
Figure 3. Combinations of S, O, and D yielding an RPN of 64.
from 1 (not noticeable except by the most discerning
customer) to 8 (inoperable with loss of primary function) can
be evaluated as having the same importance. This is even
more so for RPNs like 60 for which the severity factor can
vary from 1 to 10 (hazardous without warning). If nothing
else, the need for assurance that a failure rate is truly
acceptably low is much greater when the severity of the failure
effect is higher.
We note that 64 is the product 4 x 4 x 4; if we increase only
one factor to 5 (i.e., 5 x 4 x 4) we get an RPN of 80. The
numbers between 64 and 80 can be formed in a variety of
ways. One of these, 70 can result from the combination S =
10, O = 7, D = 1. Again, it is difficult to accept that a failure
mode having a severity of 10 (hazardous without warning), a
high probability of occurrence (7), and a low detection (1) can
be bounded in importance by systems having moderate (4 or
5) severity, moderate (4) occurrence, and moderate (4)
detection.
4.3. Sensitivity to Small Changes
Multiplying the numbers comprising the RPN is intended to
magnify the effects of high risk factors. This also makes the
RPN such that a small change in one factor has a much larger
effect when the other factors are larger than when they are
small. Hence, small variations in one ranking can lead to very
different effects on the RPN, depending on the values of the
90 1 1000
RPN; at the other extreme of D and O equal to 1, the same 1
point difference only gives a 1 point difference in the RPN;
near the middle of the scales, if D and O are both 4, a 1 point
difference gives a 16 point difference in the RPN. We also
note that the 100 point swing due to a change in S (with O and
D both 10) could occur anywhere on the RPN scale from a
low of 200 (goes to 100) to a high of 1000 (goes to 900). As
noted earlier individual judgments may give small differences
in the severity ranking and may result in larger differences in
the more subjective detection ranking. These small
differences in judgment can lead to potentially large
differences in the RPN ranking for very similar failure modes.
Both of the combinations of S, O, and D below result in an
RPN of 192.
Severity (S) Occurrence (O) Detection (D) RPN
3 8 8 192
8 3 8 192
But a 1 point change in S in the first causes a 64 point change
in the RPN, whereas in the second a 1 point change in S
causes only a 24 point change in the RPN.
4.4. Comparing RPNs
The RPN is an attempt to quantify and rank assessments of
the suitability of a design on three dimensions: the severity of
the effect of a failure, the frequency of occurrence of the
failure, and the likelihood of the failure mode detection, along
a single dimension so that design concerns can be prioritized
and compared. This is generally not possible without some
kind of cost function that quantifies how reductions along one
dimension relate to changes along another dimension.
Calculation of the RPN implies that trade-offs can be made
between the severity, occurrence, and detection factors
according to a geometric cost function. For example, doubling
the severity (e.g., 4 → 8), halving the occurrence, (e.g., 4 → 2)
and keeping the detection the same has no net effect on the
RPN. But for this property (e.g., doubling or halving the
values) to be meaningful the underlying scale of measurement
must be a ratio scale. The operations have no meaning on an
ordinal scale.
About the best that can be done to compare RPNs is a
multidimensional Pareto ranking in which a failure whose S,
O, and D values are all lower than another’s is ranked lower
than the other. (E.g., RPN1 < RPN2 if S1 < S2, O1 < O2, and D1
< D2).
The use of a single number such as the RPN to “Rank”
failure modes encourages management to set an arbitrary
lower threshold, e.g., "We will only worry about concerns
having an RPN greater than 64," as a way of deciding what
concerns will be accepted and which ones will be corrected.
This is especially true for a large complex product, such as an
automobile in which thousands of failure modes must be
prioritized so that limited resources can be productively used
to correct potential problems. Unfortunately, the practical
effect of this thresholding can be an unproductive “numbers
games” in which the objective becomes to “get the RPN below
the threshold” rather than to improve the quality of the design.
5.0. CONCLUSIONS AND RECOMMENDATIONS
Although the RPN methodology is very widely used it is a
severely flawed ranking technique. The fundamental problem
is that the scales used to order the failure modes in terms of
the severity, occurrence, and detection ratings are ordinal
scales but they are treated as if numerical operations on them,
most notably multiplication, are meaningful. The results are
not only meaningless but are in fact misleading.
The RPN number itself is not on a continuous scale as might
at first be perceived, but one with many holes and the same
number can (in general) be constructed from many different
combinations of the severity, occurrence, and detection
rankings. Small changes in one of the factors from which the
RPN is computed can have different effects on the RPN
2003 PROCEEDINGS Annual RELIABILITY AND MAINTAINABILITY Symposium
depending on the values of the other numbers. Thus, the RPN
number itself offers no clue as to how the design can be
improved or even how big a change in the number constitutes
a meaningful improvement. Comparisons of different RPNs
have little meaning and design improvements made to reduce
the RPN may, in fact, not be improvements at all.
The RPN approach should be dropped and an entirely
different prioritization techniques should be used. The
following recommendations are made:
1. The detection ranking should be dropped. (Others have
also recommended using only the severity and occurrence to
prioritize the failure modes; see for example [5, 6, 7].) First,
the category name is misleading since it is a measure of
whether subsequent testing will show that the failure mode
actually exists rather than whether the failure will be detected
when it occurs. Second, the rank assigned for the failure mode
is highly subjective and one would expect considerable
variation from one analyst or design team to another. (This
could be offset with extensive training but it remains a
problem.) Third, a low detection ranking means that the
company’s “design verification program” will be able to
detect that the potential problem is real, but fixing design
flaws late in the design process is almost always expensive.
Even if a design flaw is “certain” to be found by a fleet test, or
a field test after the design is complete, that is much too late to
be of much benefit. The detection ranking should be replaced
with a comment indicating what tests might be needed to more
accurately determine the frequency of occurrence of the
potential failure.
2. The rankings for the severity categories should also be
scrapped. Instead these categories should be considered as
nominal classifications (categorizations) for safety,
operational, and cosmetic related failure mode effects. An
acceptable upper limit on the probability of occurrence should
be determined for each class and all failure modes in the class
whose probability of occurrence was too high (above that
limit) would then need to be corrected or mitigated as
appropriate. If the analysis is being done for safety the
“Hazardous without warning” (Rank 10) and “Hazardous with
warning” (Rank 9) and perhaps the “Very High” (Rank 8)
categories would be of the most interest. If the analysis is
being done with respect to the operational performance and
reliability of the vehicle the “Very High” (Rank 8), “High”
(Rank 7), “Moderate” (Rank 6), and “Low” (Rank 5) would be
of the most interest. If the analysis is being done with respect
to the marketability of the automobile the cosmetic defect
categories: “Very Low” (Rank 4), “Minor” (Rank 3), and
“Very Minor” (Rank 2) categories would also become of more
concern. The overall design would have to be concerned with
all of these types of potential failures. It might be appropriate
to rename these categories to better describe the types of
failures they describe rather than to give them an implied
ordinal ranking, which might not be applicable. A frequently
occurring “Minor” defect in a vehicle’s finish could make it
difficult to sell and give the manufacturer a reputation for
“poor quality”.
If a cost could be associated with each failure effect, that
would allow the failures to be placed on a dollar scale (a ratio
scale); the product of the cost of the failure effect and the
385
 probability of occurrence of the underlying failure mode could
then be multiplied to give an “expected cost” of the failure.
Proposed design changes could then be evaluated by their
effect on the expected cost.
REFERENCES
1. http://www.top-biography.com/9103-
William%20Thomson/quotations.htm.
2. "Potential Failure Mode and Effects Analysis In Design (Design FMEA)
and For Manufacturing and Assembly Processes (Process FMEA)
Instruction Manual", Ford Motor Company, September 1988.
3. "Potential Failure Mode and Effects Analysis In Design (Design FMEA)
and Potential Failure Mode and Effects Analysis In Manufacturing and
Assembly Processes (Process FMEA) Reference Manual", Society of
Automotive Engineers, Surface Vehicle Recommended Practice, J1739,
July 1994.
4. C. C. Reaves, Quantitative Research for the Behavioral Sciences, John
Wiley, New York, NY, 1992.
5. "Recommended Failure Mode and Effects Analysis (FMEA) practices for
non-automobile applications", Society of Automotive Engineers,
Aerospace Recommended Practice, ARP 5580, July 2001.
6. J. B. Bowles, "The new SAE FMECA standard", Proc. Ann. Reliability and
Maintainability Symp., Anaheim, CA, January 1998, pp. 48-53.
386 2003 PROCEEDINGS Annual RELIABILITY AND MAINTAINABILITY Symposium
7. P. Palady, M. Horvath, and C. Thomas, “Restoring the Effectiveness of
Failure Modes and Effects Analysis”, Society of Automotive Engineers
International Congress and Exposition, Detroit, MI, 1994, Technical Paper
No. 940884.
8. P. J. Fleming and J. J. Wallace, “How not to lie with statistics: the correct
way to summarize benchmark results”, Communications of the ACM, Vol.
29, No. 3, March 1986, pp. 218-221.
BIOGRAPHY
John B. Bowles
Computer Science and Engineering
University of South Carolina
Columbia, SC 29208 USA
e-mail: bowles@engr.sc.edu
John Bowles is an Associate Professor in the Computer Science and
Engineering Department at the University of South Carolina where he teaches
and does research in reliable system design. Previously he was employed by
NCR Corporation and Bell Laboratories where he worked on several large
system design projects. He has a BS in Engineering Science from the
University of Virginia, an MS in Applied Mathematics from the University of
Michigan, and a Ph.D. in Computer Science from Rutgers University.