FMEA RPN calculation: a worked S × O × D example

For a classic FMEA worksheet, calculate each row's Risk Priority Number as RPN = Severity × Occurrence × Detection. With the fictional ratings below, the external-seal-leakage row is 8 × 3 × 7 = 168; after a proposed design and detection change, its revised value is 8 × 2 × 2 = 32. That 81% numerical reduction is a prioritization result, not proof that the pump is safe, reliable, compliant, or ready for service.

Scope and terminology first

IEC 60812:2018, Edition 3.0 describes FMEA as a systematic way to identify how an item or process might fail, the local and global effects, and possible causes so that treatment decisions can be made. Its scope covers hardware, software, processes, human action, and their interfaces. The IEC page also makes an important boundary explicit: the generic standard can support safety analysis, but it does not provide application-specific safety guidance.

This note uses a process FMEA (PFMEA) worksheet for one fictional step: transfer clean water at 120 L/min with centrifugal pump P-101. A row reads from the intended function to a failure mode, effect, cause, current controls, and three ordinal ratings:

• Severity (S) rates the seriousness of the stated effect. A larger number is worse.
• Occurrence (O) rates the cause's occurrence under the current prevention controls. A larger number is worse.
• Detection (D) rates the chance that the current controls will fail to detect the cause or mode in time. A larger number is worse, so D = 1 is favorable and D = 10 is unfavorable.
• RPN is the product S × O × D, with a mathematical range from 1 to 1,000 when each input is an integer from 1 through 10.

The three rating scales are not universal measurements. The integers below come from a fictional project rubric for teaching arithmetic; they are not failure probabilities, event frequencies, percentages, or values copied from IEC, SAE, or AIAG-VDA tables. A real team must select the governing method and write anchors that fit the product, process, customer, sector, and lifecycle stage. The current SAE J1739_202605, stabilized in May 2026, covers DFMEA, supplemental FMEA-MSR, and PFMEA and provides its own terms, rating charts, worksheets, requirements, and recommendations.

Inputs and assumptions for the worked sheet

Assume P-101 transfers nonhazardous water between atmospheric tanks. The study boundary includes the pump, local isolation, seal system, suction strainer, low-flow indication, and maintenance access. It excludes the motor-control circuit design, upstream and downstream process hazards, pipe stress, pressure relief, detailed safeguards, human-factors validation, and proof-test coverage.

The team records these pre-action inputs:

The values deliberately mix consequence types. S = 10 for personnel exposure is not comparable to S = 8 for water release unless the approved rubric says exactly what each anchor means. The purpose is to show the mechanics and the review questions, not to recommend these ratings.

NASA's FMEA Through the Project Lifecycle describes FMEA as a bottom-up study of failure modes and effects and places reliability, design, subject-matter, test, quality, manufacturing, maintenance, and service expertise around the work. That is why one analyst should not silently invent the real ratings, boundaries, or actions.

Calculate and rank the three rows

Multiply the three ratings without rounding:

1. External seal leakage: RPN = 8 × 3 × 7 = 168.
2. No flow: RPN = 6 × 5 × 3 = 90.
3. Unexpected start: RPN = 10 × 1 × 8 = 80.

Sorting only the products gives 168 > 90 > 80. Recompute the result independently by changing the multiplication order: (8 × 3) × 7 = 24 × 7 = 168, (6 × 3) × 5 = 18 × 5 = 90, and (10 × 8) × 1 = 80 × 1 = 80. The factors are dimensionless ordinal scores, so the product has no physical unit. Writing 168 failures/year or 80% risk would be false.

The third row is the essential negative test. A personnel-exposure scenario does not become acceptable merely because its low assumed occurrence produces the smallest RPN. IEC 60812 says failure modes can be prioritized to support treatment decisions; it does not say one product is a universal acceptance criterion. Preserve Severity as a separate review field, apply any project-specific mandatory-action rule, and document the decision rather than using an RPN cutoff as an automatic release gate.

Re-rate only after defining the action

The fictional team proposes three changes:

Severity stays unchanged because none of the proposed controls changes the defined worst effect. That is a check, not a universal law: a redesign can sometimes change the effect itself, but a detector does not normally make the consequence less severe. Occurrence moves only where the proposed design or prevention control plausibly acts on the cause; Detection moves only where a control can reveal the cause or mode in time.

These are proposed, not verified, revised ratings. Do not close the actions until the owner, due date, implemented configuration, test evidence, residual assumptions, and team approval exist. NASA's FMEA/CIL 201 training lists design, manufacturing controls, tests, inspections, failure history, and operational use as distinct forms of retention rationale; a lower number without that evidence is only optimistic data entry.

Reproducible Schematex source

fmea "P-101 water-transfer PFMEA"
  type: process
  rank: rpn
  flag: rpn > 100
  number: PFMEA-P101-01
  team: "Reliability / Operations / EHS"
  revision: 0

  item "P-101 transfer pump" fn "Deliver 120 L/min"
    mode "External seal leakage"
      effect "Water reaches dry equipment area" sev: 8
      cause "Mechanical seal wear" occ: 3
        controls prevention: "PM every 4,000 h" detection: "Operator round each shift" det: 7
    mode "No flow"
      effect "Batch transfer missed" sev: 6
      cause "Suction strainer fouling" occ: 5
        controls prevention: "Weekly strainer check" detection: "Low-flow alarm after start" det: 3
    mode "Unexpected start"
      effect "Personnel exposed to rotating equipment" sev: 10
      cause "Isolation state not verified" occ: 1
        controls prevention: "LOTO procedure + local disconnect" detection: "No engineered state proof" det: 8

  action "External seal leakage" / "Mechanical seal wear"
    do: "Double seal + tested leak detector" owner: "Reliability" target: "2026-Q4"
    revised sev: 8 occ: 2 det: 2
  action "No flow" / "Suction strainer fouling"
    do: "DP alarm + condition-based cleaning" owner: "Operations" target: "2026-Q4"
    revised sev: 6 occ: 2 det: 2
  action "Unexpected start" / "Isolation state not verified"
    do: "Trapped-key isolation + zero-energy check" owner: "EHS" target: "2026-Q4"
    revised sev: 10 occ: 1 det: 2

Schematex 1.0.13 strictly parsed and rendered this source with no diagnostics on August 23, 2026. The model flattened one item, three modes, three effects, and three causes into three worksheet rows; it calculated all pre-action and revised RPNs, sorted on rank: rpn, and flagged only the row above 100.

The renderer also displays an AP column. The current Schematex FMEA syntax reference explicitly says its Action Priority implementation uses provisional severity-primary banding rather than the paywalled exact AIAG-VDA decision tables. Therefore this article does not quote, validate, or use those displayed AP values as an AIAG-VDA conclusion. For controlled automotive work, use the licensed governing edition and an approved implementation.

Checks and invariants

Run these checks before accepting any worksheet:

1. Range: every S, O, and D is an integer from 1 through 10 under the chosen rubric.
2. Direction: a larger Detection value means poorer detection. If a strong automatic test is rated D = 10, the scale may have been reversed.
3. Completeness: each row has a function, failure mode, effect, cause, and named current control or an explicit statement that no control exists.
4. Arithmetic: recompute every product and revised product independently; S × O × D must equal the displayed RPN.
5. Units: no RPN is labeled as probability, frequency, percentage, dollars, or time.
6. Traceability: every revised rating points to an implemented action and objective evidence, not merely a recommendation.
7. Severity review: high-severity effects receive the required review even when occurrence or RPN is low.
8. Boundary: interfaces and operating modes outside the worksheet are named so a clean table is not mistaken for complete system coverage.

For a tie test, add two fictional rows with S=9, O=2, D=5 and S=5, O=6, D=3. Both equal 90, but their Severity differs. A stable sort can order the rows; multiplication cannot decide which consequence, control obligation, or approval path governs.

Failure modes and review boundary

Common worksheet failures include rating the mode instead of the effect, rating occurrence without naming the cause, reversing Detection, averaging several effects instead of preserving the governing effect, claiming credit for a control that acts after the stated effect, lowering revised scores before implementation, and treating an arbitrary RPN threshold as proof of acceptable risk.

Paste the source into the Schematex playground, replace one fictional row at a time, and keep the assumptions beside the scores. Before issuing the worksheet, reconcile it with the process description, equipment drawings, maintenance history, incident data, hazard analysis, control narrative, test records, and action-tracking system; the diagram is a drafting and review aid, not the engineering approval.