**Scope and boundaries determine whether the analysis is useful.** Begin by naming the item, life-cycle phase, intended function, operating state, interfaces, customer, and decision the analysis must support. A DFMEA examines how a product or equipment design may fail to meet a requirement. A PFMEA examines how fabrication, assembly, service, or wafer-processing steps may create nonconformance. An equipment FMEA can bridge both: a gas box is a designed subsystem, while valve replacement and chamber qualification are processes. The AIAG/VDA sequence is a strong organizing model: planning and preparation, structure analysis, function analysis, failure analysis, risk analysis, optimization, and results documentation. IEC 60812:2018 provides a generic framework applicable to hardware, software, processes, human action, and their interfaces. Select the governing method before scoring; do not mix tables from different manuals and pretend the result is calibrated. **Write each failure chain in technically distinct fields.** A function states the intended verb and measurable requirement. A failure mode is the manner in which that function is not achieved. An effect is the consequence at the next level and ultimately to the fab, product, user, safety, or environment. A cause is the physical, software, procedural, or human mechanism that produces the mode. A control either prevents the cause or detects the cause or mode in time to act. For the function “maintain backside helium at 10 Torr during a 60 s etch,” “wafer overheats” is usually an effect, not the first failure mode. A sharper chain is: seal surface fails to contain gas; leakage lowers zone pressure by 3 Torr; edge temperature rises 8 °C; local etch rate shifts 6%; profile moves outside specification; electrical yield falls. Plausible causes include an O-ring cut, particle on the sealing land, warped wafer, blocked orifice, pressure-sensor offset, or an incorrect clamp-voltage sequence. Each cause needs different prevention and detection. **Risk ranking informs judgment but never replaces it.** Traditional FMEA often assigns ordinal severity $S$, occurrence $O$, and detection $D$ ratings, commonly on organization-defined 1-to-10 scales, then calculates $$RPN = S \times O \times D$$ An illustrative row with $S=9$, $O=3$, and $D=4$ yields $RPN=108$. Another row with $S=4$, $O=9$, and $D=3$ also yields $RPN=108$, although the consequences and action logic are not equivalent. Multiplication of ordinal scores creates ties and false spacing; a change from 2 to 4 is not proved to be twice the risk. Never interpret RPN as probability, expected loss, or a cross-company metric. The AIAG/VDA handbook introduced Action Priority (AP) tables to replace RPN as the principal automotive prioritization mechanism. AP considers combinations of severity, occurrence, and detection and assigns high, medium, or low action priority under its own definitions. High AP does not mean an automatic numerical risk threshold, and low AP does not waive engineering responsibility. Use the current licensed table and customer-specific requirements; this article intentionally does not reproduce proprietary rating tables. Some organizations use a risk matrix, criticality number, safety classification, or regulatory rule. FMECA extends FMEA by including explicit criticality analysis, often using severity and a measure of likelihood or importance. It is not merely FMEA with an extra letter. For quantitative reliability, distinguish a demonstrated rate such as 20 FIT from an ordinal occurrence rank of 3. For safety work, link hazards, diagnostic coverage, and residual risk to the applicable safety process rather than stretching ordinary PFMEA scores. | Field | Strong entry | Weak entry | Evidence or decision | |---|---|---|---| | Function | Maintain 10 Torr backside helium for 60 s | Cool wafer | Recipe and thermal requirement | | Failure mode | Zone cannot hold commanded pressure | Tool problem | Pressure trace and leak test | | Effect | Edge temperature rises 8 °C; etch rate shifts 6% | Bad wafer | Thermal and 49-site wafer maps | | Cause | Seal cut by 0.5 mm particle during assembly | Human error | Inspection and part genealogy | | Prevention | Keyed seal carrier and torque-controlled assembly | Training | Design review and torque record | | Detection | Pressure-decay test plus alarm challenge | SPC | MSA, challenge result, reaction plan | | Action | Add keyed carrier; owner A; due in 14 days | Monitor | Completed change and repeat evidence | | Residual risk | Re-rate after 30 cycles and 3 lots pass | Score lowered | Objective effectiveness record | **Controls must be separated by purpose and timing.** Prevention controls reduce the chance that a cause occurs: keyed connectors, recipe permissions, poka-yoke fixtures, qualified parts, torque tools, software range checks, preventive maintenance, and robust design margins. Detection controls reveal a cause or failure mode before the effect escapes: interlocks, pressure-decay tests, endpoint traces, alarms, monitor wafers, inspections, and electrical test. A customer return is not a strong detection control; it is evidence that earlier controls failed. Measurement-system analysis belongs in the control assessment. If a four-point probe has 2% repeatability against a 3% process limit, small shifts are poorly distinguished. If an XPS survey samples one coupon while the failure is edge-localized, chemistry coverage is weak. If a Keithley leakage test uses 1 nA resolution but the harmful regime begins at 100 pA, the control is mismatched. If a Keysight trace captures at 10 Hz while an arc lasts 2 ms, it may miss the event entirely. State the detection limit rather than awarding confidence by instrument name. **Actions should change the failure chain, not decorate the worksheet.** Prefer elimination and design prevention over added inspection. Remove an incompatible material, widen a process margin, key a connector, interlock an unsafe sequence, reduce stored energy, or redesign a seal land before asking operators to inspect harder. Detection improvements remain valuable when prevention cannot remove the mode, but they must trigger a bounded response before escape. Re-rating is earned only after implementation and evidence. Severity usually remains unchanged unless the design reduces the consequence; improved detection does not reduce severity. Occurrence can fall when prevention removes or controls the cause. Detection can improve when a validated control finds the mode earlier and with sufficient coverage. Preserve original ratings, record revised ratings, and link objective proof. Closing an action because its due date arrived corrupts the risk model. For a chamber arc example, suppose a 3 kW RF step creates a vulnerable 20 ms transition. An action replaces a loose connector design and adds arc sensing at 100 kHz. Verification should include installation checks, controlled fault challenge, trace review, at least 100 recipe cycles, and wafer evidence. If the sensor is sampled at 1 kHz, its 1 ms interval may detect the event, but end-to-end shutdown latency still must be measured. The FMEA row closes only when the redesigned path and response meet the declared requirement. ```flowchart Define product, process, equipment, life-cycle state, boundary, interfaces, assumptions, and governing method → Decompose structure into systems, subsystems, elements, operations, and interfaces → State measurable functions and requirements for each element → Identify failure modes as loss, degradation, unintended function, timing error, or interface failure → Propagate local, next-level, and end effects → Identify physical, software, material, procedural, and human causes → Inventory prevention and detection controls at their actual timing and coverage → Assign severity, occurrence, and detection using the approved criteria → Apply Action Priority, approved risk matrix, or justified criticality method → Select actions that eliminate, prevent, then detect → Assign owner, due date, verification evidence, and decision authority → Implement under change control → Challenge controls and measure action effectiveness → Re-rate without erasing original risk → Link residual controls into drawings, recipes, maintenance plans, control plans, SPC, and reaction plans → Review after change, excursion, new evidence, or defined interval ``` **Semiconductor FMEA must connect equipment physics to wafer evidence.** A PFMEA for deposition may trace precursor-flow loss to thickness, composition, conformality, particles, and device impact. An etch PFMEA may connect chamber seasoning, endpoint signal, mask selectivity, critical dimension, sidewall profile, and residue. An implant PFMEA may connect energy calibration, beam current, wafer charging, dose, channeling, sheet resistance, and junction behavior. The analysis becomes credible when each control observes a variable causally close to the failure mode. Consider a post-maintenance mass-flow-controller replacement. The function is to deliver 100 sccm within ±1%. Failure modes include no flow, offset flow, unstable flow, wrong gas identity, leakage when closed, and delayed response. Causes include wrong calibration gas, reversed installation, incorrect full-scale configuration, damaged seal, wiring mismatch, or recipe mapping. Controls could include part-number verification, helium leak test at $L=5\times10^{-9}$ mbar·L/s, zero/span check, 10-point flow comparison, valve-closure test, and a monitor-wafer result. One passing center-point reading does not cover dynamics or shutoff. Correlate controls across scales. Ellipsometry can map a nominal 100 nm film at 49 sites; four-point probe can map sheet resistance; XPS can assess surface composition; SIMS can examine depth contamination; AFM can measure morphology; Hall effect can test carrier response; DLTS can probe electrically active traps; corona-Kelvin can reveal surface-potential change. None alone proves causal closure. Select the smallest evidence set that covers the failure chain, and record why omitted methods add no decision value. Use fault-tree analysis when top-down combinations and common causes matter; use FMEA for bottom-up failure chains. Use 8D or equivalent corrective action to investigate an occurred problem; use FMEA to institutionalize the learned risks and controls. Use FMEDA when functional-safety metrics require failure rates and diagnostic coverage. These methods complement one another and should share traceable identifiers, not compete as interchangeable templates. **Governance keeps the analysis alive after approval.** Establish a multidisciplinary team with design, process, equipment, manufacturing, quality, reliability, safety, supplier, and service knowledge appropriate to scope. The facilitator protects method discipline but does not supply all technical answers. Record dissent, assumptions, missing evidence, and accountable decisions. A workshop of 6 informed people for 4 h can outperform 40 h of isolated spreadsheet completion because interfaces are examined together. A control challenge might require 50 ms response at 2 V and a 10 min stable repeat. Management acceptance of residual risk must be explicit when action is infeasible or disproportionate. “No action” requires rationale and authority; it does not mean risk disappeared. Safety, regulatory, and customer-specific obligations override convenience. RPN thresholds alone must never suppress action on a high-severity mode. Where uncertainty is material, create an experiment, fault challenge, or monitoring plan that converts uncertainty into evidence. Through the risk-prioritization and control-effectiveness lens, FMEA is a traceable argument from function to failure chain to verified treatment. Its value is demonstrated when teams distinguish modes, effects, and causes; use ratings under a declared method; prioritize severity and action rather than worship an RPN; connect controls to semiconductor physics and measurement capability; and keep residual risk synchronized with real production evidence.