Aladon released RCM3™ in April 2015 at its Principals’ meeting in South Africa. RCM3 will be the next generation Aladon RCM.
RCM3™ does not replace RCM2™! RCM2 is still the most used RCM methodology worldwide. We have enhanced our methodology and our process to make the analysis results even more robust and defensible (especially for high risk industries). RCM3 will be offered parallel to RCM2 for our clients who request it.
We have built on our legacy and brand to bring RCM mainstream with the “new” Management Systems ISO 55000 and ISO 31000.
Aladon and “The Aladon Network” is the world’s leading reliability expert in providing RCM Training and Consulting Services. We listened to our critics and took advice from our customers when we developed our advanced next generation RCM. Recently, traditional RCMs (all derivatives and abbreviations) came under pressure when RCM critics stated that RCM does not deal well with protected functions (functions that are protected through protective devices, i.e. a duty / standby pump arrangement).
For the hardcore RCM people out there, we know it is not true, but we have to defend our methodologies and shield the criticism and we did. Most traditional RCMs have a subjective approach to risk – we changed it! Over the next few weeks Aladon will post a series of articles that will explain the difference between the Aladon RCM2 and RCM3 processes, the reasons for the changes (enhancements), and the highlights of the RCM3 process. Although RCM3 was only released recently, it has been trialed and tested with large corporations on various sites with great success. The development of RCM3 started before John Moubray passed away and has been in development and in testing over a period of almost 10 years.
In the first RCM3 article, we are going to discuss the comments and answer our critics with regards to the “perceived shortcomings” of RCM and how RCM deals incorrectly with protected functions. For this purpose we are going to use the example of a duty / standby pump. First, we will explore how traditional RCM processes deal with the pump example and secondly, how the Aladon RCM3 will address the same example.
Our definition of RCM: “RCM is a process used to determine what must be done to any physical asset to ensure it continues to do what the user wants it to do (fulfill its functions) in the present Operating Context”.
The critics stated that according to the RCM process, the loss of the protected function (say, to transfer water) on its own (duty pump fail) will not matter since the protective device (standby pump) will take over and restore the function. According to the critics, RCM review groups could neglect the duty pump (failure doesn’t matter) and focus on the standby pump primarily. This, according to the critics, may be acceptable in low risk environments, but may not be acceptable in nuclear, chemical, petro-chemical, and highly regulated environments and we agree…..
The traditional approach:
We will discuss two scenarios. In the first scenario; based on the definition and information from the example above, the failure of the duty pump will not matter (provided no consequential damage occurred), and therefore the RCM review team may recommend “run-to-failure” for the duty pump. This could be the most effective and economical form of maintenance for the duty pump – therefore the decision may be the correct one. In the example we assume low or no consequences for the multiple failure. The multiple failure (when both pumps fail simultaneously) would have a consequence (let’s assume an operational consequence i.e. downtime, production loss, etc.). The probability of the multiple failure could be managed (reduced) by increasing the availability of the standby pump. The availability of the protective device is “increased” (or the probability of the multiple failure is decreased) by performing a “functional check” on the standby pump. The task is done at a frequency which depends on the reliability of the protected function (duty pump) and the availability needed from the protective device (standby pump). The last being related to the associated risk of the multiple failure. To summarize, for the two pumps we could end up with a “run-to-failure” recommendation for the duty pump and a “functional check” for the standby pump.
In the second scenario; if the pumps in the above example provide cooling water to a nuclear reactor, failure of the duty pump may result in an unacceptable risk to the owners (although the failure on its own still does not matter). Losing the redundancy may increase the risk to an intolerable level. However, the function to cool is still preserved by the standby pump taking over the function from the duty pump that has failed. If traditional RCM is applied correctly, the answer to the question whether this failure mode (on its own) could cause a loss of function or other damage which could injure or kill someone or breach any known environmental standard or regulation, will be NO!
The review group may find themselves with the same recommendation for the two pumps where they end up with a “run-to-failure” recommendation for the duty pump and a “functional check” for the standby pump.
Based on the increase in risk, it would be required to increase the availability of the standby pump (reduce the probability of a multiple failure) by increasing the frequency of the functional checks. In other words, in order to reduce the probability of a catastrophic failure, the RCM review group may still rely primarily on the availability and integrity of the protective device. Only essential maintenance may be performed on the duty pump i.e. lubrication.
The Duty / Standby Pump arrangement
Our New RCM3 approach:
The new RCM3 process decision logic splits Hidden Consequences in two categories, multiple failures that affect “Safety and the Environment” and the ones that affect “Operations”. This is especially useful and essential for high risk environments as described above. Furthermore, RCM3 places the focus on the protected function first and foremost. The RCM3 process addresses the reliability of the duty pump first through applying suitable proactive failure management strategies to the protected function. In doing so, the probability of the functional failure is reduced and therefore less likely to rely on the protective device to take over the function which failed. The result is a more reliable system and less “functional checks” (testing) of the protective device or standby pump will be required. Overall, it reduces risk, improves reliability and reduces the cost of maintenance.
RCM3 does so in asking the question described above differently; “Could the effect of this failure mode on its own (in the absence of any OR due to failure of existing protective devices) result in an intolerable risk to people?”. The answer to this question is now YES!
From this, the review group will focus on the protected function (duty pump) first, and develop a proactive failure management strategy for the same. The revised risk (based on the new maintenance strategy) will be assessed and if the risk is still intolerable, the protective device and its availability requirement will be addressed. The following question will now be considered; “Could the effect of the multiple failure result in an intolerable physical risk to people or result in an intolerable risk of breaching any environmental standards or regulations?
If the answer is YES, the RCM review group will seek a suitable failure finding task (to reduce the risk of the multiple failure to a tolerable level) and if a suitable failure finding task cannot be found, a redesign will be compulsory.
It is our experience that when the process is followed and applied correctly, less redundancy (protection) is required and the overall failure finding frequency for the protective device is reduced dramatically. The outcome also recommends less compulsory redesigns and more decisive decisions are made by the review groups.
For more information about RCM3, please contact your nearest Aladon Network Member, or contact The Aladon Network.