The severity is scored. The safeguard isn't.

There is a particular silence on a plant floor when every end-of-line test passes. Green lamps, a clean shift report, nobody arguing at the andon board. After two decades running quality in automotive and aerospace plants, I distrust that silence more than any alarm – it usually means the tests are photographing the present while the failure lives in the future. This week Honda recalled more than 635,000 vehicles over a steering defect that increases crash risk, and the industry reflexively asked the familiar first question: what failed? Wrong first question. The right one – the only one a control-plan author can act on – is which control could, even in principle, have caught a severity-10 failure mode before 635,000 units shipped. I have no inside information on Honda's root cause and will not invent one. Escape paths, though, are generic. That part I can dissect.

The physics a test stand cannot photograph

An end-of-line function test is a snapshot taken at kilometre zero. The rack moves, the torque sits in tolerance, the diagnostic handshakes clean – and the unit ships. Nothing in that snapshot sees torque drift, gear wear, grease migration or corrosion, because those are functions of time, load and environment. They pass today and fail at 40,000 km, on a motorway, in the rain, with a family inside. Sampling does not rescue you either. It detects variation across a population, not degradation along a timeline. Two different physics. Two different controls.

Now open the PFMEA. Loss of steering scores severity 10 with no warning – everyone in this industry scores it that way, and they are right to. Then look one column right in the control plan: "100% end-of-line function test." The plant feels safe. 100% sounds like certainty. But a 100% test that sees only kilometre zero detects 100% of the past and 0% of the future. When your only interceptors are snapshot controls and the failure mode is wear-out, the escape is not a risk event – it is a schedule.

Severity is scored in the FMEA and paid for in the field – the control plan sets the exchange rate.

What a severity-10 control chain looks like

Prevention comes before detection, or the detection is decoration. For a wear-driven safety characteristic the chain runs in a fixed order. Design margins proven against worst-case duty cycles: salt, dust, temperature swings, torque spikes, fifteen years of bad road. Capability studies on the parameters that drive degradation, not on final function. Poka-yoke wherever assembly allows, so a missing grease fill or a wrong preload cannot physically occur. Then, and only then, detection. Cpk on a kilometre-zero function test tells you the part was good when new. It says nothing about the slope.

I lived this at WITTE Automotive, on latch and locking mechanisms – textbook severity-9 and severity-10 parts. The end-of-line function test passed everything, serenely, while the actual wear-driver, heat-treat hardness, drifted quietly upstream. The fix was not a fourth inspection station. It was SPC on the driver itself, backed by Q-Wall, QRQC and A3 discipline, so that drift triggered a reaction the same shift, not the same fiscal year. That is where the substantial failure-cost reduction came from: cents of control at the furnace against hundreds of euros per vehicle in the field.

SNOP taught me the same arithmetic at the scale of a 900-plus-employee plant. Our 70% defect-cost reduction came from controlling upstream parameters, not from buying more final inspection. Final inspection is the most expensive place in a plant to learn physics.

The audit question that separates paper from control

Here is the exercise I would run in any plant or supplier. Pull the control plan. Find every severity-10 and severity-9 line. For each, one question: which of these controls could catch a failure that needs 40,000 km to develop?

Go down the column honestly. If the truthful answer is "the customer", you are not looking at a control chain. You are looking at a deferred recall. The best quarter I have closed on critical customer escalations – zero of them – was won in columns like these, not at final inspection.

This is where IATF 16949 and VDA 6.3 stop being paperwork and become a lever. The logic of both is that a special characteristic must trigger distinct actions – specific controls, specific frequency, a defined reaction plan, traceability – not a highlighted row with a symbol in the margin. A highlighted row is typography. Too many organisations have turned the whole thing into a scoring ritual: severity gets its honest 10, detection gets its optimistic 2, the audit passes. And a 100% end-of-line test on a wear-out mode is a very precise photograph of the unit's first day – rather like vetting a marathon runner with a birth certificate.

The regulator will run the audit either way

The same week, Chery South Africa recalled nearly 24,000 vehicles with a regulatory investigation attached – and the attachment is the real news. Regulators are beginning to ask not only what failed, but why the safeguard chain behind the severity score did not hold. That is a severity-to-safeguard audit, run on a company from the outside. Fleet telemetry makes such a recall smaller and faster to bound. It has never once stopped a defect from shipping. It is the last net, not the strategy.

So run it yourself first. One afternoon, one control plan, one honest question per line: what exactly catches this at 40,000 km? Special-characteristic governance stopped being a scoring exercise the moment steering defects began shipping at six-figure volume with a perfect severity 10 sitting in the FMEA in ink. The score was written. The safeguard wasn't. Until the control plan answers the physics, a green end-of-line board is not a verdict – it is a countdown running politely in your favour.