故事 · 从导弹到阿波罗的「先想坏」
Origin Story · "Imagine It Broken" — From Missiles to Apollo
FMEA 诞生于 1940-1960 年代的美军与航天:导弹、阿波罗登月这类系统,一旦失效就是人命和巨款,
根本没有「出事再修」的机会。工程师于是反过来想 —— 在画完图纸之前,先把所有「可能怎么坏」一条条列出来,
再问每条:坏了多严重(S)、多常发生(O)、现有手段能不能提前发现(D)。
三个分一乘,得到 RPN,谁高先治谁。后来这套方法被汽车业(尤其丰田、福特)发扬光大,
分成盯设计的 DFMEA 和盯工艺的 PFMEA,写进了行业标准(AIAG-VDA)。
它的精神只有一句:与其事后救火,不如事前把火源排好队,一个个掐掉。
FMEA was born in the US military and aerospace programs of the 1940s–1960s. For systems like missiles and the Apollo lunar mission, a single failure cost lives and fortunes —
there was no "fix it after it breaks" option. Engineers flipped the question around: before the drawings are even done, list every way it could fail,
then ask of each one: how bad is it (S), how often does it happen (O), can current controls catch it early (D)?
Multiply the three to get the RPN, and treat the biggest first. The automotive industry — Toyota and Ford in particular — then took the method mainstream,
splitting it into DFMEA for design defects and PFMEA for process defects, eventually codified into industry standards (AIAG-VDA).
The spirit is one sentence: instead of firefighting after the fact, queue up every ignition source beforehand and snuff them out one by one.
1 风险优先数排序:调 S/O/D,看队伍重排 RPN Ranking: Move S/O/D, Watch the Queue Re-sort
拖 S/O/D 滑块Drag the S/O/D sliders每根条是一个失效模式,长度 = RPN(S×O×D),按高到低排序。红色是高危(≥100)。点条或左边下拉选中它,调三个滑块,看它在队伍里升降。 Each bar is one failure mode; bar length = RPN (S×O×D), sorted high to low. Red marks high risk (≥ 100). Click a bar or pick from the left dropdown, move the three sliders, and watch it climb or fall in the queue.
2 三个维度 + 两种 FMEA Three Dimensions + Two Flavors of FMEA
严重度 S:失效后果有多惨(1 无感 ~ 10 危及安全)。设计难降,常靠避免该失效本身。
Severity (S): how bad the consequence (1 = unnoticed, 10 = safety-critical). Hard to lower in design — usually you eliminate the failure mode itself.
发生度 O:多频繁发生(1 极罕见 ~ 10 几乎必现)。靠提升设计/工艺稳健性来压。
Occurrence (O): how frequent (1 = extremely rare, 10 = almost certain). Lowered by making the design or process more robust.
探测度 D:现有手段多难提前抓到(1 必被发现 ~ 10 根本测不出)。加检测/防错最易降。
Detection (D): how hard current controls catch it (1 = certain to find, 10 = impossible to detect). The easiest to drive down — add inspection or poka-yoke.
DFMEA vs PFMEA:前者查设计是否埋雷,后者查制造工艺是否会做坏。两者互补。
DFMEA vs PFMEA: the former checks whether the design itself plants traps; the latter checks whether the manufacturing process will build it wrong. They are complementary.
3 现实里的 FMEA FMEA in the Wild
汽车安全件:刹车、安全气囊的 DFMEA,S 几乎是 10,逼着设计从根上避免该失效。
Automotive safety parts: in DFMEAs for brakes and airbags, S is basically 10, which forces the design to eliminate the failure mode at the root.
装配工艺:PFMEA 排查漏装、错装、扭矩不足,靠防错(Poka-Yoke)把 O 和 D 一起压低。
Assembly processes: PFMEAs hunt for missed parts, wrong parts, and under-torqued fasteners; poka-yoke drives both O and D down at the same time.
医疗器械:高 S 失效要求把 D 降到极低 —— 多重检测确保「即使发生也必被拦下」。
Medical devices: high-S failures demand near-zero D — layered detection ensures "if it does occur, it gets caught".
设备维护:用 RPN 排序决定预防性维护优先级,把有限资源压在最危险的部位。
Equipment maintenance: RPN ranking sets preventive-maintenance priority, focusing scarce resources on the most dangerous components.
一句话In One Line
FMEA 的精髓,是把「凭感觉觉得哪儿危险」变成「用 S×O×D 算出来谁最该先治」。
三个维度里,严重度 S 往往最难降 —— 一个会致命的失效,后果就是那么惨,
所以高 S 项常要靠重新设计去彻底避免该失效发生;
而探测度 D 通常最划算:加一道检测、做一个防错,就能让「即使坏了也立刻被拦下」,RPN 应声而降。
这就是为什么有经验的团队拿到 FMEA,第一刀常砍向 D。
但要记住:RPN 只是排序的算盘,不是绝对真理 —— 一个 S=10 的安全风险,
哪怕 RPN 不是最高,也必须优先处理。算法服务判断,别让判断被算法绑架。
The essence of FMEA is replacing "a gut feeling about what's dangerous" with "a S×O×D number that says who to treat first".
Of the three dimensions, Severity is usually the hardest to lower — a lethal failure is a lethal failure,
so high-S items typically require a redesign that eliminates the failure mode altogether.
Meanwhile Detection is usually the cheapest win: add one inspection or one poka-yoke and "even if it breaks, it gets caught" — RPN drops on cue.
That is why seasoned teams swing the first axe at D.
Just remember: RPN is a sorting abacus, not absolute truth. An S = 10 safety risk
must be tackled first, even when its RPN isn't the largest. The algorithm serves judgement — never let judgement be hijacked by the algorithm.
常见误用Common Mistakes
只看 RPN 总分,忽视高 S 项。严重度高的安全风险必须优先,哪怕 RPN 不是最大。
Looking only at RPN totals while ignoring high-S items. High-severity safety risks always go first, even when their RPN isn't the largest.
FMEA 做完归档就不再更新。它是活文档,设计/工艺一变就要重评 S/O/D。
Filing the FMEA away once it's written. It's a living document — re-score S/O/D every time the design or process changes.
评分凭一人拍脑袋。用统一评分准则、跨职能团队评,分数才一致可比。
One person scoring on a hunch. Use a shared scoring rubric and a cross-functional team — only then are scores consistent and comparable.