FMEA RPN Calculator

The risk priority number is severity times occurrence times detection, each rated from 1 to 10, so an RPN runs from 1 to 1000. The multiplication is the easy part, and reading the result correctly is the part that decides whether an FMEA is worth the days it took to write.

The three ratings

Each of the three is a whole number from 1 to 10, and on all three a higher number is worse.

• Severity. How bad the effect is if the failure happens. Ten is a safety or regulatory consequence.
• Occurrence. How likely the cause is. Ten is almost inevitable.
• Detection. How likely the existing control is to catch it first. Ten means it would not be caught.

Detection is the one that gets entered backwards. The rating is not how good the control is; it is how likely the failure is to slip past it. A control that reliably finds the fault scores low, and a machine with no control at all scores 10. Reversing that one column inverts the priority of an entire worksheet, and it is silent when it happens.

The arithmetic

RPN = severity × occurrence × detection. The smallest possible value is 1 and the largest is 1000.

Severity × occurrence is worth calculating at the same time. It runs from 1 to 100 and it is the risk before any credit for detection, which is to say the risk that is actually there rather than the risk that gets found in time.

The trap inside the multiplication

RPN treats the three ratings as interchangeable, and they are not. Reducing occurrence removes failures. Reducing severity changes what happens when they occur. Reducing detection does neither: it only finds the failure sooner, and it does nothing at all on the day the detection itself fails.

The product cannot tell those apart, so two items with the same RPN can require entirely different work. Take a failure rated severity 9, occurrence 5, detection 4, and another rated severity 5, occurrence 6, detection 6. Both come to 180 and would sit next to each other on a sorted list. But severity times occurrence is 45 on the first and 30 on the second, and the first one hurts somebody when it happens. Sorting on the product alone hides that difference completely.

A severity of 9 or 10 outranks the score

A failure whose effect is a safety or regulatory consequence is acted on whatever the product comes to.

The reason is structural rather than cautious. Detection can lower an RPN without changing anything about what happens when the control fails, and severity is the one rating that no control reduces. An item with a severity of 10 and a comfortable RPN is not describing a small risk; it is describing a control that is currently working. Controls stop working. Screening the severity column before sorting on the product catches these, and sorting on the product alone buries them in the middle of the list where nobody reads.

There is no standard threshold

A number such as 100 or 125 circulates widely and no standard sets it.

A threshold is a decision an organisation makes about how much risk it is prepared to carry and how much effort it can spend, and the same number means different things on a fleet of ten machines and a fleet of a thousand. Set one, write down why that number and not another, and revisit it when the list it produces stops being workable. A threshold that generates four hundred actions has not measured risk, it has measured the size of the plant.

What the newer method does instead

The AIAG and VDA handbook replaces the product with an action priority table that looks up the three ratings together, precisely so that a high severity cannot be multiplied away.

The table returns a priority rather than a number, which removes both the false precision of a three digit score and the arithmetic that let detection cancel severity. Where a customer works to that method, its table governs the decision, and a risk priority number is at most a rough guide read alongside it.

A worked example

A failure mode rated severity 8, occurrence 4 and detection 5, against a threshold of 100 taken from your own procedure.

• RPN = 8 × 4 × 5 = 160
• Severity × occurrence = 8 × 4 = 32

160 is above the threshold, so the procedure calls for action on this one. Severity is 8, which does not reach the 9 that outranks the score, so nothing overrides the arithmetic here and the number can be read as it stands.

Now look at what improving the detection alone would do. Taking detection from 5 to 2, by adding a measurement that reliably finds the fault, brings the RPN to 8 × 4 × 2 = 64, which is below the threshold and off the action list. Severity times occurrence is still 32. The failure is exactly as likely and exactly as damaging as it was, and it has left the list. That is not an argument against condition monitoring, which genuinely does move detection. It is an argument for reading both figures before deciding an item is closed.

Frequently asked questions

What is the RPN in an FMEA?

The risk priority number is severity times occurrence times detection. Each of the three is rated from 1 to 10, so the product runs from 1 to 1000. Severity is how bad the effect is if the failure happens, occurrence is how likely the cause is, and detection is how likely the existing control is to catch it first, where 10 means it would not be caught at all.

What is a good RPN threshold for taking action?

No standard sets one. Numbers such as 100 or 125 circulate widely and none of them comes from a published requirement. A threshold is a decision an organisation makes about how much risk it is prepared to carry and how much effort it can spend, and the same number means different things on a fleet of ten machines and a fleet of a thousand. Set it, write down the reasoning, and revisit it when the list it produces stops being workable.

Why read severity times occurrence next to the RPN?

Because it is the risk before any credit is taken for detection. The full product treats the three ratings as interchangeable and they are not: reducing occurrence removes failures, while reducing detection only finds them sooner and does nothing on the day the detection itself fails. Severity times occurrence keeps that distinction visible, and two items with the same RPN can carry very different values of it.

Why does a severity of 9 or 10 need action whatever the RPN says?

Because a failure whose effect is a safety or regulatory consequence is acted on regardless of what the product comes to. Detection can pull an RPN down without changing anything about what happens on the day the control fails, and severity is the one rating that no control reduces. A low score built on a high severity and a good detection rating is describing the control, not the consequence.

What replaced the RPN in the AIAG and VDA method?

An action priority table. Instead of multiplying the three ratings, the AIAG and VDA handbook looks all three up together and returns a priority, precisely so that a high severity cannot be multiplied away by a comfortable detection rating. Where a customer works to that method, its table governs the decision and the product is at most a rough guide read alongside it.