Brief History
The development of RCM3 started back in 1998.
The
original concepts have been fully developed
before John Moubray passed away
and further tested
over a period of almost 10 years
through Aladon Network Members with many
world-class facilities. The results of their
pioneering work have been groundbreaking and
has been implemented successfully in many
Blue Chip Companies with results that exceed
the expectation of most.
RCM2 Approach
The
Duty / Standby Pump arrangement
We will discuss two scenarios.
In the first scenario, based
on the example above, the failure of the
duty pump will not matter (provided no
consequential damage occurred), and
therefore the RCM review team may recommend
“run-to-failure” for the duty pump. This
could be the most effective and economical
form of maintenance for the duty pump –
therefore the decision may be the correct
one. In the example we assume low or no
consequences for the multiple failure. The
multiple failure (when both pumps fail
simultaneously) would have a consequence
(let’s assume an operational consequence
i.e. downtime, production loss, etc.).
The probability of the
multiple failure could be managed (reduced)
by increasing the availability of the
standby pump. The availability of the
protective device is “increased” (or the
probability of the multiple failure is
decreased) by performing a “functional
check” on the standby pump. The task is done
at a frequency which depends on the
reliability of the protected function (duty
pump) and the availability needed from the
protective device (standby pump). The last
being related to the associated risk of the
multiple failure.
To summarize, for the two
pumps we could end up with a
“run-to-failure” recommendation for the duty
pump and a “functional check” for the
standby pump.
In the second scenario, if the
pumps in the above example provide cooling
water to a nuclear reactor, failure of the
duty pump may result in an unacceptable risk
to the owners (although the failure on its
own still does not matter). Losing the
redundancy may increase the risk to an
intolerable level. However, the function to
cool is still preserved by the standby pump
taking over the function from the duty pump
that has failed. If traditional RCM is
applied correctly, the answer to the
question whether this failure mode (on its
own) could cause a loss of function or other
damage which could injure or kill someone or
breach any known environmental standard or
regulation, will be NO!
Based on the increase in risk,
it would be required to increase the
availability of the standby pump (reduce the
probability of a multiple failure) by
increasing the frequency of the functional
checks. In other words, in order to reduce
the probability of a catastrophic failure,
the RCM review group may still rely
primarily on the availability and integrity
of the protective device. Only essential
maintenance may be performed on the duty
pump i.e. lubrication.
RCM3 Approach
The new RCM3 process decision
logic splits Hidden Consequences in two
categories, multiple failures that affect
“Safety and the Environment” and the ones
that affect “Operations”. This is especially
useful and essential for high risk
environments as described above.
Furthermore, RCM3 places the focus on the
protected function first and foremost.
The RCM3 process addresses the
reliability of the duty pump first through
applying suitable proactive failure
management strategies to the protected
function. In doing so, the probability of
the functional failure is reduced and
therefore less likely to rely on the
protective device to take over the function
which failed. The result is a more reliable
system and less “functional checks”
(testing) of the protective device or
standby pump will be required. Overall, it
reduces risk, improves reliability and
reduces the cost of maintenance.
RCM3 does so in asking the
question described above differently; “Could
the effect of this failure mode on its own
(in the absence of any OR due to failure of
existing protective devices) result in an
intolerable risk to people?”. The answer to
this question is now YES!
From this, the review group
will focus on the protected function (duty
pump) first, and develop a proactive failure
management strategy for the same. The
revised risk (based on the new maintenance
strategy) will be assessed and if the risk
is still intolerable, the protective device
and its availability requirement will be
addressed. The following question will now
be considered; “Could the effect of the
multiple failure result in an intolerable
physical risk to people or result in an
intolerable risk of breaching any
environmental standards or regulations?
If the answer is YES, the RCM
review group will seek a suitable failure
finding task (to reduce the risk of the
multiple failure to a tolerable level) and
if a suitable failure finding task cannot be
found, a redesign will be compulsory.
RCM3 Additional Benefits
RCM3 exceeds SAE standards and broadens RCM2
capability to align with more recent and
international accepted ISO Management
Systems (ISO 55000 and ISO 31000).
The
analysis results are even more robust and
defensible (especially for high risk
industries). And, everything we keep
learning with each passing milestone makes
RCM3 even better. Additionally, RCM3 is
fully integrated with other Business Risk
Management Systems like RBI and HAZOP.
|