Skip to content

Method guide · TPM and maintenance

Reliability-centered maintenance (RCM): the 7 questions, failure patterns and a worked example

Short answer

Reliability-centered maintenance (RCM) is a method for deciding what maintenance each asset needs by working through what it must do, the ways it can fail and what each failure costs. For every failure mode the team picks one task that can really prevent or find it and is worth the effort, or decides on purpose to run it to failure.

An RCM analysis answers seven questions for one asset: its functions and the standard each must meet, how it can fail to meet them, what causes each failure, what happens when it occurs, why that matters, what task can predict or prevent it, and what to do if no task fits. The answers turn into a list of tasks, each tied to a failure mode: condition checks, scheduled replacements, failure-finding tests on protective devices, redesigns and planned run to failure. The method came from airline maintenance in the 1970s, and SAE JA1011 sets out what a process must include to be called RCM.

Last reviewed:

What is reliability-centered maintenance?

Reliability-centered maintenance starts from the failure, not from the machine's manual. Instead of asking "what PM does this conveyor need?", the team asks "what does this conveyor have to do, how can it stop doing that, and which of those failures is worth acting on?" Every task that comes out of the analysis names the failure mode it deals with. A task that cannot name one is dropped.

The result is a mix. Some failure modes get a condition check, because they give a warning you can measure. Some get a replacement at a fixed age, because they really do wear out on time. Protective devices get a test, because nobody notices when they fail. Some failures are designed out. And some are left to run to failure on purpose, with a spare ready, because no task would pay for itself. RCM is the method for deciding which is which, one failure mode at a time.

Reliability-centered and reliability-centred are the same thing, US and UK spelling. "Reliability maintenance" is often used loosely for the same idea, or for the wider job of a reliability engineer. RCM is the shorthand in both cases.

Where RCM came from

The method came out of airline maintenance. F. Stanley Nowlan and Howard F. Heap of United Airlines described it in Reliability-Centered Maintenance, their 1978 report for the US Department of Defense, which gave the method its name. Their data showed that many aircraft components did not wear out at a predictable age, so overhauling them on a timer did little for reliability. The airline industry's MSG-3 process for planning aircraft maintenance grew from the same work.

John Moubray carried the method into plants and utilities with his book Reliability-centred Maintenance (RCM II, 2nd edition 1997). In 1999 SAE International published SAE JA1011, Evaluation Criteria for Reliability-Centered Maintenance (RCM) Processes, which sets the minimum a process must do to be called RCM, followed in 2002 by SAE JA1012, a guide to applying it. Both are paid standards; this page names them and puts the questions in its own words.

The 7 questions of RCM

SAE JA1011 frames an RCM process as seven questions asked, in order, about the asset being analysed. Here they are in plain words, with what the team writes down for each and how they come out for the conveyor drive in the worked example further down.

The seven questions of an RCM analysis

  1. 1Functions

    What must it do, and how well?

  2. 2Functional failures

    How can it fail to do that?

  3. 3Failure modes

    What causes each failure?

  4. 4Effects

    What happens when it fails?

  5. 5Consequences

    Why does it matter?

  6. 6Proactive task

    What task can predict or prevent it?

  7. 7Default action

    What if no task fits?

Then review: findings and new failures send the team back to questions 3 to 6

Asked in order for one asset. Questions 1 to 4 analyse the failures, like an FMEA; questions 5 to 7 decide the maintenance.
The seven RCM questions in plain words
QuestionWhat the team writes downOn the conveyor drive (illustrative)
1. What does the asset have to do, and how well?Functions, each with a performance standard: a rate, a pressure, a temperature, a limitCarry bottles to the filler at up to 300 a minute; slip before a jam can break the chain; keep gearbox oil off the floor
2. In what ways can it fail to do that?Functional failures: a total loss and each partial loss of every functionStops; runs but skips and drops bottles; leaks oil; does not slip in a jam
3. What causes each functional failure?Failure modes: specific causes, from breakdown records and from the people who fix the machineBearing wear, seal leak, chain stretch, photo-eye fault, seized torque limiter
4. What happens when each one occurs?Failure effects: what anyone would see, what gets damaged, how long the stop lastsThe bearing seizes, the conveyor stops, and a breakdown change takes about 6 hours
5. In what way does each failure matter?Consequence class: hidden, safety or environment, operational, or non-operationalThe oil leak puts oil on a walkway, so it has a safety consequence
6. What can be done to predict or prevent each failure?A proactive task and its interval, if one is both possible and worth doingA vibration and temperature reading on the gearbox every 4 weeks
7. What should be done if no proactive task fits?A default action: a failure-finding test, a redesign or run to failureThe photo-eye runs to failure, with a spare kept at the line

Questions 1 to 4 are the failure analysis, close to an FMEA. Questions 5 to 7 are the decision, and that is what makes it RCM. The free [RCM worksheet](/templates/rcm-worksheet) has a column for every answer and works out the failure-finding interval.

Most of the effort goes into question 1. If the function says only "convey bottles", every later answer is vague. A function with a number in it, "up to 300 bottles a minute", lets the team say exactly when a partial failure starts, and so what counts as a failure worth preventing.

Failure consequences and the RCM task types

Question 5 sorts each failure mode into one of four classes, and the class sets what "worth doing" means for any task. Nowlan and Heap's decision diagram asks about consequences first for that reason.

The four consequence classes and the test a task has to pass
ClassWhat it meansA task is worth doing if
HiddenNobody doing normal work would know the function has failed. Typical of protective devices: relief valves, level switches, torque limiters, standby pumps.It keeps the protective function available enough that the multiple failure (the protection failed and then needed) is as rare as the site accepts
Safety or environmentThe failure could hurt someone or breach an environmental limit or a lawIt brings the risk down to a level the site accepts, whatever it costs. If no task does, redesign.
OperationalThe failure stops or slows output, or harms qualityIt costs less over a year than the repairs plus the lost output it prevents
Non-operationalEvident, and costs only the repairIt costs less than the repairs it prevents. Often nothing passes, and run to failure is the answer.

Question 6 then tries the proactive tasks in order. A condition-based task comes first, because it replaces a part only when the part needs it. A scheduled restoration or replacement comes next, and only fits a failure mode with a clear wear-out age that most parts reach. For a hidden failure where neither works, question 7 gives a failure-finding test. The other defaults are a redesign, which includes a change to how the machine is run or a procedure, and run to failure.

RCM task types and when each one fits
TaskWhat it isFits when
Condition-based (on-condition)Check for a warning sign and act when you find it: vibration, temperature, oil analysis, a measured wear gauge, a look and listenA warning can be detected, the warning time is fairly consistent, and it lasts longer than the time you need to act
Scheduled restorationOverhaul or rebuild at a set age in hours, cycles or timeFailures rise sharply after a known age and most parts reach it
Scheduled discardReplace the part at a set age, whatever it looks likeThe same as restoration, for parts that are cheaper to throw away than to rebuild
Failure-findingTest a protective device to find out whether it has already failedThe failure is hidden and no condition or age-based task works
Redesign or one-time changeChange the equipment, the way it is run, or a procedureSafety or environmental risk stays too high with any task, or an operational failure costs too much
Run to failureNo scheduled task; repair when it fails, with the spare and the procedure readyThe failure is evident, harms no one, and no task is cheaper than the failures it prevents

The P-F interval sets how often to check

A condition check works inside the P-F interval: the time from the point P where a coming failure can first be detected to the point F where it fails. The ABS Guidance Notes on Reliability-Centered Maintenance (section 4) put the check interval at no more than half the P-F interval. Then test the worst case: a sign that appears just after a check is found one interval later, so the time left is the P-F interval minus the check interval, and it must be longer than the time you need to get the part and plan the stop. The maintenance strategy selector runs these questions for one failure mode and does both interval sums.

The six failure patterns behind RCM

The reason RCM does not simply replace parts on a timer is the shape of the failure curve. United Airlines plotted how the chance of failure changed with age for its aircraft components and found six shapes. Nowlan and Heap published them in 1978 (Exhibit 2.13 of their report), with the share of the items studied that followed each one.

The six age-reliability patterns (Nowlan and Heap, 1978)
PatternShape of the chance of failure against ageShare of items studiedWhat a timed replacement does
A. BathtubHigh when new, then low and flat, then a wear-out zone4%Can help, if the age limit sits before the wear-out zone
B. Wear-outFlat or slowly rising, then a clear wear-out zone2%Can help, the classic case for a fixed life
C. Slowly risingRises steadily with age, no clear wear-out age5%Little: there is no age at which the risk jumps
D. Low, then steadyLow when new or just repaired, then rises quickly to a flat level7%Nothing after the first period
E. RandomThe same chance of failure at every age14%Nothing: a new part is as likely to fail as an old one
F. Early lifeHigh when new or just repaired, then flat68%Harm: each replacement starts a new high-risk period

Check the shares: 4 + 2 + 5 + 7 + 14 + 68 = 100%. Patterns A, B and C together are 4 + 2 + 5 = 11%, which leaves 89% with no wear-out zone. These are one airline's aircraft parts, not plant equipment, and we know of no comparable published study for plants that we could check. What carries over is the test, not the percentages.

Share of items in each failure pattern (Nowlan and Heap, 1978)

  1. A. Bathtub4%
  2. B. Wear-out2%
  3. C. Slowly rising5%
  4. D. Low, then steady7%
  5. E. Random14%
  6. F. Early life68%
Only patterns A, B and C, 11% together, have an age at which a timed replacement helps. Pattern F alone is 68%. These were aircraft parts, so carry over the test, not the percentages.

On a line, the lesson is to look at your own work orders before setting a fixed life. If the failures of a part come at widely spread ages, a scheduled replacement will throw away good parts and still miss the early failures. Pattern F is also a warning about intrusive PM: every time a machine is opened up, the chance of a bad repair, a pinched seal or a misaligned coupling comes back. The four most common causes of equipment failure covers how failures start on the floor.

RCM example: a worked analysis of one conveyor drive

This example is illustrative, not data from a real machine. A bottling line runs two 8-hour shifts, 5 days a week. The infeed conveyor carries bottles from the depalletiser to the filler. It has a motor, a gearbox, a drive chain, a torque limiter that slips if bottles jam, and a photo-eye that tells the filler bottles are coming. The current PM has two lines: "replace gearbox bearings every 2 years" and "inspect conveyor monthly", with no limit given. The team is the line's lead operator, the maintenance technician who fixes it, the area supervisor and a facilitator.

Functions and functional failures (questions 1 and 2)

Conveyor drive functions and how each can fail (illustrative)
Function, with its standardFunctional failures
1. Carry bottles from the depalletiser to the filler at up to 300 a minute1A. Does not move at all. 1B. Moves, but skips and drops bottles below 300 a minute.
2. Slip and stop the drive if bottles jam, before the chain or gearbox is damaged2A. Does not slip at its set torque.
3. Keep gearbox oil inside the gearbox3A. Leaks oil onto the floor.

The RCM worksheet (questions 3 to 7)

RCM analysis of the infeed conveyor drive (illustrative)
Failure modeEffect: what happensConsequenceTask chosenInterval and owner
1A. Gearbox output bearing wearsNoise, vibration and heat rise for weeks, then the bearing seizes and the conveyor stops. About 6 hours to change it as a breakdown.Evident, operationalCondition-based: vibration and temperature reading on the gearbox, plan the change when it passes the alert limitEvery 4 weeks, technician on the route
1B. Drive chain stretches with wearThe chain rides up the sprocket teeth, then skips. Bottles fall and jam at the filler.Evident, operationalCondition-based: measure elongation with a chain wear gauge, replace at the maker's limitEvery 13 weeks, technician
1A. Infeed photo-eye failsThe filler sees no bottles and stops. About 20 minutes to swap the sensor with a spare.Evident, operational, smallRun to failure: electronics fail at random and there is no warning to check for. One spare photo-eye kept at the line.No scheduled task
2A. Torque limiter seizes and will not slipNothing shows in normal running. At the next jam the chain snaps or the gearbox shaft breaks.Hidden; the multiple failure is operationalFailure-finding: slip test at the set torque, then resetEvery 26 weeks, technician
3A. Gearbox output seal leaksOil drips onto the walkway and the oil level falls. Left alone, the gearbox runs dry and the bearing fails.Safety (slip) and operationalCondition-based: look at the sight glass and the floor at shift start. One-time change: fit a drip tray under the gearbox.Every shift, operator, on the CILR checklist

Failure modes are numbered by the functional failure they cause. The oil leak is a safety failure because of the slip, so cost does not decide: the daily check finds the leak early and the drip tray keeps oil off the walkway in the time between.

The intervals, worked out

Gearbox bearing. The technician's vibration readings on similar gearboxes show a bearing defect about 8 weeks before it seizes, so the P-F interval is 8 weeks. Getting the bearing and a weekend stop takes 2 weeks. The check interval is the smaller of 8 / 2 = 4 weeks and 8 - 2 = 6 weeks, so every 4 weeks. Worst case: a defect that starts just after a reading is found 4 weeks later, which leaves 8 - 4 = 4 weeks, more than the 2 weeks needed.

Drive chain. From the alert limit on the wear gauge to the chain skipping takes about 26 weeks of running, and a new chain is on the shelf in 1 week. The interval is the smaller of 26 / 2 = 13 weeks and 26 - 1 = 25 weeks, so every 13 weeks. Worst case left: 26 - 13 = 13 weeks, against 1 week needed.

Torque limiter. It fails at random, with an MTBF of 25 years, and the site wants it working 99% of the time. The failure-finding interval is 2 x (1 - availability) x MTBF (ABS Guidance Notes, section 5) = 2 x 0.01 x 25 = 0.5 years, which is 26 weeks. Check it another way: an unavailability of 0.01 gives an interval of 2% of the MTBF, and 2% of 25 years is 0.5 years, or 0.5 x 52 = 26 weeks. The formula holds while the interval is under a tenth of the MTBF: 0.5 / 25 = 0.02, well under 0.1.

Scheduled RCM tasks on the conveyor drive, time per year (illustrative)
TaskIntervalTimes a yearMinutes eachMinutes a year
Gearbox vibration and temperature4 weeks52 / 4 = 1310130
Chain elongation check13 weeks52 / 13 = 430120
Torque limiter slip test26 weeks52 / 26 = 24590
Technician total19340
Sight glass and floor checkEvery shift2 shifts x 5 days x 50 weeks = 5001500

Check the technician total: 130 + 120 + 90 = 340 minutes, and 340 / 60 = 5 hours 40 minutes a year, with the conveyor running for the vibration reading and stopped for the other two. The operator check is 500 minutes, 8 hours 20 minutes a year, spread a minute at a time inside the start-of-shift CILR round.

What changed in the PM list

The two-yearly bearing change is dropped. The last four bearing failures on these gearboxes came at 9, 31, 14 and 26 months: an average of (9 + 31 + 14 + 26) / 4 = 20 months, but spread so widely that a change every 24 months would have come too late for two of them (9 and 14) and thrown away two bearings that had months left (26 and 31). That spread looks like a random pattern, not a wear-out age, so a condition check fits and a fixed life does not. It also takes away a 6-hour planned stop every two years, and the risk of a bad reassembly each time.

"Inspect conveyor monthly" is replaced by three tasks that each name a failure mode and a limit. The torque limiter, which nobody had tested before, gets a test twice a year. The photo-eye gets a spare instead of a task. The new tasks go into the CMMS as PMs with these intervals, and the operator check goes onto the line's CILR checklist.

How to run an RCM analysis, step by step

An RCM analysis is a team exercise on one asset or system at a time. It needs the people who run the machine and the people who fix it in the room, because each knows failures the other does not.

  1. 1

    Pick the asset

    Start with one where failures hurt and the PM is not working: a line constraint, a utility the whole plant depends on, a machine with a safety history. The equipment criticality analysis ranks the candidates.

  2. 2

    Set the boundary and the team

    Write down where the system starts and stops (motor to discharge flange, depalletiser to filler infeed) and what is outside it. The team is an operator, a technician, someone who can speak for production and a facilitator who knows the method.

  3. 3

    Write the functions and functional failures

    Questions 1 and 2. Include protective functions, containment and anything a regulation requires, not only the main job. Put a number in every standard you can.

  4. 4

    List failure modes and effects

    Questions 3 and 4. Use work orders, downtime logs and the technicians' memory. Name causes at the level where a task can act on them: "output bearing wears", not "gearbox fails".

  5. 5

    Class each failure mode and choose a task

    Questions 5 to 7, in the order of the decision diagram. Write down the evidence for each answer, such as the warning time, the failure ages and the MTBF, and mark a guess as a guess.

  6. 6

    Load the tasks and review them

    Put each task into the CMMS or the CILR checklist with its interval and owner. Look at the analysis again after the first failures and at least once a year, and change any interval the findings say is wrong.

A full analysis of one system often takes the team several sessions, which is why most plants keep full RCM for their critical assets. Shorter methods that skip or combine questions are common and usually called streamlined or RCM-based. They can be sensible on less critical assets, but they do not meet SAE JA1011, so call them what they are. The fault tree analysis template helps where one functional failure has several causes that combine.

RCM vs preventive maintenance, predictive maintenance, TPM and FMEA

RCM is not another kind of maintenance next to PM and predictive maintenance. It is the method that decides where each of those kinds goes. TPM works on who does the maintenance and how the plant is organised around it. They fit together rather than compete.

RCM compared with the maintenance approaches it is confused with
ApproachWhat it isWhat decides the taskHow it relates to RCM
Reactive (run to failure)Repair after the failureNothing; the failure arrivesRCM picks it on purpose for some failure modes, with spares ready
Preventive maintenance (PM)Planned work at a set interval of time or useThe calendar or a meter, usually from the maker's manualRCM keeps a timed task only where a failure mode has a wear-out age
Predictive or condition-based maintenance (PdM)Act on a measured warning signA reading passing a limitRCM's first choice whenever a warning can be detected in time
Reliability-centered maintenance (RCM)A method for choosing the task for each failure modeThe function, the failure mode and its consequenceThe decision method itself
Total productive maintenance (TPM)A plant-wide program in which operators and maintenance share care of the equipment, organised in pillarsPillar activities: autonomous maintenance, planned maintenance and the restRCM can set the tasks the planned maintenance pillar runs, and operators take the simple checks under autonomous maintenance
FMEAA structured review of failure modes, effects and causes, ranked for riskA severity, occurrence and detection rating or action priorityRCM questions 3 and 4 are an FMEA; RCM then adds the consequence class and task selection

Preventive maintenance covers the PM program, the schedule and PM compliance in numbers. Preventive vs predictive maintenance compares the two side by side. FMEA covers the ratings, RPN against action priority and DFMEA against PFMEA. Total productive maintenance covers the eight pillars and autonomous maintenance, and the TPM and maintenance hub lists the rest.

Benefits and limits of reliability-centered maintenance

  • Every task has a reason. Each line in the PM list names the failure mode it deals with, so a task that does nothing can be found and dropped.
  • Less intrusive work. Timed overhauls of parts that fail at random are replaced by checks, which cuts planned stops and the failures a bad reassembly causes.
  • Hidden failures get found. Relief valves, level switches, interlocks and standby units get a test at a worked-out interval instead of being assumed to work.
  • Safety decisions are written down. A failure that could hurt someone is never left to a cost argument, and the record shows what was decided and why.
  • Operators and technicians share what they know. The sessions put the people who see the first signs next to the people who know what the parts do.

The limits are real too. A full analysis takes team time, so it is not worth doing on every asset. It needs failure records that many plants do not have yet, and early answers are often estimates that have to be revised. It also decays: a study done once and filed while the process, the product or the equipment changes soon describes a different machine. Plants that get the most from RCM treat it as a living record they review, not a project they finish.

Where RCM results live: the CMMS, the CILR checklist and the work order

An RCM analysis ends as tasks, and the tasks have to land somewhere people will do them. Technician tasks go into the CMMS as preventive maintenance with their intervals, where each one comes due as a work order and the history builds the evidence for the next review. Short operator checks go onto the line's CILR checklist. Findings from either become work orders with a priority.

LeanSuite is not a CMMS and does not replace one. It handles the operator side of maintenance and works alongside your CMMS: when a scheduled PM comes due or an operator tags an abnormality, it creates the work order and routes it to the maintenance team, and CILR checklists can be assigned to an asset with a repeat rule, with missed checks shown in red. See autonomous maintenance and professional maintenance tags.

Common RCM mistakes

  • Starting from the old PM list. Asking "which of these tasks do we keep?" skips the functions and the failure modes, and misses failures the old list never covered.
  • Functions without a standard. "Pump water" cannot tell a partial failure from normal running; "pump at least 40 cubic metres an hour" can.
  • Failure modes at the wrong level. "Gearbox fails" is too broad to choose a task for; "output bearing wears" is not.
  • Treating a hidden function as evident. A torque limiter or relief valve that has seized gives no sign until the day it is needed. Ask question 5 about every protective device.
  • Choosing a timed replacement without failure ages. A fixed life only helps a failure mode with a wear-out age. Look at when the part actually failed before you set one.
  • Doing it at a desk. An analysis written by one engineer without the operator and the technician misses the failure modes they know about and gets little support on the floor.
  • Never coming back to it. Intervals set from guesses must move when findings come in: a defect found late means a shorter interval; flat readings over many checks allow a longer one.

Free templates and tools

FAQ

Questions about reliability-centered maintenance (RCM)

  1. Reliability-centered maintenance (RCM) is a method for deciding what maintenance each asset needs by working through its functions, the ways it can fail and what each failure costs. For every failure mode the team picks a task that can really prevent or find it and is worth doing: a condition check, a scheduled replacement, a failure-finding test, a redesign, or run to failure on purpose.

  2. SAE JA1011 frames RCM as seven questions about an asset: what it must do and how well, how it can fail to do that, what causes each failure, what happens when each occurs, why each failure matters, what task can predict or prevent it, and what to do if no task fits. The first four are the failure analysis; the last three are the maintenance decision.

  3. On a bottling line conveyor, an RCM team found five failure modes. The gearbox bearing got a vibration check every 4 weeks because it gives about 8 weeks of warning. The chain got a wear-gauge check every 13 weeks. The torque limiter, which nobody notices has seized until a jam, got a slip test every 26 weeks. The oil leak got a daily operator check and a drip tray. The photo-eye runs to failure with a spare. The figures are illustrative.

  4. Every maintenance task names the failure it deals with, so tasks that do nothing are dropped. Timed overhauls of parts that fail at random are replaced by checks, which cuts planned stops and repair-induced failures. Hidden failures in protective devices get tested at a worked-out interval. Safety failures are decided on risk, not cost. The limits: it takes team time, needs failure records, and must be reviewed as the equipment changes.

  5. Preventive maintenance is a type of task: planned work at a set interval of time or use. RCM is the method that decides, failure mode by failure mode, whether a preventive task is the right answer at all. It keeps a timed task only where failures rise after a known age, and otherwise chooses a condition check, a failure-finding test, a redesign or run to failure.

  6. The P-F interval is the time from the point where a coming failure can first be detected, P, to the point where it fails, F. A condition check has to happen more often than that: the ABS Guidance Notes on RCM say at no more than half of it. A bearing that shows a vibration defect 8 weeks before it seizes is checked every 4 weeks, which still leaves 4 weeks to act in the worst case.

  7. No, but they overlap. An FMEA lists failure modes, their effects and causes and ranks them for risk, often to change a design or a process. RCM uses the same failure mode analysis for its questions 3 and 4, then adds the consequence class and a rule for choosing a maintenance task for each failure mode. You can think of RCM as an FMEA with a maintenance decision on every row.

  8. SAE JA1011, Evaluation Criteria for Reliability-Centered Maintenance (RCM) Processes, is a standard published by SAE International in 1999. It sets the minimum a process has to do to be called RCM, framed as seven questions. SAE JA1012, published in 2002, is a guide to applying it. Shorter methods that skip or combine questions are often called streamlined or RCM-based.

  9. RCM is an analysis method that decides which maintenance task each failure mode gets. TPM, total productive maintenance, is a plant-wide program in which operators and maintenance share care of the equipment, organised in pillars such as autonomous maintenance and planned maintenance. They work together: RCM can set the tasks the planned maintenance pillar runs, and the simple checks move to operators under autonomous maintenance.

Or browse the topics, the full library and the lean glossary.

Rather see it on your own problem?

Bring the problem you are stuck on, and we will show you on a call how LeanSuite handles it.

Pass it on

We want LeanSuite to be the best place on the internet for lean help. If this was useful, send it to someone on your team or in your network who needs it.