Failure Analysis and Reliability-Centred Maintenance

Introduction and Context

Maintenance decisions are most effective when they are based on how equipment can fail, why failure occurs, what consequences result, and which intervention can manage the associated risk. Failure analysis converts operating experience and engineering knowledge into structured evidence. Reliability-centred maintenance (RCM) then uses that evidence to select technically feasible and economically justified maintenance tasks.

Traditional maintenance often follows a calendar: components are inspected, overhauled, or replaced at predetermined intervals. This approach can be appropriate for age-related degradation, but it may be wasteful when failures are random, and it may be unsafe when hidden failures are not detected. RCM takes a different starting point. It asks what functions an asset must perform, how those functions can be lost, what consequences follow, and what maintenance policy best controls those consequences.

Failure analysis and RCM are therefore complementary. Functional analysis defines the required performance. Failure Modes and Effects Analysis (FMEA) and Failure Modes, Effects and Criticality Analysis (FMECA) identify and prioritise failure modes. Fault-tree analysis (FTA) reasons deductively from an undesirable top event to its possible causes. Root-cause analysis (RCA) investigates why a particular failure occurred. Pareto analysis helps concentrate improvement effort. RCM integrates these methods into a defensible maintenance programme.

Learning Objectives

After completing this chapter, the learner should be able to:

1. Distinguish functions, functional failures, failure modes, effects, and consequences.
2. Construct and interpret FMEA/FMECA and fault trees.
3. Apply RCA and Pareto analysis without confusing symptoms with causes.
4. Calculate and interpret basic reliability and risk measures.
5. Select condition-based, time-directed, failure-finding, redesign, or run-to-failure tasks using RCM logic.
6. Evaluate the organisational, economic, safety, and ethical implications of maintenance decisions.

1. The Logic of Failure Analysis

A useful failure description has several levels:

• Asset: the physical item being managed, such as a pump or compressor.
• Function: what the asset must do, including performance standard and operating context.
• Functional failure: the inability to perform a required function to the specified standard.
• Failure mode: the specific manner in which the functional failure occurs.
• Failure cause: the physical, human, organisational, or environmental reason for the failure mode.
• Failure effect: what is observed locally and at system level.
• Failure consequence: the broader impact on safety, environment, production, quality, cost, or compliance.

For example, the function of a cooling-water pump may be to deliver 120 m³/h at a specified pressure. A functional failure is delivery below the minimum required flow. Possible failure modes include impeller erosion, motor overload, suction blockage, and seal leakage. A cause may be abrasive solids in the water; an effect may be reduced flow and rising bearing temperature; a consequence may be product loss or an unsafe reactor temperature.

This hierarchy prevents a common analytical error: treating a component name as a failure mode. “Bearing failure” is incomplete. The analyst should state whether the bearing seized, developed excessive clearance, overheated, or produced unacceptable vibration, and should then investigate the causal mechanism.

Reliability terminology and measures

Reliability is the probability that an item performs its required function for a specified time under stated conditions. For a non-repairable item, reliability is commonly represented by:

where R(t) is reliability at time t, T is the random time to failure, and F(t) is the cumulative distribution function of failure time. The equation applies to a defined population, mission, operating environment, and failure criterion.

For an exponential time-to-failure model with constant failure rate λ:

Here λ has units of failures per unit time, t has the corresponding time unit, and λ is assumed constant. The mean time to failure is:

This model is appropriate only when the constant-hazard assumption is reasonable. It should not be used automatically for components with infant mortality or wear-out behaviour.

For repairable equipment, availability is often more relevant than reliability. Under stable operating conditions and when repair and operating times can be approximated by their means:

MTBF is mean time between failures and MTTR is mean time to repair. Both must use the same time unit. This expression describes inherent or operational availability only according to the time definitions adopted; planned downtime, logistics delays, and administrative delays must be treated consistently.

2. Functional Analysis as the Foundation of RCM

RCM begins with the asset boundary and operating context. The analyst records duty cycle, loading, environment, interfaces, performance requirements, redundancy, regulations, and consequences of failure. A function should include a verb, an object, and a measurable performance standard.

For a compressed-air system, functions might include:

• supply air at 7 bar ± 0.2 bar;
• remove condensate before it reaches the process;
• protect the receiver from overpressure;
• indicate pressure locally and in the control room;
• contain lubricating oil without unacceptable leakage.

Each function is translated into one or more functional failures. The statement “compressor failure” is too broad. More useful statements are “cannot deliver at least 500 Nm³/h at 7 bar” or “cannot stop automatically at the high-pressure trip set point.”

The operating context matters because the same failure mode can have different consequences. A standby fire pump that fails while idle may have no immediate production effect, but its failure may remain hidden until a fire demand occurs. A continuously monitored process pump may show early warning through vibration and temperature trends.

A practical functional-analysis worksheet should contain asset identification, function, performance standard, functional failure, operating mode, protection layers, and consequence category. It should be reviewed with operators, maintainers, process engineers, and safety specialists rather than being prepared by maintenance alone.

3. FMEA and FMECA

FMEA structure

FMEA is a bottom-up method. The analyst starts with component or subsystem failure modes and traces their effects upward. A robust FMEA generally records:

Failure modes should be stated at an actionable level. “Corrosion” may be too general; “external corrosion perforates the suction pipe beneath insulation” is more useful because it suggests inspection and prevention controls.

FMECA and criticality

FMECA extends FMEA by ranking failure modes according to criticality. A qualitative ranking may classify severity, occurrence, and detectability as low, medium, or high. A numerical Risk Priority Number is sometimes calculated as:

where S is severity, O is occurrence likelihood, and D is detectability, each assigned an ordinal score. RPN is a screening aid, not a probability and not a universal measure of risk. Multiplication can hide important differences: a low-frequency catastrophic failure may receive a lower RPN than a frequent minor failure. Safety and regulatory consequences should therefore be escalated independently of RPN.

A more defensible risk statement separates consequence and likelihood:

The expression is conceptually useful, but the numerical calculation is meaningful only when probability and consequence definitions, time horizon, exposure, and uncertainty are specified.

Illustrative FMEA

Consider a centrifugal process pump. A failure mode is “mechanical seal loses containment.” A possible cause is dry running due to loss of seal flush. The local effect is leakage; the system effect is reduced pump reliability and possible pressure loss. Consequences may include operator exposure, environmental release, product contamination, and an unplanned shutdown. Existing controls may include a seal-flush pressure switch, leakage detection, and operator rounds. Candidate actions include verifying flush pressure, installing a low-flow alarm, improving alignment, and reviewing seal selection.

The FMEA should not end with a score. It must lead to an action whose failure mechanism, interval, responsible person, acceptance criterion, and escalation rule are explicit.

4. Fault-Tree Analysis

FTA is a top-down, deductive method. It begins with a defined top event, such as “loss of cooling to the reactor,” and uses logical gates to identify combinations of causes.

An OR gate means that any input can produce the output. An AND gate means that all specified inputs must occur, subject to the model assumptions. Basic events should be independent, mutually exclusive where required, and clearly defined. Real systems may violate independence through common-cause failures, shared utilities, environmental stressors, or human actions; these must be modelled explicitly rather than assumed away.

Figure: Simplified fault tree for loss of cooling. The example uses OR relationships and does not claim statistical independence.

For a simple OR gate with statistically independent basic events A and B:

For a simple AND gate under independence:

These equations apply only to the defined event period and model assumptions. Common-cause failures require additional modelling and may make the simple product calculation invalid.

FTA is particularly valuable for safety-critical systems, protection layers, control-system failures, and identifying single points of failure. Its weakness is that it can become excessively complex and may omit organisational or latent conditions unless the team deliberately includes them.

5. Root-Cause Analysis

RCA investigates a specific undesired event and seeks causes that, if controlled, would prevent recurrence. It should distinguish:

• physical causes, such as fatigue, contamination, or overheating;
• human causes, such as incorrect assembly or an omitted inspection;
• latent organisational causes, such as inadequate design standards, production pressure, training gaps, or weak management of change.

The “five whys” is a useful questioning discipline, not a requirement to stop after exactly five questions. A fishbone diagram can organise possible causes under headings such as machine, method, material, measurement, people, and environment. Evidence should then test each proposed cause.

A strong RCA defines the event and boundary, preserves evidence, constructs a timeline, compares normal and abnormal conditions, tests hypotheses, identifies immediate and systemic causes, and assigns corrective actions with owners and due dates. “Operator error” is rarely an adequate final cause. The investigation should ask whether the procedure was usable, the indication was clear, the workload reasonable, and the system designed to tolerate predictable human error.

Corrective action should be proportionate. Replacing a failed component may restore operation but not prevent recurrence. More durable controls may include redesign, contamination control, interlocks, poka-yoke, revised procedures, competency assurance, or changes to procurement specifications.

6. Pareto Analysis and Evidence-Based Prioritisation

Pareto analysis ranks failure events, costs, downtime, or consequences from largest to smallest and displays cumulative contribution. It is based on the practical observation that a relatively small number of categories may account for a large share of an effect, but the frequently cited “80/20 rule” is not a law.

Data must be classified consistently. A Pareto chart based on number of work orders may produce a different priority from one based on downtime hours or safety exposure. The analyst should state the metric, period, population, exclusions, and coding rules. Rare catastrophic events may deserve action even when they contribute little to total downtime.

Pareto analysis is most useful for selecting improvement projects and identifying recurring failure modes. It is not a substitute for FTA, FMEA, or risk assessment. A high-frequency failure may be a symptom of a deeper common cause, such as poor lubrication practice or an unsuitable operating envelope.

7. Reliability-Centred Maintenance Decision Logic

RCM asks seven practical questions:

1. What are the required functions and performance standards?
2. In what ways can the asset fail to fulfil those functions?
3. What causes each functional failure?
4. What happens when each failure occurs?
5. Why does each failure matter?
6. What task can predict, prevent, or detect the failure, if any?
7. What should be done if no suitable proactive task exists?

The principal maintenance task categories are:

Condition-based maintenance is appropriate when a measurable condition provides sufficient warning and the inspection interval is shorter than the progression from detectable condition to functional failure. If the warning period is W and the inspection interval is I, a basic scheduling requirement is I < W, with additional allowance for measurement uncertainty, decision time, and repair logistics. This is a practical criterion rather than a universal theorem.

Scheduled restoration or discard is justified only when the probability of failure increases with age or use and an effective life limit is known. Many electronic and mechanical failures are not age-related in a predictable way; arbitrary replacement can introduce infant mortality and maintenance-induced failures.

For hidden protective functions, failure-finding is essential. A standby relief valve, emergency trip, or fire pump may fail without being evident during normal operation. The test interval should be selected using risk, demand frequency, test effectiveness, and the consequences of an undetected failure.

RCM also recognises default actions. If no proactive task is technically feasible and the consequence is unacceptable, redesign or a change in operating strategy is required. If the consequence is tolerable and the item is economical to replace, run-to-failure may be the rational policy—not neglect, but an intentional decision supported by spare parts and response arrangements.

8. Worked Example: Selecting a Task for a Pump Bearing

An illustrative pump has a bearing that may develop progressive vibration before functional failure. The maintenance team estimates that once vibration reaches the alert condition, approximately 21 days remain before unacceptable performance, with uncertainty of ±4 days. Measurements and review require up to 3 days, and repair planning requires 4 days. The routine inspection interval is 7 days.

The conservative available warning time is:

The required response allowance is 3 + 4 = 7 days. Since the inspection interval of 7 days is less than the conservative warning time of 17 days, weekly vibration monitoring is technically plausible, provided the alarm threshold is validated and readings are reliable. The action is not simply “take vibration readings”; it should specify measurement points, instrument, route, alert and alarm limits, analyst competence, trend review, and response time.

Suppose the pump operates 8,000 hours per year and has 10 failures in a two-year observation period. A rough observed failure rate is:

The corresponding observed MTBF estimate is:

This estimate is descriptive, not proof that future failures will follow a constant-rate exponential model. Exposure, censoring, changing operating conditions, and failure-definition quality must be examined before using it for prediction.

9. Integrated Case Study: Illustrative Food-Processing Cooling System

Background

The following is a fictional illustrative case. A food-processing plant experiences repeated trips of a chilled-water pump supplying a critical packaging area. Production losses occur when temperature rises above the process limit. The plant has preventive replacement of pump seals every six months, but failures continue.

Problem

Over twelve months, the plant records 18 pump-related interruptions. Pareto coding shows that seal leakage accounts for 9 events, suction blockage for 4, motor overload for 3, and instrumentation faults for 2. The maintenance team proposes reducing the seal replacement interval to three months.

Analysis

Functional analysis defines the pump function as delivering at least 90 m³/h at 4 bar during production and providing automatic low-flow protection. FMEA identifies dry running, poor alignment, loss of seal flush, contaminated water, and incorrect seal installation as possible seal-leakage causes. RCA of two recent events finds that the flush strainer was partially blocked and that the low-flow switch had not been tested for eleven months. The proposed shorter replacement interval addresses neither cause.

FTA of “loss of chilled-water supply” identifies two branches: pump unavailable and control/protection unavailable. The latter is important because an untested low-flow switch can allow dry running and convert a developing problem into rapid seal damage. A Pareto chart based only on event counts would prioritise seals, but a consequence review shows that hidden protection failure creates a higher safety and production risk.

Approach and solution

The RCM team selects the following actions:

1. weekly inspection of seal-flush pressure and strainer differential condition;
2. monthly vibration and motor-current trending;
3. quarterly functional testing of the low-flow trip;
4. alignment verification after coupling work and installation controls for seals;
5. redesign of the flush arrangement to reduce blockage susceptibility;
6. spare seal kits and a documented contingency plan;
7. review of pump operating point to prevent prolonged low-flow operation.

Routine six-month seal replacement is discontinued unless inspection evidence or life data justify it. The pump remains subject to condition-directed maintenance, while the low-flow trip receives a failure-finding task.

Outcome

In the next six months, seal-related interruptions fall substantially, and the plant identifies one failed low-flow switch during a planned test rather than during a production emergency. The improvement is attributed not to one replacement interval but to control of the failure mechanism and restoration of protection-system assurance.

Learning points

The case demonstrates that the most frequent component failure is not always the most important risk. FMEA identifies mechanisms; FTA exposes combinations and protection weaknesses; RCA tests actual causes; Pareto analysis focuses improvement; and RCM converts the findings into specific tasks. The quality of the result depends on accurate functional definitions and evidence from operations.

10. Implementation, Governance, and Contemporary Practice

RCM should be implemented by a cross-functional team with a trained facilitator, controlled asset hierarchy, consistent failure codes, and documented decision rules. The maintenance management system should link failure modes to job plans, inspection routes, spare parts, competencies, and history. Task intervals should be reviewed after significant failures, design changes, process changes, or evidence that a task is ineffective.

Performance measures should include more than preventive-maintenance compliance. Useful indicators include repeat failure rate, corrective-work percentage, schedule compliance, overdue safety-critical tests, condition-monitoring alert conversion, maintenance-induced failure rate, and availability of critical functions. Leading indicators should be balanced with lagging indicators such as downtime and incidents.

Digital sensors, historians, machine-learning models, and digital twins can improve detection and diagnosis, but they do not replace functional analysis. A predictive model trained on incomplete or biased failure data can generate false alarms or miss rare events. AI outputs require validated thresholds, traceable data, human review, cybersecurity controls, and clear accountability. Automated recommendations must not silently change safety-critical task intervals.

Governance also includes management of change, configuration control, calibration, competence, permit-to-work requirements, and compliance with applicable safety and environmental regulations. Maintenance records may contain information about individual performance; access, retention, and use should respect privacy and employment policies. Ethically, production pressure must not justify deferring a task whose risk has not been formally assessed and accepted by an authorised person.

Challenges and Limitations

Failure analysis is affected by incomplete records, inconsistent terminology, survivorship bias, small samples, changing operating conditions, and pressure to identify a single cause. FMEA can become a paperwork exercise if failure modes are copied from generic templates without local validation. FTA can create false precision when probabilities are guessed. RPN rankings can distort priorities. Pareto analysis can neglect low-frequency, high-consequence events. RCA can become blame-oriented. RCM can fail when tasks are selected without checking access, skills, tools, spare parts, or response capacity.

These limitations are managed by stating assumptions, distinguishing evidence from judgement, using uncertainty explicitly, involving multiple disciplines, and auditing whether tasks actually control the intended failure mechanism. The final test is operational: does the selected task reduce risk or restore required function at an acceptable total cost?

Best-Practice Checklist

• Define functions in measurable operational terms.
• Separate functional failures, failure modes, causes, effects, and consequences.
• Use FMEA for bottom-up completeness and FTA for top-down system logic.
• Treat RPN as a screening device, not a substitute for risk judgement.
• Verify RCA hypotheses against physical and documentary evidence.
• Select Pareto metrics that reflect the decision being made.
• Use condition monitoring only when warning time supports intervention.
• Avoid arbitrary age-based replacement without age-related failure evidence.
• Test hidden protective functions at defined intervals.
• Record task purpose, method, limits, owner, and response.
• Review effectiveness after failures and changes.
• Govern digital and AI tools through validation, cybersecurity, and human accountability.

Chapter Summary

Failure analysis begins with the functions an asset must perform and the conditions under which it operates. Functional failures describe lost performance; failure modes describe how the loss occurs; causes explain why it occurs; effects and consequences describe what follows. FMEA provides a structured bottom-up examination, while FMECA adds criticality prioritisation. FTA reasons from a top event through logical combinations of basic events. RCA investigates actual events and should include physical, human, and latent organisational causes. Pareto analysis helps focus resources but must not obscure rare catastrophic risks.

RCM uses these methods to choose condition-directed, time-directed, failure-finding, run-to-failure, or redesign strategies. Reliability and availability equations are useful only when their assumptions and data definitions are appropriate. Effective maintenance is therefore not the maximum amount of maintenance; it is the set of controlled tasks that preserves required functions at acceptable safety, environmental, operational, and economic risk.

Key Terms

Function: Required purpose and performance of an asset.

Functional failure: Inability to perform a required function to its specified standard.

Failure mode: Specific manner in which a functional failure occurs.

Failure cause: Physical, human, environmental, or organisational reason for a failure mode.

Failure effect: Immediate or local result of a failure.

Failure consequence: Broader safety, environmental, operational, quality, or cost impact.

FMEA: Bottom-up structured analysis of failure modes and effects.

FMECA: FMEA extended with criticality assessment.

Fault-tree analysis: Top-down deductive analysis using logical gates.

Root-cause analysis: Evidence-based investigation of why an undesired event occurred.

Pareto analysis: Ranking of categories by contribution to a selected measure.

Reliability: Probability of performing a required function for a stated time and condition.

Availability: Proportion of required time an item is capable of performing its function.

Condition-directed task: Task based on detecting evidence of developing failure.

Time-directed task: Restoration or replacement performed at a defined interval.

Failure-finding task: Test intended to reveal a hidden failure.

Run-to-failure: Deliberate acceptance of failure where consequences are tolerable.

Common-cause failure: Multiple failures arising from one shared cause.

MTBF: Mean time between failures for a repairable item.

MTTR: Mean time to repair.

Review Questions

Short Answer Questions

1. Distinguish a functional failure from a failure mode.
2. What is the principal difference between FMEA and fault-tree analysis?
3. Why should RPN not be treated as a complete measure of risk?
4. Define a failure-finding task and give one example.
5. State the assumptions behind the exponential reliability model.

Long Answer Questions

1. Explain how functional analysis provides the foundation for an RCM programme.
2. Describe the stages of a high-quality RCA and explain why “operator error” is usually an incomplete conclusion.
3. Compare condition-directed, time-directed, failure-finding, run-to-failure, and redesign strategies.
4. Explain how FMEA, FTA, RCA, and Pareto analysis can be integrated in a maintenance improvement project.
5. Discuss the limitations and governance requirements of AI-enabled predictive maintenance.

Analytical / Application Questions

1. A standby fire pump is tested only when demanded and has no continuous indication of readiness. Develop a functional analysis, identify hidden failures, and propose an RCM task strategy.
2. A machine has frequent minor sensor failures and rare but severe loss-of-containment events. Explain how Pareto ranking, FMECA, and risk assessment should be combined to set priorities.
3. A bearing has a conservative detectable-warning period of 14 days. Measurement review requires 2 days and repair preparation requires 4 days. Assess whether a weekly inspection interval is technically plausible, and state what additional evidence is required before implementation.

Multiple Choice Questions with Answers

Question 1

Which statement best defines a functional failure?

A. The physical component name associated with an asset

B. The inability to perform a required function to the specified standard

C. The cost of restoring equipment after a breakdown

D. The probability that a component will fail during a mission

Correct Answer: B. The inability to perform a required function to the specified standard

Question 2

FMEA is primarily which type of analytical method?

A. Top-down deductive analysis

B. Bottom-up analysis of failure modes and effects

C. Financial analysis of maintenance budgets

D. Statistical analysis of production demand

Correct Answer: B. Bottom-up analysis of failure modes and effects

Question 3

In a fault tree, an AND gate indicates that:

A. Any one input event is sufficient for the output

B. The output cannot occur under any conditions

C. All specified input events must occur, subject to model assumptions

D. Input events are necessarily independent

Correct Answer: C. All specified input events must occur, subject to model assumptions

Question 4

For a constant failure rate λ, which expression represents exponential reliability?

A. R(t) = 1 − λt

B. R(t) = e^(−λt)

C. R(t) = λ/t

D. R(t) = t/λ

Correct Answer: B. R(t) = e^(−λt)

Question 5

What is the principal purpose of a failure-finding task?

A. To replace every component at a fixed age

B. To reveal hidden failures in protective or standby functions

C. To eliminate the need for root-cause analysis

D. To increase the number of corrective work orders

Correct Answer: B. To reveal hidden failures in protective or standby functions

Question 6

Why can an RPN ranking be misleading?

A. It never uses severity information

B. It is always a probability expressed as a percentage

C. Multiplication of ordinal scores can hide catastrophic low-frequency risks

D. It can only be calculated for electrical equipment

Correct Answer: C. Multiplication of ordinal scores can hide catastrophic low-frequency risks

Question 7

A bearing has a conservative warning period of 17 days. Review and repair preparation require 7 days, and inspections occur every 7 days. What is the most appropriate conclusion?

A. The interval is technically plausible, subject to validated thresholds and reliable measurements

B. The interval is impossible because inspections must occur hourly

C. The bearing must automatically be replaced every 17 days

D. No condition monitoring can be used for bearings

Correct Answer: A. The interval is technically plausible, subject to validated thresholds and reliable measurements

Question 8

Which task is most appropriate when a component has no demonstrated age-related wear-out pattern and failure consequences are tolerable?

A. Arbitrary monthly replacement

B. Run-to-failure with suitable response and spares planning

C. Permanent removal of the component

D. Daily complete overhaul

Correct Answer: B. Run-to-failure with suitable response and spares planning

Question 9

Which method begins with an actual undesired event and investigates physical, human, and latent organisational causes?

A. Root-cause analysis

B. Pareto analysis

C. Reliability block modelling

D. Time-directed discard

Correct Answer: A. Root-cause analysis

Question 10

For a repairable item with MTBF = 900 hours and MTTR = 100 hours, the simplified availability is:

A. 0.10

B. 0.50

C. 0.90

D. 1.11

Correct Answer: C. 0.90