Design for Quality and Risk Management

Introduction

Quality is created primarily during product and process design, not inspected into a finished product. Design decisions determine materials, tolerances, operating conditions, maintenance requirements, safety exposure, manufacturability and the customer’s experience throughout the product life cycle. Consequently, production managers must connect customer requirements with engineering characteristics, process capability, reliability and risk controls.

Design for Six Sigma (DFSS) provides a structured approach for preventing defects before production begins. Its principal framework, DMADV—Define, Measure, Analyse, Design and Verify—is particularly suitable when a new product or major redesign is required. Complementary methods include robust design, quality function deployment, design and process failure mode and effects analysis, fault-tree analysis, control plans and reliability engineering.

Risk management does not mean eliminating all uncertainty. It means identifying uncertainty, estimating its consequences and likelihood, selecting proportionate controls, and monitoring residual risk. Effective decisions therefore combine technical evidence, customer needs, legal duties, economic consequences and ethical considerations.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose and stages of DFSS and DMADV.
2. Translate customer requirements into measurable design specifications.
3. Apply robust-design principles to reduce sensitivity to variation.
4. Construct and interpret FMEA and fault trees.
5. Distinguish reliability, maintainability, availability and failure rate.
6. Develop a control plan across the product and process life cycle.
7. Make risk-based decisions using evidence, severity, likelihood and detectability.
8. Evaluate the limitations, governance requirements and ethical implications of quality-risk methods.

1. Design for Six Sigma and DMADV

Traditional Six Sigma DMAIC improves an existing process whose performance can be measured. DFSS is used when a product, service or process is new, fundamentally changed, or incapable of meeting requirements through incremental improvement. The aim is not simply a low defect rate; it is a design that is inherently capable, reliable, safe and economical.

A common conceptual relationship is:

The DMADV framework

The phases are iterative rather than strictly linear. Verification may reveal that a customer requirement was misunderstood or that a design interaction was overlooked. A disciplined team therefore maintains traceability from each requirement to a test or acceptance criterion.

Define: establishing value and boundaries

The project charter should identify the customer, intended use, constraints, expected benefits, schedule, resources and decision authority. Stakeholder analysis is important because the user, purchaser, regulator, maintenance technician and manufacturing operator may have different quality expectations. A product that satisfies the buyer but is unsafe to service is not a successful design.

Measure: converting voice into CTQs

The voice of the customer may be collected through interviews, observation, complaints, warranty analysis, market research and regulatory review. Statements such as “the equipment must be easy to use” are not directly testable. They must be translated into critical-to-quality (CTQ) requirements, such as maximum setup time, allowable force, response time or error rate.

A CTQ tree typically moves from need to driver to measurable requirement:

Figure: Translating a vague customer need into measurable CTQs.

A measurement definition must state the characteristic, instrument, method, sampling point, units, acceptance limits and conditions. Measurement-system capability must be considered; an unreliable gauge can cause either false acceptance or unnecessary rejection.

Analyse: selecting a capable concept

Concept selection should consider function, safety, manufacturability, serviceability, environmental impact, supply risk and total life-cycle cost. Quality function deployment (QFD) uses a relationship matrix to compare customer requirements with engineering characteristics. It helps reveal conflicts—for example, a thinner wall may reduce weight but reduce stiffness and fatigue life.

Design teams should use experiments, simulation, benchmarking and risk analysis. A design of experiments (DOE) can expose interactions that one-factor-at-a-time testing may miss. If a response y depends on factors x₁ and x₂, a simple interaction model may be written as:

Here β₀ is the intercept, β₁ and β₂ are main effects, β₁₂ is the interaction effect, and ε represents unexplained variation. The model is useful only when its assumptions—appropriate data, adequate experimental design and reasonably suitable residual behaviour—are examined.

Design and Verify

Detailed design includes dimensions, materials, interfaces, software logic, process sequence, inspection strategy and supplier requirements. Verification asks whether the design conforms to specified requirements; validation asks whether the resulting product meets the needs of its intended users in its intended environment. Both should include normal, extreme and foreseeable misuse conditions where relevant.

2. Robust design and variation reduction

A robust design performs acceptably despite noise factors such as temperature, humidity, operator differences, material variation, vibration and supply variation. The preferred hierarchy is:

1. Remove the source of variation where feasible.
2. Make the design less sensitive to unavoidable variation.
3. Control the operating environment and process.
4. Inspect or screen the output as a last line of defence.

Taguchi’s framework distinguishes control factors, which designers can set, from noise factors, which are difficult or expensive to control. A robust parameter design seeks factor settings that reduce response variation while maintaining the target.

For a smaller-is-better characteristic, one commonly used signal-to-noise measure is:

where y_i is the observed response and n is the number of observations. For a larger-is-better characteristic, the expression is:

These indices are comparative tools, not universal proof of optimality. The target, loss function, measurement quality and practical engineering constraints must still be considered. Robust design also includes tolerance design: widening a tolerance may reduce manufacturing cost but increase functional risk, while tightening it may increase cost without meaningful customer benefit.

3. Failure mode and effects analysis

FMEA is a structured, team-based method for anticipating how a product or process could fail, why it might fail, and what the consequences would be. It supports prevention rather than relying on final inspection.

A typical FMEA records:

Historically, teams calculated a risk priority number:

where S, O and D are ordinal ratings, often from 1 to 10. RPN is not a probability and has no physical unit. It can be misleading because different combinations can produce the same number; for example, a catastrophic but rare failure may receive the same RPN as a minor but frequent failure. Modern practice therefore gives priority to high-severity items, legal or safety requirements, known single-point failures and inadequate prevention controls, rather than relying on RPN alone.

FMEA quality depends on functional decomposition, realistic failure mechanisms, cross-functional participation, evidence-based ratings and timely closure of actions. It should be updated after design changes, field failures, process changes and new knowledge.

4. Fault-tree thinking

Fault-tree analysis (FTA) begins with a defined top event, such as “loss of braking,” and works backward through logical combinations of contributing events. An AND gate means all input events are required; an OR gate means any input event can produce the output.

For statistically independent events A and B:

For an OR combination:

If A and B are independent, this becomes P(A ∪ B) = P(A) + P(B) − P(A)P(B). These calculations must not be used casually: common-cause failures, dependence, conditional probabilities and incomplete data can invalidate the assumption of independence.

FTA is especially useful for safety, reliability and system-level reasoning. FMEA generally proceeds from component or process failure toward effects; FTA proceeds from an undesired effect toward causes. Used together, they expose both bottom-up and top-down weaknesses.

5. Reliability, maintainability and availability

Reliability is the probability that an item performs its required function for a specified time under specified conditions. For a constant failure rate λ and an exponential lifetime model:

where R(t) is reliability at time t, λ is the constant failure rate per unit time, and t uses the same time unit. The model assumes a constant hazard rate and is most appropriate for the useful-life period of some products, not necessarily for early-life or wear-out failures.

The mean time to failure under this model is:

For repairable equipment, mean time between failures (MTBF) describes the average operating time between failures, while mean time to repair (MTTR) describes restoration time. A simple steady-state inherent availability approximation is:

This excludes many logistical delays unless they are incorporated into the time definitions. In practice, availability may also depend on spare parts, technicians, planned maintenance, diagnosis and supply-chain support.

Worked example

A pump has a constant failure rate of 0.0002 failures per operating hour. Its reliability over 1,000 hours is:

R(1000) = e^(−0.0002 × 1000) = e^(−0.2) ≈ 0.819

Thus, under the stated model, the probability of surviving 1,000 hours is approximately 81.9%. The MTTF is 1/0.0002 = 5,000 hours. These are model-based estimates, not guarantees for every pump.

6. Control plans across the life cycle

A control plan specifies how important product and process characteristics will be controlled. It should be linked to the process map, FMEA, drawings, regulatory requirements and work instructions. Typical fields include operation, characteristic, specification, measurement method, sample size, frequency, responsible role, reaction plan and records.

Control plans evolve through:

• prototype control, which emphasizes learning and rapid feedback;
• pre-launch control, which provides intensified monitoring during ramp-up; and
• production control, which uses validated controls and statistically justified sampling.

A good reaction plan states what happens when a limit is exceeded: stop or contain the process, identify affected product, notify the responsible authority, correct the cause, verify the correction and decide product disposition. “Inspect 100%” is not a complete reaction plan and does not remove the need for root-cause correction.

Statistical process control is appropriate when the characteristic is measurable, the process is sufficiently stable and the sampling scheme is rational. Control limits are estimates of process behaviour; specification limits are requirements from design or the customer. Confusing the two can lead to incorrect decisions. Capability indices such as C_p and C_pk should be used only when stability and distributional assumptions are reasonable:

Here USL and LSL are upper and lower specification limits, μ is the process mean and σ is the within-process standard deviation. Both indices are dimensionless. C_p measures potential capability if centred; C_pk also reflects centring. Non-normal or autocorrelated data require appropriate alternatives or transformation.

7. Risk-based decision making

Risk is commonly conceptualised as a combination of the likelihood of an event and the severity of its consequence. A quantitative expected-loss model is:

where p_i is the probability of scenario i, C_i is its consequence expressed in a consistent monetary or utility unit, and the scenarios should be sufficiently defined to avoid double counting. Expected loss alone is unsuitable for catastrophic risks, rights-based decisions or situations where probabilities are highly uncertain.

A mature risk process includes hazard identification, risk estimation, treatment, communication, monitoring and review. Controls should follow the hierarchy of controls: eliminate the hazard, substitute, engineer safeguards, establish administrative controls, and use personal protective equipment where appropriate. In product safety, the ALARP principle—reducing risk as low as reasonably practicable—may be relevant, but it does not justify ignoring mandatory requirements.

Decision makers should distinguish:

• known risk, supported by credible data;
• uncertainty, where probabilities or models are incomplete; and
• ambiguity, where stakeholders interpret the situation differently.

Governance requires documented assumptions, competent approval, change control, traceability, independence of safety review where necessary, and escalation of unacceptable risk. Ethical practice prohibits suppressing adverse test results, manipulating ratings to obtain approval, or transferring avoidable risk to users, workers or communities.

8. Integrated illustrative case: electrically powered lifting table

Background

A manufacturer plans a powered lifting table for warehouse operators. The existing manual table causes ergonomic complaints and inconsistent lifting times. The new design must lift 300 kg, operate in dusty environments and remain safe if a sensor or control component fails.

Problem definition

Customer interviews identify four CTQs: lifting capacity, positioning accuracy, low operating effort and prevention of uncontrolled descent. Regulatory review adds guarding, emergency stopping and electrical safety requirements.

Analysis

The team creates a functional decomposition: support load, generate motion, sense position, control motion and restrain the load. A design FMEA identifies potential failures including motor overheating, sensor misalignment, control-software error, structural fatigue and brake slippage. Severity is high for uncontrolled descent, so the team prioritises independent mechanical restraint and verified stopping performance rather than accepting a low RPN based on assumed rarity.

FTA begins with the top event “platform descends unintentionally.” Causes include brake failure OR control command during a hazardous condition. The control-command branch is expanded into sensor error AND inadequate software interlock, while the brake branch includes wear, contamination and insufficient holding capacity. The analysis reveals a common-cause concern: the same power supply could disable both sensing and braking.

Design solution

The proposed design uses a normally engaged brake, a mechanically rated support device, two-channel position sensing and a control logic that requires agreement between channels. A prototype test varies load, temperature, voltage, dust exposure and repeated cycles. A robust-design experiment identifies that brake performance is sensitive to contamination and temperature; improved sealing and a larger design margin reduce that sensitivity.

The control plan specifies incoming brake inspection, torque verification, sensor functional testing, software version control, end-of-line load testing and periodic field inspection. The reaction plan requires containment and engineering review if descent speed, stopping distance or sensor disagreement exceeds limits.

Outcome

Pilot testing demonstrates compliance with the CTQs and identifies a previously unrecognised connector loosening failure. A locking connector and vibration test are added before release. The case illustrates that FMEA, FTA, robust design and control planning are most valuable when treated as connected reasoning tools rather than isolated forms.

Learning points

1. Safety-critical requirements deserve priority even when probability estimates are uncertain.
2. Independent protective layers are stronger than repeated versions of one weak control.
3. Environmental and misuse conditions must be included in verification.
4. Design knowledge must be transferred into process controls and service instructions.

9. Challenges, limitations and contemporary practice

These methods can become bureaucratic when teams complete forms without technical investigation. Ordinal ratings may create false precision; historical failure data may not represent a new technology; and models can overlook human behaviour, software interactions or common-cause failures. Workshops may also be dominated by senior voices, suppressing operator knowledge.

Digital engineering increasingly links requirements, CAD models, simulation, test evidence, FMEA, configuration management and field data through a digital thread. Machine-learning tools can identify patterns in warranty data or suggest candidate failure modes, but they cannot replace engineering judgement, causal validation or accountability. AI outputs require data-quality checks, version control, explainability appropriate to the decision and protection of confidential and personal information.

Best practice is to use cross-functional teams, involve suppliers and users early, quantify uncertainty where possible, maintain requirement-to-test traceability, prioritise prevention, verify measurement systems, review changes formally and learn from field performance. Quality and risk decisions should be proportionate: minor cosmetic variation should not receive the same governance process as a potential loss-of-life hazard, yet low-severity recurring defects may still justify action because of cost and customer trust.

Chapter Summary

Design for Quality places prevention before inspection. DFSS and DMADV guide teams from customer needs through measurable CTQs, concept selection, detailed design and verification. Robust design reduces sensitivity to noise factors, while QFD and DOE help connect customer value with engineering decisions. FMEA provides structured bottom-up analysis of failure modes; FTA provides top-down logical analysis of system hazards. Reliability models quantify survival and repairable-system performance only under stated assumptions. Control plans convert design and process knowledge into operational controls and reaction plans. Risk-based decision making combines severity, likelihood, uncertainty, legal requirements and ethical responsibility. The strongest quality systems integrate these methods across design, production, service and end-of-life stages.

Key Terms

Design for Six Sigma: A method for designing products and processes capable of meeting customer and business requirements.

DMADV: Define, Measure, Analyse, Design and Verify framework for new or substantially redesigned outputs.

Critical-to-quality characteristic: A measurable characteristic that strongly affects customer or regulatory acceptance.

Quality function deployment: A structured method for translating customer requirements into engineering characteristics.

Robust design: Design that performs consistently despite unavoidable variation and noise factors.

Noise factor: A source of variation that is difficult or costly to control.

Failure mode: The specific manner in which a function can fail.

FMEA: A systematic analysis of failure modes, causes, effects and controls.

Fault-tree analysis: Top-down logical analysis beginning with an undesired event.

AND gate: Fault-tree condition in which all input events are required.

OR gate: Fault-tree condition in which any input event can produce the output.

Reliability: Probability of performing a required function for a stated time and condition.

Failure rate: Rate at which failures occur under specified assumptions.

Maintainability: Ability to restore an item to service within stated conditions and time.

Availability: Proportion or probability of time that an item is operational when required.

Control plan: Document specifying characteristics, methods, frequency, responsibility and reactions.

Specification limit: Customer or design boundary defining conformity.

Process capability: Ability of a stable process to meet specification limits.

Residual risk: Risk remaining after controls are implemented.

Traceability: Ability to link requirements, decisions, evidence, changes and outputs.

Review Questions

Short Answer Questions

1. Why is DFSS more suitable than DMAIC for a completely new product?
2. Distinguish a customer need from a CTQ.
3. What is the difference between an FMEA and a fault-tree analysis?
4. State the assumptions of the exponential reliability model.
5. Why must a control plan contain a reaction plan?

Long Answer Questions

1. Explain each phase of DMADV and show how the phases should be linked through traceability.
2. Discuss how robust design and tolerance design can reduce total life-cycle cost.
3. Explain the strengths and limitations of using RPN in FMEA prioritisation.
4. Compare reliability, maintainability and availability, including the assumptions behind the availability equation.
5. Describe how an integrated FMEA, FTA and control-plan process can manage a safety-critical product.

Analytical / Application Questions

1. A repairable machine has an MTBF of 1,200 hours and an MTTR of 8 hours. Calculate its inherent availability using A = MTBF/(MTBF + MTTR), and explain what the result excludes.
2. Develop a mini-FMEA for a packaging operation in which a label may be missing, including function, failure effect, likely causes, prevention controls, detection controls and proposed action.
3. Construct a fault-tree narrative for the top event “customer receives an unsafe product.” Identify at least one AND relationship, one OR relationship and a possible common-cause failure.

Multiple Choice Questions with Answers

Question 1

Which framework is primarily intended for a new or substantially redesigned product?

A. DMADV

B. DMAIC

C. 5S

D. Kanban

Correct Answer: A. DMADV

Question 2

What is the main purpose of a CTQ?

A. To replace all customer research

B. To express a customer requirement in measurable form

C. To calculate equipment availability

D. To assign employees to shifts

Correct Answer: B. To express a customer requirement in measurable form

Question 3

In an FMEA, the effect of a failure mode describes:

A. How the failure is detected

B. The consequence of the failure

C. The person responsible for correction

D. The process capability index

Correct Answer: B. The consequence of the failure

Question 4

In a fault tree, an AND gate indicates that:

A. Any one input is sufficient

B. No input can cause the event

C. All specified input events are required

D. The events are always independent

Correct Answer: C. All specified input events are required

Question 5

For a constant failure rate, which expression represents reliability?

A. R(t) = 1 − λt

B. R(t) = e^(−λt)

C. R(t) = λ/t

D. R(t) = t/λ

Correct Answer: B. R(t) = e^(−λt)

Question 6

A pump has λ = 0.0002 failures per hour. Its MTTF under the exponential model is:

A. 200 hours

B. 2,000 hours

C. 5,000 hours

D. 20,000 hours

Correct Answer: C. 5,000 hours

Question 7

Which statement correctly distinguishes specification limits from control limits?

A. Both are always calculated from process data

B. Specification limits express requirements; control limits estimate process behaviour

C. Specification limits apply only to suppliers

D. Control limits are legal limits in every industry

Correct Answer: B. Specification limits express requirements; control limits estimate process behaviour

Question 8

Which action is generally strongest in the hierarchy of controls?

A. Personal protective equipment

B. Warning signs

C. Administrative instruction

D. Elimination of the hazard

Correct Answer: D. Elimination of the hazard

Question 9

If MTBF is 1,000 hours and MTTR is 10 hours, inherent availability is approximately:

A. 90.9%

B. 98.0%

C. 99.0%

D. 99.9%

Correct Answer: C. 99.0%

Question 10

Why can RPN alone be misleading in FMEA?

A. It has units of time

B. It cannot include any severity assessment

C. Different severity, occurrence and detection combinations can produce the same score

D. It is valid only for financial risks

Correct Answer: C. Different severity, occurrence and detection combinations can produce the same score