Rriiabiliry

Engineering

and SystemSafety60 ( 1998) 12 I - 132 0 1998 Elsevier Science Limited All rights msewed. Printed in Northern Ireland 0951-8320/98/519.00

ELSEVIER

pn:sO951-8320(97)00092-6

Reliability centered maintenance

Reliability centered maintenance (RCM) is a method for maintenance planning developed within the aircraft industry and later adapted to several other industties and military branches. This paper presents a structured approach to RCM, and discusses the various steps in the approach. The RCM method provides a framework for utilizing operating experience in a more systematic way. The requirements for reliability models and data are therefore highlighted. The gap between maintenance practitioners and scientists working with maintenance optimization models is discussed. together with some future challenges for RCM. 0 1998 Elsevier Science Limited. -

1 INTRODUCTION
As many modem maintenance practices, the reliability centered maintenance (RCM) concept originated within the aircraft industry. RCM has now been applied with considerable success for more than 20 years; Iirst within the aircraft industry, and later within the military forces, the nuclear power industry, the offshore oil and gas industry, and many other industries. Experiences from these industries show significant reductions in preventive maintenance (PM) costs while maintaining, or even improving, the availability of the systems. According to the Electric Power Research Institute (EPRI) RCM is: a systematic consideration of system functions, the way functions can fail, and a priority-based consideration of safety and economics that identifies applicable and effective PM tasks. The main focus of RCM is therefore on the systemfuncdons, and not on the system hardware. Traditional maintenance plans are often based on a combination of recommendations from manufacturers, legislation and company standards, and-to a minor extentmaintenance models and data (see Fig. 1). Many companies are faced with laws and regulations related to personnel safety and environmental protection that set requirements to their maintenance strategies. The oil companies operating in the Norwegian sector of the North Sea are, for example, required to test well barriers according to regulations by the Norwegian Petroleum Directorate. *Author to whom correspondence [email protected] should be sent. E-mail:
121

Recommendations from manufacturers are not always based on real experience data. Many manufacturers get very little feedback from the users of their equipment after the guarantee period is over. It is also sometimes claimed that manufacturers recommendations may be more slanted towards maximizing the sales of consumable spares rather than minimizing the downtime for the use?. Fear of product liability claims may perhaps also influence the manufacturers recommendations. The main objective of RCM is to reduce the maintenance cost, by focusing on the most important functions of the system, and avoiding or removing maintenance actions that are not strictly necessary. If a maintenance program already exists, the result of an RCM analysis will often be to eliminate inefficient PM tasks. The RCM concept is described in several reports and textbooks3-5. Several military and non-military standards have also been issued6-lo. The main ideas presented in the various sources are more or less the same, but the detailed procedures may be rather different. Maintenance aspects should preferably be considered during system design, from the early concept phase. However, all too often the maintainability considerations are postponed until it is too late to make any significant system changes. Detailed maintenance strategies should also be established before the system is put into operation. Very often these strategies are only rudimentary and made on an ad hoc basis as problems occur. In this article we will, however, not discuss the important aspect of how to integrate RCM-like ideas in the early development stages, but assume that we either are dealing with a system that is ready for commissioning or a system in operation. The maintenance tasks considered in the RCM approach are all related to failures and functional degradation.

122

M. Rausand

Legislation and company standards . Manufacturers rscommendations

I 1 1 Malntsnancs ) 8 I i models and data L__________ __----____J .

;_--________________-___

Maintenance tasksartdintatws

provide a reduced expected loss related to personnel injuries, environmental damage, production loss, and/or material damage. When developing the PM program, it should, however, be realized that RCM will never be a substitute for poor design, inadequate build quality or bad maintenance practices. An RCM analysis basically provides answers to the following seven questions.
1. What are the fnn~ions and associated performance

Fig. 1. Traditional development of maintenance plans.

Maintenance carried out, for example to preserve or improve the aesthetical appearance of a system by cleaning and painting is outside the scope of RCM-at least when such m~nten~ce has no effects on the system functions. However, planning of such tasks should be integrated with the planning of RCM relevant tasks. The main objective of this article is to present a structured approach to RCM, and to discuss the various steps in this approach. We will further briefly discuss the (claimed) gap between theory and practice regarding m~nten~ce optimization. The RCM concept is introduced and briefly discussed in Section 1. Section 2 outlines the seven questions which form the basis of an RCM analysis. A detailed RCM procedure comprising 12 main steps is presented in Section 3. The structure, and the presented work-sheets are new compared to previous RCM approaches. The gap between theory and practice within maintenance engineering and planning is briefly discussed in Section 4. The article is concluded in Section 4 with a brief discussion the application of RCM, and some future challenges.

2. 3. 4. 5. 6. 7.

standards of the equipment in its present operating context? In what ways does it fail to fulfill its functions? What is the cause of each functional failure? What happens when each failure occurs? In what way does each failute matter? What can be done to prevent each failure? What should be done if a suitable preventive task cannot be found?

Experience has shown that approximately 30% of the efforts of an RCM analysis is involved in defining functions and performance standards, i.e., answering question no. 1.

3 MAIN STEPS OF AN RCM ANALYSIS The RCM analysis may be carried out as a sequence of . activities or steps, some of which are overlapping in time 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. Study pillion System selection and definition Functional failure analysis (PPA) Critical item selection Data collection and analysis PMECA Selection of rn~nten~~e actions ~te~in~ion of maintenance intervals Preventive maintenance comparison analysis Treatment of non-critical items Implementation In-service data collection and updating

2 WHAT IS RCM? RCM is a technique for developing a PM program. It is based on the assumption that the inherent reliability of the equipment is a function of the design and the build quality. An effective PM program will ensure that the inherent reliability is realized. It cannot, however, improve the reliability of the system. This is only possible through redesign or modification. The application of PM is often misunderstood. It is easy to erroneously believe that the more an item is routinely maintained, the more reliable it will be. Often the opposite is the case, due to maintenance-induced failures. RCM was designed to balance the costs and benefits, to obtain tbe most cost-effective PM program. To achieve this, the desired system performance standards have to be specified. PM will not prevent all failures, and therefore the potential consequences of each failure must be identified and the likelihood of failure must be known. PM tasks are chosen to address each failure by using a set of applicability and effectiveness criteria. To be effective, a PM task must

The various steps are discussed in the following. Step 1: Study preparation In Step 1 an RCM project group is established. The project group must define and clarify the objectives and the scope of the analysis. Requirements, policies, and acceptance criteria with respect to safety and envi~nmen~ portion should be made visible as boundary conditions for the RCM analysis. Overall drawings and process diagrams, like piping and instrumentation diagrams, P&ID, must be made available. Possible discrepancies between the as-built documentation and the real plant must be identified. The resources that are available for tbe analysis are

Reliability centered maintenance usually limited. The RCM group should therefore be sober with respect to what to look into, realizing that analysis cost should not dominate potential benefits. Step 2: System selection and dehltion Before a decision to perform an RCM analysis at a plant is taken, two questions should be considered. 1. To which systems are an RCM analysis beneficial compared with more traditional maintenance planning? 2. At what level of assembly (plant, system, subsystem ...) should the analysis be conducted? All systems may in principle benefit from an RCM analysis. With limited resources, we must, however, make priorities, at least when introducing RCM in a new plant. We should start with the systems that we assume will benefit most from the analysis. Most operating plants have developed some sort of assembly hierarchy. In the offshore oil and gas industry this hierarchy is referred to as a tug number system. The following terms will be used in this article for the levels of the assembly hierarchy: Plant is a set of systems that function together to provide some sort of output. An offshore gas production platform is for example considered to be a plant. System is a set of subsystems that perform a mainfunction in the plant (e.g., generate el. power, supply steam). The gas compression system on an offshore gas production platform may for example be considered as a system. Note that the compression system may consist of several compressors with a high degree of redundancy. Redundant units performing the same main function should be included in the same system. The system level is recommended as the starting point for the RCM analysis5*9.This means that on an offshore oil/gas platform the starting point of the analysis should for example be the gas compression system, and not the whole platform. The systems may be broken down into subsystems, and subsubsystems, etc. For the purpose of the RCM analysis, the lowest level of the hierarchy will be the so-called analysis items: Analysis item is an item that is able to perform at least one significant function as a stand-alone item (e.g., pumps, valves, and electric motors). By this definition a shutdown valve is, for example, an analysis item, while the valve actuator is not. The actuator is a supporting equipment to the shutdown valve, and only has a function as a part of the valve. The importance of distinguishing the analysis items from their supporting equipment is clearly seen in the FMECA in Step 6. If an analysis item is found to have no significant failure modes, then none of the failure modes or causes of the supporting equipment am important, and therefore do not need to be addressed. Similarly, if an analysis item has only one significant failure mode, then the supporting equipment only needs to be analyzed to

123

determine if there are failure causes that may affect that particular failure mode *. Therefore only the failure modes and effects of the analysis items need to be analyzed in the FMECA in Step 6. By the RCM approach all maintenance tasks and maintenance intervals are decided for the analysis items. When it comes to the execution of a particular maintenance task on an analysis item, this will usually involve repair, replacement or testing of a component or part of the analysis item. These components/parts are identified in the EMECA in Step 6. The RCM analyst should always try to keep the analysis at the highest practical indenture level. The lower the level, the more difficult it is to define performance standards. It is important that the analysis items are selected and defined in a clear and unambiguous way in this initial phase of the RCM analysis, since the following steps of the analysis will be based on these items. If the 0REDA13 database is to be used in later phases of the RCM analysis, it is recommended to define the analysis items in compliance with the equipment units in OREDA. Step 3: Functional failure analysis (FFA) A specific system was selected in Step 2. The objectives of this step are as follows; (i) to identify and describe the system s required functions and performance criteria, (ii) to describe input interfaces required for the system to operate, and (iii) to identify the ways in which the system might fail to function. Step 3 (I): Identitication of system functions The system will usually have a high number of different functions. It is essential for the RCM analysis that all the important system functions are identified. The analyst may benefit from using a checklist or a classification scheme like the one presented later. The same classification may also be used in Step 6 to identify functions of analysis items. The term item is therefore used to denote either a system or an analysis item. Essentialfunctions - These are the functions required to fulfill the intended purpose of the item. The essential functions are simply the reasons for installing the item. An essential function of a pump is for example to pump a fluid. Auxiliary functions - These are the functions that are required to support the essential functions. A failure of an auxiliary function may in many cases be more critical than a failure of an essential function. An auxiliary function of a pump is for example containment of the fluid.

hf. Ruusand Protectivefunctions - The functions intended to protect people, equipment and the environment. An example of a pmtective function is the pmtection provided by a prossum safety valve on a pressure vessel. These functions comprise Znfonnation functions condition monitoring, various gauges and alarms etc.

functional block diagrams, reliability block diagrams, and fault tree~ ~. Step 3 (iit): Functional failures The next step is a functional failure analysis (RFA) to identify and describe the potential system failure modes. In most of the RCM references the system failure modes are denoted
fu~tio~Z failures.

apply to the interfaces between the item in question and other items. Tbe interfaces may be active or passive. A passive interface is for example present when an item is a support or a base for another item.
Supetjhousjknctions - According to Moubray4: Items or components are sometimes encountered which are completely superfluous, This usually happens when equipment was modified frequently over a period of years, or when new equipment has been overspecified. SuperiIuous functions are sometimes present when the item was designed for an operational context that is different from the actual operational context. In some cases failures of a superfluous function may cause failure of other functions. The various functions may also be classified as follows. On-line ~~~~~ - These are functions operated either continuously or so often that the user has current knowledge about their state. The termination of an on-line function is called an evident failure. Q&line functions - These. are functions that are used intermittently or so infrequently that their availability is not known by the user without some special check or test. An example of an off-line function is the essential function of an emergency shutdown (EBD) system. The te~ination of an off-line function is called a hidden failure.

Znte~ace~tio~

These fu~ons

A variety of classifications schemes for failure modes have been published16. Some of these schemes may be used to secure that all relevant functional failures are identified. We will need to classify failures as follows. Sudden failures - Failures that could not be forecast by prior testing or examination.
Gradual failures - Failures that could be forecast by testing or examination. A gradual failure will represent a gradual drifting out of the specified range of performance values. The recognition of gradual failures requires comparison of actual device performance with a performance specification, and may in some cases be a difficult task.

An important type of failures is the so-called aging failures, i.e., failures whose probability of occurrence increases with time, as a result of processes inherent in the item17. Aging failures are also called weurout failures. The aging failure is sometimes a gradual failure, meaning that the performance of the item is gradually drifting out of the specified range. In other cases the aging failure will be sudden. The inherent resistance of the item may gradually be reduced until a failure occurs. The performance of the item may in such cases be perfect until the failure occurs. The functional failures may be recorded on a specific FFA work-sheet, which is rather similar to a standard FMECA work-sheet. An example of an FFA work-sheet is shown in Fig. 2. In the first column of Fig. 2 the various operational modes of the system are recorded. For each o~~~on~ mode, all the relevant system functions are recorded in column 2. The performance requirements to each function, like target values and acceptable deviations are listed in column 3. For each system function (in column 2) all the relevant functional failures are listed in column 4. In columns 5-8 a criticality ranking of each functional failure in that particular operational mode is given, The reason for including the criticality ranking is to be able to limit the extent of the further analysis by ~s~g~~ng insigni~c~t functional failures. For complex systems such a screening is often very important in order not to waste time and money. The criticality must be judged on the plant level, and should be ranked in the four consequence classes: 0 S: Safety of personnel 0 E: Environmental impact

Items with bidden failures are often protective devices, whereas those with evident failures are the protected ones. Note that this classification of functions should only be used as a checklist to ensure that all important functions are revealed. Discussions about whether a function should be classified as essential or auxiliary etc. should be avoided. The system may in general have severa operational modes (e.g., running, and standby), and different functions for each operational mode. Step 3 (ii): I~en~~~tion of interfaces The various system functions may be represented e.g., by functional block diagrams, to illustrate the input interfaces to a functiorP4. In some cases we may want to split system functions into subfunctions on an increasing level of detail, down to functions of analysis items. This may be accomplished by both

Reliability centered maintenance

125

c-w

The combination of the FSIs and the MCSIs are denoted ~inte~~e sign~~ca~t items (MSI). Some authors5 claim that such a screening of critical items should not be done, othersI claim that the selection of critical items is very important in order not to waste time and money. We tend to agree with both. In some cases it may be beneficial to focus on critical items, in other cases we should analyze all items. In the FMECA in Step 6, each of the MSIs will be analyzed to identify potential failure modes and effects. Step 5: Data co@ction and analysis The various steps of the RCM analysis require a variety of input data, like design data, operational data, and reliability data ,. In this section we will only briefly discuss the necessary reliability data input. Reliability data is necessary to decide the criticality, to mathematically describe the failure process and to optimize the time between PM-tasks. Reliability data include a.o.15:
l l

Fig. 2. Example of an

FFA worksheet.

l l

A: Production availability C: Material loss (costs)

For each of these consequence classes the criticality may be ranked as for example; high (H), medium (M), low (L), or negligible (N), where the definition of the categories will depend on the specific application. If at least one of the four entries are medium (M) or high (H), the c~ticali~ of the functional failure should be classified as signiftcant, and be subject to further analysis. The frequency of the functional failure may also be classified in e.g., four categories. The frequency classes may be used to prioritize between the significant functional failures. If all the four criticality entries of a functional failure are low or negligible, and the frequency is also low, the failure is classified as insignificant, and disregarded in the further analysis. Step 4: Crtticai &em selectbn The objective of this step is to identify the analysis items that are potentially critical with respect to the functional failures identified in Step 3 (iii). These analysis items are denotedfunctional signijcunt items (FSI). Note that some of the less critical functional failures were disregarded at this stage of the analysis. For simple systems the FSIs may be identified without any formal analysis. In many cases it is obvious which analysis items that have influence on the system functions. For complex systems with an ample degree of tedundancy or with buffers, we may need a formal approach to identify the FSIs. Depending on the complexity of the system, importance ranking based on techniques like fault tree analysis, reliability block diagrams, or Monte Carlo simulation may be suitable15. In a petroleum production plant there is often a variety of buffers and rerouting possibilities. For such systems, Monte Carlo simul~on-by using computer programs like M~AM or MAROS-may often be the only feasible approach. In addition to the FSIs, we should also identify items with high failure rate, high repair costs, low maintainability, long lead time for spare parts, or items requiring external maintenance personnel. These analysis items are denoted muintenance cost significant items (MCSI).

mean time to failure (MTTF) mean time to repair (MTTR) 0 failure rate function z(t)

In many cases the failure rate will be an increasing function of time, indicating that the item is deteriorating. In other cases the failure rate may be decreasing, indicating that the item is improving. There are also cases where the failure rate is decreasing in one time interval and increasing in another. For repairable systems, the situation may be even more complex with a time de~ndent rate of occurrence of failures (rocof)t5. Several life models are available. Among these are; the Weibull distribution, the lognormal distribution, the Bimbaum-Saunders distribution, and the inverse Gaussian distribution15. All of these distributions are rather flexible, and may be used for detailed modeling of specific failure mechanisms. However, for most applications the class of Weibull distributions is sufficiently flexible to be the preferred dis~bution. In the rest of this article we will therefore assume that the time to failure follows a two-parameter Weibull distribution with shape parameter cx and scale parameter @15. In some cases the value of the shape parameter (Y may be estimated based on knowledge about the relevant failure mechanisms, i.e., based on expert judgment. The operational and reliability data are collected from available operating experience and from external files where reliability information from systems with similar design and operating conditions may be found (e.g., data banks, data h~d~ks, field data from own data storage, rn~uf~~r~ s r~ommendations). The external information available should be considered carefully before it is used, because such information is generally available at a rather coarse level. In some situations there is a complete lack of reliability data. This is the fact when developing a maintenance program for new systems. The maintenance program development

126

M. Rausand

Fig. 3. Example of an RCM-FMECAwork-sheet.

starts long before the equipment enters service. Helpful sources of information may then be experience data from similar equipment, directions from manufacturers and results from testing. The RCM method will even in this situation provide useful information. Step 6: Failure modes, effects and criticality analysis The objective of this step is to identify the dominantfailure modes of the MSIs identified in Step 4. A variety of different FMECA work-sheets are used in the main RCM references. The FMECA work-sheet used in our approach is presented in Fig. 3, and is more detailed than most of the FMECA work-sheets in the main RCM references. The various columns in our FMECA work-sheet are as follows:
MS1 The analysis item number in the assembly hierarchy (tag

measure. A failure of an MS1 will not necessarily give a worst case outcome resulting from e.g., redundancy, buffer capacities, etc. Conditional likelihood columns are therefore introduced.
Worst case probability The worst case probability is defined as the probability

that an equipment failure will give the worst case outcome. To obtain a numerical probability measure-, a system model is required. This will often be inappropriate at this stage of the analysis, and a descriptive measure may be used.
MlTF

number), optionally with a descriptive text.

Mean time to failure for each failure mode is recorded. Either a numerical measure or likelihood classes may be used. The information described so far should be entered for all failure modes. A screening may now be appropriate, giving only dominant failure modes, i.e., items with high criticality.
Criticality The criticality field is used to tag off the dominant failure

running and standby.

For each operational mode, the MS1 may have several functions. A function of a standby pump is for example to start
upon demand. Failure mode

modes according to some criticality measure. A criticality measure should take failure effect, worst case probability and MTTF into account. Yes is used to tag off the dominant failure modes. For the dominant failure modes the following fields are required:
Failure cause

A failure mode is the manner by which a failure is observed, and is defined as non-fulfillment of one of the functions.
Effect of failure/severity class The effect of a failure is described in terms of the worst

case outcome for the S, E, A, and C categories introduced in Step 3 (iii). The criticality may be specified by the same four classes as in Step 3 (iii), or by some numerical severity

For each failure mode there may be several failure causes. An MS1 failure mode will typically be caused by one or more component failures. Note that supporting equipment to the MSIs entered in the FMECA work-sheet is for the first time considered at this step. In this context a failure cause may therefore be a failure mode of a supporting equipment. A fail to close failure of a safety valve may for example be caused by a broken spring in the failsafe actuator.

Reliability Failure mechanism

centered muintenance

127

For each failure cause, there is one or several failure mechanisms. Examples of failure mechanisms are fatigue, corrosion, and wear.
%IUlTF The M ITF was entered on an MS1 failure mode level. It is

There are generally three main reasons for doing a PM task; 0 to prevent a failure to detect the onset of a failure l to discover a hidden failure
l

also interesting to know the (marginal) M ITF for each failure mechanism. To simplify, a per cent is given, and the (marginal) MTTF may be calculated for each failure mechanism. The BMTTF will obviously only be an approximation since the effects of the various failure mechanisms usually are strongly interdependent.
Failure characteristic

The following basic maintenance tasks are considered: 1. 2. 3. 4. 5. Scheduled on-condition task Scheduled overhaul Scheduled replacement Scheduled function test Run to failure

Failure propagation may be divided into three classes. The failure propagation may be measured by one or several (condition monitoring) indicators. The failure is referred to as a gradual failure . The failure probability is age-dependent, i.e., there is a predictable wearout limit. The failure is referred to as an aging failure . Complete randomness. The failure cannot be predicted by either condition monitoring indicators or by measuring the age of the item. The time to failure can only be described by an exponential distribution, and the failure is referred to as a sudden failure .
Maintenance action

Scheduled on-condition task is a task to determine the condition of an item, for example, by condition monitoring. There are three criteria that must be met for an on-condition task to be applicable3.

1. It must be possible to detect reduced failure resistance for a specific failure mode. 2. It must be possible to define a potential failure condition that can be detected by an explicit task. 3. There must be a reasonable consistent age interval between the time of potential failure (P) and the time of functional failure (F), as illustrated in Fig. 4.
Scheduled overhaul may be performed of an item at or before some specified age limit, and is often called hard time maintenance . An overhaul task is considered applicable to an item only if the following criteria are met3.

For each failure mechanism, an appropriate maintenance action may hopefully be found by the decision logic in Step 7. This field can therefore not be completed until Step 7 is performed.
Failure characteristic measure

For gradual failures , the condition monitoring indicators are listed by name. Aging failures are described by an aging parameter, i.e., the shape parameter (a) in the Weibull distribution is recorded.
Recommended maintenance interval

1. There must be an identifiable age at which there is a rapid increase in the item s failure rate function. 2. A large proportion of the units must survive to that age. 3. It must be possible to restore the original failure resistance of the item by reworking it.
Scheduled replacement is replacement of an item (or one of its parts) at or before some specified age limit. A scheduled replacement task is applicable only under the following circumstances3.

In this column the interval between consecutive maintenance tasks is given. The length of the interval is determined in Step 8.
Step 7: Sektion of Maintenance Actions

This step is the most novel compared to other maintenance planning techniques. A decision logic is used to guide the analyst through a question-and-answer process. The input to the RCM decision logic is the dominant failure modes from the FMECA in Step 6. The main idea is for each dominant failure mode to decide whether a PM task is applicable and effective, or it will be best to let the item deliberately run to failure and afterwards carry out a corrective maintenance task.

1. The item must be subject to a critical failure. 2. Test data must show that no failures are expected to occur below the specified life limit. 3. The item must be subject to a failure that has major economic (but not safety) consequences. 4. There must be an identifiable age at which the item shows a rapid increase in the failure rate function. 5. A large proportion of the units must survive to that age.
Scheduledfunction test is a scheduled failure-finding task or inspection of a hidden function to identify any failure. Failure-finding tasks are preventive only in the sense that they prevent surprises by revealing failures of hidden

128 Performance 4
100%

M. Rausand

0%

Thea&lelII0 befom

Fii

4. P-F curve.

functions, A scheduled function test task is applicable to an item under the following conditions3. 1. The item must be subject to a functional failure that is not evident to the operating crew during the performance of normal duties. 2. The item must be one for which no other type of task is applicable and effective.
Run to failure is a deliberate decision to run to failure because the other tasks are not possible or the economics are less favorable. PM will not prevent all failures. Consequently, if there is a clear identifiable failure mode that cannot be adequately addressed by an applicable and effective PM task that will reduce the probability of failure to an acceptable level, then there is need to redesign or modify the item. If the consequences of faihue relate to safety or the envi~~ent then this redesign ~co~en~tion will no~ally be rn~~to~. For operational and economic consequences of failure this may be desirable, but a cost-benefit as~ssment has to be performed. The criteria given for using the various tasks should only be considered as guidelines for selecting an appropriate task. A task might be found appropriate even if some of the criteria are not fulfilled. A variety of different RCM decision logic diagrams are used in the main RCM references. Some of these are rather complex. Our decision logic diagram is shown in Fig. 5, and is much simpler than those found in other RCM references. The resulting maintenance tasks will, however, in most cases be the same. It should be emphasized that such a logic can never cover all situations. For example in the situation of a hidden function with aging failures, a combination of scheduled replacements and function tests is required.

Step 8: Determination of maintenance intervals The RCM decision logic in Fig. 5 is used to decide PM tasks. Many of these PM tasks are to be performed at regular intervals. To determine an optimal interval is a very difficult

task that has to be based on information about the failure rate function, the likely consequences and costs of the failure the PM task is supposed to prevent, the cost and risk of the PM task, etc. A huge number of maintenance optimization models have been published, see reviews e.g, by Pierskalla and Voelker *, Valdez-Plores and Feldman 9, Cho and Par& , and Dekker. A general framework for maintenance optimization is presented in a recent article by Vatn et al**. Many of the articles on maintenance optimization were written by statisticians and scientists in operations research with limited knowledge about the practical context in which their models are supposed to be used, and in a language that is more or less inaccessible to maintenance practitioners. Another problem is that the vast majority of the models are based on the assumption that; (1) only single units are considered, and that (2) the cost of a single unit failure can easily be qu~tified in (discounted) rnone~~ units. A general problem with most of the models is that the necessary input data is seldom available - or, not in the format required by the models. In practice the various maintenance tasks have to be grouped into maintenance packages that are carried out at the same time, or in a specific sequence. The maintenance intervals can therefore not be optimized for each single item. The whole maintenance package has-at least to some degree-to be treated as an entity. Many practitioners have found these problems so overwhelming that they do not even try to use models to optimize the maintenance intervals. They rely on the manufacturers recommendations and past experience and therefore end up with too frequent maintenance. The remark made by Smiths (p. 103) is typical: ...it is the author s experience mat any introduction of quantitative reliability data or models into the RCM process only clouds the PM issue and raises credibility questions that are of no constructive value.. In most cases we have to adopt a pragmatic approach. According to the RCM Handbook: The best thing you can do if you lack good information about the effect of age

Reliability

centered maintenance

129

. Is aging Qmamemr (x,1? No Yes lo overhaul feasible?

Is the functiin hiin? No

YW

I------

m7p

-----I

Nodal : found I L--___-____-I

; 1

Fig. 5. Maintenancetask assignment/decisionlogic. on reliability is to pick a periodicity that seems right. Later, you can personally explore the characteristics of the hardware at hand by periodically in~e~~g the periodic@ and finding out what happens.. Step 9: Preventive maintenance comparison analysis Two overriding criteria for selecting maintenance tasks are used in RCM. Each task selected must meet two requirements:
l

* the unavailability of physical resources elsewhere while in use on this task l pr~uction unav~lability during m~nten~ce l unavailability of protective functions during maintenance of these In contrast, the cost of a failure may include: the consequences of the failure should it occur (i.e., loss of production, possible violation of laws or regulations, reduction in plant or personnel safety, or damage to other equipment) the consequences of not performing the PM task even if a failure does not occur (i.e., loss of warranty) increased premiums for emergency repairs (such as overtime, expediting costs, or high replacement power cost). Step 10: Treatment of non-MSIs In Step 4 critical items (MSIs) were selected for further analysis. A remaining question is what to do with the items which are not analyzed. For plants already having a maintenance program, a brief cost evaluation should be carried out. If the existing maintenance cost related to the non-M% is insignificant, it is reasonable to continue this program. See Paglia et al. I2 for further discussion. Step 11: Implementation A necessary basis for ~pl~n~ng the result of the RCM analysis is that the organizational and technical maintenance support functions are available. A main issue is therefore to ensure that these support functions are available. Experience shows that many accidents occur either during maintenance or because of in&qua& maintenance. When implementing a ~~~ program it is therefore

it must be applicable it must be effective

Applicability - meaning that the task is applicable in relation to our reliability knowledge and in relation to the consequences of failure. If a task is found based on the preceding analysis, it should satisfy the applicability criterion. A PM task is applicable if it can eliminate a failure, or at least reduce the probability of occurrence to an acceptable levelz3 - or reduce the impact of failures! Cast-e~ectjvene~~ - meaning that the task does not cost more than the failure(s) it is going to prevent. The PM task s effectiveness is a measure of how well it accomplishes that purpose and if it is worth doing. Clearly, when evaluating the effectiveness of a task, we are balancing the cost of performing the maintenance witb the cost of not performing it23. The cost of a PM task may include:

the risk/cost related to maintenance induced failures * the risk the maintenance personnel is exposed to during the task l the risk of increasing the likelihood of failure of another component while the one is out of service l the use and cost of physical resources
l

130

M. Rausand We see the RCM concept as a way to reduce this isolation by building bridges over the gap between the maintenance practitioners, the reliability engineers, and the statisticians and operation researchers working with maintenance optimization models. An RCM analysis provides a thorough un&~~~ng of system lotion, functional ~ui~~n~, unction failures, and causes and consequences of fun~on~ failures. This knowledge is established and documented through a teamwork and cooperation between various disciplines in the company. This teamwork may bridge existing gaps between disciplines within the company. In some cases an external consultant may also be involved in the RCM process. This consultant may sometimes have a contact with the research world, or themself be a researcher. It should, however, be realized on both sides of the gap that RCM only is a minor part of a total ~nten~~.systern. The PM tasks that come out of the RCM decision logic are only broad classes, like scheduled function test . This task description does not say how the task is to be performed, by whom, or how the results from the task are to be reported. To be applicable, the RCM analysis must fit into the company s total maintenance system. The main RCM message: cost reduction while maintaining (or improving) production regularity and safety and environmental protection, is generally appealing to the top pageant. It is therefore rather easy to sell the main RCM idea to the top plant m~age~nt, and also to the rn~n~n~ce managers. The main steps of the RCM analysis are easy to comprehend and perform by practitioners. They will easily realize benefits from the analysis process. The only really problematic step is the selection of maintenance intervals. This step relies on a number of complex probabilistic concepts that are usually difficult to fully understand and interpret. By making the other steps of the RCM process, the practitioners may, however, realize the irn~~ce of using models and data to select optimal intervals. This may create a good climate for fruitful communication with reliability engineers, statisticians, and operations researchers. Although a huge number of articles have been written about maintenance optimization, most of these missed the target-at least from a practitioner s point of view. RCM provides a means for communication, and hence a possible bridge over the gap between theory and practice. By using this bridge, the statisticians and operations researchers may get help to establish more realistic models and methods, and ~~sfo~ these into practical tools for the maintenance practitioners. Application of their models in a real situation will certainly be an incentive to improve their research. Many companies have skilled reliability engineers and statisticians among their own staff, who may support such a bridge, or act as a supplementary bridge. This is the case for many of the oil companies operating in the North Sea, and especially in Norway.

of vital importance to consider the risk associated with the various maintenance tasks. For complex maintenance operations, like for example offshore well workovers, it may be relevant to perform a task analysis combined with e.g., a Human HAZOP to reveal possible hazards and human errors related to the ~te~ce task. See also Hochz3 for a further discussion on omening the RCM analysis results. Step 12: In-service data cokction and updating The reliability data we have access to at the outset of the analysis may be scarce, or even second to none. In our opinion, one of the most significant advantages of RCM is that we systematically analyze and document the basis for our initial decisions, and, hence, can better utilize operating experience to adjust that decision as operating experience data become available. The full benefit of RCM is therefore only obtained when operation and maintenance experience is fed back into the analysis process. The updating process should be concentrated on three major time perspectives .
l l l

Short term interval adjustments Medium term task evaluation Long term revision of the initial strategy

For each signifi~t failure that occurs in the system, the failure ch~act~stics should be compared with the FMEC!A. If the failure was not covered adequately in the FMECA, the relevant part of the RCM analysis should, if necessary, be revised. The short term update may be considered as a revision of previous analysis results. The input to such an analysis is updated failure information and reliability estimates. This analysis should not require much resources, as the framework for the analysis is already established. Only Steps 5-8 in the RCM process will be affected by short term updates. The medium term update will more carefully review the basis for the selection of m~nten~ce actions in Step 7. Analysis of maintenance experience may identify significant failure causes not considered in the initial analysis, requiring an updated FMECA in Step 6. The long term revision will consider all steps in the analysis. It is not sufficient to consider only the system being analyzed, it is required to consider the entire plant with its relations to the outside world, e.g., contractual considerations, new laws regulating environmental protection etc.

4 GAP BETWEEN THEORY AND PRACTICE It has been claimed that2? ...there is between practitioners of maintenance and than in any other professional activity. aspects influencing this isolation-or, gap and practice-are discussed by Dekke? . more isolation the researchers A number of between theory

Relia~ili~

ce~ered

~in~e~nce

131

5 DISCUsslON A high number of dif%rent apptoaches to maintenance are on the market. It is generally difficult for the plant agent to decide whether RCM is mom beneficii than for example (TP?vQ2 -? The decision is Total Productive Map very important since the in~~n of a new ~n~n~~ plamring system, like RCM and TPM, will imply a sig~fic~t cost, and it may take several years before the benefits from the new system 0~~~s the initial costs. This interval is, for example, claimed to be ~~x~~ly 2 years for RCM. A consequence of inducing RCM will usually be to carry out a ~ndamen~l re-evaluation of a wide range of system support aspects, like training, spares, workshop facilities etc. In the defense area, a policy regime has grown up during the last 20 years, embracing both system support and RCM. This regime is called Integrated Logistic Support (ILS) and is supported e.g., by military standards30. A company int~ucing RCM may later extend this system to ILS. The success of RCM relies partly on the av~lability of efficient and user-f~endly software; both general maintenance m~agement software (MMS), and more specialized software, e.g., for FF+A and FMECA, life data analysis, system analysis, and interval selection. RCM-and the m~nten~ce discipline in general-has a lot of challenges in the years to come. One of these challenges is connected to condition monitoring, a method that has become increasingly popular during the last few years. A lot of complex and expensive condition monitoring equipment has been installed, often without a sound scientific basis. The ~lationship between a condition me~urement and the rern~~ng time to failure is in many cases not fully understood. It is, for example, not obvious that a minor vibration of a pump is an vocation of a fo~~ming pump failure. Condition monito~ng has without doubt reduced the number of criticaf failures, but it is reason to believe that it also has implied a fair amount of unnecess~ m~nten~ce - and, some of the condition monito~ng equipment will in addition require substantial m~nten~ce. These problems should be subject to more detailed research. In practice it is often difficult to follow prescribed maintenance intervals (even if we are able to decide optimal intervais in RCM). Failures of important equipment will
inevitably be given priority, delay long-planned activities, and create a ba&Iog. This bac.kIog may add up and create a

based on a joint article which is part of his PhD thesisI. The author is grateful to and would like to thank an anonymous reviewer for constructive suggestions to improve the article.

EVINCES
1. Sandtorv, H. & Rausand,M. R~~~l~ing the loop between &sign and operation pliability. ~~~n~e~e, 1991, 6(l), 13-21. 2. Barnes, R. The reality of ~liabili~ centered m~nte~ce. Journal of the Safety and ReIi~ili~ Society, 1996, 15(3), 6-12. 3. Nowlan, F.S. and Heap, H.F., Reliability~n~~d Maintenance, Tech. Rep. AD/AO&579, National Technical Information Service, US Department of Commerce, Springfield, Virginia, 1978. 4. Moubray, J., Re~iabili~-~entred ~ainte~nce, ButterworthHeinemann, Oxford, 1991. 5. Smith, A. M., ReIi~ifi~-Centered ~ainte~nce, McGrawHill, New York, 1993. ~a~ge~~; Part 3. I I: RCbl 6. IEC 300-?- 11, De~~iIi~ Guide (draft). Intemation~ Ele~trot~hni~~ Commission, Geneva, 1996. 7. NAVAIR 00-25-403, GuideI~nes for the Naval Aviation Reli~ili~ Centered ~ainte~e Process. Internet address: ht~:f/namo~~.nawc~.navy.mil. 8. MIL-STD 1843, Re~i~iIi~-Centered Maintenance. US Department of Defense, Washington DC 20301. Maintenance. 9. MIL-STD 2 I73( AS), Reii~jli~-Centered Requirements for Naval Aircrafr, Weapon Systems and Support Equipment. US Department of Defense, Washington DC 20301, 1986. 10. RCM Handbook, Reli~ili~ Centered sentence Handbook, Naval Sea Systems Come SKI-~-GIB-~IW US Department of Defense, W~hin~on DC BAIT, 20301, 1983. opti~iz~~on: gels and methods. 11. Vatn, J., ~ainte~ce PhD dis~~tion, No~egi~ Unive~ity of Science and Technology, ~p~ent of caption and Quality Engineering, N-7034 T~n~eim, Norway, 1996. 12. Paglia, A., Barnard, D. and Sonnett, D., A Case Study of the RCM Project at V.C. Summer Nucfear Generating Station. 4th Inte~tio~I Power Generation Exhibition and Conference, Tampa, Florida, USA, 1991.5, pp. 1003- 1013. 13. OREDA-1992, Ofihore Reliabif~~ Data. DNV Technica, P.O.Box 300, 1322 Hovik, Norway, 1992. 14. Pahl, G. and Beitx, W., Engineering Design. The Design Council, London, 1984. 15. Heyland, A. and Rausand, M., System Reii~ili~ Theory; ~odeis and Statistical fete. John Wiley & Sons, New York, 1994. 16. Rausand, M. & f&en, K. The basic concepts of failure analysis. Reli~ili~ ~ng~nee~g and System Safety, 1996, 53, 73-83. and quality of service. In Znter17. IEC 50(191), De~n~bility nat~~l Electrote~~i~a~ V~~u~~ {IEVI, Ch. 191, Intetnational El~~~hni~ Commission, Geneva, 1990. 18. Pierskalla, W. P. & Voelker, J. A. A survey of maintenance models: the control and surveillance of deteriorating systems. Naval Research Logistics Quarterly, 1976,23, 353-388. 19. Valdez-Flares, C. & Feldman, R. A survey of preventive maintenance models for stochastically deteriorating singleunit systems. Naval Research Logistics Quarterly, 1989, 36,4 19-446.

occult situation for the m~nten~ce dep~ment, and destroy the whole RCM program. Another probiem is how to integrate op~~nity maintenance in an RCM pro~am. ~~~ni~ rn~n~n~ce is discussed in the literature, e.g., by Dekker and Smeiti~3 , but it is still not obvious how to plan and integrate this important type of maintenance with RCM.

The RCM approach presented in this articie was developed through extensive discussions with J$rn Vatn, and is

132

hf. Rausand 25. Kirwan, B., A Guide to Practical Human Reliabihy Assessment, Taylor & Francis, London, 1994. 26. Mahk, M. Reliable preventive maintenance scheduling. AZEE Trans., 1979, 11.221-228. 27. Nakajima, S., Introduction to TPM: total productive maintenance, Productivity Press, Cambridge, Mass., 1988. 28. Willmott, P., Total Productive Maintenance: the Western way, Butterworth-Heinemann, Oxford, 1994. 29. Suzuki, T., ed., TPM in process industries, Productivity Press, Portland, Or., 1994. 30. MIL-STD 1388, Logistic Support Analysis, US Department of Defense, Washington DC 20301, 1983. 3 1. Dekker, R. & Smeitink, E. Preventive maintenance at opportunities of restricted duration. Naval Research Logistics, 1994,41,335-353.

20. Cho, D. I. dt Pa&u, M. A survey of maintenance models for multi-unit systems. Europeon Journal of Operations Research, 1991,51, 1-23. 21. Dekker, R. Application of maintenance optimization models: a review and analysis. Reliability Engineering and System Safety, 19%, 51,229-240. 22. Vatn, J., Hokstad, P. & Bodsberg, L. An overall model for maintenance optimixation. Reliability Engineering and System Safety, 1996, 51,241-257. 23. Hoch, R., A Practical Application of Reliability Centered Maintenance. The American Society of Mechanical Engineers, 90-JPCXYPwr-S1, Joint ASMEIJBEE Power Generation Conference, Boston, MA, 21-25 Oct., 1990. 24. Kit-wan, B. and Ainswortb, L. K., A Guide to Task Analysis, Taylor & Francis, London, 1992.