S-RBI

Shell Risk-Based Inspection - The Methodology -

Risk and Reliability Management
Presenter: Henk van den Berg
Business Group Consultancy
Maintenance, Inspection and Reliability Engineering
In the past.............
• Time based inspections based on...
- legal obligations
- maintenance practices
• During the shutdowns....
- look in/at everything
- keep it “as new”
- cost not a major concern
• Often “surprises”
- no systematic approach
- no databases
Why RBI ?
Integrity
• “Sweating” the assets &
- Longer runs Reliability
- No unplanned shutdowns
- Shorter shutdowns

• Legislation changes (in many countries) Itegr

ity
• Deregulation of pressure equipment inspection mngm
plan nt
• Auditing by authorities

• Better knowledge and better techniques available

3
Why apply Risk-Based Inspection?

• To move away from time based inspection governed

by minimum compliance with rules, regulations and
standards for inspection.
• To apply a strategy of doing what is needed for
safeguarding integrity and improving reliability and
availability of the unit by planning and executing
those inspections that are needed.
• Risk Based Inspection provides economic benefits: less
inspection, shorter shut down, longer run length, less
unplanned shut down.
• Risk Based Inspection safeguards integrity.

4
S-RBI: Shell Risk-Based Inspection

• S-RBI Work flow

- in the RRM software
• S-RBI methodology
- part of RRM Manual, version 1 issued in 1999
- Version 2 May 2004

5
The S-RBI process
Equipment
Data List
Analysis/Review
Design- and Feedback
Inspection Data

Asset Integrity
Task Execution
Database
S-RBI PACKAGE

Corrosion Loop Inspection/Monitoring

Definition Planning

Criticality Confidence
Assessment Assessment

6
S-RBI Methodology

7
RBI Study – Team Sessions
• Review plant data, former and future operating
conditions (where applicable)
• Discuss materials selection and inspection experience
• Develop Corrosion Loops and Operating Windows
• Do criticality analysis
• List confidence rating
• Develop inspection/monitoring scope
- mainly by inspection & corrosion members, team review

8
S-RBI process flow chart
Asset Integrity data

1 Corrosion Loop
Definition

(optional)

Corrosion Loop
Criticality Assessment
2

(Item) Criticality
Criticality = N ? No Mitigate Risk
Assessment

Yes

No Inspection: Criticality
N H/E Detailed Analysis
review only level

L / M /MH

Develop
3 Inspection & Process
Monitoring Plan
Execute
Analyse &
Feedback

9
S-RBI IS Based on Corrosion Loops

CORROSION

WHAT TYPE OF DEGRADATION

CAN OCCUR AND WHERE ?
MATERIAL
+
ENVIRONMENT

WHICH (PROCESS) CONTROLS

ARE NEEDED ?

10
What is a “Corrosion Loop”?
“A Practical Way to Describe, Understand and Check
Degradation Mechanisms in a Unit”
• Part of the Unit Subjected to:
-the same process conditions
-the same materials selection CORROSION LOOP
criteria 12-E-102
=>Resulting in the same degradation Loop
2
mechanisms. Loop 3

12-D-101
12-E-101 12-K-101
• One “Operating Window” Loop 1
1st stage

- control of degradations via

process control 12-G-101
to burn pit
- values agreed by team
(boundary conditions for RBI)
- deviation should be reported • same process conditions
• same degradation mechanisms
11
Corrosion Loop Boundaries
Inert vapour
4
1. Change in Construction
Vapour
E-1 Material
2 Liquid
2. Change in Process
Conditions
V-1 3. Process Unit limit (“Battery
Feed
Susceptible
material 3 Limit”)
1 Corrosive liquid
Restistant
4. Equipment in severest CL
material
5. Merge very small CL’s, split
Inert vapour 5 very large CL’s
C-1
E-2

3
Inert liquid
12
 Corrosion Loops for a Kero HDT
Feed from Hydrogen from Platformer
CDU
Recycle Hydrogen

E-1202

R-1201

CTW To Fuel Gas system

CS 5Cr 0.5Mo

E-1201 1.25Cr 0.5Mo

cs cs cs as as ss
321 SS

F E D C B A
CS Product to
Stripper

Sour Water
13
Heat Exchanger Definitions

Shell side Tube side

Head (He)

Shell (Sh)

Tube outside (To)

Tube
inside
(Ti)

14
Sub Tags & Tag Groups
16” P1004 3117Y
C-201 TOP

SUB - TAGS
4” P1005 3117Y

C-201 “DRY OH PIPING”

24” Tags P1004, P1005, P1006
P1002
3117X

C-201 Bottom TAG GROUPS

“WET PIPING”
tags P1002, P1003

12” P1003 3117X

15
Experience with Corrosion Loops
• Applied in refineries, chemical plants and gasplants

• Good experience and part of S-RBI approach

• Useful to set operating windows

• Information on degradation mechanisms (and affected

areas)

• Info on degradation available for all staff concerned with

integrity!

16
Integrity Operating Window
Refer to dedicated presentation

17
Criticality Assessment

18
Criticality Assessment
For the Corrosion Loop:
• Stop if Negligible Criticality or Negligible Consequence of Failure
is obtained (no further analysis on item by item basis)
- these items are analysed by S-RCM to optimise maintenance
plans and in a review scheme for RBI (checking if changes
occurred)
For Individual Items:
• Carry out the criticality rating for each item
- can be grouped for similar piping items into e.g. “LP piping”
- can be divided into 2 loops, e.g. “Column top”,
and “Column bottom”
19
S-RBI process flow chart
Asset Integrity data

1 Corrosion Loop
Definition

(optional)

Corrosion Loop
Criticality Assessment
2

(Item) Criticality
Criticality = N ? No Mitigate Risk
Assessment

Yes

No Inspection: Criticality
N H/E Detailed Analysis
review only level

L / M /MH

Develop
3 Inspection & Process
Monitoring Plan
Execute
Analyse &
Feedback20
 Criticality Matrix
RECTIFY
EXTREME
CRITICALITY
HIGH L MH H E E
PROBABILITY

MEDIUM L M MH H E DETAILED
LOW N L M MH H ANALYSIS
NEGLI-
GIBLE N N L M MH HIGH
NEGLI LOW MED HIGH EXTEN
S-RBI
GIBLE IUM SIVE
CRITICALITY

CONSEQUENCES
NEGLIGIBLE
NO INSPECTION MEDIUM HIGH
REVIEW ONLY MEDIUM
LOW
INSPECTION PLAN
21
Susceptibility to Failure instead of Probability
• The Susceptibility to Failure (StF) is the worst case estimate for the
degradation under consideration, without corrective actions
(no inspections, no monitoring).
• The StF will lead to the “Criticalty” of the items in combination with
the Consequence of Failure (CoF).
• After implementation of monitoring & inspection, the remaining
possibility that such a degradation leads to an incident is described
as the Probability of Failure (PoF); together with CoF this describes
the remaining “Risk” in operation.
The PoF must be As Low As Reasonably Possible
(ALARP) and not exceed “Low” in general, and
“Negligible” where the CoF is Medium, High or Extreme
22
Criticality Rating
• Determine the Susceptibility to Failure (StF)

• Determine the Consequence of Failure (CoF)

• Combination of StF and CoF yields the Criticality

Ö CRITICALITY = potential risk

without preventive measures or corrections

23
 The SHELL S-RBI RISK MATRIX
SUSCEPTIBILITY TO FAILURE RRM criticality class
H High (>4 DCR) L
L
H
MH
E
H
X
E E
X
Probability class

M Medium (1-4 DCR) L L M M H MH E

H E X

L Low (>0.5-1DCR) N N L L M M H MH H E

N Negligible (≤0.5 DCR) N N N N L L M M MH H

Slight Damage Minor Damage Local Damage Major Damage Extensive Damage
Economics (USD) <10k 10-100k 0.1-1M 1-10M >10M
Consequence
Category

Health and Safety Slight Injury Minor Injury Major Injury Single Fatality Multiple Fatalities

Environment Slight Effect Minor Effect Localised Effect Major Effect Massive Effect

Consequence class N L M H E

RAM = Risk Assessment Matrix E = Extreme

RBI = StF (Susceptibility to Failure), DCR (Design H = High
Corrosion rate) MH = Medium High
IPF = DR, Demand Rate M = Medium
RCM = ETBF, Estimated Time Between Failure L = Low
N = Negligible
24
 RBI Criticality Matrix (2)
SUSCEPTIBILITY TO FAILURE RRM CRITICALITY CLASS
4 HIGH L MH H E E
PROBABILITY CLASS

3 MEDIUM L M MH H E
2 LOW N L M MH H
1 NEGLIGIBLE N N L M MH
SLIGHT DAMAGE MINOR DAMAGE LOCAL DAMAGE MAJOR DAMAGE EXTENSIVE
ECONOMICS (USD)
CONSEQUENCE

<10K 10-100K 0.1-1M 1-10M DAMAGE >10M

CATEGORY

MULTIPLE
HEALTH & SAFETY SLIGHT INJURY MINOR INJURY
NORMAL DESIGN CASE MAJOR INJURY SINGLE FATALITY
FATALITIES

ENVIRONMENT SLIGHT EFFECT MINOR EFFECT LOCAL EFFECT MAJOR EFFECT MASSIVE EFFECT
NEGLIGIBLE OR LOW
NEGLIGIBLE SUSCEPTIBILITY
LOW TO FAILURE
MEDIUM HIGH EXTREME
CONSEQUENCE CLASS 1 2 3 4 5

NOTE: Medium or High StF can occur

e.g. as a result of changed operating conditions
25
Susceptibility to Failure (StF) Assessment

26
Susceptibility to Failure (StF) (1)
• Determine potential degradation mechanisms for the
Loop.
• For those degradation mechanisms, identify the StF per
item.
- for each item since there can be differences in temperature etc..
• For each item, analyse the different degradation
mechanisms separately since they may result in different
failure modes.
- Different inspection techniques/intervals may be required.
- Monitoring scheme to be indicated for non-age related
degradations.
27
Susceptibility to Failure (StF) (2)
• The failure mode will influence the Consequence of
Failure and therefore the Criticality.
- The “item criticality” will be the highest rating of all failure
modes.

28
Age-Related Degradations vs Non Age-
Related Degradations (1)
Degradation

AGE-RELATED

Time
29
Age-Related Degradations vs Non Age-
Related Degradations (2)
Degradation

AGE-RELATED
NON AGE-RELATED
E.G. SCC

Time
30
Susceptibility to Failure (StF) (3)
• Age Related Degradations
- time factor (very) important in relation to degradation
- degradations can be foreseen/predicted and controlled
- general corrosion (thinning)
- creep
- part of normal design criteria, basis for “design life”

• Non-Age Related Degradations

- time factor not important in relation to degradation
- degradations can be fast often related to plant upsets
- e.g. stress corrosion cracking due to Cl or caustic
- brittle failure

⇒ not acceptable, not in normal designs; 31

special precautions/controls needed
 SUSCEPTIBILITY TO FAILURE
determine
failure characteristic

failure characteristic: failure characteristic:

age-related non age-related

DEGRADATION MODULES
- CRACKING
- H-ATTACK
THINNING CREEP CUI
- MECHANICAL

determine Susceptibility determine determine determine Susceptibility

based on the ratio: Susceptibility Susceptibility based on
actual corrosion rate/ based on the based point API/SHELL Technical
design corrosion rate operating conditions scoring system Modules
fitness-for-service study32
StF – via S-RBI Degradation Library

• Based on the API BRD 581 Technical Modules

- modified where required to reflect SGSI experience
• 25 Modules available for all major refinery
degradation mechanisms.
- general corrosion
- acids
- water
- etc.
- CUI, H2S, H2 attack, SCC, etc.

33
Degradation Sections

• Internal Corrosion
• External Corrosion
• Creep
• Thermal fatigue
• Vibration fatigue
• Stress Corrosion Cracking
• Low Temperature Embrittlement
• High Temperature Embrittlement
• High Temperature Hydrogen Damage
• Erosion

34
Modules
T1 High Temperature H2S/H2 Corrosion
T2 High Temperature Sulphidic and Naphthenic Acid
Corrosion
T4 Hydrochloric Acid Corrosion
T5 Sulphuric Acid Corrosion AGE – RELATED
T6 Hydrofluoric Acid Corrosion DEGRADATIONS
T7 Sour Water Corrosion
T8 Amine Corrosion
T3A Corrosion Under Insulation of Carbon and Low Alloy
Steel
T3B Corrosion Under Insulation of Austenitic Stainless Steel
T11 High Temperature Oxidation
H2 Creep

35
Modules
H7 Thermal fatigue
S8 Vibration Fatigue
S1 Wet H2S Cracking (Refineries and Gas Plants)
S2 Caustic Cracking
S3 Polythionic Acid Stress Corrosion Cracking
S4 Chloride Stress Corrosion Cracking (Cl-SCC)
S5 Amine Cracking
S6 Cracking and Blistering in Hydrofluoric Acid
Services
L1 Low Temperature Embrittlement NON AGE - RELATED
H3 Temper Embrittlement DEGRADATIONS
H4 Sigma Phase Embrittlement
H1 High Temperature Hydrogen Attack
T13 Erosion

36
StF - Age-Related Degradations
1 Internal Corrosion The actual corrosion rate is very high (e.g. > 4 × CRd) H
General and/or localised The actual corrosion rate is high (e.g. 1 - 4 × CRd) M
The actual corrosion rate is acceptable/low (e.g. 0.5 - 1.0 × CRd) L
The actual corrosion rate is very low (e.g. < 0.5 × CRd) N

2 External Corrosion Severe external corrosion ( e.g. 60 -120 °C with high humidity and/or H
spray, condense, cycling conditions, damaged insulation)
Corrosion under Serious external corrosion , (e.g. -5 to 60 °C or 120 - 150 °C and M
insulation humid climate, damaged insulation)
Minor external corrosion under normal operating conditions(0.05mm/yr) L
No foreseeable external corrosion (not insulated or >150 °C) N

3 Creep Operation in the creep range, risk of major upsets which must be H
quantified in terms of remnant life
Operation in the creep range, risk of minor upsets which must be M
quantified in terms of remnant life
Operation in the creep range at or below design conditions L
No foreseeable operation in the creep range N

37
Susceptibility to Failure Internal Corrosion
general & localized corrosion
Corrosion Rating for
Susceptibility to Failure

H igh > 4 x design CR

M edium >1 - 4 x design CR RRM MATRIX

L ow 0.5 - 1 x design CR

N egligible < 0.5 x design CR

38
StF - Non Age-Related Degradations (1)
4 Fatigue - Thermal Cyclic temperature range or delta T of two process streams greater than 250 °C H
Cyclic temperature range or delta T of two process streams between 150 and M
250 °C
Cyclic temperature range or delta T of two process streams between 100 and L
150 °C
All other lines or equipment N

5 Fatigue - Vibrations Vibrating in zone 1, or nominal pipe diameter less than 50 mm and in zone 2 H
and 3
Vibrating in zone 2, or nominal pipe diameter between 50 and 100 mm and in M
zone3
Vibrating in zone 3 L
No foreseeable fatigue due to vibration (zone 4 or no vibrations N

6 Stress Corrosion Cracking High susceptibility H

External or internal Medium susceptibility M
Low susceptibility L
Not susceptible N

39
 Start

Caustic Cracking Module Yes

Stress
API 581 and degradation library Relieved? Not Susceptible

No
NaOH Plot Point on NACE
Concentration Caustic Soda Temperature
Service Graph

Yes Plots in No
Area “A”?
Yes No
NaOH
conc<5%wt?

Yes Yes No NaOH

Heat Heat
traced? traced? conc<5%wt?
H
No No
Medium Susceptibility High Susceptibility Yes
M
Steamed Medium Susceptibility
out? Yes
L No M
Yes No
Low Susceptibility Steamed Not Susceptible
out?
N
40
StF – Non Age-Related Degradations (2)
NAR 7 Low Temp. Embrittlement Operating or upsets outside the limits of DEP 30.10.02.31 H
Gen.
(No cat. M)
Operating or upsets within the limits of DEP 30.10.02.31 L
Gen.
Not susceptible under any foreseeable conditions N

NAR 8 High Temp. Embrittlement Operating in the embrittlement range and no S/D H
precautions
Design or upsets in the embrittlement range and no S/D M
precautions
Design and operation below the embrittlement range or S/D L
precautions
Not susceptible under any foreseeable conditions N

41
StF – Non Age-Related Degradations (3)
NAR 9 High Temperature Operating/upset conditions above the Nelson curve limit H
Hydrogen Attack (API 941)
Operating conditions between the Nelson curve limit M
and 20 °C below (API 941)
Operating conditions are 20 - 50 °C below L
the Nelson curve limit (API 941)
Operating conditions are > 50 °C below the Nelson curve N
limit (API 941) or Material is not susceptible
under any foreseeable conditions

NAR 10 Erosion Flow velocity is much higher than design and/or much larger H
amounts of solids/droplets present
(non protected system) Flow velocity is higher than design, and/or solids/droplets M
higher than design
Flow velocity is per design or less, solids/droplets loading as L
per design or less
No foreseeable occurrence of erosion N

42
Consequence of Failure (CoF)
Assessment

43
Consequence of Failure Assessment
• Purpose is to Estimate Consequence Class (1 out of 5)
• Three Levels of Assessment are Available
1 Direct selection (using Risk Assessment Matrix - RAM)
2 “Simple” questionnaire using RAM descriptions,
but split over important aspects of each category
3 “Detailed” questionnaire, using relevant process
and equipment data
• Use Top-Down Approach
- Use 3 to set the levels for the loop, for main items

44
 Direct Assessment of Consequence of Failure

NEGLIGIBLE LOW MEDIUM HIGH EXTENSIVE

<10 k$ 10 - 100 k$ 0.1 - 1 M$ 1 - 10 M$ >10 M$

NO DISRUPTION BRIEF DISRUPTION PARTIAL PARTIAL SUBSTANTIAL/
ECONOMICS SHUTDOWN OPERATION TOTAL LOSS OF
CAN BE RESTARTED LOSS (2 WEEKS) OPERATION

NO/SLIGHT INJURY MINOR INJURY MAJOR INJURY SINGLE FATALITY MULTIPLE

HEALTH FIRST AID/MEDICAL LOST TIME INCLUDING INCLUDING FATALITIES
& SAFETY TREATMENT INCLUDED PERMANENT PERMANENT TOTAL
MAXIMUM 1 WEEK PARTIAL DISABILITY DISABILITY

NO/SLIGHT EFFECT MINOR EFFECT LOCALISED EFFECT MAJOR EFFECT MASSIVE EFFECT
LOCAL DAMAGE CONTAMINATION, AFFECTING EXTENSIVE SEVERE DAMAGE
ENVIRONMENT WITHIN FENCE NO PERMANENT NEIGHBOURHOOD RESTAURATION NUISANCE IN
EFFECT REQUIRED LARGE AREA

Î The highest consequence class is governing.

45
Economics
• Production Loss
- deferred income (no or downgraded product)

- product wasted (flared or spilled)

• Repair Costs
- repair/re-install item

- fixed contractor costs (lump sum)

• Labour
46
Direct Assessment of Economic Consequences
Class Potential Im pact Description
N Slight dam age N o disruption to operation
< 10 kUSD

L M inor dam age Brief disruption

10-100 kUSD

M Local dam age Partial shutdown that can be

0.1-1 M USD restarted

H M ajor dam age Partial operation loss (2 w eeks

1 - 10 M USD shutdown)

E Extensive dam age Substantial or total loss of

> 10 M USD operation

definitions as given in the HSE RAM

47
Economic Consequences
simple questionnaire
ELEMENT COST
Production loss 1 k

Repair costs 2 k

Labour 3 k

Total 6 k
Economic consequence class: N

48
Production Loss Equation
Production losses
Down time 6 hr = 100 kUSD
Reduced throughput 5 hr @ 20 % = 50 kUSD
Miscellaneous = 30 kUSD
Total production losses 180 kUSD
Repair costs
Materials / Equipment = 10 kUSD
Fixed contractor costs = 4 kUSD
Miscellaneous = 0 kUSD
Total repair costs 14 kUSD
Labour
Craftsmen 5 hr = 300 USD
Operator 4 min = 7.2 USD
Staff 1 hr = 80 USD
Contractor 2 hr = 100 USD
Total labour 0.487 kUSD

Total economic consequence 194.487 kUSD

49
Economic consequence class M
Staggered Production Loss Equition
100

80 PLE example:
0 - 2 h: 2 kUSD/h
Loss [kUSD]

2 - 8 h: 4 kUSD/h
60 > 8h : 8 kUSD/h
5 periods
8
40 can be
2 defined
20

0
0 t1 5 t2 10 15
Time [h]

In software 2 and 8 should be entered as 50

the inputs with the loss value up to that limit
Health and Safety
• Three health and safety effects are considered:
1 Thermal effect (fire)
2 Blast and fragment (explosion)
3 Toxic effect
- which can be reduced by mitigation
• Maximum of three minus mitigation is overall
Health and Safety class
• “Simple” questionnaire connects the degree of hazard
to
Health and Safety descriptions
- e.g. medium fire which could cause minor injuries
51
HSE RAM DEFINITIONS
Table 3-2 Health/Safety consequence definitions as given in the HSE RAM
document
Class Potential Impact Description

N No/Slight injury First aid case and medical treatment case. Not affecting
work performance or causing disability.
L Minor injury Lost time injury. Affecting work performance, such as
restriction to activities or a need to take a few days to fully
recover (maximum one week).
M Major injury Including permanent partial disability. Affecting work
performance in the longer term, such as prolonged absence
from work. Irreversible health damage without loss of life,
e.g. noise induced hearing loss, chronic back injuries.
H Single fatality Also includes the possibility of multiple fatalities (maximum
3) in close succession due to the incident, e.g. explosion.
E Multiple fatalities May include 4 fatalities in close succession due to the
incident, or multiple fatalities (4 or more) each at different
points and/or with different activities.

52
Health & Safety - Simple Questionnaire (1)

CONSEQUENCE CONSEQUENCE DESCRIPTION

CLASS

FIRE
Failure mode leads to:
1 N No fire or fire which could only cause slight injuries (no LTI)
2 L Fire which could cause minor injuries (LTI)
3 M Fire which could cause major injuries (LTI> 1 week and/or partial disability)
4 H Fire causing up to a single fatality or permanent total disability
EXPLOSION
Failure mode leads to:
1 N No explosion but just a flash fire which could only cause slight injuries (first aid)
2 L No explosion but a flash fire which could cause minor injuries (LTI)
3 M Explosion or flash fire which could cause major injuries (LTI>1week and/or
partial disability)
4 H Explosion or flash fire which could cause a single fatality or permanent total
disability
5 E Explosion which could cause multiple fatalities

53
Health & Safety - Simple Questionnaire (2)

CONSEQUENCE CONSEQUENCE DESCRIPTION

CLASS

TOXIC
Failure mode leads to:
1 N No or very small toxic release which could cause only slight injuries (first aid)
2 L Small toxic release which could cause minor injuries (LTI)
3 M Medium toxic release which could cause major injuries (LTI>1week and/or
partial disability)
4 H Large toxic release which could cause a single fatality or permanent total
5 E di bilit
Very large toxic release which could cause multiple fatalities
MITIGATION
Exposure near failure location and possibility to avert danger of hazardous
event could reduce possible H/S consequence class by:
0 No means or only marginally
-1 One class
-2 Two classes

54
Health & Safety - Detailed Questionnaire

Table 3-4 Common consequence matrix

4 N H E E
Consequence
quantity 3 N M H E
of Failure
2 N L M H Negligible to
quantity 1 N N L M Extreme
released 1 2 3 4
property

For fires flammability

55
Health & Safety - Fire
• Two parameters are used to estimate fire
consequence:
- Flammability
- NFPA (National Fire Protection Association)
flammability index, 0 ≤ Nf ≤ 4 and temperature
- Released quantity (instantaneous/per hour/inventory)
- three levels: < 500 kg, 0.5 - 5 ton, and > 5 ton

• Matrix to determine fire class (Max H)

56
Fire - Detailed H & S Questionnaire
Nf P ro d u cts
Table 3-6 Fire safety questionnaire
0 S ulphur D iox ide, S odium
C hloride Flammability
1 S ulphur, A m m onia 1 Not flammable (Nf < 2) or low
2 D iesel F uel, F uel O il 1 to 6 flammability (Nf >1 and T product < T flash)
3 G asoline, N aphtha, E thyl
A lcohol, P etroleum C rude 2 Medium flammability
(Nf > 1 and T flash < T product < T auto ign)
4 H ydrogen, M ethane,
H ydrogen S ulphide 3 High flammability
(Nf > 1 and T product > T auto ign)
released 3 N M H
quantity 2 N L M
Released quantity
1 N N L (instantaneous or per hour or inventory)
1 2 3 1 < 500 kg
flammability 2 0.5-5 ton
3 > 5 ton

57
Release of Liquid through a hole
10 advised as the
average case, results
in released Q=2
hole diameter [mm]

5 mm

50
500
5000

1
1 10 100
pressure [barg]
58
Defect Sizes upon Failure
• Standard hole size 3 mm for gas and 3 - 5 mm for liquids for
normal degradations leading to pitting and small holes;
- these sizes are detected rather quickly and precautions
will be in hand if sizes are larger:
- depressurization
- evacuation
- fire fighting etc.

• A 1 inch hole for degradations leading to large area thinning,

e.g. ammonium chloride salt attack.
• Ruptures are considered if embrittlement is encountered or
large scale Stress Corrosion Cracking could occur.
• Local standards/philosophies can overrule these sizes.
59
 Failure Mode & Consequences
Degradation Failure mode Consequence of Failure Typical defect:
w w worst case & if flammable contents w

Pitting Small leak Leak, no significant damage Hole, 3-5 mm dia

Small fire
(Big fire or explosion) (System Inventory)

Embrittlement Fracture Big fire or explosion System Inventory

Caustic cracking Cracks Leaks Hole, 3-5 mm dia

SCC

General corrosion Leak Fire, small explosion Hole, 3-5 mm dia

Rupture Big fire or explosion System Inventory
To avoid long discussions, general worst case failure
modes are taken as default starting point
(modified if required, after discussions)
60
Health & Safety - Explosions

Two Explosion / Impact Risks are Considered:

1 Vapour Cloud Explosions (VCE)
- VCE possibility (flammable cloud and congested area)
- released vapour mass (instantaneous, per hour)
- matrix to determine VCE class
2 Other impact/high pressure risks
- high pressure equipment
- failure causing flying debris
⇒ Maximum of the Two is Explosion Class (Max E)

61
Explosion – Detailed H & S Questionnaire
Table 3-7 VCE consequence questionnaire
VCE possibility
1 None; no release of an
explosive cloud
2 Low; release of an explosive
cloud in an open area
released 4 N H E E 3 Medium; release of an explosive
vapour 3 N M H E cloud in a medium congested
area (some obstacles present)

2 N L M H 4 High; release of an explosive

mass
cloud in a heavily congested
1 N N L M area (many obstacles present)
1 2 3 4
VCE possibility Released vapour mass
(instantaneous or per hour)
1 < 50 kg
2 50 - 500 kg
3 0.5 - 5 ton
4 > 5 ton 62
Release of Gas
through a 3 mm hole C1-C2 and H2
1000
Release rate [kg/h]

100
C1-C2 (@ 50 C)
H2 (@ 50 C)

10
0 50 100 150 200 250
Pressure [bara]
63
Release of LPG through a 3 MM hole

2500
Released quantity [kg/h]

2000

1500

1000 C3 @ 50 C
C3 @ 100 C
500 C4 @ 50 C
C4 @ 100 C
0
0 50 100 150 200 250
Pressure [bara]
64
Explosion & HP - Detailed H & S Questionnaire

Table 3-8 Other explosion and high pressure equipment consequence questionnaire
N no gas present or p*V<5 bar m3
L gas present and 5 ≤ p*V ≤ 50 bar m3
M gas present and 50 < p*V < 500 bar m3
H gas present and p*V>500 bar m3 or failure causing some flying debris (solid particles)
E failure causing major flying debris (solid particles)

65
High Pressure Consequence of Gas Pipes

10
5
PxV
pipe diameter [m]

50
500 bar m3

0,1
1 10 100
pressure [barg]
66
Health & Safety - Toxic Effects
Two Parameter Determine Toxic Consequence:
- Toxicity
– NFPA “health” index, 0 ≤ Nh ≤ 4
- Concentration
– four levels: < 1000 ppm, …, > 10%

⇒ Matrix to Determine Toxic Class (Max E)

67
Toxic Releases - Detailed H & S Questionnaire
Table 3-9 Toxicity index, Nh, examples
Nh Products
0 Diesel
1 Butane, Gasoline
Table 3-10 Toxic consequence questionnaire
2 CO, benzene,
Toxicity Ethylene Oxide
1 Not toxic (Nh≤1) or low toxicity 3 H2S, chlorine, Ammonia,
(Nh≤3 and conc. < 100 ppm). Sulphuric Acid, Phenol
2 Medium toxicity (Nh=2) 4 Hydrogen Fluoride (HF),
3 High toxicity (Nh=3) Hydrogen Cyanide

4 Extreme toxicity (Nh>3)

4 N H E E
Concentration (in ppm or % volume) Concentration 3 N M H E
1 < 1000 ppm 2 N L M H
2 < 10 000 ppm (or < 1%) 1 N N L M
3 1-10 % 1 2 3 4
4 > 10 % Toxicity
68
Health & Safety - Mitigation
Two Factors Determine Mitigation:
1 Exposure
- Frequency of and exposure time in hazardous zone
2 Possibility to avert the hazardous situation
- Depends on: rate of development, ease of recognition,
avoidance of exposure, use of PPE, experience.
⇒ Matrix to Determine Overall Reduction
(0, 1 or 2 classes)

69
Mitigation - Detailed H & S Questionnaire

Table 3-11 Mitigation questionnaire

Exposure
1 Very rare
(less than 10 man-minutes per day)
2 Occasionally
(less than 6 man-hours per day)
Possibility 3 -1 0 0
3 Frequently to continuously
to avert 2 -1 -1 0 (more than 6 man-hours per day)
danger 1 -2 -1 -1
1 2 3 Possibility to avert danger
Exposure
1 In almost all circumstances
2 In some circumstances
(more than 25% of cases)
3 Not (or hardly possible)

70
Possibility to Avert Danger
Factors to be taken into Account:
- Rate of Development of the Hazardous Event
• Suddenly / Slowly
- Ease of Recognition of Danger
• Seen Immediately / Detected by Technical Means
- Avoidance of Exposure to Hazardous Event
• Escape Routes Available / Under certain Conditions / Unavailable
- Use of Personal Protective Equipment
- Actual Safety Experience
• Similar Equipment and/or Failures

71
Environment
Two Effects are Considered:
1 Liquid spills (max E)
- toxicity
- Released quantity (or inventory)
- location (within / outside fence)
- surface (possibility to reach surface and/or ground water
2 Gas emissions (max M)
- Type (volume and how harmful)
- Effects (complaints)
⇒ Maximum of both effects is Environment Class
72
Environmental - Simple Questionnaire

Table 3-13 Simple environment questionnaire

Severity Consequence description
rating
Liquid spills
Failure mode leads to a liquid spill with:
1 N No or negligible environmental damage
2 L Minor environmental damage
3 M Localised environmental damage
4 H Major environmental damage
5 E Massive environmental damage
Gas emission
Failure mode leads to:
1 N No or small harmful release
2 L Small harmful release leading to many complaints or large
3 M Large harmful release leading to many complaints

73
Environmental - Detailed Questionnaire
Location
Table 3-14 Liquid spills questionnaire 0 Contamination remains inside fence

Environmental toxicity 1 (Part of) contamination is outside fence

Surface of spill
1 Not harmful to environment (e.g.
water) 0 No chance that spilled liquids will reach
2 Harmful but not toxic outside fence surface or ground water
(e.g. most alkanes)
1 There is a possibility that spilled liquids will
3 Harmful and toxic reach outside fence surface or ground water
(e.g. drins)
4 N H E
Released quantity ( or inventory) 3 N M H
1 < 500 kg Quantity 2 N L M
2 0.5 - 5 ton 1 N N L
3 5 - 50 ton 1 2 3
4 > 50 ton Toxicity

74
Environmental - Detailed Questionnaire
Table 3-15 Gas emission questionnaire
Type of release
3 large (> 1000 normal m3 ) and harmful
2 small and harmful Type of 3 L M
1 other Release 2 N L
1 N N
1 2
Effect
Effect
1 No or few complaints
2 Many complaints or is to be reported to the Authorities.

75
Determination of the Consequence of Failure -
Summary
• Direct
• Simple Questionnaire
- compliant with HSE descriptions
• Detailed Questionnaire
- provide guidance and consistency
- useful if limited HSE experience is available
- mechanistic ⇒ keep thinking
- seek specialist advice in cases of doubt or high criticality

76
Confidence Assessment

77
Confidence Rating
• Indicator for Confidence in Forecast of Degradation

• Rating - very low to very high – Reflects:

- stability/predictability of degradation
- number and quality of previous inspections
- process stability

⇒ Better Confidence Yields Longer Inspection Intervals

78
 Age-Related

1. DEGRADATION MECHANISM IS STABLE AND CAN BE PROPERLY

CONTROLLED
¾ CRITERIA FOR STABLE:
9 It remains constant over time
9 It does not change drastically with relatively small changes in
operating conditions
¾ END RESPONSIBILITY : Corrosion Engineer

79
 Age-Related..

2. MULTIPLE RELIABLE INSPECTIONS HAVE BEEN CARRIED OUT

¾ CRITERIUM FOR RELIABLE
9 Adequate Inspection Method & Location w.r.t. Degradation
Mechanism
¾ CRITERIA FOR MULTIPLE
9 < = 1 : No
9 2 – 3 : Intermediate
9 >= 4 : Yes
¾ END RESPONSIBILITY : Inspection Engineer

80
 Age-Related...

3. RELEVANT PROCESS PARAMETERS ARE RELIABLE MONITORED

¾ CRITERIA FOR RELIABLE MONITORED
9 Process parameters that are relevant to the degradation
mode
9 Reliable & Consistant Monitoring
¾ END RESPONSIBILITY : Operator / Process Engineer &
Corrosion Engineer

81
Task Planning

82
S-RBI Process FlowCchart
Asset Integrity data

1 Corrosion Loop
Definition

(optional)

Corrosion Loop
Criticality Assessment
2

Criticality (Item) Criticality

Criticality =N? No Mitigate Risk
Level : Assessment

Yes

No Inspection: Criticality
N H/E Detailed Analysis
review only level

L / M /MH

Develop
3 Inspection & Process
Monitoring Plan
Execute
Analyse &
Feedback
83
 Decision Chart for Application and Determination
of Remnant Life Determine Failure Characteristics

failure characteristic: failure characteristic:

age-related non-age-related

Corrosion Cracking, HIC,

Thinning Creep
Under Insulation Mechanical
Remnant Life concept
not used for CUI & NAR

Remnant Life = Specific Determine Determine

Assessment Susceptibility based Susceptibility based
remaining CA / SCR Methods on Questionnaire on Questionnaire and
Degradation Modules
Redesign if required
step 1: rem. CA = rem.design CA Selection of
step 2: rem. CA = t(last) – t(min) Inspection Scenario Process Monitoring
based on Criticality plus Opportunity
and Confidence rating Inspection 84
SCR is the Selected
Corrosion Rate
(see Figure 5-3)
Selected Corrosion Rate

Start

measurements ? Yes trend

No

historical CR CR > default CR ? Yes

historical
experience
data?? Yes

No No

degradation theoretical CR Selected CR

Yes
model ?

No
Default CR

85
Calculation Scheme for Remaining Corrosion
Allowance Start

Design CA
No
specified?

Yes

Design CA Calculate
Yes
consumed? t (min, required)

No

RCA = RCA =
t (min, measured) -
DCA - corrosion t (min, required) 86
Calculation of Inspection Interval
for age-related degradations
susceptibility to consequence of failure
failure (questionnaire) (questionnaire)
- inspection records
- experience
matrix
- judgement
CONFIDENCE
CRITICALITY RATING

corrosion allowance
matrix
corrosion rate
multiply
REMNANT LIFE X INTERVAL FACTOR

MAXIMUM
MAXIMUM INSPECTION
INSPECTION 87
INTERVAL
INTERVAL (in
(in years)
years)
Age-Related Degradation - inspection interval factor
function of Criticality and Confidence Rating
Inspection Interval Factor for Adjustment of interval factor
Medium Confidence Rating based on Confidence Rating
Criticality Interval Factor
Confidence Rating Adjustment factor
H 0.2
VH - Very high + 0.2
MH 0.3
add or H - High + 0.1
M 0.4
subtract M - Medium 0
L 0.5
L - Low -0.1
N 0.6
VL - Very Low -0.2
Scoring points for adjustment factor with add
/su
medium confidence as starting point. Maximum adjustment +/- 0.2 to/ btract
f
Description Score SCORE ME r o m
DIU
M
YES Int. NO
Degradation mechanism is stable and properly controlled + 0.1 0 -0.1
Multiple reliable inspections have been carried out + 0.1 0 -0.1 88

Relevant process parameters are reliably monitored + 0.1 0 0

 Interval Factors - for Age-Related Degradations

CONFIDENCE RATING

CRITICALITY Very Low Low Medium High Very High

H 0 0.1 0.2 0.3 0.4

MH 0.1 0.2 0.3 0.4 0.5

M 0.2 0.3 0.4 0.5 0.6

L 0.3 0.4 0.5 0.6 0.7

N (review only) 0.4 0.5 0.6 0.7 0.8

89
 Maximum Inspection Interval

WALL
THICKNESS INSPECTIONS

t new REMNANT LIFE

X X
MAXIMUM INSPECTION
X INTERVAL

MINIMUM ALLOWABLE THICKNESS

t (min)

LIFETIME IN YEARS
90
Guideline for Inspection Coverage (in % of likely
affected area/items)
Probability of Detecting
Representative Damage

Current Condition of Medium

High Low
Equipment

Nearing End of Life 20-40 40-70 70-100

(RL <= ¼DL)

Mid Life 10-20 20-40 40-70

(¼DL < RL < ¾DL)

As New 5-10 10-20 20-40

(RL >= ¾DL)
where: RL = remnant life, and DL = design life

91
Inspection Strategies for
CUI
Refer to dedicated presentation

92
 Monitoring Scheme - for non age-related
degradations
susceptibility consequence of failure
to failure (questionnaire) (questionnaire)

matrix

CONFIDENCE
CRITICALITY RATING

Redesign matrix Implement Monitoring

– PROCES DESIGN NO YES - PROCESS
– MECHANICAL DESIGN MONITORING
- OPPORTUNITY
ACCEPTABLE? INSPECTIONS
93
RRM Criticality Matrix - for non age-related
degradation
RBI
StF
IPF
DR
RCM
ETBF RRM CRITICALITY CLASS
PROBABILITY CLASS

4 HIGH 0 - 0.5 y 0 - 0.5 y L HNOT acceptable

MH for nonEage-relatedE
3 Additional M degradation mechanisms
MEDIUM 0.5 - 4 y 0.5 - 4 y L H MH E
process
2 LOW 4 - 20 y 4 - 20 y N L M MH H
monitoring
1 NEGL. > 20 y > 20 y NOTNrequired N L M MH
SLIGHT DAMAGE MINOR DAMAGE LOCAL DAMAGE MAYOR DAMAGE EXT. DAMAGE
ECONOMICS (USD)
CONSEQUENCE

<10K 10-100K 0.1-1M 1-10M >10M

CATEGORY

MULTIPLE
HEALTH & SAFETY SLIGHT INJURY MINOR INJURY MAYOR INJURY SINGLE FATALITY
FATALITIES

SLIGHT MINOR LOCALISED MAYOR MASSIVE

ENVIRONMENT EFFECT EFFECT EFFECT EFFECT EFFECT

NEGLIGIBLE LOW MEDIUM HIGH EXTREME

CONSEQUENCE CLASS 1 2 3 4 5

STF (RBI): Susceptibility to Failure E = Extreme H = High

DR (IPF): Demand Rate MH = Med.High M = Medium
ETBF (RCM): Estimated Time Between Failures L = Low N = Negligible
94
Confidence Rating - non-age related
degradation
Confidence Rating Adjustment factor
VH - Very high + 0.2
H - High + 0.1
M - Medium 0
L - Low -0.1
VL - Very Low -0.2

Description Score
YES Int. NO
Degradation mechanism can be easily controlled + 0.1 0 - 0.1
Relevant proc. parameters are reliably monitored + 0.1 0 - 0.1
95
Reliable inspections were carried out + 0.1 0 0
Monitoring and Inspection - for non age-related
degradations

Confidence Rating
Criticality Very Low Low Medium High Very High
Extreme
DETAILED ANALYSIS AND
High RISK MITIGATING
MEASURES REQUIRED
Medium High MONITORING AND
OPPORTUNITY
Medium INSPECTION
Low IMPROVE MONITORING
Negligible NO INSPECTION/PROCESS MONITORING REQUIRED

96
Process Monitoring - non-age related
degradations
• Parameters to be monitored, as described in the
Integrity Operating Window (IOW).

• Frequency to be described/agreed.

• Deviations measured (outside monitoring scheme)

shall be discussed in the team and actions
reported;
changes via Plant Change procedure if needed.

• Revise inspection plans if needed.

97
Inspection / Monitoring Timing?
• Age-Related Degradations - Inspections
- Calculate Remnant Life
- Apply Interval Factor:
- based on Confidence and Criticality Rating

• Non Age-Related Degradations - Monitoring

- Apply table to check if monitoring is required/acceptable:
- monitoring scheme (+ opportunity inspections)
- Based on Confidence and Criticality Rating

98
Inspection Tasks CRITICALITY
MATRIX

negligible LOW/MEDIUM/MH extreme

criticality & HIGH CRITICALITY criticality
detailed analysis &
‘no’ inspection
risk mitigation
NON-AGE RELATED AGE RELATED DEGRADATIONS
DEGRADATIONS
CUI
RECTIFY IF CONFIDENCE RATING
REQUIRED CONFIDENCE RATING
REMNANT LIFE

INFORMATION FROM
PROCESS MONITORING DEGRADATION INSPECTION INTERVAL
AND OPPORTUNITY INSPECTION MODULES
NON-INTRUSIVE/INTRUSIVE

INSPECTION/MONITORING
TASKS 99
 Criticality Matrix

Low / Medium & High &

Negligible
MediumHigh Extreme
Criticality
Criticality Criticality

‘No’ Detailed
Inspection Analysis

Age-Related Non-Age-Related
confidence
rating
CUI confi- remnant life confidence
dence rating rating

Inspection Interval Process Monitoring

non-intrusive / intrusive

information about:
degradation morphology,
CUI Strategy non-destructive testing, Specific
selection process conditions, etc. Risk Management

Other
Inspection / Monitoring Tasks Actions 100
 S-RBI STUDY FOR A CORROSION LOOP

1. Define the Corrosion Loop THE

2. Describe process conditions 10
3. Establish the “Operating Window” STAGES
4. List items in the Loop:
¾ Materials and corrosion allowances (design)
5. Agree Potential Degradation Mechanisms for the Loop
6. Review inspection history – corrosion rates
7. Give a Confidence Rating for each item and degradation
8. Do the criticality rating per Degradation Mechanism
9. Establish remnant life and maximum inspection interval or
monitoring scheme
10. Define scope of inspections/monitoring
Next stage: DEVELOP DETAILED INSPECTION PLAN

101
The S-RBI process
Equipment
Data List
Analysis/Review
Design- and Feedback
Inspection Data

Asset Integrity
Task Execution
Database
S-RBI PACKAGE

Corrosion Loop Inspection/Monitoring

Definition Planning

Criticality Confidence
Assessment Assessment

102
FEEDBACK/REVIEW
• VALIDATION AND UPDATING
OF THE PLANT INTEGRITY DATABASE:
¾ after each T/A or maintenance and inspection shutdown
¾ at the implementation of plant changes
¾ at deviations of integrity operating conditions

• YEARLY REVIEW BY RBI-TEAM TO ESTABLISH:

¾ actual condition and fitness for purpose
¾ degradation mechanism and -rate
¾ confidence rating

• UPDATE INSPECTION PLAN, IF REQUIRED

103
RRM software v2.0
Release Jan. 2004

104
Thank you for your patience

105