Computers & Industrial Engineering 182 (2023) 109409

Contents lists available at ScienceDirect

Computers & Industrial Engineering

journal homepage: www.elsevier.com/locate/caie

Automatic identification of maintenance significant items in reliability

centered maintenance analysis by using functional modeling and reasoning
Mengchu Song ∗, Xinxin Zhang, Morten Lind
Department of Electrical and Photonics Engineering, Technical University of Denmark, Elektrovej, Bygning 326, 2800 Kongens Lyngby, Denmark

ARTICLE INFO ABSTRACT

Keywords: Complex industrial systems adopt reliability centered maintenance (RCM) for maintenance optimization to
Reliability centered maintenance improve safety and reduce maintenance cost. Preserving function is the core maintenance principle, yet the
Maintenance significant items function concept has not been systematically studied in the context of RCM. This article presents a framework
RCM automation
of model-based RCM analysis, which is driven by functional modeling and reasoning. The study focuses on
Functional modeling
identifying the so-called maintenance significant items through assessment of failure consequences. Multilevel
Failure consequence analysis
Functional reasoning
flow modeling (MFM) is proved competitive to identify sufficient system functions that expect maintenance to
preserve. It is also able to define failure modes and represent their interactions with system functions, which
are essential to RCM. A failure analysis tool for RCM is developed by taking advantage of the causal reasoning
capability of MFM, which can be used to automatically analyze consequences of all failures predefined for a
target system and generate equipment classifications useful to maintenance optimization. The study provides
the possibility of RCM automation, which has been highly demanded by various complex industries. Moreover,
as a fundamental functional knowledge framework, MFM can easily accommodate changes in design and
operation, which affords the opportunity of implementing a living RCM program.

1. Introduction petrochemicals (Zhou et al., 2016) and metals production (Deshpande

& Modak, 2002).
Reliability centered maintenance (RCM) is technically not a spe- There is an revolutionary transformation in the maintenance mind-
cific maintenance method, it is rather a systematic analysis approach set by RCM, that maintenance is not about protecting equipment but
for planning and optimizing the global preventive maintenance (PM) should be used to preserve function (Smith & Hinchcliffe, 2003). It
regime. RCM has two main objectives: one is to improve safety by
implies that sometimes we need to abandon vendors’ maintenance
ensuring that the most critical components are properly maintained;
recommendations and consider the purpose or role that equipment
the other is to reduce cost by avoiding expenditure on unnecessary
can serve to determine PM. Therefore, RCM puts most of its efforts
maintenance activities, which thus can improve the maintenance ef-
ficiency (Kim & Jeong, 2013; Rausand, 1998). The use of RCM also in tasks such as defining functions and acceptable performance stan-
enhances the performance of PM strategies in particular to condition- dards, identifying the ways in which functions may fail, and relating
based maintenance (CBM). It can not only advise acceptable intervals components and their failure modes with higher-level failures of func-
for condition monitoring (Huang et al., 2014), but also support an tions in higher levels that can be caused to occur (Rausand, 1998).
adaptive maintenance method to reach cost-effectiveness (Niu et al., There is no doubt that conducting these tasks is the key to ensure an
2010). With growing demands on equipment maintenance, many indus- effective maintenance planning. However, the cost is that the analysis
trial domains have accommodated RCM to their maintenance planning can be rather a labor-intensive and time-consuming process, which is
programs. After the approach was originally developed for commercial considered as the major drawback of the classical RCM analysis (EPRI,
aviation (Nowlan & Heap, 1978), it has been extensively employed in 2002; Pujadas & Chen, 1996). This is reflected by a pilot study (Fox
transportation such as maritime (Eriksen et al., 2021) and railway (Car- et al., 1994) where the concept of RCM was first introduced into the
retero et al., 2003), energy from conventional resources such as nu-
nuclear industry. Although being deemed as an outstanding success, it
clear (IAEA, 2007) and fossil fuel (Melani et al., 2018), to renewable
took three full-time engineers and six working years to accomplish the
wind power (Fischer et al., 2012), infrastructure like urban distribu-
whole analysis.
tion system (Bertling et al., 2005), and process industries including

∗ Corresponding author.
E-mail addresses: [email protected] (M. Song), [email protected] (X. Zhang), [email protected] (M. Lind).

https://doi.org/10.1016/j.cie.2023.109409
Received 8 March 2023; Received in revised form 22 May 2023; Accepted 25 June 2023
Available online 27 June 2023
0360-8352/© 2023 The Author(s). Published by Elsevier Ltd. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

reliability improvement plans including maintenance. Johnston (2002)

Nomenclature try to automatize the step after LTA, to determine the optimal mainte-
AHP Analytic Hierarchy Process nance tactics for specific equipment categories by combining Bayesian
AI Artificial Intelligence belief network (BBN) and plausible reasoning theory. As the analysis is
updated with evidence about the maintenance situation, the decision
BBN Bayesian Belief Network
system can show the real-time percentage confidence of all possible
CBM Condition-based Maintenance
maintenance actions, which can provide a dynamic and structured
CBR Case-based Reasoning
documentation for the RCM analysis. Considering too much qualitative
CMMS Computerized Maintenance Management human judgement is involved in the decision, Ma et al. (2020) suggest
System making RCM data-driven, which is realized by replacing failure mode,
FBD Functional Block Diagram effect and criticality analysis (FMECA) with quantitative analysis on
FM Functional Modeling maintenance effects, and replacing the original decision logic with
FMECA Failure Mode Effect and Criticality Analysis quantitative Monte Carlo simulation.
FR Functional Reasoning
Exploration of past experience. The RCM analysis can be automated by
LTA Logic Tree Analysis exploiting previous analysis experiences, which mainly concentrates
MFM Multilevel Flow Modeling in applications of case-based reasoning (CBR). The idea of using CBR
MSI Maintenance Significant Item is that historical records of RCM analysis on similar items can be
P&ID Piping & Instrumentation Diagram referenced in the analysis on a new item (Cheng et al., 2012, 2008).
PM Preventive Maintenance An existing RCM analysis case is first acquired and formalized as a
RCM Reliability Centered Maintenance representation containing results about FMECA and logic decisions,
RTF Run-to-Failure which can be automatically retrieved to generated new outcomes.
TTE Time-to-Effect Similar works can be found in Cândea et al. (2014), Kobbacy (2012),
Rodríguez-Padial et al. (2022).

Optimization and automation of evaluation criteria. The efficiency of

RCM analysis can also be improved through optimizing the evalua-
Industry as well as academia have therefore made many attempts to
tion criteria for identifying the maintenance significant items (MSIs),
optimize and automatize the RCM analysis. The RCM automation can which denote equipment whose failures are significant to safety or
be realized in various implementation steps and by several aspects: the like, and thus are worth the PM investment. Netto et al. (2020)
Software automation solution. Some works seek a software solution to define eight criteria, including those regarding system availability and
data management involved in RCM. The tedious process of RCM largely various types of failure impacts, and propose an equipment ranking
comes from manual recording of the information required for the anal- approach based on analytic hierarchy process (AHP), which can be
ysis. Accordingly, various commercial software have been developed easily automated and conveniently replicated to the other applications.
to link RCM to client’s original databases, and satisfy the needs for Likewise, Tang et al. (2017) propose an analysis framework combining
constantly referring back to the prior analysis stages (Smith & Hinch- qualitative method for initial screening, and quantitative method like
cliffe, 2003). In other words, it is necessary to develop a maintenance AHP for evaluating the importance level of MSI. Dehghanian et al.
information system for RCM (Pujadas & Chen, 1996). Gabbar et al. (2012) also adapt AHP but with fuzzy modifications to determine the
(2006, 2003) develop an RCM engine as a module of computerized most critical component types. Tang et al. (2015) define another set
maintenance management system (CMMS) in the plant enterprise engi- of indexes for scoring the importance level of equipment. AHP and
neering environment, which can assist to decide feasible maintenance Monte Carlo simulation are applied to reduce the subjective influences
strategies and calculate the required maintenance parameters. Huo in the scoring process. Different importance levels are then divided
et al. (2005) also assert that interfacing with CMMS is the key to and integrated into the original RCM logic to determine the optimal
ensure quality and accuracy of the RCM analysis. Moreover, it can help maintenance strategies. Selvik and Aven (2011) specifically takes into
extract analysis sheets to automatically produce useful intermediate account uncertainty and risk in the score system, which is advised to
reports. Campos et al. (2010) emphasize information synergy during be integrated into FMECA.
maintenance management, and develop a data model that can integrate The above methods more or less imply the premise of RCM that
both maintenance management system like CMMS and maintenance maintenance planning is not driven by preserving equipment but can be
techniques such as CBM in order to keep the RCM analysis up-to- determined by function as well as the other influence factors. The main
date. Clemente et al. (2013) aim at developing an information system reason why distinct maintenance strategies are chosen for different
used for supporting maintenance decisions based on RCM, and Siqueira types of equipment is because equipment may have various functions
(2006) proposes the corresponding software requirements. in operation, and failures on equipment could have different degrees of
functional significance. Although function is very fundamental in RCM
Automation of analysis process. Despite software applications can sup- and can be seen as the source where the approach starts from, none
port efforts in RCM by reducing the burden of paperwork, it can never of existing efforts on RCM automation have attempted to make explicit
replace humans in their role in the analysis process (Smith & Hinch- the function concept that can be used for RCM analysis or describe how
cliffe, 2003). Instead, some researchers focus on optimizing the analysis it may relate to physical structure. Identifying the relationship between
algorithms, and from this perspective to realize RCM automation. Fon- function and equipment is the key to analyze effects of failure modes,
seca and Knapp (2000) develop a computerized RCM framework, which which is critical to sort equipment for the purpose of maintenance
adapts fuzzy reasoning to assess risk involved in each failure mode, and decision-making. Even in the classical RCM (Nowlan & Heap, 1978), the
uses an optimized decision tree that not only considers the relevancy function definition is theoretically arbitrary and not prescribed (EPRI,
of failure effects but also the likelihood of occurrence to prioritize 2002). In other words, there is a lack of systematic approach that can
failure modes. Shimizu et al. (1993) optimize one of the major RCM provide the basic functional knowledge that can be shared among RCM
steps, i.e. logic tree analysis (LTA) to determine the equipment/failure analyst, RCM decision support system and final maintenance imple-
mode category, and develop an RCM decision support system with menter. In order fill this gap, it is believed that functional modeling
the modified LTA. The system is able to retrieve failure information (FM) can make a valuable contribution. The interest of FM arises from
from databases and automatically generate the priority or criticality of the artificial intelligence (AI) field, where people attempt to represent

2
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

knowledge about artifacts so that computers can reason about artifacts its failures, and make comparisons with results concluded from the
for problem-solving (Chandrasekaran, 2005). Utilizing the concept of classical RCM analysis. Section 6 discusses several issues that need to be
function without reference to the actual structure of system is promis- addressed in the future, which are keys to further improvement of the
ing on human problem-solving, because the goal-oriented feature of analysis accuracy and realization of the so-called living RCM program.
FM is consistent with the human recognition and reasoning on arti- Finally, conclusions are given in Section 7.
facts (Erden et al., 2008). For RCM analysis, FM is also practical to
establish a common communication framework. Another strength of 2. Model-based RCM analysis
applying FM in RCM is that it can facilitate automated reasoning for
analysis tasks involving function, referred to as functional reasoning Various standards or textbooks (EPRI, 2002; Nowlan & Heap, 1978;
(FR) (Chandrasekaran, 1994; Far & Elamy, 2005). In order to identify Rausand, 1998; SAE, 1999; Smith & Hinchcliffe, 2003) usually describe
the maintenance significant items (MSIs) for RCM, it is required to RCM as a seven-step decision process. Fig. 1 makes comparisons be-
identify equipment failures that could potentially result in functional tween how the relevant questions are answered by the classical RCM
failures at higher plant or system levels, which may be automated by analysis and what is proposed here, namely a model-based approach
FR if functions are explicitly represented in FM. that is driven by MFM. For a selected target system, both analyses
This article explores the potential of multilevel flow modeling start from identifying the system functions that are expected to be
(MFM) proposed by Lind (1982), which is a known formal FM lan- preserved. The ultimate goal of preventive maintenance is to prevent
guage. MFM decomposes system’s function structure along two dimen- these functions from failing. It is therefore necessary to define a list of
sions, i.e. means-end and part-whole, and utilizes well-defined symbols system functions as complete as possible, because any inadvertent miss
to represent the function structure (Lind, 1994). Moreover, MFM is of functions will lead to unsuccessful identification of potential main-
not only used as static knowledge, but can also be reasoned about tenance tasks (Smith & Hinchcliffe, 2003). Traditionally, the function
dynamically when the represented system changes its state (e.g. fail- identification is conducted by using functional block diagram (FBD),
ure) (van Paassen & Wieringa, 1999). For several decades MFM has in conjunction with an input–output analysis. FBD treats each block
been employed to improve reliability and safety of complex industrial as a functional subsystem, which may contain a set of components to
systems to a significant extent. Originally, the approach was invented achieve one or more high-level functions. Blocks are connected via
for design of human–machine interfaces to reduce human errors during input/output interfaces, between which there are flows of material,
energy, or information. It is commonly considered that the output
the supervisory control of industrial plants (Lind, 1999). It was also ap-
interfaces in FBD define what system is desired to produce, thus are
plied in a series of safety-related issues, such as alarm analysis and fault
viewed as all the system functions that can be defined from FBD (Smith
diagnosis (Larsson, 1996; Lind & Zhang, 2014; Öhman, 2002), synthesis
& Hinchcliffe, 2003).
of normal operating procedures (Song et al., 2019), and accident man-
However, FBD is insufficient to identify all necessary functions.
agement (Song & Gofuku, 2018; Song et al., 2020, 2021), and hazard
Although being entitled as a function identification method, FBD is
identification (Hu et al., 2015; Rossing et al., 2010; Wu et al., 2013).
essentially structure-oriented, which approximately follows the physical
By combining strengths of MFM from both FM and FR perspectives,
connections, i.e. there is no clear distinction between structure and
this article presents a framework of model-based RCM analysis, which
function. For a process plant, for instance, the modeled FBD is usually
applies the identical methodology to establish the essential database
similar to a piping & instrumentation diagram (P&ID). In contrast, MFM
for the analysis, at the same time facilitate the consequence analysis
is goal-oriented, which is more suitable and sufficient to describe the
of failure modes. The proposed RCM framework has been proved
functionality of complex systems, because function is interpreted by
competitive in both knowledge representation and analysis capability
human who always has an intention or goal to perform tasks, regard-
for RCM, which provides the opportunity of RCM automation. On the
less of whether it is operation, maintenance, or analysis (Jalashgar,
one hand, MFM is competitive to provide more sufficient and structured
1999). Functions and goals can be seen as mental aspects that define
functional knowledge than the existing RCM methods, which can not
the system besides its objective physical interactions. As shown in
only ensure the completeness that all system-level functions desired
Fig. 2, MFM explains this goal-oriented principle through the means-end
to be preserved by planned maintenance activities can be identified,
decomposition. By distinguishing between means and ends, a system
but also enable the automated analysis within the function model.
can be described in terms of goals, functions and the physical compo-
On the other hand, the developed analysis system can automatize the
nents1 (Lind, 1994). However, MFM does not completely exclude the
most tedious activity in RCM, i.e. failure consequence analysis, which representation of the interaction between physical objects. By adopt-
benefits from sufficient knowledge representation for RCM as well as ing the part-whole principle (not shown in Fig. 2), MFM can reflect
the intrinsic causal reasoning capability of MFM. It is further detailed the interactions between different physical parts, each of which may
how the method is possible to handle changes during the life cycle have its own means-end hierarchy. Fig. 2 also describes two modeling
of industry in order to implement a living RCM program. Following strategies of MFM. On one hand, a top-down procedure can be followed
the classical RCM analysis explained by Nowlan and Heap (1978), to decompose a top-level goal into sub-goals or higher-level functions,
this article only concerns how MSIs are determined by evaluation of until some lower-level functions can be realized by known components.
the consequences of failures, while the other decisive factors such On the other hand, one can start from the component level to find out
as risk and failure probability are not considered at the moment. what function it may achieve, and aggregate different functions into
In addition, decisions from equipment classification to maintenance higher-level functions or goals. The two different modeling strategies
action selection, and further to the final determination of maintenance of MFM ensure that neither essential functions nor existing components
intervals are also beyond the scope of this article. will be missed in the analysis. Note that MFM can be simply used to
The remaining parts of the article are organized as follows: Sec- identify system functions that need to be preserved, relationships be-
tion 2 provides an overview of model-based RCM analysis driven by tween equipments and functions are also established during functional
functional modeling. Section 3 introduces the methodology of MFM modeling, which implies that the same functional knowledge frame-
and presents an example of using MFM-based function model to define work for function identification can potentially be used for analyzing
the system functions, and to relate them with the equipment func- effects of equipment failures on the defined functions. In contrast, the
tions. Section 4 explains failure consequence reasoning based on MFM failure analysis in the classical RCM analysis is a relatively independent
and introduces the development of a failure analysis tool that can process from the function identification.
automatically generate consequences of all failure modes in the target
system. Section 5 feeds results from the failure consequence assessment
1
into a logic tree analysis to generate classifications of equipment and In this article, component (s) and equipment are used interchangeably.

3
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 1. A framework of model-based RCM.

Fig. 2. The means-end principle of MFM and two modeling strategies.

The next stage, i.e. failure analysis requires to conduct a detailed failure mode and high-level system functions it may affect, decomposi-
FMECA to determine the components that are important to each func- tion of multiple levels of functions makes it possible to identify a route
tional failure, which in the classical RCM analysis heavily relies on the that can establish this link. Besides, MFM provides a qualitative way
human expertise. As mentioned above, MFM has implied the knowledge of defining equipment failure modes and system functional failures,
regarding the correlation between physical structures and functions. Al- as well as a rule-based causal reasoning solution to establish cause-
though MFM does not directly provide the link between an equipment consequence relations between those two types of failure (Zhang et al.,

4
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

2013). The failure consequence analysis supported by MFM will be Table 1

List of the components that need considerations of maintenance actions.
elaborated in the following. Results from the failure analysis, either
No. Label Description Type
FMECA tables or consequence reasoning cases of all equipment failure
modes in the target system, can be fed into the LTA, by which equip- C01 P1 Main pump Non-Instrument
C02 P2 Sweep pump
ment and its failure modes can be classified for the purpose of selecting C03 V1 Alignment valve at bottom drain
optimal maintenance strategies of its own. In the subsequent sections, C04 V2 Alignment valve at spa drain
the methodology of MFM will be elaborated, and a case of swimming C05 V3 Alignment valve at return pool flow
C06 V4 Alignment valve at return spa flow
pool water treatment system will be used to illustrate how the system
C07 D1 Overflow drain valve
functions are identified by MFM and how the failures are defined and C08 Cl Chlorinator
analyzed within the function model. C09 D2 Flush valve on swirl filter
C10 S1 Swirl filter
C11 F1 Trap filter at weir
3. Functional modeling for RCM analysis C12 F2 Trap filter at main pump suction
C13 H1 Gas heater
C14 V5 Alignment valve at sweep line
3.1. Multilevel flow modeling IC01 T1 Timer electromechanical of main pump Instrument
IC02 T2 Timer electromechanical of sweep pump
IC03 G1 Pressure gauge on swirl filter
MFM has been matured with a scheme of knowledge acquisition IC04 TC1 Temperature control (not shown)
and representation (Wu et al., 2021), which largely enhances the mod- IC05 SW1 Pool/spa switch (not shown)

eling efficiency and also provides the possibility of automated model

generation from engineering documentations (Song & Lind, 2020).
Fig. 3 shows the modeling procedure for MFM. The initial procedure 3.2. Functional modeling of a water treatment system
is to identify material, energy and information streams involved in the
system, which is similar to FBD to establish functional subsystems and In this section, MFM is used to construct a function model of the
interrelations between each other. However, FBD does not represent water treatment system of a swimming pool, which is from an illustra-
functions of streams or their decomposition of material streams into tive example of classical RCM analysis in Smith and Hinchcliffe (2003).
sub-streams, which is an important aspects of the representation in While the case is simple, it can sufficiently be used for demonstrating
MFM flow structures. The results are different input–output combina- how RCM is applied in the process industry without losing generality, as
tions decomposed from the identified streams, each of which afterward it takes all the features of a scaled-up process plant, such as integrating
in MFM can be represented as flow structures to describe a causal multiple components and addressing multiple materials and energy.
interpretation that can achieve a specific function. Because the stream
analysis is conducted from known physical structures and also implies 3.2.1. System description
knowledge about design intentions, it can be treated as a bottom-up Fig. 5 shows the schematic of water treatment system. Depending
modeling strategy of MFM. However, the intentional knowledge of on the demand, the system can be divided into three major functional
system can also be described through the objective tree, which is an subsystems,
hierarchy of abstractions that represents the means-end relationships
Pumping. Pumping can provide circulating water from the pool to var-
among high-level functions or objectives. An objective tree offers a
ious subsystems, including heating and water conditioning. Pumping
solution to the decomposition of system complexity, whereby a system
can provide boost pressure for the pool sweep, which is used to stir the
can be composed of several subsystems that have their own subsys-
water to keep dirt in suspension for filtering.
tems or elementary components (Modarres & Cheon, 1999; Rasmussen,
1985). However, in principle the decomposition of objectives/functions Heating. Heating is mainly achieved by a heater, which can raise the
does not always follow along the levels of assembly, e.g. from plant, temperature of the pool or the spa on demand. There is an automatic
to system, equipment unit, component until part (ISO, 2016), which control that can let the heat provide the desired temperature increase.
means that the physical structures within the same level of assembly The heater can be shut down when the temperature exceeds the high
can also provide means and end between each other. Subsequently, limit. Heating is relevant to the safety issue of the water treatment
the objective tree helps to integrate flow structures identified from system. During heating, there must no potential equipment damage
the stream analysis into a hierarchical means-end structure. Each flow from uncontrolled fire.
structure describes a functional sequence established by different MFM Water conditioning. Filtering and chlorination is required to maintain
flow function primitives (see Fig. 4), which are causal related and the water purification. Coarse in water is first filtered at two trap filters,
directed towards a common objective. In each flow structure, there afterward fine filtering at the swirl filter. There is a pressure gauge on
is a main function as the means that can directly contribute to the the swirl filter that indicates the need for back-flushing. The chlorinator
corresponding objective as the end. As shown in Fig. 3, for example, realizes the chlorination function, which needs bleed flow from the
it is the function 𝑝12 in the function sequence 𝑝11 → 𝑝12 → 𝑝13 that pumping to maintain a desired chlorine level in the water.
ultimately achieves the function 𝑃 1, which can be seen as the objective Table 1 lists the components that need considerations of mainte-
of the function sequence. The other MFM symbols shown in Fig. 4 nance actions. For the purpose of illustration, in this case study, we only
include causal relations and means-end relations used for connecting focus on the non-instrument equipment. To simplify, it is also assumed
flow function primitives, and those for modeling control. that failures on the water and gas pipelines are implausible, thus no
Using the same set of symbols to represent functions of both equip- maintenance is considered for the components.
ment and higher system level ensures the consistency in describing
component functional failures and system functional failures. Although 3.3. MFM-based function model
RCM does not prescribe that the equipment failure must be perceived
in terms of functional failure in order to analyze its consequences on MFM identifies the functions that need to be preserved by main-
system functional failure, it will be found that the modeling consistency tenance by exploring the intentional knowledge of design rather than
of MFM provides the convenience for making such connection. through the outputs of each functional subsystem. The key to this

5
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 3. The modeling procedure of MFM.

FBD due to the consideration of the means-end relationship. Table 2

compare between two sets of system functions and indicates how the
functions identified from two different ways of thinking can corre-
spond between each other. Considering purposes of the water treatment
system, the top objectives relevant to the outage issue are effective
filtering (Objective 1), and disinfection (Objective 2). Heating (Objective
3) is safety-related. Note that pumping is not identified as a high-level
function as in the classical RCM analysis, rather implicitly as a function
that can provide means to the three objectives. Although Table 2 does
not show much discernible difference between two methods in terms of
the number of identified functions, adopting a bottom-up strategy from
equipment-level to system-level and a top-down strategy in the opposite
direction can ensure that all equipment can be analyzed and all system
functions can be preserved. Moreover, because those system functions
are identified structurally and interactively, it implies that when a
Fig. 4. MFM Symbols.
failure mode affects a system function, it will probably propagate the
influence to the others. This information is crucial to the RCM analysis
when evaluating the failure consequences on those functions.
is establishing an objective tree, which can identify not only objec- As shown in Fig. 7, the MFM Model of the water treatment system
tives/functions in different abstraction of levels but also the means-end is built by using the symbols listed in Fig. 4. The model construction
relations between them. What was concluded from the stream analysis, is guided by the objective tree in Fig. 6, where each of the identified
i.e. flow structures describing specific functions achieved by equipment
system functions is represented by an objective primitive. It should be
can then be related to corresponding objectives. Fig. 6 shows the
emphasized that most of objectives are established on the system level,
objective tree of water treatment system. It starts from two high-level
each of which is then linked to appropriate flow structures that are
goals, outage and safety, which are also the criteria in the RCM analysis
realized by one or more components. Functions in the component can
for judging the criticality of failure consequences. Outage mainly con-
cerns the system operability that ensures there is not outage or loss of be further achieved by functions of component’s mechanical parts. For
productivity. While safety-related objectives/functions generally refer instance, Fig. 8 shows how the system function F1.1.2.2 ’maintain
to those that can prevent potential personnel death or injury (Smith water flow’ is elaborated with functions of the pump P1. By using
& Hinchcliffe, 2003). The two goals can be decomposed by iteratively the concept of main function, F1.1.2.2 can be directly connected
finding what objectives/functions can provide means to ends. to tra2 ’pressure water flow’, which can be seen as the function that
The system functions identified from the objective tree are believed defines P1 as a stand-alone item on the component level. In order
to be more sufficient and structured than those from the traditional to facilitate the definition of equipment failure modes for the failure

6
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 5. Schematic of water treatment system.

Table 2
List of identified system functions.
Functions identified by functional modeling Functions identified by FBD (Smith & Hinchcliffe, 2003)
No. FBD No. Description No. Description
Objective 1 (O31) Effective filtering Subsystem 1 Pumping
F1.1 2.1 Provide filtered water 1.1 Maintain 70 GPM water flow at specified times
F1.1.1 2.1.1 Catch larger debris by trap filter 1.1.1 Initiate flow at specified time
F1.1.2 1.1 Maintain 70 GPM water flow at specified time 1.1.2 Maintain flow rate
CF1.1.2.1 1.1.1 Initiate flow 1.1.3 Terminate flow at specified time
F1.1.2.2 1.1.2 Maintain water flow 1.2 Maintain 50 GPM sweep flow at specified times
CF1.1.2.3 1.1.3 Terminate flow 1.2.1 Initiate sweep flow at specified time
CF1.1.2.3.1 1.4 Automatically active/deactivate water flow 1.2.3 Terminate sweep flow at specified time
F1.1.3 2.1.2 Filtering by swirl filter 1.2.2 Maintain sweep flow rate
CF1.3.1 2.3 Backwash when pressure is high 1.3 Maintain water bleed to chlorinator
F1.2 1.2 Maintain 50 GPM sweep flow at specified times 1.4 Automatically active/deactivate water flow
CF1.2.1 1.2.1 Initiate flow Subsystem 2 Water conditioning
F1.2.2 1.2.2 Maintain water flow 2.1 Provide filtered water to the heating subsystem
CF1.2.3 1.2.3 Terminate flow 2.1.1 Catch larger debris by trap filter
Objective 2 (O32) Effective disinfection 2.1.2 Filtering by swirl filter
F2.1 2.2 Send chlorinated water to exit piping 2.2 Send chlorinated water to exit piping
F2.1.1 1.3 Maintain water bleed to chlorinator 2.2.1 Add chlorine to bleed water
F2.1.2 2.2.1 Add chlorine to bleed water 2.2.2 (1.3)
Objective 3 (O22) Safely heat water on demand Subsystem 3 Heating
F3.1 3.1 Provide desired heat input to water 3.1 Provide desired heat input to water on demand
F3.1.1 3.1.1 Ignite at specified time 3.1.1 Ignite at specified time
F3.1.2 3.1.2 Shut down at desired temperature 3.1.2 Shut down at desired temperature
F3.2 3.2 Maintain a safe operation 3.2 Maintain a safe operation
F3.2.1 3.2.1 Prevent gas accumulation 3.2.1 Prevent gas accumulation
CF3.2.2 3.2.2 Shut down at high limit control temperature 3.2.2 Shut down at high limit control temperature
F3.2.3 3.2.3 Maintain release of flue gas 3.2.3 Maintain release flue gas

analysis, functions in the mechanical part level, such as energy con- important to evaluate the relationship between equipment failures and
version (efs1) and bearing support (mfs2) are modeled as well, which system functional failures.
together with function on the component level can be seen as all
4. Failure consequence analysis by MFM
functions that a component can produce. Since all of the defined system
functions have been interrelated in the objective tree, the MFM model This section introduces how different equipment failure modes can
further allows association of equipment functions, which is extremely be defined in MFM, and how the same function model can be used

7
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 6. Objective tree of water treatment system.

to analyze failure consequences on the predefined system functions, so equipment failure modes and system function failures,
that failure modes can be sorted for selection of optimal maintenance ⎧ ⎧
tactics. ⎪high, 𝑞 > 𝑞ℎ𝑖𝑔ℎ ⎪high, 𝑣 > 𝑣ℎ𝑖𝑔ℎ
⎪ ⎪
𝑆𝑓 (𝑡𝑟𝑎) = ⎨normal, 𝑞𝑙𝑜𝑤 ≤ 𝑞 ≤ 𝑞ℎ𝑖𝑔ℎ 𝑆𝑓 (𝑠𝑡𝑜) = ⎨normal, 𝑣𝑙𝑜𝑤 ≤ 𝑣 ≤ 𝑣ℎ𝑖𝑔ℎ
⎪ ⎪
4.1. Failure definition in MFM ⎪low, 𝑞 < 𝑞𝑙𝑜𝑤 ⎪low, 𝑣 < 𝑣𝑙𝑜𝑤
⎩ ⎩
⎧
⎪high, 𝑝 > 𝑝ℎ𝑖𝑔ℎ ⎧
Failure is usually defined as termination of the ability of a compo- ⎪ ⎪normal, 𝑞 ≤ 𝑞𝑚𝑎𝑥
nent to perform the intended function (Rausand & Øien, 1996). Given 𝑆𝑓 (𝑠𝑜𝑢) = ⎨normal, 𝑝𝑙𝑜𝑤 ≤ 𝑝 ≤ 𝑝ℎ𝑖𝑔ℎ 𝑆𝑓 (𝑏𝑎𝑟) = ⎨
⎪ ⎪breach, 𝑞 > 𝑞𝑚𝑎𝑥
that all component functions have been represented in the MFM model, ⎪low, 𝑝 < 𝑝𝑙𝑜𝑤 ⎩
⎩
the model can also be used for reasoning about the states of functions
⎧
and those of the corresponding equipment (van Paassen & Wieringa, ⎪false (high), 𝑓𝑚 = high/breach
𝑆𝑓 (𝑜𝑏𝑗) = ⎨
1999; Zhang et al., 2013), which is therefore useful to define and ⎪false (low), 𝑓𝑚 = low
analyze equipment failures. Instead of referring to the actual values of ⎩
physical variables, MFM defines function states as well as state relations Where 𝑆𝑓 is failure state of a specific functional primitive; 𝑞 is volume
between functions in terms of qualitative ranges of variable’s values. flow rate; 𝑣 is volume content; 𝑝 is potential output for a mass or energy
Hence, function states are generally defined against a predetermined source; 𝑓𝑚 represents the main function, whose states can determine
normal condition of the variable that relates to the function in question. whether and how the objective associated to it can succeed or fail.
Any abnormal state deviated from this normal state can be seen as a The parameter values with subscript high and low represent thresholds,
failure of function, which implies that the associated equipment may exceeding of which may be considered as a failure. 𝑞𝑚𝑎𝑥 is the maximum
also fail. For the purpose of functional failure analysis, the follow- leak flow that is allowed for a barrier function. The states of flow
ing discrete states of MFM functional primitives are used to define functions, i.e. transport, storage, source, and barrier are used to describe

8
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 7. MFM Model of water treatment system. The purple, red, green boxes represent mass flow structures, energy flow structures, and control flow structures, respectively. Each
green frame encloses function primitives and flow structures that are achieved by a specific asset on the component level.

the failure modes of the equipment listed in Table 1. As shown in 4.2.1. A rule-based automated failure consequence analysis tool
Table 3, there are 32 unique failure modes that are considered for the
RCM analysis of the water treatment system. The failure modes include In addition to being an FM method, MFM is also used as an FR
those defined in the equipment level, such as "fail closed" of a valve, approach to analyze causal processes regarding how the intended func-
which directly associates to an equipment functional failure, and those tions can be achieved and why they are not achieved in some other
usually perceived by safety analyst as failure cause (EPRI, 2002), such as situations. MFM does not directly describe the causality like ’A causes
"failed bearing seal" of a pump, which is seen as a cause that the pump B’. The uniqueness of MFM is that it takes the representation of func-
fails to perform its function. Each of failure modes can be associated tions and reasoning about events on functions as two separated tasks.
to an abnormal state of the specific function in the MFM model. On First of all, the process of building an MFM model has implied whether
the left side of Fig. 9, it is shown how the model fragment shown in there are potential cause–effect relations between functions in different
Fig. 8 defines the failure modes of pump P1 by using qualitative states. levels of abstraction. Since both part-whole and means-end dimen-
A functional modeling workbench has been developed for MFM to store sion have been considered in connecting functions, it is believed that
the failure information, which in the failure analysis can be used for MFM is able reveal more comprehensive causal relationships than
automatic reasoning. the other function models, which either miss one type of relation or
another. Then MFM adopts a rule-based reasoning solution to explain
how causal processes can be manifested. In MFM, cause-consequence
4.2. Causal reasoning solution for failure consequence analysis rules exist for all the possible patterns of function pairs, which are
established independently from the modeling object (Zhang et al.,
The causal aspects of MFM allow a function model to be used for 2013). For instance, Fig. 10 shows a set of rules involved in the
relating equipment failure modes with system functional failures, which pattern {f:sto,r:inf,f:tra}, which represents a storage function
is helpful to determine the importance of equipment for maintenance that has capability to affect a transport function in the downstream
tasks. direction. The rules are defined in terms of functional states, i.e. the

9
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 8. Example of decomposing a system-level objective as functions on the component and part level.

Fig. 9. Definition of equipment failure modes and failure consequence analysis by using MFM.

10
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Table 3
Failure mode list.
Component Failure mode Failure mode in MFM
No. Label Description Function Failure state
C01 Main pump 1 FM01.01 Failed bearing seal Barrier Breach
2 FM01.02 Motor short Source Low
3 FM01.03 Leak at pump motor joint Barrier Breach
4 FM01.04 Bearing deterioration Transport Low
C02 Sweep pump 5 FM02.01 Failed bearing seal Barrier Breach
6 FM02.02 Motor short Source Low
7 FM02.03 Leak at pump motor joint Barrier Breach
8 FM02.04 Bearing deterioration Transport Low
C03 Alignment valve at bottom drain 9 FM03.01 Fail closed Transport Low
10 FM03.02 Fail open Barrier Breach
C04 Alignment valve at spa drain 11 FM04.01 Fail closed Transport Low
12 FM04.02 Fail open Barrier Breach
C05 Alignment valve at return pool flow 13 FM05.01 Fail closed Transport Low
14 FM05.02 Fail open Barrier Breach
C06 Alignment valve at return spa flow 15 FM06.01 Fail closed Transport Low
16 FM06.02 Fail open Barrier Breach
C07 Overflow drain valve 17 FM07.01 Stuck in closed position Transport Low
C08 Chlorinator 18 FM08.01 Clogged Storage High
19 FM08.02 No chlorine tablets Storage Low
C09 Flush valve 20 FM09.01 Stuck Transport Low
C10 Swirl filter 21 FM10.01 Clogged Storage High
22 FM10.02 Water leak Barrier Breach
C11 Trap filter at weir 23 FM11.01 Clogged Storage High
24 FM11.02 Broken basket Barrier Breach
C12 Trap filter at main pump suction 25 FM12.01 Clogged Storage High
26 FM12.02 Broken basket Barrier Breach
27 FM12.03 Leaky gasket Barrier Breach
C13 Gas heater 28 FM13.01 Failed pilot light Transport Low
29 FM13.02 Burner dirty/Clogged Storage High
30 FM13.03 Clogged vents Storage High
C14 Alignment valve at sweep line 31 FM14.01 Fail closed Transport Low
32 FM14.02 Fail open Barrier Breach

an equipment failure mode, represented as abnormal function state

may result in unwanted consequences. All of MFM rules have been
integrated in a rule-based system, which can provide an inference
engine and dedicated search algorithms to automatically perform the
causal reasoning. The right-side of Fig. 9, it shows graphically the
consequence reasoning of pump’s four failure modes and how they
propagate influences to the system function F1.1.2.2. As can be
found, all equipment failures can damage the system function, but
with different reasoning routes. The causal reasoning based on function
model is relatively independent from the process of constructing such
a model and defining failure information. It is therefore possible to
analyze multiple failures without modification of the model, which can
significantly enhance the efficiency of failure consequence analysis. A
Fig. 10. An example of cause-consequence rule in MFM. failure consequence analysis tool is developed that can automatically
analyze all failure modes predefined in the function model. As shown
in Fig. 11, the system is based on the previously developed rule-based
reasoning system (Zhang et al., 2013), by which a failure can be
qualitative states as introduced before. Note that the causal rules are
checked with a matching rule to produce the nearest consequence, and
bidirectional. On one hand, as shown in Fig. 10, the propagation direc-
then using this as a new assumption to match the other rules until no
tion from cause to consequence can be both upstream and downstream.
rule can be found. Every failure predefined in the MFM model can be
On the other hand, the use of rules can be from cause to consequence or
conducted with the same consequence reasoning process, whose result
vice versa, which depends on the chronological order of facts, whether
can be manifested in the form of tree structure showing the failure
using cause as a known evidence to find out consequence in the future,
consequences in a chronological order.
or taking consequence as an observation to identify its possible cause
that has occurred. Rules for the different directions of reasoning should
4.3. Failure consequence analysis for water treatment system
be used for the above two scenarios. For example, assuming the state
[tra, high], and using the upper-side rule, the conclusion is a cause
By applying the developed automated failure analysis tool, the
[sto, high]; while applying the lower-side rule, it will conclude a
consequences of equipment failure modes listed in Table 3 can be
consequence [sto, low].
analyzed. After inputting the MFM model in the analysis tool, the
MFM takes the simple rule format shown in Fig. 10 to solve complex analysis results can be presented in the form of a matrix, as shown
problems. By combining rules of different patterns in a given func- in Fig. 12. It highlights the consequences of each failure of the pre-
tion model, an assumption about the function state can propagate to defined system functions, which is the criteria mainly of concern in the
elsewhere by iteratively using the conclusion from a rule activation context of RCM. The 𝑥-axis lists the failure modes. Red and blue color
to trigger another rule. In the context of RCM, it is of interest how respectively represent positive failure state and negative failure state of

11
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 11. Architecture of the developed failure consequence analysis tool.

the corresponding equipment function. Note that a function state that simple questions. Before the consequences are examined, each failure is
is not consistent with the defined failure mode may not represent a firstly examined whether its occurrence is evident to system’s operation
specific equipment failure, which is therefore not examined although personnel. The purpose of asking this question is to identify hidden
it is displayed in the results. For example, the failure mode FM11.01, failures, which will be given a special maintenance task. The difficulty
i.e. clogged filter is represented as high state of a storage function, of a failure being evident can vary from application to application. For
while low state of the same function is not defined as a failure. The example, a nuclear power plant may have an advanced control room,
other function states on the 𝑥-axis include those who do have impacts where various alarms, indicator lights, coupled with using computer-
on the defined system functions, but are not capable to trigger the ized decision support systems can monitor every equipment, failures of
influences themselves as equipment failure modes. In such cases, it may which are thus evident. In the case study of water treatment system,
be necessary to consider environmental factors or the failure modes however, failures can only be evident through occasional rounds by
beyond the considered system boundary. In addition, Fig. 12 highlights the owner of the swimming pool. In addition, failures can be hidden in
the failure consequences on the two high-level objectives, i.e. safety standby components, which will not be discovered until a demand is
concern (O01) and outage concern (O02), which are relevant in the made for their function.
logic tree analysis to determine whether a failure mode is critical or not
in terms of RCM. A critical state can be indicated if it can be concluded Every failure regardless of evident or not are then passed to the
by the causal reasoning on the MFM model that the function failure second and third question to ask if its consequences are relevant to
state may lead to false state of any objective, which can represent either a safety and outage problem, respectively. Safety in general concerns
a safety–critical or outage-critical system function. the risk of possible personnel death or injury, and outage focuses more
Note that conventional RCM methods to obtain similar results as on loss of productivity. Fig. 6 showed how safety and outage concerns
in Fig. 12 are largely experience-dependent. While the proposed RCM can be decomposed into different system functions that needs to be
framework is established on a comprehensive and systematic functional preserved, hence failure consequences on those functions that result
modeling methodology. It not only indicates the criteria for the analy- from the matrix shown in Fig. 12 can be used to determine how a failure
sis, i.e. system functions, but also the correlations between those system is critical to safety or outage. The remaining of failures that have no
functions and the failure modes that require the analysis. The failure serious impacts will be assigned as run-to-failure (RTF), which allows a
consequence analysis in the proposed RCM framework is essentially an component to be fixed after failure has occurred. Smith and Hinchcliffe
automated causal reasoning process, without which each failure mode (2003) do not specify a method to judge how a hidden failure can
on the 𝑥-axis of Fig. 12 needs to be mentally tested on every defined be critical, but (Bloom, 2006) suggest conducting a multiple failure
system functions on the 𝑦-axis, which is going to be a tedious and analysis to check if the hidden failure, in combination with an addi-
error-prone work. tional failure or initiating event, can result in unwanted consequences,
either related to safety or outage. A yes answer to this question can
5. Logic tree analysis classify the hidden failure as potentially critical. The multiple failure
analysis may involve in changes of operating modes, which can pose
All resulting failure consequences are examined by a qualitative a challenge to applying MFM for failure consequence reasoning. MFM
process, i.e. logic tree analysis (LTA) to further classify components applications involving operating mode changes will be discussed in the
and their failure modes (Nowlan & Heap, 1978). Fig. 13 shows the next section. All equipment whose failures have critical consequences
structure of LTA, which in our work utilizes the results from the MFM- can be treated as MSIs, which as a rule of thumb require preventive
based consequence reasoning. The classical RCM analysis asks three maintenance conducted before occurrence of the failure.

12
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

modes whose resulting category is different between two methods are

given with comments for explanation. By referring to the matrix shown
in Fig. 12, it is easy to determine how an equipment failure is possible
to affect which defined system functions, which will result in a distinct
equipment category in terms of maintenance. In general, there are two
reasons that cause this distinction,

• MFM is not capable to distinguish between equipment being

designed as a necessary condition to achieve a system function
and as a method to affect the performance of system function. For
instance, the purpose of sweep line is to improve the efficiency of
filtering rather than realize filtering, which implies that the filter-
ing function can be still available without operation of sweep line.
Hence, the classical RCM classifies FM02.01∼FM02.04 as RTF
because they have no immediate impact on the corresponding
system function. While in MFM, since the function of sweep line
can only be described as one of means for the filtering function,
the consequence reasoning will immediately show the unwanted
impacts, which make those failures be classified as critical.
• The classical RCM usually defines a time period to judge the fail-
ure criticality. It is acceptable as long as there is no serious conse-
quence within this defined period even it may have impacts in the
future. However, current practices of MFM do not consider time
series in the failure consequence reasoning (Kirchhübel et al.,
2022). The possibility of a failure to produce critical consequences
will immediately be reflected in the results without indicating
when the failure can be critical. In this sense, MFM-based RCM
is relatively more conservative than the classical RCM. Failure
modes belonged to this situation include: FM01.04, FM02.04,
FM08.01∼FM08.02, FM09.01, FM10.01∼FM10.02, FM11.01, and
FM12.01. Time-based failure consequence reasoning will be dis-
cussed in the next section.

6. Discussion

Although the purpose of all the RCM efforts is to establish the

linkages between equipment failures and system functions, there has
been much debate regarding the analysis procedure whether it should
start from the higher system level, or the other way round, i.e. from
the lower equipment level (EPRI, 2002). Conventionally, RCM is con-
sidered as a deductive approach, which requires to constantly inter-
rogate what equipment failures may cause the system function to
fail. Moubray (1997) pointed out that in practice the deductive ap-
proach has a risk of missing important contributing components, espe-
cially for complex systems that contain large amount of items. To this
end, Smith and Hinchcliffe (2003) make an improvement by providing
an equipment list, in which every component needs to be asked whether
its failure could lead to any failure of the identified system functions.
Involving such an inductive approach can assure that all potential
failure contributors are analyzed (EPRI, 2002). Bloom (2006) simply
suggests identifying functions at the equipment level without knowing
functions at the system level, and from this point identifying the effects
of equipment failures.
MFM can be seen as both a deductive and inductive approach, which
essentially eliminate the procedural arbitrariness of where to begin
with for the RCM analysis. By offering a systematic functional modeling
Fig. 12. Consequences of all equipment failure modes in the water treatment system methodology, two types of knowledge required in RCM, i.e. equipment
on the predefined system functions and high-level objectives. and system can be ultimately encountered level by level in the means-
end hierarchy. Regardless of deductive or inductive, the traditional
approach heavily relies on analyst expertise and requires much labor of
Table 4 compares classifications of 32 failure modes of the water analyst. In contrast, MFM provides an effective solution for automated
treatment system resulted from the proposed MFM-based RCM and failure consequence analysis based on the formalized functional knowl-
those from the classical RCM. The fact whether a failure mode is edge, the results from which can directly contribute to RCM. Therefore,
evident or not is provided from (Smith & Hinchcliffe, 2003). Failure integrating functional modeling and reasoning by MFM into the RCM
analysis provides the opportunity of RCM automation. Comparing to

13
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 13. LTA structure.

Source: Adapted
from Smith and
Hinchcliffe (2003)
and Bloom (2006).

existing RCM automation methods reviewed in Section 1, the proposed However, there are still several issues in RCM expected to be
RCM framework has the following advantages and novelties: resolved by MFM, which require corresponding improvements of MFM.

6.1. Redundancy and hidden failures

i The proposed method is more than a software solution that can
facilitate the analysis through information management, it can In the past experiences of RCM implementation, it has found a
be seen as the analysis itself. lot of fuzziness in analyzing the standby or redundant items (Bloom,
ii The proposed method contributes to automation of analysis pro- 2006; Nowlan & Heap, 1978). A standby component normally does not
cess, which directly uses the core knowledge of RCM, i.e. func- operate, but only performs its function when initiated on demand EPRI
tion. There has been no similar work that intends to auto- (2002). As mentioned before, failures of standby equipment cannot
mate the RCM analysis with system’s functional information, be observable until it is actually executed, as referred to the hidden
which results largely from the fact that no function structure failures. This fact in particular reduces the reliability improvement
has been systematically established. For example, Fonseca and expected from redundancy, because if the first failure is undiscovered
Knapp (2000) propose an RCM framework, including a priority before the additional failure occurs on the redundant equipment, it will
index for evaluating failure consequences, which calculates in- still defeat the intended function just as though no redundancy is pro-
dex of three levels of consequence. In practice, however, this vided. In other words, hidden failures that have no immediate effects
index still has to be given by experts in order to finalize the are as important as evident critical failures. Multiple failure analysis
analysis. has therefore been advised for evaluating hidden failures in the RCM
iii Exploration of past experience for RCM automation in particu- analysis (Bloom, 2006), although (Smith & Hinchcliffe, 2003) assert
lar the use of case-based reasoning is essentially a data-driven that any possibility of multiple independent failures in a redundant
method, which has common black-box feature. This means that configuration should lead to redesign, rather than seeking solutions
it is difficult to follow the rationale behind the analysis results. from the maintenance analysis.
While the proposed method focuses on explicitly representing The redundancy issue in RCM in turn poses a challenge of applying
the essential knowledge for RCM analysis and adopting a reason- MFM to the RCM analysis. In MFM, it is commonly assumed that all
ing strategy that mimics human problem solving, so it is easy to represented functions are in the mode of operation. While functions of
understand. the standby equipment are considered disconnected from the function
iv Optimization and automation of evaluation criteria focus on a model that describes how system is operating at present. It implies that
scoring process rather than analysis process. Although multiple when performing the consequence reasoning, failures of these ‘standby’
criteria instead of failure consequence alone have been recently functions will not have any impact on the defined system functions.
suggested, scoring process cannot be considered as the RCM However, in scenarios triggered by additional failures or other initiat-
analysis anymore according to the definition of RCM but a ing events, during which the standby equipment comes into play, any
following step after the analysis. The proposed method focuses existing failure may result in the corresponding system functions being
more on the analysis process. achieved. Hence, it is necessary to consider change of operating modes

14
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Table 4
Comparison between classifications of 32 failure modes of the water treatment system resulted from the proposed MFM-based RCM and those from the classical RCM.
Failure mode Evident Classical RCM (Smith & Hinchcliffe, 2003) MFM-based RCM
Safety Outage Category Comments Safety Outage Category Comments
FM01.01 YES NO YES B NO YES B
FM01.02 YES NO YES B NO YES B
FM01.03 YES NO YES B NO YES B
FM01.04 YES NO NO C No immediate impact. NO YES B Immediate impact.
Gives audible indication.
FM02.01 YES NO NO C No impact on NO YES B Degrade filtering efficiency.
filtering function.
FM02.02 YES NO NO C No impact on NO YES B Degrade filtering efficiency.
filtering function.
FM02.03 YES NO NO C No impact on NO YES B Degrade filtering efficiency.
filtering function.
FM02.04 YES NO NO C No impact on NO YES B Degrade filtering efficiency.
filtering function. Immediate impact.
Gives audible indication.
FM03.01 NO NO YES D/B NO YES D/B
FM03.02 NO NO YES D/B NO YES D/B
FM04.01 NO NO YES D/B NO YES D/B
FM04.02 NO NO YES D/B NO YES D/B
FM05.01 NO NO YES D/B NO YES D/B
FM05.02 NO NO YES D/B NO YES D/B
FM06.01 NO NO YES D/B NO YES D/B
FM06.02 NO NO YES D/B NO YES D/B
FM07.01 NO NO YES D/B NO YES D/B
FM08.01 NO NO NO D/C Must be corrected in 4 NO YES D/B Water deterioration occurs
days or serious water immediately.
deterioration occurs.
FM08.02 NO NO NO D/C Must be corrected in 4 NO YES D/B Water deterioration occurs
days or serious water immediately.
deterioration occurs.
FM09.01 NO NO NO D/C No impact on NO YES D/B Degrade efficiency of
filtering function. swirl filter.
FM10.01 YES NO NO C Pressure gauge reading NO YES B Degrade filtering efficiency
is increasing. immediately.
Can shorten motor life Damage motor operation
if clogged for several immediately.
weeks.
FM10.02 YES NO NO C NO NO C
FM11.01 NO NO NO D/C Can shorten motor life NO YES D/B Degrade filtering efficiency
if clogged for several immediately.
weeks. Damage motor operation
immediately.
FM11.02 NO NO NO D/C NO NO D/C
FM12.01 NO NO NO D/C Can shorten motor life NO YES D/B Degrade filtering efficiency
if clogged for several immediately.
weeks. Damage motor operation
immediately.
FM12.02 NO NO NO D/C NO NO D/C
FM12.03 YES NO NO D/C NO NO D/C
FM13.01 YES NO YES B NO YES B
FM13.02 NO YES YES D/A/B YES YES D/A/B
FM13.03 YES YES YES A/B YES YES A/B
FM14.01 NO NO YES D/B NO YES D/B
FM14.02 NO NO YES D/B NO YES D/B

in the failure consequence analysis. The identical equipment failure operation since the corresponding function is not performed. If then
may have different consequences in different operating modes, thus the operating mode switches to Mode 2 on a demand by manually
should have different maintenance strategies. starting up the pump, however, pre-existence of this failure will damage
the critical function. As mentioned before, this kind of failure can be
A redundancy case can be illustrated how hidden failures can be classified as potentially critical, which is manifested by an initiating
addressed by MFM (Song & Lind, 2022). Assume it is a two-path event (Bloom, 2006). The lower two models shows the consequence
system that can serve a critical function, as shown in Fig. 14. The reasoning for the failure of C: flow, i.e. ’fail closed’, in a situation
system receives normal water supply from a service line, or from a assuming that there is a protection logic that can automatically trigger
standby pump that can be put into operation when the service line is the pump working when the service line is unavailable. As a result of
unavailable. Here the check valve C is specifically tested, which has the redundancy logic, there will be no damaging impact of the failure
two distinct functions, i.e. providing flow path (C: flow) and flow on the critical function. If the failure is evident, it can be classified
isolation (C: isolate), respectively in the mode when the service as RTF; while if it is hidden, it can be potentially critical when the
line and the pump is operating. Fig. 14 shows how changes of operating pump fails as an additional failure. The above case indicates that to
modes should be considered in the failure consequence reasoning with obtain the accurate equipment classification it is needed to capture the
MFM. The upper two models show the consequence reasoning for the knowledge of operating mode changes in the functional modeling, and
failure of C: isolate, ’fail open’. In Mode 1 when the service line apply different function models for the failure consequence reasoning.
is operating, the failure is hidden and has no impact on the system

15
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 14. Considering changes of operating modes in failure consequence reasoning.

6.2. Living RCM program level and established relations with the other parts of model,
which allows the new failures immediately to be used for the
consequence reasoning.
RCM should not be seen as a one-shot analysis, rather it requires
• Modifications of the system design regarding equipment, pro-
a constant review of not only changes in the information used for
ductivity improvements, safety enhancements, and so on. Since
generating the decision but also appropriateness of the decision itself.
MFM is represented in the form of a hierarchical structure, those
Therefore, a living RCM program needs to be developed in order to
changes can be conveniently reflected in appropriate levels of
make the planned PM program adapt to new requirements (EPRI,
abstraction without modifying the whole model.
2002). As an information model, MFM is capable to accommodate
• Changes of operating modes. Different function models are re-
changes and updates of information without many modifications on
quired for different operating modes, which are beneficial to
the existing models, which makes MFM convenient to be adjusted
identify hidden failures that are only manifested by additional
on the changes of information inputs during the functional modeling,
failures or initiating events.
and therefore easy to make RCM ‘living’. Those information changes
• Update of our understandings of how systems are designed to
input into the analysis that need to be further addressed by MFM
behave. In the current practices, MFM models are to a large extent
include (Smith & Hinchcliffe, 2003):
built by human. Continuous improvements on understanding the
design knowledge is beneficial to ensure that the model is accu-
• Newly occurred failure modes that have not been covered in
rate and complete, so that right RCM decisions can be produced
the previous analysis. As explained in Section 4, supplementary
from the failure analysis.
failure information can easily be integrated at the equipment

16
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 15. Concept of applying MFM in the living RCM program.

As shown in Fig. 15, any modification on the function model as time period of system operation is concerned, the failure consequence
a result of changes in the input information will be fed into the reasoning can lead to different failure categories in terms of RCM.
automated RCM analysis tool, so that different packages of equipment
classification may be concluded. Note that implementing RCM in a
living program does not require the RCM tool to be modified accord- 7. Conclusions
ingly since the rules used for reasoning about failure consequences as
well as the decision logic for determining the equipment categories are RCM is all about function analysis and failure analysis. This article
independent from specific applications. This allows modeling modifi- presents a framework of model-based RCM analysis, which adopts
cations immediately reflected in the equipment classification, and can functional modeling and functional reasoning to classify failure modes
thus improve the efficiency of the RCM implementation. and identify MSIs. Compare to the existing RCM efforts, MFM is able to
provide sufficient functional knowledge essential for the RCM analysis,
6.3. Temporal aspects of failure consequence analysis including system functions, equipment functions, and their interactions,
which make possible of RCM automation. By taking advantage of
Apart from additional failures and initiating events, hidden failures the causal reasoning ability of MFM, a failure consequence analysis
can also be potentially critical as a result of time (Bloom, 2006). For tool is developed, which can automatically evaluate the consequences
example, the failure mode FM11.01 in the provided case, the clogged of all equipment failures that are predefined in the function model.
filter would have neither indication nor immediate effect, but over The results can be directly used in the RCM decision process, such
time could shorten life of motor of the pump downstream. In the as to determine whether the equipment is maintenance significant or
sense of time, however, results from MFM in current practices are non-critical that allows to run to failure. The case study on a water
relatively conservative. Because every failure will immediately show treatment system indicates that the developed tool can produce the
the consequences on all possible reasoning routes in the reasoning tool, similar results as the classical RCM method does, but with improved
without consideration of cumulative effect of failure and duration of analysis efficiency by automatizing parts of the analysis process that
influence propagation, as indicated in Table 4, FM11.01 is classified heavily rely on analyst’s workload and experience conventionally. Al-
as hidden/critical by MFM while the classical RCM deems it non-critical though the proposed RCM framework is only demonstrated on a simple
within an acceptable time interval. process system, it can be comfortably adapted to any complex indus-
Therefore, it is essential to determine when a failure can be critical try where RCM is needed for maintenance optimization to manage
after the onset of failure and consider how this temporal aspect can safety and cost, considering the widespread applicability of MFM in its
be integrated into the proposed model-based RCM analysis in order to functional representation and failure reasoning. However, it should be
produce accurate equipment classifications. The temporal aspects are noted that RCM as well as the proposed RCM framework are established
important to assess the system dynamics, e.g. alarm sequence (Kirch- on the assumption that equipment failure modes would have potentially
hübel et al., 2022). Kim and Seong (2018) introduced time-to-detect and negative effects on the system performance, which implies that the
time-to-effect, respectively into flow functions and relations of MFM, by method is perfectly applicable to coherent systems. How the failure
which the results from the causal reasoning based on MFM are able to reasoning performs for non-coherent systems, in which normal condi-
contain temporal information. Fig. 16 shows how the temporal aspects tion of a constituent component may contribute to the system failure,
are considered in the failure consequence reasoning and RCM. Assume and how the reasoning results can be used for maintenance decisions
that Time-to-effect (TTE) is defined for every relation in the MFM model, need further investigation. Future works also include implementing the
which represents the time that a function state change propagates by proposed approach in the living RCM program that can accommodate
causal influences to the neighboring function. Assume that a failure of changes in design and operation. Moreover, in order to ensure that RCM
A (𝑓𝐴 ) occurs at 𝑡0 , it will only have consequence on B after TTEAB , can lead to the most optimized maintenance actions, it is necessary
and it also takes TTEBD to transmit the influence from B to D, which is to integrate criteria such as failure probability and risk in addition to
used to determine the failure criticality. Therefore, depending on which failure consequences into the RCM analysis.

17
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

Fig. 16. Considering time aspect in failure consequence reasoning. S𝑘 (t ) represents the state of function k at time t, C(f, t ) represents the category of failure f at time t.

CRediT authorship contribution statement Cheng, Z., Jia, X., Gao, P., Wu, S., & Wang, J. (2008). A framework for intelligent
reliability centered maintenance analysis. Reliability Engineering & System Safety,
93(6), 806–814. http://dx.doi.org/10.1016/j.ress.2007.03.037.
Mengchu Song: Conceptualization, Formal analysis, Investigation,
Clemente, T., Almeida-Filho, A., Alencar, M., & Cavalcante, C. (2013). A decision
Writing – original draft. Xinxin Zhang: Project administration, Funding support system based on RCM approach to define maintenance strategies. In Lecture
acquisition. Morten Lind: Methodology, Writing – review & editing. notes in business information processing (pp. 122–133). Springer Berlin Heidelberg,
http://dx.doi.org/10.1007/978-3-642-36611-6_9.
Declaration of competing interest Dehghanian, P., Fotuhi-Firuzabad, M., Bagheri-Shouraki, S., & Razi Kazemi, A. A.
(2012). Critical Component Identification in Reliability Centered Asset Management
of Power Distribution Via Fuzzy AHP. IEEE Systems Journal, 6(4), 593–602. http:
The authors declare that they have no known competing finan- //dx.doi.org/10.1109/JSYST.2011.2177134.
cial interests or personal relationships that could have appeared to Deshpande, V. S., & Modak, J. P. (2002). Application of RCM to a medium scale
influence the work reported in this paper. industry. Reliability Engineering & System Safety, 77(1), 31–43. http://dx.doi.org/
10.1016/S0951-8320(02)00011-X.
Data availability EPRI (2002). Reliability and Preventive Maintenance: Balancing Risk and Reliability: For
Maintenance and Reliability Professionals at Nuclear Power Plants: Technical Report,
Palo Alto, CA: Electric Power Research Institute.
No data was used for the research described in the article. Erden, M. S., Komoto, H., Van Beek, T. J., D’Amelio, V., Echavarria, E., & Tomiyama, T.
(2008). A review of function modeling: Approaches and applications. Artificial
Acknowledgments Intelligence for Engineering Design, Analysis and Manufacturing, 22(2), 147–169. http:
//dx.doi.org/10.1017/S0890060408000103.
Eriksen, S., Utne, I. B., & Lützen, M. (2021). An RCM approach for assessing
This work has been funded by the Danish Offshore Technology
reliability challenges and maintenance needs of unmanned cargo ships. Reliability
Centre, Denmark as a project of improving process safety in automation Engineering & System Safety, 210, Article 107550. http://dx.doi.org/10.1016/j.ress.
systems. The authors would also appreciate the cooperation with Kairos 2021.107550.
Technology AS, Norway to develop the MFM-based RCM analysis tool. Far, B. H., & Elamy, A. H. (2005). Functional reasoning theories : Problems and
perspectives. Artificial Intelligence for Engineering Design, Analysis and Manufacturing,
19, 75–88. http://dx.doi.org/10.1017/S0890060405050080.
Source of support
Fischer, K., Besnard, F., Member, S., Bertling, L., & Member, S. (2012). Reliability-
Centered Maintenance for Wind Turbines Based on Statistical Analysis and Practical
Danish Offshore Technology Centre, Denmark Experience. IEEE Transactions on Energy Conversion, 27(1), 184–195. http://dx.doi.
org/10.1109/TEC.2011.2176129.
References Fonseca, D. J., & Knapp, G. M. (2000). Expert system for reliability centered main-
tenance in the chemical industry. Expert Systems with Applications, 19(1), 45–57.
http://dx.doi.org/10.1016/S0957-4174(00)00019-1.
Bertling, L., Allan, R., & Eriksson, R. (2005). A Reliability-Centered Asset Maintenance
Fox, B., Snyder, M., & Smith, A. M. (1994). Reliability-centered maintenance improves
Method for Assessing the Impact of Maintenance in Power Distribution Systems.
operations at TMI nuclear plant. Power Engineering, 98(11), 75–78.
IEEE Transactions on Power Systems, 20(1), 75–82. http://dx.doi.org/10.1109/
TPWRS.2004.840433. Gabbar, H. A., Yamashita, H., & Suzuki, K. (2006). Integrated Plant Maintenance Man-
Bloom, N. (2006). Reliability Centered Maintenance: Implementation Made Simple. New agement Using Enhanced RCM Mechanism. International Journal of Performability
York City, US: McGraw-Hill. Engineering, 2(4), 369–381. http://dx.doi.org/10.23940/ijpe.06.4.p369.mag.
Campos, M. A. L., Fumagalli, L., Fernández, J. F. G., Márquez, A. C., & Macchi, M. Gabbar, H. A., Yamashita, H., Suzuki, K., & Shimada, Y. (2003). Computer-aided RCM-
(2010). UML model for integration between RCM and CBM in an e-Maintenance based plant maintenance management system. Robotics and Computer-Integrated
architecture. IFAC Proceedings Volumes, 43(3), 110–115. http://dx.doi.org/10.3182/ Manufacturing, 19(5), 449–458. http://dx.doi.org/10.1016/S0736-5845(03)00031-
20100701-2-PT-4012.00020. 0.
Cândea, G., Kifor, S., & Constantinescu, C. (2014). Usage of case-based reasoning in Hu, J., Zhang, L., Cai, Z., & Wang, Y. (2015). An intelligent fault diagnosis system
FMEA-driven software. Procedia CIRP, 25(C), 93–99. http://dx.doi.org/10.1016/j. for process plant using a functional HAZOP and DBN integrated methodology.
procir.2014.10.016. Engineering Applications of Artificial Intelligence, 45, 119–135. http://dx.doi.org/10.
Carretero, J., Pérez, J. M., García-Carballeira, F., Calderón, A., Fernández, J., García, J. 1016/j.engappai.2015.06.010.
D., Lozano, A., Cardona, L., Cotaina, N., & Prete, P. (2003). Applying RCM in large Huang, L.-J., Jiang, H., Chen, Y., & Chen, S.-J. (2014). Using Condition-based Main-
scale systems : a case study with railway networks. Reliability Engineering & System tenance and Reliability-centered Maintenance to Improve Maintenance in Nuclear
Safety, 82, 257–273. http://dx.doi.org/10.1016/S0951-8320(03)00167-4. Power Plants. In Progress of Nuclear Safety for Symbiosis and Sustainability: Advanced
Chandrasekaran, B. (1994). Functional representation and causal processes. Advances Digital Instrumentation, Control and Information Systems for Nuclear Power Plants (pp.
in Computers, 38, 73–143. http://dx.doi.org/10.1016/S0065-2458(08)60176-X. 177–185). Springer, http://dx.doi.org/10.1007/978-4-431-54610-8_18.
Chandrasekaran, B. (2005). Representing function : Relating functional representation Huo, Z., Zhang, Z., Wang, Y., & Yan, G. (2005). CMMS Based Reliability Centered
and functional modeling research streams. Artificial Intelligence for Engineering Maintenance. In Proceedings of the IEEE Power engineering society transmission and
Design, Analysis and Manufacturing, 19, 65–74, 10.10170S0890060405050079. distribution conference (pp. 1–6). http://dx.doi.org/10.1109/TDC.2005.1546784.
Cheng, Z., Chen, L., Jia, X., & Zeng, H. (2012). Case Representation and Retrieval in IAEA (2007). Application of Reliability Centred Maintenance To Optimize Operation and
the Intelligent RCM Analysis System. In Advances in intelligent and soft computing Maintenance in Nuclear Power Plants (pp. 1–94). Vienna, Austria: International
(pp. 21–28). http://dx.doi.org/10.1007/978-3-642-28658-2_4. Atomic Energy Agency.

18
M. Song et al. Computers & Industrial Engineering 182 (2023) 109409

ISO (2016). Petroleum, petrochemical and natural gas industries — collection and exchange Rausand, M., & Øien, K. (1996). The basic concepts of failure analysis. Reliability En-
of reliability and maintenance data for equipment industries, ISO 14224:2016. Geneva, gineering & System Safety, 53(1), 73–83. http://dx.doi.org/10.1016/0951-8320(96)
Switzerland: International Organization for Standardization. 00010-5.
Jalashgar, A. (1999). Goal-oriented systems modelling: Justification of the approach and Rodríguez-Padial, N., Marín, M. M., & Domingo, R. (2022). Assisted-Driven Design of
overview of the methods. Reliability Engineering & System Safety, 64(2), 271–278. Customized Maintenance Plans for Industrial Plants. Applied Sciences, 12(14), 7144.
http://dx.doi.org/10.1016/S0951-8320(98)00067-2. http://dx.doi.org/10.3390/app12147144.
Johnston, D. C. (2002). Plausible Reasoning Theory in Reliability-Centered Maintenance Rossing, N. L., Lind, M., Jensen, N., & Jørgensen, S. B. (2010). A functional HAZOP
Analysis. In Proceedings of the annual reliability and maintainability symposium (pp. methodology. Computers and Chemical Engineering, 34(2), 244–253. http://dx.doi.
367–371). http://dx.doi.org/10.1109/RAMS.2002.981669. org/10.1016/j.compchemeng.2009.06.028.
Kim, J., & Jeong, H. Y. (2013). Evaluation of the adequacy of maintenance tasks using SAE (1999). Evaluation Criteria for Reliability Centered Maintenance (RCM) Processes, SAE
the failure consequences of railroad vehicles. Reliability Engineering & System Safety, Standard JA1011. Warrendale, PA: Society of Automotive Engineers.
117, 30–39. http://dx.doi.org/10.1016/j.ress.2013.03.008. Selvik, J. T., & Aven, T. (2011). A framework for reliability and risk centered
Kim, S. G., & Seong, P. H. (2018). Enhanced reasoning with multilevel flow mod- maintenance. Reliability Engineering & System Safety, 96, 324–331. http://dx.doi.
eling based on time-to-detect and time-to-effect concepts. Nuclear Engineering and org/10.1016/j.ress.2010.08.001.
Technology, 50(4), 553–561. http://dx.doi.org/10.1016/j.net.2018.03.008. Shimizu, S., Sugawara, M., Sakurai, S., Mori, T., & Saikawa, K. (1993). Decision-making
Kirchhübel, D., Lefebvre, D., Lind, M., Lmansouri, S., & Myllerup, C. (2022). Timing as- support systems for reliability-centered maintenance. Journal of Nuclear Science and
pects in causality analysis with multilevel flow modelling. IFAC-PapersOnLine, 55(6), Technology, 30(6), 505–515. http://dx.doi.org/10.1080/18811248.1993.9734512.
649 – 654. http://dx.doi.org/10.1016/j.ifacol.2022.07.201, Conference paper. Siqueira, I. P. (2006). Software Requirements for Reliability-Centered Maintenance
Kobbacy, K. A. (2012). Application of Artificial Intelligence in maintenance modelling Application. In Proceedings of 9th International conference on probabilistic methods
and management. IFAC Proceedings Volumes (IFAC-PapersOnline), 45(31), 54–59. applied to power systems, PMAPS (pp. 1–7). http://dx.doi.org/10.1109/PMAPS.2006.
http://dx.doi.org/10.3182/20121122-2-ES-4026.00046. 360282.
Larsson, J. E. (1996). Diagnosis based on explicit means-end models. Artificial Smith, A. M., & Hinchcliffe, G. R. (2003). RCM-Gateway to world class maintenance.
Intelligence, 80(1), 29–93. http://dx.doi.org/10.1016/0004-3702(94)00043-3. Oxford, UK: Butterworth-Heinemann.
Lind, M. (1982). Multilevel Flow Modelling of Process Plant for Diagnosis and Control, Song, M., & Gofuku, A. (2018). Planning of alternative countermeasures for a station
Risø-M-2357: Technical Report, Roskilde, Denmark: Risø National Laboratory. blackout at a boiling water reactor using multilevel flow modeling. Nuclear
Lind, M. (1994). Modeling Goals and Functions of Complex Industrial Plants. Applied Ar- Engineering and Technology, 50(4), 542–552. http://dx.doi.org/10.1016/j.net.2018.
tificial Intelligence, 8(2), 259–283. http://dx.doi.org/10.1080/08839519408945442. 03.004.
Lind, M. (1999). Plant modelling for human supervisory control. Transactions of the Song, M., Gofuku, A., & Lind, M. (2019). Synthesis of Valve and Pump Operations
Institute of Measurement and Control, 21(5), 171–180. http://dx.doi.org/10.1177/ in Complex Plants by Using Functional Modeling. IFAC-PapersOnLine, 52(19),
014233129902100405. 187–192. http://dx.doi.org/10.1016/j.ifacol.2019.12.094.
Lind, M., & Zhang, X. (2014). Functional modelling for fault diagnosis and its Song, M., Gofuku, A., & Lind, M. (2020). Model-based and rule-based synthesis of
application for NPP. Nuclear Engineering and Technology, 46(6), 753–772. http: operating procedures for planning severe accident management strategies. Progress
//dx.doi.org/10.5516/NET.04.2014.721. in Nuclear Energy, 123, Article 103318. http://dx.doi.org/10.1016/j.pnucene.2020.
Ma, Z., Ren, Y., Xiang, X., & Turk, Z. (2020). Data-driven decision-making for equip- 103318.
ment maintenance. Automation in Construction, 112(July 2019), Article 103103. Song, M., & Lind, M. (2020). Towards Automated Generation of Function Models from
http://dx.doi.org/10.1016/j.autcon.2020.103103. P&IDs. In 25th IEEE International conference on emerging technologies and factory
Melani, A. H. A., Murad, C. A., Caminada Netto, A., de Souza, G. F. M., & Nabeta, S. automation, ETFA (pp. 1081–1084). http://dx.doi.org/10.1109/ETFA46521.2020.
I. (2018). Criticality-based maintenance of a coal- fired power plant. Energy, 147, 9212146.
767–781. http://dx.doi.org/10.1016/j.energy.2018.01.048. Song, M., & Lind, M. (2022). Functional modeling and reasoning for reliability centered
Modarres, M., & Cheon, S. W. (1999). Function-centered modeling of engineering maintenance. In Proceedings of the 32nd European Safety and Reliability Conference
systems using the goal tree – success tree technique and functional primitives. (ESREL 2022) (pp. 642–649). http://dx.doi.org/10.3850/978-981-18-5183-4_R14-
Reliability Engineering & System Safety, 64, 181–200. http://dx.doi.org/10.1016/ 06-264-cd.
S0951-8320(98)00062-3. Song, M., Lind, M., Yang, J., & Gofuku, A. (2021). Integrative decision support for
Moubray, J. (1997). RCM II, Reliability-Centered Maintenance. New York City, US: accident emergency response by combining MFM and Go-Flow. Process Safety and
Industrial Press. Environmental Protection, 155, 131–144. http://dx.doi.org/10.1016/j.psep.2021.09.
Netto, A. C., De Andrade Melani, A. H., Murad, C. A., De Carvalho Michalski, M. 015.
A., De Souza, G. F. M., & Nabeta, S. I. (2020). A novel approach to defining Tang, Y., Liu, Q., Jing, J., Yang, Y., & Zou, Z. (2017). A framework for identification
maintenance significant items: A hydro generator case study. Energies, 13(23), 1–20. of maintenance significant items in reliability centered maintenance. Energy, 118,
http://dx.doi.org/10.3390/en13236273. 1295–1303. http://dx.doi.org/10.1016/j.energy.2016.11.011.
Niu, G., Yang, B. S., & Pecht, M. (2010). Development of an optimized condition-based Tang, Y., Zou, Z., Jing, J., Zhang, Z., & Xie, C. (2015). A framework for making
maintenance system by data fusion and reliability-centered maintenance. Reliability maintenance decisions for oil and gas drilling and production equipment. Journal
Engineering & System Safety, 95(7), 786–796. http://dx.doi.org/10.1016/j.ress.2010. of Natural Gas Science and Engineering, 26, 1050–1058. http://dx.doi.org/10.1016/
02.016. j.jngse.2015.07.038.
Nowlan, F. S., & Heap, H. F. (1978). Reliability-Centered Maintenance, AD/A066 579: Wu, J., Lind, M., Zhang, X., Pardhasaradhi, K., Kumah, S., & Myllerup, C. M. (2021).
Technical Report, Springfield, Virginia: US Department of Commerce. Knowledge acquisition and representation for intelligent operation support in
Öhman, B. (2002). Discrete Sensor Validation with Multilevel Flow Models. IEEE offshore fields. Process Safety and Environmental Protection, 155, 415–443. http:
Intelligent Systems, 17(3), 55–61. http://dx.doi.org/10.1109/MIS.2002.1005632. //dx.doi.org/10.1016/j.psep.2021.09.036.
van Paassen, M., & Wieringa, P. A. (1999). Reasoning with multilevel flow models. Wu, J., Zhang, L., Liang, W., & Hu, J. (2013). A novel failure mode analysis model
Reliability Engineering & System Safety, 64(2), 151–165. http://dx.doi.org/10.1016/ for gathering system based on Multilevel Flow Modeling and HAZOP. Process
s0951-8320(98)00060-x. Safety and Environmental Protection, 91(1–2), 54–60. http://dx.doi.org/10.1016/j.
Pujadas, W., & Chen, F. F. (1996). A reliability centered maintenance strategy for a psep.2012.02.002.
discrete part manufacturing facility. Computers & Industrial Engineering, 31(1–2), Zhang, X., Lind, M., & Ravn, O. (2013). Consequence reasoning in multilevel flow
241–244. http://dx.doi.org/10.1016/0360-8352(96)00121-0. modelling. IFAC Proceedings Volumes (IFAC-PapersOnline), 46(15), 187–194. http:
Rasmussen, J. (1985). The Role of Hierarchical Knowledge Representation in Decision //dx.doi.org/10.3182/20130811-5-US-2037.00028.
making and System Management. IEEE Transactions on Systems, Man and Cybernetics, Zhou, D., Zhang, H., Li, Y. G., & Weng, S. (2016). A Dynamic Reliability-Centered
SMC-15(2), 234–243. http://dx.doi.org/10.1109/TSMC.1985.6313353. Maintenance Analysis Method for Natural Gas Compressor Station Based on
Rausand, M. (1998). Reliability centered maintenance. Reliability Engineering & System Diagnostic and Prognostic Technology. Journal of Engineering for Gas Turbines and
Safety, 60, 121–132. http://dx.doi.org/10.1016/S0951-8320(98)83005-6. Power, 138(6), 1–9. http://dx.doi.org/10.1115/1.4031644.

19