Maritime University of Szczecin
Akademia Morska w Szczecinie
2011, 28(100) z. 1 pp. 53–59 2011, 28(100) z. 1 s. 53–59
Failure finding tasks in Reliability Centred Maintenance
Wyszukiwanie uszkodzeń urządzeń w systemie utrzymania
ruchu ukierunkowanym na niezawodność i bezpieczeństwo
Marcin Kołodziejski
Prosafe Offshore, Greenwell Road, East Tullos Inustrial Estate Aberdeen AB12 3AX, United Kingdom, e-mail: magosiak@box43.pl
Key words: RCM, hidden and evident faults, hidden faults finding Abstract
Paper presented difference between Reliability Centered Maintenance and reactive/preventive maintenance. Methods of performing RCM analysis which lead to selecting the most appropriate maintenance policy were described. Tasks designed to detect hidden failures – failure finding tasks – and the difference between hidden and evident failures were presented. Importance of failure finding tasks in failure prevention was discussed. Methods of how to determine the frequency of failure finding tasks were described. It was presented RCM analysis as a method to maintain desired availability of offshore dynamic positioning platform MSV “Regalia”.
Słowa kluczowe: utrzymanie ruchu, uszkodzenia jawne, uszkodzenia ukryte, wyszukiwanie uszkodzeń
ukrytych
Abstrakt
W artykule przedstawiono różnicę pomiędzy RCM (Reliability Centred Maintenance) a tradycyjnymi syste-mami zarządzania utrzymaniem ruchu urządzeń. Omówiono sposób prowadzenia analizy zgodnej z zasadami RCM, na podstawie której dobiera się odpowiednią strategię utrzymania ruchu. Omówiono różnicę pomiędzy uszkodzeniami jawnymi i ukrytymi. Przedstawiono zadania wyszukiwania uszkodzeń ukrytych urządzeń jako narzędzia służącego do zapobiegania awariom. Zaprezentowano metody służące do wyznaczenia częstości wykonywania czynności wyszukiwania uszkodzeń. Na przykładzie platformy utrzymującej pozycję w sposób dynamiczny zaprezentowano działania wynikające z analizy RCM, zmierzające do utrzymania obiektu w sta-nie zdatności funkcjonalnej.
Introduction
Evolution of approach towards maintenance in time perspective can be presented as three genera-tions of maintenance [1, 2]:
reactive maintenance (fix it when it broke); preventive maintenance – planned and
pre-ventive repairs. Increasing production demand during WWII caused that downtime of the equipment came into consideration, equipment failures could and should be prevented – this led to the concept of preventive maintenance. This system has also been utilized on most of the ships under approval of Classification Societies (CSM – Continuous Survey
Machin-ery, MPMS – Machinery Planned Maintenance Scheme) [3];
predictive-proactive maintenance;
• TPM (Total Productive Maintenance) – product centered operation and production integrated with maintenance activities. It was introduced in Japanese automobile manufac-turing factories in 1960s;
• Toyota Production System – production and maintenance system developed by the Toyota Company;
• CMMS – Computerized Maintenance Man-agement;
• system 80/20 (Pareto principle). Simply stat-ed, the 80/20 rule generally asserts that
a minority of causes, inputs or efforts usually lead to a majority of the results, outputs or rewards. From a maintenance point of view 80% of failures come from 20% of the equip-ment. It is important to be able to recognize those 20% as maintenance activities will focus on them. Allocation of maintenance resources on remaining 80% is reduced be-cause potential gains are relatively small [4]; • Reliability Centred Maintenance. In 2004
RCM has been recognized and approved by Classification Societies as maintenance ma-nagement system aboard ships and floating offshore installations [5].
The traditional approach to scheduled mainte-nance programs was based on the concept that eve-ry item or a piece of complex equipment has a right age at which complete overhaul is necessary. This overhaul will prevent the failure of this piece of equipment. Through the years of observations, it was discovered that many types of failures could not be prevented by such maintenance activities, regardless how intensive they were [2, 4, 6, 7]. As a result of those observations new, proactive and prognostic maintenance systems were developed and introduced. RCM was among them.
RCM history began in 1960s when maintenance steering group was formed to oversee development of the initial maintenance program for the new Boeing 747 airplane. In the early years of commer-cial jet aviation, air craft manufacturers and airlines were trying to reduce failure rate by decreasing overhaul intervals. Such a maintenance system would prove to be not economical in case of a new, very sophisticated airplane. Overhauls at given time intervals reduced a small proportion of failures, but in the same time caused an increase of failures caused by overhauls themselves. Overhauls had a negative effect on reliability, because the proba-bility of failure of the newly replaced or overhauled equipment increased due to premature failures and infant mortality. Boeing Management decided to develop a brand new maintenance system.
Observation of failure modes allowed a discov-ery of phenomenon that similar components did not wear out over time in any sort of identical manner. Only 10% of all components (excluding construc-tion elements) exhibited a wear-out rate that could justify their replacement at given intervals [4, 6, 7]: Scheduled overhaul has little effect on the over-all reliability of a complex item unless the item has a dominant failure mode;
There are many items for which there is no ef-fective form of scheduled maintenance.
Document known as MSG-1 (Maintenance Steering Group) was used by special teams within aviation industry and developed into the first maintenance program based on the principles of reliability centered maintenance. Boeing 747 pro-gram was successful. Following a number of im-provements, new document called MSG-2 was introduces. It was used to develop the scheduled maintenance programs for the Lockhead 1011 and the Douglas DC10 airplanes. Later on, document known as MSG-3 was modified 4 times in 1988, 1993, 2001 and 2002. It has been adopted by most the airlines. It was also used to develop mainte-nance systems for latest airplanes, e.g. Boeing 777 and Airbus 330/340. MSG-3 today guides the development of initial scheduled maintenance programs used by industrial world.
In 1986 US Navy Air Force embarked on devel-oping RCM processes for their own use. In 1990s British Royal Navy implemented RCM-oriented Naval Engineering Standard (NES45). In 1987 RCM was adopted on an industry-wide basis by the American Nuclear Power Industry [4]. RCM im-plementation projects range from awareness train-ing to full-scale implementation. Until today RCM projects have been carried out in almost all sectors of industry. These include military, building ser-vices, transport, utilities, offshore, marine, petro-chemicals and many more. In 1996 RCAM was implemented by NASA (National Aeronautics and Space Administration) [8].
RCM has also been implemented on offshore oil and gas installations. In 2004 RCM was approved by Lloyds Register of Shipping as maintenance management system aboard ships and floating off-shore installations [3, 5]. Semisubmersible rig MSV “Regalia” is one of the first platforms that imple-mented RCM. Initial RCM analysis were performed in 2004, actual implementation took place in 2005– 2006. In 2010 MSV “Regalia” was granted RCM Descriptive Note by Lloyds Register of Shipping. This Class Note is an approval of Classification Society for RCM based maintenance system aboard the rig.
Reliability Centered Maintenance is a process used to determine what must be done to ensure that physical asset continues to perform its function in its present operating context. RCM process can be described as 7 steps [2]:
What are functions of the asset and its perfor-mance standards in its operation context? In what ways does the asset fail to perform its
functions?
What is the result of each failure? What is the importance of each failure?
What can be done to predict / prevent each fail-ure?
What should be done, if there is no proactive task that can prevent the failure?
Above steps allow to perform a systematic eval-uation of the asset. A set of tasks is generated on the basis of this evaluation that is used to develop and optimize a maintenance strategy. RCM incor-porates decision logic to ascertain the safety and operational consequences of failures and identifies the mechanisms responsible for those failures. The consequence of failure is what the whole RCM process is all about. All RCM related activities have one goal – to find out what consequences failure will have and how to prevent it. RCM leads to development of preventative maintenance program [6].
Description of semisubmersible offshore rig MSV “Regalia”
MSV “Regalia” (Fig. 1) is a semisubmersible, DP (dynamic positioning) rig. The vessel maintains station by means of a dynamic positioning control system which is integrated to 6 azimuth thrusters located in the two pontoons. The MSV “Regalia” is a semi submersible with identical pump room and propulsion unit rooms located within each pontoon. The pontoons are connected to the main platform by four octangular columns, each 12 meters long, one located at each corner. Height over the lower deck is 25.5 meters above the keel. The lower deck within the main platform contains the main power generation plant and associated switchboard rooms at the aft end of the area. Power generation plant consists of 2 independent engine rooms. There are 3 off identical Diesel driven generator sets in each of the engine rooms.
Fig. 1. MSV “Regalia” during refit in Bergen Rys. 1. MSV „Regalia” podczas remontu w Bergen
Access from the “Regalia” to the unit which is being supported is provided by a hydraulic telescopic aluminum gangway for use by the con-struction personnel accommodated on “Regalia” (Fig. 2).
Fig. 2. MSV “Regalia” on DP alongside anchored semisub-mersible MSV “Visund”
Rys. 2. MSV „Regalia” w trakcie operacji DP obok zakotwi-czonej platformy „Visund”
All systems and component involved in station keeping have built-in redundancy to meet DP3 requirements [9]. In 1994, the IMO adopted the current standards of DP Classification as estab-lished in Annex 7 of IMO 645 the Draft MSC Circular – Guidelines for Vessels with Dynamic Positioning Systems, IMO DP Class 3 being accepted as the highest standard where a loss of position should not occur as a result of a single failure in any active component or system.
IMO 645 identified DP Classification wich will be described below [9].
For equipment Class 2, a loss of position is not to occur in the event of a single fault in any active component or system. Normally static components will not be considered to fail where adequate pro-tection from damage is demonstrated, and reliabil-ity is to the satisfaction of the Administration.
Single failure criteria include:
any active component or system (generators, thrusters, switchboards, remote controlled valves, etc.);
any normally static component (cables, pipes, manual valves, etc.) which is not properly documented with respect to protection and relia-bility.
For equipment Class 3, a single failure includes: items listed above for Class 2, and any normally
static component is assumed to fail;
all components in any one watertight compart-ment, from fire or flooding;
all components in any one fire sub-division, from fire or flooding.
For Equipment Classes 2 and 3, a single inad-vertent act should be considered as a single fault, if such an act is reasonably probable.
During DP operation, the main requirement is that single point failure should not lead to loss of control / loss of position. System design in support of this must promote aspects of required redundan-cy to support this philosophy whilst also satisfying relevant class rules and associated industry guide-lines as a formal route of acceptance. The end user receiving a system which is thus fit for purpose in an operational capability, and thus removes the technical shortfalls as a result of both design – in-terfacing and administration of construction guide-lines.
FMEA (Failure Modes and Effect Analysis) per-formed for MSV “Regalia” [10] defines a worst case single failure [11] as the Main Busbar black-out, consequence of it will be power supply failure to 3 out of 6 Azimuth Thrusters. In case of such a failure vessel is able to maintain station keeping, however with limited redundancy. Any consecutive failure may cause loss of position.
Maintenance strategy aboard MSV “Regalia” is to assure such a reliability of the dynamic position-ing equipment that will ensure a safe station keep-ing. The traditional approach to scheduled mainte-nance programs did not meet this purpose as it was based on the concept that every item on a piece of complex equipment should be overhauled or re-placed at fixed intervals, usually set up by the man-ufacturer. This overhaul was to prevent the failure of this piece of equipment. Scheduled maintenance system did not take into consideration the conse-quences of failures for dynamic positioning opera-tion. To increase reliability of the vessel and her systems owner of the rig decided to implement new maintenance management system – RCM. The whole concept of RCM is based on Failure Modes and Effect Analysis. FMEA carried out for MSV “Regalia” [10] analyzed failure consequences for safety and reliability of dynamic positioning.
RCM process classifies all functions performed by systems into two categories – evident functions and hidden functions. If failure of the function will become evident to operating crew then it is an evi-dent. And the opposite, if failure will not become evident to operating crew then function is hidden. Stand-by pump, that is automatically started in case of main pump failure, is an example of a hidden function – its failure will not become evident until main pumps fails. The first step in RCM analysis – failure consequence evaluation – is to separate den functions from evident functions because hid-den ones require different approach in maintenance
strategy. Hidden functions are mostly associated with protective devices [2, 4] that are not fail safe. Protective devices are used to prevent or, at least, to reduce the probability of failure of protected func-tion. Examples of protective devices installed on Diesel generator sets onboard MSV “Regalia”: lubricating oil low pressure shut down, overspeed device,
high cooling water temperature shut down, main bearings temperature shut downs, oil mist detector.
Each one of them will activate emergency stop of the Diesel generator set, if parameter set points are exceeded.
A multiple failure occurs, if a protected function fails while a protective device is in a failed state. Failure of lubrication system on the Diesel genera-tor set, when lubricating oil low pressure shut down is in failed state, is an example of multiple failure. It will result in a catastrophic damage to the engine. RCM process applied to hidden functions imple-ments maintenance activities that prevent multiple failures, or at least minimize their consequences. Hidden failure of protective device increases prob-ability of multiple failure. When maintenance pro-gram for hidden functions is developed, its main objective is to prevent the failure of protected func-tion. Probability of a multiple failure in any period equals to the probability of protected function fail-ure, when protective device already is in failed state in the same period. Most important element of hid-den function performance is its ability to reduce the probability of multiple failure to a tolerable level.
Proactive maintenance and failure finding
Proactive maintenance contains activities which are undertaken prior to failure occurrence. They are to prevent the component from getting into failed state. According to RCM process, proactive maintenance is worth doing if it eliminates or re-duces the consequences of analyzed failure mode to the level that justifies cost of doing the task [2]. If it is not possible to perform proactive maintenance activities that can prevent a hidden failure, it is still possible to reduce the risk of multiple failure by testing hidden function at fixed intervals. Proactive activities are more conservative and probably safer way of maintaining the equipment as they prevent the failure. Failure finding is based on the principle that hidden failure already occurred in the system and we are to detect it prior to multiple failure oc-currence. That’s why failure finding is applicable in RCM process when RCM analysis cannot imple-ment proper proactive tasks [2]. If proactive tasks
cannot be defined then failure finding tasks are carried out at suitable intervals and if failure of hidden function / protective device is repaired as soon as it is found, it is still possible to maintain high levels of reliability of protected function. In some cases, it is impossible to implement failure finding task into maintenance system that will secure desirable level of reliability. To reduce probability of multiple failure, RCM process rec-ommends redesign of the equipment
If it is possible to implement proactive or failure finding tasks for the component, but their cost is higher than economical consequences of failure, then, if safety is not compromised, component is designated as run-to-failure [2]. A run-to-failure component is designated as such because it is un-derstood to have no safety, operational or economi-cal consequences as the result of single failure.
The goal of failure finding is to make sure that a protective device will provide required protection to protected function when called upon to do so. Failure finding tasks are often described as func-tional checks – they determine if protective device is still operational and fulfils its function. A failure finding task must detect all failure modes which may cause protective device to fail. This applies especially to complex devices such as electrical circuits. Function of entire system must be tested from sensor to actuator. Best way to do it is to simulate the condition, when circuit is supposed to be activated to make sure that it responds in desired way. Protective device should not be disturbed during the test as dismantling makes it possible to put it back together incorrectly. In a number of cases, it is impossible to perform failure finding tasks. I takes place, e.g. when there is no access to protective device or it is not possible to test protec-tive device without destroying it. In those cases, if risk of multiple failure is too high, component should be redesigned. Risk of multiple failure must be minimized when carrying out failure finding tasks. Some of the failures finding tasks actually increase a risk of the multiple failure. An example is functional test of overspeed device of Diesel engine. Test is performed by gradual and controlled increasing of the engine speed above nominal value. Nominal speed of Diesel engines onboard MSV “Regalia” is 900 rpm, mechanical overspeed is set to activate emergency stop of the engine at 115% of nominal speed – it equals to 1035 rpm. Overspeed test causes speed overload of the engine and may cause catastrophic damage to the engine, should overspeed device fail to stop the engine at its setpoint. If protective device has to be switched off during the test, then alternative protective
de-vice should be provided, or the protected function should be shut down until protection is restored.
Most of the protective devices have one, single failure mode however, for some protective devices, it may be appropriate to carry out FMEA of the device to identify individual failure modes which might be cause of device failure. It will allow dif-ferentiating modes of failure finding activities for subcomponents of protective device [2].
Main problem associated with failure finding maintenance activities is a possible scenario that the task itself can cause the very failure that it is sup-posed to detect. If the system is disturbed during by the task, there is always a possibility that system will be left in a failed state. In such a case protec-tive device will be left in a failed state from the moment when test is completed, even if it was in good state prior to the test. It will trigger a hidden failure. In this case failure finding task causes a failure which will remain in the system until next failure finding is scheduled or what is worse, until failure of protected function which will cause mul-tiple failure. In such a case failure finding task will not reduce probability of multiple failure regardless of its frequency.
Frequency of failure finding tasks
Failure finding task intervals are determined by two variables – required availability and the failure frequency of protective device. For preventive maintenance tasks, their intervals depend on life expectancy of the element [1]. Predictive mainte-nance task intervals are based on time between the occurrence of potential failure (first symptoms of failure) and its decay into a functional failure. A potential failure is a condition which indicates that functional failure is in the process of occurring or about to happen. Following potential failure, condition of the component deteriorates and then, if it is not detected and corrected, functional failure takes place [2]. There are many ways of finding out if failures are in the process of occurring, e.g. vibra-tion monitoring, thermography, oil analysis, flow measurements etc. If potential failure is discovered prior to functional failure occurrence, there is a pos-sibility to prevent the failure, or to minimize conse-quences of the functional failure. Tasks designed to detect potential failures are called on-condition tasks because components which are checked dur-ing those tasks are left in service on the condition that they meet their performance standards. This is also known as predictive maintenance as they are trying to establish, if and when component is going to fail.
If proactive maintenance activities that will pre-vent the failure cannot be established then the next step in RCM decision process is to define failure finding maintenance activities. Those activities apply to hidden failures only.
If following abbreviations are used [2]: FFI – failure finding internal,
MTIVE – MTBF (mean time between failures)
of the protective device,
UTIVE – allowed unavailability of protective
device.
Then it is possible to present the following for-mula for calculating FFI [2]:
FFI = 2UTIVEMTIVE (1)
As per above formula, to establish failure find-ing internal for a protective device, it is necessary to know mean time between failures and desired availability of the device.
Knowing relationship between failure finding intervals, reliability and unavailability of protective device, the next step will be to establish what avail-ability is required, i.e.:
1. To determine what probability can be tolerated for multiple failure which will occur, if hidden function already is in a failed state when pro-tected function fails;
2. To establish probability of protected function failure in considered period of time;
3. To define what availability (1 – UTIVE) the
hid-den function must have to minimize the proba-bility of multiple failure to the desired level. Mean time between failures of protective devise must be known as well.
If probability of a multiple failure is, e.g. 1 in 100 years then MMF (mean time between multiple
failures) is 100 years, and probability of multiple failure in any year is 1 / MMF. If demand rate
(prob-ability of protected function failure) is once in 10 years then MTED (mean time between failures of
protected function) is 10 years and probability of protected function failure is 1 / MTED
Multiple failure probability is a product of prob-ability of protected function failure and unavailabil-ity of protective device [2]:
TIVE TED MF 1 1 U M M (2) MF TED TIVE M M U (3) TIVE TIVE 2 FFI U M (4) MF TED TIVE 2 FFI M M M (5)
Formula (5) allows calculating the interval of failure finding activities. To determine this interval following values must be known:
probability of protective device failure, probability of protected function failure, probability of multiple failure.
Conclusions
RCM process applied to any sophisticated industrial system will define a great number of hidden function; in some systems this number can reach 40% of all failure modes. Most of them require systematic failure finding maintenance activities. In some systems 30% of all maintenance tasks generated by RCM are failure finding tasks [2]. Many maintenance strategies neglect hidden failures, esp. of protective devices which become evident in case of multiple failure. This article stresses the importance of maintenance strategy properly applied to hidden functions.
Probability of multiple failure can be reduced by:
decreasing of the rate of failure of protected function (proactive / predictive maintenance or its redesign to improve protected function relia-bility);
increasing the availability of protective device (proactive maintenance, failure finding, redesign of protective device to decrease its unavailabil-ity). Availability is the proportion of time when system is in a functioning condition.
Multiple failure probability depends on the rate of failure of protected component. Higher standard of maintenance achieved due to RCM decision process will reduce its rate of failure. Similar result can be obtained as a result of equipment redesign to improve its reliability. Resign is the last step in RCM decision process and is only recommended, if it is not possible to implement either proactive or failure finding tasks and it must be economical. When risk associated with protected systems is assessed, sometimes probability of protective de-vice failure and protected dede-vice is regarded as a fixed relationship. This leads to the idea that probability of multiple failure can only be changed by modification to the hardware (redesign). This assumption is wrong as in most cases, it is possible to change both probability of failure of protected function and the availability of protective device by adopting suitable maintenance strategy. This results
in possible reduction of multiple failure probability to the desired level. If it is possible to identify a potential failure to prevent occurrence of func-tional failure, then MTBF will be increased sub-stantially what in turn will decrease multiple failure frequency. However, the reason for installing a protective device is that the protected function is susceptible to failures that cannot be anticipated and having serious consequences. If nothing is done to prevent the failure of protected device, it will fail at some stage and will stop to provide any protec-tion to protected funcprotec-tion. From this moment mul-tiple failure probability is equal to the probability of the protected function. To prevent a multiple fail-ure, proper maintenance activities must ensure that the hidden will fulfill its function when the protect-ed device fails. If it was possible to establish a proactive task which could ensure 0% unavaila-bility of the protective device, then a multiple fail-ure would be impossible. In practice, it is very un-likely. RCM decision process delivers availability required to reduce the probability of the multiple failure to a tolerable level. Proactive task is only worth implementing into maintenance strategy, if it reduces the probability of the multiple failure to a tolerable level and is justified on economic ground.
Paper presents the role of Reliability Centered Maintenance implemented on semisubmersible offshore rig MSV “Regalia” with regards to hidden failures. It also describes reason for a decision to implement on MSV “Regalia” RCM system based on Failure Mode and Effects Analysis. Further re-search on MSV “Regalia” RCM system will carry out detailed analysis of hidden failures for selected platform systems including results of 5 years obser-vation of hidden failures rate. It will also present
maintenance activities with regard to hidden func-tions that were implemented as a result of RCM decision process and their influence on density of hidden failures.
References
1. LEGUTKO S.: Trendy rozwoju i utrzymania ruchu. Eksplo-atacja i Niezawodność, 2009, 2, 8–16.
2. MOUBRAY J.: Reliability Centered Maintenance RCMII, 2001.
3. https://www.cdlive.lr.org
4. SMITH A.: RCM – Gateway to World Class Maintenance, 2003.
5. Lloyds Register of Shipping, ShipRight – Design and Con-struction, Machinery Planned Maintenance and Condition Monitoring, Changes incorporated in May 2004.
6. BLOOM NEIL B.: Reliability Centered Maintenance, 2006. 7. NOWLAN F., HEAP H.: Reliability Centered Maintenance,
1978.
8. National Aeronautics and Space Administration (NASA) Reliability Centered Maintenance Guide for Facilities and Collateral Equipment, 2008.
9. Aneks 7 IMO 645 – Guidelines for Vessels with Dynamic Positioning Systems.
10. MSV “Regalia” – Rig Operation Manual, property of Prosafe Offshore, 2011.
11. MATUSZAK Z., KOŁODZIEJSKI M.: Comments about the dy-namic position vessels service. Marine Technology ODRA 97, Computational Mechanics Publications, Southampton Boston 1997, 343–349.
Others:
12. KOŁODZIEJSKI M.: Monitorowanie stanu urządzeń ukie-runkowane na niezawodność i bezpieczeństwo zgodne ze standardami RCM (Reliability Centred Maintenance). Technicka Diagnostika, Asociace technickych diagnostiku Ceske republiku, 2011, 1, 34.
13. KOŁODZIEJSKI M.: Problemy związane z eksploatacją pęd-ników wodnostrumieniowych na jednostkach utrzymują-cych pozycję w sposób dynamiczny – dynamic positioning. Budownictwo Okrętowe i Gospodarka Morska, 1998, 10, 22–25.
