Nigel S., Chambers S., Johnson R. Operations Management
Подождите немного. Документ загружается.
Part Four Improvement
584
Part of an FMEA exercise at a transportation company has identified three failure modes
associated with the failure of ‘goods arriving damaged’ at the point of delivery:
Goods not secured (failure mode 1)
Goods incorrectly secured (failure mode 2)
Goods incorrectly loaded (failure mode 3).
The improvement group which is investigating the failures allocates scores for the prob-
ability of the failure mode occurring, the severity of each failure mode, and the likelihood
that they will be detected using the rating scales shown in Table 19.2, as follows:
Probability of occurrence
Failure mode 1 5
Failure mode 2 8
Failure mode 3 7
Severity of failure
Failure mode 1 6
Failure mode 2 4
Failure mode 3 4
Probability of detection
Failure mode 1 2
Failure mode 2 6
Failure mode 3 7
The RPN of each failure mode is calculated:
Failure mode 1 (goods not secured) 5 × 6 × 2 = 60
Failure mode 2 (goods incorrectly secured) 8 × 4 × 5 = 160
Failure mode 3 (goods incorrectly loaded) 7 × 4 × 7 = 196
Priority is therefore given to failure mode 3 (goods incorrectly loaded) when attempting
to eliminate the failure.
Worked example
Figure 19.7 Procedure for failure mode and effect analysis (FMEA)
Based on a quantitative evaluation of these three questions, a risk priority number (RPN)
is calculated for each potential cause of failure. Corrective actions, aimed at preventing
failure, are then applied to those causes whose RPN indicates that they warrant priority, see
Figure 19.7.
M19_SLAC0460_06_SE_C19.QXD 10/20/09 9:55 Page 584
Chapter 19 Risk management
585
Table 19.2 Rating scales for FMEA
A. Occurrence of failure
Description Rating Possible failure
occurrence
Remote probability of occurrence 10
It would be unreasonable to expect failure to occur
Low probability of occurrence 2 1:20,000
Generally associated with activities similar to
previous ones with a relatively low number of failures 3 1:10,000
Moderate probability of occurrence 4 1:2,000
Generally associated with activities similar to previous 5 1:1,000
ones which have resulted in occasional failures 6 1:200
High probability of occurrence 7 1:100
Generally associated with activities similar
to ones which have traditionally caused problems 8 1:20
Very high probability of occurrence 9 1:10
Near certainty that major failures will occur 10 1:2
B. Severity of failure
Description Rating
Minor severity 1
A very minor failure which would have no noticeable effect
on system performance
Low severity 2
A minor failure causing only slight customer annoyance 3
Moderate severity 4
A failure which would cause some customer dissatisfaction, 5
discomfort or annoyance, or would cause noticeable 6
deterioration in performance
High severity 7
A failure which would engender a high degree of 8
customer dissatisfaction
Very high severity 9
A failure which would affect safety
Catastrophic 10
A failure which may cause damage to property,
serious injury or death
C. Detection of failure
Description Rating Probability of
detection
Remote probability that the defect will reach the customer 1 0 to 15%
(It is unlikely that such a defect would pass through
inspection, test or assembly)
Low probability that the defect will reach 2 6 to 15%
the customer 3 16 to 25%
Moderate probability that the defect will 4 26 to 35%
reach the customer 5 36 to 45%
6 46 to 55%
High probability that the defect will reach 7 56 to 65%
the customer 8 66 to 75%
Very high probability that the defect will 9 76 to 85%
reach the customer 10 86 to 100%
M19_SLAC0460_06_SE_C19.QXD 10/20/09 9:55 Page 585
Preventing failure occurring
Once a thorough understanding of the causes and effects of failure has been established, the
next responsibility of operations managers is to try to prevent the failures occurring in the
first place. The obvious way to do this is to systematically examine any processes involved
and ‘design out’ any failure points. Many of the approaches used in Chapters 4 and 5 on
process and product/service design and Chapter 17 on quality management can be used to
do this. In this section we will look at three further approaches to reducing risk by trying
to prevent failure: building redundancy into a process, ‘fail-safeing’ some of the activities in
the process, and maintaining the physical facilities in the process.
Redundancy
Building in redundancy to an operation means having back-up systems or components in
case of failure. It can be expensive and is generally used when the breakdown could have
a critical impact. It means doubling or even tripling some parts of a process or system in case
one component fails. Nuclear power stations, spacecraft and hospitals all have auxiliary
systems in case of an emergency. Some organizations also have ‘back-up’ staff held in reserve
in case someone does not turn up for work. Rear-brake lighting sets in buses and trucks
contain two bulbs to reduce the likelihood of not showing a red light. Human bodies contain
two of some organs – kidneys and eyes, for example – both of which are used in ‘normal
operation’ but the body can cope with a failure in one of them. The reliability of a component
together with its back-up is given by the sum of the reliability of the original component and
the likelihood that the back-up component will both be needed and be working.
R
a+ b
= R
a
+ (R
b
× P (failure))
where
R
a+b
= reliability of component a with its back-up component b
R
a
= reliability of a alone
R
b
= reliability of back-up component b
P (failure) = the probability that component a will fail and therefore component b
will be needed.
Redundancy is often used for servers, where system availability is particularly important.
In this context, the industry used three main types of redundancy.
Redundancy
Part Four Improvement
586
The food manufacturer in the earlier worked example has decided that the cheese depos-
itor in the pizza-making machine is so unreliable that it needs a second cheese depositor
to be fitted to the machine which will come into action if the first cheese depositor fails.
The two cheese depositors (each with reliability = 0.9) working together will have a
reliability of:
0.9 + [0.9 × (1 − 0.9)] = 0.99
The reliability of the whole machine is now:
0.95 × 0.99 × 0.97 × 0.99 × 0.98 = 0.885
Worked example
M19_SLAC0460_06_SE_C19.QXD 10/20/09 9:55 Page 586
Chapter 19 Risk management
587
● Hot standby – where both primary and secondary (backup) systems run simultaneously.
The data are copied to the secondary server in real time so that both systems contain
identical information.
● Warm standby – where the secondary system runs in the background to the primary
system. Data are copied to the secondary server at regular intervals, so there are times
when both servers do not contain exactly the same data.
● Cold standby – where the secondary system is only called upon when the primary system
fails. The secondary system receives scheduled data backups, but less frequently than in a
warm standby, so cold standby is mainly used for non-critical applications.
Fail-safeing
The concept of fail-safeing has emerged since the introduction of Japanese methods of
operations improvement. Called poka-yoke in Japan (from yokeru (to prevent) and poka
(inadvertent errors)), the idea is based on the principle that human mistakes are to some
extent inevitable. What is important is to prevent them becoming defects. Poka-yokes are
simple (preferably inexpensive) devices or systems which are incorporated into a process
to prevent inadvertent operator mistakes resulting in a defect. Typical poka-yokes are such
devices as:
● limit switches on machines which allow the machine to operate only if the part is posi-
tioned correctly;
● gauges placed on machines through which a part has to pass in order to be loaded onto,
or taken off, the machine – an incorrect size or orientation stops the process;
● digital counters on machines to ensure that the correct number of cuts, passes or holes
have been machined;
● checklists which have to be filled in, either in preparation for, or on completion of, an
activity;
● light beams which activate an alarm if a part is positioned incorrectly.
More recently, the principle of fail-safeing has been applied to service operations. Service
poka-yokes can be classified as those which ‘fail-safe the server’ (the creator of the service)
and those which ‘fail-safe the customer’ (the receiver of the service). Examples of fail-safeing
the server include:
● colour-coding cash register keys to prevent incorrect entry in retail operations;
● the McDonald’s french-fry scoop which picks up the right quantity of fries in the right
orientation to be placed in the pack;
● trays used in hospitals with indentations shaped to each item needed for a surgical
procedure – any item not back in place at the end of the procedure might have been left
in the patient;
● the paper strips placed round clean towels in hotels, the removal of which helps house-
keepers to tell whether a towel has been used and therefore needs replacing.
Examples of fail-safeing the customer include:
● the locks on aircraft lavatory doors, which must be turned to switch the light on;
● beepers on ATMs to ensure that customers remove their cards;
● height bars on amusement rides to ensure that customers do not exceed size limitations;
● outlines drawn on the walls of a childcare centre to indicate where toys should be replaced
at the end of the play period;
● tray stands strategically placed in fast-food restaurants to remind customers to clear their
tables.
Fail-safeing
Poka-yoke
M19_SLAC0460_06_SE_C19.QXD 10/20/09 9:55 Page 587
Maintenance
Maintenance is how organizations try to avoid failure by taking care of their physical facilities.
It is an important part of most operations’ activities particularly in operations dominated by
their physical facilities such as power stations, hotels, airlines and petrochemical refineries.
The benefits of effective maintenance include enhanced safety, increased reliability, higher
quality (badly maintained equipment is more likely to cause errors), lower operating costs
(because regularly serviced process technology is more efficient), a longer lifespan for process
technology, and higher ‘end value’ (because well-maintained facilities are generally easier to
dispose of into the second-hand market).
The three basic approaches to maintenance
In practice an organization’s maintenance activities will consist of some combination of
the three basic approaches to the care of its physical facilities. These are run to breakdown
(RTB), preventive maintenance (PM) and condition-based maintenance (CBM).
Run-to-breakdown maintenance – as its name implies involves allowing the facilities to con-
tinue operating until they fail. Maintenance work is performed only after failure has taken
place. For example, the televisions, bathroom equipment and telephones in a hotel’s guest
rooms will probably only be repaired when they fail. The hotel will keep some spare parts and
the staff available to make any repairs when needed. Failure in these circumstances is neither
catastrophic (although perhaps irritating to the guest) nor so frequent as to make regular
checking of the facilities appropriate.
Preventive maintenance attempts to eliminate or reduce the chances of failure by servicing
(cleaning, lubricating, replacing and checking) the facilities at pre-planned intervals. For example,
the engines of passenger aircraft are checked, cleaned and calibrated according to a regular
schedule after a set number of flying hours. Taking aircraft away from their regular duties for
preventive maintenance is clearly an expensive option for any airline. The consequences of failure
while in service are considerably more serious, however. The principle is also applied to facilities
with less catastrophic consequences of failure. The regular cleaning and lubricating of machines,
even the periodic painting of a building, could be considered preventive maintenance.
Maintenance
Run-to-breakdown
maintenance
Preventive maintenance
Part Four Improvement
588
Much of the previous discussion surrounding the prevention of failure has assumed a
‘rational’ approach. In other words, it is assumed that operations managers and customers
alike will put more effort into preventing failures that are either more likely to occur or more
serious in their consequences. Yet this assumption is based on a rational response to
risk. In fact, being human, managers often respond to the perception of risk rather than its
reality. For example, Table 19.3 shows the cost of each life saved by investment in various
road and rail transportation safety (in other words, failure prevention) investments. The
table shows that investing in improving road safety is very much more effective than
investing in rail safety. And while no one is arguing for abandoning efforts on rail safety,
it is noted by some transportation authorities that actual investment reflects more the
public perception of rail deaths (low) compared with road deaths (very high).
Critical commentary
Table 19.3 The cost per life saved of various safety (failure prevention) investments
Safety investment Cost per life (BM)
Advanced train protection system 30
Train protection warning systems 7.5
Implementing recommended guidelines on rail safety 4.7
Implementing recommended guidelines on road safety 1.6
Local authority spending on road safety 0.15
M19_SLAC0460_06_SE_C19.QXD 10/20/09 9:55 Page 588
Chapter 19 Risk management
589
Condition-based
maintenance
Figure 19.8 A mixture of maintenance approaches is often used – in a car, for example
Condition-based maintenance attempts to perform maintenance only when the facilities
require it. For example, continuous process equipment, such as that used in coating photo-
graphic paper, is run for long periods in order to achieve the high utilization necessary for
cost-effective production. Stopping the machine to change, say, a bearing when it is not strictly
necessary to do so would take it out of action for long periods and reduce its utilization.
Here condition-based maintenance might involve continuously monitoring the vibrations,
for example, or some other characteristic of the line. The results of this monitoring would
then be used to decide whether the line should be stopped and the bearings replaced.
Mixed maintenance strategies
Each approach to maintaining facilities is appropriate for different circumstances. RTB is
often used where repair is relatively straightforward (so the consequence of failure is small),
where regular maintenance is very costly, or where failure is not at all predictable (failure is
just as likely to occur after repair as before). PM is used where the cost of unplanned failure
is high and where failure is not totally random. CBM is used where the maintenance activity
is expensive, either because of the cost of providing the maintenance itself, or because of the
disruption which the maintenance activity causes to the operation. Most operations adopt a
mixture of these approaches. Even an automobile uses all three approaches (see Fig. 19.8).
Light bulbs and fuses are normally replaced only when they fail. Engine oil is subject to
preventive maintenance at a regular service. Finally, most drivers also monitor the condition
of the auto, for example by measuring the amount of tread on the tyre.
Breakdown versus preventive maintenance
The balance between preventive and breakdown maintenance is usually set to minimize
the total cost of breakdown. Infrequent preventive maintenance will cost little to provide but
will result in a high likelihood (and therefore cost) of breakdown maintenance. Conversely,
very frequent preventive maintenance will be expensive to provide but will reduce the cost
of having to provide breakdown maintenance (see Fig. 19.9a). The total cost of maintenance
appears to minimize at an ‘optimum’ level of preventive maintenance. However, the cost
of providing preventive maintenance may not increase quite so steeply as indicated in
Figure 19.9(a). The curve assumes that it is carried out by a separate set of people (skilled
maintenance staff ) from the ‘operators’ of the facilities. Furthermore, every time preventive
maintenance takes place, the facilities cannot be used productively. This is why the slope
of the curve increases, because the maintenance episodes start to interfere with the normal
working of the operation. But in many operations some preventive maintenance can be
performed by the operators themselves (which reduces the cost of providing it) and at times
M19_SLAC0460_06_SE_C19.QXD 10/20/09 9:55 Page 589
which are convenient for the operation (which minimizes the disruption to the operation).
The cost of breakdowns could also be higher than is indicated in Figure 19.9(a). Unplanned
breakdowns may do more than necessitate a repair and stop the operation; they can take
away stability from the operation which prevents it being able to improve itself. Put these
two ideas together and the minimizing total curve and maintenance cost curve look more
like Figure 19.9(b). The emphasis is shifted more towards the use of preventive maintenance
than run-to-breakdown maintenance.
Total productive maintenance
Total productive maintenance (TPM) is ‘the productive maintenance carried out by all
employees through small group activities’, where productive maintenance is ‘maintenance
management which recognizes the importance of reliability, maintenance and economic
efficiency in plant design’.
9
In Japan, where TPM originated, it is seen as a natural extension
in the evolution from run-to-breakdown to preventive maintenance. TPM adopts some of
the team-working and empowerment principles discussed in Chapter 9, as well as a con-
tinuous improvement approach to failure prevention as discussed in Chapter 18. It also sees
maintenance as an organization-wide issue, to which staff can contribute in some way. It is
analogous to the total quality management approach discussed in Chapter 17.
The five goals of TPM
TPM aims to establish good maintenance practice in operations through the pursuit of ‘the
five goals of TPM’:
9
1 Improve equipment effectiveness by examining all the losses which occur.
2 Achieve autonomous maintenance by allowing staff to take responsibility for some of the
maintenance tasks and for the improvement of maintenance performance.
3 Plan maintenance with a fully worked out approach to all maintenance activities.
4 Train all staff in relevant maintenance skills so that both maintenance and operating staff
have all the skills to carry out their roles.
5 Achieve early equipment management by ‘maintenance prevention’ (MP), which involves
considering failure causes and the maintainability of equipment during its design, manu-
facture, installation and commissioning.
Total productive
maintenance
Part Four Improvement
590
Figure 19.9 Two views of maintenance costs. (a) One model of the costs associated with preventive maintenance
shows an optimum level of maintenance effort. (b) If routine preventive maintenance tasks are carried out by
operators and if the real cost of breakdowns is considered, the ‘optimum’ level of preventive maintenance shifts
toward higher levels
M19_SLAC0460_06_SE_C19.QXD 10/20/09 9:55 Page 590
Chapter 19 Risk management
591
Reliability-centred
maintenance
Reliability-centred maintenance
Reliability-centred maintenance (RCM) uses the pattern of failure for each type of failure
mode of a part of a system to dictate the approach to its maintenance. For example, take
the process illustrated in Figure 19.10. This is a simple shredding process which prepares
vegetables prior to freezing. The most significant part of the process, which requires the
most maintenance attention, is the cutter sub-assembly. However, there are several modes of
failure which could lead to the cutters requiring attention. Sometimes they require changing
simply because they have worn out through usage, sometimes they have been damaged by
small stones entering the process, sometimes they have shaken loose because they were
not fitted correctly. The failure patterns for these three failure modes are very different, as
illustrated in Figure 19.10. Certainly, ‘wear-out’ can be managed by timing preventive main-
tenance intervals just prior to the increased likelihood of failure. But this approach would
not help prevent stone damage which could happen at any time with equal likelihood. The
approach here would be to prevent stones getting to the cutters in the first place, perhaps
through fixing a screen. The failure pattern for the cutters shaking loose is different again.
If the cutters have been incorrectly fitted, it would become evident soon after the fitting.
Again, preventive maintenance is unlikely to help here; rather effort should be put into
ensuring that the cutters are always correctly fitted, perhaps by organizing more appropriate
training of staff. The approach of RCM is sometimes summarized as ‘If we cannot stop it
from happening, we had better stop it from mattering’. In other words, if maintenance can-
not either predict or even prevent failure, and the failure has important consequences, then
efforts need to be directed at reducing the impact of the failure.
Figure 19.10 One part in one process can have several different failure modes, each of which requires a different
approach
M19_SLAC0460_06_SE_C19.QXD 10/20/09 9:55 Page 591
Mitigating the effects of failure
Risk, or failure, mitigation means isolating a failure from its negative consequences. It is
an admission that not all failures can be avoided. However, in some areas of operations
management relying on mitigation, rather than prevention, is unfashionable. For example,
‘inspection’ practices in quality management were based on the assumption that failures were
inevitable and needed to be detected before they could cause harm. Modern total quality
management places much more emphasis on prevention. Yet, in operations and process
resilience, mitigation can be vital when used in conjunction with prevention in reducing
overall risk.
Part Four Improvement
592
Back in 1853 Elisha Graves Otis introduced the world’s
first safety elevator in Yonkers, New York. It was to have
a remarkable impact on the world’s skylines. Without
elevators, the skyscraping buildings that dominate
most modern cities would probably never have been
developed. Given the number of elevators in regular use
throughout the world and the Otis Company’s position
as a leading supplier, Otis is the world’s leading people
mover. And Otis is very much aware that every time we
enter an elevator we are trusting our lives to the people
who designed and made it, and, more immediately, the
people who maintain it. Without effective maintenance
the elevators which are often on duty every minute of
every day would literally be death traps. Central to the
Otis philosophy of maintenance is its ‘Otis Maintenance
Management System’ (OMMS), a programme that
takes into account its clients’ elevators’ maintenance
needs. Using this system Otis can customize inspection
and maintenance schedules for up to twelve years of
operation or five million trips in advance. Maintenance
procedures are determined by each elevator’s individual
pattern of use. Frequency of trips, the loads carried by
the elevator and conditions of use, are all incorporated
to determine the frequency and nature of maintenance
activities. Because no component part of any
equipment is perfect, Otis also monitors the life
cycle characteristics of all its elevators’ components.
This information on wear and failure is made available
to its customers via its twenty-four communications
centre and web site. This ongoing understanding of
component life also is used to update maintenance
schedules.
Short case
Lifting maintenance
performance
10
With Otis’s call service, when an elevator has a
problem, a technician can be on their way to a customer’s
facility within minutes. Its twenty-four-hours-a-day,
seven-days-a-week service which handles over 1.2 million
calls a year can get the elevators back in service on
average within two and half hours. Also the Otis on-site
monitoring equipment system is a sophisticated and
interconnected system of sensors, monitors, hardware
and software that collects, records, analyses and
communicates hundreds of different system functions.
If the system detects a problem it automatically makes
a service call, calling out a technician who has been
provided with the information collected by the system
and that will be used to help identify the component
causing the problem. ‘Around-the-clock response is
important’, says Otis, ‘because problems don’t keep
office hours . . . [the remote sensing] . . . system detects
deteriorating components, identifies intermittent
anomalies, notes the small nuisances that . . . would
have gone undetected. . . . It identifies most potential
problems before they occur.’
Source: Alamy Images
M19_SLAC0460_06_SE_C19.QXD 10/20/09 9:55 Page 592
Failure recovery
Chapter 19 Risk management
593
Risk mitigation actions
The nature of the action taken to mitigate failure will obviously depend on the nature of
the risk. In most industries technical experts have established a classification of risk mitiga-
tion actions that are appropriate for the types of risk likely to be suffered. So, for example, in
agriculture, government agencies and industry bodies have published mitigation strategies
for such risks as the outbreak of crop disease, contagious animal infections, and so on.
Such documents will outline the various mitigation actions that can be taken under different
circumstances and detail exactly who are responsible for each action. Although these classifica-
tions tend to be industry-specific, the following generic categorization gives a flavour of the
types of mitigation actions that may be generally applicable.
Mitigation planning is the activity of ensuring that all possible failure circumstances have
been identified and the appropriate mitigation actions identified. It is the overarching activity
that encompasses all subsequent mitigation actions, and may be described in the form of a
decision tree or guide rules.
Economic mitigation includes actions such as insurance against losses from failure, spread-
ing the financial consequences of failure, and ‘hedging’ against failure. Insurance is the best
known of these actions and is widely adopted, although ensuring appropriate insurance and
effective claims management is a specialized skill in itself. Hedging often takes the form
of financial instruments, for example, a business may purchase a financial ‘hedge’ against the
price risk of a vital raw material deviating significantly from a set price.
Containment (spatial) means stopping the failure physically spreading to affect other parts
of an internal or external supply network. Preventing contaminated food from spreading
through the supply chain, for example, will depend on real-time information systems that
provide traceability data.
Containment (temporal) means containing the spread of a failure over time. It particularly
applies when information about a failure or potential failure needs to be transmitted without
undue delay. For example, systems that give advanced warning of hazardous weather such as
snow storms must transmit such information to local agencies such as the police and road
clearing organizations in time for them to stop the problem causing excessive disruption.
Loss reduction covers any action that reduces the catastrophic consequences of failure by
removing the resources that are likely to suffer those consequences. For example, the road
signs that indicate evacuation routes in the event of severe weather, or the fire drills that
train employees in how to escape in the event of an emergency, may not reduce all the con-
sequences of failure, but can help in reducing loss of life or injury.
Substitution means compensating for failure by providing other resources that can substitute
for those rendered less effective by the failure. It is a little like the concept of redundancy that
was described earlier, but does not always imply excess resources if a failure has not occurred.
For example, in a construction project, the risk of encountering unexpected geological prob-
lems may be mitigated by the existence of a separate work plan and that is invoked only if
such problems are found.
Recovering from the effects of failure
In parallel with considering how to prevent failures occurring, operations managers need to
decide what they will do when failures do occur. This activity is called failure recovery. All
types of operation can benefit from well-planned recovery. For example, a construction com-
pany whose mechanical digger breaks down can have plans in place to arrange a replacement
from a hire company. The breakdown might be disruptive, but not as much as it might have
M19_SLAC0460_06_SE_C19.QXD 10/20/09 9:55 Page 593