01 · Mechanics and boundaries
Mechanics and boundaries
Failure mode and effects analysis examines how a required process function could fail, what that failure would do, why it could occur, and what controls exist. A failure mode describes loss of the function; an effect describes the consequence; a cause describes a mechanism. Keep those levels separate. “Wrong label” is a mode, “parcel reaches the wrong customer” an effect, and “two open order records share a printer queue” a candidate cause.
FMEA prioritizes potential failure risk. It does not verify the root causes of observed defects. Severity describes consequence, occurrence describes likelihood under stated conditions, and detection describes the strength of controls before escape. Ratings are ordinal judgments governed by a defined scale, not measurements of probability or expected financial loss.
02 · Construct the analysis
Construct the analysis
Define the process boundary and required functions first. Break dispatch into release, pick, pack, check, and load. For each function identify missing, incorrect, excessive, or delayed performance. Trace local and customer effects. List causes separately from preventive and detective controls. Identify the control actually used, its timing, its owner, and the evidence that it works.
Traditional RPN multiplies severity, occurrence, and detection ratings. Different combinations can produce the same product, so an arbitrary RPN cutoff is a poor substitute for reviewing serious effects. In AIAG–VDA contexts use the applicable Action Priority tables and rating rules, which prioritize action from combinations of ratings rather than an invented numerical conversion. Confirm customer and organizational requirements. Do not assign an AP category from intuition or present these illustrative scores as AIAG table ratings.
03 · Worked warehouse-dispatch example
Worked warehouse-dispatch example
The fictional North Quay warehouse dispatches a single parcel-order family. Its boundary starts when an order is accepted for release and ends at confirmed carrier handover. Demand is 240 orders in a 420-minute net working day. Each order contains three lines on average, but the example keeps the parcel order as the unit of flow. No number below describes a real organization or a demonstrated improvement. The purpose is to make the reasoning traceable rather than to present a success story.
A representative order spends 12 minutes awaiting release, 2 minutes being released, 18 minutes awaiting picking, 8 minutes being picked, 24 minutes awaiting packing, 5 minutes being packed, 10 minutes awaiting checking, 2 minutes being checked, 15 minutes awaiting loading, and 3 minutes being loaded. These mutually exclusive intervals total 99 minutes: 20 minutes of processing and 79 minutes of waiting. They describe one complete normal-route trace, not a statistically estimated mean for every order. A separate 100-order diagnostic sample contains 20 late orders, defined as handover more than 120 minutes after acceptance. The normal trace and late-order sample therefore answer different questions.
Three pickers, three packers, two checkers, and two loaders work in parallel within their respective stages. At the illustrated processing times, theoretical stage capacities are 157.5, 252, 420, and 280 orders per day. Picking is below the 240-order requirement even before interruptions or rework. Release has two staff and a theoretical capacity of 420. These capacities assume dedicated resources, identical order mix, and no overlapping assignments. They are not observed outputs and should never be reported as effective capacity.
Consider a wrong-carrier-label mode. On a locally defined illustrative ten-point scale, the team assigns S=8, O=3, D=6, giving RPN 144. A delayed-release mode receives S=6, O=6, D=4, also 144. The equal product hides different consequences and control weaknesses. A wrong-destination parcel warrants explicit severity review even though its estimated occurrence is lower.
The proposed label control binds one scanned parcel identifier to one print job and rejects a mismatch at loading. Preventing cross-order print selection targets occurrence; an independent loading scan targets detection. Neither normally lowers severity: the consequence of an escaped wrong shipment remains serious. A supervisor asks for challenge tests using deliberately mismatched labels before changing the detection rating. These are proposed tests, not claimed results.
04 · Interpretation and decisions
Interpretation and decisions
Use the analysis to allocate preventive work, not merely to rank rows. Assign a concrete design change, accountable owner, verification method, and review date. Link accepted controls to the operating method so that the FMEA does not describe checks that nobody performs. Where occurrence is unknown, record the uncertainty and seek exposure data instead of assigning a reassuring low score.
A weak FMEA lists “operator error” as the cause of every failure and lowers ratings once training is scheduled. A sound analysis describes the selection mechanism, assesses training only where knowledge is the relevant barrier, and changes residual ratings after evidence confirms the control. Risk prioritization remains distinct from the cause-effect investigation of the 20 observed late orders.
05 · Sound application and adaptations
Sound application and adaptations
For high-consequence functions, analyze control independence and common failures. Two scans using the same wrong master record may agree while both are wrong. Consider restart, printer recovery, partial orders, returns, and handover during system outage, not only normal operation. Update the FMEA when layout, software, order mix, or carrier rules change.
An FMEA is limited by team knowledge and the relevance of its ratings. It is not a mathematical proof of safety or a complete reliability model. Use specialized fault-tree, reliability, or human-factors analysis where combinations and consequences require them. Preserve earlier ratings and the evidence for revision so future reviewers can distinguish reduced risk from a changed scoring interpretation.
06 · Evidence and follow-through
Evidence and follow-through
Make the observation auditable before debating a countermeasure. Preserve an anonymous order identifier, acceptance and handover timestamps, route, line count, shift, exception flag, and the observer's definitions. A timestamp from a completed screen action may describe data entry rather than physical completion. Reconcile several records with direct observation and ask the person doing the work what each event actually means. Keep an uncertainty note when clocks differ or two actions overlap; rounding cannot repair an ambiguous boundary.
Observe ordinary work and exceptions over a period that includes opening, replenishment, breaks, and the carrier cutoff. Selecting only easily followed orders produces a clean-looking but biased picture. When an order is unfinished at observation end, keep it visible as unfinished rather than silently deleting it. For multi-line orders, establish whether timing ends at the first line or the complete order. Include all three lines in the latter case, because the customer receives the order only after its final requirement is satisfied.
Turn the analysis into a bounded decision. Describe the proposed change, the mechanism expected to alter performance, the measure that would detect the change, and the conditions under which it would be withdrawn. A small layout change might reduce walking yet increase congestion; an extra release wave might lower one queue yet overload picking. Monitor handover performance, first-pass accuracy, work in process, and staff workload together. Treat the proposed numbers as planning assumptions until a comparable observation period supplies evidence.
07 · Boundary and robustness review
Boundary and robustness review
Before implementing the selected countermeasure, check the boundary one more time. If the analysis starts after order release, an upstream acceptance hold is outside its measured lead time even though the customer experiences it. If the analysis ends at the loading bay, a parcel waiting for the carrier is still incomplete within the stated dispatch outcome. Keep those events inside the customer-facing boundary, or state exactly why a narrower operational measure is also being used.
Assess robustness across normal variation. A proposed operating rule should specify what happens when an urgent order arrives, stock is unavailable, a staff member is absent, or the carrier changes collection time. Those conditions do not invalidate the main analysis; they define where its assumptions need adaptation. Rehearse an exception through the proposed route with the people responsible for each decision. Record which assumptions remain unverified and what evidence would be sufficient to proceed.
Finish with an explicit learning statement: what the evidence currently supports, what it does not establish, and which observation is needed next. A quantified hypothesis can be useful without becoming a guaranteed result. Retain the current-state observations so a later comparison can use the same event definitions and population. When the observed outcome differs from the prediction, revisit the mechanism and resource assumptions rather than adjusting the target after the fact.
Connections
Related methods and phase use
Placed under Analyze because of the outcome it supports. Use the method in other phases when its purpose and assumptions fit the work; the phase list is a guide to selection, not a compulsory sequence.
Sources
Professional foundations and further reading
The explanation and fictional teaching examples are written for LeanTrainingLab. Linked primary sources provide professional foundations; example values and local conventions are stated in the guide. The accepted toolset draws on Six Sigma+Lean Toolset, second edition (Lunau, editor; Springer, 2013). No book text or examples are reproduced here.