Product Design Risk / DFMEA Review
An outside engineering challenge to your design before you commit to tooling. Fixed scope, fixed price, and a defined exit point agreed before the work starts.
Kickoff within 10 business days, readout 15 business days after that. Work back from your tooling or gate date. The 24 hours is the total across everyone involved, not per person, and includes the readout session.
Defined scope. Defined decision objective. No open-ended consulting commitment required.
When this is worth doing
This review is built for one window: while change is still practical.
The architecture is stabilizing and major changes are becoming more expensive.
Capital is about to be committed to production-intent hardware.
Important assumptions or failure modes may have changed.
Testing needs to demonstrate that consequential risks are actually controlled.
Leadership wants another experienced set of eyes before scale.
Stronger evidence of systematic design-risk management is required.
If one of these is approaching, this is the point to challenge the design. Not after the issue reaches tooling, production or the customer.
What you get
- A ranked risk register. Failure modes, causes and effects, prioritized by consequence rather than by scoring convention.
- A named action list. Each action with an owner and the validation evidence that would close it.
- A short management summary, written to be read by someone who will not read the register.
- A readout session with your engineering team to walk the findings and disagree with them.
- A follow-up closure check after your team works the actions, included. We look at what got closed and what did not.
See a sample risk register and management summary
Illustrative example. Not from a client engagement. Prepared to show the format and depth of the deliverable. The subsystem and findings are generic.
Severity (S) and Action Priority (AP) per AIAG-VDA FMEA methodology. Ordered by consequence, not by score.
| Failure mode | Cause / mechanism | Effect | Action | Evidence that closes it |
|---|---|---|---|---|
| Solder joint fatigue at power stageS 9 · AP H | No conduction path from the power device to the housing. Thermal model assumes convection the enclosure does not deliver | Intermittent fault at high duty, then permanent loss of function. Presents as no-fault-found at service | Add thermal boss or gap pad to the housing wall. Model junction temperature at worst-case duty and ambient, not nominal | Thermal survey at worst-case duty, power cycling to required cycles |
| Connector terminal fretting corrosionS 8 · AP H | Micro-motion at the terminal interface under vibration. No secondary retention, and terminal normal force sized for a lower-vibration application | Intermittent open circuit that clears on reseat. Long latency, high warranty cost, low diagnosability | Confirm terminal normal force against this vibration profile. Add retention or specify a plated finish rated for the motion | Fretting test at the program profile, contact resistance measured before and after |
| Conformal coating shadowing at tall componentsS 8 · AP H | No coverage requirement behind tall components. Spray geometry leaves shadowed areas uncoated with no inspection criterion | Dendritic growth and leakage current under humidity. Surfaces months into service | Define coverage requirement including shadowed areas. Add an inspection method that can actually see them | Coverage verification on production-intent boards, humidity bias test to program duration |
| Electrolytic capacitor wear-outS 7 · AP H | No derating analysis at worst-case ambient. Ripple current near rated at the temperature the enclosure actually reaches | Function loss late in life, inside the warranty period | Derating analysis at measured internal ambient. Reselect or reduce ripple loading | Derating calculation against measured internal temperature, life test at worst case |
| Connector header sealing face non-conformingS 8 · AP M | Molding warpage at the header flange. No flatness requirement on the sealing face | Ingress at the connector interface. Escapes as a sporadic supplier quality issue rather than a design issue | Add a flatness callout to the sealing face. Capability study on production tooling, not prototype parts | Cpk on flatness from tooling trial, leak test on production-intent parts |
| Mounting resonanceS 7 · AP M | First mode of the mounting arrangement falls inside the excitation band. Bracket carried over from a lighter predecessor unit | Solder cracking and connector fretting, both late-surfacing | Modal analysis using as-built mass, not predecessor mass. Retune boss spacing or bracket section | Modal test correlation, vibration durability to program profile |
Three things worth your attention.
1. The thermal path is assumed rather than designed. Items 1 and 4. The thermal model assumes convection that a sealed enclosure does not deliver, and the capacitor selection was made against an ambient the unit will not actually see. These are the same root cause reaching two different components. Both are recoverable now with a boss and a pad and a part change. After tooling, item 1 becomes a housing change and item 4 becomes a wear-out pattern that surfaces inside warranty and takes a year to diagnose.
2. Two failure modes are invisible to the current test plan. Items 2 and 3. Fretting corrosion and coating shadowing both produce intermittent faults with long latency. Neither is covered by the tests currently planned, which means the program will pass validation and learn about them in the field. This is not a case of the design being wrong. It is a case of the test not being able to tell you whether it is wrong.
3. Two assumptions have not been rechecked against this design. Items 5 and 6. The bracket was sized for a lighter unit, and sealing performance has been verified on prototype parts rather than against production tooling variation. Both were reasonable positions when taken. Neither has been revisited since the design changed around them.
What this means for timing. Items 1, 5 and 6 touch the housing and the mounting arrangement. Resolving them together before tooling release costs a design iteration. Resolving them afterward costs tool modification and revalidation on each one separately.
What we need, and what is not included
- Current DFMEA, if one exists
- Drawings or CAD for the subsystems in scope
- Requirements or performance specification
- Current test and validation plan
- Bill of materials
- Any known field, warranty or supplier issues on predecessor designs
If some of this does not exist yet, that is usually worth knowing and does not stop the review.
- No PFMEA, process flow or control plan
- No testing, test execution or lab work
- No CAD, design changes or engineering rework
- No supplier audits or supplier-facing work
- No ongoing engineering support after the closure check
Several of these are available separately. They are priced separately because bundling them would make this scope impossible to hold.
Waqar Hashim performs the review personally.
Former Chief Engineer at General Motors and VP of Engineering at EV startups, with three decades inside product programs carrying real launch dates and real consequences.
Independence and confidentiality. We do not work for your suppliers or your competitors on the same program. If a conflict exists, we tell you before the engagement begins and decline the work.
Everything produced in a review belongs to you. The risk register, the report and the working notes are yours, they are not shared with anyone outside your team, and they are not reused in any form.
Where this has been applied
An automotive program depended on hardware and embedded technology from a supplier with little automotive background. The supplier was strong in its own market and had never worked to APQP. Neither side had a shared method for showing that design risk was under control.
DFMEAs were being produced after the design was complete, as a gate deliverable rather than as part of designing. Several high-severity failure modes had been written down and never worked. The open issues on the enclosure would have allowed water ingress and corrosive failure of the electronics inside. Nobody was withholding anything. The document simply arrived after the point where it could change a decision.
Weeks before tooling kickoff, during an independent design risk review.
The open high-severity items were reworked as engineering questions rather than as entries in a spreadsheet: what could still be changed, what had to be validated, and what evidence would close each one. The ingress problem was resolved with a single expedited design update.
The changes were made in CAD rather than in steel. Approximately $3.5M in tooling modifications avoided.
A DFMEA completed after design freeze records risk. It does not reduce it. The document can be complete and correct and still arrive too late to be worth anything.
What happens next
Here is what it is and what it is not. No proposal deck, no follow-up sequence. If this is not the right thing for your program, we say so on the call and tell you what would be.
You get afterward: a scope of work stating the subsystems covered, the price, the duration, the dates and what we need from your team.
Request a 30-minute Design Risk ReviewOr just ask a question first: waqar@productrecoverygroup.com
- What you are building, and where it sits against the triggers above
- Which subsystems would be in scope
- Whether an existing DFMEA is available to work from
- Your gate or tooling date, and whether the timing still works