User Guide for RBI Framework and

R-Tech’s iRiS RBI System

iRiS - integrated Risk management System for RBI - Risk Based Inspection

Steinbeis Advanced Risk Technologies (Group) R-Tech

Copyright © 2014, R-Tech

version 6.0

1
 Table of Contents
Contents
1. Forward........................................................................................................................................... 9
2. Introduction .................................................................................................................................. 10
3. Scope ............................................................................................................................................. 11
4. Terms and definitions .................................................................................................................. 11
5. The RBI framework ...................................................................................................................... 13
5.1. RBIF principles ....................................................................................................................... 13
5.2. RBIF requirements ................................................................................................................ 13
5.2.1. General requirements ................................................................................................... 13
5.2.2. Documentation Requirements ..................................................................................... 15
5.2.3. Personnel Requirements .............................................................................................. 16
5.2.4. Requirements for Performing Consequences of Failure (CoF) analysis ................... 16
5.2.5. Requirements for performing Probability of Failure (PoF) analysis ........................ 18
5.2.6. Requirements for Performing Risk Assessments ....................................................... 19
5.3. RBIF within the overall management system...................................................................... 19
5.4. Compatibility with other known approaches ...................................................................... 20
6. The RBIF process .......................................................................................................................... 20
6.1. Initial analysis and planning ................................................................................................. 21
6.2. Data collection and validation .............................................................................................. 25
6.3. Multilevel risk analysis (ranging from screening to detailed) ........................................... 27
6.4. Decision making/action plan ................................................................................................ 33
6.5. Execution and reporting........................................................................................................ 36
6.6. Performance review/Evergreening phase .......................................................................... 38
7. Overview of R-Tech iRiS .............................................................................................................. 41
8. Technical Background.................................................................................................................. 43
9. Getting started .............................................................................................................................. 45
9.1. Analyses .................................................................................................................................. 45
9.2. Software identification card.................................................................................................. 42
10. Analysis ......................................................................................................................................... 49
10.1. Analysis Page.......................................................................................................................... 49
10.2. Analysis info ........................................................................................................................... 50

2
 10.3. Analysis settings .................................................................................................................... 51
11. Process Units ................................................................................................................................ 55
11.1. Process Units Information .................................................................................................... 55
11.2. Current Data .............................................................................. Error! Bookmark not defined.
11.2.1. Creating and modifying components ..................................................................... 116
12. Components and Levels of Analysis............................................................................................ 58
12.1. Components ........................................................................................................................... 58
12.2. Basic Data ............................................................................................................................... 63
12.3. Dimensions ............................................................................................................................. 64
12.4. Operating Data ....................................................................................................................... 66
12.5. Piping Data ............................................................................................................................. 67
12.6. Design Data............................................................................................................................. 67
12.7. Material and Lining ................................................................................................................ 68
12.8. Hydrotesting .......................................................................................................................... 68
12.9. Inspection intervals ............................................................................................................... 69
12.10. Problem Description.............................................................................................................. 70
12.11. Level I: Performing Level I Analysis ..................................................................................... 70
12.12. Level I Data: Potential Damage Mechanisms ....................................................................... 71
12.13. Level I Data Consequences .................................................................................................... 72
12.14. Level I Data: Evaluation Period ............................................................................................ 75
12.15. Level I Data: Results .............................................................................................................. 76
12.16. Level II: Performing Level II Analysis .................................................................................. 77
12.17. Level II: Technical Module Subfactor: General .................................................................... 78
12.18. Level II Probabilities Thinning Technical Module .............................................................. 79
12.19. Level II: Probabilities: External Corrosion Technical Module............................................ 82
12.20. Level II Probabilities Stress Corrosion Cracking Technical Module .................................. 84
12.21. Level II: Probabilities: Brittle Fracture Technical Module ................................................. 87
12.22. Level II: Probabilities: High temperature hydrogen attack (HTHA).................................. 88
12.23. Level II Probabilities Piping Fatigue Technical Module ..................................................... 90
12.24. Level II: Probabilities: Lining Technical Module ................................................................. 92
12.25. Level II: Probabilities: Furnace Technical Module .............................................................. 94
12.26. Level II Consequences Data Input ........................................................................................ 97
12.27. Level II: Consequences: Results ............................................................................................ 99
3
 12.28. Level II: Inspection History ................................................................................................. 100
12.29. Level II: Inspection Planning............................................................................................... 102
12.30. Level III: Performing Level III Analysis .............................................................................. 104
12.31. Level III: Modification Factors Data Input ......................................................................... 104
12.32. Level III: Modification Factor: Results ............................................................................... 107
12.33. Level III: Financial Risk: Data Input ................................................................................... 109
12.34. Level III: Financial Risk: Results ......................................................................................... 111
12.35. Documents and Overview ................................................................................................... 112
13. NDT .............................................................................................................................................. 114
13.1. NDT Analysis ........................................................................................................................ 118
13.2. Measuring Points ................................................................................................................. 119
13.3. NDT Measurements ............................................................................................................. 120
13.4. Latest Values ........................................................................................................................ 123
14. EskomRBI Analysis..................................................................................................................... 124
14.1. EskomRBI ............................................................................................................................. 124
14.2. EskomRBI Component Data ................................................................................................ 124
14.3. EskomRBI Level I Probabilities .......................................................................................... 127
14.4. EskomRBI Level I Consequences ........................................................................................ 130
14.5. EskomRBI Level II Probabilities ......................................................................................... 132
14.6. EskomRBI Level II Consequences....................................................................................... 136
15. Reports ........................................................................................................................................ 139
15.1. General.................................................................................................................................. 139
15.2. Executive Summary ............................................................................................................. 140
15.3. Risk Matrix ........................................................................................................................... 141
15.4. Component Count ................................................................................................................ 141
15.5. Damage mechanisms ........................................................................................................... 142
15.6. Thinning Corrosion Rates ................................................................................................... 142
15.7. Corrosion Development ...................................................................................................... 143
15.8. Gain - Loss ............................................................................................................................ 143
15.9. Financial Risk ....................................................................................................................... 144
15.10. Cumulative Risk ................................................................................................................... 147
15.11. Inspection Plan..................................................................................................................... 148
15.12. General Comments............................................................................................................... 148
4
 15.13. Component Summary Sheet................................................................................................ 149
15.14. The GIS Map ......................................................................................................................... 149
15.15. Risk Map ............................................................................................................................... 150
16. Appendices.................................................................................................................................. 151
16.1. Appendix I: API 581:2008 Thinning Damage Factor ........................................................ 151
16.2. Appendix II: API 581:2008 Component Lining Damage Factor ....................................... 170
16.3. Appendix III: API 581:2008 External Corrosion Damage Factor - Ferritic Component 176
16.4. Appendix IV: API 581:2008 HTHA Damage Factor ........................................................... 182
16.5. Appendix V: API 581:2008 Brittle Fracture Damage Factor ............................................ 187
16.6. Appendix VI: API 581:2008 Piping Mechanical Fatigue Damage Factor ......................... 195
16.7. Appendix VII: API 581:2000 Furnace Tube Technical Module ........................................ 202
16.8. Appendix VIII: API 581:2000 Stress Corrosion Cracking Technical Module .................. 218
16.8.1 Caustic Cracking ............................................................................................................ 227
16.8.2 Amine Cracking............................................................................................................ 231
16.8.3 Sulfide Stress Cracking ................................................................................................ 235
16.8.3 Hydrogen Induced Cracking in Hydrogen Sulfide Services (HIC/SOHIC-H2S) ...... 239
16.8.4 Carbonate Cracking ..................................................................................................... 244
16.8.5 Polythionic Acid Cracking (PTA) ................................................................................ 248
16.8.6 Chloride Stress Corrosion Cracking (ClSCC) ............................................................. 252
16.8.7 Hydrogen Stress Cracking in Hydrofluoric Acid Service (HSC-HF) ......................... 255
16.8.8 Hydrogen Induced Cracking in Hydroflouric Services (HIC/SOHIC-HF) ................ 259
16.9 Appendix IX: API 581:2000 Financial Risk ........................................................................ 263
16.10 Appendix X: RBI 581:2000 Modification Factor................................................................ 270
16.10.1 Equipment modification factor .............................................................................. 270
16.10.2 Technical Modules ................................................................................................... 272
16.10.3 Universal Subfactor ................................................................................................. 286
16.10.4 Mechanical Subfactor .............................................................................................. 288
16.10.5 Process Subfactor .................................................................................................... 293
16.11 Appendix XI: Definition of Reliability-Centered Maintenance (RCM) ............................. 298
16.11.1 Definitions of RCM ................................................................................................... 298
16.11.2 RCM Process overview ............................................................................................ 302
16.11.3 Primary functions .................................................................................................... 303
16.11.4 Functional failure .................................................................................................... 308
5
 16.11.5 Maintenance Strategy Selection (MSS) .................................................................. 313
16.11.6 Redesign ................................................................................................................... 317
16.11.7 Calculations MTBF, Analysis, Statistic ................................................................... 318
17. Bibliography ............................................................................................................................... 322

6
7
8
1. Forward
This user guide draws primarily from the document “Risk Based Inspection Framework” (EN
16991:2018) in order to lay out the basis for the RBI Methodology which the iRiS-RBI software
was designed to support.

The document (EN 16991:2018) has been prepared by Technical Committee: CEN/TC 319
“Maintenance”, the secretariat of which is held by UNI and is currently submitted to the CEN for
formal vote

9
2. Introduction
Since the late 1990s, inspection and maintenance approaches in industry have been globally
moving from prescriptive, time-based towards risk-based, aiming to increase the on-stream
production time, reduce unscheduled downtime due to corrective maintenance, avoid shutdown
due to equipment failure and/or to reduce undesirable impacts on process safety.
This European Standard provides the essential elements of risk-based assessment of industrial
assets according to the approach developed and demonstrated in the European pre-
standardization document CWA 15740:2008 [1]. The CWA 15740 document was updated in
2011, and from 2014 its further development continued within EN 16991:2018 and the
corresponding EU Project RIMAP (Risk-Based Inspection and Maintenance Procedures for
European Industry) [2] [3]. Both the project and this standard aim to make inspection and
maintenance programs in industrial plants more cost-efficient while at the same time
maintaining and improving safety, health, and environmental performances.
Chapters one through six of this user guide aim to provide basic guidelines for managers and
engineers who seek to establish RBIM (Risk-based Inspection and Maintenance) policies in their
relevant industry, used in conjunction with the relevant internationally accepted practices,
national regulations and RBI company policies and coupled with a relevant data management
application for risk assessment. For a full recount of the RBI Framework, refer to EN 16991:2018.
As RBI management is a proactive, risk oriented process that benefits greatly from a centralized
data organization for which a dedicated tool, complying with accepted standards and applicable
regulations, should be used; therefore chapters seven and onwards introduce the iRiS RBI
application and act as a manual for its usage, details how it supports RBIM and its required data
analyses.
R-Tech iRiS RBI is fully based on the API 581 Base Resource Documents and is used for the
assessment of risk on the equipment/component level and for developing and evaluating
inspection strategies to support of the RBI Framework and management methodology.

10
3. Scope
This document aims to provide basic guidelines for Risk-Based Inspection and Maintenance
(RBIM) in hydrocarbon and chemical process industries, power generation and other industries
where RBI is applicable, based on the proposed European Standard EN 16991 that specifies the
Risk-Based Inspection Framework (RBIF).
This is supported by the iRiS RBI Tool which utilizes API 581 to provide a platform for gathered
data and to perform the necessary calculations for the risk assessments required for decision
making in RBIM.

4. Terms and definitions

The following terms and definitions apply in this document.
4.1. risk
Combination of the probability of occurrence of harm and the severity of that harm
Note 1 to entry: The probability of occurrence includes the exposure to a hazardous
situation, the occurrence of a hazardous event, and the possibility to limit the harm.
Note 2 to entry: Other definitions, e.g. the one from ISO 31000 are recognized, but not used
practically in the document.
[SOURCE: ISO/IEC Guide 51:2014, 3.9]
The definition of risk and its application in the software is based on API 581 and is the result
of Consequence multiplied by Probability. Consequence is measured as
{Consequences/Event} while Probability is measured as {Events/Year}; therefore, Risk is
{Consequences/Year}.
[SOURCE: API 581:2000, 6.4]

Risk = PoF x CoF [i.e. square meters / year] or [€/year]

Where:
PoF = Probability of Failure [events/year]
CoF = Consequence of Failure [i.e. square meters or €]

4.2. risk management

Coordinated activities to direct and control an organization with regard to risk
Note 1 to entry: Systematic application of management policies, procedures, and practices
to the tasks of analysing, evaluating and controlling risk.
[SOURCE: ISO Guide 73:2009, 2.1, ISO 31000:2009, 2.2]
4.3. equipment
An individual item that is part of a system, equipment is comprised of an assemblage of
components Examples include pressure vessels, pressure relief devices, piping, boilers and
heaters.
[SOURCE: API RP 581:2016, 3.1.23]

11
4.4. inspection
Examination for conformity by measuring, observing or testing the relevant characteristics
of an item
[SOURCE: EN 13306:2010, 8.1]
4.5. maintenance
Combination of all technical, administrative and managerial actions during the life cycle of
an item intended to retain it in, or restore it to, a state in which it can perform the required
function
[SOURCE: EN 13306:2010, 2.1]
4.6. integrity operating window (IOW)
Established limits for process variables (parameters) that can affect the integrity of the
equipment if the process operation deviates from the established limits for a predetermined
length of time (includes critical, standard and informational IOW’s)
[SOURCE: API RP 584, 3.6]
4.7. preventive maintenance
Maintenance carried out at predetermined intervals or according to prescribed criteria and
intended to reduce the probability of failure or the degradation of the functioning of an item
[SOURCE: EN 13306:2010, 7.1]
4.8. corrective maintenance
Maintenance carried out after fault recognition and intended to put an item into a state in
which it can perform required function
[SOURCE: EN 13306:2010, 7.5]
4.9. reliability centred maintenance (RCM)
Method to identify and select failure management policies to efficiently and effectively
achieve the required safety, availability and economical operation
[SOURCE: IEC 60300-3-11, 3.1.23]
4.10. risk based inspection (RBI)
Risk assessment and management process to plan, implement and evaluate inspections in a
structured and documented way
4.11. probability of failure (PoF)
Likelihood of an equipment or component failure due to a single damage mechanism or
multiple mechanisms occurring under specific operating conditions
[SOURCE: API RP 581:2016, 3.1.57]
4.12. consequence of failure (CoF)
Outcome of a failure can be expressed in terms of safety to personnel, economic loss, and/or
damage to the environment
[SOURCE: IEC 60300-3-11, 3.1.23]
4.13. evergreening
Dynamic process of keeping records and analysis updated and relevant for the current
situation
4.14. area susceptible to damage/susceptible area
Area in a plant where a certain degradation is more probable to occur
[SOURCE: API RP 581:2016, part 2]
12
 4.15. degradation
Detrimental change in physical condition, with time, use or external cause
Note 1 to entry: Degradation may lead to a failure.
Note 2 to entry: In a system context, degradation may also be caused by failures within the
system.
[SOURCE: EN 13306:2010, 5.6]
4.16. degradation group
Group of piping or equipment items exposed to the same internal/external environment and
operating conditions, with the same material selection and/or design, thus having the same
potential degradation mechanisms.
Note 1 to entry: Degradation grouping can allow the use of inspection data from any
equipment in the selection to assess the condition of the entire degradation group.
Equipment in a degradation group are normally physically connected to each other.
Note 2 to entry: Corrosion group and/or corrosion circuit and/or corrosion loop is also used
if the relevant degradation is corrosion type.
[SOURCE: adapted from DNV RP-G101: 2010]
4.17. condition monitoring locations (CML)
Designated areas on pressure vessels where periodic examinations are conducted.
Previously, they were normally referred to as “thickness monitoring locations (TMLs)”
[SOURCE: API 510:2006]

5. The RBI framework

5.1. RBIF principles
The risk-based approach shall apply a multidisciplinary engineering analysis to ensure that
targets related to health, safety, business and environmental criteria are met. These targets
shall be met by implementing optimized inspection, monitoring and maintenance programs
based on an appropriate risk-based methodology covering the following items:
 planning of the primary work products of RBI assessments and management approach in
such a way that risks at system and/or equipment level are managed, considering risks
from the Health, Safety & Environment (HSE) and/or the economic/business perspective;
 defining the RBI framework which meets the requirements of good engineering practices
and industrial reference standards in handling hazardous materials and containment;
 complying with applicable legal or normative regulations and guidelines.

5.2. RBIF requirements

5.2.1. General requirements
The general requirements of the RBIF are:
 the objectives and risk criteria shall be clearly defined;
 the assessment and the applied procedure shall comply with the applicable legal and
regulatory requirements;
 an adequate level of input information shall be available for the assessment;

13
 the assessment shall be performed by a multidisciplinary team including personnel with
the appropriate required competence and qualifications;
 the integrity and safety assessment and the applied procedures shall provide results,
which are:
o realistic, but with conservative treatment of uncertainties and assumptions;
o representable in a risk matrix, auditable and consistent with both the objectives
and applied risk criteria supporting RBI planning and decision making on the
target system or equipment.
 the assessment shall reflect the real conditions in the plant and be kept in “evergreening”
status;
 change management shall be made according to an accepted and recognized standard,
such as EN ISO 9000 [5];
 in the case when computer models/tools are used, these shall be validated and their
decision logic shall be documented and authorised by the risk managers.

The RBI process is divided into the main RBI application level and an inspection and
maintenance strategy level. The main RBI application level is shown in the Figure 1 and
takes into account the following factors:
 the level of risk;
 the opportunity to eliminate failure causes;
 the risk to personnel during execution of inspection and maintenance;
 the risk of introducing new failure causes while trying to eliminate the existing ones.

Is the risk posed by a failure below the Yes Run to failure or routine
negligible risk level as established per maintenance (lubrication, etc.)
relevant regulations? recommended

No
IMPLEMENT/OPTIMIZE
Can failure cause be identified Yes
and required risk reduction is clearly cost  Procedures
effective?  Modification
 Operating conditions
No

Establish new inspection

and maintenance strategy Yes

Is the substitution of inspection and No

Redesign
maintenance strategy possible?
Can the inspection and maintenance
No
strategy ensure low risk for personnel and
avoidance of new failures?

Yes

Apply

Figure 1 — Main RBI application level and decision tree

14
In cases where substitution of the inspection and maintenance strategy is not possible,
technical (e.g. robotics) or organizational (e.g. training) measures may be introduced to
reduce the risk and to avoid introducing any new failures.
The decision tree serves three important purposes:
 to ensure a systematic evaluation of needs for inspection and maintenance activities;
 to ensure consistency of the evaluation between different units, plant systems and
similar units at different locations;
 to simplify the documentation of reached conclusions.

When the inspection and maintenance strategy has been determined, the method, intervals,
and extent of inspection shall be determined so that risks remain acceptable, costs are
optimized and both are aligned with the organisation’s asset management strategy. This is
achieved by establishing risk reduction measures for the items that exceed the acceptance
limits and, where possible, by mitigating measures like inspections and maintenance for
items that remain below these limits for the period of assessment.
The approaches and methodologies used in RBIF can be compatible with the generic
requirements resulting from basic ISO Standards such as EN ISO 9000-series [5], EN
ISO 14000-series [6], ISO 55000 [7] and in-particular, ISO 31000-series [8] (IEC/ISO 31010
[9], ISO/IEC Guide 51 [10], ISO Guide 72, ISO Guide 73 [11]). Other standards with which
RBIF can also be compatible are EN 13306 [12], ISO/DIS 45001, ISO 22301 [13], IEC
61508/61511[14] [15] and ISO/IEC 17020 [16].

5.2.2. Documentation Requirements

It is essential that all RBI assessments are clearly documented, with all factors contributing
to the final risk assessment defined. In addition to a well-established and documented
process, the minimum documentation shall include:
 team members performing the assessment and their competence;
 previous assessment date;
 reassessment interval;
 list of factors used to determine risk (severity, probability of failure and exposure);
 list of assumptions made during the assessment;
 risk assessment results for unmitigated risks;
 actions required to move to new mitigated risk levels; and
 optionally: risk assessment results for mitigated risks levels.
The aforementioned documents will help to review the processes, the changes in the
processes and to update the inspection related information.

15
5.2.3. Personnel Requirements
The RBIF requires competent personnel at all levels as well as appropriate routines for the
execution of the assessment and should include:
 a team leader (facilitator);
 a materials and damage mechanism specialist with sufficient qualification and
experience to understand the process, predict failure mechanisms and identify
limitations in inspection techniques;
 an inspection/NDT and maintenance specialist;
 a plant operation and process specialist;
 reliability, risk assessment, HSE, financial and business personnel; and
 other specialist(s) as needed.
The RBI team shall include with written evidence the following areas of expertise:
inspection, maintenance, materials and damage mechanism, process technology, RBI,
operations and facilitation and any other case specific competency. In addition, local rules
and legislation may set particular competency requirements.

5.2.4. Requirements for Performing Consequences of Failure (CoF) analysis

General requirements
The CoF assessment shall start with a comprehensive description of the system or item that
is considered in the RBI process. Relevant system data such as location, dimensions,
materials and process data such as temperature, pressure and fluid/gas properties shall be
available.
The actual analysis is done on relevant damage mechanisms and failure modes of the system
or equipment. The analysis should then lead to a credible classification of the potential
consequences of that failure mode.
When assessing the CoF, HSE aspects shall be included as a minimum. If the RBI process is
used for assuring HSE rather than for financial optimization, the averaging of individual
aspects (HSE and/or business consequences) is not allowed.
Consequence values might be derived from existing quantitative risk assessments or other
risk assessment analysis considering consequences of release. For assessing the CoF: safety,
CoF: health and CoF: environment, the mass of fluid which is released due to a leak, is usually
the main factor. In the case of release, the inventory of isolatable sections of a process plant
shall be considered. The inventory is the total mass of the fluid present in a single isolatable
section. The mass (volume, density) of the whole inventory shall be utilized in the
assessment instead of the individual smaller mass of fluid in each item of equipment. These
sections are often defined by Emergency Shut-off Valves (ESVs).

Requirements related to CoF: safety

The CoF: safety assessment shall be documented and approved by the responsible
authorities recognised as per the applicable (e.g. national) regulations, if necessary.
The methods can be based on at least one or more of the following aspects (depending on
the type of equipment and fluid):
 released mass flow rate;

16
 type of release (instantaneous discharge of total contained quantity or by leakage at a
specified rate);
 flammability;
 toxicity;
 energy release (pressure or heat); and
 kinetic energy of projectiles (kinetic energy of equipment fragments with a potential of
domino effect).

Requirements related to CoF: health

The CoF: health assessment shall be documented and approved by the responsible
authorities recognized as per the applicable (e.g. national) regulations, if necessary, as
required for CoF: safety
The methods can be based on at least one or more of the following aspects (depending on
the type of equipment and release):
 properties of the release that affect health;
 released mass; and
 acute or long-term effects on persons / population.

Requirements related to CoF: environment

The CoF: environment assessment shall be documented and if necessary approved by the
responsible authorities recognized as per the applicable (e.g. national) regulations as
required for CoF: safety.
The environmental impact shall include effects on soil, air, surface water and ground water.
The methods can be based on at-least one or more of the following aspects (depending on
the type of equipment and release):
 properties of the release that affect the environment;
 released mass;
 direct and indirect effect on flora and fauna; and
 remediation effort.

Requirements related to CoF: business

The CoF: business assessment should be documented like rest of the consequences.
It is required to consider the financial effect of a failure on assets and total or partial loss of
production. Damage to assets typically includes material and labour costs of repair and/or
replacement of equipment. Costs associated with product value could be: lost revenues
caused by production losses due to shutdown and/or loss of containment, reduced margin
in case of off-spec products or reduced throughput and reprocessing costs, etc.

17
5.2.5. Requirements for performing Probability of Failure (PoF) analysis
Conservatism of simplified approaches
Available methods for assessing Probability of Failure may vary in their level of detail. The
results from a simplified approach such as risk screening shall be conservative when
compared to the results from a more detailed analysis.

Auditability of results
The results shall be auditable by peer review; therefore the methodology, the input data, the
decision criteria and the results shall be documented (the results may be recorded in an
approved document).

Multi-level approaches (screening - detailed, in level of asset hierarchy)

Qualitative, semi-quantitative or quantitative approaches (ranging from screening to
detailed) shall be used. The use of descriptive terms, such as “very high” to “very low” or
similar can be used only if the meaning (explanation) of these terms is provided. The
approach can be multi-level both in terms of “qualitative/quantitative” and in terms of level
of asset hierarchy.

Levels of Analysis are implemented in iRiS RBI as follows:

 Level I Analysis is an easy-to-use qualitative screening tool that provides rankings and
ranges only for units or major portions of units at a plant site to highlight the equipment
that is at high-risk so users can determine priorities for further quantitative RBI studies.
Output is generated in the form of a five-by-five matrix of Probability versus
Consequence and provides further information that includes the ranking and suggested
inspection intervals. Level I is designed as first step toward quantitative criticality
ranking.
 Level II Analysis is a semi quantitative approach that expands on the level I analysis and
provides most of the benefit of Level III analysis regarding likelihood determination, at
the cost of lesser elaboration on consequences and as a result, requires less input than
Level III. It will provide the probability ranking based on the outputs of technical
modules only, and provide the evaluation of consequences based on affected area only.
 Level III Analysis is a quantitative approach to RBI providing the most detailed analysis
of the three levels. This level provides Financial Risk analysis and Equipment
Modification Factors analysis along with the data provided in the Level III analysis.

Additional aspects to be considered

The PoF assessment shall be structured with well-defined boundary conditions. In order to
allow the use of other/similar approaches for global companies, the PoF assessment should
be done in such a way that the following aspects are covered, to screen the operation and
identify the relevant degradation mechanisms:
 identify susceptibility to degradation mechanisms;
 establish realistic (“best estimate”) damage rates;
 determine the susceptibility to failure and/or assess the probability that a given level of
damage will exceed the damage tolerance of the equipment and result in a failure;

18
  analyse possible interaction or synergy effects for all active and potential degradation
mechanisms;
 assess the effect of the inspection and monitoring program in the past as well as the one
planned for the future;
 determine the confidence level in the damage rate e.g. considering the following aspects:
o inspection history and effectiveness;
o process parameters and available process data;
o degradation models, their applicability and shortcomings;
o effectiveness of mitigation such as the effect of inhibitors and recoating; and
o Update the confidence level after inspection.
 determine the PoF with respect to the planned interval for the next inspection; and
 determine the PoF with respect to risk acceptance criteria.

5.2.6. Requirements for Performing Risk Assessments

The requirements specified for personnel, PoF assessment and CoF assessment apply also
to risk assessment [4]. In addition:
 The development of a scenario for each failure mode is a critical step. Techniques such
as fault tree analysis, event tree analysis, Bayesian networks, cause and effect methods,
bow tie and similar should be considered;
 The efficiency of the risk mitigating activities shall be connected to identified failure
modes and the projected risk reduction should be estimated and/or follow ALARP
principles.

5.3. RBIF within the overall management system

The development and implementation of a RBIM plan requires resources (e.g. personnel,
budget, spare parts, documentation etc.). The management shall assess the effectiveness of
the RBIM by monitoring performance indicators such as completeness of implementation,
leaks and near leaks, overdue inspection/maintenance tasks, reliability, costs and similar.
The management shall identify and define the objectives related to acceptable levels of risk
in inspection and maintenance activities. The objectives should be transparent and support
the company’s overall objectives, with respect to health, safety, environment, production,
quality and reputation etc. The objectives should also be in-line with the national or other
normative requirements, and/or possible other requirements (e.g. the contractual etc.).
The RBIM strategy shall ensure that risk mitigating actions are identified and implemented
before the health, safety or environmental (HSE) risks associated with an equipment failure
become unacceptable. If the HSE risks are tolerable/acceptable, actions to reduce economic/
business risks may still be needed.
The RBIM framework shall be seen as a part of the overall Maintenance Execution Inspection
(MEI) working process and the Quality Management System (QMS) taking into account the
following:
 definition of objectives, goals and requirements;
 establishment of inspection and maintenance program(s);
 planning of tasks and activities in inspection and maintenance;
19
  execution of work orders;
 reporting about failures and status;
 preparing and performing improvement/corrective actions;
 asset management;
 management of change;
 ensuring safe production and safe work practices;
 emergency response and controls;
 investigation of incidents;
 training; and
 control and quality assurance.

5.4. Compatibility with other known approaches

The overall RBIF approach proposed in this standard, based on CWA 15740:2008 [1], is
generally compatible with other major risk-based approaches such as API [17], VGB [18]
and ASME [19] [20], and it follows similar goals. However, while the principles are largely
similar, the users are warned against expecting identical results. There are differences in
detail that may result in differences when using different approaches on the same plant, case
or system.

6. The RBIF process

The RBIF process provides guidance for developing and maintaining a risk-based inspection and
maintenance program, preferably embedded into a higher level quality or risk management
environment such as Asset Integrity Management System (AIMS), Integrated Risk Management
(IRM) and Process Safety Management System (PSMS). The RBIF process includes these main
steps:
1) initial analysis and planning;
2) data collection and validation;
3) multilevel risk analysis (risk assessment);
4) decision making and action plan;
5) execution and reporting; and
6) performance review/evergreening phase.
An overview of the RBIF including Reliability Centred Maintenance (RCM) for functional failure
is shown in the Figure 2. Functional failure is included to demonstrate that RCM follows the same
route as RBI and results in proactive maintenance planning.

20
 Continuous improvement INITIAL ANALYSIS AND PLANNING
and management change  Objectives, system, criteria
 Acceptance
 Hazard identification
Redefinition of
the scope of analysis
DATA COLLECTION AND VALIDATION

Feedback RISK ANALYSIS SETUP

 Selection of systems, equipment and components
 Specification of possible generic scenarios, failure modes and consequences

Integrity related Integrity related, Functionality related

safety system related
or functionality related?

Safety
RBI activities system RCM activities
related
tion s

tion s
Detailed analysis Detailed analysis
tra mles

tra mles
(Intermediate levels) (Intermediate levels)
nsi

nsi
a

a
Screening analysis Screening analysis
Se

Se
MULTILEVEL RISK ANALYSIS MULTILEVEL RCM ANALYSIS
 Scenario (structural failures)  Scenario (functional failures)
 Probability of Failure (PoF)  MTBF assessment
 Consequence of Failure (CoF)  Probability of Failure (PoF)
 Risk  Consequence of Failure (CoF)
 Risk/reliability/availability

No
Risk acceptable? Mitigation measures

Yes
DECISION MAKING / ACTION PLAN
 Operation review
 Inspection planning
 Monitoring
 Maintenance planning

EXECUTION AND REPORTING

PERFORMANCE REVIEW / EVERGREENING PHASE

 KPI assessment
 Evaluation reporting
 Update periodically

Figure 2 — Framework of RBIM procedure within the overall management system

6.1. Initial analysis and planning

General description and scope
Initial analysis and planning key to the RBIF and in which the objectives and scope of the
RBIF (in terms of systems and sub-systems) and relevant criteria for the assessment shall
be adequately defined.

Planning and preliminary analysis

The initial analysis and planning phase starts immediately after the decision to implement
RBI at a location (or in a particular plant or area) is made. This phase consists of the
following steps:
 definition of objectives (e.g. company health and safety objectives, optimized
timing/prioritisation and extent of next inspection);

21
 definition of systems, sub-systems (loops) and equipment to be considered, as well as
the respective boundaries (e.g.: preheating system from inlet x to outlet y [P&ID No.#]
including pressure vessels xyz, etc.);
 definition of the scope of analysis, including normal operating conditions and
exceptional situations to be considered (e.g. start-up/shutdown, disturbances, accidents
etc.), as well as the operating periods covered;
 definition of data sources available (e.g. design data, equipment history,
equipment/component inspection data, PHA studies, etc.);
 definition of regulations to be considered;
 specification of the team;
 specification of the tools (including software) to be used;
 Acceptance of the methodology and objectives by relevant actors concerned (e.g.
management, external bodies and/or authorities);
 Definition of accepted risk.

Definition of objectives
Management shall clearly define measurable objectives for the assessment and confirm the
applied procedure suggested by the assessment team. These objectives are largely defined
in terms of health, safety, environment and business impact. In particular, risk-based
inspection and maintenance when applied to a plant shall address one or more of the
following objectives:
 meeting the requirements of health, safety and environmental regulations by reducing
the corresponding risks to at least ALARP level or lower;
 improving the safety and reliability of the plant;
 optimizing inspection and maintenance (possibly also production and quality) cost; and
 extending the useful service life of the plant, e.g. beyond its design life, and implementing
an appropriate end of life strategy.

Definition of systems, sub-systems (loops) and equipment to be considered

As the RBI analysis may focus on multiple levels, from several plants, a single plant or certain
systems (unit operations) of a plant, to certain equipment or even components of an
individual item of equipment, the first step consists of defining the systems and/or sub-
systems (loops) of interest.
Systems are generally defined based on the functions they perform. The sub-systems shall
be manageable and meaningful to allow for assessment of specific issues related to them,
e.g. according to particular degradation mechanisms, process parameters, materials
selection, inventory groups, etc. Note that the Inventory is the total mass of fluid available
for release through a leak in an isolatable section of a process plant (inventory group).
In order to establish the hierarchy, every system is divided into sub-systems, equipment
and/or locations that might relate to a system failure. This ‘decomposition’ shall continue
until the smallest components for which sufficient data from inspections, maintenance, and
failure history are available or may be collected. In certain cases, Condition Monitoring
Locations (CMLs) can be also be used to enhance/ optimise the monitoring and maintenance
of equipment.

22
Definition of the scope of analysis
For the systems, sub-systems (loops) and equipment to be assessed, the scope of the analysis
including operating conditions, loads and exceptional situations (e.g. upsets), as well as the
operating period considered shall be determined.

Definition of data sources available

The data sources available shall be identified. The data, as a minimum, shall include:
 design data;
 operating data; and
 historical data (maintenance and inspection records), where available/applicable.

The data should be balanced in respect to the needs of the application (system or
equipment), the scope of the assessment, the expected level of detail (or acceptable
uncertainty) in the results, and foreseen future service.
Preceding an initial analysis, a brief overview of the plant or unit and its operation as a whole
shall be given, including, if available, the following information:
 process/operating history;
 specific process/operating requirements for plant items within the scope;
 routine operation;
 specific limiting factors for plant items within the scope;
 factors that can result in abnormal and upset conditions;
 possible future process/operating issues;
 potential degradation mechanisms and influential process variables and usual methods
of mitigation;
 inspection history overview, including repair and alterations; and
 Management of Change (MOC) list (plant, field changes).

Where no data exists (e.g. inspection history, because the plant or unit is still in the design
phase), a conservative risk approach shall be applied based on the RBI teams’ expertise and
experience.

Definition of regulations to be considered

The applicable regulatory requirements shall be identified. These requirements may include
the qualification of team members, software tools to be used, prescribed inspection
intervals, etc.

Team specifications
The RBI team shall have these competencies:
 inspection and maintenance;
 specific equipment disciplines (e.g. materials, corrosion, electrical, instrumentation and
control, fixed and rotating equipment, etc.);
 health, safety and environmental issues;
23
 plant operation and processes;
 reliability risk assessment and business impact.

Attention should be paid to the selection of the competent team and the RBI facilitator, both
being a key element in successful risk-based assessment. In addition, plant specific
knowledge should be available in-house. Where in-house experience is non-existing or
unavailable, an appropriate external resource may be consulted.

Tools to be used
It can be difficult to perform a detailed risk assessment without the support of dedicated
software tools. Such tools are used for managing the input data, performing the operations
and calculations required for risk assessment and supporting decision making. Additionally,
computerized systems are used to store the data and analyse results or other related
information when the need for reassessment arises.
The RBI team shall make sure that the software to be used is able to comply with the scope
and targets given for the assessment and that the basic analysis methodologies comply, e.g.,
with local legal requirements.

Acceptance of the methodology

The RBI team and plant management should have an understanding of the level of
commitment and resources required for a successful implementation of the procedure, and
shall be responsible to ensure the acceptance of the procedure and its objectives by the
essential stakeholders.
In order to include the HSE risks, the metric for risk-based decisions shall be defined via
company standards and/or national legislation. For the process industry in general, three
main risk criteria should be used:
 plant worker safety and health;
 3rd party safety (people outside the plant boundary); and
 environmental damage, in short and long terms.
In case of business risk/impact, no absolute limits are provided by the regulatory
framework or comparable practices. Instead, the business impact associated with the
assessed risk is to be compared with the competing alternatives in monetary terms.
Financial limits shall be expressed by plant management well within the initial stage of the
assessment process and provided to the RBI team.

Definition of accepted risk

The risk acceptance criteria are used to derive the required inspection and maintenance
activities within the given time frame. For degradation mechanisms developing over time,
the degradation rate and acceptance limit provides an upper bound on the timescale for
preventive maintenance or inspection activities. For non-trendable degradation
mechanisms, the acceptance limit has no clear time scale, and prevention (through design),
or early detection through proper measures (inspection, maintenance, operation) and
process monitoring shall be demonstrated. In all cases, the effectiveness of selected
inspection methods for detecting degradation mechanisms and damage extent shall be
considered.
24
6.2. Data collection and validation
General description and scope
The collection and organization of relevant data and information (e.g. about design,
operation, failure information, etc.) is mandatory in risk-based analysis. The data used to
assess both the probability and consequence (and thus the risk) should be validated.
Where the data are sparse or of poor quality, the uncertainty associated with the risk
analysis should be assessed and possibly quantified. In such cases, the conclusion and
assessments shall be on the conservative side with respect to consequences and
probabilities.
Before collecting data, the RBI team shall specify the data that will actually be needed. This
is needed in order to plan the data collection process, and to assess the effort needed to
collect the data and the information. All collected data should be stored in a database like
system, which will enable the assessment, additional updating and auditing during the RBI
process. Refer to the iRiS RBI application segment of this document for further details.

Requirements
Data collected for the implementation of the RBIF process shall include at least:
 plant level data;
 design, manufacturing and construction data;
 operating data;
 maintenance and inspection;
 safety systems (e.g. fire detection systems, etc.);
 relevant international available experience; and
 business related economic data (optional).

In addition to reviewing documents, e.g. Process Flow Diagrams (PFDs), Piping and
Instrumentation Diagrams (P&IDs), inspection, maintenance and operating records and
procedures, etc. the team shall ensure that relevant non-documented data are collected.
The team shall have access to plant personnel who can provide an understanding of the
actual plant configuration and operating conditions, the effectiveness of the plant inspection
and maintenance programs, and the identification of problems particular to the investigated
plant.

Collect and validate documented data

The collection and validation of documented relevant data shall as a minimum include the
following elements:
 Design, manufacturing and construction data:
These data are largely plant and equipment specific and in the form of numerical data or
diagrams and drawings of the process and systems, equipment, material selection and
corrosion controls, as well as safety systems. These background data also describe the
functional requirements and intended loadings, and can indicate potential locations of
failures. Data validation may be performed by internal cross-comparisons, comparison
to physical and technical limits of the process and by cross-comparison to expert
opinion.
25
 Inspection and maintenance history (including failure analysis):
These data are plant and equipment specific, and typically include records of inspection
results and of possible corrective actions such as repairs or modifications to the original
system or equipment. The records shall also include experience on the mode and causes
of failures or other process anomalies. The most recent data updates any preceding
information, and it may be possible to construct time series from these data. Records of
previous engineering and failure analyses, as well as data and results from other process
safety risk assessments (e.g. RCM, QRA, PHA, HAZOP, etc.) may be considered as input to
the RBI analysis. Data validation may be performed as described above.
 Operational history:
These data are plant and equipment specific, and may include at least some records of
operator logs to identify operating periods, transients outside the integrity operating
window (IOW), start-ups, trips and other shut-downs, and load levels during different
phases of operation. These records also indicate to what extent the actual operation has
possibly deviated from that intended in design. For predicting the future performance, it
is imperative to consider the future mode of operation, if it is foreseen to be different
from that in the past. Data validation may be performed as described above.
 Safety systems:
Measures or barriers intended to prevent or control any hazard which may arise during
plant operation, or to mitigate the consequences in case of hazardous release. These
measures or barriers mainly comprise of:
o plant safety devices such as e.g. pressure relief systems, spill, fire and gas
detection systems; and
o people and procedures e.g. operators, operating procedures, training and
competency.
 Generic failure and operational data for similar cases or equipment:
Generic data about failures in similar cases and equipment is available from various
sources [4] [21]. Generic data and information from operational experience are partly
included in these sources, although the available information can vary widely depending
on case and equipment. Data validation can be mainly performed by comparison of such
sources and by expert opinion.
 Economic data:
These data can in principle be plant and equipment specific, but are also often taken as
generic for each equipment type or type of action to be performed on it. Data validation
may be performed by cross-comparisons or by asking for quotations from suppliers. The
required information should also include cost of loss of production and indirect losses
due to e.g. fines, refurbishment, etc.

Collect relevant non-documented data

Non-documented data typically consist of personnel knowledge and opinions, which can be
a very important source of information for the RBI analysis. Therefore, an interview process
with the personnel (subsequently referred to as “expert”) is recommended, and should
include the following aspects:
 expert opinion on his/her general experience with the equipment or system;
 expert opinion on the perceived consequences (including personal) of unforeseen
equipment failure;

26
  expert opinion on the earliest possible time of failure;
 expert opinion on the longest possible life (for a single item of equipment), or (for multi-
component items of equipment) on a time when repair is no longer economic/feasible;
and
 expert opinion on reasonable time intervals between shortest and longest failure times.
Agreement on the intervals is important, because too coarse a scale will not reveal
uncertainty, and too fine a scale may require excessively detailed analysis.

6.3. Multilevel risk analysis (ranging from screening to detailed)

General description and scope
Risk analysis consists of the following steps:
 identify hazards;
 identify relevant degradation mechanisms and failure modes;
 determine Consequence of Failure (CoF);
 determine Probability of Failure (PoF); and
 determine risk and classify equipment e.g. on CoF/PoF risk maps or iso-risk (equal-risk)
curves [17] [20].
Multilevel risk analysis defines the risk assessment in terms of complexity of the analysis
(e.g. from the simplified/screening analysis to the detailed one), and in terms of plant
hierarchy level (depth).

Risk analysis - screening level

Risk screening is particularly suited for plants with a limited set of data and for the initial
evaluation phase. It divides the systems and groups of equipment into two groups:
high/medium-risk items and low risk items; the high/medium risk items should be analysed
in detail while the low risk items should only require minimal surveillance to verify and
ensure that the assumptions made during the screening process remain true (see Figure 3).
If information is missing during the screening, preventing the determination of risk
associated with the equipment, the equipment shall be regarded with a conservative
approach as having the worst conditions.
The following requirements shall be fulfilled for risk analysis:
 The decision criteria shall be defined and recorded in writing;
 The PoF shall be established for a given (predefined) time frame based on a prediction
of damage development for operation within a specified operating window. The
specified operating window shall include factors, which can be influenced by the
operation of the process (e.g. temperature, pressure) as well as factors which cannot be
influenced by the operation (e.g. seismic zone, climate);
 The health, safety, environment and business effects shall be included in order to assess
the consequence. In addition, the consequence results should be such that the highest
(dominant) CoF for one of the individual aspects (health, safety, environment and/or
business consequences) determines the final score (no averaging);
 The methodology, the input data, the decision criteria and the results shall be
documented;
 The results shall be auditable by peer review;
27
 Level 1 Level 2
(Screening Analysis) (Intermediate Analysis)

Very Action as for High Risk

High (Level 3),
Medium High consider repair/replacement
High

Risk Risk High

Level 3
(detailed analysis, based on e.g.)
PoF

Medium
 Detailed NDT
 Strain measurements
Low Medium Low  Hardness measurements
Low

Risk Risk  A-parameter

 FE analysis
Very Low  Crack assessment

Low High
CoF
Decision making /
Action Plan

Execution and Reporting

Performance review /
Evergreening Phase
Figure 3 — Screening risk matrix

Risk analysis - detailed assessment

The detailed assessment shall be applied to the high/medium risk systems and groups of
equipment identified during risk screening and to all equipment within the scope of work if
no risk screening has been performed. For each system or group of equipment, the relevant
degradation mechanisms shall be identified and the extent of damage shall be estimated.
Furthermore, the most likely damage development shall be determined. Based on this
information, the maximum time interval to the next inspection/maintenance activity shall
be determined subject to the condition that the health, safety, environmental and business
risks remain acceptable (as defined in the acceptance criteria). This should then be
combined with inspection/maintenance cost and inspection/maintenance effectiveness to
derive cost optimal maintenance/inspection intervals such that the health, safety, and
environmental, risks are acceptable, i.e. the acceptance criteria are satisfied.

The detailed analysis consists of the following main tasks (Figure 2):
 identify hazards, relevant degradation mechanisms and failure modes;
 determine probabilities of failure (both unmitigated and in those later mitigated);
 determine consequence of failure (both unmitigated and in those later mitigated);
 assess risk.

28
Requirements
The main requirements for identifying and considering degradation mechanisms are:
 identify the degradation mechanisms according to the systematic example given in
Figure 4. The degradation mechanism can be active in a given system/equipment;
 the plant breakdown, identification of degradation mechanisms and analysis process
shall be duly documented;
 the plant management shall ensure that service and maintenance history and knowledge
of all known degradation mechanisms in the plant is considered in the analysis;
 the responsible person(s) involved in the analysis shall ensure that all knowledge about
the degradation mechanisms from the available literature is considered in the analysis;
 the responsible person(s) involved in the analysis shall ensure that all available
knowledge about the degradation mechanisms and experience from similar plants is
considered in the analysis;
 all emerging degradation mechanisms not taken into account under the specific
categories are taken into account under “other” degradation mechanism.

In addition:
The analysis of failure modes increases the level of detail in the CoF assessment. If it is not
undertaken, a conservative approach shall be followed. A conservative approach may, e.g.,
assume that the complete inventory escapes instantaneously.
The PoF shall be established for a given (predefined) time frame based on a prediction of
damage development for operation within a specified operating window. The specified
operating window shall include parameters which may vary during operation (e.g.
temperature, pressure) as well as parameters which cannot be changed (e.g. seismic zone,
climate).
The prediction of lifetime may come from the result of one of the following: measured
inspection data, calculation making use of operating conditions or expert opinion. If so
desired, specific analysis tools may be used, e.g. probabilistic (safety) analysis and/or fitness
for service analysis. For all non-trendable degradation mechanisms, for which degradation
progress cannot be properly monitored or predicted, prevention (through design), or early
detection through proper measures (inspection, maintenance, operation) and process
monitoring shall be demonstrated. A methodology should be available in which the relation
between the effectiveness of measures (type, scope and frequency) and the
likelihood/probability of failure is given.
The CoF analysis shall focus onto the highest (dominant) aspect from the individual ones
(health, safety, environment and/or business). The averaging of these aspects shall not be
done.
The decision criteria shall be defined and recorded in writing. The methodology should be
verified/ benchmarked. CoFsafety can be benchmarked against existing and recognized
methods.
The task should be performed by the competent RBI team (see 6.2, Initial analysis and
planning).
The results should be auditable by peer review; therefore, the methodology, the input data,
the decision criteria and the results shall be documented (the results shall be recorded in an
authorized document).
29
 Failure cause or root cause

Disturbances, deviations,
Material damage related problems
function related problems

I. Corrosion, erosion,
IV. Fouling/Deposits
environmental related

I.A Volumetric loss of material on VI.A Deposits, fouling without fluid

surface disturbances

I.B Cracking (on surface mainly) ...

... V. Fluid flow disturbances

II. Mechanical or thermo-

mechanical loads related to: VI. Vibration

II.A Volumetric loss of material on

surface VII. Improper dimensioning,
improper clearances
II.B Cracking (on surface mainly)
VIII. Man-made disturbances
...
IX. Natural disturbances
III. Other structural (e.g. earthquakes, flood, storms)
damage mechanisms
X. Fires, explosions or similar

XI. Damage and/or loss of function

due to other cause

XI.A External leakage (EXL)

XI.B Failure to start (FTS)

XI.C Failed while running (FWR)

XI.D Overheated (OHE)

XI.E Other (OTH)

Figure 4 — Damage types that may be considered, appearing as failures or root failure causes [4]

Performing a Risk Assessment

In order to assess the health, safety, environment, and business risks, the probability and
consequence of failure shall be determined. The results can be plotted in risk matrices
(Figure 12) for presentation and comparison. Separate matrices should be used for each risk
type unless it is appropriate to compare/combine the risk types. Note that the risk matrix
presents the risk for a predefined time period.
It is generally useful to rank the evaluated equipment or components by risk level (see Table
2), because this will provide guidance on where to concentrate the inspection/maintenance
effort and where such activities can be reduced. If risks are measured in monetary terms,
the expected need for mitigation investment as well as savings resulting from avoidance of
30
unnecessary inspection and maintenance become apparent. This requires the setting of a
reasonable cut-off level for the evaluated risk criteria.

Risk Level Decision/Action criteria

Very high Define required immediate measures to reduce risk e.g. consider equipment repair/
replacement. A possible re-design may also be considered.

High Define required inspection and maintenance program to reduce risk. (Note: it can be
acceptable if the driver is economic loss, security, image loss and public disruption)

Medium Reduce the risk through mitigation measures as low as reasonably practical (ALARP).
For business risk, find the optimal cost.

Low If no inspection and maintenance program plan exists, it is not mandatory to establish
one. Otherwise, fine tune the program to find the optimal costs and follow the ALARP
principle.

Very Low No Action

Table 2 — Example of decision/action criteria for various risk levels in risk matrix [4]

Output
The results from these tasks are:
 the PoF value for the item of equipment under consideration;
 the CoF value for the item of equipment under consideration;
 risk matrix, utilizing the values gained for item of equipment under consideration; see
example in Figure 12 below, and
 risk value or category from Table 2.

31
 PoF
MOTBF Qualitative Description Cat.
annual
In a small population*, one or more failures
can be expected annually.
<1 Very
> 10−2 5 Very high risk
year probable Failure has occurred several times a year in
location.

In a large population**, one or more failures

can be expected annually.

Probability of Failure/Likelihood
1–5
10−3 to 10−2 Probable 4 High risk
years Failure has occurred several times a year in
operating company.

Several failures may occur during the life of

the installation for a system comprising of a
5–25
10−4 to 10−3 Possible small number of equipment 3 Medium risk
years
Failure has occurred in company.
Several failures may occur during the life of
the installation for a system comprising of a
25–100 large number of equipment
10−5 to 10−4 Unlikely 2 Low risk
years
Failure has occurred in industry.
Failure is not expected.
Very Low,
> 100
< 10−5 Very unlikely Failure has not occurred in industry. 1 (negligible
years
risk)

Notes: Consequence of Failure

* Small population = 20 to 50 items of equipment.
A B C D E
** Large population = More than 50 items of equipment.
Warning Limited impact Serious impact
Warning Temporary
issued on public on public
issued health
Health effects problems,
health, threat health, life
Possible of chronic threatening
No effect curable
impact diseases illness
(or)
First aid
No aid needed
needed Temporary Permanent
Safety effects Work work disability work disability
Fatalities
No work
disruption
disability
(or)
Off-site
Impact (e.g.
Negligible Minor impact On-site damage
Environment impact
spill)
(e.g. spill) damage Long term
contained
effect
(or)
Business (€) < 10k€ 10–100 k€ 0,1–1 M€ 1–10 M€ > 10 M€
(or)
On-site
Security None On-site (Local)
(General)
Off site Society threat

(or)
Loss of reputation None Minor Bad publicity Company issue Political issue
(or)
Small Large
Public disruption None Negligible Minor
community community
Figure 5 — Example of the risk matrix for detailed assessment, involving HSE and economic risks with five risk
limit categories, including examples of the values on the scales (the scale and values to be determined in each
particular application), adapted from [4] [22]

32
6.4. Decision making/action plan
General description and scope
The following findings/factors necessitate optimization and updating of the strategy (plan):
 material degradation;
 unreliability of equipment/machinery;
 human error in the operation, maintenance or inspection of the equipment/machinery;
 legislation and other regulatory requirements;
 external hazards such as earthquakes, harsh weather etc.; and
 unacceptable risk, as defined by the acceptance criteria.

Requirements
Adequate competencies, understanding, knowledge and experience relevant for:
 RBI and knowledge of how the RBI results relate to inspection activities;
 degradation mechanisms and inspection methods including their application and
limitations;
 legislative requirements and facility specific procedures and requirements; and
 relevant acceptance criteria and codes.
The work process shall be auditable by peers and well documented.

The inspection and monitoring plan:

 shall consider relevant degradation mechanisms for all systems included in the scope.
 shall meet the relevant legislative requirements;
 should be verified in the field and adjusted for accessibility, removal of insulation and
other preparatory work;
 shall be verified by personnel with a similar or higher competence level than the
personnel establishing the plan.

Inputs
The minimum required input to establish a risk-based inspection and maintenance plan are:
 results from RBI analysis including degradation mechanisms, PoF, CoF, risk ranking and
the time interval of inspection and maintenance plans;
 historical inspection and maintenance data;
 design and operational data including necessary technical documentation; and
 general turn-around plans and availability of the relevant systems/equipment.

Procedure
The following steps can be followed to prepare an inspection program based on the RBIF
methodology:
 identify items with risk above the risk acceptance limit;
 define actions for the different degradation mechanisms;
33
 define degradation groups and relevant areas susceptible to damage (i.e. susceptible
areas);
 select inspection points/locations.

These steps do not take into account other documentation/information that is required to
optimize the inspection program. Such information might be:
 monitoring results, including IOW;
 process changes;
 operational irregularities (upsets);
 non-conformities from fabrication; and
 legislative requirements.

The above mentioned documentation might change the RBI results and hence alter the
inspection program. Such information should be incorporated in a RBI re-
analysis/evergreening to reflect the actual situation in the best possible way.
The analysed equipment should be ranked according to risk. Equipment exceeding the risk
limits soon after the planned inspection period should also be included into the planning.
This step can help to better prioritize the actions.
Following the results of the RBI analysis, the applicable degradation mechanisms shall be
identified and relevant inspection methods shall be defined for each type of mechanism. The
following shall be evaluated (see also Figure 6):
 next inspection, maintenance or monitoring interval;
 inspection method and required coverage to achieve reliable results;
 probability of detection (PoD);
 typical inspection locations (consideration of weakness and locations for corrosion
control i.e. susceptible areas); and
 inspection cost; and
 case and application specific issues and limitations e.g. consider NII when dealing with
sensitized austenitic steel equipment.
This information can be used as basis for a company-specific guideline which controls the
handling of different degradation mechanisms.

Define degradation groups and relevant susceptible areas

Figure 6 provides the suggested general workflow of the RBI process. In order to achieve an
effective inspection program, the inspections should be organized according to the
degradation groups, as illustrated by step #2 in Figure 6. This utilizes the correlation
between items within same degradation group to achieve reliable and updated degradation
rates. A degradation group might suffer from several types of degradation, with several sets
of susceptible areas; these should be assessed and planned separately, as shown by step #3
in Figure 6.

34
 Maintenance, monitoring
or other risk mitigating actions

START: #1
Filter on Inspection due to
Components/items with risk Flagged for inspection
inspectable other requirements
exceeding risk acceptance in the actual year
degradations (e.g. legislative)
criteria

#4 #2
#3
Identify all susceptible Group by degradation
Group by degradation
areas on inspection mechanisms
mechanisms
drawings and in the (e.g. degradation
within each group
field groups)

#5
#6
Select a representative Annual detailed
Decide the optimal
number of susceptible inspection program
inspection method
areas

#7
#9 #8 Verify/correct the
Report inspection Perform inspection inspection program at
site

#10
Assess the
No Yes #11 END:
inspection results:
Update RBI analysis Update inspection program
need to
update?

Figure 6 — Example of general work flow of the RBI process

The inspection coverage with respect to number of susceptible areas should be assessed
according to the entire degradation group – all susceptible areas within the group shall be
identified to understand what constitutes the full “100% inspection” for the relevant
degradation, as shown by step #4 in Figure 6.
Based on defined hot spots within a degradation group and defined inspection methods for
different degradation mechanisms the accurate inspection points (e.g. CML’s), as shown by
step #5 in Figure 6, and inspection method as shown by step #6 in Figure 6, shall be applied.
The inspection and inspection effectiveness table given in [23], Appendix F may be used as a
guideline to decide on inspection extent.
The inspection program should be verified on site to optimise the program with respect to
access and other relevant conditions, normally outside the RBI analysis. This input shall also
be utilized to plan for preparatory work, as shown by step #7 in Figure 6.

35
 Output
In principle, the decision logic gives guidance for the establishment of preferred inspection
and maintenance strategies on the basis of the risk assessment, detectability of damage and
the failure characteristics.
The inspection and maintenance plan shall be plant specific. Such a plan shall include but
not be limited to, the following elements (the same holds true for dead-legs and piping with
irregular flow e.g. bypasses, drains, etc.):
 details of inspection methods (e.g. UT scan), locations (e.g. Nozzle G 6°° position) and
interval (e.g. 24 months);
 time and condition based maintenance (preventive/predictive);
 on-stream inspection and maintenance;
 planned corrective actions (e.g. replace nozzle);
 identification of degradation and damage (e.g. general corrosion 0,2 mm/year and
erosion); and
 regular functional testing (PRV) and monitoring (IOW);
 the RBI inspection plan shall ensure timely and effective inspection, which correctly
detects and identities the degradation, and reduces the uncertainty by increasing
knowledge about the actual equipment state.

6.5. Execution and reporting

General description and scope
The output of a RBIM plan is the input for the planning and scheduling for all involved
departments, disciplines and contractors for the maintenance and inspection work at a
facility including the turnaround. The output of the development of the RBIM plan will be
based around maintainable items. It will allow management of risk and lead to knowledge
based decisions. The RBIM output will allow for a broad variety of strategies such as the
reduction or mitigation of the risk through monitoring, functional testing and improvement
of procedures for process, operation and/or maintenance, inspection, modification, repair,
replacement, or operation to failure. The maintenance work can be split into three main
categories shown in Table 3.

Type of maintenance Typical procedure By whom

1a. On-stream/in-service No plant nor item shutdown Operating / own staff / specialists /
(Non-Intrusive), OS/NI required contracting companies
1b. On-stream/not in-service Item shutdown required, but no Operating / own staff / specialists /
(Intrusive), OS/I plant shutdown contracting companies
2. Short shutdown Shutdown to change worn Own staff / specialists / contracting
equipment, or changes called by companies
process (catalysts, molecular
sieves, etc.)
3. Turnaround/general Larger plant stops for major Own staff and contracting
overhaul upgrades, repair, inspection, companies
process upgrades
Table 3 — Principal categories of inspection/maintenance

36
 Input
The main input to the planning and execution is a RBI process including all equipment in
scope. From this risk assessment the following results are expected:
 risk ranking of the plant(s)/equipment/component(s) including, but not necessarily
limited to static equipment, piping and pressure relief devices;
 type of inspection and maintenance. This can be a high level inspection plan as usually
delivered by the RBI software or a detailed inspection plan, including specific inspection
locations and methods as usually delivered by an inspection expert;
 timing for activity/planned inspection date – typically by condition based or time-based
scheduling;
 required work and skills to perform the tasks, and estimated time per task;
 requirement for total or partial plant shutdown, intrusive or non-intrusive inspection;
 dependencies between work on the evaluated unit and other equipment/components;
 tools, personnel expertise and spare parts required.

Procedure
The maintenance (or inspection) work normally consists of work generated from 3 different
sources (see Figure 7) and involves activities specified in Table 4:
1) Preventive plans generated by RBIM assessments (condition based and/or scheduled
maintenance), even if these only refer to inspection;
2) Corrective maintenance calls from observed failures or emerging problems;
3) Failures identified via condition monitoring.

Maintenance

Preventive Corrective
maintenance maintenance
(RBIM) (RBWS)

Condition based Scheduled RBIM

maintenance Maintenance recommended

Scheduled, on Non-regulatory
Regulatory required
request or required Immediate Deferred
maintenance
continuous maintenance

Figure 7 — Maintenance Planning. Example of RBWS priority setting for work order planning (short and long-term), EN
13306 [12]

37
6.6. Performance review/Evergreening phase
General description and scope
The purpose of the evaluation of the RBIM process is to assess its effectiveness and impact
in establishing the inspection and maintenance programs. This will allow the identification
of areas where modifications and improvements are needed. Specifically, evaluation
consists of the following tasks:
 assessment of the effectiveness of the RBIM process in achieving the intended goals
(assessment of effectiveness);
 updating the RBIM process by taking into account possible plant changes (additions, new
units, changes) and available new knowledge (reassessment of the risk);
 periodical re-evaluation of existing RBI plans in order to discuss eventual changes in:
a) design requirements;
b) process parameters, operational conditions;
c) actions after non-planned maintenance (e.g. plant integrity failures);
d) actions after turnaround (shutdown) maintenance and inspection; and
e) actions after legal and compliance issues.
 frequent discussion on inspection and/or maintenance findings in order to actualize
RBIM plans based on the newly acquired data;
 re-evaluation of data based on experience from industry or other plants with similar units
and process conditions, including relevant references and regulatory documents since
last review;
 periodical re-evaluation of CoF, based on the periodical re-evaluation of HAZOP etc. or
financial factors, e.g. through change in long term spare part availability, reputation or
product value.

Requirements
The evergreening process involves both internal and external assessment conducted by the
plant organization (RBI team) and by independent experts, respectively.
The internal evaluation by the plant organization is an integral part of every RBI activity and
should be considered as a living process within the overall risk decision making process.
The internal evaluation can take place in any moment of RBI, especially when:
 discrepancy from any expectation or requirement is found, e.g. design requirements,
process parameters, operational conditions, leaks, non-planned maintenance that has
been performed etc.;
 new knowledge or acquired data, e.g. inspection and/or maintenance findings is
available or plant changes occur.

In both cases, a detailed analysis of the importance of the involved item shall be conducted
in order to assess whether it has a significant impact on the RBIM process including the
inspection and maintenance planning, and some corrective action should be undertaken. In
the latter case a thorough analysis of the causes leading to discrepancy or of the effects of
the new knowledge/plant changes shall be performed.
The external evaluation can be executed through independent reviews by independent third
parties, by the owner, or regulatory bodies (e.g. audits). Independent reviews provide an
38
opportunity to complement the internal evaluation with a different and neutral perspective.
A point to note is that the value of information provided by the independent review is
directly proportional to the openness and collaboration that the external experts will find in
the audited organization. The integration of independent reviews with internal evaluation
will allow the identification of necessary actions for improvement.

Work process efficiency benchmarking

The RBI process should be benchmarked against best practices in the same plant, company
or industrial sector. This can be done in parallel and as part of evergreening, or separately,
in order to prepare a management report.
An internal evaluation resulting from the team’s experience with the RBI process can be
further supported by an external evaluation, part of an audit or view of authorities.
Since RBI is not a project in itself but a process, its implementation should partly be handled
as change management and be sustainable. The outcome of a RBI process is a risk analysis
including PoF and CoF, potential damages and damage rates, IOW as well as a detailed
inspection plan, including inspection locations, methods, reasoning for the chosen methods
(PoD), coverage and maximum inspection interval.
The following key elements shall exist after this phase:
 management system for maintaining documentation, data, IOW, analysis updates;
 documented method for determining the PoF and CoF; and
 documented method for managing risk through mitigation strategies (inspection and
other).

The RBI process is supposed to generate/identify/consider (as appropriate):

 potential and active damage mechanism;
 IOW parameters and limits;
 risk ranking of all evaluated assets/equipment;
 detailed inspection plan, incl. methods, locations, coverage, interval; and
 description of other mitigation activities, e.g. IOW monitoring, hazard effect control.

Immediately after the above outcome of the detailed inspection plan, the evergreening
phase begins. This phase usually includes following steps:
 inspection work pack initiation;
 inspection execution;
 evaluation of inspection data and entry into RBI database;
 feedback and NCR initiation;
 updates from units, if changes in equipment, process changes or process upsets have
occurred (this information needs to be made available by operations to inspection,
maintenance and RBI teams);
 risk calculation;
 update of active damage mechanisms (corrosion rate, remaining life) and inspection
plans;

39
 consultation of technical supervision organisations (if applicable);
 follow up on NCRs;
 confirmation of correction/repair;
 reminder of non-completed repairs and inspection due dates; and
 distribution of the RBI plan to the planning department.

The risk management and replacement strategy can be used in order to assess the optimum
time for replacements, according to cost of risk (this usually increases with time, but also
with market fluctuations, e.g. in case of high demand for the product, the cost of risk
increases), cost of not performing the maintenance, labour and material costs, value of lost
production during maintenance. Such RBI cost-benefit analyses serve as the economic basis
for inspection decisions and optimal replacement strategies in line with the turnarounds.

40
7. Overview of R-Tech iRiS
R-Tech iRiS is an acronym for a Risk-Based Inspection (RBI) software developed by R-Tech and
continuously updated since 2007, for equipment analysis in petrochemical, process and power
plants. The full name of the software is "integrated Risk management System for RBI" and it is
fully based on the API 581 Base Resource Documents.
The software integrates all relevant aspects of risk assessment and management in
petrochemical, process and power plants: RBI (Risk-based Inspection), RCM (Reliability Centered
Maintenance) and HSE/HSSE (Health, Safety, Environment / Security), as a company-wide
Intranet-Extranet-based platform.
RBM (Risk Based Management), RBI, RCM, RCFA, HSE and HSSE systems allow the inclusion of
safety, environmental, business and reliability considerations into the decision making process
and thus provide better targeting of resources and improved results of run - replace - repair
decisions, as well as in the overall operation, safety, inspection and maintenance.
This is accomplished by considering the risks of possible undesirable events, the risk itself being
expressed as the likelihood of the event (in a given scenario) multiplied by its resulting
consequences. When properly developed, implemented and used, the RBI, RCM, RCFA and
HSE/HSSE systems help to significantly optimize plant key performance indicators (KPIs) and
assure safe, economic and competitive operation.

In the following sections, the requirements for running the software are given and all integral
parts of the software are described.

41
7.1. Software identification card

Software Identification Card

Name R-Tech iRiS
Short description The software is used Risk Based Inspection analysis for assessment of the risk on
equipment/sub equipment level and for developing and evaluating inspection strategies.
An RBI analysis assists to determine the required effort by providing three key
parameters, the likelihood of failure of the item, the consequence of failure of the item
and the risk from the combination of likelihood and consequence of failure. The purpose
of a RBI analysis is to focus inspection activities on those pieces of equipment where
failure risks associated with an active damage mechanism are highest. The term risk is a
combination of the likelihood of failure and the consequence of failure. Program for
reduction of unexpected losses recommended and shall be made to the company (a set of
economically effective measures to reduce the risk of loss in case of damage and provide
protection to the company facilities).

Server – Minimum required

Processor Dual Core 2GHz
RAM 4 GB
HDD 320 GB
IIS
Version Minimum required: v6.0
SQL Server

Installation Microsoft SQL Server 2008 R2 installed in mixed user mode

Database
Name RTechRBI
Database
nss
User
Size (MB) ~8 MB (from current date)
Number of
34
tables
Extension .bak
DB Backups
Backup is performed by Maintenance Plan in MS SQL Server, it is done on every second
Backup
day.
Application
Developed
VB.NET
In
.NET Framework V4.0
Frameworks
Telerik 2014.1.403.40
Code backup is performed on every change, we are using Source Of Site (SOS) for
Backup committing changes and saving files.

IE Min V8 Used V10-11

Web
Mozilla Min V13 Used V29
Browser
Chrome MIn V23 Used V35

42
8. Technical Background

R-Tech iRiS RBI is fully based on the API 581 Base Resource Documents. The software is used for
the assessment of risk on the equipment/component level and for developing and evaluating
inspection strategies.

What is Risk?
In common usage, the word risk has several meanings often referring to the probability or
possibility of a loss. Alternatively, the word risk is used to refer to the magnitude of a possible
loss. In API 581 risk describes a combination of both the consequence and likelihood of a loss;
thus high-risk events have a high probability to occur, entailing more dire consequences or losses
while Low-risk events are less likely to occur, resulting in no significant losses.
The definition of risk as applied in the software is given below.

Definition of Risk
Risk is always the result of Consequence multiplied by Probability. Consequence is always
measured as {Consequences/Event}. Probability is always measured as {Events/Year}.
Therefore, Risk is always {Consequences/Year}.

Risk = PoF x CoF [i.e. square meters / year] or

[€/year]
Where:
PoF = Probability of Failure [events/year]
CoF = Consequence of Failure [i.e. square meters
or €]

Measuring Risk
In order to evaluate the risk of an event, both the probability and consequence of that event must
be evaluated. Consequences can be expressed in different ways. Usually, they are expressed as
the result of a certain event that may affect a person or company personally, financially, or
legally. Common expressions for Consequences are {Environmental Damage/Event},
{Fatalities/Event}, {Area Affected by Fire/Event}, {Area Affected by Toxic Exposure/Event},
{Business Interruption/Event}, {Equipment Damage/Event}, and so on. For the purpose of the
software and evaluation, in the Level I of the analysis, the consequences are clustered in classes.
In the case of Level II, the consequences are expressed in Affected area by given damage (square
meters).

What is Risk Based Inspection?

First developed for the nuclear industry, Risk Based Inspection provides guidance on how to
weigh the costs and benefits of inspections in a systematic manner that helps users to make

43
informed business decisions regarding inspection and maintenance spending.
RBI provides the possibilities to do the following:
 Evaluate current inspection plans to determine priorities for inspections
 Evaluate future inspection plans for decision making
 Evaluate how changes to basic operations can affect equipment integrity
 Identify critical contributors to risk that may otherwise be overlooked
 Establish economically optimal levels of inspection as weighed against risk reduction
 Incorporate Acceptable Risk levels.

Levels of Analysis
Level I Analysis
Level I is an easy-to-use qualitative screening tool that provides rankings and ranges only for
units or major portions of units at a plant site to determine priorities for quantitative RBI
studies.
With minimal input from the user, decisions can be made regarding inspection techniques and
frequencies. Usually used by a team of materials/corrosion, inspection, hazards and operations
engineers, Level I quickly highlights the equipment that is at high-risk that users may then wish
to assess in more detail.
Output is generated in the form of a five-by-five matrix of Probability versus Consequence and
provides further information that includes the ranking and suggested inspection intervals. Level
I is designed as first step toward quantitative criticality ranking.

Level II Analysis
Level II is an approach that is a step closer to being a quantitative analysis than Level I, and it is
a scaled down approach of Level III. The Level II approach to RBI provides most of the benefit of
Level III analysis regarding likelihood determination, but it requires less input than Level III. It
will provide the probability ranking based on the outputs of technical modules only, and provide
the evaluation of consequences based on affected area only.

Level III Analysis

Level III is a quantitative approach to RBI providing the most detailed analysis of the three levels.
This level provides Financial Risk analysis and Equipment Modification Factors analysis along
with the data provided in the Level III analysis.

44
9. Getting started
9.1. Analyses
The R-Tech iRiS Start page

Figure 9.1.1: Start page.

The side menu on the R-Tech iRiS start page is a navigation menu to the various management
tools used by the system:

Overview:
Clicking on Overview will display the hierarchical setup of the company, split into its business
and/or operating units, each with all its associated components. This display provides an
overview of the extent and levels of analyses that were done in the plant.
Drilling down to a component will display links to all analyses in which the component
participates and the analysis level or type on which it was done.

Figure 9.1.2: Start page.

45
Clicking on an analysis link will generate a printable component summary report, as it is
reflected in the particular analysis,

Master Analysis:
A drill down list of all defined units in the plant, organized in hierarchical order. Clicking on
a unit will load its master analysis – an analysis which contains all the fundamental data
regarding the unit such as environmental conditions, tied components and inspection history.
Please refer to chapter 11.2 for further information.

Analyses:
A drill down list of all defined units in the plant, organized in hierarchical order and their
associated analyses. Clicking on an analysis will load its information page, please refer to
chapter 10 for further information.
Click on the ‘Show as Table’ button at the top of the drill down list in order to present all the
analyses in tabular form. This table provides the user with search options and the ability to
copy, delete or create new analyses.
Click on the ‘Method’ drop down menu to filter analyses by type.

Figure 9.1.3: Analyses Table.

Note: it is not possible to open and make changes to an analysis that is currently in use
(opened and edited by another user). The analysis that is currently in use is marked by a red
background on the table. However, it is possible to open a currently used analysis as a copy
of it. This means that the user can open and see the analysis, can also edit/make changes to
the analysis but if saved, the changes will be saved as a new analysis, under a different file
name. When the user tries to open an analysis that is currently being used, a notification will
appear and the user will have the choice to continue under the conditions explained above or
to cancel the action. Should the user choose to continue with the action and open an analysis
in use, the software will automatically change the name of the analysis by adding the prefix
'Copy' to it (it can of course be changed later).
46
 Performing the analysis
Analyses' calculations are done by the software in the background and require completing
the following:
 Create/select an analysis
 All analysis parameters are set - chapter 10
 Process unit data is set - chapter 11
 All component data is set - chapter 12

The user may then choose a report to display, as detailed in chapter 15

9.2. Use cases

Create an analysis:
Note: it is recommended to first verify that the required unit is set up and that all relevant
components are associated with it; both are set up in the Master Analysis by an administrator.
1. Click on Analyses on side menu
2. Click on ‘Show as Table’
3. Click on ‘New Analysis for Unit:’ and choose the relevant unit.

4. Choose the analysis method from the drop down menu; this will affect further options
for the analysis and reports.

5. Fill in the new analysis’ information form; note that most of the parameters already
have their default values taken from the Master Analysis. These can be modified for
this particular analysis and do not affect other analyses.
6. Save settings before moving on to add components.
7. Add components to the analysis; note that only components that are already
associated with the unit in the Master Analysis will be available.
8. Click on a component to modify its data for this particular analysis; note that most of
the parameters default to the data set in the Master Analysis and modifying them will
only affect this particular analysis.
9. Save each component before switching to another.
47
 10. Upload supplementary documents for the analysis.
11. It is now possible to produce reports for any component which was fully set up in the
analysis.

Modify an analysis or a component

Choose an analysis from the analyses tree on the side menu or from the table. Note that the
table offers filtering options to ease locating specific analyses.

48
10. Analyses
10.1. Analysis Page
After choosing a unit from the "New Analysis for..." drop down menu or opening an analysis
by double clicking on it, the 'Analysis Info' screen is displayed by default (figure 10.1.1); this
page consists of a header, a side menu on the left side and a main window to its right.

Figure 10.1.1: The analysis page - Working area

The header contains the following:

 Method: Select the type and method for working within the analysis; refer to section
10.3 for more information.
The available options are: Combined, API RBI, RCM, NDT and EskomRBI (EN16991).
 Add Components to Analysis: select to add a new component from the available
components list, as predefined in Master Analysis (see section 11.2); filterable by
'Piping', Other Equipment' or 'All Types'. Clicking on an option pops up a new window
containing all available components where new components may be selected by
checkmarks. Click 'OK' when done.
Note: this option will be greyed out if there are no components set up for the analyzed
unit or if all components set up for the unit were already added
 Remove Components from Analysis: remove a specific component or all components
that are classified at a certain risk level, e.g. clicking on 'All Low Risk' will remove all
components with a calculated low risk.
Note: in order to remove a specific component and not a risk level, it must first be
selected in the 'Components' subsection of the side menu
 Close Analysis: close the analysis and return to the start page
 Analysis Title: in the format 'Analysis Name' / 'Unit Name'
49
 The side menu contains all the analysis related information and definitions, divided into
segments:
 Analysis: information about the analysis itself and its settings; refer to this section and
10.2.
 Process Units: a complete list of units covered by the analysis, presented in hierarchical
order. Clicking on a unit loads its information and settings; refer to chapter 11.
 Components: a complete list of components, grouped by their type or according to their
location within units. Selecting a component loads its information and setting; refer to
chapter 12
 Reports: a list of all available reports; clicking on an item will generate the report. Refer
to chapter 15
Selecting an item within the segments will load the forms corresponding to the selected
item, in the main window.

SAVE Analysis Settings

Clicking on this button will save the analysis.

10.2. Analysis info

After selecting or creating an analysis, the analysis page loads, split into sections, the top
most of which is the general analysis information:

Figure 10.2.1: Analysis Info

Analysis Name
This field is mandatory. The system provides a generic name by default and it is
recommended to enter a short, descriptive title for the analysis.

Process Unit
The process unit that is currently analyzed.

Analysis Author
This field is optional.

Description
This field is optional. A field for a detailed description of the analysis; Length is not limited.

50
 Analysis Date
This field is mandatory and defaults to the analysis' creation day. Change the date for
future analyses.

Plan End Year

This field is mandatory and defaults to five years ahead.

Analysis ID
This field cannot be changed by the user. The analysis' index number and can be used as
reference.

Date Created and Created by

These fields cannot be changed by the user; display the date and time the analysis file was
created and by whom.

Date Modified and Modified By

These fields cannot be changed by the user; display the last date and time the analysis file
was modified and saved and by whom.

10.3. Analysis settings

Figure 10.3.1: Analysis Settings

Autosave Interval [min]

The software’s time between automatically saving information, in minutes. Input “0” to disable auto
saving.

Analysis Method
A drop down menu for choosing the analysis method; contains RBI, NDT, EskonRBI and
Combined method. This determines the method for the analysis and thus the information
required for it and available types of reports that may be generated.
Defining the method as combined, the same set of units and their associated components
may be analyzed using the different methods simply by selecting from the 'Method'
dropdown menu while in the analysis.
Note that RCM analysis is only applicable to a particular set of components and therefore
will present results for those components.

51
 Show as Component Name
Choose the displayed name for components in this analysis:
Name: use the component’s unique name given in the Name field;
Location Code: use the component’s functional location/KKS code;
Description: use the component’s descriptive name.

Length Unit
Choose between meters (m) or millimeters (mm).

Volume Unit
Choose between cubic meters (m3) and litters (l).

Pressure Unit
Choose between bar and kilo-Pascal (kPa).

Pressure Testing Interval [months]

Time interval between planned pressure tests.

10.4. RBI Settings

Figure 10.4.1: RBI settings

Method for Qualitative Analysis

Select the check box to include the Risk Based Inspection Framework for qualitative
analysis. More details about the method for qualitative analysis is available in the
beginning of this manual and further details can be found in the standard: EN16991
publications.

Equipment Modification Factors

An equipment modification factor is developed for each equipment item, based on the
specific environment in which the item operates. It is composed of four sub factors, which
are discussed in Appendix: RBI 581:2000: Modification Factor. Each sub factor is
composed of several elements which are analyzed according to defined rules. For each
element, numeric values are assigned to indicate how much the failure frequency will
deviate from generic, as a result of the conditions being analyzed. Positive values are
assigned for conditions that are judged to be more deleterious than generic, and negative
values are used to indicate a reduction in expected failure frequency.

52
A value of +10 is assigned when the condition is expected to increase failure frequency by
approximately one order of magnitude.
Throughout this portion of an RBI analysis, it is assumed that all equipment items have
been designed and fabricated in accordance with industry and company standard design
practices, unless there is specific evidence to the contrary. These standard practices are
generally based on recognized industry standards, such as ASME, TEMA, and ANSI.
The final estimated numeric value is converted to Equipment Modification Factor and the
resulting value is unique for each equipment item. Computed in such a way, it provides the
characteristics of each piece of the equipment based on the conditions in its specific
operating environment. More details about Equipment Modification factor can be found in
Appendix: RBI 581:2000: Modification Factor.

Select the check box to include the Equipment Modification Factor in the Probability
calculation.

Management Factor
Management Factor or Management Systems Factor accounts for the influence of the
facility's management system on the mechanical integrity of the plant equipment. This
factor accounts for the probability that accumulating damage which results in loss of
containment will be discovered in time and is directly proportional to the quality of a
facility's mechanical integrity program. In other words, it serves to adjust the generic
failure frequencies for differences in process safety management systems. The factor is
derived from the results of an evaluation of a facility or operating unit's management
systems that affect plant risk.
It is determined through an evaluation of the PSM System. Different practices within units
at a facility might create differences in the management systems evaluation factors
between the units. However, within any one study, the management systems evaluation
factor should be the same. The factor is applied equally to all equipment items within the
study and, as a result, it does not change the order of the risk-based ranking of the
equipment items. More information about Management Factor can be found in Chapter
8.4, Appendix D of API 581:2000 and Chapter 4 of API 581:2008 (please see references).

Select the check box to include the Management Factor in the Probability calculations.

Consequence Area Setting

Consequence factors are used to calculate the risk rank and depend on the consequence
area settings specified in the Program Settings screen. Four options are available for the
Consequence Area settings:
 Equipment Damage Area
 Potential Fatality Area
 Toxic Area
 Maximum - all three are calculated and the maximal value is chosen

53
Weather Type
To calculate the External Corrosion Factor due to weather, the program makes use of the
weather conditions prevailing at the location to calculate the potential corrosion rate. In
order for the program to calculate accurate values, select a weather condition setting of:
 Marine - average rainfall is 1000+ mm/year
 Temperate - average rainfall from 500 to 1000 mm/year
 Arid - average rainfall is below 500 mm/year.

Cold Weather
Cold climates impose additional risks on plant operation. Extremely low temperatures
inhibit maintenance and inspection activities and can result in reduced operator
monitoring of equipment outside. Winter conditions can also have a direct effect on
equipment items, e.g. ice and snow buildup can cause distortion or failure of small lines,
instrument and electrical runs, etc. In addition, frozen level controllers, cracked water
lines, frozen water contained in deadlegs, and plugged process lines are common winter
problems. Cold weather problems can be minimized by proper design, but they cannot be
totally eliminated (please refer to Appendix X: RBI 581:2000: Modification Factor).
A penalty is applied based on the lowest average daily temperature at the plant site. Indoor
plants should consider lowest indoor temperature.

Seismic Zone
A plant located in a seismically active area has a somewhat higher probability of failure
than facilities outside such areas, even when the plant has been designed to appropriate
standards. The following values are based on the seismic zones presented in ANSI A58.1,
1982 and also partly described in Chapter 8.3.2.3 of API581:2000.

 Zone 1 - Minor damage (Modified Mercalli intensity V and VI)

 Zone 2 - Moderate damage (Modified Mercalli intensity VII)
 Zone 3 - Major damage (Modified Mercalli intensity VIII or greater)
 Zone 4 - Areas within Zone 3 close to certain major fault systems.
Table 1: Modified Mercalli Intensity Scale.

54
11. Process Units
11.1. Process Units Information
Process Units are set up in the Master Analysis and their information is drawn from it into
the analyses. For the purpose of analyzing different alternatives, the option is given to change
certain unit parameters for the specific analysis as described below.
Set up and permanent modifications of process units’ data is done in the Master Analysis;
refer to Chapter 13.

Figure 11.1.1. Process Unit Information.

Process Unit Name

The unit's name, as defined in Master Analysis.

Description
The unit's description, as defined in Master Analysis.

Service Start
Estimate of the date of when service started.

Population Density [/m²]

Required value for the consequence analysis in a Level III analysis; provide an estimate of the
density of people per square meter in the units' area.

Unit Outage Cost [€/day]

Required value for the financial risk estimation of a Level III analysis; provide an estimate of
the loss of production per unit per day in term of money.

55
Injury/Fatality Cost [€/person]
Required value for a Level III analysis; provide an estimate for the cost of the injury/fatality
per person. However, it should be noted this value should be high enough to reflect the
personal safety requirements (i.e. a unit that otherwise might not be ranked as "critical" by
other criteria might become critical through this factor).

Inspection Planning Strategy

Select from 4 strategies for the inspection's planning strategy: Optimized, as required by law,
No replacement and Custom.

Planned Shutdowns
Provide the count of all planned shutdowns for a year.

Unplanned Shutdowns
Provide the count of unplanned shutdowns per year (average of the last three years).

Process Stability
Estimate the level of the process' stability; choose the best fitting descriptor: more stable than
average process, above average, less stable than average process and much less stable than
average process.

Release Valves Maintenance

Estimate how punctual is the maintenance of the relief valves (RV); choose the best fitting
option: less than 5% of RV overdue, from 5 to 15% of RV overdue, 15 to 25% overdue and
more than 25% overdue.

Release Valves Fouling Tendency

Estimate the relief valves' tendency for fouling; choose the best fitting value: no significant
amount of fouling, some polymer and other fouling material and significant level of fouling.

Service Type
Select the type of service of the relief valve: clean or corrosive; select unknown if no data is
present.

Plant Condition
This element considers the current condition of the facility being evaluated and is required
for level III analyses. The ranking should be based on the professional judgment of the
observer, when considering the following characteristics:

56
1. The general appearance of the plant, as assessed during a plant walk through. Factors to
observe include:
 The overall state of housekeeping
 Evidence of temporary repairs, particularly if it appears that the "temporary" condition
has been in place for an extended period
 Deteriorating paint, excessive number of steam leaks, or other evidence that routine
maintenance is being neglected.

2. Effectiveness of the plant's maintenance program, based on interviews with operations and
maintenance personnel.
 Complete most maintenance activities properly the first time, with few call-backs
 Avoid excessive and growing backlogs of work requests
 Maintain a constructive relationship between maintenance and operations personnel.

3. Plant layout and construction.

In its current condition, the plant should have equipment spacing and orientation that
facilitates maintenance and inspection activities. The facility should be ranked according
to the following criteria:
A - Significantly better than industry standards
B - About equal to industry standards
C - Below industry standards
D - Significantly below industry standards

Management Score (0- 100)

Provide the management score value; this field is mandatory for Level III.
See Appendix D of API 581:2000 or Chapter 4.5 of API 581:2008 for further details.

SAVE Process Unit:

Clicking on this button will save the current process unit.

57
12. Components and Levels of Analysis
12.1. Components
Every analysis of a particular Unit is ultimately the combined analyses of its specific
equipment and components and therefore, these must be added to the analysis and relevant
parameters must be set to each and every component.
The components themselves are defined in The Master Analysis and are made available for
analysis by assigning them to the particular units; for more information and to
create/modify components, refer to chapter 13.

Definitions:
 Equipment: an individual item that is part of a system, equipment is comprised of an
assembly of Components. Examples include pressure vessels, relief devices, piping,
boilers and heaters.
 Component: any part that is designed and fabricated to a recognized code or standard.
For example, a pressure boundary may consist of the components: cylindrical shell
sections, formed heads, nozzles, tank shell courses, tank bottom plate, etc.

Adding components to an analysis:

Click on Add Components to Analysis and choose showing Piping components, other
Equipment or all.

Figure 12.1.1: Add Components Drop menu

A new window will open with all the components that are assigned to the analyzed unit,
filtered according to what was selected above.

Checkmark the desired components and click 'OK'

Figure 12.1.2: Component Selection

58
Filters:

Figure 12.1.4: Component search filters

The components will be added to their corresponding units, as pre-defined in The Master
Analysis and will be shown on the side menu, under 'Components'; presented according to
type or to hierarchical unit order:

Figure 12.1.4: Components by Units

59
Removing components from the analysis:
Remove a component from the analysis by clicking on 'Remove Components From Analysis'
at the header and choosing 'This Component'. A component must be first selected in order for
this option to show. Click 'OK' when asked to confirm to remove the component.

Figure 12.1.5: Remove components

A user may also remove all components that are classified at a certain risk level, e.g. clicking
on 'All Low Risk' will remove all components with a calculated low risk.

Working with components:

Selecting a component will load its attributes panel in the main window:

Figure 12.1.6: Component Attributes Panel

60
The top of the panel contains the component header with general information and a drop
down menu with the options for the RBI level of analysis required for the specific component:
None, Level I, Level II and Level III.

Figure 12.1.7: RBI Levels

Special Note: Each level adds more information requirements to its predecessor and more
tabs will appear accordingly. for instance, at RBI level 'None', only the Component Data,
Documents and Overview tabs are shown (see figure X above) while choosing RBI level I -
Qualitative will add the 'Level I' tab after Component Data. Level II will add more tabs and
level III will add even more.

Figure 12.1.8: Level I tabs

In addition, tabs and segments are also contextual and linked to the type of the component so
some will only appear for that particular type. e.g. Boiler type components will show the
contextual tab Piping Fatigue under Probabilities tab (Levels II and III):

Figure 12.1.9: Probability tabs for Boilers

61
On the other hand, Pressure Vessel type components will have the Brittle tab instead:

Figure 12.1.10: Probability tabs for Pressure Vessels

Lastly, choosing any analysis level other than 'None', enables the risk matrix which is
presented next to the Basic Data segment. Each analysis level adds more information and
accuracy to the risk matrix, e.g. the risk matrix for a level I analysis compared to a level III for
the same component; note how the risk assessment changes due to the added information:

Figure 12.1.11: Level I Risk Matrix

Figure 12.1.11: Level III Risk Matrix

All tabs and the segments within them are fully described, segment by segment, in the
following sections; starting with the Basic Data segment in Component Data tab, continuing
with the Dimensions segment and so forth, adding information according to analysis level.

SAVE Component
Clicking on this button will save the current component.

Update TO Master
Update The Master Analysis with the current values. Note: this will overwrite the values in
The Master Analysis and cannot be restored.

Update FROM Master

Retrieve information for all fields from The Master Analysis.

62
12.2. Basic Data

Figure 12.2.1: Basic data.

Component Name NEEDS REVIEW??

The Component Name is the primary identifier of an equipment item throughout the RBI
analysis. Where possible, the component name assigned by the plant should be used. If no
name exists (e.g. piping runs), a numbering system should be established and a unique ID
assigned to each item. Some items require a suffix for full identification, for example, to
differentiate between the shell or tube side of heat exchangers.
Each component that is normally online and operating should be listed separately. For
example, if the plant has two tower re-boilers and both are normally in service, then the two
exchangers should be recorded as separate components. On the other hand, if one of two
exchangers is installed as spare and is normally not operating, only one component should
be listed.

Process Unit
The process unit to which the component is associated with.
When defined in The Master Analysis: drop down menu with all defined units.

KKS System
The system code under KKS.

KKS Level 2
KKS level 2 code.

Component Type
Each component must be assigned to a category for which generic failure frequency values
are available.
When defined in The Master Analysis: drop down menu with all defined component types.

Functional Location Code

The functional location code of the component according to the used plant codification
system (e.g. KKS or AKZ).

63
 Description
The description of the component.
When defined in The Master Analysis: open text field, unlimited length. Enter a description
that will allow easy identification of the component.

Service start
The year when the component went into service; defined in The Master Analysis.

Status
Whether the component is operational or not.
When defined in The Master Analysis: drop down menu with the options Operational, Non-
Operational, Scrapped and Test.

12.3. Dimensions
Note: most fields in this segment can only be modified in The Master Analysis and this
information is presented for reference. For each analysis, a user may define the corrosion
allowance left for the component.

Figure 12.3.1: Dimension information.

Length [m] and Out Diameter [mm]

The primary purpose for recording the physical dimensions of equipment items is to permit
calculation of equipment volume and, in turn, process inventory. Great accuracy is not
required to arrive to meaningful results. Consistency in determining what to measure is more
important. The following rules include a number of simplifying assumptions to minimize the
effort required to gather the data.
Equipment Type Measure
Pressure vessels Length of cylindrical section, excluding heads.
For columns of uniform diameter that are treated as a single equipment item, the total length, excluding
heads.
For columns of uniform diameter that are treated as two half-columns, one-half the total length, excluding
Columns
heads.
For columns with a reduced section, the length of the specific section. Include the transition section with the
larger diameter portion.
Heat exchanger, shell Length, excluding channel(s) and head.
Equipment Type Measure
Heat exchanger, tube Length of the channel(s) plus the tube length in the shell.
Pumps & compressors Zero (these items are assumed to have zero volume).
Tanks Height
Piping Total length of the pipe segment, including any branches.

Table 2: The measure of length

64
 Equipment Type Measure
Vessels, columns Outer diameter.
For shells of uniform diameter, the outer diameter.
Heat exchanger, shell For kettle-type, etc., the maximum dimension perpendicular to length. For double pipe, the diameter of the
outer pipe.
For double pipe, the diameter of the inner pipe. For all other types of exchangers, the channel diameter.
Heat exchanger, tube
(Note: The non-tube portion of the tube bundle diameter is compensated for in the volume calculation.)
Pumps, compressors Zero
Piping Nominal diameter

Table 3: The measure of diameter

Total Inside Volume (m3)

Provide the inside volume of the component.

Total Steel Mass (KG)

Provide the total steel mass of the component.

Insulated/Lagging
Insulated items may be subject to external corrosion under the insulation. Indicate by check
marking if the equipment item is fully or partially insulated, with any type or thickness of
insulation.

Design Wall Thickness [mm]

Provide the component's wall thickness. If the component has more than one wall thickness,
provide the minimal one.
For boiler components (i.e. "HEATER" component type), provide tube wall thickness. The
value provided has to be the actual measured thickness upon being placed in the current
service, or the minimum construction thickness. The thickness used must be the thickness at
the beginning of the time in service entered in the equipment data.

Corrosion Allowance
Provide the corrosion allowance for the component.
Corrosion allowance describes an extra measurement added to the thickness of the wall. This
helps estimate the expected metal loss throughout the lifespan of certain equipment. The
depth of penetration may vary from case to case, depending on the conditions of exploitation.
By knowing the expected rate of corrosion and the expected service life of a plant or parts,
industries can compute the additional thickness needed for corrosion resistance of
equipment in the design process.
Corrosion allowance must be determined once the wall thickness has been identified. The
wall thickness should comply with various requirements such as temperature, pressure and
weight. This allowance should not only be measured by project engineers, but also by local
or state agencies. Local agencies have more experience with local conditions in a particular
area.

Total Inside Volume (Calculated) (m3)

Automatic calculation of the component's total calculated internal volume, based on other
inputs.

65
 Total Steel Mass (Calculated) ( KG)
Automatic calculation of the steel mass of the component, based on other inputs.

Post-Weld Heat Treated (PWHT )

Determine whether the equipment/piping has been properly stress relieved after welding
and cold forming. It is a method for reducing and redistributing the residual stresses in the
material that have been introduced by welding. The extent of relaxation of the residual
stresses depends on the material type and composition, the temperature of PWHT and the
soaking time at that temperature. A commonly used guideline for PWHT is that the joint
should be soaked at peak temperature for 1 hour for each 25mm (1 inch) of thickness,
although for certain cases a minimum soak time will be specified.

12.4. Operating Data

Figure 12.4.1: Operating Data

Operating Temperature [C]

The normal operating temperature is also used in consequence calculation and can be an
important variable in several damage mechanisms. When a range of operating temperatures
is employed, as may be the case in a plant producing a variety of product grades, record the
most severe temperature normally specified (highest for high temperature operations,
lowest for low temperature processes). Temperature extremes under upset conditions can
have a profound effect on rate of damage for several damage mechanisms. The highest and
lowest temperature that could occur should be recorded. For equipment that induces a large
temperature change (heat exchangers, furnaces, etc.) it is best to input the average
temperature across the equipment.

Operating Pressure [bar]

The normal operating pressure entry is used in various consequence calculations and in
determination of the the safety factor. When a range of operating pressures is employed, as
may be the case in a plant producing a variety of product grades, the highest pressure
normally specified should be recorded. Pressure extremes under upset conditions should
also be recorded if they are significantly different from normal operating pressure. Examples
would include conditions where a vacuum might be imposed on a pressure vessel, or where
the relief valve setting is much higher than normal operating pressure. For equipment that
induces a large pressure change (pumps, condensers, etc.). it is prudent to input the high side
pressure.

66
12.5. Piping Data
Note: this segment only appears for components of the type: 'Piping'

Figure 12.5.1: Piping Data

From Equipment
This component come from this piece of equipment.
When defined in The Master Analysis: describe the relevant equipment in the most concise
manner that still allows its identification.

To Equipment
This component goes to this piece of equipment.
When defined in The Master Analysis: describe the relevant equipment in the most concise
manner that still allows its identification.

Piping Type:
The intended use of the component.
When defined in The Master Analysis: drop down menu with the options Process Piping,
Steam and Water Piping and Auxiliary Piping.

12.6. Design Data

Figure 12.6.1: Design Data.

Design Temperature [C]

The design temperature of the component should be recorded. Items designed for low
temperature service may have a Minimum Design Metal Temperature and a maximum
design temperature. The design temperature, shell side and tube side for a heat exchanger.

Design Pressure [bar]

The design pressure of the component should be recorded. If modifications to the item since
its original fabrication have changed the design pressure, the current value should be listed.
The design pressure, shell side and tube side for a heat exchanger.

Design Standard
According to which standard specifications was the component designed.

67
12.7. Material and Lining

Figure 12.7.1: Material and lining.

Material
Material of Construction is a primary consideration for evaluating several damage
mechanisms. Therefore, the choice of the material is essential to assure proper analysis.
When defined in The Master Analysis: drop down menu with list of materials

Initial Fluid State

When defined in The Master Analysis: select Gas or Liquid. The initial state of the fluid is
required to be defined as either liquid or gas. The state is simply the phase of the hazardous
material that could be released while in the vessel/line, prior to coming into contact with the
atmosphere (i.e., flashing and aerosolization is not included at this point).

Lining
This field specifies whether the equipment item has an interior coating or lining. For all lined
vessels, the material of construction of the lining should be recorded.
When defined in The Master Analysis: drop down menu with lining options.

Description Resistance
Alloy Cladding or Weld Overlay Resistant to the environment.
Alloy Cladding or Weld Overlay Possibly subject to attack, e.g. corrosion at welded joints, or diluted weld overlays.

Strip Lined Alloy (“Wall papered”) Typically subject to failure at seams.

Organic Coating, typically > 30 mils
Limited life.
dry film thickness.
Thermal Resistance Service:
Castable Refractory
Subject to occasional spalling or collapse.
Plastic Refractory
Refractory Brick
Severe/abrasive service:
Castable Refractory Limited life in highly abrasive service.
Ceramic Tile
Glass lined Complete protection, subject to failure due to thermal or mechanical shock.
Partial protection. The brick provides thermal protection, but is not intended to keep the fluid away
Acid Brick
from the base metal.

Table 4: Lining

12.8. Pressure Testing

Figure 12.8.1: Pressure Testing

68
 Subject to Pressure Testing
Indicate whether the component is subject to pressure testing.

Test pressure [bar]

The pressure of the tests performed.

Test interval (months)

The normal interval between tests.

Previous Test
Last year when a pressure test was performed.

12.9. Prescribed Inspections

Figure 12.9.1: Prescribed Inspections

The inspection intervals for pressure relief devices are determined by the probability and
consequence of the event outcomes that can result from PRD failure to open or leakage. The
probability side of the equation relates to the probability that the PRD fails to perform its
function, either failing to open upon demand or leaking. The consequence side is related to
loss of containment from the piece of equipment protected by the PRD or to leakage through
the PRD. Risk increases as a function of time since the probability of failure of the PRD
increases and the probability of leakage through the PRD increases with time. Additionally,
the consequences of PRD failure increase since the protected equipment damage increases
over time which increases the likelihood and consequences associated with loss of
containment. The recommended interval is determined for a PRD by calculation of the risk as
a function of time and determining the time at which the risk is equal to the risk target.

Internal and External Inspections Prescribed

Indicate whether inspections are already prescribed for the component, either internal or
external.

Efficiency
Select inspection efficiency, on a descending scale from A down to D.

Interval [months]
Number of months between inspections.

69
 Previous Inspection
Year of last inspection.

12.10. Comments and Problem Description

Use this segment to document a known problem with the component.

Figure 12.10.1: Problem Description

12.11. Level I: Performing Level I Analysis

Note: this chapter refers to API 581:2008.
Level I analysis is qualitative and it serves to make the first risk assessment of the
components. The final result of Level I analysis is a risk estimation of every component and
based on its results, a selection of the components which should be subject for further Level
II and/or Level III analysis can be done.
The qualitative procedure which is performed in a Level I analysis, requires less detailed
information about the facility and the calculations performed by the software are basic; as a
result, this level of analysis' ability to discriminate is much more limited but is also far less
time consuming. In this regard, the qualitative technique provides ranges and rankings rather
than specific values and should be used to rank units or major portions of units at a plant site
to determine priorities for quantitative RBI studies or similar activities. As such, level I
analysis is used as a screening tool, providing rankings and ranges only.
The quantitative RBI analysis on the other hand, which is performed in Levels II and III and
described in the next sections, provides risk values for each equipment, item and pipe
segment. With this level of information, a comprehensive inspection plan can be developed
for the unit.
Finally, a suggested inspection frequency is delivered based on both the consequences and
probability of failure.

Input data
Level I Input data is divided into 2 parts: severity of certain conditions used to assess damage
mechanisms (I through X) and evaluation of the consequences.

Figure 12.11.1: Level I Inputs.

70
12.12. Level I Data: Potential Damage Mechanisms
Potential Damage Mechanism
Probability is determined by simply estimating the susceptibility of the component to one or
more damage mechanisms that contribute the most to plant failures. An adjustment is made
based on the length of time since the last inspection was performed on the component.

Figure 12.12.1: Potential damage mechanisms

The estimated level of severity levels should be selected for each of the damage mechanisms
listed; the default severity is set to None.
If the equipment/component was never inspected or not by techniques which can identify
the damage mechanism being considered, estimate the severity as follows:
Severity Description
Major  Damage mechanism has occurred several times in this operating plant in this or
similar components (in terms of materials and/or design and service); or
 The equipment has been repaired/replaced due to the damage mechanism in the
past.
Severe  Damage mechanism has occurred once in this operating plant, in similar components
(in terms of materials and/or design and service);
or
 More than once in the operating company, and no adequate previous inspection
performed to prove or disprove the presence of the damage mechanism.
Moderate  Damage mechanism has occurred once in the operating company
or
 More than once within the industry world-wide in similar components (in terms of
materials and/or design and service) and no adequate previous inspection performed
to prove or disprove the presence of the damage mechanism.
Minor Damage Mechanism has occurred in the industry world-wide, in similar components (in terms
of materials and/or design and service) and no adequate previous inspection performed to
prove or disprove the presence of the damage mechanism.
None  Damage Mechanism not known to have occurred in the industry world-wide, in
similar components (in terms of materials and/or design and service);
or
 Previous inspection has confirmed no presence of damage mechanism.

If the equipment/component was inspected in the past, a general rule of thumb would be that
the selected severity should be an appropriate reflection of the situation, for example:
1. If the equipment/component has been in service for a long period of time, and the
suspected damage mechanism was not detected during past inspections by techniques
which can identify it, then a proportionately low susceptibility should be assigned

71
 2. Conversely, if the equipment/component has been is service for a short period of time
and indications of the damage mechanism were detected, a proportionately high
susceptibility should be assigned.
3. If a trendable, time dependent damage mechanism was detected and the rate of
degradation is well established, then the estimated equipment/component remaining life
relative to the service age should be taken into consideration when selecting the
susceptibility.
4. If non-trendable damage mechanisms are confirmed through inspection, then the higher
severities should be considered.

12.13. Level I Data Consequences

Fill in the parameters to evaluate the consequences resulting from a failure of the
component

Figure 12.13.1: Consequences

Representative Fluid Type

The options available in Level I for the Representative Fluid are from a broadly defined range
that helps determine a flammability consequence ranking. This ranking is further refined
with the data from the temperature and pressure field:
 Non-flammable
 Light Hydrocarbon
 Medium Hydrocarbon
 Heavy Hydrocarbon.

An example of a Light Hydrocarbon may be propane, a Medium Hydrocarbon may be gasoline,

and a Heavy Hydrocarbon may be a crude.

Release Inventory
The Inventory is represented in a very broad range that helps determine a flammability
consequence ranking. This ranking is further refined with the data from the temperature and
pressure fields:
 Small release
 Moderate release
 Large release.

72
Toxic Percentage
Toxic consequences depend heavily on the percentage of the process fluid that is toxic.
Highly toxic process streams or those containing a portion of highly toxic components can
be evaluated using a broadly estimated range of the percentage of the toxic component in
the stream. The following choices are available in the Toxic Percentage field of the Level I
Analysis:
 None
 <1%
 1 - <5%
 5 - <50%
 >= 50%.

Business Interruption
Business interruption is evaluated by a simple four category assessment combining the the
impact on production, whether excess production capacity exists and whether the product
is in a sold-out market. The following choices relate to the impact of a failure and the
amount of business interruption associated with it.
 No shutdown, little or no impact on throughput
 Short shutdown, or reduced throughput
 Extended shutdown
 Long-term shutdown.

Operating Pressure Class

With the information provided in the Representative Fluid Type and Release Inventory, the
Operating Pressure and Temperature let the software to further refine the flammability
consequence ranking. The following choices are available for this field.
 <= 7 bar
 > 7 bar to <= 35 bar
 > 35 bar to <= 70 bar
 > 70 bar.

Operating Temperature [°C]

With the information provided in the Representative Fluid Type and Release Inventory, the
Operating Pressure and Temperature let the software to further refine the flammability
consequence ranking. The following choices are available for this field.
 < 150 °C
 150 to 430 °C
 > 430 °C.

73
Financial consequences
Estimated costs and/or losses rising from a failure:
 No financial loss or loss up to 1000 EUR; no shutdown or short-term shutdown
 Loss from 1000 to 10.000 EUR; production loss from a couple of hours up to one day
 Loss from 10.000 to 100.000 EUR; production loss from one day up to one week
 Loss from 100.000 to 1.000.000 EUR; production loss of several weeks
 Loss of more than 1.000.000 EUR; long term shutdown

Reputation consequences
How an incident is expected to affect the company's reputation and to be perceived in
public:
 No consequence on reputation
 No influence or very small negative influence on company reputation, i.e. there is a some
knowledge about the incident among employees and local community, possibly a short
article in local press, there is no overall concern about the incident, the incident is seen
as a unit problem
 Moderate influence on the company reputation, i.e. negative articles in local/regional
press, there is a degree of concern among the employees and surrounding communities,
the incident is seen as a plant issue
 Big influence on company reputation, i.e. there is an overall concern and reaction on the
national level, incident is seen as top management/corporate issue
 Major influence on the company reputation, i.e. concern and reaction onthe
international level, the incident is seen as a political issue

Environmental Consequences
Environmental consequences are mitigated in two ways: physical barriers that act to
contain leaks on site and detection and isolation systems that limit the duration of the leak.
In API RBI, the volume contained on site is accounted for directly in the spill calculation
while detection and isolation systems serve to reduce the duration of the leak and thus, the
final spill volume.
Select how a spill is expected to affect the environment:
 No consequences, i.e. spills that evaporate by themselves or can be cleaned in 24 hours
without the need to involve additional work force
 Small consequences - no long term environmental consequences, i.e. controlled spill
with mitigation measures in place, small release to the ground, infrequent breach of
allowed emission values
 Moderate consequences, i.e. pipeline spill that requires some investment in ground
mitigation, without a large potential for ground or underground water contamination,
vegetation damage, frequent breach of allowed emission values
 Large damage - considerable damage to the environment, mostly inside the plant
premises that require comprehensive mitigation measures, i.e. oil spill with potential to
damage ground or underground water, inside or outside the plant

74
  Huge damage - long term and serious damage to the environment, inside and outside of
the plant, i.e. crude oil spill contaminating large areas, ground or underground water
that require comprehensive mitigation measures and involves large financial
investments

Sold-out Market or No Spare Part Capacity

Checking this box tells the software to add a higher level of conservatism to the calculations.
The client may need to inspect more often or more effectively because there are no
available spare parts.

Initial Fluid State

The only two options available in this field are Gas and Liquid. This field helps determine a
flammability consequence ranking. That ranking is further refined with the data from the
temperature and pressure fields.

12.14. Level I Data: Evaluation Period

Figure 12.14.1: Evaluation Period

Last Inspection
The last year in which the specific component was inspected should be noted in Last
Inspection field. This works in conjunction with the Mechanism and Severity data to
determine the probability for failure by adjusting these values to the length of time since the
last inspection was done.
This field is updated by the latest inspection recorded in the system. If none is recorded in
system, manually input the year of the last inspection done to the component; leave blank if
it was never inspected before.

Evaluation Year
Evaluation Year represents the year for which the Risk Analysis is performed. The default
value is current year.

75
12.15. Level I Data: Results
The results are automatically calculated in the background based on the inputs per
component and are displayed in the bottom of the data input page; note that a simplified
results' matrix is also presented at the top of the page.
Make sure to click on 'SAVE Component' whenever changes are made in order to recalculate
the results.
Note: a full presentation of the results is available in "Reports", on the side menu; see chapter
15.

Figure 12.15.1: Results.

Flammable Base Consequence Category

Shows the category of the flammable base.

Toxic Base Consequence Category

Shows the category of the toxic base.

Business Base Consequence Category

Shows the category of the business base.

Financial Base Consequence Category

Shows the category of the business base

Reputation Base Consequence Category

Shows the category of the business base

Environment Base Consequence Category

Shows the category of the business base

Consequence Driver
The consequence driver is available only in the Level I analysis. The Consequence Driver
identifies the consequence type that drives the risk. Examples are business interruption,
safety, toxicity, etc.

76
 Consequence Category
The consequence categories have a ranking from "A" (low consequence) to "E" (high
consequence). This is solely for the convenience of presentation in a 5X5 matrix. The
categories may have absolute values assigned, or they may simply be a relative ranking.
Comparison of a category under one definition to a category under another definition is not
valid, and may be misleading. For more details about consequence categories please see
Chapter 4.4.5, API 581:2008.

Likelihood Category
The likelihood category is a ranking from "1" (low likelihood) to "5" (high likelihood). This is
solely for the convenience of presentation in a 5X5 matrix. The categories may have absolute
values assigned, or they may simply be a relative ranking. Comparison of a category under
one definition to a category under another definition is not valid, and may be misleading. For
more details please see API 581:2008.

Risk
The risk rank is a ranking from "Low" to "High." This is solely for the convenience of
presentation in a 5X5 matrix. The categories may have absolute values assigned, or they may
simply be a relative ranking. Comparison of a category under one definition to a category
under another definition is not valid, and may be misleading.

Recommended Inspection Interval

The Recommended Inspection Interval is the number of years in which the equipment should
be inspected.
Note: for more detailed results and visualization refer to chapter 7, Reports.

12.16. Level II: Performing Level II Analysis

Level II analysis is quantitative and provides more accurate data about a component's risk
levels but also requires more extensive data about the component. For more information
about the characteristics of different analysis levels please refer to API 581:2008.

The main features of the Level II approach are:

 Results are displayed in a simplified manner, e.g., a 5 X 5 matrix showing Probability vs.
Consequence in which the values are presented as categories
 Simplified approach to the inventory estimation
 Simplified Category / consequence conversion
 Probability ranking done using Technical module sub factor (TMS) only.

This is in contrast with Level III approach, where the consequences are calculated at the end
and expressed in monetary units, and probability expressed using the generic failure rates
and modification factors.

77
 Therefore, the main outputs of the Level II analysis are:
 Risk Rank in 5x5 matrix
 Inspection plan based on TMS.

To perform the Level II analysis, one needs to provide the data for the following:
 Component data
 Probabilities
 Consequences
 Complete inspection history
 Evaluate the probability / determine Technical Module Subfactors (TMS) for the
appropriate damage mechanisms.

As a user may notice further on, most of the inputs needed to be provided are concerning the
input of damage mechanism data.

12.17. Level II: Technical Module Subfactor: General

Note: This block refers to API 581:2000.

In general, the RBI approach involves the calculation of the Likelihood of failure as shown on
Figure 12.15.1. As already mentioned, because the universal subfactor and process
subfactors, as well as Management Systems Evaluation Factors are usually common for the
whole unit, the ranking in the Level II is done based on Technical Module subfactor.

Figure 12.17.1: General path of Likelihood determination (API 581:2000).

78
 The calculation of each of the Technical Module Subfactor (TMS) is given in Annexes of API
581:2000 and API 581:2008, and will not be covered in this manual. The user is strongly
encouraged to read each of the Annexes in order to be able to fully understand the whole
calculation process.

In general, the value of each of TMS is dependent on:

 Type of equipment/sub equipment
 Material of construction
 Construction/fabrication process
 Operating conditions (pressure, temperature, etc.)
 Fluid properties in the system
 Inspection records (number of previous inspections and equivalent inspection
effectiveness).

12.18. Level II Probabilities Thinning Technical Module

Note: This block refers to API 581:2008 (appendix V: Thinning Damage Factor)

This module establishes a Technical Module Subfactor (likelihood of failure modifier) for
process components subject to damage by mechanisms that result in thinning. General
thinning and localized thinning (which includes pitting and erosion-corrosion) are within the
scope of the module. If thinning rates have not been established from thickness inspection
data, supplements are available in this module to provide conservative estimates of thinning
rates for damage mechanisms that result in thinning. Expert advice may also be used to
establish expected rates of thinning in the absence of measured data.
This technical module assumes that the thinning mechanism has resulted in an average rate
of thinning over the time period defined in the basic data which is fairly constant. The
likelihood of failure is estimated by examining the possibility that the rate of thinning is
greater than what is expected. The likelihood of these higher rates is determined by the
amount of inspections and on-line monitoring that has been performed. The more thorough
the inspection, and the greater the number of inspections and continued use of on-line
monitoring, the less likely is the chance that the rate of thinning is greater than anticipated.

79
 Figure 12.18.1: Thinning technical module.

Design Wall Thickness [mm]

The actual measured thickness upon being placed in the current service, or the minimum
construction thickness. The thickness used must be the thickness at the beginning of the time
in service entered in the equipment data.

Corrosion Allowance [mm]

The corrosion allowance is the specified design or actual corrosion allowance upon being
placed in the current service.
Corrosion allowance describes an extra measurement added to the thickness of the wall in
order to help estimate the expected metal loss throughout the lifespan of a certain
component. The depth of penetration may vary from case to case, depending on the
conditions of exploitation. By knowing the expected rate of corrosion and the expected
service life of a plant or parts, industries can compute the additional thickness needed for
corrosion resistance of equipment in the design process.
Corrosion allowance must be determined once the wall thickness has been identified. The
wall thickness should comply with various requirements such as temperature, pressure and
weight. This allowance should not only be measured by project engineers, but also by local or
state agencies which often have more experience with local conditions in a particular area.

Correct for Corrosion Allowance

Checkmark if there is a need to include the corrosion allowance in the calculation. It will be
substituted from wall thickness in order to calculate the actual ar/t.

Corrosion Type
Determine whether the thinning is general or localized for inspection results of effective
inspections. General corrosion is defined as affecting more than 10% of the surface area and
the wall thickness variation is less than 1.25 mm. Localized corrosion is defined as affecting
less than 10% of the surface area or a wall thickness variation greater than 1.25 mm
80
Known Cause??

Online Monitoring
The types of proactive on-line monitoring methods or tools employed:
 Key process variables
 Corrosometer probes
 Corrosion coupons

Injection Point and Highly effective inspection performed for Injection Points
For piping, determine if there is an injection or mix point in the circuit. For piping circuits
which contain an injection or mix point, determine whether or not a highly effective
inspection designed to detect local corrosion at these points has been performed.

Deadleg and Highly effective inspection performed for Deadlegs

For piping, determine if there is a deadleg in the circuit. For piping circuits which contain a
deadleg, determine whether or not a highly effective inspection designed to detect local
corrosion in deadlegs has been performed.

Corrosion Rate [mm/year]

The current rate of thinning calculated from thickness data, if available. Corrosion rates
calculated from thickness data typically vary from one inspection to another. These
variations may be due to variations in the wall thickness, or they may indicate a change in the
actual corrosion rate. If the short term rate (calculated from the difference between the
current thickness and the previous thickness) is significantly different from the long term
rate (calculated from the difference between the current thickness and the original
thickness), the component can be evaluated using the short term rate, but the appropriate
time and thickness must be used. If the corrosion rate has not been established by inspection,
estimated corrosion rates may be determined from the applicable Supplements or expert
advice.

Pressing the “Calculate” button will bring up the Thinning technical module questionnaire.

Pressing “Save” will save the results and “Update and Close” will save the results and close
the dialog.

Inspection Effectiveness
Effectiveness of the most effective inspection performed in the past will be considered as
"desired" inspection effectiveness.

Number of Equivalent Inspections

Equivalent number of inspections performed according to the inspection history.

81
 Potential Cause
Displays the potential cause (either entered as “Known cause” or as the result of calculation)

Thinning Factor
Damage factor as determined according to appendix V: Thinning Damage Factor (API
581:2008).

Thinning Category
Probability category according to the damage factor for Thinning.

12.19. Level II: Probabilities: External Corrosion Technical Module

Note: This block refers to API 581:2008 (Appendix IV: External Corrosion Damage
Factor - Ferritic Component)

External damage can occur to most process plant components. The result is a gradual
thinning of some materials or may result in stress corrosion cracking of other materials.
Perhaps the most serious cases of external damage involve corrosion under insulation (CUI).
This form is especially hazardous because insulation can become wet or contaminated,
accelerating the corrosion. Another reason that CUI is particularly serious is that it is very
difficult to detect. In any case, the problem can be reduced or eliminated by proper inspection
for corrosion, proper installation and maintenance of insulation, or by proper selection,
application, and maintenance of protective coatings. External damage is evaluated separately
for carbon/low alloy steels (subject to thinning) and austenitic stainless steels (subject to
stress corrosion cracking).
Note: if the material is not carbon steel or austenitic stainless steel, this option is not
available. Also, in cases where the operating temperature is higher than 120 Celsius for
carbon steels or between 37 and 150 Celsius for austenitic steels, this option will also not be
available.

Figure 12.19.1: External Corrosion.

82
Weather Type
To calculate the weather setting for External Corrosion Factor, the program makes use of the
weather conditions prevailing at the location to calculate the potential corrosion rate. In
order for the program to calculate accurate values, it uses the weather condition setting that
was given to the Unit in which the component is installed:
 Marine - Average Rainfall is 1000+ mm/ yr
 Temperate - Average Rainfall is 500 - 1000 mm/ yr
 Arid - Average Rainfall is < 500 mm/ yr.

Insulation Condition
Determine whether the insulation condition is good based on external visual inspection of
jacketing condition. Above Average insulation will show no signs of damage (i.e. punctured,
torn or missing water proofing, and missing caulking) or standing water (i.e. brown, green,
or black stains). Take careful note of areas where water can enter into the insulation system,
such as inspection ports and areas where the insulation is penetrated (i.e. nozzles, ring
supports and clips). Note that horizontal areas also accumulate water.

Complexity
The number of branches, etc.: Below Average, Average, Above Average.

Chlorine Free
Determine if the insulation is 'Cl-' free. If unknown assume 'Cl-' is present.
Note: this option is only available if the component's material austenitic stainless steel.

Piping Support
If piping is supported directly on beams or other such configuration that does not allow for
proper coating maintenance, external corrosion can be more severe.
Note: this option is available only if the selected equipment type is piping.

Soil or Water to Air Interface

If the piping has an interface where it enters either soil or water, this area is subject to
increased corrosion.
Note: his option is available only if the selected equipment type is piping.

Coated
Indicate that coating has been performed.

Coating Good
Indicates that coating condition is in good condition.
Note: this option is available only if Coated is selected.

83
 Last Coated
Enter the year of the last coating. It will be used as a start date of the calculation if no
inspection afterwards was performed.
Note: this option is available only if Coated is selected.

Corrosion Rate
Select "Estimated" if an expert judgment exists about the corrosion rate/susceptibility. If the
value is measured, then use this value. This option is not available if no previous external
inspections have been performed. If no values have been so far indicated, use "calculated"
option.

Inspection Effectiveness
Inspection effectiveness of the most effective inspection performed in the past will be
considered as "desired" inspection effectiveness.

Number of Equivalent Inspections

Equivalent number of inspections performed according to the inspection history.

External Corrosion Factor

Damage factor as determined according to Appendix IV: External Corrosion Damage Factor -
Ferritic Component (API 581:2008).

External Corrosion Category

Probability category according to the damage factor for External corrosion.

12.20. Level II Probabilities Stress Corrosion Cracking Technical Module

Note: This block refers to API 581:2000 (appendix VIII: Stress Corrosion Cracking
Technical Module)

This module establishes a Technical Module Subfactor (probability of failure modifier) for
process components subject to damage by mechanisms that result in Stress Corrosion
Cracking (SCC). Caustic cracking, amine cracking, sulfide stress cracking (SSC), hydrogen-
induced cracking (HIC), stress-oriented hydrogen-induced cracking (SOHIC), carbonate
cracking, polythionic acid cracking (PTA) and chloride cracking (ClSCC) are within the scope
of the module.
Technical Supplements are included in this module to provide estimates of the susceptibility
to specific damage mechanisms that result in stress corrosion cracking. Expert advice may
also be used to establish susceptibility to stress corrosion cracking. This technical module
assumes that the susceptibility to each SCC mechanism is determined in the applicable
technical module supplement. The susceptibility is designated as high, medium, or low based
on process, material, and fabrication variables. A severity index can be determined which is
the product of the susceptibility of the equipment/piping to cracking (or the probability of
initiating cracks) and the probability of a crack resulting in a leak.

84
 Figure 12.20.1: Stress Corrosion Cracking Module.
Hydrogen Probes
Select this option if hydrogen probes are used as proactive corrosion monitoring method. In
acidic process environments, hydrogen is a byproduct of the corrosion reaction; generated in
such a reaction, it can be absorbed by steel particularly when traces of sulphide or cyanide
are present. This may lead to hydrogen induced failure by one or more of several
mechanisms. The concept of hydrogen probes is to detect the amount of hydrogen
permeating through the steel by mechanical or electrochemical measurement and to use this
as a qualitative indication of corrosion rate.

Key Process Monitoring

Select this option if the key process monitoring is used as a proactive corrosion monitoring
method.

Corrosion Rate [mm/year]

 Predicted: If expert judgment exists, this option allows for evaluation according to it. In
cases when more than one predicted mechanism is recorded, enter the one which yields
the highest probability factor.
 Detected: If Stress corrosion cracking was already detected, select this option. The
Susceptibility will be automatically assigned to "high". This option is not available if there
are no inspections recorded. The method can also handle known cracks in a simplistic
manner. Probability of failure due to a specific crack or array of cracks in the
equipment/piping should be further evaluated using more advanced methods and fitness
for service evaluations.
 Calculated: This technical module assumes that a susceptibility to each SCC mechanism
is determined in the applicable technical module supplement. The susceptibility is
designated as high, medium, or low based on process, material, and fabrication variables.
A severity index can be determined which is the product of the susceptibility of the
equipment/piping to cracking (or the probability of initiating cracks) and the probability
of a crack resulting in a leak.

85
Mechanism
Expected damage mechanism:
 Unknown
 Caustic cracking
 Amine cracking
 Carbonate cracking
 Sulfide stress cracking
 HIC/SOHIC (hydrogen sulfide services)
 Hydroflouric acid services HSC-HF
 HIC/SOHIC (hyrofluoric acid)

Susceptibility
Estimated susceptibility of the component to damage mechanisms:
 Low
 Medium
 High

Inspection Effectiveness
Inspection effectiveness of the most effective inspection performed in the past will be
considered as "desired" inspection effectivenes. The calculation of the numbers of the
equivalent inspections is done according to the method described in Chapter 9.4 (API
581:2000) and appendix VIII: Stress Corrosion Cracking Technical Module (API 581:2000).

Number of Equivalent Inspections

Equivalent number of inspections performed according to the inspection history, as it is
described in Chapter 9.4 and technical modules in appendix VIII: Stress Corrosion Cracking
Technical Module (API 581:2000).

Potential Cause
Potential/detected/calculated mechanism of SCC. The damage mechanism that yields the
highest SCC factor will be selected for the calculated values.

SCC Factor
Damage factor as determined according to appendix VIII: Stress Corrosion Cracking
Technical Module (API 581:2000).

SCC Category
Probability category according to the damage factor for SCC. Pressing the Calculate button,
the Stress Corrosion Cracking technical module questionnaire will be shown.

86
12.21. Level II: Probabilities: Brittle Fracture Technical Module
Note: This block refers to API 581:2008 (appendix II: Brittle Fracture Damage Factor)

This module establishes a Technical Module Subfactor (probability of failure modifier) for
process components subject to failure by brittle fractures. Low Temperature/Low Toughness
Fracture, Temper Embrittlement, 475 Celsius Embrittlement, and Sigma Phase
Embrittlement are within the scope of the module. Technical Supplements are included in
this module to provide estimates of the susceptibility to specific brittle fracture mechanisms
that can result in failure. Expert advice may also be used to establish susceptibility to brittle
fracture mechanisms.
Brittle fracture requires the coincident presence of a sufficient size defect, application of
sufficient stress, and a susceptible material. The susceptibility to failure by brittle fracture
can change due to in-service conditions. The supplements determine the likelihood
adjustment (Technical Module Subfactor) that is appropriate to each case.
Note: Availability of this option depends highly on other inputs like selected material and
operating temperature.

Figure 12.21.1: Brittle Fracture Technical Module

Minimum Design Metal Temperature [C]

Can be entered by the user. The temperature may be set to the atmospheric boiling point of
the fluid in the component if the fluid is a liquid.
Minimum Design Metal Temperature (MDMT) is one of the design conditions for pressure
vessels engineering calculations, design and manufacturing according to the ASME Boilers
and Pressure Vessels Code. Each pressure vessel that conforms to the ASME code has its own
MDMT, and this temperature is stamped on the vessel nameplate. The precise definition can
elaborate, but in simple terms the MDMT is a temperature arbitrarily selected by the user of
the vessel according to the type of fluid and the temperature range the vessel is going to
handle. The so-called arbitrary MDMT must be lower than or equal to the CET (which is an
environmental or "process" property, see below) and must be higher than or equal to the
(MDMT)M (which is a material property).

Upset Management Used

Are administrative controls for upset management in place? (yes/no)

87
 Minimum Upset Temperature [C]
The minimum operating temperature, under normal or upset conditions.

Specification ID and Grade

Used to look up the basic properties (Tensile strength, yield strength, etc.) for the
equipment/piping. If known, the exact specification and grade should be used, otherwise, a
conservative default can be used.

Impact Test Temperature [C]

If impact tested. If left unchecked, the software assumes that impact tests were not done.

Material Normalized
Used to look up the required impact test temperature.

Adjust for Service Experience

Adjust for Service Experience. Per API 579 Level 2 Method 3 (Grandfathering), if equipment
has been exposed for many years to the lowest expected temperature, the risk may be
adjusted lower if the equipment is not in fatigue or SCC service. This is based on thousands of
years of successful industry experience.

Brittle Fracture Factor

Damage factor as determined according to appendix II: Brittle Fracture Damage Factor.

Brittle Fracture Category

Probability category according to the damage factor for brittleness.

12.22. Level II: Probabilities: High temperature hydrogen attack (HTHA)

Note: This block refers to API 581:2008 (appendix I: HTHA Damage Factor)

High Temperature Hydrogen Attack (HTHA) occurs in carbon and low alloy steels exposed to
a high partial pressure of hydrogen at elevated temperatures. It is the result of atomic
hydrogen diffusing through the steel and reacting with carbides in the microstructure. There
are two reactions associated with HTHA: First the hydrogen molecule, H2 must dissociate to
form atomic hydrogen H and then it can diffuse through steel.
Damage due to the HTHA can possess two forms: internal decarburization and fissuring from
the accumulation of methane gas at the carbide matrix interface and surface decarburization
from the reaction of the atomic hydrogen with carbides at or near the surface where the
methane gas can escape without causing fissures. Internal fissuring is more typically
observed in carbon steel, C-1/2Mo steels and in Cr-Mo steels at higher hydrogen partial
pressures, while surface decarburization is more commonly observed in Cr-Mo steels at
higher temperatures and lower hydrogen partial pressures.
HTHA can be mitigated by increasing the alloy content of the steel and, thereby, increasing
the stability of the carbides in the presence of hydrogen. As a result, carbon steel that only

88
contains Fe3C carbides has significantly less HTHA resistance than any of the Cr-Mo steels
that contain Cr and Mo carbides that are more stable and resistant to HTHA.
Historically, HTHA resistance has been predicted based on industry experience which has
been plotted on a series of curves for carbon and low alloy steels showing the temperature
and hydrogen partial pressure regime in which these steels have been successfully used
without damage due to HTHA. These curves, which are commonly referred to as the Nelson
curves, are maintained based on industry experience in API Recommended Practice 941.

Note: if the material is not carbon or low alloy steel or when operating temperature is less
than 250 Celsius and pressure less than 66 bar, this option is not available.

Figure 12.22.1: HTHA Technical Module

Hydrogen Partial Pressure [bar]

Determine the hydrogen partial pressure which is equal to mole fraction of hydrogen times
the total pressure (absolute).

Damage Observed
The base level technical subfactor can be adjusted downward if an effective inspection is
performed and NO DAMAGE is detected. As with stress corrosion cracking type of damage, if
damage is found during inspection, a significant upward adjustment is made to the subfactor.
It should be noted that once damage is observed a fitness-for-service assessment should be
performed.
Note: this field is available only if records of previous HTHA inspections are recorded in the
inspection history.

Inspection Effectiveness
Inspection effectiveness of the most effective inspection performed in the past will be
considered as "desired" inspection effectiveness. The calculation of the numbers of the
equivalent inspections is done according to the method described in appendix I: HTHA
Damage Factor (API 581:2008).

Number of Equivalent Inspections

Equivalent number of inspections performed according to the inspection history.

89
 HTHA Pv
The assessment of susceptibility to HTHA is based on the time the equipment has been
exposed to high pressure hydrogen at elevated temperatures. A single parameter, PV, has
been developed to relate time at temperature and a hydrogen partial pressure. This
parameter can be used to define the susceptibility of a material to damage from HTHA. For
the basis of this technical module, the susceptibility to damage from HTHA is based on
200,000 hours of service at a given combination of temperature and hydrogen partial
pressure.

HTHA Susceptibility
HTHA Susceptibility as determined according to appendix I: HTHA Damage Factor (API
581:2008).

HTHA Factor
Damage factor as determined according to appendix I: HTHA Damage Factor (API 581:2008).

HTHA Category
Probability category according to appendix I: HTHA Damage Factor (API 581:2008).

12.23. Level II Probabilities Piping Fatigue Technical Module

Note: This block refers to API 581:2008 (appendix III: Piping Mechanical Fatigue
Damage Factor)
Fatigue failures of piping systems present a very real hazard under certain conditions.
Properly designed and installed piping systems should not be subject to such failures but
prediction of vibration in piping systems at the design stage is very difficult, especially if there
are mechanical sources of cyclic stresses such as reciprocating pumps and compressors. In
addition, even if a piping system is not subject to mechanical fatigue in the as-built condition,
changing conditions such as failure of pipe supports, increased vibration from out of balance
machinery, chattering of relief valves during process upsets, changes in flow and pressure
cycles or adding weight to unsupported branch connections (pendulum effect) can render a
piping system susceptible to failure.
Note: this module is only available if the type of the component is piping.

Figure 12.23.1: Piping Technical Module

90
Previous Failures
If there has been no history of fatigue failures and there have been no significant changes,
then the likelihood of a fatigue failure is believed to be low.
 none,
 1 failure
 more than 1 failure.

Audible or Visible Shaking

The severity of shaking can be measured in these subjective terms or can be measured as
indicated at the bottom of the table in optional basic data.
 Minor - no visible shaking, barely perceptible feeling of vibration when touching the pipe
 Moderate - little or no visible shaking, definite feeling of vibration when touching the pipe
 Severe - visible signs of shaking in pipe, branches, attachments, or supports; obvious
feeling of vibration when touching the pipe

Shaking present more than weeks

If there have been no significant recent changes in the piping system and the amount of
shaking has not changed for years, or the amount of accumulative cycles is greater than the
endurance limit, then it can be assumed that the cyclic stresses are below the endurance limit.
Most piping shaking will be at a frequency greater than 1 hertz. One hertz for one year is
approximately 3x107 cycles, well beyond the endurance limit for most construction materials
For how long has the piping been shaking?
 0 - 2 weeks
 2 - 13 weeks
 13 - 52 weeks

Shaking Source
Determine to which cyclic source the piping is connected. The connections could be direct,
e.g. letdown and mixing valves, or indirect, i.e. through structural support.
 Valve with high pressure drop
 Release valve Chatter
 Reciprocating machinery

Corrective Action
Credit is given for analysis work which shows that the shaking piping is not a fatigue concern.
 Modifications were based on complete engineering analysis
 Modifications were based on an expert opinion
 No modifications were done at all.

Complexity per 15 meters of pipe

Determine the piping complexity in terms of the number of branched connections, number of
fittings, etc.
91
 Joint Design
Determine the type of joint or branch connection that is predominant throughout this section
of piping that is being evaluated.
 Threaded
 Socket welded
 Saddle on
 Saddle in
 Weldolets
 Sweepolets

Condition
What is the condition of the piping section being evaluated in terms of support?
 Missing/ damaged supports
 Unsupported weights on branches
 Broken gussets
 Gussets/supports welded directly to pipe
 Good condition

Branch Size
Branches of higher diameter will be significantly less susceptible to mechanical fatigue.

Fatigue Factor
Damage factor as determined according to appendix III: Piping Mechanical Fatigue Damage
Factor.

Fatigue Category
Probability category according to the damage factor for Fatigue.

12.24. Level II: Probabilities: Lining Technical Module

Note: This block refers to API 581:2008 (appendix VI: Component Lining Damage
Factor)
The purpose of this technical module is to provide a general RBI approach for handling
equipment that has a protective internal lining. It is common practice to construct equipment
with a material that is known to be subject to failure in the operating environment, but to
protect the material from the environment with a lining that is resistant. A general approach
to using RBI for lined equipment involves assessing the severity of damage that would be
expected to occur on the base material, and then give credit for the existence of a lining. The
degradation rate of the lining itself is not addressed. Evaluations of lining effectiveness at
preventing damage are based on expert opinion. All linings afford some degree of protection
from the operating environment. Many linings will last for an indefinite period of time,
essentially being immune to damage mechanisms that might otherwise occur. Other linings
will slowly degrade with time, and have a finite life. In such cases, the age of the lining (or the
92
years since the last inspection) becomes important in assigning a factor. Particularly in the
case of organic linings, the assumption is made that the lining is compatible with the
environment, operated within design temperature limits (including steam out) and properly
applied with appropriate curing.
Note: this module is only available if 'Lining' type was specified for the component.

Figure 28: Lining Technical Module

Last Inspection [year]

Age of Lining, or Years since Last Inspection (Thorough visual inspection).

Organic Service Start

The year the equipment has entered the organic service.

Lining Condition
 Poor - The lining has either had previous failures or exhibits conditions that may lead to
failure in the near future. Repairs to previous failures are not successful or are of poor
quality
 Average - The lining is not showing signs of excessive attack by any damage mechanisms.
Local repairs may have been performed, but they are of good quality and have
successfully corrected the lining condition
 Good - The lining is in 'like new' condition with no signs of attack by any damage
mechanisms. There has been no need for any repairs to the lining.

On-Line Monitoring
Some lined equipment has monitoring to allow early detection of a leak or other failure of the
lining. The monitoring allows orderly shutdown of the equipment before failure occurs. If on-
line monitoring is used, and it is known to be effective at detecting lining deterioration, the
lining failure factor will be multiplied by 0.1. Examples of monitoring systems include
thermography or heat sensitive paint (refractory linings), weep holes with detection devices
(loose alloy linings), electrical resistance detection (glass linings).

Lining Factor
Damage factor as determined according to appendix VI: Component Lining Damage Factor.

93
 Lining Category
Probability category according to the damage factor.

12.25. Level II: Probabilities: Furnace Technical Module

Note: This block refers to API 581:2000 (Appendix VII: Furnace Tube Technical
Module)
Special Note: this module has been subsequently discontinued in API 581:2008 and later as
it was found that the model's results were not sufficiently in line with the actual damage
progression and behavior noted in industry. The use of this module is left at the explicit
discretion of the user (the use is not recommended by the current edition of API 581).

This module establishes a damage factor (probability of failure modifier) for externally fired
furnace tubes. This technical module applies to ferritic steel (carbon steel and low alloy steels
through 12 Cr) and austenitic stainless steel (Types 304, 316, 321 and 347) tubes in refinery
heaters. These tubes are assumed to be directly fired, heat absorbing and enclosed within a
firebox. This module addresses damage caused by long term exposure to temperature as well
as short term overheating.
The relationship between creep life, stress and temperature is relatively complex. However,
heater tube design methods use simplified relationships developed from accelerated tensile
creep tests. The scatter in the results of these uni-axial creep tests is relatively large and
because of this scatter in experimental creep properties and dependence on accelerated
creep tests for the creep properties, there is a significant amount of uncertainty associated
with the prediction of creep life.
The prediction of heater tube life is further complicated by other effects such as external
oxidation which is the most common corrosion problem in heater tubes. Oxidation thins the
tube wall, increasing the stress and accelerating creep damage; its rate is a function of
temperature and amount of oxygen in the firebox:
 Internal corrosion. In some refinery furnaces, such as in Crude Distillation units, high
temperature sulfidation can be a problem. As corrosion thins the tube wall, the stress
increases and the rate of creep damage is accelerated. The rate of high temperature
sulfidation is a function of temperature and sulfur content in the process stream
 Other corrosion. Because the tubes are operated at high temperatures, even small
amounts of contaminants in either the process or fuel can cause accelerated corrosion of
the tube metal. For example, the combination of high temperatures and small amounts of
sodium and vanadium in the fuel can cause excessive external corrosion
 Uneven heating. The temperature distribution in heater fireboxes is affected by the
positioning of the tubes relative to the burners, the shape and size of the firebox, the tube
spacing, and the distances between the tubes and the burners
 Flame impingement. Flame impingement is affected by the same factors of uneven
heating; however, it is also affected by the adjustment of the burners and the control of
fuel and air in the fire box

94
 Coking. In many types of petroleum heaters, coke deposits build up on the inside of the
tube. The coke deposits act as a thermal insulation between the tube metal and the
process, raising the temperature of the tube wall, accelerating creep and corrosion.

This technical module assumes that the long-term creep does not occur unless the operating
tube wall metal temperature is higher than the temperatures given for each material of
construction. Local overheating; however, may occur as a result of uneven heating or flame
impingement and is addressed for all furnaces.
Note: This module is available only when the selected component type is "HEATER".

Figure 25.1.1: Furnace Technical Module.

Design Tube Metal Temperature [C]

Provide design tube metal temperature.

Operating Tube Metal Temperature [C]

Determine the average operating tube metal temperature determined from thermography or
skin thermocouples. If the tube temperature is not available, use process outlet temperature
plus 50 Celsius for nonfouling, noncoking service. For tubes in fouling or coking service, add
80C to process outlet temperature.

Upset (Overheat) Temperature [C]

Estimate the magnitude of extreme temperature excursions over the design tube metal
temperature (not the operating tube metal temperature). See Determination of Short-Term
Failure Probability for guidance on choosing the appropriate level of over-heating.

Upset Time [h]

Estimate the accumulated duration of extreme over-heating events. Offered values are: less
than 10, between 10 and 100, between 100 and 500, above 500.

95
Online Monitoring
Determine the types of proactive corrosion monitoring methods or tools employed, such as
tube skin thermocouples, thermography, process operating variables, etc.

Corrosion Rate [mm/year] Estimated

Provide estimated corrosion rate if experience or expert opinion is available.

Corrosion Rate [mm/year] Measured

Provide measured corrosion rate if available from current thickness measurements.

Corrosion Rate [mm/year] Calculated

Estimate thinning rates using Thinning Supplements C, D and I.

Current Wall Thickness [mm]

Current wall thickness calculated from the original wall thickness, corrosion rate and service
duration.

Tube Stress [MPa]

Current tube stress (as calculated using the current wall thickness).
Pressing the Calculate button, the Furnace technical module questionnaire will be shown.
Pressing Save will save the results and Update and Close will save the results and close the
dialog.

Furnace Factor
Furnace Damage Mechanism factor.

Furnace Category
Furnace Risk Category.

96
12.26. Level II Consequences Data Input
Note: this chapter refers to both API 581:2000 and API 581:2008, consequence
estimation.

Figure 12.26.1: Consequences Input Data.

Representative Fluid
Because very few refinery streams are of pure materials, the selection of a representative
material almost always involves making some assumptions. These assumptions, and the
sensitivity of the results, depend to a degree upon the type of consequences that are to be
evaluated. For mixtures, the representative material should be defined firstly by the NBP and
MW, and secondly by the density.
If these values are unknown, for the mixture can be calculated using:

where xi is mole fraction of the component and Propertyi may be normal boiling point,
molecular weight, or Density
Flammable consequence results are not highly sensitive to the exact material selected,
provided the molecular weights are similar, because air dispersion properties and heats of
combustion are similar for all hydrocarbons with similar molecular weights. This is
particularly true for straight chain alkanes, but becomes less true as the materials become
less saturated or aromatic. Hence, one should be very careful when applying the RBI BRD
consequence formulas to materials (such as aromatics, chlorinated hydrocarbons, etc.) not
already defined in the BRD. In such cases, it is recommended that test runs using quantitative
consequence analysis programs be made to more appropriately select the correct material
that yields similar consequence areas

Toxic Percentage
As a general rule, it is not necessary to evaluate a toxic release if the concentration of the
material within the equipment item is at or below the IDLH (Immediately Dangerous to Life
or Health) value. For hydrogen fluoride (HF), this is 30 ppm, for H2S this is 300 ppm, for NH3,
it is 300 and for Cl it is 30.

97
Toxic Model
Toxic fluids are similar to flammables in that not all toxic releases result in a single type of
effect. By themselves, hydrogen fluoride (HF), ammonia and chlorine pose only a toxic hazard.
On the other hand, some toxic materials such as hydrogen sulfide (H2S) are both toxic and
flammable. However, any toxic material, when mixed with hydrocarbons, can pose flammable
and toxic hazards. RBI allows for each of these possibilities. RBI evaluates the risks associated
with four toxic materials that typically contribute to toxic risks for a refinery: hydrogen
fluoride (HF), and hydrogen sulfide (H2S), ammonia (NH3) and chlorine (Cl). The same
approach can be used to evaluate other toxic materials.

Detection System
The list shown below, provides guidance to the user for assigning a qualitative letter rating
(A, B, or C) to the unit's detection and isolation systems. These letter ratings are later used in
the consequence estimation sections to determine the effect of the mitigation systems on final
consequences. Note that Detection System A is usually found only in specialty chemical
applications and is not often used in refineries; it is only provided here for completeness. The
information presented is used only when evaluating the consequences of continuous-type
releases. In other words, if more than 5,000 kg of hydrocarbon are released in 3 minutes, the
process of assessing detection and isolation capability is not applied:
 A - Instrumentation designed specifically to detect material losses by changes in
operating conditions (i.e., loss of pressure or flow) in the system
 B - Suitably located detectors to determine when the material is present outside the
pressure-containing envelope
 C - Visual detection, cameras, or detectors with marginal coverage.

Isolation System
 A - Isolation or shutdown systems activated directly from process instrumentation or
detectors, with no operator intervention
 B - Isolation or shutdown systems activated by operators in the control room or other
suitable locations remote from the leak
 C - Isolation dependent on manually operated valves.

Inventory Value
Specify the inventory if known. Otherwise, the middle of the Inventory Range will be used.

Inventory Range
 < 50 kg - Release resulting in less than total de-inventory of the component being
evaluated
 50 - 500 kg - Release resulting in total de-inventory of the component being evaluated
 500 - 5000 kg - Release resulting in total de-inventory of the component being evaluated,
plus one to ten other components
 5000 - 50000 kg - Release resulting in total de-inventory of the component being
evaluated, plus ten or more other components
 50000 - 500000 kg - Release will result in total de-inventory of the unit.
98
 Mitigation System
Mitigation systems affect a release in different ways. Some systems reduce duration by
detecting and isolating the leak. Other mitigation systems minimize the chances for ignition
or the spread of material. In RBI, consequence mitigation systems are treated in two ways:
 Systems that detect and isolate a leak
 Systems that are applied directly to the hazardous material to reduce consequences.

Mitigation System Consequence Adjustment

None No reduction
Inventory blowdown, coupled
with isolation system rated B or Reduce release rate or mass by 25%
higher
Fire water deluge system and
Reduce consequence area by 20%
monitors
Fire water monitors only Reduce consequence area by 5%
Foam spray system Reduce consequence area by 15%

Table 5: Mitigation System.

12.27. Level II: Consequences: Results
Note: this chapter refers to both API 581:2000 and API 581:2008, consequence
estimation.

Figure 12.27.1: Consequences: Results

Consequence Category
The consequence category is a ranking from "A" (low consequence) to "E" (high
consequence). Consequence Category Likelihood Weighted Average Area are:
 < 1 m2
 1 - 10 m2
 10 - 100 m2
 100 - 1000 m2
 1000 m2.

In keeping with the philosophy of Level II being a simplified approach for the purposes of
ranking equipment by risk, business interruption and environmental consequences are not
included in the approach.

99
 Likelihood Category
The likelihood category is a ranking from "1" (low likelihood) to "5" (high likelihood). This is
solely for the convenience of presentation in a 5X5 matrix. The categories may have absolute
values assigned, or they may simply be a relative ranking. Comparison of a category under
one definition to a category under another definition is not valid, and may be misleading. For
more details, refer to API 581:2008.

Risk
The risk rank, from "Low" to "High".

Consequence area [m2]

Reflects the area within which the results of a component failure will be evident.

Injury/Fatality area [m2]

The area within the people may be injured.

Toxicity area [m2]

The area within it may be polluted by toxic substances.

Equipment damage area [m2]

The area within which equipment may be damaged.

Details
Calculated values for different scenarios of inventory release.

12.28. Level II: Inspection History

At level II and III analyses, the software takes into its calculations all previous inspections
that were performed for the particular component and this history is presented in this
section. Therefore, in order for the software to correctly determine the Technical Module
Subfactors (TMS), all previous inspections must be entered for the component in question.
This however, can only be done in The Master Analysis as this information is considered
permanent for the particular component and cannot be changed in analyses.

100
 Figure 12.28.1: Inspection history.

While in The Master Analysis, select the component in the relevant unit, select level II or III
analysis and click on 'New Inspection' (greyed out in analyses) to open the new inspection
dialogue box:

Figure 12.28.2: New Inspection Dialogue

Inspection type
The type of inspection but not from point of view of applied inspection method, but rather
from point of view of damage mechanism that was supposed to be detected/inspected:
 Thinning
 External corrosion / corrosion under insulation
 Stress corrosion cracking (SCC)
 High temperature hydrogen attack (HTHA)
 Furnace / Creep-Thinning
 Emrittlement
 Mechanical Damage (i.e. piping fatigue)
 Other (i.e. Lining).

101
 Date
Date of the inspection

Effectiveness
Should be one of the values from A to E, where A is the best, and E is the worst inspection
category. In the software, it is considered that A=2B=4C=8D (that means one A inspection is
worth as two B inspections or four C inspections or eight D inspections). E type inspections
are considered as ineffective and therefore ignored/not accounted for.
For the given inspection type, subtype, intrusive and inspection category, system will provide
information about what kind of inspection methods are typical to be considered just below
the inspection category.

Intrusive
Should provide the information whether the applied inspection was intrusive or non-
intrusive.

Measured Wall Thickness

When applicable, provide the component's wall thickness as measured in the inspection. If
the component has more than one wall thickness, provide the minimal one.

Subtype
Is available for Stress corrosion cracking (SCC), while different forms of stress corrosion
cracking would require different inspection methods to be detected. The list of available
damage mechanisms is identical with the list which is further on described in the SCC
Technical module for Likelihood calculation.

Description
Concise and meaningful summarized information about the inspection report and its
findings. Try to be as quantitative as possible and refer the number and name of the report in
question, as well as its location.

12.29. Level II: Inspection Planning

An inspection plan for the component can be developed and the software will calculate its
projected effects on the component's risk level at the target year of its unit's inspection plan
(the unit to which the component belongs; see “Process Unit/Target inspection plan
end”).??

Add New Inspection

To add a future inspection, click on 'Add New Inspection' and follow the steps described in
section 12.28: Inspection History. Unlike the past inspections detailed in Inspection History,
these inspections are analysis specific and are not entered in The Master Analysis. In
addition, the year for the inspection is limited to the range between the current year and the
target year of the unit's inspection plan end.

102
Once inspections are added or modified, clicking 'Recalculate' will update the 'Results for
Accepted Inspection Plan' segment to reflect the added inspections' projected effect on the
component's risk.

Figure 12.29.1: Summary inspection planning.

The effects of the inspection's plan are displayed in three risk matrices, so the immediate
effects on the risk evolution of the planned inspections can be observed (current evaluation,
future evaluation without inspection and future evaluation with inspection).
Below the matrices, the risk factor rating and corresponding category per damage
mechanism are presented for each outcome (current evaluation, future evaluation without
inspection and future evaluation with inspection).

Suggest Inspection Plan

The software can also suggest an optional inspection plan based on the parameters for the
component by referring to trendable damage mechanisms (e.g. Thinning group of Damage
Mechanisms). iRiS tracks the increase of risk over time, until the set Plan End Date; if the risk
exceeds a defined risk threshold (by default, the high risk area), the software will try to
automatically suggest an appropriate inspection/action, to ensure that the
equipment/component does not exceed the set threshold. The highest inspection
effectiveness level is always suggested by default.

Figure 12.29.2: Automatic Inspection Suggestions

103
12.30. Level III: Performing Level III Analysis
Level III is a quantitative approach to RBI providing the most detailed analysis of the three
levels. This level adds a Financial Risk analysis and Equipment Modification Factors analysis
along with the data provided in the Level II analysis.
Accordingly, there will be two additional tabs: Modification Factors and Financial Risk which
are explained in the following sections; the other tabs remain the same as in Level II and are
described in the previous sections.

12.31. Level III: Modification Factors Data Input

Note: this block refers to Modification Factors (API 581:2000)

In order to perform the analysis, the following "Modification Factors" input page should be
filled in:

Figure 12.31.1: Modification factors.

Cold Weather
Cold climates impose additional risks on plant operation. Extremely low temperatures inhibit
maintenance and inspection activities and can result in reduced operator monitoring of
outside equipment. Ice and snow buildup can cause a distortion or failure of small lines,
instrument and electrical runs. In addition, frozen level controllers, cracked water lines,
cracked or frozen water containing deadlegs and plugged process lines are common winter
problems. Cold weather problems can be minimized by proper design but not completely
avoided. This parameter is set in The Master Analysis.
 >5 oC
 From -5 oC to 5 oC
 From 5 oC and 30 oC
 Bellow -30 oC.

104
Component Condition
Select the quality level of the component, compared with industry standards:
A - significantly better than industry standards
B - about equal to industry standards
C - below industry standards
D - Significantly below industry standards

Construction Code
These codes represent the accumulated knowledge from generations in process industry.
While designing and fabricating a component according to Code cannot assure fault-free
operation, it provides a good basis for minimizing problems in most applications:
A - The equipment meets the latest edition of the code
B - Code has been significantly modified since fabrication
C - No formal code existed or not fabricated to existing code

Design Life [years]

The designed life span of the component, in years.

Vibration monitoring
Wear is the most common failure of rotating equipment such as pumps and compressors.
Wear-related damage can result in seal failure, shaft damage or in extreme cases rapture of
the pump case. Vibration monitoring can normally detect the problems before failure occurs.
In this section the data about monitoring of vibrations should be added.
 no vibration monitoring
 periodic vibration monitoring
 online vibration monitoring

Planned shutdowns
Planned shutdowns include all outages for which the Standard Operating Procedures for
shutdown are employed. The intent is to include all outages where normal, systematic
shutdown procedures are employed. Any shutdown may have potential for operational
errors, even when carefully planned.
 0 to 1 per year
 1 to 3 per year
 4 to 6 per year
 >6 per year

105
Unplanned Shutdowns
Unplanned shutdowns are those that occur with a minimum of prior planning and include
situations such as power failures, leaks and fires. Select the number of unplanned shutdowns
per year, averaged on last three years.
 0 to 1 per year
 1 to 3 per year
 4 to 6 per year
 >6 per year

Process Stability
Some processes operate smoothly, day after day and do not require frequent interventions
from the operators. Other require frequent attention to adjust set points, control product
quality or change product grades. Select the best fitting qualitative assessment that describes
the stability of the process:
A - More stable than average process
B - Process has about average stability
C - Less than stable than average process
D - Much less stable than average process.

Release Valves Maintenance

Relief valve (RV) Maintenance is one of the four RV elements. RVs must be removed from
service periodically in accordance with API 510 for maintenance and inspection to ensure
that it functions properly.
Assess by how much RV maintenance is overdue:
 Less than 5% of Release Valves overdue
 From 5 to 15% of Release Valves overdue
 From 15 to 25% of Release Valves overdue
 Greater than 25% of Release Valves overdue or deficient RV Maintenance.

Release Valves Fouling Frequency

Components in process systems that contain significant amounts of polymer or other
extremely viscous material are more difficult to protect than other components in clean
streams. Even with proper design, accumulation of these materials can block or restrict
access to the relief valve.
A - No significant amount of fouling
B - Some polymer or other fouling material, with a history of occasional buildup in some
portions
C - High level of fouling, with a history of frequent buildup of deposit in release valves and/or
other parts.

106
 Relief Valves’ Service Type; Select an option:
 Corrosive: corrosive processes present special problem for relief systems. Although the
process itself is often designed to resist these impacts, relief systems are usually less
resistant and can result in unpredictable relief valve performance. If it can be considered
that relief valve works under such conditions this type of service should be chosen
 Clean: this type of services should be chosen if it is revealed that RV operates in clean
environment, where no fouling tendencies, corrosives or other contaminants are
identified
 Unknown: if none of previous 2 is applicable or there is no information about the
environment in which RV operates.

Complexity
The piping complexity can be evaluated through number of protrusions such as branch
connections, nozzles, pipe supports, poorly designed insulation support rings, etc. and any
design feature that would promote the retention and/or collection of moisture.
Provide the following inputs:
 Nozzle count: all nozzles should be included in the count
 Valve count: in RBI analysis valves are considered as part of the piping system. Each block
valve, control valve, drain valve and vent valve should be included in the count, all except
relief valves
 Branch count: any line that tees into the pipe segment being evaluated, other than an
injection point, is considered a branch. Drain lines, mixing tees, relief valve branches etc.
should be included. Each branch creates an opportunity for failure due to imposed
stresses, deadleg corrosion, fatigue etc. Each branch has a complexity factor of 3
 Connection count: all connections should be included. A flanged connection has much
higher probability of leaking than welded connection, and in further calculations it
receives a complexity factor of10
 Injection point count: number of injection points is important because these are locations
where relatively small quantities of potentially corrosive materials are injected in the
process streams to control stream composition or other process variables. Piping in
vicinity of injection points can be subject to corrosion. Examples: chlorine in reformers,
water injection in overhead systems, polysulfide injection in catalytic cracking wet gas,
antifoam injections etc.

12.32. Level III: Modification Factor: Results

Note: this block refers to Modification Factors (API 581:2000)

Figure 12.32.1: Results of Modification Factor Module.

107
Universal Subfactor
The universal sub factor covers conditions that equally affect all components in the facility.
As a result, the information concerning these conditions needs to be collected and recorded
only once. The numeric values assigned for each of the three elements of the subfactor are
applied equally to all equipment items. The universal factor includes these three elements:
 Plant condition
 Cold weather operation
 Seismic activity.

Mechanical Subfactor
The mechanical subfactor addresses conditions related primarily to the design and
fabrication of the component. Information for analysis is normally found on P&ID’s, in
engineering files, etc. and the generated numeric values are often different for each
component. This subfactor is composed of the following five elements:
 Complexity
 Construction Code
 Life Cycle
 Safety Factors
 Vibration Monitoring.

Process Subfactor
The process subfactor is based on the conditions that are influenced the most by the process
and how the facility is operated. Data is gathered from various sources, such as operating
records, discussions with personal etc. The process subfactor has three elements, of which
some might have sub-elements:
 Continuity of the process
 Stability of the process
 Relief valves.

Total Equipment Factor

Total equipment modification factor reflects the specific conditions that can have major
influence on the failure frequency of the component. It is calculated for each component,
based on the specific environmental conditions in which it operates. This factor's
calculation is based in part on several of the subfactors mentioned above and generally,
positive values are assigned where the conditions are judged to be more adverse than
standard and negative values refer to more favorable conditions.

108
 Management Systems Evaluation Factor
This factor is derived from the results of the evaluation of a facility or operating unit’s
management system that affects plant risk. Different practices within units at a facility
might create differences in the management systems evaluation factor between the units.
However, within one study the management evaluation factor should be the same and it is
applied equally to all components within the study and it does not change the order of the
risk-based ranking of the components.

12.33. Level III: Financial Risk: Data Input

Note: this block refers to Financial Risk (API 581:2000)
The Financial Risk Technical Module summarizes the costs related to equipment outages,
replacements, injuries, and optionally also include environmental costs; all inputs are
estimated costs in euro.

Figure 12.33.1: Financial Risk Technical Module: Data inputs.

Material
This field shows the Material of the current component. The material of construction is
usually carbon steel, unless otherwise required for process reasons.

Population Density [m2]

Represents the density of population around the particular component. In a level I analysis it
is considered to be constant for the entire facility; in level II or III, the value of the unit is set
by default but a specific value should be assigned to each different component, depending on
the distance from walkways, control rooms etc. It shows the population density expressed
per square meter.

Damage Area Cost [€/m2]

It is necessary to calculate the component damage costs to other equipment components in
the vicinity of the failure, if the failure results in a flammable or explosive event (toxic releases
do not result in damage to surrounding equipment).
Estimated cost of repairs for other components in the potentially affected area around the
analyzed component, per square meter, in euro.

109
Outage Cost [€/day]
The costs incurred due to business interruption are determined by the amounts of downtime
and lost production that can be directly associated with the repair of the specific component
that suffered loss of containment (due to holes or rupture) as well as the downtime associated
to the repairs of the surrounding equipment in the area of the event.
Calculated costs of an outage of a certain equipment, expressed as expense per day, in euro.

Injury/Fatality cost [€/person]

Estimated cost of injuries, per person, in euro.
This estimate should be sufficiently high to adequately represent typical costs to business of
an injury up to and including fatal injuries.

Internal Inspection Cost [€]

The cost to have an internal inspection performed.

External inspection cost [€]

The cost to have an external inspection performed.

Replacement Costs [€]

Hardware purchase cost, in Euros.

Released from Diked Area [%]

A diked area is defined as an area bounded by contours of land or a sporting a physical barrier
that retains fluids to a depth greater than 1".
Estimate the percentage value of fluid that spills from the diked area.

Release Type
Where is the fluid released to: ground or water? The cost of a cleanup greatly depends on
where the fluids spilled to; spills into waterways for instance will be much more costly than
spills above ground.

Estimated Cleanup Cost [€/m3]

Estimated costs for a cleanup. The environmental cost must be provided as an estimate by
the analyst.

Include Environment costs

Environmental consequences resulting from containment breaches can be a significant and
should be added to the other costs including fines and other financial penalties.
Checkmark to include.

110
12.34. Level III: Financial Risk: Results
Note: this block refers to Financial Risk (API 581:2000)

Figure 12.34.1: Financial Risk Technical Module: Results.

Hole Size (Small, Medium, Large, Rupture)

The method chosen for these calculations operates under the assumption that there is a
specific cost associated with each possible leak scenario (release hole size), and that these
are unique to each component type. This approach was chosen based on the inherent
differences in the costs associated with repairing components suffering small hole damage to
that of a component that was ruptured.

Outage Days
Duration of the outage of the facility, estimated for particular hole size and corresponding
leakage scenario.

Damage Area Cost [€]

It is a calculated damage done to surrounding equipment in case of fire or explosion. Toxic
events do not create damages to surrounding equipment so they are excluded from the
calculation.

Injury/Fatality Cost [€]

Estimated cost of potential injuries/fatalities.

Business Interruption Cost [€]

The costs associated with business interruption is determined based on the amount of
downtime (and lost production) associated with repairing damage to the specific piece of
equipment that has had loss of containment (due to holes or rupture) as well as the downtime
associated with repairing surrounding equipment in the area of the plant affected by the
release (consequence area).

Total Cost [€]

Sum of all potential costs in case of adverse events.

Financial Risk [€/year]

Total annual financial risk for a particular equipment item.

111
 Total Injuries
Estimated total number of injuries based on different leakage hole size, amount released and
affected area.

Volume Release [m3]

Estimated release of the volume, based on the hole size, fluid properties and other specific
conditions.

Volume Release to the environment [m3]

Estimated release of the volume in water or ground.

Cleanup Costs [€]

The cost of cleanup depends on where the release is likely to be spilled. Spills into waterways
for instance will be much more costly than spills above ground. Spills that work their way
below ground will also be more costly than those above ground. The environmental cost must
be provided as an estimate by the analyst.
Only liquids are considered to have the potential for environmental costs. Additionally, it is
assumed that any liquid with a normal boiling point less than 93 C° [200 F°] will readily
evaporate and environmental costs will be negligible. Also, if the release is likely to auto-
ignite, the environmental costs should not be included since the release will probably ignite
and burn.

Environmental Risk [€/year]

Total estimated environmental risk per year.

12.35. Documents and Overview

The last two tabs are Documents and Overview and these remain the same regardless to the
level of analysis or the method used.

Figure 12.35.1: Documents

112
A repository for component specific documents; parent unit documents are also shown.

Figure 12.35.1: Overview

An overview of all analyses in which this component is present.

113
13. Master Analysis
As mentioned throughout this guide, the software calculates risk per particular component
in a particular unit and takes into account modifications that are done to the specific
component for analysis purposes. This naturally requires units and component templates to
be set up in a central database from which these units and components can be taken into
analyses. This database is the Master Analysis.
Cardinal units such as the company itself and its business centers are set up at the initial
software implementation and are not covered here. However, once these units are set up, a
user may add new units to them, according to the organization's hierarchy.
It is worth mentioning again that in order to perform analyses, the units and components on
which said analyses are to be done must already be defined and set up in The Master Analysis.
Hence, if either does not exist, the user must first define them before performing the analysis,
as explained below.

13.1. Creating and modifying process units

While in The Master Analysis, click on 'New Process Unit in Unit' dropdown menu and select
the unit to which a new unit needs to be added or to which modifications are required.

Figure 11.2.1: New Unit in Unit.

114
The Process Unit information dialog will be displayed in the main window, containing the
unit's data in case of an existing unit or defaulting to the data (inheriting) from the parent
unit in case of a new unit.

Figure 11.2.2: Process Unit Information.

For full descriptions of the various fields, see chapter 11. Unlike the form which is presented
while in an analysis, all fields are editable in The Master Analysis and thus the unit's
information can be fully modified.

Deleting units
In order to delete a unit, select it; once the unit's information displays, click on 'Delete
Process Unit' on the header and click 'OK' on the confirmation message. Note that cardinal
(predefined) units cannot be deleted in this manner.

Important note: all changes done in The Master Analysis are permanent and will show in
all future analyses; this however, is not retroactive and will not affect existing analyses. It is
strongly advised to keep track of these changes for future reference.

115
13.2. Creating and modifying components
Definitions:
 Component: any part that is designed and fabricated to a recognized code or standard.
For example, a pressure boundary may consist of components (cylindrical shell sections,
formed heads, nozzles, tank shell courses, tank bottom plate, etc.).
 Equipment: an individual item that is part of a system, equipment is comprised of an
assemblage of Components. Examples include pressure vessels, relief devices, piping,
boilers and heaters.

Creating new equipment

While in The Master Analysis for the particular unit in which a new component is required,
click on 'New Component' for a dropdown menu containing possible component types.

Figure 11.2.3: Component Type List

Selecting a component type from the list will create a new component of that type with a
default name and associated with the respective unit in the component tab in the side menu.
The Component's attributes panel will automatically open in the main window, further
explained in section 12.1 and onwards.

Types of equipment that can be analyzed

Fixed Equipment:
 Column
 Column Bottom
 Column Top.

116
Exchanger:
 Condenser, Shell
 Condenser, Tube side
 Heat Exchanger, Shell
 Heat Exchanger, Tube Side
 Vessel
 Drum
 Reactor
 Pressure vessel (general)
 Cigar
 Furnace Tubes
 Boiler - Furnace Tubes for Fired Heater.

Pipe:
 Piping up to 0.75"
 Piping up to 1"
 Piping up to 2"
 Piping up to 4"
 Piping up to 6"
 Piping up to 8"
 Piping up to 10"
 Piping up to 12"
 Piping up to16"
 Piping > 16".

Other:
 Filter
 Fin/Fan Cooler
 Atmospheric Storage Tank (Shell)
 Atmospheric Storage Tank Floor
 Boiler (General)
 Coiled Tube
 Rotating equipment other
 Centrifugal pump, double seal
 Centrifugal pump, single seal
 Compressor, centrifugal
 Compressor, reciprocating
 Reciprocating pump.

117
14. NDT
14.1. NDT Analysis
The system offers a 'Non Destructive Testing' (NDT) alternative analysis type that aims to
predict the life expectancy of components susceptible to corrosion such as piping and
pressure vessels. It is in essence a tool for wall thickness measurements management and its
predications are made according to those measurements.
The NDT Analysis is started by selecting NDT from the Analysis Method dropdown menu at
Analysis Settings and saving the analysis' settings.

Figure X.1.1: Method in Analysis Settings

Components are shared with RBI and are set up in The Master Analysis accordingly. Note the
'service start' year which will dictate the start year for corrosion calculations.

Figure X.1.2: Component Basic Data

 The NDT analysis requires to first set up measurement points and their values, i.e.
Nominal, Minimal and Minimal Accepted values for every measurement point. This is
done in the Measuring points tab; refer to section X.2.
 After all points are set up, actual measurements may be input in the NDT tab and their
corresponding predictions are also presented there; refer to section X.3.
 The software offers a graphical presentation of the measurements in 'Latest Values' tab;
refer to section X.4.

118
14.2. Measuring Points
The NDT analysis is done for specific measuring points on each component. In this section,
these points are set up in the system and their properties serve as a baseline measurement
from which predictions are later derived.
By default, there are 10 points to be set up per component but if more are needed, a bulk
amount of new points can be added to the record at the bottom of the page by selecting the
desired amount from the drop down menu.

Figure X.3.1: Insert New Measuring Points

Larger components (equipment) with many measuring points may be segregated into
specific Component Parts (assemblies). The default Part is Piping and others may be added
by clicking on 'Add new record', naming it and saving changes. This adds the new component
parts to the Component Parts selection below, in which measurement points are defined.

Figure X.3.2: Add Component Parts

Measurement points are defined per component part, set by default to Piping but may be
changed in the Component Parts selection dropdown menu to other parts, as defined above.
Each part has 10 records by default, to which more can be added either by inserting them one
by one by clicking on 'New Measuring Point' or in bulk with the option described above. Note
to 'Save Changes' after each modification.

Figure X.3.3: Component Part Selection

119
 Name:
Technical name of the measuring point that will allow for easy identification.

Nominal Value:
The original wall thickness at the measuring point, gained either by measuring during
installation or from technical manufacturer readouts.

Minimal Value:
The minimal thickness measured that requires further attention. Automatically calculated to
be 70% of the Nominal Value but can be overridden by the user.

Minimal Accepted Value:

The minimal thickness that suggest imminent danger which requires immediate action.

14.3. NDT Measurements

Measurements taken during component inspections and repairs done to particular points are
recorded in this section. The measurement point's properties that were defined in section X.2
'Measuring Points' are presented in the greyed out segment at the top of the table.
Measurements' results are presented immediately below that and figures that are below the
defined thresholds for Minimal Value and Minimal Accepted Value are highlighted in yellow
and red respectively.
Wall thickness lost in percent (%) is calculated automatically from the Nominal Value and the
latest measured value.

Figure X.2.2: NDT Measurements' Data

120
Modifying records:
Click on 'New Measurement' in order to insert the results of an inspection or a repair. Choose
the inspection's date and enter the measurement's value for the point that was inspected or
if a repair was done, insert the point's new thickness and select 'Repair' from the dropdown
menu.
In case of an existing record, modifications can be made by double clicking on the record and
modifying the fields as necessary.
Click on 'Save Changes' for new records and other modifications to take effect.
Note that points which had repairs done to tem will have the value highlighted in grey and
that repairing resets all previous point measurements for the purpose of further calculations.

Statistical Results:
The system summarizes statistical derivatives from the measurements' details in the
following table:

Figure X.2.3: NDT statistical results

Next Planned Inspection:

Quarter time to life expectancy from last inspection.

Repair / Replacement Year:

Half time to life expectancy from last inspection.

Remark:
Free text for the evaluation.

Max Measured Corrosion Rate [mm/year]:

The maximum corrosion rate calculated according to the recorded measurements; in effect,
the maximal slope calculated between a pair of measurements.

Remaining Life Time, Based on Max Measured Corrosion Rate [year]:

The year when the measurement point which is worst off in a component will reach critical
minimal wall thickness, at the maximal corrosion rate.

Measuring Point Selection:

A dropdown menu to choose which Measurement Point to showcase in the Predictions
segment described below. By default, the worst off Point is taken and labeled as [Urgent].

121
 Figure X.2.4: Current NDT Predictions

Methods for Prediction:

 Linear Predication calculates wall thickness degradation according to the maximal
calculated corrosion rate
 Linear predication, last 3 measurements calculates wall thickness degradation according
to the average corrosion rate calculated for the past 3 measurements
 Polynomial extrapolation that fits a second order polynomial curve to the measurement
points (requires at least 3 points)

Predicated End of Life [year]

According to prediction type chosen, the year when a Measurement Point reaches the critical
Minimal Accepted Value.

Suggested Action [year] (Half Time to End of Life)

According to prediction type chosen, the year calculated for half the time period until end of
life; it is advised that an action should be taken this year to further evaluate the Measurement
Point.

122
14.4. Latest Values
Charts the measurements results and values in two forms for easy reference:

Percentage Lost
By selecting 'Percentage' in both the View Selection dropdown menu and in the legend
(default view) will present a bar chart with the percentage of lost material per measurement
point, highlighting the most corroded point/ location

Figure X.4.1: Percentages Lost

Measured Values
By selecting 'Measured Values' in the View Selection dropdown menu and the desired values
set/measured for each measurement point in the legend will present a bar chart that displays
the current value at a measurement point against its set values.

Figure X.4.2: Set and Measured Values

123
15. EskomRBI Analysis
15.1. EskomRBI
The Eskom RBI program identifies and protects plant pressure equipment assets from failure
by managing their particular failure mechanisms. This is in essence a master inspection and
maintenance plan for the management of all inspection activities (inspections, tests,
condition monitoring, interventions and input to operator rounds) for the life of the plant.
The RBI process is a step-by-step approach to develop, maintain and optimize the plant Risk
Inspection Basis, by incorporating plant specific knowledge, maintenance and failure history,
risk assessment techniques and international industry best practice, to finally achieve an
effective Inspection and Maintenance Strategy for each specific pressure equipment
component type on each individual power station. The RBI process further includes the
understanding of how equipment fails, the development of defense mechanisms to
counteract these failures and the application of technology to predict potential failures.
The following sections describes the particular aspects and dialogues arising from
performing this type of analysis, while all other elements and segments are covered in the
previous sections. As with other elements in the software, these options become available
only when performing this type of analysis; in order to use it, select 'EskomRBI' from the
Method dropdown menu in 'Analysis Settings'.

Figure 15.1.1: Select EskomRBI for Analysis Method

All the options in the side menu operate the same as with other analyses and the main change
is within each particular component assigned to the analysis.

15.2. EskomRBI Component Data

Segments in EskomRBI Component Data that are added or modified compared to other
methods:

Figure 15.2.1: Dimensions

Nominal Diameter [mm]

What is the internal diameter of the component? Relevant for piping and pressure vessels.
Nominal diameter (nominal bore), if the component is classified as piping; or the internal
diameter, if the component is classified as a pressure vessel.

124
 Figure 15.2.2: Operating Data

Operating Flow Rate [kg/s]

What is the ordinary/usual fluid flow rate in Kilograms per Second that passes through the
component?

Nominal Operating Temperature [C]

What is the ordinary/usual temperature in which the component is operating? This relates
to the design operating temperature and is mainly important for high temperature
components operating over 400°C, or in the creep range.

Figure 15.2.3: Other Data

Safety and Protection Devices / Data Source C

Does the system in which the component is installed have safety and protection devices?
Provide the Data Source as per Part C: Design specification data of the “Data Gathering
Guideline”.

Online Monitoring / Data Source D

Is it possible to tell report operating parameters from the online software, e.g. trend, etc.?
Provide the Data Source as per Part D: Operating information of the “Data Gathering
Guideline”.

Inspection Info Available / Data Source E

Is the information of prior inspections available, e.g. scope of work, results, etc.?
Provide the Data Source as per Part F: Inspection of the “Data Gathering Guideline”.

Failure History / Data Source F

Was the information of previous failures recorded for the component?
Provide the Data Source as per Part F: Inspection of the “Data Gathering Guideline”.

125
 Figure 15.2.4: SANS Data

Equipment Type
As defined for the component in The Master Analysis.

Applicable Figure
Per the methodology defined in SANS 347, predefined according to Equipment type which is
set up in The Master Analysis.

Design Hazard Category Classification (SANS 347 Edition 2)

Per the methodology defined in SANS 347, predefined according to Equipment type which is
set up in The Master Analysis.

Operating Fluid
The closest equivalent to the fluid contained in the component in normal operations, for the
purpose of hazard categorization according to SANS 347.

Dangerous Fluid
Check marked automatically by the choice of the fluid in The Master Analysis; presented here
as information.

State of Contents (at Atmospheric Conditions)

Material state of the operating fluid under atmospheric conditions (not operating conditions).
For example, water above its boiling point, contained in a component at above atmospheric
pressures may be in a liquid state, but it will flash into steam, in the case of a leak.

Damage Mechanisms
Select the damage mechanisms that are expected to affect the component:

Figure 15.2.5: Damage Mechanisms

Level I Damage Mechanisms:

Select the mechanisms that are expected to affect the component that are to be inspected in
a level I analysis.
Level I assessment is essentially carried out to quickly screen out components/equipment
with low levels of risk. It uses a simple, yet robust evaluation of Probability of Failure (PoF)
by determining which of a number of specific criteria will influence the probability of a
126
 failure, utilizing the simplified values “high” and “low” that equate to high and low scores
respectively.
When performing a Level I risk assessment, the most likely damage mechanism should be
considered together with a “worst case scenario” for the type of failure and the probability
that it could occur.
Note that the mechanisms selected in this multi-choice field, control the tabs for details that
are generated for the level I analysis' probabilities; refer to section 14.3.

Level II Damage Mechanisms:

Select the Damage mechanisms that require further inspection, as risen from the level I
analysis' results. This analysis level is much more detailed than the previous level and unlike
in other analysis methods, it changes the required inputs, not only adds new fields; refer to
section 14.5.??

15.3. EskomRBI Level I Probabilities

Similar to the general analysis, once a level I analysis is chosen for a component, two tabs are
added to the main window: Probabilities and Consequences. All mechanisms that were
chosen for the level I analysis under 'Component Data', add a tab with their name under the
probabilities.
Note: the questions in the Technical Module are the same for all mechanisms and contain the
same options and therefore only explained once.

Figure 15.3.1: EskomRBI Level I Probabilities

GFF
The GFF - Generic Failure Frequency, is a way of using specialist experience to identify the
relative failure frequency of different components. The method used at Level I is broadly
based on a DNV classification system:
Annual failure Description
probability (guidance only)
Quantitative Qualitative
(1)In a large population e.g. tubing, one or more failures can be
10-2 High
expected annually.
(2)Failure has occurred several times a year in operating company.
(1)Several failures may occur during the life of the installation for a
10-3 Medium
system comprising a small number of components.
(2)Failure has occurred in operating company.
(1)Several failures may occur during the life of the installation for a
10-4 Low
system comprising a large number of components.
(2)Failure has occurred in industry.
< 10-5 Negligible (1)Failure is not expected.
(2)Failure has rarely occurred in industry.
Table 7: GFF multiplier explained

127
Assume No Inspection [years]
Input the number of years that are expected to pass until the next inspection; this adds up
with the time passed since the actual last inspection.
As almost all damage mechanisms are time dependent, the probability of a component failing
will increase with time. To take this into account, a factor calculated according to how long it
passes without an inspection, is used with the GFF so that the longer the period required
between inspections, the higher the risk.

Figure 15.3.2: EskomRBI Level I Probabilities Technical Module

Age (since installed)

Number of service hours for the component since installation
 L: between 50k and 150k hours
 H: under 50k or over 150k hours

Material Issues
Are there known material defects?
 L: no known material issues
 H: known material issues

Last Inspection
When was the last inspection?
 L: less than 6 years ago
 H: more than 6 years ago

Damage/Degradation Present
If there is a history, knowledge or indications of an active degradation mechanism?
 L: none present
 H: present

Estimated Rate of Degradation (relative to required service period)

Within how many years does a conservative estimate of degradation indicate a problem?
 L: failure expected in more than 9 years
 H: failure expected in less than 9 years
128
Operating Conditions
Are operating conditions known or suspected to be beyond the designed operating
conditions?
 L: generally below designed operation conditions
 H: generally above designed operation conditions

Likelihood of Mal-operation
Is mal-operation known to occur or is it possible for it to occur? e.g. large temperature
excursions, passing valve, significant chemical excursions, large thermal transients, fast ramp
rates, etc.
 L: unlikely
 H: likely

Is Component Seam Welded

Design concerns in the original
Is the component considered to have potential design issues? e.g. is seam welded HT
components, or large change in section at weld, etc.
 L: no
 H: yes

Industry Experience
Is there relevant knowledge within the industry of the component failing?
 L: no known failures
 H: known failures

Prior Repairs/Damage
Is it known or suspected that repairs were done to the component or that high levels of
damage were found in the past?
 L: no known repairs
 H: known repairs

Figure 15.3.3: EskomRBI Level I Probabilities Results

PoF
Probability of Failure (PoF), calculated based on inputs.

129
 CoF Safety
Consequences of Failure (CoF) from Safety aspect, calculated based on inputs.

CoF Business
Consequences of Failure (CoF) from Business aspect, calculated based on inputs.

PoF Comments
User comments for Probability of Failure (PoF).

Level Comments
User comments for the level I analysis.

15.4. EskomRBI Level I Consequences

There are a number of potential consequence types that can be evaluated e.g. legal,
reputation, loss of earning, cost of repairs etc. For this process the consequences considered
are, in order of importance,
1. Safety and health
2. Business
3. Environmental

The above criteria are used together with the Hazard Category (SANS 347 Pressure
Classification), and the nature of failure (leak or Burst). As in the case of the PoF
determination a simple “High”, “Low” classification is used for each Criterion except for the
Hazard category which has 3 main Classes (IV highest to Class II). Strictly speaking there are
lower classifications (Category I and Sound Engineering Practice (SEP)) which do not require
a RBI process to be used to manage their integrity. The criteria used are shown in Table 5
together with the logarithmic numeric used to score and the general descriptor. The
weighting used for each criterion is also shown in yellow.
For each component to be assessed the RBI Team will assign a score which will be factored
by the weighting. The Hazard category is automatically calculated in the software based on
the dimensions/volume of the component and the contents. This produces a component CoF.

Figure 15.4.1: EskomRBI Level I Consequences Technical Module

Failure Type
What kind of failure is expected, considering the damage mechanism?
 L: Leak
 H: Burst

130
Safety
How likely are serious injuries or fatalities to occur due to the failure?
 L: Unlikely fatalities/serious injury
 H: likely fatalities/serious injury

Health
Reportable incident causing long term health issues to employee/s or resident/s in areas
surrounding the station?
 L: minor or no implications
 H: major implications

Environment
How likely to occur is a major impact on the environment as a consequence to a failure?
This refers to the potential for a reportable environmental incident occurring e.g. large
water spill, oil spill, asbestos released, etc.
 L: minor or no impact
 H: major impact

Lost MW/Income
 L: under 144000 MW/h (600 MW for 10 days)
 H: over 144000 MW/h (600 MW for 10 days)

Repair Cost
Estimate the costs to repair the component after a failure; in ZAR
 L: under 1 MR
 H: over 1MR

Figure 15.4.2: EskomRBI Level I Consequences Results

PoF
Probability of Failure (PoF), calculated based on inputs.

CoF Safety
Consequences of Failure (CoF) from Safety aspect, calculated based on inputs.

CoF Business
Consequences of Failure (CoF) from Business aspect, calculated based on inputs.
131
 PoF Comments
User comments for Probability of Failure (PoF).

Level Comments
User comments for the level I analysis.

15.5. EskomRBI Level II Probabilities

Level II Probabilities differ from the Level I Probabilities only in the questions presented in
the Technical Module of the mechanisms.

Figure 15.5.1: EskomRBI Level II Probabilities Technical Module

Age (since installed)

Estimated number of service hours for the component since installation
 VL: between 50k and 99k hours
 L: between 100k and 149k hours
 M: between 150k and 199k hours
 H: between 200k and 249k hours
 VH: under 50k or over 250k hours

Total Starts per Year

Approximately how many starts per year does this component have?
 VL: less than 10
 L: between 10 and 49
 M: between 50 and 99
 H: between 100 and 200
 VH: more than 200

132
Typical Start-Up Rate / Loading Rate
Estimated ramp/start-up rate of the component, with regard to component stress load and
recommended ramp/start-up rate:
 VL: very low
 L: low
 M: medium
 H: high
 VH: very high

Potential Material Problems

Is the component made of a material that is regarded in the industry as a problematic
material? i.e. difficult to manage damage mechanisms, welding issues, etc.?
 VL: no known material issues
 M: possible material issues
 VH: known major material issues

Repairs/Damage
Are there any known repairs that were done to or damages that were found on the
component?
 VL: no repairs or damage
 M: possible repairs or damage
 VH: known repairs or damage

Last Inspection
When was the component last inspected for the specific damage mechanism in question?
 VL: less than 2 years
 L: between 2 and 4 years
 M: between 4 and 6 years
 H: between 6 and 8 years
 VH: more than 6 years

Adequacy of Scope (for all DMs)

With the identified damage mechanism in mind, did the inspection carried out cover all
relevant locations?
 VL: extensive coverage of 60-100% of suspect areas
 L: good coverage of 30-60% of suspect areas
 M: partial coverage of suspect areas (30% or less)
 H: poor coverage - only spot checks carried out
 VH: Very poor coverage - no significant inspection performed

133
Adequacy of Techniques (for all DMs)
With the identified damage mechanism in mind, how could the adequacy of the inspection
techniques be described?
 VL: very good - techniques used would find all possible damage types
 L: good - techniques used would detect most damage
 M: average - techniques used would detect some damage
 H: poor - techniques used may detect some damage
 VH: very poor -techniques used would not detect damage

Estimated Rate of Degradation

What is the industry's trended set of inspection results or life calculations? If not available,
estimate a conservative judgement for time to failure:
 VL: failure in more than 12 years
 L: failure in 9 to 12 years
 M: failure in 6 to 9 years
 H: failure in 3 to 6 years
 VH: failure in less than 3 years

Water/Steam Chemistry
Is the water chemistry typically within limits?
 VL: always within limits
 L: rarely outside of limits
 M: generally within limits
 H: rarely within limits
 VH: Always outside of limits

Mechanical Fatigue Stress

Is a potential for Mechanical Fatigue stress known or plausible?
 VL: not possible
 L: unlikely
 M: possible
 H: likely
 VH: Known

Thermal Fatigue Stress

Is a potential for Thermal Fatigue stress known or plausible?
 VL: not possible
 L: unlikely
 M: possible
 H: likely
134
 VH: Known

Local Mechanical Over-stressing

Is local mechanical over-stressing known or plausible?
 VL: not possible
 L: unlikely
 M: possible
 H: likely
 VH: Known

Local Hot Spots

Are any local Hot Spots known or likely?
 VL: not possible
 L: unlikely
 M: possible
 H: likely
 VH: Known

Nominal Operating Temperature

Is the nominal operating temperature typically/often above the design operating
temperature?
 VL: normally more than 10 degrees Celsius below design
 L: normally 5 to10 degrees Celsius below design
 M: normally +/- 5 degrees Celsius from design
 H: normally 5 to10 degrees Celsius above design
 VH: normally over than 10 degrees Celsius above design

Corrosion Susceptibility
How susceptible is the component to on or off-load corrosion?
 VL: very Low - will not occur (0%)
 L: low - unlikely to occur (<20%)
 M: medium - may occur (20-50 %)
 H: high - will probably occur (50-85%)
 VH: very High - will definitely occur (>85%)

Established Frequency of Temperature Excursions

How many temperature excursions above design parameters, that cause an alarm, are there
per year?
 VL: no excursions
 L: less than 3 excursions per year
135
  M: 3 to 9 excursions per year
 H: 10 to 20 excursions per year
 VH: more than 20 excursions per year

Severity of Temperature Excursions

Assuming the component suffers temperature excursions, how severe are those excursions?
 VL: never above alarm limits (0%)
 L: rarely above alarm limits (<5%)
 M: occasionally above alarm limits (6-24%)
 H: Frequently above alarm limit (25-90%)
 VH: Always above alarm limit (>90%)

Design Concerns
Is it known or believed that there is any issue with the design of this component?
 VL: no issues
 M: Possible / minor issues with design
 VH: Definite issues with design

15.6. EskomRBI Level II Consequences

Level II Consequences differ from the Level I Consequences only in the questions presented
in the Technical Module of the mechanisms

Figure 15.6.1: EskomRBI Level II Consequences Technical Module

Failure Type
What kind of failure is expected, considering the damage mechanism?
 VL: Pin hole leak/ inconsequential Failure
 L: Minor Leak/Failure
 M: Medium Leak/ Failure
 H: Major Leak/ Failure
 VH: Burst/ Catastrophic failure

136
Estimated Area Affected by Failure
How big is the area around the component that is expected to be affected by the failure?
Estimate a radius, in meters
 VL: Local (within about 5 meters)
 L: Minor (within about 10 meters)
 M: Medium (within about 20 Meters)
 H: Large (within about 40 meters)
 VH: Very Large, larger than 40m (most of boiler house/turbine hall or combination)

No. of People in Area

How many persons are expected to be in the affected area?
 VL: up to 1
 L: 1 to 2 persons
 M: 3 to 4 persons
 H: 5 to 6 persons
 VH: more than 6 persons

Typical Time in Area (per day)

For how long, each day, would those persons typically be in the affected area?
 VL: less than an hour
 L: 1 to 2 hours
 M: 3 to 4
 H: 5 to 6 hours
 VH: more than 6 hours

Injury Type
How extensive are injuries expected to be as a consequence to a failure? Are fatalities
expected?
 VL: None
 L: possible injury
 M: Injury
 H: Multiple Injuries with possible fatality
 VH: Multiple Fatalities

137
Environment
How likely to occur is a major impact on the environment as a consequence to a failure?
This refers to the potential for a reportable environmental incident occurring e.g. large
water spill, oil spill, asbestos released, etc.
 VL: not possible
 L: Unlikely
 M: possible
 H: Likely
 VH: Very Likely

Lost MWh
In case of failure, would it cause a unit trip? And if so, for how many days would you expect
the unit to be down? (Relate days to MWhrs) would lost the lost generation be expected to
be?
 VL: <14400 MWh (equivalent to 1 day offline)
 L: 14401 - 43200 MWh (equivalent to 3 days offline)
 M: 43201 - 144000 MWh (equivalent to 10 days offline)
 H: 144001 -432000 MWh (equivalent to 30 days offline)
 VH: >432000 MWh (longer shutdown)

Repair Cost
Estimate the costs to repair the component after a failure; in ZAR
 VL: <100KR
 L: 0.5MR
 M: 1MR
 H: 10MR
 VH: >100MR

138
16. Reports
16.1. General
As it was already previously discussed, summary of the results of the analysis can be found
in reports, where the user can choose to have some specific parts or full report. Once the
analysis is saved the user can access it anytime and produce the reports. In the next blocks
the user can find more detailed information about several reports.

Figure 16.1.1: Reports List

139
 Report Type
Select the level of detail for the reports, according to the level of analysis

Figure 16.1.2: Reports List

16.2. Executive Summary

An executive summary is a short document or section of a document, produced for business
purposes, that summarizes a longer report, proposal or a group of related reports in such a
way that readers can rapidly become acquainted with a large body of material without
having to read it all. It usually contains a brief statement of the problem or proposal covered
in the major document(s), background information, concise analysis and main conclusions.
Note: the executive summary will not be automatically generated and needs to be written
by the user.

Figure 16.2.1: Executive Summary

140
16.3. Risk Matrix
A summary of all selected components into a single risk matrix; the cumulative number of
components with the particular probability and consequence ratings combinations are
presented on 5 X 5 matrix.

Figure 16.3.1: Risk Matrix

16.4. Component Count

Count components that participate in the analysis with various options for visual
representation, sorted by component type.

Figure 16.4.1: Component Count

141
16.5. Damage mechanisms
Displays component counts by damage mechanisms; for all components participating in the
analysis.

Figure 16.5.1: Damage Mechanism

16.6. Thinning Corrosion Rates

The rate of corrosion is the speed at which a metal deteriorates in a specific environment.
The rate, or speed, is dependent upon environmental conditions as well as the type, and
condition, of the metal

Figure 16.6.1: Thinning and Corrosion rates.

142
16.7. Corrosion Development
Displays all components that according to current conditions and parameters, are projected
to develop corrosion by the year selected.

Figure 16.6.1: Thinning and Corrosion rates.

16.8. Gain - Loss

Compares the potential gains to losses, in terms of risk, converted to monetary values, per
component in the analysis; beginning with the component that is affected the most by
potential inspection (the greatest delta between gains and losses) and continuing in
descending order.
The component's Net Present Value in terms of risk is the difference between costs saved due
to events averted or mitigated plus maintenance costs and the cost of unmitigated event:

143
 The report highlights the components that may benefit the most from inspections and other
mitigation actions, in terms of reduction of future risk and its associated costs.

Figure 16.8.1: Gain and Loss

16.9. Financial Risk

Charts all components in descending order of the impact that inspections may have on them,
in terms of return on investment (RoI) through reduced risk. This is represented by the S-
Factor calculated for each component combined with the costs associated with the risk and
inspections:

The results are arranged in a graph form for easy identification of the most influential
component on the net present value (NPV) of risks associated to components with the highest
impact on said value, once inspected.

144
Below the graph, the components are detailed in a table.

Figure 16.9.2: Financial Impacts' Example

Name
Component name.

Current Financial Risk [€/year]

Total cost of the risk associated with the component, calculated for the day of the analysis;
taking into account the parameters defined in section 5.33, Level III Analysis: Financial Risk

Current Frequency of Failure [events/year]

The expected rate of failure occurrence; calculated from the probabilities defined for the
component and for the day of the analysis.

Future Financial Risk, No Inspection [€/year]

Total cost of the risk associated with the component, calculated for the analysis' planned end
year; taking into account the parameters defined in section 5.33, Level III Analysis: Financial
Risk and assuming no inspection was done until the planned end year.

Future Frequency of Failure, No Inspection [events/year]

The expected rate of failure occurrence; calculated from the probabilities defined for the

145
component and for the analysis' planned end year, assuming no inspection was done until the
planed end year.

Future Financial Risk with Inspection [€/year]

Total cost of the risk associated with the component, calculated for the analysis' planned end
year; taking into account the parameters defined in section 5.33, Level III Analysis: Financial
Risk and assuming an inspections plan was carried out by the planned end year.

Future Frequency of Failure, with Inspection [events/year]

The expected rate of failure occurrence; calculated from the probabilities defined for the
component and for the analysis' planned end year, assuming an inspections plan was carried
out by the planned end year.

Risk Reduction with Inspection [€/year]

The difference in risk cost between the future financial risk with and without an inspection.

Inspection Cost
Total cost of an inspections plan.

S-Factor
The returns on an investment in an inspection, in terms of risk cost saved: the difference
between the future cost without and inspection and the future cost with an inspection,
divided by the cost of the inspection.

Cumulative Risk Reduction [€]

A running sum of all risk reductions for all analyzed components.

Cumulative Inspection Cost [€]

A running sum of all inspections' costs, planned for all analyzed components.

Cumulative Value [€]

A running sum of the net value of costs saved, after deducting investment into inspections.

146
16.10. Cumulative Risk
This cumulative graph showcases the greatest contributors to risk costs in the analysis. The
leftmost component accrues the most cost, in Euro, the next component adds to the cost and
so forth.
This highlights in a glance the components to be prioritized for inspection optimization,
increased safety and cost reduction.

Figure 16.10.1: Cumulative Risk Chart

147
16.11. Inspection Plan
Inspection plan is a report that provides instructions on how an inspection is to take place.
Inspection plans provide details about what characteristics must be tested in order to ensure
the quality of the object, as well as specific metrics and measurements that must be achieved
in order for the object to be judged in compliance with standards.

Figure 16.11.1: Inspection Plan

16.12. General Comments

Fields where a user can add general comments to the analysis

Figure 16.12.1: General Comments

148
16.13. Component Summary Sheet
Displays components' data for all components that participate in the analysis; filterable by
level of risk

Figure 16.13.1: Component Selection

16.14. The GIS Map

This Google-Map shows the exact geographical location of the current object; unit
coordinates are set up for the unit when implementing the software.

Figure 16.14.1: GIS Map

149
16.15. Risk Map
With the help of an implementer, components can be set up within a diagram that represents
the unit's layout. Each component is linked to its risk assessment and its representative
coloration and details adjust on the map when updated.

Figure 16.15.1: Plant Layout Example for Risk Map

Hovering over a component displays a tooltip detailing the analysis that was performed for it
and its resulting risk assessment; clicking on the component will load its Data Sheet from the
analysis.

150
17. Appendices
17.1. Appendix I: API 581:2008 Thinning Damage Factor
Scope
The damage factor calculation for components subject to damage mechanisms that result in
general or local thinning is covered in this paragraph.

Screening Criteria
In an API RBI assessment, all components should be checked for thinning.

Required Data
The basic component data required for analysis is given in Table A1. Component types and
required geometry data are shown in Table A2 and Table A3, respectively. The data required
for determination of the thinning damage factor is provided in Table A4.

Basic Data Comments

Start Date The date the component was placed in service.

Thickness, mm [in] The actual measured thickness of the component measured at the
component start date or the minimum construction thickness.
Corrosion Allowance, mm The corrosion allowance is the specified design or actual corrosion
[in] allowance upon being placed in the current service.
Design Temperature, °C [°F] The design temperature, shell side and tube side for a heat exchanger.

Design Pressure, MPa [psi] The design pressure, shell side and tube side for a heat exchanger.

Operating Temperature, The highest expected operating temperature expected during operation
°C [°F] including normal and unusual operating conditions, shell side and tube side
for a heat exchanger.
Operating Pressure, The highest expected operating pressure expected during operation
MPa [psi] including normal and unusual operating conditions, shell side and tube side
for a heat exchanger.
Design Code The design code of the component containing the component.
Equipment Type The type of Equipment
Component Type The type of Component, see Table 22
Component Geometry Data Component geometry data depending on the type of component, see Table
23
Material Specification The specification of the material of construction, the ASME SA or SB
specification for pressure vessel components or of ASTM specification for
piping and tankage components. Data entry is based on material
specification, grade, year, UNS Number, class/condition/temper/
size/thickness; this data is readily available in the ASME Code.
Weld Joint Efficiency Weld joint efficiency per the Code of construction,
Heat Tracing Is the component heat traced? (Yes or No)
Table A1: Basic Component Data Required for Analysis.

151
 Equipment Type Component Type Geometry Type
Compressor COMPC CYL
Compressor COMPR CYL
Heat Exchanger HEXSS CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Heat Exchanger HEXTS CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Heat Exchanger HEXTUBE CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Pipe PIPE-1 CYL, ELB
Pipe PIPE-2 CYL, ELB
Pipe PIPE-4 CYL, ELB
Pipe PIPE-6 CYL, ELB
Pipe PIPE-8 CYL, ELB
Pipe PIPE-10 CYL, ELB
Pipe PIPE-12 CYL, ELB
Pipe PIPE-16 CYL, ELB
Pipe PIPEGT16 CYL, ELB
Pump PUMP2S CYL
Pump PUMPR CYL
Pump PUMP1S CYL
Tank650 TANKBOTTOM PLT
Tank650 COURSE-1 CYL
Tank650 COURSE-2 CYL
Tank650 COURSE-3 CYL
Tank650 COURSE-4 CYL
Tank650 COURSE-5 CYL
Tank650 COURSE-6 CYL
Tank650 COURSE-7 CYL
Tank650 COURSE-8 CYL
Tank650 COURSE-9 CYL
Tank650 COURSE-10 CYL
Vessel/FinFan KODRUM CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Vessel/FinFan COLBTM CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Vessel/FinFan FINFAN CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Vessel/FinFan FILTER CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Vessel/FinFan DRUM CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Vessel/FinFan REACTOR CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Vessel/FinFan COLTOP CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Vessel/FinFan COLMID CYL, ELB, SPH, HEM, ELL, TOR, CON, NOZ
Table A2: Permissible Component Types and Geometry Types Based on the Equipment Type.

152
Geometry Type Geometry Description Geometry Data

CYL Cylindrical Shell Diameter (OD for Component Types Pipe and Tube/NS Pipe,
ID for all other Component Types)
Length
Volume
ELB Elbow or Pipe Bend Diameter (OD for Component Types Pipe and Tube/NS Pipe,
ID for all other Component Types)
Bend Radius
Volume
SPH Spherical Shell Diameter (ID)
Volume
HEM Hemispherical Head Diameter (ID)
Volume
ELL Elliptical Head Diameter (ID)
Major-to-Minor Axis Ratio
Volume
TOR Torispherical Head Diameter (ID)
Crown Radius (IR)
Knuckle (IR)
Volume
CON Conical Shell Diameter (ID)
Length
Cone Angle
Volume
NOZ Nozzle Diameter (ID)
Length
Volume
Table A3: Geometry Data Based on the Geometry Type.

153
 Basic Data Comments
Thinning Type Determine whether the thinning is general or localized based on inspection results of
(General or effective inspections. General corrosion is defined as affecting more than 10% of the
Localized) surface area and the wall thickness variation is less than 1.27 mm (50 mils). Localized
corrosion is defined as affecting less than 10% of the surface area or a wall thickness
variation greater than 1.27 mm (50 mils).
Corrosion Rate The current rate of thinning calculated from thickness data, if available. Corrosion
(mm/yr:mpy) rates calculated from thickness data typically vary from one inspection to another.
These variations may be due to variations in the wall thickness, or they may indicate
a change in the actual corrosion rate. If the short-term rate (calculated from the
difference between the current thickness and the previous thickness) is significantly
different from the long-term rate (calculated from the difference between the current
thickness and the original thickness), then the component may be evaluated using
the short term rate, but the appropriate time and thickness must be used.
Inspection The effectiveness category of each inspection that has been performed on the
Effectiveness component during the time period (specified above).
Category
Number of The number of inspections in each effectiveness category that have been performed
Inspections during the time period (specified above).
On-Line Monitoring The types of proactive on-line monitoring methods or tools employed, such as
corrosion probes, coupons, process variables (Coupons, Probes, Process Variables, or
Combinations, etc.)
Thinning Mechanism If credit is to be taken for on-line monitoring, the potential thinning mechanisms
must be known. A knowledgeable materials/corrosion engineer should be consulted
for this information, also see API 571 [6].
Presence of For piping, determine if there is an injection or mix point in the circuit.
Injection/Mix Point
(Yes or No).
Type of For piping circuits which contain an injection or mix point, determine whether not
Injection/Mix Point the inspection program is highly effective or not highly effective to detect local
Inspection corrosion at these points.
Presence of a For piping, determine if there is a deadleg in the circuit.
Deadleg (Yes or No).
Type of Inspection For piping circuits which contain a deadleg, determine if the inspection program
for Deadleg currently being used is highly effective or not highly effective to detect local corrosion
Corrosion in dead legs has been performed.
Welded Construction Applicable to Atmospheric Storage tanks only, tanks may be welded or riveted
construction. Is the tank of welded construction? (Yes or No)
Maintained to API Applicable to Atmospheric Storage tanks only. Is the tank maintained in accordance
653 with API 653 [5] (Yes or No)
Settlement Applicable to Atmospheric Storage tanks only, tanks may be welded or riveted
construction. What is the settlement history of the tank
• Recorded settlement exceeds API 653 criteria
• Recorded settlement meets API 653 [5] criteria
• Settlement never evaluated
• Concrete foundation, no settlement
Table A4: Data Required for Determination of the Thinning Damage Factor.

154
Basic Assumptions
In the damage factor calculation, it is assumed that the thinning mechanism has resulted in
an average rate of thinning over the time period defined in the basic data that is fairly
constant. The probability of failure is estimated by examining the possibility that the rate of
thinning is greater than what is expected. The probability of these higher rates is determined
by the amount of inspection and on-line monitoring that has been performed. The more
thorough the inspection, and the greater the number of inspections and continued use of on-
line monitoring, the less likely is the chance that the rate of thinning is greater than
anticipated. In the damage factor calculation, it is assumed that thinning damage would
eventually result in failure by plastic collapse.

Determination of the Damage Factor:

Overview
A flow chart of the steps required to determine the damage factor for thinning is shown in
Figure A1. The following paragraphs provide additional information and the calculation
procedure. The corrosion rate should be calculated from thickness data available from
equipment inspection(s). If corrosion rates have not been calculated from thickness
inspection data, conservative estimates may be established; both from expert opinion from
knowledgeable materials or corrosion engineers. The results of inspections that have been
performed on the component should be used to designate the type of thinning (i.e., general
versus localized). If both general and localized thinning mechanisms are possible, then
designate the type of thinning as localized. The type of thinning designated will be used to
determine the effectiveness of inspection performed.

155
Figure A1: Determination of the Thinning Damage Factor.

156
Inspection Effectiveness
Inspections are ranked according to their expected effectiveness at detecting thinning and
correctly predicting the rate of thinning. The actual effectiveness of a given inspection
technique depends on the characteristics of the thinning mechanism, (i.e., whether it is
general or localized). Examples of inspection activities for general and localized thinning,
respectively, that are both intrusive (requires entry into the equipment), non-intrusive (can
be performed externally), and buried components are provided in Table A5 through Table
A7, respectively. Note that the effectiveness category assigned to the inspection activity
differs depending on whether the thinning is general or localized. For localized thinning,
selection of locations for examination must be based on a thorough understanding of the
damage mechanism in the specific process. The effectiveness of each inspection performed
within the designated time period must be characterized in accordance with Table A5
through Table A10, as applicable. The number and category of the highest effective inspection
will be used to determine the damage factor. If multiple inspections of a lower effectiveness
have been conducted during the designated time period, they can be equated to an equivalent
higher effectiveness inspection. Note that for tank bottoms, credit is given for only one
inspection.

Inspection Inspection Intrusive Inspection Example Non-intrusive Inspection

Category Effectiveness Example
Category
A Highly Effective 50 to 100% examination of the 50 to 100% ultrasonic scanning
surface (partial internals coverage (automated or manual)
removed), and accompanied by or profile radiography
thickness measurements
B Usually Effective Nominally 20% examination (no Nominally 20% ultrasonic
internals removed), and spot scanning coverage (automated or
external ultrasonic thickness manual), or profile radiography,
measurements or external spot thickness
(statistically validated)
C Fairly Effective Visual examination with thickness 2 to 3% examination, spot
measurements external ultrasonic thickness
measurements, and little or no
internal visual examination

D Poorly Effective Visual examination Several thickness measurements,

and a documented inspection
planning system

E Ineffective No inspection Several thickness measurements

taken only externally, and a poorly
documented inspection planning
system
Table A5: Guidelines for Assigning Inspection Effectiveness – General Thinning.

157
Inspection Inspection Intrusive Inspection Example Non-intrusive Inspection
Category Effectiveness Example
Category
A Highly Effective 100% visual examination (with 50 to 100% coverage using
removal of internal packing, trays, automated ultrasonic scanning, or
etc.) and thickness measurements profile radiography in areas
specified by a corrosion engineer
or other knowledgeable specialist.
B Usually Effective 100% visual examination (with 20% coverage using automated
partial removal of the internals) ultrasonic scanning, or 50%
including manways, nozzles, etc. manual ultrasonic scanning, or
and thickness measurements. 50% profile radiography in areas
specified by a corrosion engineer
or other knowledgeable specialist.
C Fairly Effective Nominally 50% visual Nominally 20% coverage using
examination and spot ultrasonic automated or manual ultrasonic
thickness measurements scanning, or profile radiography,
and spot thickness measurements
at areas specified by a corrosion
engineer or other knowledgeable
specialist.
D Poorly Effective Nominally 20% visual Spot ultrasonic thickness
examination and spot ultrasonic measurements or profile
thickness measurements radiography without areas being
specified by a corrosion engineer
or other knowledgeable specialist.
E Ineffective No inspection Spot ultrasonic thickness
measurements without areas
being specified by a corrosion
engineer or other knowledgeable
specialist.
Table A6: Guidelines for Assigning Inspection Effectiveness – Local Thinning.

158
Inspection Inspection Intrusive Inspection Non-intrusive Inspection Non-intrusive
Category Effectiveness Example Example Inspection Example
Category
A Highly 100% internal Complete excavation, a. Cathodic Protection
Effective inspection via state-of- 100% external visual (CP) System maintained
the-art pigging and in- inspection, and 100% and managed by NACE
line inspection inspection with NDE certified personnel and
technologies (UT, MFL, technologies (UT thickness complying with NACE
internal rotary UT, etc.) measurement such as SP0169 [14]– includes
100% external handheld devices at close- Stray current surveys on a
inspection of equipment interval grid locations, UT regular basis b. Close
that is only partially B-scan, automated Interval Survey (at
buried using an NDE ultrasonic scanning, excavationsites) to assess
crawler with guided-wave UT global the performance of the CP
circumferential search, crawler with system locally c. Sample
inspection technology circumferential inspection soil and water resistivity
(MFL, lambwave UT) technology such as MFL or and chemistry
lambwave UT, digital measurements along
radiography in more than entire structure
one direction)
B Usually Internal inspection via Excavation at “Selected” a. CP System maintained
Effective pigging and in-line locations, 100% external and managed by NACE
inspection technologies visual, and 100% certified personnel and
(UT, MFL, internal rotary inspection with NDE complying with NACE
UT, etc.) of selected technologies (UT thickness SP0169 – includes Stray
areas / sections, measurement such as current surveys on a
combined with statistical handheld devices at close- regular basis
analysis or extreme interval grid locations, UT b. Close Interval Survey
value analysis (EVA). B-scan, automated (at excavation sites) to
External inspection of ultrasonic scanning, assess the performance of
equipment that is only guided-wave UT global the CP system locally
partially buried using an search, crawler with
c. Sample soil and water
NDE crawler with circumferential inspection
resistivity and chemistry
circumferential technology such as MFL or
inspection technology lambwave UT, digital measurements along
entire structure
(MFL, lambwave UT) on radiography in more than
selected areas / sections, one direction) d. DC Voltage Gradient
combined with statistical (DCVG) to determine
analysis or extreme coating damage
value analysis (EVA).
C Fairly Partly inspection by Partial excavation guided ---
Effective internal smart pig or wave UT global search
specialized crawler inspection in each
device, including a direction of pipe. Corrosion
representative portion of Inspection and
the buried pipe. (<25%) Maintenance managed by
NACE certified and CP
specialist, or equivalent
D Poorly Hydrostatic testing Spot check with ---
Effective conventional NDE
equipment of local areas
exposed by excavation
E Ineffective No inspection --- ---
Table A7: Guidelines for Assigning Inspection Effectiveness – Buried Components.

159
Inspection Inspection Inspection
Category Effectiveness Category

A Highly Effective  Intrusive inspection – good visual inspection with pit depth
gage measurements at suspect locations.
 UT scanning follow up on suspect location and as general
confirmation of wall thickness
B Usually Effective  External spot UT scanning based on visual information from
previous internal inspection of this tank or similar service
tanks.
 Internal video survey with external UT follow-up.
C Fairly Effective Eternal spot UT scanning based at suspect locations without benefit
of any internal inspection information on tank type or service.
D Poorly Effective External spot UT based at suspect locations without benefit of any
internal inspection information on tank type or service.
E Ineffective No inspection
Table A8: Guidelines for Assigning Inspection Effectiveness – Tank Shell Course Internal.

160
Inspection Inspection Inspection
Category Effectiveness Category
A Highly Effective · Insulated– >95% external visual inspection prior to removal of
insulation
· Remove >90% of insulation at suspect locations, OR >90% pulse
eddy current inspection.
· Visual inspection of the exposed surface area with follow-up by
UT or pit gauge as required.
· Non-Insulated- >95% visual inspection of the exposed surface
area with follow-up by UT or pit gauge as required.
B Usually Effective · Insulated– >95% external visual inspection prior to removal of
insulation
· Remove >30% of insulation at suspect locations, OR >30% pulse
eddy current inspection.
· Visual inspection of the exposed surface area with follow-up by
UT or pit gauge as required.
· Non-Insulated- >50% visual inspection of the exposed surface
area with follow-up by UT or pit gauge as required.
C Fairly Effective · Insulated– >95% external visual inspection prior to removal of
insulation
· Remove >10% of insulation at suspect locations, OR >10% pulse
eddy current inspection.
· Visual inspection of the exposed surface area with follow-up by
UT or pit gauge as required.
· Non-Insulated- >25% visual inspection of the exposed surface
area with follow-up by UT or pit gauge as required.
D Poorly Effective · Insulated– >95% external visual inspection prior to removal of
insulation
· Remove >5% of insulation at suspect locations, OR >5% pulse
eddy current inspection.
· Visual inspection of the exposed surface area with follow-up by
UT or pit gauge as required.
· Non-Insulated- >10% visual inspection of the exposed surface
area with follow-up by UT or pit gauge as required.
E Ineffective · Insulated– No visual inspection of insulation surface area or
removal of insulation.
· Non-Insulated- <5% visual of the exposed surface area
Table A9: Guidelines for Assigning Inspection Effectiveness – Tank Shell Course External.

161
Inspection Inspection Soil Side Non-intrusive Inspection
Category Effectiveness Category Example

A Highly Effective a.Floor scan 90+% & UT a. Commercial blast

follow up b. Effective supplementary
b. Include welds if warranted light
from the results on the plate c. Visual 100% (API 653)
scanning
d. Pit depth gauge
c. Hand scan of the critical
e. 100% vacuum box testing of
zone
suspect welded joints

Coating or Liner:
a. Sponge test 100%
b. Adhesion test
c. Scrape test
B Usually Effective a. Floor scan 50+% & UT a. Brush blast
follow up b. Effective supplementary
OR light
b. EVA or other statistical c. Visual 100% (API 653 [5])
method with Floor scan d. Pit depth gauge
follow-up if warranted by the
result
Coating or Liner:
a. Sponge test >75%
b. Adhesion test
c. Scrape test
C Fairly Effective a. Floor scan 5-10+% plates; a. Broom swept
supplement with scanning b. Effective supplementary
near light
Shell & UT follow-up; Scan c. Visual 100%
circle and X pattern
d. Pit depth gauge
b. Progressively increase if
damage found during
scanning Coating or Liner:
c. Helium/Argon test a. Sponge test 50 – 75%
d. Hammer test b. Adhesion test
e. Cut coupons c. Scrape test
D Poorly Effective a. Spot UT a. Broom swept
b. Flood test b. No effective supplementary
lighting
c. Visual 25-50%

Coating or Liner:
a. Sponge test <50
E Ineffective None none
Table A10: Guidelines for Assigning Inspection Effectiveness – Tank Bottoms.

162
Calculation of the Damage Factor
The following procedure may be used to determine the damage factor for thinning, see Figure
A1. Note that this procedure makes the assumption that the cladding corrodes prior to any
corrosion of the base metal. Where thinning due to external corrosion exists, this procedure
will be conservative.
 STEP 1 Determine the number of inspections, and the corresponding inspection
effectiveness category for all past inspections. Combine the inspections to the highest
effectiveness performed.
 STEP 2 Determine the time in-service, , since the last inspection thickness reading,
.
 STEP 3 Determine the corrosion rate for the base metal, , based on the material of
construction and process environment. Where the component has cladding, a corrosion
rate, , must also be obtained for the cladding.
 STEP 4 Determine the minimum required wall thickness, , per the original
construction code or using API 579 Appendix A. If the component is a tank bottom, then
in accordance with API 653, if the tank does not have a release prevention
barrier and if the tank has a release prevention barrier.
 STEP 5 For clad components, calculate the time or age from the last inspection required
to corrode away the clad material, , using Eq. 1.1:

Eq. 1.1
 STEP 6 Determine the parameter using Eq. 1.2 or Eq. 1.3 based on the and
from STEP 2, from STEP 3, from STEP 4 and the age required to corrode away
the cladding, , if applicable from STEP 5 .

1) For components without cladding, and for components where the cladding is corroded
away at the time of the last inspection (i.e .), use Eq. 1.2

Eq. 1.2

2) For components that have cladding (i.e. ) at the time of the last inspection,
use Eq. 1.3:

Eq. 1.3

163
 STEP 7 Determine the base damage factor for thinning, , using Table A11 or Table
A12, as applicable, based on the number of, and highest effective inspection category from
STEP 1, and the parameter from STEP 6

 STEP 8 Determine the damage factor for thinning, using Eq. 1.4:

Eq. 1.4

The adjustment factors in Eq.1.4 are determined as follows:

1) Adjustment to Damage Factor for On-Line Monitoring, In addition to inspection, on-
line monitoring of corrosion (or key process variables affecting corrosion) is commonly used
in many processes to prevent corrosion failures. The advantage of on-line monitoring is that
changes in corrosion rates as a result of process changes can be detected long before they
would be detected with normal periodic inspections. This earlier detection usually permits
more timely action to be taken that should decrease the probability of failure. Various
methods are employed, ranging from corrosion probes, corrosion coupons, and monitoring
of key process variables. If on-line monitoring is employed, then credit should be given to
reflect higher confidence in the predicted thinning rate. However, these methods have a
varying degree of success depending on the specific thinning mechanism. Using knowledge
of the thinning mechanism and the type of on-line monitoring, determine the on-line
monitoring factor from Table A12. If more than one monitoring method is used, only the
highest monitoring factor should be used (i.e. the factors are not additive). Note that
shall not be applied if .

2) Adjustment for Injection/Mix Points, An injection/mix point is defined as a point

where a chemical (including water) is being added to the main flow stream. A corrosive mix
point is defined as: mixing of vapor and liquid streams where vaporization of the liquid
stream can occur; water is present in either or both streams; or temperature of the mixed
streams is below the water dew point of the combined stream.
3) If a piping circuit contains an injection/mix point, then an adjustment factor equal to
should be used to account for the higher likelihood of thinning activity at this location.
If a highly effective inspection specifically for injection/mix point corrosion within the
injection point circuities performed, then an adjustment is not necessary, or .
4) Adjustment for Deadlegs, - A deadleg is defined as a section of piping or piping circuit
that is used only during intermittent service such as start-ups, shutdowns, or regeneration
cycles rather than continuous service. Deadlegs include components of piping that normally
have no significant flow. If a piping circuit contains a deadleg, then an adjustment should be
made to the thinning damage factor to account for the higher likelihood of thinning activity
at this location. The adjustment factor is . If a highly effective inspection method is
used to address the potential of localized corrosion in the deadleg, then an adjustment is not
necessary, or .

164
5) Adjustment for Welded Construction, Applicable only to atmospheric storage tanks.
If the component is welded (i.e. not riveted), then otherwise .
6) Adjustment for Maintenance in Accordance with API 653, Applicable only to
atmospheric storage tanks. If the tank is maintained in accordance with API 653, then
; otherwise, .
7) Adjustment for Settlement, Applicable only to atmospheric storage tank bottoms. It
is determined based on the following criteria:
 Recorded settlement exceeds API 653 criteria
 Recorded settlement meets API 653 criteria
 Settlement never evaluated

 Concrete foundation, no settlement .

165
 Inspection Effectiveness

Art E D
Inspection
C B A D
2 Inspections
C B A D
3 Inspections
C B A
0.02 1 1 1 1 1 1 1 1 1 1 1 1 1
0.04 1 1 1 1 1 1 1 1 1 1 1 1 1
0.06 1 1 1 1 1 1 1 1 1 1 1 1 1
0.08 1 1 1 1 1 1 1 1 1 1 1 1 1
0.10 2 2 1 1 1 1 1 1 1 1 1 1 1
0.12 6 5 3 2 1 4 2 1 1 3 1 1 1
0.14 20 17 10 6 1 13 6 1 1 10 3 1 1
0.18 250 200 130 70 7 170 70 10 1 130 35 3 1
0.20 400 300 210 110 15 290 120 20 1 260 60 5 1
0.25 520 450 290 150 20 350 170 30 2 240 80 6 1
0.30 650 550 400 200 30 400 200 40 4 320 110 9 2
0.35 750 650 550 300 80 600 300 80 10 540 150 20 5
0.40 900 800 700 400 130 700 400 120 30 600 200 50 10
0.50 1,200 1,100 970 600 270 1,000 600 200 60 900 360 80 40
0.55 1,350 1,200 1,130 700 350 1,100 750 300 100 1,000 500 130 90
0.60 1,500 1,400 1,250 850 500 1,300 900 400 230 1,200 620 250 210
0.65 1,900 1,700 1,400 1,000 700 1,600 1,105 670 530 1,300 880 550 500
Inspection Effectiveness

Art 4 Inspections 5 Inspections 6 Inspections

E D C B A D C B A D C B A
0.02 1 1 1 1 1 1 1 1 1 1 1 1 1
0.04 1 1 1 1 1 1 1 1 1 1 1 1 1
0.06 1 1 1 1 1 1 1 1 1 1 1 1 1
0.08 1 1 1 1 1 1 1 1 1 1 1 1 1
0.10 2 1 1 1 1 1 1 1 1 1 1 1 1
0.12 6 2 1 1 1 2 1 1 1 1 1 1 1
0.14 20 7 2 1 1 5 1 1 1 4 1 1 1
0.16 90 30 5 1 1 20 2 1 1 14 1 1 1
0.18 250 100 15 1 1 70 7 1 1 50 3 1 1
0.20 400 180 20 2 1 120 10 1 1 100 6 1 1
0.25 520 200 30 2 1 150 15 2 1 120 7 1 1
0.30 650 240 50 4 2 180 25 3 2 150 10 2 2
0.35 750 440 90 10 4 350 70 6 4 280 40 5 4
0.40 900 500 140 20 8 400 110 10 8 350 90 9 8
0.45 1,050 600 200 30 15 500 160 20 15 400 130 20 15
0.50 1,200 800 270 50 40 700 210 40 40 600 180 40 40
0.55 1,350 900 350 100 90 800 260 90 90 700 240 90 90
0.60 1,500 1,000 450 220 210 900 360 210 210 800 300 210 210
0.65 1,900 1,200 700 530 500 1,100 640 500 500 1,000 600 500 500
Table A11: Thinning Damage Factors.

166
 Inspection Effectiveness

Art E D C
Inspection
B A
0.05 4 1 1 1 1
0.10 14 3 1 1 1
0.15 32 8 2 1 1
0.20 56 18 6 2 1
0.25 87 32 11 4 3
0.30 125 53 21 9 6
0.35 170 80 36 16 12
0.40 222 115 57 29 21
0.45 281 158 86 47 36
0.50 347 211 124 73 58
0.55 420 273 173 109 89
0.60 500 346 234 158 133
0.65 587 430 309 222 190
0.70 681 527 401 305 270
0.75 782 635 510 409 370
0.80 890 757 638 538 498
0.85 1,005 893 789 696 658
0.90 1,226 1,044 963 888 856
0.95 1,255 1,209 1,163 1,118 1,098
1.00 1,390 1,390 1,390 1,390 1,390
Table A12: Thinning Damage Factors for Tank Bottoms.

167
 Thinning Mechanism Adjustment Factors as a Function of On-Line Monitoring,Fom
Key Process Electrical Corrosion
Variable Resistance Probes Coupons
(See Note 3) (See Note 3)
Hydrochloric Acid (HCI) Corrosion 10 10 2
(20 if in conjunction
with Probes)
High Temperature Sulfidic/Naphthenic 10 10 2
Acid Corrosion
High Temperature H2S/H2 1 10 1
Corrosion

Sulfuric Acid (H2S/H2) Corrosion

Low Velocity 20 10 2
≤3 ft/s for CS,
≤5 ft/s for SS,
≤7 ft/s for higher alloys
20 10 2
High Velocity 10 10 1
> 3 ft/s for CS, (20 if in conjunction
> 5 ft/s for SS, with Probes)
> 7 ft/s for higher alloys
Hydrofluoric Acid (HF) Corrosion 10 1 1

Sour Water Corrosion

Low Velocity 20 10 2
≤20 ft/s
High Velocity 10 2 2
> 20 ft/s
Amine
Low Velocity 20 10 2
High Velocity 10 10 1
Other Corrosion Mechanism 1 1 1
1. The adjustment factors shown above are estimates providing a measure of the relative effectiveness of various on-
line monitoring methods. Factors based on the user’s experience can be used as a substitute for the values presented
in this table.
2. Factors shall not be added unless noted. This table assumes that an organized on-line monitoring plan is in place that
recognizes the potential corrosion mechanism. Key process variables are, for example, oxygen, pH, water content,
velocity, Fe content, temperature, pressure, H2S content, CN levels, etc. The applicable variable(s) should be monitored
at an appropriate interval, as determined by a knowledgeable specialist. For example: coupons may be monitored
quarterly while pH, chlorides, etc. may be monitored weekly.
3. The effectiveness of other on-line corrosion monitoring methods (e.g. Hydrogen flux, FSM, LP probe) shall be
evaluated by a corrosion engineer or other knowledgeable specialist.
Table A13: On-Line Monitoring Adjustment Factors

168
Nomenclature

age is the time since the last thickness reading

agerc is the time required or age from the last inspection date when the cladding is corroded away
Art is the damage factor parameter
Cr is the corrosion rate
Cr ,bm is the corrosion rate for the base metal
Cr ,cm is the corrosion rate for the cladding
CA is the corrosion allowance
is the damage factor for thinning
is the base value of the damage factor for thinning

FAM is the damage factor adjustment for tank maintenance per API 653
FDL is the damage factor adjustment for dead legs
FIP is the damage factor adjustment for injection points
FOM is the damage factor adjustment for online monitoring
FSM is the damage factor adjustment for settlement
FWD is the damage factor adjustment for welded construction
tmin is the minimum required wall thickness based on the applicable construction code
t is the furnished thickness of the component base metal
trc is the remaining thickness of the cladding
trd is the thickness reading

169
17.2. Appendix II: API 581:2008 Component Lining Damage Factor
Scope
A general approach for computing the damage factor for a component that has a protective
internal lining is covered in this paragraph. It is common practice to construct a component
with a material that is known to be subject to damage in the operating environment, but to
protect the material from the environment with a lining that is resistant as described in Table
A14. The lining types covered in this paragraph are shown in Table A15. A general approach
to using API RBI for lined component involves assessing the severity of damage that would
be expected to occur on the base material, and then give credit for the existence of a
lining. The degradation rate of the lining itself is not addressed. Evaluations of lining
effectiveness at preventing damage are based on expert opinion.

Lining Series ID Environment (Damage Mechanisms of Example Lining

Base Metal)
Alloy Linings Corrosive (Thinning) Strip Lined Alloy
Organic Coatings Corrosive (Thinning) Organic Coating or Lining
Refractory High Temperature (Thinning, Creep, Erosion) Castable Refractory
Plastic Refractory
Refractory Brick
Ceramic Fiber Refractory
Refractory/Alloy Combination
Glass Lined Corrosive (Thinning) Glass Lined
Acid Brick Corrosive (Thinning) Brick / Mortar
Table A14: Typical Examples of Protective Internal Linings.

Description Resistance
Strip Lined Alloy Typically subject to failure at seams.
(“Wall papered”)
Organic Coating, typically > 0.762 mm (30 mils) dry film Limited life.
thickness.
Thermal Resistance Service: Subject to occasional spilling or
Castable Refractory collapse.
Plastic Refractory
Refractory Brick
Severe/abrasive service: Limited life in highly abrasive service.
Castable Refractory
Ceramic Tile
Glass linings Complete protection, subject to failure
due to thermal or mechanical shock.
Acid Brick Partial protection. The brick provides
thermal protection, but is not intended
to keep the fluid away from the base
metal.
Table A15: Lining Types and Resistance.

170
Screening Criteria
If the component has an inorganic or organic lining, then the component should be evaluated
for lining damage.

Required Data
The required data to determine the lining damage factor is shown in Table A1 and Table A16.

Required Data Comments

Type of Lining See Table A17 and Table A18 as applicable
Age of Lining Age of lining, or years since last inspection (i.e. since last thorough
(years) visual inspection or other appropriate method)
Lining Condition Condition of lining based on Table A19
On-Line Monitoring for Lining On-line monitoring, see paragraph 6.5.2. of API 581:2008
Failure
Damage factor Thinning damage factor determined as in paragraph 5.0 of API
581:2008
Table A16: Data Required for Determination of the Lining Damage Factor.

Basic Assumptions
All linings afford some degree of protection from the operating environment. Many linings
will last for an indefinite period of time, essentially being immune to damage mechanisms
that may otherwise occur. Other linings will slowly degrade with time, and have a finite life.
In such cases, the age of the lining (or the years since the last inspection) becomes important
in assigning a factor. Particularly in the case of organic linings, the assumption is made that
the lining is compatible with the environment, operated within design temperature limits
(including steam out), and properly applied with appropriate curing.

Determination of the Damage Factor:

Overview
A flow chart of the steps required to determine the damage factor for linings is shown in
Figure A2. The following paragraphs provide additional information and the calculation
procedure. The basic approach is that the type of lining and the age or years since last
inspection determines a lining failure factor. This is adjusted for a qualitative description of
the lining condition. It is further adjusted based on the probability of component failure upon
lining failure (i.e. if the lining fails, does the component fail rapidly, or will it be expected to
last for a considerable time?). A final credit is made for on-line monitoring that can provide
early detection of a lining failure.
After a lining damage factor is computed, it is then compared to the thinning damage factor
determined for the base metal. The minimum of the two values is used. The basis for this is
that if the thinning damage is small compared to the lining damage factor, then it does not yet
matter if the lining has failed or not. This also provides a check that lining failure is not
necessarily equated with a component.

171
 Figure A2: Determination of the Lining Damage Factor.

Calculation of the Damage Factor

The following procedure may be used to determine the damage factor for lining damage, see
Figure A2:
 STEP 1 Determine the lining type and time in-service , of the lining
 STEP 2 Determine the base value of the lining damage factor , using Table A17 and
Table A18, as applicable, based on the age and lining type from STEP 1
 STEP 3 Determine the damage factor for lining damage , is determined using Eq.
2.1 below:

Eq. 2.1
The adjustment factors in Eq. 2.1 are determined as described below:
1. Adjustment for Lining Condition, The adjustment factors are given in Table A19
based on a qualitative assessment of the lining condition.
2. Adjustment for On-Line Monitoring, Some lined components have monitoring to
allow early detection of a leak or other failure of the lining. The monitoring allows orderly
shutdown of the component before failure occurs. If on-line monitoring is used, and it is
known to be effective at detecting lining deterioration, ; otherwise .
Examples of monitoring systems include thermography or heat sensitive paint
172
 (refractory linings), weep holes with detection devices (loose alloy linings), and electrical
resistance detection (glass linings).

Years Since Last Damage Factor as a Function of Inorganic Lining Type

Thorough Visual
Inspection Strip Lined Alloy Castable Castable Glass Acid Fiberglass
(Resistant) Refractory Refractory Lined Brick
Severe
Conditions
1 0.3 0.5 9 3 0 1
2 0.5 1 40 4 0 1
3 0.7 2 146 6 0 1
4 1 4 428 7 0 1
5 1 9 1,017 9 1 1
6 2 16 1,978 11 1 1
7 3 30 3,000 13 1 2
8 4 53 3,000 16 1 3
9 6 89 3,000 20 2 7
10 9 146 3,000 25 3 13
11 12 230 3,000 30 4 26
12 16 351 3,000 36 5 47
13 22 518 3,000 44 7 82
14 30 738 3,000 53 9 139
15 40 1,017 3,000 63 11 228
16 53 1,358 3,000 75 15 359
17 69 1,758 3,000 89 19 548
18 89 2,209 3,000 105 25 808
19 115 2,697 3,000 146 40 1,587
20 146 3,000 3,000 146 40 1,587
21 184 3,000 3,000 170 50 2,119
22 230 3,000 3,000 199 63 2,743
23 286 3,000 3,000 230 78 3,000
24 351 3,000 3,000 266 97 3,000
25 428 3,000 3,000 306 119 3,000
Table A17: Lining Damage Factors – Inorganic Linings.

173
Years in Service Damage Factor as a Function of Time Since the Last Inspection
Inspected More Than 6 Inspected Within Last 6 Inspected Within Last 3
years ago years years
1 30 1 0
2 89 4 0
3 230 16 0
4 518 53 0
5 1,017 146 0.2
6 1,758 351 1
7 2,697 738 4
8 3,000 1,358 16
9 3,000 2,209 53
10 3,000 3,000 146
11 3,000 3,000 351
12 3,000 3,000 738
13 3,000 3,000 1,358
14 3,000 3,000 2,209
15 3,000 3,000 3,000
16 3,000 3,000 3,000
17 3,000 3,000 3,000
18 3,000 3,000 3,000
19 3,000 3,000 3,000
20 3,000 3,000 3,000
21 3,000 3,000 3,000
22 3,000 3,000 3,000
23 3,000 3,000 3,000
24 3,000 3,000 3,000
25 3,000 3,000 3,000
Table A18: Lining Damage Factors – Organic Linings.

Qualitative Description Adjustment Multiplier

Condition Flc
Poor The lining has either had previous failures or exhibits 10
conditions that may lead to failure in the near future. Repairs
to previous failures are not successful or are of poor quality.
Average The lining is not showing signs of excessive attack by any 2
damage mechanisms. Local repairs may have been
performed, but they are of good quality and have successfully
corrected the lining condition.
Good The lining is in “like new” condition with no signs of attack by 1
any damage mechanisms. There has been no need for any
repairs to the lining.
Table A19: Lining Condition Adjustment.

174
Nomenclature
is the time since the last thickness reading

is the damage factor for liners

is the base value of the damage factor for liners

is the damage factor adjustment for lining condition

is the damage factor adjustment for online monitoring

175
17.3. Appendix III: API 581:2008 External Corrosion Damage Factor -
Ferritic Component
Scope
The damage factor calculation for ferritic components subject to external corrosion is
covered in this paragraph.

Description of Damage
The damage factor calculation for ferritic components subject to external corrosion is
covered in this paragraph.
As a general rule, plants located in areas with high annual rainfalls or warmer, marine
locations are more prone to external corrosion than plants located in cooler, drier, mid-
continent locations. Regardless of the climate, units located near cooling towers and steam
vents are highly susceptible to external corrosion, as are units whose operating temperatures
cycle through the dew point on a regular basis. Mitigation of external corrosion is
accomplished through proper painting. A regular program of inspection for paint
deterioration and repainting will prevent most occurrences of external corrosion.

Screening Criteria
If the component is uninsulated and subject to any of the following, then the component
should be evaluated for external damage from corrosion.
1. Areas exposed to mist overspray from cooling towers.
2. Areas exposed to steam vents.
3. Areas exposed to deluge systems.
4. Areas subject to process spills, ingress of moisture, or acid vapors.
5. Carbon steel systems, operating between –23°C and 121°C (–10°F and 250°F). External
corrosion is particularly aggressive where operating temperatures cause frequent or
continuous condensation and reevaporation of atmospheric moisture.
6. Systems that do not normally operate between -12°C and 177°C (10°F and 350°F) but
cool or heat into this range intermittently or are subjected to frequent outages.
7. Systems with deteriorated coating and/or wrappings.
8. Cold service equipment consistently operating below the atmospheric dew point.
9. Uninsulated nozzles or other protrusions components of insulated equipment in cold
service conditions.

176
Required Data
The basic component data required for analysis is given in Table A1 and the specific data
required for determination of the damage factor for external corrosion is provided in Table
A20:

Required Data Comments

Driver The drivers for external corrosion. This can be the weather at a location
(e.g. Marine), the potential for cooling tower drift, the use of sprinkler
systems, or other contributors.
Corrosion Rate Corrosion rate for external corrosion. Based on Temperature, and
(mm/yr:mpy) Driver (see below), or user input.
Coating Installation Date The date the coating was installed.
Coating Quality Relates to the type of coating applied, for example:
None – No coating or primer only
Medium – Single coat epoxy
High – Multi coat epoxy or filled epoxy
Pipe Support Penalty (Yes/No) If piping is supported directly on beams or other such configuration that
does not allow for proper coating maintenance, external corrosion can be
more severe.
Interface Penalty (Yes/No) If the piping has an interface where it enters either soil or water, this area
is subject to increased corrosion.
Inspection Effectiveness The effectiveness category that has been performed on the component.
Category
Number of Inspections The number of inspections in each effectiveness category that have been
performed.
Table A20: Data Required for Determination of the Damage Factor – External Corrosion.

Basic Assumption
The damage factor for external corrosion is based on the method for general thinning.

Determination of the Damage Factor

Overview
A flow chart of the steps required to determine the damage factor for external corrosion is
shown in Figure A3. The following paragraphs provide additional information and the
calculation procedure.

177
 Figure A3: Determination of the External Corrosion Damage Factor

Inspection Effectiveness
Inspections are ranked according to their expected effectiveness at detecting external
corrosion and correctly predicting the rate of damage. Examples of inspection activities for
external corrosion are provided in Table A21.
The effectiveness of each inspection performed within the designated time period must be
characterized in accordance with Table A21. The number and category of the highest effective
inspection will be used to determine the damage factor. If multiple inspections of a lower
effectiveness have been conducted during the designated time period, they can be equated to
an equivalent higher effectiveness inspection.

178
 Inspection Inspection Inspection
Category Effectiveness
A Highly effective Visual inspection of >95% of the exposed surface area with follow-up by
UT, RT or pit gauge as required.
B Usually effective Visual inspection of >60% of the exposed surface area with follow-up by
UT, RT or pit gauge as required.
C Fairly effective Visual inspection of >30% of the exposed surface area with follow-up by
UT, RT or pit gauge as required.
D Poorly effective Visual inspection of >5% of the exposed surface area with follow-up by
UT, RT or pit gauge as required.
E Ineffective Visual inspection of <5% of the exposed surface area with follow-up by
UT, RT or pit gauge as required.
Table A21: Guidelines for assigning Inspection effectiveness – External Corrosion.

Calculation of the Damage Factor

The following procedure may be used to determine the damage factor for external corrosion,
see Figure A3.
 STEP 1 – Determine the number of inspections, and the corresponding inspection
effectiveness category for all past inspections. Combine the inspections to the highest
effectiveness performed
 STEP 2 – Determine the time in-service, agetk, since the last inspection thickness reading
trd, taken either externally or internally
 STEP 3 – Determine the in-service time, agecoat, since the coating has been determined to
be ineffective using Eq. 3.1:

Eq. 3.1

The parameter Date is determined based on the coating quality using Eq.3.2 through Eq.3.4.

Date = Component Installation Date (No Coating or Poor Coating Quality)

Eq. 3.2

Date = Coating Installation Date + 5 years (Medium Coating Quality)

Eq. 3.3

Date = Coating Installation Date +15 years (High Coating Quality)

Eq. 3.4

179
 STEP 4 – Determine the in-service time, age , over which external corrosion may have
occurred using Eq. 3.5:

Eq. 3.5
 STEP 5 – Determine the base corrosion rate, CrB , based on the driver and operating
temperature using Table A22

Corrosion Rate as a Function of Driver (1) (mpy)

Operating Marine / Cooling Temperate Arid / Dry Severe
temperature (°F) Tower Drift Area
10 0 0 0 0
18 1 0 0 3
43 5 3 1 10
90 5 3 1 10
160 5 2 1 10
225 1 0 0 2
250 0 0 0 0
Note:
1. Driver is defined as the atmospheric condition causing the corrosion rate.
2. Interpolation may be used for intermediate values of temperature.
Table A22: Corrosion Rates for Calculation of the Damage Factor - External Corrosion.

 STEP 6 – Compute the final corrosion rate using Eq. 3.6:

Eq. 3.6

The adjustment factors are determined as follows:

1. Adjustment for Pipe Supports, FPS – If piping is supported directly on beams or other
such configuration that does not allow for proper coating maintenance, then FPS = 2;
otherwise, FPS = 1
2. Adjustment for Interface, FIP – If the piping has an interface where it enters either soil
or water, then FIP = 2, otherwise, FIP = 1.

 STEP 7 – Determine the minimum required wall thickness, tmin, per the original
construction code or using API 579, Appendix A

 STEP 8 – Determine the parameter using Eq. 3.7, based on the age from STEP 4, the
, from STEP 2, from STEP 6, and the tmin from STEP 7.

180
Nomenclature
is the damage factor parameter

is the in-service time

is the in-service time since the coating has been determined to be ineffective
is the in-service time since the last internal or external inspection measurement was taken

is the corrosion rate

is the base value of the corrosion rate

is the corrosion allowance

is the damage factor for external corrosion

is the corrosion rate adjustment factor for interface for soil and water

is the corrosion rate adjustment factor for pipe supports

is the minimum required wall thickness based on the applicable construction code

is the thickness reading

181
17.4. Appendix IV: API 581:2008 HTHA Damage Factor
Scope
The damage factor calculation for carbon steel, C-0.5Mo, and Cr-Mo alloys components
subject to High Temperature Hydrogen Attack (HTHA) is covered in this paragraph.

Description of Damage
High Temperature Hydrogen Attack (HTHA) occurs in carbon and low alloy steels exposed to
a high partial pressure of hydrogen at elevated temperatures. It is the result of atomic
hydrogen diffusing through the steel and reacting with carbides in the microstructure. There
are two reactions associated with HTHA. First the hydrogen molecule H2 must dissociate to
form atomic hydrogen, H, which can diffuse through steel.
(hydrogen dissociation)
eq.4.1

The reaction to form atomic hydrogen occurs more readily at higher temperatures and higher
hydrogen partial pressures. As a result, as both the temperature and hydrogen partial
pressure are increased, the driving force for HTHA increases. The second reaction that occurs
is between atomic hydrogen and the metal carbides.

eq.4.2

Damage due to the HTHA can possess two forms, internal decarburization and fissuring from
the accumulation of methane gas at the carbide matrix interface and surface decarburization
from the reaction of the atomic hydrogen with carbides at or near the surface where the
methane gas can escape without causing fissures. Internal fissuring is more typically
observed in carbon steel, C-0.5Mo steels and in Cr-Mo steels at higher hydrogen partial
pressures, while surface decarburization is more commonly observed in Cr-Mo steels at
higher temperatures and lower hydrogen partial pressures. HTHA can be mitigated by
increasing the alloy content of the steel and, thereby, increasing the stability of the carbides
in the presence of hydrogen. As a result, carbon steel that only contains Fe3C carbides has
significantly less HTHA resistance than any of the Cr-Mo steels that contain Cr and Mo
carbides that are more stable and resistant to HTHA.
Historically, HTHA resistance has been predicted based on industry experience which has
been plotted on a series of curves for carbon and low alloy steels showing the temperature
and hydrogen partial pressure regime in which these steels have been successfully used
without damage due to HTHA. These curves, which are commonly referred to as the Nelson
curves, are maintained based on industry experience in API RP 941.

182
Screening Criteria
If all of the following are true, then the component should be evaluated for susceptibility to
HTHA.
 The material is carbon steel, C-0.5Mo, or a Cr-Mo low alloy steel
 The operating temperature is greater than 204°C [400°F] and the operating hydrogen
partial pressure is greater than 0.552 MPa [80 psia].

Required Data
The basic component data required for analysis is given in Table A1 and the specific data
required for determination of the damage factor for HTHA is provided in Table A23.

Required Data Comments

Heat Treatment Condition Determine whether C-0.5Mo steel heat treatment was annealed or normalized. C-
of C-0.5Mo 0.5Mo in the annealed condition can have HTHA resistance no better than carbon
steel. Default is annealed condition.
Hydrogen Partial Pressure, Determine the hydrogen partial pressure, which is equal to mole fraction of
MPa [psia] hydrogen times the total pressure (absolute).
Temperature, °C [°F] Determine the temperature of exposure.
Age, hours Determine time of exposure in hours.
Inspection Effectiveness The effectiveness category that has been performed on the component.
Category
Number of Inspections The number of inspections in each effectiveness category that have been
performed.
Table A23: Data Required for Determination of the Damage Factor – HTHA.

Basic Assumption
The assessment of susceptibility to HTHA is based on the time the component has been
exposed to high pressure hydrogen at elevated temperatures. A single parameter Pv , has been
developed to relate time at temperature and a hydrogen partial pressure. This parameter is
given by following equations:

(MPa: oC)
Eq. 4.3

(psia: oF)
Eq. 4.4

183
The variables in the equations and the associated units are defined in Table A23 This
parameter can be used to define the susceptibility of a material to damage from HTHA. In the
technical basis of this paragraph, the susceptibility to damage from HTHA is based on 200,000
hours of service at a given combination of temperature and hydrogen partial pressure. If
HTHA is detected in the component during an inspection, a Fitness-For-Service assessment
should be performed in accordance with API 579.

Determination of the Damage Factor:

Overview
A flow chart of the steps required to determine the damage factor for HTHA is shown in Figure
A4. The following paragraphs provide additional information and the calculation procedure.

Figure A4: Determination of the HTHA Damage Factor (API 581:2008).

184
Inspection Effectiveness
Inspections are ranked according to their expected effectiveness at detecting HTHA and
correctly predicting the rate of damage. Examples of inspection activities for detection of
HTHA are provided in Table A24. The effectiveness of each inspection performed within the
designated time period must be characterized in accordance with Table A24. The number and
category of the highest effective inspection will be used to determine the damage factor. If
multiple inspections of a lower effectiveness have been conducted during the designated time
period, they can be equated to an equivalent higher effectiveness inspection.
For HTHA, damage factors are only provided for two inspections. If more than two
inspections are performed that conform to Table A24, then the damage factor for two
inspections shall be used.

Inspection Inspection,
Inspection
Category Effectiveness, Category
A Highly Effective Inspection techniques for HTHA are not available to qualify for a
category A inspection
B Usually Effective Extensive Advanced Ultrasonic Backscatter Technique (AUBT),
spot AUBT based on stress analysis or extensive in-
situ metallography.
C Fairly Effective Spot AUBT or spot in-situ metallography.
D Poorly Effective Ultrasonic backscatter plus attenuation
E Ineffective Attenuation only
Table A24: Guidelines for Assigning Inspection Effectiveness – HTHA.

Calculation of the Damage Factor

The following procedure may be used to determine the damage factor for HTHA:

 STEP 1 – If the temperature is less than or equal to 204°C [400°F] or the hydrogen partial
pressure is less than or equal to 0.552 MPa [80 psia], the component is not susceptible to
HTHA, proceed to STEP 6 to determine the damage factor
 STEP 2 – Determine the number of inspections, and the corresponding inspection
effectiveness category for all past inspections
 STEP 3 – Determine the material of construction, exposure time, age , exposure
temperature, T , and the exposure hydrogen partial pressure, PH2
 STEP 4 – Compute the Pv factor
 STEP 5 – Determine the susceptibility using Table A25 based on the value of from STEP 4
and the material of construction from STEP 3
 STEP 6 – Determine the damage factor for HTHA, , using Table A26 based on the
susceptibility from STEP 5. Note that if an inspection indicates the presence of HTHA, then
the Damaged Observed category in Table A26 shall be used regardless of the number and
type of inspection.

185
 Critical PV Factors as a Function of Susceptibility
Materials High Medium Low
Susceptibility Susceptibility Susceptibility Not Susceptible
Carbon Steel Pv > 4.70 4.61 < Pv ≤ 4.70 4.53 < Pv ≤ 4.61 Pv ≤ 4.53
C-0.5Mo (1) (Annealed) Pv > 4.95 4.87 < Pv ≤ 4.95 4.78 < Pv ≤ 4.87 Pv ≤ 4.78
C-0.5Mo (1) (Normalized) Pv > 5.60 5.51 < Pv ≤ 5.60 5.43 < Pv ≤ 5.51 Pv ≤ 5.43
1 Cr-0.5Mo (2) Pv > 5.80 5.71 < Pv ≤ 5.80 5.63 < Pv ≤ 5.71 Pv ≤ 5.63
1.25Cr-0.5Mo (3) Pv > 6.00 5.92 < Pv ≤ 6.00 5.83 < Pv ≤ 5.92 Pv ≤ 5.83
2.25Cr-1Mo Pv > 6.53 6.45 < Pv ≤ 6.53 6.36 < Pv ≤ 6.45 Pv ≤ 6.36
Notes:
1. Annealed material should be used unless a normalized heat treatment can be confirmed.
2. If the hydrogen partial pressure is greater than 8.274 MPa (1200 psia), then use the critical P factors for
1.25Cr-0.5 Mo.
3. A debit has not been applied for steels with high levels of tramp elements such as As, Sb, Sn, and P. If a high
level of tramp elements is suspected, then the critical factors should be reduced. The critical PV factor can
be as much as 0.25 lower for heats of steels with high levels of tramp elements.
Table A25: Carbon and Low Alloy Steel Susceptibility to HTHA.

No First Inspection Second Inspection Effectiveness

Effectiveness
Susceptibility Inspection D C B D C B
Damage Observed --- 2000 2000 2000 2000 2000 2000
(2)
High Susceptibility 2000 1800 1200 800 1600 800 400
Medium 200 180 120 80 160 80 40
Susceptibility
Low Susceptibility 20 18 12 8 16 8 4
Not Susceptible 1 1 1 1 1 1 1
Notes:
1. The HTHA damage factor has been provided for only two inspections. For a greater number of inspections,
the damage factor remains constant.
2. The category shall be used if HTHA is detected during an inspection
Table A26: Damage Factor - HTHA.

Nomenclature
age is the in-service time, hours

is the damage factor for HTHA

PH2 is the hydrogen partial pressure, MPa [psia]
Pv is the factor Pv
T is the temperature, °C [°F]

186
17.5. Appendix V: API 581:2008 Brittle Fracture Damage Factor
Scope
The damage factor calculation for ferritic components subject to brittle fracture due to low-
temperature operation is covered in this paragraph.

Description of Damage
Brittle fracture due to low temperature operating or low toughness is the sudden failure of a
structural component, usually initiated at a crack or defect. This is an unusual occurrence,
because design stresses are normally low enough to prevent such an occurrence. However,
some older equipment with thick walls, equipment that might see low temperatures due to
an upset, or equipment that has been modified could be susceptible to varying degrees. Low
temperature/low toughness fracture of steel is affected by:
 The applied loads. Brittle fracture is less likely at low applied loads
 The material specification. Some materials are manufactured to have good fracture
properties or toughness properties. Materials are often “qualified” for use by performing
an impact test. This test measures the energy needed to break a notched specimen
 Temperature. Many materials (especially ferritic steels) become brittle below some
temperature called the transition temperature. Brittle fracture is typically not a concern
above 149°C [300°F]
 Residual stresses and post-weld heat treatment.
 Thickness

The goal of the low temperature/low toughness fracture assessment is to rank components
with respect to their relative probability of failure with respect to fracture. This assessment
will take into account the thickness, the material type, the post-weld heat treatment, and
temperatures.

Screening Criteria
If all of the following are true, then the component should be evaluated for susceptibility to
brittle fracture.
 The material is carbon steel or a low alloy steel, see Table 27.
 The Minimum Design Metal Temperature (MDMT) is unknown, or the MDMT is known
but the component may operate at below the MDMT under normal or upset conditions.

Required Data
The basic component data required for analysis is given in Table A1 and the specific data
required for determination of the damage factor for brittle fracture is provided in Table A28.

187
Curve Material (1), (2), (6)
A 1. All carbon and all low alloy steel plates, structural shapes and bars not listed in Curves B, C and
D below.
2. SA-216 Grades WCB and WCC if normalized and tempered or water-quenched and tempered;
SA -217 Grade WC6 if normalized and tempered or water-quenched and tempered
3. The following specifications for obsolete materials: A7, A10, A30, A70, A113, A149, A150 (3).
4. The following specifications for obsolete materials from the 1934 edition of the ASME Code,
Section VIII: S1, S2, S25, S26, and S27 (4).
5. A201 and A212 unless it can be established that the steel was produced by a fine-grain practice
(5)
B 1. SA-216 Grade WCA if normalized and tempered or water-quenched and tempered
SA-216 Grades WCB and WCC for thicknesses not exceeding 2 inches if produced to a fine
grain practice and water-quenched and tempered
SA -217 Grade WC9 if normalized and tempered
SA-285 Grades A and B
SA-414 Grade A
SA-442 Grade 55 > 1 in. if not to fine grain practice and normalized
SA-442 Grade 60 if not to fine grain practice and normalized
SA-515 Grades 55 and 60
SA-516 Grades 65 and 70 if not normalized
SA-612 if not normalized
SA-662 Grade B if not normalized
2. Except for cast steels, all materials of Curve A if produced to fine grain practice and normalized
which are not listed for Curve C and D below;
3. All pipe, fittings, forgings, and tubing not listed for Curves C and D below;
4. Parts permitted from paragraph UG-11 of the ASME Code, Section VIII, Division 1, shall be
included in Curve B even when fabricated from plate that otherwise would be assigned to a
different curve.
5. A201 and A212 if it can be established that the steel was produced by a fine-grain practice.
C 1. SA-182 Grades 21 and 22 if normalized and tempered.
SA-302 Grades C and D
SA-336 Grades F21 and F22 if normalized and tempered
SA-387 Grades 21 and 22 if normalized and tempered
SA-442 Grade 55 < 1 in. if not to fine grain practice and normalized
SA-516 Grades 55 and 60 if not normalized
SA-533 Grades B and C
SA-662 Grade A
2. All material of Curve B if produced to fine grain practice and normalized and not listed for
Curve D below
D SA-203
SA-442 if to fine grain practice and normalized
SA-508 Class 1
SA-516 if normalized
SA-524 Classes 1 and 2
SA-537 Classes 1 and 2
SA-612 if normalized
SA-662 if normalized
SA-738 Grade A

188
 Notes:
1. When a material class or grade is not shown, all classes or grades are included.
2. The following apply to all material assignment notes.
a. Cooling rates faster than those obtained in air, followed by tempering, as permitted by the material
specification, are considered equivalent to normalizing and tempering heat treatments.
b. Fine grain practice is defined as the procedures necessary to obtain a fine austenitic grain size as described
in SA-20.
3. The first edition of the API Code for Unfired Pressure Vessels (discontinued in 1956) included these ASTM
carbon steel plate specifications. These specifications were variously designated for structural steel for bridges,
locomotives, and rail cars or for boilers and firebox steel for locomotives and stationary service. ASTM A149
and A150 were applicable to high-tensile-strength carbon steel plates for pressure vessels.
4. The 1934 edition of Section VIII of the ASME Code listed a series of ASME steel specifications, including S1
and S2 for forge welding; S26 and S27 for carbon steel plates; and S25 for open-hearth iron. The titles of some
of these specifications are similar to the ASTM specifications listed in the 1934 edition of the API Code for
Unfired Pressure Vessels.
5. These two steels were replaced in strength grades by the four grades specified in ASTM A 515 and the four
grades specified in ASTM A 516. Steel in accordance with ASTM A 212 was made only in strength grades the
same as Grades 65 and 70 and has accounted for several known brittle failures. Steels in conformance with
ASTM A 201 and A 212 should be assigned to Curve A unless it can be established that the steel was produced
by fine-grain practice, which may have enhanced the toughness properties.
6. No attempt has been made to make a list of obsolete specifications for tubes, pipes, forgings, bars and
castings. Unless specific information to the contrary is available, all of these product forms should be assigned
to Curve A.

Table 27: Assignment of Materials to the Material Temperature Exemption Curves.

Required Data Comments

Administrative Controls for Upset Are there controls and or awareness training to prevent the
Management (Yes/No) coincident occurrence of low temperatures (upset) at or near
design pressures?
Minimum Operating Temperature Can be entered by the user. The temperature may be set to the
under Normal or Upset Conditions? atmospheric boiling point of the fluid in the component if the fluid
is a liquid
Table 28: Data Required for Determination of the Damage Factor Brittle Fracture.

Basic Assumption
Brittle fracture requires the coincident presence of a sufficient size defect, application of
sufficient stress, and a susceptible material. The susceptibility to failure by brittle fracture
can change due to in-service conditions.

Determination of the Damage Factor:

Overview
A flow chart of the steps required to determine the damage factor for brittle fracture is shown
in Figure A5. The following sections provide additional information and the calculation
procedure.

189
 Figure A5: Determination of the brittle fracture damage factor.

Inspection Effectiveness
Low temperature/low toughness fracture is prevented by a combination of appropriate
design and operating procedures. When low temperature/low toughness fracture does occur,
it almost invariably initiates at some pre-existing crack-like defect. From the initiation point,
a crack will grow quickly, resulting in a serious leak or sometimes-complete rupture of the
component. Theoretically, an inspection to locate and remove such preexisting defects would
reduce the probability of failure. However, the initiating defect can be very small, and need
not be exposed to the surface where it could be found. For this reason, inspection for such
defects is generally not considered to be an effective method for prevention of brittle fracture.

190
If existing records of a component do not indicate if it is constructed of normalized plate, then
a metallurgical examination may help resolve this. In some cases, it may be possible to
remove samples of the material large enough for testing to determine the toughness, which
can also improve the accuracy of the prediction of low temperature/low toughness fracture
probability.
For this damage mechanism, credit is not given for inspection. However, the results of
metallurgical testing can be used to update the inputs to the damage factor calculation that
may result in a change in this value.

Calculation of the Damage Factor

The following procedure may be used to determine the damage factor for brittle fracture, see
Figure A5:
 STEP 1 Determine if administrative or process controls exist that will prevent the
component from being fully pressurized below some temperature. If so, use this
temperature for Tmin and go to STEP 3
 STEP 2 Determine the minimum temperature Tmin, that the component may be subjected
to during operation, use the lowest of the following:
o The minimum design temperature
o The minimum temperature as estimated by the process engineer, including upsets
o If the vessel or pipe is filled with a pressurized liquid, the boiling point of the liquid at
atmospheric pressure. For example liquid ammonia has a boiling point of -33.3°C [-
27.94°F] and propane has a boiling point of -42°C [-44°F].
 STEP 3 Determine the reference temperature, Tref, in accordance with API 579
 STEP 4 Determine Tmin and Tref, Tmin is from STEP 1 or STEP 2, as applicable, Tref is from
step 3

 STEP 5 Determine the base damage factor , using Table A29 if the
component has not been subject to PWHT or Table A30 if the component has been subject
to PWHT based on Tmin Tref from STEP 4

 STEP 6 Determine the damage factor

Eq. 5

The adjustment factor for service experience FSE, is determined as follows. If the component
has been exposed for many years to the lowest expected temperature and if the component
is not in fatigue or SCC service, then FSE = 0.01; otherwise FSE = 1. This adjustment is based on
the grandfathering concept permitted in API RP 579, Part 3, Level 2, Method 3.

191
 Tmin - Tref Damage Factor as a Function of Component Thickness
(F) 0.25 0.5 1 1.5 2 2.5 3 3.5 4
100 0 0 0 0 0 0 0.9 1.1 1.2
80 0 0 0 0.8 1.1 2 2 4 6
60 0 0 1 2 4 9 19 36 60
40 0 0.7 2 9 29 69 133 224 338
20 0.1 1.3 10 49 143 296 500 741 1008
0 0.9 3 39 175 424 759 1142 1545 1950
-20 1.2 7 109 405 850 1366 1897 2415 2903
-40 2 16 220 697 1317 1969 2596 3176 3703
-60 2 30 350 988 1740 2479 3160 3769 4310
-80 3 46 474 1239 2080 2873 3581 4203 4746
-100 4 61 579 1436 2336 3160 3883 4509 5000
Table A29: Damage Factor, Component not Subject to PWHT

Tmin - Tref Damage Factor as a Function of Component Thickness

(F) 0.25 0.5 1 1.5 2 2.5 3 3.5 4
100 0 0 0 0 0 0 0 0 0
80 0 0 0 0 0 0 0 0 0.2
60 0 0 0 0 0 0.5 0.9 1.1 1.3
40 0 0 0 0.5 1.1 1.3 2 3 4
20 0 0 0.6 1.2 2 4 7 13 23
0 0 0 1.1 2 6 14 29 53 88
-20 0 0.4 2 5 17 41 83 144 224
-40 0 0.9 3 12 38 90 171 281 416
-60 0 1.1 5 22 68 153 277 436 623
-80 0 1.2 7 34 102 219 382 582 810
-100 0 1.3 9 46 133 277 472 704 962
Table A30: Damage Factor, Component Subject to PWHT

Impact Test Exemption Temperature

Component Exemption Temperature as a Function of ASME Exemption Curve (F)

Thickness (in)
Curve A Curve B Curve C Curve D

0.25 18 -20 -55 -55

0.3125 18 -20 -55 -55

0.375 18 -20 -55 -55

0.4375 24.2 -14 -40.5 -55

0.5 31.6 -6.9 -32.2 -55

0.5625 38.2 -0.6 -27.2 -51

192
0.625 44 5.2 -22.8 -47.5

0.6875 49.2 10.4 -18.7 -44.2

0.75 53.9 15.1 -15 -41.1

0.8125 58.2 19.5 -11.6 -38.1

0.875 62.1 23.5 -8.6 -35.3

0.9375 65.6 27.2 -5.7 -32.7

1 68.9 30.6 -3.1 -30.1

1.0625 71.9 33.8 -0.7 -27.8

1.125 74.6 36.7 1.6 -25.5

1.1875 77.2 39.4 3.7 -23.4

1.25 79.6 42 5.8 -21.4

1.3125 81.8 44.4 7.7 -19.5

1.375 83.8 46.6 9.6 -17.6

1.4375 85.8 48.7 11.4 -15.9

1.5 87.6 50.7 13.1 -14.3

1.5625 89.2 52.5 14.8 -12.7

1.625 90.8 54.3 16.4 -11.2

1.6875 92.3 55.9 17.9 -9.8

1.75 93.7 57.5 19.4 -8.5

1.8125 95.1 58.9 20.9 -7.2

1.875 96.3 60.3 22.3 -5.9

1.9375 97.5 61.7 23.7 -4.7

2 98.6 63 25 -3.6

2.0625 99.7 64.2 26.3 -2.5

2.125 100.7 65.3 27.5 -1.4

2.1875 101.7 66.4 28.7 -0.4

2.25 102.6 67.5 29.9 0.6

2.3125 103.5 68.5 31 1.6

2.375 104.3 69.5 32.1 2.5

2.4375 105.1 70.5 33.2 3.4

2.5 105.8 71.4 34.3 4.3

193
 2.5625 106.5 72.3 35.3 5.2

2.625 107.2 73.2 36.3 6

2.6875 107.9 74 37.2 6.9

2.75 108.5 74.8 38.2 7.7

2.8125 109.1 75.6 39.1 8.5

2.875 109.7 76.4 39.9 9.3

2.9375 110.2 77.2 40.8 10.1

3 110.8 77.9 41.7 10.9

3.0625 111.3 78.7 42.5 11.7

3.125 111.7 79.4 43.3 12.4

3.1875 112.2 80.1 44 13.2

3.25 112.6 80.8 44.8 13.9

3.3125 113.1 81.5 45.5 14.7

3.375 113.5 82.1 46.3 15.4

3.4375 113.9 82.8 47 16.2

3.5 114.2 83.5 47.7 16.9

3.5625 114.6 84.1 48.3 17.6

3.625 114.9 84.8 49 18.3

3.6875 115.3 85.4 49.6 19.1

3.75 115.6 86 50.2 19.8

3.8125 115.9 86.7 50.9 20.5

3.875 116.2 87.3 51.4 21.2

3.9375 116.4 87.9 52 21.9

4 116.7 88.5 52.6 22.5

Table A31: Impact Test Exemption Temperature.

Nomenclature:

is the damage factor for brittle fracture

is the base damage factor for brittle fracture

F SE is the damage factor adjustment for service experience
Tmin is the minimum temperature
Tref is the reference temperature

194
17.6. Appendix VI: API 581:2008 Piping Mechanical Fatigue Damage Factor
Scope
The damage factor calculation for piping components subject to mechanical fatigue is covered
in this paragraph.

Description of Damage
Fatigue failures of piping systems present a very real hazard under certain conditions.
Properly designed and installed piping systems should not be subject to such failures, but
prediction of vibration in piping systems at the design stage is very difficult, especially if there
are mechanical sources of cyclic stresses such as reciprocating pumps and compressors. In
addition, even if a piping systems are not subject to mechanical fatigue in the as-built
condition, changing conditions such as failure of pipe supports, increased vibration from out
of balance machinery, chattering of relief valves during process upsets, changes in flow and
pressure cycles or adding weight to unsupported branch connections (pendulum effect) can
render a piping system susceptible to failure. Awareness of these influences incorporated
into a management of change program can reduce the probability of failures.

Screening Criteria
If all of the following are true, then the component should be evaluated for susceptibility to
mechanical fatigue:
 The component is pipe.
 There have been past fatigue failures in this piping system or there is visible/audible
shaking in this piping system or there is a source of cyclic vibration within approximately
15.24 meters [50 feet] and connected to the piping (directly or indirectly via structure).
Shaking and source of shaking can be continuous or intermittent.

Transient conditions often cause intermittent vibration.

Required Data
The basic component data required for analysis is given in Table A1 and the specific data
required for determination of the damage factor for mechanical fatigue is provided in A32.

195
 Required Data Comments
Number of Previous Fatigue If there has been no history of fatigue failures and there have been
Failures: None, One or >1 no significant changes, then the probability of a fatigue failure is
believed to be low.
Severity of Vibration (audible or The severity of shaking can be measured in these subjective terms
visible shaking): Minor, Moderate or or can be measured as indicated at the bottom of this table in
Severe optional basic data. Examples of shaking are:
· Minor – no visible shaking, barely perceptible feeling of vibration
when the pipe is touched
· Moderate – Little or no visible shaking, definite feeling of
vibration when the pipe is touched
· Severe – Visible signs of shaking in pipe, branches, attachments,
or supports. Severe feeling of vibration when the pipe is touched.
Number of weeks pipe has been If there have been no significant recent changes in the piping
shaking: 0 to 2 weeks, 2 to 13 weeks, system and the amount of shaking has not changed for years, or
13 to 52 weeks. the amount of accumulative cycles is greater than the endurance
limit, then it can be assumed that the cyclic stresses are below the
endurance limit. (Most piping shaking will be at a frequency
greater than 1 hertz. One hertz for one year is approximately
3x107 cycles, well beyond the endurance limit for most
construction materials.)
Sources of cyclic stress in the vicinity Determine to what cyclic source the piping is connected. The
of the item (e.g. within 50’): connections could be direct or indirect, e.g., through structural
reciprocating machinery, PRV chatter, supports.
high pressure drop valves (e.g., let-
down and mixing valves), none
Corrective Actions taken: Credit is given for analysis work which shows that the shaking
Modifications based on complete piping is not a fatigue concern
engineering analysis, Modifications
based on experience, No Modifications
Piping Complexity: Based on 15.24 Determine the piping complexity in terms of the number of
meters (50 feet) of pipe, choose: branched connections, number of fittings, etc.
· 0 to 5 branches, fittings, etc
· 5 to 10 branches, fittings, etc
· >10 branches, fittings, etc.
Type of joint or branch design used in Determine the type of joint or branch connection that is
this piping: Threaded, Socket Welded, predominant throughout this section of piping that is being
Saddle on, Saddle in, Piping tee, evaluated.
Weldolet, Sweepolet
Condition of the pipe: Missing/ What is the condition of the piping section being evaluated in
Damaged Supports, Unsupported terms of support?
weights on branches, Broken gussets,
Gussets/supports welded directly to
pipe, Good Condition
Table A32: Data Required for Determination of the Damage Factor – Mechanical Fatigue.

Basic Assumption
Properly designed piping has a low tendency for mechanical fatigue failure due to the low
period of vibration or low stress amplitude. The period is determined by the piping diameter,
thickness, mass, support spacing, and support type.

196
Based on input from plant engineers and inspectors from several disciplines, the following
key indicators of a high l probability of failure were identified:
 Previous failures due to fatigue
 Audible, visible, or otherwise noticeable piping vibration (including small branch
connections) that is greater than typical plant piping systems
 Connection to reciprocating machinery, extreme cavitation through let-down or mixing
valves, or relief valve chatter.

The presence of any or all of the above indicators determines the base susceptibility, which
is then modified by various adjustment factors.

Determination of the Damage Factor:

Overview
A flow chart of the steps required to determine the damage factor for mechanical fatigue. The
following sections provide additional information and the calculation procedure.

Figure A6: Determination of the Piping Mechanical Fatigue Damage Factor.

197
Inspection Effectiveness
For this damage mechanism, credit is not given for inspection. However, the results of
metallurgical testing can be used to update the inputs to the damage factor calculation that
may result in a change in this value.
Mechanical fatigue failures in piping are not that common. Unfortunately, when failures
occur, they can be of high consequence. In addition and more unfortunately, traditional non-
destructive testing techniques are of little value in preventing such failures. The reason that
crack detection techniques are not by themselves adequate are several:
1. Most of the time to failure in piping fatigue is in the initiation phase, where a crack in the
process of forming has formed but is so small that it is undetectable.
2. By the time a crack has reached a detectable size, the crack growth rate is high, and failure
will likely occur in less than a typical inspection frequency.
3. Cyclic stresses in vibrating piping tend to have a fairly high frequency, which increases
the crack growth rate.
4. Cracks form and grow in locations that are typically difficult to inspect, such as at fillet
weld toes, the first unengaged thread root and defects in other welds.
5. The initiation site for crack growth is not necessarily on the outside of the pipe; in fact, a
crack can grow from an embedded defect undetectable from either side without special
techniques.

Therefore, inspection for mechanical fatigue in piping systems depends heavily on detection
and correction of the conditions that lead to susceptibility. Such techniques include:
1. Visual examination of pipe supports to assure that all supports are functioning properly
(i.e., they are actually supporting the pipe).
2. Visual examination of any cyclic motion of the pipe. If pipe can be seen to be vibrating or
moving in a cyclic manner, the pipe should be suspected of mechanical fatigue failure.
3. Visual examination of all fillet welded supports and attachments to piping. Fillet welds
are especially susceptible to failure by fatigue, and these may provide an early warning
of problems if cracks or failures are found.
4. As a general rule, small branch connections with unsupported valves or controllers on
them are highly susceptible to failure. Examine these for signs of motion, and provide
proper support for all such installations.
5. Surface inspection methods (PT, MT) can be effective in a focused and frequent inspection
plan.
6. Manually feeling the pipe to detect vibration. This requires experience, but normally
process plant piping will not vibrate any more severely than a car engine at idle speed.
7. Measurement of piping vibration using special monitoring equipment. There are no set
values of vibration that will be acceptable or non-acceptable under all conditions, so
experience with using and interpreting vibration data is required.
8. Visual inspection of a unit during transient conditions and different operating scenarios
(e.g., startups, shutdowns, upsets, etc.) looking for intermittent vibrating conditions.
9. Checking for audible sounds of vibration emanating from piping components such as
control valves and fittings.

198
Calculating the Damage Factor:
The following procedure may be used to determine the damage factor for mechanical fatigue,
see Figure A6.
STEP 1 – Determine the number of previous failures that have occurred, and determine the
base damage factor based on the following criteria:
 None – =1
 One – =50
 Greater than one – = 500.

STEP 2 – Determine the amount of visible/audible shaking or audible noise occurring in the
pipe, and determine the base damage factor based on the following criteria:
 Minor – = 1
 Moderate – = 50
 Severe – = 500.

STEP 3 – Determine the adjustment factor for visible/audible shaking based on the following
criteria. This adjustment is based on observation that some piping systems may endure
visible shaking for years. A repeated stress with a cycle of only 1 hertz (1/s) results in over
30 million cycles in a year. Most systems, if they were subject to failure by mechanical fatigue
would be expected to fail before reaching tens or hundreds of million cycles. One should note
that intermittent cycles are cumulative.
 Shaking less than 2 weeks – =1
 Shaking between 2 and 13 weeks – = 0.2
 Shaking between 13 and 52 weeks – = 0.02.

STEP 4 – Determine the type of cyclic loading connected directly or indirectly within
approximately 15.24 meters (50 feet) of the pipe, and determine the base damage factor
based on the following criteria:
 Reciprocating Machinery – = 50
 PRV Chatter – = 25
 Valve with high pressure drop – = 10
 None – = 1.

199
STEP 5 – Determine the base damage factor using Eq. 6.1:

Eq. 6.1

STEP 6 – Determine the final value of the damage factor using Eq. 6.2

Eq. 6.2

The adjustment factors are determined as follows.

1) Adjustment for Corrective Action, – Established based on the following criteria:
 Modification based on complete engineering analysis – = 0.002
 Modification based on experience – = 0.2
 No modifications – =2.

2) Adjustment for Pipe Complexity, – Established based on the following criteria:

 0 to 5 total pipe fittings – = 0.5
 6 to 10 total pipe fittings – =1
 Greater than 10 total pipe fittings – =2.

3) Adjustment for Condition of Pipe, – Established based on the following criteria:

 Missing or damaged supports, improper support – =2
 Broken gussets, gussets welded directly to the pipe – =2
 Good Condition – =1.

4) Adjustment for Joint Type or Branch Design, – Established based on the following
criteria:
 Threaded, socketweld, saddle on – =2
 Saddle in fittings – =1
 Piping tee, Weldolets – = 0.2
 Sweepolets – = 0.02.

200
5) Adjustment for Branch Diameter, – Established based on the following criteria:
 All branches less than or equal to 2 NPS – =1
 Any branch greater than 2 NPS – =0.02.

Nomenclature

is the base damage factor for previous failures

is the base damage factor for shaking

is the base damage factor for cyclic loading type

is the damage factor for mechanical fatigue

is the base damage factor for mechanical fatigue

is the damage factor adjustment for branch diameter

is the damage factor adjustment for corrective action

is the damage factor adjustment for condition of pipe

is the damage factor adjustment for joint type

is the damage factor adjustment for pipe complexity

is the adjustment factor for audible shaking

201
17.7. Appendix VII: API 581:2000 Furnace Tube Technical Module
Likelihood analysis
Introduction
The probability of failure for furnace tubes is calculated directly in the furnace technical
module with the following generic failure frequencies for long-term creep. If short-term creep
is possible, the generic failure frequencies are multiplied by a factor of 100, as shown in Table
A33.

Hole size Long-term creep Short-term creep

¼ in 0.0 0.0
1 in 4.62*10-6 4.62*10-4
4 in 1.32*10-6 1.32*10-4
Rupture 6.60*10-7 6.60 *10-5
Table A33: Furnace tube generic failure frequencies.

Scope
This module establishes a damage factor (probability of failure modifier) fir externally fire
furnace tubes. This technical module applies to ferritic steel (carbon steel and low alloy steels
through 12 Cr) and austenitic stainless steel (types 304, 316, 321 and 347) tubes in refinery
heaters. These tubes are assumed to be direct fired, heat absorbing and enclosed within a
firebox. This module addresses damage caused by long term exposure to temperature as well
as short term over-heating.

Technical module screening questions

Screening options Action
Is the type of equipment a fired heater or If yes, continue through the Furnace Tube Technical
furnace used to heat liquid process streams? Module.
If no, exit Furnace Tube Technical Module.

Table A34: Screening questions for Furnace Technical Module.

Basic Data
The basic data listed in Table A35 are the minimum required to determine the technical
module subfactor for furnace tubes.

Basic assumptions
a) Generally, fired heater tubes in refineries are designed to comply with API RP 530. This
recommended practice is used to select the minimum wall thickness required for heater
tubes as a function of the material of construction, the temperature and the applied stress.
The recommended practice addresses both creep and corrosion damage. Whole
allowances for corrosion are made, API RP 530 specifies minimum allowable tube wall
thickness based on the estimated creep life. At elevated temperatures, components
subject to a constant stress fail after a period of time. This time to failure decreases as the
stress or the temperature increases.
202
 Basic data Comments
Material of Construction Determine the material of construction of the tubes.
Time in service, ti (years) Determine the total numbers of years that the tubes have been in service. If
the tubes were in a previous service in which creep failure was not a concern,
this time may be ignored. Assume 8,500 hours of operation per year,
Time since previous Determine the number of years since the previous inspection which there is
inspection (years) thickness data. This time will be used, along with the calculated corrosion
rate, to determine the current thickness.
Corrosion Rate (mpy) Determine the current rate of thinning calculation of the thickness data, if
available. If the thinning rate has not been established by inspection, then
estimated thinning rates may be determined from this module and the
Thinning module.
Operating Tube Metal Determine the average operating tube metal temperature determined from
Temperature, TMT ( oF) thermography or skin thermocouples. If the tube temperature is not
available, use process outlet temperature plus 100°F for non-fouling, non-
coking service for tubes in fouling or coking service, add 150°F to process
outlet temperature.
Operating Pressure, p Determine the highest expected operating pressure (may be the relief valve
(psi) set pressure (unless pressures that high are unlikely).
Tube Diameter, Do (inch) Determine the tube outer diameter used for design calculations at time of
construction.
Tube Wall Thickness Determine the actual measured thickness from the last inspection. If
(inch) inspection results are not available, then determine the new construction
minimum thickness.
Inspection Effectiveness Determine the effectiveness category each inspection has been performed on
Category the equipment during the time (specified above). See Table A45 for
guidelines to assign inspection effectiveness categories r furnace tubes.
Number of Inspections Determine the number of inspections in each category that have been
performed during the time period specified above.
Severity of possible over- Estimate the magnitude of extreme temperature excursions from 0oF - 300oF
heating ΔToh ( oF) over the design tube metal temperature (not operating tube metal
temperature).
Duration of possible over- Estimate the accumulated duration of extreme over-heating events.
heating, Toh (hours)
Estimate
On-Line Monitoring Determine the types of proactive corrosion monitoring methods tools
employed, such as tube skin thermocouples, thermography, process
operating variables etc.
Table A35: Basic Data Required for Analysis of Furnace Tubes.

b) For the material of construction, API RP 530 presents two creep strengths: the mean
strength and the minimum strength. The mean curves in API RP 530 correspond to the
average creep strength of the heater tube material while the minimum curves correspond
to the strength that is exceeded by 95% of heater tube material.

c) The relationship between creep life, stress and temperature is relatively complex.
However, heater tube design methods use simplified relationships developed from
accelerated tensile creep tests. The scatter in the results of these uniaxial creep tests is
relatively large. Because of this scatter in experimental creep properties and dependence
on accelerated creep tests for the creep properties, there is a significant amount of
uncertainty associated with the prediction of creep life.
203
d) The prediction of heater tube life is further complicated by other effects as listed below:

 External oxidation. The most common corrosion problem in heater tubes is external
oxidation of the tubes. Oxidation thins the tube walls, increasing the stress and
accelerating the rate of creep damage. The oxidation rate is a function of temperature and
amount of oxygen in the firebox.
 Internal corrosion. In some refinery furnaces, such as in Crude Distillation units, high
temperature sulfidation can be a problem. As corrosion thins the tube wall, the stress
increases and the rate of creep, damage is accelerated. The rate of high temperature
sulfidation is a function of temperature and sulfur content in the process stream.
 Other corrosion. Because the tubes are operated at high temperatures, even small
amounts of contaminants in either the process or fuel can cause accelerated corrosion of
the tube metal. For example, the combination of high temperatures and small amounts of
sodium and vanadium in the fuel can cause excessive external corrosion.
 Uneven heating. The temperature distribution in heater fireboxes is affected by the
positioning of the tubes relative to the burners, the shape and size of the firebox, the tube
spacing, and the distances between the tubes and the burners.
 Flame impingement. Flame impingement is affected by the same factors of uneven
heating; however, it is also affected by the adjustment of the burners and the control of
fuel and air in the fire box.
 Coking. In many types of petroleum heaters, coke deposits build up on the inside of the
tube. The coke deposits act as a thermal insulation between the tube metal and the
process, raising the temperature of the tube wall, accelerating creep and corrosion.

e) This technical module assumes that the long-term creep does not occur unless the
operating tube wall metal temperature is higher than the temperatures given for each
material of construction in Table A36. Local overheating; however, may occur as a result
of uneven heating or flame impingement and is addressed for all furnaces.

Material type Elastic temperature limit ( oF)

Carbon steel 770
½ Mo 920
1¼ Cr - ½ Mo 930
2¼ Cr – 1 Mo 900
3 Cr – 1 Mo 920
5 Cr - ½ Mo 880
5 Cr - ½ Mo - Si 840
7 Cr - ½ Mo 850
9 Cr – 1 Mo 960
12Cr 800
304/304H SS 1,080
316/316H SS 1,120
321 SS 1,010
321H SS 1,040
347/347H SS 1,100
Table A36: Metal temperature limit for creep consideration.

204
f) Failure resulting from long-term exposure at temperatures in excess of those outlined in
Table A36 is assumed to result from creep and creep cracking. The limit states used to
estimate the life for design is covered in detail in APIO RP 530. If the expected tube metal
temperatures are less than those listed in Table A36, the furnace tubes should be assessed
using the technical module for general thinning. If however, the tube could be exposed to
high metal temperatures for short time intervals, proceed to Determination of Short-
Term Failure Probability section below.

Determination of technical module subfactors (TMSF)

The technical module subfactor is determined using the procedure outlined in Figure A7.
Because there are two modes of failure, there are two parts to this procedure: a procedure
that estimates the likelihood of a long term failure and a procedure that estimates the
likelihood of a short term over-heating failure. This results in two estimates of the TMSF. The
maximum of these two estimates is used.

Determination of actual tube metal temperature (TMT)

Determine the average operating tube metal temperatures as measured by thermography or
skin thermocouples. If the measured TMT is not available, it can be estimated by using the
process outlet temperature + 100°F for non-coking service, and + 150°F for coking service.

Determination of elastic metal temperature limit

The critical tube metal temperate (Telas) is determined by using the following table for various
material of construction. If the actual tube metal temperature is less than theoretical
temperature tabulated above, then long-term creep is not a consideration.

Determination of corrosion rate

The average corrosion rate should be calculated from thickness data available from furnace
tube inspections, if available.
If a calculated thinning rate is not available, estimated thinning rates should be determined
for each potential thinning mechanism (See Appendix G, API 581:2000) using high
temperature sulfidic and naphthenic acid corrosion (see high temperature H2S/H2 corrosion
(see G.8. API 581:2000) and high temperature oxidation (see G.13, API 581:2000). The
screening questions in should be used to determine which of the thinning mechanisms apply.
These thinning rates will be added to give a composite thinning rate. Alternatively, expert
advice may be used to establish the maximum inning rate.

Determination of current wall thickness (Tcurrent)

Determine the current thickness using the corrosion rate and thickness obtained from the
last known inspection. If no inspections have been performed, use the original tube wall
thickness, the total time in service and the estimated corrosion rate determined above to
estimate the current thickness.

205
Figure A7: Determination of Technical Module Subfactors for Furnace Tubes.

206
Figure A8: Determination of Technical Module Subfactors for Furnace Tubes (continues Figure 7).

207
Figure A9: Determination of Technical Module Subfactors for Furnace Tubes (continues figures A7 and A8).

Calculation of stress
Calculate the stress in the tube, S using the current thickness (Tcurrent), operating pressure (p),
and tube outside diameter (Do), as shown in the Eq. 7.1 below.

Eq. 7.1

If the tube stress is less than that tabulated in Table A37, long term creep is not a concern.
However short term overheating should still be considered.

208
 Material type Elastic stress limit (ksi)
Carbon steel 3.2
½ Mo 1.75
11/4 Cr - 1/2Mo 2.6
3Cr – 1Mo 2.2
5Cr – 1/2Mo 2.4
5Cr – 1/2Mo – Si 2.4
7Cr – 1/2Mo 1.7
9Cr – 1Mo 1.5
12Cr 1.25
12Cr 2.1
304/304H SS 2.4
316/316H SS 1.85
321 SS 1.85
321H SS 2.05
347/347H SS 1.95
Table A37: Tube Stress Limit for Creep Consideration.

Determination of long-term failure probability

a) The probability of failure as a result of long term creep is calculated following these steps:
The mean Larson Miller parameter, LMavg is determined using the expressions in Table A38 at
the stress level calculated in Calculation of Stress.
b) The Larson Miller Parameter at the current operating conditions is calculated using the
following equation:

Eq. 7.2
Where TMT is the operating tube metal temperature in [oF], ti is the total time in service in
hours and C is tabulated for each material of construction in Table A38.

c) The parameter LMdelta is determined. This parameter is defined as the average difference
between the mean and minimum Larson Miller curves in API 530. These values are tabulated
in Table A38.

d) The parameter X is determined using the mean and operating Larson Miller parameters
and dividing by difference by LMdelta as shown in the following equation:

Eq. 7.3

209
 The failure factor is calculated using the following formula:

Eq. 7.4

Material type Expression for LMavg LMdelta C

Carbon steel 42.2443 – 0.000025156 S3 – 1.24914 S1/2 – 1.90435 ln S 0.34 20
C – 1/2Mo 41.2074 – 0.000011355 S3 – 2.30593 ln S 0.62 20
3/4Cr – 1/2Mo 42.601 – 2.62249 ln S 1.11 20
5/4 Cr - 1/2Mo 47.1376 – 44.18064 ln S – 1.8401/S1/2 – 8.41296 exp-S 0.85 20

3Cr – 1Mo 44.786 – 3.50144 ln S 0.69 20

5Cr – 1/2Mo 45.5586 – 3.92851 ln S 1.41 20

5Cr – 1/2Mo – Si 45.1928 – 4.06518 ln S 1.82 20

7Cr – 1/2Mo 45.7938 – 4.42502 ln S 1.19 20

9Cr – 1Mo 44.7031 – 3.10233 ln S 1.32 20

12Cr 59.8012 – 13.6331 ln S + 4.3462 ln2 S – 0.60141ln3 S 1.29 25

304/304H SS 43.1703 – 4.15807 ln S 1.57 15

316/316H SS 41.4735 – 3.3742 ln S 0.75 15

321 SS 39.8956 – 3.12309 ln S 1.97 15

321H SS 42.1308 – 3.84328 ln S 1.63 15

347/347H SS 41.6803 – 3.38401 ln S 0.72 15
S= tube stress, in ksi
LM= Larson Miller parameter in (°R) (log10 hours)
Table A38: Larson Miller parameter expressions.

Determination of the long-term technical module subfactor (TMSFLT)

A technical module subfactor can be calculated from the failure factors using the following
equation.

Eq. 7.5

Inspection effectiveness category

Inspections are ranked according to their expected effectiveness at finding damage and
correctly predicting remaining life of furnace tubes. The actual effectiveness of a given
inspection technique or combination of techniques depends on the characteristics of the
material of construction and the method used. Table A39 provides an example of inspection
activities for furnace tubes.

210
Nonintrusive inspections cannot be applied to heater tube inspection since internal entry into
the firebox is necessary for this to occur. The credit provided for inspection is determined by
using the expressions in Table A40. N is the number of inspections, or 4, whichever is the
smaller.

Determine the TMSFadj using Eq. 7.6:

Eq. 7.6

The long term technical module subfactor may be modified to take credit for on-line
monitoring using the guidance provided further below.

Inspection Example: intrusive inspection

Effectiveness Category
Highly effective Visual inspection, UT thickness measurements of all tubes, and strapping at UT
measurement locations, FMR at various locations
Usually effective Visual inspection, UT measurements of all tubes
Fairly effective Visual inspection with spot UT measurements of 75% of the tubes
Poorly effective Visual inspection with spot UT measurements
Ineffective Visual
Table A39: Guidelines for assigning inspection effectiveness.

Inspection Example: intrusive inspection

Effectiveness Category
Highly effective max (min (1, (1.25N 2 - 10.15N + 25.75) / 100), 0)

Usually effective max (min (1, (0.75 N 2 - 9.65N + 33.75) / 100, 0)

Fairly effective max (min (1, (1.75 N 2 - 18.05N + 56.25) / 100)

Poorly effective max (min (1, (4 N 2 - 39.60N + 119.5) / 100), 0)

Ineffective 1.0
Table A40: Inspection Effectiveness Reduction Factor.

Determination of short-term failure probability

The method discussed so far assumes steady or nearly steady operating conditions over the
life of furnace resulting in long term creep. This type of damage is not the only mode of failure
that can occur. Short periods of exposure to high temperatures or flame impingement can
result in failure. While this mode of failure is common, it is much more difficult to assess
quantitatively because it is caused by unexpected circumstances or upsets in the operation
or firing of the furnace. The methods, charts and procedures outlined in this section are
intended as guidance to the engineer in evaluating the potential susceptibility to short term
failure caused by over-heating.

211
Because such failures depend on a large array of factors too complex and varied to cast into
an exact calculation, the method outlined here depends on two factors:
a) The estimated severity of probable over-heating as measured by the difference between
the tube metal temperature during the over-heating event and the design tube metal
temperature. This quantity is denoted as ΔToh.
b) The estimated accumulated time of exposure to over-heating; this time of exposure is
denoted as toh.

The severity ΔToh of a possible over-heating is a function of the factors covered below. Values
of ΔToh can range up to 300oF, indicating that in some locations of the furnace, the metal
temperature can be as much as 300°F higher than the design tube metal temperature of a
short periods of time. Heaters that have one or more of the following problems should be
assigned high values of ΔToh.:
a) A history of over-heating. Heaters that have failed after unusually short periods of time
should be assigned a high value of ΔToh
b) Observed flame impingement.
c) High possibility of heavy coking.

The time of exposure toh is a measure of how frequent and how long over-heating events can
or has lasted. The value of toh can range between 10 and 1000 hours and indicates the amount
of accumulated time that the furnace has been exposed to severe operating conditions.
Heaters that should be assigned high values of toh may have one or more of the following
problems:
a) Unstable operation. Furnaces that have a history of unstable operation should be assigned
a high value toh
b) Burner control problems. Furnaces that have a history of burners that are difficult to adjust
and control should be assigned a high toh.

The probability of failure due to short term overheating can be calculated following these
steps:

STEP 1: The quantity ΔT5%, is calculated using the function in Eq. 7.7 and the expected
accumulated duration of over-heating events. This over-heating temperature, ΔT5%
corresponds to values of ΔToh that result in a 5% probability of failure in the LM curves.

Eq. 7.7

Eq. 7.7 assumes that a 1°F overheating event 1,000 hours long is equivalent to a one hour
long 250°F overheating event. The long duration event is calibrated based on the observation
that if the tube has been operating for long times at its design pressure and temperature the
probability of failure is about 5%. The short event is calibrated by the observation that tubes
that survive a short intense event such as a fire do not necessarily fail.

212
STEP 2: As the actual over-heating temperature, ΔToh increases, the probability of failure
increases as a function of the difference between ΔToh and ΔT5%. Use the function in Equation
Eq. 7.8 to calculate the failure factor for short term over-heating.

Eq. 7.8

Determination of short-term technical module subfactor (TMSFST)

A technical module subfactor can be calculated from the failure probability using Eq. 7.5.

Adjustment to TMSF for online monitoring factors

Unexpected high corrosion rates, uneven heating, unexpected short-term over heating of the
tubes, and flame impingement have the effect of increasing the life fraction consumed of the
tubes. In addition to inspection, on-line monitoring of short-term upsets and over-firing
conditions is commonly used to prevent premature tube failures. The advantage of on-line
monitoring is that short-term changes in tube metal temperatures can be detected before
periodic inspections. This detection permits a better estimate of the consumed life fraction
and therefore estimated remaining life of the tubes. Various methods are employed including
tube skin thermocouples, thermography, and a combination visual inspection and burner
alignment.
If on-line monitoring is employed, credit should be given to reflect a higher confidence in the
predicted life fraction consumed. However, these methods have varying degrees of success
depending on the type of furnace and tube materials. The adjustment factors suggested in
Table A41 assume problems found through on-line monitoring are corrected as a result of
the findings.

On-Line monitoring method Long-term creep online Short-term creep online

monitoring factor monitoring factor

No monitoring 1.0 1.0

Daily visual and burner adjustment 5 50
by operations
Thermography 10 100
Tube skin thermocouples and 10 100
instrumentation to panel
TMSFadjusted = TMSF / On-line Monitoring Factor
Table A41: Guidelines for Determining the On-line Monitoring Factor.

Combining long-term and short-term technical module subfactors

The furnace module TMSF should be taken as the larger of the short-term and long-term
technical module subfactors.

213
Consequence analysis
Determining a Representative Fluid and its Properties
The scope of this Appendix is limited to furnaces that are used to heat liquid process streams.
Furnaces such as steam/methane reformers are very much different, partly because the
consequences of a leak are not usually very severe, except in the case of massive failures. (i.e.,
a furnace fired with methane used to heat methane is not severely affected by a tube leak
releasing more fuel into the fìrebox.).

Representative material Examples of applicable materials

C 3 – C5 Propane, butane, isooctane, pentane LPG
C6– C8 Gasoline
C9 – C12 Diesel
C13 – C16 Jet fuel, kerosene
C17 – C25 Gas oil, typical crude
C25+ Residuum, heavy crude
Table A42: List of Materials Modeled for Furnaces.

Selecting a set of hole sizes

The only hole sizes that practically need to be modeled for furnaces are 1 inch. holes and
larger. Smaller holes are likely to produce leaks that are consumed within the fire box, and
do not present a large potential for major damage. There may be some internal damage, such
as damage to an adjacent tube due to flame impingement. Thus, furnace tubes can use the
hole sizes: 1 inch, 4 inch and rupture, provided that the diameter of the leak than or equal to
the diameter of the tube itself.

Hole size Range Representative value

Medium 0.25 - 2 inches 1 inch
Large 2 – 6 inches 4 inches
Rupture >6 inches Entire diameter of item
Table A43: Hole Sizes Used in Furnaces RBI Analysis.

Estimating the total amount of fluid available for release

To avoid generating results that are not credible for furnaces, the analyst must estimate the
maximum amount of fluid that can be released from a furnace, then apply this maximum as
an upper limit for consequence calculations.
Since there are isolation valves between most furnaces and their attached vessels (from both
directions), the maximum quantity released is suggested to be limited to the furnace
inventory plus three minutes flow from both sources. If there are no isolation valves, or if
there are only manual valves located close to the furnace, this total release inventory should
be increased.

214
Estimating release rate and type of release
For furnaces, it is considered that all releases will be of a continuous nature (although some
may be of short duration). Also, the scope of this Appendix is limited to liquid releases.
Discharges of liquids through a sharp-edged orifice are described by the work of Bernoulli
and Toricelli (Perry and Green, 1984) and can be calculated as:

Eq. 7.9
Where:
QL - liquid discharge rate (lb/sec)
Cd - discharge coefficient
A - hole cross-sectional area (in2)
r - density of liquid (lb/ft3)
P - difference between upstream and atmospheric pressure @id)
gc - conversion factor from lb to lb
(32.2lb-ft / lbfsec2).

The discharge coefficient for fully turbulent flow from sharp-edged orifices is 0.60 to 0.64. A
value of 0.61 is recommended for the RBI calculations. The above equation is used for both
flashing and non-flashing liquids.
For furnace incidents, all of the releases will be continuous in nature. There is no need to
evaluate the instantaneous effects.

Determining the final phase of the fluid

For the purposes of this Appendix, the methods for determining the final phase of the fluid
after release a furnace tube closely follows the methods outlined in API 581:2000 section 7.
One exception is that gaseous initial fluid phases are not considered. In actual furnace tube
failures, there is an increased tendency initially for a liquid fluid to vaporize upon leakage of
the tube, due to the high temperatures in the fire box. However, in the event of a significant
leak, the furnace quickly becomes fuel-rich in the fire box and the flame is either extinguished
or greatly reduced. Subsequent flames occur where the released hydrocarbon can find
sufficient oxygen to bum: at the top of the stack, and around air entry louvers or observation
ports. Continued release of the hydrocarbon typically results in a liquid release from the
bottom of the furnace with a pool fire.

Phase of fluid at Phase of fluid at steady state Determination of final phase for
steady state operating ambient conditions consequence calculation
conditions
Liquid Gas Model as gas unless the fluid boiling point at
ambient conditions is greater than 80oF, then
model as a liquid.
liquid liquid Model as a liquid

Table A44: Guidelines for Determining the Phase of a Fluid.

215
The adjustments to release characteristics based on detection, isolation and mitigation
systems are provided in Table A45. These values are based on engineering judgment, utilizing
experience in evaluating mitigation measures in quantitative risk analyses.

Response system ratings Consequence adjustment

Detection Isolation
A A Reduce release rate or mass by 25%
A B Reduce release rate or mass by 25%
A or B C Reduce release rate or mass by 20%
B B Reduce release rate or mass by 5%
C C Reduce release rate or mass by 15%
Mitigation system Consequence adjustment
Inventor; blowdown, coupled with isolation system rated B Reduce release rate or mass by 25%
or higher
Fire water deluge system and monitors Reduce release rate or mass by 20%
Fire water monitors only Reduce release rate or mass by 5%
Foam spray system Reduce release rate or mass by 15%
Table A45: Adjustments to Flammable Consequences of Mitigation Systems.

Determine the consequence area of the release

Determination of the consequences of the release from a furnace tube failure is similar to the
methods outlined in API 581:2000 section 7, with the following important exceptions:
 Since there is a source of ignition in the fire box, the accumulation of a large (over 10,000
lb) cloud of vapor is not considered possible, thus VCEs are eliminated from
consideration.
 Similarly, since furnace tube failures produce continuous type releases, rather than
instantaneous releases, the possibilities of fireball or flash fire scenarios are also
considered to be nil.

Table A46 represents the specific event outcomes expected for furnace tube releases. Note
that the fires are considered for lighter hydrocarbons. These are cases where most or all of
the released fluid vaporizes and fluid can exit from furnace openings with considerable force,
resulting in a substantial flame affected area.
Also in a manner analogous to the methods outlined in API 581:2000 section 7, the affected
area is calculated from Table A47. By definition, ignition is likely, and the release is of a
continuous nature. There is an additional constraint placed on affected area calculation for
furnaces: most furnaces have spill containment in the form of a curb at least 6 in. high and
located approximately 10 ft from the outer perimeter of the furnace structure. This reduces
the affected area of the release to the impoundment area. "Typical" impoundment areas are
approximately 3,000 ft2. If no containment exists, use the calculated affected area from the
equations in Table A47.

216
 Fluid Ignition VCE Fireball Flash fire Jet fire Pool fire
C3 – C5 1 - - - 1 -
C6– C8 1 - - - 1 -
C9 – C12 1 - - - 1 -
C13 – C16 1 - - - 0.5 0.5
C17 – C25 1 - - - 0.5 0.5
C25+ 1 - - - - -
Table A46: Specific Event Probabilities-Continuous Release Auto Ignition Likely.

Fluid Final phase gas

Area of equipment damage (ft2) Area of fatalities (ft2)

C3 – C5
-
C6– C8

C9 – C12

C13 – C16 - -

C17 – C25 - -
C25+ - -

Table A47a: Continuous Release Consequence Equations-Auto Ignition Likely.

Fluid Final phase liquid

Area of equipment damage (ft2) Area of fatalities (ft2)

C3 – C5

C6– C8

C9 – C12

C13 – C16

C17 – C25

C25+

Table A47b: Continuous Release Consequence Equations-Auto Ignition Likely.

217
17.8. Appendix VIII: API 581:2000 Stress Corrosion Cracking Technical
Module
Scope
This module establishes a technical module subfactor (probability of failure modifier) for
process equipment subject to damage by mechanisms that result in stress corrosion cracking
(SCC). Caustic cracking, amine cracking, sulfide stress cracking (SSC), hydrogeninduced
cracking (HIC), stress-oriented hydrogeninduced cracking (SOffiC), carbonate cracking,
polythionic acid cracking (PTA), and chloride cracking (ClSCC) are within the scope of the
module. Technical Supplements are included in this module to provide estimates of the
susceptibility to specific damage mechanisms that result in stress corrosion cracking. Expert
advice may also be used to establish susceptibility to stress corrosion cracking.

Technical Module Screening Questions

There are no screening questions to bypass the Technical Module for stress corrosion
cracking. All equipment must enter this Technical Module.

Required Data
The basic data listed in Table A48 are the minimum required to determine a technical module
subfactor for stress corrosion cracking.

Basic Data Comments

Susceptibility to SCC (Low, The susceptibility is determined by each applicable Technical
Medium, High) Supplements or by expert advice.
The highest expected operating pressure (may be the relief valve set
Operating Pressure, (psi)
pressure unless pressures at that level are unlikely).
The pressure used to determine the minimum allowable wall
MAWP (psi) thickness. If MAWP is not available, design pressure may be used for
this input.
The material of construction of equipment from the inspection
Material of Construction
records.
The highest expected operating temperature expected during
Operating Temperature
operation (consider normal and non-normal operating conditions)
Presence of SCC and Cracking
Attempt to determine the cracking mechanism from inspection
Mechanism, if known (Caustic,
reports, or expert advice. If the cause of cracking is not known, a more
Amine, SCC, HIC/SOHIC,
conservative damage factor may result.
Carbonate, RTA, CISCC, Unknown
Time since last SCC inspection Use inspection history to determine years since the last SCC
(years) inspection.
The effectiveness category that has been performed on the
Inspection Effectiveness Category equipment. See Tables below for guidelines to assign inspection
effectiveness categories for each of the SCC mechanisms.
Online Monitoring (Hydrogen The type of proactive corrosion monitoring methods or tools
Probes, Process Variables, or employed, such as hydrogen probes and/or process variable
Combination) monitoring.
The number of inspections in each effectiveness category that have
Number of Inspections
been performed
Table A48: Susceptibility

218
Additional Data
Additional data are required to answer the screening questions for the SCC mechanisms listed
in Table A49. Further data required for each sec mechanism are listed in the basic data table
near the beginning of each supplement.

Screening Questions Action

1. Caustic Cracking
If Yes to both, proceed to Table A59
Is the material carbon or low alloy steel?
(16.12)
Does the environment contain caustic in any concentration?
2. Amine Cracking
Is the material of construction carbon or low alloy steel? If Yes to both, proceed to Table A60
Is the equipment exposed to acid gas treating amines (MEA, DEA, (16.13)
DIPA, MDEA etc.)?
3. SSC/HIC/SOHIC
If Yes to both, proceed to Table A61
Is the material of construction carbon or low alloy steel?
(16.14) and Table A62 (16.15)
Does the environment contain water and H2S?
4. Carbonate Cracking
If Yes to both, proceed to Table A63
Is the material of construction carbon steel?
(16.15)
Does the environment contain sour water at pH>7.5?
5. Polythionic Acid Cracking (PTA)
Is the material austenitic stainless steel? If Yes to both, proceed to Table A64
Is the equipment exposed or potentially exposed to sulfur bearing (16.15)
compounds?
6. Chloride Stress Corrosion Cracking (CISCC)
Is the material austenitic stainless steel?
Is the equipment exposed or potentially exposed to chlorides and If Yes to all, proceed to Table A65 (16.16)
water also considering upsets und hydrotest water remaining in
equipment for process conditions)?
Is the operating temperature between 100 oF and 300 oF.
7. Hydrogen Stress Cracking (HSC-HF, HIC/SOHIC-HF)
If Yes to both, proceed to Table A66
Is the material carbon or low alloy steel?
(16.16) and Table A67 (16.16)
Is the equipment exposed to hydrofluoric acid?
Table A49: Screening Questions for SCC Mechanisms.

Basic assumptions
This Technical Module assumes that a susceptibility to each sec mechanism is determined in
the applicable section of this module. The susceptibility is designated as high, medium, or low
based on process, material, and fabrication variables. A "severity index" can be determined
which is the product of the susceptibility of the equipment/piping to cracking (or the
likelihood of initiating cracks) and the likelihood of a crack resulting in a leak. The method
can also handle known cracks in a simplistic manner. Likelihood of failure due to a specific
crack or array of cracks in the equipment/piping should be further evaluated using more
advanced methods and fitness for service evaluations.

219
Determination of Technical Module Subfactor (TMSF)
A flow chart of the steps required to determine the technical module subfactor is presented
in Figures A10A and A10B. These steps are discussed below, along with the required tables.

Figure A10A: Determination of Technical Module Subfactor for Stress Corrosion Cracking.

220
Figure A10B: Determination of Technical Module Subfactor for Stress Corrosion Cracking (continues figure A10A)

221
TMSF: Screening Question for Technical Supplements
The screening questions listed in Table A49 are used to select the applicable SCC mechanism.

HTSF: Determination of Susceptibility for Each Potential SCC Mechanism

The individual section for each sec mechanism will establish a susceptibility that is possible
in this equipment.

Adjustment for Existing Cracking

If SCC has been detected in this equipment, then the susceptibility is considered high. If the
mechanism of the detected SCC is known, then the susceptibility of that mechanism should
be increased to high. If the mechanism of the detected sec is not known, then the susceptibility
for cracking of all potential mechanisms should be increased to high.

Determination of Severity Index

Use the susceptibility for each SCC mechanism to enter Table A50 and determine the severity
index for each potential/existing sec mechanism. The severity index for equipment with no
inspection is outlined below for each of the stress cracking mechanisms.

Maximum Severity Index

Determine the maximum severity index and which mechanism resulted in the highest
severity index.
Susceptibility Severity index
Caustic Amine Carbonate SSC, HIC-SOHIC CSSCC PTA
HSC-HF
High 5,000 1,000 1,000 100 100 5,000 5,000
Medium 500 100 100 10 10 500 500
Low 50 0 10 1 1 50 50
Not 1 1 1 1 1 1 1
Table A50: Determination of Severity Index.

Inspection Effectiveness
Inspections are ranked according to the expected effective ness of detecting cracking. The
actual effectiveness of a given inspection technique or combination of techniques depends on
the characteristics of the specific cracking mechanism and other factors.
Tables A51A through A51F provide examples of inspection activities that are both intrusive
(requires entry into equipment) and non-intrusive (can be performed externally). Note that
the effectiveness categories vary somewhat for each cracking mechanism.

222
 Inspection Example: Example:
Effectiveness Intrusive Inspection Nonintrusive Inspection
Category
Shear wave ultrasonic testing of
Wet fluorescent magnetic particle or dye penetrant 25-100% of welds/cold bends or
Highly Effective
testing of 25%-100% of welds/cold bends. Radiographic testing of 50-100%
of welds/cold bends.
Shear wave ultrasonic testing of
Wet fluorescent magnetic particle or dye penetrant 10-24% of welds/cold bends or
Usually Effective
testing of 10%-24% of welds/cold bends. Radiographic testing of 25-49% of
welds/cold bends.
Shear wave ultrasonic testing of
less than 10% of welds/cold
Wet fluorescent magnetic particle or dye penetrant
Fairly Effective bends or Radiographic testing of
testing of less than 10% of welds/cold bends.
less than 25% of welds/cold
bends.
Poorly Effective Visual inspection Visual inspection for leaks.
Ineffective No inspection No inspection
Table A51A: Effectiveness of Inspection for Caustic Cracking.

Inspection Example: Example:

Effectiveness Intrusive Inspection Nonintrusive Inspection
Category
Wet fluorescent magnetic particle testing of 100%
Highly Effective of repair welds and 50-100% of other welds/cold None
bends.
Shear wave ultrasonic testing of
Wet fluorescent magnetic particle testing of 20- 50-100% of welds/ cold bends;
Usually Effective
49% of welds/cold bends. or Acoustic Emission testing with
follow-up shear wave UT.
Wet fluorescent magnetic particle testing of less
than 20% of welds/cold bends; or Dry magnetic
Shear wave ultrasonic testing of
Fairly Effective particle testing of 50-100% of welds/cold bends;
20-49% of welds cold bends.
or Dye penetrant testing of 50-100% of welds/cold
bends.
Shear wave ultrasonic testing of
Dry magnetic particle testing of less than 50% of
less than 20% of welds/cold
Poorly Effective welds/cold bends; or Dye penetrant testing of less
bends; or Radiographic testing;
than 50% of welds/cold bends.
or Visual inspection for leaks.
Ineffective Visual inspection No inspection
Table A51B: Effectiveness of Inspection for Amine Cracking & Carbonate Cracking.

223
 Inspection
Example: Example:
Effectiveness
Intrusive Inspection Nonintrusive Inspection
Category
Shear wave ultrasonic testing of 25-100%
of weldments, transverse and parallel to
Wet fluorescent magnetic particle testing
Highly Effective the weld with the weld cap removed; or
of 25-100% of weldments.
Acoustic Emission testing with follow-up
shear wave UT.
Wet fluorescent magnetic particle testing
of 10-24% of weldments; or Dry magnetic Shear wave ultrasonic testing of 10-24%
Usually Effective particle testing of 25-100% of weldments: of weldments; Radiographic testing of 50-
or Dye penetrant testing of 25-100% of 100% of weldments.
weldments.
Wet fluorescent magnetic particle testing
of less than 10% of weldments; or Dry Shear wave ultrasonic testing of less than
Fairly Effective magnetic particle testing of less than 25% 10% of weldments; Radiographic testing
of weldments; or Dye penetrant testing of of 20-49% of weldments.
less than 25% of weldments.
Radiographic testing of less than 20% of
Poorly Effective Visual inspection
weldments.
Ineffective No inspection No inspection
Table A51C: Effectiveness of Inspection for Sulfide Stress Cracking and Hydrogen Stress Cracking.

Inspection
Example: Example:
Effectiveness
Intrusive Inspection Nonintrusive Inspection
Category
Wet fluorescent magnetic particle testing of
Highly Effective SO- l00% of weldments, plus additional shear None
wave UT for subsurface cracking.
Automated shear wave ultrasonic
Wet fluorescent magnetic particle testing of testing of 20 - 100% of weldments; or
Usually Effective
20-49% of weldments. Acoustic Emission testing with follow-
up shear wave UT.
Wet fluorescent magnetic particle testing of Automated shear wave ultrasonic
less than 20% of weldments; or Dry magnetic testing of less than 20% of
Fairly Effective particle testing of 50-100% of weldments; or weldments; or Manual shear wave
Dye penetrant testing of 50-100% of ultrasonic testing of 20-100% of
weldments weldments.
Dye penetrant testing of less than 50% of
Manual shear wave ultrasonic testing
Poorly Effective weldments; Visual inspection for hydrogen
of less than 20o/o of weldments.
blisters.
Ineffective No inspection Radiographic testing
Table A51D: Effectiveness of Inspection for HIC/SOHIC and HIC/SOHIC-HF.

224
 Inspection
Example: Example:
Effectiveness
Intrusive Inspection Nonintrusive Inspection
Category
Radiography (25%+)
Highly Effective Dye penetrant (25%+)
Shear wave ultrasonics (25%+)
Radiography approx. (5%)
Usually Effective Dye penetrant testing
Shear wave ultrasonics (25%+)
Spot Radiography
Fairly Effective Dye penetrant (10%+)
Spot shear wave ultrasonics
Poorly Effective Visual Visual for leaks
Ineffective No Inspection No Inspection
There is no highly effective inspection without a minimum of partial insulation removal and external VT and PT
Table A51E: Effectiveness of Inspection for PTA.

Inspection
Example: Example:
Effectiveness
Intrusive Inspection Nonintrusive Inspection
Category
Shear wave ultrasonic testing of 25% to 100% of
Dye penetrant testing of
Highly Effective weldments, transverse and parallel to the weld with the
50% to 100% of weldments.
weld cap removed.
Shear wave ultrasonic testing of 10% to 24% of
Dye penetrant testing of
Usually Effective weldments, radiographic testing of 50% to 100% of
25% to 50% of weldments.
weldments. AE test with partial insulation removal
Shear wave ultrasonic testing of less than 10% of
Dye penetrant testing of less
Fairly Effective weldments, radiographic testing of 20% to 49% of
than 25% of weldments.
weldments.
Poorly Effective Visual Visual for Leaks
Ineffective No Inspection No Inspection
Table A51F: Effectiveness of Inspection for CISCC.

Escalation of Technical Module with Time

It is assumed that the likelihood for cracking would increase with time since the last
inspection as a result of increased exposure to upset conditions and other non-normal
conditions. Therefore, the TMSF should be increased by the following relationship:

Final TMSF = TMSF * (years since last inspection for cracking)1.1

As an example, a piece of equipment/piping with a TMSF of 10 would increase to a Final TMSF

of 58 in five years without any inspection and would increase further to 125 after ten years
without inspection. This escalation factor should not be applied to PTA.

225
Adjustment to Technical Module Subfactor for On-Line Monitoring
In addition to inspection, on-line monitoring using hydrogen probes and/or key process
variables affect HIC/SOHIC susceptibility. The advantage of on-line monitoring is that
changes in SCC susceptibility as a result of process changes can be detected before significant
cracking damage occurs.
This earlier detection usually permits more timely action to be taken that should decrease
the probability of failure. For HIC/SOHIC, an on-line monitoring factor of 2 is applied if either
hydrogen probes or monitoring of key process variables are used. If both hydrogen probes
and monitoring key process variables are used, an online monitoring factor of 4 is applied.
Divide the TMSF by this factor. Do not apply this factor if the TMSF is 1. No on-line monitoring
factor should be applied for any other stress corrosion cracking mechanism.

Table A52: Technical Module Subfactor Determination.

226
16.8.1 Caustic Cracking
Description of Damage
Caustic cracking is defined as cracking of a metal under the combined action of tensile stress
and corrosion in the presence of sodium hydroxide (NaOH) at elevated temperature. The
cracking is predominantly intergranular in nature, and typically occurs as a network of fine
cracks in carbon steels; low alloy ferritic steels have similar cracking susceptibility.
There are three key parameters that determine susceptibility of steel fabrications to caustic
cracking. They are caustic concentration, metal temperature, and level of tensile stress.
Industry experience indicates that some caustic cracking failures occur in a few days, while
many require prolonged exposure of one or more years. Increasing the caustic concentration
or metal temperature accelerates the cracking rate.
Figure A12 provides information on the caustic cracking susceptibility of carbon steel. Caustic
cracking of steel is not anticipated at metal temperatures less than about 115°F. In the 115°F
to 180°F range, cracking susceptibility is a function of the caustic concentration. Above 180°F,
cracking susceptibility is a function of the caustic concentration. Above 180°F cracking is
highly likely for all concentrations above about 5% wt. Although cracking susceptibility is
significantly lower in caustic solutions with less than 5% concentration, presence of high
temperatures (approaching boiling) can cause locally higher concentrations which would
increase cracking susceptibility.
Notable case histories of this phenomenon include caustic cracking of distillation columns
when caustic is added to the column for pH control, and caustic cracking of boiler feed water
equipment or piping bolts when gasket leaks expose the bolts to feed water leaks. With regard
to temperature, the key consideration is the actual metal temperature, and not just the
normal process temperature. There are many case histories of caustic cracking of "ambient
temperature" caustic equipment that was heat traced or steamed out while still containing
caustic. As-welded or as-bent carbon and low alloy steel assemblies are susceptible to caustic
cracking because of the high level of residual stress remaining after fabrication by these
methods. Application of a post-fabrication stress-relieving heat treatment (e.g. post weld heat
treatment) is a proven method of preventing caustic cracking. A heat treatment of about
1150°F for one hour per inch of thickness (one hour minimum) is considered an effective
stress-relieving heat treatment to prevent caustic cracking of carbon steel.

Basic Data
The data listed in Table A53 are required to determine the susceptibility of carbon and low
alloy ferritic steel equipment and piping to caustic cracking. If exact process data are not
known, contact a knowledgeable process engineer to obtain the best estimates.

Determination of Susceptibility to caustic Cracking

Using basic data from Table A53, enter the decision tree in Figure A11 to determine the
susceptibility to caustic cracking.

227
References
1. Corrosion Data Survey-Metals Section, NACE International, Houston, TX, Fifth Edition
(March 1974), p.274.
2. NACE-5, Stress Corrosion Cracking of Hydrogen Embrittlement of Iron Base Alloys, Edited
by R.W. Staehle, et al., NACE International, Houston, TX, 1977, pp. 583-587.
3. P. Gegner, "Corrosion Resistance of Materials in Alkalies and Hypochlorites," Process
Industries Corrosion, NACE International, Houston TX, 1975, pp. 296-305.
4. J. K. Nelson, "Materials of Construction for Alkalies and Hypochlorites," Process Industries
Corrosion:-The Theory and Practice, NACE International, Houston, TX, 1986, pp.297-310.

Basic Data Comments

Determine the concentration of the caustic solution being handled in this
NaOH Concentration (%) equipment/piping. Take into account whether heating or flashing of water
produces higher concentration.
Determine the concentration of the caustic solution being handled in this
Maximum Process
equipment/piping. Take into account whether heating or flashing of water
Temperature
produces higher concentration.
Determine the maximum process temperature in this equipment/piping.
Heat Traced? (Yes or No)
Consider local heating due to mixing if at a caustic injection point.
Determine whether the equipment/piping has been steamed out prior to
Steamed out? (Yes or No)
water flushing to remove residual caustic.
Determine whether the equipment/piping has been properly stress
Stress Relieved? (Yes or No)
relieved after welding and cold forming.
Table A53: Basic Data Required for Analysis of Caustic Cracking.

228
Figure A11: Determination of Susceptibility to Caustic Cracking.

229
Figure A12: Caustic Soda Service Graph.

230
16.8.2 Amine Cracking
Description of Damage
Amine cracking is defined as cracking of a metal under the combined action of tensile stress
and corrosion in the presence of an aqueous alkanolamine solution at elevated temperature.
The cracking is predominately intergranular in nature, and typically occurs in carbon steels
as a network of very fine, corrosion product filled cracks. Low alloy ferritic steels are also
susceptible to amine cracking. Amine cracking is typically observed in amine treating units
which use aqueous alkanolamine solutions for removal of acid gases such as H2S and from
various gas or liquid hydrocarbon streams.
Four available parameters are used to assess the susceptibility of steel fabrications to amine
cracking. They are the type of amine, amine solution composition, metal temperature, and
level of tensile stress.
With regard to the type of amine, results of an NACE survey indicate that amine cracking is
most prevalent in monoethanolamine (MEA) and disopropanolamine (DIPA) units, and to a
somewhat lesser extent in diethanolamine (DEA) units. Cracking is much less prevalent in
methyldiethanolamine (MDEA), Sulfinol, and diglycolamine (DGA) units.
Studies have concluded that the cracking occurs in a narrow range of electrochemical
potential, which is very dependent upon the amine solution composition. Carbonate is a
critical solution contaminant, and other contaminants such as chlorides, cyanides, etc. have
been shown to affect cracking susceptibility. Despite this mechanistic understanding, the
electrochemical potential of in-service equipment and piping may not be readily available.
Amine concentration is a factor in cracking susceptibility in MEA solutions, where cracking
susceptibility has been shown to be higher in the 15 to 35% con centration range. There is
not sufficient understanding of this relationship in other amine solutions, but it is noteworthy
that cracking susceptibility is lower in MDEA and Sulfinol units which typically utilize higher
concentration amine solutions.
With regard to the amine solution composition, cracking typically occurs in the lean
alkanolamine solution which is alkaline and contains very low levels of acid gases. Amine
cracking does not occur in fresh amine solutions, i.e., those that have not been exposed to acid
gases. Amine cracking is not likely to occur in rich alkanolarnine solutions, which contain high
levels of acid gases. In rich amine solutions, other forms of cracking are far more prevalent
(see note).
With regard to temperature, amine cracking susceptibility is generally higher at elevated
temperatures. A key consideration is the actual metal temperature, and not just the normal
process temperature. Cracking has occurred in equipment and piping that normally operates
at low temperatures but was heat traced or steamed out prior to water washing to remove
residual amine solution.
With regard to the level of tensile stress, as-welded or as bent carbon and low alloy steel
fabrications are susceptible to amine cracking because of the high level of residual stress
remaining after fabrication by these methods. Application of a post-fabrication stress-
relieving heat treatment (e.g., postweld heat treatment) is a proven method of preventing
amine cracking. A heat treatment of about 150°F for one hour per inch of thickness (one hour
minimum) is considered an effective stress-relieving heat treatment to prevent amine
cracking of carbon steel.

231
Note: Other forms of cracking have been reported in amine units. Most of these occurred in
equipment and piping exposed to rich alkanolamine solutions and have typically been forms
of hydrogen damage such as sulfide stress cracking (SSC), hydrogen-induced cracking (HIC),
and stress-oriented hydrogen-induced cracking (SOHIC). These are dealt in other sections of
this module.

Basic Data
The data listed in Table A54 are required to determine the susceptibility of carbon and low
alloy ferritic steel equipment and piping to amine cracking. If exact process data are not
known, contact a knowledgeable process engineer to obtain the best estimates.

Basic Data Comments

Type of Amine Determine what type of amine is being handled in this equipment/piping
Determine what amine solution composition is being handled in this
equipment/piping. Fresh amine has not been exposed to H2S or CO2.
Lean amine contains low levels of H2S or C02
Amine Solution Composition
Rich amine contains high levels of H2S or C02
For equipment exposed to both lean and rich amine solutions (i.e., amine
contractors and regenerators), indicate lean.
Maximum Process
Determine the maximum process temperature in this equipment/piping.
Temperature
Determine whether the equipment/piping is steamtraced or electric-
Heat traced? (Yes or No)
traced (e.g., for freeze protection).
Determine whether the equipment/piping has been steamed out prior to
Steamed out? (Yes or No)
water flushing to remove residual amine.
Determine whether the equipment/piping has been properly stress
Stress Relieved? (Yes or No)
relieved after welding and cold forming.
Table A54: Basic Data Required for Analysis of Amine Cracking.

Determination of Susceptibility to Amine Cracking

Using the basic data from Table A54, enter the decision tree in Figure A13 to determine the
susceptibility to amine cracking.

232
Figure A13: Determination of Susceptibility to Amine Cracking.

233
References
1. Avoiding Environmental Cracking in Amine Units, API Recommended Practice 945, 1st
Edition, August 1990.
2. Richert, Bagdasarian, and Shargay, "Stress Corrosion Cracking of Carbon Steel in Amine
Systems;• NACE paper#187, Corrosion/87 (see also "Extent of Stress Corrosion Cracking
in Amine Plants Revealed by Survey", Oil & Gas Journal, June 5, 1989).
3. Parkins and Foroulis, "The Stress Corrosion Cracking of Mild Steel in Monoethanolamine
Solutions,"NACE paper #188, Corrosion/87 (see also Materials Performance 25, 10
(1986), pp. 20-27).
4. Lenhart, Craig, and Howell, "Diethanolamine SCC of Mild Steel;' NACE paper#212,
Corrosion/86.
5. Gutzeit and Johnson, "Stress Corrosion Cracking of Carbon Steel Welds in Amine Service,"
NACE paper #206, Corrosion/86.
6. Schutt, HU, "New Aspects of Stress Corrosion Cracking in Monoethanolamine Solutions,"
NACE paper#l59, Corrosion/88 (see also Materials Performance 27, 12 (1988), pp. 53-
58).
7. Bagdasarian, Shargay and Coombs, "Stress Corrosion Cracking of Carbon Steel in DEA and
ADIP Solutions;• Materials Performance 30, 5 (1991), pp. 63-67 (see also Oil & Gas
Journal,Jan. 13, 1992, pp. 42-44).

234
16.8.3 Sulfide Stress Cracking
Description of Damage
Sulfide stress cracking is defined as cracking of a metal under the combined action of tensile
stress and corrosion in the presence of water and hydrogen sulfide. SSC is a form of hydrogen
stress cracking resulting from absorption of atomic hydrogen that is produced by the sulfide
corrosion process on the metal surface. SSC usually occurs more readily in high strength (high
hardness) steels in hard weld deposits or hard heat-affected zones of lower-strength steels.
Susceptibility to SSC is related to the hydrogen permeation flux in the steel, which is primarily
associated with two environmental parameters-pH and H2S content of the water. Typically,
the hydrogen flux in steels has been found to be lowest in near neutral pH solutions, with
increasing flux at both lower and higher pH values. Corrosion at low pH values is caused by
H2S, whereas corrosion at high pH values is caused by high concentrations of the bisulfide
ion. Presence of cyanides at elevated pH can further aggravate the hydrogen penetration into
the steel. SSC susceptibility is known to increase with H2S content, e.g. H2S partial pressure in
the gas phase or H2S content of the water phase. The presence of as little as 1 ppm of H2S in
the water has been found to be sufficient to cause SSC.
Susceptibility to SSC is primarily related to two material parameters-hardness and stress
level High hardness of the steel increases its susceptibility to SSC. SSC has not generally been
a concern for carbon steel base metals typically used for refinery pressure vessels and piping
in wet hydrogen sulfide service because these steels have sufficiently low strength (hardness)
levels. However, weld deposits and HAZs may contain zones of high hardness and high
residual stresses from welding. High residual tensile stresses associated with welds increases
susceptibility to SSC. PWHT significantly reduces residual stresses and also tempers (softens)
weld deposits and HAZs. A post weld heat treatment of about 1150°F for one hour per inch
of thickness (one hour minimum) is considered effective for carbon steel. Somewhat higher
temperatures are required for low alloy steels. Control of hardness and reduction of residual
stresses are recognized methods for preventing SSC as outlined in NACE Standard RP0472.

Basic Data
The data listed in Table A55 are required to determine the susceptibility of carbon and low
alloy ferritic steel equipment and piping to SSC. If exact process data are not known, contact
a knowledgeable process engineer to obtain the best estimates.

Determination of Environmental Severity

If there is no water present, then the equipment/piping is considered Not Susceptible to SSC.
If there is water present, then the basic data from Table A55 on the H2S content of the water
and its pH should be used to estimate the environmental severity (potential level of hydrogen
flux) using Table A56.

Determination of Susceptibility to SCC

Using the environmental severity determined in Table A56 and the basic data from Table A55
on maximum Brinell hardness and post weld heat treatment of weldments, the susceptibility
to SSC should be determined using Table A67. A flow chart of the steps required to determine
the susceptibility to SSC is presented in Figure A14.

235
 Basic Data Comments
Presence of Water Determine whether free water is present in the equipment /piping. Consider not only
(Yes or No) normal operating conditions, but also startup, shutdown, process upsets, etc.

Determine the H2S content of the water phase. If analytical results are not readily
H2S Content of Water
available, it can be estimated using the approach of Petrie & Moore (Reference 2).
Determine the pH of the water phase. If analytical results are not readily available, it
pH of Water
should be estimated by a knowledgeable process engineer.

Presence of Cyanides Determine the presence of cyanide through sampling and/or field analysis. Consider
(Yes or No) primarily normal and upset operations but also startup and shutdown conditions.
Determine the maximum Brinell hardness actually measured at the weldments of the
Max Brinell steel equipment/piping. Report readings actually taken as Brinell, not converted
Hardness from finer techniques (e.g., Vickers, Knoop, etc.) If actual readings are not available,
use the maximum allowable hardness permitted by the fabrication specification.
PWHT of Weldments Determine whether all the weldments of the equipment/piping have been properly
(Yes or No) postweld heat treated after welding.
Table A55: Basic Data Required for Analysis of Sulfide Stress Cracking.

H2S Content of Water

pH of Water
<50 ppm 50 to 1,000 ppm 1,000 to 10,000 ppm >10,000 ppm
<5.5 Low Moderate High High
5.5 to 7.5 Low Low Low Moderate
7.6 to 8.3 Low Moderate Moderate Moderate
8.4 to 8.9 Low Moderate Moderate High
>9.0 Low Moderate High High
Note: If cyanides are present, increase the susceptibility to SSC one category for pH > 8.3 and H 2S
concentrations greater than 1,000 ppm
Table A56: Environmental Severity.

As-welded PWHT
Max Brinell Hardness Max Brinell Hardness
Environmental
<200 200-237 >237 <200 200-237 >237
Severity
High Low Medium High Not Low Medium
Moderate Low Medium High Not Not Low
Low Low Low Medium Not Not Not
Note: Actually tested as Brinell, not converted from finer techniques, e.g. Vickers, Knoop, etc
Table A57: Susceptibility to SSC.

236
Figure A14: Determination of Susceptibility of Sulfide Stress Cracking.

237
References
1. Methods and Controls to Prevent In Service Environmental Cracking of Carbon Steel
Weldments in Corrosive Petroleum Refining Environments, NACE Standard RP0472-95.
2. R. R. Petrie and E. M. Moore, Jr., "Determining the Suitability of Existing Pipelines and
Producing Facilities for Wet Sour Service," Materials Performance 28, 6 (June 1989), pp.
59-65.
3. Review of Published Literature on Wet H2S Cracking of Steels through 1989, NACE
Publication 8X294
4. Stress Corrosion Cracking and Hydrogen Embrittlement of Iron Base Alloys, NACE-5,
Edited by R. W Staehle, et. al., NACE International, Houston, TX, 1977, pp. 541-559.
5. C. M. Hudgins, et. al., "Hydrogen Sulfide Cracking of Carbon and Alloy Steels," Corrosion,
Vol. 22, pp. 238-251.
6. Guidelines for Detection, Repair, and Mitigation of Existing Petroleum Refinery Pressure
Vessels in Wet H2S Environments, NACE Standard RP0296-96.

238
16.8.3 Hydrogen Induced Cracking in Hydrogen Sulfide Services (HIC/SOHIC-H2S)
Description of Damage
Hydrogen-induced cracking is defined as stepwise internal cracks that connect adjacent
hydrogen blisters on different planes in the metal, or to the metal surface. No externally
applied stress is needed for the formation of HIC. The driving force for the cracking is high
stresses at the circumference of the hydrogen blisters caused by buildup of internal pressure
in the blisters. Interactions between these high stress fields tend to cause cracks to develop
that link blisters on different planes in the steel.
The buildup of pressure in the blisters is related to the hydrogen permeation flux in the steel.
The source of the hydrogen in the steel is the corrosion reaction with wet hydrogen sulfide.
Water must be present for this corrosion reactor to occur, and the resultant hydrogen flux is
primarily associated with two environmental Parameters-pH and H2C content of the water.
Typically, the hydrogen flux in steels has been found to be lowest in near neutral pH solutions,
with increasing flux at both lower and higher pH values. Corrosion at low pH values is caused
by H2C, whereas corrosion at high pH values is caused by high concentrations of the bisulfide
ion. Presence of cyanides at elevated pH can further aggravate the hydrogen penetration into
the steel. Hydrogen permeation is known to increase with H2C content, e.g. H2C partial
pressure in the gas phase or H2C content of the water phase. The presence of a little as 50
ppm of H2C in the water has been sufficient to cause HIC.
Hydrogen blisters are planar hydrogen-filled cavities formed at discontinuities in the steel
(e.g. voids, inclusions, laminations, sulfide inclusions). Blisters most often occur in rolled
plate steels, especially those with a banded microstructure resulting from elongated sulfide
inclusions. Susceptibility to hydrogen blistering, and therefore me is primarily related to the
quality of the plate steel, i.e., the number, size and shape of the discontinuities. In this regard,
the sulfur con tent of the steel is a key material parameter. Reducing the sulfur content of the
steel reduces the susceptibility to blistering and HIC. Additions of calcium which controls
sulfide inclusion shape control is generally beneficial.
SOHIC is defined as a stacked array of small blisters joined by hydrogen-induced cracking
that is aligned in the through thickness direction of the steel as a result of high localized
tensile stresses. SOHIC is a special form of HIC which usually occurs in the base metal,
adjacent to the heat-affected zone of a weld, where stresses are highest due to the additive
effect of applied stress (from internal pressure) and the residual stresses from welding. As
with HIC, plate steel quality is a key parameter for SOHIC susceptibility. In addition, reduction
of residual stresses by PWHT can reduce, but may not eliminate, the occurrence and severity
of SOHIC. The level of applied stress also influences the occurrence and severity of SOHIC.
Although HIC/SOHIC is much more prominent in plate steel fabrications, it has been observed
to a limited extent in steel pipe fabrications, usually in the more severe hydrogen charging
environments.

Basic Data
The data listed in Table A58 are required to estimate susceptibility of carbon steel equipment
and piping to HIC/SOHIC. If exact process data are not known, contact a knowledgeable
process engineer to obtain the best estimates. If the sulfur content of the plate steel is not
known, contact a knowledgeable materials engineer to obtain an estimate of steel quality.

239
 Basic Data Comments

Presence of Water Determine whether free water is present in the equipment/piping. Consider not
only normal operating conditions, but also startup, shutdown, process upsets,
(Yes or No) etc.
Determine the H2S content of the water phase. If analytical results are not readily
H2S Content of Water
available, it can be estimated using the approach of Petrie & Moore
Determine the pH of the water phase. If analytical results are not readily
pH of Water
available, it should be estimated by a knowledgeable process engineer.

Presence of Cyanides Determine the presence of cyanide through sampling and/or field analysis.
Consider primarily normal and upset operations but also startup and shutdown
(Yes or No) conditions.
Determine the sulfur content of the steel used to fabricate the equipment/piping.
Sulfur Content of Plate This information should be available on MTR's in equipment files. If not
Steel available, it can be estimated from the ASTM or ASME specification of the steel
listed on the U-1 form in consultation with materials engineer.
Determine what product form of steel was used to fabricate the
equipment/piping. Most equipment is fabricated from rolled and welded steel
Steel Product Form plates (e.g. A285, A515, A516, etc.), but some small-diameter equipment is
fabricated from steel pipe and piping components. Most small-diameter piping
(Plate or Pipe) is fabricated from steel pipe (e.g.Al06, A53, API 5L, etc.) and piping components
(e.g. AIOS, A234, etc.), but most large diameter piping (above approximately 16
in. diameter) is fabricated from rolled and welded plate steel.

PWHT of Weldments Determine whether all the weldments of the equipment/piping have been
(Yes or No) properly post weld heat treated after welding.

Table A58: Basic Data Required for Analysis of HIC/SOHIC-H2S.

Determination of Environmental Severity

If there is no water present, then the equipment/piping is considered not susceptible to
HIC/SOHIC. If there is water present, then the basic data from Table A59 on the H2S content
of the water and its pH should be used to estimate the environmental severity (potential level
of hydrogen flux) using Table A60.

1,000 to
pH of Water <50ppm 50 to 1000ppm >10,000ppm
10,000ppm
<5.5 Low Moderate High High
5.5 to 7.5 Low Low Low Moderate
7.6 to 8.3 Low Moderate Moderate Moderate
8.4 to 8.9 Low Moderate Moderate High
>9.0 Low Moderate High High
Note: If cyanides are present, increase the susceptibility of SCC one category for pH > 8.3 and HzS
concentrations greater than 1,000 ppm
Table A59: Susceptibility to HIC/SOHIC

240
Determination of Susceptibility to HICISONIC
For equipment and large diameter piping fabricated from rolled and welded plate steel, the
environmental severity determined in Table A59 and the basic data from Table A58 on the
sulfur content of the plate steel and postweld heat treatment, should be used to determine
the susceptibility to HIC/SOHIC using Table A60. Small diameter equipment and piping
fabricated from steel pip and piping components should be considered to have a low
susceptibility to HIC/SOHIC unless it has not been postweld heat treated and is exposed to a
high severity environment, in which case it should be considered to have a medium
susceptibility. A flow chart of the steps required to determine the susceptibility to HIC/SOHIC
is presented in Figure A15.

High Sulfur Steels Low Sulfur Steels Ultra-Low Steels

Environmental >0.01%S 0.002 to 0.01% S <0.002% S
Severity
As welded PWHT As welded PWHT As welded PWHT

High High High High Medium Medium Low

Moderate High Medium Medium Low Low Low
Low Medium Low Low Low Not Not
Table A60: Environmental Severity

241
Figure A15: Determination of Susceptibility to HIC/SOHIC.

242
References
1. R. R. Petrie and E. M. Moore, Jr., “Determining the Suitability of Existing Pipelines and
Producing Facilities for Wet Sour Service, “Materials Performance 28, 6 (June 1989), pp.
59-65.
2. R. D. Merrick, “Refinery Experiences with Cracking in Wet H2S Environments,” Materials
Performance 27, 1 (January 1988), pp. 30.
3. R. D. Merrick and M.L. Bullen, “Prevention of Cracking in Wet H2S Environments;’ NACE
Corrosion/89, paper no. 269.
4. Materials and Fabrication Practices for New Pressure Vessels Used in Wet H2S Refinery
Service, NACE Publication 8X194.
5. Review of Published Literature on Wet H2S Cracking of Steels through 1989, NACE
Publication 8X294.
6. Research Report on Chamcterization and Monitoring of Cmcking in Wet H2S Service, API
Publication 939, October 1994.
7. M. S. Cayard and R. D. Kane, “Characterization and Monitoring of Cracking of Steel
Equipment in Wet H2S Service;’ NACE Corrosion/95, Paper no. 329.
8. Guidelines for Detection, Repair, and Mitigation of Existing Petroleum Refinery Pressure
Vessels in Wet H2S Environments, NACE Standard RP0296-96.

243
16.8.4 Carbonate Cracking
Description of Damage
Carbonate cracking is a common term applied to cracking of a metal under the combined
action of tensile stress and corrosion in the presence of an alkaline sour water containing
moderate to high concentrations of carbonate. The cracking is predominantly intergranular
in nature, and typically occurs in as-welded carbon steel fabrications as a network of very
fine, oxide-filled cracks. Carbonate cracking typically propagates parallel to the weld in
adjacent base metal, but can also occur in the weld deposit or heat affected zones. The pattern
of cracking observed on the steel surface is sometimes described as a spider web of small
cracks, which often initiate at or interconnect with weld-related flaws that serve as local
stress raisers.
Carbonate cracking has been most prevalent in the catalytic cracking unit main fractionator
overhead condensing and reflux system, the downstream wet gas compression system, and
the sour water systems emanating from these areas. Assuming the presence of a sour water
phase, three key parameters are used to assess the susceptibility of steel fabrications to
carbonate cracking. They are the pH of the sour water, carbonate concentration of the sour
water, and level of tensile stress.
Studies have concluded that the cracking occurs in a narrow range of electrochemical
potential, which is very dependent upon the sour water composition. Presence of moderate
to high levels of carbonates in an alkaline sour water often produces an electrochemical
potential of steel which is in this narrow range where carbonate cracking is likely to occur.
Another common contaminant in these sour waters, cyanides, has been shown to influence
cracking susceptibility. Despite this mechanistic understanding, the electrochemical
potential of in-service equipment and piping may not be readily available. Therefore, pH and
carbonate concentration of the sour water are judged to be the key environmental
parameters influencing the susceptibility of steel fabrications to carbon ate cracking. Based
on a survey of many units reported in Reference 2, cracking susceptibility increases with
increasing pH and carbonate concentration.
With regard to the level of tensile stress, as-welded or as· bent carbon steel fabrications are
susceptible to carbonate cracking because of the high level of residual stress remaining after
fabrication by these methods. Application of a post fabrication stress-relieving heat
treatment (e.g. post weld heat treatment) is a proven method of preventing carbonate
cracking. A heat treatment of about 1150°F for one hour per inch of thickness (one hour
minimum) is considered an effective stress-relieving heat treatment to prevent carbonate
cracking of carbon steel.

Basic Data
The data listed in Table A61 are required to determine the susceptibility of carbon steel
equipment and piping to carbon ate cracking. If exact process data are not known, contact a
knowledgeable process engineer to obtain the best estimates.

244
 Basic Data Comments

Presence of Water Determine whether free water is present in the equipment/piping. Consider
not only nor mal operating conditions, but also startup, shutdown, process
(Yes or No) upsets, etc.
Presence of 50 ppm or more Determine whether 50 ppm or more H2S is present in the water phase in
H2S in the Water this equipment/ piping. If analytical results are not readily available, it
(Yes or No) should be estimated by a knowledgeable process engineer.

Determine the carbonate concentration of the water phase present in this

C03 = Concentration in
equipment/piping. If analytical results are not readily available, it should be
Water
estimated by a knowledge able process engineer.

Determine the pH of the water phase. If analytical results are not readily
pH of Water
available, it should be estimated by a knowledgeable process engineer.

Stress Relieved? Determine whether the equipment/piping has been properly stress
(Yes or No) relieved after welding and cold forming.
Table A61: Basic Data Required for Analysis of Carbonate Cracking.

Determination of Susceptibility to Carbonate Cracking

If the equipment/piping is properly stress relieved, then it is considered not susceptible to
carbonate cracking. If there is no free water present, or if the water phase present contains
less than 50 ppm H2S, the equipment/piping is considered Not Susceptible. If the
equipment/piping contains a water phase with 50 ppm or greater H2S at a pH of 7.6 or
greater, then the equipment/piping is considered susceptible. Using the basic data from Table
A61 on pH and carbonate concentration of the water phase, the susceptibility to carbonate
cracking should be determined using Table A62. A flow chart of the steps required to
determine the susceptibility to carbonate cracking is presented in Figure A16.

C03 Concentration in water

pH of Water
<100ppm 100-500ppm 500-1,000ppm >1,000ppm
7.6 to 8.3 Low Low Low Medium
8.4 to 8.9 Low Low Medium High
=9.0 Low Medium High High
Table A62: Susceptibility to Carbonate Cracking.

245
Figure A16: Determination of Susceptibility to Carbonate Cracking.

246
References
1. R. D. Merrick, “Refinery Experiences with Cracking in Wet H2S Environments;’ Materials
Performance 21, 1 (1988), pp. 30-36.
2. J. H. Kmetz and D. J. Truax, “Carbonate Stress Corrosion Cracking of Carbon Steel in
Refinery FCC Main Fractionator Overhead Systems,” NACE Paper #206, CORROSION/90.
3. H. U. Schutt, “Intergranular Wet Hydrogen Sulfide Cracking,” NACE Paper #454,
Corrosion/92 (see also “Stress Corrosion Cracking of Carbon Steel in Amine Systems:’
NACE paper #187, Corrosion/87) (see also Materials Performance 32, 11 (1993),
pp.55…).

247
16.8.5 Polythionic Acid Cracking (PTA)
Description of Damage
Polythionic acid (PTA) and sulfurous acid are major considerations in the petroleum-refining
industry, particularly in catalytic cracking, desulfurizer, hydrocracker and catalytic reforming
processes. These complex acids typically form in sulfide containing deposits during
shutdown (or ambient) conditions when the equipment and/or piping are exposed to air and
moisture. The acid environment, combined with susceptible materials of construction in the
sensitized or as welded condition, results in rapid intergranular corrosion and cracking.
Preventive measures to reduce or eliminate PTA include flushing the equipment with alkaline
or soda ash solution to neutralize sulfides immediately after shutdown and exposure to air
or purging with dry nitrogen during the shutdown to prevent air exposure, according to
recommended practices established by NACE (RP0170).
PTA and sulfurous acid will cause SCC in sensitized austenitic stainless steels and nickel-base
alloys. Cracking is always intergranular and requires relatively low tensile stresses for
initiation and propagation. As-welded, regular and high carbon grade stainless steels, such as
types 304/304H and 316/316H, are particularly susceptible to SCC in the weld HAZ. Low-
carbon (<0.03% C) are less susceptible at temperatures less than 800°F. Chemically stabilized
stain less steel grades, such as types 321 and 347 are less susceptible to PTA, particularly if
they are thermally stabilized. Susceptibility of alloys and chemically or thermally stabilized
materials to PTA can be determined by laboratory corrosion testing according to ASTM G35.

Basic Data
The data listed in Table A63 are required to determine the susceptibility of equipment or
piping to PTA. If exact process data is not known, contact a knowledgeable process engineer
to obtain the best estimates.

Basic Data Comments

Determine the material of construction of the
Material of Construction
equipment/piping.
Thermal History Determine the thermal history of the material.
(Solution Annealed, Stabilized before Consider especially whether thermal stabilization heat
welding, Stabilized after welding) treatment was performed after all welding.
Determine the maximum operating temperature of the
Maximum Operating Temperature (°F) equipment/piping. Consider any high temperature exposure
such as during decoking.
Presence of Sulfides, Moisture and
Determine whether these constituents are present in the
Oxygen:
equipment/piping. If uncertain, consult with a process
During Operation? (Yes or No) engineer. Consider whether high temperature
During Shutdown? (Yes or No) equipment/piping in sulfidic service is opened to environment
during shutdown.
Downtime Protection Used? (Yes or No)
Table A63: Basic Data Required for Analysis of Polythionic Acid Cracking.

248
Determine Susceptibility to PTA
If the process temperature is less than or equal to 800 °F, use Table A64 to determine
susceptibility. If the process temperature is greater than 800°F, use Table A65 to determine
susceptibility. A flow chart of the steps required to determine the susceptibility to PTA is
presented in Figure A17.

Solution Annealed Stabilized Before Stabilized After

(default) Welding Welding
H Grade 300 series SS High - -
L Grade 300 series SS Low Low - -
321 Stainless Steel Medium Medium Low
347 Stainless Steel, Alloy 20, Alloy
Low Low Low
625. All austenitic weld overlay
Table A64: Susceptibility to PTA-Operating Temperatures = 800°F.

Solution Annealed Stabilized Before Stabilized After

(default) Welding Welding
All regular 300 series Stainless
High - -
Steels and Allays 600 and 800
H Grade 300 series SS High - -
L Grade 300 series SS Medium - -
321 Stainless Steel High High Low
347 Stainless Steel, Alloy 20, Alloy
Medium Low Low
625. All austenitic weld overlay
Table A65: Susceptibility to PTA-Operating Temperatures > 800°F.

249
Figure A17: Determination of Susceptibility to Polythionic Acid Cracking (PTA).

250
References
1. Metals Handbook, Ninth Edition, ASM International, Metals Park, Ohio 44073, Volume 13
Corrosion, pp. 327.
2. D. R. Mcintyre and C. P. Dillon, Guidelines for Pre venting Stress Corrosion Cracking in the
Chemical Process Industries, Publication 15, Materials Technology Institute ofthe
Chemical Process Industries, 1985, pp. 69.
3. The Role of Stainless Steels in Petroleum Refining, American Iron and Steel Institute,
1977, pp. 42-4
4. Protection of Austenitic Stainless Steels and Other Austenitic Alloys from Polythionic Acid
Stress Corrosion Cracking During Shutdown of Refinery Equipment, NACE International
Recommended Practice RP0170-93, NACE International, Houston, TX.
5. D.V. Beggs and R.W. Howe “Effects of Welding and Thermal” Stabilization on the
Sensitization and Polythionic Acid Stress Corrosion Cracking of Heat and Corrosion
Resistant Alloys,” NACE International Corrosion/93 Paper 541, NACE International,
Houston, TX.
6. L. Scharfstein, “The effect of Heat Treatment in the Prevention of Intergranular Corrosion
Failures of AISI 321 Stainless Steel” Materials Performance, September 1983, pp. 22-24.
7. E. Lendvai-Linter, “Stainless Steel Weld Overlay Resistance to Polythionic acid Attack,”
Materials Performance, Volume 18, No 3, 1979, pp 9
8. K.Tamaki, S. Nakano and M. Kimura “Application of CrNi Stainless Steel Weld Metals to
Polythionic Acid Environments,” Meterials Performance, August 1987, pp 9-13
9. C.H. Samans, “Stress Corrosion Cracking Susceptibility of Stainless Steels ans Nickel-Base
Alloys in Polythionic Acids and Acid Cooper Sulfate Solution,” Corrosion, Volume 20, no.8,
August 1964, pp. 256-262.
10. R.L. Piehl, “Stress Corrosion Cracking by Sulfur Acids,” Proceesings of API division of
Refining, Volume 44(III), 1964, pp.189-197
11. S. Ahmad, M.L. Mehta, S.K. Saraf, and I.P. Saraswat, “Stress Corrosion Cracking of
Sensitized 304 Austenitic Stainless Steel in Sulfurous Acid,” Corrosion Volume 37, No.
7, July 1981, 99. 412-415.
12. S.Ahmad, M.L.Mehta, S.K. Saraf, and I.P. Saraswat, “Stress Corrosion Cracking of Sentized
304 Austenitic Stainless Steel in Petroleum Refinery Environment, ” Corrosion, Volume
38, No.6, June 1982, p. 347-353.

251
16.8.6 Chloride Stress Corrosion Cracking (ClSCC)
Description of Damage
Chloride stress corrosion cracking (ClSCC) of austenitic stainless steels can occur in a chloride
containing aqueous environment. The susceptibility to ClSCC is dependent on the
concentration of the chloride ions, the temperature, and other factors outlined in the basic
data Table A66. It should be emphasized that the chloride concentration in water within
wetting and drying conditions can be higher than the concentration measured in the bulk
solution due to partial water vaporization. Such vaporization can increase ClSCC
susceptibility. ClSCC is more likely to occur at metal temperatures above 150°F. Examples of
common sources of chlorides in a refinery are as follows:
 Chloride salts from crude oil, produced water, and ballast water
 Water condensed from process stream (process water)
 Boiler feedwater and stripping system
 Catalyst
 Insulation
 Residue from hydrotest water and other manufacturing operations
 Fumes for chemicals containing either organic or inorganic chlorides

ClSCC may occur during service or shutdown periods, if chloride containing solutions are
present, especially at temperatures above 150°F. ClSCC can occur internally (for example, by
wash-up water or fire water).
Chloride SCC is typically trans-granular and highly branched. The greatest susceptibility to
ClSCC is exhibited by austenitic stainless steels with a nickel content of 8% (e.g. 300 series
SS, 304, 316, etc.). Greater resistance is generally shown by alloys of either lower or higher
nickel contents. Duplex stainless steels with low nickel contents are generally immune to
ClSCC, as are alloys with greater than 42% nickel.

Basic Data
The data listed in Table A66 is required to determine the susceptibility of austenitic stainless
steel equipment and piping to ClSCC. If exact data is not known, contact a knowledgeable
process engineer to obtain the estimates.

Basic Data Comments

Cl- Concentration of Determine the bulk Cl- concentration of the water phase. If unknown, default
Process Water (ppm) value for ppm is >1,000. Consider Cl- content of any water present in system (i.e.
hydro test, boiler feed, steam) Also, consider the possibility of concentration of Cl-
by evaporation or upset conditions.
Operating Temperature Determine the highest operating temperature expected during operation
(OF) (consider normal and non-normal operating conditions).
pH of Process Water Determine pH of the process water. High pH solutions with high chlorides
generally are not as susceptible to cracking as low pH solution with chlorides.
Default is pH = 10.
Note: Steam traced lines are in the 130°F to 200°F range unless the operating temperature is higher than 200°F
Table A66: Basic Data Required for Analysis of CISCC.

252
Determination of Susceptibility to CISCC
Using basic data from Table A66, determine the process side susceptibility to CISCC from
Table A67 or Table A68. Then enter the decision tree in Figure A18 to determine the
susceptibility to ClSCC.

Temperature (°F) Chloride ion (ppm)

1-10 11-100 101-1,000 >1,000

<150 Low Medium Medium High
151-200 Medium Medium High High
201-300 Medium High High High
Table A67: Process Side Susceptibility to CISCC (for pH> 10)

Temperature (°F) Chloride ion (ppm)

1-10 11-100 101-1,000 >1,000

<200 Low Low Low Low
201-300 Low Low Low Medium
Table A68: Process Side Susceptibility to CISCC (for pH> 10)

253
 Figure A18: Determination of Susceptibility to CISCC.
References
1. D. R. Mcintyre and C. P. Dillon, Guideline for Preventing Stress Corrosion Cracking in the
Chemical Process Industries, Publication 15, Materials Technology Institute of the
Chemical Process Industry, 1985.
2. Stress Corrosion Cracking and Hydrogen Embrittlement of Iron Base Alloys, Edited by R.
W. Staehle, et. Al., NACE-5, NACE International, Houston, TX, 1977.
3. “Corrosion in the Petrochemical Industry,” Edited by Linda Garverick, Essential Research,
pages 118-119, ASM International, Materials Park, OH, 1994.

254
16.8.7 Hydrogen Stress Cracking in Hydrofluoric Acid Service (HSC-HF)
Description of Damage
Hydrogen stress cracking (HSC) is defined as cracking of a metal under the combined action
of tensile stress and a corrosion mechanism that produces hydrogen which may diffuse into
the metal. HSC may result from exposure to hydrogen sulfide (covered in Supplement C-
Sulfide Stress Cracking) or from exposure to hydrofluoric acid (HF) as covered in this
Supplement. HSC-HF occurs in high-strength (high hardness) steels or in hard weld deposits
or hard heat-affected zones of lower-strength steels. In addition, HSC-HF may occur in
stressed Alloy 400 if oxygen or other oxidizers are present in the HF.
Concentrated hydrofluoric acid (HF) is used as the acid catalyst in HF alkylation units. The
usual HF-in-water concentrations are 96-99+% and the temperatures are generally below
150°F. Under these conditions a fully killed (deoxidized), low sulfur, clean soft carbon steel is
the material of choice for most equipment except where close tolerances are required for
operation (i.e., pumps, valves, instruments). Where close tolerances are required and at
temperatures over 150°F to approximately 350°F, Alloy 400 is used.
Corrosion in 80% and stronger HF-in-water solutions is equivalent to corrosion in anhydrous
hydrofluoric acid (AHF,<200 ppm H20) and reference to corrosion in AHF implies an HF-in-
water concentration as low as 80%. HF acid with concentrations lower than 80% HF-in-water
are considered aqueous. Both aqueous and anhydrous HF can cause hydrogen embrittlement
of hardened carbon and alloy steels. To prevent hydrogen embrittlement in welded steel
structures, the requirements of NACE standard RP0472, Methods and Controls to Prevent In-
Service Cracking of Carbon Steel Welds in Corrosive Petroleum Refining Environments should
be followed. Welds produced by all welding methods should be hardness tested.
Alloy steel fasteners have been a source of many failures in anhydrous HF service. ASTM A193
Grade B7, chromium molybdenum steel bolts are hard and will crack in the presence of HF.
Grade B7M, the same steel tempered to a lower hardness of 201-235 Brinell may be a better
choice if contact by HF cannot be avoided. However, B7M bolts will also crack if stressed
beyond their yield point in an HF environment. Bolt torque may be difficult to control in field
flange make-up. In this case, B7 bolts may be specified and replacement of any bolt which
may have contacted HF as a result of flange leaks would be required.

Basic Data
Table A69 lists the basic data required for analysis of susceptibility to HSC-HF. The table also
provides comments regarding the data that is required.
Basic Data Comments

Presence of HF Determine whether HF may be present in the equipment/piping. Consider not only
nor mal operating conditions, but also upset conditions that may allow carryover of
(Yes or No) HF from other equipment.
Determine the maximum Brinell hardness actually measured at the weldments of the
steel equipment/piping. Reading should be made and reported using Brinell scale,
Brinell Hardness of
not converted from microhardness techniques (e.g., Vicker, Knoop, etc.).If actual
Steel Weldments
readings are not available, use the maximum allowable hardness permitted by the
fabrication specification.
PWHT of Weldments Determine whether all the weldments of the equipment/piping have been properly
(Yes or No) post weld heat treated after welding.
Table A69: Basic Data Required for Analysis of HSC-HF

255
Determination of Susceptibility to HFHSC
If HF is present in any concentration, then the equipment/ piping is potentially susceptible to
HSC-HF. The basic data from Table A69 should be used to obtain the susceptibility rating from
Table A70 for carbon steel. A flow chart of the steps required to determine the susceptibility
of equipment to HSC-HF is given in Figure A20.

Basic Data Comments

Presence of HF Determine whether HF may be present in the equipment/piping. Consider not

only normal operating conditions, but also upset conditions that may allow
(Yes or No) carryover of HF from other equipment.
PWHT of weldments Determine whether all the weldness of the equipment /piping have been
(Yes or No) properly post weld heat threated.
Determine the sulfur content of the plate steel used to fabricate the
equipment/piping. This information should be available on MTR’s in
Sulfur contents of Plate
equipment files. If not available, it can be estimated from the ASTM or ASME
Steel
specification of the steel listed on the U-1 form in the consultation with a
material engineer.
Table A69: Basic Data Required for Analysis of HIC/SOHIC-HF

As Welded PWHT
Max Brinell Hardness Max Brinell Hardness
<200 200-237 >237 <200 200-237 >237
Low Medium High Not Low High
Table A70: susceptibility to HSC-HF for Carbon and Low Alloy Steel

256
Figure A20: Determination of Susceptibility to HSC-HF

257
References
1. T. F. Degnan, "Material of Construction for Hydrofluo ric Acid and Hydrogen Auoride,"
Process Industries Corrosion, NACE, Houston, TX 1986.
2. Corrosion Resistance of Nickel-Containing Alloy in Hydrofluoric Acid, Hydrogen Fluoride
and Fluorine, Corrosion Engineering Bulletin CEB-5, The International Nickel Co., Inc.,
1968.

258
16.8.8 Hydrogen Induced Cracking in Hydroflouric Services (HIC/SOHIC-HF)
Description of Damage
Hydrogen-induced cracking is defined as stepwise internal cracks that connect adjacent
hydrogen blisters on different planes in the metal, or to the metal surface. No externally
applied stress is needed for the formation of HIC. The driving force for the cracking is high
stress at the circumference of the hydrogen blisters caused by buildup of internal pressure in
the blisters. Interaction between these high stress fields tends to cause cracks to develop that
link blisters on different planes in the steel.
The source of hydrogen in the steel is the corrosion reaction with either wet hydrogen sulfide
(covered in H.8) or hydrofluoric acid (HF). HF is used in HF alkylation units at concentrations
in the range 96-99+% HF-in-water. Exposure of carbon steel to aqueous or anhydrous HF
may result in HIC/SOHIC.
Hydrogen blisters are planar hydrogen-filled cavities formed at discontinuities in the steel
(i.e., voids, inclusions, laminations, sulfide inclusions). Blisters most often occur in rolled
plate steels with a banded microstructure resulting from elongated sulfide inclusions.
Susceptibility to hydrogen blistering, and therefore HIC, is primarily related to the quality of
the plate steel (i.e., the number, size and shape of the discontinuities). In this regard, the sulfur
content of the steel is a primary material parameter. Reducing the sulfur content of the steel
reduces the susceptibility to blistering and HIC. Addition of calcium for sulfide inclusion
shape control is generally beneficial.
SOHIC is defined as a stacked array of small blisters joined by hydrogen-induced cracking
that is aligned in the through thickness direction of the steel as a result of high localized
tensile stresses. Some is a special form of HIC which usually occurs in the base metal adjacent
to the heat-affected zone of a weld, where there are high residual stresses from welding. As
with HIC, plate steel quality is a key parameter of SOHIC susceptibility. In addition, reduction
of residual stresses by PWHT can reduce, but may not eliminate, the occurrence and severity
of some.

Basic Data
Table A71 lists the basic data required for analysis of susceptibility of carbon steel equipment
to HIC/SOHIC-HF. If the sulfur content of the steel is not known, contact a knowledgeable
materials engineer to obtain an estimate of steel quality.

Basic Data Comments

Presence of HF Determine whether HF may be present in the equipment/piping. Consider not only
normal operating conditions, but also upset conditions that may allow carryover of
(Yes or No) HF from other equipment.
PWHT of weldments Determine whether all the weldness of the equipment /piping have been properly
(Yes or No) post weld heat threated.

Determine the sulfur content of the plate steel used to fabricate the
Sulfur contents of equipment/piping. This information should be available on MTR’s in equipment files.
Plate Steel If not available, it can be estimated from the ASTM or ASME specification of the steel
listed on the U-1 form in the consultation with a material engineer.

Table A71: Basic Data Required for Analysis of HIC/SOHIC-HF

259
Determination of Susceptibility to HF HIC/SOHIC
If HF is present in any concentration, then the equipment/piping is potentially susceptible to
HIC/SOHIC-HF. Basic data from Table A71 should be used to obtain the susceptibility rating
from Table A72 for carbon steel. Piping fabricated from wrought components of conventional
steels (i.e., A 53, A 106, API 5L [not including 5LX],A 234,A 105, etc.) should be considered to
have a low susceptibility to HIC/SOHIC-HF. For equipment, and large diameter piping
fabricated from rolled and welded plate steel, the susceptibility should be determined using
Table A72. A flow chart of the steps required to determine the susceptibility is presented in
Figure A21.
The susceptibility of the steel to blistering is directly related to the cleanliness of the steel
which is measured by sulfur content. It should be recognized that blistering is not a damage
mechanism which will lead to a leak path unless it is accompanied by hydrogen-induced
cracking leading to the surface. Blistering does pose a danger to mechanical integrity when it
approaches a weld which contains sufficient residual stresses to drive the hydrogen-induced
cracking to the surfaces. It is in this last case, the most severe situation that is considered
when determining the susceptibility to HIC/SOHIC-HF.

High sulfur steel a Low sulfur steel b Ultra-low sulfur steel c

> 0.01% S > 0.002-0.01% S < 0.002% S
As welded PWHT As welded PWHT As welded PWHT
High High High Medium Medium Low
a Typically includes A 70, A 201, A 212, A 285, A 515, and most A 516.
b Typically includes early generation of HIC-resistant A516 in 198Os, with Ca additions.
c Typically includes later generation of HIC-resistant A 516n 1990s.
Table A72: Susceptibility to HIC/SOHIC –HF

260
Figure A21: Determination of Susceptibility to HIC/SOHIC HF

261
References
1. T. F. Degnan, "Material of Construction for Hydrofluoric Acid and Hydrogen Auoride,"
Process Industries Corrosion, NACE, Houston, TX 1986.
2. Corrosion Resistance of Nickel-Containing Alloy in Hydrofluoric Acid, Hydrogen Fluoride
and Fluorine, Corrosion Engineering Bulletin CEB-5, The International Nickel Co., Inc.,
1968.

262
16.9 Appendix IX: API 581:2000 Financial Risk
Financial Risk Evaluation
In the April 1995 API Base Resource Document, risk could be calculated using cost as the
measure of consequence; this was referred to as the “business interruption approach”.
However, use of this method revealed a few potentially serious shortcomings:
 The method used only the affected area as the basis of determining the cost of a failure.
This led to zero cost for equipment that had zero affected area (e.g. nonflammable,
nontoxic releases)
 The method considered only business interruption as the basis of the cost associated
with a failure.

These problems are addressed in the “Level III” approach by recognizing that there are many
costs associated with any failure of equipment in a process plant. These include, but are not
limited to:
 Cost of equipment repair and replacement
 Downtime associated with equipment repair and replacement
 Costs due to potential injuries associated with a failure
 Environmental cleanup costs.

The modified approach for Level III is to consider all of these costs on both an equipment
specific basis and an affected area basis. Thus, any failure has costs associated with it,
whether or not the failure actually results into the release of a hazardous fluid. Recognizing
and using this fact presents a more realistic value of the risk associated with a failures. Since
the costs include more than just business interruption, the approach used for Level III is
called the “financial risk” approach.

An Example for Risk Comparison of Affected Area Basis vs. Financial Basis
Table A73 shows methods similar to the Level III method mentioned above, worked into an
example from a typical distillation unit. Note the difference of the risk ranking based on
affected area compared to the risk ranking based on financial risk. There is very little
difference in the higher risk items with one very important exception: item P-31 is a pipe
containing a non-flammable and non-toxic fluid. Based on affected area, the consequence is
zero, therefore the risk is zero and only using the consequence area as the basis for risk, the
item was ranked near the very bottom of the list. When the cost of the item failure was
included, this item immediately jumped near to the top of the list. This is primarily due to a
very high Technical Module Subfactor (TSM) – The pipe is subject to a damage mechanism
and based on the technical module inputs of damage rate and past inspections, the pipe has
a high probability of failure. By allowing the costs of failure to be considered, the financial
risk pointed out that a potential for failure with repair, replacement, and downtime was to be
considered.

263
 ID Equipment Repre- Fluid Risk Risk Risk Risk Conse- Sum Damage
Type senting State ft2/yr Rank $/yr Rank quence Technical Adjusted
Fluid Ft2/yr $/yr Area ft2 Module Frequency
Subfactor

P-30 Pipe-6 Liquid C3 – 1092 1 5,573,859 1 1,296 3205.1 8.42E

C5
P-4 1 Pip->16 Liquid C17 – 193 2 936,178 2 6,487 170.6 2.97E
C25
P-42 Pipe-10 Liquid C17 – 154 3 754,536 3 5,562 185.0 2.78E
C25
c- 1 Column Vapor C6 – 133 4 651,147 4 1,322 646.9 1.01E
top C8
E-33 Exchanger Liquid C6 – 31 5 166,135 5 1,692 115.7 1.80E
-TS C8
E-37 Exchanger Liquid C6 – 31 6 166,135 6 1,692 115.7 1.8OE
-TS C8
E-39 Exchanger Liquid C6 – 31 7 166,135 7 16.92 115.7 1.8OE
-TS C8
E-52 Exchanger Liquid C25+ 22 9 161,306 8 203 683.3 1.07E

P-3 Pipe- 12 Liquid C25+ 16 11 126,325 10 190 641.6 8.66E

P” Pip-8 Liquid C9- 19 10 100,906 11 1713 80.7 1.1 3E

C12
P- 1 Pipe- 12 Liquid C25+ 8 14 75.669 12 93 653.6 8.82E

D4 Drum Liquid C6 – 12 12 69,461 13 71 1 110.2 1.72E

C8
D-10 Drum Liquid C3-C5 9 13 44,980 14 1,493 37.7 5.88E

P-11 Pipe-12 Liquid C13- 8 15 41,432 15 1,086 51.5 6.95E

C16
P-3 1 Pipe- 1 Liquid Misc. O 200 40,907 16 O 3,846.2 9.72E

P-23 Pip->16 Liquid C9- 6 16 34,437 17 1,539 23.9 4.16E

C12
E- Exchanger Liquid C25+ 5 17 24,630 18 6,194 5.2 8.16E
100
E-54 Exchanger Liquid C25+ 3 21 24,254 19 203 102.7 1.6OE

P-8 Pip-8 Liquid C13 – 4 18 22,944 20 1,610 18.9 2.73E

C16
E-42 Exchanger Liquid C25+ 3 22 22,895 21 198 98.6 1.54E

Table A73: Risk Comparison of a Typical Distillation Unit.

264
Financial Risk Methods
The basic method of risk analysis as presented in the BRD is not changed for the financial risk
analysis and risk is still calculated as the consequence of failure (now expressed as cost) times
the probability of failure. But, for a rigorous and flexible analysis, the consequences (costs)
are evaluated at the hole size level thus, risk is also evaluated at the hole size level by using
the probability of failure associated with each hole size. The total risk is calculated as the sum
of the risks from each hole size.

Equipment Damage Costs – By Specific Items

A major weakness with the original (April 1995) BRD “business interruption approach” is
that the cost of the equipment item being evaluated was not directly considered. Thus any
failure with zero affected area led to zero risk which is not realistic, since the failure of a
steam pipe has a definite cost impact, even if it does not result in a large area of damage
compared to a hydrocarbon pipe. The solution is to evaluate the cost of the equipment failure
itself, independent of whether it has an affected area or not and then all other costs can be
added. Testing of this method has resulted in nonflammable piping moving from near the
bottom of the risk ranking to near the top, especially it has a high probability of failure due to
some damage mechanism. Thus, such a pipe would be appropriately considered by Risk-
Based Inspection as a high priority candidate for inspection.
The method was tested using both a composite financial risk, based on the combination of all
possible leak scenarios (hole sizes), and using a specific cost associated with each hole size
and unique to each equipment item. The latter approach was chosen based on the inherent
differences in the costs associated with very small compared to very large holes. A small hole
in a piping system can sometimes be repaired with little or no impact on production by use
of a temporary lamp until a permanent repair can be scheduled during normal maintenance
shutdowns. Larger holes usually do not allow this option and shutdown and repair costs are
greatly increased.
Table A74 references the equipment damage costs suggested for the equipment included in
the BRD but actual failure cost data for equipment should be used if available. Note that piping
cost estimates area on per foot basis. The sources cited were used to estimate the relative
installed costs of the equipment. Since repair or replacement of equipment usually does not
involve replacement of all supports, foundations, etc., the repair and replacements costs
presented do not reflect actual installed cost.

265
 Type Description Failure Cost Failure Cost Failure Cost Failure Cost
Small* Medium* Large* Rapture*

Pump1 Centrifugal Pump, $1 ,000 $2,500 $5,000 $5,000

single seal
Pump2 Centrifugal Pump, $1 ,000 $2,500 $5,000 $5,000
double seal
ColumnBTM Column $10,000 $25,000 $50,000 $100,000
Columntop Column $10,000 $25,000 $50,000 $100,000
CompC Compressor, $10,000 $20,000 $100,000 $300,000
Centrifugal
CompR Compressor, $5,000 $10,000 $50.000 $100,000
Reciprocating
Filter Filter $1,000 $2,000 $4,000 $10,000
Fill-up FinPan Coolers $1,000 $2,000 $20,000 $40,000
Exchanger Heat Exchanger, $1,000 $2,000 $20,000 $60,000
Shell
Pipe-0.75 piping, 0.75” $5 $0 $0 $10
diameter, per ft
Pipe- 1 Piping, 1” $5 $0 $0 $20
diameter, per ft
Pipe-2 Piping, 2“ $5 $0 $0 $40
diameter, per ft
Pipe4 Piping, 4 diameter, $5 $10 $0 $60
per ft
Pipe-8 Piping, 6” $5 $20 $0 $120
diameter, per ft
Pipe- 10 Piping, 8” $5 $30 $60 $180
diameter, per ft
Pipe-12 piping, lo” $5 $40 $80 $240
diameter, per ft
Piped piping, 12” $5 $60 $120 $360
diameter, per ft
pipe-16 piping, 16 $5 $80 $160 $500
diameter, per ft
Pipe-> 16 Piping, >16“ $10 $120 $240 $700
diameter, per ft
Drum Pressure vessels $5,000 $12,000 $20,000 $40,000
Reactor Reactor $10,000 $24,000 $40,000 $80.000
-PR Reciprocating $1,000 $2,500 $5,000 $10,000
Pumps
Tank Atmospheric $40,000 $40,000 $40,000 $80,000
Storage Tank
Heater Furnace Tubes for $1,000 $10,000 $30,000 $60,000
Fired Heater
Table A74: Equipment Damage Costs.

266
The cost estimates shown in Table A74 are based on carbon steel prices. It is suggested for
the Level III approach that these costs be multiplied by a material cost factor for other
materials. Table A75 shows the suggested values for these cost factors. These factors are
based on a variety of sources from manufacturer’s data and cost quotations.

Material Cost Factor Material Cost Factor

Carbon Steel 1.0 Clad Alloy 600 7.0

1I l4 Cr ½Mo 1.3 CS “Teflon” Lined 7.8
21/4CR1/2Mo 1.7 Clad Nickel 8.0
5Cr1/2Mo 1.7 Alloy 800 8.4
7Cr1/2Mo 2.0 70/30 Cu/Ni 8.5
Clad 304 SS 2.1 904 L 8.8
9Cr1/2Mo 2.6 Alloy 20 11
405 SS 2.8 Alloy 400 15
410 SS 2.8 Alloy 600 15
304 SS 3.2 Nickel 18
Clad 316 SS 3.3 Alloy 625 26
CS “Saran” lined 3.4 Titanium 28
CS “Ruber” lined 4.4 Alloy “C” 29
316 SS 4.8 Zirconium 34
CS Glass lined 5.8 Alloy “B” 36
Clad Alloy 400 6.4 Tantalum 535
90/10 Cu/Ni 6.8 - -
Table A75: Material Cost Factors.

Equipment Damage Costs – Other Affected Equipment

As presented in the BRD, it is still necessary to calculate the equipment damage costs to other
equipment in the vicinity of the failure, if the failure results in a flammable event. It is
intended that for the Level III approach a Process Unit constant value of equipment cost per
ft2 be used as a default value for all equipment in the unit. In other words, as a starting point
the average cost of other equipment surrounding any given a piece of equipment is about the
same. This could be refined for individual equipment items by allowing the default value to
be overridden with a higher or lower value where appropriate. For illustration purposes, an
average cost of equipment used in the pilot study was $550/ft2 – this value is then multiplied
by the affected area to obtain the cost of other equipment damaged by the failure.

Business Interruption Costs – By Specific Items

Another weakness in the original (April 1995) BRD “Business Interruption” approach was
that the downtime associated with an individual equipment failure was also based on
affected area. Thus the downtime of the failure itself was not considered, and if the failure
had zero affected area, again, the cost associated with it was zero. This weakness is corrected
in much the same way that the weakness of not considering equipment damage and repair
was corrected. For each hole size, an estimated down-time for each equipment item is
presented in Table A76. Centrifugal pumps are assumed to have on-line spares, so there is no
downtime associated with the failure of these equipment types.

267
 Type Description Outage Time Outage Time Outage Time Outage Time
Short Medium Large Rupture

Pump1 Centrifugal Pump, 0 0 0 0

single seal
Pump2 Centrifugal Pump, 0 0 0 0
double seal
ColumnBTM column 2 4 5 21
Columntop Column 2 4 5 21
CompC Compressor, 2 3 7 14
Centrifugal
CompR Compressor, 2 3 7 14
Reciprocating
Filter Filter 0 1 1 1
Finfan Fin/Fan Coolers 1 1 3 5
Exchanger Heat Exchanger, Shell 1 1 3 5

Pipe-0.75 Piping, 0.75” 0 0 0 1

diameter, per ft
Pipe- 1 Piping, 1” diameter, 0 0 0 1
per ft.
Pipe-2 Piping, 2” diameter, 0 0 0 2
per ft
Pipe4 Piping, 4” diameter, 0 1 0 2
per ft
Pipe-6 Piping, 6 diameter, 0 1 2 3
per ft
Pipe-8 Piping, 8” diameter, 0 2 3 3
per ft
Pipe-10 Piping, 10’ diameter, 0 2 3 4
per ft
Pipe-12 Piping, 12” diameter, 0 3 4 4
perf t
Pipe-16 Piping, 16” diameter, 0 3 4 5
per ft
Pipe-> 16 Piping, >16” diameter, 1 4 5 7
per ft
Drum Pressure vessels 2 3 3 7
Reactor Reactor 4 6 6 14
Pump Reciprocating Pumps 0 0 0 0
Tank Atmospheric Storage 0 0 0 7
Tank
Heater Furnace Tubes for 1 2 4 5
Fired Heater
Table A76: Estimated Equipment Down Time.

268
Business Interruption Costs – Other Affected Equipment
If a failure does have an affected area, the cost of downtime for replacement and repair of
other affected equipment must be considered. The Level III approach uses the downtime
associated with a total cost of other equipment damage. Figure below shows the method.

Potential Injury Costs

Another cost to consider when a failure occurs is the potential costs of injuries. Similar to the
above mentioned example of failing to consider the business cost of a zero affected area event
that consequently led to under ranking that event with respect to risk, if injury costs are not
considered, then a risk could be present that is not considered in allocating inspection
resources.
The method for the Level III approach is to use a process unit constant of population density
as a default for all equipment in the unit. This default value can be overridden by higher or
lower values depending on specific equipment location with respect to controls rooms,
walkways, roads, etc. The costs are calculated by multiplying population density with the cost
per individual affected. This value must be sufficiently high to adequately represent typical
costs to businesses of an injury up to and including fatal injuries.

269
16.10 Appendix X: RBI 581:2000 Modification Factor
16.10.1 Equipment modification factor
An equipment modification factor, or FE, is developed for each equipment item, based on the
specific environment in which the item operates. The FE is composed of four subfactors
which will be discussed below. An overview of the equipment modification factor is showed
in Figure A22. Each sub factor is composed of several elements which are analyzed according
to well defined rules. For each element, numeric values are assigned to indicate how much
the failure frequency will deviate from generic as a result of the condition being analyzed.
Positive values are assigned for conditions that are judged to be more deleterious than
generic, and negative values are used to indicate a reduction in expected failure frequency. A
value of +10 is assigned when the condition is expected to increase failure frequency
approximately one orders of magnitude.
Throughout this portion of the RBI analysis, it is assumed that all equipment items have been
designed and fabricated in accordance with industry and company standard design practices,
unless there is specific evidence to the contrary. These standard practices are generally based
on recognized industry standards, such as ASME, TEMA, and ANSI. It is beyond the scope of
an RBI analysis to confirm design accuracy.
RBI highlights the conditions that can have an adverse influence on properly designed
equipment. The numeric values derived reflect the impact of these conditions on failure
frequency.
All numeric values assigned to quantify the rate of damage are positive numbers, since
probability of failure cannot be reduced by the existence of a damage mechanism. However,
by definition, generic failure frequency data include all equipment items, some with on-going
damage mechanisms and some without. It follows that when an equipment item has no
operative damage mechanism, it should have a failure frequency that is somewhat lower than
generic. To account for this, all equipment items are assigned a base numeric value of -2.0,
and damage mechanism values are added as appropriate. The -2.0 base adjustment value
was developed while validating a plant-wide RBI study. When no damage
mechanisms are identified, this system results in a negative numeric value for the equipment
item (and therefore a lower than generic failure frequency), all other factors being equal.
If the summed equipment factor is a negative value, it is converted as described below to
develop a positive final equipment modification factor.

270
 Figure A22: Overview of Equipment Modification Factor

After the sub factors have been analyzed, the numeric values for all the separate
determinations are summed to yield a final numeric value for the equipment item. The final
equipment modification factor is based on this value. The sum can be either positive or
negative, and it will normally range from -10 to +20, although at the start of the program, the
factor can be much higher when piece of equipment has high damage rate and a relatively
ineffective inspection history. The final numeric value is converted to FE as shown in Table
A77.
The resulting equipment modification factor is unique for each equipment item and is based
on the item’s specific operating environment.

If the sum of numeric values is… the FE is…

Less than -1.0 The reciprocal of the absolute value of the numeric
value
-1.0 to 1.0 1.0
Greater than 1.0 Equal to numeric value
Table A77: Converted Equipment Modification Factor.

271
16.10.2 Technical Modules

The Technical Modules are the systematic methods used to assess the effect of specific
failure mechanisms on the probability of failure. They use four functions:
a. Screen for the damage mechanisms under normal and upset operating conditions.
b. Establish a damage rate in the environment.
c. Quantifying the effectiveness of the inspection program.
d. Calculate the modification factor to be applied to the “generic” failure frequency.

The Technical Module evaluates two categories of information:

1. Deterioration rate of the equipment item’s material of construction, resulting from its
operating environment.
2. Effectiveness of the facility’s inspection program to identify and monitor the operative
damage mechanisms prior to failure.

Inspection techniques required to detect and monitor one failure mechanism may be totally
different from those needed for another mechanism. These differences are addressed by
creating a separate Technical Module for each damage mechanism. For some damage
mechanisms the rate of damage can be significantly greater under certain non-routine
conditions, such as temperature excursions or abnormal changes in the concentrations of a
particular contaminant. These conditions often occur during process upsets or startups and
shutdowns. The Technical Module accounts for such conditions and modifies the probability
of failure accordingly. An example of the process for developing a Technical Module is
presented in this section. The fully developed Technical Modules are presented in
Appendices F through N of API 581:2000.
The user of the RBI system should not consider procedures described in this chapter to be
all-inclusive or inviolable. This chapter is intended to establish a method for the systematic
and reproducible analysis of the factors that affect failure frequency. At the same time,
the RBI study should be conducted under the oversight of a person or persons with
appropriate technical expertise.

Analyzing the effect of in-service damage and inspection the probability of failure involves
the following seven steps:
a. Screen for damage mechanisms and establish expected damage rate.
b. Determine the confidence level in the damage rate.
c. Determine the effectiveness of inspection programs in confirming damage levels and
damage rates.
d. Calculate the effect of the inspection program on improving the confidence level of the
damage rate.
e. Calculate the probability that a given level of damage will exceed the damage tolerance of
the equipment and result in failure.
f. Calculate the technical module subfactor.
g. Calculate the composite technical module subfactor of all damage mechanisms.

272
Screen for Damage Mechanism and Establish Expected Damage Rate
The screening step consists of evaluating the combinations of process conditions and
construction materials for each equipment item, to determine what damage mechanisms are
potentially active. If no damage mechanisms are found, a technical module subfactor of -2 is
applied to that specific piece of equipment, giving a reduction from the generic probability of
failure. For the general corrosion technical module, two screening questions are used:
1. Is the corrosion rate known to be less than 1 mpy?
2. Is the equipment designed with a corrosion allowance?

If the answer to the first question is no, or alternatively if the answer to the second question
is yes, the analyst is directed to proceed with the evaluation of the equipment item. Where a
damage mechanism is identified, the rate of damage progression is generally known or can
be estimated for process plant equipment. Sources of damage rate information include:
a. Published data.
b. Laboratory testing.
c. Institute testing.
d. Experience with similar equipment.
e. Previous inspection data.

Supplements to the technical modules are being developed for specific materials-
environment combinations, and references describing the specific mechanisms are provided.
Example: For general internal corrosion, the damage rate is the corrosion rate used in an API
510 or MI 570 calculation to determine the remaining life and the inspection frequency. In
some cases, a measured of corrosion may not be available. The Technical Modules will
provide default values, typically derived from published data or from experience with similar
processes, to see until inspection results are available.

Determine the Confidence Level in the Damage Rate

The damage rate in process equipment is often not known with certainty. The ability to state
the rate of damage precisely is limited be equipment complexity, process and metallurgical
variations, inaccessibility for inspection, and limitations of inspection and test methods. The
uncertainty in the expected damage rate can be determined from historical data on the
frequency with which various damage rates occur. A realistic understanding of the
uncertainty in expected damage rates will include consideration of case histories from a
variety of familiar processes and equipment. The best information will come from operating
experiences where the conditions that led to the observed damage rate could realistically be
expected to occur in the equipment under consideration. Other sources of information could
include databases of plant experience or reliance on expert opinion. The latter method is used
most often, since plant databases, where they exists, usually do not contains efficiently
detailed information.
Example: Economical equipment design usually requires internal corrosion rates of less than
five mils per year. However, higher rates are sometimes observed. It is not very unusual to
observe corrosion rates twice what was expected or previously observed. Usually these
higher rates are detected during inspections, but sometimes the occurrence of higher-than-
expected corrosion rates is not detected until failure of the pressure boundary of the process
occurs.
273
Observed less frequently are corrosion rates as much as four times the expected rate.
Rarely are corrosion rates for uniform corrosion more than four times the rate expected.
(Localized corrosion can be significantly more variable and thus must be evaluated in a
separate technical module.) The default values provided here are expected to apply to many
plant processes. Notice that the uncertainty in the corrosion rate varies, depending on the
source and quality of the corrosion rate data.
For general internal corrosion, the reliability of the information sources used to establish a
corrosion rate can be put into the following three categories:

Low Reliability Information Sources for Corrosion Rates

a. Published data.
b. Corrosion rate tables.
c. “Default” values.

Although they are often used for design decisions, the actual corrosion rate that will be
observed in a given process situation may significantly differ from the design value.

Moderate Reliability Information Sources for Corrosion Rates

a. Laboratory testing with simulated process conditions.
b. Limited in-situ corrosion coupon testing.

Corrosion rate data developed from sources that simulate the actual process conditions
usually provide a higher level of confidence in the predicted corrosion rate.

High Reliability Information Sources for Corrosion Rates

a. Extensive field data from thorough inspections.
b. Coupon data, reflecting five or more years of experience with the process equipment
(assuming no change in process conditions has occurred).

If enough data are available from actual process experience, there is little likelihood that the
actual corrosion rate will greatly exceed the expected value under normal operating
conditions. Table A78 expresses the degree of confidence that the true damage rate falls into
the listed damager ate ranges, based on the reliability of the damage rate data.

Actual Damage Rate Low Reliability Data Medium Reliability High Reliability Data
Range Data
Predicted rate or less 0.5 0.7 0.8
Predicted rate to two 0.3 0.2 0.15
times rate
Two to four times 0.2 0.1 0.05
predicted rate
Table A78: Confidence in Predicted Damage Rate.

274
Determine the Effectiveness of Inspection Programs in Confirming Damage Levels and Damage
Rates
Inspection programs (the combination of NDE methods such as visual, ultrasonic, etc., used
to determine the equipment condition) vary in their effectiveness for locating and sizing
damage, and thus for determining damage rates. Limitations in the ability of a program to
improve confidence in the damage level result from the inability to inspect 100% of
the areas subject to damage, and from inherent limitations of some test methods to detect
and quantify damage. Probability-of-detection curves provide some information on inherent
test limitations.

The technical modules are based on three damage states defined in Table A79.
Damage State Category Example – General Corrosion
Damage State 1 The rate of general corrosion is less than or equal to
The damage in the equipment is no worse than there are predicted by past inspection records, or
what is expected based on damage rate models historical data if no inspections have been performed
or experience.

Damage State 2 The rate of general corrosion as much as twice the

The damage in the equipment is “somewhat” predicted rate.
worse than anticipated. This level of damage is
sometimes seen in similar equipment items.

Damage State 3 The rate of general corrosion is as much as four times

The damage in the equipment is “considerably” the predicted rate.
worse than anticipated. This level of damage is
rarely seen in similar equipment items, but has
been observed on occasion industry wide.

Table A79: Generic Descriptions of Damage State Categories

The effectiveness of an inspection program can be quantitatively expressed as the likelihood

that the observed damage state (and thus the predicted damage rate) actually represents the
true state. As in the previous discussion of damage rate estimates, plant information and
experience, together with expert opinion, provide information with which to express the
inspection program’s effectiveness.
In general, inspection programs are classified into one of five categories:
a. Highly effective.
b. Usually effective.
c. Fairly effective.
d. Poorly effective.
e. Ineffective.

The following section explains how the estimate of inspection effectiveness is developed and
how categories are assigned Example: For general internal corrosion, the damage rate can be
determined very effectively with a thorough inspection, but even “spot” random
measurements yield considerable information since the corrosion rate usually does not vary
much except over fairly large areas.
275
It is important to recognize that inspection codes and practices expect thickness
measurements to be taken at repeatable locations to improve the accuracy of
corrosion rate calculations. Inspection programs are described and their effectiveness
category are defined in Table A80. Default values, based on expert opinion, are provided in
Table A81, indicating the level of confidence that each of the three levels of inspection
effectiveness will accurately determine the corrosion rate.

Qualitative Inspection Effectiveness Category General Corrosion Examples

Highly Effective Assessment of general corrosion by complete

Inspection methods correctly identify the internal visual examination coupled with
anticipated in service damage in nearly every case ultrasonic thickness measurements
(90%).
Usually effective Assessment of general corrosion by partial visual
Inspection methods correctly identify the actual examination coupled with ultrasonic thickness
damage state most of the time (70%). measurements

Fairly effective Assessment of general corrosion by external spot

Inspection methods correctly identify the true ultrasonic thickness measurements
damage state in nearly half of the time ( 50%).

Poorly effective Assessment of general corrosion by hammer

Inspection methods will provide little information testing, telltale holes
to correctly identify the true damage state (40%).

Ineffective Assessment of general corrosion by external

Inspection method will provide no or almost no visual examination
information that will correctly identify the true
damage state (90%).
Table A80: Inspection Effectiveness for General Internal Corrosion

Likelihood that inspection result determines the true damage

Damage rate Range of actual Poorly/ Fairly Usually Highly

state damage rate Ineffective Effective Effective Effective

1 Measured rate or 0.33 0.5 0.7 0.9

less
2 Measured rate to 0.33 0.3 0.2 0.09
2x measured rate

3 2x to 4x measured 0.33 0.2 0.1 0.01

rate
Table A81: General Corrosion Inspection Effectiveness

276
Calculate the Effect of the Inspection Program on Improving the Confidence Level in the Damage
Rate
At this point, the Technical Module has defined the need to determine the probability of a
given damage state occurring in the equipment item being evaluated. The problem is of the
general form: “Given an expectation of a given state, and given that a test can be performed
to improve the confidence level in the expectation of that state, what is the expectation of the
state after the test is performed, if the test does not yield conclusive results?’
Problems of this type can be solved using a widely recognized statistical method called Bayes
Theorem. This theorem combines the prior probabilities p[A] (the expected state) with the
conditional probabilities, p[Bk|Ai] (the inspection effectiveness) to yield an expression for the
probability that an equipment item is in any state Ai given that the item was observed to be
in state Ak which results in observation Bk,:

Note:
p[AilBk] – posterior probabilities [%]
p[A] – expected state [%]
p[Bk|Ai] – the inspection effectiveness [%].

The probabilities, p[Ai|Bk] are called posterior probabilities. For those unfamiliar with the
equation, it can be expressed as follows: “the probability of the true state, given the state of a
sample equals [(the probability of the sample state, given the true state) times (the prior
probability of the state)] divided by [the sum over all states of (the probability of the sample
state, given the true state) times (the prior probability of the state)]”.
The power of the theorem is that it provides a formal means of incorporating
an uncertain inspection result with information on the expected condition based on
analysis or opinion. Given an expectation of the likelihoods of different damage rates, and
given inspection results that tend to indicate one rate or another, Bayes Theorem is used to
update the prior expectations. The inspection frequency and the total number of inspections
are used to perform the inspection updating. The “value” of an inspection in improving the
certainty of the damage rate can clearly determinate by using Bayes’ Theorem. The updated
confidence in damage rates is then used to calculate the amount of damage that may be
present in the equipment.
Example: For the above examples of expected damage rates and inspection effectiveness, the
updated confidence in the damage rates after inspection can be determined:
a. Corrosion rates for a new plant are estimated from corrosion tables
b. A thorough inspection is conducted after some time in operation
c. The expected corrosion rate is confirmed

277
The confidence in the expected corrosion rate can be updated by Bayes’ Theorem, as shown
in Table A82:
Damage Rate Range of Damage Rate After a Fairly After a Usually After a Highly
State Effective Effective Effective
Inspection Inspection Inspection
1 Measured rate or less 0.66 0.814 0.940

2 Measured rate to 2x 0.24 0.140 0.056

measured rate
3 2 to 4x measured rate 0.10 0.046 0.004

Table A82: Confidence in Damage Rate after Inspection.

Calculate the Frequency at which a Given Level of Damage Will Exceed the Damage Tolerance
of the Equipment and Result in Failure
The potential damage rates, represented by the uncertainty in the estimated damage rate,
will lead to different levels of damage after a given time in operation. The next step in the
Technical Module is to calculate the frequency of failure associated with a given damage state.
Failure of process equipment with respect to damage states depends on a number of random
variables, Z1, Z2 ... Zn such as maximum pressure, maximum crack size, yield strength, or
fracture toughness. The space of these quantities is divided into two regions:
a. The safe set is the region of the space that contains combinations of the basic variables, Z;,
that do not result in failure.
b. The failure set is the region of this space that contains all combinations of the variables, Z;,
that result in failure.

A mode of failure is defined by a limit state function g(Z;). The surface described by g(Zi) = 0
divides the variable into the safe set where g(Zi) > 0 and the failure set where g(Zi) < 0. For
example, the limit state function for a pressure vessel might be:

where
S = strength
L = load.

Whenever the load exceeds the strength, the vessel fails and g(SL) < 0. For a failure mode that
is described by a limit state function, the probability of failure is the probability of being in
the failure set, g(Zi) < 0. Several approaches can be used to calculate the probability of failure.
For RBI, since this is a decision-making tool, relatively simple reliability index methods have
been chosen.
The procedure used here is to “calibrate” the calculated probability of failure to the generic
failure frequency by adjusting the inputs to the reliability index so that an “accept- able” level
of damage corresponds to the generic failure frequency. This “calibrated” reliability
index model is used to calculate a failure frequency for higher damage states.

278
Example: For the case of general corrosion, the mode of failure is ductile overload, which
occurs when the flow stress in a thinned wall is exceeded by the stress caused by the applied
loads.
For the example above with different potential corrosion rates, the damage state (wall loss)
is calculated for each rate. Then the frequency of failure for each state is calculated using a
simple reliability index method.
Case Study: For the pressure vessel example, remember that the vessel has been in
service for six years. Table A83 shows the probabilities of failure that correspond to the three
different damage states.
Damage State Corrosion rate Wall loss Remaining wall Frequency of Failure
1 0.010 in./yr 0.06 0.315 8x10-6
2 0.020 in./yr 0.12 0.255 2x10-5
3 0.040 in./yr 0.24 0.135 5x10-3
Table A83: Calculated Frequency of Failure for Different Damage States

Calculate the Technical Module Subfactor

The next step in the Technical Module is to calculate the “technical module subfactor” that is
used to compare the frequency of failure due to the damage state, to the generic failure
frequency for the equipment type under consideration. The technical module subfactor is the
ratio of the frequency of failure due to damage, to the generic failure frequency, times the
likelihood that the damage level is present.
The frequency of failure for the damage state is divided by the “generic” failure frequency.
The resulting ratio shows how much more likely the equipment being analyzed is to fail as a
result of the given damage state than is the “generic” equipment item. This ratio is then
multiplied by the likelihood that the damage state exists, as updated by inspection
information.
Example: For a pressure vessel subject to general corrosion, Table A84 shows the calculated
technical module sub- factor. As an illustration of the effect of inspection updating, the
subfactor is calculated for two cases:
a. The vessel is six years old and has not yet been inspected.
b. The vessel is six years old and has received one inspection rated “usually effective.”
Note: the reduction in the technical module subfactor following the inspection.

Damage Probability “Generic” Ratio to Likelihood Partial Likelihood of Partial

State of Failure Probability “Generic” of Damage Damage Damage Damage
of Failure (before Factor (no (after Factor (one
inspection) inspection) inspection) inspection)

1 8x10 -6 1x10-4 0.08 0.5 0.04 0.81 0.06

2 2x10 -5 1x10-4 0.2 0.3 0.06 0.14 0.03
3 5x10 -3 1x10-4 50 0.2 10 0.05 2

Total Technical Module Subfactor 10 2

Table A84: Calculated Technical Module Subfactor.

279
Calculate the Composite Technical Module Subfactor for all Damage Mechanisms
A technical module subfactor is calculated for each damage mechanism that is active in the
piece of equipment. To calculate the composite (total) technical module subfactor for the
equipment, all of the individual subfactors are added. This approach has the advantage of
showing a quantitative change in the total factor if any one of the subfactors changes. The
approach also reflects that different damage mechanisms are often not completely
independent. That is, damage caused by one mechanism may influence the severity of damage
caused by another (for example, stress corrosion cracking may begin at stress concentrators
caused by pitting corrosion).

Using Measured Corrosion Rates in the Absence of Expert Opinion or Data

A serious weakness can exist in the application of RBI technology as outlined in this chapter
if the source of corro-sion rate data is not properly considered. In the model presented,
corrosion rates are always assumed to have a potential to be higher than expected, unless
this potential has been eliminated by thorough or multiple inspections. The technical module
subfactor tables for thinning are based on a simplified version of Bayesian updating that
assumes that expert opinion will generally be used to establish corrosion rates. Since such
expert opinions are fairly reliable, and generally on the conservative side, the method used
will also generally err on the conservative side. However, many plants do not have or use
expert opinion as the basis for corrosion rates, but instead rely entirely upon thickness
measurements taken by technicians who have little or no knowledge of process corrosion. In
such a case, the corrosion rate measured can be much less than the actual corrosion rate
(depending on the degree to which the corrosion is localized and upon the effectiveness level
of the inspection). In such cases, it is strongly suggested that corrosion rate estimates be
made by knowledgeable per sensing data or tools such as the Technical Module Supplements.

Two methods are suggested for establishing corrosion rates

in the absence of corrosion data, expert opinion or prior
knowledge of the type and rate of corrosion occurring in a particular system.

Method #1 – Simplified Approach

When a corrosion rate is to be used for Risk-Based Inspection in the absence of corrosion rate
data or information about localized corrosion, the question usually arises: “How much is
needed to determine the rate and type of corrosion?” It may be risky to use spot external
thickness measurements for such purposes, but it may be a waste of money to use more
thorough methods if they are not needed. The following guidelines are offered to aid in a
decision:
a. Localized corrosion likely: Use a “highly effective” methof to determine positively if
localized corrosion is occurring. These methods are described in Appendix F: Technical
Module for Thinning. Process streams that should be in thos category include any that contain
water or other conductive fluid, plus:
1. Chlorides or other halides.
2. Sulfur compounds.
3. Organic acids.

280
b. Localized corrosion possible: use a “usually effective” method to determine
positively if localized corrosion is occurring. These methods are described in Appendix
F: Technical Module for Thinning. Process streams that should be in this category include
any that do not contain water or other conductive fluid but do contain:
1. Chlorides or other halides.
2. Sulfur compounds.
3. Organic acids.
c. Localized corrosion unlikely: Use “fairly effective” method to determine positively if
localized corrosion is occurring. These methods are described in the Technical
Module for Thinning, Appendix F. Process streams that should be in this category include any
that do not contain water or other conductive fluid and also do not contain:
1. Chlorides or other halides.
2. Sulfur compounds.
3. Organic acids.

“Other conductive fluid” refers to some classes of organic chemicals that, like water, can
conduct electricity. These fluids (e.g. dimethyl formamide, n-butyl alcohol, are not normally
part of refinery process streams, but are present in some chemical plants). As a general rule,
fluids with a conductivity of less than I0-7 ohm-l cm-1 are nonconductive and therefore tend
to be noncorrosive.

Method #2-Rigorous Approach

There sometimes arises a situation in which corrosion data, expert opinion or prior
knowledge of the type and rate of corrosion do not agree with the inspection findings. If the
inspection finds higher rates of corrosion than expected, then there is little doubt that these
higher rates exist and they should be used unless they are attributed to some process upset
or unusual condition that has been corrected. On the other hand, if the inspection data shows
lower rates of corrosion than expected, then a conflict arises about which data is correct.
If the measured corrosion rates are lower than the expected corrosion rate, then repeated
observations of these lower rates must be used to “override” the expected rate, much in the
same way that repeated inspections eliminate the possibilities of higher corrosion rates using
the current methods. As more inspections are performed, or more highly effective inspections
are performed, the corrosion rate to be used approaches the measured rate from the higher
expected rate. The corrosion rate to be used will depend on the number and types of
inspections, how much lower than the expected rate is the measured rate, and also upon the
confidence level of the expert opinion or data that is used to establish expected rates.
Bayesian updating was used to generate the following tables. A factor is looked up from the
table based on the number and types of inspections. This factor is multiplied by the measured
rate to generate the rate that should be entered in the program.

281
The degree to which there is a dispute between the expected and measured rates depends in
part upon the confidence that can be placed on the expected rates. In the following tables, M9
through M11, the confidence level is described in one of three ways:
a. High-Opinion or data is very slightly conservative, lower rates are not expected.
b. Medium-Opinion or data is somewhat conservative; some chance of lower rates is
recognized.
c. Low-Opinion or data is highly conservative, significant chance of lower rates is recognized.

Example: Corrosion rate data for a piping system is well established from performance of
similar systems, and is sup- ported by published data and laboratory tests. The expected
maximum corrosion rate is 10 mpy, and it is known that the corrosion is often highly
localized. A contractor takes spot thickness measurements and reports a corrosion rate of 1
mpy. Obviously, there is reason to be skeptical about the data. Since the contractor took only
spot measurements and is not especially knowledgeable about where to take them, the
inspection effectiveness is judged as “poorly effective.” In Table A87 the factor for 1 poorly
effective inspection result-ing in a measurement of 1/10 the expected rate.
Evidence expected rate is 8.3. This factor is multiplied by the measured rate of 1 mpy yields
an input rate of 8.3 mpy. In other words, the data from the measurement has not success-
fully changed the expert opinion significantly. Note that repeated inspections and more
highly effective inspections (if they continue to observe the lower corrosion rate) will result
in the RBI input corrosion rate approaching the measured rate. The factors in tables A85 and
A86 are used similarly.

Weighted average Corrosion Rate, Measured Rate = ½ of Expected; Confidence = High

Inspection Effectiveness
No. of Inspections Highly Usually Fairly Poorly
1 1.4 1.8 1.9 1.9
2 1.0 1.5 1.8 1.9
3 1.0 1.1 1.7 1.9
4 1.0 1.0 1.5 1.8
5 1.0 1.0 1.3 1.8
6 1.0 1.0 1.2 1.7
7 1.0 1.0 1.1 1.7
8 1.0 1.0 1.1 1.6
9 1.0 1.0 1.0 1.6
10 1.0 1.0 1.0 1.5
11 1.0 1.0 1.0 1.4
12 1.0 1.0 1.0 1.3
Weighted average Corrosion Rate; Measured Rate = ½ of Expected; Confidence = Medium
Inspection Effectiveness
No. of Inspections Highly Usually Fairly Poorly
1 1.1 1.5 1.7 1.8
2 1.0 1.2 1.5 1.7
3 1.0 1.0 1.4 1.6
282
 4 1.0 1.0 1.2 1.6
5 1.0 1.0 1.1 1.5
6 1.0 1.0 1.1 1.4
7 1.0 1.0 1.0 1.4
8 1.0 1.0 1.0 1.3
9 1.0 1.0 1.0 1.2
10 1.0 1.0 1.0 1.2
11 1.0 1.0 1.0 1.2
12 1.0 1.0 1.0 1.1
Weighted average Corrosion Rate; Measured Rate = ½ of Expected; Confidence = Low

Inspection Effectiveness
No. of Inspections Highly Usually Fairly Poorly
1 1.1 1.2 1.4 1.4
2 1.0 1.1 1.2 1.4
3 1.0 1.0 1.1 1.3
4 1.0 1.0 1.1 1.3
5 1.0 1.0 1.0 1.2
6 1.0 1.0 1.0 1.2
7 1.0 1.0 1.0 1.1
8 1.0 1.0 1.0 1.1
9 1.0 1.0 1.0 1.1
10 1.0 1.0 1.0 1.1
11 1.0 1.0 1.0 1.1
12 1.0 1.0 1.0 1.1
Table A85: Measured Corrosion Rates Approximately ½ of the Expected Rate.

Weighted average Corrosion Rate, Measured Rate = ¼ of Expected; Confidence = High

Inspection Effectiveness
No. of Inspections Highly Usually Fairly Poorly
1 2.0 3.4 3.6 3.7
2 1.1 2.4 3.4 3.7
3 1.0 1.4 3.0 3.6
4 1.0 1.1 2.5 3.5
5 1.0 1.0 2.0 3.3
6 1.0 1.0 1.5 3.2
7 1.0 1.0 1.3 3.0
8 1.0 1.0 1.1 2.8
9 1.0 1.0 1.1 2.5
10 1.0 1.0 1.0 2.3
11 1.0 1.0 1.0 2.1
12 1.0 1.0 1.0 1.9
Weighted average Corrosion Rate; Measured Rate = ¼ of Expected; Confidence = Medium

283
 Inspection Effectiveness
No. of Inspections Highly Usually Fairly Poorly
1 1.3 2.4 2.9 3.1
2 1.0 1.5 2.4 3.0
3 1.0 1.1 1.9 2.8
4 1.0 1.0 1.6 2.6
5 1.0 1.0 1.3 2.4
6 1.0 1.0 1.2 2.1
7 1.0 1.0 1.1 1.9
8 1.0 1.0 1.0 1.8
9 1.0 1.0 1.0 1.6
10 1.0 1.0 1.0 1.5
11 1.0 1.0 1.0 1.4
12 1.0 1.0 1.0 1.3
Weighted average Corrosion Rate; Measured Rate = ¼ of Expected; Confidence = Low
Inspection Effectiveness
No. of Inspections Highly Usually Fairly Poorly
1 1.1 1.5 1.9 2.1
2 1.0 1.1 1.6 2.0
3 1.0 1.0 1.3 1.8
4 1.0 1.0 1.2 1.6
5 1.0 1.0 1.1 1.5
6 1.0 1.0 1.1 1.4
7 1.0 1.0 1.0 1.3
8 1.0 1.0 1.0 1.3
9 1.0 1.0 1.0 1.2
10 1.0 1.0 1.0 1.2
11 1.0 1.0 1.0 1.1
12 1.0 1.0 1.0 1.1
Table A86: Measured Corrosion Rates Approximately ¼ of the Expected Rate

Weighted average Corrosion Rate, Measured Rate = 1/10 of Expected; Confidence = High
Inspection Effectiveness
No. of Inspections Highly Usually Fairly Poorly
1 4.2 8.3 9.0 9.3
2 1.2 5.3 8.3 9.1
3 1.0 2.3 7.2 8.8
4 1.0 1.3 5.7 8.5
5 1.0 1.1 4.0 8.1
6 1.0 1.0 2.8 7.7
7 1.0 1.0 1.9 7.1
8 1.0 1.0 1.5 6.5

284
 9 1.0 1.0 1.3 5.8
10 1.0 1.0 1.1 5.2
11 1.0 1.0 1.1 4.5
12 1.0 1.0 1.0 3.9
Weighted average Corrosion Rate, Measured Rate = 1/10 of Expected; Confidence = Medium
Inspection Effectiveness

No. of Inspections Highly Usually Fairly Poorly

1 2.2 5.4 7.0 7.7
2 1.1 2.5 5.6 7.2
3 1.0 1.3 4.1 6.6
4 1.0 1.1 2.8 6.0
5 1.0 1.0 2.0 5.3
6 1.0 1.0 1.6 4.7
7 1.0 1.0 1.3 4.1
8 1.0 1.0 1.2 3.6
9 1.0 1.0 1.1 3.1
10 1.0 1.0 1.1 2.7
11 1.0 1.0 1.0 2.3
12 1.0 1.0 1.0 2.1
Weighted average Corrosion Rate, Measured Rate = 1/10 of Expected; Confidence = Low
Inspection Effectiveness

No. of Inspections Highly Usually Fairly Poorly

1 1.5 2.7 4.0 4.8

2 1.0 1.5 2.9 4.2
3 1.0 1.1 2.1 3.7
4 1.0 1.0 1.6 3.2
5 1.0 1.0 1.4 2.8
6 1.0 1.0 1.2 2.5
7 1.0 1.0 1.1 2.2
8 1.0 1.0 1.1 2.0
9 1.0 1.0 1.0 1.8
10 1.0 1.0 1.0 1.7
11 1.0 1.0 1.0 1.5
12 1.0 1.0 1.0 1.4
Table A87: Measured Corrosion Rates Approximately 1/10 of the Expected Rate.

285
16.10.3 Universal Subfactor
The universal subfactor covers conditions that equally affect all equipment items in the
facility. As a result, the information concerning these conditions needs to be collected and
recorded only once. The numeric values assigned for each of the three elements of the
subfactor are applied equally to all equipment items.
As shown in A22, the universal subfactor includes the following elements:
a. Plant condition.
b. Cold weather operation.
c. Seismic activity.

Plant Condition
This element considers the current condition of the facility being evaluated. The ranking
should be based on the professional judgment of the observer, when considering the
following characteristics:
a. The general appearance of the plant, as assessed during a plant walk through. Factors to
observe include:
1. The overall state of housekeeping.
2. Evidence of temporary repairs, particularly if it appears that the "temporary" condition
has been in place for an extended period.
3. Deteriorating paint, excessive number of steam leaks, or other evidence that routine
maintenance is being neglected.

b. Effectiveness of the plant's maintenance program, based on interviews with operations and
maintenance personnel. An effective program will:
1. Complete most maintenance activities properly the first time, with few call-backs.
2. Avoid excessive and growing backlogs of work requests.
3. Maintain a constructive relationship between maintenance and operations personnel.

c. Plant layout and construction. In its current condition, the plant should have equipment
spacing and orientation that facilitates maintenance and inspection activities. The facility
should be ranked according to the criteria in Table A88.

Plant Condition Category Numeric value

Significantly better than industry standards A -1.0

About equal to industry standards B 0

Below industry standards C +1.5

Significantly below industry standards D +4.0

Table A88: Ranking According to Plant Conditions.

286
Cold Weather Operation
Cold climates impose additional risks on plant operation. Extremely low temperatures inhibit
maintenance and inspection activities and can result in reduced operator monitoring of
outside equipment. Winter conditions can also have a direct effect on equipment item. Ice
and snow buildup can cause distortion or failure of small lines, instrument and electrical runs,
etc. In addition, frozen level controllers, cracked water lines, cracked or frozen water
containing deadlegs and plugged process lines are common winter problems. Cold weather
problems can be minimized by proper design, but they cannot be totally eliminated.
A penalty is applied based on the lowest average daily temperature at the plant site. Indoor
plants should consider lowest indoor temperature, see Table A89:

Winter Temperature Numeric Value

Above 40 F o 0

+20 F o to +40 F o 1.0

-20 F o to +20 F o 2.0

Bellow -20 F o 3.0

Table A89: Penalty for Cold Weather Operation.

Seismic Zone
A plant located in a seismically active area has a somewhat higher probability of failure than
facilities outside such areas, even when the plant has been designed to appropriate standards.
The following values are based on the seismic zones presented in ANSI A58.1, 1982 and also
partly described in Chapter 8.3.2.3 of API581:2000.

Seismic zone Numeric Value

0 or 1 0
2 or 3 1.0
4 2.0
Table A90: Penalty for Seismic Zone Operations.

Zone Category Description

Zone 1 Minor damage (Modified Mercalli intensity V and VI)

Zone 2 Moderate damage (Modified Mercalli intensity VII)

Zone 3 Major damage (Modified Mercalli intensity VIII or

greater)
Zone 4 Areas within Zone 3 close to certain major fault
systems
Table A91: Modified Mercalli Intensity Scale.

287
16.10.4 Mechanical Subfactor
The mechanical subfactor addresses conditions related primarily to the design and
fabrication of the equipment item. Information for analysis is normally found on P&ID’s, in
engineering files, etc. The numeric values generated are often different for each equipment
item.
As shown in Figure A22, this subfactor is composed of the following five elements:
 Complexity
 Construction Code
 Life Cycle
 Safety Factors
 Vibration Monitoring

Complexity
The complexity element is applied differently to equipment and piping which are handled as
separate sub-elements.

Equipment Complexity:
The generic failure frequency database does not differentiate for size and complexity for
pressure vessels, columns, heat exchangers, etc. One way of judging the complexity of an
equipment item and, in most cases, the size of the item is by determining the number of
nozzles on it. A nozzle count is easily obtained and can be applied consistently to all types of
equipment. Table A92 provides numeric values for a range of nozzle counts for all types of
pressure vessels. All nozzles of 2-inches diameter or greater should be included in the count,
including nozzles not currently in service. Manways should also be included.

Equipment item Numeric Value

-1.0 0 +1.0 +2.0
Column-Total <20 20-35 36-46 >46
Column-Half <10 10-17 18-23 >23
Compressor 2 3-6 7-10 >10
Exchanger Shell <7 7-12 13-16 >16
Exchanger-Tube <4 4-8 9-11 >11
Pump - 2-4 >4 -
Vessel <7 7-12 13-16 >16
Table A92: Nozzle Count versus Numeric Value.

288
Piping Complexity
In a typical RBI study, 60 to 80 percent of the equipment items analyzed will be piping
segments. Studies have shown that about one-third of all major equipment failures involve
points can be subject to accelerated or localized corrosion, even during normal operating
conditions. Each injection point adds a complexity factor 200f piping, more than any other
single equipment category.
Therefore, it is as important to be able to differentiate between piping segments as between
items in any other equipment category.
The generic database provides a differentiation based on pipe diameter and line length;
failure frequency for each diameter is stated in terms of failures/year/foot of length. Further
differentiation based on the complexity of the segments obtained by assigning a Complexity
Factor. This factor is the sum of the features of a piping segment that can increase the
probability of failure.

Piping complexity is comprised of the following:

a. Number of Connections
A flanged connection has a much higher probability of leaking than a welded connection. Each
flange included in the pipe segment is given a complexity factor of 10. (It is assumed that no
process lines in the plant have screwed connections, temporary clamps, or other non-
standard fittings. If such connections are in use, a significantly higher factor should be
applied, as appropriate.)

b. Number of Injection Points

Injection points are locations where relatively small quantities of potentially corrosive
materials are injected into process streams to control stream composition or other process
variables. Examples of injection points include chlorine in reformers, water injection in
overhead systems, polysulfide injection in catalytic cracking wet gas, antifoam injections,etc.
(Locations where two process streams join, e.g., mixingtees, are not considered injection
points.). Experience has shown that piping in the vicinity of injection points can be subject to
accelerated or localized corrosion, even during normal operating conditions. Each injection
point adds a complexity factor 20.

c. Number of Branches
Any line that tees into the pipe segment being evaluated, other than an injection point, is
considered a branch. Drain lines, mixing tees, relief valve branches, etc., should be included.
Each branch creates an opportunity for failure due to imposed stresses, deadleg corrosion,
fatigue, etc. Each branch has a complexity factor of 3.

d. Number of Valves
In an RBI analysis, valves are considered part of the piping. For consistency of analysis, all
valves immediately downstream of the piping segment should be considered a part of that
segment. Each block valve, control valve, drain valve, and vent valve should be included. Only
relief valves are not included in the count.
Small to medium sized leaks at valve pickings are not uncommon. Each valve adds a
complexity factor of 5.
289
The complexity factor for a piping segment is the sum of the four values above:

Since the generic failure frequency is expressed in units per foot of pipe length, the
complexity factor must also be adjusted for pipe length. The complexity factor determined
above is divided by pipe length to determine the complexity factor per foot. Numeric values
and then be assigned for each pipe segment, as shown in Table A93.

Complexity Factor/Ft Numeric Value Complexity Factor/Ft Numeric Value

<0.10 -3.0 2.0 to 3.49 1.0

0.10 to 0.49 -2.0 3.50 to 5.99 2.0

0.50 to 0.99 -1.0 6.00 to 10.00 3.0

1.00 to 1.99 0 >10.00 4.0

Table A93: Complexity Factors.

Construction Code
Codes represent the accumulated knowledge from generations of experience in the Process
Industry. While designing and fabricating an equipment item according to Code cannot assure
failure-free operation, it provides a proven and accepted basis for minimizing problems in
most applications. Codes are not always available, of course, particularly for specialty
equipment and for applications in emerging technologies.
Equipment designed and built for these end-uses can operate as safely as more conventional
Code equipment, but often reliability and predictability suffer until a greater body of
knowledge is established to improve basic designs. In addition, since there are fewer
established guidelines, variability between fabricators would be likely increase. The
following Categories differentiate between equipment items designed and built according to
current Codes, absolute Codes, or where no Codes exist. If a Code vessel has been modified,
the modification must also meet Code, or it should be considered a non-Code vessel. Numeric
values for each category are shown in Table A94. In certain cases, it may be appropriate to
use a mere numeric value for Category C. If significant industry experience has demonstrated
very good (or very poor) service for a particular type of equipment, the numeric value can be
adjusted accordingly. In no case, however, should it be less than 2.0. Values above 10.0 would
indicate a very severe problem.

Status of Code Category Numeric Value

The equipment meets the latest edition of the Code. A 0
The Code for this type of equipment has been significantly B 1.0
modified since the time of fabrication.
No formal Code existed for this type of equipment at the time of C 5.0
fabrication, or it was not fabricated to an existing Code.
Table A94: Code Status Values.

290
Life Cycle of Equipment
Frequently, the reliability of an equipment item is lower, and its probability of failure is
higher, during the items first few months or years of service. After the resolution of any initial
design problems, fabrication defects, operating difficulties, etc., the items failure frequency
remains relatively constant until near the end of its useful life, when the failure frequency
often increases again.
This evaluation is based on the design life of the equipment item and on the number of years
that the item has been in its current service. The years of service can be different from the
age of the plant: less if the item has been replaced or added, or more if the item was previously
used in another service. The design life of equipment is a function of its service in the process.
Equipment items that are subject to aggressive damage mechanisms, such as severe
corrosion or fatigue problems, will often be designed for a finite life. The probability of failure
for such items increases as they near the end of that period. Equipment operating in a more
benign environment may well not have a stated or implied design life.
Even for these items, however, some increased failure frequency can be expected after an
extended period. That period is set at 40 years in the FU31 procedure. Design life, as used in
this context, is not equivalent to economic life. Some processes are expected to have a
relatively short economic life at the time of their design, and this can influence certain design
considerations. However, unless there are known damage mechanisms that will limit the
items life, equipment in such facilities should be assumed to have a 40 year design life.
For the Life Cycle Element, both Years in Service and Design Life will need to be determined
for each equipment item. The numeric values for the Life Cycle correction are based on the
percent of the design life that has elapsed since the item entered its current service (Table
A95).

% of Designed Life Elapsed Numeric Value

0–7 2.0
7 – 75 0
76 100 1.0
>100 4.0
Table A95: Life Cycle Values.

Safety Factors
The safety factor is composed of two sub-elements:
a. Operating Pressure
The ratio of operating pressure to design pressure measures the safety factor at normal
operating conditions. Equipment operating well below design pressure should have a lower
probability of failure than an item operating at design pressure. The values in Table A96
reflect this philosophy.
b. Operating Temperature
When equipment items operate at temperatures well above normal practice and near the
upper limits for their material of construction, the failure frequency increases. Similarly,
failure frequencies higher for items that operate at abnormally low temperatures. Stresses
are created as the equipment is cooled well below ambient temperatures, causing leaks to
occur at flanges, etc. This operating temperature factor does not account for brittle fracture
of carbon or low alloy steels as a result of low temperature operation. The potential for brittle
291
fracture should be assessed as part of a Technical Module evaluation. The values in Table A97
reflect these concerns.
For operating temperatures between these upper and lower limits, the numeric value of the
operating temperature element is 0.

Vibration Monitoring Element

Wear is the most common cause of failure of rotating equipment such as pumps and
compressors. Wear-related damage can result in seal failure, shaft damage or in extreme
cases, even rupture of the pump case. Vibration monitoring can normally detect developing
problems before equipment failure occurs. The values in Table A98 should be applied to all
pumps and compressors in the study.
% of Designed Life Elapsed Numeric Value
0–7 2.0
7 – 75 0
76 100 1.0
>100 4.0
Table A96: Operating Pressure Values.

For facilities where the risk contributed by erosion or wear in the pressure-containing parts
of rotating equipment is a major concern, the RBI analyst can use the Technical Module for
thinning mechanisms. That module might provide higher modification factors, based on
material handled, service conditions, specific monitoring techniques, etc. The mechanical
subfactor is calculated by adding the factors from each of the five elements in this section.

Operating Pressure/ Numerical Value

Design Pressure
>1.0 5.0
0.9 1.0 1.0
0.7 0.89 0
0.5 0.69 -1.0
<0.5 -2.0
Table A97: Operating Temperature Values.

Numeric value

Monitoring Technique Pumps Compressors

No vibration monitoring program 0.5 1.0

Periodic vibration monitoring -2.0 0

On-line vibration monitoring -4.0 -2.0

Table A98: Values for Vibration Monitoring of Pumps and Compressors.

292
16.10.5 Process Subfactor
Conditions that are most influenced by the process and how the facility is operated are
included in the process subfactor. Information for analyzing these conditions is gathered
from operating records, discussions with operating personnel, etc. The resulting numeric
values can be universal or item specific, depending upon the circumstance. This subfactor has
the following three elements, each of which has several sub-elements:
a. Continuity of the process.
b. Stability of the process.
c. Relief valves.

Many studies have shown a disproportionate share of equipment failures during periods of
non-routine operation, e.g., startups, shutdowns, and upsets. M & M Protection Consultants
put the value at 25% for the large losses they report. This element adjusts the generic failure
frequencies r differences in process continuity and basic stability. For many facilities, the
continuity and stability values will be a constant for all equipment items. However, when
different sections of a unit can be operated independently or have inherently different
stability characteristics, specific values should be developed for each section. In a few cases,
individual pieces of equipment may require higher or lower values than the remainder of the
facility; an exothermic reactor vessel would be one example.

Continuity of the Process

Planned Shutdowns
Planned shutdowns include all outages for which the Standard Operating Procedures for
shutdown are employed. The exact amount of notice required to qualify as planned will vary
with the complexity of the process. The intent is to include only those outages where normal,
systematic shutdown procedures are employed. The average number of planned shutdowns
per year over the last three years should be used to determine the numeric value, unless that
period was atypical.
Any shutdown, even one that is carefully planned and conducted, may have the potential for
operational errors and mechanical failures. The greater the number of shutdowns, the higher
the probability of such failure. The increase in probability is normally not directly
proportional to the number of planned outages, however. It can be assumed that batch
operations and other operations with frequent planned shutdowns will have been designed
to minimize the impact of such outages. This assumption is incorporated in the values of
Table A99.

Unplanned Shutdowns
Unplanned shutdowns are those that occur with a minimum of prior planning and include
situations such as power failures, leaks, and fires. With even the best of emergency
procedures, unplanned shutdowns tend to be more hazardous than planned ones. The
numeric values assigned below reflect this (Table A100). Again, the average number of
unplanned shutdowns per year over the last three years should be used.

293
Stability of the Process
Some processes operate smoothly, day after day, with little intervention from the operators.
Others require frequent attention to adjust set points, control product quality, or change
product grades. Over time, process instability will result in significant upsets or unplanned
outages, thereby increasing failure frequency.
Number of Planned Shutdowns Numeric Value
0 to 1/year -1.0
1.1 to 3/year 0
3.1 to 6/year 2.0
>6/year 3.0
Table A99: Numeric Values for Planned Shutdowns.

The numeric value assigned for this element is based on the inherent stability of the process.
To gain insight on process stability, the RBI users should interview process, engineering, and
maintenance personnel, then review available operating records and other source
documents. The stability ranking will be based on the professional judgment of the observer.

Number of Unplanned Shutdowns Numeric Value

0 to 1/year -1.5
1.1 to 3/year 0
3.1 to 6/year 2.0
>6/year 3.0
Table A100: Numeric Values for Unplanned Shutdowns.

Factors to be considered in making this judgment include:

a. Is the chemical process particularly complex? Does the process include any exothermic
reactions or abnormally severe temperatures and pressures?
b. Has the process been involved in any major incidents at this or any other site?
c. Does the process include any unproven process technology or design concepts, or does it
require special materials of construction for piping or equipment?
d. Does the control system meet current standards, including computer control with
appropriate safety features? Is an emergency shutdown system and auxiliary power for
control systems needed for provided?
e. Do the process operators and shift supervisors have extensive training and experience in
the process? In many cases, all equipment items in a plant will be given the same ranking.
However if one section of the plants significantly more or less stable than another section,
and stability in that section does not significantly influence the remainder of the plant, then
equipment items in that section should be rated differently than the rest of the plant.

Stability Ranking Numeric Value

More stable than the average process -1.0
Process has about average stability 0
Less stable than the average process 1.0
Much less stable than the average process 2.0
Table A101: Numeric Values for Stability Rankings.

294
The assigned stability ranking is converted to a numeric value as shown in Table A101.

Relief Valves Element

The following four sub-elements deal with pressure relief valves throughout the plant
a. Maintenance program.
b. Fouling service.
c. Corrosive service.
d. Very clean service.

The RBI procedure does not address the sizing or location of specific relief valves. It is
assumed that those requirements were handled properly during initial plant design or as part
of a detailed process hazard analysis. Instead, these questions assess design and process
conditions that influence whether the relief valves will be able to function when needed.
Obviously, relief valves are most likely to function according to design when they are in clean
service and inspected and maintained properly. Deviations from these conditions increase
the probability of failure.
In many cases, the conditions affecting relief valves are more nearly universal (plant-wide)
than equipment-item specific. One relief valve often protects two or more vessels and all
attendant piping. On the other hand, some sections of the plant may present more problems
for the relief system than others. The specific situation should dictate whether the questions
are answered universally or on an item-specific basis.

Relief Valve Maintenance Program

Relief valves must be removed from service periodically for maintenance and inspection to
ensure that they will function properly. It is, however, beyond the scope of the RBI procedure
to analyze the appropriateness of the facility’s RV maintenance program. Instead, the numeric
value for this sub-element is based on the plant’s level of compliance with its RV maintenance
program.
Plant records should be consulted to determine the percent of relief valves that are overdue
for scheduled maintenance and inspection. The percentage should be based on the number
of valves overdue, compared to the total population of relief valves. If a definitive schedule
has not been established for relief valve maintenance, or if the plant does not maintain a
record of overdue valves, the default value, to be applied to all equipment items, is Category
D.
If a facility has elected to install block valves under some or all relief valves to permit them to
be removed from service during plant operation, it must have a well-defined and rigidly
enforced procedure to ensure that such block valves cannot be inadvertently closed when the
relief valve is in service. This procedure should include a requirement to seal or lock all block
valves under active relief valves in an open position. If the facility has block valves under
relief valves and does not have a written procedure to this effect, all equipment items in the
unit should be rated as Category D. It is assumed that an RV would only be removed from
service when a redundant valve is in place.

295
During the plant walk through, the observer should examine several blocks under relief
valves to determine whether they could be closed inadvertently. If any block valves are
observed that are not sealed open or otherwise prevented from being closed, all items should
be rated as Category D. Numeric values should be assigned as shown in Table A102, including
the possible penalties noted above.

Status of RV Maintenance Category Numeric Value

Less than 5% of RVs overdue A -1.0
5% to 15% of RVs overdue B 0
15% to 25% of RVs overdue C 1.0
Over 25% of RVs overdue, or deficient RV maintenance D 2.0
or block valve program
Table A102: Numeric Valves for Relief Valve Maintenance.

Fouling Service
Equipment items in process streams that contain significant amounts of polymer or other
extremely viscous material are more difficult to protect than equipment in clean streams.
Even with proper system design these materials can build up in and around the relief device
and inlet piping, blocking or restricting access to the relief valve.
A numeric value is assigned to indicate whether the relief valve is subject to fouling by
components in the process stream (Table A103). If the fouling tendency arise throughout the
plant, it may be necessary to treat this question as item or section specific.

Category Numeric Value

No significant amount of fouling A 0

Some polymer or other fouling material, with a history B 2.0
occasional buildup in portions of the system
High level of fouling, with a history of frequent buildup C 4.0
of deposits in RVs and/or other parts of the system.
Table A103: Numeric Values for Relief Valve Fouling Tendencies.

Corrosive Service
Corrosive process streams present special problems for relief systems. The process side of
the system will undoubtedly be designed to withstand the corrosive stream, but often the
internals of the relief valve are less resistant. Small leaks past valve seats can corrode valve
springgus, ides, etc., resulting in unpredictable relief valve performance. If the process stream
is considered corrosive for carbon and low alloy steel, a penalty as shown in Table A104 is
assigned unless it is known that all relief valve internals are at least as corrosion-resistant as
the process side of the valves, or unless corrosion-resistant rupture discs have been installed
under the relief valves.

Very Clean Service

Relief valves on process streams that have no identifiable fouling tendencies, corrosives, or
other contaminants should be more reliable than the average relief valves. A credit is given if
the process stream meets these requirements as shown in Table A105.
296
 Corrosive Service Numeric Value
(without corrosion-resistant design)
Yes 3.0
No 0
Table A104: Numeric Value for Corrosion Service.

Very Clean Service Numeric Value

Yes -1.0
No 0
Table A105: Numeric Values for Very Clean Service.

Summary-Equipment Modification Factor

The preceding sections have developed the Equipment Modification Factor, which is
comprised of four subfactors: Technical Module, Universal, Mechanical, and Process. In turn,
each subfactor is comprised of several elements which have been covered above.

297
16.11 Appendix XI: Definition of Reliability-Centered Maintenance (RCM)
16.11.1 Definitions of RCM
What is RCM?
Reliability-Centered Maintenance (RCM) is a logical, systematic decision making process for
defining optimum maintenance tasks. It is a process used to determine the maintenance
requirements of any physical asset in its present operating context. Also it is the detailed
analysis of the functional failures and the failure modes for the development of a maintenance
strategy to realize the inherent reliability capabilities of equipment.
RCM is based around answering seven key questions about a system
 What are the functions and associated performance standards of the system/asset
?(Function)
 In what ways does it fail to fulfill its functions? (Functional Failure)
 What causes each functional failure? (Failure Mode)
 What happens when each failure occurs? (Failure Effect)
 In what way does each failure matter? (Consequence)
 What can be done to predict or prevent each failure? (Proactive Tasks)
 What should be done if a suitable proactive task cannot be found?
 Default Actions, Maintenance strategies.

Functions
First main thing is that the operating context of the asset shall be defined. All the functions of
the asset/system shall be identified (all primary and secondary functions, including the
functions of all protective devices). Also all function statements shall contain a verb, an object,
and a performance standard (quantified in every case where this can be done).
Performance standards incorporated in function statements shall be the level of performance
desired by the owner or user of the asset/system in its operating context.
For defying assets functionality two main question should be asked:
 What is Function— what the owner or user of a physical asset or system wants it to do.
 What is assets secondary functions— Functions which a physical asset or system has to
fulfill apart from its primary function(s), such as those needed to fulfill regulatory
requirements and those which concern issues such as protection, control, containment,
comfort, appearance, energy efficiency, and structural integrity.

Functional Failures and Modes:

Functional failures
Question for functional failure is: “In what ways does it fail to fulfill its functions?” Starting
position for this question is relayed on assumption that all the failed states associated with
each function shall be identified.

298
Failure modes
If asset fail what is the cause of it, all failure modes reasonably likely to cause each functional
failure shall be identified. The method used to decide what constitutes a “reasonably likely”
failure mode shall be acceptable to the owner or user of the asset. Failure modes shall be
identified at a level of causation that makes it possible to identify an appropriate failure
management policy.
Lists of failure modes shall include failure modes that have happened before, failure modes
that are currently being prevented by existing maintenance programs and failure modes that
have not yet happened but that are thought to be reasonably likely (credible) in the operating
context. They also should include any event or process that is likely to cause a functional
failure, including deterioration, design defects, and human error whether caused by
operators or maintainers (unless human error is being actively addressed by analytical
processes apart from RCM).

Failure Effects
These effects shall describe what would happen if no specific task is done to anticipate,
prevent, or detect the failure. They should also include all the information needed to support
the evaluation of the consequences of the failure, such as:
a. What is the evidence (if any) that the failure has occurred (in the case of hidden functions,
what would happen if a multiple failure occurred)
b. What it does (if anything) to kill or injure someone, or to have an adverse effect on the
environment
c. What it does (if anything) to have an adverse effect on production or operations
d. What physical damage (if any) is caused by the failure?
e. What (if anything) must be done to restore the function of the system after the failure?

Failure Consequence Categories

The consequences of every failure mode shall be formally categorized as follows:
 the consequence categorization process shall separate hidden failure modes from evident
failure modes
 the consequence categorization process shall clearly distinguish events (failure modes
and multiple failures) that have safety and/or environmental consequences from those
that only have economic consequences (operational and non-operational consequences).
 The assessment of failure consequences shall be carried out as if no specific task is
currently being done to anticipate, prevent, or detect the failure.

Failure Management Policy Selection

The failure management selection process shall take account of the fact that the conditional
probability of some failure modes will increase with age (or exposure to stress), that the
conditional probability of others will not change with age, and the conditional probability of
yet others will decrease with age.
All scheduled tasks shall be technically feasible and worth doing (applicable and effective),
and the means by which this requirement will be satisfied as defined under failure
management policies.
If two or more proposed failure management policies are technically feasible and worth doing
299
(applicable and effective), the policy that is most cost-effective shall be selected.
The selection of failure management policies shall be carried out as if no specific task is
currently being done to anticipate, prevent or detect the failure.

Failure Management Policies Scheduled Tasks

All scheduled tasks shall comply with the following criteria:
In the case of a hidden failure mode where the associated multiple failure has safety or
environmental consequences, the task shall reduce the probability of the hidden failure mode
to an extent which reduces the probability of the associated multiple failure to a level that is
tolerable to the owner or user of the asset.
In the case of an evident failure mode that does not have safety or environmental
consequences, the direct and indirect costs of doing the task shall be less than the direct and
indirect costs of the failure mode when measured over comparable periods.
In the case of a hidden failure mode where the associated multiple failure does not have safety
or environmental consequences, the direct and indirect costs of doing the task shall be less
than the direct and indirect costs of the multiple failure plus the cost of repairing the hidden
failure mode when measured over comparable periods of time. In the case of an evident
failure mode that has safety or environmental consequences, the task shall reduce the
probability of the failure mode to a level that is tolerable to the owner or user of the asset.

On-condition tasks:
Any on-condition task (or predictive or condition-based or condition monitoring task) that is
selected shall satisfy the following additional criteria:
 there shall exist a clearly defined potential failure
 there shall exist an identifiable P-F interval (or failure development period)
 the task interval shall be less than the shortest likely P-F interval
 it shall be physically possible to do the task at intervals less than the P-F interval
 the shortest time between the discovery of a potential failure and the occurrence of the
functional failure (the P-F interval minus the task interval) shall be long enough for
predetermined action to be taken to avoid, eliminate, or minimize the consequences of
the failure mode.

Scheduled discard tasks:

Any scheduled discard task that is selected shall satisfy the following additional criteria:
 There shall be a clearly defined (preferably a demonstrable) age at which there is an
increase in the conditional probability of the failure mode under consideration.
 A sufficiently large proportion of the occurrences of this failure mode shall occur after
this age to reduce the probability of premature failure to a level that is tolerable to the
owner or user of the asset.

300
Scheduled restoration tasks
Any scheduled restoration task that is selected shall satisfy the following additional criteria:
 There shall be a clearly defined (preferably a demonstrable) age at which there is an
increase in the conditional probability of the failure mode under consideration.
 A sufficiently large proportion of the occurrences of this failure mode shall occur after
this age to reduce the probability of premature failure to a level that is tolerable to the
owner or user of the asset.
 The task shall restore the resistance to failure (condition) of the component to a level that
is tolerable to the owner or user of the asset.

Failure-finding tasks
Any failure-finding task that is selected shall satisfy the following additional criteria (failure-
finding does not apply to evident failure modes):
 The basis upon which the task interval is selected shall take into account the need to
reduce the probability of the multiple failure of the associated protected system to a level
that is tolerable to the owner or user of the asset.
 The task shall confirm that all components covered by the failure mode description are
functional.
 The failure-finding task and associated interval selection process should take into
account any probability that the task itself might leave the hidden function in a failed
state.
 It shall be physically possible to do the task at the specified intervals.

Failure Management Policies

One time changes
The RCM process shall endeavor to extract the desired performance of the system as it is
currently configured and operated by applying appropriate scheduled tasks.
 In cases where such tasks cannot be found, one-time changes to the asset or system may
be necessary, subject to the following criteria
 In cases where the failure is hidden, and the associated multiple failure has safety or
environmental consequences, a one-time change that reduces the probability of the
multiple failure to a level tolerable to the owner or user of the asset is compulsory
 In cases where the failure mode is evident and has safety or environmental consequences,
a one-time change that reduces the probability of the failure mode to a level tolerable to
the owner or user of the asset is compulsory
 In cases where the failure mode is hidden, and the associated multiple failure does not
have safety or environmental consequences, any one-time change must be cost-effective
in the opinion of the owner or user of the asset
 In cases where the failure mode is evident and does not have safety or environmental
consequences, any one-time change must be cost-effective in the opinion of the owner or
user of the asset.

301
 Run-to-failure
Any run-to-failure policy that is selected shall satisfy the appropriate criterion as follows:
 In cases where the failure is hidden and there is no appropriate scheduled task, the
associated multiple failure shall not have safety or environmental consequences
 In cases where the failure is evident and there is no appropriate scheduled task, the
associated failure mode shall not have safety or environmental consequences.

RCM Benefits
Implementation of RCM usually is followed by the benefits such as:
 Safety & environmental integrity improvement
 Improved operating performance
 Improved maintenance cost effectiveness
 Maximized useful life of assets
 Maintenance strategy information & decisions fully documented
 Clearly identifies manpower & spares resource requirements
 Helps to build good teamwork

16.11.2 RCM Process overview

 Define The RCM Boundaries and Operating Context
 FMEA – Failure Mode and Effect Analyses
 FCA – Failure Characteristic Analyses
 MSS – Maintenance Strategy Selection
 Task Alignment of Maintenance Tasks
 Task Description & Detail
 Monitor & Update Implementation

Operating context
An operating context statement for a physical asset typically includes a brief overall
description of how it is to be used, where it is to be used, overall performance criteria
governing issues such as output, throughput, safety, environmental integrity, and so on.
Specific issues that should be documented in the operating context statement include:
a. Batch versus flow processes: whether the asset is operating in a batch (or intermittent)
process or a flow (or continuous) process
b. Quality standards: overall quality or customer service expectations, in terms of issues such
as overall scrap rates, customer satisfaction measurements (such as on-time performance
expectations in transportation systems, or rates of warranty claims for manufactured goods),
or military preparedness
c. Environmental standards: what organizational, regional, national, and international
environmental standards (if any) apply to the asset?
d. Safety standards: whether any predetermined safety expectations (in terms of overall
injury and/or fatality rates) apply to the asset

302
 e. Theater of operations: characteristics of the location in which equipment is to be operated
(arctic versus tropical, desert vs. jungle, onshore vs. offshore, proximity to sources of supply
of parts and/or labor, etc.)
f. Intensity of operations: in the case of manufacturing and mining, whether the process of
which the equipment forms a part is to operate 24 hours per day, seven days per week, or at
lower intensity. In the case of utilities, whether the equipment operates under peak load or
base load conditions.
g. Redundancy: whether any redundant or standby capability exists, and if so what form it
takes
h. Work-in-process: the extent to which work-in-process stocks (if any) allow the equipment
to stop without affecting total output or throughput
i. Spares: whether any decisions have been made about the stocking of key spares that might
impinge on the subsequent selection of failure management policies
j. Market demand/raw material supply: whether cyclic fluctuations in market demand
and/or the supply of raw materials are likely to impinge on the subsequent selection of failure
management policies. (Such fluctuations may occur over the course of a day in the case of an
urban transport business, or over the course of a year in the case of a power station, an
amusement park, or a food processing business.).

In the case of very large or very complex systems, it might be sensible to structure the
operating context in a hierarchical fashion, if necessary starting with the mission statement
of the entire organization that is using the asset.

16.11.3 Primary functions

RCM Question 1 “What are the functions…”
 Define the Primary Function “What It Is Required To Do” – not the Design
 Define the Performance Standards “Quantitative rather than Qualitative”
 Define the Tolerances on the Performance Standard “Minimum, Maximum, Nominal, etc.”.
PRIMARY FUNCTIONS are the reason why any organization acquires any asset or system is
to fulfill a specific function or functions. These are known as primary functions of the asset.

Functional descriptions
Function description – “to be capable of safely transporting people and luggage from A to B”
Protective function statements need special handling. For example, the function of a pressure
safety valve may be described as follows: “To be capable of relieving the pressure in the boiler
if it exceeds 25 bar.”

Performance standards
Owners are satisfied if their assets generate a satisfactory return on the investment made to
acquire them (usually financial return for commercial operations, or other measures for non-
commercial operations). Users are satisfied if each asset continues to do whatever they want
it to do to a standard of performance that they—the users—consider satisfactory. Finally,
society as a whole is satisfied if assets do not fail in ways that threaten public safety and the
environment.

303
This means that if we are seeking to cause an asset to continue to function to a level that is
satisfactory to the user, then the objective of maintenance is to ensure that assets continue to
perform above the minimum level that is acceptable to those users. If it were possible to build
an asset that could deliver the minimum performance without deteriorating in any way, then
it would be able to run continuously, with no need for maintenance.
However, deterioration is inevitable, so it must be allowed for. This means that when any
asset is put into service, it must be able to deliver more than the minimum standard of
performance desired by the user. What the asset is able to deliver at this point in time is
known as its initial capability. This means that performance can be defined in two ways:
a. Desired performance (what the user wants the asset to do)
b. Built-in capability (what it can do).

Figure A23: Different levels of performance

The margin for deterioration must be large enough to allow for a reasonable amount of use
before the component degrades to functional failure, but not so large that the system is “over-
designed” and hence too expensive. In practice, the margin is adequate in the case of most
components, so it is usually possible to develop maintenance programs accordingly.
However if the desired performance is higher than built-in capability, no amount of
maintenance can deliver the desired performance, in which case the asset is not maintainable.
All this means that, in order to ascertain whether an asset can be maintained, we need to
know both kinds of performance: the built-in capability of the asset, and the minimum
performance that the user is prepared to accept in the context in which the asset is being
used. This minimum performance is the performance standard that must be incorporated in
the function statement.
Some examples are performance standards:
 at speeds between 0 and 120 km/h
 maximum weight limit of 500kg
 minimum fuel consumption of 15 km/l

304
Note that users and maintainers often have significantly different views about what
constitutes acceptable performance. As a result, in order to avoid misunderstandings about
what constitutes “functional failure,” the minimum standards of acceptable performance
must be clearly understood and accepted by the users and maintainers of the asset, together
with anyone else who has a legitimate interest in the behavior of the asset.
Performance standards must be quantified where possible, because quantitative standards
are clearer and more precise than qualitative standards. Occasionally it is only possible to use
qualitative standards, for example when dealing with functions relating to appearance. In
such cases, special care must be taken to ensure that the qualitative standard is understood
and accepted by users and maintainers of the asset.

Secondary functions:
 Environmental integrity
 Safety, structural integrity
 Control, containment, comfort
 Appearance
 Protection
 Economy, efficiency
 Superfluous.

Environmental integrity
These functions define the extent to which the asset must comply with the corporate,
municipal, regional, national, and international environmental standards or regulations that
apply to that asset. These standards govern such things as the release of hazardous materials
into the environment, and noise.
Some examples are i.e. compliance with regulations covering:
 noise
 working temperatures
 pollution discharges to the atmosphere
 effluent discharges
 international, national, local or company standards and regulations.

Structural / Safety Functions

It is sometimes necessary to write function statements that deal with specific threats to safety
that are inherent in the design or operation of the process (as opposed to safety threats that
are a result of a functional failure). For example, the function of electrical insulation on a
domestic appliance is “to prevent users from touching electrically live components.”
Safety integrity examples
 Pressure Regulations
 HSE.

Many assets have a secondary function of providing support for or a secure mount for another
item. For example, while the primary function of a wall may be to protect people and
equipment from the weather, it might also be expected to support the roof, or to bear the
weight of shelves and pictures.
305
Integrity of structures examples:
 corrosion protection, etc.
 safe working loads
 fixings and mountings.

Control Functions
In many cases, users not only want assets to fulfil functions to a given standard of
performance, but they also want to be able to regulate the performance. This expectation is
summarized in separate function statements. For example, a function of a cooling system may
be to regulate temperature at will between one specific temperature and another. Indication
and feedback form an important subset of the control category of functions.
Examples of control functions:
 Temperature
 Pressure, flows
 Chemical dosing
 Variable speed.

To provide information
 Gauges, dials
 Control panels.

Containment Functions
Containment— Systems whose primary function is to store materials must also contain them.
Similarly, systems that transfer materials—especially fluids—also have a containment
function. These functions must be specified as well.
Some examples of containment functions:
 Storage Containment
 Tanks
 Vessels
 Thermal Insulation.

Some examples of transfer containment (fluid, gas, air)

 Pipes
 Joints
 Seals.

Comfort Functions
Owners and users generally expect that their assets or systems will not cause pain or anxiety
to operators or maintainers. These problems should of course be dealt with at the design
stage. However deterioration or changing expectations can lead to unacceptable levels of pain
or anxiety. The best way to ensure that this does not happen is ensure that the associated
function statements are described precisely and that they fully reflect current standards
 Human Discomfort (Ergonomics)

306
 Adjustable Height
 Glazing Visibility
 Lighting Levels
 Equipment Operability
 Quick Release Mechanism
 Swinging Control Panels.

Appearance Functions
Appearance often constitutes an important secondary function. For example, the primary
reason for painting most industrial equipment is to protect it from corrosion. However a
bright color may be chosen to enhance its visibility for safety’s sake, and this function should
also be documented

Protection Functions
Protective functions avoid, eliminate, or minimize the consequences of the failure of some
other function. These functions are associated with devices or systems that:
 Warn people of abnormal conditions
o sensors, switches, alarms, etc
 Trip or stop equipment when fault occurs
o high priority alarms
 Relieve abnormal conditions
o safety or relief valves, bursting discs, etc.
 Take over the duty role
o standby equipment or systems
 Prevent dangerous situations from arising in the first place
o warning signs, protective covers.

A protective function ensures that the failure of the function being protected is much less
serious than it would be without the protection. The associated devices are incorporated into
systems to reduce risk, so their functions should be documented with special care.

Efficiency / Economy Functions

In most organizations, overall cost expectations are expressed in the form of expenditure
budgets. However for specific assets, cost expectations can be addressed directly by
secondary function statements concerning such things as energy consumption rates and the
rate of attrition of process materials.
Some examples are:
 dosing levels
 heating efficiency
 motor drawn current
 fuel economy
 water usage
 recovery, etc.

307
 Superfluous functions
Some systems incorporate items or components that are found to be completely superfluous.
This usually happens when equipment or the way in which it is used has been modified over
a period of years, or when new equipment has been over-specified.
Although such items have no positive function and are often costly to remove, they can in fact
fail and thus reduce overall system reliability. To avoid this, some may require maintenance
and so consume resources.
If they are removed, the associated failure modes and costs will also be removed. However,
before their removal can be recommended with confidence, their functions need to be clearly
identified and understood.

16.11.4 Functional failure

RCM Question 2 “In what ways can it fail”?
A functional failure is defined as the inability of an asset to fulfill a function to a standard of
performance which is acceptable to the user. This definition covers complete loss of function
and situations where the asset still functions but performs outside acceptable limits
(performance standard).
Functional failures can be classified into one of three groups:
 when capability drops below user desired performance after the asset enters service
 when desired user performance rises above capability after the asset enters service
 when the asset is not capable of doing what is wanted from the outset.

The majority of ‘maintenance significant’ failure modes are associated with the first category.
Functional failures are described as “fails to be capable of …”
Partial failures need to be identified separately because they are nearly always caused by
different failure modes from total failures, and because the consequences are also nearly
always different.

Failure modes
RCM question 3 “What causes it to fail”?
 Zero based – no maintenance is done
 A failure mode is any event which could cause a functional failure – past, future &
currently prevented
 All failure modes which are reasonably likely to cause a functional failure should be
identified
 The root cause of failure modes should be identified.

Failure effects
 Failure effects should describe the following:
 Evidence (if any) that the functional failure has occurred (alarms, indication etc.)
 The effects on safety or the environment
 The effect on production/operation (economic or service level)

308
 Potential secondary damage to other equipment
 Downtime or repair actions with estimated time (loss of function to the restoration of
function).

Sources of Information about Failure Modes

Failure modes that have occurred before on the same or similar assets are the most obvious
candidates for inclusion in the list of failure modes, unless something has been changed in
such a way that the failure mode cannot occur again. Sources of information about these
failure modes include people who know the asset well (operators, maintainers, equipment
vendors, or other users of the same equipment), technical history records, and data banks.
Failure modes that are the subject of existing proactive maintenance routines should also be
incorporated in the list of failure modes. One way to ensure that none of these failure modes
has been overlooked is to study existing maintenance schedules for identical or very similar
assets and ask, “what failure mode would occur if this task was not performed?” However
existing schedules should only be reviewed as a final check after the rest of the RCM analysis
has been completed, in order to reduce the possibility of perpetuating the status quo.
Finally, the list of failure modes should include failure modes that have not yet occurred but
that are considered to be real possibilities in the context under consideration. Identifying and
deciding how to deal with failure modes that have not happened yet is an essential feature of
proactive management in general, and of risk management in particular. It is also one of the
most challenging aspects of the RCM prospect, because it calls for a high degree of judgment
applied by skilled and knowledgeable people.

Failure classification
RCM Question 5: “In what way does each failure matter?”
Failure classification specifies the impact of failures (i.e. the consequence or extent to which
each failure matters):
 Hidden or evident under normal conditions
 Safety or environmental
 Operational (economic or service level)
 Non-operational.

309
 Figure A24: Failure Classification Decision Tree

Hidden & Evident Failures

Hidden failures: a hidden failure is one, which will not become evident to the operating crew
under normal circumstances if it occurs on its own, for example protective devices.
Evident failures: an evident failure is one which will on its own eventually become evident to
the operating crew under normal circumstances, for example, alarms activate, flow stops.

Safety / Environmental Failures

A failure has safety consequences if it causes a loss of function or damage which could hurt
or kill someone. A failure has environmental consequences if it causes a loss of function or
damage which could lead to a breach of any known environmental standard or regulation.
For failure modes which have safety or environmental consequences, a proactive task is only
worth doing if it reduces the probability of the failure to a tolerably low level.
A selected list of examples includes:
a. Increased risk of fire or explosion
b. The escape of hazardous chemicals
c. Electrocution
d. Vehicle accidents or derailments
e. Ingress of dirt into food or pharmaceutical products
f. Exposure to sharp edges or moving machinery

Operational Failures
Failure has operational consequences if it has a direct adverse effect on operational
capability.
For failure modes with operational consequences, a proactive task is worth doing if, over a
period of time, it costs less than the cost of the operational consequences plus the cost of
repairing the failure which it is meant to prevent.
310
Non-Operational Failures
A failure has non-operational consequences if it has no direct adverse effect on safety, the
environment or operational capability.
For failure modes with non-operational consequences, a proactive task is worth doing if, over
a period of time, it costs less than the cost of repairing the failure which it is meant to prevent.

Failure Characteristic Analyses

Information of the asset conditions that give prior warning of the failure mode:
 time intervals between the onset of failure and catastrophic failure (for age-related
failure)
 time intervals before the onset of failure (indicates periods when failures will be unlikely)
 useful and safe life (for random failure)
 estimates can be used if no other data is available.

Figure A25: Failure Characteristic Patterns

Relationship between age and failure

The failure management selection process shall take account of the fact that the conditional
probability of some failure modes will increase with age (or exposure to stress), that the
conditional probability of others will not change with age, and the conditional probability of
yet others will decrease with age.
Patterns A and B both display a point at which there is a rapid increase in the conditional
probability of failure (sometimes called a “wear-out zone”). Pattern C shows a steady increase
in the probability of failure, but no distinct wear-out zone. Pattern D shows low conditional
probability of failure when the item is new or just out of the shop, then a rapid increase to a
constant or very slowly increasing level, while pattern E shows a constant conditional
probability of failure at all ages (random failure). Pattern F starts with high infant mortality,
dropping to a constant or very slowly decreasing conditional probability of failure.

311
In general, age-related failure patterns apply to items that are very simple, or to complex
items that suffer from a dominant failure mode. In practice, they are commonly associated
with direct wear (most often where equipment comes into direct contact with the product),
fatigue, corrosion, oxidation and evaporation.
MTBF – is main characteristics of random failures, and represents mean time between
failures.

Hidden and evident failures

Some failure modes occur in such a way that nobody knows that the item is in a failed state
unless, or until, some other failure (or abnormal event) also occurs. These are known as
hidden failures. A hidden failure is a failure mode whose effects do not become apparent to
the operating crew under normal circumstances if the failure mode occurs on its own.
Conversely, an evident failure is a failure mode whose effects become apparent to the
operating crew under normal circumstances if the failure mode occurs on its own.
The RCM approach to the evaluation of failure consequences begins by separating hidden
failures from evident failures. Hidden failures can account for up to half the failure modes
that could affect modern, complex equipment, so they need to be handled with special care.

Hidden Failures and Protection

The function of any protection is to ensure that the consequences of the failure of the
protected function are much less serious than they would be if there was no protection. So
any protective function is in fact part of a system with at least two components:
a. The protective function
b. The protected function.

The existence of such systems creates two sets of failure possibilities, depending on whether
the failure of the protection is evident or not. The implications of each set are considered in
the following paragraphs, starting with devices whose failure is evident.

Failure Consequences
The consequence categorization process shall clearly distinguish events (failure modes and
multiple failures) that have safety and/or environmental consequences from those that only
have economic consequences (operational and non-operational consequences).

Safety consequences
A failure has safety consequences if there is an intolerable probability that it could kill or
injure a human being. The distinction between a “tolerable” and an “intolerable” probability
is very subjective and has to be defined a-priori for the whole evaluation process.
Beliefs about what is a tolerable level of risk of death or injury vary widely from individual to
individual and from group to group. Many factors influence these beliefs. The two most
dominant are the degree of control that any individual thinks he or she has over the situation
and the benefit that people believe they will derive from exposing themselves to the risk.

312
 This in turn influences the extent to which they might choose to expose themselves to the
risk. This view then has to be translated into a degree of risk that might be tolerated by the
whole population (all the workers on a site, all the citizens of a town or even the entire
population of a country).

Environmental Consequences
At another level, “safety” refers to the safety or well-being of society in general. Such failures
tend to be classed as “environmental” issues. Society’s expectations take the form of
municipal, regional and national environmental standards. Some organizations also have
their own even more stringent corporate standards. As a result, a failure has environmental
consequences if there is an intolerable probability that it could breach any known
environmental standard or regulation.

Operational Consequences
The primary function of most equipment in commerce and industry is usually connected with
the need to earn revenue or to support revenue-earning activities. Failures that affect the
primary functions of these assets affect the revenue-earning capability of the organization.
The magnitude of these effects depends on how heavily the equipment is utilized and the
availability of alternatives. However, in nearly all cases the costs of these effects are greater—
often much greater—than the cost of repairing the failures, and these costs need to be taken
into account when assessing the cost effectiveness of any failure management policy.
In general, failures affect operations in four ways:
a. they affect total output or throughput
b. they affect product quality
c. they affect customer service (and may incur financial penalties)
d. they increase operating costs in addition to the direct cost of repair.

Non-Operational Consequences
The consequences of an evident failure that has no direct adverse effect on safety, the
environment or operational capability are classified as non-operational. The only
consequences associated with these failures are the direct costs of repairing the failure itself
and any secondary damage, so these consequences are also economic.

16.11.5 Maintenance Strategy Selection (MSS)

The RCM decision making process provides a strategic framework for classifying all failures
on the basis of their consequences.
The RCM decision diagram is used to:
 evaluate if proactive maintenance is technically feasible and worth doing, or
 what action should be taken if a suitable proactive task cannot be found.

313
 Figure A26: RCM Strategy Decision Logic

Figure A27: Maintenance Strategies

Proactive Tasks
Proactive maintenance tasks are tasks undertaken before a failure occurs, in order to prevent
the item from getting into a failed state.
Proactive tasks include both:
 predictive tasks and
 preventive tasks.

314
Task selection depends upon the following criteria:
 whether the task is technically feasible?
 whether the task is worth doing economically?

Predictive Tasks
Predictive or on-condition tasks are designed to detect potential failures.
A potential failure as an identifiable condition which indicates that a functional failure is
either about to occur or is in the process of occurring
On-condition tasks entail checking for potential failures, so that action may be taken to
prevent the functional failure or to avoid the consequences.

Figure A28: Frequency of Condition Based Tasks

Condition Based Maintenance (CBM)

Condition monitoring does not always mean expensive monitoring equipment
 Human senses (look, feel, hear, smell, taste)
 CM is a rapidly developing technology
 Trend graphs give warning
 Alarms, indicators should be set before the failure point.

Condition maintenance techniques

 Dynamic – rotating equipment vibration & acoustics
 Particle – size, shape property changes
 Chemical – elements in fluids
 Physical – ultrasonic, coupon testing
 Temperature – thermograph
 Electrical – potential, impedance tests.

315
CM Technical Feasibility
 do we have any prior warning of the failure?
 what is it?
 how long will it take to fail from the prior warning?
 is it consistent in time?
 will it give us enough time to respond appropriately?

If ‘yes’ to all the above then the condition monitoring task is technically feasible

Assessment of condition monitoring techniques

 For operational & non-operational – over a period of time, will the cost of doing the
maintenance task be less than letting it fail?
 For safety & environmental – does this task reduce the risk?

Preventive Tasks
Preventative tasks consist of two categories:
Scheduled restoration tasks entail re-manufacturing a single component or overhauling an
entire assembly at or before a specified age limit, regardless of its condition at the time.
Scheduled discard tasks entail discarding an item or component at or before a specified age
limit, regardless of its condition at the time.

Figure A29: Restoration & Discard Age for age related failures

Restoration/discard technical feasibility

 do we have a reliable age projection ?
 what is the age ?
 will most items reach this age ? (if safety or environmental they must!)
 will we bring it back to as new (restoration) ?

if ‘yes’ to all the above then the restoration or discard task is technically feasible

316
 Default actions – Evident failure
Redesign is mandatory for safety or environmental consequences
Redesign is optional for operational & non-operational consequences.
If the failure mode can be eliminated by a simple design change this should be considered –
e.g. with training personnel, painting etc.
Default actions – Hidden failure
The objective of a maintenance program for a hidden failure is to prevent – or at least to
reduce the probability of – the associated multiple failure (A multiple failure is when the
protected function fails and the protective device is also in a failed state)
If condition monitoring, scheduled replacement or scheduled discarding are not applicable
then a failure finding task should be considered

Failure Finding Tasks

Scheduled failure finding tasks entail checking a hidden function at regular intervals to find
out whether it has failed.

Failure finding tasks should avoid dismantling protective devices or otherwise disturbing
them. It should be possible to carry out a failure-finding task without significantly increasing
the risk of the associated multiple failures.

Failure Finding Intervals

To determine the failure finding interval for a single protective device the following
information is needed:
 MTBF of protective device:
 desired availability of the device
Generic database MTBF (e.g. OREDA) or failure rate can sometimes be used if no other
information is available.

No scheduled maintenance (run to failure)

No scheduled maintenance is only valid if:
 a suitable proactive or failure-finding task cannot be found for a hidden failure, and the
associated multiple failure does not have safety or environmental consequences
 a cost-effective proactive task cannot be found for evident failures which have
operational or non-operational consequences.

16.11.6 Redesign
If a suitable failure-finding task cannot be found:
 redesign is compulsory if the multiple failure could affect safety or the environment
 redesign must be justified on economic grounds if the multiple failure does not affect
safety or the environment.

317
 Redesign means:
 a change in the physical configuration of an asset or system
 a change to a process or operating procedure
 a change to the capability of a person, usually by training.

Figure A30: RCM Interactions

RCM and Safety Legislation/Regulations

A question often arises concerning the relationship between RCM and tasks specified by
regulatory authorities (environmental legislation is dealt with directly).
Most regulations governing safety merely demand that users are able to demonstrate that
they are doing whatever is prudent to ensure that their assets are safe. This has led to rapidly
increasing emphasis on the concept of an audit trail, which basically requires users of assets
to be able to produce documentary evidence that there is a rational, defensible basis for their
maintenance programs. In the vast majority of cases, RCM wholly satisfies this type of
requirement.
However, some regulations demand that specific tasks should be done on specific types of
equipment at specific intervals. It quite often happens that the RCM process suggests a
different task and/or a different interval, and in most of these cases, the RCM-derived task is
a superior failure management policy.
However, in such cases, it is wise to continue doing the task specified by the regulations and
to discuss the suggested change with the appropriate regulatory authority.

16.11.7 Calculations MTBF, Analysis, Statistic

MTBF Calculation
Asset reliability is defined as the probability that asset will be able to perform her function
for a specific period of time. Value of this reliability is defined by MTBF (Mean Time between
Failures) which is related only for repairable assets.
318
Example:
There are 20000 people which are older than 80 years in one sample population. After two
years, data is collected of the failures (deaths) for this population. Throughout this year, 500
people failed (died).

For better understanding list of used terms is provided:

Total Operating Time (ToT) – defines a time period multiplied by be number of the same
asset group. (In example = 20000 *2 = 40000)
Failure Rate – number which describes number of failures divided by the total number of
assets from the same group. (In example = 500 / 40000 =0.0125%)
Mean Time Between Failures (MTBF) – average time between failures of one type of assets
inside one group.
Service life – expected length of operation before asset will fail. (In example = this is the age
at which person dies)
Mission life – the period of time that data is collected (In example = duration of two years)
Useful life – the time after asset is broken and before the assets start to wear out. (In
example: regarding the human life that is period between when person is a young child and
leave this stage as an aging adult)

Electro-
Reductor Fans Turbine Compressors Pumps motors TOT
POE 19 108 62 71 777 4
NOF 42 180 156 311 1991 4
MTBF 28760,571 38145,6 25267,385 14514,135 24810,925 63576 TOT1
Table A106: MTBF Calculation Example

319
 Figure A31 – Example: MTBF Calculation

Analysis calculation
The Analysis calculation report is one of the reports which is included in RCM, showing
current number of failures per month for the selected asset type.

Figure A32 – Example: Analysis calculation for pumps

Statistic calculation
This report calculates and shows number of failures regarding the failure cause during
selected time period. As for previous reports start date is 01.11.2006.

320
Figure A33 Example: Statistic calculation

321
18. Bibliography

[1] EUROPEAN COMMITTEE FOR STANDARDIZATION. CWA 15740:2008; Risk-Based

Inspection and Maintenance Procedures for European Industry (RIMAP). CEN, Brussels,
2008
[2] JOVANOVIC. A. (2004). Overview of RIMAP project and its deliverables in the area of power
plants. Int. J. Press. Vessels Piping. 2004, 81 (10-11) pp. 815–824
[3] JOVANOVIC, A. (2000). Extending the concept of Risk-based Inspection (RBI) to Risk-based
Life, Management (RBLM). State-of-the-art Resource Document prepared for and under a
subcontract of JRC, Petten, May 2000, EU DGIII (EUR report), Luxembourg, pp. 174
[4] RIMAP, Risk-Based Inspection and Maintenance Procedures for European industry, EU FP5-
GROWTH project, Project ID: G1RD-CT-2001-03008 (available on CORDIS)
(for further details, contact the project coordinator: jovanovic@risk-technologies.com)
[5] ISO 9000:2015, Quality management systems — Fundamentals and vocabulary
[6] ISO 14000 series, Environmental management
[7] ISO 55000, Asset management — Overview, principles and terminology
[8] ISO 31000, Risk management — Principles and guidelines
[9] IEC/ISO 31010, Risk Management - Risk assessment techniques
[10] ISO/IEC Guide 51, Safety aspects - Guidelines for their inclusion in standards
[11] ISO Guide 73, Risk management — Vocabulary
[12] EN 13306:2010, Maintenance – Maintenance terminology
[13] ISO 22301:2012, Societal security — Business continuity management systems —
Requirements
[14] IEC 61508:2010, Functional safety of electrical/ electronic/ programmable electronic
safety-related systems
[15] IEC 61511:2016, Functional safety – safety instrumented systems for the process industry
sector
[16] EN ISO/IEC 17020:2012, Conformity assessment — Requirements for the operation of
various types of bodies performing inspection
[17] API 580:2016, Risk-Based Inspection
[18] VGB S-506, Condition Monitoring and inspection of components of steam boiler plants,
pressure vessels installations and high-pressure water and steam pipes, VGB-S-506-R-
00;2012-03
[19] ASME CRTD-41, Risk-based Methods for Equipment Life Management: An Application
Handbook. New York: ASME International, 2003. Vol. 41
[20] ASME PCC-3-2007, Inspection Planning Using Risk-based Methods. New York: ASME
International, 2008
[21] JOVANOVIC, A.S., AUERKARI, P. and GIRIBONE, R. RIMAP WP4, D4. Application Workbook
for Power Plants, GROWTH project GIRD-CT-2001-03008. RIMAP RTD Consortium, 2003.
Ver.: 2
[22] DNV-RP-G101:2010. Risk based inspection of offshore topside static mechanical equipment.
[23] SINTEF Technology and Society. Offshore Reliability Data. 4th edition handbook. OREDA,
2002

322