api 580-risk-based-inspection 2002

Risk-based Inspection

API RECOMMENDED PRACTICE 580FIRST EDITION, MAY 2002

Copyright American Petroleum Institute Provided by IHS under license with API Licensee=Borealis/9990751100

Not for Resale, 09/10/2008 00:22:58 MDTNo reproduction or networking permitted without license from IHS

--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


Downstream Segment

API RECOMMENDED PRACTICE 580FIRST EDITION, MAY 2002



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

SPECIAL NOTES

API publications necessarily address problems of a general nature. With respect to partic-ular circumstances, local, state, and federal laws and regulations should be reviewed.

API is not undertaking to meet the duties of employers, manufacturers, or suppliers towarn and properly train and equip their employees, and others exposed, concerning healthand safety risks and precautions, nor undertaking their obligations under local, state, or fed-eral laws.

Information concerning safety and health risks and proper precautions with respect to par-ticular materials and conditions should be obtained from the employer, the manufacturer orsupplier of that material, or the material safety data sheet.

Nothing contained in any API publication is to be construed as granting any right, byimplication or otherwise, for the manufacture, sale, or use of any method, apparatus, or prod-uct covered by letters patent. Neither should anything contained in the publication be con-strued as insuring anyone against liability for infringement of letters patent.

Generally, API standards are reviewed and revised, reaffirmed, or withdrawn at least everyfive years. Sometimes a one-time extension of up to two years will be added to this reviewcycle. This publication will no longer be in effect five years after its publication date as anoperative API standard or, where an extension has been granted, upon republication. Statusof the publication can be ascertained from the API Standards Department [telephone (202)682-8000]. A catalog of API publications and materials is published annually and updatedquarterly by API, 1220 L Street, N.W., Washington, D.C. 20005, www.api.org.

This document was produced under API standardization procedures that ensure appropri-ate notification and participation in the developmental process and is designated as an APIstandard. Questions concerning the interpretation of the content of this standard or com-ments and questions concerning the procedures under which this standard was developedshould be directed in writing to the director, Standards Department, American PetroleumInstitute, 1220 L Street, N.W., Washington, D.C. 20005, [email protected]. Requests forpermission to reproduce or translate all or any part of the material published herein shouldalso be addressed to the general manager.

API standards are published to facilitate the broad availability of proven, sound engineer-ing and operating practices. These standards are not intended to obviate the need for apply-ing sound engineering judgment regarding when and where these standards should beutilized. The formulation and publication of API standards is not intended in any way toinhibit anyone from using any other practices.

Any manufacturer marking equipment or materials in conformance with the markingrequirements of an API standard is solely responsible for complying with all the applicablerequirements of that standard. API does not represent, warrant, or guarantee that such prod-ucts do in fact conform to the applicable API standard.

All rights reserved. No part of this work may be reproduced, stored in a retrieval system, or transmitted by any means, electronic, mechanical, photocopying, recording, or otherwise,

without prior written permission from the publisher. Contact the Publisher, API Publishing Services, 1220 L Street, N.W., Washington, D.C. 20005.

Copyright © 2002 American Petroleum Institute



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

FOREWORD

This recommended practice is intended to provide guidance on developing a risk-basedinspection (RBI) program on fixed equipment and piping in the hydrocarbon and chemicalprocess industries. It includes:

• What is RBI• What are the key elements of RBI• How to implement a RBI programIt is based on knowledge and experience of engineers, inspectors, risk analysts and other

personnel in the hydrocarbon and chemical industry.RP 580 is intended to supplement API 510

Pressure Vessel Inspection Code

, API 570

Pip-ing Inspection Code

and API 653

Tank Inspection, Repair, Alteration and Reconstruction

.These API inspection codes and standards allow an owner/user latitude to plan an inspectionstrategy and increase or decrease the code designated inspection frequencies based on theresults of a RBI assessment. The assessment must systematically evaluate both the probabil-ity of failure and the associated consequence of failure. The probability of failure assessmentmust be based on all forms of deterioration that could reasonably be expected to affect thepiece of equipment in the particular service. Refer to the appropriate code for other RBIassessment requirements. RP 580 is intended to serve as a guide for users in properly per-forming such a RBI assessment.

The information in this recommended practice does not constitute and should not be con-strued as a code of rules, regulations, or minimum safe practices. The practices described inthis publication are not intended to supplant other practices that have proven satisfactory, noris this publication intended to discourage innovation and originality in the inspection ofhydrocarbon and chemical facilities. Users of this recommended practice are reminded thatno book or manual is a substitute for the judgment of a responsible, qualified inspector orengineer.

API publications may be used by anyone desiring to do so. Every effort has been made bythe Institute to assure the accuracy and reliability of the data contained in them; however, theInstitute makes no representation, warranty, or guarantee in connection with this publicationand hereby expressly disclaims any liability or responsibility for loss or damage resultingfrom its use or for the violation of any federal, state, or municipal regulation with which thisPublication may conflict.

Suggested revisions are invited and should be submitted to the director, Standards Depart-ment, American Petroleum Institute, 1220 L Street, N.W., Washington D.C. 20005, [email protected].

iii



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

CONTENTS

Page

1 INTRODUCTION, PURPOSE AND SCOPE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.1 Purpose. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21.3 Target Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

2 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32.1 Referenced Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32.2 Other References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

3 DEFINITIONS AND ACRONYMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43.2 Acronyms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

4 BASIC CONCEPTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74.1 What is Risk? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74.2 Risk Management and Risk Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74.3 The Evolution of Inspection Intervals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74.4 Inspection Optimization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84.5 Relative Risk vs. Absolute Risk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

5 INTRODUCTION TO RISK-BASED INSPECTION. . . . . . . . . . . . . . . . . . . . . . . . . . 85.1 Consequence and Probability for Risk-Based Inspection. . . . . . . . . . . . . . . . . . . 85.2 Types of RBI Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95.3 Precision vs. Accuracy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115.4 Understanding How RBI Can Help to Manage Operating Risks . . . . . . . . . . . . 115.5 Management of Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125.6 Relationship Between RBI and Other Risk-Based and Safety Initiatives . . . . . 125.7 Relationship with Jurisdictional Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . 13

6 PLANNING THE RBI ASSESSMENT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136.1 Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136.2 Establishing Objectives and Goals of a RBI Assessment . . . . . . . . . . . . . . . . . . 136.3 Initial Screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146.4 Establish Operating Boundaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166.5 Selecting a Type of RBI Assessment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166.6 Estimating Resources and Time Required . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

7 DATA AND INFORMATION COLLECTION FOR RBI ASSESSMENT . . . . . . . 177.1 RBI Data Needs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177.2 Data Quality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187.3 Codes and Standards—National and International . . . . . . . . . . . . . . . . . . . . . . . 187.4 Sources of Site Specific Data and Information . . . . . . . . . . . . . . . . . . . . . . . . . . 18

8 IDENTIFYING DETERIORATION MECHANISMS AND FAILURE MODES . . 198.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198.2 Failure and Failure Modes for Risk-Based Inspection . . . . . . . . . . . . . . . . . . . . 198.3 Deterioration Mechanisms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198.4 Other Failures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

v



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

ASSESSING PROBABILITY OF FAILURE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209.1 Introduction to Probability Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209.2 Units of Measure in the Probability of Failure Analysis. . . . . . . . . . . . . . . . . . . 209.3 Types of Probability Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219.4 Determination of Probability of Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

10 ASSESSING CONSEQUENCES OF FAILURE . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2310.1 Introduction to Consequence Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2310.2 Types of Consequence Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2310.3 Units of Measure in Consequence Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2410.4 Volume of Fluid Released . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2410.5 Consequence Effect Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

11 RISK DETERMINATION, ASSESSMENT AND MANAGEMENT. . . . . . . . . . . . 2611.1 Purpose. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2611.2 Determination of Risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2611.3 Risk Management Decisions and Acceptable Levels of Risk. . . . . . . . . . . . . . . 2811.4 Sensitivity Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2811.5 Assumptions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2811.6 Risk Presentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2911.7 Establishing Acceptable Risk Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2911.8 Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

12 RISK MANAGEMENT WITH INSPECTION ACTIVITIES . . . . . . . . . . . . . . . . . . 3012.1 Managing Risk by Reducing Uncertainty Through Inspection . . . . . . . . . . . . . 3012.2 Identifying Risk Management Opportunities from RBI

and Probability of Failure Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3012.3 Establishing an Inspection Strategy Based on Risk Assessment . . . . . . . . . . . . 3112.4 Managing Risk with Inspection Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3112.5 Managing Inspection Costs with RBI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3212.6 Assessing Inspection Results and Determining Corrective Action . . . . . . . . . . 3212.7 Achieving Lowest Life Cycle Costs with RBI . . . . . . . . . . . . . . . . . . . . . . . . . . 32

13 OTHER RISK MITIGATION ACTIVITIES. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3213.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3213.2 Equipment Replacement and Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3313.3 Evaluating Flaws for Fitness-for- Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3313.4 Equipment Modification, Redesign and Rerating. . . . . . . . . . . . . . . . . . . . . . . . 3313.5 Emergency Isolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3313.6 Emergency Depressurizing/De-inventory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3313.7 Modify Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3313.8 Reduce Inventory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3313.9 Water Spray/Deluge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3313.10 Water Curtain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3313.11 Blast-Resistant Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3313.12 Others . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

vi



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

REASSESSMENT AND UPDATING RBI ASSESSMENTS . . . . . . . . . . . . . . . . . . 3414.1 RBI Reassessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3414.2 Why Conduct a RBI Reassessment? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3414.3 When to Conduct a RBI Reassessment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

15 ROLES, RESPONSIBILITIES, TRAINING AND QUALIFICATIONS . . . . . . . . . 3515.1 Team Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3515.2 Team Members, Roles & Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3515.3 Training and Qualifications For RBI Application. . . . . . . . . . . . . . . . . . . . . . . . 36

16 RBI DOCUMENTATION AND RECORD-KEEPING . . . . . . . . . . . . . . . . . . . . . . . 3716.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3716.2 RBI Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3716.3 RBI Personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3716.4 Time Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3716.5 Assignment of Risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3716.6 Assumptions Made to Assess Risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3716.7 Risk Assessment Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3716.8 Mitigation and Follow-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3816.9 Codes, Standards and Government Regulations . . . . . . . . . . . . . . . . . . . . . . . . . 38

APPENDIX A DETERIORATION MECHANISMS . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Figures1 Management of Risk Using RBI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Risk Plot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Continuum of RBI Approaches. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Risk-based Inspection Planning Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Example Event Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 Example Risk Matrix Using Probability and Consequence Categories

to Display Risk Rankings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297 Risk Plot when Using Quantitative or Numeric Risk Values . . . . . . . . . . . . . . . . . 30

Tables1 Thinning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392 Stress Corrosion Cracking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413 Metallurgical and Environmental Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434 Mechanical Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

vii



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

1


1 Introduction, Purpose and Scope

1.1 PURPOSE

The purpose of this document is to provide users with thebasic elements for developing and implementing a risk-basedinspection (RBI) program. The methodology is presented in astep-by-step manner to the maximum extent practicable.Items covered are:

a. An introduction to the concepts and principles of risk-based inspection for risk management; and

b. Individual sections that describe the steps in applyingthese principles within the framework of the RBI process:

1. Planning the RBI Assessment.

2. Data and Information Collection.

3. Identifying Deterioration Mechanisms and FailureModes.

4. Assessing Probability of Failure.

5. Assessing Consequence of Failure.

6. Risk Determination, Assessment and Management.

7. Risk Management with Inspection Activities.

8. Other Risk Mitigation Activities.

9. Reassessment and Updating.

10. Roles, Responsibilities, Training and Qualifications.

11. Documentation and record-keeping.

The expected outcome from the application of the RBI pro-cess should be the linkage of risks with appropriate inspec-tion or other risk mitigation activities to manage the risks.The RBI process is capable of generating:

a. A ranking by risk of all equipment evaluated.

b. A detailed description of the inspection plan to beemployed for each equipment item, including:

1. Inspection method(s) that should be used (e.g., visual,UT, Radiography, WFMT).

2. Extent of application of the inspection method(s) (e.g.,percent of total area examined or specific locations).

3. Timing of inspections/examinations.

4. Risk management achieved through implementation ofthe inspection plan.

c. A description of any other risk mitigation activities (suchas repairs, replacements or safety equipment upgrades).

d. The expected risk levels of all equipment after the inspec-tion plan and other risk mitigation activities have beenimplemented.

1.1.1 Key Elements of a RBI Program

Key elements that should exist in any RBI program are:

a. Management systems for maintaining documentation, per-sonnel qualifications, data requirements and analysis updates.b. Documented method for probability of failuredetermination.c. Documented method for consequence of failuredetermination.d. Documented methodology for managing risk throughinspection and other mitigation activities.

However, all the elements outlined in 1.1 should be ade-quately addressed in RBI applications, in accordance with therecommended practices in this document.

1.1.2 RBI Benefits and Limitations

The primary work products of the RBI assessment andmanagement approach are plans that address ways to managerisks on an equipment level. These equipment plans highlightrisks from a safety/health/environment perspective and/orfrom an economic standpoint. In these plans, cost-effectiveactions for risk mitigation are recommended along with theresulting level of risk mitigation expected.

Implementation of these plans provides one of the follow-ing:

a. An overall reduction in risk for the facilities and equip-ment assessed.b. An acceptance/understanding of the current risk.

The RBI plans also identify equipment that does notrequire inspection or some other form of mitigation becauseof the acceptable level of risk associated with the equipment’scurrent operation. In this way, inspection and maintenanceactivities can be focused and more cost effective. This oftenresults in a significant reduction in the amount of inspectiondata that is collected. This focus on a smaller set of datashould result in more accurate information. In some cases, inaddition to risk reductions and process safety improvements,RBI plans may result in cost reductions.

RBI is based on sound, proven risk assessment and manage-ment principles. Nonetheless, RBI will not compensate for:

a. Inaccurate or missing information.b. Inadequate designs or faulty equipment installation.c. Operating outside the acceptable design envelope.d. Not effectively executing the plans.e. Lack of qualified personnel or teamwork.f. Lack of sound engineering or operational judgment.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

2 API R

ECOMMENDED

P

RACTICE

580

1.1.3 Using RBI as a Continuous Improvement Tool

Utilization of RBI provides a vehicle for continuouslyimproving the inspection of facilities and systematicallyreducing the risk associated with pressure boundary failures.As new data (such as inspection results) becomes available orwhen changes occur, reassessment of the RBI program can bemade that will provide a refreshed view of the risks. Riskmanagement plans should then be adjusted appropriately.

RBI offers the added advantage of identifying gaps orshortcomings in the effectiveness of commercially availableinspection technologies and applications. In cases wheretechnology cannot adequately and/or cost-effectively mitigaterisks, other risk mitigation approaches can be implemented.RBI should serve to guide the direction of inspection technol-ogy development, and hopefully promote a faster and broaderdeployment of emerging inspection technologies as well asproven inspection technologies that may be available but areunderutilized.

1.1.4 RBI as an Integrated Management Tool

RBI is a risk assessment and management tool thataddresses an area not completely addressed in other organiza-tional risk management efforts such as Process Hazards Anal-yses (PHA) or reliability centered maintenance (RCM). Itcomplements these efforts to provide a more thorough assess-ment of the risks associated with equipment operations.

RBI produces Inspection and Maintenance Plans for equip-ment that identify the actions that should be implemented toprovide reliable and safe operation. The RBI effort can provideinput into an organization’s annual planning and budgetingthat define the staffing and funds required to maintain equip-ment operation at acceptable levels of performance and risk.

1.2 SCOPE

1.2.1 Industry scope

Although the risk management principles and conceptsthat RBI is built on are universally applicable, RP 580 is spe-cifically targeted at the application of RBI in the hydrocarbonand chemical process industry.

1.2.2 Flexibility in Application

Because of the broad diversity in organizations’ size, cul-ture, federal and/or local regulatory requirements, RP 580offers users the flexibility to apply the RBI methodologywithin the context of existing corporate risk managementpractices and to accommodate unique local circumstances.The document is designed to provide a framework that clari-fies the expected attributes of a quality risk assessment with-out imposing undue constraints on users. RP 580 is intendedto promote consistency and quality in the identification,

assessment and management of risks pertaining to materialdeterioration, which could lead to loss of containment.

Many types of RBI methods exist and are currently beingapplied throughout industry. This document is not intended tosingle out one specific approach as the recommended methodfor conducting a RBI effort. The document instead isintended to clarify the elements of a RBI analysis.

1.2.3 Mechanical Integrity Focused

The RBI process is focused on maintaining the mechanicalintegrity of pressure equipment items and minimizing the riskof loss of containment due to deterioration. RBI is not a sub-stitute for a process hazards analysis (PHA) or HAZOP. Typi-cally, PHA risk assessments focus on the process unit designand operating practices and their adequacy given the unit’scurrent or anticipated operating conditions. RBI complementsthe PHA by focusing on the mechanical integrity related dete-rioration mechanisms and risk management through inspec-tion. RBI also is complementary to reliability centeredmaintenance (RCM) programs in that both programs arefocused on understanding failure modes, addressing themodes and therefore improving the reliability of equipmentand process facilities.

1.2.4 Equipment Covered

The following types of pressurized equipment and associ-ated components/internals are covered by this document:

a. Pressure vessels—all pressure containing components.b. Process piping—pipe and piping components.c. Storage tanks—atmospheric and pressurized.d. Rotating equipment—pressure containing components.e. Boilers and heaters—pressurized components.f. Heat exchangers (shells, heads, channels and bundles).g. Pressure relief devices.

1.2.5 Equipment Not Covered

The following non-pressurized equipment is not coveredby this document:

a. Instrument and control systems.b. Electrical systems.c. Structural systems.d. Machinery components (except pump and compressorcasings).

1.3 TARGET AUDIENCE

The primary audience for RP 580 is inspection and engi-neering personnel who are responsible for the mechanicalintegrity and operability of equipment covered by this rec-ommended practice. However, while an organization’sInspection/Materials Engineering group may champion theRBI initiative, RBI is not exclusively an inspection activity.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

R

ISK

-

BASED

I

NSPECTION

3

RBI requires the involvement of various segments of theorganization such as engineering, maintenance and opera-tions. Implementation of the resulting RBI product (e.g.,inspection plans, replacement/upgrading recommendations,etc.) may rest with more than one segment of the organiza-tion. RBI requires the commitment and cooperation of thetotal organization. In this context, while the primary audi-ence may be inspection and materials engineering personnel,others within the organization who are likely to be involvedshould be familiar with the concepts and principles embod-ied in the RBI methodology.

2 References

2.1 REFERENCED PUBLICATIONS

APIAPI 510

Pressure Vessel Inspection Code—Inspec-tion, Repair, Alteration, and Rerating

API 570

Piping Inspection Code—Inspection,Repair, Alteration, and Rerating of In-service Piping Systems

RP 579

Fitness-For-Service

Std 653

Tank Inspection, Repair, Alteration, andReconstruction

RP 750

Management of Process Hazards

RP 752

Management of Hazards Associated WithLocation of Process Plant Buildings, CMAManagers Guide

RP 941

Steels for Hydrogen Service at ElevatedTemperatures and Pressures in PetroleumRefineries and Petrochemical Plants

ACC

1

Responsible Care—CAER Code ResourceGuide

AIChE

2

Dow’s Fire and Explosion Index HazardClassification Guide

, 1994

ASME

3

A Comparison of Criteria For Acceptanceof Risk – PVRC Project 99-IP-01

, Febru-ary 16, 2000

EPA

4

58 FR 54190 (40

CFR

Part 68)

Risk Management Plan(RMP) Regulations

ISO

5

Risk Management Terminology

OSHA

6

29

CFR

1910.119

Process Safety Management

2.2 OTHER REFERENCES

The following publications are offered as a guide to assistthe user in the development of risk-based inspection pro-grams. These references have been developed specifically fordetermining risk of process units and equipment, and/ordeveloping risk-based inspection programs for process equip-ment. In these references, the user will find many more refer-ences and examples pertaining to risk assessments of processequipment.1. Publication 581

Base Resource Document on Risk-BasedInspection,

American Petroleum Institute.2.

Risk-Based Inspection

, Applications Handbook, Ameri-can Society of Mechanical Engineers.

3.

Risk-Based Inspection,

Development of Guidelines,CRTD, Vol. 20-3, American Society of Mechanical Engi-neers, 1994.

4.

Risk-Based Inspection,

Development of Guidelines,CRTD, Vol. 20-2, American Society of Mechanical Engi-neers, 1992.

5.

Guidelines for Quantitative Risk Assessment

, Center forChemical Process Safety, American Institute of Chemi-cal Engineers, 1989.

6. A Collaborative Framework for Office of Pipeline SafetyCost-Benefit Analyses, September 2, 1999.

7. Economic Values for Evaluation of Federal AviationAdministration Investment and Regulatory Programs,FAA-APO-98-8, June 1998.

The following references are more general in nature, butprovide background development in the field of risk analysisand decision making, while some provide relevant examples.

1.

Pipeline Risk Management Manual

, Muhlbauer, W.K.,Gulf Publishing Company, 2nd Edition, 1996.

2.

Engineering Economics and Investment Decision Meth-ods

, Stermole, F.J., Investment Evaluations Corporation,1984.

1

American Chemistry Council, 1300 Wilson Boulevard, Arlington,Virginia, 22209, www.americanchemistry.com.

2

American Institute of Chemical Engineers, 3 Park Avenue, NewYork, New York 10016-5991, www.aiche.org.

3

American Society of Mechanical Engineers, 345 East 47th Street,New York, New York 10017, www.asme.org.

4

Environmental Protection Agency, 1200 Pennsylvania Avenue,N.W., Washington, District of Columbia 20460, www.epa.gov.

5

International Organization for Standardization, 1, rue de Varembe,Case postale 56, CH-1211 Geneve 20, Switzerland, www.iso.ch.

6

Occupational Safety and Health Administration, 200 ConstitutionAvenue, N.W., Washington, District of Columbia 20210,www.osha.gov.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

4 API R

ECOMMENDED

P

RACTICE

580

3.

Introduction to Decision Analysis

, Skinner, D.C., Proba-bilistic Publishing, 1994.

4. Center for Process Safety, American Institute of Chemi-cal Engineers (AIChE).

Guidelines for Evaluating theCharacteristics of Vapor Cloud Explosions, Flash Fires,and BLEVEs.

New York: AIChE, 1994.5. Center for Process Safety, American Institute of Chemi-

cal Engineers (AIChE).

Guidelines for Use of VaporCloud Dispersion Models.

New York, AIChE, 1987.6. Center for Process Safety, American Institute of Chemi-

cal Engineers (AIChE). “International Conference andWorkshop on Modeling and Mitigating the Conse-quences of Accidental Releases of Hazardous Materials,”September 26-29, 1995. New York: AIChE, 1995.

7. Federal Emergency Management Agency, U.S. Depart-ment of Transportation, U.S. Environmental ProtectionAgency.

Handbook of Chemical Hazard Analysis Proce-dures,

1989.8. Madsen, Warren W. and Robert C. Wagner. “An Accu-

rate Methodology for Modeling the Characteristics ofExplosion Effects.”

Process Safety Progress

, 13 (July1994), 171-175.

9. Mercx, W.P.M., D.M. Johnson, and J. Puttock. “Valida-tion of Scaling Techniques for Experimental VaporCloud Explosion Investigations.”

Process SafetyProgress

, 14 (April 1995), 120.10. Mercx, W.P.M., R.M.M. van Wees, and G. Opschoor.

“Current Research at TNO on Vapor Cloud ExplosionModeling.”


, 12 (October 1993),222.

11. Prugh, Richard W. “Quantitative Evaluation of FireballHazards.”


, 13 (April 1994), 83-91.

12. Scheuermann, Klaus P. “Studies About the Influence ofTurbulence on the Course of Explosions.”

Process SafetyProgress

, 13 (October 1994), 219.13. TNO Bureau for Industrial Safety, Netherlands Organiza-

tion for Applied Scientific Research. Methods for theCalculation of the Physical Effects of the Escape of Dan-gerous Material (Liquids and Gases). Voorburg, theNetherlands: TNO (Commissioned by Directorate-Gen-eral of Labour), 1980.

14. TNO Bureau for Industrial Safety, Netherlands Organiza-tion for Applied Scientific Research. Methods for theDetermination of Possible Deterioration to People andObjects Resulting from Releases of Hazardous Materi-als. Rijswijk, the Netherlands: TNO (Commissioned byDirectorate-General of Labour), 1992.

15. Touma, Jawad S., et al. “Performance Evaluation ofDense Gas Dispersion Models.”

Journal of AppliedMeteorology

, 34 (March 1995), 603-615.16. U.S. Environmental Protection Agency, Federal Emer-

gency Management Agency, U.S. Department ofTransportation.

Technical Guidance for Hazards Analy-

sis, Emergency Planning for Extremely HazardousSubstances

. December 1987.17. U.S. Environmental Protection Agency, Office of Air

Quality Planning and Standards.

Workbook of ScreeningTechniques for Assessing Impacts of Toxic Air Pollutants

.EPA-450/4-88-009. September 1988.

18. U.S. Environmental Protection Agency, Office of AirQuality Planning and Standards.

Guidance on the Appli-cation of Refined Dispersion Models for Hazardous/Toxic Air Release

. EPA-454/R-93-002. May 1993.19. U.S. Environmental Protection Agency, Office of Pollu-

tion Prevention and Toxic Substances. Flammable Gasesand Liquids and Their Hazards. EPA 744-R-94-002.February 1994.

3 Definitions and Acronyms

3.1 DEFINITIONS

For purposes of this recommended practice, the followingdefinitions shall apply.

3.1.1 absolute risk:

An ideal and accurate descriptionand quantification of risk.

3.1.2 ALARP (As Low As Reasonably Practical):

Aconcept of minimization that postulates that attributes (suchas risk) can only be reduced to a certain minimum under cur-rent technology and with reasonable cost.

3.1.3 consequence:

Outcome from an event. There maybe one or more consequences from an event. Consequencesmay range from positive to negative. However, consequencesare always negative for safety aspects. Consequences may beexpressed qualitatively or quantitatively.

3.1.4 damage tolerance:

The amount of deteriorationthat a component can withstand without failing.

3.1.5 deterioration:

The reduction in the ability of acomponent to provide its intended purpose of containment offluids. This can be caused by various deterioration mecha-nisms (e.g., thinning, cracking, mechanical). Damage or deg-radation may be used in place of deterioration.

3.1.6 event:

Occurrence of a particular set of circum-stances. The event may be certain or uncertain. The event canbe singular or multiple. The probability associated with theevent can be estimated for a given period of time.

3.1.7 event tree:

An analytical tool that organizes andcharacterizes potential accidents in a logical and graphicalmanner. The event tree begins with the identification ofpotential initiating events. Subsequent possible events(including activation of safety functions) resulting from theinitiating events are then displayed as the second level of theevent tree. This process is continued to develop pathways orscenarios from the initiating events to potential outcomes.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

R

ISK

-

BASED

I

NSPECTION

5

3.1.8 external event:

Events resulting from forces ofnature, acts of God or sabotage, or such events as neighboringfires or explosions, neighboring hazardous material releases,electrical power failures, tornadoes, earthquakes, and intru-sions of external transportation vehicles, such as aircraft,ships, trains, trucks, or automobiles. External events are usu-ally beyond the direct or indirect control of persons employedat or by the facility.

3.1.9 failure:

Termination of the ability of a system, struc-ture, or component to perform its required function of con-tainment of fluid (i.e., loss of containment). Failures may beunannounced and undetected until the next inspection (unan-nounced failure), or they may be announced and detected byany number of methods at the instance of occurrence(announced failure).

3.1.10 failure mode:

The manner of failure. For risk-based inspection, the failure of concern is loss of containmentof pressurized equipment items. Examples of failure modesare small hole, crack, and rupture.

3.1.11 hazard:

A physical condition or a release of a haz-ardous material that could result from component failure andresult in human injury or death, loss or damage, or environ-mental degradation. Hazard is the source of harm. Compo-nents that are used to transport, store, or process a hazardousmaterial can be a source of hazard. Human error and externalevents may also create a hazard.

3.1.12 Hazard and Operability (HAZOP) Study:

AHAZOP study is a form of failure modes and effects analysis.HAZOP studies, which were originally developed for the pro-cess industry, use systematic techniques to identify hazardsand operability issues throughout an entire facility. It is partic-ularly useful in identifying unforeseen hazards designed intofacilities due to lack of information, or introduced into exist-ing facilities due to changes in process conditions or operat-ing procedures. The basic objectives of the techniques are:

a. To produce a full description of the facility or process,including the intended design conditions.b. To systematically review every part of the facility or pro-cess to discover how deviations from the intention of thedesign can occur.c. To decide whether these deviations can lead to hazards oroperability issues.d. To assess effectiveness of safeguards.

3.1.13 likelihood:

Probability.

3.1.14 mitigation:

Limitation of any negative conse-quence or reduction in probability of a particular event.

3.1.15 probability:

Extent to which an event is likely tooccur within the time frame under consideration. The mathe-matical definition of probability is “a real number in the scale0 to 1 attached to a random event”. Probability can be related

to a long-run relative frequency of occurrence or to a degreeof belief that an event will occur. For a high degree of belief,the probability is near one. Frequency rather than probabilitymay be used in describing risk. Degrees of belief about prob-ability can be chosen as classes or ranks like “Rare/unlikely/moderate/likely/almost certain” or “incredible/improbable/remote/ occasional/probable/frequent”.

3.1.16 Qualitative Risk Analysis (Assessment):

Methods that use engineering judgment and experience as thebases for the analysis of probabilities and consequences offailure. The results of qualitative risk analyses are dependenton the background and expertise of the analysts and theobjectives of the analysis. Failure Modes, Effects, and Criti-cality Analysis (FMECA) and HAZOPs are examples ofqualitative risk analysis techniques that become quantitativerisk analysis methods when consequence and failure proba-bility values are estimated along with the respective descrip-tive input.

3.1.17 Quantitative Risk Analysis (Assessment):

An analysis that:

a. Identifies and delineates the combinations of events that, ifthey occur, will lead to a severe accident (e.g., major explo-sion) or any other undesired event.

b. Estimates the frequency of occurrence for eachcombination.

c. Estimates the consequences.

Quantitative risk analysis integrates into a uniform meth-odology the relevant information about facility design, oper-ating practices, operating history, component reliability,human actions, the physical progression of accidents, andpotential environmental and health effects, usually in as real-istic a manner as possible.

Quantitative risk analysis uses logic models depictingcombinations of events that could result in severe accidentsand physical models depicting the progression of accidentsand the transport of a hazardous material to the environment.The models are evaluated probabilistically to provide bothqualitative and quantitative insights about the level of risk andto identify the design, site, or operational characteristics thatare the most important to risk.

Quantitative risk analysis logic models generally consist ofevent trees and fault trees. Event trees delineate initiatingevents and combinations of system successes and failures,while fault trees depict ways in which the system failures rep-resented in the event trees can occur. These models are ana-lyzed to estimate the frequency of each accident sequence.

3.1.18 relative risk:

The comparative risk of a facility,process unit, system, equipment item or component to otherfacilities, process units, systems, equipment items or compo-nents, respectively.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

6 API R

ECOMMENDED

P

RACTICE

580

3.1.19 residual risk:

The risk remaining after risk miti-gation.

3.1.20 risk:

Combination of the probability of an eventand its consequence. In some situations, risk is a deviationfrom the expected. When probability and consequence areexpressed numerically, risk is the product.

3.1.21 risk acceptance:

A decision to accept a risk. Riskacceptance depends on risk criteria.

3.1.22 risk analysis:

Systematic use of information toidentify sources and to estimate the risk. Risk analysis pro-vides a basis for risk evaluation, risk mitigation and riskacceptance. Information can include historical data, theoreti-cal analysis, informed opinions and concerns of stakeholders.

3.1.23 risk assessment:

Overall process of risk analysisand risk evaluation.

3.1.24 risk avoidance:

Decision not to become involvedin, or action to withdraw from a risk situation. The decisionmay be taken based on the result of risk evaluation.

3.1.25 risk-based inspection:

A risk assessment andmanagement process that is focused on loss of containment ofpressurized equipment in processing facilities, due to materialdeterioration. These risks are managed primarily throughequipment inspection.

3.1.26 risk communication:

Exchange or sharing ofinformation about risk between the decision maker and otherstakeholders. The information may relate to the existence,nature, form, probability, severity, acceptability, mitigation orother aspects of risk.

3.1.27 risk control:

Actions implementing risk manage-ment decisions. Risk control may involve monitoring, re-evaluation, acceptance and compliance with decisions.

3.1.28 risk criteria: Terms of reference by which the sig-nificance of risk is assessed. Risk criteria may include associ-ated cost and benefits, legal and statutory requirements,socio-economic and environmental aspects, concerns ofstakeholders, priorities and other inputs to the assessment.

3.1.29 risk estimation: Process used to assign values tothe probability and consequence of a risk. Risk estimationmay consider cost, benefits, stakeholder concerns and othervariables, as appropriate for risk evaluation.

3.1.30 risk evaluation: Process used to compare the esti-mated risk against given risk criteria to determine the signifi-cance of the risk. Risk evaluation may be used to assist in theacceptance or mitigation decision.

3.1.31 risk identification: Process to find, list, and char-acterize elements of risk. Elements may include; source,event, consequence, probability. Risk identification may alsoidentify stakeholder concerns.

3.1.32 risk management: Coordinated activities todirect and control an organization with regard to risk. Riskmanagement typically includes risk assessment, risk mitiga-tion, risk acceptance and risk communication.

3.1.33 risk mitigation: Process of selection and imple-mentation of measures to modify risk. The term risk mitiga-tion is sometimes used for measures themselves.

3.1.34 risk reduction: Actions taken to lessen the proba-bility, negative consequences, or both associated with a par-ticular risk.

3.1.35 source: Thing or activity with a potential for con-sequence. Source in a safety context is a hazard.

3.1.36 source identification: Process to find, list, andcharacterize sources. In the safety area, source identificationis called hazard identification.

3.1.37 stakeholder: Any individual, group or organiza-tion that may affect, be affected by, or perceive itself to beaffected by the risk.

3.1.38 toxic chemical: Any chemical that presents aphysical or health hazard or an environmental hazard accord-ing to the appropriate Material Safety Data Sheet. Thesechemicals (when ingested, inhaled or absorbed through theskin) can cause damage to living tissue, impairment of thecentral nervous system, severe illness, or in extreme cases,death. These chemicals may also result in adverse effects tothe environment (measured as ecotoxicity and related to per-sistence and bioaccumulation potential).

3.1.39 unmitigated risk: The risk prior to mitigationactivities.

3.2 ACRONYMS

ACC American Chemistry CouncilAIChE American Institute of Chemical EngineersALARP As Low As Reasonably PracticalANSI American National Standards InstituteAPI American Petroleum InstituteASME American Society of Mechanical

EngineersASNT American Society of Nondestructive

TestingASTM American Society of Testing and MaterialsBLEVE Boiling Liquid Expanding Vapor

ExplosionCCPS Center for Chemical Process SafetyCOF Consequence of FailureEPA Environmental Protection AgencyFAR Fatality Accident RateFMEA Failure Modes and Effects AnalysisHAZOP Hazard and Operability Assessment



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

RISK-BASED INSPECTION 7

ISO International Organization for Standardization

MOC Management of ChangeNACE National Association of Corrosion

EngineersNDE Non destructive examinationNFPA National Fire Protection AssociationOSHA Occupational Safety and Health

AdministrationPHA Process Hazards AnalysisPMI Positive Material IdentificationPOF Probability of FailurePSM Process Safety ManagementPVRC Pressure Vessel Research CouncilQA/QC Quality Assurance/Quality ControlQRA Quantitative Risk AssessmentRBI Risk-Based InspectionRCM Reliability Centered MaintenanceRMP Risk Management PlanTEMA Tubular Exchangers Manufacturers

AssociationTNO The Netherlands Organization for Applied

Scientific Research

4 Basic Concepts4.1 WHAT IS RISK?

Risk is something that we as individuals live with on a day-to-day basis. Knowingly or unknowingly, people are con-stantly making decisions based on risk. Simple decisionssuch as driving to work or walking across a busy streetinvolve risk. More important decisions such as buying ahouse, investing money and getting married all imply anacceptance of risk. Life is not risk-free and even the mostcautious, risk-adverse individuals inherently take risks.

For example, in driving a car, people accept the probabilitythat they could be killed or seriously injured. The reason thisrisk is accepted is that people consider the probability ofbeing killed or seriously injured to be sufficiently low as tomake the risk acceptable. Influencing the decision are thetype of car, the safety features installed, traffic volume andspeed, and other factors such as the availability, risks andaffordability of other alternatives (e.g., mass transit).

Risk is the combination of the probability of some eventoccurring during a time period of interest and the conse-quences, (generally negative) associated with the event. Inmathematical terms, risk can be calculated by the equation:

Risk = Probability x Consequence

Likelihood is sometimes used as a synonym for probabil-ity, however probability is used throughout this document forconsistency.

4.2 RISK MANAGEMENT AND RISK REDUCTION

At first, it may seem that risk management and risk reduc-tion are synonymous. However, risk reduction is only part ofrisk management. Risk reduction is the act of mitigating aknown risk to a lower level of risk. Risk management is a pro-cess to assess risks, to determine if risk reduction is requiredand to develop a plan to maintain risks at an acceptable level.By using risk management, some risks may be identified asacceptable so that no risk reduction (mitigation) is required.

4.3 THE EVOLUTION OF INSPECTION INTERVALS

In process plants, inspection and testing programs areestablished to detect and evaluate deterioration due to in-ser-vice operation. The effectiveness of inspection programs var-ies widely, ranging from reactive programs, whichconcentrate on known areas of concern, to broad proactiveprograms covering a variety of equipment. One extreme ofthis would be the “don’t fix it unless it’s broken” approach.The other extreme would be complete inspection of all equip-ment items on a frequent basis.

Setting the intervals between inspections has evolved overtime. With the need to periodically verify equipment integrity,organizations initially resorted to time-based or “calendar-based” intervals.

With advances in inspection approaches, and better under-standing of the type and rate of deterioration, inspection inter-vals became more dependent on the equipment condition,rather than what might have been an arbitrary calendar date.Codes and standards such as API 510, 570 and 653 evolved toan inspection philosophy with elements such as:

a. Inspection intervals based on some percentage of equip-ment life (such as half life).

b. On-stream inspection in lieu of internal inspection basedon low deterioration rates.

c. Internal inspection requirements for deterioration mecha-nisms related to process environment induced cracking.

d. Consequence based inspection intervals.

RBI represents the next generation of inspectionapproaches and interval setting, recognizing that the ultimategoal of inspection is the safety and reliability of operatingfacilities. RBI, as a risk-based approach, focuses attentionspecifically on the equipment and associated deteriorationmechanisms representing the most risk to the facility. Infocusing on risks and their mitigation, RBI provides a betterlinkage between the mechanisms that lead to equipment fail-ure and the inspection approaches that will effectivelyreduce the associated risks. In this document, failure is lossof containment.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

8 API RECOMMENDED PRACTICE 580

4.4 INSPECTION OPTIMIZATION

When the risk associated with individual equipment itemsis determined and the relative effectiveness of differentinspection techniques in reducing risk is estimated or quanti-fied, adequate information is available for developing an opti-mization tool for planning and implementing a risk-basedinspection program.

Figure 1 presents stylized curves showing the reduction inrisk that can be expected when the degree and frequency ofinspection are increased. The upper curve in Figure 1 repre-sents a typical inspection program. Where there is no inspec-tion, there may be a higher level of risk, as indicated on the y-axis in the figure. With an initial investment in inspectionactivities, risk generally is significantly reduced. A point isreached where additional inspection activity begins to show adiminishing return and, eventually, may produce very littleadditional risk reduction. If excessive inspection is applied,the level of risk may even go up. This is because invasiveinspections in certain cases may cause additional deteriora-tion (e.g., moisture ingress in equipment with polythionicacid; inspection damage to protective coatings or glass linedvessels). This situation is represented by the dotted line at theend of the upper curve.

RBI provides a consistent methodology for assessing theoptimum combination of methods and frequencies. Eachavailable inspection method can be analyzed and its relativeeffectiveness in reducing failure probability estimated. Giventhis information and the cost of each procedure, an optimiza-tion program can be developed. The key to developing such aprocedure is the ability to assess the risk associated with eachitem of equipment and then to determine the most appropriateinspection techniques for that piece of equipment. A concep-tual result of this methodology is illustrated by the lowercurve in Figure 1. The lower curve indicates that with theapplication of an effective RBI program, lower risks can beachieved with the same level of inspection activity. This isbecause, through RBI, inspection activities are focused onhigher risk items and away from lower risk items.

As shown in Figure 1, risk cannot be reduced to zero solelyby inspection efforts. The residual risk factors for loss of con-tainment include, but are not limited to, the following:

a. Human error.b. Natural disasters.c. External events (e.g., collisions or falling objects).d. Secondary effects from nearby units.e. Consequential effects from associated equipment in thesame unit.f. Deliberate acts (e.g., sabotage).g. Fundamental limitations of inspection method.h. Design errors.i. Unknown mechanisms of deterioration.

Many of these factors are strongly influenced by the pro-cess safety management system in place at the facility.

4.5 RELATIVE RISK VS. ABSOLUTE RISK

The complexity of risk calculations is a function of thenumber of factors that can affect the risk. Calculating abso-lute risk can be very time and cost consuming and often, dueto having too many uncertainties, is impossible. Many vari-ables are involved with loss of containment in hydrocarbonand chemical facilities and the determination of absolute risknumbers is often not cost effective. RBI is focused on a sys-tematic determination of relative risks. In this way, facilities,units, systems, equipment or components can be rankedbased on relative risk. This serves to focus the risk manage-ment efforts on the higher ranked risks.

It is considered, however, that if a Quantitative RBI studyis conducted rigorously that the resultant risk number is afair approximation of the actual risk of loss of containmentdue to deterioration. Numeric risk values determined in qual-itative and semi-quantitative assessments using appropriatesensitivity analysis methods also may be used to evaluaterisk acceptance.

5 Introduction to Risk-Based Inspection5.1 CONSEQUENCE AND PROBABILITY FOR

RISK-BASED INSPECTION

The objective of RBI is to determine what incident couldoccur (consequence) in the event of an equipment failure, andhow likely (probability) is it that the incident could happen.For example, if a pressure vessel subject to deterioration fromcorrosion under insulation develops a leak, a variety of conse-quences could occur. Some of the possible consequences are:

Figure 1—Management of Risk Using RBI

Level of inspection activity

Ris

k

Risk using RBIand an optimizedinspection program

Residual risk notaffected by RBI

Risk with typical inspection programs



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


a. Form a vapor cloud that could ignite causing injury andequipment damage.

b. Release of a toxic chemical that could cause healthproblems.

c. Result in a spill and cause environmental deterioration.

d. Force a unit shutdown and have an adverse economicimpact.

e. Have minimal safety, health, environmental and/or eco-nomic impact.

Combining the probability of one or more of these eventswith its consequences will determine the risk to the operation.Some failures may occur relatively frequently without signifi-cant adverse safety, environmental or economic impacts.Similarly, some failures have potentially serious conse-quences, but if the probability of the incident is low, then therisk may not warrant immediate action. However, if the prob-ability and consequence combination (risk) is high enough tobe unacceptable, then a mitigation action to predict or preventthe event is recommended.

Traditionally, organizations have focused solely on theconsequences of failure or on the probability without system-atic efforts tying the two together. They have not consideredhow likely it is that an undesirable incident will occur. Onlyby considering both factors can effective risk-based decisionmaking take place. Typically, risk acceptability criteria aredefined, recognizing that not every failure will lead to anundesirable incident with serious consequence (e.g., waterleaks) and that some serious consequence incidents have verylow probabilities.

Understanding the two-dimensional aspect of risk allowsnew insight into the use of risk for inspection prioritizationand planning. Figure 2 displays the risk associated with theoperation of a number of equipment items in a process plant.Both the probability and consequence of failure have beendetermined for ten equipment items, and the results have beenplotted. The points represent the risk associated with eachequipment item. Ordering by risk produces a risk-basedranking of the equipment items to be inspected. From thislist, an inspection plan can be developed that focuses atten-tion on the areas of highest risk. An “iso-risk” line is shownon Figure 2. This line represents a constant risk level. A userdefined acceptable risk level could be plotted as an iso-riskline. In this way the acceptable risk line would separate theunacceptable from the acceptable risk items. Often a risk plotis drawn using log-log scales for a better understanding of therelative risks of the items assessed.

5.2 TYPES OF RBI ASSESSMENT

Various types of RBI assessment may be conducted at sev-eral levels. The choice of approach is dependent on multiplevariables such as:

a. Objective of the study.b. Number of facilities and equipment items to study.c. Available resources.d. Study time frame.e. Complexity of facilities and processes.f. Nature and quality of available data.

The RBI procedure can be applied qualitatively, quantita-tively or by using aspects of both (i.e., semi-quantitatively).Each approach provides a systematic way to screen for risk,identify areas of potential concern, and develop a prioritizedlist for more in depth inspection or analysis. Each develops arisk ranking measure to be used for evaluating separately theprobability of failure and the potential consequence of failure.These two values are then combined to estimate risk. Use ofexpert opinion will typically be included in most risk assess-ments regardless of type or level.

5.2.1 Qualitative Approach

This approach requires data inputs based on descriptiveinformation using engineering judgment and experience asthe basis for the analysis of probability and consequence offailure. Inputs are often given in data ranges instead of dis-crete values. Results are typically given in qualitative termssuch as high, medium and low, although numerical valuesmay be associated with these categories. The value of thistype of analysis is that it enables completion of a risk assess-ment in the absence of detailed quantitative data. The accu-racy of results from a qualitative analysis is dependent on thebackground and expertise of the analysts.

5.2.2 Quantitative Approach

Quantitative risk analysis integrates into a uniform meth-odology the relevant information about facility design, oper-ating practices, operating history, component reliability,

Figure 2—Risk Plot

Consequence of failure

Pro

babi

lity

of fa

ilure

ISO-risk line

1 2

3

4

5

6

7

8

910



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


human actions, the physical progression of accidents, andpotential environmental and health effects.

Quantitative risk analysis uses logic models depictingcombinations of events that could result in severe accidentsand physical models depicting the progression of accidentsand the transport of a hazardous material to the environment.The models are evaluated probabilistically to provide bothqualitative and quantitative insights about the level of risk andto identify the design, site, or operational characteristics thatare the most important to risk. Quantitative risk analysis isdistinguished from the qualitative approach by the analysisdepth and integration of detailed assessments.

Quantitative risk analysis logic models generally consist ofevent trees and fault trees. Event trees delineate initiatingevents and combinations of system successes and failures,while fault trees depict ways in which the system failures rep-resented in the event trees can occur. These models are ana-lyzed to estimate the probability of each accident sequence.Results using this approach are typically presented as risknumbers (e.g., cost per year).

5.2.3 Semi-quantitative Approach

Semi-quantitative is a term that describes any approachthat has aspects derived from both the qualitative and quanti-tative approaches. It is geared to obtain the major benefits ofthe previous two approaches (e.g., speed of the qualitativeand rigor of the quantitative). Typically, most of the data usedin a quantitative approach is needed for this approach but inless detail. The models also may not be as rigorous as thoseused for the quantitative approach. The results are usuallygiven in consequence and probability categories rather thanas risk numbers but numerical values may be associated witheach category to permit the calculation of risk and the appli-cation of appropriate risk acceptance criteria.

5.2.4 Continuum of Approaches

In practice, a RBI study typically uses aspects of qualita-tive, quantitative and semi-quantitative approaches. TheseRBI approaches are not considered as competing but rather ascomplementary. For example, a high level qualitativeapproach could be used at a unit level to find the unit within a

facility that provides the highest risk. Systems and equipmentwithin the unit then may be screened using a qualitativeapproach with a more quantitative approach used for thehigher risk items. Another example could be to use a qualita-tive consequence analysis combined with a semi-quantitativeprobability analysis.

The three approaches are considered to be a continuumwith qualitative and quantitative approaches being theextremes of the continuum and everything in between being asemi-quantitative approach. Figure 3 illustrates this contin-uum concept.

The RBI process, shown in the simplified block diagram inFigure 4, depicts the essential elements of inspection plan-ning based on risk analysis. This diagram is applicable to Fig-ure 3 regardless which RBI approach is applied, i.e., each ofthe essential elements shown in Figure 4 are necessary for acomplete RBI program regardless of approach (qualitative,semi-quantitative or quantitative).

5.2.5 Quantitative Risk Assessment (QRA)

Quantitative Risk Assessment (QRA) refers to a prescrip-tive methodology that has resulted from the application ofrisk analysis techniques at many different types of facilities,including hydrocarbon and chemical process facilities. For allintents and purposes, it is a traditional risk analysis. A RBIanalysis shares many of the techniques and data requirementswith a QRA. If a QRA has been prepared for a process unit,the RBI consequence analysis can borrow extensively fromthis effort.

The traditional QRA is generally comprised of five tasks:

a. Systems identification.b. Hazards identification.c. Probability assessment.d. Consequence analysis.e. Risk results.

The systems definition, hazard identification and conse-quence analysis are integrally linked. Hazard identification ina RBI analysis generally focuses on identifiable failure mech-anisms in the equipment (inspectable causes) but does notexplicitly deal with other potential failure scenarios resultingfrom events such as power failures or human errors. A QRA

Figure 3—Continuum of RBI Approaches

QualitativeRBI

QuantitativeRBISemi-qualitative RBI

High

Detail ofRBI analysis

Low



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


deals with total risk, not just risk associated with equipmentdeterioration.

The QRA typically involves a much more detailed evalua-tion than a RBI analysis. The following data are typically ana-lyzed:

a. Existing HAZOP or process hazards analysis (PHA)results.b. Dike and drainage design.c. Hazard detection systems.d. Fire protection systems.e. Release statistics.f. Injury statistics.g. Population distributions.h. Topography.i. Weather conditions.j. Land use.

Experienced risk analysts generally perform a QRA. Thereare opportunities to link the detailed QRA with a RBI study.

5.3 PRECISION VS. ACCURACY

Risk presented as a precise numeric value (as in a quantita-tive analysis) implies a greater level of accuracy when com-pared to a risk matrix (as in a qualitative analysis). Theimplied linkage of precision and accuracy may not existbecause of the element of uncertainty that is inherent withprobabilities and consequences. The accuracy of the output isa function of the methodology used as well as the quantityand quality of the data available. The basis for predicted dam-age and rates, the level of confidence in inspection data andthe technique used to perform the inspection are all factorsthat should be considered. In practice, there are often manyextraneous factors that will affect the estimate of damage rate(probability) as well as the magnitude of a failure (conse-

quence) that cannot be fully taken into account with a fixedmodel. Therefore, it may be beneficial to use quantitative andqualitative methods in a complementary fashion to producethe most effective and efficient assessment.

Quantitative analysis uses logic models to calculate proba-bilities and consequences of failure. Logic models used tocharacterize materials deterioration of equipment and todetermine the consequence of failures typically can have sig-nificant variability and therefore could introduce error andinaccuracy impacting the quality of the risk assessment.Therefore, it is important that results from these logic modelsare validated by expert judgment.

The accuracy of any type of RBI analysis depends onusing a sound methodology, quality data and knowledgeablepersonnel.

5.4 UNDERSTANDING HOW RBI CAN HELP TO MANAGE OPERATING RISKS

The mechanical integrity and functional performance ofequipment depends on the suitability of the equipment tooperate safely and reliably under the normal and abnormal(upset) operating conditions to which the equipment isexposed. In performing a RBI assessment, the susceptibilityof equipment to deterioration by one or more mechanisms(e.g., corrosion, fatigue and cracking) is established. The sus-ceptibility of each equipment item should be clearly definedfor the current operating conditions including such factors as:

a. Process fluid, contaminants and aggressive components.

b. Unit throughput.

c. Desired unit run length between scheduled shutdowns.

d. Operating conditions, including upset conditions: e.g.,pressures, temperatures, flow rates, pressure and/or tempera-ture cycling.

Figure 4—Risk-based Inspection Planning Process

Data andinformationcollection

Consequence offailure

Probability offailure

Riskranking

Inspectionplan

Mitigation(if any)

Reassessment

Risk assessment process



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


The suitability and current condition of the equipmentwithin the current operating envelope will determine theprobability of failure (POF) of the equipment from one ormore deterioration mechanisms. This probability, when cou-pled with the associated consequence of failure (COF) (seeSection 11) will determine the operating risk associated withthe equipment item, and therefore the need for mitigation, ifany, such as inspection, metallurgy change or change in oper-ating conditions.

5.5 MANAGEMENT OF RISKS

5.5.1 Risk Management Through Inspection

Inspection influences the uncertainty of the risk associatedwith pressure equipment primarily by improving knowledgeof the deterioration state and predictability of the probabilityof failure. Although inspection does not reduce risk directly, itis a risk management activity that may lead to risk reduction.In-service inspection is primarily concerned with the detec-tion and monitoring of deterioration. The probability of fail-ure due to such deterioration is a function of four factors:

a. Deterioration type and mechanism.

b. Rate of deterioration.

c. Probability of identifying and detecting deterioration andpredicting future deterioration states with inspectiontechnique(s).

d. Tolerance of the equipment to the type of deterioration.

5.5.2 Using RBI to Establish Inspection Plans and Priorities

The primary product of a RBI effort should be an inspec-tion plan for each equipment item evaluated. The inspectionplan should detail the unmitigated risk related to the currentoperation. For risks considered unacceptable, the planshould contain the mitigation actions that are recommendedto reduce the unmitigated risk to acceptable levels.

For those equipment items where inspection is a cost-effective means of risk management, the plans shoulddescribe the type, scope and timing of inspection/examinationrecommended. Ranking of the equipment by the unmitigatedrisk level allows users to assign priorities to the variousinspection/examination tasks. The level of the unmitigatedrisk should be used to evaluate the urgency for performing theinspection.

5.5.3 Other Risk Management

It is recognized that some risks cannot be adequately man-aged by inspection alone. Examples where inspection maynot be sufficient to manage risks to acceptable levels are:

a. Equipment nearing retirement.

b. Failure mechanisms (such as brittle fracture, fatigue)where avoidance of failure primarily depends on operatingwithin a defined pressure/temperature envelope.c. Consequence-dominated risks.

In such cases, non-inspection mitigation actions (such asequipment repair, replacement or upgrade, equipment rede-sign or maintenance of strict controls on operating condi-tions) may be the only appropriate measures that can be takento reduce risk to acceptable levels. Refer to Section 13 formethods of risk mitigation other than inspection.

5.6 RELATIONSHIP BETWEEN RBI AND OTHER RISK-BASED AND SAFETY INITIATIVES

The risk-based inspection methodology is intended tocomplement other risk-based and safety initiatives. The out-put from several of these initiatives can provide input to theRBI effort, and RBI outputs may be used to improve safetyand risk-based initiatives already implemented by organiza-tions. Examples of some initiatives are:

a. OSHA psm programs.b. EPA risk management programs.c. ACC responsible care.d. ASME risk assessment publications.e. CCPS risk assessment techniques.f. Reliability centered maintenance.g. Process hazards analysis.h. Seveso 2 directive in Europe.

The relationship between RBI and several initiatives isdescribed in the following examples:

5.6.1 Process Hazards Analysis

A process hazards analysis (PHA) uses a systemizedapproach to identify and analyze hazards in a process unit.The RBI study can include a review of the output from anyPHA that has been conducted on the unit being evaluated.Hazards identified in the PHA can be specifically addressedin the RBI analysis.

Potential hazards identified in a PHA will often affect theprobability of failure side of the risk equation. The hazardmay result from a series of events that could cause a processupset, or it could be the result of process design or instrumen-tation deficiencies. In either case, the hazard may increase theprobability of failure, in which case the RBI procedure shouldreflect the same.

Some hazards identified would affect the consequence sideof the risk equation. For example, the potential failure of anisolation valve could increase the inventory of material avail-able for release in the event of a leak. The consequence calcu-lation in the RBI procedure can be modified to reflect thisadded hazard.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


Likewise, the results of a RBI assessment can significantlyenhance the overall value of a PHA.

5.6.2 Process Safety Management

A strong process safety management system can signifi-cantly reduce risk levels in a process plant (refer to OSHA 29CFR 1910.119 or API RP 750). RBI may include methodolo-gies to assess the effectiveness of the management systems inmaintaining mechanical integrity. The results of such a man-agement systems evaluation are factored into the risk deter-minations.

Several of the features of a good PSM program provideinput for a RBI study. Extensive data on the equipment andthe process are required in the RBI analysis, and output fromPHA and incident investigation reports increases the validityof the study. In turn, the RBI program can improve themechanical integrity aspect of the PSM program. An effectivePSM program includes a well-structured equipment inspec-tion program. The RBI system will improve the focus of theinspection plan, resulting in a strengthened PSM program.

Operating with a comprehensive inspection programshould reduce the risks of releases from a facility and shouldprovide benefits in complying with safety-related initiatives.

5.6.3 Equipment Reliability

Equipment reliability programs can provide input to theprobability analysis portion of a RBI program. Specifically,reliability records can be used to develop equipment failureprobabilities and leak frequencies. Equipment reliability isespecially important if leaks can be caused by secondary fail-ures, such as loss of utilities. Reliability efforts, such as reli-ability centered maintenance (RCM), can be linked with RBI,resulting in an integrated program to reduce downtime in anoperating unit.

5.7 RELATIONSHIP WITH JURISDICTIONAL REQUIREMENTS

Codes and legal requirements vary from one jurisdiction toanother. In some cases, jurisdictional requirements mandatespecific actions such as the type of inspections and intervalsbetween inspections. In jurisdictions that permit the applica-tion of the API inspection codes and standards, RBI should bean acceptable method for setting inspection plans. It is recom-mended that all users review their jurisdictional code andlegal requirements for acceptability of using RBI for inspec-tion planning purposes.

6 Planning the RBI Assessment6.1 GETTING STARTED

This section helps a user determine the scope and the prior-ities for a RBI assessment. Screening is done to focus the

effort. Boundary limits are identified to determine what isvital to include in the assessment. The organizing process ofaligning priorities, screening risks, and identifying bound-aries improves the efficiency and effectiveness of conductingthe assessment and its end-results in managing risk.

A RBI assessment is a team-based process. At the begin-ning of the exercise, it is important to define:

a. Why the assessment is being done.b. How the RBI assessment will be carried out.c. What knowledge and skills are required for theassessment.d. Who is on the RBI team.e. What are their roles in the RBI process.f. Who is responsible and accountable for what actions.g. Which facilities, assets, and components will be included.h. What data is to be used in the assessment.i. What codes and standards are applicable.j. When the assessment will be completed.k. How long the assessment will remain in effect and when itwill be updated.l. How the results will be used.

6.2 ESTABLISHING OBJECTIVES AND GOALS OF A RBI ASSESSMENT

A RBI assessment should be undertaken with clear objec-tives and goals that are fully understood by all members ofthe RBI team and by management. Some examples are listedin 6.2.1 to 6.2.7.

6.2.1 Understand Risks

An objective of the RBI assessment may be to betterunderstand the risks involved in the operation of a plant orprocess unit and to understand the effects that inspection,maintenance and mitigation actions have on the risks.

From the understanding of risks, an inspection programmay be designed that optimizes the use of inspection andplant maintenance resources.

6.2.2 Define Risk Criteria

A RBI assessment will determine the risk associated withthe items assessed. The RBI team and management maywish to judge whether the individual equipment item andcumulative risks are acceptable. Establishing risk criteria tojudge acceptability of risk could be an objective of the RBIassessment if such criteria do not exist already within theuser’s company.

6.2.3 Management of Risks

When the risks are identified, inspection actions and/orother mitigation that have a positive effect in reducing risk toan acceptable level may be undertaken. These actions may be



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


significantly different from the inspection actions undertakenduring a statutory or certification type inspection program.The results of managing and reducing risk are improvedsafety, avoided losses of containment, and avoided commer-cial losses.

6.2.4 Reduce Costs

Reducing inspection costs is usually not the primary objec-tive of a RBI assessment, but it is frequently a side effect ofoptimization. When the inspection program is optimizedbased on an understanding of risk, one or more of the follow-ing cost reduction benefits may be realized.

a. Ineffective, unnecessary or inappropriate inspection activi-ties may be eliminated.b. Inspection of low risk items may be eliminated or reduced.c. On-line or non-invasive inspection methods may be substi-tuted for invasive methods that require equipment shutdown.d. More effective infrequent inspections may be substitutedfor less effective frequent inspections.

6.2.5 Meet Safety and Environmental Management Requirements

Managing risks by using RBI assessment can be useful inimplementing an effective inspection program that meets per-formance-based safety and environmental requirements. RBIfocuses efforts on areas where the greatest risk exists. RBIprovides a systematic method to guide a user in the selectionof equipment items to be included and the frequency, scopeand extent of inspection activities to be conducted to meetperformance objectives.

6.2.6 Sort Mitigation Alternatives

The RBI assessment may identify risks that may be man-aged by actions other than inspection. Some of these mitiga-tion actions may include but are not limited to:

a. Modification of the process to eliminate conditions drivingthe risk.b. Modification of operating procedures to avoid situationsdriving the risk.c. Chemical treatment of the process to reduce deteriorationrates/susceptibilities.d. Change metallurgy of components to reduce POF.e. Removal of unnecessary insulation to reduce probabilityof corrosion under insulation.f. Reduce inventories to reduce COF.g. Upgrade safety or detection systems.h. Change fluids to less flammable or toxic fluids.

The data within the RBI assessment can be useful in deter-mining the optimum economic strategy to reduce risk. Thestrategy may be different at different times in a plant’s lifecycle. For example, it is usually more economical to modify

the process or change metallurgy when a plant is beingdesigned than when it is operating.

6.2.7 New Project Risk Assessment

A RBI assessment made on new equipment or a newproject, while in the design stage, may yield important infor-mation on potential risks. This may allow the risks to be min-imized by design, prior to actual installation.

6.2.8 Facilities End of Life Strategies

Facilities approaching the end of their economic or operat-ing service life are a special case where application of RBIcan be very useful. The end of life case for plant operation isabout gaining the maximum remaining economic benefitfrom an asset without undue personnel, environmental orfinancial risk.

End of life strategies focus the inspection efforts directlyon high-risk areas where the inspections will provide a reduc-tion of risk during the remaining life of the plant. Inspectionactivities that do not impact risk during the remaining life areusually eliminated or reduced.

End of life inspection RBI strategies may be developed inassociation with a fitness for service assessment of damagedcomponents using methods described in API RP 579.

It is important to revisit the RBI assessment if the remain-ing plant life is extended after the remaining life strategy hasbeen developed and implemented.

6.3 INITIAL SCREENING

6.3.1 Establish Physical Boundaries of a RBI Assessment

Boundaries for physical assets included in the assessmentare established consistent with the overall objectives. Thelevel of data to be reviewed and the resources available toaccomplish the objectives directly impact the extent of physi-cal assets that can be assessed. The screening process isimportant in centering the focus on the most important physi-cal assets so that time and resources are effectively applied.

The scope of a RBI assessment may vary between an entirerefinery or plant and a single component within a single pieceof equipment. Typically, RBI is done on multiple pieces ofequipment (e.g., an entire process unit) rather than on a singlecomponent.

6.3.2 Facilities Screening

At the facility level, RBI may be applied to all types ofplants including but not limited to:

a. Oil and gas production facilities.b. Oil and gas processing and transportation terminals.c. Refineries.d. Petrochemical and chemical plants.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


e. Pipelines and pipeline stations.f. LNG plants.

Screening at the facility level may be done by a simplifiedqualitative RBI assessment. Screening at the facility levelcould also be done by:

a. Asset or product value.b. History of problems/failures at each facility.c. PSM/non-PSM facilities.d. Age of facilities.e. Proximity to the public.f. Proximity to environmentally sensitive areas.

Examples of key questions to answer at the facility levelare:

1. Is the facility located in a regulatory jurisdiction thatwill accept modifications to statutory inspection intervalsbased on RBI?2. Is the management of the facility willing to invest inthe resources necessary to achieve the benefits of RBI?3. Does the facility have sufficient resources and exper-tise available to conduct the RBI assessment?

6.3.3 Process Units Screening

If the scope of the RBI assessment is a multi-unit facility,then the first step in the application of RBI is screening ofentire process units to rank relative risk. The screening pointsout areas that are higher in priority and suggests which pro-cess units to begin with. It also provides insight about thelevel of assessment that may be required for operating sys-tems and equipment items in the various units.

Priorities may be assigned based on one of the following:

a. Relative risk of the process units.b. Relative economic impact of the process units.c. Relative COF of the process units.d. Relative reliability of the process units.e. Turnaround schedule.f. Experience with similar process units.

Examples of key questions to answer at the process unitlevel are similar to the questions at the facility level:

1. Does the process unit have a significant impact on theoperation of the facility?2. Are there significant risks involved in the operation ofthe process unit and would the effect of risk reduction bemeasurable?3. Do process unit operators see that some benefit may begained through the application of RBI?4. Does the process unit have sufficient resources andexpertise available to conduct the RBI assessment?

6.3.4 Systems within Process Units Screening

It is often advantageous to group equipment within a pro-cess unit into systems or circuits where common environmen-tal operating conditions exist based on process chemistry,pressure and temperature, metallurgy, equipment design andoperating history. By dividing a process unit into systems,the equipment can be screened together saving time com-pared to treating each piece of equipment separately.

A common practice utilizes block flow or process flow dia-grams for the unit to identify the systems. Information aboutmetallurgy, process conditions, credible deterioration mecha-nisms and historical problems may be identified on the dia-gram for each system.

When a process unit is identified for a RBI assessment andoverall optimization is the goal, it is usually best to include allsystems within the unit. Practical considerations such asresource availability may require that the RBI assessment islimited to one or more systems within the unit. Selection ofsystems may be based on:

a. Relative risk of the systems.b. Relative COF of systems.c. Relative reliability of systems.d. Expected benefit from applying RBI to a system.

6.3.5 Equipment Items Screening

In most plants, a large percentage of the total unit risk willbe concentrated in a relatively small percentage of the equip-ment items. These potential high-risk items should receivegreater attention in the risk assessment. Screening of equip-ment items is often conducted to identify the higher risk itemsto carry forward to more detailed risk assessment.

A RBI assessment may be applied to all pressure contain-ing equipment such as:

a. Piping.b. Pressure vessels.c. Reactors.d. Heat exchangers.e. Furnaces.f. Tanks.g. Pumps (pressure boundary).h. Compressors (pressure boundary).i. Pressure relief devices.j. Control valves (pressure boundary).

Selection of equipment types to be included is based onmeeting the objectives discussed in 6.2. The following issuesmay be considered in screening the equipment to be included:

1. Will the integrity of safeguard equipment be compro-mised by deterioration mechanisms?2. Which types of equipment have had the most reliabilityproblems?



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


3. Which pieces of equipment have the highest COF ifthere is a pressure boundary failure?4. Which pieces of equipment are subject to most deterio-ration that could affect pressure boundary containment?5. Which pieces of equipment have lower design safetymargins and/or lower corrosion allowances that may affectpressure boundary containment considerations?

6.3.6 Utilities, Emergency and Off-plot Systems

Whether or not utilities, emergency and off-plot systemsshould be included depends on the planned use of the RBIassessment and the current inspection requirements of thefacility. Possible reasons for inclusion of off-plot and utilitiesare:

a. The RBI assessment is being done for an overall optimiza-tion of inspection resources and environmental and businessCOF are included.b. There is a specific reliability problem in a utility system.An example would be a cooling water system with corrosionand fouling problems. A RBI approach could assist in devel-oping the most effective combination of inspection,mitigation, monitoring, and treatment for the entire facility.c. Reliability of the process unit is a major objective of theRBI analysis.

When emergency systems (e.g., flare systems, emergencyshutdown systems) are included in the RBI assessment, theirservice conditions during both routine operations and theirduty cycle should be considered.

6.4 ESTABLISH OPERATING BOUNDARIES

Similar to physical boundaries, operating boundaries for theRBI study are established consistent with the study objectives,level of data to be reviewed and resources. The purpose ofestablishing operational boundaries is to identify key processparameters that may impact deterioration. The RBI assess-ment normally includes review of both POF and COF for nor-mal operating conditions. Start-up and shut-down conditionsas well as emergency and non-routine conditions should alsobe reviewed for their potential effect on POF and COF.

The operating conditions, including any sensitivity analy-sis, used for the RBI assessment should be recorded as theoperating limits for the assessment.

Operating within the boundaries is critical to the validity ofthe RBI study as well as good operating practice. It may beworthwhile to monitor key process parameters to determinewhether operations are maintained within boundaries.

6.4.1 Start-up and Shut-down

Process conditions during start-up and shut-down can havea significant effect on the risk of a plant especially when theyare more severe (likely to cause accelerated deterioration)

than normal conditions. A good example is polythionic acidstress corrosion cracking. The POF for susceptible plants iscontrolled by whether mitigation measures are applied duringshutdown procedures. Start-up lines are often included withinthe process piping and their service conditions during start-upand subsequent operation should be considered.

6.4.2 Normal, Upset and Cyclic Operation

The normal operating conditions may be most easily pro-vided if there is a process flow model or mass balance avail-able for the plant or process unit. However, the normaloperating conditions found on documentation should be veri-fied as it is not uncommon to find discrepancies that couldimpact the RBI results substantially. The following datashould be provided:

a. Operating temperature and pressure including variationranges.b. Process fluid composition including variation with feedcomposition ranges.c. Flow rates including variation ranges.d. Presence of moisture or other contaminant species.

Changes in the process, such as pressure, temperature orfluid composition, resulting from unit abnormal or upset con-ditions should be considered in the RBI assessment.

Systems with cyclic operation, such as reactor regenerationsystems, should consider the complete cyclic range of condi-tions. Cyclic conditions could impact the probability of fail-ure due to some deterioration mechanisms (e.g., fatigue,thermal fatigue, corrosion under insulation).

6.4.3 Operating Time Period

The unit run lengths of the selected process units/equip-ment is an important limit to consider. The RBI assessmentmay include the entire operational life, or may be for aselected period. For example, process units are occasionallyshut down for maintenance activities and the associated runlength may depend on the condition of the equipment in theunit. A RBI analysis may focus on the current run period ormay include the current and next-projected run period. Thetime period may also influence the types of decisions andinspection plans that result from the study, such as inspection,repair, replace, operating, and so on. Future operational pro-jections are also important as part of the basis for the opera-tional time period.

6.5 SELECTING A TYPE OF RBI ASSESSMENT

Selection of the type of RBI assessment will be dependenton a variety of factors, such as:

a. Is the assessment at a facility, process unit, system, equip-ment item or component level.b. Objective of the assessment.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


c. Availability and quality of data.d. Resource availability.e. Perceived or previously evaluated risks.f. Time constraints.

A strategy should be developed, matching the type ofassessment to the expected or evaluated risk. For example,processing units that are expected to have lower risk may onlyrequire simple, fairly conservative methods to adequatelyaccomplish the RBI objectives. Whereas, process units whichhave a higher expected risk may require more detailed meth-ods. Another example would be to evaluate all equipmentitems in a process unit qualitatively and then evaluate thehigher risk items identified more quantitatively. Refer to 5.2for more on types of RBI assessment.

6.6 ESTIMATING RESOURCES AND TIME REQUIRED

The resources and time required to implement a RBIassessment will vary widely between organizations depend-ing on a number of factors including:

a. Implementation strategy/plans.b. Knowledge and training of implementers.c. Availability and quality of necessary data and information.d. Availability and cost of resources needed forimplementation.e. Amount of equipment included in each level of RBIanalysis.f. Degree of complexity of RBI analysis selected.g. Degree of accuracy required.

The estimate of scope and cost involved in completing aRBI assessment might include the following:

1. Number of facilities, units, equipment items, and com-ponents to be evaluated.2. Time and resources required to gather data for theitems to be evaluated.3. Training time for implementers.4. Time and resources required for RBI assessment ofdata and information.5. Time and resources to evaluate RBI assessment resultsand develop inspection, maintenance, and mitigationplans.

7 Data and Information Collection for RBI Assessment

7.1 RBI DATA NEEDS

A RBI study may use a qualitative, semi-quantitative and/or quantitative approach. The fundamental difference amongthese approaches is the amount and detail of input, calcula-tions and output.

For each RBI approach it is important to document allbases for the study and assumptions from the onset and toapply a consistent rationale. Any deviations from prescribed,standard procedures should be well documented. Documenta-tion of unique equipment and piping identifiers is a goodstarting point for any level of study. The equipment shouldalso correspond to a unique group or location such as a partic-ular process unit at a particular plant site.

Typical data needed for a RBI analysis may include but isnot limited to:

a. Type of equipment.b. Materials of construction.c. Inspection, repair and replacement records.d. Process fluid compositions.e. Inventory of fluids.f. Operating conditions.g. Safety systems.h. Detection systems.i. Deterioration mechanisms, rates and severity.j. Personnel densities.k. Coating, cladding and insulation data.l. Business interruption cost.m. Equipment replacement costs.n. Environmental remediation costs.

7.1.1 Qualitative RBI

The qualitative approach typically does not require all ofthe data mentioned in 7.1. Further, items required only needto be categorized into broad ranges or classified versus a ref-erence point. It is important to establish a set of rules toassure consistency in categorization or classification.

Generally, a qualitative analysis using broad rangesrequires a higher level of judgment, skill and understandingfrom the user than a quantitative approach. Ranges and sum-mary fields may evaluate circumstances with widely varyingconditions requiring the user to carefully consider the impactof input on risk results. Therefore, despite its simplicity, it isimportant to have knowledgeable and skilled persons performthe qualitative RBI analysis.

7.1.2 Quantitative RBI

Quantitative risk analysis uses logic models depictingcombinations of events that could result in severe accidentsand physical models depicting the progression of accidentsand the transport of a hazardous material to the environment.The models are evaluated probabilistically to provide bothqualitative and quantitative insights about the level of risk andto identify the design, site, or operational characteristics thatare the most important to risk. Hence, more detailed informa-tion and data are needed for quantitative RBI in order to pro-vide input for the models.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


7.1.3 Semi-quantitative RBI

The semi-quantitative analysis typically requires the samedata as a quantitative analysis but generally not as detailed.For example, the fluid volumes may be estimated. Althoughthe precision of the analysis may be less, the time required fordata gathering and analysis will be less too.

7.2 DATA QUALITY

The data quality has a direct relation to the relative accu-racy of the RBI analysis. Although the data requirements arequite different for the various types of RBI analysis, qualityof input data is equally important. It is beneficial to the integ-rity of a RBI analysis to assure that the data are up to date andvalidated by knowledgeable persons (see Section 15).

As is true in any inspection program, data validation isessential for a number of reasons. Among the reasons are out-dated drawings and documentation, inspector error, clericalerror, and measurement equipment accuracy. Another poten-tial source of error in the analysis is assumptions on equip-ment history. For example if baseline inspections were notperformed or documented, nominal thickness may be usedfor the original thickness. This assumption can significantlyimpact the calculated corrosion rate early in the equipment’slife. The effect may be to mask a high corrosion rate or toinflate a low corrosion rate. A similar situation exists whenthe remaining life of a piece of equipment with a low corro-sion rate requires inspection more frequently. The measure-ment error may result in the calculated corrosion rateappearing artificially high or low.

This validation step stresses the need for a knowledgeableindividual comparing data from the inspections to the expecteddeterioration mechanism and rates. This person may also com-pare the results with previous measurements on that system,similar systems at the site or within the company or publisheddata. Statistics may be useful in this review. This reviewshould also factor in any changes or upsets in the process.

7.3 CODES AND STANDARDS—NATIONAL AND INTERNATIONAL

In the data collection stage, an assessment of what codesand standards are currently in use, or were in use during theequipment design, is generally necessary. The amount andtype of codes and standards used by a facility can have a sig-nificant impact on RBI results.

7.4 SOURCES OF SITE SPECIFIC DATA AND INFORMATION

Information for RBI can be found in many places within afacility. It is important to stress that the precision of the datashould match the complexity of the RBI method used. Theindividual or team should understand the sensitivity of thedata needed for the program before gathering any data. It may

be advantageous to combine RBI data gathering with otherrisk/hazard analysis data gathering (e.g., PHA, QRA) asmuch of the data overlaps.

Specific potential sources of information include but arenot limited to:

a. Design and Construction Records/Drawings.

1. P&IDs, PFDs, MFDs, etc.2. Piping isometric drawings.3. Engineering specification sheets.4. Materials of construction records.5. Construction QA/QC records.6. Codes and standards used.7. Protective instrument systems.8. Leak detection and monitoring systems.9. Isolation systems.10. Inventory records.11. Emergency depressurizing and relief systems.12. Safety systems.13. Fire-proofing and fire fighting systems.14. Layout.

b. Inspection Records.

1. Schedules and frequency.2. Amount and types of inspection.3. Repairs and alterations.4. PMI records.5. Inspection results.

c. Process Data.

1. Fluid composition analysis including contaminants ortrace components.2. Distributed control system data.3. Operating procedures.4. Start-up and shut-down procedures.5. Emergency procedures.6. Operating logs and process records.7. PSM, PHA, RCM and QRA data or reports.

d. Management of change (MOC) records.e. Off-Site data and information—if consequence may affectoff-site areas.f. Failure data.

1. Generic failure frequency data—industry or in-house.2. Industry specific failure data.3. Plant and equipment specific failure data.4. Reliability and condition monitoring records.5. Leak data.

g. Site conditions.

1. Climate/weather records.2. Seismic activity records.

h. Equipment replacement costs.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


1. Project cost reports.2. Industry databases.

i. Hazards data.1. PSM studies.2. PHA studies.3. QRA studies.4. Other site specific risk or hazard studies.

j. Incident investigations.

8 Identifying Deterioration Mechanisms and Failure Modes

8.1 INTRODUCTION

Identification of the appropriate deterioration mechanisms,susceptibilities and failure modes for all equipment includedin a RBI study is essential to the quality and the effectivenessof the RBI evaluation. A metallurgist or corrosion specialistshould be consulted to define the equipment deteriorationmechanisms, susceptibility and potential failure modes. Dataused and assumptions made should be validated and docu-mented. Process conditions (normal and upset) as well asanticipated process changes should be considered in the eval-uation. The deterioration mechanisms, rates and susceptibili-ties are the primary inputs into the probability of failureevaluation. The failure mode is a key input in determining theconsequence of failure except when a worst case conse-quence analysis, assuming total release of component inven-tory, is used.

8.2 FAILURE AND FAILURE MODES FOR RISK-BASED INSPECTION

The term failure can be defined as termination of the abilityto perform a required function. RBI, as described in this Rec-ommended Practice, is concerned with one type of failure,namely loss of containment caused by deterioration.

The term failure mode is defined as the manner of failure.Failure modes can range from a small hole to a completerupture.

8.3 DETERIORATION MECHANISMS

The term deterioration mechanism is defined as the type ofdeterioration that could lead to a loss of containment. Thereare four major deterioration mechanisms observed in thehydrocarbon and chemical process industry:

a. Thinning (includes internal and external).b. Stress corrosion cracking.c. Metallurgical and environmental.d. Mechanical.

Understanding equipment operation and the interactionwith the chemical and mechanical environment is key to per-forming deterioration mechanism identification. For example,

understanding that localized thinning may be caused by themethod of fluid injection and agitation is as important asknowing the corrosion mechanism. Process specialists canprovide useful input (such as the spectrum of process condi-tions, injection points etc.) to aid materials specialists in theidentification of deterioration mechanisms and rates.

Appendix A provides tables describing the individual dete-rioration mechanisms covered by these four categories, thekey variables driving deterioration, and typical process indus-try examples of where they may occur. These tables covermost of the common deterioration mechanisms. Other deteri-oration types and mechanisms may occur in specific hydro-carbon and chemical processing applications; however, theseare relatively infrequent.

8.3.1 Thinning

Thinning includes general corrosion, localized corrosion,pitting, and other mechanisms that cause loss of materialfrom internal or external surfaces. The effects of thinning canbe determined from the following information:

a. Thickness – both the original, historic and current mea-sured thickness.b. Equipment age – number of years in the current serviceand if the service has changed.c. Corrosion allowance – design allowance for the currentservice.d. Corrosion rate.e. Operating pressure and temperature.f. Design pressure.g. Number and types of inspections.

8.3.2 Stress Corrosion Cracking

Stress corrosion cracking (SCC) occurs when equipment isexposed to environments conducive to certain cracking mech-anisms such as caustic cracking, amine cracking, sulfidestress cracking (SSC), hydrogen-induced cracking (HIC),stress-oriented hydrogen-induced cracking (SOHIC), carbon-ate cracking, polythionic acid cracking (PTA), and chloridecracking (ClSCC). Literature, expert opinion and experienceare often necessary to establish susceptibility of equipment tostress corrosion cracking. Susceptibility is often designatedas high, medium, or low based on:

a. Material of construction.b. Mechanism and susceptibility.c. Operating temperature and pressure.d. Concentration of key process corrosives such as pH, chlo-rides, sulfides, etc.e. Fabrication variables such as post weld heat treatment.

The determination of susceptibility should not only con-sider susceptibility of the equipment/piping to cracking (or



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


probability of initiating a crack), but also the probability of acrack resulting in a leak or rupture.

8.3.3 Metallurgical and Environmental Deterioration of Properties

Causes of metallurgical and environmental failure are var-ied but typically involve some form of mechanical and/orphysical property deterioration of the material due to expo-sure to the process environment.

One example of this is high-temperature hydrogen attack(HTHA). HTHA occurs in carbon and low alloy steelsexposed to high partial pressures of hydrogen at elevated tem-peratures. Historically, HTHA resistance has been predictedbased on industry experience that has been plotted on a seriesof curves for carbon and low alloy steels showing the temper-ature and hydrogen partial pressure regime in which thesesteels have been successfully used without deterioration dueto HTHA. These curves, which are commonly referred to asthe Nelson curves, are maintained based on industry experi-ence in API RP 941.

Consideration for equipment susceptibility to HTHA isbased on:

a. Material of construction.b. Operating temperature.c. Hydrogen partial pressure.d. Exposure time.

Refer to Appendix A for other examples of these types offailures and causes. In general, the critical variables for dete-rioration are material of construction, process operating, start-up and shut-down conditions (especially temperature) andknowledge of the deterioration caused by those conditions.

8.3.4 Mechanical

Similar to the metallurgical and environmental failures,various types and causes of mechanical deterioration are pos-sible. Examples and the types of failure resulting can befound in the Appendix A. The most common mechanicaldeterioration mechanisms are fatigue (mechanical, thermaland corrosion), stress/creep rupture, and tensile overload.

8.4 OTHER FAILURES

RBI could be expanded to include failures other than lossof containment. Examples of other failures and failure modesare:

a. Pressure relief device failure – plugging, fouling, non-activation.b. Heat exchanger bundle failure – tube leak, plugging.c. Pump failure – seal failure, motor failure, rotating partsdamage.d. Internal linings – hole, disbondment.

9 Assessing Probability of Failure9.1 INTRODUCTION TO PROBABILITY ANALYSIS

The probability analysis in a RBI program is performed toestimate the probability of a specific adverse consequenceresulting from a loss of containment that occurs due to a dete-rioration mechanism(s). The probability that a specific con-sequence will occur is the product of the probability of failure(POF) and the probability of the scenario under considerationassuming that the failure has occurred. This section providesguidance only on determining the POF. Guidance on deter-mining the probability of specific consequences is providedin Section 11.

The probability of failure analysis should address all dete-rioration mechanisms to which the equipment being studiedis susceptible. Further, it should address the situation whereequipment is susceptible to multiple deterioration mecha-nisms (e.g., thinning and creep). The analysis should be cred-ible, repeatable and well documented.

It should be noted that deterioration mechanisms are notthe only causes of loss of containment. Other causes of loss ofcontainment could include but are not limited to:

a. Seismic activity.b. Weather extremes.c. Overpressure due to pressure relief device failure.d. Operator error.e. Inadvertent substitution of materials of construction.f. Design error.g. Sabotage.

These and other causes of loss of containment may have animpact on the probability of failure and may be included inthe probability of failure analysis.

9.2 UNITS OF MEASURE IN THE PROBABILITY OF FAILURE ANALYSIS

Probability of failure is typically expressed in terms of fre-quency. Frequency is expressed as a number of events occur-ring during a specific time frame. For probability analysis, thetime frame is typically expressed as a fixed interval (e.g., oneyear) and the frequency is expressed as events per interval(e.g., 0.0002 failures per year). The time frame may also beexpressed as an occasion (e.g., one run length) and the fre-quency would be events per occasion (e.g., 0.03 failures perrun). For a qualitative analysis, the probability of failure maybe categorized (e.g., high, medium and low, or 1 through 5).However, even in this case, it is appropriate to associate anevent frequency with each probability category to provideguidance to the individuals who are responsible for determin-ing the probability. If this is done, the change from one cate-gory to the next could be one or more orders of magnitude orother appropriate demarcations that will provide adequatediscrimination.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


9.3 TYPES OF PROBABILITY ANALYSIS

The following paragraphs discuss different approaches tothe determination of probability. For the purposes of the dis-cussion, these approaches have been categorized as “qualita-tive” or “quantitative.” However, it should be recognized that“qualitative” and “quantitative” are the end points of a contin-uum rather than distinctive approaches (see Figure 3). Mostprobability assessments use a blend of qualitative and quanti-tative approaches.

The methodology used for the assessment should be struc-tured such that a sensitivity analysis or other approach may beused to assure that realistic, though conservative, probabilityvalues are obtained (see 11.4).

9.3.1 Qualitative Probability of Failure Analysis

A qualitative method involves identification of the units,systems or equipment, the materials of construction and thecorrosive components of the processes. On the basis ofknowledge of the operating history, future inspection andmaintenance plans and possible materials deterioration, prob-ability of failure can be assessed separately for each unit, sys-tem, equipment grouping or individual equipment item.Engineering judgment is the basis for this assessment. Aprobability of failure category can then be assigned for eachunit, system, grouping or equipment item. Depending on themethodology employed, the categories may be described withwords (such as high, medium or low) or may have numericaldescriptors (such as 0.1 to 0.01 times per year).

9.3.2 Quantitative Probability of Failure Analysis

There are several approaches to a quantitative probabilityanalysis. One example is to take a probabilistic approachwhere specific failure data or expert solicitations are used tocalculate a probability of failure. These failure data may beobtained on the specific equipment item in question or onsimilar equipment items. This probability may be expressedas a distribution rather than a single deterministic value.

Another approach is used when inaccurate or insufficientfailure data exists on the specific item of interest. In this case,general industry, company or manufacturer failure data areused. A methodology should be applied to assess the applica-bility of these general data. As appropriate, these failure datashould be adjusted and made specific to the equipment beinganalyzed by increasing or decreasing the predicted failure fre-quencies based on equipment specific information. In thisway, general failure data are used to generate an adjusted fail-ure frequency that is applied to equipment for a specific appli-cation. Such modifications to general values may be madefor each equipment item to account for the potential deterio-ration that may occur in the particular service and the typeand effectiveness of inspection and/or monitoring performed.

Knowledgeable personnel should make these modificationson a case-by-case basis.

9.4 DETERMINATION OF PROBABILITY OF FAILURE

Regardless of whether a more qualitative or a quantitativeanalysis is used, the probability of failure is determined bytwo main considerations:

a. Deterioration mechanisms and rates of the equipmentitem's material of construction, resulting from its operatingenvironment (internal and external).b. Effectiveness of the inspection program to identify andmonitor the deterioration mechanisms so that the equipmentcan be repaired or replaced prior to failure.

Analyzing the effect of in-service deterioration and inspec-tion on the probability of failure involves the following steps:

a. Identify active and credible deterioration mechanisms thatare reasonably expected to occur during the time period beingconsidered (considering normal and upset conditions).b. Determine the deterioration susceptibility and rate.c. Quantify the effectiveness of the past inspection and main-tenance program and a proposed future inspection andmaintenance program. It is usually necessary to evaluate theprobability of failure considering several alternative futureinspection and maintenance strategies, possibly including a“no inspection or maintenance” strategy. d. Determine the probability that with the current condition,continued deterioration at the predicted/expected rate willexceed the damage tolerance of the equipment and result in afailure. The failure mode (e.g., small leak, large leak, equip-ment rupture) should also be determined based on thedeterioration mechanism. It may be desirable in some cases todetermine the probability of more than one failure mode andcombine the risks.

9.4.1 Determine the Deterioration Susceptibility and Rate

Combinations of process conditions and materials of con-struction for each equipment item should be evaluated toidentify active and credible deterioration mechanisms. Onemethod of determining these mechanisms and susceptibilityis to group components that have the same material of con-struction and are exposed to the same internal and externalenvironment. Inspection results from one item in the groupcan be related to the other equipment in the group.

For many deterioration mechanisms, the rate of deteriora-tion progression is generally understood and can be estimatedfor process plant equipment. Deterioration rate can beexpressed in terms of corrosion rate for thinning or suscepti-bility for mechanisms where the deterioration rate isunknown or immeasurable (such as stress corrosion crack-



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


ing). Susceptibility is often designated as high, medium orlow based on the environmental conditions and material ofconstruction combination. Fabrication variables and repairhistory are also important.

The deterioration rate in specific process equipment isoften not known with certainty. The ability to state the rate ofdeterioration precisely is affected by equipment complexity,type of deterioration mechanism, process and metallurgicalvariations, inaccessibility for inspection, limitations ofinspection and test methods and the inspector’s expertise.

Sources of deterioration rate information include:

a. Published data.b. Laboratory testing.c. In-situ testing and in-service monitoring.d. Experience with similar equipment.e. Previous inspection data.

The best information will come from operating experi-ences where the conditions that led to the observed deteriora-tion rate could realistically be expected to occur in theequipment under consideration. Other sources of informationcould include databases of plant experience or reliance onexpert opinion. The latter method is often used since plantdatabases, where they exist, sometimes do not contain suffi-ciently detailed information.

9.4.2 Determine Failure Mode

Probability of failure analysis is used to evaluate the failuremode (e.g., small hole, crack, catastrophic rupture) and theprobability that each failure mode will occur. It is importantto link the deterioration mechanism to the most likely result-ing failure mode. For example:

a. Pitting generally leads to small hole-sized leaks. b. Stress corrosion cracking can develop into small, throughwall cracks or, in some cases, catastrophic rupture. c. Metallurgical deterioration and mechanical deteriorationcan lead to failure modes that vary from small holes toruptures. d. General thinning from corrosion often leads to larger leaksor rupture.

Failure mode primarily affects the magnitude of the conse-quences. For this and other reasons, the probability and con-sequence analyses should be worked interactively.

9.4.3 Quantify Effectiveness of Past Inspection Program

Inspection programs (the combination of NDE methodssuch as visual, ultrasonic, radiographic etc., frequency andcoverage/location of inspections) vary in their effectivenessfor locating and sizing deterioration, and thus for determiningdeterioration rates. After the likely deterioration mechanisms

have been identified, the inspection program should be evalu-ated to determine the effectiveness in finding the identifiedmechanisms.

Limitations in the effectiveness of an inspection programcould be due to:

a. Lack of coverage of an area subject to deterioration.b. Inherent limitations of some inspection methods to detectand quantify certain types of deterioration.c. Selection of inappropriate inspection methods and tools.d. Application of methods and tools by inadequately trainedinspection personnel.e. Inadequate inspection procedures.f. Deterioration rate under some extremes of conditions is sohigh that failure can occur within a very short time. Eventhough no deterioration is found during an inspection, failurecould still occur as a result of a change or upset in conditions.For example, if a very aggressive acid is carried over from acorrosion resistant part of a system into a downstream vesselthat is made of carbon steel, rapid corrosion could result infailure in a few hours or days. Similarly, if an aqueous chlo-ride solution is carried into a sensitized stainless steel vessel,chloride stress corrosion cracking could occur very rapidly(depending on the temperature).

If multiple inspections have been performed, it is importantto recognize that the most recent inspection may best reflectcurrent operating conditions. If operating conditions havechanged, deterioration rates based on inspection data from theprevious operating conditions may not be valid.

Determination of inspection effectiveness should considerthe following:

1. Equipment type.2. Active and credible deterioration mechanism(s).3. Rate of deterioration or susceptibility.4. NDE methods, coverage and frequency.5. Accessibility to expected deterioration areas.

The effectiveness of future inspections can be optimized byutilization of NDE methods better suited for the active/credi-ble deterioration mechanisms, adjusting the inspection cover-age, adjusting the inspection frequency or some combination.

9.4.4 Calculate the Probability of Failure by Deterioration Type

By combining the expected deterioration mechanism, rateor susceptibility, inspection data and inspection effectiveness,a probability of failure can now be determined for each dete-rioration type and failure mode. The probability of failuremay be determined for future time periods or conditions aswell as current. It is important for users to validate that themethod used to calculate the POF is in fact thorough and ade-quate for the users’ needs.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


10 Assessing Consequences of Failure

10.1 INTRODUCTION TO CONSEQUENCE ANALYSIS

The consequence analysis in a RBI program is performedto provide discrimination between equipment items on thebasis of the significance of a potential failure. In general, aRBI program will be managed by plant inspectors or inspec-tion engineers, who will normally manage risk by managingthe probability of failure with inspection and maintenanceplanning. They will not normally have much ability to modifythe consequence of failure. On the other hand, managementand process safety personnel may desire to manage the conse-quence side of the risk equation. Numerous methods for mod-ifying the consequence of failure are mentioned in Section13. For all of these users, the consequence analysis is an aidin establishing a relative risk ranking of equipment items. Theconsequence analysis should be a repeatable, simplified,credible estimate of what might be expected to happen if afailure were to occur in the equipment item being assessed.

More or less complex and detailed methods of conse-quence analysis can be used, depending on the desired appli-cation for the assessment. The consequence analysis methodchosen should have a demonstrated ability to provide therequired level of discrimination between higher and lowerconsequence equipment items.

10.1.1 Loss of Containment

The consequence of loss of containment is generally evalu-ated as loss of fluid to the external environment. The conse-quence effects for loss of containment can be generallyconsidered to be in the following categories:

a. Safety and health impact.b. Environmental impact.c. Production losses.d. Maintenance and reconstruction costs.

10.1.2 Other Functional Failures

Although RBI is mainly concerned with loss of contain-ment failures, other functional failures could be included in aRBI study if a user desired. Other functional failures couldinclude:

a. Functional or mechanical failure of internal componentsof pressure containing equipment (e.g., column trays, demis-ter mats, coalescer elements, distribution hardware, etc.).b. Heat exchanger tube failure.

Note: There may be situations where a heat exchanger tube failurecould lead to a loss of containment of the heat exchanger or ancillaryequipment. These would typically involve leakage from a high pres-sure side to a low pressure side of the exchanger and subsequentbreach of containment of the low pressure side.

c. Pressure relief device failure.

d. Rotating equipment failure (e.g., seal leaks, impeller fail-ures, etc.).

These other functional failures are usually covered withinreliability centered maintenance (RCM) programs and there-fore are not covered in detail in this document.

10.2 TYPES OF CONSEQUENCE ANALYSIS

The following paragraphs discuss different approaches tothe determination of consequences of failure. For the pur-poses of the discussion, these approaches have been catego-rized as “qualitative” or “quantitative.” However, it should berecognized that “qualitative” and “quantitative” are the endpoints of a continuum rather than distinctive approaches (seeFigure 3).

10.2.1 Qualitative Consequences Analysis

A qualitative method involves identification of the units,systems or equipment, and the hazards present as a result ofoperating conditions and process fluids. On the basis ofexpert knowledge and experience, the consequences of failure(safety, health, environmental or financial impacts) can beestimated separately for each unit, system, equipment groupor individual equipment item.

For a qualitative method, a consequences category (such as“A” through “E” or “high”, “medium” or “low”) is typicallyassigned for each unit, system, grouping or equipment item. Itmay be appropriate to associate a numerical value, such ascost (see 10.3.2), with each consequence category.

10.2.2 Quantitative Consequences Analysis

A quantitative method involves using a logic model depict-ing combinations of events to represent the effects of failureon people, property, the business and the environment. Quan-titative models usually contain one or more standard failurescenarios or outcomes and calculate consequence of failurebased on:

a. Type of process fluid in equipment.

b. State of the process fluid inside the equipment (solid, liq-uid or gas).

c. Key properties of process fluid (molecular weight, boilingpoint, autoignition temperature, ignition energy, density, etc.).

d. Process operating variables such as temperature andpressure.

e. Mass of inventory available for release in the event of aleak.

f. Failure mode and resulting leak size.

g. State of fluid after release in ambient conditions (solid, gasor liquid).



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


Results of a quantitative analysis are usually numeric. Con-sequence categories may be also used to organize more quan-titatively assessed consequences into manageable groups.

10.3 UNITS OF MEASURE IN CONSEQUENCE ANALYSIS

Different types of consequences may be described best bydifferent measures. The RBI analyst should consider thenature of the hazards present and select appropriate units ofmeasure. However, the analyst should bear in mind that theresultant consequences should be comparable, as much aspossible, for subsequent risk prioritization.

The following provide some units of measure of conse-quence that can be used in a RBI assessment.

10.3.1 Safety

Safety consequences are often expressed as a numericalvalue or characterized by a consequence category associatedwith the severity of potential injuries that may result from anundesirable event.

For example, safety consequences could be expressedbased on the severity of an injury (e.g., fatality, serious injury,medical treatment, first aid) or expressed as a category linkedto the injury severity (e.g., A through E).

10.3.2 Cost

Cost is commonly used as an indicator of potential conse-quences. It is possible, although not always credible, to assigncosts to almost any type of consequence. Typical conse-quences that can be expressed in “cost” include:

a. Production loss due to rate reduction or downtime.b. Deployment of emergency response equipment andpersonnel.c. Lost product from a release.d. Degradation of product quality.e. Replacement or repair of damaged equipment.f. Property damage offsite.g. Spill/release cleanup onsite or offsite.h. Business interruption costs (lost profits).i. Loss of market share.j. Injuries or fatalities.k. Land reclamation.l. Litigation.m. Fines.n. Goodwill.

The above list is reasonably comprehensive, but in practicesome of these costs are neither practical nor necessary to usein a RBI assessment.

Cost generally requires fairly detailed information to fullyassess. Information such as product value, equipment costs,repair costs, personnel resources, and environmental damage

may be difficult to derive, and the manpower required to per-form a complete financial-based consequence analysis may belimited. However, cost has the advantage of permitting a directcomparison of various types of losses on a common basis.

10.3.3 Affected Area

Affected area is also used to describe potential conse-quences in the field of risk assessment. As its name implies,affected area represents the amount of surface area that expe-riences an effect (toxic dose, thermal radiation, explosionoverpressure, etc.) greater than a pre-defined limiting value.Based on the thresholds chosen, anything — personnel,equipment, environment — within the area will be affectedby the consequences of the hazard.

In order to rank consequences according to affected area, itis typically assumed that equipment or personnel at risk areevenly distributed throughout the unit. A more rigorousapproach would assign a population density with time orequipment value density to different areas of the unit.

The units for affected area consequence (square feet orsquare meters) do not readily translate into our everydayexperiences and thus there is some reluctance to use this mea-sure. It has, however, several features that merit consider-ation. The affected area approach has the characteristic ofbeing able to compare toxic and flammable consequences byrelating to the physical area impacted by a release.

10.3.4 Environmental Damage

Environmental consequence measures are the least devel-oped among those currently used for RBI. A common unit ofmeasure for environmental damage is not available in the cur-rent technology, making environmental consequences diffi-cult to assess. Typical parameters used that provide anindirect measure of the degree of environmental damage are:

a. Acres of land affected per year.b. Miles of shoreline affected per year.c. Number of biological or human-use resources consumed.

The portrayal of environmental damage almost invariablyleads to the use of cost, in terms of dollars per year, for theloss and restoration of environmental resources.

10.4 VOLUME OF FLUID RELEASED

In most consequence evaluations, a key element in deter-mining the magnitude of the consequence is the volume offluid released. The volume released is typically derived froma combination of the following:

a. Volume of fluid available for release – Volume of fluid inthe piece of equipment and connected equipment items. Intheory, this is the amount of fluid between isolation valvesthat can be quickly closed.b. Failure mode.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


c. Leak rate.d. Detection and isolation time.

In some cases, the volume released will be the same as thevolume available for release. Usually, there are safeguardsand procedures in place so that the breach of containment canbe isolated and the volume released will be less than the vol-ume available for release.

10.5 CONSEQUENCE EFFECT CATEGORIES

The failure of the pressure boundary and subsequentrelease of fluids may cause safety, health, environmental,facility and business damage. The RBI analyst should con-sider the nature of the hazards and assure that appropriate fac-tors are considered for the equipment, system, unit or plantbeing assessed.

Regardless of whether a more qualitative or quantitativeanalysis is used, the major factors to consider in evaluating theconsequences of failure are listed in the following sections.

10.5.1 Flammable Events (Fire and Explosion)

Flammable events occur when both a leak and ignitionoccurs. The ignition could be through an ignition source orauto-ignition. Flammable events can cause damage in twoways: thermal radiation and blast overpressure. Most of thedamage from thermal effects tends to occur at close range, butblast effects can cause damage over a larger distance from theblast center. Following are typical categories of fire andexplosion events:

a. Vapor cloud explosion.b. Pool fire.c. Jet fire.d. Flash fire.e. Boiling liquid expanding vapor explosion (BLEVE).

The flammable events consequence is typically derivedfrom a combination of the following elements:

1. Inherent tendency to ignite.2. Volume of fluid released.3. Ability to flash to a vapor.4. Possibility of auto-ignition.5. Effects of higher pressure or higher temperatureoperations.6. Engineered safeguards.7. Personnel and equipment exposed to damage.

10.5.2 Toxic Releases

Toxic releases, in RBI, are only addressed when they affectpersonnel (site and public). These releases can cause effectsat greater distances than flammable events. Unlike flammablereleases, toxic releases do not require an additional event(e.g., ignition, as in the case of flammables) to cause person-

nel injuries. The RBI program typically focuses on acutetoxic risks that create an immediate danger, rather thanchronic risks from low-level exposures.

The toxic consequence is typically derived from the fol-lowing elements:

a. Volume of fluid released and toxicity.b. Ability to disperse under typical process and environmen-tal conditions.c. Detection and mitigation systems.d. Population in the vicinity of the release.

10.5.3 Releases of Other Hazardous Fluids

Other hazardous fluid releases are of most concern in RBIassessments when they affect personnel. These materials cancause thermal or chemical burns if a person comes in contactwith them. Common fluids, including steam, hot water, acidsand caustics can have a safety consequence of a release andshould be considered as part of a RBI program. Generally, theconsequence of this type of release is significantly lower thanfor flammable or toxic releases because the affected area islikely to be much smaller and the magnitude of the hazard isless. Key parameters in this evaluation are:

a. Volume of fluid released.b. Personnel density in the area.c. Type of fluid and nature of resulting injury.d. Safety systems (e.g., personnel protective clothing, show-ers etc.).

Other considerations in the analysis are:

e. Environmental damage if the spill is not contained.f. Equipment damage. For some reactive fluids, contact withequipment or piping may result in aggressive deteriorationand failure.

10.5.4 Environmental Consequences

Environmental consequences are an important componentto any consideration of overall risk in a processing plant. TheRBI program typically focuses on acute and immediate envi-ronmental risks, rather than chronic risks from low-levelemissions.

The environmental consequence is typically derived fromthe following elements:

a. Volume of fluid released.b. Ability to flash to vapor.c. Leak containment safeguards.d. Environmental resources affected.e. Regulatory consequence (e.g., citations for violations,fines, potential shutdown by authorities).

Liquid releases may result in contamination of soil,groundwater and/or open water. Gaseous releases are equallyimportant but more difficult to assess since the consequence



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


typically relates to local regulatory constraints and the pen-alty for exceeding those constraints.

The consequences of environmental damage are bestunderstood by cost. The cost may be calculated as follows:

Environmental Cost = Cost for cleanup + Fines + Other costs

The cleanup cost will vary depending on many factors.Some key factors are:

1. Type of spill—above ground, below ground, surfacewater etc.2. Type of liquid.3. Method of cleanup.4. Volume of spill.5. Accessibility and terrain at the spill location.

The fine component cost will depend on the regulationsand laws of the applicable local and federal jurisdictions.

The other cost component would include costs that may beassociated with the spill such as litigation from landowners orother parties. This component is typically specific to thelocale of the facility.

10.5.5 Production Consequences

Production consequences generally occur with any loss ofcontainment of the process fluid and often with a loss of con-tainment of a utility fluid (water, steam, fuel gas, acid, causticetc). These production consequences may be in addition to orindependent of flammable, toxic, hazardous or environmentalconsequences. The main production consequences for RBIare financial.

The financial consequences could include the value of thelost process fluid and business interruption. The cost of thelost fluid can be calculated fairly easily by multiplying thevolume released by the value. Calculation of the businessinterruption is more complex. The selection of a specificmethod depends on:

a. The scope and level of detail of the study.b. Availability of business interruption data.

A simple method for estimating the business interruptionconsequence is to use the equation:

Business Interruption = Process Unit Daily Value xDowntime (Days)

The Unit Daily Value could be on a revenue or profit basis.The downtime estimate would represent the time required toget back into production. The Dow Fire and Explosion Indexis a typical method of estimating downtime after a fire orexplosion.

More rigorous methods for estimating business interrup-tion consequences may take into account factors such as:

a. Ability to compensate for damaged equipment (e.g., spareequipment, rerouting, etc.).b. Potential for damage to nearby equipment (knock-ondamage).c. Potential for production loss to other units.

Site specific circumstances should be considered in thebusiness interruption analysis to avoid over or under statingthis consequence. Examples of these considerations include:

1. Lost production may be compensated at anotherunderutilized or idle facility.2. Loss of profit could be compounded if other facilitiesuse the unit’s output as a feedstock or processing fluid.3. Repair of small damage cost equipment may take aslong as large damage cost equipment.4. Extended downtime may result in losing customers ormarket share, thus extending loss of profit beyond produc-tion restart.5. Loss of hard to get or unique equipment items mayrequire extra time to obtain replacements.6. Insurance coverage.

10.5.6 Maintenance and Reconstruction Impact

Maintenance and reconstruction impact represents theeffort required to correct the failure and to fix or replaceequipment damaged in the subsequent events (e.g., fire,explosion). The maintenance and reconstruction impactshould be accounted for in the RBI program. Maintenanceimpact will generally be measured in monetary terms andtypically includes:

a. Repairs.b. Equipment replacement.

11 Risk Determination, Assessment and Management

11.1 PURPOSE

This section describes the process of determining risk bycombining the results of work done as described in Section 9and 10. It also provides guidelines for prioritizing and assess-ing the acceptability of risk with respect to risk criteria. Thiswork process leads to creating and implementing a risk man-agement plan.

11.2 DETERMINATION OF RISK

11.2.1 Determination of the Probability of a Specific Consequence

Once the probabilities of failure and failure mode(s) havebeen determined for the relevant deterioration mechanisms



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


(see Section 9), the probability of each credible consequencescenario should be determined. In other words, the loss ofcontainment failure may only be the first event in a series ofevents that lead to a specific consequence. The probability ofcredible events leading up to the specific consequence shouldbe factored into the probability of the specific consequenceoccurring. For example, after a loss of containment the firstevent may be initiation or failure of safeguards (isolation,alarms, etc.). The second event may be dispersion, dilution oraccumulation of the fluid. The third event may be initiation ofor failure to initiate preventative action (shutting down nearbyignition sources, neutralizing the fluid, etc) and so on until thespecific consequence event (fire, toxic release, injury, envi-ronmental release etc.)

It is important to understand this linkage between the prob-ability of failure and the probability of possible resulting inci-dents. The probability of a specific consequence is tied to theseverity of the consequence and may differ considerably fromthe probability of the equipment failure itself. Probabilities ofincidents generally decrease with the severity of the incident.For example, the probability of an event resulting in a fatalitywill generally be less than the probability that the event willresult in a first aid or medical treatment injury. It is importantto understand this relationship.

Personnel inexperienced in risk assessment methods oftenlink the probability of failure with the most severe conse-quences that can be envisioned. An extreme example wouldbe coupling the POF of a deterioration mechanism where themode of failure is a small hole leak with the consequence of amajor fire. This linkage would lead to an overly conservativerisk assessment since a small leak will rarely lead to a majorfire. Each type of deterioration mechanism has its own char-acteristic failure mode(s). For a specific deterioration mecha-nism, the expected mode of failure should be taken intoaccount when considering the probability of incidents in theaftermath of an equipment failure. For instance, the conse-quences expected from a small leak could be very differentthan the consequences expected from a brittle fracture.

The following example serves to illustrate how the proba-bility of a specific consequence could be determined. Theexample has been simplified and the numbers used are purelyhypothetical.

Suppose a piece of equipment containing hydrocarbons isbeing assessed. An event tree starting with a loss of contain-ment could be depicted as shown in Figure 5.

The probability of the specific consequence is the productof the probability of each event leading up to the specific con-sequence. In the example, the specific consequence beingevaluated is a fire. The probability of a fire would be:

Probability of Fire = (Probability of Failure) x(Probability of Ignition)

Probability of Fire = 0.001 per year x 0.01 = 0.00001 or 1 x 10-5 per year

The probability of no fire encompasses two scenarios (lossof containment and no loss of containment). The probabilityof no fire would be:

Probability of No Fire = (Probability of Failure x Probability of Non-ignition) +

Probability of No Failure

Probability of No Fire = (0.001 per year x 0.99) + 0.999 per year = 0.99999 per year

Note: The probability of all consequence scenarios should equal 1.0.In the example, the probability of the specific consequence of a fire(1 x 10-5 per year) plus the probability of no fire (9.9999 x 10-1peryear) equals 1.0.

Typically, there will be other credible consequences thatshould be evaluated. However, it is often possible to deter-mine a dominant probability/consequence pair, such that it isnot necessary to include every credible scenario in the analy-sis. Engineering judgment and experience should be used toeliminate trivial cases.

11.2.2 Calculate Risk

Referring back to the Risk equation:

Risk = Probability x Consequence

it is now possible to calculate the risk for each specific con-sequence. The risk equation can now be stated as:

Risk of a specific consequence = (Probability of a specific consequence) x

(Specific Consequence)

The total risk is the sum of the individual risks for eachspecific consequence. Often one probability/consequencepair will be dominant and the total risk can be approximatedby the risk of the dominant scenario.

For the example mentioned in 11.2.1, if the consequence ofa fire had been assessed at $1 x 107 then the resulting riskwould be:

Risk of Fire = (1 x 10-5 per year) x ($1 x 107) = $100/year

If probability and consequence are not expressed as numer-ical values, risk is usually determined by plotting the proba-bility and consequence on a risk matrix (see 11.6).Probability and consequence pairs for various scenarios maybe plotted to determine risk of each scenario. Note that whena risk matrix is used, the probability to be plotted should be



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


the probability of the associated consequence, not the proba-bility of failure.

11.3 RISK MANAGEMENT DECISIONS AND ACCEPTABLE LEVELS OF RISK

11.3.1 Risk Acceptance

Risk-based inspection is a tool to provide an analysis of therisks of loss of containment of equipment. Many companieshave corporate risk criteria defining acceptable and prudentlevels of safety, environmental and financial risks. These riskcriteria should be used when making risk-based inspectiondecisions. Because each company may be different in termsof acceptable risk levels, risk management decisions can varyamong companies.

Cost-benefit analysis is a powerful tool that is being usedby many companies, governments and regulatory authoritiesas one method in determining risk acceptance. Users arereferred to "A Comparison of Criteria for Acceptance ofRisk" by the Pressure Vessel Research Council, for moreinformation on risk acceptance. Risk acceptance may vary fordifferent risks. For example, risk tolerance for an environ-mental risk may be higher than for a safety/health risk.

11.3.2 Using Risk Assessment in Inspection and Maintenance Planning

The use of risk assessment in inspection and maintenanceplanning is unique in that consequential information, which istraditionally operations-based, and probability of failure infor-mation, which is typically engineering/maintenance/inspec-tion-based, is combined to assist in the planning process. Partof this planning process is the determination of what to inspect,how to inspect (technique), and the extent of inspection (cover-age). Determining the risk of process units, or individual pro-cess equipment items facilitates this, as the inspections are nowprioritized based on the risk value. The second part of this pro-cess is determining when to inspect the equipment. Under-standing how risk varies with time facilitates this part of the

process. Refer to Section 12 for a more detailed description ofinspection planning based on risk analysis.

11.4 SENSITIVITY ANALYSIS

Understanding the value of each variable and how it influ-ences the risk calculation is key to identifying which inputvariables deserve closer scrutiny versus other variables whichmay not have significant effects. This is more importantwhen performing risk analyses that are more detailed andquantitative in nature.

Sensitivity analysis typically involves reviewing some orall input variables to the risk calculation to determine theoverall influence on the resultant risk value. Once this analy-sis has been performed, the user can see which input variablessignificantly influence the risk value. Those key input vari-ables deserve the most focus or attention.

It often is worthwhile to gather additional information onsuch variables. Typically, the preliminary estimates of proba-bility and consequence may be too conservative or too pessi-mistic; therefore, the information gathering performed afterthe sensitivity analysis should be focused on developing morecertainty for the key input variables. This process should ulti-mately lead to a re-evaluation of the key input variables. Assuch, the quality and accuracy of the risk analysis shouldimprove. This is an important part of the data validation phaseof risk assessment.

11.5 ASSUMPTIONS

Assumptions or estimates of input values are often usedwhen consequence and/or probability of failure data are notavailable. Even when data are known to exist, conservativeestimates may be utilized in an initial analysis pending inputof future process or engineering modeling information, suchas a sensitivity analysis. Caution is advised in being too con-servative, as overestimating consequences and/or probabilityof failure values will unnecessarily inflate the calculated riskvalues. Presenting over inflated risk values may misleadinspection planners, management and insurers, and can createa lack of credibility for the user and the RBI process.

Figure 5—Example Event Tree

Loss of containmentProbability of failure = 1/1000 = 0.001/year

No fireProbability of non-ignition = 99/100 = 0.99

FireProbability of Ignition = 1/100 = 0.01



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


11.6 RISK PRESENTATION

Once risk values are developed, they can then be presentedin a variety of ways to communicate the results of the analysisto decision-makers and inspection planners. One goal of therisk analysis is to communicate the results in a common for-mat that a variety of people can understand. Using a riskmatrix or plot is helpful in accomplishing this goal.

11.6.1 Risk Matrix

For risk ranking methodologies that use consequence andprobability categories, presenting the results in a risk matrixis a very effective way of communicating the distribution ofrisks throughout a plant or process unit without numericalvalues. An example risk matrix is shown in Figure 6. In thisfigure, the consequence and probability categories arearranged such that the highest risk ranking is toward theupper right-hand corner. It is usually desirable to associatenumerical values with the categories to provide guidance tothe personnel performing the assessment (e.g., probabilitycategory C ranges from 0.001 to 0.01). Different sizes ofmatrices may be used (e.g., 5 x 5, 4 x 4, etc.). Regardless ofthe matrix selected, the consequence and probability catego-ries should provide sufficient discrimination between theitems assessed.

Risk categories may be assigned to the boxes on the riskmatrix. An example risk categorization (higher, medium,lower) of the risk matrix is shown in Figure 6. In this examplethe risk categories are symmetrical. They may also be asym-metrical where for instance the consequence category may begiven higher weighting than the probability category.

11.6.2 Risk Plots

When more quantitative consequence and probability dataare being used, and where showing numeric risk values ismore meaningful to the stakeholders, a risk plot (or graph) isused (Figure 7). This graph is constructed similarly to therisk matrix in that the highest risk is plotted toward the upperright-hand corner. Often a risk plot is drawn using log-logscales for a better understanding of the relative risks of theitems assessed. In the example plot in Figure 7, ten pieces ofequipment are shown, as well as an iso-risk line (line of con-stant risk). If this line is the acceptable threshold of risk in thisexample, then equipment items 1, 2 and 3 should be mitigatedso that their resultant risk levels fall below the line.

11.6.3 Using a Risk Plot or Matrix

Equipment items residing towards the upper right-handcorner of the plot or matrix (in the examples presented) willmost likely take priority for inspection planning becausethese items have the highest risk. Similarly, items residingtoward the lower left-hand corner of the plot (or matrix) willtend to take lower priority because these items have the low-est risk. Once the plots have been completed, the risk plot (ormatrix) can then be used as a screening tool during the priori-tization process.

11.7 ESTABLISHING ACCEPTABLE RISK THRESHOLDS

After the risk analysis has been performed, and risk valuesplotted, the risk evaluation process begins. Risk plots andmatrices can be used to screen, and initially identify higher,

Figure 6—Example Risk Matrix Using Probability and Consequence Categories to Display Risk Rankings

12

34

5

A B C D E

Higher risk

Lower risk

Medium risk

Pro

babi

lity

cate

gory

Consequence category

Qualitative Risk Matrix



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


intermediate and lower risk equipment items. The equipmentcan also be ranked (prioritized) according to its risk value intabular form. Thresholds that divide the risk plot, matrix ortable into acceptable and unacceptable regions of risk can bedeveloped. Corporate safety and financial policies and con-straints or risk criteria influence the placement of the thresh-olds. Regulations and laws may also specify or assist inidentifying the acceptable risk thresholds.

Reduction of some risks to an acceptable level may not bepractical due to technology and cost constraints. An “As LowAs Reasonably Practical” (ALARP) approach to risk man-agement or other risk management approach may be neces-sary for these items.

11.8 RISK MANAGEMENT

Based on the ranking of items and the risk threshold, therisk management process begins. For risks that are judgedacceptable, no mitigation may be required and no furtheraction necessary.

For risks considered unacceptable and therefore requiringrisk mitigation, there are various mitigation categories thatshould be considered:

a. Decommission: Is the equipment really necessary to sup-port unit operation?

b. Inspection/condition monitoring: Can a cost-effectiveinspection program, with repair as indicated by the inspectionresults, be implemented that will reduce risks to an acceptablelevel?

c. Consequence mitigation: Can actions be taken to lessenthe consequences related to an equipment failure?d. Probability mitigation: Can actions be taken to lessen theprobability of failure such as metallurgy changes or equip-ment redesign?

Risk management decisions can now be made on whichmitigation actions(s) to take. Risk management/mitigation iscovered further in Sections 12 and 13.

12 Risk Management with Inspection Activities

12.1 MANAGING RISK BY REDUCING UNCERTAINTY THROUGH INSPECTION

In previous sections, it has been mentioned that risk can bemanaged by inspection. Obviously, inspection does not arrestor mitigate deterioration mechanisms. Inspection serves toidentify, monitor, and measure the deterioration mecha-nism(s). Also, it is invaluable input in the prediction of whenthe deterioration will reach a critical point. Correct applica-tion of inspections will improve the user's ability to predictthe deterioration mechanisms and rates of deterioration. Thebetter the predictability, the less uncertainty there will be as towhen a failure may occur. Mitigation (repair, replacement,changes etc.) can then be planned and implemented prior tothe predicted failure date. The reduction in uncertainty andincrease in predictability through inspection translate directlyinto a reduction in the probability of a failure and therefore areduction in the risk. However, users should be diligent toassure that temporary inspection alternatives, in lieu of morepermanent risk reductions, are effective.

Risk mitigation achieved through inspection presumes thatthe organization will act on the results of the inspection in atimely manner. Risk mitigation is not achieved if inspectiondata that are gathered are not properly analyzed and actedupon where needed. The quality of the inspection data andthe analysis or interpretation will greatly affect the level ofrisk mitigation. Proper inspection methods and data analysistools are therefore critical.

12.2 IDENTIFYING RISK MANAGEMENT OPPORTUNITIES FROM RBI AND PROBABILITY OF FAILURE RESULTS

As discussed in Section 11, typically a risk priority list isdeveloped. RBI will also identify whether consequence orprobability of failure or both is driving risk. In the situationswhere risk is being driven by probability of failure, there isusually potential for risk management through inspection.

Once a RBI assessment has been completed, the items withhigher or unacceptable risk should be assessed for potential

Figure 7—Risk Plot when Using Quantitative or Numeric Risk Values

Consequence of failure

Pro

babi

lity

of fa

ilure

ISO-risk line

12

3

4

5

6

7

8

910

Risk plot



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


risk management through inspection. Whether inspectionswill be effective or not will depend on:

a. Equipment type.b. Active and credible deterioration mechanism(s).c. Rate of deterioration or susceptibility.d. Inspection methods, coverage and frequency.e. Accessibility to expected deterioration areas.f. Shutdown requirements.g. Amount of achievable reduction in probability of failure(POF) (i.e., a reduction in POF of a low POF item may be dif-ficult to achieve through inspection). Depending on factorssuch as the remaining life of the equipment and type of dete-rioration mechanism, risk management through inspectionmay have little or no effect. Examples of such cases are:

1. Corrosion rates well-established and equipment near-ing end of life.2. Instantaneous failures related to operating conditionssuch as brittle fracture.3. Inspection technology that is not sufficient to detect orquantify deterioration adequately.4. Too short a time frame from the onset of deteriorationto final failure for periodic inspections to be effective (e.g.,high-cycle fatigue cracking).5. Event-driven failures (circumstances that cannot bepredicted).

In cases such as these, an alternative form of mitigationmay be required.

The most practical and cost effective risk mitigation strat-egy can then be developed for each item. Usually, inspectionprovides a major part of the overall risk management strategy.

12.3 ESTABLISHING AN INSPECTION STRATEGY BASED ON RISK ASSESSMENT

The results of a RBI assessment and the resultant risk man-agement assessment may be used as the basis for the develop-ment of an overall inspection strategy for the group of itemsincluded. The inspection strategy should be designed in con-junction with other mitigation plans so that all equipmentitems will have resultant risks that are acceptable. Usersshould consider risk rank, risk drivers, item history, numberand results of inspections, type and effectiveness of inspec-tions, equipment in similar service and remaining life in thedevelopment of their inspection strategy.

Inspection is only effective if the inspection technique cho-sen is sufficient for detecting the deterioration mechanismand its severity. As an example, spot thickness readings on apiping circuit would be considered to have little or no benefitif the deterioration mechanism results in unpredictable local-ized corrosion (e.g., pitting, ammonia bisulfide corrosion,local thin area, etc.). In this case, ultrasonic scanning, radiog-

raphy, etc. will be more effective. The level of risk reductionachieved by inspection will depend on:

a. Mode of failure of the deterioration mechanism.b. Time interval between the onset of deterioration and fail-ure, (i.e., speed of deterioration).c. Detection capability of inspection technique.d. Scope of inspection.e. Frequency of inspection.

Organizations should be deliberate and systematic inassigning the level of risk management achieved throughinspection and should be cautious not to assume that there isan unending capacity for risk management through inspec-tion.

The inspection strategy should be a documented, iterativeprocess to assure that inspection activities are continuallyfocused on items with higher risk and that the risks are effec-tively reduced by the implemented inspection activity.

12.4 MANAGING RISK WITH INSPECTION ACTIVITIES

The effectiveness of past inspections is part of the determi-nation of the present risk. The future risk can now beimpacted by future inspection activities. RBI can be used as a“what if” tool to determine when, what and how inspectionsshould be conducted to yield an acceptable future risk level.Key parameters and examples that can affect the future riskare:

a. Frequency of inspection – Increasing the frequency ofinspections may serve to better define, identify or monitor thedeterioration mechanism(s) and therefore reduce the risk.Both routine and turnaround inspection frequencies can beoptimized.b. Coverage – Different zones or areas of inspection of anitem or series of items can be modeled and evaluated to deter-mine the coverage that will produce an acceptable level ofrisk. For example:

1. A high risk piping system may be a candidate forextensive inspection, using one or more NDE techniquestargeted to locating the identified deteriorationmechanisms.2. An assessment may reveal the need for focus on partsof a vessel where the highest risk may be located andfocus on quantifying this risk rather than look at the rest ofthe vessel where there are perhaps only low risk deteriora-tion processes occurring.

c. Tools and techniques – The selection and usage of theappropriate inspection tools and techniques can be optimizedto cost effectively and safely reduce risk. In the selection ofinspection tools and techniques, inspection personnel shouldtake into consideration that more than one technology mayachieve risk mitigation. However, the level of mitigation



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


achieved can vary depending on the choice. As an example,radiography may be more effective than ultrasonic for thick-ness monitoring in cases of localized corrosion.d. Procedures and practices – Inspection procedures and theactual inspection practices can impact the ability of inspec-tion activities to identify, measure and/or monitordeterioration mechanisms. If the inspection activities are exe-cuted effectively by well-trained and qualified inspectors, theexpected risk management should be obtained. The user iscautioned not to assume that all inspectors and NDE examin-ers are well qualified and experienced, but rather to take stepsto assure that they have the appropriate level of experienceand qualifications. e. Internal or external inspection – Risk reductions by bothinternal and external inspections should be assessed. Oftenexternal inspection with effective on-stream inspection tech-niques can provide useful data for risk assessment. It is worthnoting that invasive inspections, in some cases, may causedeterioration and increase the risk of the item. Exampleswhere this may happen include:

1. Moisture ingress to equipment leading to SCC or poly-thionic acid cracking.2. Internal inspection of glass lined vessels.3. Removal of passivating films.4. Human errors in re-streaming.5. Risk associated with shutting down and starting upequipment.

The user can adjust these parameters to obtain the opti-mum inspection plan that manages risk, is cost effective, andis practical.

12.5 MANAGING INSPECTION COSTS WITH RBI

Inspection costs can be more effectively managed throughthe utilization of RBI. Resources can be applied or shifted tothose areas identified as a higher risk or targeted based on thestrategy selected. Consequently, this same strategy allowsconsideration for reduction of inspection activities in thoseareas that have a lower risk or where the inspection activity haslittle or no affect on the associated risks. This results in inspec-tion resources being applied where they are needed most.

Another opportunity for managing inspection costs is byidentifying items in the inspection plan that can be inspectednon-intrusively on-stream. If the non-intrusive inspectionprovides sufficient risk management, then there is a potentialfor a net savings based on not having to blind, open, clean,and internally inspect during downtime. If the item consid-ered is the main driver for bringing an operational unit down,then the non-intrusive inspection may contribute to increaseduptime of the unit. The user should recognize that while thereis a potential for the reduction of inspection costs through theutilization of RBI, equipment integrity and inspection costoptimization should remain the focus.

12.6 ASSESSING INSPECTION RESULTS AND DETERMINING CORRECTIVE ACTION

Inspection results such as deterioration mechanisms, rateof deterioration and equipment tolerance to the types of dete-rioration should be used as variables in assessing remaininglife and future inspection plans. The results can also be usedfor comparison or validation of the models that may havebeen used for probability of failure determination.

A documented mitigation action plan should be developedfor any equipment item requiring repair or replacement. Theaction plan should describe the extent of repair (or replace-ment), recommendations, the proposed repair method(s),appropriate QA/QC and the date the plan should be completed.

12.7 ACHIEVING LOWEST LIFE CYCLE COSTS WITH RBI

Not only can RBI be used to optimize inspection costs thatdirectly affect life cycle costs, it can assist in lowering overalllife cycle costs through various cost benefit assessments. Thefollowing examples can give a user ideas on how to lower lifecycle costs through RBI with cost benefit assessments.

a. RBI should enhance the prediction of failures caused bydeterioration mechanisms. This in turn should give the userconfidence to continue to operate equipment safely, closer tothe predicted failure date. By doing this, the equipment cycletime should increase and life cycle costs decrease.

b. RBI can be used to assess the effects of changing to amore aggressive fluid. A subsequent plan to upgrade con-struction material or replace specific items can then bedeveloped. The construction material plan would consider theoptimized run length safely attainable along with the appro-priate inspection plan. This could equate to increased profitsand lower life cycle costs through reduced maintenance, opti-mized inspections, and increased unit/equipment uptime.

c. Turnaround and maintenance costs also have an affect onthe life cycle costs of an equipment item. By using the resultsof the RBI inspection plan to identify more accurately whereto inspect and what repairs and replacements to expect, turn-around and maintenance work can be preplanned and, insome cases, executed at a lower cost than if unplanned.

13 Other Risk Mitigation Activities

13.1 GENERAL

As described in the previous section, inspection is often aneffective method of risk management. However, inspectionmay not always provide sufficient risk mitigation or may notbe the most cost effective method. The purpose of this sectionis to describe other methods of risk mitigation. This list is not



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


meant to be all inclusive. These risk mitigation activities fallinto one or more of the following:

a. Reduce the magnitude of consequence.b. Reduce the probability of failure.c. Enhance the survivability of the facility and people to theconsequence.d. Mitigate the primary source of consequence.

13.2 EQUIPMENT REPLACEMENT AND REPAIR

When equipment deterioration has reached a point that therisk of failure cannot be managed to an acceptable level,replacement/repair is often the only way to mitigate the risk.

13.3 EVALUATING FLAWS FOR FITNESS-FOR- SERVICE

Inspection may identify flaws in equipment. A fitness-for-service assessment (e.g., API RP 579) may be performed todetermine if the equipment may continue to be safely oper-ated, under what conditions and for what time period. A fit-ness-for-service analysis can also be performed to determinewhat size flaws, if found in future inspections, would requirerepair or equipment replacement.

13.4 EQUIPMENT MODIFICATION, REDESIGN AND RERATING

Modification and redesign of equipment can provide miti-gation of probability of failure. Examples include:

a. Change of metallurgy.b. Addition of protective linings and coatings.c. Removal of deadlegs.d. Increased corrosion allowance.e. Physical changes that will help to control/minimizedeterioration.f. Insulation improvements.g. Injection point design changes.

Sometimes equipment is over designed for the processconditions. Rerating the equipment may result in a reductionof the probability of failure assessed for that item.

13.5 EMERGENCY ISOLATION

Emergency isolation capability can reduce toxic, explosionor fire consequences in the event of a release. Proper locationof the isolation valves is key to successful risk mitigation.Remote operation is usually required to provide significantrisk reduction. To mitigate flammable and explosion risk,operations need to be able to detect the release and actuate theisolation valves quickly (within a few minutes). Longerresponse times may still mitigate effects of ongoing fires ortoxic releases.

13.6 EMERGENCY DEPRESSURIZING/DE-INVENTORY

This method reduces the amount and rate of release. Likeemergency isolation, the emergency depressurizing and/orde-inventory needs to be achieved within a few minutes toaffect explosion/fire risk.

13.7 MODIFY PROCESS

Mitigation of the primary source of consequence can beachieved by changing the process towards less hazardousconditions. Examples:

a. Reduce temperature to below atmospheric pressure boil-ing point to reduce size of cloud.b. Substitute a less hazardous material (e.g., high flash sol-vent for a low flash solvent).c. Use a continuous process instead of a batch operation.d. Dilute hazardous substances.

13.8 REDUCE INVENTORY

This method reduces the magnitude of consequence. Someexamples:

a. Reduce/eliminate storage of hazardous feedstocks or inter-mediate products.b. Modify process control to permit a reduction in inventorycontained in surge drums, reflux drums or other in-processinventories.c. Select process operations that require less inventory/hold-up.d. Substitute gas phase technology for liquid phase.

13.9 WATER SPRAY/DELUGE

This method can reduce fire damage and minimize or pre-vent escalation. A properly designed and operating systemcan greatly reduce the probability that a vessel exposed to firewill BLEVE.

13.10 WATER CURTAIN

Water sprays entrap large amounts of air into a cloud.Water curtains mitigate water soluble vapor clouds by absorp-tion as well as dilution and insoluble vapors (including mostflammables) by air dilution. Early activation is required inorder to achieve significant risk reduction. The curtain shouldpreferably be between the release location and ignitionsources (e.g., furnaces) or locations where people are likely tobe present. Design is critical for flammables, since the watercurtain can enhance flame speed under some circumstances.

13.11 BLAST-RESISTANT CONSTRUCTION

Utilizing blast resistant construction provides mitigation ofthe damage caused by explosions and may prevent escalation



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


of the incident. When used for buildings (see API RP 752), itmay provide personnel protection from the effects of anexplosion. This may also be useful for equipment critical toemergency response, critical instrument/control lines, etc.

13.12 OTHERS

a. Spill detectors.

b. Steam or air curtains.

c. Fireproofing.

d. Instrumentation (interlocks, shut-down systems, alarms,etc.).

e. Inerting/gas blanketing.

f. Ventilation of buildings and enclosed structures.

g. Piping redesign.

h. Mechanical flow restriction.

i. Ignition source control.

j. Improved design standards.

k. Improvement in process safety management program.

l. Emergency evacuation.

m. Shelters (safe havens).

n. Toxic scrubbers on building vents.

o. Spill containment.

p. Facility siting.

q. Condition monitoring.

r. Improved training and procedures.

14 Reassessment and Updating RBI Assessments

14.1 RBI REASSESSMENTS

RBI is a dynamic tool that can provide current and pro-jected future risk evaluations. However, these evaluations arebased on data and knowledge at the time of the assessment.As time goes by, changes are inevitable and the results fromthe RBI assessment should be updated.

It is important to maintain and update a RBI program toassure the most recent inspection, process, and maintenanceinformation is included. The results of inspections, changesin process conditions and implementation of maintenancepractices can all have significant effects on risk and can trig-ger the need to perform a reassessment.

14.2 WHY CONDUCT A RBI REASSESSMENT?

There are several events that will change risks and make itprudent to conduct a RBI reassessment. It is important thatthe facility have an effective management of change processthat identifies when a reassessment is necessary. Sections14.2.1 through 14.2.4 provide guidance on some key factorsthat could trigger a RBI reassessment.

14.2.1 Deterioration Mechanisms and Inspection Activities

Many deterioration mechanisms are time dependent. Typi-cally, the RBI assessment will project deterioration at a con-tinuous rate. In reality, the deterioration rate may vary overtime. Through inspection activities, the average rates of dete-rioration may be better defined.

Some deterioration mechanisms are independent of time(i.e., they occur only when there are specific conditionspresent). These conditions may not have been predicted in theoriginal assessment but may have subsequently occurred.

Inspection activities will increase information on the con-dition of the equipment. When inspection activities have beenperformed, the results should be reviewed to determine if aRBI reassessment is necessary.

14.2.2 Process and Hardware Changes

Changes in process conditions and hardware changes, suchas equipment modifications or replacement, frequently cansignificantly alter the risks, and dictate the need for a reas-sessment. Process changes, in particular, have been linked toequipment failure from rapid or unexpected corrosion orcracking. This is particularly important for deteriorationmechanisms that depend heavily on process conditions. Typ-ical examples include chloride stress corrosion cracking ofstainless steel, wet H2S cracking of carbon steel and sourwater corrosion. In each case, a change in process conditionscan dramatically affect the corrosion rate or cracking tenden-cies. Hardware changes can also have an effect on risk. Forexample:

a. The probability of failure can be affected by changes in thedesign of internals in a vessel or size and shape of piping sys-tems that accelerate velocity related corrosion effects. b. The consequence of failure can be affected by the reloca-tion of a vessel to an area near an ignition source.

14.2.3 RBI Assessment Premise Change

The premises for the RBI assessment could change andhave a significant impact on the risk results. Some of the pos-sible changes could be:

a. Increase or decrease in population density.b. Change in materials and repair/replacement costs.c. Change in product values.d. Revisions in safety and environmental laws andregulations.e. Revisions in the users risk management plan (such aschanges in risk criteria).

14.2.4 The Effect of Mitigation Strategies

Strategies to mitigate risks such as installation of safetysystems, repairs etc. should be monitored to assure they have



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


successfully achieved the desired mitigation. Once a mitiga-tion strategy is implemented, a reassessment of the risk maybe performed to update the RBI program.

14.3 WHEN TO CONDUCT A RBI REASSESSMENT

14.3.1 After Significant Changes

As discussed in 14.2, significant changes in risk can occurfor a variety of reasons. Qualified personnel should evaluateeach significant change to determine the potential for achange in risk. It may be desirable to conduct a RBI reassess-ment after significant changes in process conditions, deterio-ration mechanisms/rates/severities or RBI premises.

14.3.2 After a Set Time Period

Although significant changes may not have occurred, overtime many small changes may occur and cumulatively causesignificant changes in the RBI assessment. Users should setdefault maximum time periods for reassessments. The gov-erning inspection codes (such as API 510, 570 and 653) andjurisdictional regulations should be reviewed in this context.

14.3.3 After Implementation of Risk Mitigation Strategies

Once a mitigation strategy is implemented, it is prudent todetermine how effective the strategy was in reducing the riskto an acceptable level. This should be reflected in a reassess-ment of the risk and appropriate update in the documentation.

14.3.4 Before and After Maintenance Turnarounds

As part of the planning before a maintenance turnaround, itcould be useful to perform a RBI reassessment. This canbecome a first step in planning the turnaround to insure thework effort is focused on the higher risk equipment items andon issues that might affect the ability to achieve the premisedoperating run time in a safe, economic and environmentallysound manner.

Since a large amount of inspection, repairs and modifica-tions are performed during a maintenance turnaround, it maybe useful to update an assessment after the turnaround toreflect the new risk levels.

15 Roles, Responsibilities, Training and Qualifications

15.1 TEAM APPROACH

RBI requires data gathering from many sources, special-ized analysis, and then risk management decision-making.Generally, one individual does not have the background orskills to single-handedly conduct the entire study. Usually, ateam of people, with the requisite skills and background, is

needed to conduct an effective RBI assessment. Section 15.2sets out a listing of a typical RBI team. Depending on theapplication, some of the disciplines listed may not berequired. Some team members may be part-time due to lim-ited input needs. It is also possible that not all the team mem-bers listed may be required if other team members have therequired skill and knowledge of multiple disciplines. It maybe useful to have one of the team members to serve as a facil-itator for discussion sessions and team interactions.

15.2 TEAM MEMBERS, ROLES & RESPONSIBILITIES

15.2.1 Team Leader

The team leader may be any one of the below mentionedteam members. The team leader should be a full-time teammember, and should be a stakeholder in the facility/equip-ment being analyzed. The team leader typically is responsi-ble for:

a. Formation of the team and verifying that the team mem-bers have the necessary skills and knowledge.

b. Assuring that the study is conducted properly.

1. Data gathered is accurate.

2. Assumptions made are logical and documented.

3. Appropriate personnel are utilized to provide data andassumptions.

4. Appropriate quality and validity checks are employedon data gathered and on the data analysis.

c. Preparing a report on the RBI study and distributing it tothe appropriate personnel whom are either responsible fordecisions on managing risks or responsible for implementingactions to mitigate the risks.

d. Following up to assure that the appropriate risk mitigationactions have been implemented.

15.2.2 Equipment Inspector or Inspection Specialist

The equipment inspector or inspection specialist is gener-ally responsible for gathering data on the condition and his-tory of equipment in the study. This condition data shouldinclude the new/design condition and current condition. Gen-erally, this information will be located in equipment inspec-tion and maintenance files. If condition data are unavailable,the inspector/specialist, in conjunction with the materials andcorrosion specialist, should provide predictions of the currentcondition. The inspector/specialist and materials & corrosionspecialist are also responsible for assessing the effectivenessof past inspections. The equipment inspector/inspection spe-cialist is usually responsible for implementing the recom-mended inspection plan derived from the RBI study.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


15.2.3 Materials and Corrosion Specialist

The materials and corrosion specialist is responsible forassessing the types of deterioration mechanisms and theirapplicability and severity to the equipment considering theprocess conditions, environment, metallurgy, age, etc., of theequipment. This specialist should compare this assessment tothe actual condition of the equipment, determine the reasonfor differences between predicted and actual condition, andthen provide guidance on deterioration mechanisms, rates orseverity to be used in the RBI study. Part of this comparisonshould include evaluating the appropriateness of the inspec-tions in relation to the deterioration mechanism. This special-ist also should provide recommendations on methods ofmitigating the probability of failure (such as changes in met-allurgy, addition of inhibition, addition of coatings/linings,etc.) and methods of monitoring the process for possiblechanges in deterioration rates (such as pH monitoring, corro-sion rate monitoring, contaminant monitoring, etc.).

15.2.4 Process Specialist

The process specialist is responsible for the provision ofprocess condition information. This information generallywill be in the form of process flow sheets. The process spe-cialist is responsible for documenting variations in the pro-cess conditions due to normal occurrences (such as start-upsand shutdowns) and abnormal occurrences. The process spe-cialist is responsible for describing the composition and vari-ability of all the process fluids/gases as well as their potentialtoxicity and flammability. The process specialist should eval-uate/recommend methods of risk mitigation (probability orconsequence) through changes in process conditions.

15.2.5 Operations and Maintenance Personnel

This person(s) is responsible for verifying that the facility/equipment is being operated within the parameters set out inthe process operating envelope. They are responsible for pro-viding data on occurrences when the process deviated fromthe limits of the process operating envelope. They are alsoresponsible for verifying that equipment repairs/replace-ments/additions have been included in the equipment condi-tion data supplied by the equipment inspector. Operationsand maintenance are responsible for implementing recom-mendations that pertain to process or equipment modifica-tions and monitoring.

15.2.6 Management

Management’s role is to provide sponsorship and resources(personnel and funding) for the RBI study. They are respon-sible for making decisions on risk management or providingthe framework/mechanism for others to make these decisionsbased on the results of the RBI study. Finally, management is

responsible for providing the resources and follow-up systemto implement the risk mitigation decisions.

15.2.7 Risk Assessment Personnel

This person(s) is responsible for assembling all of the dataand carrying out the RBI analysis. This person(s) is typicallyresponsible for:

a. Defining data required from other team members.b. Defining accuracy levels for the data.c. Verifying through quality checks the soundness of dataand assumptions.d. Inputting/transferring data into the computer program andrunning the program (if one is used).e. Quality control of data input/output.f. Manually calculating the measures of risk (if a computerprogram is not used).g. Displaying the results in an understandable way and pre-paring appropriate reports on the RBI analysis.

Furthermore, this person(s) should be a resource to the teamconducting a risk/benefit analysis if it is deemed necessary.

15.2.8 Environmental and Safety Personnel

This person(s) is responsible for providing data on environ-mental and safety systems and regulations. He/she also isresponsible for assessing/recommending ways to mitigate theconsequence of failures.

15.2.9 Financial/Business Personnel

This person(s) is responsible for providing data on the costof the facility/equipment being analyzed and the financialimpact of having pieces of equipment or the facility shutdown. He/she also should recommend methods for mitigat-ing the financial consequence of failure.

15.3 TRAINING AND QUALIFICATIONS FOR RBI APPLICATION

15.3.1 Risk Assessment Personnel

This person(s) should have a thorough understanding ofrisk analysis either by education, training, or experience. He/she should have received detailed training on the RBI meth-odology and on the procedures being used for the RBI studyso that he/she understands how the program operates and thevital issues that affect the final results.

Contractors that provide risk assessment personnel for con-ducting RBI analysis should have a program of training andbe able to document that their personnel are suitably qualifiedand experienced. Facility owners that have internal riskassessment personnel conduct RBI analysis should have aprocedure to document that their personnel are sufficiently



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


qualified. The qualifications and training of the risk assess-ment personnel should be documented.

15.3.2 Other Team Members

The other team members should receive basic training onRBI methodology and on the program(s) being used. Thistraining should be geared primarily to an understanding andeffective application of RBI. This training could be providedby the risk assessment personnel on the RBI Team or byanother person knowledgeable on RBI methodology and onthe program(s) being used.

16 RBI Documentation and Record-keeping

16.1 GENERAL

It is important that sufficient information is captured tofully document the RBI assessment. Typically, this documen-tation should include the following data:

a. The type of assessment.b. Team members performing the assessment.c. Time frame over which the assessment is applicable.d. The inputs and sources used to determine risk.e. Assumptions made during the assessment.f. The risk assessment results (including information onprobability and consequence).g. Follow-up mitigation strategy, if applicable, to managerisk.h. The mitigated risk levels (i.e., residual risk after mitigationis implemented).i. References to codes or standards that have jurisdictionover extent or frequency of inspection.

Ideally, sufficient data should be captured and maintainedsuch that the assessment can be recreated or updated at a latertime by others who were not involved in the original assess-ment. To facilitate this, it is preferable to store the informa-tion in a computerized database. This will enhance theanalysis, retrieval, and stewardship capabilities. The useful-ness of the database will be particularly important in steward-ing recommendations developed from the RBI assessment,and managing overall risk over the specified time frame.

16.2 RBI METHODOLOGY

The methodology used to perform the RBI analysis shouldbe documented so that it is clear what type of assessment wasperformed. The basis for both the probability and conse-quences of failure should be documented. If a specific soft-ware program is used to perform the assessment, this alsoshould be documented and maintained. The documentationshould be sufficiently complete so that the basis and the logicfor the decision making process can be checked or replicatedat a later time.

16.3 RBI PERSONNEL

The assessment of risk will depend on the knowledge,experience and judgment of the personnel or team performingthe analysis. Therefore, a record of the team membersinvolved should be captured. This will be helpful in under-standing the basis for the risk assessment when the analysis isrepeated or updated.

16.4 TIME FRAME

The level of risk is usually a function of time. This either isas a result of the time dependence of a deterioration mecha-nism, or simply the potential for changes in the operation ofequipment. Therefore, the time frame over which the RBIanalysis is applicable should be defined and captured in thefinal documentation. This will permit tracking and manage-ment of risk effectively over time.

16.5 ASSIGNMENT OF RISK

The various inputs used to assess both the probability andconsequence of failure should be captured. This shouldinclude, but not be limited to, the following information:

a. Basic equipment data and inspection history critical to theassessment, e.g., operating conditions, materials of construc-tion, service exposure, corrosion rate, inspection history, etc.b. Operative and credible deterioration mechanisms.c. Criteria used to judge the severity of each deteriorationmechanism.d. Anticipated failure mode(s) (e.g., leak or rupture).e. Key factors used to judge the severity of each failuremode.f. Criteria used to evaluate the various consequence catego-ries, including safety, health, environmental and financial.g. Risk criteria used to evaluate the acceptability of the risks.

16.6 ASSUMPTIONS MADE TO ASSESS RISK

Risk analysis, by its very nature, requires that certainassumptions be made regarding the nature and extent ofequipment deterioration. Moreover, the assignment of failuremode and the severity of the contemplated event will invari-ably be based on a variety of assumptions, regardless ofwhether the analysis is quantitative or qualitative. To under-stand the basis for the overall risk, it is essential that these fac-tors be captured in the final documentation. Clearlydocumenting the key assumptions made during the analysisof probability and consequence will greatly enhance the capa-bility to either recreate or update the RBI assessment.

16.7 RISK ASSESSMENT RESULTS

The probability, consequence and risk results should becaptured in the documentation. For items that require risk



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


mitigation, the results after mitigation should be documentedas well.

16.8 MITIGATION AND FOLLOW-UP

One of the most important aspects of managing riskthrough RBI is the development and use of mitigation strate-gies. Therefore, the specific risk mitigation required toreduce either probability or consequence should be docu-mented in the assessment. The mitigation “credit” assignedto a particular action should be captured along with any timedependence. The methodology, process and person(s) respon-

sible for implementation of any mitigation should also bedocumented.

16.9 CODES, STANDARDS AND GOVERNMENT REGULATIONS

Since various codes, standards and governmental regula-tions cover the inspection for most pressure equipment, it willbe important to reference these documents as part of the RBIassessment. This is particularly important where implemen-tation of RBI is used to reduce either the extent or frequencyof inspection. Refer to Section 2 for a listing of some relevantcodes and standards.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

39

APPENDIX A—DETERIORATION MECHANISMS

Table 1—Thinning

Deterioration Mechanism Description Behavior Key Variables Examples

Hydrochloric Acid Corrosion

Typically causes localized corrosion in car-bon and low alloy steel, particularly at initial condensation points (< 400°F). Austenitic stainless steels experience pitting and crev-ice corrosion. Nickel alloys can corrode under oxidizing conditions.

Localized Acid %, pH, materials of construction,tem-perature

Crude unit atmospheric column overhead, Hydrotreating effluent trains, Catalytic reforming effluent and regeneration systems.

GalvanicCorrosion

Occurs when two metals are joined and exposed to an electrolyte.

Localized Joined materials of construction, distance in galvanic series

Seawater and some cooling water services.

Ammonia Bisul-fide Corrosion

Highly localized metal loss due to erosion corrosion in carbon steel and admiraltybrass.

Localized NH4HS % in water (Kp), velocity, pH

Formed by thermal or catalytic cracking in hydrotreating, hydroc-racking, coking, catalytic cracking, amine treating and sour water efflu-ent and gas separation systems.

Carbon Dioxide (Carbonic Acid) Corrosion

Carbon dioxide is a weakly acidic gas which is corrosive when dissolved in water becom-ing carbonic acid (H2CO3). CO2 is com-monly found in upstream sections before treatment. Aqueous CO2 corrosion of carbon and low alloy steels is an electrochemical process involving the anodic dissolution of iron and the cathodic evolution of hydro-gen. The reactions are often accompanied by the formation of films of FeCO3 (and/or Fe3O4) that can be protective or non-protec-tive depending on the conditions.

Localized Carbon dioxide con-centration, process conditions.

Refinery steam condensate system, hydrogen plant and the vapor recov-ery section of catalytic cracking unit.

Sulfuric AcidCorrosion

Very strong acid that causes metal loss in various materials and depends on manyfactors.

Localized Acid %, pH, material of construction, tem-perature, velocity, oxi-dants

Sulfuric acid alkylation units, dem-ineralized water.

Hydrofluoric Acid Corrosion

Very strong acid that causes metal loss in various materials.

Localized Acid %, pH, material of construction, tem-perature, velocity,oxidants

Hydrofluoric acid alkylation units, demineralized water.

Phosphoric Acid Corrosion

Weak acid that causes metal loss. Generally added for biological corrosion inhibition in water treatment.

Localized Acid %, pH, material of construction,temperature

Water treatment plants.

Phenol (carbolic acid) Corrosion

Weak organic acid causing corrosion and metal loss in various alloys.

Localized Acid %, pH, material of construction,temperature

Heavy oil and dewaxing plants.

Amine Corrosion Used in gas treatment to remove dissolved CO2 and H2S acid gases. Corrosion gener-ally caused by desorbed acid gases or amine deterioration products.

General at low velocities, local-ized at high velocities

Amine type and con-centration, material of construction, tempera-ture, acid gas loading, velocity

Amine gas treating units.

AtmosphericCorrosion

The general corrosion process occurring under atmospheric conditions where carbon steel (Fe) is converted to iron oxide Fe2O3.

General uni-form corrosion

Presence of oxygen, temperature range and the availability of water/moisture

This process is readily apparent in high temperature processes where carbon steels have been used with-out protective coatings (steam pip-ing for example).

Corrosion Under Insulation

CUI is a specific case of atmospheric corro-sion where the temperatures and the concen-trations of water/moisture can be higher. Often residual/trace corrosive elements can also be leached out of the insulation material itself creating a more corrosive environment.

General to highlylocalized

Presence of oxygen, temperature range and the availability of water/moisture and corrosive constituents within the insulation.

Insulated piping/vessels.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


Soil Corrosion Metallic structures in contact with soil will corrode.

General to localized

Material of construc-tion, soil characteris-tics, type of coating.

Tank bottoms, underground piping.

High Temperature Sulfidic Corrosion without H2

A corrosive process similar to atmospheric corrosion in the presence of oxygen. In this case the carbon steel (Fe) is converted in the presence of sulfur to iron sulfide (FeS). Conversion rate (and therefore corrosion rate) is dependent on temperature of opera-tion and sulfur concentration.


Sulfur concentration and temperature.

All locations where there is suffi-cient temperature (450°F minimum) and sulfur is present in quantities greater than 0.2%. Common loca-tions are crude, coker, FCC, and hydroprocessing units.

High Temperature Sulfidic Corrosion with H2

With the presence of hydrogen, a signifi-cantly more aggressive case of sulfidation (sulfidic corrosion) can exist.


Sulfur and hydrogen concentration and tem-perature.

All locations where there is suffi-cient temperature (450°F minimum) and sulfur is present in quantities greater than 0.2%. Areas of hydro-processing units- reactor feed down-stream of the hydrogen mix point, the reactor, the reactor effluent and the recycle hydrogen gas including the exchangers, heaters, separators, piping, etc.

Naphthenic Acid Corrosion

Naphthenic acid corrosion is attack of steel alloys by organic acids that condense in the range of 350°F to 750°F. The presence of potentially harmful amounts of naphthenic acids in crude may be signified by higher neutralization numbers.

Localized corrosion

Naphthenic/organic acid concentration and temperature.

Middle section of a vacuum column in a crude unit (primarily in the MVGO cut), can also occur in atmospheric distillation units, fur-naces and transfer lines.

Oxidation A high temperature corrosion reaction where metal is converted to a metal oxide above specific temperatures.


Temperature, presence of air, material of con-struction.

Outside of furnace tubes, furnace tube hangers, and other internal fur-nace components exposed to com-bustion gases containing excess air.

Table 1—Thinning




--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


Table 2—Stress Corrosion Cracking


Chloride Cracking Cracking that can initiate from the ID or OD of austenitic stainless steel equipment, primarily due to fabrica-tion or residual stresses. Some applied stresses can also cause cracking.

Transgranular cracking.

Acid (chloride) concentra-tion, pH, material of con-struction, temperature, fabrication, stresses approaching yield.

Externally present in equipment with poor insulation and weatherproofing, downwind of cooling water spray and equipment exposed to fire water. Internally wherever chlorides can be present with water such as atmo-spheric column overheads of crude units and reactor effluent condensing streams.

Caustic Cracking Cracking primarily initiated from the ID of carbon steel equipment, prima-rily due to fabrication or residual stresses.

Typically, inter-granular, also can be trans-granular crack-ing.

Caustic concentration, pH, material of construction, temperature, stress.

Caustic treating sections, caustic ser-vice, mercaptan treatment, crude unit feed preheat desalting, sour water treatment, steam systems.

Polythionic Acid Cracking

Cracking of austenitic stainless steels in the sensitized condition (due to high temperature exposure or welding) in the presence of polythionic acid in wet, ambient conditions. Polythionic acid is formed by a conversion of FeS in the presence of water and oxygen.

Intergranularcracking.

Material of construction, sensitized microstructure, presence of water, poly-thionic acid.

Generally occurs in austenitic stain-less steel materials in catalytic crack-ing unit reactor and flue gas systems, desulfurizer furnaces and hydropro-cessing units.

Amine Cracking Amine is used in gas treatment to remove dissolved CO2 and H2S acid gases. Cracking generally caused by desorbed acid gases or amine deterio-ration products.

Intergranularcracking.

Amine type and concentra-tion, material of construc-tion, temperature, stress.

Amine treating units.

Ammonia Cracking

Cracking of carbon steel and admiralty brass.

Intergranular cracking in car-bon steel, trans-granular in copper zinc alloys.

Material of construction, temperature, stress.

Generally present in ammonia pro-duction and handling such as over-head condensation where ammonia is a neutralizer.

Hydrogen Induced Cracking / Stress Oriented Hydro-gen InducedCracking

Occurs in carbon and low alloy steel materials in the presence of water and H2S. Deterioration of the material properties is caused when atomic hydrogen, generated through corro-sion, diffuses into the material and reacts with other atomic hydrogen to form molecular hydrogen gas in inclu-sions of the steel. Deterioration can take the form of blisters and step-wise cracking in stress relieved equipment and non-stress relieved equipment.

Planar cracks (blisters), Transgranular cracks as blis-ters progress toward welds.

H2S concentration, water, temperature, pH, material of construction.

Anywhere that H2S is present with water such as crude units, catalytic cracking compression and gas recov-ery, hydroprocessing, sour water and coker units.

Sulfide Stress Cracking

Occurs in carbon and low alloy steel materials in the presence of water and H2S. Deterioration takes the form of cracking in non or improperly stress relieved equipment.

Transgranular cracking, nor-mally associ-ated with fabrication, attachment and repair welds.

H2S concentration, water, temperature, pH, material of construction, post weld heat treatment condition, hardness




--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


HydrogenBlistering

Occurs in carbon and low alloy steel materials in the presence of water and H2S. Deterioration of the material properties is caused by atomic hydro-gen generated through corrosion dif-fuses into the material and reacts with other atomic hydrogen to form molec-ular hydrogen gas in inclusions of the steel. Deterioration takes the form of planar blisters and can occur in stress relieved and non-stress relieved equip-ment.

Planar cracks(blisters).

H2S concentration, water, temperature, pH, material of construction.


Hydrogen Cyanide Cracking

Presence if hydrogen cyanide can pro-mote hydrogen deterioration (SOHIC, SCC, and blistering) by destabilizing the iron sulfide protective surface scale.

Planar cracks (blisters) and transgranular cracking.

Presence of HCN, H2S con-centration, water, tempera-ture, pH, material of construction.


Table 2—Stress Corrosion Cracking




--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


Table 3—Metallurgical and Environmental Failures


High-Temperature Hydrogen Attack

Occurs in carbon and low alloy steel materials in the presence of high temperature and hydrogen, usually as a part of the hydrocarbon stream. At elevated temperatures (> 500°F), deterioration of the material proper-ties is caused by methane gas form-ing fissures along the grain boundaries. Atomic hydrogen dif-fuses into the material and reacts with carbon from the steel, forming methane gas and depleting the steel of carbon.

Intergranular fis-sure cracking, decarburization.

Material of construction, hydrogen partial pressure, temperature, time in ser-vice.

Typically occurs in reaction sections of hydrocarbon pro-cessing units such as hydro-desulfurizers, hydrocrackers, hydroforming and hydrogen production units.

Grain Growth Occurs when steels are heated above a certain temperature, begin-ning about 1100°F for CS and most pronounced at 1350°F. Austenitic stainless steels and high nickel-chromium alloys do not become subject to grain growth until heated to above 1650°F.

Localized Maximum temperature reached, time at maximum temperature, material of construction.

Furnace tubes failures, fire damaged equipment, equip-ment susceptible to run-away reactions.

Graphitization Occurs when the normal pearlite grains in steels decompose into soft weak ferrite grains and graphite nodules usually due to long term exposure in the 825°F–1400°F range.

Localized Material of construction, temperature and time of exposure.

FCC reactor.

Sigma PhaseEmbrittlement

Occurs when austenitic and other stainless steels with more than 17% chromium are held in the range of 1000°F–1500°F for extended time periods.

Generalized Material of construction, temperature and time of exposure.

Cast furnace tubes and compo-nents, regenerator cyclones in FCC unit.

885°F Embrittlement Occurs after aging of ferrite con-taining stainless steels at 650°F–1000°F and produces a loss of ambient temperature ductility.

Generalized Material of construction, temperature.

Cracking of wrought and cast steels during shutdowns.

Temper Embrittlement Occurs when low alloy steels are held for long periods of time in tem-perature range of 700°F–1050°F. There is a loss of toughness that is not evident at operating temperature but rather shows up at ambient tem-perature and can result in brittle fracture.

Generalized Material of construction, temperature and time of exposure.

During shutdown and start-up conditions the problem may appear for equipment in older refinery units that have oper-ated long enough for this con-dition to develop. Hydrotreating and hydrocrack-ing units are of interest because they are used at elevated tem-peratures.

Liquid Metal Embrittlement

Form of catastrophic brittle failure of a normally ductile metal caused when it is in, or has been in, contact with a liquid metal and is stressed in tension. Examples include stainless steel and zinc combination and cop-per based alloys and mercury com-bination.

Localized Material of construction, tension stress, presence of liquid metal.

Mercury is found in some crude oils and subsequent refinery distillation can con-dense and concentrate it at low spots in equipment such as condenser shells. Failure of process instruments that utilize mercury has been known to introduce the liquid metal into refinery streams.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


Carburization Caused by carbon diffusion into the steel at elevated temperatures. The increased carbon content results in an increase in the hardenability of ferritic steels and some stainless steels. When carburized steel is cooled a brittle structure can result.

Localized Material of construction, temperature and time of exposure.

Furnace tubes having coke deposits are a good candidate for carburization (ID).

Decarburization Loss of carbon from the surface of a ferrous alloy as a result of heating in a medium that reacts with carbon.

Localized Material of construction, temperature environment.

Carbon steel furnace tubes (OD). Result of excessive over-heating (fire).

Metal Dusting Highly localized carburization and subsequent wastage of steels exposed to mixtures of hydrogen, methane, CO, CO2, and light hydro-carbons in the temperature range of 900°F–1500°F.

Localized Temperature, process stream composition.

Dehydrogenation units, fired heaters, coker heaters, cracking units and gas turbines.

Selective Leaching Preferential loss of one alloy phase in a multiphase alloy.

Localized Process stream flow condi-tions, material of construc-tion.

Admiralty tubes used in cool-ing water systems.

Table 3—Metallurgical and Environmental Failures




--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---


Table 4—Mechanical Failures


Mechanical Fatigue Failure of a component by cracking after the continued application of cyclic stress which exceeds the material’s endurance limit.

Localized Cyclic stress level, material of construction.

Reciprocating parts in pumps and compressors and the shafts of rotating machinery and associated piping, cyclic equipment such as pressure swing absorbers.

Corrosion Fatigue Form of fatigue where a corrosion process, typically pitting corrosion adds or promotes the mechanical fatigue process.

Localized Cyclic stress, material of construction, pitting poten-tial of the process stream.

Steam drum headers, boiler tubes.

Cavitation Caused by the rapid formation and collapse of vapor bubbles in liquid at a metal surface as a result of pres-sure variations.

Localized Pressure head value along the flow of process stream.

Backside of pump impellers, elbows.

Mechanical Deterioration

Typical examples are the misuse of tools and equipment, wind deterio-ration, careless handling when equipment is moved or erected.

N/A Equipment design, operat-ing procedures.

Flange faces and other machined seating surfaces may be damaged when not protected with covers or when not handled with care.

Overloading Occurs when loads in excess of the maximum permitted by design are applied to equipment.


Hydrostatic testing can overload supporting structures due to excess weight applied. Thermal expan-sion and contraction can cause overloading problems.

Over-pressuring Application of pressure in excess of the maximum allowable working pressure of the equipment under consideration.


Excess heat as a result of upset process condition can result in over-pressuring; blocking off equipment which is not designed to handle full process pressure.

Brittle Fracture Loss of ductility wherein the steel is referred to as having low notch toughness or poor impact strength.

Localized Material of construction, temperature.

During equipment pressurization in absence of precautionary mea-sures.

Creep High temperature mechanism wherein continuous plastic defor-mation of a metal takes place while under stresses below the normal yield strength.

Localized Material of construction, temperature, applied stress.

Furnace tubes and supports.

Stress Rupture Time to failure for a metal at ele-vated temperatures under applied stress below its normal yield strength.

Localized Material of construction, temperature, applied stress, time of exposure.

Furnace tubes.

Thermal Shock Occurs when large and non-uniform thermal stresses develop over a rela-tively short time in a piece of equip-ment due to differential expansion or contraction. If movement of the equipment is restrained this can pro-duce stresses above the yield strength of the material.

Localized Equipment design, operat-ing procedures.

Associated with occasional, brief flow interruptions or during a fire.

Thermal Fatigue Thermal fatigue is a process of cyclic changes in stress in a material due to cyclic change in temperature.

Localized Equipment design, operat-ing procedures.

Coke drums are subject to thermal cycling and associated thermal fatigue cracking. Bypass valves and piping with heavy weld rein-forcement on reactors in cyclic temperature service are also prone to thermal fatigue.



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

Available through Global Engineering Documents.

Effective January 1, 2002.

Phone Orders: 1-800-854-7179 (Toll-free in the U.S. and Canada)303-397-7956 (Local and International)

Fax Orders: 303-397-2740Online Orders: www.global.ihs.com

Invoice To (❏ Check here if same as “Ship To”)

Name:

Title:

Company:

Department:

Address:

City: State/Province:

Zip/Postal Code: Country:

Telephone:

Fax:

E-Mail:

❏ Payment Enclosed ❏ P.O. No. (Enclose Copy)

❏ Charge My Global Account No.

❏ VISA ❏ MasterCard ❏ American Express ❏ Diners Club ❏ Discovery

Credit Card No.:

Print Name (As It Appears on Card):

Expiration Date:

Signature:

Quantity Product Number Title Total

Subtotal

Applicable Sales Tax (see below)

Rush Shipping Fee (see below)

Shipping and Handling (see below)

Total (in U.S. Dollars)

★ To be placed on Standing Order for future editions of this publication,place a check mark in the SO column and sign here:

Pricing and availability subject to change without notice.

Date:

SO★ Unit Price

❏ API Member (Check if Yes)

Ship To (UPS will not deliver to a P.O. Box)

Name:

Title:

Company:

Department:

Address:

City: State/Province:

Zip/Postal Code: Country:

Telephone:

Fax:

E-Mail:

Mail Orders – Payment by check or money order in U.S. dollars is required except for established accounts. State and local taxes, $10 processing fee*, and 5% shipping must be added. Sendmail orders to: API Publications, Global Engineering Documents, 15 Inverness Way East, M/S C303B, Englewood, CO 80112-5776, USA.Purchase Orders – Purchase orders are accepted from established accounts. Invoice will include actual freight cost, a $10 processing fee*, plus state and local taxes.Telephone Orders – If ordering by telephone, a $10 processing fee* and actual freight costs will be added to the order.Sales Tax – All U.S. purchases must include applicable state and local sales tax. Customers claiming tax-exempt status must provide Global with a copy of their exemption certificate.Shipping (U.S. Orders) – Orders shipped within the U.S. are sent via traceable means. Most orders are shipped the same day. Subscription updates are sent by First-Class Mail. Other options,including next-day service, air service, and fax transmission are available at additional cost. Call 1-800-854-7179 for more information.Shipping (International Orders) – Standard international shipping is by air express courier service. Subscription updates are sent by World Mail. Normal delivery is 3-4 days from shipping date.Rush Shipping Fee – Next Day Delivery orders charge is $20 in addition to the carrier charges. Next Day Delivery orders must be placed by 2:00 p.m. MST to ensure overnight delivery.Returns – All returns must be pre-approved by calling Global’s Customer Service Department at 1-800-624-3974 for information and assistance. There may be a 15% restocking fee. Special orderitems, electronic documents, and age-dated materials are non-returnable.*Minimum Order – There is a $50 minimum for all orders containing hardcopy documents. The $50 minimum applies to the order subtotal including the $10 processing fee, excluding anyapplicable taxes and freight charges. If the total cost of the documents on the order plus the $10 processing fee is less than $50, the processing fee will be increased to bring the order amountup to the $50 minimum. This processing fee will be applied before any applicable deposit account, quantity or member discounts have been applied. There is no minimum for orders containing onlyelectronically delivered documents.

APIAmerican Petroleum Institute

2002 Publications Order Form

C51008

RP 579, Fitness-for-Service

API 570, Piping Inspection Code: Inspection, Repair, Alteration, and Rerating of In-service Piping Systems

$ 86.00C57002

C57901

C58101

C65303

K75000

K75201

K76003

API 510, Pressure Vessel Inspection Code: Maintenance Inspection, Rating, Repair, and Alteration $ 99.00

$ 595.00

Publ 581, Base Resource Document—Risk-based Inspection $ 595.00

Std 653, Tank Inspection, Repair, Alteration, and Reconstruction $ 155.00

RP 750, Management of Process Hazards $ 48.00

$ 72.00RP 752, Management of Hazards Associated with Location of Process Plant Buildings, CMA Managers Guide

Publ 760, Model Risk Management Plan Guidance for Petroleum Refineries—Guidance for Complying with EPA’s RMP Rule (40 Code of Federal Regulations 68)

$ 181.00



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

There’s more where thiscame from.

The American Petroleum Institute provides additional resources and programs to the oil and natural gas industry which are based on APIStandards. For more information, contact:

• Monogram Licensing Program Phone: 202-962-4791Fax: 202-682-8070

• American Petroleum Institute Quality Registrar Phone: 202-962-4791(APIQR) Fax: 202-682-8070

• API Spec Q1 Registration Phone: 202-962-4791Fax: 202-682-8070

• Perforator System Registration Phone: 202-962-4791Fax: 202-682-8070

• Inspector Certification Programs Phone: 202-682-8161Fax: 202-962-4739

• Engine Oil Licensing and Certification System Phone: 202-682-8233(EOLCS) Fax: 202-962-4739

• Training/Workshops Phone: 202-682-8490Fax: 202-962-4797

Check out the API Publications, Programs, and Services Catalog online atwww.api.org.

APIAmerican Petroleum Institute Helping You Get The Job Done Right.SM01.01.02



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

05/02



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---

Additional copies are available through Global EngineeringDocuments at (800) 854-7179 or (303) 397-7956

Information about API Publications, Programs and Services isavailable on the World Wide Web at: http://www.api.org

Product No. C58001



--``,`,,,,,``,`,,,`,`,,`,``-`-`,,`,,`,`,,`---