The severity is a ten. The control plan isn't.

Here is an uncomfortable piece of arithmetic. No part on a car carries more analysis than the brake pedal. Severity 10 in every passenger-vehicle DFMEA, entire chapters of customer-specific requirements devoted to it, design reviews that argue over it for months. This week it failed in the field anyway – in a six-figure luxury Chinese electric SUV, in more than one vehicle, loudly enough that the South China Morning Post is covering it and a regulator is circling. Stop asking whether the FMEA was thorough enough. It was. Ask instead where the designation went.

The timing is not incidental. The same week, Chery's Omoda 5 lost its vehicle type approval over a rear-axle issue, new registrations frozen until the company proves the fix. Regulators have moved from recalling cars to suspending permission to sell them. That is a different sport, and it punishes a different failure: not the one the analysis missed, but the one the paperwork failed to carry downstream.

What a severity-ten part is supposed to look like

Every mature OEM has a grammar for it – inverted triangle, arrow in a diamond, a bold S, whichever alphabet the customer's manual runs on. The symbol is not decoration. It obligates a chain: capability targets above the ordinary, 100% control or a poka-yoke that makes the failure impossible rather than merely detectable, a reaction plan that stops the line rather than quarantines a sample, traceability to shift, machine and heat lot, notification rights over any change touching the characteristic.

I wrote control plans from scratch at SNOP, building the quality function for a greenfield plant of 900-plus people – no legacy documents to hide behind, no inherited symbols to trust. One lesson, worth carving into every quality director's desk: deciding which characteristics earn special controls is the most consequential decision you make. Every symbol is a promise of machinery, containment and traceability that someone downstream has to keep. A control plan is a contract with people you will never meet.

Where the designation goes to die

Trace the part two steps down. The OEM's DFMEA says safety. The tier-1 pedal-box supplier's control plan says safety – symbols in the header, a poka-yoked station, a safe-launch containment protocol. Then the pedal arm or bracket goes out to the tier-2 that actually forms, casts or welds it. What arrives there is a drawing with tolerances, a PPAP package and a purchase order.

Print tolerance is not a safety designation. A tier-2 welding to a ±0.5 mm dimension has no way of knowing that minimum weld penetration is the difference between a hard pedal and a dead one. The severity lived in the OEM's FMEA, was referenced in the tier-1's control plan, and arrived at the last machine as geometry.

And nobody audits that machine. Certification audits stop at the certificate holder. Second-party audits sample tier-2s rarely, and usually after an escape. I ran VDA 6.3-style process audits that followed the designation below the tier-1 instead of stopping at its wall of symbols – process questions asked at the sub-tier, parent PFMEA in hand, unannounced.

I have also run the 8Ds that come when you don't. Field escapes traced back to sub-tier suppliers who never knew they held a safety-classified characteristic. They learned of their designation from my corrective action, which is the most expensive way in this industry to issue one. Keeping a quarter at zero critical customer escalations was not the product of nothing going wrong. It was the product of chasing the chain to the last machine before the customer had to.

A safety designation that stops travelling at the tier boundary was never a control – it was a watermark.

How to test the cascade before the regulator does

Three tests. None requires a certificate.

Walk the symbol to the last forming station. Stand at the weld cell or press that last touched the characteristic and ask the operator what a bad one costs. A blank stare means the cascade is dead, whatever the control plan header says. The symbol has to survive translation into one person's understanding, or it has not survived at all.

Second, read the tier-2's control plan against the parent PFMEA, line by line. Does the sub-tier plan reference the same failure modes, or only the dimensional ones? The reaction plan has to live somewhere outside the binder – in the andon logic, the quarantine rule, the ERP stop – because a control that exists only on paper controls nothing.

The third test is change-point management, because the classic escape is a weld-parameter optimisation nobody classified as significant. A cycle-time win, a new wire feeder, a cheaper consumable – all inside tolerance, all unvalidated. Pull the tier-2's change log and cross-reference every change touching the characteristic against revalidation records. A thin log is not tidiness. It is invisibility.

The economics are not close. A day of auditing at a tier-2 costs a few hundred euro. A brake-pedal field campaign runs nine figures before the lawyers arrive; Stellantis is carrying a €4.1 billion quality bill on older vehicles right now, with a century of institutional memory and armies of supplier-quality engineers. A new ISO 9001 revision lands this quarter, and so does a wave of AI supplier-quality tooling. Neither moves a symbol across a tier boundary. That still takes a person, a print and a question.

The luxury EV with failing brake pedals was well analysed, I'd wager. Somewhere sits a DFMEA of genuine quality – a ten in the severity column, reviewed, signed, defended. The escape was administrative: a designation that evaporated at a tier boundary, a symbol that never became a control, a weld parameter that changed without anyone knowing it was load-bearing. Regulators have grasped this faster than the industry has. They no longer recall the car; they suspend the approval, and the certificate on the wall covers none of it. Conformity lives at the last machine that touches the part. Go find yours before the regulator does.