Most RCM articles describe the method. This one shows the arithmetic. What follows is a complete reliability centered maintenance analysis of one asset — BFP-2, the No. 2 boiler feed pump at a municipal water utility (a fictional plant; the numbers and the reasoning are real RCM). BFP-2 is one of two 100% motor-driven centrifugal pumps in a duty/standby pair, auto-starting on low header pressure, continuous duty. By the end, the analysis prices the pump's failure consequences at $259,390 per year and answers them with a maintenance program that costs 55.6 craft-hours per year. Getting from one number to the other is the whole method, and it happens in three moves: define the functions, sort every failure mode by consequence, and let the decision logic — not habit — pick the tasks.
Start with functions, not with the machine
An RCM analysis doesn't start by asking what can break. It starts by asking what the asset is for, in numbers a failure can be measured against. BFP-2 has five functions:
- F1 (primary): deliver 400–520 gpm at 1,200–1,250 psig.
- F2 (primary): contain feedwater within the pressure boundary — leakage no more than design weep.
- F3 (protective): shut the pump down at or below minimum safe suction pressure.
- F4 (protective): prevent reverse flow through the stopped pump.
- F5 (secondary): start and reach full load within 30 seconds of a start demand.
Those five functions produce seven functional failures — total loss of flow, flow below 400 gpm, leakage beyond design weep, the trip failing to act, the check valve passing reverse flow, failure to start, and a slow start. Only then do failure modes enter: the specific mechanisms that cause each functional failure, stated at the level where a task could actually act on them. Not "bearing failure" — bearing fatigue spalling, lubricant oxidation, and coupling element fatigue are three different lines, because they behave differently and earn three different tasks. BFP-2's register holds 12 failure modes. That number is not the point. The point is what happens to each one next.
Consequences come before tasks — always
Every mode is sorted into exactly one of four consequence categories, in a fixed order: Hidden, Safety/Environmental, Operational, Non-operational. The sort matters because the category decides how hard the analysis is allowed to work. BFP-2's twelve land like this: 3 hidden, 2 safety/environmental, 6 operational, 1 non-operational.
The category is set by the failure's effect, not by its price tag — and the seal shows why. Mechanical seal face wear would price as an expensive operational failure, and it does carry a $40,250/yr figure. But the effect narrative records hot condensate spraying a walkway. The safety question answers yes, the mode becomes Safety/Environmental, and from that point its justification no longer depends on the dollar figure at all. Nine of the twelve modes carry priced consequences (at the analysis's $5,000/hour downtime rate), and those nine total the $259,390/yr. Read that number correctly: it is the exposure the program is being compared against in review — not a savings claim, and any analysis that presents it as one should be challenged.
The hidden modes get their own mathematics. The low-suction trip switch can drift and nobody will know until the day it's demanded — that's what "hidden" means. You can't monitor a hidden failure into visibility; you proof-test it, and the interval is calculated, not guessed. With the switch's MTBF at 8 years and a target average availability of 99%, the failure-finding interval is FFI = 2 × (1 − 0.99) × 8 years = 0.16 years — about 8 weeks. Packaged on an 8-week proof-test route, the achieved availability is 99.04%, and the multiple failure it guards against works out to roughly once in 520 years. Operations originally asked for 99.9% availability on that trip — until the same arithmetic priced it: a proof test every two weeks, a burden the plant couldn't staff. Targets are decisions with prices. The analysis's job is to show the price before the decision hardens.
The decision logic picks the task — and sometimes picks none
With the category settled, each mode walks the decision logic: Is there a condition-directed task — something measurable that degrades on a P-F interval? A time-directed restoration or discard? A failure-finding task for the hidden ones? And if no proactive task is feasible and worth doing, the logic doesn't shrug — it defaults, and the default depends on the category.
BFP-2's twelve modes come out as six condition-directed tasks, one time-directed discard, two failure-finding tasks, one run-to-failure, one one-time change, and one deliberate “no scheduled task.” The variety is the method working. Wear-ring clearance growth is the textbook condition-directed case: a quarterly performance test against the F1 standard, catching the trend inside a 6-month P-F interval. Suction strainer blockage is the opposite shape — a 4-week P-F that forces a fortnightly differential check, because a monthly round physically cannot catch it. The coupling gets the analysis's only time-directed answer, a 5-year discard, because it offers no in-service signal the team would defend and the element is cheap.
The two defaults are the most instructive lines in the register. Deadheading the pump — discharge valve closed — is a Safety/Environmental mode with no feasible proactive task, because deadheading is an operating state, not a degradation you can trend. For a safety-category mode, the logic's answer is mandatory: a one-time change, here a low-flow trip and discharge-valve interlock evaluation, leaving the analysis as an engineering action. And the protective coating breakdown? Evident, non-operational, $600 a year. It runs to failure, repainted at the next casing access another task already creates — a defended default, recorded with its reasoning, not an oversight.
Packaging: where the analysis becomes a program nobody has to admire
Decisions aren't a program until they're packaged. BFP-2's nine scheduled tasks land in six recurring packages: a weekly operator round (19.5 hrs/yr), a monthly PdM route (10), a quarterly test route (12), the 8-week proof-test route (6.5), the annual outage (6), and the 5-year outage (1.6). Total: 55.6 craft-hours per year. The one-time change sits in a project queue where it belongs; the run-to-failure and no-scheduled-task modes stay visible on the packaging strip, counted, so their absence of tasks is a reviewed number rather than a forgotten one.
Set the two numbers side by side and you have the entire argument for doing RCM this way: $259,390 a year of priced, categorized consequence, answered by 55.6 hours a year of tasks — each one justified by a specific failure mode, in a specific consequence category, through a logic a reviewer can retrace line by line. No inherited tasks. No "we've always done it this way." And when the plant's evidence changes, the living review changes the analysis — because the analysis, not somebody's memory of a meeting, is the record.
Run this analysis on your own asset — start free.
The complete BFP-2 analysis — every function, mode, consequence answer, and interval calculation — is the free RCM Quick-Start Sample from Apex Reliability Engineering: download it here. It's drawn from the RCM Analysis Workbook — the full 9-tab JA1011 workbook (2,306 live formulas, built-in 150-mode library, 19-page guide) for running the method on your own equipment.
Your email is used only to deliver your files. Apex Reliability Engineering never sells or shares your information, and we don't send spam.