What is the Difference Between Occurrence (O) and Detection (D) in DFMEA? — One is Determined by Preventive Controls, the Other by Verification Methods, with a Table of Evidence Levels and Seven Common Misjudgments

A power tool company was conducting a DFMEA review for a new project and paused on the page about the sealing structure. The failure cause was "insufficient seal compression, leading to permanent deformation and leakage after long-term pressure," with an O score of 4 and a D score of 3, resulting in an AP rating of L. The review leader, as usual, asked two questions: Why is O 4? The engineer replied, "We've never had a leak with this type of structure before." Why is D 3? The answer was, "We conducted a 1,000-hour aging test."

Further probing into the details revealed the problem. The "Preventive Control" column stated "Design according to design specifications," while the "Detection Control" column referred to "DVP&R Item 7." The design specifications contained no provisions regarding compression, and the test report did not clarify whether the applied stress could trigger the mechanism of permanent deformation. In other words, the entries in both columns were essentially the same—non-existent.

The issue is not whether these scores are too high or too low, but whether the person scoring treats O and D as numbers that can be filled in based on impressions. They are not impression scores; they are conclusions based on two pieces of evidence: O measures how much the probability of occurrence is reduced by your design preventive actions, while D measures how many escapes your verification methods can catch before production starts. One looks at whether the cause has been suppressed, and the other looks at whether the cause has been detected. Confusing these two aspects will degrade DFMEA into a review ledger filled with numbers.

1. Clarify the Boundaries: S, O, and D Each Handle a Different Aspect, Without Overlapping

Among the three scores, only S is unrelated to control measures. S measures the severity of the failure effect, and the score is as high as the consequences are severe. No amount of testing will reduce the severity of an airbag failure from 10 to 8. O and D, on the other hand, are directly influenced by control measures, but they are changed through different paths.

To determine which score a measure should change, there is a nearly foolproof method: see if the measure changes the likelihood of the event occurring or if it changes the likelihood of detecting the event before it occurs. The former affects O, the latter affects D, and if neither is affected, no score should be changed.

This criterion can prevent the most common type of debate in review meetings. Someone might suggest "increasing full inspection at the factory," which merely shifts the inspection upstream. O remains unchanged, and D should not be altered—mass production inspection falls under the scope of PFMEA. Another suggestion might be "using a more temperature-resistant material," which would lower O, but D may not necessarily decrease because the lifespan margin of the new material is still unknown and requires additional verification.

2. How to Anchor O: Look at the Evidence Level of Preventive Controls, Not Historical Luck

The most common mistake in evaluating O is using results to retroactively determine the score. "This product has had no issues for three years, so O is 2"—this statement contains a fatal assumption: the shipping volume, usage conditions, material batches, and customer usage methods over the past three years are identical to those of the next three years. This assumption almost never holds true. Three years without issues may simply mean insufficient exposure, and the failure has not yet manifested; it is luck, not control.

O should be anchored in the form of preventive controls, divided into five levels based on the strength of evidence:

The most useful aspect of this table is that it transforms "I think there's no problem" into "What level of evidence can you provide?" During the review, only three questions need to be asked:

1. Can the actions listed in the "Preventive Control" column be pointed to specific clauses in the drawings or design specifications? If not, the maximum level is 2.
2. Is this action specifically targeted at this failure cause? If it is a general specification, the maximum level is 2.
3. Are there empirical or field data from similar designs under similar conditions? If not, the maximum level is 3, and O should not be lower than 4.

The third question is often overlooked but is the most valuable. A DFMEA for a bracket component in an automotive parts company originally had O=5 for the cause of "insufficient wall thickness leading to fatigue cracking," with the justification being "finite element analysis showed a safety factor of 1.4." The review leader asked: Where does 1.4 come from? The answer was: The company's specifications require a minimum of 1.3. Further questioning: Is the part subjected to random vibration or constant amplitude load, and which does 1.4 correspond to? The engineer could not answer. According to the anchoring table, O was adjusted to 7—only a general specification, no specific analysis for the mechanism. After additional random vibration spectrum life simulation and bench verification, O was reduced to 3. The change in score is not the focus; the key is that the 7 now corresponds to real evidence.

Another criterion worth remembering is: O=1 is only valid if the structure makes it impossible for the cause to occur. Relying on "well-managed," "stable supplier," or "skilled operator" to score 1 is treating organizational capability as design prevention. Once personnel or suppliers change, this 1 becomes invalid, and DFMEA will not automatically update.

3. How to Anchor D: The Detection Object in DFMEA is the "Cause," Not Whether the Final Product is Conforming

The direction of common mistakes in evaluating D is opposite to that of O: O is often scored too low (to make the design seem controllable), while D is often scored too low (to make the verification seem sufficient). Both can lead to a lower AP rating and prevent necessary actions from being taken.

In DFMEA, D evaluates the "probability of this failure cause being detected during the design and verification phase." Note three key terms: cause, design phase, and detected. Therefore:

• The detection object is the cause, not whether the final product is conforming. Even if a 1,000-hour test shows no failures, if the applied stress does not trigger the mechanism, the detection capability for this cause is zero.
• Detection occurs during the design phase. Inspection during mass production, client acceptance, and post-sales warranty do not count as design detection.
• "Detection" requires a determinable outcome. Saying "we discussed this issue" in a review meeting does not constitute detection because there is no record, no criterion, and no conclusion.

Detection methods can be roughly divided into five levels, to be used in conjunction with the evidence levels for O:

To score D at 3 or below, all three conditions must be met: the test item corresponds to the failure mechanism, the conditions cover the worst-case scenario, and the criteria are quantifiable with a statistically based sample size. The sample size for zero-failure tests is not arbitrarily determined but is calculated based on reliability and confidence levels, using the formula n = ln(1−C) / ln(R): 90% confidence and 90% reliability require 22 samples, while 95% confidence and 95% reliability require 59 samples. Announcing "verification passed" after testing 3 samples and finding no failures corresponds to a low reliability confidence level that cannot support any conclusions.

Two specific traps are particularly worth avoiding. First, simulation is not detection unless the model has been calibrated by physical tests. Unverified simulations are essentially assumptions and can score at most 6～7. Second, "reviewed in the meeting" can score at most 8～9. Reviews without structure, records, or criteria are the weakest form of detection, and scoring them as 4 is equivalent to using meeting minutes to replace test data.

The details of scoring detection in PFMEA and common mistakes are already discussed in PFMEA: Is 'Inspection' Always Worth Less? (8.3.1). The only difference between DFMEA and PFMEA is that PFMEA explores whether process parameters are correct, while DFMEA explores whether design mechanisms have been verified. Using the same detection logic in both documents is inherently incorrect.

4. A Practical Calibration: Four Steps to Pull Scores from Impressions Back to Evidence

Step 1: Write the controls first, then score. Fill in the "Current Preventive Control" and "Current Detection Control" columns for each failure cause with specific actions, formatted as "action + document number + responsible person." Rows that cannot specify concrete actions must not be scored—this rule can prevent 80% of impression-based scoring.

Step 2: Score according to the anchoring table and add a "Scoring Basis" column. Add a column to O and D to clearly state why the score is what it is, such as "O=7: only general specifications, no specific analysis for this mechanism" or "D=6: aging test did not cover extreme temperatures and tolerance boundaries." This column is the first thing reviewed during audits and the only thing that can be understood when revisiting the document six months later. The table structure is as follows:

Step 3: Self-check using four cross-rules.

1. O and D must not have the same source. If both columns list the same action (e.g., "simulation done" in both preventive and detection columns), one of them is incorrect—simulation can only be used for detection and does not change the probability of the cause occurring.
2. O≤4 without specific design measures should be rejected. General specifications cannot support a score of 4.
3. D≤4 without mechanism coverage and quantifiable criteria should be rejected. The existence of a test does not equate to effective detection.
4. S≥9 cannot be used as a reason to not change the design based on low O and low D. Severity takes precedence: safety and regulatory-related failures must have design changes or poka-yoke, even if O and D are low. Otherwise, this DFMEA will almost certainly be questioned during client audits.

Step 4: Re-evaluate after measures are implemented and keep version records. After implementing the measures, return to the table to re-score the O or D for that row and record the change in AP. A DFMEA that does not re-evaluate is equivalent to not closing the loop—it only records the issues but not how many have been resolved.

Here is a complete example (using a generic company name, with example data). The housing sealing structure of the power tool mentioned earlier, recalibrated according to the anchoring table:

The recalibration results in worse scores, with AP rising from L to H. This is not a bad thing—it brings a problem that would otherwise be overlooked to the forefront. After implementing the measures and re-evaluating, O is reduced to 3 (with tolerance stacking calculation and compression design lower limit, Level 3 evidence), and D is reduced to 4 (boundary tests cover the upper and lower limits, but sample size and criteria need to be strengthened), bringing AP back to M. Throughout the process, the scores first increase and then decrease, but the risk is genuinely reduced.

5. Seven Common Misjudgments, Addressed One by One

1. Using historical results to score O. "We've never had an issue before" indicates insufficient exposure, not effective control. Fix: Only consider the evidence level of preventive controls.
2. Using "tests conducted" to score D. If the test does not correspond to the mechanism, the detection capability is zero. Fix: Ask, "Does the stress applied in this test trigger the cause?"
3. Treating design review as strong detection. Reviews without structure, records, or criteria can score at most 8～9. Fix: Reviews should have checklists, conclusions, and signatures.
4. Writing mass production inspection into the DFMEA detection column. This belongs to PFMEA. Fix: DFMEA should only list verification and analysis methods during the design phase.
5. Filling O and D with the same action. Listing the same action in both columns means the score is counted twice. Fix: Use the first rule of Step 3 for self-check.
6. Measures only add tests. Adding tests can only reduce D, not O, and testing resources are limited. The correct sequence is to first use design measures to reduce O (often achieving the goal in one step with low marginal cost), then allocate testing resources based on the product of S and O—prioritize those with high S and high O, and those with high S and low O can be verified after the prototype stage. This ranking rule can resolve the most common scheduling conflicts between R&D and testing departments: it's not about who shouts the loudest, but who contributes the most risk.
7. Directly copying scores from family FMEAs. If the structure and preventive controls of the previous generation are reused, the evidence levels must be re-verified; if the structure or material has changed, the previous Level 4 evidence becomes invalid.

6. In One Sentence

O is the report card for preventive controls, and D is the report card for verification methods; neither score can be written in a vacuum but must be derived from the evidence you have—write the controls first, score according to the evidence level, and re-evaluate after measures are implemented to transform DFMEA from a ledger into a risk decision record.

Change the design to change O, add verification to change D, and don't change the score if you can't change the evidence.

Knowledge code: 8.2.1

Version: v20261105

Author: QTank QTank is dedicated to providing systematic professional knowledge, methodologies, and practical tools for quality management practitioners, helping enterprises continuously improve their quality capabilities.