Home / Risk
A rattle and a recall score the same. Until now.
Multiply severity by occurrence by detection and a thousand possible combinations collapse into a hundred and twenty values. RPN 100 — the number most action rules are set on — is shared by twelve of them, with severity running from 1 to 10. Place the ratings instead of multiplying them and every combination gets its own score, with impact dominant by construction. That is RPN+, and adopting it costs nothing: the same ratings, the same tables, one line of elegant mathematics.
1 Rank the impact first
2 State the failure mode
3 The causes
4 Likelihood
RISK REGISTER
Nothing is sent anywhere — this runs in your browser and closing the tab clears it. Use Copy register to keep the result. Scores are relative rankings for one team on one system; they are not comparable between organizations, and they never replace the judgment of the people who know the equipment.
The workflow
Structured Risk Analysis (SRA): two phases, fourteen steps. Preparation establishes what can fail, how badly, why and how often; conclusion prioritizes and acts. The fork comes early, before impact is ranked, because it decides which tables the whole analysis uses: the method changes according to the evidence available — because a counted incidence can only come from defect history, and on a new design nobody has any. Rather than invent a number and multiply it by two real ones, the analysis switches metric and says so. One gate keeps the expensive work for the modes that matter: on impact, and only on impact.
Two decisions doing the work
Most of the boxes above are recognizable practice. These two are not, and they are what the method is for.
The evidence fork
Incidence (Occurrence) is a count. You can only score it honestly if something has occurred and somebody wrote it down. Where that history exists, use it and compute RPN+. Where it doesn't, switch to the Expert Judgment branch, Likelihood and Risk Exposure (RE+), rather than guessing an incidence to keep the formula intact — and drop to a simplified 1–5 scale, because ten grades of a number nobody measured is precision that isn't there and the final consequence is to disqualify using Action Priority. Expert judgment can only return a structured estimate, never a measured rate. The fork chooses the decision method by the evidence available: Branch A decides from what happened; Branch B decides from what could happen. Impact is decided the same way in both. The four conditions that make a defect history, and how each branch decides: the Third step.
Impact decides, so impact goes first
Frequency is survivable. Consequence is not always. A defect that happens weekly and costs an hour is something you schedule around; one that happens every three years and puts someone in hospital, or loses the certification, is the one that ends the business. So impact is ranked before anything else, and low impact exits there like noise. Then why spend resources on cause analysis — long debates, the 6M and the 5 Whys, not to mention the rest of the analysis meetings — on modes that were never going to matter? This is why the next step was born: the first gate. Cause analysis follows only on what survives it.
The first gate: screen on impact, never on frequency
There is one gate and one rule. A failure mode leaves the study only because its impact is too low to matter, never because it happens rarely. Incidence and likelihood rank the modes once each branch is gathered into its list; they order the work and the mitigation choice, and they never remove a mode. Importance is the gate’s cross-check, not a second rule: where RIQ+ Worthiness and impact disagree — a Must screened out, a Could with a catastrophic failure — the gate raises a caveat, the Risk Leader has it settled, and the register keeps who settled it and what was decided. The gate also runs the sanity test early, requirement by requirement, before the cause analysis is paid for; the full test comes at the Eleventh step.
The gate needs an owner, not just a threshold
A complete table is defensible: every mode assessed, standard followed, nobody exposed. A short list is a judgment, and judgments have owners — which is why the instinct to score everything is hard to shift, and why it is not simply timidity. In regulated work an auditor will ask to see that every mode was considered. So screening out has to appear as a documented decision with a threshold and an authority behind it, never as a silence. Set the rule at management level and the analyst is applying a policy rather than defending a personal call. The export here writes the threshold and leaves a line for the signature.
Start with the requirements catalog
Every failure mode hangs off a requirement, so the requirements catalog comes before the risk analysis — and it is the part most teams find hardest.
A requirement written as prose cannot be tested, cannot enter a FAST diagram, and cannot be scored for risk. Written as a function — a verb, a noun, a unit and a tolerance — it does all three. The requirements catalog builder is free and runs in your browser: seven aspects with their characteristics, two hundred function verbs, a hundred and fifty-eight measurable nouns, two hundred unit abbreviations, and a refusal if the requirement cannot be measured.
It is the same catalog the register reads from. One artefact feeding value engineering, function analysis and risk analysis, rather than three documents that drift apart.
Requirements
Requirements are tested before they are filed
Ten checks after ISO/IEC/IEEE 29148: is it verifiable, is the noun a quantity, does the unit fit the noun, is the tolerance usable, is it unambiguous, singular, solution-independent, complete, consistent with the catalog — and three only a reviewer can answer: is it necessary, is the value correct, is it feasible? Advisory: the tool tells you, you decide.
RIQ+ — MoSCoW that actually sorts Importance
MoSCoW puts requirements in four buckets and stops: inside a bucket nothing is ordered, so twenty Musts arrive with no sequence, and the sequence is settled by whoever speaks loudest. RIQ+ extends MoSCoW by distinguishing priorities within each bucket.
This innovative ordering can help teams control scope creep and supports real flexible planning in agile environments. RIQ+ keeps the MoSCoW promise and still sorts inside each letter with a quantifying method to set a rational priority using Worthiness, Effort and Readiness as key factors.
Requirements are ordered, not just lettered. RIQ+ rates every requirement, and the MoSCoW letter is derived from it, never chosen. Two questions come first: why the requirement exists — a need, a hazard, or a life-threatening hazard — and whether it is imposed on you, by law or by contract, with the citation. A life-threatening hazard, or a requirement imposed, is a Must, and its worth is not ticked. Eleven ticks give the letter and a score of 64 distinct values, the catalog sorts by it, and every report prints the ticks behind each score.
What MoSCoW cannot do
- Four buckets with no edges. MoSCoW never defines its letters. No rule says what makes a Must rather than a Should, a Should rather than a Could, or a Could rather than a Won’t, so the letter is argued, not counted, and the most senior voice wins it.
- Won’t means two things. Not now, or never: the same letter for a postponement and a rejection.
- It hides urgency in the letters. A Must often means “needed first”. Urgency is about when, not about how much a requirement matters, so it belongs in a Needed by date, never in the score.
- Its usual patches are worse. Weighted scores, RICE and WSJF divide by effort, so a lesser requirement climbs above a more valuable one, and the ties stay.
RIQ+ answers every one: each letter has a counted edge (the Worthiness ticks), urgency stays a date, and the score is injective, so every combination has its own place and Worthiness always leads. The rating tables for Worthiness, Effort and Readiness are in the Second step of the SRA steps. The defects that rating every requirement by RIQ+ uncovered, one by one: the Expert Corner, the defects nobody wrote down.
1. The score
RIQ+ = 100 × Worthiness + 10 × Effort + 1 × Readiness
Each digit is rated 1 to 4. The ratings are placed, not multiplied, so the score is injective: 4 x 4 x 4 = 64 combinations, 64 distinct levels from 111 to 444, no two the same. It reads back: 342 is Worthiness 3, Effort 4, Readiness 2.
A Could never outranks a Must
Given the same requirements, RICE puts a lesser one above a more valuable one in 7 % of pairs and WSJF in 17 %, because both divide by effort. RIQ+ never does: Worthiness is the leading digit. That is the promise MoSCoW makes and cannot keep.
2. Why placed and not multiplied
With the same population of requirements fed to each method:
| Method | Distinct results | A lesser requirement ranked above a more valuable one |
|---|---|---|
| RIQ+ | 64 of 64 | never |
| ICE | 120 of 1000 | 6.9% of pairs |
| RICE | 191 of 900 | 7.0% |
| WSJF | 230 of 2401 | 16.6% |
Multiplying throws away the identity of the ratings; dividing by effort lets size beat worth. Placing avoids both: RIQ+ is injective, and Worthiness always leads.
The MoSCoW letter stays, the way RPN stays beside RPN+: familiar to read, no longer an input.
Say the failure mode in one line
Most risk sessions stall in the same place: nobody can state the mode clearly. The causes come later, with 6M and 5 Whys, further down this page.
The statement structure
Five parts in a fixed order, one line. Where it comes from: the risk scenario, a reference for newcomers in the Expert Corner. If the failure, exposing the target to the hazard, it will result in the harm or damage, because of the root cause, with this incidence or likelihood. Say it that way and you cannot skip the consequence, which is what impact is actually scored against — a mode written as a bare noun phrase gets ranked on a feeling.
What 6M is actually for
Identifying causes is what it does. Preventing premature convergence is why it is worth doing.
The empty categories earn their keep
The first plausible cause arrives within about ninety seconds of a problem being described, and without a structure the room converges on it. Six categories force a look at five places nobody wanted to look. Much of the value sits in the ones that come back empty, because you can now say you looked.
Where they land is itself a finding
All in Manpower and you are blaming people, and the analysis has not started. All in Methods and it is organizational, so no shop-floor fix will touch it. Spread evenly and it is either systemic or the problem is stated too broadly to analyze. Clustered in Materials and Machinery and it is physical, with an owner and a budget.
Two domains answer who fixes it
Splitting the six into knowhow and physical answers a question the categories alone do not. Physical — Machinery, Materials, Mother Nature — has equipment owners, spare parts and capital behind it, and is closed with a work order. Knowhow — Manpower, Methods, Measurements — is training, procedure, qualification and data, and is closed with a decision. No amount of maintenance moves a knowhow cause, and no amount of training moves a worn bearing.
Measurements is the one that gathers the other five
Measurements is a distinct source, tied to Quality Assurance and cGMP activity, and it integrates the other five categories — which is what stops the same cause being argued over three times. It covers the collection and management of records, tables, key performance indicators, reports, inspection results and any other quantitative or qualitative data taken from process inputs, from the transformation itself, and from process outputs. It covers the devices and procedures used to capture, analyze, qualify and report that data: samples, automated and manual logs, test results, scatter diagrams, and graphical or written information. And it covers the measurement system itself — the condition and qualification of instruments, gauges and physical devices, the test methods, the records, and the inspectors and laboratory technicians who take the readings.
So a reading nobody acted on, a gauge whose calibration lapsed, a sample taken at the wrong point and a KPI that measures the wrong thing all land here, under QC, QA and cGMP, rather than being scattered across Machinery, Manpower and Methods where no one owns them together.
6M and 5 Whys are a pair, not alternatives. 6M gives breadth, 5 Whys gives depth. 6M alone produces a wide, shallow list nobody can act on. 5 Whys alone produces one deep chain that may have started down the wrong branch — ask why a defective product reached a customer and you follow detection; ask why the defect exists and you follow creation. Both are legitimate readings of the same observation, and only the deeper levels reveal that they share a root.
A worked chain from the deck: customers are dissatisfied, because the product is defective, because material quality control is ineffective, because the standards are unclear, because design and production standards are poor, because there is no engineering standards function and no engineering management. The root cause is an organizational gap, not a product defect — and no amount of inspection would have found it.
Three things 5 whys can do for you
It will tell you which cause dominates. That is what the scoring is for, and treating a long cause list as a priority list is the most common way the two get confused.
It can express interaction. Causes that only produce failure in combination appear as two independent entries. There is a way to write the AND between them (one after other), and that AND is often the whole mechanism.
The categories are not mutually exclusive. A gauge that drifted is Measurements or Machinery depending on who is classifying it, and arguing the point is wasted time. When a cause fits two, the useful question is which domain it sits in — who fixes it — not which M it belongs to. This is why the SRA recommendation about the 6M Knowhow and Physical Domains and Measurements covering all aspects of QA, QC, and cGMP exists.
RPN+ and RE+ in detail
RPN+: impact decides, incidence orders, detection breaks ties. RE+: impact decides, likelihood breaks ties. A product collapses the ratings together and cannot be taken apart again. Placing them instead gives every combination its own score, with impact dominant by construction rather than by weighting.
The Same Risk Score Hides a Bigger Danger
A rattling panel that occurs constantly and a catastrophic failure that occurs once in a decade produce the same Risk Priority Number. Placing the ratings instead of multiplying them tells them apart:
| Ratings | RPN | RPN+ | |
|---|---|---|---|
| Trivial, Frequent | I1 N10 D1 | 10 | 201 |
| Catastrophic, Rare | I10 N1 D1 | 10 | 1011 |
| Trivial, Rare, Difficult Detection | I1 N1 D10 | 10 | 120 |
| the same three ratings is the critizism of RPN. | identical | five ranks apart | |
Under RPN these are the same failure mode as far as any sorting or any threshold is concerned, and only one of them can close the business. Under RPN+ the catastrophic one outranks the nuisance by eight hundred, because impact sits in the hundreds column and nothing occurrence or detection can do will reach it. That is the whole change: the ratings are placed rather than blended, so they can still be told apart afterwards.
The elegant mathematics behind the claim at the top of this page:
| Distinct RPN values | 120 of 1000 |
| Combinations sharing a score | 994 |
| Largest single tie | 24 combinations |
The twelve combinations sharing RPN 100 run from severity 1 to severity 10: the threshold everybody acts on cannot separate a cosmetic nuisance from a fatality.
What RPN+ is
100 × Impact (Severity) + 10 × Incidence (Occurrence) + 1 x Detection, running 111 to 1110. Each digit from 1 - 10, to be used if there is a history of defects. Every one of the thousand combinations gets its own score. The coefficients are not weights — they are the smallest separations that stop one rating carrying into the next, which is why they are not open to argument the way a weighting would be.
What RE+ is
10 × Impact (Severity) + 1 x Likelihood (Probability), running 11 to 55. Each digit from 1 - 5, to be used if there is not a history of defects. All twenty-five combinations distinct. The RE product is proportionally worse than RPN — fourteen values out of twenty-five — and it scores a negligible certainty exactly the same as a catastrophic rarity. See next RE+ table.
Risk Exposure+ Impact (Severity) vs Likelihood (Probability) when there is not a defect history. The colors in this figure are a remainder of the lack of precision of a very old compass that misled the evangelists of risk and failure since the MIL-STD-1629 and nobody dare to "root cause it"."
What detectability does
In the RPN+ path it takes the units digit, because a mode you cannot detect is genuinely worse — it can break a tie, never outrank incidence or impact. In the exposure path it is not scored: there is no product and no control to rate yet. It is designed instead, as the Detection Provision — how the failure will announce itself — and it still governs the mitigation choice: prevent it, detect it, or both.
Why not just weight it
Weighting reduces the collisions and never removes them: severity squared still leaves 994 combinations tied with something, and the first reviewer asks why that exponent and not another. A weight is a judgment and can be argued with. These coefficients are the smallest values that stop one rating carrying into the next — there is one correct answer and it is elegant mathematics.
It reads back
Impact 7, incidence 5, detection 4 scores 754. The number carries its own ratings, so a score in a report can be checked without opening the register. That holds for every rating below 10, and RE+ always reads back because both its scales are single digit.
The two also run on different ranges — RPN from 1 to 1000, Risk Exposure from 1 to 25 — so they are different scales twice over and must never be sorted into a single list. A register that mixes them produces a ranking where position depends partly on which method was used, which is exactly the invisible distortion the fork exists to avoid. The register above keeps them apart.
What it costs
It costs nothing to adopt. The same three ratings, the same tables, the same scales. No new judgment is required of anyone, and the classical figure still appears beside it for whoever asks. This is elegant mathematics, not a method change.
The products are still reported. Customers ask for them and suppliers report them, so RPN and RE appear in brackets beside every plus score. But the ranking is on the plus score, because a product cannot order what it cannot tell apart. Sorting a register by RPN descending is sorting by a number that has 120 rungs for a thousand things.
Worth being straight about what this is and is not. The plus scores are an ordering, not a magnitude: 1011 is not ten times worse than 101. RPN claims to be a magnitude and fails at being either. The same trade appears elsewhere on this site — a surface finish specified before the feed is chosen, a tool life measured rather than assumed. Giving up a false precision to get a true one.
RPN+ and Action Priority
The AIAG & VDA handbook retired RPN in 2019 for the same reason this page exists, and gave severity the dominance it deserved. That diagnosis was right. The cure was a lookup table with three answers.
- Three answers for a thousand cases. Action Priority says high, medium or low. Forty modes arrive as "high" with no order among them, and teams fall back to sorting them by RPN, bringing back every flaw the change was meant to remove. RPN+ gives every mode its own place.
- It needs an occurrence nobody has. On a new design there is no history, and the handbook has no way to record that the occurrence was guessed. The fork was built for exactly that gap.
- It cannot be checked by hand. A published table versus one line of elegant mathematics that reads back as its own ratings.
SRA has retired Action Priority. Where a customer contract still requires an Action Priority deliverable, supply it — required by contract, not by reason — and rank inside each band with RPN+. The full comparison, row by row with the worked cases, is in RPN+ against Action Priority; the case against the legacy methods, exhibit by exhibit, is in the Expert Corner.
The consistency test: RIQ+ against RPN+ and RE+
The same judgment is made twice, at two levels, by people looking at different things. Where the two disagree, one of them is wrong — and that is worth knowing before the register is signed.
Two judgments, one object
RIQ+ ranks the requirement: how much it is worth and how far that worth reaches. RPN+ and RE+ rank what happens when it fails. Nobody sets out to contradict themselves, but the two are usually rated in different sessions, from different evidence, and often by different people. Comparing them costs nothing — the numbers are already there.
What a match tells you
A Must have whose worst failure mode is catastrophic is coherent: the worth and the consequence agree, and the ranking can be trusted. A Could have whose worst mode is a nuisance is equally coherent. Agreement is not proof the ratings are right, but disagreement is near proof that one of them is wrong.
What a mismatch means
Two shapes, two different errors. Importance high, impact low: the requirement is called a Must, yet nothing that fails about it does much harm — so either it is not really a Must, or the consequences are being under-rated. Importance low, impact high: a Could have carries a mode that can hurt someone — something that dangerous is not a nice-to-have, and the requirement is misclassified.
The bands. A Must is expected to carry a worst mode of impact 7 to 10, a Should 4 to 8, a Could 2 to 6. The ranges overlap on purpose: the test is meant to catch the contradiction, not to police every judgment. A Won't have with any scored mode at all is flagged outright — a requirement nobody will do should have no failure modes attached to it.
What can go wrong, and what the test does about it. The usual failure of an FMEA is not bad arithmetic; it is an input nobody questioned. A requirement is called a Must because it was written by the customer, while its modes are rated by someone who has never seen a failure. Or the modes are rated honestly and the importance was inherited from an old document. Neither error shows up in any score, because both sides are internally consistent. The test catches them by crossing the two.
And what it deliberately does not do. It changes no ranking, moves no number and blocks no sign-off. It produces findings — the requirement, the mismatch, and why it matters — and a person decides. Automating the correction would be the wrong move: the test cannot know which of the two ratings is the wrong one, and guessing would replace a visible disagreement with an invisible one. The same applies to the spread check: when one requirement carries both a catastrophic mode and a trivial one, the requirement is probably two requirements, and only an engineer can split it.
It runs on the Consistency check button, and the findings print in the report beside the evidence checks, so an auditor reads what was questioned as well as what was decided.
The best part. A saved trip to the library to dust a hard cover Manual to uncover such interesting sanity test.
The register application
The method above is the point; this is the state of the tool that runs it. It is a desktop application: one analysis file per site, no server, no account.
A risk study generates far more than a ranking, and almost all of it is thrown away. The tables record the conclusions and lose the reasoning — which is why the same failure mode gets argued from scratch at the next review, and why a study nobody can reconstruct gets redone rather than updated.
The record
It saves itself
There is no save button. Every change is written as it is made, and an unfinished failure mode survives closing the window. A mode is filed in the analysis by itself once it is complete — requirement, ID, description, effect and score.
It keeps what forms discard
Which branch each score came from. What was screened out, by whose authority, under which threshold. The 6M category and the 5 Whys chain behind a cause. What changed between revisions and why. A standard FMEA sheet has a column for none of it.
Search instead of a second register
One box searches every analysis in the file: failure modes, causes, controls, actions, reviews, requirements and the people named in them. The questions that serious management should be asking about risk continuously are included in ready-made searches: what is overdue, what is due for review, which critical risks carry no action, and which controls nobody has verified. A result opens the analysis at that very row.
Governance
The criteria are written down
Rule 0, impact 1 is always screened out, then the screening gate, the act-regardless threshold, the evidence thresholds, the review interval and the committee dispute spread. They belong to the organization, are printed in every report, and are changed only by the criteria manager, inside the tool, as a new table version.
The tables belong to the company
No two organizations mean the same thing by an impact of 7. Every published 1–10 scale is somebody's industry presented as a universal. So the tables are set once at corporate level, and then everyone is held to them: rules, verbs, nouns, requirement domains and aspects, the impact, incidence, likelihood and detectability wording, and the cause descriptions, all edited in the tool by the criteria manager. Anything typed in because a list lacked it waits as a proposal for them to accept, correct or reject. Consistency comes from a fixed local standard, not a borrowed global one.
Someone owns it
A Risk Leader holds the tables, the thresholds and the register itself — the same authority the gate needs, so screening out is a published rule rather than a personal call. Tables are versioned rather than overwritten, and every score records the version it was given under, so an old report still means what it meant.
Sign-off is the only formal act
When the analysis is ready, an approver signs it off: the decision on the residual risk, with a name and a date, and the whole analysis frozen as a numbered revision that can never change. Work continues on the working copy, and the report says on its face which one it is. That signature is on the residual risk planned. Once the actions are done, each mode is re-rated on its evidence, and the residual risk achieved is signed again: the Fourteenth step sets out how.
Evidence and monitoring
A rating is a claim; a control is the evidence
A low incidence with no prevention control, a good detectability on an unverified method, a control checked more than a year ago, a critical mode with no action, an action done but never re-rated, a review overdue: the tool names each one as a finding, and the report prints them.
Monitoring, not just scoring
Each mode carries its controls with the date they were last verified, its actions with owner and due date, and its reviews of whether the action worked, each setting the next review date. Scores are kept as a history, so the report shows the risk before and after the action.
The team is on the record
Who took part, and what they speak for. A mode can be scored as a committee — one rating per person, the safer of the median and the average rounded up scored, every vote kept — and a wide spread of impact is flagged as disputed, because that is where the misunderstanding is.
Everything the analysis holds is in one file, so a report can be printed at any time and a signed revision reprinted exactly as it was signed. Nothing is sent anywhere.
The report is then a view, not a document. Print it as often as it is needed, for the review, for the auditor, for the board — always from the same register, always current, never a copy that drifted.
Working sessions
The register handles the elegant mathematics. The hard part is getting a room to say out loud what can go wrong, and to admit which failure modes have no history behind them. That is where an outside facilitator earns the cost. I run risk workshops on site or remote.
Examples that get a session moving
All tools included in the SRA not just save time, they have plenty of examples to trigger momentum, clarity, and stronger ideas from your team particularly your brainstorming sessions.
These examples provide a practical starting point for your creative thinking. Well-chosen examples give individuals and teams a shared reference:
- Reducing ambiguity
- Making it easier to move from abstract discussion to actionable ideas
- Promote real-world solutions, increasing the likelihood that promising becomes practical
- Inspiring new thinking, helping participants visualize possibilities and build on proven approaches
- Creating shared context: Real-world applications clarify concepts and align the group around a common understanding
- Introducing diverse perspectives, mixing different fields encourage participants to challenge assumptions and explore unconventional solutions
- Used effectively, examples help teams reduce the frustration and fatigue that often come with stalled brainstorming sessions
- Building a culture where innovation is not treated as a special event, but as an everyday organizational capability
RPN+, RE+ and RIQ+ are free to use
Free for anyone to use. No patent has been sought and none will be.
Anyone may implement RPN+, RE+ and RIQ+ — software vendors, standards bodies, consultancies, end users — without permission, license or fee. The technical note is published to establish prior art, so that the method cannot later be patented by anyone and withheld from use. A formula is not subject to copyright in any case; the statement is made to remove doubt rather than to grant a right that would otherwise be withheld.
The only thing asked in return is credit:
Where the method is implemented, described or taught, please attribute it as:
RPN+ and RE+, from Structured Risk Analysis by Jorge A. Parra.
They provide clear, tie-free risk rankings with distinct scores that prioritize impact.
RIQ+ — Requirement Importance Quantified, from Structured Risk Analysis by Jorge A. Parra.
It orders requirements inside each MoSCoW letter without ties, worthiness first.
The technical note sets out the derivation of the coefficients, the full enumeration behind every figure quoted on this page, and a statement of what in the method is prior art and what is not. The note is © 2026 Jorge A. Parra and licensed CC BY 4.0: it may be copied, adapted and built on, commercially or not, with credit.
Where this came from, and what to read next
Requirements catalog
Where every study starts: functions written as verb, noun, unit and tolerance, with a success criterion, and ranked with RIQ+.
The SRA steps
Fourteen steps from the requirement to the effectiveness review, with the fork, the impact gate and the consistency test in their places.
Expert Corner
The legacy on trial with its own arithmetic, how practitioners carry their experience across, and the job description of the SRA Auditor.
Although MIL-STD-1629A has been retired, it remains influential because it established core FMEA/FMECA procedures. The multiplied scores that grew out of that tradition — the RPN and the Risk Exposure product — do not provide a reliable point of reference for comparing the true direction and magnitude of risk. As a result, organizations have developed numerous methods to compensate for their limitations, increasing the complexity, cost, time, and potential for error of criticality studies.
The method on this page argues with some of these documents and leans on others. Either way they are the primary sources, and an engineer deciding whether to trust RPN+, RE+ and RIQ+ should read them rather than take this page's word for it.
| Standard | Access | What it is |
|---|---|---|
| ISO 31000 — Risk management, guidelines | paid | The vocabulary and the framework the rest borrows. Paid. |
| IEC 60812 — Failure modes and effects analysis | paid | The FMEA standard itself, third edition 2018. This is the document behind the RPN arithmetic argued with on this page. Paid. |
| IEC 31010 — Risk assessment techniques | paid | Thirty-one techniques and when each one fits. Paid. |
| AIAG & VDA FMEA Handbook | paid | The 2019 automotive seven-step method and Action Priority, which this page compares RPN+ against. Paid. |
| SAE J1739 | paid | The older North American automotive FMEA practice. Paid. |
| ISO 14971 — Risk management for medical devices | paid | Out of scope for this tool, and named here because people ask: this method is not a substitute for it. Paid. |
| Source | Access | What it gives you |
|---|---|---|
| ICH Q9(R1) — Quality Risk Management | free | The cGMP backbone, free as a PDF. The reason Measurements sits with QA on this page. |
| ICH — guideline page and training material | free | The briefing pack and the training slides that go with Q9. |
| NASA Risk Management Handbook | free | Free, readable, and unusually honest about what risk management cannot do. |
| US FDA | free | Guidance on quality systems and process validation, free. |
| Bosch — Problem Solving (Quality booklet 16) | free | Bosch's structured problem-solving methods, as it trains its own suppliers. Free PDF. |
| Bosch — Failure Mode and Effects Analysis (Quality booklet 14) | free | Bosch's FMEA method as it trains its own suppliers. Free PDF. |
| Tool | What it does |
|---|---|
| APIS IQ-RM | Structure trees, failure nets, AIAG-VDA conformance. |
| Plato SCIO | The other established European FMEA suite. |
| HBK ReliaSoft XFMEA | FMEA alongside reliability prediction and life data analysis. |
| Isograph | Reliability Workbench, FMECA and fault trees. |
| Siemens Opcenter | FMEA inside the wider quality and manufacturing suite. |
On the paid ones. Most of the standards cost money, and there is no free copy that is also legitimate. If you only read one, read IEC 60812: it is the document that defines the RPN this method replaces, and the collision arithmetic above is checkable against it.
On the other tools. They are listed because the comparison on this page is worth checking. APIS and Plato do things this tool does not — structure trees, failure nets, AIAG-VDA conformance — and for an automotive supplier under IATF 16949 that difference decides the choice. Unrival Tools is not affiliated with any of them and the names are their trademarks.