Reliability-centered maintenance (RCM) is a structured way to decide what maintenance each asset needs. It starts from what the asset has to do and how it can fail, not from a fixed schedule. For each failure mode, it weighs the consequences and picks the task that's worth doing: inspect, restore, replace, test, or run to failure.
Most PM programs grow by copying the OEM manual, adding a task after every bad breakdown, and rarely removing anything. RCM goes the other way. It asks why each task exists and what failure it's supposed to stop, and drops anything with no good answer.
This guide covers the seven questions behind RCM, then works one ordinary piece of plant equipment through all seven, start to finish. That's the part most RCM articles skip.
What reliability-centered maintenance is
RCM came out of the airline industry. When the Boeing 747 was being prepared for service in the late 1960s, the industry's Maintenance Steering Group wrote a new decision process for its maintenance program (MSG-1, 1968), instead of scaling up the overhaul-everything approach used on older aircraft.
In 1978, F. Stanley Nowlan and Howard Heap of United Airlines wrote up the method in a report for the US Department of Defense, titled Reliability-Centered Maintenance. That report gave the method its name. It's still the reference everyone cites.
Today the minimum requirements are set by SAE JA1011, Evaluation Criteria for Reliability-Centered Maintenance (RCM) Processes. It was first issued in 1999 and last revised in November 2024. JA1011 doesn't tell you how to run an analysis. It sets the bar a process has to clear before it can call itself RCM.
The 7 questions of RCM (SAE JA1011)
An RCM process has to answer seven questions about each asset, in this order. In plain English:
- Functions. What does the asset have to do, and to what performance standard, in the way you actually run it?
- Functional failures. In what ways can it fail to do that?
- Failure modes. What causes each of those failures?
- Failure effects. What happens when each one occurs?
- Failure consequences. How much does each failure matter: safety, environment, production, or just repair cost?
- Proactive tasks. What can be done to predict or prevent each failure, and how often?
- Default actions. What should you do if no proactive task is worth doing?
Search for "the 7 steps of RCM" and you'll find lists of 6, 8 and 9 steps. Those are vendors' project plans (pick the system, form the team, review the results). They're useful, but they aren't the standard. The seven questions are what JA1011 checks.
The order matters. Question 1 trips up a lot of teams, because "the pump pumps water" isn't a function with a standard. "Delivers at least 40 m³/h at 3 bar to the header" is. A failure can only be defined against a number.
How an RCM analysis works in practice
An RCM analysis is a meeting, or a series of them, not a document someone writes alone. A typical team for one system:
- an operator who knows how the equipment is actually run
- a technician who knows how it actually fails
- a maintenance planner or reliability engineer who will own the resulting task list
- a facilitator trained in RCM, who keeps the team on the seven questions and stops them jumping straight to tasks
The team starts with the operating context: duty cycle, redundancy, what's downstream, what a stoppage costs. The same pump in two plants can need two different maintenance plans. Then they work through the seven questions and record the answers on an RCM worksheet.
Questions 2 to 4 are essentially a failure mode and effects analysis. If you've done an FMEA, that part will feel familiar. RCM adds the functions in front of it and the consequence-and-task decisions after it.
Reliability-centered maintenance example: a cooling-water pump set
Here's one asset taken through all seven questions. It's an illustrative example, not a customer case, and the numbers are typical rather than measured. But the logic is exactly what an RCM team would go through.
Operating context. An injection-moulding shop runs six moulding machines whose oil coolers and mould temperature units share one cooling-water header. Two identical centrifugal pumps feed that header: Pump A runs (duty) and Pump B waits (standby). If Pump A trips, a pressure switch starts Pump B. If the header loses flow, mould temperatures climb within minutes, cycle times stretch, and the machines start making rejects before they alarm out.
Functions (question 1):
- F1. Deliver at least 40 m³/h of cooling water at 3 bar or more to the moulding-machine header.
- F2. If the duty pump stops, the standby pump starts and restores flow within 30 seconds.
- F3. Keep the water in the pipework (no leaks onto the floor or into the motor or nearby electrical panels).
F2 is the interesting one. When it fails, nothing visible happens. Pump B can sit with a seized shaft or a dead contactor for months, and nobody knows until Pump A trips and nothing takes over. In RCM terms that's a hidden failure, and it's the failure this whole example turns on.
The worksheet (questions 2 to 7):
A full RCM worksheet has a column for each question. Here it's condensed to four: the function and how it fails (questions 1 to 3), what happens (4), how much it matters (5), and the task with its interval and owner (6 and 7).
| Failure mode | What happens | Consequence | Task (interval, owner) |
|---|---|---|---|
| F1, no flow: duty pump bearing wears and seizes | Pump A trips and Pump B starts. A short pressure dip, then normal | Operational, low (if Pump B works) | On-condition: vibration and bearing-temperature reading on the route. Monthly, technician |
| F1, low flow: suction strainer blocks with scale and debris | Header pressure falls slowly, mould temperatures creep up, rejects rise | Operational | Scheduled restoration: isolate and clean the strainer. Every 4 weeks, technician |
| F1, no flow: elastomer coupling element cracks and fails | Pump A stops driving and Pump B starts | Operational, low (if Pump B works) | Scheduled discard: replace the element at the annual shutdown, only if your history shows age-related cracking. Technician |
| F2, standby doesn't start: Pump B seized from standing, or its contactor or pressure switch is faulty | Nothing on its own. If Pump A then fails, the header loses flow and all six machines stop | Hidden | Failure-finding: swap duty and standby, and confirm Pump B starts and holds pressure. Monthly, technician and operator |
| F3, leak: mechanical seal wears | Drips, then a spray near the motor and panel | Safety (electrical) | On-condition: check the seal for weeping on the daily round. Daily, operator |
| F1, wrong local reading: discharge pressure gauge on a non-critical branch fails | Branch reading lost. The header has its own gauge | Non-operational | Run to failure. Keep a spare gauge on the shelf |
A few things fall out of this that a "replace everything on a calendar" approach would miss:
- The bearing doesn't get a fixed replacement interval. It gives warning through vibration and heat long before it seizes, so you watch it and replace it when the readings say so.
- The strainer gets cleaned on a schedule because there's no practical way to see it loading up. With no differential-pressure gauge across it, there's no condition to watch. Fitting one would be a one-time change that turns this task into an on-condition check.
- The coupling element only gets a fixed discard interval with evidence. If your breakdown records don't show it failing with age, the default is to inspect it during the bearing route rather than throw away good parts.
- The standby pump test is the most important task on the list, even though Pump B never actually does any work. Without it, the redundancy you paid for is an assumption.
- The branch gauge gets nothing. Deciding not to maintain something is a valid RCM outcome when the failure is cheap and has no knock-on effect.
If the team decides that even a monthly test leaves too much risk of both pumps being down together (say a failed header would also overheat a hydraulic system), the default action is a one-time change: add a low-flow alarm on the header, so a double failure is caught in seconds instead of in the reject bin.
Choosing the task: the RCM decision logic
Question 5 decides how hard a task has to work to be worth doing. RCM sorts every failure mode into one of four consequence categories:
| Consequence | A task is worth doing if... | If no task works |
|---|---|---|
| Hidden (only matters when something else also fails) | It reduces the risk of the multiple failure to a tolerable level | Failure-finding task. If the multiple failure affects safety or the environment, redesign |
| Safety or environmental | It reduces the risk of the failure to a tolerably low level | Redesign is compulsory |
| Operational (stops or slows production, hurts quality) | It costs less over time than the lost production plus the repair | Run to failure, or redesign if the losses are high |
| Non-operational (repair cost only) | It costs less over time than the repair | Run to failure |
Within those rules, RCM prefers some task types over others, in this order:
- On-condition task. Inspect for a sign that failure is coming, and act on what you find. It's preferred because you only replace parts that are actually degrading.
- Scheduled restoration. Rework or clean at a fixed interval, regardless of condition. It only makes sense if the failure is age-related and there's no practical way to detect it coming.
- Scheduled discard. Replace at a fixed age or usage. The same conditions apply, and it's usually costlier than restoring.
- Failure-finding. Test a hidden function to see if it still works. It applies to hidden failures only.
- Run to failure or one-time change. Use these when nothing above is technically possible and worth doing.
This is where RCM connects to the types of maintenance you already run. Preventive, condition-based and breakdown maintenance aren't competing philosophies. They're the possible outputs of this decision.
Why age-based replacement often doesn't work: the six failure patterns
The finding that made RCM famous is about how things fail over time. Nowlan and Heap plotted the probability of failure against age for the nonstructural items in United Airlines' fleet and found six shapes:
| Pattern | Shape | Share of items (Nowlan & Heap, 1978) |
|---|---|---|
| A | Bathtub: high when new, then flat, then rising wear-out | 4% |
| B | Flat, then a clear wear-out zone | 2% |
| C | Slowly rising, no clear wear-out age | 5% |
| D | Low when new, quickly rising to a steady level | 7% |
| E | Constant (random) at every age | 14% |
| F | High when new (infant mortality), then constant | 68% |
Only patterns A, B and C show failure probability rising with age, about 11% of the items studied. For the rest, replacing a part at a fixed age doesn't make it less likely to fail. For pattern F, the largest group, a fresh replacement is more likely to fail early than the old part it replaced.
A caveat that most articles leave out: this is aircraft data from the 1970s. A plant's pumps, gearboxes and conveyors aren't jet components, and you shouldn't quote these percentages as if they describe your equipment. What carries over is the lesson, not the numbers: don't assume a part wears out on a schedule. Check whether it gives a detectable warning first. If it does, inspect for that warning. Only fall back to a fixed replacement interval when you have evidence of age-related wear.
The P-F interval and how often to inspect
On-condition tasks depend on one idea: the P-F interval. Most failures don't happen instantly. There's a point P where a developing failure first becomes detectable, such as a vibration change, a temperature rise, or a drip. Later there's a point F where the asset actually fails. The time between them is the P-F interval.
That interval, not the calendar or the OEM's generic advice, sets how often you inspect. To catch the failure, you need at least one inspection between P and F, with enough time left to plan the repair. A common rule of thumb is to inspect at about half the P-F interval. It's a practice, not a law, and short or uncertain intervals call for more margin.
In the pump example, if your vibration readings show bearing defects becoming visible roughly two months before seizure, a monthly route puts at least one reading inside that window. If the bearings in your plant give only three weeks of warning, monthly is too slow.
This is also why deferred maintenance is riskier than it looks. Skip one inspection on a short P-F interval, and the failure can pass straight from undetected to broken.
For age-related tasks, your failure records do the same job. MTBF and MTTF (see MTTR vs MTBF) tell you how long items actually last in your plant. You can work them out from your own data with the MTBF calculator or the MTTF calculator.
RCM maintenance vs preventive, condition-based and TPM
These terms get compared as if they were alternatives. They work at different levels:
- Preventive maintenance is a task type: work done on a fixed schedule. RCM decides which preventive tasks are worth having, and often removes some.
- Condition-based maintenance is also a task type: inspect, then act on what you find. It's RCM's first choice whenever a failure gives detectable warning.
- Run to failure is a legitimate RCM output for cheap, non-critical failures, as long as it's chosen deliberately.
- TPM (total productive maintenance) is an operating program that brings operators into routine care and loss reduction. It doesn't compete with RCM. In practice, many of the daily checks an RCM analysis produces, like the seal check above, end up on the operator's round.
So "RCM vs PM" is the wrong comparison. RCM is the decision process. PM, condition-based tasks and run to failure are what it decides between.
When full RCM isn't worth it, and what to do instead
A full RCM study is expensive. You need a trained facilitator, people from operations and maintenance away from their normal work, and often several days per system. Doing it across a whole plant at once is how RCM programs stall.
A more practical sequence:
- Rank criticality first. Score each asset on what a failure does to safety, quality and output. A simple A/B/C ranking, like the one in our preventive maintenance schedule guide, is enough to start.
- Do full RCM on the A-list, especially assets with safety consequences, hidden functions (standby units, protective devices, interlocks), or repeated breakdowns.
- Use a lighter review for everything else. For B and C assets, OEM recommendations plus your own breakdown history, checked with the same "what failure does this task prevent?" question, is usually enough.
Be honest about what that lighter review is. SAE JA1011 is explicit that a process skipping any of the seven questions isn't RCM. "RCM-lite" methods can still be useful. Just don't label their output as RCM in an audit or a contract.
Where a CMMS helps
An RCM analysis produces two things: a task list, and a set of assumptions about how your equipment fails. A CMMS doesn't do the analysis for you. Its job is to carry out the task list reliably and to collect the failure data that tells you whether the assumptions were right.
In MachDatum, asset criticality sits on each asset record, so you can pull the A-list straight from the asset register. RCM tasks become PM plans on recurrence schedules, with the procedure attached as a versioned checklist, so the monthly standby-pump test arrives as a work order with its steps already on it. Overdue PMs surface in the PM list, which matters most for failure-finding tasks that are easy to skip because "the standby has never been needed."
The feedback loop is the breakdown work order. Work order workflows can require a failure mode and root cause before a job moves on, so every failure is recorded the same way. At the next review, that history shows which failure modes are actually happening and whether your intervals are right.
We're onboarding our first group of manufacturing teams now. If your PM program has grown by accretion and you want the tasks and the failure history in one place, see how MachDatum CMMS handles assets, PM plans and work orders.
