Reliability Engineering and System Safety 96 (2011) 324–331

Contents lists available at ScienceDirect

Reliability Engineering and System Safety

journal homepage: www.elsevier.com/locate/ress

A framework for reliability and risk centered maintenance

J.T. Selvik a,n, T. Aven b,1
a
University of Stavanger and IRIS (International Research Institute of Stavanger), Norway
b
University of Stavanger, Norway

a r t i c l e in f o a b s t r a c t

Article history: Reliability centered maintenance (RCM) is a well-established analysis method for preventive
Received 15 January 2010 maintenance planning. As its name indicates, reliability is the main point of reference for the planning,
Received in revised form but consequences of failures are also assessed. However, uncertainties and risk are to a limited extent
3 August 2010
addressed by the RCM method, and in this paper we suggest an extension of the RCM to reliability and
Accepted 8 August 2010
risk centered maintenance (RRCM) by also considering risk as the reference for the analysis in addition
Available online 11 August 2010
to reliability. A broad perspective on risk is adopted where uncertainties are the main component of risk
Keywords: in addition to possible events and associated consequences. A case from the offshore oil and gas
Reliability centered maintenance industry is presented to illustrate and discuss the suggested approach.
Risk
& 2010 Elsevier Ltd. All rights reserved.
Uncertainties

1. Introduction
Planning of preventive maintenance (PM) of technical systems
is a challenging task. A balance has to be made between the
frequency and extension of the maintenance on the one hand and
costs on the other. The preventive maintenance is introduced to
avoid the occurrence of failures of the system and reduce
potential consequences of failures, but maintenance could in
some cases also introduce failures. Both of these counteracting
aspects are of relevance to preventive maintenance planning.
Different tools have been developed to support the planning of
PM and this paper addresses one of these, the Reliability Centered
Maintenance (RCM) methodology. RCM is a widely accepted
methodology that has been available in the industry for over 30
years, and has proved to offer an efficient strategy for preventive
maintenance optimization [1].
The main objective of RCM is to reduce maintenance costs and
at the same time increase reliability and safety. The system
functionalities and reliability are highlighted as the name
Reliability Centered Maintenance concept indicates. A two-step
procedure is adopted:
i. Inductive analysis of the potential failures, where typically a
variant of failure mode, effects and criticality analysis (FMECA)
is used, to determine critical components of the system; see
e.g. Rausand and Høyland [2].
n
Corresponding author. Tel.: +47 51 87 50 00; fax: + 47 51 87 52 00.
E-mail addresses: jts@iris.no (J.T. Selvik), terje.aven@uis.no (T. Aven).
1
Tel.: + 47 83 10 00; fax: + 47 51 83 10 50.
ii. Application of logical decision diagrams: the so-called RCM logic,
to specify suitable categories of PMs (predictive maintenance
(PdM), replacement, etc.); see e.g. Bloom [3].
The minimum criteria that a RCM process has to meet is defined
by the three technical standards IEC 60300-3-11 [4], SAE-JA1011
[5] and SAE-JA1012 [6], which are the RCM standards typically
used, e.g. for equipment in the oil and gas industry (see e.g. Khamis
and Hiren [7] and Carretero et al. [8]). The RCM methodology has
extensive application also outside this industry. The methodology
has its origin in the aircraft and aerospace industry and it was also
early applied by the military and the nuclear industry. According to
Khamis and Hiren [7] the methodology was used by more than 400
nuclear power stations. Applications are also found in railwork
networks ([9] and [10]), metallurgical industries [11,1] and coal
mines [11]. For a good overview of various applications, see
Carretero et al. [7], where also use in the following industries or
sectors are described: chemical & processing, medical (hospitals),
sawmill, shipping, transportation (Paris metro transportation
network—RATP) and water distribution.
Several methodological improvements of the method have also
been suggested, e.g. PM Optimization [12], RCM 2 [13], Stream-
lined RCM [14], Intelligent RCM Analysis [15] and also a so-called
probabilistic approach by Eisinger and Rakowsky [16]. For the
purpose of the present paper we will concentrate on the ideas of
Eisinger and Rakowsky. These researchers point out that it is
crucial to the decision process that the RCM is adjusted to reflect
uncertainties, as ignoring these may in many applications lead to
‘‘non-optimal’’ maintenance strategies. Eisinger and Rakowsky
focus on the RCM logic specifically and suggest an adjustment of
this, where probabilities are assessed instead of the traditional

0951-8320/$ - see front matter & 2010 Elsevier Ltd. All rights reserved.
doi:10.1016/j.ress.2010.08.001
 J.T. Selvik, T. Aven / Reliability Engineering and System Safety 96 (2011) 324–331
YES or NO options when navigating through the decision diagram.
Having only the choice between YES or NO, they argue that it is
not possible to adequately reflect the assessor’s confidence in the
different choices.
In the present paper we take the uncertainty comment by
Eisinger and Rakowsky [16] a step further. We agree with Eisinger
and Rakowsky [16] that uncertainties need to be reflected in the
analysis, but a clarification is required as to what this means. In
our analysis, uncertainties refer to the occurrences of failure
events and their consequences, and are not about vague
(ambiguous) statements and the assessors’ doubt concerning
what to do, as seem to a part of the Eisinger and Rakowsky [16]
rationale for incorporating uncertainties.
To some extent these uncertainties (about the occurrences of
failure events and their consequences) are addressed in the
analysis. The FMECA assigns probabilities of failure events and
expected consequences. In some of the FMECAs the presentation
of expected values is extended by the use of worst-case
consequences. However, the analysis is mainly expected-value
focused and an important uncertainty dimension is not revealed:
the assessments are based on background knowledge, including
many assumptions, which could hide or camouflage uncertainties.
For example, for assessments on a specific valve in a subsea
flowline system, there are assumptions on fluid pressures and
amount of erosive particles. The probabilities produced are
conditioned on these assumptions.
The traditional RCM approach can be viewed as founded on a
risk perspective where risk is equal to the expected value or the
combination of probabilities and events/losses. To take into
account uncertainties as indicated above, we need to base the
RCM on a broader risk perspective and one way to do this is to
replace probability with uncertainty in the definition of risk. This
leads to a risk perspective as presented in Aven [17] (see also
[18]).
Risk is understood as the two-dimensional combination of:
i. Events (A) and the consequences of these events (C)
ii. Uncertainties U about A and C (will A occur and what will the
consequences C be?)
Such a risk perspective is referred to as the (A, C, U)
perspective [19].
In this way we obtain a shift in the methodological focus from
reliability and probabilities (expected values) to reliability,
uncertainties and risk. We find that a proper name for this
adjusted methodology would be ‘‘reliability and risk centered
maintenance’’, where risk is given a definition as above with
uncertainty being a main component. For short we refer to the
methodology as RRCM.
The purpose of the present paper is to motivate this revised
methodology and describe its main features.
To illustrate the applicability of this methodology we will use a
case from the oil and gas industry, where the aim is to determine
the maintenance strategy for a subsea flowline arrangement in
the North Sea. The flowline is placed about 300 metres below sea
level, and has a length of over 20 kilometres; see Fig. 1. It
transports a corrosive mix of oil, gas and water that contains
varying amounts of sand particles. These sand particles are
erosive and may contribute to the shutdown of several production
wells if leakage should occur. To prevent leakage due to the
Valve A Valve B
Wells Riser
Fig. 1. Case flowline system.
325
presence of corrosion and erosion, the flowline is designed with
an inner coating. The arrangement also includes two hydraulically
operated valves: one close to the production wells and one close
to the production riser. The case is motivated by an analysis by
Castanier and Rausand [20].
The structure of the remaining part of the paper is as follows. A
brief description of the RCM methodology is presented in the next
section, Section 2, where we apply RCM on the case presented
above. Then in Section 3 the new reliability and risk centered
methodology is explained, and in Section 4 it is discussed and
compared with the traditional RCM approach. The case is used as
a basis for the comparison. Section 5 provides some conclusions.
2. RCM—description of the methodology
The RCM methodology can be described by the following three
phases:
i. Identification of Maintenance Significant Items (MSI).
ii. Assignment of suitable PM tasks for the MSI.
iii. Implementation and update of the PM tasks.
In this section we will give a brief presentation of these phases
using the flowline case as an illustration. The methodological
description is mainly based on Rausand [21], Rausand and Vatn
[22] and Bloom [3].
A general aspect emphasized in the references above is that
the RCM project group should include multiple disciplines and
create ownership of the process. The project group should include
at least one person from the maintenance function and one
person from the operations function, in addition to a RCM
specialist. And the group should work dynamically in the sense
that expertise is rotated when needed in the analysis.
2.1. Description of the RCM phases
The RCM phases listed above are described in the following
Sections 2.1.1–2.1.3.
2.1.1. Phase i—identification of MSI
The first phase is a screening phase, where the number of
items for analysis is reduced. The purpose of this phase is to
identify the Maintenance Significant Items (MSI), i.e. the items we
later feed into the RCM logic for specification of PM tasks. These
items are identified from criticality rankings performed for each
of the items, where all functional failures for each of them are
assessed, assuming that all other items are functioning perfectly.
Typically a type of qualitative ranking is used based on a
criticality matrix including information on the various failure
modes, failure frequency and consequences. The assessments are
performed on an overall system level, for the following conse-
quence categories:
 Operational consequences (production availability).
 Hidden failure consequences (relevant for redundant systems).
 Non-operational consequences (including both direct costs
and commitments).
 Safety and environmental consequences.
For the other items, the non-MSI, the ‘‘optimal’’ maintenance
strategy is assessed to be operation until failure occurs and then
to perform Corrective Maintenance (CM), i.e. Run-To-Failure
(RTF). RTF might also be a relevant maintenance strategy for
326 J.T. Selvik, T. Aven / Reliability Engineering and System Safety 96 (2011) 324–331
Does a failure YES
alerting measurable
indicator exist?
NO
Increasing failure
YES
rate?
NO
Is the function YES
hidden?
NO
Run-To-Failure (RTF)
Fig. 2. Example of RCM logic (Rausand and Vatn [9]).
some of the MSI, depending on their failure and lifetime
characteristics, failure consequences and maintenance costs.
For simple systems that include only a few items, it is in most
cases quite obvious which of the items are important for the
reliability of the system and what their failure consequences are,
and the MSI may be identified without any rigid analysis.
2.1.2. Phase ii—assignment of suitable PM tasks for the MSI
To describe the next phase, phase ii, we refer to the case
presented in Section 1. For this case, based on crude criticality
assessments we find all the items to be MSI:
 Steel lines (including coating) between production wells and
production riser.
 Valves A and B (hydraulically operated valves).
Reliability data shows that failures on the above items are rare,
but depending on the failure mode, all of the items are single-
handedly capable of taking out the production if a failure on one
of these should occur.
In order to assign suitable PM tasks for the items, we first
apply an RCM-adjusted FMECA, which is basically a regular
FMECA worksheet to which some additional RCM relevant fields
are added; see e.g. Rausand [21] and Rausand and Vatn [22,23].
An example of the FMECA worksheets applied for Valve A in
the flowline case is presented below. This worksheet is not as
extensive as the fields proposed by Rausand and Vatn [22], but
shows some of the main points.
FMECA worksheet:
 Item ID: Valve B; actuation: hydraulically operated.
 Generic item: Valve, process isolation.
 Equipment class: Flowline.
 MSI item: Yes.
 Operational mode: In operation, open position.
 Functional mode: Ensure containment.
 Functional failure: External leakage (process medium).
 Failure cause: Corrosion/erosion.
 Failure mechanism: External influence/material related.
 Failure characteristics: Unknown (constant failure rate assumed).
 Probability of Failure: Subjective prob. assessment; failure rate:
0.6 critical failures/year and in range (1.2, 2.5) failures/year for
all failure modes and criticalities.
Continuous predictive
YES
maintenance
Is continuous
monitoring
feasible? Scheduled predictive
NO maintenance
YES Scheduled overhaul
Is overhaul
feasible?
NO Scheduled replacement
Scheduled function
testing
 Lifetime distribution: Exponential.
 Failure consequences: Contamination. Pollution in sea, process
medium.
 Failure consequence type: Environmental.
 Failure severity: Critical (high criticality).
 Recommended PM task: addressed in text below.
Based on the FMECA results, PM tasks are determined by
application of RCM logic. These are decision diagrams that
through various YES or NO questions navigate the assessor to
the ‘‘optimal’’ maintenance task for the item assessed (repeated
for all the relevant failure modes); see the above references; an
example of a simple version is provided in Fig. 2. The design of the
RCM logic determines the additional fields that are relevant for
the FMECA worksheet. Several variations of the RCM logic exist,
but they are all based on the same principle; by use of decision
logic we assign PM tasks based on failure characteristics, failure
consequences and appropriate cost-effective maintenance tasks
to mitigate these.
For the items in the referred case, we apply the RCM logic
presented in Fig. 2. We start with the steel lines, and answer YES
to the first question: does a failure alerting measurable indicator
exist? And NO to the next question: is continuous monitoring
feasible? The steel lines are thus, by use of this RCM logic,
navigated to ‘‘scheduled predictive maintenance’’. For the valves
we answer the first question by NO, which leads to another
second question: Increasing failure rate? Due to the limited data
available on such valves, we answer NO to this. Then we need to
answer whether the function is hidden. Also this question is
answered NO, leading us to Run-To-Failure (RTF) as the appro-
priate task. The information is then placed in the worksheet
above.
When the PM tasks are in place, the next step is to assess their
intervals. This is in many cases a challenging task. Maintenance
optimization is and has been a well-studied field for several
decades. It includes use of mathematical models to determine the
optimal intervals; see e.g. Rausand and Vatn [23], Percy [24], Cui
[25], Wang and Pham [26] and Dekker [27].
Some of these models are quite complicated to apply; they
might, for example, request use of advanced mathematics, input
data of limited availability and failure rate functions that can be hard
to determine. Regarding the case for optimization of pipeline
inspection intervals, see e.g. Castanier and Rausand [20]. Use of
 J.T. Selvik, T. Aven / Reliability Engineering and System Safety 96 (2011) 324–331
such models may also be combined with expert judgements based
on the available information, as for example described in Apeland
and Scarf [28]. There is no defined ‘‘one-way’’ to determine the
intervals. In many cases the intervals are not optimized at all and
simply determined as a combination of expert recommendations,
operational experience, various requirements and available
resources, see e.g. Bloom [3]. In a study involving two oil companies
operating on the Norwegian Continental Shelf [29], it was found that
the RCM interval determination for the involved participants was
mainly based on operational experience and established practice
rather than direct use of mathematical models. This practice is
in line with the main standards for establishing maintenance
programmes within the oil and gas industry, such as the NORSOK
standards Z-008 [30] and Z-016 [31] (the latter now replaced by
international standard ISO 20815 [32]).
A mix of various maintenance tasks and intervals is typically
the result of the above assessments, and in order to apply the
results in practice a form of ‘‘packing’’ is necessary; see e.g.
Rausand [21]. The PM tasks and intervals are grouped such that
maintenance resources are able to handle the tasks efficiently. In
such grouping it might also be decided to include some of the
items that are not analyzed in detail (the non-MSI). Thus a
‘‘packed PM interval’’ field is added to the FMECA worksheets.
2.1.3. Phase iii - implementation and update of the PM tasks
The third phase, phase iii, describes the managerial processes
for how the results are applied in practice. It consists of
communication of the results from the project group to manage-
ment, the operational processing and later update of the results
when new and relevant information becomes available.
A quality assurance process is performed as part of this phase,
with the aim of identifying issues that are overlooked or ignored
in the FMECA. The process also addresses methodological
limitations in the use of FMECA, for example related to the
generation of relevant alternatives, and the treatment of multiple-
failure interactions (as failures are assessed individually, the
effect of some failures may not be accounted for).
The general aspect pointed out at the beginning of this section
on how the project group should be composed, is of relevance for
the communication of the results (PM tasks and intervals), but
also for the treatment of uncertainties and later updates. The
results should be well documented for later updates to be
efficient, including documentation of general conditions and
assumptions used in the assessments.
For further description of this phase, see e.g. Rausand [21],
Rausand and Vatn [23], Bloom [3] and Moubray [13].
1. 2.
Identification PM task
of MSI assessments
5. Uncertainty analysis
7.
Preventive Managerial
maintenance review and
programme judgement
Fig. 3. RRCM framework.
327
2.2. Potential for methodological improvements: uncertainty
assessments
According to Bloom [3], it is estimated that more than 60% of
all RCM programmes initiated have failed to be successfully
implemented. One of the main reasons for this is failure to assess
and communicate uncertainties in the assessments. This reason
depends somewhat on the type of industry and the complexity of
the systems analyzed, as well as the resources assigned to the
RCM project, e.g. external resources such as consultants and
purpose-built software. See also Cheng et al. [15]. Although there
is high industrial awareness on the relevance of uncertainties, the
uncertainty issue is often given rather limited attention in the
assessments in practice. This is illustrated by the changes in the
procedures for handling of uncertainty when the NORSOK Z-016
[31] was replaced by ISO 20815 [32]. In the ISO standard the focus
on uncertainties was reduced compared with the original
NORSOK document.
In Section 1 we argued that the RCM process should be
adjusted to take into account broader uncertainty assessments.
Already some uncertainty assessments are included, but as
pointed out in Section 1, these are restricted to probabilities of
failure events and expected consequences in the FMECA assess-
ments, and do not reflect all of the relevant uncertainty
dimensions; they especially exclude uncertainties ‘‘hidden’’ in
the assumptions made. These uncertainties are referred to as
‘‘uncertainty factors’’. As mentioned earlier, it may be possible to
reveal some of the assumptions in the RCM documentation and
treat them in later updates, but it will not give the assessors the
relevant uncertainty information for decision-making.
In the following section we present an extended RCM
approach, referred to as the Reliability and Risk Centered
Maintenance (RRCM) framework, based on these ideas for broader
uncertainty assessments. The RCM will still be the methodological
platform, but the approach to risk and uncertainties will be more
comprehensive. The (A, C, U) risk perspective introduced in
Section 1 constitutes the formal conceptual basis for the frame-
work.
3. Reliability and risk centered maintenance (RRCM)
In this section we present the reliability and risk centered
maintenance (RRCM) framework. The main features of the
framework are illustrated in Fig. 3, showing a process defined
by seven boxes of assessments to determine the PM programme.
3. 4.
PM interval Packing of
assessments PM tasks
6.
Uncertainty
evaluation &
presentation
of results
328 J.T. Selvik, T. Aven / Reliability Engineering and System Safety 96 (2011) 324–331
Table 1
Uncertainty assessment score interpretation.
Aspect Score
Uncertainty Low (L)
Medium (M)
High (H)
Sensitivity L Unrealistically large changes in base case values needed to bring about altered conclusions.
M Relatively large changes in base case values needed to bring about altered conclusions.
H Relatively small changes in base case values needed to bring about altered conclusions.
Importance L, M or H
The first four boxes are described by phases i and ii of the
traditional RCM process (see Sections 2.1.1 and 2.1.2). These
boxes provide already established methodologies to the frame-
work, where a dashed line is drawn around the boxes to indicate
the boundaries of the traditional process i and ii. A fifth box (no. 5)
is then introduced, attached to the boxes 2 and 3, to integrate
dedicated uncertainty assessments into the framework. These
assessments are included as an integrated part of the PM task and
interval assessments (i.e. these two boxes), and adds to the
uncertainty assessments performed as integral parts of the
traditional RCM methodology (steps nos. 1–4), for example
assessments in FMECA, where uncertainties are partially covered
through subjective (epistemic) probabilities for failure events and
their consequences.
In the fifth box (see Fig. 3) we specifically address the
uncertainty factors. Many of these factors are derived from the
assumptions made in the established assessment tasks in boxes 2
and 3, as the uncertainty factors cannot be revealed and assessed
before the traditional probability based analysis has been
conducted. In line with Aven [19] and Flage and Aven [33], the
uncertainty analyses cover the following main tasks:
1. Identification of uncertainty factors.
2. Assessment and categorization of the uncertainty factors with
respect to degree of uncertainty.
3. Assessment and categorization of the uncertainty factors with
respect to degree of sensitivity.
4. Summarization of the uncertainty factors’ importance.
Table 1 indicates a score system for tasks 2–4, inspired by Selvik
and Aven [34] and Flage and Aven [33]. All the tasks 1–4 are applied
for both the PM task assessment and the PM interval assessment.
When we apply this system for box 2, the judgement of the
sensitivity score is linked to the extent that the factor is able to
change the PM task. To integrate these scores into the PM task and
interval assessments we expand the FMECA to include all the results
from the assessments in steps (boxes) nos. 1–5. Such expansion will
also benefit the later presentation of the results.
Steps 1–4 (see Fig. 3) together with 5 thus provide the input for
the total uncertainty evaluation of the system studied; see box no. 6.
An important part of the uncertainty evaluation is communication of
the results to the management function. The value of the
information should be considered, to not overload the management
with information not relevant to the decision-making.
Interpretation
One or more of the following conditions are met:
 The assumptions made are seen as very reasonable.
 Much reliable data are available.
 There is broad agreement/consensus among experts.
 The phenomena involved are well understood; the models used are known to give
predictions with the required accuracy.
Conditions between those characterising low and high uncertainty.
One or more of the following conditions are met:
 The assumptions made represent strong simplifications.
 Data are not available, or are unreliable.
 There is lack of agreement/consensus among experts.
 The phenomena involved are not well understood; models are non-existent or known/believed
to give poor predictions.
Average of the other two aspect scores.
The RRCM framework also includes managerial review and
judgement, as shown in the seventh box in Fig. 3, in line with the
decision framework presented in Aven [19]. The inputs to
management from the various assessments are placed into a
broader context, where the boundaries and limitations of the
various assessments are taken into account, and also additional
aspects and inputs are taken into consideration, for example
manufacturer recommendations and existing PM programmes.
The managerial review and judgement may also request revisions
or analytic changes results should appear unreasonable.
Section 3.1 presents the results from the uncertainty assess-
ment for the flowline case.
3.1. RRCM—uncertainty assessment in the flowline case
Our focus is on the uncertainty factors that have the potential
to change the probability of an event and consequence pair to
such an extent that it may have an effect on the PM tasks or
intervals assessed.
The uncertainty factors can be integrated into one of the
FMECA worksheets, as an extension of this to also include the
uncertainty assessments. The fields in the extended FMECA
worksheet below may be used. We give a short description of
these fields before moving on to show how to perform the
assessments of the uncertainty factors in the flowline case.
Extended FMECA worksheet (refer to list in Section 2.1.2):
 Recommended PM task: Result from the RCM logic; in this case:
Run-To-Failure (RTF).
 Uncertainty factors for PM task assessments: List the re-
levant uncertainty factors identified related to the PM task
assessment.
 Uncertainty factor score: For the uncertainty factors identified,
give a qualitative score on degree of uncertainty, sensitivity
and importance in line with the score system given in Table 1.
 Sensitivity of PM task recommendation: Check if an uncertainly
factor has the potential to produce a different PM task than the
one recommended. List the adjusted tasks and the correspond-
ing uncertainty factors.
 PM interval determination: Description of how the PM interval
assessment is performed; type of optimization model used and
relevant constraints. In this case the interval is assessed by the
use of expert judgements.
 J.T. Selvik, T. Aven / Reliability Engineering and System Safety 96 (2011) 324–331
Table 2
Case uncertainty assessment.
No. Assumption
1 Data selection criterion based on item size (inner diameter) and fluid type
2 Data are able to describe the items’ failure characteristics
3 Mobilisation history found in database is representative
4 All of the other items are functioning
5 Only one failure occurs at the time / within a short time interval
6 Item failures are observed shortly after they occur
7 Regular pigging will prevent flowline blockage
8 Use of smart pig provides accurate sensor readings inside the flowline
9 Company and industry requirements are followed
10 Items are properly tested and inspected before and during installation
 Recommended PM interval: Result from the PM interval
assessment.
 Uncertainty factors for PM interval assessments: List the relevant
uncertainty factors identified related to the PM interval
assessment.
 Uncertainty factor score: For the uncertainty factors identified,
give a qualitative score on degree of uncertainty, sensitivity
and importance.
 Sensitivity of PM interval recommendation: Check if an
uncertainly factor has the potential to produce a significant
change in the PM interval compared with the one recom-
mended. List the adjusted intervals and the corresponding
uncertainty factors.
In the following we address the uncertainty factors related to
the PM tasks for the specific flowline case. Several critical
assumptions made in the basic FMECA were identified. Below
we present and list some of the derived uncertainty factors based
on these assumptions. They are relevant for both the steel lines
and the valves.
Following are some of the identified uncertainty factors:
1. Data selection criterion based on item size (inner diameter)
and fluid type.
2. Data are able to describe the items’ ‘‘failure characteristics’’.
3. Mobilisation history in database is representative.
4. All of the other items are functioning.
5. Only one failure occurs at the time/within a short time
interval.
6. Item failures are observed shortly after they occur.
7. Regular pigging will prevent flowline blockage.
8. Use of smart pig provides accurate sensor readings inside the
flowline.
9. Company and industry requirements are followed.
10. Items are properly tested and inspected before and during
installation.
These factors are briefly described in the following.
The FMECA is, to a large extent, based on data found in
company internal databases. However, the selection criterion
used may lead to failure probabilities that do not reflect the
erosive properties of the fluid. It is not clear to what extent the
criterion adopted has included flowlines and valves that are
subject to similar conditions.
There are limited amounts of relevant data available to predict
the performance of the equipment. The data represent newer
flowline systems, and for these few events have occurred. The
relevant items’ sizes are not found in older data. Thus, one may
question to what extent the data are dominated by the items’
‘‘childhood events’’.
329
Degree of uncertainty Degree of sensitivity Degree of importance
M M M
H H H
H M H/M
M H M
L M L/M
M H M/H
L H M
M M M
L L L
M M M
Another factor related to the database is the maintenance
vessel mobilisation time, which could be a significant contributor
to system downtime. It is assumed that the mobilisation history
in the database is representative, but this assumption may be
challenged as it is difficult to determine the correct mobilisation
times for the relevant items from the available data.
By using FMECA, criticality assessments are carried out
assuming that only one failure event or failure mode occurs at
the time. It is assumed that all the other items are working
perfectly. None of the other items are then in a failure mode, are
waiting for maintenance or have hidden failures. However, real
life may very well be different.
It is also assumed that failures are immediately detected when
they occur. However, this assumption may not hold in practice for
the valves as failures of these may be hidden due to redundancies.
Some valve failures may be detectable only by function testing or
the appearance of a second failure of another item within the
redundant system.
The flowline is regularly pigged by use of a smart pig that
monitors flowline inside parameters, for example the inner
diameter and temperature. The reliability and accuracy of this
smart pig is not assessed by the FMECA, nor is the assumption
that pigging prevents blockage. These assumptions may lead us to
ignore failure modes concerning flowline blockage.
The last two uncertainty factors are related; they address the
assumptions that the items installed are adequately tested and
inspected prior to production start up and that production is
inside the design criteria and requirements/recommendations,
e.g. design pressure and sand concentration limits.
Now, having identified a list of uncertainty factors and
included these in the extended FMECA worksheet, we next assess
and categorize these with respect to degrees of uncertainty and
sensitivity, which combined provides a basis for making a
judgement of importance. The importance classification points
to factors that should, if time and resources allow, be followed-up
in further analyses.
The result of the uncertainty assessment is shown in Table 2,
based on the score system presented in Table 1. The results are
placed in the uncertainty factor score field in the worksheet.
Table 2 shows that both the uncertainty factors nos. 2 and 3
are classified with high uncertainty. Of these two uncertainty
factors, only factor 2 is classified with high importance as the
mobilisation times alone do not have a high enough potential
to change the PM task assessment. Factor no. 2 is found to have
a potential to produce a different PM task than the one
first recommended, as it was revealed in the sensitivity assess-
ments that this uncertainty factor naturally lead to the PM
tasks ‘‘scheduled overhaul’’ or ‘‘replacement’’ instead of RTF.
Thus, this factor and the two new PM tasks are placed in
the FMECA worksheet into the field Sensitivity of PM task
330 J.T. Selvik, T. Aven / Reliability Engineering and System Safety 96 (2011) 324–331
recommendation. The sensitivity of this factor is also addressed in
Section 4.
The uncertainty assessments for the PM intervals are
performed in same way as for the PM tasks. To avoid repetition,
the details are omitted.
The uncertainty analysis is combined with the results of the
other tasks, including the probability assessments for failure
events and consequences in the FMECA, which are evaluated as a
basis for communication to management. The evaluations high-
light which uncertainties to give weight to in the presentation of
the results.
3.2. Managerial review and judgement
The results presented in Table 2 provide additional decision
support to that which is included in the RCM process. When these
results are communicated to management, weight is also given to
the limitations in the traditional RCM assessments.
Although management performs review and judgement late in
the RRCM process, this is not to say that management is not
involved in early assessments. Management may, for example,
influence who will perform the various analyses and provide
guidelines to the PM optimization. Management involvement in
early phases is often considered a key success factor in project
management, so also for the implementation of the RRCM process.
4. Discussion—comparison of RCM and the RRCM framework
Applying the RRCM framework may or may not result in
different decisions compared with the RCM analysis methodology.
For the flowline case, the RCM assessments (RCM logic) and the
first parts of the RRCM framework led to scheduled PM for the
steel lines and RTF for the valves. The importance of the factors
identified may however change this, the conclusion being that the
valves should be subject to predictive maintenance (condition
monitoring) – maybe even continuous instead of scheduled – to
prevent failure events.
Consider, for example, the hydraulic valves in the case
presented (see Fig. 1): Valve B say, located about 20 km from
the riser base. As condition monitoring (predictive maintenance)
is unfeasible due to the long distance from the topside installation
and the harsh seabed conditions, we are, by use of the RCM logic
(see Fig. 2), led to answer the following question: is the failure
rate of the valve increasing for the specific failure mode? Then we
consider the second of the uncertainty factors; that we assume
our data to be able to describe the ‘‘failure characteristics’’ of the
valve. Having limited experience and no failures recorded in the
data set, we may make the judgement that the probability of
failure for this failure mode is low and we see no indication of
increase in failure rate. However, corrosion and erosion wear on
the valves could result in an increase in failure trend over time, for
example for the failure modes ‘‘leakage in closed position’’ and
‘‘fail to close’’. The consequence is that the suitable PM task is to
perform scheduled overhaul or replacement instead of RTF.
The presented case covers a rather limited system and it is
easy to see the total picture. But the process is not much more
difficult to carry out for larger systems, although more demanding
with respect to amount of time needed to perform the analyses.
All the items are listed and then assessed one at a time, for all
failure modes, both within RCM and RRCM.
In a project development, a number of assumptions are made
and these need to be followed up in coming project phases. The
RRCM provides a methodology for assessing the importance of the
various assumptions and support decision-making.
The managerial review and judgement allows for quality
assurance and second opinions in the RRCM process. Also other
risk methodologies, for example risk based inspection (RBI),
which is frequently used for assessment of inspection intervals for
pipeline systems in the Norwegian oil and gas industry, could be
included in the overall considerations in the managerial review
and judgement.
Within the RRCM framework, we apply subjective (epistemic)
probabilities as a quantitative measure of uncertainty. These
probabilities are used in FMECA. In RCM often a relative
frequency-based perspective on probabilities is used. The way
probability and risk are understood strongly influences the
presentation and communication of the results.
The RCM assessments are quite demanding for larger systems
due to all the failure modes that are to be analyzed by FMECA and
RCM logic. By adding additional assessments we also increase the
time needed to perform the process, as well as the resources
required. However, the extra time and costs due to the
uncertainty factor assessments should not be very large compared
with the overall costs used for RCM. If uncertainty and risk are to
be adequately incorporated in the assessments, some extra
resources are required.
5. Conclusions
RCM is a systematic analysis method for planning the
preventive maintenance (PM) of technical systems. Reliability
and consequences of the relevant system items are assessed in
order to identify and determine suitable PM tasks and intervals.
Over the years, RCM has gained a solid reputation for being a
successful method, but also for having some shortcomings. One of
these is traced to the limited assessments of risk and uncertainties.
In this paper we have presented and discussed the RRCM
framework: a framework based on the existing RCM, which
improves the risk and uncertainty assessments by adding some
additional features to the existing RCM methodology. An extended
uncertainty assessment is added, to address uncertainties ‘‘hid-
den’’ in assumptions of the standard RCM analyses. The un-
certainties are then communicated to management through an
extended uncertainty evaluation, which integrates the results from
the FMECA (and the formal maintenance optimization if optimiza-
tion models are established) and the separate uncertainty analysis.
An essential feature of the presented framework is the managerial
review and judgement, which places the decision process into a
broader management context. In this step consideration is given to
the boundaries and limitations of the tools used.
A case from the oil and gas industry is presented to
demonstrate the applicability of RRCM. The approach is, however,
general and could also be used for other types of applications. We
believe that by applying the RRCM, an improved basis can be
established for informing decision makers compared with the
RCM method, as the importance of risk and uncertainties is more
adequately taken into account.
Acknowledgements
The authors are grateful to three anonymous referees for their
constructive comments and suggestions to the original version of
this paper.
References
[1] Desphande VS, Modak JP. Application of RCM to a medium scale industry.
Reliability Engineering and System Safety 2002;77:31–43.
 J.T. Selvik, T. Aven / Reliability Engineering and System Safety 96 (2011) 324–331
[2] Rausand M, Høyland A. System reliability analysis: models, statistical
methods, and applications. 2nd ed.. Hoboken, N.J.: Wiley-Interscience; 2003.
[3] Bloom N. Reliability centered maintenance: implementation made simple.
NY: McGraw-Hill Companies; 2006.
[4] IEC. IEC 60300-3-11/ NEK IEC 60300-3-11: Dependability management, Part
3–11: Application guide Reliability centred maintenance. Norsk elektrote-
knisk komite (NEK), 1999.
[5] SAE. SAE-JA1011: Evaluation criteria for reliability-centered maintenance
(RCM) processes, Society of Automotive Engineers, 1999.
[6] SAE. SAE-JA1012: A guide to the reliability-centered maintenance (RCM)
standard, Society of Automotive Engineers, 2002.
[7] Khamis B, Hiren S. Use of reliability centered maintenance (RCM) analysis in
Petroleum Development Oman (PDO) for maintenance rationalization. SPE
paper 87249. In: Proceedings of the 2000 Abu Dhabi International Petroleum
Exhibition and Conference, 2000.
[8] Carretero J, Garcı́a F, Pérez M, Peña JM, Pérez JM, Cotaina N, et al. Study of
existing reliability centered maintenance (RCM)—approaches used in
different industries. Informe Técnico FIM/110.1/DATSI/00, Facultad de
Informática, UPM, 2000.
[9] Carretero J, Pérez JM, Garcı́a-Carballeira F, Calderón A, Fernández J,
Garcı́a JD, et al. Applying RCM in large scale systems: a case study
with railway networks. Reliability Engineering and System Safety
2003;82:257–73.
[10] Vatn J. Maintenance in the rail industry. Preventive maintenance models for
complex systems. In: Kobbacy KAH, Murthy DNP, editors. Complex System
Maintenance Handbook. London: Springer-Verlag Limited; 2008. p. 509–32.
[chapter 21].
[11] Desphande VS, Modak JP. Application of RCM for safety considerations
in a steel plant. Reliability Engineering and System Safety 2002;3(78):
325–34.
[12] Johnson LP, Improving equipment reliability and plant efficiency through PM
optimization. Fractal Solutions, Inc., 1995, /http://www.fractalsoln.com/
Papers/PMO_Analysis.pdfS.
[13] Moubray J. Reliability-centered maintenance. 2nd ed.. NY: Industrial Press
Inc; 1997.
[14] Bookless C, Sharkey M. Streamlined RCM in the nuclear industry.
Maintenance and Asset Management 1999;14(1):27–30.
[15] Cheng Z, Jia X, Gao P, Wu S, Wang J. A framework for intelligent reliability
centered maintenance analysis. Reliability Engineering and System Safety
2008;93:784–92.
[16] Eisinger S, Rakowsky UK. Modeling of uncertainties in reliability centered
maintenance—a probabilistic approach. Reliability Engineering and System
Safety 2001;71:159–64.
[17] Aven T. A unified framework for risk and vulnerability analysis and
management covering both safety and security. Reliability Engineering and
System Safety 2007;92:745–54.
331
[18] Aven T, Renn O. On risk defined as an event where the outcome is uncertain.
Journal of Risk Research 2009;12:1–11.
[19] Aven T. A semi-quantitative approach to risk analysis, an alterative to QRAs.
Reliability Engineering and System Safety 2008;93(6):790–7.
[20] Castanier B, Rausand M. Maintenance optimization for subsea pipelines.
International Journal for Pressure Vessels and Piping 2006;83:236–43.
[21] Rausand M. Reliability centered maintenance. Reliability Engineering and
System Safety 1998;60:121–32.
[22] Rausand M, Vatn J. Reliability centred maintenance. In: Kobbacy KAH, Murthy
DNP, editors. A Complex System Maintenance Handbook (Springer Series in
Reliability Engineering). London: Springer-Verlag Limited; 2008. p. 79–108.
[chapter 4].
[23] Rausand M, Vatn J. Reliability Centered Maintenance. In: Guedes Soares C,
editor. Risk and Reliability in Marine Technology. Rotterdam: Balkema;
1998. p. 421–40.
[24] Percy DF. Preventive maintenance models for complex systems. In: Kobbacy
KAH, Murthy DNP, editors. Complex System Maintenance Handbook.
London: Springer-Verlag Limited; 2008. p. 179–208. [chapter 8].
[25] Cui L. Maintenance models and optimization. In: Misra KB, editor.
Handbook of Performability Engineering. London: Springer-Verlag Limited;
2008. p. 789–806. [chapter 48].
[26] Wang H, Pham H. Reliability and Optimal Maintenance. London: Springer-
Verlag Limited; 2006.
[27] Dekker R. Applications of maintenance optimization models: a review and
analysis. Reliability Engineering and System Safety 1996;51:229–40.
[28] Apeland S, Scarf PA. A fully subjective approach to modelling inspection
maintenance. European Journal of Operational Research 2003;148:410–25.
[29] Selvik JT, Flage R and Aven T. The use of maintenance optimization
models—an empirical study from the Norwegian oil and gas industry. In:
Proceedings of the European safety and reliability conference, ESREL 2010,
2010.
[30] NORSOK. Z-008: Criticality analysis for maintenance purposes. Rev. 2.
Norwegian Technology Centre, 2001.
[31] NORSOK. Z-016: Regularity management & reliability technology. Rev. 1.
Norwegian Technology Centre. [Now replaced by ISO 20815], 1998.
[32] International Organization for Standardization (ISO). ISO 20815: Petroleum,
petrochemical and natural gas industries–Production assurance and relia-
bility management. 1st ed., 2008.
[33] Flage R, Aven T. Expressing and communicating uncertainty in relation to
quantitative risk analysis. Reliability and Risk Analysis: Theory & Application
2009;2(13):9–18.
[34] Selvik JT, Aven T. An extended Bayesian updating approach to support
product selection based on performance testing—a drilling jar case. In:
Bris R, Guedes Soares C, Martorell S, editors. Reliability, Risk and Safety:
Theory and Applications, vol. 2. Leiden: CRC Press, Taylor & Francis Group;
2009. p. 813–9.