Criticality Is Not Priority: How Engineering Leaders Decide What Work Comes First

01

The Monday morning backlog trap

A mid-size refinery or power station can carry ten to twenty thousand open notifications in its CMMS. When a large share of them are coded Priority 1, the code carries no information. Planners then fall back on proximity, seniority and noise: the operator who calls twice gets the crew, and the slow-developing failure on an unspared machine waits.

The ranking is usually not wrong. It is being asked to answer a question it was never designed for. A criticality register describes potential consequence. It says nothing about whether the asset is degrading this week, whether a regulator expects closure by the 30th, whether the drawings are current, whether the parts are in the storeroom, or whether a certified millwright is available on Thursday.

• Symptom: priority codes inflate until P1 means nothing.
• Symptom: turnaround scope grows until the window cannot hold it.
• Symptom: crews mobilize to work that stops for paperwork or parts.
• Symptom: compliance actions age quietly in a separate system.

Criticality tells you what would hurt most if it failed. Priority tells you what must be worked on now. Readiness tells you whether it can be. A plant that confuses the three is not prioritizing; it is queuing.

02

Asset criticality is foundational, but it is not priority

Asset criticality is the intrinsic potential consequence of losing a function: life safety, environment, production, cost and the system dependency that makes one failure cascade into many. It is a stable baseline, revisited at management of change, after turnarounds and when bad-actor reviews show the consequence model was wrong. BPG Criticality (criticality.blackoutpowergroup.com) structures exactly this baseline, with weighted dimensions and a dependency multiplier, as a decision-support input.

Task priority is time-bound. It answers how quickly risk is moving toward an unacceptable outcome and how much time remains to act. A Tier 1 compressor running smoothly may rightly sit at routine priority. A Tier 2 pump whose vibration has doubled in ten days may need to be worked first. The decision requires both: consequence sets the stakes, risk velocity sets the clock.

03

P0 non-negotiables: statutory, safety and environmental overrides

Some work does not compete. A mechanical integrity deficiency under a process safety program, an overdue relief device inspection, an environmental permit exceedance or a consent-decree milestone is not ranked against production optimization. It enters above the economic queue, and the only legitimate debate is the least-cost, lowest-risk way to comply.

These overrides are typically governed in an EHS and process safety platform such as Enablon or Sphera, while the physical work lives in SAP or Maximo. The common failure is that the two never meet: the audit action shows as open in one system while no work order, crew hours or materials exist in the other. Each P0 action needs a linked work order, an owner, a due date and a closure evidence requirement.

• Statutory or code inspection deadlines (pressure equipment, relief devices, fired equipment).
• Process safety actions from PHA, HAZOP, LOPA, incident investigation and MI audits.
• Environmental permit limits and regulatory commitments.
• Imminent life-safety hazards identified in the field.

04

Dynamic modifiers: condition and P-F acceleration

Condition data is what turns a static score into a live risk position. Bently Nevada System 1 for rotating machinery protection and diagnostics, and the AVEVA PI System for process history, are the plant-standard sources most engineering leaders already trust. Inspection findings from thickness surveys, thermography and oil analysis belong in the same picture.

The governing concept is the P-F interval from the FMECA. If a detected degradation mechanism typically progresses to functional failure in weeks, discovery itself raises priority regardless of the next planned outage. If the mechanism is slow and well-monitored, the work can wait for the window. The FMECA Criticality Guardian carries these intervals so the triage meeting is arguing about evidence, not intuition.

05

Document management as an execution gate

Document control is usually treated as back-office closeout. In practice it is one of the hardest constraints on execution. Work on a pressure boundary, a protection system or a control loop cannot safely or legally proceed if the P&ID is not current, the MOC is not approved, the isolation list does not match the field, or the weld procedure is not qualified for the material and thickness.

Mature organizations therefore treat document readiness as a gate with the same standing as material readiness. A work order is not released until the engineering package is current and approved. Engineering document platforms such as Hexagon SmartPlant Foundation and Autodesk Vault hold revision control; the CMMS references the governed revision; the planner confirms it before release. After execution, redlines and as-built records return to the master so the next crew does not inherit a stale drawing.

06

Spares and supply chain: the unspared single point of failure

Inventory status changes priority. An unspared duty pump with a rotor in the storeroom is a manageable risk; the same pump with a rotor quoted at an extended OEM lead time is a different risk, even though nothing physical has changed. When the spare is consumed, criticality has not moved but exposure has.

Long-lead procurement also inverts the calendar. If installation is six months away but the component lead time exceeds that, the procurement task is urgent now. SAP Materials Management and SAP Ariba, or the Maximo inventory equivalent, should flag critical-spare reservations, purchase order release dates and promised delivery against the planned execution date. Where long-term service agreements govern parts and field service, their mobilization terms belong in the same view.

07

Outage windows and schedule-critical float

Turnarounds create a category that ranking alone misses: schedule-critical work. An item can be moderate in consequence but must be engineered, approved and procured before a fixed window, or it slips by years. Its priority is driven by the float remaining between today and the last responsible date to be ready.

Oracle Primavera P6 carries the logic network, manning histograms and the outage critical path. Deltek Acumen Fuse checks whether that schedule is mechanically sound: open ends, hard constraints, out-of-sequence logic and false float. Where confidence matters, schedule risk analysis tests whether the window is achievable. A schedule that has not passed these checks should not be used to defend scope decisions.

08

The hardened industrial toolchain

No single platform resolves priority. Each tool owns one kind of evidence, and the value comes from disciplined handoffs between them. The list below is deliberately limited to platforms that plant managers, reliability leaders and turnaround superintendents recognize as industry baseline. Equivalent systems can fill the same roles.

09

A five-band priority hierarchy

Priority bands only work if each band has criteria, a response expectation and a named approval, and if the share of work in the top bands is actively limited. When more than a small fraction of the backlog sits in P0 and P1, the bands are inflated and must be re-triaged, not expanded.

10

The governance rhythm and the Principal's questions

Prioritization is a cadence, not a calculation. A weekly triage brings the Responsible Engineer, maintenance planning, operations, EHS, supply chain and the turnaround coordinator to one exception board. They resolve new P0 and P1 entries, clear document and material blockers, confirm discipline loading, and freeze the next two-week schedule. Changes inside the frozen window require a stated reason.

Tools and AI-assisted analytics can surface exceptions faster, but they do not accept risk. The Responsible Engineer and operations leadership remain accountable for deferral decisions, and each deferral should record its basis and review date. Quarterly, the criticality baseline itself is reviewed against failures, MOCs and bad actors.

• What is the failure mechanism, and how fast does it progress?
• What happens to the system, not just the asset, if it fails before we act?
• Is the spare physically in the storeroom, and what is the real lead time?
• Is the document package current and approved for this exact work?
• Which discipline is the bottleneck, and what else does this displace?
• If we defer, who accepts the risk, on what evidence, until when?