Concepts

Tasks

Settings

Overview of Risk Analysis

APM maintenance task analysis supports two types of risk analysis:

•	Failure mode risk analysis is performed on the failure mode as a whole

•	Demand scenario risk analysis is performed on each demand scenario identified for the failure mode

This topic explains each type and the concepts that are common to them.

Failure Mode Risk Analysis

In the process of evaluating a failure mode, you can quantify the relative risk (criticality) associated with the failure by evaluating the consequences (severity of the effect), the probability of the failure occurring, and (optionally) the failure’s detectability, assigning values for each factor. APM then calculates the relative risk by multiplying the severity value by the probability value, and then by the detectability value, if it is used.

When the relative risk is established, APM calculates the failure mode’s consequence priority using a set of customer-defined rules. The consequence priority rules can be based on the failure mode’s severity, relative risk, downtime costs, downtime duration, or a combination. For example, the Extreme priority could be assigned to failure modes whose total severity is equal to 5.0.

After you have analyzed the failure modes, you can compare failure modes and identify the relative importance of addressing them. The Risk Assessment view in the Strategy Development Analysis window includes failure mode lists based on criticality, consequence priority, severity, and relative risk, as well as a risk plot, risk matrix, and lists of the evaluations. This view is also available for the asset.

APM provides two ways to perform failure mode risk analysis:

•	Using a simple evaluation that allows you to enter weighted severity values, probability values, and confidence factors

•	Using evaluation forms for in-depth analysis of consequences

With both methods, APM calculates the relative risk and displays it in the risk matrix chart. The method available in the Maintenance Action Plan window depends on the option selected in the analysis’ risk analysis settings.

Before you can perform risk assessments, the severities, probabilities, failure mode consequence priorities, and risk matrix entries must be set up in the site’s Strategy Development settings. For more information, see Risk Analysis Settings.

Demand Scenario Risk Analysis

APM provides a method of performing risk analysis on safety devices that protect equipment, people, and environments from events such as pressure build-up, fire, or equipment failure. Risk analysis is performed on one or more demand scenarios identified on the failure mode.

A demand scenario is a situation that requires that an asset, such as a safety device, be put into operation. Examples of demand scenarios are fire, power failure, and blocked outlet.

Probability Based on Likelihood of Failure and Demand Rate

When demand scenario analysis is performed, probability of failure is based on the likelihood of failure and demand rate. The analysis team determines the probability by:

•	Identifying the likelihood of the failure occurring based on past history or industry experience. This value describes how often the asset has been required to operate. An example of likelihood of failure is “Has happened at this location more than once in the last two years”.

•	Completing a confidence evaluation that quantifies the team’s faith in the current maintenance or inspection practices to contain the demand scenario’s risk. The confidence factor can adjust the likelihood of failure up or down.

•

Identifying one or more demand scenarios. These are the situations that result in the safety device being required. For each scenario, a demand rate is also selected. The demand rate is the frequency with which the scenario is likely to occur. Demand rates are typically defined in terms of 0-0.5 year, 0.5-1.0 year, and so on.

•	The demand rate with the highest criticality is used with the likelihood of failure to determine the probability of failure. APM uses the probability matrix to ascertain the result, and the selected probability of failure is added to the failure mode.

Demand Scenarios and the Failure Mode

The analysis team can then use questionnaires to evaluate the severity of consequences (health and safety, economic, environmental, reputation) to arrive at the demand scenario’s relative risk (criticality). APM uses the demand scenario with the highest criticality to represent the failure mode.

For information about setting up probability questionnaires and matrices, as well as likelihood of failure values, demand rates, and scenarios, see Failure Probability Settings.

The rest of this topic provides more detail about risk analysis concepts.

Risk (Criticality)

The risk number is calculated for the failure mode as the product of the Total failure mode consequence severity, the probability of failure, and (optionally) detectability.

Risk = Severity * Probability * Detectability

Severity

Failure severity measures the consequences when a failure occurs. Severity can be described in terms of health and safety, environmental, reputation, and economic categories and is usually described as:

•

Severe

•

High

•

Medium

•

Low

•	Negligible

An impact statement and numerical value are associated with each severity value defined in APM. The higher the number, the more severe the effect. Economic impact can also be associated with each severity value to help determine avoidance savings and maintenance feasibility.

Probability of Failure

The probability of failure is the likelihood that the asset will fail due to the failure mode. There are three ways to evaluate probability:

•	Using a probability evaluation questionnaire

•	Based on the estimated time between failure

•	Based on the likelihood of failure and demand rate

Probability is usually described as high, medium, low, or negligible.

Detectability

“Detectability” refers to the ability of the system or process to detect a hazardous event. Lower scores are used for failures that are easy to detect and higher scores for failures that are harder to detect. When support for detectability is enabled in an analysis, the relative risk calculation becomes:

(Economic severity score + Health and safety severity score + Environmental severity score + Reputation severity score) * Probability score * Detectability score = Relative Risk Number

Consequences

For each important failure mode, the severity of the consequences of failure must be determined. Consequences are categorized:

•	Economic effects

•	Health and safety effects

•	Environmental effects

•	Reputation effects

Each of these consequence categories is assigned a value. The sum of the values in all categories is used in the calculation of the consequence assessment.

Economic Consequences

The economic consequence of failure reflects the financial effect of the failure on assets and production. Labor and material costs associated with lost production and with repairing or replacing the damaged equipment are economic consequences.

Costs associated with health or safety or environmental consequences are not included as economic consequences. For example, clean-up costs incurred as a result of a spill are not considered as an economic consequence.

Health and Safety Consequences

Equipment failure can cause hazards in the workplace. Examples are extreme temperatures or pressure or noxious fumes. It is important to note that mitigating factors are considered when assessing health and safety consequences:

•	The frequency of the hazard occurring and duration of exposure of people in the hazard zone

•	The possibility of averting the hazardous event

The following are examples of health and safety consequences:

Potential Impact	Description
No / slight injury	First aid or medical treatment, not affecting work performance or causing disability
Minor injury	Lost time injury affecting work performance such as modified work duties or time off work to recover
Major injury	Includes permanent partial disability, affecting long-term work performance. May include extended absence from work and damage to health such as chronic back injuries, sight or hearing loss.
Fatalities	May include single or multiple fatalities in close succession to the incident.

Environmental Consequences

Environmental incidents are an important category to consider when determining overall consequence. Typically, two types of environmental incidents are considered:

•	Release of liquids that may cause soil and water pollution

•	Release of gases that may cause atmospheric pollution

Several levels of consequence evaluation are taken into account, as shown in the table below:

Potential Impact	Description
No / slight effect	Local environmental damage, usually within the enclosed space or system. Negligible financial impact.
Minor effect	Contamination; damage sufficient to attack the environment. Typically a single complaint or single breach of statutory limits.
Localized effect	Limited loss of known toxic discharge but repeated breaches of statutory limits. Damage affects areas outside the enclosed space.
Major effect	Severe environmental damage. Extensive measures are required to restore the contaminated environment. Extended breach of statutory limits.
Massive effect	Persistent severe environmental damage or nuisance extending over a large area. A major loss to the organization in terms of commercial, recreational, or nature conservancy. Constant or extremely numerous breaches of statutory limits.

Reputation Consequences

Consequences to reputation measure the impact that negative media attention has on an organization’s ability to operate in good faith. Typically, the severity of bad press is evaluated in terms of how far-reaching it is and how long it takes to mitigate, as shown in the table below:

Potential Impact	Description
No / slight effect	Negative local press for less than a week
Minor effect	Negative provincial or state press for a week or more
Medium effect	Negative national press for a week or more
Major effect	Negative international press for a month
Severe effect	Negative international/national press for more than one month

Failure Mode Consequence Priorities

APM calculates a consequence priority for the failure mode during risk analysis or for the failure during RCA evaluation. Consequence priorities allow you to rank and compare an asset’s failure modes and failures. In failure analysis, the consequence priority is used in the calculation that determines whether the failure is suitable for RCA.

The rules defined for a priority can be based on any of these properties:

•	Downtime cost – the total downtime cost of the failure mode or failure is used. The total downtime cost is the sum of the downtime occurrence cost and the downtime rate costs times the length of the downtime:

Downtime Cost = Downtime Occurrence Costs + (Downtime Rate * Downtime Duration)

•	Downtime duration

•	Failure cost

•	Relative risk (risk analysis only)

•	Severity, which can include the sum, minimum, or maximum value for any or all of:

•	Health and safety consequences

•	Economic consequences

•	Environmental consequences

•	Reputation consequences

•	Failure mode consequences (risk analysis only)

The failure mode is assigned the highest ranking consequence priority for which it satisfies the priority’s rules.

As an example, suppose a set of three consequence priorities. To simplify the example, the rules are based on a single property (total severity). In practice, the rules can be more complex and involve multiple properties and rule groups.

Priority	Rank	Rule
High	3	Total severity is at least 12
Medium	2	Total severity is at least 6
Low	1	Total severity is at least 0

A failure mode with a severity of 14 is assigned the consequence priority High. Although it satisfies the rules for each of the consequence priorities, it is assigned High because that is the highest ranking priority.

Risk Matrix

Criticality or risk is defined as the combination of two parameters: the likelihood or probability of failure and the consequences of failure. The risk matrix displays this combination, typically with four or five criticality levels and four or five probability levels. For example:

This example contains the following probability, consequence, priority, and criticality values.

Probability of Failure

Possible values are:

•	Frequent (<1 year) – Very High (5.00)

•	Probable (1-3 years) – High (4.00)

•	Possible (3-10 years) – Medium (3.00)

•	Unlikely (10-30 years) – Low(2.00)

•	Remote (> 30 years) – Very low (1.00)

Consequence Categories

Possible values are:

•

Economic

•	Damage < $100K Minor upset (1.00)

•	Damage $100K Major upset (2.00)

•	Damage $1M-10M Unit outage (3.00)

•	Damage $10M-100M Unit outage >1 week (4.00)

•	Asset loss >$100M Unit outage >1 month (5.00)

•	Health and Safety

•	First-aid injury (1.00)

•	Medical-aid injury (2.00)

•	Lost-time injury (3.00)

•	Single fatality or permanent disability (4.00)

•	Multiple fatalities (5.00)

•	Environmental

•	Minor incident (1.0)

•	Reportable incident (2.0)

•	Minor permit violation (3.00)

•	Major permit violation (4.00)

•	Loss of permit (5.00)

•	Reputation

•	Local (1.0)

•	Province-wide (2.0)

•	Industry-wide (3.00)

•	National (4.00)

•	International (5.00)

Consequences

Possible values are:

•	Negligible – Any of (Environmental, Operational, Safety, Reputation) Is equal to 1.00

•	Low – Any of (Environmental, Operational, Safety, Reputation) Is equal to 2.00

•	Medium – Any of (Environmental, Operational, Safety, Reputation) Is equal to 3.00

•	High – Any of (Environmental, Operational, Safety, Reputation) Is equal to 4.00

•	Severe – Any of (Environmental, Operational, Safety, Reputation) Is at least 5.00

Criticality Rating

The criticality that is selected is the most severe combination of consequence priority and probability. For example, the Medium-high (MH) criticality is selected when the consequence priority is High and the probability of failure is Medium.

The ratings require corresponding responses. Negligible criticality can result in no formal inspection plan. Failure modes with low to medium-high criticalities usually require inspection plans. High and extreme criticalities can call for detailed analysis that can result in equipment redesign or further mitigating factors.

Demand Scenarios and Confidence Factors

Confidence questionnaires are used to measure the analysis team’s faith in current maintenance or inspection practices to contain the failure mode’s risk. Confidence statements can include things like:

•	Is the equipment degradation mechanism stable and properly controlled?

•	Have multiple reliable inspections been performed?

•	Are the relevant process parameters reliably monitored?

The result of the evaluation is a confidence factor, which can adjust the inspection factor or likelihood of failure up or down. 

The confidence rating reflects the confidence that the inspector and materials or corrosion engineer have in the likelihood of failure. The rating depends on:

•	The expert’s judgment on the stability and control of the failure modes

•	The number and quality of inspections

•	Whether reliable process (integrity operating window) monitoring is carried out

Confidence ratings range from very high to very low. These are parameters used in determining inspection intervals or process monitoring. Confidence rating scores are summed with the maximum value being 2.0.

Confidence Rating Score	Confidence Rating
2.00	Very high
1.00	High
0.00	Medium
-1.00	Low
-2.00	Very low

In this example, the age-related degradation confidence statements are as follows:

Statement	Yes	Intermediate	No
Degradation mechanism is stable and can be properly controlled	1.0	0.00	-1.0
Multiple reliable inspections have been carried out	1.0	0.00	-1.0
Relevant process parameters are reliably monitored	1.0	0.00	-1.0

The non-age-related degradation confidence statements are:

Statement	Yes	Intermediate	No
Degradation mechanism can be properly controlled	1.0	0.00	-1.0
Relevant process parameters are reliably monitored	1.0	0.00	-1.0
Reliable inspections have been carried out	1.0	0.00	-1.0

Risk Plot Chart

Risk plot charts provide a visual representation of an asset’s unmitigated (or initial) risk based on severity (consequence) and probability of failure. The risk value is determined by asset prioritization or strategy development analysis. If a feasibility evaluation is performed on a failure mode, the chart also shows the mitigated (or residual) risk.

The risk plot chart can appear in the following locations:

•	Asset Prioritization Analysis window, Worksheet and Summary views

•	Maintenance Action Plan window, Criticality and Feasibility views (MTA2, RCM2, RBI analyses)

•	Strategy Development Analysis window, Risk Assessment view, Risk Plot tab

Risk plot lines indicate risk tolerance levels to provide context for analysis results. Tolerance levels can be shown as a single plot line or as color areas. Here is an example of a chart that shows a single risk plot line:

Risk plot charts support as many as five color areas (named Extreme, High, Medium, Low, Negligible). The default colors for the areas provided with APM are purple, red, orange, yellow, and green, respectively. Here is an example of a chart from a strategy development analysis: