9. Reliability, Maintenance, Safety and Resilient Operations

Introduction and context

Operational excellence is often associated with efficient flow, low variation, and continuous improvement. These outcomes, however, cannot be sustained when equipment fails unexpectedly, people are exposed to unacceptable hazards, or the organization is unable to recover from disruption. Reliability, maintenance, safety, and resilience therefore form an integrated part of process improvement rather than a separate technical function.

A process may be statistically capable yet operationally unreliable. A production line may meet specifications during normal operation but lose customers because of repeated breakdowns. Similarly, a hospital, data centre, transport system, or utility may have efficient routine processes but experience severe consequences when a critical service is interrupted. The managerial challenge is to design processes that perform consistently, protect people and the environment, and recover rapidly when abnormal conditions occur.

This chapter examines reliability engineering, total productive maintenance (TPM), preventive and predictive maintenance, failure analysis, human factors, safety management, business continuity, and operational risk controls. The central argument is that dependable operations are created by combining technical analysis with disciplined work systems, informed leadership, competent people, and organizational learning.

Learning objectives

After studying this chapter, the learner should be able to:

1. Explain reliability, maintainability, availability, safety, and resilience and distinguish among them.

2. Apply reliability and maintenance models to operational decisions.

3. Compare corrective, preventive, predictive, and reliability-centred maintenance.

4. Use tools such as FMEA, fault-tree analysis, root-cause analysis, and risk matrices.

5. Explain the contribution of TPM and human factors to operational excellence.

6. Design integrated controls for safety, continuity, and operational risk.

7. Evaluate digital technologies and emerging practices in maintenance and resilience.

8. Make balanced managerial decisions involving cost, risk, compliance, and service performance.

The architecture of dependable operations

Reliability is the probability that an item or process will perform its required function for a specified time under stated conditions. The definition is important because reliability is always conditional. A pump may be reliable at a specified flow and temperature but unreliable when overloaded or operated without adequate lubrication.

Maintainability is the probability that a failed asset can be restored to a specified condition within a stated time using prescribed procedures and resources. It depends on accessibility, modular design, diagnostic information, tools, spare parts, and technician competence. Availability combines reliability and maintainability. In simplified form:

Availability = Uptime / (Uptime + Downtime)

For a repairable item under stable conditions, inherent availability is often expressed as:

A = MTBF / (MTBF + MTTR)

where MTBF is mean time between failures and MTTR is mean time to repair. This equation illustrates a managerial point: availability can improve either by reducing failures or by shortening restoration time. Increasing MTBF alone is not always the best investment.

Safety concerns the prevention of unacceptable harm to people, assets, the environment, and society. Resilience is the capability of a system to anticipate, withstand, absorb, adapt to, and recover from disruptive events while maintaining essential functions. Reliability generally focuses on performance under specified conditions; resilience includes adaptation to conditions that may not have been fully anticipated.

These concepts are related but not interchangeable. A system can be reliable in normal conditions but not resilient to a flood, cyberattack, or supply interruption. A system can be highly available but unsafe if operators bypass safeguards to restore service quickly. Operational excellence requires simultaneous attention to performance, risk, and human well-being.

Important terminology

A failure is the termination of an item's ability to perform a required function. A fault is an abnormal condition that may lead to failure. A defect is nonconformance in a component, process, or design. A degraded failure permits partial performance, whereas a catastrophic failure causes complete loss of a critical function.

Failure modes describe the ways in which failure occurs, such as leakage, fracture, overheating, or loss of calibration. Failure effects describe the consequences at the equipment, process, customer, safety, or environmental level. Failure causes are the underlying physical, human, organizational, or external reasons for the failure.

The bathtub curve is a conceptual representation of a changing failure rate. It includes an early-life period with decreasing failure rate, a useful-life period with approximately random failures, and a wear-out period with increasing failure rate. The curve is useful for thinking about failure behaviour, but it should not be assumed that every asset follows it or that age-based replacement is always justified.

Reliability engineering and failure behaviour

Reliability engineering begins with functional definition. Engineers and process owners must identify what an asset or process is required to do, under what operating conditions, with what performance limits. Vague statements such as “the compressor should work” are inadequate. A better specification may require delivery of a defined pressure and flow within a temperature range, for a stated duty cycle, while meeting noise and safety constraints.

Reliability data may include failure counts, operating hours, repair durations, environmental conditions, inspection findings, and failure modes. Data quality is critical. If minor failures are inconsistently recorded or downtime is attributed to the wrong asset, subsequent decisions will be misleading. Reliability analysis should distinguish random failures from failures associated with design weaknesses, operating error, poor maintenance, contamination, or normal wear.

For components with a constant failure rate, reliability may be represented by:

R(t) = e^-λt

where λ is the failure rate and t is time. The model is not a universal law; it is an approximation appropriate only when its assumptions are defensible. More advanced analyses may use Weibull distributions to identify infant mortality, random failure, or wear-out behaviour. A Weibull shape parameter below one commonly indicates decreasing failure rate, a value near one an approximately constant rate, and a value above one increasing failure rate.

Series and parallel relationships are also important. In a series system, failure of any critical component can cause system failure; system reliability is therefore the product of component reliabilities. Redundancy in parallel can improve reliability, although common-cause failures may defeat apparent redundancy. For example, two pumps supplied by the same contaminated lubricant system do not provide genuine independence.

Reliability allocation is the process of distributing a system reliability target among subsystems. It should consider criticality, technology maturity, operating environment, maintainability, and cost. Reliability growth involves identifying weaknesses through testing and operation, correcting them, and demonstrating improved performance. A repair that merely restores the same vulnerable design is not reliability growth.

Maintenance as a process of value creation

Maintenance is not simply the repair of broken equipment. It preserves or restores the capability required by the value-creating process. Excessive maintenance can waste labour, introduce maintenance-induced defects, and consume scarce resources. Insufficient maintenance creates instability, safety exposure, and emergency work. The objective is not maximum maintenance but optimum asset performance at acceptable risk and life-cycle cost.

Corrective maintenance occurs after a fault or failure has been detected. It may be deliberate run-to-failure for low-consequence, inexpensive, non-critical items, or it may be an undesirable emergency response. Preventive maintenance is performed at predetermined intervals or according to prescribed usage. Time-based replacement is appropriate where failure probability increases with age and the task is technically effective. It is inappropriate when failures are random or when replacement itself introduces risk.

Predictive or condition-based maintenance uses evidence of actual condition. Vibration analysis can identify imbalance, misalignment, bearing deterioration, and looseness. Thermography can reveal abnormal heat patterns. Oil analysis can detect wear particles, contamination, and chemical degradation. Ultrasonic inspection may identify compressed-air leakage or early bearing problems. Electrical signature analysis, motor current monitoring, and performance trending are additional techniques.

Predictive maintenance is not synonymous with installing sensors. It requires a failure mode that produces a detectable and actionable condition, suitable measurement intervals, competent interpretation, and a work process capable of responding before functional failure. A sensor that generates alerts without decision rules or technician capacity merely creates digital noise.

Reliability-centred maintenance (RCM) selects maintenance policies by asking: What are the functions and performance standards? How can the asset fail to fulfil them? What causes each failure? What happens when it fails? Why does the failure matter? What task can predict or prevent it? What should be done if no effective proactive task exists? RCM integrates condition-based tasks, scheduled restoration, scheduled discard, failure-finding tasks for hidden functions, and redesign or run-to-failure decisions.

Total productive maintenance extends maintenance responsibility beyond a specialist department. Its central ideas include operator involvement, autonomous maintenance, planned maintenance, focused improvement, quality maintenance, early equipment management, training, safety, and administrative improvement. Operators may clean, inspect, lubricate, identify abnormalities, and restore basic conditions, while specialists perform complex diagnosis and engineering work. TPM succeeds when roles and competence are clear; it should not be used to transfer unsafe technical work to unqualified operators.

Overall equipment effectiveness (OEE) is commonly expressed as:

OEE = Availability × Performance × Quality

Availability reflects losses from breakdowns and setups; performance reflects speed losses and minor stops; quality reflects defects and rework. OEE is a diagnostic measure, not a complete measure of business excellence. Maximizing it may be inappropriate when demand is low, flexibility is strategically important, or running equipment faster increases safety or quality risk.

Failure analysis and risk-based decision-making

Failure analysis should move beyond asking who made the mistake. A technically useful analysis identifies physical mechanisms, immediate causes, latent conditions, management controls, and barriers that failed. Common methods include the following.

Failure Modes and Effects Analysis (FMEA) is a prospective method. A team lists functions, failure modes, effects, causes, existing controls, and recommended actions. Severity, occurrence, and detectability ratings may be used to prioritize attention, although numerical risk priority numbers should not replace professional judgement. High-severity failures may require action even when occurrence is low.

Fault-tree analysis (FTA) begins with a top event, such as loss of cooling, and works backward through logical OR and AND relationships to identify combinations of causes. It is particularly useful for critical systems and for analysing how independent failures or common-cause failures can produce a hazardous outcome.

Event-tree analysis begins with an initiating event and examines the success or failure of subsequent barriers. It supports analysis of escalation and emergency response. Root-cause analysis (RCA) examines an occurred event through methods such as causal trees, five whys, barrier analysis, and change analysis. RCA should produce verified causes and sustainable corrective actions, not merely retraining or reminders.

Risk is commonly understood as a combination of the likelihood of an event and the severity of its consequences. A risk matrix can support screening, but it has limitations: categories may be subjective, rare high-consequence events may be underestimated, and precise-looking scores can create false confidence. Where possible, quantitative analysis should use credible frequencies, consequence modelling, exposure data, and uncertainty ranges.

The hierarchy of controls provides a sound order for reducing safety risk: elimination, substitution, engineering controls, administrative controls, and personal protective equipment. The lower controls depend more heavily on human behaviour and are therefore generally less robust. Lockout/tagout, machine guarding, interlocks, pressure relief, containment, and fail-safe design are examples of engineered controls. Procedures and training remain essential but should not be used as substitutes for feasible design improvements.

Human factors and safe work systems

Human error is often a symptom of system design rather than a complete explanation. Errors are more likely when interfaces are confusing, alarms are excessive, workload is high, procedures are unavailable, maintenance access is poor, or production incentives conflict with safety requirements. Human-factors engineering designs tasks, equipment, information, and environments to support reliable human performance.

A useful distinction is between slips and lapses, which occur during execution, and mistakes, which involve an incorrect plan or rule. Violations are deliberate departures from prescribed practice and may arise from normalization of deviance, unrealistic targets, weak supervision, or perceived production pressure. Fair accountability distinguishes inadvertent error from reckless behaviour while addressing the conditions that made the error likely.

Permit-to-work systems, pre-job briefings, peer checks, shift handovers, competency assurance, fatigue management, and stop-work authority are practical controls. Procedures should be accurate, usable at the point of work, and tested with the people who use them. Safety culture is demonstrated not by slogans but by resource allocation, reporting behaviour, response to bad news, and consistency of managerial decisions.

Near-miss reporting is valuable because it provides evidence before serious harm occurs. Yet reporting systems fail when employees fear punishment, feedback is absent, or every report produces excessive paperwork. Learning systems should classify events, identify recurring patterns, share lessons, and verify that corrective actions have changed risk.

Business continuity and resilient operations

Business continuity extends operational risk management from individual equipment to essential organizational services. A business impact analysis identifies critical products and processes, dependencies, maximum tolerable disruption, recovery time objectives (RTOs), and recovery point objectives (RPOs). RTO specifies how quickly a service should be restored; RPO specifies the acceptable age of recoverable data.

Continuity strategies may include spare capacity, alternate suppliers, geographic diversification, reciprocal arrangements, backup utilities, cross-training, manual workarounds, emergency logistics, and staged recovery plans. Redundancy is not automatically resilience. Duplicate assets located in the same flood zone, connected to the same network, or dependent on the same supplier may fail together.

Resilience requires anticipation as well as response. Scenario planning and stress testing should consider equipment failure, utility loss, fire, cyberattack, extreme weather, contamination, labour shortage, transport interruption, and loss of key expertise. Exercises should be realistic enough to reveal coordination problems but controlled enough to avoid unacceptable disruption. After-action reviews must convert observations into assigned, time-bound improvements.

Operational risk controls should be embedded in normal management systems. A risk register can record hazards, owners, existing controls, indicators, treatment plans, and review dates. Leading indicators may include overdue critical maintenance, safety-critical alarm bypasses, unresolved high-risk findings, competence gaps, and near misses. Lagging indicators such as injury rates, failures, and customer interruptions remain important but reveal harm after it has occurred.

Technology, analytics, and emerging practice

The industrial Internet of Things enables connected sensors, asset histories, mobile work orders, digital inspection routes, and remote monitoring. A computerized maintenance management system (CMMS) can manage asset registers, job plans, schedules, permits, spare parts, and labour records. Enterprise asset management systems connect maintenance with procurement, finance, inventory, and life-cycle planning.

Machine learning can identify abnormal patterns and estimate remaining useful life, but models require representative data and disciplined validation. A prediction is useful only when it leads to a timely, economically justified action. False alarms reduce trust; missed alarms create risk. Cybersecurity must protect connected operational technology through asset inventories, access control, network segmentation, patch governance, backup, incident response, and supplier assurance.

Digital twins can support simulation, design review, maintenance planning, and scenario testing. Augmented reality may assist remote guidance and training. Drones and robotics can inspect hazardous or inaccessible areas. These technologies alter work design and introduce new questions about competence, data ownership, privacy, algorithmic bias, and accountability. Human oversight remains necessary where decisions affect safety or critical service continuity.

Emerging practice is moving toward integrated asset performance management, risk-based inspection, sustainable maintenance, and circular life-cycle thinking. Decarbonization may change equipment duty cycles and introduce new hazards associated with batteries, hydrogen, electrification, and distributed energy. Organizations must ensure that innovation does not outrun hazard analysis and regulatory competence.

Illustrative case: resilient maintenance in a food-processing plant

Background

A medium-sized food-processing plant operated a chilled-water system supporting product cooling, hygiene, and climate control. The system had two pumps, one normally operating and one standby. The plant's maintenance team measured breakdown frequency and repair cost but had no formal criticality ranking or documented recovery objective.

Situation and problem

Over eighteen months, the plant experienced repeated pump seal failures. Operators switched to the standby pump, but the standby unit had occasionally been unavailable because preventive work was overdue. During one failure, cooling was interrupted for several hours, forcing product quarantine and emergency maintenance. Investigation showed that the plant had treated the pumps as redundant, although both depended on the same electrical panel and cooling-water quality.

Analysis

An FMEA identified seal failure, bearing failure, electrical loss, and loss of cooling-water quality as relevant modes. The effects ranged from reduced efficiency to product safety risk. A fault tree for loss of cooling showed common-cause contributors: contaminated water, shared power, inadequate standby testing, and unclear escalation responsibilities. Trend data also revealed that many work orders were closed with the vague description “pump repaired,” preventing meaningful analysis.

The risk assessment distinguished the consequence of a short interruption from a prolonged loss during a critical production stage. It established a recovery time objective and defined the conditions under which production had to stop rather than continue with uncertain cooling performance.

Approach and solution

The plant introduced a criticality-based maintenance plan. Condition monitoring included vibration checks, seal inspection, motor-current trending, and water-quality testing. The standby pump was function-tested under load at defined intervals. The shared electrical vulnerability was reduced through an independent supply arrangement, and a portable power connection was prepared as a contingency. Operators received training in abnormal-condition recognition and escalation, while maintenance technicians revised failure codes and job plans in the CMMS.

A management-of-change review was required for alterations affecting cooling capacity, control logic, or product safety. The emergency plan specified decision authority, product disposition, communication, spare-part requirements, and restart verification. A quarterly exercise tested the response without waiting for an actual failure.

Outcome

The principal improvement was not simply fewer pump failures. The plant gained visibility of the system's critical functions, common-cause vulnerabilities, response time, and recovery options. Maintenance resources were directed toward high-consequence failure modes rather than distributed uniformly across all equipment. The case illustrates why redundancy, monitoring, maintenance, and continuity planning must be designed as one system.

Learning points

First, apparent standby capacity is not effective redundancy unless it is available, tested, and sufficiently independent. Second, failure data must be specific enough to support learning. Third, safety and product-quality consequences should influence maintenance policy even when direct repair cost is modest. Finally, resilience depends on preparation, authority, and practice, not only on equipment design.

Challenges, governance, and professional judgement

Organizations commonly struggle with incomplete asset registers, poor failure coding, reactive work cultures, inadequate spare-parts policies, and conflict between short-term output and long-term reliability. A preventive schedule may become overloaded because tasks were copied from suppliers without criticality assessment. Conversely, cost reduction may eliminate inspections that appear nonproductive until a major failure occurs.

Ethically, managers have a duty to avoid exposing workers, customers, communities, and the environment to unreasonable risk. Compliance with law and standards is a minimum, not proof that risk is acceptable. Records must not be manipulated to improve performance indicators. Maintenance deferrals, alarm bypasses, temporary repairs, and degraded barriers should be visible, approved, time-limited, and actively controlled.

Governance should define asset ownership, risk acceptance authority, maintenance deferral rules, competence requirements, independent assurance, and escalation thresholds. Contractors must be selected and supervised for competence, not merely low price. Procurement decisions should consider life-cycle cost, maintainability, cybersecurity, spare-part availability, and environmental impact.

Best-practice principles

A mature organization typically:

• defines critical functions and asset criticality using consequence and likelihood;
• maintains accurate asset, failure, inspection, and work-history data;
• selects maintenance tasks according to failure behaviour and detectability;
• combines operator care with specialist engineering competence;
• designs out recurring causes rather than repeatedly repairing symptoms;
• uses the hierarchy of controls and verifies safety-critical barriers;
• measures both leading and lagging performance indicators;
• tests continuity plans and learns from exercises and near misses;
• integrates cybersecurity and change management into connected operations; and
• reviews reliability, safety, and resilience as life-cycle responsibilities.

Chapter Summary

Reliable and resilient operations require more than repairing failed equipment. Reliability describes dependable function under stated conditions, maintainability concerns restoration, availability combines uptime and downtime, safety protects people and the environment, and resilience enables adaptation and recovery from disruption. Preventive, predictive, corrective, and reliability-centred maintenance should be selected according to failure behaviour, criticality, consequence, and economic value. TPM broadens responsibility for basic equipment conditions and continuous improvement while preserving specialist competence.

FMEA, fault-tree analysis, event-tree analysis, and root-cause analysis help organizations understand failure and strengthen barriers. Human-factors design, fair accountability, usable procedures, and reporting systems address the organizational conditions behind error. Business continuity links asset management to critical services, recovery objectives, dependencies, and scenario testing. Digital technologies can improve visibility and prediction but require data quality, cybersecurity, governance, and human judgement. Operational excellence is achieved when technical reliability, safe work, continuity planning, and organizational learning reinforce one another.

Key Terms

Reliability: Probability that an item performs its required function for a specified time under stated conditions.

Maintainability: Probability that an item can be restored within a specified time using stated resources.

Availability: Proportion of total required time during which an asset or service is operational.

MTBF: Mean time between failures of a repairable item.

MTTR: Mean time required to restore an item after failure.

Failure mode: Specific manner in which an item or process fails.

Failure effect: Consequence produced by a failure mode.

Failure mechanism: Physical, chemical, or other process that produces failure.

Preventive maintenance: Planned maintenance performed at predetermined intervals or usage levels.

Predictive maintenance: Maintenance triggered by evidence of actual or developing condition.

Reliability-centred maintenance: Method for selecting maintenance policies according to functions, failure modes, consequences, and effective tasks.

Total productive maintenance: Organization-wide approach involving operators and specialists in equipment effectiveness and improvement.

OEE: Product of availability, performance, and quality measures.

FMEA: Structured prospective analysis of failure modes, causes, effects, and controls.

Fault-tree analysis: Deductive analysis that traces a top event through logical combinations of causes.

Root-cause analysis: Systematic investigation of underlying causes and failed controls after an event.

Safety barrier: Technical, human, or organizational control that prevents or limits harmful consequences.

Resilience: Capability to anticipate, withstand, adapt to, and recover from disruption.

RTO: Target time within which a critical service should be restored.

RPO: Maximum acceptable age of data available for recovery.

Review Questions

Short Answer Questions

1. Distinguish reliability from maintainability.

2. What does the MTBF–MTTR availability relationship imply for maintenance decisions?

3. Why is predictive maintenance more than the installation of sensors?

4. State the purpose of FMEA.

5. What is meant by a common-cause failure?

Long Answer Questions

1. Explain how reliability-centred maintenance differs from conventional time-based preventive maintenance.

2. Discuss the contribution of TPM to operational excellence and identify conditions required for its success.

3. Explain how human factors influence safety and maintenance performance.

4. Describe how business impact analysis supports resilient operations.

5. Evaluate the opportunities and risks of digital technologies in maintenance management.

Analytical / Application Questions

1. A critical pump has high availability because repairs are rapid, but it fails frequently and exposes workers to hazardous intervention. Analyse the situation and recommend a balanced improvement plan.

2. Using FMEA logic, analyse a failure of a temperature-control system in a food-processing operation and propose controls at multiple levels of the hierarchy of controls.

3. An organization has two supposedly redundant servers located in the same room and connected to the same power source. Assess the resilience of the arrangement and design a continuity strategy.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes availability from reliability?

A. Availability concerns the probability of failure, whereas reliability concerns repair duration

B. Availability combines operating time and restoration time, whereas reliability concerns successful function over time

C. Availability applies only to safety systems, whereas reliability applies only to production systems

D. Availability measures product quality, whereas reliability measures employee performance

Correct Answer: B. Availability combines operating time and restoration time, whereas reliability concerns successful function over time

Question 2

A maintenance team installs vibration sensors but has no defined alarm thresholds, trained analysts, or work-order response process. What is the most likely result?

A. Guaranteed reduction in mean time to repair

B. Automatic conversion to reliability-centred maintenance

C. Large amounts of data without dependable maintenance decisions

D. Elimination of common-cause failures

Correct Answer: C. Large amounts of data without dependable maintenance decisions

Question 3

Which maintenance policy is most appropriate when a failure has low consequence, the item is inexpensive, and no effective condition indicator exists?

A. Run-to-failure or deliberate corrective maintenance

B. Daily destructive inspection

C. Mandatory age-based replacement after every operating hour

D. Immediate system redesign regardless of risk

Correct Answer: A. Run-to-failure or deliberate corrective maintenance

Question 4

In an FMEA, which combination should receive particular attention even if occurrence is rated low?

A. Low severity and high detectability

B. High severity and potentially catastrophic consequence

C. High availability and low repair cost

D. Frequent cosmetic defects with no process effect

Correct Answer: B. High severity and potentially catastrophic consequence

Question 5

Why might two standby pumps fail to provide genuine redundancy?

A. They have identical nameplates

B. They are maintained by the same department

C. They share a contaminated supply or another common-cause vulnerability

D. They are operated at different times

Correct Answer: C. They share a contaminated supply or another common-cause vulnerability

Question 6

Which control is highest in the hierarchy of controls?

A. Personal protective equipment

B. Administrative instruction

C. Warning sign

D. Elimination of the hazard

Correct Answer: D. Elimination of the hazard

Question 7

A company sets an RTO of four hours for a critical service. This means that the company has specified:

A. The maximum acceptable age of backup data

B. The target time for restoring the service

C. The average time between equipment failures

D. The maximum duration of a preventive maintenance task

Correct Answer: B. The target time for restoring the service

Question 8

Which observation most strongly indicates that a TPM programme is being implemented appropriately?

A. Operators perform complex repairs without qualification

B. All maintenance work is transferred to operators

C. Operators conduct basic care and abnormality detection while specialists retain technical responsibilities

D. Maintenance is performed only after breakdowns

Correct Answer: C. Operators conduct basic care and abnormality detection while specialists retain technical responsibilities

Question 9

A root-cause investigation concludes that an operator should have been more careful, although the alarm interface was confusing and the procedure was outdated. What is the principal weakness of this conclusion?

A. It focuses on system conditions rather than individual behaviour

B. It treats a possible behavioural symptom as the complete explanation

C. It gives excessive attention to engineering controls

D. It uses too much reliability data

Correct Answer: B. It treats a possible behavioural symptom as the complete explanation

Question 10

Which statement best describes resilience?

A. The ability to prevent every possible failure

B. The ability to maintain normal output only when conditions are unchanged

C. The ability to anticipate, absorb, adapt to, and recover from disruption

D. The ability to maximize OEE regardless of safety consequences

Correct Answer: C. The ability to anticipate, absorb, adapt to, and recover from disruption