Your FMEA scored the risk as acceptable. The physics disagreed.

Here is an uncomfortable observation. Ford issued two recalls in the same week for two completely unrelated failure modes on two different vehicles. A pinion shaft fracturing under torsional load in 42,784 Mach-Es. Wipers that refuse to slow down in cold weather across 110,626 Mustangs. Two systems. Two physics problems. Two teams. One scoring methodology that looked at both and wrote acceptable.

I have run PFMEAs under IATF 16949 at Witte Automotive and SNOP. I run them now under AS9100 at Airbus. Same form. Same columns. Radically different culture. When I see recalls cluster across unrelated subsystems in the same window, I don't see bad engineers. I see a degraded scoring process that was always going to surface multiple failure modes at once, because the same optimism was applied to each one independently. The common failure mode is the methodology. Not the parts.

A pinion shaft is first-year mechanical engineering

Cyclic torsional load on a shaft is textbook stuff. You calculate the alternating shear stress, apply your fatigue concentration factors, compare against endurance limits, and either specify a material and heat treatment that survives the duty cycle or you don't. This isn't emergent behaviour nobody could anticipate. It is deterministic mechanics.

So how does it get through a DFMEA? Easy. Occurrence scored at 2. Detection at 3. Severity, yes, high—because a fractured pinion shaft on an AWD crossover means rollaway. But the RPN math gives you a number that sits below the action threshold, because two low scores multiplied by a high score still looks manageable on a spreadsheet. The failure mode gets listed, which satisfies the form. Then it gets buried under scoring that reflects what the team believed, not what the bench test demonstrated.

I have seen this pattern for twenty years. At SNOP I inherited FMEAs where every occurrence was scored 2 and every detection was scored 3. Beautiful documents. Useless. We cut defect costs by 70% not by rewriting the forms but by forcing every low score to carry test evidence or production data. No data, no low score. That rule changed the engineering conversation more than any software tool ever could.

Why aerospace doesn't tolerate this gap

Under AS9100, the cultural distance between we believe this won't fail and we have evidence this won't fail is enforced every single day. There is no recall window in aviation. A shaft fracture in service is not a warranty event. It is a board meeting, an investigation, potentially a grounding. That asymmetry shapes the FMEA culture from the first row of the sheet.

When I joined Airbus, the expectation was clear. The 50% reduction in EASA audit findings in one cycle didn't come from a new template. It came from treating the FMEA as a live engineering document that had to survive confrontation with reality—bench data, supplier PPAP evidence, production run charts. Automotive has the same IATF 16949 requirement in principle. In practice, the compliance audit checks whether you have an FMEA, not whether it is honest. The gap between IATF 16949 and AS9100 is not in the clause structure. It is in what the auditor is empowered to challenge.

An FMEA that never failed an audit but couldn't predict a field failure wasn't a risk analysis. It was a story the team told themselves in a language the auditor accepted.

The scoring disease

Here is how it progresses. A DFMEA is opened as a compliance artefact for a gate review. The cross-functional team sits in a room. Someone who designed the part scores occurrence at 2, because they are confident in their design and—honestly—who scores their own work a 4? Detection gets a 3 because there is a test planned. The RPN lands at a comfortable number. The form is filed. The gate is passed. The failure mode is now administratively closed.

Then physics delivers the field data nobody wanted. The pinion fractures. The wiper motor stalls in Minnesota in February. The FMEA gets reopened, scores revised upward, corrective actions issued—and you are running QRQC and A3 on a problem the FMEA should have prevented. I have been that person standing at the QRQC board at six in the morning, working the 8D on a failure mode that scored remote on paper and inevitable in the field.

QRQC discipline exists precisely because FMEA scoring culture suppresses what daily production reveals. When you run it properly—forced containment within one hour, cross-functional escalation, root cause on the shop floor—you are compensating for the gap between what the FMEA promised and what the process actually delivers. At Witte Automotive I used A3 to surface exactly these disconnects: the FMEA said the process was capable, the A3 told the story of why it wasn't. Both tools are valuable. Neither is a substitute for an FMEA that tells the truth.

The FMEA didn't fail because the engineers didn't know the failure mode. A first-year textbook covers pinion shaft fatigue. It failed because the methodology rewarded the optimistic number and nobody was required to defend it with evidence. The fix is not a new form, a new software platform, or an additional column. The fix is a culture that makes someone walk into the FMEA review with test data or sit down and explain why the score is a 2. That conversation—the one where confidence meets evidence—is where the recall is prevented or enabled. Everything else is paperwork around that moment.