FMEA, Criticality Analysis and Reliability-Centred Maintenance

Introduction

Maintenance engineering has moved from a largely reactive activity—repairing equipment after failure—to a structured discipline concerned with risk, function, performance and life-cycle cost. Three closely related methods support this transition:

• Failure Modes and Effects Analysis (FMEA) identifies how an item can fail and what follows from each failure.
• Failure Modes, Effects and Criticality Analysis (FMECA) adds a systematic assessment of failure significance.
• Reliability-Centred Maintenance (RCM) selects maintenance policies according to functions, functional failures, failure modes, consequences and technically feasible tasks.

These methods are complementary rather than interchangeable. FMEA is primarily a failure-analysis method; criticality analysis ranks risk or consequence; RCM is a decision process for defining an appropriate maintenance programme. Their purpose is not to maximize maintenance, but to manage failure risk at an economically and technically justified level.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Define functions, functional failures, failure modes, effects and consequences.
2. Construct and interpret an FMEA or FMECA worksheet.
3. Distinguish qualitative, semi-quantitative and quantitative criticality methods.
4. Calculate and interpret risk-priority measures while recognizing their limitations.
5. Apply the seven-question RCM process.
6. Select condition-based, scheduled restoration, scheduled discard, failure-finding, redesign or run-to-failure policies.
7. Judge whether a proposed task is technically feasible and economically justified.
8. Recognize human, safety, environmental, regulatory and data-quality issues in maintenance decisions.

1. Maintenance Decisions as Risk Decisions

A physical asset provides value through its functions. A pump may be required to deliver 40 m³/h at a specified pressure; a brake system may be required to stop a vehicle within a defined distance; a protective relay may be required to detect an abnormal condition and trip a circuit. Maintenance is justified only in relation to these required functions.

A useful distinction is:

• Reliability: the probability that an item performs a required function for a stated time under stated conditions.
• Maintainability: the probability that an item can be restored to a specified condition within a stated time using prescribed resources.
• Availability: the proportion of time, or probability at a time, that an item is capable of performing its required function.
• Risk: the combination of the likelihood of an event and the severity of its consequences.

A maintenance programme should therefore answer four questions:

1. What must the asset do?
2. How can it fail to do it?
3. What happens when it fails?
4. What action gives an acceptable level of risk at an acceptable life-cycle cost?

2. FMEA and FMECA Foundations

2.1 Hierarchical analysis

Analysis begins by defining the boundary and level of resolution. A plant may be divided into systems, subsystems, assemblies, components and parts. For example:

Cooling plant → chilled-water pump system → pump assembly → bearing assembly → rolling-element bearing

The boundary should identify interfaces, operating modes, assumptions and relevant environmental conditions. An analysis that is too broad becomes vague; one that is too detailed can consume resources without improving decisions.

2.2 Essential terminology

A function must contain a performance standard. “Provide lubrication” is incomplete; “deliver clean oil at 2.0 ± 0.2 bar at the specified flow” is more useful. A functional failure is judged against the stated standard, not against an idealized condition.

2.3 FMEA logic

A conventional FMEA proceeds from function to functional failure, failure mode, failure effect, cause, existing controls and recommended action. The analysis should consider normal operation, start-up, shutdown, standby, emergency and maintenance modes where relevant.

Failure modes should be stated at the right level. “Pump fails” is too general. Better examples are:

• impeller erosion reduces delivered head;
• mechanical seal loses containment;
• motor winding insulation breaks down;
• suction strainer becomes blocked;
• standby pump fails to start on demand.

The effect should describe what the operator or system experiences, such as reduced flow, leakage, overheating, loss of redundancy, production interruption or exposure to hazardous material. Causes may include incorrect material selection, inadequate lubrication, contamination, misalignment, overload, control-system error or human error.

2.4 FMEA worksheet

A practical worksheet may contain the following fields:

The worksheet is a reasoning record, not merely a scoring form. Every score should be traceable to evidence, assumptions and a defined scale.

3. Criticality Analysis

3.1 Qualitative criticality

Qualitative analysis classifies failures using categories such as safety, environmental, production, quality, repair cost and reputation. A simple matrix may classify consequence as minor, moderate, major or catastrophic and likelihood as rare, occasional, probable or frequent. The resulting ranking supports resource allocation, but category definitions must be explicit.

A high-consequence, low-frequency event may deserve greater attention than a frequent nuisance failure. Conversely, a frequent low-consequence failure may dominate maintenance cost. Criticality is therefore not identical to failure frequency.

3.2 Risk-priority number

Many organizations use three ordinal ratings:

where S is severity, O is occurrence likelihood and D is difficulty of detection before consequence occurs. Each is commonly rated from 1 to 10, but the scales are organizational conventions rather than physical measurements. A high detection number means poor detectability.

RPN is useful for screening when rating definitions are consistent. It has important weaknesses: ordinal scores are not necessarily proportional; different combinations can produce the same product; a catastrophic event can be masked by low occurrence; and small scoring changes can alter rank. Safety and environmental constraints should therefore be treated as threshold criteria, not left entirely to multiplication.

3.3 Quantitative criticality

Where data are adequate, risk can be represented as an expected-loss measure:

where E[L] is expected loss per selected period, pᵢ is the probability of consequence scenario i in that period, and Cᵢ is its consequence in monetary or other defined units. The scenarios must be mutually exclusive or otherwise modelled to avoid double counting.

For a simple constant-rate failure model, failure probability over time t is:

where λ is a constant failure rate in failures per unit time and t is the exposure time. This expression assumes a constant hazard rate and is not appropriate when failure rate changes substantially with age, condition or operating regime.

If a component has a failure rate of 0.002 failures per hour, the probability of at least one failure in 100 hours is:

Thus the probability is approximately 18.1%, not 20%; the approximation λt is reasonable only when λt is small.

3.4 Criticality ranking principles

A defensible ranking normally considers:

• injury or fatality potential;
• environmental release and legal limits;
• loss of essential service;
• production rate and quality;
• redundancy and restoration time;
• spare-part and specialist-resource availability;
• failure frequency and uncertainty;
• detectability and warning time;
• repair, collateral and business interruption cost.

Criticality should be reviewed after design changes, incidents, new evidence or changes in operating context.

4. Reliability-Centred Maintenance

RCM is a structured process for determining what must be done to ensure that physical assets continue to perform their required functions in their present operating context. It does not assume that every item requires preventive replacement.

4.1 The seven RCM questions

For each significant asset or system, ask:

1. What are the required functions and performance standards?
2. In what ways can it fail to fulfil its functions?
3. What causes each functional failure?
4. What happens when each failure occurs?
5. Why does each failure matter?
6. What task can predict or prevent the failure, or reduce its consequence?
7. What should be done if no suitable proactive task exists?

The fifth question classifies consequences. They may be:

• hidden: not evident during normal operation, often involving protective devices;
• safety or environmental: capable of injury, fatality or regulated environmental harm;
• operational: affecting output, quality, speed, service or operating cost;
• non-operational: involving repair cost without direct operational effect.

4.2 Selecting maintenance tasks

#### Condition-based maintenance

A condition-based task is technically feasible when a measurable condition has a useful relationship with impending functional failure and an adequate warning interval exists. Examples include vibration analysis, thermography, oil debris analysis, ultrasonic inspection and performance trending.

The condition indicator should be observable, sufficiently sensitive and economically measurable. A temperature check that changes only after catastrophic damage is not a useful predictive task.

#### Scheduled restoration

Scheduled restoration restores an item to a specified condition at a defined age, such as overhaul or refurbishment. It is appropriate when there is a recognizable age-related failure pattern and restoration is practical.

#### Scheduled discard

Scheduled discard replaces an item at a defined age. It is suitable when age materially increases failure probability and replacement is more reliable or economical than continued operation.

#### Failure-finding

A failure-finding task periodically tests a hidden protective function, such as an emergency shutdown, standby pump or relief device. The test must demonstrate the required function, not merely show that a component has power.

If a protective device has an estimated unavailability during a test interval T and a constant failure rate λ, under a simplified one-failure and immediate-repair assumption:

The factor 1/2 arises because a failure occurring uniformly between tests is, on average, present for half the interval. This approximation excludes common-cause failures, imperfect testing, repair delay and test-induced failures.

#### Run-to-failure

Corrective maintenance may be selected when failure has low consequence, no effective proactive task exists and repair or replacement resources are available. Run-to-failure is a deliberate policy, not neglect.

#### Redesign or one-time change

A design modification, process change, training intervention or procedural control may be required when no maintenance task can adequately manage the risk. Examples include eliminating a contamination source, improving guarding, changing materials or adding redundancy.

4.3 Technical feasibility and economic justification

A task is technically feasible only if it can detect or prevent the relevant failure with adequate reliability, timing and access. It must also avoid introducing unacceptable hazards. Economic justification compares the life-cycle cost of the task with the avoided expected consequences, while respecting safety and legal requirements.

A simplified net benefit may be expressed as:

where B_A is the annualized avoided failure consequence and C_A is the annualized cost of the maintenance action. A positive value supports adoption only when non-monetary constraints are satisfied. Costs may include labour, instruments, shutdowns, spares, training and false alarms; benefits may include avoided repair, downtime, environmental response and quality loss.

For comparing alternatives over multiple years, present value can be used:

where CFₜ is the net cash flow in year t, r is the discount rate per year, and N is the analysis horizon. Cash flows must be stated consistently as nominal or real values. Safety decisions should not be reduced to financial payback alone.

5. Worked FMECA Example: Cooling-Water Pump

Consider a centrifugal pump supplying cooling water to a heat exchanger. Its required function is to deliver at least 40 m³/h at 3.0 bar continuously during production. The pump has a standby unit, but the standby starts automatically only if the duty-pump discharge pressure falls below a set point.

One failure mode is mechanical-seal leakage caused by seal-face wear and contaminated water. The effects are progressive leakage, possible loss of pressure, contamination of the surrounding area and eventual pump trip. If the standby starts successfully, production continues but maintenance and cleanup are required. If the standby fails to start, cooling is lost and the process may trip.

An illustrative ordinal assessment uses scales from 1 to 10:

The RPN is a screening value, not a probability. The analysis identifies several actions:

1. trend seal leakage and bearing vibration during operator rounds;
2. improve water filtration and verify seal-material compatibility;
3. test automatic standby changeover monthly;
4. establish a leakage alarm where practical;
5. keep a seal kit and defined replacement procedure available.

A monthly standby test is a failure-finding task because the standby function is hidden during normal duty-pump operation. A condition check is appropriate for leakage and vibration if the warning interval exceeds the inspection interval. Replacing the seal at a fixed age should not be imposed automatically; if wear varies with contamination and load, condition monitoring may be more effective.

6. Detailed Illustrative Case: Packaging-Line Compressed-Air System

Background

A packaging line uses compressed air for actuators, product-contact valves and emergency stops. Unplanned pressure loss causes rejected product and line stoppage. The plant has experienced repeated compressor trips, but maintenance has focused on repairing failed compressors.

Problem definition

The required system function is to supply clean, dry air at 6.5–7.5 bar at the point of use during production. Important functional failures include insufficient pressure, excessive moisture, contamination and failure of the emergency isolation function.

Analysis

A cross-functional team consisting of operations, maintenance, engineering, safety and quality personnel builds an FMEA. Major failure modes include:

• compressor oil carryover due to separator deterioration;
• dryer failure causing condensation and valve sticking;
• receiver drain stuck closed, allowing water accumulation;
• distribution leak causing pressure loss;
• pressure switch calibration drift;
• emergency isolation valve failing to close on demand.

The emergency isolation valve has a hidden failure mode with potentially severe safety consequences. Its criticality cannot be judged by production frequency alone. The dryer has an operational and quality consequence, while a distribution leak may be frequent but comparatively moderate.

RCM decisions

For the compressor separator, differential-pressure and oil-carryover monitoring are technically feasible condition tasks. For the dryer, dew-point measurement provides a direct performance indicator. Receiver drains require scheduled inspection or an automatic drain with functional testing. Distribution leakage is managed through periodic ultrasonic surveys and repair prioritization. The emergency isolation valve receives a documented failure-finding test at a defined interval, with safe test arrangements and recorded results.

A fixed-time compressor overhaul is rejected initially because the evidence does not show a clear age-related pattern. Instead, oil analysis, vibration monitoring and performance testing are introduced. A redesign is selected for the receiver drain because repeated manual draining is unreliable and exposes workers to avoidable tasks.

Economic assessment

Suppose an ultrasonic leak survey costs 1,200 monetary units annually and is expected to avoid 2,000 units of compressed-air energy loss plus 1,000 units of annualized downtime. Its simplified net benefit is:

The calculation supports the survey, subject to the assumptions being credible. It does not by itself justify reducing safety tests on the emergency isolation valve, because safety obligations are not optional economic trade-offs.

Outcome

After implementation, the plant records fewer pressure-related stoppages, improved dew-point compliance and better assurance that emergency isolation will operate when demanded. The most important improvement is not a larger preventive-maintenance schedule; it is alignment between asset functions, failure consequences, monitoring methods and management of hidden failures.

Learning points

1. A system-level function is more informative than a list of component names.
2. Different failure modes require different policies.
3. Hidden protective failures need proof testing.
4. Condition monitoring is valuable only when it provides actionable warning.
5. Design and process changes may be better than more inspections.
6. Safety decisions require governance beyond financial optimization.

7. Data, Human Factors and Governance

FMEA quality depends on the quality of the team and evidence. Useful sources include maintenance records, inspection findings, engineering drawings, operating procedures, incident reports, manufacturer information and operator experience. Historical records may under-report near misses, misclassify causes or reflect past maintenance policies rather than intrinsic failure behaviour.

Human factors must be included explicitly. Incorrect assembly, inadequate torque, bypassed alarms, poor shift handover, confusing interfaces and access constraints can be causes or contributors to failure. Blaming an individual without examining system design produces weak corrective action.

The analysis should be governed through:

• defined rating scales and approval responsibilities;
• revision control and configuration management;
• traceable assumptions and evidence;
• review after modifications, incidents and changed operating context;
• competence requirements for inspectors and analysts;
• protection of safety-critical test records;
• clear ownership, due dates and effectiveness checks.

Artificial intelligence and machine learning can assist with anomaly detection, failure-text classification and prioritization of inspection data. They do not replace functional analysis or engineering judgment. A model trained on biased work orders may reproduce historical neglect, and an unexplained alarm can create either false confidence or unnecessary maintenance. Human oversight, data validation, cybersecurity and fail-safe design remain essential.

8. Common Errors and Best Practices

Common errors

• treating every component as equally important;
• confusing a failure cause with a failure effect;
• using vague failure modes such as “pump failed”;
• multiplying ordinal scores as if they were measured probabilities;
• selecting fixed-time replacement without evidence of age-related failure;
• ignoring hidden failures and common-cause failures;
• recommending inspections without specifying method, interval and acceptance criterion;
• counting an action as complete without verifying effectiveness;
• allowing the worksheet to become detached from the maintenance-management system.

Best practices

1. Define functions with measurable performance standards.
2. Establish the analysis boundary and operating context first.
3. Use a multidisciplinary team, including operators and maintainers.
4. Separate consequence screening from detailed task selection.
5. Give safety and environmental consequences explicit priority.
6. Link each task to a failure mode and a decision rationale.
7. Specify who performs the task, how, when and what constitutes acceptance.
8. Use failure data cautiously and state uncertainty.
9. Review task results and remove ineffective work.
10. Integrate recommendations into procedures, bills of materials, skills training and work planning.

Chapter Summary

FMEA identifies functions, functional failures, failure modes, causes, effects and existing controls. FMECA extends this process by ranking failure significance. Criticality may be qualitative, ordinal or quantitative; RPN is a screening tool with recognized limitations and must not conceal catastrophic consequences. Quantitative risk calculations require explicit assumptions about probability, consequence and exposure.

RCM uses a structured seven-question process to select maintenance policies in relation to asset functions and consequences. Technically feasible tasks include condition-based maintenance, scheduled restoration, scheduled discard and failure-finding. When no effective task exists, redesign, procedural change or deliberate run-to-failure may be appropriate. Economic analysis supports decisions but cannot override safety, environmental or regulatory obligations. Effective implementation requires reliable data, multidisciplinary judgment, human-factors awareness, governance and continuous review.

Key Terms

FMEA: A systematic analysis of failure modes, causes and effects.

FMECA: FMEA supplemented by a criticality assessment.

Function: The required purpose and performance standard of an asset or component.

Functional failure: Inability to meet a required function.

Failure mode: The specific manner in which a failure occurs.

Failure cause: The physical, human or organizational reason for a failure mode.

Failure effect: The consequence experienced locally, by the system or by the plant.

Criticality: Relative significance of a failure based on likelihood and consequence.

Risk: Combination of likelihood and consequence.

RPN: Product of severity, occurrence and detection ratings.

Hidden failure: Failure not evident during normal operation.

RCM: A process for selecting maintenance policies according to functions and consequences.

Condition-based maintenance: Maintenance initiated by evidence of deteriorating condition.

Scheduled restoration: Planned restoration of an item at a defined age or interval.

Scheduled discard: Planned replacement at a defined age or interval.

Failure-finding: Periodic testing of a hidden protective function.

Run-to-failure: Deliberate corrective maintenance after failure when justified.

Warning interval: Time between detectable deterioration and functional failure.

Common-cause failure: Multiple failures arising from one shared cause.

Life-cycle cost: Total cost of acquisition, operation, maintenance, risk and disposal.

Review Questions

5 Short Answer Questions

1. Distinguish a failure mode from a failure cause.
2. Why must an asset function include a performance standard?
3. What is a hidden failure, and why does it require special treatment?
4. State two limitations of the risk-priority number.
5. Give two examples of condition-based maintenance techniques.

5 Long Answer Questions

1. Explain the relationship between FMEA, FMECA, criticality analysis and RCM.
2. Describe the seven RCM questions and explain how they lead to a maintenance policy.
3. Compare scheduled restoration, scheduled discard, condition-based maintenance and run-to-failure.
4. Explain why safety-critical failures should not be ranked solely by RPN.
5. Discuss the roles of data quality, human factors and governance in a successful FMECA programme.

3 Analytical / Application Questions

1. A standby fire pump is not normally operated. Develop an FMEA entry for failure of its automatic start function and recommend an appropriate RCM task.
2. A bearing has a failure rate of 0.001 failures per hour under a constant-rate assumption. Calculate the probability of failure during 200 hours and explain whether the constant-rate assumption is credible for a newly installed bearing.
3. A plant proposes replacing a valve every two years, although records show failures occur at highly variable ages and condition inspections provide warning. Evaluate the proposal and recommend a technically justified alternative.

Multiple Choice Questions with Answers

Question 1

Which statement best defines a functional failure?

A. Any visible deterioration of a component

B. The inability of an item to meet a required function or performance standard

C. The physical mechanism causing wear

D. The cost of restoring an item

Correct Answer: B. The inability of an item to meet a required function or performance standard

Question 2

In an FMEA, which item describes the specific manner in which a failure occurs?

A. Failure mode

B. Failure effect

C. Failure consequence cost

D. Maintenance interval

Correct Answer: A. Failure mode

Question 3

If severity is 8, occurrence is 3 and detection is 5, what is the illustrative RPN?

A. 16

B. 40

C. 120

D. 135

Correct Answer: C. 120

Question 4

A high detection rating in the conventional RPN method generally indicates that the failure is:

A. Easy to detect before its effect occurs

B. Difficult to detect before its effect occurs

C. Certain to occur

D. Low in consequence

Correct Answer: B. Difficult to detect before its effect occurs

Question 5

Which RCM task is intended primarily to reveal a hidden failure in a standby protective device?

A. Failure-finding task

B. Cosmetic inspection

C. Scheduled discard only

D. Run-to-failure task

Correct Answer: A. Failure-finding task

Question 6

For a constant failure rate λ, the probability of at least one failure by time t is:

A. λ ÷ t

B. e^(−λt)

C. 1 − e^(−λt)

D. 1 − λ − t

Correct Answer: C. 1 − e^(−λt)

Question 7

A condition-based task is technically feasible when it:

A. Is performed at the same interval for every asset

B. Detects a meaningful condition with sufficient warning before functional failure

C. Always costs less than corrective maintenance

D. Eliminates all possible failure modes

Correct Answer: B. Detects a meaningful condition with sufficient warning before functional failure

Question 8

Which decision is most appropriate when no proactive task can manage a low-consequence failure and repair resources are readily available?

A. Mandatory weekly overhaul

B. Automatic redesign of the whole plant

C. Deliberate run-to-failure

D. Immediate asset retirement

Correct Answer: C. Deliberate run-to-failure

Question 9

If λ = 0.002 failures/hour and t = 100 hours, the constant-rate failure probability is approximately:

A. 0.002%

B. 2.0%

C. 18.1%

D. 99.8%

Correct Answer: C. 18.1%

Question 10

Why should safety consequences not be managed solely by multiplying ordinal RPN scores?

A. Ordinal scores always have monetary units

B. A catastrophic consequence can be masked by low occurrence or detection scores

C. RPN can only be used for rotating equipment

D. Severity cannot be assessed by a team

Correct Answer: B. A catastrophic consequence can be masked by low occurrence or detection scores