Introduction to RBI

This Research Report is for the exclusive use of subscribing members of The Welding Institute, and its content should not be communicated to other individuals or organisations without written consent. It is in the interest of all members to respect this confidence.

February

72212001

2001

An introduction to risk based inspection By J B Wintle

No embargo

Electronic copyright in this document as follows: Copyright 0 200 1, The Welding Institute

The

Welding Institute, Granta Cambridge CB16AL, Telephone: Telefax:

0 The

Park, United

Great Abington Kingdom

+44 (0)1223 891162 +44 (0)1223 892588

Welding

Institute

2001

AN INTRODUCTION

TO RISK BASED INSPECTION

CONTENTS TECHNOLOGY 1.

2.

3.

4.

i

BRIEFING

INTRODUCTION 1.1.

BACKGROUND

1.2.

OBJECTIVES

1.3.

RELATED

PRINCIPLES

WORK

OF RISK BASED INSPECTION

2.1.

RISK OF FAILURE

2.2.

RISK BASED INSPECTION

2.3.

CAUSES OF STRUCTURAL

2.4.

EFFECT

2.5.

FUNCTIONAL

2.6.

LINK WITH INSPECTION ASSESSMENT

OF INSPECTION

FAILURE ON THE RISK OF FAILURE

AND CONDITION

INSPECTION

PRACTICES

AND FITNESS-FOR-SERVICE

5

RISK ANALYSIS

6

3.1.

FUNDAMENTALS

6

3.2.

SYSTEM

DEFINITION

6

3.3.

HAZARD

IDENTIFICATION

7

3.4.

PROBABILITY

3.5.

CONSEQUENCE

3.6.

RISK RESULTS

DEFINING

ASSESSMENT

7

ANALYSIS

7 8

THE PROCESS FOR RISK BASED INSPECTION

4.1.

ELEMENTS

4.2.

THE RBI TEAM

4.3.

INFORMATION

OF THE PROCESS

PLANNING

8 8 9

REQUIRED

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

FOR RBI

9

AN INTRODUCTION

5.

6.

7.

TO RISK BASED INSPECTION

IMPLEMENTATION

11

OF RBI

5.1.

GENERAL APPROACH

11

5.2.

QUALITATIVE

11

5.3.

QUANTITATIVE

5.4.

CHOICE OF APPROACH

5.5.

PRACTICAL

DIFFICULTIES

5.6.

RISKWISE

AND OTHER SOFTWARE PACKAGES FOR RBI

5.7.

ILLUSTRATION

DEVELOPMENT

APPROACHES

12

APPROACHES

13 AND LIMITATIONS

OF RBI USING RISKWISETM

OF THE INSPECTION

TO IMPLEMENTING

AS A CASE STUDY

PLAN

RBI

13 14 15 15

6.1.

ELEMENTS OF THE PLAN

15

6.2.

WHAT EQUIPMENT

16

6.3.

WHAT TYPE OF DAMAGE TO LOOK FOR?

16

6.4.

WHERE TO LOOK FOR IT?

17

6.5.

How

TO FIND IT WITH SUFFICIENT RELIABILITY?

17

6.6.

FEEDBACK - How GOOD WAS THE RBI ASSESSMENT?

18

6.7.

WHEN NEXT - How OFTEN TO LOOK FOR DAMAGE?

18

6.8.

OTHER ACTIONS APART FROM INSPECTION

19

DISCUSSION

TO INSPECT?

19

OF RBI DEVELOPMENT

7.1.

CURRENT STATUS

19

7.2.

DEVELOPMENT

19

7.3.

RESPONSE OF REGULATORY

8.

SUMMARY

9.

REFERENCES

BY INDUSTRY AUTHORITIES

20 21

AND CONCLUSIONS

22

APPENDIX APPENDIX

1: Background 2: Qualitative

to API 581 Approach to RBI in API 581

APPENDIX APPENDIX

3: Quantitative Approach to RBI in API 581 4: A Case Study of Risk-Based Inspection 7380.01/99/1054.03 Copyright 0 2001, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

TECHNOLOGY

BRIEFING

Several industries operating high integrity structures and equipment with safety or financial dependence are considering planning in-service inspection on the basis of the information gained from an analysis of the risk of failure. Risk based inspection (RBI) is a structured approach to planning inspection, but many mechanical engineers responsible for the integrity of industrial plant currently only have a limited knowledge of what it entails. The objective of this report is to help TWI members from all industries and regulatory bodies understand the principles of risk based inspection and identify the essential elements required for its implementation. The risk of failure is the combination of the probability and consequences of its occurrence. Inspection provides more information about the risk of failure caused by structural deficiencies and the report discusses the effect that inspection can have on the risk. The fundamentals of industrial risk analysis are summarised, and the key elements of the process of risk based inspection identified. Risk based inspection uses an analysis of the risk of failure for the development of the inspection plan. The risk analysis identifies the credible types and causes of structural failure and assesses the rate of degradation in relation to future fitness-forservice. The report highlights the benefits from using a team and the value that TWI’s experts can bring to the process. The report describes the qualitative and quantitative approaches to risk analysis that are being developed for implementation of RBI, and highlights some of the difficulties that

AN INTRODUCTION

TO RISK BASED INSPECTION

1.

INTRODUCTION

1.1.

BACKGROUND

In-service inspection of safety related welded structures has traditionally been based on prescriptive industry practices backed up by health and safety legislation’-3. Statutory inspection is required for equipment such as pressure systems, lifting appliances and offshore platforms. Locations, frequency, and methods of inspection were based mainly on the type of the equipment rather than the specific risk. Until recently, there had not been much explicit regard to the threats to integrity or the consequences of a failure. Written schemes of examination have developed on the basis of industry experience. While these recognise the contributors to risk, they are not normally based on a detailed risk assessment for each component. Industry is now appreciating the concepts of engineering risk4 and recognising that benefit may be gained from better targeted inspection. This is now leading some sectors of industry to consider setting inspection priorities on the basis of the risk of failure’. This trend is supported by the wealth of plant operating experience and data, an improved understanding of the material degradation mechanisms, and the availability of fitness-for-service procedures. At the same time, developments in non-destructive testing (NDT) technology have increased the scope and efficiency of examinations that can be undertaken. Inspection trials have produced a greater appreciation of the reliability of actual NDT performance. These developments create a new challenge for inspection planning to ensure that the effectiveness of examinations matches the application. Risk based inspection (RBI) is a structured approach to inspection planning. Many mechanical engineers responsible for the integrity of industrial plant currently only have a limited knowledge of what it entails and how it should be implemented. TWI members would therefore benefit from having an independent introduction to REH. 1.2.

OBJECTIVES

The aim of this Members’ Report is to help TWI members from all industries and regulatory bodies understand the principles of risk based inspection and identify the essential elements required for its implementation. Specific technical objectives are: (a) To assess the current status of REH (b) To provide a reference to essential elements of the methodology (c) To illustrate approaches to its implementation (d) To provide information about how risk based principles development of the inspection plan

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

may be applied to the

Page 1

AN INTRODUCTION

TO RISK BASED INSPECTION

The report will be of most use to mechanical engineers responsible for inspection planning, but it will also be of interest to process and inspection engineers, materials scientists, safety assessors and others involved in industrial risk assessment. 1.3.

RELATED

WORK

Particular reference has been made in this report to the Base Resource Document for RBI published by the American Petroleum Institute, API 5816. This is one of the best documented approaches within the public domain and is the model for many customised approaches being developed by individual operating companies and consultancies. The background to this document is described in Appendix 1 Whilst API 581 relates primarily to the inspection of equipment at oil refineries, it illustrates how the principles of RBI may be applied to a specific industry. However, API 581 was written by and for the American petroleum industry with the objectives of that industry for safety at minimum cost very much in mind. The document is very long and only available from API at a relatively high price, factors that would tend to reduce its general readership. The number of articles on RBI in the technical journals is increasing, but most have been written from an industry specific or commercial perspective. There are as yet no generalised procedures or guidelines on how to undertake RBI, and different industries and companies are tending to develop their own approaches. This report is written from an independent standpoint for all TWI industrial members. This introduction to risk based inspection is part of the three year core research project on different aspects reliability engineering. Other aspects covered within the CRP project include the probability of fatigue damage and crack growth, the frequency and distribution of welding defects, and the statistical treatment of historical inspection data and reliability updating. Risk based inspection is a process that draws on these and many other technologies. 2.

PRINCIPLES

OF RISK BASED INSPECTION

2.1.

RISK OF FAILURE

Failure of equipment is a defined loss of a specific functionality. For structural equipment, failure often occurs as a discrete event, such the loss of containment of a pressurised fluid or the fracture of a structural member under load. The probability of failure of an item of equipment is the frequency with which the specified failure event would be expected to occur in a given period of time, normally one year, given a large population of items. When assessing the risks from failure of equipment, a wide range of potential consequences may need to be considered. There may be danger to the health and safety of employees or of the general public, pollution and other damage to the environmental, and business costs such as lost production, repair or replacement of equipment, and loss of reputation. All these can be measured in different ways.

Page 2

7380.01/99/1054.03

Copyright 0 2001, The Welding Institute

ANlNTRODUCTIONTORISKBASEDINSPECTION

The risk of failure of an item of equipment combines the annual probability of failure with a measure of the consequence of that failure. If these are numerically evaluated, then the risk is defined as the product of the failure probability rate (yr-‘) and the measure of consequence. In this case, items may be ranked on the basis of their relative risk of failure. There may be different rankings for different measures of consequence. Despite this definition, risk is often assessed qualitatively without this formal factoring. In this situation, the risk is the combination of the qualitatively assessed likelihood and the consequences of failure and is often presented as an element within a likelihood-consequence matrix. (Within this report, ‘probability’ is used in connection with quantitative assessments whereas likelihood’ is used in association with qualitative assessments of risk). 2.2.

RISKBASEDINSPECTION

Within this report, the term ‘inspection’ refers to the planning, implementation and evaluation of examinations and/or testing to determine the physical and metallurgical condition of equipment or a structure in terms of fitness-for-service. Examination includes non-destructive testing such as ultrasonic testing and radiography, but also covers visual surveys, replication, and material sampling etc. Testing might include leak or pressure testing (for pressurised components) or other test of functionality. Risk based inspection is the development of an inspection plan on the basis of the information obtained from an assessment of the risk of failure. It requires assessments of the probability and consequences of failure of the equipment being considered within the scope of the plan. The process identities the equipment having the highest risk of failure and enables criticality rankings on the basis of risk to be made. On its own, risk ranking is insufficient to define an inspection programme. It is the information about the degradation processes and the threats to integrity generated in the process that is of greatest value in developing an inspection plan. The plan can not only target the high risk components, but can also be designed to detect potential degradation processes before fitness-for-service could be threatened. 2.3.

CAUSESOFSTRUCTURALFAILURE

Structural failure of a component can result from a number of causes. It may result from the component being in a physically deficient state as a result of material flaws and defects, damage or degradation. Component deficiencies may be the result of or the degrading effects of normal service inadequate design, manufacture conditions or as a result of other initiating events that lie outside the design basis such as leaking valves or water chemistry excursions. Inspection only addresses the risk of failure arising from deficiencies in the components at the time of inspection.

7380.01/99/1054.03

Copyright 0 200 1, The Welding Institute

Page 3

ANlNTRODUCTIONTORISKBASEDINSPECTION

Within this report, material flaws and defects cover deficiencies introduced at the time of construction such as welding defects and out-of-specification (e.g. ovality). Damage refers to denting, gouging or events such as impact or tire. Degradation processes take place over a period of time as a result of service conditions and include corrosion, erosion, fatigue and crack growth. Failures of components and equipment in a satisfactory condition can also occur as a result of malfunction of equipment such as instrumentation, control systems or critical utility supplies as well as from human factors and external events. These causes and effects of failure are not addressed by the inspection of the equipment. There are other measures that industry can take for managing and mitigating the risks in these areas such as the use of diverse and redundant engineering systems, protection systems, safety management plans and operator training. The process of risk based inspection (RESI) has beneficial effects in focusing management action towards the prioritising of resources for risk reduction from deficiencies in critical items of equipment. However RBI should be seen as being part of an integrated risk management strategy that should address all causes of failure. Access to reliable and up to date data on the failure of equipment from all causes is a key requirement. 2.4.

EFFECTOFINSPECTIONONTHERISKOFFAILURE

The process of inspection only provides more information about the condition of the equipment that may be better or worse or the same as previously estimated. The inspection may have changed the prior estimate of the risk of failure, but the actual risk remains the same. In order to change the actual risk, physical intervention is needed in the form of a repair or replacement or some other kind of mitigating action such as a change to the process conditions. Increasing the level (coverage or detail) of inspection is claimed to progressively reduce the risk of failure (assuming repair action is taken) to a point where the failure risk lies outside the integrity of the equipment itself. Whilst this may be true, the rate at which risk may be reduced by increasing inspection is more problematic. Given that many failure mechanisms are generic, there is a decreasing return on inspection in terms of risk reduction if a particular mechanism is shown to be absent, or conversely, if there is widespread attack. One hundred per cent inspection will only reveal non-generic failure mechanisms such as accidental damage. Inspection can have an effect on the probability of failure if it is the initiator for actions to improve component integrity. The general health and safety principle is to act to reduce the number of failures to as low as reasonably practical (ALARP). Inspection can also have an effect on the assessment of the consequences of failure if it excludes certain catastrophic types of failure (e.g. global plastic collapse) or limits leakage to a certain size

Page 4

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

2.5.

FUNCTIONAL

TO RISK BASED INSPECTION

AND CONDITION

INSPECTION

A distinction can be made between functional inspection (i.e. testing) and condition inspection (physical or other examination of the fabric). Certain types of functional testing (for example, over-pressure testing) are considered beneficial, but their effect on the subsequent risk depends on the operational conditions and degradation mechanism. Unlike functional testing, condition inspection can rarely examine every area or volume, and the degree of coverage becomes crucial. Quantifying the benefits of different types and regimes of inspection on the probability of failure is an area where further work and insights are possible. There are many different methods for condition inspection ranging from simple visual examination to sophisticated ultrasonic and electromagnetic techniques. In order to be effective, the methods of condition inspection must relate to the type and rate of deterioration and damage expected. Therefore, it is recognised that risk based inspection must, in addition to prioritising the locations for inspection, also address the techniques, reliability and frequency of inspection in relation to the risk. No single inspection method has been invented that can detect and characterise every kind of defect or degradation. The inspection techniques employed should therefore be matched to the type of damage to be detected. The need to inspect should reflect the uncertainty in the knowledge of the current condition and rate of degradation in relation to the required life. The inspection frequency is often related to the lower bound to residual life as evaluated by a fitness-for-service assessment, usually including some factor of safety. Given that the technique has been optimised, reliability of the inspection for the particular circumstances must be considered. The effect of inspection on the risk of failure is directly related to the probability of detection of damage and defects that would be of concern. The probability of failing to detect such deficiencies also needs to be taken into account. 2.6.

LINK

WITH

INSPECTION

PRACTICES

AND FITNESS-FOR-SERVICE

ASSESSMENT

Recommended inspection practices (e.g. API) already exist for pressure systems, piping, tanks and many other classes of equipment. Risk based inspection is consistent and complementary to these practices. It provides a means to establish priorities and frequencies where practices allow scope for engineering judgement. Assessment of the susceptibility to degradation and the rate at which this occurs in relation to the tolerance for continued fitness-for-service (FFS) is a key element of RBI. If degradation is detected by inspection, fitness-for-service assessment is an alternative to plant repair. There is therefore a close link between RBI and FFS assessment undertaken using codes such as BS 7910 and API 579. A TWI Group Sponsored Project is being set up to develop this link within a coherent framework.

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Page 5

ANINTRODUCTIONTORISKBASEDINSPECTION

3.

RISK ANALYSIS

3.1.

FUNDAMENTALS Before risk based inspection planning can commence, it is necessary to undertake a risk analysis for the component, plant or installation within its geographical and environmental context. There are recognised procedures for risk analysis which generally consider a wide range of threats to integrity12. The undertaking of a general risk analysis is a common statutory requirement. The elements of a risk analysis are: l l l l l l

System definition Hazard identification Probability assessment Consequence analysis Risk results Mitigation measures

Risk based inspection of equipment requires a reduced form of risk analysis where the hazard arises from a single source, i.e. the effects of structural failure arising from component deficiency. In RBI, the probability of failure is assumed to be controlled by continuous degradation mechanisms (detectable by inspection) and not by explicit external events. The effect of local human factors by, for example, faulty operations or maintenance may be included implicitly by an assessment of the management systems. A risk analysis accepts that following the failure, the consequences can be influenced by detection, isolation and mitigation measures and these should be included in the risk analysis. 3.2.

SYSTEMDEFINITION The system definition first sets the goals and objectives of the risk analysis (e.g. to assess the impact of inspection), the types of risk to be considered (e.g. financial, health and safety, environmental), and the measures of acceptable/unacceptable risk. The physical and operational boundaries of the system are defined in terms of the equipment to be considered as giving rise to a potential primary hazard, and the associated systems and conditions that could influence the susceptibility to failure. For ease of analysis the system may be sub-divided into groups of equipment with common operating conditions, failure probability, or failure consequence. The system boundary extends as far as may suffer the consequences of failure. In some cases this will include the whole company, surrounding areas and population.

Page 6

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

3.3.

HAZARD

TO RISK BASED INSPECTION

IDENTIFICATION

A hazard is a situation or an event that may lead to undesirable consequences. Different approaches to industrial hazard identification have been developed13. These include: l

l

l

l

HAZOP (hazard and operability)

studies - a team based brain-storming

Failure modes and effects analysis (FMEA) analysis at the component level

- an inductive

exercise

‘what happens if

Fault tree analysis - a deductive approach that focuses on identifying of how undesired consequences can be caused.

the ways

Checklists - simple to apply in standard situations but may miss unique hazards.

For pressure equipment and containments, the primary hazard is assumed to be a breach of containment causing a release from the system and into the environment of contents that may be energetic, toxic, explosive, corrosive or hot. Understanding the underlying causes of the hazard and its effects in creating further chains of events (e.g. damaging other equipment) is a key part of the process. 3.4.

PROBABILITY

ASSESSMENT

In a risk analysis to evaluate plant safety, the probability assessment calculates the frequency of a certain undesirable final outcome from the frequencies of different initiating events such as a structural failure. where there can be a range of outcomes with different degrees of uncertainty resulting from a single initiating component failure, the component failure frequency is multiplied by the probability of each outcome. Failure frequencies are usually based on historical data for a broad generic class of components (e.g. piping) rather than being specific to the plant since the motive is often to compare plant risks and identify weaknesses in the system design. The use of generic failure data may not be sufficient on its own as a measure of the probability of failure of a specific component. The effect of the local conditions and actual degradation mechanisms need to be taken into account to determine the failure probability of that component. The main purpose of the risk analysis is to provide information for planning component specific inspections. 3.5.

CONSEQUENCE

ANALYSIS

Consequence analysis depends on the nature of the hazard. For process equipment containing noxious substances, the consequence analysis will require assessments of the discharge rate, dispersion, and the chances of flammable and toxic effects on the work force, local population and environment. For high-pressure plant, the consequences analysis will assess the effects of high velocity jets, pipe whip, explosion and missiles on surrounding plant systems, and the ultimate impact on plant safety and operation,

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Page 7

AN INTRODUCTION

TO RISK BASED INSPECTION

The process of risk based inspection is an integrated part of a more general policy of risk analysis for maintaining health and safety and managing industrial assets. Hazard analysis, safety management and quantitative risk assessment extend well beyond risk analysis for RI31 but provide an input to it. 3.6.

RISKRESULTS Various measures for quantifying human risk are available including the fatal accident rate, average and maximum individual risk and individual risk contours. A distinction can be made between individual (e.g. worker) and societal (e.g. local population) risk. Individual risk measures consider the risk to individuals who might be located normally within the effected zone. Some risk measures apply to groups of people around the zone. The risk of lost production and the replacement of damaged equipment can be quantified in terms of the average money lost per year as a result of failures. Risks to the environment involve clean-up costs and may cause long term damage to a company’s reputation and trading position.

4.

DEFINING

THE PROCESS FOR RISK BASED INSPECTION

4.1.

ELEMENTSOFTHEPROCESS

PLANNING

The key steps in the process of risk based inspection planning are: (a) Formation of the RE31assessment team (b) Definition

of equipment considered within the programme of planned inspection

(c) Determination

of the applicability

of risk based inspection

(d) Identification assessment

and gathering of the information

(e) Identification

of credible types and causes of failure for each unit/component

necessary to carry out the risk

(I) Assessment of the expected rates of degradation mechanisms and the probability of failure (g) Assessment of the consequences of failure in terms of safety of personnel, loss of production, damage to plant environment etc (h) Risk ranking of each unit/component

or placement in a risk matrix

(i) Development of the inspection plan defining the inspection reliability and interval in relation to risk and fitness-for-service (j) Feedback of information

Page 8

scope, methods,

from the inspection and review of RI31 assessment

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

The process is based around an assessment of the risk of failure for each unit/component and the development of an appropriate inspection plan. An important part of the process is the identification of the credible types and causes of failure and the assessment of the rate of degradation. 4.2.

THE RBI TEAM

The use of a risk based approach for planning inspection may be carried out at different levels ranging from the selection of particular welds to decisions about entire refineries or plants. API 581, for example, is broadly based and considers risk consequence in the wider company, societal and economic context. As a result, a wide range of sources of information is needed for the RE31risk analysis including financial and management. The implication of this is that a RBI study would normally need to be carried out at a reasonably senior level within a company. It would be unlikely that anyone below say the level of an engineering manager would have access to the information and expertise required and the capacity to integrate it and take decisions. The range of information required also implies that for complex installations, a multi-disciplinary team is needed to carry out a RI31 study. The team needs to be able to draw on the expertise of competent individuals with knowledge of process hazards, risk assessment, materials degradation and inspection techniques, plus staff with plant specific knowledge of maintenance and inspection, plant operation and process conditions. The use of independent agencies such as engineering insurers and external experts within the process may be vital to ensure that judgements are made which reflect the understanding and practice across an industry sector. 4.3.

INFORMATION

REQUIRED

FOR RBI

Risk analysis for inspection planning requires a wide range of information to be considered. In general, the process brings together four categories of information. (a) (b) (c) (d)

Design specifications Historical plant operating data An assessment of consequences of failure An evaluation of failure probabilities

The relationship between these categories within inspection is shown in the figure below.

7380.01/99/1054.03

Copyright 0 200 1, The Welding Institute

the process of risk-informed

Page 9

AN INTRODUCTION

TO RISK BASED INSPECTION

Fig. 1 Information

requirements

Following inspection, the results feed back into the historical database and may be used in planning further examinations. The information (deterministic or statistical) within each category depends on the approach adopted, but may include: (a) Design Specifications l l l

Defined boundaries of plant items to be considered for inspection planning Design and manufacturing records Deterministic design stress and fatigue analysis

(b) Historical Plant Data l l l l l

Operational transient and condition monitoring data Plant failures and service experience data Pre-service and in-service inspection records Environmental conditions, temperatures, water chemistry and flow rates In-service degradation assessments (fatigue, SCC, erosion-corrosion)

(c) Consequence Assessment l l l

0 l

Page 10

Design safety class categorisation Detailed assessment of consequences Failure modes and effects analysis Cost analysis of component failure Probabilistic safety assessment (PSA)

7380.01/99/1054.03 Copyright 0 2001, The Welding Institute

ANINTRODUCTIONTORISKBASEDINSPECTION

(d) Failure Probability

Evaluation

Expert assessments of the failure probability Generic component failure rates Component specific failure rates Size distributions and probability density of defects Distributions of material properties and degradation rates Full analysis of probability of failure Probability of detection versus flaw size curves Actual flaw sizing versus measured sizing data Circumstances will dictate the availability 5.

IMPLEMENTATION

5.1.

GENERALAPPROACH

and accessibility of this information,

OF RBI

Very little advice is available on how a RBI study should be implemented. Guidance is needed to underwrite the integrity of the process and the quality of information used and judgements made. At present, companies and consultancy organisations are developing their own schemes of risk analysis for REH. 5.2.

QUALITATIVEAPPROACHES

In a qualitative approach to risk based inspection, the two elements forming the risk, the likelihood and the consequences of failure are subjectively assessed within descriptive categories (high, medium or low) or given a scoring on a arbitrary scale. Risk is presented as the combination of failure likelihood and consequence within the cells of a likelihood-consequence matrix (below). Components with the same likelihood-consequence combination can be grouped together in a common risk cell. Likelihood-consequence

risk matrix

Likelihood

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Page 11

AN INTRODUCTION

TO RISK BASED INSPECTION

A five by tive matrix is commonly used as shown above. The axes may have a linear or logarithmic scale or no scale at all. For this reason care should be exercised when interpreting relative positions within the matrix since they invariably have limited significance. Similarly, blocks of cells purported to have the same risk (usually as above) should also be treated with caution. Risk is the product consequence and on a linear scale, risk contours are hyperbolae. scale, the risk contours are straight lines, and risk ranges are strips

shown by shading of likelihood and On a logarithmic across the matrix.

Ways of assessing the likelihood and consequences of failure may vary according to the approach. Sometimes an expert panel is used to make subjective judgements after discussing the issues. This is a good approach that relies on the broad engineering knowledge and experience of the panel, but can be lengthy to apply. Other approaches are based on a scoring system from answering sets of questions relating to the probability and consequences of failure. This is the approach adopted by API 581 (see Appendix 2), RISKWISE and several other proprietary schemes. Whilst easy to apply, these approaches tend to restrict wider assessment of the risks. The qualitative approach generally requires only a limited amount of information. is of most value in comparing the relative risks of equipment on a global scale. 5.3.

QUANTITATIVE

It

APPROACHES

Quantitative approaches to risk based inspection aim to quantify the failure probability rate and the measure of consequence as actual numerical values. The risk may then be expressed as a single number being the product of the calculated failure probability rate (yr-‘) and the measure of consequence. In this case, a criticality ranking of the components can be made in order of the evaluated risk. The quantitative approach requires detailed process and mechanical information and is backed by calculations to determine numerically the failure probability and consequential losses. Reliability analysis can be used to determine the probability of failure from specific mechanisms such as fracture if the distributions of the controlling variables are known. The approach has the disadvantage that it is often difficult to substantiate the distributions of material properties, defects or loads. The approach taken in API 581 (see Appendix 3) is to use published failure rates for generic classes of equipment (e.g. pumps, valves, vessels, etc) as a basis for the probability of failure. The generic rates are then modified by factors designed to take account of the specific circumstances of the equipment and the management at the plant. Allowance is made for a very wide range of factors that could have a bearing on the probability and consequences of failure. The approach is information intensive and lengthy to apply.

Page 12

7380.01/99/1054.03 Copyright 0 2001, The Welding Institute

ANINTRODUCTIONTORISKBASEDINSPECTION

5.4.

CHOICEOFAPPROACH

The choice of either a qualitative or a quantitative approach is based on the level of detailed information available and cost reward in terms of reduced risk or inspection costs. The nature of the simpler qualitative approach is that it can only act as an indicator of risk, and does not constitute a risk assessment. As a tool its best use is as quick screening method that can be used to identify the areas of highest risk and prioritise them for more detailed exercises. The costs of undertaking a detailed quantitative analysis must, however, to be weighed against the potential benefits. For instance, if only half the total risk of loss can be attributed to mechanical failure, even a quantitative risk based inspection combined with the programme cannot mitigate all events. This limitation, difficulties in finding correct data for all quantitative inputs, implies that under many circumstances there may be little cost reward for undertaking a full quantitative analysis. Unless such an exercise has other benefits apart from driving inspection needs, it is difficult to envisage situations where such a detailed and expensive exercise would as a first step be worthwhile. For most plants and situations, it is likely that a RBI would be implemented in a inspection phased manner. When a company is moving from traditional programmes to one driven by a REH risk analysis, the most significant benefit can be gained by first undertaking a qualitative assessment at a component level. Once this is achieved, then a cost-benefit analysis can be undertaken to demonstrate whether a more thorough quantitative analysis would be beneficial. 5.5.

PRACTICALDIFFICULTIESANDLIMITATIONSTOIMPLEMENTING

FtBI

Although risk based inspection is an attractive approach to planning inspection that can lead to improved knowledge of significant risks and reduced inspection costs, there are a number of factors that may, in practice, make REH difficult to implement. These factors may limit the extent and rate at which RBI can be applied. Regulators will need to ensure that these factors have been adequately addressed. The first factor is time. A significant amount of staff time is needed to undertake the process systematically and effectively. Assessment of the risk, development of an appropriate inspection plan, and feedback of results will generally take longer in terms of elapsed time than prescriptive inspection schemes. The allocation of adequate financial resources up front into the risk assessment and inspection planning phases may be another difficulty in some companies, especially if the return of reduced inspection costs cannot be guaranteed. In addition to the costs of the key internal staff, there may be extra costs associated with the use of competent persons and external consultants, and also with the gathering and analysis of information. RESI may lead to a requirement for the use of demonstrably more reliable inspection in some areas, and there may be additional costs of new procedure development, operator training and inspection qualification.

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Page 13

AN INTRODUCTION

TO RISK BASED INSPECTION

The availability and access to the information required for assessing the risk are further factors that may limit REH. Of particular importance are the records of design and manufacture, the histories of previous operation and inspection, and knowledge of the operating conditions and environment and their effects. Lack of this information increases the uncertainty and hence the potential risks. An early inspection to determine the actual condition is then usually necessary. Analysis of consequences arising from failure modes and effects can be a lengthy task in complex installations, particularly where there is the possibility of failing other equipment and setting off a sequence of damaging events. In such instances there may be need for probabilistic risk assessment and more sophisticated methods of analysis. The effects of fire and explosion, or the dispersal of toxic releases into the environment can be difficult to predict. A significant difficulty of qualitative and semi-qualitative approaches is that the assessment of risk is subjective and will tend vary from company to company. A problem for regulators is how to judge the adequacy of individual approaches when there are no industry standards or benchmarks. This problem may ease with experience, but in the shorter term there is a need for research projects comparing different approaches to risk assessment and ranking. 5.6.

RISKWISE

ANDOTHERSOFTWAREPACKAGESFOR

RBI

TWI has developed its own software package for RBI called RISKWISE. The risk model is semi-quantitative based on a scoring system from answering sets of questions relating to probability and consequences of failure for each component. The questions are designed to identify the active degradation mechanisms and the rate of degradation for each component from a database containing information about a wide range of mechanisms. The effectiveness of past inspections to detect and size degradation is taken into account by allowing for the uncertainty in the current condition in the probability of failure. The change in the risk of failure with time dependent mechanisms provides a basis for establishing the maximum period between repeat inspections. RISKWISE has a focus/defocus facility that enables the RBI team to review the effect of various consequence mitigating and inspection actions on the risk profile. RISKWISE is an intuitive tool that helps the RBI team produce a relative risk ranking and plan the period to the next inspection for each item of equipment. Its scoring and question system is easily customised to specific user requirements. The data is stored for future reference within the cycle of inspection planning. RISKWISE is available for TWI Industrial Members to use on their own. Greatest value is obtained when it is used with TWI experts as part of the RBI team. TWI’s expertise and experience covers many aspects of the RBI process including: 0 l

Page 14

identification quantification

of degradation and failure mechanisms and rates; of failure probability (FORM, MONTE);

7380.01/99/1054.03 Copyright 0 2001, The Welding Institute

ANINTRODUCTIONTORISKBASEDINSPECTION

l

0

selection of appropriate and reliable inspection strategies and methods; engineering critical assessment

A number of other software packages are also available to assist the assessment of the risk and the risk ranking of components. Designed mainly for use in the petrochemical industry, these packages include: l

. l

Tischuk system (applicable to piping systems) PACER DNV system (software in support of API 581)

Several operating companies including ESSO and Shell Global Solutions have developed their own proprietary systems. TWI has not yet had the opportunity to evaluate or compare any of these. Information about them and must be obtained from their suppliers. 5.7.

ILLUSTRATIONOF

RBI USING RISKWISETM

ASACASESTUDY

Appendix 4 gives an example of the implementation of RBI for a group of five items of equipment from a platformer unit in an oil refinery. The risk of each item is assessed using the semi-qualitative approach within the TWI software RISKWISETM. After gathering relevant information into a database, the software prompts the user to select from a given list the most appropriate answers to a series of questions relating to factors influencing the likelihood and consequences of failure. The example shows that individual items of equipment within a unit of plant can have different degradation mechanisms operating at different rates. These lead to differences between the residual lives of the items and hence the likelihood of failure within a given timescale. The user can then identify the highest risk items in the unit and those with the shortest residual lives. The software determines a recommended interval to the next inspection for each item based on the residual life proportioned according to the level of risk. Items predicted to wear out first and of high risk would be inspected before and at greater frequency than items with a longer life and low risk. When the degraded condition is such that fitness for service criteria cannot be met, the item can be replaced. 6.

DEVELOPMENT

OF THE INSPECTION

6.1.

ELEMENTSOFTHE~LAN

PLAN

Having estimated the risk for each piece of equipment, and ranked the equipment in risk order or in a risk matrix, the next step is to decide how to direct the inspection effort so that the total risk may be reduced. The equipment with the highest risk may be because the consequences of failure are so severe or because the failure probability is high. A high failure probability may result either because the

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Page 15

AN INTRODUCTION

TO RISK BASED INSPECTION

equipment is known to have suffered degradation or because the condition known but could reasonably have been expected to suffer degradation.

is not

The inspection plan for each item of equipment can be developed systematically from the information generated in the RE31process by identifying: l l l l l l

6.2.

What equipment to inspect What type of damage to look for Where to look for it How to find it with sufficient reliability How good was the RBI assessment When next (how often) to look

WHAT

EQUIPMENT

(what inspection technique)

TO INSPECT?

There is always an argument for directing inspection effort at those items of equipment assessed as having the highest risk. For high failure consequence equipment, even if its condition is believed to be satisfactory, some amount of inspection is generally appropriate and is a normal regulatory requirement. Speculative inspection of this kind may reveal unexpected degradation or damage and generates confidence in the robustness of the design and manufacturing process. Otherwise, inspection is likely to be of most benefit for those higher risk items of equipment whose condition is least certain. Uncertainty may arise from a lack of knowledge of the design, fabrication or operating history, or because the operating conditions or environment are not well known, or because the combination of these factors in causing damage is not well understood. There is a temptation not to inspect any items of equipment whose failure is assessed to be of low consequence and to allow poor condition to be revealed by failure. This may not only be false economy, but also is not consistent with good safety practice and plant management where the number of failures should be as low as reasonably practicable (ALARP). An inspection of some low risk items may reveal a generic problem that may have importance for the whole population. 6.3.

WHAT

TYPE OF DAMAGE

TO LOOK

FOR?

The RBI process will have identified which damage mechanisms are potentially present. Further information may be available from the equipment’s history and previous inspections. API 581 provides a description of different damage types and the mechanisms that may result in such damage, and an extension of this list is planned in the forthcoming document API 571 (Damage Mechanisms of Petrochemical Plant). Given a damage mechanism is postulated, it is necessary to evaluate the tolerance of the equipment to such damage in terms of its future fitness-for-service. A level of tolerable damage may be defined and used as a basis for detection and reporting within the inspection procedure. A factor of safety between the inspection reporting

Page 16

7380.01/99/1054.03 Copyright 0 2001, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

level and the maximum tolerable damage for fitness-for-service scheduled inspection is generally appropriate. 6.4.

WHERE

TO LOOK

until

the next

FOR IT?

Damage may occur uniformly throughout a piece of equipment or it may occur locally depending on the global and the varying local conditions. Uniform damage can be detected at any convenient location on the equipment and its results can be expected to be representative of the condition elsewhere. Specific factors such as the presence of welds, geometric stress concentrators, crevices for corrosion or cyclic loads will direct the inspection to particular locations. The absence of damage in these areas reduces the expectation of damage occurring in less susceptible areas elsewhere. In other cases, such as pitting corrosion, the site of local damage may not be so clear, and a more general search of a larger area may be needed. The chances of detecting damage depend on the damage density and variability compared with the size and validity of the inspection area. Quantification of these factors, whilst possible, is generally outside the scope of a REH assessment and simple qualitative judgements of the area to inspect are usually made. Failure to detect damage reduces but does not eliminate the chance of it being present. 6.5.

How

TO FIND IT WITH

SUFFICIENT

RELIABILITY?

Inspection techniques vary in their effectiveness to detect different types of damage, and the effectiveness can also be influenced by the mechanism causing the damage. The selection of an appropriate inspection technique is therefore based on its ability to detect the type of damage for the mechanism that might be present from the RBI assessment. Some general guidance on the selection of an inspection technique for some damage types is given in API 581, but the effectiveness of any technique depends as much on the specific geometry and material of the application. In order to obtain high reliability a combination of techniques is sometimes necessary. Companies such as TWI that have studied inspection effectiveness can offer advice on the optimum choice of techniques and procedures for a given inspection situation. The sensitivity of the detection capability of inspection techniques to situation and human factors is continuing to receive attention following the results of various test piece trials (PISC, PANI, Nordtest). The detection capability can be quite different in the field to that measured in the laboratory. This capability is expressed as curves of probability of detection versus flaw size that may be derived experimentally or theoretically. In a full risk based inspection plan, the probability of detection will be taken in to account in relation to the extent of damage that needs to be detected. If damage is detected, a second phase is to characterise and size the damage for fitness-for-service assessment or repair action. Different inspection techniques for characterisation and sizing may be necessary. The reliability of this phase has also

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Page 17

AN INTRODUCTION

TO RISK BASED INSPECTION

been examined in tests and analyses where the results are expressed in terms of curves of NDT measured size versus actual size. Even if no damage is detected, the limits and variability of inspection performance implies there is still some probability of damage being present after an inspection. There is also the possibility that the real extent of damage may not be revealed by the inspection or that defects detected are undersized. Since manual inspection is a subjective process, there can be value in repeating the inspection and introducing diversity and redundancy and also by making use of automated techniques. The value of repeat inspections in decreasing the probability that the true condition of the component inspected is worse than that observed depends on the assessed effectiveness of the inspection. This requires knowledge of the probabilities of detection or sizing and the prior expectation of different levels of damage from the RBI assessment. Bayes theorem provides a method for inspection risk updating depending on the number of inspections carried out. In this instance, increasing the amount of inspection can reduce risk, although there is a decreasing rate of return7. 6.6.

FEEDBACK

- How

GOOD WAS THE RBI ASSESSMENT?

After the inspection has been carried out and the results made available, there is a further stage of evaluating the results against the predictions of damage made in the RBI assessment. Variations, particularly where the damage was more than had been assessed, need to be taken into account and further investigation of the reasons may be necessary. Further inspection of other areas may be required to quantify the extent of the damage. Other steps to reduce the rate of damage in future might be taken such as changing the process conditions. Fitness-for-service evaluations or repair actions will be carried at this stage. The risk analysis will then be updated taking the new information into account and the period to the next inspection decided. 6.7.

WHEN

NEXT

- How

OFTEN

TO LOOK

FOR DAMAGE?

Setting the period between inspections on a risk basis depends on the following factors, and in particular the uncertainty associated with each factor. l l l l

four

Damage types and mechanisms that could be present or initiate in future The rate of damage progression Tolerance of the equipment to damage for fitness-for-service Probability of detection and sizing

The best estimate rate of damage progression and the tolerance of the equipment to damage define an average residual life. The inspection period may be simply taken as some fraction of this life considering appropriate conservative bounds to the uncertainties on rate and tolerance. A more complex approach is to re-estimate the rate of damage through life based on inspection results and to update the residual life and probability of failure depending on whether damage is occurring at a high

Page 18

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

ANINTRODUCTIONTORISKBASEDINSPECTION

or low rate. The reliability that may be placed in the results of the inspection then plays a key part in the judgement of the next inspection period and residual life. There is an argument that repeat inspections increase the probability of detection of the actual damage state. This argument forms the basis of inspection updating but assumes that detection by inspection is a random process, The extent and conditions to which this assumption is true in practice is an area for further discussion. 6.8.

OTHERACTIONSAPARTFROMINSPECTION

Inspection only provides new information about the physical condition of the equipment and therefore only affects the estimated failure probability, particularly in cases where there is prior uncertainty. In order to change the actual failure probability and hence the actual risk, some active intervention such as repair or replacement of the equipment is required. Other actions than inspection may have a greater effect in managing or reducing the probability of equipment failure, such as improved operator training or process control. These should also be outcomes from the RBI process. 7.

DISCUSSION

OF RBI DEVELOPMENT

7.1.

CURRENTSTATUS

There is increasing interest in risk based inspection by different sectors of industry and their regulators. Industry sees RI31 as a way of making better use of inspection resources and, where appropriate, of reducing the amount of inspection by extending run lengths and focusing inspection on the areas with highest risk. In order to justify less inspection, RI31 makes increased demands for information and analysis, and regulators are keen that the process of RI31 is carried out rigorously. 7.2.

DEVELOPMENTBY~NDUSTRY

In 1985, the American Society of Mechanical Engineers formed a Risk Analysis Task Force in response to a perceived need to initiate the use of risk based methods in the formulation of policies, codes and standards for engineering equipment and structures. At the suggestion of that task force, a research programme was established to determine how risk based methods could be used to set inspection requirements and guidelines for systems and components of interest. A RBI Research Task Force of recognised experts from a broad range of industries begun work on the programme in 1988. Initial support was from the Nuclear Regulatory Commission (NRC) and the National Board of Boiler and Pressure Vessel Inspectors. Later support was received from the Pressure Vessel Research Committee, the Welding Research Council, American insurers, Hartford Steam Boiler and API. In 1991, the Task Force published a general document as Volume 1 of a set of guidelines’. Supplementary volumes would address the specific needs for the

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Page 19

AN INTRODUCTION

TO RISK BASED INSPECTION

inspection of nuclear power plant (Vo1.2), fossil power plant (Vo1.3), aircraft structures (Vo1.4) and marine and civil structures (Vo1.5). In parallel with the continuing work of ASME, the American Petroleum Institute established a project that would lead to guidance applicable to the refinery and petrochemical industry that was to become the Base Resource Document API 58 1. The US nuclear industry has implemented the guidelines for RBI into codes and practice through work carried out by the Westinghouse Owners Group (WOG) and the Electrical Power Research Institute (EPRI). This has led to the publication of code cases 577 and 578 to ASME Xl allowing RI31 for piping and the pilot applications at the Surry and Arkansas nuclear power plants. Keeping pace with these developments, the NRC published Trial Regulatory Guide 1.178 recognising the use of risk informed decision making for the in-service inspection of piping. Following the publication of API 581 as a preliminary draft, various companies within the petrochemical refinery industry have undertaken pilot studies”“. Risk based inspection is being recognised as an option within the industry inspection codes such as API 5 10 (pressure vessels), API 570 (process piping) and API 653 (storage tanks). In October 1999, API published Recommended Practice for Risk Based Inspection (API 580). This is intended to clarify the elements of a RI31 analysis rather than single out any specific approach. Within its Post Construction Code Committee, ASME has set up an inspection planning sub committee to develop a more generic standard for risk based inspection planning. This will be applicable to a much wide range of pressure equipment. It is expected to take several years to develop. Interest in risk based inspection amongst UK and European companies has been growing in recent years, although there has not been the same scale of national effort as in the USA to provide a research base for regulatory guidance and codes and standards. TWI recognised the need for research action on behalf of its members in 1997 and this will continue within the core research programme. Individual companies are assessing the benefits of applying RBI. Reference 3 gives some examples from the petrochemical and power industries. Proposals for European co-operation in the field of risk based inspection for nonnuclear equipment are being made under the EC Fifth Framework Programme and there is interest from the European Pressure Equipment Research Council (EPERC). The CEC Joint Research Centre at Petten is co-ordinating the activity within the European nuclear industry through the ENIQ network EURIS, while individual nuclear utilities are examining the possibilities. 7.3.

Page 20

RESPONSE

OF REGULATORY

AUTHORITIES

Regulatory inspection analysis’ ’ . inspections

authorities are assessing the effect on safety of operators altering current regimes and implementing schemes of inspection based on risk These schemes are tending to propose extended run lengths between

and reduced intrusive inspection. So far, the practice of IWI is still

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

being developed and there is insufficient failure data available to draw any definitive conclusion. If implemented properly RE!I should have a beneficial effect on safety since there will be a greater chance that component deficiencies will be detected before failure. The UK Pressure System Safety Regulations already allow flexibility for duty holders to use risk based principles in the preparation of written schemes of examinations. However, there is considerable variation in the level and degree of detail of risk based schemes that are being presented. Guidance on risk based inspection for pressure systems and containments is being developed for the Health and Safety Executive by TWI and Royal SunAlliance Engineering. In the Netherlands, a co-operative project has been organised by KINT (the Dutch Quality Surveillance and NDT Society) and PMP (Project Office for Research on Materials and Production) to assess whether and how risk based inspection can be incorporated within Dutch regulations. The project will formulate conditions that have to be met for the application of RE31by Dutch industry to be acceptable. It is based around a methodology developed by KINT for the setting of inspection periods. The project commenced in 1997 and was due for completion late in 1999. The provisional conclusions and recommendations are now available from TWI. 8.

SUMMARY

AND CONCLUSIONS

The main points from this introduction

to risk based inspection are:

(a) Risk based inspection is a good process for developing an optimised scheme of inspection with the potential to assist many industries understand and manage the risks of failure better. (b) Risk based inspection is a process for developing a plan of inspection based on the information obtained from an analysis of the risk of failure. It can be applied to any equipment where inspection is used to manage the risk of failure arising from damage, defects or degradation. (c) The risk analysis requires an assessment of the causes, likelihood and consequences of failure. This may be done qualitatively or quantitatively. A wide range information is needed, particularly for complex installations (d) In order to assess the likelihood of failure, it is necessary to identify the potential degradation mechanisms, estimate the rates of degradation, and evaluate their effect on future fitness-for-service. (e) Risk based inspection is an activity that is best undertaken by a multidisciplinary team. The process is well defined although there is scope for considerable variation in its implementation. Several software packages designed to assist users assess the risk of failure are now available.

7380.01/99/1054.03

Copyright 0 200 1, The Welding Institute

Page 21

AN INTRODUCTION

TO RISK BASED INSPECTION

(f) The risk analysis is used to identify failure and those where potential service.

the components having the highest risk of degradation could threatened fitness-for-

(g) The information from the risk analysis is used to formulate what, where when and how to inspect. Inspection can have most effect on the estimated risk in situations where there is prior uncertainty. However, it can only be beneficial if the inspection methods, procedures and performance are effective and reliable. (h) Feedback of the results from inspection into the risk analysis is an essential part of the process. This may highlight the need for additional risk mitigation measures. (i) Risk based inspection can be applied by any industry where the inspection of high integrity and safety related plant and equipment is a priority. The US petrochemical and nuclear industries have led the development of RBI. There is now a need for guidelines to ensure that RBI is applied consistently. (j) Risk based inspection may be a means to reduce or re-target inspection, but may also indicate a need to increase inspection in situations where there is uncertainty. 9.

REFERENCES 1 Anon: ‘A guide to the pressure systems and transportable gas containers regulations’, Health and Safety Executive, published by HMSO, ISBN O-l l885516-6, 1990. 2 Anon: ‘Safety of pressure systems approved code of practice’, Health and Safety Executive, published by HMSO, ISBNO-11-885514-X, 1990. 3 Anon: ‘Guidance on the periodicity of examinations’, Federation (SAFED), ISBN l-90 12 12- 106, 1997.

Safety

4 Anon: ‘Extending run lengths of existing pressure equipment’, Pressure Systems Group Seminar, London, October 1997. 5 Warner F et al: ‘Risk analysis, perception and management’, 1993. 6 Anon: ‘Base resource document on risk based inspection’, Institute Publication 58 1, 1996.

Assessment

Proc of IMechE

The Royal Society,

American Petroleum

7 Chapman V and Booth A: ‘A statistical approach to the analysis of IS1 data using the Bayes method’, Paper D1/7, 7’h SMIRT Conference, Chicago, 1883. 8 Balkey K R: ‘Risk based inspection publication CRTD 20-1, 1992.

Page 22

- development

of guidelines’,

ASME

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

9 Reynolds J T: ‘The application of risk based inspection methodology petroleum and petrochemical industry’, ASME PVP Vo1.336, 1996.

in the

10 Carter W J, Hsiao C P and Ayyub B M: ‘A robust risk based inspection procedure for the petrochemical industry’, ASME PVP, Vo1.288, 1994. 11 Mainstream Research Market 1998/99, Health and Safety Executive, by HMSO, 1998.

Published

12 AlChEKCPS: ‘Guidelines for chemical process quantitative risk analysis’, Centre for Chemical Process Safety, American Institute of Chemical Engineers, New York, 1989. 13 AIChEICCPS: ‘Guidelines for hazard evaluation procedures’, Centre for Chemical Process Safety, American Institute of Chemical Engineers, New York, 1985.

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Page 23

AN INTRODUCTION

TO RISK BASED INSPECTION

APPENDIX

1

Background to API 581

7380.01/99/10.54.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

APPENDIX

1

BACKGROUND

TO API 581

In May 1996, the American Petroleum Institute published the preliminary draft of a ‘base resource document on risk based inspection’, API 581. The document was written as a research report of a project for the API Risk Based Inspection Sponsor Committee under the Committee on Refinery Equipment. Twenty-six companies (mostly American oil and petroleum majors) sponsored the project. The project was let to Det Norske Veritas who largely undertook the work on behalf of API. The document in the public domain is a preliminary draft. The validity of the information and methods presented is a matter for each user to evaluate. Much as it is subjective and judgemental, and experience is showing that many users are using API 581 a basis from which to develop their own approaches. API 581 has been produced through the American Petroleum Institute and is intended for use within American regulatory and industrial practice. It relates to plant at oil refineries designed, constructed and operated to the ASME and ANSI codes, other API inspection standards (RP 510, 563, 570), and recent US industrial and government initiatives in the field of fitness- for-purpose, process safety and risk management. The terminology and examples of API 581 relates to the type of plant used by the on-shore oil refining and petrochemical industry. There is no mention of applications to topside equipment on offshore platforms in a sea water environment or to the issues faced by other industries such as power generation or downstream chemicals. Many of the principles of RBI will apply, but specific applications outside its intended field of refinery equipment could be problematic. The document applies specifically to the inspection for flaws, damage or degradation of pressure retaining equipment within the primary pressure boundaries. It therefore excludes consideration of inspection of other equipment that may also contribute to the risk, such as control and instrumentation systems. Two distinct approaches to risk ranking are identified: qualitative and quantitative. The qualitative approach is intended to compare the relative risk of different process units, whole plants or even refineries each containing many individual items of equipment. Quantitative risk ranking of individual equipment items (vessels, pipework, etc) requires a detailed assessment of specific factors related to the equipment, inspection and process management that are judged to influence the likelihood of failure. A reduced version of the fully quantitative approach (the semiquantitative approach) is also defined where the information requirements are significantly simplified. The preliminary

draft of API 58 1 comprises 10 chapters and six appendices.

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Appendix 1 - Page 1

AN INTRODUCTION

TO RISK

BASED

INSPECTION

APPENDIX

2

Qualitative Approach to RBI in API 581

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

APPENDIX

2

QUALITATIVE

APPROACH

TO RBI IN API 581

Chapter 5 of API 581 acts as the guidance notes for the series of questionnaires (called the Workbooks) given in Appendix 1. The questionnaires relate to the various factors considered for the assessment of Likelihood and Consequence Categories. The Likelihood Category considers six factors whereas the consequence assessment contains 11 factors. The answer to each question is given a score within a set scale. The questionnaires in the likelihood category contains questions to assess the effect of the following factors on the annual probability of failure. .

Equipment Factor - related to the number or components within a unit

=

Damage Factor - identifies and assesses the known damage mechanisms

.

Inspection Factor programme

.

Condition Factor - allows for general maintenance and house-keeping

.

Process Factor - a measure of the potential for abnormal/interrupted

9

Mechanical Design Factor - complexity

-

assesses the effectiveness

of the current

inspection

operation

of the unit and extent of code design

By summing the numerical scoring given to the answers to the questions within each questionnaire, a numerical rating for each of the Factors is obtained. The total Likelihood Category is the sum of the individual factor ratings. The assessment of consequence is treated similarly headings:

but subdivided

under the

(1) Damage Consequence and (2) Health Consequence. The Damage Consequence Category evaluates a numerical value for these factors. .

Chemical Factor - tendency of the chemical contained to ignite

.

Quantity Factor - amount of chemical that could be released in a single event

n

State Factor - a measure of the flash point

1

Auto-ignition

Factor - when the chemical is above its auto-ignition

7380.01/99/1054.03 Copyright 0 2001, The Welding Institute

temperature

Appendix 2 - Page 1

AN INTRODUCTION

TO RISK BASED INSPECTION

=

Pressure Factor - how quickly a chemical can escape

.

Credit Factor - allows damage

.

Damage-potential

for plant safety features and systems that mitigate

Factor - allows for damage to adjacent equipment

The Health Consequence Factor is derived from summing the following expresses the degree of potential toxic hazard. . . . .

factors and

Toxic-quantity Factor - a measure of quantity and toxicity of the chemical Dispersibility Factor - how readily the chemical will disperse Credit Factor - allows for safety features and systems that mitigate health effects Population Factor - how many people could be affected by a toxic release

The qualitative approach to RBI caters for all levels of risk assessment within plant. For example, it can be used to compare different: (i) (ii) (iii) (iv)

a

plants units within one plant sections of a unit systems within a unit section

For this reason, depending on the level within the plant for which the risk assessment is intended, the relevance of some of the factors may vary. Some factors may be easy to assess at a plant level, but may be irrelevant at the system level. Thus, if a number of comparable items are being assessed, then it is worth customising the questionnaires to the particular circumstances. At the same time, it is recommended that the interpretation of each category is documented, so that future assessments can follow the same logic. Typically a rating of 10-l 5 on an individual likelihood factor is significant as this can change the final Likelihood Category. For example, the Damage Factor has a maximum weighting of 20, consisting of nine different damage mechanisms. API recognises that the list is not exhaustive and include a catch-all factor of 10 points for mechanisms that have not been considered. The nine mechanisms cover those that are most likely to lead to loss of containment. Two situations apparently overlooked under the Process Factor are new and intermittently operated plant/units. Both of these situations have a high associated risk of failure and should be given equal weighting to a process with more than 12 interruptions in a year, i.e. PF1=5. The Likelihood Category rating and the highest rating from health consequence categories are used to place the unit or by five likelihood-consequence matrix. This can be used potential concern and to decide which areas need the most other methods of risk reduction. Appendix 2 - Page 2

either the damage or the component within a five to identify the areas of inspection and repair or

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

The grid for determining the degree of potential risk and degree of inspection is not symmetrical within the matrix since in almost every case the consequence factor is judged to carry more weight than likelihood. In other words, risk here is being assessed as the product, likelihood times consequence. After identifying the higher risk process units on the basis of a qualitative risk ranking, the individual items of equipment (vessels, pumps, piping etc) within those units can be assessed quantitatively for the purposes of planning inspection. In the quantitative assessment, an Adjusted Failure Frequency for each item is determined and used with an appropriate measure of consequence (usually reduced to a cost) to give a measure of the risk.

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Appendix 2 - Page 3

AN INTRODUCTION

TO RISK BASED INSPECTION

APPENDIX Quantitative

3

Approach to RBI in API 581

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

APPENDIX

3

QUANTITATIVE ESTIMATION

APPROACH

OF FAILURE

TO RBI IN API 581

FREQUENCY

In API 581, the quantitative assessment of failure frequency is an integrated process considering both the equipment and process and their management. The starting point is a Generic Failure Frequency (GFF) for the type of equipment in question (e.g. pump, vessel piping, etc). API 581 gives a table of suggested failure frequencies for different types of equipment derived from published sources of failure data. The Generic Failure Frequency is then modified by a factor FE that is specific to the equipment and the process and also by a factor related to the safety management regime to determine the Adjusted Failure Frequency (AFF).

The factors FE and FM are obtained from a scoring system within questionnaires (workbooks). Equipment

Modification

a series of

Factor

The Equipment Modification

Factor (FE) is the sum of four sub-factors:

FE = FrM+FU+F~+Fp where: FTM is the Technical Module Sub-factor (covering the type and rate of damage expected, number and effectiveness of inspections, over-design margins) Fu is the Universal Sub-factor (covering the general condition of the plant, climate effects, and seismic activity) FM is the Mechanical Sub-factor (covering complexity, construction safety factors to design temperature/pressure, vibration monitoring) FP is the Process Sub-factor (covering process continuity,

code, life cycle,

stability, relief valves)

The derivation of numerical values for these sub-factors is now described

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Appendix 3 - Page 1

AN INTRODUCTION

TO RISK BASED INSPECTION

(a) The technical module sub-factor The technical module sub-factor evaluates the effect information on the generic failure frequency. These are: 1. The deterioration

of two

categories

of

rate of the material resulting from its operating environment

2. The effectiveness mechanism

of the inspection

to identify

The analysis of in-service damage and inspection Technical Module Sub-factor is in seven steps:

and monitor

effectiveness

the damage

to determine

the

1. Screen for damage mechanisms and establish an expected damage rate 2. Determine the level of confidence in the damage rate 3. Determine the effectiveness of past inspections to detect and monitor damage 4. Calculate the effect of the inspection on improving rate 5. Calculate the probability

confidence

in the damage

that the damage will result in failure

6. Calculate the Technical Module Sub-factor for each damage mechanism 7. Calculate the mechanisms

composite

Technical

Module

Sub-factor

for

all

damage

API 581 makes assumptions about the likelihood that the damage rate will be higher than the expected or predicted rate depending on the confidence or reliability placed in the supporting data. For example, if there is low confidence in the predicted damage rate, it is assumed there is a 50% chance that the rate will be as predicted or less, but with a 30% chance that the rate will be between one and two times the predicted rate, and 20% chance that it will be up to four times the rate. The effect of inspection on improving the confidence in the expected damage rate is a process known as inspection updating. It is based on the widely recognised statistical method of bayes theorem. This allows the effect of one or more inspection results, that they have a degree of uncertainly, to be incorporated with information on the expected condition based on an analysis or opinion. To assist this analysis, API 581 considers the following the so-called technical modules of Appendix 5: l

l

damage mechanisms within

General or localised corrosion and thinning mechanisms (aqueous HCl, high temperature sulphidation, vapour-liquid impingement and under-posit attack) High temperature hydrogen attack

Appendix 3 - Page 2

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

l

Stress corrosion cracking (wet H$, caustic, amine)

l

Brittle fracture

Each module has a set of screening criteria to determine if the damage mechanism is present with information to estimate the expected damage rate if this is not known, and specifies the data required for the subsequent analysis. In particular, guidelines are provided to enable the user to assess the effectiveness of the number and type of inspection methods that may have been used to detect and determine the damage rate. The Technical Module Sub-factor is then determined by entering a table with the damage rate and the number and effectiveness of inspections. (In the case of thinning, the value obtained from the table is further modified by factors to allow for the degree of overdesign and where the corrosion rate is based on extensive field measurements). (b) The universal sub-factor The Universal sub-factor covers aspects that affect all equipment facility and is the sum of numerical ratings given for l l

0

items in the

General plant condition Climate hazards Seismic activity

The assessment of general plant condition takes account of general appearance, the effectiveness of the plant’s maintenance programme and the quality of the plant’s layout and construction. The numerical rating depends on whether this is assessed to be significantly better (-l.O), about equal (O.O), below (+1.5) or significantly below industry standards (+4.0). Hazards from cold weather operation are recognised based on the lowest daily temperature at the plant site. The numerical ratings are for a winter temperature above 40°F (O.O), 20°F to 40°F (l.O), -20°F to 20°F (2.0), and below -20°F (3.0). The allowance for seismic activity is based on the seismic zones defined in ANSI A58.1 (1982). The numerical ratings are for zones 0 or 1 (O.O), for zones 2 or 3 (1 .O), and for zone 4 (2.0). (c) The mechanical sub-factor The mechanical sub-factor takes account of aspects relating to the design or fabrication of the equipment that may influence the likelihood of failure and is the sum of numerical ratings given for: 0 l

0

Complexity (of a vessel or piping section) Construction code Life cycle

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Appendix

3 - Page 3

AN INTRODUCTION

l l

TO RISK BASED INSPECTION

Safety factors Vibration monitoring

For vessels only, the complexity rating (ranging from -1.0 to +2.0) is determined from the number of nozzle penetrations of the shell and the vessel type (column, pump, exchanger etc) and is given in a table. For piping, the complexity factor is the sum of the number of connections (x10), the number of injection points (x20), the number of branches (x3), and the number of valves (x5) per foot length. The complexity rating is determined from a table and can have a numerical value ranging from -3.0 to +4.0. The benefits of design and fabrication of the equipment to a recognised code is taken into account through a rating. This has the value of 0.0 if the equipment meets the latest edition, 1.O if the code for the equipment has been significantly modified since fabrication, and 5.0 or more if the equipment was not fabricated to any code. The age of the equipment as a percentage of its design life is recognised to have an influence on the likelihood of failure in a classical ‘bath-tub’ form. The numerical ratings are for zero to 7% (2.0), 7 to 75 % (O.O), 76 to 100% (1 .O) and for more than 100% a rating of 4.0. The operating pressure and temperature of the equipment are taken into account. The rating for the increased likelihood of failure for equipment operating towards its design stress limits is related to the ratio Pop/I’designand ranges from -2.0 (for Pop/P&sign(0.5) to +5.0 (for Pop/P&sign>l.O). The increased susceptibility to failure of equipment operating above a threshold temperature (dependent of the type of steel) and below -20°F with ratings of 2.0 and 1.O respectively. Vibration monitoring applies primarily to rotating equipment like pumps and compressors. A numerical rating is given depending on whether the monitoring is on-line, periodic or none at all. (d) The process sub-factor The Process Sub-factor represents the effect of the process and the means for its control on the likelihood of equipment failure. Experience has shown that equipment failures are often associated with periods of non-routine operation (startups, shut-downs) or when control of the reaction has been lost or is uncontainable within the design basis. Three elements are considered, each of which has several sub-elements. l l l

Continuity of the process Stability of the process Relief valves

Within continuity of the process, numerical values (ranging from -1 to f3) are given depending on the number of planned and unplanned shutdowns per year. The stability of the process is assessed by expert judgement in relation to that for a ‘typical or average’ process. Considerations in making the judgement include

Appendix 3 - Page 4

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

exothermic reactions, high pressures or temperatures, training of process operators, and automated control systems. A numerical value is given depending on whether the process is more stable (-l), about the same (0), less stable (+l), or much less stable than the average (+2). The assessment of relief valves takes into account the following l l l l

sub-elements:

Maintenance programme Fouling service Corrosive service Very clean service

Numerical values between -1 and 4 are given depending on the assessment within each sub-element. The Process Sub-factor within each element. Management

is obtained by adding the numerical

Systems Evaluation

values determined

Factor

The Management Systems Evaluation Factor (FM) considers process safety management issues listed in API -RP-750 (Management of Process Hazards) and assesses the potential impact on mechanical integrity of issues under 13 headings: 1. Leadership and administration 2. Process safety information 3. Process hazard analysis 4. Management of change 5. Operating procedures 6. Safe working practices 7. Training 8. Mechanical integrity 9. Pre-start-up safety review 10. Emergency response 11. Incident investigation 12. Contractors 13. Audits The management factor evaluation comprises of a questionnaire (workbook) consisting of 101 questions, most of which have multiple parts. Points are awarded for each positive response. A total score of 1000 points is possible and would represent excellence in process safety management. The score obtained (% out of 1000) is converted to FM by means of a linear logarithmic graph where FM ranges from a value of 10 for a nil % score to a value of 0.1 for a score of 100%.

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Appendix 3 - Page 5

AN INTRODUCTION

Estimation

TO RISK BASED INSPECTION

of Consequences

The estimation of consequences of a failure in quantitative terms depends on the circumstances of the plant. For accurate consequence evaluation, the techniques of quantitative risk analysis are available, although discussion of these techniques is outside the scope of the current document. The aim of the quantitative consequence analysis is to determine the sum of money or number of lives or other measure that may be lost as a result of the failure. There are many losses that may result from plant failure and loss of containment. The immediate and obvious costs are: 0 l l l

Injury to personnel Replacement of damaged equipment Business interruption (lost revenue) Clean-up of the environment

There may, however, be many other less obvious and longer term costs that should also be considered, such as: l l l l l

Emergency supplies, equipment rentals Investigation costs, independent advisors and regulatory action Additional overtime, decreased workforce efficiency, replacing workers Customer dissatisfaction, loss of reputation and market share Legal expenses in litigation and damages

Within Chapter 7 of API 581, a system is given for the analysis of the consequences of a failure in the context of a petrochemical refinery. The analysis provides some simple methods for estimating the costs relating to equipment damage (fire and explosion), toxic consequences, environmental clean-up and business interruption. The estimation is based on data obtained from a systematic seven stage process: 1. 2. 3. 4. 5. 6. 7. 8.

Determining the properties of the fluid Evaluating the loss of containment in terms of representative hole sizes Estimating the total amount of fluid available for release Estimating the release rate Considerations of dispersion Selection of the final phase of the released fluid (liquid or gas) Evaluating the effectiveness of the post release response (emergency planning) Determining the geographical area affected by the release

It is outside the scope of this document to consider this analysis and the underlying assumptions. It can be observed that the analysis is complex and requires a large amount of input data. The methods presented represent but one approach to the problem and there will be many variations depending on particular company circumstances and loss evaluation policies.

Appendix 3 - Page 6

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

APPENDIX

4

A Case Study of Risk-Based

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Inspection

AN INTRODUCTION

TO RISK BASED INSPECTION

APPENDIX

4

A CASE STUDY OF RISK-BASED

INSPECTION

A4.1 INTRODUCTION This case study illustrates the process of assessing the risk and planning the inspection interval of five items of equipment from a unit called a platformer in an oil refinery. A summary of these five items is presented in Table Al below. The TWI approach to RE31 and the software RISKWISETM are used to assist the assessment and planning process. Table Al Summary of 5 items of equipment

‘Platforming’ is the proprietary name for a hydrocarbon refining process universally known as catalytic reforming. A schematic diagram is depicted below showing the ‘platforming’ process. The hydrocarbon feed to this process is sweetened naptha and hydrogen gas. The final liquid product (reformate) is used for gasoline blending. The naptha feed is pressurised, heated, and charged to a series of reactors. The catalytic reforming reaction takes place in the presence of hydrogen in these reactors. The product is subsequently run through air coolers where much of it is liquefied. At this stage the hydrogen gas is removed by physical separation and recycled in to the naptha feed. The remaining liquid product is sent to a gas distillation plant, where light hydrocarbon gases (e.g. butane) are removed in distillation columns.

7380.01/99/1054.03

Copyright 0 200 1, The Welding Institute

Appendix 4 - Page 1

AN INTRODUCTION

TO RISK BASED INSPECTION

03DO6 Steam

drum

03D07 H, Separator A

03D03 Reactor

4 Naptha feed and H, gas

FigAl:

No.1

Intermediate

Intermediate

heater No 1

heater No 2 ReaCtOr No2

r-l

ReaCtOr No3

I Distillation

Recycled H,

Schematic diagram showing the platforming

column

process

A4.2 RISKANALYSIS A4.2.1 Approach The risk analysis process is illustrated by the application of TWI’s software package RISKWISETM to a single item of equipment, item 03D07, the Hz Separator as shown in Fig.Al. The software has also been applied to the other four items to enable a comparison and ranking of the relative risks over different timescales. In FUSKWISETM, risk analysis consists of the following

stages:

Collection of factual data for the equipment item under consideration, Identification of credible damage mechanisms, Evaluation of likelihood factors for each of the identified damage mechanisms Evaluation of consequence factors Presentation of the risk summary. Application of the RISKWISETM software requires factual information about each item of equipment and expert judgements about factors relating to the risk. A team of individuals having the necessary breadth of access and expertise would normally be needed. Typically, such a team might include a specialist in safety and risk analysis, a process engineer, a materials/design engineer and an inspection engineer, as well as the competent person as required by the UK pressure systems safety regulations. A4.2.2 Collection

of Factual Information

The first stage of the risk analysis is to gather specific factual information for each item of equipment and enter it into the RISKWISETM database. Information is entered under three headings:

Appendix 4 - Page 2

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

Item properties (Drawings, dimensions, operating conditions, coatings etc) Materials (Specification, type, wall thickness, corrosion allowance etc) Inspection methods applied previously (Type, coverage, findings) This information serves as a basis for making pertaining to the risk.

expert judgements

about factors

The information for equipment item 03D07, the Hz Separator, is shown in Fig.A2, A3 and A4 for Item properties, Materials and Inspection methods, respectively. A4.2.3 Identification

of Damage Mechanisms

The team then uses this information together with its knowledge and expertise to identify credible damage mechanisms. In order to assist this task, RISKWISETM provides a list of damage mechanism with supporting descriptions. As the number of damage mechanisms that can affect equipment is large, and the circumstances vary, the team should use this list only as a basis for its own judgements. Credible damage mechanisms are identified by means of tick boxes on the RISKWISETM database as shown in Fig.AS for equipment item 03D07, the H2 separator. A4.2.4 Evaluation

of Risk Factors

The team now assesses the Risk Factors relating to the probability and consequences of failure as prompted by RISKWISETM. The factors are assessed qualitatively by means of tick boxes against a small number of descriptive categories. RISKWISETM gives numerical weighting to the individual answers given, and the weightings are combined by means of formulae to give total numerical ratings for likelihood and consequences of failure. An example of the risk factors sheet is shown in Fig.A6 for equipment item 03D07, the Hz separator. For each identified damage mechanism, the likelihood of failure is considered within three timescales from the time of assessment. In this case study, timescales of 72, 144 and 216 months are considered. The team is asked to judge the likelihood of failure in the timescale within descriptive five categories ranging from ‘not credible’ to ‘likely’. The team also assesses the effectiveness of previous inspection methods against damage mechanisms. The likelihood of failure is reduced if previous inspections methods were effective and increased if ineffective. This reflects the increased risk that may result from uncertainty about the current condition. RISKWISETM prompts the team to assess the potential consequences of failure of the item within descriptive categories. The toxicity and flammability of the released contents and the effects of interruptions to business and production are considered. Simple answers are sufficient as there is no requirement to quantify the consequences.

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Appendix 4 - Page 3

AN INTRODUCTION

TO RISK BASED INSPECTION

This qualitative assessment of the likelihood and consequences of failure is determined by the factors that the authors of RISKWISETM believe to be important. This is a subjective judgement and other companies may consider different factors and weightings to be more appropriate to their needs. RISKWISETM is designed so that the factors, weightings and combination may be customised for each application. A4.2.5 Presentation

of Risk Summary

The total numerical ratings for the likelihood a five point linear scale. These can then probability-consequence matrix. The ratings multiplied together to give the ‘risk index’, of the risk.

and consequences of failure are within be plotted to present the risk on a for likelihood and consequence may be a single numerical value representative

The risk of failure from each damage mechanism over each of the time-scales is determined from likelihood and consequence ratings for the item. These are plotted as co-ordinates on the Risk Summary matrix where risk increases across and up the matrix. This is illustrated in Fig.A7 for equipment item 03D07, the Hz separator. A4.3 F&K

RANKINGS

OF 5 EQUIPMENT

ITEMS

The risk analysis illustrated here by the Hz separator example has been repeated for the other 4 equipment items. For the comparison and ranking of relative risk, a risk index is determined for each item for the time-scale considered. Applying this, the risk indices of the five items after 216 months service are tabulated in Table A2 and presented graphically in Fig.A4.7. Table A2 Risk rankings of 5 equipment items for 216 months , Item ’ Steam drum 03D06 Hz separator 03D07 Flash drum 03D08 Reactor No 1 03D03 Charge heater 03F03

DM General corrosion Stress corrosion cracking General corrosion Temper embrittlement Stress corrosion cracking

Risk index 1 (low risk)

LF score 1

CF score

3

A (1)

2

B (2)

4

4

D (4)

16 (high risk)

5

E (5)

25 (high risk)

A(1)

The risk ranking shows that items 03D03 and 03F03 have a high risk of failure relative to the other 3 items. This suggests that whilst an interval of 216 months before the next inspection might be appropriate for the low risk items, the high risk items will need to be inspected much more frequently.

Appendix 4 - Page 4

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

AN INTRODUCTION

TO RISK BASED INSPECTION

A4.4 INSPECTION PLANNING For the purpose of planning the inspection frequency, RISKWISErM recommends a Maximum Inspection Period (MIP) for the item of equipment with respect to the dominating failure damage mechanism. The scheme is consistent with the UK Institute of Petroleum Guidelines and is based on a residual life calculation considering the current condition and the degradation rate. The MIP is a conservative fraction of the residual life determined by the likelihood and consequence ratings. The MIP calculation is illustrated here with respect to general wall thinning corrosion. The likelihood of failure time can be calculated with knowledge of the corrosion thickness (T), and the minimum allowable thickness (Tmin). then: RL‘=

damage mechanism of over a certain period of rate (CR), the current The residual life (RI) is

T-Tmin

CR

Using a safety factor SF determined from the likelihood MIP is:

and consequence ratings,

MP = RL/SF For T = 20Smm, Tmin = lSmm, CR=O.2 mm/year, SF = 3, RL=27.5 years = 330 month MIP=RLI3=110 months

7380.01/99/1054.03 Copyright 0 200 1, The Welding Institute

Appendix

4 - Page 5