New FMEA Risks Ranking Approach Utilizing Four Fuzzy Logic Systems

Abstract

Process equipment and plant maintenance problems are complex in the oil refinery business, since effective maintenance needs to ensure the reliability and availability of the plant. Failure Mode and Effects Analysis (FMEA) is a risk assessment tool that aims to determine possible failure modes, and to reduce the ratio of unknown failure modes, by identifying business-critical systems and the risks of their failures. For the identified failure modes, FMEA determines risk mitigation action(s). The goal is to prevent failure and keep assets and plants running at peak performance by providing fully integrated operations, maintenance, turnarounds, modifications, and asset integrity solutions, during all phases of the asset life cycle. This research was based on FMEA use/application in refineries’ units, and proposes the new fuzzy FMEA risk quantification approach method: “four fuzzy logic system”. The model included a pre-assessment, by sets of fuzzy logic systems, that examined the input parameters that affected the variables of severity, occurrence, and detectability. The proposed model prioritized risks better and addressed the drawbacks of the conventional FMEA method.

1. Introduction

What is a risk? A risk is an effect of uncertainty on an objective, as defined by ISO 31000:2009. Organizations of all types and sizes are faced with internal and external factors and influences that make it uncertain whether and when they will achieve their objectives [1]. One of the basic building blocks of a facility integrity management program is the ability to comprehend and manage risk effectively. The aim is to establish a balance between taking risks and the benefits that are obtained from a particular activity. The process of understanding risk implies not only the specific causes of risk, but also the possible effects that are relevant to them. This can be manifested in the form of safety, health, environment, business impacts, damage to equipment, or a combination of the above. An understanding of risk also ought to include an overall, or at least a general, knowledge of the intended process of assessing risk [2]. Thus, risk assessment can be defined as the general process of identifying, analyzing and evaluating risk. Risks can be assessed at the level of organization, department, project, or activity, or they can be rather specific, hence requiring different and various tools and techniques in terms of managing risks in different contexts [3].

Risk is a subjective concept that takes into account both the uncertainty and limitations of the existing know-how, as well as the attempts to predict a reliable outcome of an event. It cannot be measured physically, but presents an estimate of how likely an event and its consequences would be. Mathematically speaking, a risk is the product of the likelihood or probability of the occurrence of an undesired event and its consequences [2].

Failure Mode and Effects Analysis (FMEA) is essential in supporting reliability programs in almost every industry throughout the globe. Regardless of what industry one is involved in: aerospace, medical, appliances, electronics, automotive, chemical, energy, services, information, and so on, FMEA is a crucial instrument, as it is highly reliable, ensures safety, and assists in achieving customer satisfaction. Reliability-Centered Maintenance (RCM) is the analytical process that many companies use to establish the terms of preventive maintenance (PM) and to ensure the safe and feasible operation of any system. The core of any RCM project is an FMEA on selected manufacturing or operational equipment [4].

In a paper published in the Machines journal, S. Okwuobi et al. [5] emphasized the importance of the application of reliability-centered maintenance (RCM) for improved productivity via establishing optimal and efficient preventive maintenance (PM) programs, using FMEA as a tool. Drawbacks were discovered regarding the reporting of malfunctions by the workshop floor when the causes of a malfunction could not be determined on a piece of equipment (input from the workshop floor on failure causes that are not determined on the machine). Lacking data, the research did not result in a more detailed failure analysis. The conventional approach of performing an FMEA analysis was applied.

FMEA is defined as a method designed to: identify and comprehend potential failure modes with their specific causes, as well as the consequences of system failure; assess the risk associated with the established failure modes, effects, and causes, and prioritize corrective activities; identify and implement corrective actions to mitigate risks [4]. FMEA also is used in the reliability and safety evaluations of complex systems to determine the effects of component failures on system operation. This risk assessment tool assumes a failure mode that happens in a system/component through some failure mechanism; after this, the failure effect is evaluated. The Risk Priority Number (RPN) is the FMEA ranking system that prioritizes mitigation actions for every one of the identified failure modes. RPN is a result of the multiplication of the probability of severity (S), occurrence (O) and detectability (D).

Traditional FMEA has been criticized for having several drawbacks in practical applications, especially in risk assessment which is carried out through RPN. Therefore, the literature mentions many alternative approaches to solve some of the shortcomings of the conventional RPN method, to improve the success of FMEA. A detailed and comprehensive literature review was reported by a group of authors H. C. Liu, L. Liu, and N. Liu [6], where they studied 75 FMEA papers that were published in international journals, and categorized them according to the approaches that were used to manage the drawbacks of the conventional RPN method. The paper indicated the current trends in research, and serves as a useful guideline for further research, addressed to identify shortcomings connected to the traditional FMEA. The paper summarizes all the deficiencies of FMEA analysis: the relative importance among S, O and D is not taken into consideration; different combinations of S, O and D may result in exactly the same value of RPN, yet their hidden risk implications might differ; it is challenging to evaluate the three risk factors precisely; the mathematical formula for calculating RPN is open to doubt; the conversion of scores is different for the three risk factors; the RPN cannot be utilized for measuring the success ratio of corrective actions; the model fails to take into account the interdependencies among different failure modes and their consequences; the mathematical formula for calculating the RPN is highly sensitive to variations in risk factor evaluations.

The failure mode prioritization method approach, according to the reviewed literature, can be generally placed into one of five main categories, namely: (1) multi-criteria decision making (MCDM) [7,8,9,10,11,12]; (2) mathematical programming (MP) [13]; (3) artificial intelligence (AI) [14,15,16,17,18,19,20,21]; (4) hybrid approaches [22,23]; (5) cost-based models as an additional factor in decision making [24,25]. From the literature, the input parameters for the proposed models have used the conventional approach of FMEA analysis, taking into account the uncertainty of the assessment of risk variables by experts [15,16,17,25,26]. Most papers analyze the weight values of each variable [11,13,27], and the estimates of three or more field experts are then taken into account. In principle, most papers use a combination of expert analysis, fuzzy set, and fuzzy logic to bridge the uncertainty of the input parameters for calculating RPN factors. Fuzzy logic systems prioritize risks better in the case of the same RPN values, due to taking into consideration the influence of individual variables in risks assessment.

Fuzzy logic has a wide application. For example, it is used to model traders’ knowledge and how they make trades, according to the market conditions. A. Hernandez-Aguila et.al. have created a market prediction model using multi-agent and fuzzy systems, with the goal to simulate the interactions that provoke changes in the price [28]. Another example is based on the economic and technical development of modern society, which has resulted in the mass construction of high-rise buildings, with complex functions within a very dense population in a small area. In a high-rise building, fire represents an immediate threat to human life and property. The traditional assessment methods for fire safety are incompetent for the handling of the complex influencing factors. The research of authors M. Xu and D. Peng [29] provides an example of the application of artificial intelligence (AI) in fire safety assessments, combining the fuzzy logic inference system and radial basis function neural network (RBFNN) into an intelligent assessment method that mimicks the nonlinear inference process of fire safety experts. Fuzzy logic is also used in the medical sciences to diagnose the risk of the detection of heart disease and various other diseases. Building on those grounds, J. Kaur and B. S. Khehra [30] have suggested fuzzy logic systems to be applied to obtain an output that indicates the stages of patients in terms of their health: if they are healthy, if their condition or sickness is in the first/second stage, or if it is in critical stage.

Yet, some doubts remain in regard to how applicable the fuzzy rule-based system is to real-life circumstances, i.e., in defining the numbers of rules and the membership functions that are required by this methodology. The main aim of the research presented here was to improve FMEA analysis for refinery applications by overcoming the shortcomings of conventional FMEA, through the proposal of a new approach that utilizes four fuzzy logic systems’ blocks. This model could help standardize the FMEA procedure and make it more user-friendly. It would also mitigate the impact of subjective assessment when making critical decisions, by establishing clear rules that are connected with the business risk matrix.

To boost the operational availability and to reduce the unplanned shutdowns of refineries, it is crucial to identify the root causes of possible events with adequate preventive/mitigating barriers. There are three ways to mitigate risk: (1) reducing the failure mode severity; (2) lowering the probability of failure; (3) installing adequate process control systems. Integrity maintenance management should be set up through the identification of business-critical systems and the mitigation of the risk of their failure through mitigation actions. Our aim was to prioritize mitigation actions and allocate the budget according to initial risks. This enabled sites to make sure that all mitigation actions which served to reduce high risk were budgeted, as resources are always limited.

This research was based on the example of a conventional FMEA application for refinery units, and proposes a new fuzzy FMEA risk quantification approach method that utilizes four fuzzy logic systems. When compared to previous research, the model was applied to examine the input parameters of RPN variables (severity, occurrence and detectability) which has not been typically performed so far. For each variable, a fuzzy logic system was set up and those results served as inputs for the calculation of risk quantification (fuzzy RPN). Mitigation actions could be better prioritized according to the calculated fuzzy RPN and the aim was that all high risks would be recognized.

2. Materials and Methods

2.1. FMEA and RPN

The FMEA is a method of inductive analysis; it is an iterative, systematic, and documented process that is performed to identify basic failure/faults at the component level, and to determine their effects on the proper functioning of a system. Criticality analysis within FMEA helps to develop the priorities, risk, and mitigation actions and it is an opportunity for the continuous improvement of a system or process unit. This analysis can be performed, utilizing either actual failure modes from prior field data or hypothesized failure modes that are derived from design analysis, reliability prediction activities, and experience with how parts fail [31]. The purpose of the FMEA is to identify critical components concerning reliability and availability.

Before FMEA analysis is even attempted, it is vital to understand the basic processes of the system and how the system works. In this respect, building a functional block diagram and specifying the required functions of the system are very important [32]. In addition, the quality of the analysis will deeply depend on the team members who are conducting it. The traditional execution of an FMEA engineering analysis is carried out by a cross-functional team of subject matter experts who thoroughly analyze refinery processes. The FMEA teams consisted of a moderator, who offered methodological knowledge, and the FMEA team members, who offered technical knowledge that concerned the process or equipment that was analyzed. Detailed guidelines regarding the team members who are useful in performing a successful analysis are described by book The Basics of FMEA [33], which was used as a reference point.

It would be well worth mentioning that, though it is desirable for the FMEA team members to have some basic know-how in regards to teamwork (consensus-building techniques, team project documentation, and idea-generating techniques, such as brainstorming) as well as to have an understanding of the basics of the FMEA process before embarking on a project, the training itself is easily conducted by a versed team leader or moderator as the FMEA on a real project is being performed; thus, the team member benefits from the most effective form of skill-honing, which is real-life experience. Team members should be comfortable using continuous improvement problem-solving tools, such as flowcharts, data analysis, root cause analyses, and graphing techniques.

The first order of business on the new FMEA team’s agenda needs to be the appointing or choosing of the previously mentioned FMEA team leader or moderator, as he or she is responsible for coordinating the team and process, facilitating the progress and leading the FMEA process towards its conclusion. Another important role is that of a scribe, who is responsible for taking the minutes of meetings and archiving the FMEA records, the former most commonly being a task that rotates among team members, excluding the team leader. Next, there is the process expert, an essential role, since this is a person with expertise in the process being analyzed, someone who can clarify the process to the team and, in that way, either help establish a faster pace or slow down the FMEA process.

Though there have been many variations of FMEA, the terminology used in refinery issues includes:

• Failure mode. Failure modes are, in essence, categories of failure. A failure mode describes how some product or process would not be able to perform its desired function (in terms of design or requirements), based on what the end-users or end-customers need and expect from it. Examples of failure modes include fatigue, collapse, performance deterioration, deformation, obsolescence, corroded, binding, seizure, buckling, sagging, looseness, misalignment, leaking, vibrations, burning, etc.
• Potential cause(s) of failure. Every failure mode has a potential cause of failure that is linked to it. Some of the most common causes of failure are the use of the wrong material, poor welding, corrosion, error in assembly or dimension, exposure to too much stress, overheating, overcooling, poor maintenance, damage, error in heat treatment, material impurity, formation of cracks, imbalance, tooling marks, eccentricity, etc.
• Effect. An effect is a negative consequence that the end-customer or end-user sees or feels.
• Severity. Severity is an assessment of the seriousness of the consequences of the potential failure mode on the customer/user.
• Occurrence. Occurrence is how frequently a cause arises and causes failure modes. In a best-case scenario, past occurrence data is used to determine occurrence.
• Detection. The ability of the existing control to detect and consequently prevent a certain cause.

In the process of FMEA, the FMEA team must conduct assessments of the risk variables S, O and D for the corresponding failure modes. Using available data, expert knowledge and relevant experience with some process or product, each potential failure mode, and its respective effect are rated in all three variables (S, O and D) on a scale from 1 to 10, i.e., from low to high. The Risk Priority Number (RPN) is the FMEA ranking system that prioritizes mitigation actions for every one of the identified failure modes. RPN is the result of the multiplication of the probability of S, O and D, Equation (1). RPN has a range from 1 to 1000 for each failure mode. The RPN value is used to rank how necessary corrective action is to eliminate or reduce the risk of potential failure modes. The failure modes that hold the highest RPN values need to be addressed first, bearing in mind that those with a high severity ranking are deserving of special attention, regardless of their RPN [33].

$$RPN=S\times O\times D$$

(1)

The traditional RPN method does not consider the relative importance among risk variables. Additionally, identical RPN values for different sets of risk variables can be generated. The traditional FMEA method is not able to manage situations in which the information about risk variables weights is only partially known, so for a subject matter expert, it is not easy to exactly quantify his or her assessment as a crisp value in real-life circumstances. Therefore, the goal of this research was to improve FMEA with a fuzzy logic system. This will allow FMEA analysis to become a recognizable and widely applicable technique for analyzing the safety and reliability of refinery systems, by taking into account a set of key parameters, linguistic variables in the place of unavailable data and, perhaps most importantly, by mimicking human logical reasoning in the process of assessing risk, with minor errors.

2.2. Fuzzy Logic

The term “fuzzy logic system” was coined by Lotfi A. Zadeh in the 1960s. Fuzzy logic evades binary and/or opposing categories such as on/off, true/false and one/zero, etc. Instead, it relates to “shades of grey”, more diversified categories and nuances, such as large/very large, etc. Fuzzy logic is a process of characterizing knowledge in the context of rule bases and fuzzy sets. To elaborate, there are one or more “fuzzified” input values, which get assessed using rule bases and are then again “defuzzified” for the outputs [34].

It is precisely this sensitivity to imprecision and uncertainty that enables the creation of the uniquely human ability to understand slightly noisy speech data, the defects of natural language, interrupted and gapped texts and speech, summarizing and paraphrasing, as well as recognizing and grouping pictures, figures, or any sort of images. With fuzzy logic, we can specify mapping rules in the form of vocabulary rather than numbers. This comprehensive tool provides a flexibility in decision making and considers inaccuracy, subjectivity, uncertainty, and imprecision; therefore, it was applied for the precise determination of S, O and D variables.

The greatest benefit of fuzzy theory applications in risk assessment is that the resulting system assessment is qualitative and operational with linguistic variables, as it must be admitted that certain events simply cannot be described only in numbers. Since fuzzy logic deals with subjective, incomplete, or unreliable knowledge bases, it is well-equipped to establish the key points of any system with ease and precision. It takes risk factor levels and evaluates them at the same time, one against the other, to provide information on how they commonly contribute to risk indicators, in regard to their respective operational activities. This, in turn, helps in establishing corrective measures and procedures to reduce risks. The Fuzzy Inference System is a formulation process of the input data to output data using fuzzy logic [15].

The most widespread Fuzzy Inference System (FIS) is the Mamdani method. Owing to the simplicity of its structure, it stands out as more intuitive and easier to understand, which makes it better-suited to expert system applications that are based on human expert knowledge. Mamdani FIS is commonly used in solving all general-purpose decision-making issues and challenges, which is the main reason why it was selected for this research; it perfectly corresponds to its purpose. The following outline the steps of the Mamdani FIS that was performed [35]:

• Step 1: Fuzzify the input.

  $$Lingvistic variable=<x, T\left(x\right), U,\sigma , M>$$

  (2)
  The linguistic variable is defined by Equation (2) in which

  ■

  x is the name of the variable.

  ■

  T(x) is a set of terms, the set of names of linguistic values of x with each value being a fuzzy number defined on U.

  ■

  U is the universe of discourse.

  ■

  σ is a syntax rule for generating the names of the values of x.

  ■

  M is the semantic rule for associating with each value its meaning.

  The fuzzy set contains elements that satisfy imprecise properties for a membership function. Membership function ${\mu }_A$ quantifies the degree of belongingness of x to set A, Equation (3), where x represents input, y is output and A and B are fuzzy sets of it.

  $$A_{FUZZY}=\left\{\left(x,{\mu }_A\left(x\right)\right)|xϵX, {\mu }_A\left(x\right)ϵ\left[0,1\right]\right\}$$

  (3)

  $$B_{FUZZY}=\left\{\left(y,{\mu }_B\left(y\right)\right)|yϵY, {\mu }_B\left(y\right)ϵ\left[0,1\right]\right\}$$

  (4)

• Step 2: Find and evaluate the antecedent and consequence of each rule

  $$p_i=x is A_i$$

  (5)

  $$q_i=y is B_i$$

  (6)

  $$\mathrm{Rule} i : p_i\to q_i i=1,2,\dots ,N$$

  (7)

  $$\mathrm{IF} x is A_i \mathrm{THEN} y \mathrm{is} B_{\left(i\right)} i=1,2,\dots ,N$$

  (8)

• Step 3: Aggregate the consequents.

  $${\mu }_{AGG}\left(x,y\right)=\max \left\{min\left\{{\mu }_{A_1}\left(x\right),{\mu }_{B_1}\left(y\right)\right\},\dots ,min\left\{{\mu }_{A_N}\left(x\right),{\mu }_{B_N}\left(y\right)\right\} \right\}$$

  (9)

• Step 4: Defuzzify the results with the centroid method, where the defuzzified value y_COG is given by Equation (10).

  $$y_{COG}=\frac{\int y{\mu }_{AGG}\left(x,y\right)dy}{\int {\mu }_{AGG}\left(x,y\right)dy}$$

  (10)

3. Results

The proposed model consisted of four separate fuzzy logics and included the initial assessment of the input parameters that influenced the variables of severity, occurrence, and detectability for the identified failure modes in the refinery production process. After the setup of the fuzzy severity, the fuzzy occurrence and the fuzzy detectability systems results from these fuzzy systems, respectively, were inserted into the fuzzy FMEA system. Figure 1 presents the hierarchy of the model that was constructed by using Simulink^®, to assess the quantity of the failure mode risk, i.e., fuzzy RPN value. Fuzzy algorithms were developed by the MATLAB^® program package Fuzzy logic toolbox R2018a, where Mamdani model for FIS was selected.

3.1. Fuzzification of Model

This research contains four FIS, consuctedfor each of the fuzzy set ups; for each input parameter and variable, every detail is described in the Tables and Figures below.

For the failure modes’ severity evaluations, five fuzzy sets (very low, low, moderate, high, very high) were defined for the input criteria of assets, people, environment, and reputation (

Table 1. Selection criteria for failure modes severity evaluation.

Criteria	Fuzzy Set	Description	Fuzzy Numbers
Assets	VL	Slight damage (<10 kUSD)	(0 0 2 3)
	L	Minor damage (10–100 kUSD)	(2 3 4 5)
	M	Local damage (0.1–1 mUSD)	(4 5 6 7)
	H	Major damage (1–10 mUSD)	(6 7 9 10)
	VH	Extensive damage (>10 mUSD)	(9 10 10)
People	VL	Slight injury or health effect	(0 0 2 3)
	L	Minor injury or health effect	(2 3 4 5)
	M	Serious injury or health effect	(4 5 6 7)
	H	Single fatality or disability	(6 7 9 10)
	VH	Multiple fatalities	(9 10 10)
Environment	VL	Slight effect	(0 0 2 3)
	L	Minor effect	(2 3 4 5)
	M	Local effect	(4 5 6 7)
	H	Major effect	(6 7 9 10)
	VH	Massive effect	(9 10 10)
Reputation	VL	Slight impact	(0 0 2 3)
	L	Limited impact	(2 3 4 5)
	M	Considerable impact	(4 5 6 7)
	H	National impact	(6 7 9 10)
	VH	International impact	(9 10 10)

) while for the output fuzzy severity variable there were ten fuzzy sets (dangerous without warning, dangerous with a warning, very high, high, medium, low, very low, weak, very weak, weak, none (

Table 2. Fuzzy set of output variables after the first stage of fuzzy logic systems that represent inputs to fuzzy RPN FIS.

Ranking	Fuzzy Severity	Fuzzy Detectability	Fuzzy Occurrence
10	Dangerous without warning	Absolute uncertainty	Extremely high
9	Dangerous with warning	Very remote	Very high
8	Very high	Remote	High
7	High	Very low	Frequent
6	Medium	Low	Moderately frequent
5	Low	Moderate	Randomly
4	Very low	Moderately high	Not frequently
3	Weak	High	Rarely
2	Very weak	Very high	Very rarely
1	None	Almost certain	None

)). The same principles were then applied to the remaining variables and the risk quantification’s fuzzy RPN value, seen in

Table 3. Selection criteria for failure modes detectability evaluation.

Criteria	Ranking	Fuzzy Set	Description	Fuzzy Numbers
PROCES/CONTROL	1	No	Nothing available.	(0 0 1 2)
	2	Experts	No diagnostic is available or feasible, controlled by experts.	(1 2 3)
	3	OS	Operator staff provides the supervision.	(2 3 4)
	4	OS + LAB	Operator staff and/or diagnostic systems (trends, lab checks).	(3 4 5)
	5	I + LS	Field instruments are available.	(4 5 6)
	6	I + LS + Signal	Field instruments are available and/or diagnostic systems (trends, lab checks)	(5 6 7)
	7	I + DCS	The process control system and/or the real-time diagnostic.	(6 7 8)
	8	I + DCS + Failure	The process control system and/or the real-time diagnostic will detect the signs of a potential cause/mechanism (e.g., inter lock, AutoStart).	(7 8 9)
	9	SIS	Safety Instrumented System.	(8 9 9 10)
DECESION	0	No Act	No mitigation action	(0 0 1)
	1	SME	Measurement requires an SME engineer to observe.	(0 1 2)
	2	STAFF	The intervention is made by the staff.	(1 2 3)
	3	AUTO	The intervention is made automatically.	(2 3 3)
DATA/READING	0	No Data	Nothing available	(0 0 1)
	1	S/D	Measurement is conducted during shutdown (S/D).	(0 1 2)
	2	OFFLINE	Off-line diagnostics and condition monitoring conducted during operation.	(1 2 3)
	3	ON LINE	Real-time diagnostics and condition monitoring conducted during operation	(2 3 3)

,

Table 4. Selection criteria for failure modes occurrence evaluation.

Frequency	Ranking	Linguistic Ranking	Description	Fuzzy Numbers
Daily	10	Extremely high	The failure is almost inevitable. Occurs every day (even more than once).	(0 0 3 4)
	9	Very high	Happens (almost) every day.	(3 4 7 8)
Weekly	8	High	Repeated failures. Occurs (sometimes more than) once per week.	(7 8 31 32)
	7	Frequent	It takes more time than a week for one occurrence, but it happens every month.
Monthly	6	Moderately frequent	Failures occur relatively frequently. Occur every three months at least.	(30 32 90 93)
	5	Randomly	Failures appear infrequently. Occur once per six months.	(90 93 180 186)
	4	Not frequently	Failure happens once per 12 months.	(180 186 365 366)
Yearly	3	Rarely	One occurrence per 1–3 years. (e.g., two failures per TA cycle)	(360 365 1000 1095)
	2	Very rarely	One occurrence per 3–5 years. (e.g., one failure per TA cycle)	(1000 1095 1800 1825)
TA cycle	1	None	One occurrence in more than 5 years. (e.g., one failure per more than one TA cycle)	(1800 1825 2000 2025)

,

Table 5. Identified variables and the fuzzy set for fuzzy RPN quantification.

Fuzzy Variables	2nd Fuzzy Set	Fuzzy Numbers
Severity	Very low	(0 0 2 3)
	Low	(1 2 4 5)
	Medium	(4 5 6 7)
	High	(6 7 8 9)
	Very high	(8 9 10 10)
Occurrence	Rare	(0 0 1 2)
	Unlikely	(1 2 4 5)
	Possible	(4 5 6 7)
	Likely	(6 7 8 9)
	Frequent	(8 9 10 10)
Detectability	Very low	(8 9 10 10)
	Low	(6 7 8 9)
	Medium	(4 5 6 7)
	High	(2 3 4 5)
	Very high	(0 0 2 3)
RPN	Very low	(0 0 2 4)
	Low	(6 30 100 200)
	Medium	(6 160 300 400)
	High	(80 400 600 800)
	Very high	(360 600 1000 1000)

. For each fuzzy set, a value that defined the linguistic meaning of the set was determined. The same values were adopted to define the universe of discourse for each variable S, O, and D [1, 10] (Table 2), due to the inputs for the uzzy FMEA system being based on conventional FMEA. The rank of output for the fuzzy RPN variable was defined by interval set [1, 1000] (Table 4), with the objective of a simpler comparison of the results achieved by applying the model with a conventional RPN calculation.

Apart from the number of fuzzy sets, it was vital to identify the membership function. Based on the expert judgment, engineering know-how and the quality of information available, triangular and trapezoid membership functions were selected for each linguistic variable value assigned (Figure 2 and Figure 3).

A membership degree μ = 1 was connected to the typical fuzzy set of the joined input and output variables. The triangular membership function “trimf” was defined by the parameters [a b c], where a represents the left-side function section, with the membership a = 0, b is the central peak or the typical value, with the membership μ = 1, while c is the right-hand function section, with the membership μ = 0 [21]. The trapezoid membership function “trapmf”, however, requires four parameters, the left-most point μ = 0, the start of the plateau μ = 1, the end of plateau μ = 1, and rightmost point μ = 0. Based on the scale of 1 to 10, the pre-assessment of the variables severity, detectability, and occurrence of the failure mode was performed to measure those variables, and for each of the membership functions, their domains were determined and the shape presented can be seen in Table 2. The last fuzzy system had the role of quantifying the risk value, and the fuzzy set for the fuzzy RPN is described in Table 5.

3.2. Fuzzy Inference Systems

The fuzzy inference structure of the input criteria that determined the variables’ severity and detectability is shown in Figure 4.

3.3. Aggregation of Fuzzy Logic Systems

The process of aggregation is the process of combining fuzzy results using a set of rules, thus obtaining a final fuzzy result, which then undergoes the process of “defuzzification”. The fuzzy “If then” rule, or fuzzy conditional statements, are the expression of the form “If A then B”, where A and B are the labels of fuzzy sets that are characterized by an appropriate membership function. The MATLAB Rule Editor helps to add rules in linguistics terms. A list of rules for the risk quantification fuzzy RPN value was added in

Table A1. List of fuzzy RPN rules.

1	If Severity is Very low and Occcrence is Rare and Detectability is Very high then RPN is Very low
2	If Severity is Very low and Occcrence is Unlikely and Detectability is Very high then RPN is Low
3	If Severity is Very low and Occcrence is Possible and Detectability is Very high then RPN is Low
4	If Severity is Very low and Occcrence is Likely and Detectability is Very high then RPN is Low
5	If Severity is Very low and Occcrence is Frequent and Detectability is Very high then RPN is Low
6	If Severity is Very low and Occcrence is Rare and Detectability is High then RPN is Low
7	If Severity is Very low and Occcrence is Unlikely and Detectability is High then RPN is Low
8	If Severity is Very low and Occcrence is Possible and Detectability is High then RPN is Low
9	If Severity is Very low and Occcrence is Likely and Detectability is High then RPN is Low
10	If Severity is Very low and Occcrence is Frequent and Detectability is High then RPN is Low
11	If Severity is Very low and Occcrence is Rare and Detectability is Medium then RPN is Low
12	If Severity is Very low and Occcrence is Unlikely and Detectability is Medium then RPN is Low
13	If Severity is Very low and Occcrence is Possible and Detectability is Medium then RPN is Low
14	If Severity is Very low and Occcrence is Likely and Detectability is Medium then RPN is Low
15	If Severity is Very low and Occcrence is Frequent and Detectability is Medium then RPN is Low
16	If Severity is Very low and Occcrence is Rare and Detectability is Low then RPN is Low
17	If Severity is Very low and Occcrence is Unlikely and Detectability is Low then RPN is Low
18	If Severity is Very low and Occcrence is Possible and Detectability is Low then RPN is Low
19	If Severity is Very low and Occcrence is Likely and Detectability is Low then RPN is Low
20	If Severity is Very low and Occcrence is Frequent and Detectability is Low then RPN is Low
21	If Severity is Very low and Occcrence is Rare and Detectability is Very low then RPN is Low
22	If Severity is Very low and Occcrence is Unlikely and Detectability is Very low then RPN is Low
23	If Severity is Very low and Occcrence is Possible and Detectability is Very low then RPN is Low
24	If Severity is Very low and Occcrence is Likely and Detectability is Very low then RPN is Low
25	If Severity is Very low and Occcrence is Frequent and Detectability is Very low then RPN is Low
26	If Severity is Low and Occcrence is Rare and Detectability is Very high then RPN is Low
27	If Severity is Low and Occcrence is Unlikely and Detectability is Very high then RPN is Low
28	If Severity is Low and Occcrence is Possible and Detectability is Very high then RPN is Low
29	If Severity is Low and Occcrence is Likely and Detectability is Very high then RPN is Low
30	If Severity is Low and Occcrence is Frequent and Detectability is Very high then RPN is Medium
31	If Severity is Low and Occcrence is Rare and Detectability is High then RPN is Medium
32	If Severity is Low and Occcrence is Unlikely and Detectability is High then RPN is Medium
33	If Severity is Low and Occcrence is Possible and Detectability is High then RPN is Medium
34	If Severity is Low and Occcrence is Likely and Detectability is High then RPN is Medium
35	If Severity is Low and Occcrence is Frequent and Detectability is High then RPN is Medium
36	If Severity is Low and Occcrence is Rare and Detectability is Medium then RPN is Medium
37	If Severity is Low and Occcrence is Unlikely and Detectability is Medium then RPN is Medium
38	If Severity is Low and Occcrence is Possible and Detectability is Medium then RPN is Medium
39	If Severity is Low and Occcrence is Likely and Detectability is Medium then RPN is Medium
40	If Severity is Low and Occcrence is Frequent and Detectability is Medium then RPN is Medium
41	If Severity is Low and Occcrence is Rare and Detectability is Low then RPN is Medium
42	If Severity is Low and Occcrence is Unlikely and Detectability is Low then RPN is Medium
43	If Severity is Low and Occcrence is Possible and Detectability is Low then RPN is Medium
44	If Severity is Low and Occcrence is Likely and Detectability is Low then RPN is Medium
45	If Severity is Low and Occcrence is Frequent and Detectability is Low then RPN is Medium
46	If Severity is Low and Occcrence is Rare and Detectability is Very low then RPN is Medium
47	If Severity is Low and Occcrence is Unlikely and Detectability is Very low then RPN is Medium
48	If Severity is Low and Occcrence is Possible and Detectability is Very low then RPN is Medium
49	If Severity is Low and Occcrence is Likely and Detectability is Very low then RPN is Medium
50	If Severity is Low and Occcrence is Frequent and Detectability is Very low then RPN is Medium
51	If Severity is Medium and Occcrence is Rare and Detectability is Very high then RPN is Medium
52	If Severity is Medium and Occcrence is Unlikely and Detectability is Very high then RPN is Medium
53	If Severity is Medium and Occcrence is Possible and Detectability is Very high then RPN is Medium
54	If Severity is Medium and Occcrence is Likely and Detectability is Very high then RPN is Medium
55	If Severity is Medium and Occcrence is Frequent and Detectability is Very high then RPN is Medium
56	If Severity is Medium and Occcrence is Rare and Detectability is High then RPN is Medium
57	If Severity is Medium and Occcrence is Unlikely and Detectability is High then RPN is Medium
58	If Severity is Medium and Occcrence is Possible and Detectability is High then RPN is Medium
59	If Severity is Medium and Occcrence is Likely and Detectability is High then RPN is Medium
60	If Severity is Medium and Occcrence is Frequent and Detectability is High then RPN is Medium
61	If Severity is Medium and Occcrence is Rare and Detectability is Medium then RPN is Medium
62	If Severity is Medium and Occcrence is Unlikely and Detectability is Medium then RPN is Medium
63	If Severity is Medium and Occcrence is Possible and Detectability is Medium then RPN is Medium
64	If Severity is Medium and Occcrence is Likely and Detectability is Medium then RPN is Medium
65	If Severity is Medium and Occcrence is Frequent and Detectability is Medium then RPN is Medium
66	If Severity is Medium and Occcrence is Rare and Detectability is Low then RPN is Medium
67	If Severity is Medium and Occcrence is Unlikely and Detectability is Low then RPN is Medium
68	If Severity is Medium and Occcrence is Possible and Detectability is Low then RPN is Medium
69	If Severity is Medium and Occcrence is Likely and Detectability is Low then RPN is Medium
70	If Severity is Medium and Occcrence is Frequent and Detectability is Low then RPN is Medium
71	If Severity is Medium and Occcrence is Rare and Detectability is Very low then RPN is Medium
72	If Severity is Medium and Occcrence is Unlikely and Detectability is Very low then RPN is Medium
73	If Severity is Medium and Occcrence is Possible and Detectability is Very low then RPN is Medium
74	If Severity is Medium and Occcrence is Likely and Detectability is Very low then RPN is High
75	If Severity is Medium and Occcrence is Frequent and Detectability is Very low then RPN is High
76	If Severity is High and Occcrence is Rare and Detectability is Very high then RPN is Medium
77	If Severity is High and Occcrence is Unlikely and Detectability is Very high then RPN is Medium
78	If Severity is High and Occcrence is Possible and Detectability is Very high then RPN is Medium
79	If Severity is High and Occcrence is Likely and Detectability is Very high then RPN is Medium
80	If Severity is High and Occcrence is Frequent and Detectability is Very high then RPN is High
81	If Severity is High and Occcrence is Rare and Detectability is High then RPN is Medium
82	If Severity is High and Occcrence is Unlikely and Detectability is High then RPN is Medium
83	If Severity is High and Occcrence is Possible and Detectability is High then RPN is High
84	If Severity is High and Occcrence is Likely and Detectability is High then RPN is High
85	If Severity is High and Occcrence is Frequent and Detectability is High then RPN is High
86	If Severity is High and Occcrence is Rare and Detectability is Medium then RPN is Medium
87	If Severity is High and Occcrence is Unlikely and Detectability is Medium then RPN is High
88	If Severity is High and Occcrence is Possible and Detectability is Medium then RPN is High
89	If Severity is High and Occcrence is Likely and Detectability is Medium then RPN is High
90	If Severity is High and Occcrence is Frequent and Detectability is Medium then RPN is High
91	If Severity is High and Occcrence is Rare and Detectability is Low then RPN is Medium
92	If Severity is High and Occcrence is Unlikely and Detectability is Low then RPN is High
93	If Severity is High and Occcrence is Possible and Detectability is Low then RPN is High
94	If Severity is High and Occcrence is Likely and Detectability is Low then RPN is High
95	If Severity is High and Occcrence is Frequent and Detectability is Low then RPN is High
96	If Severity is High and Occcrence is Rare and Detectability is Very low then RPN is Medium
97	If Severity is High and Occcrence is Unlikely and Detectability is Very low then RPN is High
98	If Severity is High and Occcrence is Possible and Detectability is Very low then RPN is High
99	If Severity is High and Occcrence is Likely and Detectability is Very low then RPN is High
100	If Severity is High and Occcrence is Frequent and Detectability is Very low then RPN is High
101	If Severity is Very high and Occcrence is Rare and Detectability is Very high then RPN is Medium
102	If Severity is Very high and Occcrence is Unlikely and Detectability is Very high then RPN is High
103	If Severity is Very high and Occcrence is Possible and Detectability is Very high then RPN is High
104	If Severity is Very high and Occcrence is Likely and Detectability is Very high then RPN is High
105	If Severity is Very high and Occcrence is Frequent and Detectability is Very high then RPN is High
106	If Severity is Very high and Occcrence is Rare and Detectability is High then RPN is High
107	If Severity is Very high and Occcrence is Unlikely and Detectability is High then RPN is High
108	If Severity is Very high and Occcrence is Possible and Detectability is High then RPN is High
109	If Severity is Very high and Occcrence is Likely and Detectability is High then RPN is High
110	If Severity is Very high and Occcrence is Frequent and Detectability is High then RPN is Very high
111	If Severity is Very high and Occcrence is Rare and Detectability is Medium then RPN is High
112	If Severity is Very high and Occcrence is Unlikely and Detectability is Medium then RPN is High
113	If Severity is Very high and Occcrence is Possible and Detectability is Medium then RPN is High
114	If Severity is Very high and Occcrence is Likely and Detectability is Medium then RPN is High
115	If Severity is Very high and Occcrence is Frequent and Detectability is Medium then RPN is Very high
116	If Severity is Very high and Occcrence is Rare and Detectability is Low then RPN is High
117	If Severity is Very high and Occcrence is Unlikely and Detectability is Low then RPN is High
118	If Severity is Very high and Occcrence is Possible and Detectability is Low then RPN is Very high
119	If Severity is Very high and Occcrence is Likely and Detectability is Low then RPN is Very high
120	If Severity is Very high and Occcrence is Frequent and Detectability is Low then RPN is Very high
121	If Severity is Very high and Occcrence is Rare and Detectability is Very low then RPN is High
122	If Severity is Very high and Occcrence is Unlikely and Detectability is Very low then RPN is High
123	If Severity is Very high and Occcrence is Possible and Detectability is Very low then RPN is Very high
124	If Severity is Very high and Occcrence is Likely and Detectability is Very low then RPN is Very high
125	If Severity is Very high and Occcrence is Frequent and Detectability is Very low then RPN is Very high

. In the case of the determination of fuzzy severity, it established 625 rules; for the fuzzy RPN that number was 125, while for the other variables a smaller number of rules were defined.

3.4. Defuzzification of Fuzzy Logic Systems

Defuzzification is the process of converting a fuzzy set into numerical values. It becomes ongoing if even the smallest alteration in the input variable fails to cause a rapid change in one of the output variables. Hence, a group of authors J. Bonato, M. Badurina, and J. Dobrinić [21] chose the centroid method for its following advantages: it is well balanced, takes into account the height and width of the fuzzy output, and lastly, its results are consistent. The centroid method is defuzzified by finding a point that represents the center of gravity of the aggregated fuzzy set, and this method was also applied in this study. The calculation of the numerical value linguistic output is shown in Figure 5, which describes the model inference diagram.

The RPN risk quantification assessment was carried out by setting up a fourth fuzzy logic system. The input variables were defined by the triangular and trapezoid functions, as well as the output variable. The 3D responding function and the FIS rules resulted in the RPN risk value that was quantified depending on the input fuzzy variables S, O and D (Figure 6). What distinguishes the presented model from previous approaches is that pre-assessment was made for the input variables by defining the criteria for the evaluation and generation of fuzzy sets for them.

3.5. Analysis of Variance (ANOVA)

The statistical technique analysis of variance (ANOVA) was used to compare the means of the “S” and “D” values of the subject matter expert’s assessment, as well as the fuzzy calculated variables that were associated with ten failure modes, seen in

Table A2. The table contains subject matter experts’ assessment S and D for randomly selected failure modes and fuzzy calculation for HDS FCC unit.

Failure Mode	Possible Consequence, Severity ”S”	Process Controls, Detectability “D”		Experts			Fuzzy Variable
				1st	2nd	3th
1. Malfunction of fluid catalytic creaking debutanizer flow controls	The level in D-101 increases, liquid gets to the BD system thru PV-101B valve or safety valves PSV-101A/B, possible catalyst degradation, S/D.	FI-104, LIC-102, LSLH-101 IS-01 interlock	S	7	7	6	7.5
			D	1	1	1	2.14
2. Stuck of valve UV-102, dysfunction-	The level in D-101 rising further, liquid gets to safety valves PSV-101A/B. Feed must be stopped manually before the D-007 flare k.o. drum overfilling, S/D	FI-104, LIC-102, LSLH-101, D-007, LIS-013, I-102 Measurement is done manually by staff	S	7	7	6	7.5
			D	4	4	4	4.56
3. Malfunction of fluid catalytic creaking debutanizer flow controls	The level in D-101 decreasing, if D-101 emptying P-101A/B pumps dry running may cause damage. Combustible gas discharging at the pump sealing, fire hazard, S/D.	FI-104, LIC-102, LSLH-101 IS-02 interlock Storage tank level indicators and alarm Asset management system	S	7	7	7	7.5
			D	3	3	3	2.14
4. Feed parameters are out of range	The temperature of feed may increase above 80°C, the feed line and/or F-101 filter may be damaged. The quality of the product is out of specification. S/D of feed unit.	TI-101 (TAH) TI-102 Debutanizer shutdown Alarm signal on DCS	S	4	4	5	3.5
			D	4	4	4	4.56
5. Tube rupture on heat exchanger E-101	Leakage in E-101 heat exchanger, light hydrogen excess will cause an increase in reactor temperature, the temperature may reach a hazardous level, the reactor may be damaged, fire hazard, S/D	TI-108, TI-125, TSHH-108, TSHH-125, TI-126, TSHH-126 IS-04 interlock Lab analysis.	S	8	8	8	7.5
			D	7	7	8	8
6. PSV-103AB break, unnecessary open broken spring	R-101 pressure may decrease below the vapor pressure of the medium, feed must be stopped manually before the D-007 flare k.o. drum overfilling. S/D there is no pressure.	PIC-107 (PAL) Measurement required S/D to switch PSV	S	5	6	6	5.5
			D	7	7	7	7.5
7. TV-103 fails when IS-03 interlock system activated	IS-03 interlock closes, UV-104 as well, the feed stops. Temperature increasing near to the oil temperature may cause lighter damage.	TI-108, TI-125, TSHH-108, TSHH-125, TI-126 TSHH-126	S	4	4	4	3.5
			D	3	3	2	2.14
8. TV-103 fails when IS-04 interlock system activated	SHU reactor overheating protection (IS-04) does not close HC feed to the reactor, hot CH feeding may continue. The temperature in the reactor cannot be maintained, an exothermic reaction occurs, overheating in the reactor, fire hazard, S/D.	TI-108, TI-125, TSHH-108, TSHH-125, TI-126 TSHH-126	S	8	9	9	7.5
			D	1	1	1	2.14
9. P-104AB pump failure, cracking mechanical seal	High fluctuations and foaming at the reboiler return nozzle. Lower trays may be submerged and the separation declining. Without intervention temp reach the hazardous level, the reactor may be damaged, fire hazard, S/D	LIC-108 FIC-112 IS-09 interlock LG-112 (local)	S	9	8	9	7.5
			D	1	1	2	2.14
10. P-102AB reflux pump failure	D-102 reflux drum level increasing, tray 5 level decreasing. Blowdown to the flare through PSV-104A/B. The product is out of specification.	Tray 26: TI-133 Tray 33: TI-136 Tray 2: TI-135 Tray 17: TIC-137 FIC-114 (FAL) LIC-110 (LAH)	S	4	4	5	3.5
			D	4	4	4	4.56

. The subject matter experts were sourced from the process and technology, maintenance management department, and process control and instrumentation fields. INA refinery experts validated the model through its use on onsite failure modes, and have supported our research with their knowledge and skills. With the error α, the differences between the arithmetic group mean for “S” and “D” were not statistically significant (F < Fcrit), with results of the ANOVA presented in

Table 6. ANOVA: single Factor for fuzzy severity.

SUMMARY
Groups	Count	Sum	Average	Variance
Expert 1	10	63	6.3	3.566667
Expert 2	10	64	6.4	3.377778
Expert 3	10	65	6.5	2.944444
FUZZY “S”	10	61	6.1	3.6
ANOVA
Source of Variation	SS	df	MS	F	p-value	F crit
Between Groups	0.875	3	0.291667	0.086491	0.966993	2.866266
Within Groups	121.4	36	3.372222
Total	122.275	39

and

Table 7. ANOVA: single Factor for fuzzy detectability.

SUMMARY
Groups	Count	Sum	Average	Variance
Expert 1	10	35	3.5	4.944444
Expert 2	10	35	3.5	4.944444
Expert 3	10	36	3.6	5.6
FUZZY “D”	10	39.88	3.988	5.165262
ANOVA
Source of Variation	SS	df	MS	F	p-value	F crit
Between Groups	1.61708	3	0.539027	0.104391	0.956973	2.866266
Within Groups	185.8874	36	5.163538
Total	187.5044	39

. The variable “O” was not taken into consideration by an analyst with ANOVA, because it is based on quantitative data that is available in maintenance databases.

4. Discussion

The initial idea for the FMEA application was to detect as many as possible unknown failures within refinery systems. Generally speaking, this method describes the systematic analysis of the components of the system that is conducted in order to identify major failure modes and their importance for the performance of the entire system. FMEA’s strongest point lies in the very fact that it provides a systematic overview of the major failures in the system, which in turn forces management or any other authorities to (re)evaluate exactly how reliable the product unit system is. Furthermore, FMEA represents a strong foundation for future, all-encompassing quantitative analyses, such as a fault tree analysis, an event tree analysis, a root cause analysis, etc. Any systematic review, such as the one offered by FMEA, will most likely reveal the greatest number of weaknesses in the system that result from specific component failures. However, one must be aware that an FMEA grants no warranty, when claiming that all critical failures have been identified. Also, an FMEA could be unsuitable for systems entailing a high level of redundancy (for instance, with more components that operate with the same function, and where the failure of one unit does not result in system failure). In such systems, the analysis of individual component failures is not a matter of interest, as the functioning of the system is not compromised. Although then, the interest shifts to the combinations of events which jointly might contribute to system failures [36].

FMEA is used to identify key component failures which might lead to an accident, injury, and/or property loss. The major objectives of any FMEA are: to improve system safety, to make assets more reliable and readily available through evaluating what effects component failures would have on overall system performance, to determine those components that are vital to the safety of personnel and equipment, and, last but not least, to offer improvements to the system in general. Obviously, with safety being a major topic of any FMEA, its objectives in that area include: a system analysis to establish what effects and consequences component failures have on the performance of the system in its entirety, and, more narrowly, on safety: identifying those components that are essential to safety (where component failure might endanger system operation, cause injuries, property damage, or other losses), as well as (re)designing the system itself to enhance ‘passive’ reliability and, with it, safety in general.

An integrity maintenance management system should be set up based on the identified business critical systems and the risk of their failure. For high risks, it is necessary to determine risk mitigation actions and prioritize them according to the risk quantification, seen in

Table 8. FMEA results for high risks observed system.

No	Equipment	Risk	Unmitigated Risk				Mitigation Action Proposed	Fuzzy
			S	O	D	RPN		RPN
1	P-001 F101 A/B	Loss of T-101 Bottom pump around line capacity	8	9	4	288	Installation of larger/capacity/filters	464
2	CLC001 CFC003	Loss of Heavy Coker Gas Oil stripper bottom level control	9	4	7	252	More reliable measurement.	464
3	CLC020 CFC040	Loss of Heavy Coker Gas Oil stripper bottom level control	9	4	6	216	More reliable measurement. Continuous monitoring the transmitter/controller with self-diagnostic status in control room.	464
4	P1 draw-off pan	Loss of Heavy Coker Gas Oil product draw-off pan level	9	2	6	108	Review inspection plan and repair/assembly instruction with hydrotest.	464
5	P2 draw-off pan	Loss of Heavy Coker Gas Oil product draw-off pan level	9	2	6	108	Review inspection plan, WPS and repair/assembly instruction with hydrotest.	464
6	E-002 A/B/C	Loss of Heavy Coker Gas Oil -Fresh feed exchanger capacity	8	2	7	112	Check and clean at turnaround the tube bundle.	464
7	T-102 Pipeline T101-T102 Pipeline T102-T101	Loss of Heavy Coker Gas Oil product stripper integrity	8	2	7	112	Turnaround: Replace to new one.	464
8	CTC000	Loss of Light Catalytic Gas Oil air cooler (EA100) temperature control	5	4	6	120	More reliable measurement.	214
9	CLC002	Loss of D-006 sump level control	5	3	7	105	More reliable measurement. Continuous monitoring the transmitter/controller with self-diagnostic status in control room.	214
10	C-101	Loss of Wet Gas compressor	6	6	4	144	C-101 alternative (electric) drive.	214
11	E-101	High Fractionator overhead condensator outlet temperature	5	5	6	150	Define: external cleaning cycle and the corresponding regular cleaning.	214
12	P-015 F101 A/B	Loss of anti-sediment additive dosing.	8	2	7	112	Expert have to investigate need for application the anti-sediment agent.	464
13	P-104	Loss of Heavy Coker Gas Oil product pump capacity	8	2	6	96	P-104 New type more reliable pump.	464
14	P-105	Loss of Light Catalytic Gas Oil product pump capacity	8	2	6	96	P-105 New type more reliable pump	464
15	Pipeline T101-P106 Pipeline P106-E109 Pipeline E109-T101	Loss of Heavy Coker Gas Oil pump around integrity	9	1	8	72	Review the extinguishing system.	464

and

Table A3. Example of FMEA for the drum system of CDU.

No	Equipment	Risk	Unmitigated Risk				Mitigation Action Proposed	Fuzzy
			S	O	D	RPN		RPN
1.	D-101, D-102	Steam explosion	8	9	10	720	Change feed introduction.	464
2.	SP1AB, SP2AB, SP3, SP4AB, SP5, SP6AB, SP7AB, SP8AB,	Cannot switch drum because critical valves sensors, switch fault	9	7	6	378	Review the logic system(s).	738
3.	P-118AB	Too short cycle time (EDC loss)	6	8	7	336	Anti-foaming agent dosing instrumental control (DCS).	214
4.	P113ABC-P106AB	Too high outlet temperature	8	6	6	288	Review nozzle capacity.	464
5.	SP1AB	Too low skin temperature. (<150 °C)	9	6	5	270	Improved, more reliable replacement type.	464
6.	Tk-101	Coke cutting impossible	7	7	5	245	Regular review.	464
7.	Coke cutting system	Coke cutting impossible	7	5	7	245	Improved, more reliable replacement type (drilling system)	464
8.	SP6AB	H-101 plugging with coke.	9	5	5	225	Improved, more reliable replacement type.	464
9.	Coke handling system Crane(1),Conveyor(7),Crusher(1)	PIT filled up.	7	4	7	196	Associated organization (Logistics) maintenance (UPTIME) improvement: crane bucket, crane rope, crane rail wheels, crane electric cable, crushers, conveyors, folding rollers and guide rollers.	464
10.	Drums overhead line D101-2 to T-101	Pipe plug.	9	5	4	180	Evan Hyde: restore the HCGO quench;	464
11.	H-101 to D101-2 inlet line	Pipe block.	9	5	4	180	Analyst (heat) camera used from drum roof.	465
12.	V101A	Cannot open/close the drum.	7	6	4	168	Review the logic system (s).	465
13.	MPS supply line	MPS supply fault /leaks, block	7	6	4	168	Review MPS supply reliability, and improve if possible.	465
14.	D-101/D-102, SP3	Too low skin temperature (<150 °C)	6	7	4	168	Improved, more reliable replacement type.	214
15.	SP1AB, SP2AB,11AB	Critical valves fault /block/	8	3	5	120	Instructions: regular cleaning and inspection cycle maximum 2 years.	464
16.	CFC101 A/B	Quench water into drums controller	8	3	5	120	Instructions: Alternative steam stripping and water cooling beside local management;	464
17.	12AB, 14AB, SP7AB CXV128/129	Critical valves fault /PITCH formed in drums/	9	1	10	90	Inspection: according industry experience create action plan for inspection.	464
18.	P116-D107, pipeline	Coke Condensate system leaks	9	1	7	63	No recommendation	464
19.	E-102	Plugged by coke “explosion”	8	1	6	48	Outlet line connect to flare	214
20.	P-110 AB	Quench water supply pump	8	1	5	40	No recommendation	214

. The classification of mitigating actions that result from the FMEA analysis is as follows:

• Modification/ capital expenditures (new equipment installation to increase redundancy or detectability, replacement of existing equipment, new material used in the construction of any part, new by-pass line, etc.);
• Modification/ operative expenditures (new material used in the construction of any part, new by-pass line, etc.);
• Safety spare parts;
• Operation (start-up and shut-down instructions, monitoring, checking routes, cleaning, etc.);
• Preventive maintenance (maintenance instructions, autonomous works, diagnostics, time-based maintenance, usage-based maintenance, inspection, etc.);
• Maintenance execution (assembly instruction, contractor competencies, and capabilities, tools, etc.);
• Quality assurance (receiving goods, technical supervision, manufacturing checks, technical standard compliance, etc.).

This comprehensive exploration introduces, besides the adopted FMEA analyses for application within refinery complex systems, the pre-assessment of the input variables of FMEA analyses, which leads to the elimination of the influence of the deciding factors which are related to the knowledge and experience of the refinery’s experts. This pre-assessment of input variables also utilizes a fuzzy logic system. The four fuzzy logic system model is based on a business risk matrix, processed data, and experts’ knowledge and experience. This setup model bridges the uncertainty of the input variable used for calculating the RPN value.

Applying the fourth set of fuzzy logic in this research has found an extraordinary importance of the weight of the variables S, O, and D in the calculation of risk quantity and its prioritization. Thus, due to the contribution of fuzzy logic, it was possible to improve the understanding of the dynamics of complex problems, which are characterized by inaccurate and subjective information, and took into consideration experts’ knowledge and the major influence of severity concerning the other parameters of failure modes. That being said, this approach has not only solved FMEA’s limitations of the conventional approach, but has also made it possible to accurately analyze risk, as well as quantify it. While FMEA allows for the computing of RPN directly by multiplying S, O and D, it is not possible to match RPN values with evaluation criteria, using the traditional RPN. Fuzzy FMEA allows the assignmentof fuzzy sets of values to each level of S, O, and D; the combination of those sets is made through knowledge rules that systematically enhance the scale of RPN. As such, the value of the fuzzy model is derived fromthe strategies that specialists use to express their needs and obtain a response, according to what they have as a priority [37].

Fuzzy RPN was determined using five fuzzy sets (shown in Table 5.), having been categorized according to the risk response. The five risk response categories imply the following: insofar that the risk level is “very low” then the risk is negligible, i.e., existing measures are acceptable. For the “low” risk level, the risk is acceptable, existing measures are acceptable, and are manageable by routine procedures, however, further controls could be considered for continuous improvement. For a “medium” risk, the hazard must be eliminated, or other hazard controls must be implemented in due time, to reduce risk to a lower level. A risk level of “high” is intolerable, and risk must be addressed with a high priority. The hazard must be eliminated or other hazard controls must be implemented as soon as reasonably possible, with a high priority to reduce risk to a lower level. A risk level of “very high” is unacceptable, and in this case, the hazard must be eliminated, or other hazard controls must be implemented without delay and with top priority, to reduce risk to a lower level. From the previously defined rules, a staircase-shaped fuzzy RPN model was obtained, as shown in Figure 6d. The model is robust, relevant to minor changes in input parameters, and contains a significant characteristic of a response to quantified risk, unlike conventional RPN, where the scale is from 1 to 1000, and prioritizes exclusively according to RPN; potentially high-risk faults could be left out.

A large number of failures have the same RPN values. For example, three failure modes with the same RPN number were analyzed, seen in

Table 9. Example of risk prioritization.

No	Examples of Failure Mode	S	O	D	RPN	Fuzzy RPN	Priority
1	Break of feed pump P1 cause of the unit shutdown	8	2	5	80	464	1
2	Fouling and plug of heat exchanger cause the decreasing the temperature in the vessel (referent temp 100 °C)	2	5	8	80	86.7	3
3	Operation issue, gasoline in water causes environmental pollution, constantly product flow to the acid torch, not to the sulfur production plant.	5	8	2	80	214	2

. According to the conventional FMEA method, neither of the three cases would be considered because their respective RPNs were less than 100, so they would not be included on the list of significant risks for which mitigation activities should be defined. By applying the four fuzzy logic model, it became evident that the influence of individual variables significantly affected the prioritization of risks.

Where this paper differs from the paper by a group of authors J. Bonato, M. Badurina, and J. Dobrinić [21] is in the application of additional sets of fuzzy logic systems, which enabled a more precise determination of the input parameters for the calculation of the fuzzy RPN-a. Additionally, there is a difference in the obtained fuzzy RPN results; the previous paper stated that a fuzzy conclusion does not allow for the appearance of identical RPN values for different risk factor sets. The obtained fuzzy RPN results presented in this paper group quantified risk according to the risk response, thus aligning it with the business risk matrix.

In future research, we hope that colleagues will analyze assets (process equipment) more deeply, in such a manner that the key influencing equipment performance parameters become the criteria for determining the severity of malfunctions. In the absence of available data, an input parameter analysis, in combination with uncertain linguistic terms, will maintain the consistency of computation procedures, hence gaining more reliable severity variables. The unpredicted occurrence of breakdowns and a consequent unit shutdown is one of the most important causes of a decline in the performance of critical equipment. Furthermore, breakdowns and failures occur for a wide variety of reasons, such as poor management decisions, inefficient maintenance, operational actions, and the refinery work environment. Reliable equipment must remain in excellent condition over the turnaround cycle and not be exposed to unit shutdown.

5. Conclusions

This paper proposes a novel approach to ranking the risk that arises from an unconventional FMEA analysis via the implementation of the four fuzzy logic system. Unlike previous papers, which generally have used the fuzzy logic system to override the drawbacks of conventional FMEA, and to calculate an improved RPN, the proposed model contains a combination of four fuzzy logic systems, where the input parameters that affect the variables S, O and D are tested and analyzed additionally, i.e., a pre-assessment of input parameters is conducted through defined fuzzy logic systems.

The originality of this model is that it provides agility and strengthens the decision-making process, while taking into consideration inaccuracy, subjectivity, uncertainty, and imprecision; therefore, it was applied in order to precisely determine the severity, occurrence, and detectability variables. The fourth step of fuzzy logic in this research was addressed in order to emphasize the importance and weight of the variables S, O, and D according to risk response, using business risk matrix and human expert knowledge in the form of a non-linear relationship between variables. The result of this model was better accuracy in the calculation of the quantified failure mode risks, and the improved prioritization of mitigation activities.