Reliability Engineering and System Safety 82 (2003) 257273

www.elsevier.com/locate/ress

Applying RCM in large scale systems: a case study with railway networks
Jesus Carreteroa,*, Jose M. Pereza, Felix Garca-Carballeiraa, Alejandro Calderona,
Javier Fernandeza, Jose D. Garcaa, Antonio Lozanob, Luis Cardonab,
Norberto Cotainac, Pierre Pretec
a
b

Department of Computer Science and Engineering, Universidad Carlos III de Madrid, Avda Universidad 30, Leganes, 28911 Madrid, Spain
Infrastructure Maintenance Division, RENFE (Red Nacional de Ferrocarriles Espanoles), Edificio 22, Estacion de Chamartn, Madrid, Spain
c
ADEPA, Rue Perier 17, Montrouge, Paris, France
Received 22 November 2002; revised 28 January 2003; accepted 26 June 2003

Abstract
In 2000, the European Union founded a project named RAIL: Reliability centered maintenance approach for the infrastructure and logistics
of railway operation aimed to study the application of Reliability centered maintenance (RCM) techniques to the railway infrastructure. In this
paper, we present the results obtained into the RAIL project, including a RCM methodology adapted to large infrastructure networks and a
RCM toolkit to perform the RCM analysis, including cost aspects and maintenance planning guidance. This paper addresses the problem of
applying RCM to large scale railway infrastructure networks to achieve an efficient and effective maintenance concept. Railways use nowadays
very traditional preventive maintenance (PM) techniques, relying mostly on blind periodic inspection and the know-how of maintenance
staff. RCM was seen as a promising technique from the beginning of the RAIL project because of several factors. First, technical insights
obtained were better than the existing, so that several maintenance processes could be revised and adjusted. Second, the interdisciplinary
approach used to make the analysis was very enriching and very encouraging for maintenance staff consulted. Third, using the RCM structured
approach allowed to achieve well-documented analysis and clear decision diagrams. Our methodology includes some new features to
overcome the problems of RCM observed in other projects. As a whole, our methodology and Computerized Maintenance Management
Systems have produced two short-term benefits: reduction of time and paperwork because databases and tools are accessible through Internet,
and creation of a permanent, accurate, and better collection of information. It will also have some long-term benefits: better PM will increase
equipment life and will help to reduce corrective maintenance costs; Production will increase as unscheduled downtime decreases; purchase
costs of parts and materials will be reduced; more effective and up-to-date record of inventory/stores reports; and better knowledge of the
systems to help the company to chose those systems with the best LCC. The results have been corroborated with the application of our
methodology to signal equipment in several railway network sections, as shown in this paper. Because of the successful conclusion of the
project, the Spanish railway company (RENFE) and the German railway company (DB A.G.), not only decided to adopt RCM to enhance PM,
but they have started a large project to implement Total Preventive Maintenance relying on the implantation of the RCM methodology.
q 2003 Elsevier Ltd. All rights reserved.
Keywords: Reliability centered maintenance; Railway maintenance; Reliability; Computerized maintenance management systems; Maintenance planning

1. Introduction
In 2000, the European Union founded a project named
RAIL: Reliability centered maintenance approach for the
infrastructure and logistics of railway operation aimed to
study the application of Reliability Centered Maintenance
(RCM) techniques [2,14] to the railway infrastructure,
following the success of RCM in other industrial fields [1,4],
* Corresponding author. Fax: 34-91-62-49-129.
E-mail address: jcarrete@arcos.inf.uc3m.es (J. Carretero).
0951-8320/$ - see front matter q 2003 Elsevier Ltd. All rights reserved.
doi:10.1016/S0951-8320(03)00167-4

such as aviation [17], oil industry [19] or ships [26].

The reason for the project was that railway maintenance had
been traditionally planned using the knowledge and
experience of each company, but without any kind of
reliability based methodology to support the maintenance
plans and works. Some attempts to use RCM in railways,
like the REMAIN [32] project or the Norway railways [29]
were not adopted by the companies, probably due to their
very ambitious goals.
As a result, each railway company has today its own
maintenance procedures, which, in general, would not be

258

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

accepted by other companies and are not economically

optimized [25]. This situation arises because railway
companies are very traditional in their procedures and
because, historically, railway infrastructures have been
designed in order to procure a significant level of safety.
As a result, maintenance developed was Breakdown
Maintenance, devoted to bring back the systems to a perfect
state before it malfunctions, and train delays or revenues,
for example, were not the major issue. To maintain an
efficiently operating infrastructure and to avoid failure of
critical equipments, especially signaling equipment, the
focus has clearly shifted over the years to Preventive
Maintenance (PM), devoted to fix the equipment according
to planned maintenance schedule. Nowadays, many railway
companies have to satisfy rules provided by safety
regulation authorities, that, in several countries, define
maintenance procedures and even the frequencies for PM.
However, railway is competing with other forms of
transport today, and railway companies are being split to
provide transport services on a side and infrastructure
services on another. Now, customers want the best quality of
service at the lower cost, forcing the railway companies to
optimize every stage of the process, including maintenance.
The railway companies themselves are starting to outsource
some maintenance services, facing that business without
any kind of methodology to be applied to test the
correctness of maintenance procedures.
In this paper, we present the results obtained into the
RAIL project, including a RCM methodology [15] adapted
to large infrastructure networks and a RCM toolkit to
accomplish the RCM analysis, including cost aspects.
A description of the RCM methodology, templates design,
Computerized Maintenance Management Systems (CMMS)
tools and databases, and a test case of maintenance planning
will be presented in this paper. Section 2 briefly describes
the RCM methodology. Section 3 shows the RCM
methodology adapted to railways into the RAIL project.
Section 4 briefly describes the CMMS toolkit developed on
the RAIL project. Section 5 shows some implementation
results and maintenance optimization for a test case. And,
finally, Section 6 highlights the major conclusions extracted
from our experience.

during the 1980s and the 1990s, being now extended to

several industry fields.
But, what is RCM? There are very good definitions of
RCM in the literature [2,15,23,27]. In short, RCM can be
defined as a systematic approach to systems functionality,
failures of that functionality, causes and effects of failures,
and infrastructure affected by failures. Once the failures are
known, the consequences of them must be taken into
account. Consequences are classified in: safety and
environmental, operational (delays), non-operational,
and hidden failure consequences. Later, those categories
are used as the basis of a strategic framework for
maintenance decision-making. The decision-making
process is used in order to select the most appropriate task
to maintain a system filtering the proposed classification of
consequences through a logic decision tree. In the 1970s,
and still today, RCM was a major challenge in many
industries because it changed the focus of PM from bringing
back the systems to a perfect state to maintaining the
system in a good functional state (within some defined
operational limits). Through this approach, it provides an
understanding of how infrastructure works, what it can
(or cannot) achieve, and the causes of failures. Fig. 1 shows
the major steps of RCM methodology and their outcomes.
RCM methodology [14,15] has three major goals.
First one is to enhance safety and reliability of systems by
focusing on the most important functions. RCM is
concerned mainly with what we want the equipment to
do, not what it actually does. Second is to prevent or to
mitigate the consequences of failures, not to prevent the
failures themselves. The consequences of a failure differ
depending on where and how items are installed and
operated. Third one is to reduce maintenance costs by
avoiding or removing maintenance actions that are not

2. What is RCM?
The concepts behind RCM are not new, having their
origin in the airline industry back in the 1960s. After several
years of experience, in 1978, the US Department of Defense
issued the MSG-3 [16], an Airline/Manufacturers
Maintenance Program Planning Document. That year,
Nowlan and Heap wrote a comprehensive document on
the relationships among Maintenance, Reliability and
Safety, entitled Reliability Centered Maintenance [18],
creating the RCM methodology. RCM spread throughout
industries, specially those needing safety and reliability,

Fig. 1. RCM methodology and outcomes.

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

strictly necessary. It is no longer assumed that all failures

can be prevented by PM, or that even if they could be
prevented, it would be desirable to do so.
Of the thousands of possible failure modes on any
facility or installation, each has a different effect on
safety, environment, operations, or other costs no related
to operations. The failure consequences determine what,
if any, resources will be used to prevent their occurrence.
For example, in railway signaling infrastructure, there are
thousand of kilometers of underground wires for
communications, power supply, etc. Actually, the rate
of failure of a wire is very low, and failures are mostly
due to construction near or along the tracks. As a result,
wires are not periodically maintained, because the effort
to do it would be larger than the benefits obtained.
As RCM provides a ranking of maintenance tasks for
a system, it can be used as a good technique for
developing a PM program [8]. A formal review of failure
consequences focuses attention on maintenance tasks that
are more effective, diverting energy away from those
which have little or no effect [10]. This helps to ensure
that whatever is spent on maintenance, it is spent where
it will be more necessary to ensure that the inherent
reliability of the equipments is enhanced.
Today, RCM tools are integrated with CMMS [9],
as Relex [24] or ASPs. The latest trend encompasses
asset management and maintenance, supported by various
methods of Condition Based Maintenance Systems and
in-service inspection processes [20,7,12].
So, are there no problems? Yes! A lot of them.
First, and major, RCM initiatives involve a tremendous
amount of resources, time, and energy. It is usually a
long-term goal with a short-term expectation. It is known
that many projects to deploy RCM in manufacturing
plants failed because large projects require 2 or 3 years
to implement the process, which means expenditures but
no proven benefits. Third, the best methodology in the
world will fail if management, staff, and workers do
not support it. The success of any initiative depends on
the credibility of the experts knowledge, on showing the
benefits to the groups that can be affected by the success
of the initiative, and on creating working groups willing
to impulse the initiative by involving themselves in the
project. At last, but not least, RCM was conceived to
study exhaustively only a small part of the equipments of
a factory or system, because making a RCM analysis of
every system of the infrastructure would be complicated
and time consuming. RCM experts usually ask for data
as failure rate, medium time between failures (MTBF),
detailed costs, etc. that many times are not known for a
specific system. As may be seen, most of the former
problems are not related to the methodology itself, but to
its implementation aspects.
In Section 3 we describe how we have overcome the
former problems and how the RCM methodology can be
adapted to large scale systems, as railways.

259

3. Adapting RCM methodology for railway

infrastructure
The RAIL project had three major goals. First, trying to
harmonize European maintenance procedures to satisfy the
European interoperability rules aiming a safe trans-national
train circulation. Second, adapting the RCM methodology
to the railway infrastructure and the railway companies.
Third, optimizing maintenance costs, while keeping the
safety levels.
Those goals should be satisfied overcoming the initial
constraints found at the beginning of the RAIL project:
safety organisms, that define a safety level and even
maintenance procedures; Existing maintenance plans,
which are defined by the practice of years; Historical habits,
because railways are usually very old and large companies
with a lot of history.
Satisfying the former goals was difficult because of
several reasons. First, each railway company had a very
different understanding of the infrastructure and its
particular maintenance rules and procedures. Second,
RCM is a systematic approach aimed to maintain systems
functionality rather than restoring the equipment to the ideal
condition. This approach needed a new state of mind from
maintenance teams, because systems must be studied from a
functional point of view, and not from a mere structural
description. Moreover, the method is very time consuming
and needs a management commitment. Fourth, the scale of a
railway network is very large to apply the standard RCM
methodology to the whole network.
To deal with the former problems, we carefully analyzed
the railway network and concluded that:
1. The scale is very large, there are hundred of thousand of
assets, but the number of different models is reduced.
There are thousands of track circuits, but they can be
grouped in few models. Thus, we decided to make a
generic RCM analysis of each model to create RCM
templates, including system description, FMECA
analysis, estimated criticality, and tasks proposed to
solve failures. As RAIL was a European project, a strong
emphasis was made to unify the templates among
different companies to have maintenance procedures
accepted in several countries, which is important to
promote interoperability.
2. There was a need of a unified cost model to compare
data among different companies to promote future
comparisons of maintenance performance.
There should be several levels of analysis: line level,
section level, elemental section level and specific system
level. Each level had different possibilities, but the final goal
was to optimize m aintenance planning using the manpower
available and increasing, or at least keeping, safety and
reliability levels through criticality and FMECA analysis
made on each level.

260

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

The decision tree should be modified to demonstrate to

the companies that applying the methodology will not only
increase reliability, but it will also reduce maintenance costs
of the organization.
The former conclusions were fundamental to convince
the company managers that the outcome of the RCM
methodology could be worthwhile for the companies.
However, to satisfy those goals, we found that it was
necessary to adapt the RCM methodology to apply it in a
large scale system like a railway network. To start with, we
decided to extend the RCM methodology to apply it to
functional machines on several levels. Our methodology
has four steps: infrastructure breakdown, computing criticality and state of the systems, classical RCM analysis
(FMECA analysis and selection of maintenance type based
on criticality), and maintenance planning. Not all the steps
are applied in very level of the methodology, as shown ahead.
3.1. Infrastructure breakdown
The first step of a standard RCM methodology is to
identify the systems to study. Since the beginning, it was
very clear that our methodology and tools were going to
have two types of users:
Managing staff: who wanted to use the RAIL approach to
redefine the maintenance tasks, and their standard
frequency, and to compute the manpower needed to
maintain the infrastructure with a defined reliability
level.
Maintenance staff: who wanted to use the analyzed
results (task frequency) to define the actual
maintenance tasks, their frequency and the Maintenance Work Order.
Both type of users have a dramatically different view of
what a system is. For managers, the machine to study is
not a single asset, like a track circuit, but a whole portion of
the network (called section) or eventually the whole
network. For maintenance staff, the systems are the assets
to be maintained. Thus, it was meaningful to talk of track
circuits and their components. However, can you do a RCM
analysis for all the systems in a network with a realistic
approach? The answer was very clear: no. Former
experiences [21] showed that the RCM methodology has
been discarded many times because of its expensiveness and
lack of immediate benefits. Moreover, the managers did not
want to analyze all the machines on the network, but the
network itself as a machine. They wanted to know the
importance of each part of the railway network from a
functional point of view. However, maintenance staff was
on the opposite side. They wanted to know in detail the
behavior of a system installed on the track, including
failures, causes, tasks, etc.
To satisfy both approaches, we have extended the RCM
methodology to be applied to all the former entities, totally

Fig. 2. Railway infrastructure organization.

or partially, as shown in Fig. 2. A machine can be a line,

a section of the line, or a system installed on the track.
Classical RCM analysis is not done for the upper levels;
instead a criticality analysis is made in order to detect what
parts of the railway network are more critical from a
functional point of view. This hierarchical analysis, dividing
the network in logical machines, is our first contribution to
the modified RCM methodology. Logical machines can be
formally defined as:
N

n
[

Li ;

where L means line and N is network

Ji ;

where J means section

Si ;

where S means system

Pi ;

where P means subsystem

i1

m
[
j1

p
[
i1

k
[
i1

l
[

Mi ;

where M means maintenable item

i1

where a section Ji may belong to several lines

L1 ; L2 ; ; Lk ; and thus all the machines below, which
defines a graph as the one shown in Fig. 3.
Table 1 shows two examples of high level machines
analyzed as test case in RENFE. The first one is a line with
25 km, eight sections, and more than 250 systems.
The second one is a section of the line with only 2 km,
but almost 40 systems. The former numbers show another
feature of the railway signaling infrastructure: it is not
uniformly distributed along the tracks. We have considered
two kinds of sections: stations and tracks between two
stations. The stations usually concentrates most of the
railway signaling devices, usually grouped in some kind of
electronic interlocking system, while sections between
stations only have some track circuits and signals. Table 2
shows a simplified decomposition of a signal.

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

261

Table 2
Low level machines
Machine

Example

System
Subsystem
Maintainable item

Four lights signal

Signal head
Lens, lamp, etc.

know, not only the performance state of an asset, but the

asset state to compute risk of accident probability.
3.2. Computing criticality and state of the machines

Fig. 3. Schematic railway network graph.

However, in RENFE, there are more than 600 general

lines, 4000 sections (tracks between stations), and almost
2000 stations. Station tracks should also be included, to
almost 8000. The number of systems is very large. There are
more than 20 classes of systems (track circuits, signals,
joints, level crossings, locks, etc.), which expand to more
than 100 discriminating the different existing technologies.
The number of items of each system varies, but there are
more than 10,000 track circuits belonging to four large
categories and 21 subcategories (for example, low
frequency, 50 Hz track circuits), more than 9000 signals
belonging to eight major categories, and so on. In total,
more that 70,000 systems and 250,000 subsystems.
Moreover, see that some entities that we call low level
are so complex that are comparable to the machines studied
traditionally in many RCM systems as large and complex
[22], thus a complete RCM analysis is only completely done
for those systems identified as more functionally important
(critical) for their logical machines.
In addition, we have extended the RCM methodology to
make an analysis of the state of the critical systems, as we
are coping with safety critical components, whose failure
may cause accidents, injuries and deaths. It is important to
Table 1
High level machines
Machine

Example

Line
Section

Villalba-Cercedilla
Los Molinos-Guadarrama

Criticality is the base to rank the machines. What is

criticality? It is a measure of the importance of the system
from a functional point of view. Once criticality is
computed for several systems, those can be classified
according to their importance for the whole railway
network.
Criticality is computed for the whole hierarchical
decomposition of the infrastructure: line, section, and
system level. A set of factors is defined in order to compute
the criticality, which is an addition of all the factors values
(see Eq. (6)).
c

n
X

Fi

i1

The factors to be taken into account were defined by a team

of RCM experts, railway maintenance engineers, and
railway managers. They concluded that the factors should
be the same for lines and sections, but should be different for
systems. Why? Lines and sections are classified using
functional criteria specified mostly by the client
(the transport companies running trains along the rails)
and adding some criteria related to infrastructure and
environment. The RAIL consortium agreed on the criteria
shown in Table 3 to evaluate the criticality of lines and
sections. Some factors may have subjective values or
objective values not easy to measure, but we have always
tried to refer the factors to numerical values whenever
possible. For example, traffic density 4 means more than
200 trains/day, 3 means between 200 and 60 trains/day, 2
means between 60 and 20 trains/day and 1 means less than
20 trains/day. However, it was impossible to define all of
them numerically. For example, maintenance costs are very
different for each company. To easy criticality analysis, we
allow each company to tailor the methodology with their
own values, grading each factor from 1 to 4, which means
from low to very high. The meaning of each value is
factor-dependent, but it can be seen as a scale from less to
more critical.
In most cases, the importance of each factor is not the
same. This may be imposed by company or regulation
entities policies. To accommodate this fact, we have
introduced a weight for each factor in the formula and had

262

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

Table 3
Criticality estimators for lines and sections
Factor

Description

Value 1

Value 2

Value 3

Value 4

Technology
Traffic density
Revenues
Availability
Exploitation
Maintainability
Costs
Environmental risk
Safety risk

Kind of technology of the line or section

Number of circulation per day
Revenues obtained from exploitation
Number of hours that the line must be available per day
Number of passengers or dangerous freights
Maintenance process complexity
Costs associated to maintenance
Risk of environmental damage generated by an installation failure
Risk of people damage generated by an installation failure

Mechanic
[1,20]
Low
6
Low
Low
Low
Low
Low

Electro-mechanic
(20,60]
Medium
12
Medium
Medium
Medium
Medium
Medium

Electric
(60,200]
High
18
High
High
High
High
High

Electronic
.200
Very high
24
Very high
Very high
Very high
Very high
Very high

normalized the values between 1 and 4n.

c

n
X
i1

Wi
Fi
n
X
Wj

j1

or simplifying the notation:

c

n
X

W 0i Fi

i1

Weights are the same for the whole company. They cannot
be modified by analysts, because it will lead to a different
analysis for each set of systems and it will reduce the
robustness of criticality with respect to the subjective
variability of the weights. Thus, criticality is mostly affected
by the factors and the company policy criteria followed to
define the weights.
For systems like track circuits and signals, criticality is
computed similarly, but adding some different criteria such
as safety. The criteria used are mainly defined by
engineers, maintenance staff, and safety regulation
authorities, and they are related to MTBF, reliability,
availability, etc. A top down classification was established
for each criteria, following risk category, frequency of
failures, hazard security levels, and decision criteria
defined in RAMS standard [6]. Moreover, we allow
defining a threshold to consider a component critical,
but considering that classification could be different
depending on the operational environment. The RCM
methodology must be applied initially to those significant
items upon the threshold.
Depending on the criticality, lines, sections and systems
are classified in four levels, or classes of criticality, from A
to D, which are visualized in RAIL CMMS using colors
ranging from red to green, respectively. The resulting value
is distributed in the range 1; 4n; where n is the number of
factors involved in the computation of the criticality.
To compute the range of the classes, a statistical study
was made using the test case shown ahead. Initially, all the
intervals were similar, but after computing the criticality of
the test case systems, we asked to the experts what interval

should every system be placed, thus getting a more realistic

distribution of criticality.
However, computing the criticality of thousand of
systems is not straightforward. How does the RAIL
methodology cope with the criticality analysis of such
amount of systems? Applying criticality inheritance.
Criticality inheritance is our second contribution to the
traditional RCM methodology: To reduce the manpower
and time to analyze the railway network, criticality
inheritance is applied in a top down manner from lines
to systems. Criticality is computed for high level machines
(for instance, lines) and legated to low level machines
(sections inherent criticality information from lines) as a
starting point, applying equations similar to Eq. (9) for
every level (criticality for a section J). The criteria are
clear: if a line has a certain criticality, initially it seems
reasonable to apply to the systems of that line the same
criticality.
cj maxlci ;
lc being line criticality
l [ L; ;L and J [ L

When a line criticality is applied for the first time, the same
criticality is applied to sections and systems of that line.
When a specific section of the line is analyzed, if it belongs
to several lines, its criticality is the maximum criticality of
its parent lines (see Eq. (9)). Once computed, the critically
of the section is applied to its systems. Line criticality can
be assigned at the managerial level, while the criticality of
the sections can be assigned by several distributed
management teams starting with the inherited criticality,
thus reducing the time extension of systems analysis.
Obviously, afterwards, each machine can be analyzed
carefully, if needed, to study their situation. For example,
secondary tracks of a station are less critical than primary
ones, but those decisions can be taken closer to the section
and system evaluated. This way, the identification of
functionally significant items (FSI) can be made quickly
at first glance, while a more detailed evaluation can be made
by every maintenance team, which is in charge of a few
systems only.

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

the following equation:

Table 4
Factors defining the state of a system
Factor

Description

e
Safety
Technology
Reliability
Maintainability
Environmental
risk

Risk of accidents because of the state of the machine

Type of technology of the system
Number of failures affecting train circulations
Effort associated to system maintenance, economic
or in man-power
Environmental risk generated by an installation
failure

3.3. Computing the state of a system

In addition of criticality, we have extended the RCM
methodology to evaluate the state of the systems in order to
identify those that are in worst condition into the network,
thus requiring more maintenance and generating a higher
risk of accident. State is used in combination with criticality
to choose those systems that must undergo RCM analysis
first, to identify safety and costs issues involved in the
maintenance task selection phase, and to establish an
infrastructure replacement plan.
As with the criticality, several factors are involved in
state determination (see Table 4), but the formula used is
different:
e

n
Y

10

Fi

263

i1

n
Y

nWi =

Fi

n
X

Wj

J1

11

i1

After computing criticality and state, the infrastructure of

the railway network is perfectly classified to the system
level, so that decisions can be taken to help planning
maintenance and investments, as it will be shown later.
Including the state of the system to complement the RCM
analysis is our third contribution to the RCM methodology.
3.4. Selecting the systems to apply FMECA
After computing criticality and state of systems, some
criteria must be used to choose the FSI that will go through
the following steps of the RCM methodology. As those
steps includes very time consuming procedures (FMECA,
decision tree, etc.), two thresholds must be defined for
criticality Tc and state Te parameters. Initially, only
systems s over the criticality threshold will be chosen Sc :
Sc {s1 ;s2 ;;sj ;;sn } ;si [ S and csi $ Tc

But, if time or economic resources are not enough to analyze

all the resulting systems, those systems needing more
maintenance can be deduced using also the state e value:
Sc {s1 ; s2 ; ; sj ; ; sn }
;si [ S; csi $ Tc and sei $ Te

In this case, we use a product based formula because we

want that factors with a low value (it means a bad state)
may influence heavily the global value of e: For the same
reason, we have defined the factor values from 0 to 4. As can
be observed, if some factor is ranked with the lowest value
(0), the total state obtained (applying Eq. (10)) is 0.
The values obtained for the state range from 0 (a very bad
state) to 4n (perfect state), n being the number of factors
involved.
As in the criticality case, different factors may have
different relevance in different organizations, thus a set of
weights is used again to customize the state analysis. But in
this case, the normalization is more complex as shown in

12

13

The same criteria can be used to decide how to distribute

maintenance and replacement budget for the railway
network, as replacing most critical elements with the
worst state will optimize the results obtained with
the same budget. The thresholds must be defined to the
company level, so that there cannot be subjectivity
depending on the criteria of the analyst applying the
equations.
3.5. FMECA analysis
Following Moubray [15], the traditional RCM method
may be summarized by the following characteristic

Table 5
Failure mode analysis of a system
System

Subsystem

Function

Functional failure

Maintainable items

Condition of failure

FTG track
circuit

Transmitter

Filtering the amplified signal

Wrong voltage levels

Electric discharges and overvoltages

Amplifying the modulated signal

Wrong voltage levels

Selecting the resistor value

as a function of the wire length
Providing power supply to the FTG

Track circuit failure

Track circuit failure

Cabin filter card,

filter card
Cabin amplifier,
amplifier card
Resistor, wire
compensation
Power source

Track circuit failure

Fuse

Electric discharges and overvoltages,

wrong connection of the amplifier card
Electric discharges and overvoltages,
changing weather, ballast connected
Electric discharges and overvoltages,
background batteries empty
Electric discharges and overvoltages

264

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

Table 6
Classification of failure consequences. Punctuality criteria are for general lines
Failure consequences

Catastrophic
Critical
Marginal
Insignificant

Safety

Economic

Criteria

Value

Criteria

Value

Criteria

Value

Several dead
One dead or seriously injured people
Temporally injured people
Not injured, but aesthetic.

100
60
20
5

. 0.2M Euro
.0.1M Euro
.6000 Euro
,6000 Euro

25
10
5
1

.8 h. More than one train seriously delayed

.8 h. More than one train delayed.
30 min delay
10 min delay

40
25
8
2

elements: establishing a register of all equipment functions;

identifying functional failures (FF) and their causes, making
a failure effect classification (FMEA) to identify the most
significant items for further analysis; selecting the
maintenance tasks based on economic and technical
arguments applied to a decision tree; and defining a
maintenance plan to implement the tasks.
In railway infrastructure, systems S are composed by
several subsystems P that are maintained as a whole.
Thus, after careful evaluation with experts, we decided to
make FMEA to the subsystem level [22]. The
methodology applied was auditing some railway company
experts, studying existing descriptions of the infrastructure
(databases, functional diagrams, etc.), and using railway
system decomposition as starting point. The first stage
was decomposing each system and subsystem, including
their functional description with levels of quantitative
performance (e.g. frequency 50 Hz). Qualitative criteria
must also be quantified (e.g. risk classification in RAMS).
For each subsystem, it is mandatory to define a primary
function (e.g. to send a 50 Hz signal through the rail),
but secondary functions can be also added (e.g. must work
24 h). A secondary goal was to achieve a unified
functional description among all the railway companies.
Table 5 shows a portion of the FMEA of a transmitter of
a FTG track circuit.
Each function may have several FF, and each FF may
have several failure modes (FM). The effects of each FM
must be defined and measured, and also its consequences
and costs, using metrics like MTTR, downtime, cost, safety,
etc. The consequences of a failure have been evaluated for
the following consequence classes: safety S; costs C;
and punctuality D: Using Eq. (14), where P is the
probability of the risk if the failure occurs, and MTBF is
the medium time between failures:
R S C D

Punctuality

P
MTBF

(as shown in Fig. 4) and the resulting value is

filtered through the failure classification defined in the
RAMS standard (see Table 8). Both tables provide a
classification of the failures that may range from intolerable
to negligible.
Once classified, failure consequences are matched
using a logical decision tree to chose the best
maintenance task (MT) to be applied to a maintenance
item M: As our fourth contribution to the RCM
methodology, the logical decision tree has been also
adapted to reflect the reality of the infrastructure and to
introduce RAMS terms. Related to safety installations,
most signaling infrastructure cannot afford by law any
significant failure related to security, but experience
shows that a bad or insufficient maintenance generates
accidents, injuries and deaths. Consequently, we have
adapted the logical decision tree to include also the
system status, and not only criticality, to choose
the maintenance tasks. If the failure or the status of
the system may affect safety with a certain probability
(values of state near to zero), the only solution
recommended is restoration of the whole system.
A decision like this cannot be obtained from the
traditional RCM methodology, because only functional
features, and not state of systems, are considered.
Thus, not only intolerable failures lead to system
redesign of the subsystem, also intolerable state can
lead to replacement as the appropriated task (see Fig. 5).
See that classical RCM only detects structural or design
failures, but not the status of systems that may be against
security.
Table 7
Classification of probability of failures
Classification

Values

Probability

Frequent

10

Most probable result if the failure

occurs (.2 1021)
It may happen probably (,2 1021)
Not usual sequence of failures, but it
has happened (,1022)
Not in years, but possible (,1024)
Never happened, but possible (,1026)
Almost impossible (,1028)

14

We have assigned a severity R to each consequence class,

getting a consequence distribution. Tables 6 and 7 show the
severity and classification of probability used in
RAIL RCM.
The outcome of the FMEA analysis is normalized in the
interval [0,1] for each failure and consequence class

Probable
Occasional

6
3

Remote
Improbable
Incredible

2
1
0.5

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

265

Fig. 4. Failure consequence distribution.

If a failure is not against safety, the remainder criteria are

then filtered for environmental risk, availability,
punctuality, and costs. If several suitable maintenance
tasks are found, the cheapest maintenance task is chosen, as
shown in Eq. (15). Thus, costs B is the last criteria to
classify the maintenance tasks, with a branch of the
logical decision tree adapted to get the most efficient
maintenance task
t [ {t1 ;t2 ;;tj ;;tn }
;ti ;tj [ MT; cti ctj and bti , btj

15

The resulting tasks are classified further in time to optimize

the maintenance plan.
3.6. Root cause failure analysis
The FMECA analysis is made firstly on the system class
template. Through the analysis, we observed that every
operation has failures that occur repeatedly without any
observable cause. Those symptoms show chronic hidden
failures that could be the root of many other detected ones.
Thus, their elimination complement RCM, increasing the
performance of the methodology [11]. Solving a root cause
eliminates not just one, but a multiplicity of problems, that
will not recur because their deepest root causes have been
corrected. Combining root cause failure analysis (RCFA)
and RCM has other benefits as well. If an area in which
RCM has been completed still experiences some
failures, some failure mechanisms have been missed.
Thus, we have combined both RCFA and RCM as a good

technique to detect hidden failures and to achieve new

stages of reliability.
A good example of root cause was detected when
analyzing a certain model of low frequency track circuit,
which used to have unexpected random failures, even when
the major failures were being inspected as regulated. There
were several similar failures whose causes seemed to be
originated by several components. However, after analyzing
the system with multidisciplinary equipment including
several maintenance people, we found that the problems
were created by the increased conductivity of a wire due to
vibrations against the rail. Analyzing the problem, we saw
that those problems were present in several railway sections.
When the maintenance staff of the line was interviewed, we
found that one technician had detected the hidden failure
and solved it by adding several silent blocks to the wire.
This solution was recommended to the manufacturer and the
installer of the system. As another example, last months
Table 8
RAMS classification for failures used in the LDT
Frequency

Frequent
Probable
Occasional
Remote
Improbable
Incredible

Safety
Insignificant

Marginal

Critical

Catastrophic

Undesirable
Undesirable
Tolerable
Negligible
Negligible
Negligible

Intolerable
Intolerable
Undesirable
Tolerable
Tolerable
Negligible

Intolerable
Intolerable
Undesirable
Undesirable
Undesirable
Tolerable

Intolerable
Intolerable
Intolerable
Intolerable
Undesirable
Undesirable

266

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

Fig. 5. A branch of the logical decision tree.

maintenance staff of one new line observed that the contact

wire was eroding very fast when the speed was
incremented to 220 km. The failure was initially charged
to wire quality, which lead to change some wire sections,
without any benefit. Finally, it was discovered that the
erosion was due to the excessive hardening of a model of
springs, which were changed to eliminate the failure.
RCFA has been encouraged in those lines and sections
experiencing failures not documented or random failures
without any rational explanation to look for hidden failure
causes and to solve the problem. As we still do not have a
complete RCM database, RCFA is being accomplished by
exploiting the staff knowledge and the existing databases of
each railway company. In spite of that, the experience has
been really successful, because it has allowed the
maintenance staff to be more closely involved with creative
aspects of their work.

4. RAIL Internet CMMS

To implement the methodology, we have developed a
user-friendly CMMS tool [9] and a database to support the
RCM process and the maintenance schedule. The tool,
named RAIL RCM Toolkit, has been programmed using
the Java programming language, which can be used through

Internet. Using this tool, the analysis can be made separately

in the different territorial divisions of the railway
companies, thus reducing time and management costs
related to the expertise needed to cope with the FMECA
analysis problem. This section does not provide an
exhaustive description of our CMMS, but only a small
view of their possibilities.
RAIL RCM Toolkit provides railway maintenance
professionals with an easy-to-use library of railway
infrastructure components and a complete RCM analysis
for them. The results of the analysis are collected into a PM
database, developed with the same architecture for all the
railway company members of the RAIL project,
which allows to share maintenance data and to promote
interoperability and the introduction of shared maintenance
methods (Fig. 6).
Our CMMS uses the railway company databases to get
the inventory and some legacy data related to historic
maintenance performance, MTBF, maintenance procedures
costs, etc. RAIL database stores lines and their sections and
the evaluations of their criticality and status. It also stores:
Lines, sections and systems, and their criticality values.
Systems analysis, their FF, detection of the FF and
evaluation for each FF of the frequency, severity, and the
criticality criteria.

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

267

Our tool has a user-friendly graphic user interface that

has been designed jointly with railway maintenance
managers and staff. The infrastructure is shown as it is on
the railway network. There are quick button accesses (Fig. 7)
to equipment histories and a flexible, detailed, and graphical
reporting mechanism for LCC, organic decomposition of
components, FMCA analysis, etc. Our system fully
integrates and takes advantages of RCM providing an
interactive method for problem resolution.

5. Test case

Fig. 6. Architecture of the RAIL CMMS.

Decision-making help and maintenance tasks planning.

Reports on different aspects of the system (lines,
components, functions, etc.), and statistics of the RCM
analysis.

To estimate the potential benefits or our methodology

several parameters as risk, probability of failure and
availability must be evaluated [5,13,28]. However, our first
goal was to demonstrate that the application of the RAIL
RCM methodology could satisfy the needs of the railway PM
by increasing reliability with the same budget. Secondly, we
wanted to test that our toolkit was user-friendly and easy to
understand for the maintenance staff.
To test the methodology, the RAIL project analyzed four
test cases, including a commuter line near Madrid (Spain), a
general line near Frankfurt, a heavy mixed traffic line near
Amsterdam and a commuter line near Dublin. Only
signaling equipment was considered to reduce the size of
the test. In this paper, we will show the results of the
Spanish test case: a commuter line 23 km long near Madrid
(see Fig. 8) including 253 signaling systems. The average
traffic was medium (8 trains/h) and the UIC classification of
the line was class 5.

Fig. 7. RAILRCM Toolkit example.

268

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

Fig. 8. The Spanish test case: line Villalba-Cercedilla.

The RCM project organization consisted of two

committees:
RCM management group. The responsibility of the
RCM management group was to control the overall
project performance.
RCM working committees. The working committees
were responsible for carrying out the current analysis
and controlling the technical aspects in the project.
The working committees had a permanent group of
six people (two from RENFE, two from UCIIIM and
two from ADEPA). For specific topics, more RENFE
experts assisted them.
As may be seen in Fig. 9, only five kinds of critical
signaling components were found: switches, TPS, track
circuit, level crossings, and signals. After the criticality
analysis, 167 systems were considered critical for the
section [5]. In this test case, the most frequent type of

components were the signals, and, excepting the level

crossings, they were also considered the most critical ones
(this pattern can be extrapolated along the railway network).
As may be seen, there are few systems with high-criticality.
The next step was to elaborate from scratch a RCM
template for each kind of system including the breakdown to
maintainable items and the functional breakdown.
Those RCM templates were applied to each kind of critical
system.
5.1. Maintenance planning and risk reduction
by using the RAIL RCM methodology
Applying reliability to plan maintenance is one of the
major goals of RAIL RCM. Currently, railway maintenance is executed periodically following the rulebook (yearly
PM rate, fT in Table 10), and applying reduction when the
manpower is less than the ruled one. The problem is that PM

Fig. 9. Total number and criticality classes of the test case systems.

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

is executed blindly, being the rate equal for each kind of

component, independently of their state, location, or
criticality.
RAIL RCM allows to plan preventive periodic
maintenance with two new criteria:

122 medium, and 35 low criticality):

10
X

fi1 ei

i1

122
X

fi2 ei

i1

35
X

18

fi3 ei # 1700

i1

16f12 e1 5f13 e1 9f21 e2 38f22 e2

29f23 e2 31f32 e3 37f42 e4 1f51 e5

1. Risk factor
2. Criticality

1f53 e5 # 1700

Let us assume that we only have 1.700 h/yr to maintain

the test line systems. If we apply blind planning,
the number of inspections of each type of equipment is
computed using the following equation system
176
X

269

f1j $ 3f2j
f4j f1j

;j criticality class

f3j f2j

;j criticality class

f5j f1j

;j criticality class

16

fi ei # 1700

;j criticality class

2
f
3 12
3
# f21
4
1
# f21
2
1
# f51
2

f13 #

i1

f1 $ 3f2

f22

f4 f1
f23

f3 f2
f5 f1

f53

where ei is the inspection effort for system i; and fi is the

number of inspections/year for system i; and the equation
should respect the restrictions defined, which are consistent
with the frequencies defined by the company (see Table 9
column fT ).
As we have several equipments of the same type
(as show in Fig. 8), we can develop the equation to:

where ei is the inspection effort for system i; fij is the

number of inspections/year for system i and criticality
class j; and the equation should respect the restrictions
defined, where the last four ones are new and due to the
relation of criticalities cij =cmaxi : Simplifying and solving
again the equations system, we get that:

21f1 276f2 131f3 137f4 2

2f5 3 # 1700

f22 f32 4;

17

f12 f42 12;

f13 f53 8;

f21 6;

f23 6

Thus, what is the risk reduction achieved by applying

RAIL RCM? Following [28], an estimated maintenance
frequency can be obtained as

And solving Eq. (17), we get that:

f1 f4 f5 12;

f51 16;

f2 f3 4

Applying RAIL RCM methodology, the number of

inspections of each type of equipment is computed
using the following equation system, where the elements
are distinguished by type and criticality class (10 high,

fi

2A
uR

19

where A 1023 is factor to normalize the values, R is

the acceptable risk factor for that system computed using

Table 9
Theoretic and RAILRCM preventive maintenance frequency
Component

Criticality c

Theoretic yearly
PM rate fT

Yearly PM rate using

RAILRCM fRM

PM rate for 1700

hours fR

Yearly PM rate for 1700 h

and RAILRCM fRA

Hours/op per
inspection t

Track circuit
Switch

Medium
Medium
Low
Medium
Low
High
Medium
Medium
High

24
24
24
8
8
8
8
24
24

12
12
6
4
2
8
4
12
24

12
12
6
4
4
4
4
12
12

12
12
8
4
3
6
4
16
8

2
2
2
1
1
1
1
3
3

Signals

ASFA
Level crossing

270

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

Fig. 10. Risk variation by using RAILRCM.

Eq. (14), and u is the number of initiating events per

year for the system. From the former equation, the risk
variation r can be defined as the ratio between the
current risk and the risk existing after applying RAIL
RCM
r 12

R1
2A=uf1
f
12
12 0
R0
2A=uf0
f1

20

where Eq. (20) provides a distribution function of r;

varying in the interval 1; 21; for systems of the same
type and the same number of initiating events depending
only on new and old number of inspections and a
normalization factor to harmonize the distribution. Fig. 10
shows the risk variation when using RAIL RCM
(Fig. 10). Systems not present have the same risk before
and after applying RAIL RCM. As you may see, the
risk factor of high-criticality systems has been considerably reduced (50% for signals), while risk factor of low
criticality systems is slightly increased (5%) for signals.
This conclusion is very important because most of the
accidents in the Spanish railways during the last five
years were due to signaling systems and level crossings.
Most of the death were due to accidents in level
crossings.
Obviously, there should be a minimum threshold for
inspecting each system. That threshold would define
additional restrictions for linear equations used to plan
maintenance, in the form of minimum for the frequencies
found as solutions. If the manpower is not available to

satisfy the minimum safety standards, an alarm should be

sent to the railway company and railway safety authorities.
5.2. Maintenance planning and risk reduction
by using the RAIL RCM methodology
Section 5.1 has described how to optimize maintenance
using RCM to reduce risk given a fixed cost for the test case
line. However, we also tested RAIL RCM to optimize costs
while satisfying a certain risk factor. The acceptable risk can
be a technical or managerial decision. Currently most
railway companies use the ALARP paradigm for
infrastructure, but what is the maintenance level to achieve
that?
To compute the optimum maintenance intervals,
Eq. (18) must be applied, but including more restrictions
to guarantee the risk level, as shown in Eq. (21). The major
goal is to minimize manpower needed for maintenance.
fT column of Table 9 shows the theoretic inspection
values recommended for maximum reliability. Currently
those values are applied depending on the line classification,
without discriminating by criticality numbers. With those
premises, the maximum theoretical time TT to be devoted
to PM would be 3784 h. However, once RAIL RCM
criteria is applied, after applying the RCM methodology,
using our RCM tool with the company experts, we obtained
a new PM rate fRM for each type of equipment and
criticality, as shown in the fifth column of Table 9, thus
requiring only 1846 h to maintain the section of the line with
the same performance and reliability standards. Thus PM

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

time could be reduced to a 48% without affecting security or

availability.
!
10
122
35
X
X
X
minpm min
21
fi1 ei
fi2 ei
fi3 ei
i1

i1

i1

minpm min16 f12 e1 5 f13 e1 9 f21 e2

38 f22 e2 29 f23 e2 31 f32 e3

271

Table 10
Manpower devoted to the test case
Personal

Number of hours

Maintenance engineer RENFE

Signaling specialist RENFE
ADEPA assistance
UCIIIM assistance
Total

290
480
320
480
1470

37 f42 e4 1 f51 e5 1 f53 e5

f1j $ 3f2j
f4j f1j

;j criticality class

f3j f2j

;j criticality class

f5j f1j

;j criticality class

2
f
3 12
3
f22 # f21
4
1
f23 # f21
2
1
f53 # f51
2
2A
rij #
uij fij

application, assuming a MTBM for the line of a year

(8760 h):

;j criticality class

Ea MTBM=MTBM 3784 0:70

24

Er MTBM=MTBM 1846 0:83

where Er is nearer to the industrial standards (85%) than Ea,
the actual PM theoretically recommended in the railway
network. Actually, the manpower currently devoted to PM
in the test case in more similar to the 1700 h used in the
former section. The PM manpower has been reduced along
the years while the number of accidents was very low,
however, experience was the only source for that decision.
RAIL RCM methodology provides an analytical tool to
compute optimum values considering reliability.

f13 #

5.3. Manpower needed to develop the test case

;j criticality class; ;i system type

Expert agreed that the number of inspections could be

reduced for most equipment because they have been
estimated with maximum frequency of usage. Including
the criticality, restrictions allow to adjust the inspection
intervals to minimize manpower while maintaining
reliability.
Following Nakajima [30], the effectiveness of a system
can be measured as:
Effectiveness Availability Performance Rate
Quality Rate

22

According to him, effectiveness is an operating performance

measure, which combines availability, productivity, and
quality rate, into a single quantitative measure in order to
evaluate a systems performance. Assuming that
performance and quality rate are not reduced applying
RAIL RCM criteria in Eq. (22), as the experts and the first
two months of test demonstrates, the only parameter
influenced is the availability because of the reduction of
the line downtime or delays of trains due to PM. Defining
the achieved availability as [31]:
Availability MTBM=MTBM PMT

23

where MTBM is the mean time before maintenance, and

PMT is the PM time.
We can compare the effectiveness of our methodology by
comparing the situation before (Ea) and after (Er) its

The manpower devoted for the test case was 1440 h, as

showed in Table 10. However, the effort was not equally
distributed. The biggest part of the effort was devoted to
elaborate the RCM template of each system (720 h), mostly
because we were training the experts at the same time.
Surprisingly, they were happy with the methodology and
very receptive from the very first stages. Once the templates
were made, analyzing the line was easy and it was made in
200 h. Rest of the time was devoted to maintenance tasks
choosing and maintenance plan elaboration.
As the RAIL RCM Internet toolkit allows to work
cooperatively, we hope to have the network analyzed to the
system level in one year.

6. Conclusions
This paper addressed the problem of applying RCM to
large scale railway infrastructure networks to achieve an
efficient and effective maintenance concept. Railways use
nowadays very traditional PM techniques, relying on blind
periodic inspection and the know-how of maintenance
staff. RCM was seen as a promising technique from the
beginning of the RAIL project because of several factors.
First, technical insights obtained were better than the
existing, so that several maintenance processes could be
revisited and adjusted. Second, the interdisciplinary
approach used to make the analysis was very enriching

272

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

and very encouraging for maintenance staff, which was

consulted for the first time. Third, using the RAIL RCM
structured approach allowed to achieve well-documented
analysis and clear decision diagrams.
However, there were also some drawbacks we had to
overcome. First, the method was very time consuming and,
initially, it was not suitable for large scale infrastructures.
Second, the RCM methodology, even using RCM II, is
thought for industry. The criteria to calculate criticality and
the decision charts presented some limitations to apply
them to railway infrastructure. Our methodology has
included the following new features to overcome the
former problems:
New concept of machine, defined as any entity
functionally significant to the organization. We consider
several types of machines (lines, sections, functional
elements as track circuits, etc.).
Downsizing of the problem by making a generic RCM
analysis of each machine on a template. The thousands
of elements could be reduced to less than 120 classes.
Each template carefully studied one of those classes,
including a complete FMECA analysis.
Criticality inheritance, so that the criticality of a
higher-level machine is propagated to lower level
machines if the experts chose this option. Using this
approach, the RCM methodology can be easily used for
different purposes: planning and optimizing maintenance at a large scale, planning maintenance of each
system separately, or making an exhaustive RCM
analysis of a section of a line to study its behavior in
a more detailed way.
Root cause analysis, which allowed to find recurrent
failures, to solve them for all the same class of systems,
and to modify maintenance procedure books accordingly.
Using criticality and state to classify critical systems.
Our methodology has been implemented in a CMMS,
named RAIL RCM Toolkit, which allows to execute the
RCM methodology collectively through Internet. With our
tool, the managing staff makes a first classification of the
criticality of infrastructure to the line, or even section, level.
This classification is provided to the territorial managers
that can study, using our CMMS, each one of the sections in
their areas to compute criticality reflecting the specific
features of each one. At last, each maintenance team can
influence the system by applying the same criteria to each
system they are maintaining. This structured approach,
helped by the RAIL RCM Toolkit, had a very good
acceptance among the users.
Our methodology and CMMS have produced some shortterm benefits: reduction of time and paperwork because of
databases and tools accessible through Internet, and creation
of a more accurate collection of maintenance information.
It will also have some long-term benefits: better PM will
increase equipment life and help to reduce corrective

maintenance costs; production will increase as unscheduled

downtime decreases; purchase costs of parts and materials
will be reduced; more effective and up-to-date record of
inventory/stores reports; and better knowledge of the
systems to help the company to chose the systems with
the best LCC.
Even when field tests are still in progress, the tests
executed in several countries show that our RCM
methodology is suitable for railway PM maintenance,
enhancing the effectiveness of PM to reach almost the
industry standards. As a result, being a successful
conclusion of the project, the Spanish railway company
(RENFE) and the German railway company (DB A.G.), not
only decided to adopt RCM to enhance PM, but they have
started a large project to implement Total Preventive
Maintenance (TPM) [3] relying on the implantation of
RAIL RCM.

Acknowledgements
This work was partially funded by the European Union
project 2000-RD-10819 and the Spanish Ministry Of
Science under the project TIC2000-1995-CE. We would
like to acknowledge the railway partners of the RAIL
project (RENFE, DB A.G., Iarnrod Eireann and
Netherlanden Spoorwegen) and other research partners
(Bast&Roost and FIR) for their contribution to this work.

References
[1] Abdul-Nour G, et al. A reliability based maintenance policy: a case
study. Comput Ind Engng 1998;33(3/4):5914.
[2] Anderson R, Lewis N. Reliability centered maintenance:
management and engineering methods. The Netherlands: Elsevier;
1990.
[3] Ben-Daya M. You may need RCM to enhance TPM implementation.
J Qlty Maintenance Engng 2002;6(2).
[4] Carretero J, Garcia F, Perez JM, Perez M, Cotaina N, Prete P. Study
of existing reliability centered maintenance (RCM) approaches used
in different industries. Technical report FIM/110.1/DATSI/00, Spain:
Universidad Politecnica de Madrid; 2000.
[5] Carretero J, Garcia F, Perez JM. Planning preventive maintenance in
railway networks using RCM. Working With Display Units (WWDU)
Conference, Germany; May 2002.
[6] EN 50126. Railway applicationsthe specification and demonstration of reliability, availability, maintainability and safety
(RAMS), CENELEC; 2000.
[7] Deshpande VS, Modak JP. Application of RCM to a medium scale
industry. Reliab Engng Syst Safety 2002;77(1):3143.
[8] Hall R. Optimizing preventive maintenance using RCM. Maintenance
1992;7(4).
[9] Hounsell D. Tomorrows CMMS. Plant Maintenance Resource
Center, USA: Trade Press Publishing Corporation; 1996. http://
www.plant-maintenance.com/maintenance_articles_cmms.shtml.
[10] IEC, Dependability management. Part 310. Application guide:
maintainability. IEC; 1982.

J. Carretero et al. / Reliability Engineering and System Safety 82 (2003) 257273

[11] Latino M. RCFA RCM formula for successful maintenance.
Plant Engng Mag 1999.
[12] McCall J. Maintenance policies for stochastically failing equipment: a
survey. Mgmt Sci 1965;11(5).
[13] Morsmann A. Reliability-based maintenancebreakthrough in
maintenance improvement. Machine Plant Syst Monit 2000;213.
[14] Moubray J. Maintenance management: a new paradigm. Maintenance
January 1996;11(1).
[15] Moubray J. Reliability centered maintenance RCM II. Oxford, UK:
Butterwoth/Heinnemann; 1997.
[16] ATA. MSG-3, revision 2. ATA of America; 1978.
[17] NAVAIR, Guidelines for the naval aviation reliability-centered
maintenance. Direction of Commander, Naval Air Systems
Command, USA; 1996.
[18] Nowlan FS, Heap HF. Reliability-centered maintenance.
Technical
report
AD/A066-579.
National
Technical
Information Service, US Department of Commerce, Springfield,
Virginia; 1978.
[19] OREDA Consortium, Reliability data handbook, 3rd ed.; 1997.
[20] Parida S, Kotu NR, Prasad MM. Development and implementation of
reliability centered maintenance using vibration analysis: experiences
at Rourkela steel plant. 15th WCNDT, Rome; 2000.
[21] Pintelon L, Nagarur N, Van Puyvelde F. Case study: RCMyes, no or
maybe? J Qlty Maintenance Engng March 1999;5(3).

273

[22] Pujadas W, Chen F. A reliability centered maintenance strategy for a

discrete part manufacturing facility. Comput Ind Engng June 1996;
31(1/2).
[23] Rausand M. Reliability centered maintenance. Reliab Engng Syst
Safety 1998;60:12132.
[24] RELEX. Computerized maintenance management systems: RCM
tools. RELEX Software. http://www.relexsoftware.com, 2001.
[25] Red Nacional de los Ferrocarriles Espanoles. Procedimientos de
mantenimiento de instalaciones de senalizacion; septiembre de 2000.
[26] Schlkins N. Application of the reliability centered maintenance
structures methods to ships and submarines. Maintenance June 1996;
11(3).
[27] Smith AM. Reliability-centered maintenance. New York: McGrawHill; 1993.
[28] Svee H, Jorgen H, Vatn J. Estimating the potential benefit of
introducing reliability centered maintenance on railway infrastructure.
SINTEF technical report; 2000.
[29] Vatn J, Hokstad P, Bodsberg L. An overall model for maintenance
optimization. Reliab Engng Syst Safety 1996;51:24157.
[30] Nakajima S. Total productive maintenance. Productivity Press; 1988.
[31] Ireson WG, Clyde FC. Handbook of reliability engineering and
management. New York: McGraw-Hill; 1988.
[32] REMAIN consortium. Final consolidated progress report, European
Union; February 1998.