This Research Report is for the exclusive use of

subscribing members of The Welding Institute, and

its content should not be communicated to other
indivà duals or organisations without written
consent. It is in the interest of aH members to
respect this confidence.

February 2001 722/2001

Anîntroductîonto
risk based inspection
By J B Wintle

No embargo

Electronic copyright
in this document as follows:
Copyright O 2001, The Welding
Institute

TWI
E0
PDDH
’Ł The Weldiag lastitute, Granta rack, Great Abiagton
Cambridge CB1 6AL, United l'Liagdom
Telephone: +44 (0)1223 891162
’S0 Telefax: +44 (0)1223 892588
If
66
0f O The WeÎdiog Insütute 2001
8T
 AN INTRODUCTION TO RISK BASED INSPECTION

CONTENTS

TECHNOLOGY BRIEFING i

1. INTRODUCTION

1•1. MAC KG RO UND

1.2. OBJE CTIV ES

1.3. RELATED WORK 2

2. PRINCIPLES OF RISK BASED INSPECTION 2

2.1. RISK OF FAILURE 2

2.2. Risx BASED INSPECTION 3
2.3. CA USES OF STRUCTURAL FA I LURE 3

2.4. EFFECT OF INSPECTION ON THE RISK OF FAILURE 4

2.5. FU NC TION A L AND CONDITION INSPECTION 5

2.6. LINK WITH INSPECTION PRACTICES AND FITNESS-FOR-SERVICE

ASSESSMENT
5

3. RISK ANALYSIS 6

3.1. FU N DA M ENTALS 6

3.2. SYSTEM DEFINITION 6

3.3. HAZARD ID ENTIFICATIO N 7

3.4. PROBABILITY ASSESSMENT 7

3.5. CONSEQUENCE DNA LYSIS 7

3.6. Risx RESULTS 8

4. DEFINING THE PROCESS FOR RISK BASED INSPECTION PLANNING 8

4.1. ELEMENTS OF THE PROCESS 8

4.2. THE RBI TEAM 9

4.3. IN FORM ATION REQU IRED FOR RBI 9

7380.01/99/1054.03
Copyright0 2001, The Welding Institute
 AN INTRODUCTION TO RISK BASED INSPECTION

5. IMPLEMENTATION OF RBI 11

5.1. GEN ERAL APPROA CH 11

5.2. QUALITATIVE APPROA CHES 11

5.3. QUANTITA TIVE APPROA CH ES 12

5.4. WHO ICE OF APPROACH

5.5. PRACTICAL DIFFICULTIES AND IMITATIO N S TO IM PL EM ENTIN G RBI 13

5.6. RISKWISE AND OTHER SOFTWARE PACKAGES FOR RBI 14

T
5.7. ILLUSTRATION OF RBI USING RISKWISE “ AS A CASE STUDY 15

6. DEVELOPMENT OF THE INSPECTION PLAN 15

6.1. ELEMENTS OF THE PLAN 15

6.2. WHAT EQUIPMENT TO INSPECT* 16

6.3. THAT TYPE OF DAMAGE TO LOox FoR? 16

6.4. WHERE TO Loox FoR iT? 17

6.5. HOW TO FIND IT WITH SUFFICIENT RELIABILITY* 17

6.6. FEEDBAC K - )fOW GOOD WAS THE RBI ASSESSMENT* 18

6.7. WHEN NEXT - How OFTEN To Loox FOR DA MAGE* 18

6.8. OTHER ACTIONS APA RT FROM INSP ECTION 19

7. DISCUSSION OF RBI DEVELOPMENT 19

7.1. CURRE NT STATUS 19

7.2. DEVELOPMENT BY INDUSTRY 19

7.3. RESPONSE OF REGULATORY AU THOR ITIES 20

8. SUMMARY AND CONCLUSIONS 21

9. REFERENCES 22

APPENDIX 1: Background to API 581

APPENDIX 2: Qualitative Approach to RBI in API 581

7380.01/99/1054.03
Copyright0 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED INSPECTION

TECHNOLOGY BRIEFING

Several industries operating high integrity structures and equipment with safety
or financial dependence are considering planning in-service inspection on the
basis of the information gained from an analysis of the risk of failure. Risk based
inspection (RBI) is a structured approach to planning inspection, but many
mechanical engineers responsible for the integrity of industrial plant currently
only have a limited knowledge of what it entails. The objective of this report is to
help TWI members from all industries and regulatory bodies understand the
principles of risk based inspection and identify the essential elements required
for its implementation.

The risk of failure is the combination of the probability and consequences of its
occurrence. Inspection provides more information about the risk of failure
caused by structural deficiencies and the report discusses the effect that inspection can
have on the risk. The fundamentals of industrial risk analysis are summarised, and
the key elements of the process of risk based inspection identified.

Risk based inspection uses an analysis of the risk of failure for the development
of the inspection plan. The risk analysis identifies the credible types and causes
of structural failure and assesses the rate of degradation in relation to future
fitness-for- service. The report highlights the benefits from using a team and the
value that TWI’s experts can bring to the process.

The report describes the qualitative and quantitative approaches to risk analysis
that are being developed for implementation of RBI, and highlights some of the
difficulties that may limit its applicability. The process of RBI is illustrated by a
case study using the approach within the TWI software RISKWISETM.
Appendices to the report describe the background and approaches to RBI taken
by the American Petroleum Institute’s Base Resource Document for RBI (API
581). Although intended for application at oil refineries, API 581 illustrates how
risk based inspection is being addressed by a particular industry.

RBI requires the application of risk based principles to the development of the
inspection plan. The information generated by the risk analysis is used to
formulate what, where, when and how to inspect. Feedback from inspection into
the risk analysis and future planning is highlighted as an essential part of the
process.

The report discusses the development of RBI from the research by the American
Society of Mechanical Engineers (ASME) on risk based methods in the late
1980’s and subsequently by sectors of US industry. Interest by industry in the
UK and Europe is growing, and regulators are responding to developments to
make sure that safety is not compromised. Guidelines are being developed to
ensure consistent standards for risk based inspection, but there is a need for
comparative studies of the different approaches to identify best and common
practice.

The review concludes that when properly implemented, RBI is a good process
for developing an optimised scheme of inspection. RBI has the potential to assist
many industries to understand and manage the risks of failure better. In some
cases this may be a means to reduce or re-target plant inspections, but where
there is uncertainty, RBI may indicate a need for increasing inspection.
AN INTRODUCTION TO RISK BASED INSPECTION

7380.01/99/1054.03
Page i
Copyright O 2001, The Welding
Institute
1. INTRODUCTION

1.1. MAC KG ROUN D

In-service inspection of safety related welded structures has traditionally been

based on prescriptive industry practices backed up by health and safety legislation l 3
Statutory inspection is required for equipment such as pressure systems, lifting
appliances and offshore platforms. Locations, frequency, and methods of
inspection were based mainly on the type of the equipment rather than the
specific risk.

Until recently, there had not been much explicit regard to the threats to integrity
or the consequences of a failure. Written schemes of examination have
developed on the basis of industry experience. While these recognise the
contributors to risk, they are not normally based on a detailed risk assessment for
each component.

Industry is now appreciating the concepts of engineering risk4 and recognising

that benefit may be gained from better targeted inspection. This is now leading
some sectors of industry to consider setting inspection priorities on the basis of
the risk of failure5. This trend is supported by the wealth of plant operating
experience and data, an improved understanding of the material degradation
mechanisms, and the availability of fitness-for-service procedures.

At the same time, developments in non-destructive testing (NDT) technology

have increased the scope and efficiency of examinations that can be undertaken.
Inspection trials have produced a greater appreciation of the reliability of actual
NDT performance. These developments create a new challenge for inspection
planning to ensure that the effectiveness of examinations matches the
application.

Risk based inspection (RBI) is a structured approach to inspection planning.

Many mechanical engineers responsible for the integrity of industrial plant
currently only have a limited knowledge of what it entails and how it should be
implemented. TWI members would therefore benefit from having an
independent introduction to RBI.

1.2. OBJECTIVES

The aim of this Members’ Report is to help TWI members from all industries
and regulatory bodies understand the principles of risk based inspection and
identify the essential elements required for its implementation. Specific technical
objectives are:

(a) To assess the current status of RBI

(b) To provide a reference to essential elements of the methodology

(c) To illustrate approaches to its implementation

(d) To provide information about how risk based principles may be applied to
the development of the inspection plan
7380.01/99/1054.03 Page 1
Copyright0 2001, The Welding Institute
 The report will be of most use to mechanical engineers responsible for
inspection planning, but it will also be of interest to process and inspection
engineers, materials scientists, safety assessors and others involved in industrial
risk assessment.

1.3. RE LAT ED WORK

Particular reference has been made in this report to the Base Resource Document
for RBI published by the American Petroleum Institute, API 5816. This is one of
the best documented approaches within the public domain and is the model for
many customised approaches being developed by individual operating
companies and consultancies. The background to this document is described in
Appendix 1

Whilst API 581 relates primarily to the inspection of equipment at oil refineries,
it illustrates how the principles of RBI may be applied to a specific industry.
However, API 581 was written by and for the American petroleum industry with
the objectives of that industry for safety at minimum cost very much in mind.
The document is very long and only available from API at a relatively high
price, factors that would tend to reduce its general readership.

The number of articles on RBI in the technical journals is increasing, but most
have been written from an industry specific or commercial perspective. There
are as yet no generalised procedures or guidelines on how to undertake RBI, and
different industries and companies are tending to develop their own approaches.
This report is written from an independent standpoint for all TWI industrial
members.

This introduction to risk based inspection is part of the three year core research
project on different aspects reliability engineering. Other aspects covered within
the CRP project include the probability of fatigue damage and crack growth, the
frequency and distribution of welding defects, and the statistical treatment of
historical inspection data and reliability updating. Risk based inspection is a
process that draws on these and many other technologies.

2. PRINCIPLES OF RISK BASED INSPECTION

2.1. Risx or FAILURE

Failure of equipment is a defined loss of a specific functionality. For structural

equipment, failure often occurs as a discrete event, such the loss of containment
of a pressurised fluid or the fracture of a structural member under load. The
probability of failure of an item of equipment is the frequency with which the
specified failure event would be expected to occur in a given period of time,
normally one year, given a large population of items.

When assessing the risks from failure of equipment, a wide range of potential
consequences may need to be considered. There may be danger to the health and
safety of employees or of the general public, pollution and other damage to the
environmental, and business costs such as lost production, repair or replacement
of equipment, and loss of reputation. All these can be measured in different
ways.
Page 2 7380.01/99/1054.03
Copyright0 2001, The Welding Institute
 The risk of failure of an item of equipment combines the annual probability of
failure with a measure of the consequence of that failure. If these are numerically
evaluated, then the risk is defined as the product of the failure probability rate
(yr 1 ) and the measure of consequence. In this case, items may be ranked on the
basis of their relative risk of failure. There may be different rankings for
different measures of consequence.

Despite this definition, risk is often assessed qualitatively without this formal
factoring. In this situation, the risk is the combination of the qualitatively
assessed likelihood and the consequences of failure and is often presented as an
element within a likelihood-consequence matrix. (Within this report,
‘probability’ is used in connection with quantitative assessments whereas
likelihood’ is used in association with qualitative assessments of risk).

2.2. Risc BASED INSPECTION

Within this report, the term ‘inspection’ refers to the planning, implementation
and evaluation of examinations and/or testing to determine the physical and
metallurgical condition of equipment or a structure in terms of fitness-for-
service. Examination includes non-destructive testing such as ultrasonic testing
and radiography, but also covers visual surveys, replication, and material
sampling etc. Testing might include leak or pressure testing (for pressurised
components) or other test of functionality.

Risk based inspection is the development of an inspection plan on the basis of

the information obtained from an assessment of the risk of failure. It requires
assessments of the probability and consequences of failure of the equipment
being considered within the scope of the plan. The process identifies the
equipment having the highest risk of failure and enables criticality rankings on
the basis of risk to be made.

On its own, risk ranking is insufficient to define an inspection programme. It is

the information about the degradation processes and the threats to integrity
generated in the process that is of greatest value in developing an inspection
plan. The plan can not only target the high risk components, but can also be
designed to detect potential degradation processes before fitness-for-service
could be threatened.

2.3. CAUSES OF STRUCTURAL FA IL URE

Structural failure of a component can result from a number of causes. It may

result from the component being in a physically deficient state as a result of
material flaws and defects, damage or degradation. Component deficiencies may
be the result of inadequate design, manufacture or the degrading effects of
normal service conditions or as a result of other initiating events that lie outside
the design basis such as leaking valves or water chemistry excursions. Inspection
only addresses the risk of failure arising from deficiencies in the components at
the time of inspection.

Copyrig
7380.01/99/1054.03 ht O
2001, The Welding Institute
Page 3
 Within this report, material flaws and defects cover deficiencies introduced at
the time of construction such as welding defects and out-of-specification (e.g.
ovality). Damage refers to denting, gouging or events such as impact or fire.
Degradation processes take place over a period of time as a result of service
conditions and include corrosion, erosion, fatigue and crack growth.

Failures of components and equipment in a satisfactory condition can also occur

as a result of malfunction of equipment such as instrumentation, control systems
or critical utility supplies as well as from human factors and external events.
These causes and effects of failure are not addressed by the inspection of the
equipment. There are other measures that industry can take for managing and
mitigating the risks in these areas such as the use of diverse and redundant
engineering systems, protection systems, safety management plans and operator
training.

The process of risk based inspection (RBI) has beneficial effects in focusing
management action towards the prioritising of resources for risk reduction from
deficiencies in critical items of equipment. However RBI should be seen as being
part of an integrated risk management strategy that should address all causes of
failure. Access to reliable and up to date data on the failure of equipment from all
causes is a key requirement.

2.4. EFFECT OF INSPECT ION ON THE ASK OF FAILURE

The process of inspection only provides more information about the condition of
the equipment that may be better or worse or the same as previously estimated.
The inspection may have changed the prior estimate of the risk of failure, but the
actual risk remains the same. In order to change the actual risk, physical
intervention is needed in the form of a repair or replacement or some other kind
of mitigating action such as a change to the process conditions.

Increasing the level (coverage or detail) of inspection is claimed to progressively

reduce the risk of failure (assuming repair action is taken) to a point where the
failure risk lies outside the integrity of the equipment itself. Whilst this may be
true, the rate at which risk may be reduced by increasing inspection is more
problematic. Given that many failure mechanisms are generic, there is a
decreasing return on inspection in terms of risk reduction if a particular
mechanism is shown to be absent, or conversely, if there is widespread attack.
One hundred per cent inspection will only reveal non-generic failure
mechanisms such as accidental damage.

Inspection can have an effect on the probability of failure if it is the initiator for
actions to improve component integrity. The general health and safety principle
is to act to reduce the number of failures to as low as reasonably practical
(ALARP). Inspection can also have an effect on the assessment of the
consequences of failure if it excludes certain catastrophic types of failure (e.g.
global plastic collapse) or limits leakage to a certain size

Page 4
7380.
01/99
/1054
.03
Copy
right
O
2001
, The
Weld
ing
Instit
ute
2.5. FU NCT I ON AL AN D CON DITION INSPECTION

A distinction can be made between functional inspection (i.e. testing) and

condition inspection (physical or other examination of the fabric). Certain types
of functional testing (for example, over-pressure testing) are considered
beneficial, but their effect on the subsequent risk depends on the operational
conditions and degradation mechanism. Unlike functional testing, condition
inspection can rarely examine every area or volume, and the degree of coverage
becomes crucial. Quantifying the benefits of different types and regimes of
inspection on the probability of failure is an area where further work and insights
are possible.

There are many different methods for condition inspection ranging from simple
visual examination to sophisticated ultrasonic and electromagnetic techniques. In
order to be effective, the methods of condition inspection must relate to the type
and rate of deterioration and damage expected. Therefore, it is recognised that
risk based inspection must, in addition to prioritising the locations for inspection,
also address the techniques, reliability and frequency of inspection in relation to
the risk.

No single inspection method has been invented that can detect and characterise
every kind of defect or degradation. The inspection techniques employed should
therefore be matched to the type of damage to be detected. The need to inspect
should reflect the uncertainty in the knowledge of the current condition and rate
of degradation in relation to the required life. The inspection frequency is often
related to the lower bound to residual life as evaluated by a fitness-for-service
assessment, usually including some factor of safety.

Given that the technique has been optimised, reliability of the inspection for the
particular circumstances must be considered. The effect of inspection on the risk
of failure is directly related to the probability of detection of damage and defects
that would be of concern. The probability of failing to detect such deficiencies
also needs to be taken into account.

2.6. LINK WITH INSPECTION PRACTICES AND FITNESS-FOR-SERVICE ASSESSMENT

Recommended inspection practices (e.g. API) already exist for pressure systems,
piping, tanks and many other classes of equipment. Risk based inspection is
consistent and complementary to these practices. It provides a means to establish
priorities and frequencies where practices allow scope for engineering
judgement.

Assessment of the susceptibility to degradation and the rate at which this occurs
in relation to the tolerance for continued fitness-for-service (FFS) is a key
element of RBI. If degradation is detected by inspection, fitness-for-service
assessment is an alternative to plant repair. There is therefore a close link
between RBI and FFS assessment undertaken using codes such as BS 7910 and
API 579. A TWI Group Sponsored Project is being set up to develop this link
within a coherent framework.
7380.01/99/1054.03 Page 5
Copyright O 2001, The Welding Institute
3. RISK ANALYSIS

3.1. FU N D AM ENTALS

Before risk based inspection planning can commence, it is necessary to

undertake a risk analysis for the component, plant or installation within its
geographical and environmental context. There are recognised procedures for
risk analysis which generally consider a wide range of threats to integrity' 2. The
undertaking of a general risk analysis is a common statutory requirement. The
elements of a risk analysis are:

• System definition
• Hazard identification
• Probability assessment
• Consequence analysis
• Risk results
• Mitigation measures

Risk based inspection of equipment requires a reduced form of risk analysis

where the hazard arises from a single source, i.e. the effects of structural failure
arising from component deficiency.

In RBI, the probability of failure is assumed to be controlled by continuous

degradation mechanisms (detectable by inspection) and not by explicit external
events. The effect of local human factors by, for example, faulty operations or
maintenance may be included implicitly by an assessment of the management
systems. A risk analysis accepts that following the failure, the consequences can
be influenced by detection, isolation and mitigation measures and these should
be included in the risk analysis.

3.2. SYSTEM DEFINITION

The system definition first sets the goals and objectives of the risk analysis (e.g.
to assess the impact of inspection), the types of risk to be considered (e.g. financial,
health and safety, environmental), and the measures of acceptable/unacceptable
risk.

The physical and operational boundaries of the system are defined in terms of
the equipment to be considered as giving rise to a potential primary hazard, and
the associated systems and conditions that could influence the susceptibility to
failure. For ease of analysis the system may be sub-divided into groups of
equipment with common operating conditions, failure probability, or failure
consequence. The system boundary extends as far as may suffer the
consequences of failure. In some cases this will include the whole company,
surrounding areas and population.
Page 6 7380.01/99/1054.03
Copyright O 2001, The Welding
Institute
3.3. HAZAR D IDENTIFICATION

A hazard is a situation or an event that may lead to undesirable consequences.

Different approaches to industrial hazard identification have been developed l 3.
These include:

• HAZOP (hazard and operability) studies - a team based brain-storming

exercise

• Failure modes and effects analysis (FMEA) — an inductive ‘what happens ir

analysis at the component level

• Fault tree analysis — a deductive approach that focuses on identifying the

ways of how undesired consequences can be caused.

• Checklists — simple to apply in standard situations but may miss unique

hazards.

For pressure equipment and containments, the primary hazard is assumed to be a

breach of containment causing a release from the system and into the
environment of contents that may be energetic, toxic, explosive, corrosive or hot.
Understanding the underlying causes of the hazard and its effects in creating
further chains of events (e.g. damaging other equipment) is a key part of the
process.

5.4. PROBABIL FTY ASSESSMENT

In a risk analysis to evaluate plant safety, the probability assessment calculates

the frequency of a certain undesirable final outcome from the frequencies of
different initiating events such as a structural failure. Where there can be a range
of outcomes with different degrees of uncertainty resulting from a single
initiating component failure, the component failure frequency is multiplied by
the probability of each outcome. Failure frequencies are usually based on
historical data for a broad generic class of components (e.g. piping) rather than
being specific to the plant since the motive is often to compare plant risks and
identify weaknesses in the system design.

The use of generic failure data may not be sufficient on its own as a measure of
the probability of failure of a specific component. The effect of the local
conditions and actual degradation mechanisms need to be taken into account to
determine the failure probability of that component. The main purpose of the risk
analysis is to provide information for planning component specific inspections.

3.5. CONSEQ U ENC E A LYSIS

Consequence analysis depends on the nature of the hazard. For process

equipment containing noxious substances, the consequence analysis will require
assessments of the discharge rate, dispersion, and the chances of flammable and
toxic effects on the work force, local population and environment. For high-
pressure plant, the consequences analysis will assess the effects of high velocity
jets, pipe whip, explosion and missiles on surrounding plant systems, and the
ultimate impact on plant safety and operation.
7380.01/99/1054.03 Page 7
Copyright O 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED INSPECTION

The process of risk based inspection is an integrated part of a more general

policy of risk analysis for maintaining health and safety and managing industrial
assets. Hazard analysis, safety management and quantitative risk assessment
extend well beyond risk analysis for RBI but provide an input to it.

3.6. Risx RcSULTS

Various measures for quantifying human risk are available including the fatal
accident rate, average and maximum individual risk and individual risk contours.
A distinction can be made between individual (e.g. worker) and societal (e.g.
local population) risk. Individual risk measures consider the risk to individuals
who might be located normally within the effected zone. Some risk measures
apply to groups of people around the zone.

The risk of lost production and the replacement of damaged equipment can be
quantified in terms of the average money lost per year as a result of failures.
Risks to the environment involve clean-up costs and may cause long term
damage to a company’s reputation and trading position.

4. DEFININc TnE ROCESS FOR RISK BASED INSPECTION PLANNING

4.1. EL EM ENTS OF THE PROCESS

The key steps in the process of risk based inspection planning are:

(a) Formation of the RBI assessment team

(b) Definition of equipment considered within the programme of planned

inspection

(c) Determination of the applicability of risk based inspection

(d) Identification and gathering of the information necessary to carry out the risk
assessment

(e) Identification of credible types and causes of failure for each unit/component

(Q Assessment of the expected rates of degradation mechanisms and the

probability
of failure

(g) Assessment of the consequences of failure in terms of safety of personnel,

loss of production, damage to plant environment etc

(h) Risk ranking of each unit/component or placement in a risk matrix

(i) Development of the inspection plan defining the inspection scope, methods,
reliability and interval in relation to risk and fitness-for-service

(j) Feedback of information from the inspection and review of RBI assessment
AN INTRODUCTION TO RISK BASED INSPECTION

Page 8 7380.01/99/1054.03
Copyright O 2001, The Welding Institute
 AN INTRODUCTION TO RISK BASED INSPECTION

The process is based around an assessment of the risk of failure for each
unit/component and the development of an appropriate inspection plan. An
important part of the process is the identification of the credible types and causes
of failure and the assessment of the rate of degradation.

4.2. THE RBI TEAM

The use of a risk based approach for planning inspection may be carried out at
different levels ranging from the selection of particular welds to decisions about
entire refineries or plants. API 581, for example, is broadly based and considers
risk consequence in the wider company, societal and economic context. As a
result, a wide range of sources of information is needed for the RBI risk analysis
including financial and management.

The implication of this is that a RBI study would normally need to be carried out
at a reasonably senior level within a company. It would be unlikely that anyone
below say the level of an engineering manager would have access to the
information and expertise required and the capacity to integrate it and take
decisions. The range of information required also implies that for complex
installations, a multi-disciplinary team is needed to carry out a RBI study.

The team needs to be able to draw on the expertise of competent individuals with
knowledge of process hazards, risk assessment, materials degradation and
inspection techniques, plus staff with plant specific knowledge of maintenance
and inspection, plant operation and process conditions. The use of independent
agencies such as engineering insurers and external experts within the process
may be vital to ensure that judgements are made which reflect the understanding
and practice across an industry sector.

4.3. IN FORMATION REQUIRED FOR RBI

Risk analysis for inspection planning requires a wide range of information to be

considered. In general, the process brings together four categories of
information.

(a) Design specifications

(b) Historical plant operating data
(c) An assessment of consequences of failure
(d) An evaluation of failure probabilities

The relationship between these categories within the process of risk-informed

inspection is shown in the figure below.

7380.01/99/1054.03 Page 9
Copyright O 2001, The Welding Institute
 Failure Probability

Evaluation

Historical Design
Plant data Inspection Specifications
Programme

Consequence
Assessment

Fig.1 Information requirements

Following inspection, the results feed back into the historical database and may
be used in planning further examinations. The information (deterministic or
statistical) within each category depends on the approach adopted, but may
include:

(a) Design Specifications

• Defined boundaries of plant items to be considered for inspection planning

• Design and manufacturing records
• Deterministic design stress and fatigue analysis

(b) Historical Plant Data

• Operational transient and condition monitoring data

• Plant failures and service experience data
• Pre-service and in-service inspection records
• Environmental conditions, temperatures, water chemistry and flow rates
• In-service degradation assessments (fatigue, SCC, erosion-corrosion)

(c) Consequence Assessment

• Design safety class categorisation

• Detailed assessment of consequences
• Failure modes and effects analysis
• Cost analysis of component failure
• Probabilistic safety assessment (PSA)

Page 10 7380.01/99/1054.03
Copyright O 2001, The Welding
Institut
e
AN INTRODUCTION TO RISK BASED INSPECTION

(d) Failure Probability Evaluation

• Expert assessments of the failure probability

• Generic component failure rates
• Component specific failure rates
• Size distributions and probability density of defects
• Distributions of material properties and degradation rates
• Full analysis of probability of failure
• Probability of detection versus flaw size curves
• Actual flaw sizing versus measured sizing data

Circumstances will dictate the availability and accessibility of this information.

5. IMPLEMENTATION OF RBI

5.1. GEN ERAL AP PROA CH

Very little advice is available on how a RBI study should be implemented.

Guidance is needed to underwrite the integrity of the process and the quality of
information used and judgements made. At present, companies and consultancy
organisations are developing their own schemes of risk analysis for RBI.

5.2. DUAL ITATIV E APPROACHES

In a qualitative approach to risk based inspection, the two elements forming the
risk, the likelihood and the consequences of failure are subjectively assessed
within descriptive categories (high, medium or low) or given a scoring on a
arbitrary scale. Risk is presented as the combination of failure likelihood and
consequence within the cells of a likelihood-consequence matrix (below).
Components with the same likelihood-consequence combination can be grouped
together in a common risk cell.

Likelihood-consequence risk matrix

Catastrophic High Medium Low

Negligible

IncredibleVery unlikely Unlikely Possible Probable

Likelihood

7380.01/99/1054.03 Page 11
Copyright O 2001, The Welding Institute
 A five by five matrix is commonly used as shown above. The axes may have a
linear or logarithmic scale or no scale at all. For this reason care should be
exercised when interpreting relative positions within the matrix since they
invariably have limited significance.

Similarly, blocks of cells purported to have the same risk (usually shown by
shading as above) should also be treated with caution. Risk is the product of
likelihood and consequence and on a linear scale, risk contours are hyperbolae.
On a logarithmic scale, the risk contours are straight lines, and risk ranges are
strips across the matrix.

Ways of assessing the likelihood and consequences of failure may vary

according to the approach. Sometimes an expert panel is used to make subjective
judgements after discussing the issues. This is a good approach that relies on the
broad engineering knowledge and experience of the panel, but can be lengthy to
apply.

Other approaches are based on a scoring system from answering sets of

questions relating to the probability and consequences of failure. This is the
approach adopted by API 581 (see Appendix 2), RISKWISE and several other
proprietary schemes. Whilst easy to apply, these approaches tend to restrict
wider assessment of the risks.

The qualitative approach generally requires only a limited amount of

information. It is of most value in comparing the relative risks of equipment on a
global scale.

5.5. @UANT I TA TIVE APPROACH ES

Quantitative approaches to risk based inspection aim to quantify the failure

probability rate and the measure of consequence as actual numerical values. The
risk may then be expressed as a single number being the product of the
calculated failure probability rate (yr ') and the measure of consequence. In this
case, a criticality ranking of the components can be made in order of the
evaluated risk.

The quantitative approach requires detailed process and mechanical information

and is backed by calculations to determine numerically the failure probability
and consequential losses. Reliability analysis can be used to determine the
probability of failure from specific mechanisms such as fracture if the
distributions of the controlling variables are known. The approach has the
disadvantage that it is often difficult to substantiate the distributions of material
properties, defects or loads.

The approach taken in API 581 (see Appendix 3) is to use published failure rates
for generic classes of equipment (e.g. pumps, valves, vessels, etc) as a basis for
the probability of failure. The generic rates are then modified by factors designed
to take account of the specific circumstances of the equipment and the
management at the plant. Allowance is made for a very wide range of factors that
could have a bearing on the probability and consequences of failure. The
approach is information intensive and lengthy to apply.
Page 12 7380.01/99/1054.03
Copyright O 2001, The Welding Institute
5.4. CHO lC E OF AP PRO AC H

The choice of either a qualitative or a quantitative approach is based on the level

of detailed information available and cost reward in terms of reduced risk or
inspection costs. The nature of the simpler qualitative approach is that it can only
act as an indicator of risk, and does not constitute a risk assessment. As a tool its
best use is as quick screening method that can be used to identify the areas of
highest risk and prioritise them for more detailed exercises.

The costs of undertaking a detailed quantitative analysis must, however, to be

weighed against the potential benefits. For instance, if only half the total risk of
loss can be attributed to mechanical failure, even a quantitative risk based
inspection programme cannot mitigate all events. This limitation, combined with
the difficu1ties in finding correct data for all quantitative inputs, implies that
under many circumstances there may be little cost reward for undertaking a full
quantitative analysis. Unless such an exercise has other benefits apart from
driving inspection needs, it is difficult to envisage situations where such a
detailed and expensive exercise would as a first step be worthwhile.

For most plants and situations, it is likely that a RBI would be implemented in a
phased manner. When a company is moving from traditional inspection
programmes to one driven by a RBI risk analysis, the most significant benefit
can be gained by first undertaking a qualitative assessment at a component level.
Once this is achieved, then a cost-benefit analysis can be undertaken to
demonstrate whether a more thorough quantitative analysis would be beneficial.

5.5. BRAC T ICAL IFFIC ULT IES AN D LIM ITATIONS TO IM PLEM ENT ING RBI

Although risk based inspection is an attractive approach to planning inspection

that can lead to improved knowledge of significant risks and reduced inspection
costs, there are a number of factors that may, in practice, make RBI difficult to
implement. These factors may limit the extent and rate at which RBI can be
applied. Regulators will need to ensure that these factors have been adequately
addressed.

The first factor is time. A significant amount of staff time is needed to undertake
the process systematically and effectively. Assessment of the risk, development
of an appropriate inspection plan, and feedback of results will generally take
longer in terms of elapsed time than prescriptive inspection schemes.

The allocation of adequate financial resources up front into the risk assessment
and inspection planning phases may be another difficulty in some companies,
especially if the return of reduced inspection costs cannot be guaranteed. In
addition to the costs of the key internal staff, there may be extra costs associated
with the use of competent persons and external consultants, and also with the
gathering and analysis of information. RBI may lead to a requirement for the use
of demonstrably more reliable inspection in some areas, and there may be
additional costs of new procedure development, operator training and inspection
qualification.

Copyright
7380.01/99/1054.03
0 2001, The Welding Institute
Page 13
AN INTRODUCTTON TO RISK BASED INSPECTION

The availability and access to the information required for assessing the risk are
further factors that may limit RBI. Of particular importance are the records of
design and manufacture, the histories of previous operation and inspection, and
knowledge of the operating conditions and environment and their effects. Lack
of this information increases the uncertainty and hence the potential risks. An
early inspection to determine the actual condition is then usually necessary.

Analysis of consequences arising from failure modes and effects can be a

lengthy task in complex installations, particularly where there is the possibility
of failing other equipment and setting off a sequence of damaging events. In
such instances there may be need for probabilistic risk assessment and more
sophisticated methods of analysis. The effects of fire and explosion, or the
dispersal of toxic releases into the environment can be difficult to predict.

A significant difficulty of qualitative and semi-qualitative approaches is that the

assessment of risk is subjective and will tend vary from company to company. A
problem for regulators is how to judge the adequacy of individual approaches
when there are no industry standards or benchmarks. This problem may ease
with experience, but in the shorter term there is a need for research projects
comparing different approaches to risk assessment and ranking.

5.6. RISKWISE AND OTHER SOFTWARE PACKAGES FOR RBI

TWI has developed its own software package for RBI called RISKWISE. The
risk model is semi-quantitative based on a scoring system from answering sets of
questions relating to probability and consequences of failure for each component.
The questions are designed to identify the active degradation mechanisms and
the rate of degradation for each component from a database containing
information about a wide range of mechanisms.

The effectiveness of past inspections to detect and size degradation is taken into
account by allowing for the uncertainty in the current condition in the probability
of failure. The change in the risk of failure with time dependent mechanisms
provides a basis for establishing the maximum period between repeat
inspections. RISKWISE has a focus/defocus facility that enables the RBI team to
review the effect of various consequence mitigating and inspection actions on the
risk profile.

RISKWISE is an intuitive tool that helps the RBI team produce a relative risk
ranking and plan the period to the next inspection for each item of equipment. Its
scoring and question system is easily customised to specific user requirements.
The data is stored for future reference within the cycle of inspection planning.

RISKWISE is available for TWI Industrial Members to use on their own.

Greatest value is obtained when it is used with TWI experts as part of the RBI
team. TWI’s expertise and experience covers many aspects of the RBI process
including:

• identification of degradation and failure mechanisms and rates;

• quantification of failure probability (FORM, MONTE);

Page 14
 AN INTRODUCTTON TO RISK BASED INSPECTION

7380.0
1/99/10
54.03
Copyr
ight O
2001,
The
Weldi
ng
Institu
te
AN INTRODUCTION TO RISK BASED INSPECTION

• selection of appropriate and reliable inspection strategies and methods;

• engineering critical assessment

A number of other software packages are also available to assist the assessment
of the risk and the risk ranking of components. Designed mainly for use in the
petrochemical industry, these packages include:

• Tischuk system (applicable to piping systems)

• PACER
• DNV system (software in support of API 581)

Several operating companies including ESSO and Shell Global Solutions have
developed their own proprietary systems. TWI has not yet had the opportunity to
evaluate or compare any of these. Information about them and must be obtained
from their suppliers.
T
5.7. ILLUSTRATION OF RBI SING RISKWISE “ AS A CASE STUDY

Appendix 4 gives an example of the implementation of RBI for a group of five

items of equipment from a platformer unit in an oil refinery. The risk of each
item is assessed using the semi-qualitative approach within the TWI software
RISKWISE T“. After gathering relevant information into a database, the software
prompts the user to select from a given list the most appropriate answers to a
series of questions relating to factors influencing the likelihood and
consequences of failure.

The example shows that individual items of equipment within a unit of plant can
have different degradation mechanisms operating at different rates. These lead to
differences between the residual lives of the items and hence the likelihood of
failure within a given timescale. The user can then identify the highest risk items
in the unit and those with the shortest residual lives.

The software determines a recommended interval to the next inspection for each
item based on the residual life proportioned according to the level of risk. Items
predicted to wear out first and of high risk would be inspected before and at
greater frequency than items with a longer life and low risk. When the degraded
condition is such that fitness for service criteria cannot be met, the item can be
replaced.

6. DEVELOPMENT OF THE INSPECTION PLAN

6.1. EL E MENT S OF THE PLAN

Having estimated the risk for each piece of equipment, and ranked the
equipment in risk order or in a risk matrix, the next step is to decide how to
direct the inspection effort so that the total risk may be reduced. The equipment
with the highest risk may be because the consequences of failure are so severe or
because the failure probability is high. A high failure probability may result
either because the
AN INTRODUCTION TO RISK BASED INSPECTION

7380.01/99/1054.03 Page 15
Copyright O 2001, The Welding Institute
 equipment is known to have suffered degradation or because the condition is not
known but could reasonably have been expected to suffer degradation.

The inspection plan for each item of equipment can be developed systematically
from the information generated in the RBI process by identifying:

• What equipment to inspect

• What type of damage to look for
• Where to look for it
• How to find it with sufficient reliability (what inspection technique)
• How good was the RBI assessment
• When next (how often) to look

6.2. THAT E9UIPMENT TO INSPECT*

There is always an argument for directing inspection effort at those items of

equipment assessed as having the highest risk. For high failure consequence
equipment, even if its condition is believed to be satisfactory, some amount of
inspection is generally appropriate and is a normal regulatory requirement.
Speculative inspection of this kind may reveal unexpected degradation or
damage and generates confidence in the robustness of the design and
manufacturing process.

Otherwise, inspection is likely to be of most benefit for those higher risk items of
equipment whose condition is least certain. Uncertainty may arise from a lack of
knowledge of the design, fabrication or operating history, or because the
operating conditions or environment are not well known, or because the
combination of these factors in causing damage is not well understood.

There is a temptation not to inspect any items of equipment whose failure is

assessed to be of low consequence and to allow poor condition to be revealed by
failure. This may not only be false economy, but also is not consistent with good
safety practice and plant management where the number of failures should be as
low as reasonably practicable (ALARP). An inspection of some low risk items
may reveal a generic problem that may have importance for the whole
population.

6.3. WHAT TYPE OF DAMAGE TO LOox FOR?

The RBI process will have identified which damage mechanisms are potentially
present. Further information may be available from the equipment’s history and
previous inspections. API 581 provides a description of different damage types
and the mechanisms that may result in such damage, and an extension of this list
is planned in the forthcoming document API 571 (Damage Mechanisms of
Petrochemical Plant).

Given a damage mechanism is postulated, it is necessary to evaluate the

tolerance of the equipment to such damage in terms of its future fitness-for-
service. A level of tolerable damage may be defined and used as a basis for
detection and reporting within the inspection procedure. A factor of safety
between the inspection reporting
Page 16 7380.01/99/1054.03
Copyright O 2001, The Welding
Institute
AN INTRODUCTION TO RISK BASED
INSPECTION

level and the maximum tolerable damage for fitness-for-service until the next
scheduled inspection is generally appropriate.

6.4. WHERE TO Loox FoR IT?

Damage may occur uniformly throughout a piece of equipment or it may occur

locally depending on the global and the varying local conditions. Uniform
damage can be detected at any convenient location on the equipment and its
results can be expected to be representative of the condition elsewhere. Specific
factors such as the presence of welds, geometric stress concentrators, crevices
for corrosion or cyclic loads will direct the inspection to particular locations. The
absence of damage in these areas reduces the expectation of damage occurring in
less susceptible areas elsewhere.

In other cases, such as pitting corrosion, the site of local damage may not be so
clear, and a more general search of a larger area may be needed. The chances of
detecting damage depend on the damage density and variability compared with
the size and validity of the inspection area. Quantification of these factors, whilst
possible, is generally outside the scope of a RBI assessment and simple
qualitative judgements of the area to inspect are usually made. Failure to detect
damage reduces but does not eliminate the chance of it being present.

6.5. HOW TO FIND IT WITH SUFFICIENT ML IABIL ITY*

Inspection techniques vary in their effectiveness to detect different types of

damage, and the effectiveness can also be influenced by the mechanism causing
the damage. The selection of an appropriate inspection technique is therefore
based on its ability to detect the type of damage for the mechanism that might be
present from the RBI assessment. Some general guidance on the selection of an
inspection technique for some damage types is given in API 581, but the
effectiveness of any technique depends as much on the specific geometry and
material of the application. In order to obtain high reliability a combination of
techniques is sometimes necessary. Companies such as TWI that have studied
inspection effectiveness can offer advice on the optimum choice of techniques
and procedures for a given inspection situation.

The sensitivity of the detection capability of inspection techniques to situation

and human factors is continuing to receive attention following the results of
various test piece trials (PISC, PANI, Nordtest). The detection capability can be
quite different in the field to that measured in the laboratory. This capability is
expressed as curves of probability of detection versus flaw size that may be
derived experimentally or theoretically. In a full risk based inspection plan, the
probability of detection will be taken in to account in relation to the extent of
damage that needs to be detected.

If damage is detected, a second phase is to characterise and size the damage for
fitness-for-service assessment or repair action. Different inspection techniques
for characterisation and sizing may be necessary. The reliability of this phase has
also

Copyright
7380.01/99/1054.03
 AN INTRODUCTION TO RISK BASED
INSPECTION

0 2001, The Welding Institute

Page 17
AN INTRODUCTION TO RISK BASED INSPECTION

been examined in tests and analyses where the results are expressed in terms of
curves of NDT measured size versus actual size.

Even if no damage is detected, the limits and variability of inspection

performance implies there is still some probability of damage being present after
an inspection. There is also the possibility that the real extent of damage may not
be revealed by the inspection or that defects detected are undersized. Since
manual inspection is a subjective process, there can be value in repeating the
inspection and introducing diversity and redundancy and also by making use of
automated techniques.

The value of repeat inspections in decreasing the probability that the true
condition of the component inspected is worse than that observed depends on the
assessed effectiveness of the inspection. This requires knowledge of the
probabilities of detection or sizing and the prior expectation of different levels of
damage from the RBI assessment. Bayes theorem provides a method for
inspection risk updating depending on the number of inspections carried out. In
this instance, increasing the amount of inspection can reduce risk, although there
is a decreasing rate of return7.

6.6. FE E DBAC K - How GOOD WAS THE RBI ASSESSMENT*

After the inspection has been carried out and the results made available, there is
a further stage of evaluating the results against the predictions of damage made
in the RBI assessment. Variations, particularly where the damage was more than
had been assessed, need to be taken into account and further investigation of the
reasons may be necessary. Further inspection of other areas may be required to
quantify the extent of the damage.

Other steps to reduce the rate of damage in future might be taken such as
changing the process conditions. Fitness-for-service evaluations or repair actions
will be carried at this stage. The risk analysis will then be updated taking the new
information into account and the period to the next inspection decided.

6.7. WHEN NEXT - How OFTEN TO LOOK FOR DAMAG E*

Setting the period between inspections on a risk basis depends on the following
four factors, and in particular the uncertainty associated with each factor.

• Damage types and mechanisms that could be present or initiate in future

• The rate of damage progression
• Tolerance of the equipment to damage for fitness-for-service
• Probability of detection and sizing

The best estimate rate of damage progression and the tolerance of the equipment
to damage define an average residual life. The inspection period may be simply
taken as some fraction of this life considering appropriate conservative bounds to
the uncertainties on rate and tolerance. A more complex approach is to re-
estimate the rate of damage through life based on inspection results and to update
the residual life and probability of failure depending on whether damage is
occurring at a high
AN INTRODUCTION TO RISK BASED INSPECTION

Page 18 7380.01/99/1054.03
Copyright 0 2001, The Welding Institute
 or low rate. The reliability that may be placed in the results of the inspection then
plays a key part in the judgement of the next inspection period and residual life.

There is an argument that repeat inspections increase the probability of detection

of the actual damage state. This argument forms the basis of inspection updating
but assumes that detection by inspection is a random process. The extent and
conditions to which this assumption is true in practice is an area for further
discussion.

6.8. OTH ER ACT ION S APART FROM INSPECT ION

Inspection only provides new information about the physical condition of the
equipment and therefore only affects the estimated failure probability,
particularly in cases where there is prior uncertainty. In order to change the
actual failure probability and hence the actual risk, some active intervention such
as repair or replacement of the equipment is required. Other actions than
inspection may have a greater effect in managing or reducing the probability of
equipment failure, such as improved operator training or process control. These
should also be outcomes from the RBI process.

7. DISCUSSION OF RBI DEVELOPMENT

7.1. CURRENT STATUS

There is increasing interest in risk based inspection by different sectors of

industry and their regulators. Industry sees RBI as a way of making better use of
inspection resources and, where appropriate, of reducing the amount of
inspection by extending run lengths and focusing inspection on the areas with
highest risk. In order to justify less inspection, RBI makes increased demands for
information and analysis, and regulators are keen that the process of RBI is
carried out rigorously.

7.2. OEVE LOPM ENT Bv INDUSTRY

In 1985, the American Society of Mechanical Engineers formed a Risk Analysis

Task Force in response to a perceived need to initiate the use of risk based
methods in the formulation of policies, codes and standards for engineering
equipment and structures. At the suggestion of that task force, a research
programme was established to determine how risk based methods could be used
to set inspection requirements and guidelines for systems and components of
interest.

A RBI Research Task Force of recognised experts from a broad range of

industries begun work on the programme in 1988. Initial support was from the
Nuclear Regulatory Commission (NRC) and the National Board of Boiler and
Pressure Vessel Inspectors. Later support was received from the Pressure Vessel
Research Committee, the Welding Research Council, American insurers,
Hartford Steam Boiler and API.

In 1991, the Task Force published a general document as Volume 1 of a set of

guidelines'. Supplementary volumes would address the specific needs for the
7380.01/99/1054.03 Page 19
Copyright0 2001, The Welding Institute
 inspection of nuclear power plant (Vol.2), fossil power plant (Vol.3), aircraft
structures (Vol.4) and marine and civil structures (Vol.5). In parallel with the
continuing work of ASME, the American Petroleum Institute established a
project that would lead to guidance applicable to the refinery and petrochemical
industry that was to become the Base Resource Document API 581.

The US nuclear industry has implemented the guidelines for RBI into codes and
practice through work carried out by the Westinghouse Owners Group (WOG)
and the Electrical Power Research Institute (EPRI). This has led to the
publication of code cases 577 and 578 to ASME X1 allowing RBI for piping and
the pilot applications at the Surry and Arkansas nuclear power plants. Keeping
pace with these developments, the NRC published Trial Regulatory Guide 1.178
recognising the use of risk informed decision making for the in-service
inspection of piping.

Following the publication of API 581 as a preliminary draft, various companies

within the petrochemical refinery industry have undertaken pilot studies 9’'0. Risk
based inspection is being recognised as an option within the industry inspection
codes such as API 510 (pressure vessels), API 570 (process piping) and API 653
(storage tanks). In October 1999, API published Recommended Practice for Risk
Based Inspection (API 580). This is intended to clarify the elements of a RBI
analysis rather than single out any specific approach.

Within its Post Construction Code Committee, ASME has set up an inspection
planning sub committee to develop a more generic standard for risk based
inspection planning. This will be applicable to a much wide range of pressure
equipment. It is expected to take several years to develop.

Interest in risk based inspection amongst UK and European companies has been
growing in recent years, although there has not been the same scale of national
effort as in the USA to provide a research base for regulatory guidance and codes
and standards. TWI recognised the need for research action on behalf of its
members in 1997 and this will continue within the core research programme.
Individual companies are assessing the benefits of applying RBI. Reference 3
gives some examples from the petrochemical and power industries.

Proposals for European co-operation in the field of risk based inspection for non-
nuclear equipment are being made under the EC Fifth Framework Programme
and there is interest from the European Pressure Equipment Research Council
(EPERC). The CEC Joint Research Centre at Petten is co-ordinating the activity
within the European nuclear industry through the ENIQ network EURIS, while
individual nuclear utilities are examining the possibilities.

7.3. SPON SE OF REGU LATORY AUTHORITIES

Regulatory authorities are assessing the effect on safety of operators altering

current inspection regimes and implementing schemes of inspection based on
risk analysis' '. These schemes are tending to propose extended run lengths
between inspections and reduced intrusive inspection. So far, the practice of RBI
is still

Page 20
 7380.0
1/99/1
054.03
Copyri
ght0
2001,
The
Weldi
ng
Institut
e
 being developed and there is insufficient failure data available to draw any
definitive conclusion. If implemented properly RBI should have a beneficial
effect on safety since there will be a greater chance that component deficiencies
will be detected before failure.

The UK Pressure System Safety Regulations already allow flexibility for duty
holders to use risk based principles in the preparation of written schemes of
examinations. However, there is considerable variation in the level and degree of
detail of risk based schemes that are being presented. Guidance on risk based
inspection for pressure systems and containments is being developed for the
Health and Safety Executive by TWI and Royal SunAlliance Engineering.

In the Netherlands, a co-operative project has been organised by KINT (the

Dutch Quality Surveillance and NDT Society) and PMP (Project Office for
Research on Materials and Production) to assess whether and how risk based
inspection can be incorporated within Dutch regulations. The project will
formulate conditions that have to be met for the application of RBI by Dutch
industry to be acceptable. It is based around a methodology developed by KINT
for the setting of inspection periods. The project commenced in 1997 and was
due for completion late in 1999. The provisional conclusions and
recommendations are now available from TWI.

8. SUMMARY AND CONCLUSIONS

The main points from this introduction to risk based inspection are:

(a) Risk based inspection is a good process for developing an optimised scheme
of inspection with the potential to assist many industries understand and
manage the risks of failure better.

(b) Risk based inspection is a process for developing a plan of inspection based
on the information obtained from an analysis of the risk of failure. It can be
applied to any equipment where inspection is used to manage the risk of
failure arising from damage, defects or degradation.

(c) The risk analysis requires an assessment of the causes, likelihood and
consequences of failure. This may be done qualitatively or quantitatively. A
wide range information is needed, particularly for complex installations

(d) In order to assess the likelihood of failure, it is necessary to identify the

potential degradation mechanisms, estimate the rates of degradation, and
evaluate their effect on future fitness-for-service.

(e) Risk based inspection is an activity that is best undertaken by a multi-

disciplinary team. The process is well defined although there is scope for
considerable variation in its implementation. Several software packages
designed to assist users assess the risk of failure are now available.

Institute
7380.01/99/1054.03
Copyright O 2001, The Welding
Page 21
 (f) The risk analysis is used to identify the components having the highest risk
of failure and those where potential degradation could threatened fitness-
for- service.

(g) The information from the risk analysis is used to formulate what, where
when and how to inspect. Inspection can have most effect on the estimated
risk in situations where there is prior uncertainty. However, it can only be
beneficial if the inspection methods, procedures and performance are
effective and reliable.

(h) Feedback of the results from inspection into the risk analysis is an essential
part of the process. This may highlight the need for additional risk mitigation
measures.

(i) Risk based inspection can be applied by any industry where the inspection of
high integrity and safety related plant and equipment is a priority. The US
petrochemical and nuclear industries have led the development of RBI. There
is now a need for guidelines to ensure that RBI is applied consistently.

(j) Risk based inspection may be a means to reduce or re-target inspection, but
may also indicate a need to increase inspection in situations where there is
uncertainty.

9. REFERENCES

1 Anon: ‘A guide to the pressure systems and transportable gas containers

regulations’, Health and Safety Executive, published by HMSO, ISBN 0-11-
885516-6, 1990.

2 Anon: ‘Safety of pressure systems approved code of practice’, Health and

Safety Executive, published by HMSO, ISBN0-Il-885514-X, 1990.

3 Anon: ‘Guidance on the periodicity of examinations’, Safety Assessment

Federation (SAFED), ISBN 1-901212-106, 1997.

4 Anon: ‘Extending run lengths of existing pressure equipment’, Proc of

IMechE Pressure Systems Group Seminar, London, October 1997.

5 Warner F et a1: ‘Risk analysis, perception and management’, The Royal

Society,
1993.

6 Anon: ‘Base resource document on risk based inspection’, American

Petroleum Institute Publication 581, 1996.

7 Chapman V and Booth A: ‘A statistical approach to the analysis of ISI data

using the Bayes method’, Paper D1/7, 7" SMIRT Conference, Chicago, 1883.

8 Balkey K R: ‘Risk based inspection — development of guidelines’, ASME

publication CRTD 20-1, 1992.

Page 22
7380.0
1/99/1
054.03
Copyri
ght O
2001,
The
Weldin
g
Institut
e
 9 Reynolds J T: ‘The application of risk based inspection methodology in the
petroleum and petrochemical industry’, ASME PVP Vol.336, 1996.

10 Carter W J, Hsiao C P and Ayyub B M: ‘A robust risk based inspection

procedure for the petrochemical industry’, ASME PVP, Vol.288, 1994.

11 Mainstream Research Market 1998/99, Health and Safety Executive, Published

by HMSO, 1998.

12 AlChE/CCPS: ‘Guidelines for chemical process quantitative risk analysis’,

Centre for Chemical Process Safety, American Institute of Chemical Engineers,
New York, 1989.

13 AlChE/CCPS: ‘Guidelines for hazard evaluation procedures’, Centre for

Chemical Process Safety, American Institute of Chemical Engineers, New York,
1985.

7380.01/99/1054.03 Page 23
Copyright O 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED
INSPECTION

APPENDIX 1

Background to API 581

7380.01/99/1054.03
Copyright O 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED INSPECTION

APPENDIX 1
BACKGROUND TO API 581

In May 1996, the American Petroleum Institute published the preliminary draft
of a ‘base resource document on risk based inspection’, API 581. The document
was written as a research report of a project for the API Risk Based Inspection
Sponsor Committee under the Committee on Refinery Equipment. Twenty-six
companies (mostly American oil and petroleum majors) sponsored the project.
The project was let to Det Norske Veritas who largely undertook the work on
behalf of API.

The document in the public domain is a preliminary draft. The validity of the
information and methods presented is a matter for each user to evaluate. Much as
it is subjective and judgemental, and experience is showing that many users are
using API 581 a basis from which to develop their own approaches.

API 581 has been produced through the American Petroleum Institute and is
intended for use within American regulatory and industrial practice. It relates to
plant at oil refineries designed, constructed and operated to the ASME and ANSI
codes, other API inspection standards (RP 510, 563, 570), and recent US
industrial and government initiatives in the field of fitness- for-purpose, process
safety and risk management.

The terminology and examples of API 581 relates to the type of plant used by
the on-shore oil refining and petrochemical industry. There is no mention of
applications to topside equipment on offshore platforms in a sea water
environment or to the issues faced by other industries such as power generation
or downstream chemicals. Many of the principles of RBI will apply, but specific
applications outside its intended field of refinery equipment could be
problematic.

The document applies specifically to the inspection for flaws, damage or

degradation of pressure retaining equipment within the primary pressure
boundaries. It therefore excludes consideration of inspection of other equipment
that may also contribute to the risk, such as control and instrumentation systems.

Two distinct approaches to risk ranking are identified: qualitative and

quantitative. The qualitative approach is intended to compare the relative risk of
different process units, whole plants or even refineries each containing many
individual items of equipment. Quantitative risk ranking of individual equipment
items (vessels, pipework, etc) requires a detailed assessment of specific factors
related to the equipment, inspection and process management that are judged to
influence the likelihood of failure. A reduced version of the fully quantitative
approach (the semi- quantitative approach) is also defined where the information
requirements are significantly simplified.

The preliminary draft of API 581 comprises 10 chapters and six appendices.

Copyright0 2001, The

7380.01/99/1054.03 Welding Institute
AN INTRODUCTION TO RISK BASED INSPECTION

Appendix 1 - Page 1
AN INTRODUCTION TO RISK BASED INSPECTION

APPENDIX 2

Qualitative Approach to RBI in API 581

7380.01/99/1054.03
Copyright O 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED INSPECTION

APPENDIX 2
QUALITATIVE APPROACH TO RBI IN API 581

Chapter 5 of API 581 acts as the guidance notes for the series of questionnaires
(called the Workbooks) given in Appendix 1. The questionnaires relate to the
various factors considered for the assessment of Likelihood and Consequence
Categories. The Likelihood Category considers six factors whereas the consequence
assessment contains 11 factors. The answer to each question is given a score
within a set scale.
The questionnaires in the likelihood category contains questions to assess the effect
of the following factors on the annual probability of failure.

• Equipment Factor — related to the number or components within a unit

• Damage Factor — identifies and assesses the known damage mechanisms

• Inspection Factor — assesses the effectiveness of the current inspection

programme

• Condition Factor — allows for general maintenance and house-keeping

• Process Factor — a measure of the potential for abnormal/interrupted operation

• Mechanical Design Factor — complexity of the unit and extent of code design

By summing the numerical scoring given to the answers to the questions within
each questionnaire, a numerical rating for each of the Factors is obtained. The
total Likelihood Category is the sum of the individual factor ratings.

The assessment of consequence is treated similarly but subdivided under the

headings:

(1) Damage Consequence and

(2) Health Consequence.

The Damage Consequence Category evaluates a numerical value for these factors.

• Chemical Factor — tendency of the chemical contained to ignite

• Quantity Factor — amount of chemical that could be released in a single event

• State Factor — a measure of the flash point

• Auto-ignition Factor — when the chemical is above its auto-ignition temperature

7380.01/99/1054.03 Appendix 2 - Page 1

Copyright O 2001, The Welding
Institute
AN INTRODUCTION TO RISK BASED INSPECTION

• Pressure Factor — how quickly a chemical can escape

• Credit Factor — allows for plant safety features and systems that mitigate
damage

• Damage-potential Factor — allows for damage to adjacent equipment

The Health Consequence Factor is derived from summing the following factors
and expresses the degree of potential toxic hazard.

• Toxic-quantity Factor — a measure of quantity and toxicity of the chemical

• Dispersibility Factor — how readily the chemical will disperse
• Credit Factor - allows for safety features and systems that mitigate health
effects
• Population Factor — how many people could be affected by a toxic release

The qualitative approach to RBI caters for all levels of risk assessment within a
plant. For example, it can be used to compare different:

(i) plants
(ii) units within one plant
(iii) sections of a unit
(iv) systems within a unit section

For this reason, depending on the level within the plant for which the risk
assessment is intended, the relevance of some of the factors may vary. Some
factors may be easy to assess at a plant level, but may be irrelevant at the system
level. Thus, if a number of comparable items are being assessed, then it is worth
customising the questionnaires to the particular circumstances. At the same time,
it is recommended that the interpretation of each category is documented, so that
future assessments can follow the same logic.

Typically a rating of 10-15 on an individual likelihood factor is significant as

this can change the final Likelihood Category. For example, the Damage Factor
has a maximum weighting of 20, consisting of nine different damage
mechanisms. API recognises that the list is not exhaustive and include a catch-all
factor of 10 points for mechanisms that have not been considered. The nine
mechanisms cover those that are most likely to lead to loss of containment.

Two situations apparently overlooked under the Process Factor are new and
intermittently operated plant/units. Both of these situations have a high
associated risk of failure and should be given equal weighting to a process with
more than 12 interruptions in a year, i.e. PF1=5.

The Likelihood Category rating and the highest rating from either the damage or
the health consequence categories are used to place the unit or component within a
five by five likelihood-consequence matrix, This can be used to identify the areas
of potential concern and to decide which areas need the most inspection and
repair or other methods of risk reduction.

Appendix 2 - Page 2 7380.01/99/1054.03

Copyright O 2001, The Welding Institute
 The grid for determining the degree of potential risk and degree of inspection is
not symmetrical within the matrix since in almost every case the consequence
factor is judged to carry more weight than likelihood. In other words, risk here is
being assessed as the product, likelihood times consequence.

After identifying the higher risk process units on the basis of a qualitative risk
ranking, the individual items of equipment (vessels, pumps, piping etc) within
those units can be assessed quantitatively for the purposes of planning
inspection. In the quantitative assessment, an Adjusted Failure Frequency for
each item is determined and used with an appropriate measure of consequence
(usually reduced to a cost) to give a measure of the risk.

7380.01/99/1054.03 Appendix 2 - Page 3

Copyright O 2001, The Welding
Institute
 AN INTRODUCTION TO RISK BASED INSPECTION

APPENDIX 3

Quantitative Approach to RBI in API 581

7380.01/99/1054.03
Copyright O 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED
INSPECTION

APPENDIX 3
QUANTITATIVE APPROACH TO RBI IN API 581

ESTIMATION OF FAILURE FREQUENCY

In API 581, the quantitative assessment of failure frequency is an integrated

process considering both the equipment and process and their management. The
starting point is a Generic Failure Frequency (GFF) for the type of equipment in
question (e.g. pump, vessel piping, etc). API 581 gives a table of suggested
failure frequencies for different types of equipment derived from published
sources of failure data.

The Generic Failure Frequency is then modified by a factor FE that is specific to

the equipment and the process and also by a factor related to the safety
management regime to determine the Adjusted Failure Frequency (AFF).

AFF = GFF x Fg x FM

The factors FE and FM are obtained from a scoring system within a series of
questionnaires (workbooks).

Equipment Modification Factor

The Equipment Modification Factor (Fb) is the sum of four sub-factors:

F E F TM+F U+F M+Fp

where:

F2p is the Technical Module Sub-factor (covering the type and rate of damage
expected, number and effectiveness of inspections, over-design margins)
Fu is the Universal Sub-factor (covering the general condition of the plant,
climate effects, and seismic activity)

Fp is the Mechanical Sub-factor (covering complexity, construction code, life

cycle, safety factors to design temperature/pressure, vibration monitoring)

Fp is the Process Sub-factor (covering process continuity, stability, relief

valves) The derivation of numerical values for these sub-factors is now

described

7380.01/99/1054.03 Appendix 3 - Page 1

Copyright0 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED
INSPECTION

(a) The technical module sub-factor

The technical module sub-factor evaluates the effect of two categories of
information on the generic failure frequency. These are:

1. The deterioration rate of the material resulting from its operating environment

2. The effectiveness of the inspection to identify and monitor the damage

mechanism

The analysis of in-service damage and inspection effectiveness to determine the

Technical Module Sub-factor is in seven steps:

1. Screen for damage mechanisms and establish an expected damage rate

2. Determine the level of confidence in the damage rate

3. Determine the effectiveness of past inspections to detect and monitor damage

4. Calculate the effect of the inspection on improving conridence in the damage

rate

5. Calculate the probability that the damage will result in failure

6. Calculate the Technical Module Sub-factor for each damage mechanism

7. Calculate the composite Technical Module Sub-factor for all damage

mechanisms

API 581 makes assumptions about the likelihood that the damage rate will be
higher than the expected or predicted rate depending on the confidence or
reliability placed in the supporting data. For example, if there is low confidence
in the predicted damage rate, it is assumed there is a 50% chance that the rate
will be as predicted or less, but with a 30% chance that the rate will be between
one and two times the predicted rate, and 20% chance that it will be up to
four times the rate.

The effect of inspection on improving the confidence in the expected damage

rate is a process known as inspection updating. It is based on the widely
recognised statistical method of bayes theorem. This allows the effect of one or
more inspection results, that they have a degree of uncertainly, to be
incorporated with information on the expected condition based on an analysis or
opinion.

To assist this analysis, API 581 considers the following damage mechanisms
within the so-called technical modules of Appendix 5:

• General or localised corrosion and thinning mechanisms (aqueous HCl, high

temperature sulphidation, vapour-liquid impingement and underposit attack)

• High temperature hydrogen attack

Appendix 3 - Page 2 7380.01/99/1054.03

Copy0right 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED INSPECTION

• Stress corrosion cracking (wet H S, caustic, amine)

• Brittle fracture

Each module has a set of screening criteria to determine if the damage

mechanism is present with information to estimate the expected damage rate if
this is not known, and specifies the data required for the subsequent analysis. In
particular, guidelines are provided to enable the user to assess the effectiveness
of the number and type of inspection methods that may have been used to detect
and determine the damage rate. The Technical Module Sub-factor is then
determined by entering a table with the damage rate and the number and
effectiveness of inspections. (In the case of thinning, the value obtained from the
table is further modified by factors to allow for the degree of overdesign and
where the corrosion rate is based on extensive field measurements).

(b) The universal sub-factor

The Universal sub-factor covers aspects that affect all equipment items in the
facility and is the sum of numerical ratings given for

• General plant condition

• Climate hazards
• Seismic activity

The assessment of general plant condition takes account of general appearance,

the effectiveness of the plant’s maintenance programme and the quality of the
plant’s layout and construction. The numerical rating depends on whether this is
assessed to be significantly better (-1.0), about equal (0.0), below (+1.5) or
significantly below industry standards (+4.0).

Hazards from cold weather operation are recognised based on the lowest daily
temperature at the plant site. The numerical ratings are for a winter temperature
above 40°F (0.0), 20°F to 40 F (1.0), -20oF to 20°F (2.0), and below -20°F (3.0).

The allowance for seismic activity is based on the seismic zones defined in
ANSI A58.1 (1982). The numerical ratings are for zones 0 or 1 (0.0), for zones
2 or 3
(1.0), and for zone 4 (2.0).

(c) The mechanical sub-factor

The mechanical sub-factor takes account of aspects relating to the design or
fabrication of the equipment that may influence the likelihood of failure and is
the sum of numerical ratings given for:

• Complexity (of a vessel or piping section)

• Construction code
• Life cycle

7380.01/99/1054.03 Appendix 3 - Page 3

Copyright0 2001, The Welding Institute
• Safety factors
• Vibration monitoring

For vessels only, the complexity rating (ranging from —1.0 to +2.0) is
determined from the number of nozzle penetrations of the shell and the vessel
type (column, pump, exchanger etc) and is given in a table. For piping, the
complexity factor is the sum of the number of connections (x10), the number of
injection points (x20), the number of branches (x3), and the number of valves
(x5) per foot length. The complexity rating is determined from a table and can
have a numerical value ranging from —3.0 to +4.0.

The benefits of design and fabrication of the equipment to a recognised code is

taken into account through a rating. This has the value of 0.0 if the equipment
meets the latest edition, 1.0 if the code for the equipment has been significantly
modified since fabrication, and 5.0 or more if the equipment was not fabricated
to any code.

The age of the equipment as a percentage of its design life is recognised to have
an influence on the likelihood of failure in a classical ‘bath-tub’ form. The
numerical ratings are for zero to 7% (2.0), 7 to 75 % (0.0), 76 to 100% (1.0) and
for more than
100% a rating of 4.0.

The operating pressure and temperature of the equipment are taken into account.
The rating for the increased likelihood of failure for equipment operating
towards its design stress limits is related to the ratio op design and ranges from
—2.0 (for o design <0•5) tO +5.0 (for Pop design 1.0). The increased susceptibility
to failure of equipment operating above a threshold temperature (dependent of the
type of steel) and below -20OF with ratings of 2.0 and 1.0 respectively.

Vibration monitoring applies primarily to rotating equipment like pumps and

compressors. A numerical rating is given depending on whether the monitoring
is on-line, periodic or none at all.

(d) The process sub-factor

The Process Sub-factor represents the effect of the process and the means for its
control on the likelihood of equipment failure. Experience has shown that
equipment failures are often associated with periods of non-routine operation
(start- ups, shut-downs) or when control of the reaction has been lost or is
uncontainable within the design basis. Three elements are considered, each of
which has several sub-elements.

• Continuity of the process

• Stability of the process
• Relief valves

Within continuity of the process, numerical values (ranging from —1 to +3) are
given depending on the number of planned and unplanned shutdowns per year.
The stability of the process is assessed by expert judgement in relation to that for
a ‘typical or average’ process. Considerations in making the judgement
include
Appendix 3 - Page 4 7380.01/99/1054.03
Copyright O 2001, The Welding Institute
 exothermic reactions, high pressures or temperatures, training of process
operators, and automated control systems. A numerical value is given depending
on whether the process is more stable (-1), about the same (0), less stable (+1), or
much less stable than the average (+2).

The assessment of relief valves takes into account the following sub-elements:

• Maintenance programme
• Fouling service
• Corrosive service
• Very clean service

Numerical values between —1 and 4 are given depending on the assessment

within each sub-element.

The Process Sub-factor is obtained by adding the numerical values determined

within each element.

Management Systems Evaluation Factor

The Management Systems Evaluation Factor (Fq) considers process safety

management issues listed in API —RP-750 (Management of Process Hazards)
and assesses the potential impact on mechanical integrity of issues under 13
headings:

l. Leadership and administration

2. Process safety information
3. Process hazard analysis
4. Management of change
5. Operating procedures
6. Safe working practices
7. Training
8. Mechanical integrity
9. Pre-start-up safety review
10. Emergency response
il. Incident investigation
12. Contractors
13. Audits

The management factor evaluation comprises of a questionnaire (workbook)

consisting of 101 questions, most of which have multiple parts. Points are
awarded for each positive response. A total score of 1000 points is possible and
would represent excellence in process safety management. The score obtained
(% out of 1000) is converted to M by means of a linear logarithmic graph where
Fq ranges from a value of 10 for a nil % score to a value of 0.1 for a score of
100%.

Copyright O 2001,
7380.01/99/1054.03 The Welding Institute
Appendix 3 - Page 5
 Estimation of Consequences

The estimation of consequences of a failure in quantitative terms depends on the

circumstances of the plant. For accurate consequence evaluation, the techniques
of quantitative risk analysis are available, although discussion of these
techniques is outside the scope of the current document. The aim of the
quantitative consequence analysis is to determine the sum of money or number
of lives or other measure that may be lost as a result of the failure.

There are many losses that may result from plant failure and loss of
containment. The immediate and obvious costs are:

• Injury to personnel
• Replacement of damaged equipment
• Business intemiption (lost revenue)
• Clean-up of the environment

There may, however, be many other less obvious and longer term costs that
should also be considered, such as:

• Emergency supplies, equipment rentals

• Investigation costs, independent advisors and regulatory action
• Additional overtime, decreased workforce efficiency, replacing workers
• Customer dissatisfaction, loss of reputation and market share
• Legal expenses in litigation and damages

Within Chapter 7 of API 581, a system is given for the analysis of the
consequences of a failure in the context of a petrochemical refinery. The analysis
provides some simple methods for estimating the costs relating to equipment
damage (fire and explosion), toxic consequences, environmental clean-up and
business interruption. The estirtiation is based on data obtained from a
systematic seven stage process:

1. Determining the properties of the fluid

2. Evaluating the loss of containment in terms of representative hole sizes
3. Estimating the total amount of fluid available for release
4. Estimating the release rate
5. Considerations of dispersion
6. Selection of the final phase of the released fluid (liquid or gas)
7. Evaluating the effectiveness of the post release response (emergency planning)
8. Determining the geographical area affected by the release

It is outside the scope of this document to consider this analysis and the
underlying assumptions. It can be observed that the analysis is complex and
requires a large amount of input data. The methods presented represent but one
approach to the problem and there will be many variations depending on
particular company circumstances and loss evaluation policies.

Appendix 3 - Page 6 7380.01/99/1054.03

Copyright O 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED INSPECTION

APPENDIX 4

A Case Study of Risk-Based Inspection

7380.01/99/1054.03
Copyright0 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED INSPECTION

APPENDIX 4

A CASE STUDY OF RISK-BASED INSPECTION

A4.1 INTRODUCTION
This case study illustrates the process of assessing the risk and planning the
inspection interval of five items of equipment from a unit called a platformer
in an oil refinery. A summary of these five items is presented in Table Al below.
The TWI approach to RBI and the software RISKWISE T“ are used to assist the
assessment and planning process.

Table Al Summary of 5 items of equipment

Item ID Item type Item name Process description

03D03 Reactor Reactor No.1 Cold wall, catalytic reforming reactor
03D06 Reactor Steam drum Stream disengaging drum
03D07 Reactor Separator Products separator
03D08 Reactor Flash drum Flash drum
03F03 Fired heater Charge heater Fired coil tube inside furnace

‘Platforming’ is the proprietary name for a hydrocarbon refining process

universally known as catalytic reforming. A schematic diagram is depicted below
showing the ‘platforming’ process. The hydrocarbon feed to this process is
sweetened naptha and hydrogen gas. The final liquid product (reformate) is used
for gasoline blending.

The naptha feed is pressurised, heated, and charged to a series of reactors. The
catalytic reforming reaction takes place in the presence of hydrogen in these
reactors. The product is subsequently run through air coolers where much of it is
liquefied. At this stage the hydrogen gas is removed by physical separation and
recycled in to the naptha feed. The remaining liquid product is sent to a gas
distillation plant, where light hydrocarbon gases (e.g. butane) are removed in
distillation columns.

7380.01/99/1054.03 Appendix 4 - Page 1

Copyright O 2001, The Welding
Institute
AN INTRODUCTION TO RISK BASED
INSPECTION

03 D06

Steam drum

Fig.Al: Schematic diagram showing the platforming process

A4.2 RiSK ANALYSIS

A4.2.1 Approach

The risk analysis process is illustrated by the application of TWI’s software

package RISKWISE TM to a single item of equipment, item 03D07, the H2
Separator as shown in Fig.Al. The software has also been applied to the other
four items to enable a comparison and ranking of the relative risks over different
timescales.

In RISKWISE TM, risk analysis consists of the following stages:

Collection of factual data for the equipment item under

consideration, Identification of credible damage mechanisms,
Evaluation of likelihood factors for each of the identified damage
mechanisms Evaluation of consequence factors
Presentation of the risk summary.

Application of the RISKWISE T“ software requires factual information about

each item of equipment and expert judgements about factors relating to the risk.
A team of individuals having the necessary breadth of access and expertise
would normally be needed. Typically, such a team might include a specialist in
safety and risk analysis, a process engineer, a materials/design engineer and an
inspection engineer, as well as the competent person as required by the UK
pressure systems safety regulations.

A4.2.2 Collection of Factual Information

The first stage of the risk analysis is to gather specific factual information for
each item of equipment and enter it into the RISKWISE TM database. Information
is entered under three headings:

Appendix 4 - Page 2 7380.01/99/1054.03

Copyright O 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED
INSPECTION

Item properties (Drawings, dimensions, operating conditions, coatings etc)

Materials (Specification, type, wall thickness, corrosion allowance etc)
Inspection methods applied previously (Type, coverage, rndings)

This information serves as a basis for making expert judgements about factors
pertaining to the risk.

The information for equipment item 03D07, the Ht Separator, is shown in Fig.A2,
A3 and A4 for Item properties, Materials and Inspection methods, respectively.

A4.2.3 Identification of Damage Mechanisms

The team then uses this information together with its lcnowledge and expertise
to identify credible damage mechanisms. In order to assist this task, RISKWISE
TM
provides a list of damage mechanism with supporting descriptions. As the
number of damage mechanisms that can affect equipment is large, and the
circumstances vary, the team should use this list only as a basis for its own
judgements. Credible damage mechanisms are identified by means of tick boxes
on the RISKWISE T“ database as shown in Fig.A5 for equipment item 03D07,
the H2 separator.

A4.2.4 Evaluation of Risk Factors

The team now assesses the Risk Factors relating to the probability and
consequences of failure as prompted by RISKWISE TM. The factors are assessed
qualitatively by means of tick boxes against a small number of descriptive
categories. RISKWISE TM gives numerical weighting to the individual answers
given, and the weightings are combined by means of formulae to give total
numerical ratings for likelihood and consequences of failure. An example of the
risk factors sheet is shown in Fig.A6 for equipment item 03D07, the He
separator.

For each identified damage mechanism, the likelihood of failure is considered

within three timescales from the time of assessment. In this case study,
timescales of 72, 144 and 216 months are considered. The team is asked to judge
the likelihood of failure in the timescale within descriptive five categories
ranging from ‘not credible’ to ‘likely’.

The team also assesses the effectiveness of previous inspection methods against
damage mechanisms. The likelihood of failure is reduced if previous inspections
methods were effective and increased if ineffective. This reflects the increased
risk that may result from uncertainty about the current condition.

RISKWISE T“ prompts the team to assess the potential consequences of failure

of the item within descriptive categories. The toxicity and flammability of the
released contents and the effects of intemiptions to business and production are
considered. Simple answers are sufficient as there is no requirement to quantify
the consequences.

7380.01/99/1054.03 Institute
Copyright O 2001, The Welding
AN INTRODUCTION TO RISK BASED
INSPECTION

Appendix 4 - Page 3
 This qualitative assessment of the likelihood and consequences of failure is
determined by the factors that the authors of RISKWISE TM believe to be
important. This is a subjective judgement and other companies may consider
different factors and weightings to be more appropriate to their needs.
TM
RISKWISE IS designed so that the factors, weightings and combination may
be customised for each
application.

A4.2.5 Presentation of Risk Summary

The total numerical ratings for the likelihood and consequences of failure are
within a five point linear scale. These can then be plotted to present the risk on a
probability-consequence matrix. The ratings for likelihood and consequence may
be multiplied together to give the ‘risk index’, a single numerical value
representative of the risk.

The risk of failure from each damage mechanism over each of the time-scales is
determined from likelihood and consequence ratings for the item. These are
plotted as co-ordinates on the Risk Summary matrix where risk increases across
and up the matrix. This is illustrated in Fig.A7 for equipment item 03D07, the Ht
separator.

A4.3 RISK BANKINGS OF 5 EQUIPMENT ITEMS

The risk analysis illustrated here by the Hz separator example has been repeated
for the other 4 equipment items. For the comparison and ranking of relative risk,
a risk index is determined for each item for the time-scale considered. Applying
this, the risk indices of the five items after 216 months service are tabulated in
Table A2 and presented graphically in Fig.A4.7.

Table A2 Risk rankings of 5 equipment items for 216 months

Item DM LF score CF score Risk index

Steam drum General 1 A (1) 1 (low risk)
03D06 corrosion
H2 separator Stress corrosion 3 A (1) 3
03D07 cracking
Flash drum General 2 B (2) 4
03D08 corrosion
Reactor No 1 Temper 4 D (4) 16 (high risk)
03D03 embrittlement
Charge heater Stress corrosion 5 E (5) 25 (high risk)
03F03 cracking

The risk ranking shows that items 03D03 and 03F03 have a high risk of failure
relative to the other 3 items. This suggests that whilst an interval of 216 months
before the next inspection might be appropriate for the low risk items, the high
risk items will need to be inspected much more frequently.

Appendix 4 - Page 4 7380.01/99/1054.03

Copyright O 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED INSPECTION

A4.4 IN S PECTION PLAN N ING

For the purpose of planning the inspection frequency, RISKWISE “

recommends a Maximum Inspection Period (MIP) for the item of equipment with
respect to the dominating failure damage mechanism. The scheme is consistent
with the UK Institute of Petroleum Guidelines and is based on a residual life
calculation considering the current condition and the degradation rate. The MIP is a
conservative fraction of the residual life determined by the likelihood and
consequence ratings.

The MIP calculation is illustrated here with respect to damage mechanism of

general wall thinning corrosion. The likelihood of failure over a certain period of
time can be calculated with knowledge of the corrosion rate (CR), the current
thickness (T), and the minimum allowable thickness (Thin)- The residual life
(RL) is then:

CR

Using a safety factor SF determined from the likelihood and consequence

ratings, MIP is:

MIP — RL/SF

For T —— 20.5aHR9 T jjjin' 15111111 Cfi=0.2 mm/year, SF — 3,

W=27.5 years = 330 month MIP——RL/3——
110 months

7380.01/99/1054.03 Appendix 4 - Page 5

Copyright O 2001, The Welding
Institute
 AN INTRODUCTION TO RiSK BASED INSPECTION

Item Properties

O- General
Item Type Reactor
Item Number 03D07
Item Name Separator
Process Description Products sepeiatoi
Facility Zone 1
Process Area Unit 3 - Platfoimet
Manufacturer Redheugh
HeatT reated Yes
Design Code ASME VIII Div.1
Lommision Date (mm/yyyy) Maich 1968
Current Inspection Period (Months) 72
Drawings
PFD 2440ñ
PID 02-03-05-31218 A
n Design Eanditions
Design Temperature (‘C) 117
Design Pfessuie (barg) 31
Dimensions
Height/Lsngth (mm]
Diameter [mm)
Volume (n2) 13
m Operating Conditions
Max Operating Temperature (*C) 55
Max Operating Pressure (barg) 28
Flow Rate (rr27hr) 213
Primary Fluid Gasoline
Most Volatile Fluid Hydrogen
Toxic Constituents
Aqueous Phase Duiing Dpeiation
Aqueous Phase Ouring Shutdown
Chemical lniection
)Cyclic Operation
Coatin s, Insulation and Aladdin
External Coating
External Insulation
Internal Coating
Internal Lining
Internal Cladding

Fig.A2 Data input sheet for item properties

Appendix 4 - Page 6
 AN INTRODUCTION TO RISK BASED INSPECTION

Materials

Description I Specification Grade (Generic Material | Nominal Wall Thickness [mm) | Corrosion Allowance (mmj | Repairs
Shell C-Mn steel NO
Bottom head Cement linted NO
Nozzles C-Mn steel NO
Top head C-Mn steel NO

Fig.A3 Data input sheet for materials

 AN INTRODUCTION TO RISK BASED INSPECTION

Damage Mechanisms

Description Location and Notes

@- lgetal Thinning

)Vanadate attack |O|

Q- Environmental Damage
Carburization
Decarburization
Dezincificahon
HIC/SWC

Hydrogen embti(tIement
Liquid metal embrittlement
Stress corrosion cracking Caustic SCC
@- Igetallurgical/Nechanical

Fire damage

Dvei-heating

Fig.A5 Data input sheet for damage mechanisms

7380.01/99/1054.03 Appendix 4 - Page 9

Copyright O 2001, The Welding Institute
 AN INTRODUCTION TO RISK BASED INSPECTION

Risk Factors

Õ LĞetiłu›od Faclœs
Cwrerg c0rx:štîon ńom inspection rec‹xds EZI As expected
Likeihood of fóksc due to... 72 nx›nths. 144 maths. 216 nonths
Cofrosïon ia'x:ief ktstdatìon Not cfedż›Ie. Nd credÔle. Not credible
Genœal corrosion Not credible. Hot credible. Unlikely
Stress conosón cracking Nd creóbłe. Not ciedÖle. Unlikely
- Effectivmess of inspection jxorpazzTø agan4t...
CoirosìŒi tøxlef čutdation Average
Generd corroeón czj Good
Stress corrœÓn crac æg IneffectŃe
Component słxXdown frequency Less than five shtJdowns a year
Pdertîd for exeerIir›g key process vaid:lies m Ve/y słabIe
Operation in relatÓn to deg îmÈs ca Withiri normal opeiding rarige
Recurring repai issue c:a No
Œ- Eorzsezpænne Factzzts
Product loss cø Under 2,000rr2
Pressure factof æa Undei 50bat
Fire7expłosón damage potentid cø Low
Pdential tœîcity of iebase Ca Me‹bxn
Effect of component faŁ¥e on țxodætiœi cii One
unit Location of co«ą›orłent vńthn płaa Midde
Tirrie taken to rectšy comporænt faìLse Greater than one month
Threat to personnel. stzfaxdîng caz¥zxxúy and envšo... Threat to pers¢xvid. surrounding commcnky and envčo...
I | Standard of locd safety arangefłærg features I ‹= Adequate

Fig.A6 Data input sheet for risk factors

Appendix 4 - Page 10 7380.01/99/1054.03

Copyright0 2001, The Welding Institute
 Likelihood 5

A B C D E
Consequence

Fig.A7 Risk matrix showing results of risk analysis for H2 separator

7380.01/99/1054.03 Appendix 4 - Page 1 I

Copyright O 2001, The Welding Institute
AN INTRODUCTION TO RISK BASED INSPECTION

30

25

0
03006 03007 03f•03
03D03

Fig.A8 Risk rankings of five items in the platformer

unit

Appendix 4 - Page 7380.01/99/1054.03

12 Copyright O 2001, The Welding Institute