Risk based inspection (RBI) – A risk based approach to planned plant inspection

SPC/Technical/General/46

Version No:

4

OG status:

Fully Open

Author unit / section:

HID CI1F

Target audience:

HID Regulatory Specialist Inspectors (CI 1-3 and OSD)
HID Field Discipline Specialist Inspectors (Mechanical)
FOD Specialist Group Discipline Specialist Inspectors (Mechanical)

Purpose

This semi-permanent circular provides guidance to HID inspectors on the inspection of plant integrity management systems that adopt a risk-based approach, commonly known as Risk Based Inspection (RBI).

The guidance gives additional technical detail to support Chapter 8 of the HID LD 1-4 Inspection Manual, Assessing Risk Control Systems, RCS1: Planned Plant Inspection. It may also be of use to Regulatory Specialist Inspector carrying out Ageing Plant Inspections without the support of a Mechanical Engineering Discipline Specialist.

Some of the key findings of HSE sponsored research on RBI have been incorporated. This includes an introduction to an RBI Audit Tool (which can be found as part of Best practice for risk based inspection as a part of plant integrity management" TWI and Royal & Sun Alliance Engineering, CRR 363/2001, developed to assist duty holders in evaluating their own processes. This takes the form of a structured question set, which is potentially very useful to inspectors.

The aim is to provide front-line Regulatory Specialists with sufficient guidance to enable them to engage in dialogue with duty holders on the topic of risk-based inspection and to identify any potential areas of concern. Regulatory specialists are not expected to attempt a detailed technical inspection using this guidance. The information is given to help them prioritise their interventions and assess the level of importance/urgency when considering a request for specialist support.

Scope

1. This guidance is particularly relevant to the application of RBI in refineries, chemical process plant and similar establishments onshore and to process plant on offshore installations.

2. The circular does not cover the application of RBI in the specialised areas of Mining, transmission-pipeline engineering or to jacket structures encountered offshore. RBI can also be applied to the inspection-planning regime for supporting structures but this aspect is not covered in this SPC. The application of risk-based strategies to other related activities, such as maintenance, is also out of scope.

3. This SPC does not list or discuss in detail legislation or guidelines relevant to periodic examination, but a useful summary can be found in Chapter 2 of the contract research report by TWI/Royal Sun Alliance.

Background

4. Traditionally, plant has been examined at fixed intervals according to equipment type. This approach is not able to take account of good operating experience. Goal-setting legislation, such as the Pressure Systems Safety Regulations 2000 and the Control of Major Accident Hazard Regulations, allows for risk-based strategies, which focus inspection resources where they will have the greatest benefit.

5. Some industry sectors, particularly refining and petrochemicals, are adopting RBI to underpin and direct planned plant inspection. RBI is claimed to offer cost savings resulting from better targeting of finite resources, with reduced maintenance costs and increased plant availability.

6. RBI is claimed to offer safety benefits too, as it focuses on critical plant and identifies priorities for inspection based on risk. Critical plant will include pressure systems, but may also include some non-pressure plant, for example atmospheric storage vessels used to store dangerous substances on COMAH installations.

7. A number of factors will influence whether RBI achieves safety standards that are at least the equivalent of conventional inspection planning. These include:

• The reason for changing from conventional planning arrangements;
• The accuracy of data used in support of risk assessment methods; and
• The arrangements for audit and review of RBI systems.

8. RBI is a powerful tool if carried out correctly, as part of a long-term strategy. The introduction of RBI will typically require significant upfront investment of resources. However, there is the potential with reduced downtime etc. for improved safety standards and genuine cost savings. But, if the technique is not fully supported in the ways outlined below, it may not give the expected benefits. Decisions on changes to inspection methodology may be made that are not based on sound evidence. Inappropriate or incorrect application of RBI has the potential to dilute safety standards and can result in dangerous plant failures.

9. Sector specific guidance on RBI and the implementation of RBI schemes for the refining and petrochemical industries may be found in API RP 580 and the supporting publication API PUBL 581. Specific advice for the offshore industry is available in the DNV publication, DNV-RP-G101.

10. However, at the time of writing, probably the most accessible source of general information on the topic is the research report by TWI/Royal Sun Alliance. The bulk of this SPC is given over to key information extracted from this report. References are given to the corresponding text in the report for readers who wish or need to have greater detail.

Good practice for risk-based inspection

11. This circular uses the term Good Practice as it is used by HSE in the ALARP Suite where HSE makes a distinction between Good and Best Practice. This distinction is not universally observed in HSE publications however, particularly those that pre-date the ALARP suite. The reports referenced in this SPC may also use the term Best Practice to convey the same meaning as Good Practice. For the purposes of this circular, the information set out in the TWI/Royal & Sun Alliance report is considered to represent Good Practice and therefore duty holders are normally expected to adopt these practices or others that are demonstrably equivalent in their effectiveness.

12. Although there is no acknowledged definition of RBI, the term is now widely accepted as referring to a structured, team-based approach to planning inspection (including intervals between examinations and methods used) according to an assessment of the risk (which considers the potential causes, likelihood and consequences).

13. It cannot be emphasised too strongly that the most critical element of the assessment is the identification of the potential degradation mechanisms and sites. Knowledge of the active and potential threats to the integrity of the equipment is vital to the success of the RBI approach. The inspection plan can then target the high-risk equipment and be designed to detect degradation before fitness-for-service is threatened.

Inspecting integrity management systems that use RBI

14. This section highlights some of the key issues surrounding RBI, which Regulatory Specialists may wish to explore during interventions. Where inspectors have concerns or are unhappy with the responses from duty holders these should be referred to colleagues in the Mechanical Integrity specialist discipline.

15. The discussion mirrors the structure of the RBI Audit tool, in Appendix B of the TWI/Royal Sun Alliance report, and includes links to the question sets to be found there. Links are also provided to the more detailed information in the main report.

Why is there a requirement for RBI?

16. Duty holders should be clear about their reasons for adopting RBI and able to demonstrate that these are consistent with good health and safety management. One of the main drivers for adopting RBI is to optimise the cost of compliance with statutory duties. The duty holder should ensure that safety of personnel and the public is not compromised by financial considerations and broader company concerns.

17. The approach to integrity management adopted should reflect the complexity of the plant and the potential severity of the consequences of failure.

Background Information: CRR 363/2001, Chapter 3

Which systems and equipment require integrity management?

18. Systems subject to RBI need to be clearly defined. The boundaries and limits of the system should be established. All equipment relevant to an assessment of the risk from failure must be included.

19. The RBI team should identify all critical plant and equipment that is to be included in the programme. Critical equipment will normally include all pressure equipment and any associated pressure relief systems. Any other plant where the consequences of failure are unacceptable (eg the release of dangerous substances from pipe work and fittings, pumps, flare lines, or storage tanks) should be included. The exclusion of equipment from examination must be justified. The sites most susceptible to degradation should be determined and examined preferentially.

Background Information: CRR 363/2001, Chapter 3

Who are the members of the RBI team and what are their responsibilities?

20. For all but the simplest of installations, it is unlikely that a single individual will possess all of the skills, experience and knowledge required for a suitable and sufficient analysis. Implementing RBI will normally require the putting together of a multi-disciplinary team. The number in the team will vary, but three would normally be considered the minimum. The team needs to have the right mix of knowledge and experience and should be able to call upon other staff if required.

21. Areas to be covered include: Risk Assessment; Process Hazards/ Consequences; Plant Safety and Integrity Management; Mechanical Engineering/Materials Science; Plant-specific operation, maintenance and inspection history; Inspection methods (including NDT techniques where applicable)

22. For plant with the potential to lead to a major accident in the event of failure, the qualifications and competence of the individuals in the team need to be of a professionally recognised standing.

23. The RBI team must know its terms of reference and the necessary rigor of its approach. Records of team meetings should be made, and in particular, note taken of how qualitative judgements and decisions were reached.

24. It is highly desirable that the team leader is, and is seen to be, organisationally independent from the direct pressures of the production function and has the necessary seniority and authority.

Background information: CRR 363/2001, Chapter 4

Is all of the essential plant data necessary for the analysis available to the team?

25. The duty holder should make available all essential data for the risk assessment to be carried out. The original design and construction drawings and inspection reports of equipment are essential in order to assess many aspects relating to its structural integrity. The operating parameters should be clearly understood, along with potential variations. Data used in the analysis should be validated.

26. Records of poor material, welding, defects, weld repairs and manufacturing concessions are particularly useful since these can often locate sites of further deterioration in service. Without this information there is uncertainty that may only be remedied by in-service inspection. Comprehensive information should be compiled on the current condition of the plant, against which any degradation may be monitored.

27. Previous inspection reports enable trends in the deterioration of equipment to be established. But many risk based inspection strategies consisting of a review of the inspection frequency, are based only on previous inspection reports. This is not good practice. The scope and technique of the previous inspections should be taken into account. The techniques used in previous inspections should be appropriate for the degradation mechanism(s) identified by the RBI team.

Background information: CRR 363/2001, Chapter 5

Is the risk assessment thorough and complete?

28. The RBI team should use risk assessment, which may be either qualitative or quantitative, to prioritise plant for inspection. The risk assessment can be broken down into stages, all of which need to be completed if the inspection plan is to be soundly based:

• Identification of potential degradation mechanisms and modes of failure
• Assessment of the probability of failure for each mechanism/mode
• Assessment of the consequences of equipment failure, which will involve identification of the accident scenarios involving failure of the equipment
• Determination of the risk from equipment failure
• Risk ranking and categorisation

29. RBI schemes can be broadly divided into two types: those that rely predominantly on expert judgement (qualitative) and those that incorporate probabilistic methods (quantitative). Qualitative methods are more common than quantitative methods, and you should recognise that quantitative methods will still require an element of expert judgement.

30. A key element of the analysis is an accurate identification of all relevant degradation mechanisms and sites (active and potentially active). There should be a thorough and systematic process for identifying these. Again, this will be more effective if it involves experienced staff from different disciplines rather than being the work of a single person.

31. It should consider whether changes to the operating parameters of plant could affect the degradation mechanisms. It should also consider whether a feedback mechanism exists between plant operators and the RBI assessment team to register the implications of such changes.

32. Research has revealed wide discrepancies between the degradation mechanisms identified by different duty holders, using a variety of in-house and commercial assessment tools. In some cases thorough analysis may conclude that there are no active or potentially active degradation mechanisms. However, some uncertainty will exist even for the most well controlled plant environments.

33. Consequently, any RBI scheme for high-consequence plant that fails to include provision for validating the assumptions made about degradation mechanisms gives cause for concern. This applies to the mechanisms which have been assessed as active or potentially active, and importantly also to mechanisms other than those assessed as active or potentially active where it may be necessary to undertake sample checks to confirm their exclusion.

34. With an in-house assessment methodology, the duty holder will typically have a better understanding of the significance of the inputs. Third party tools and expert systems can be used successfully, but the duty holder needs to ensure that personnel using the tool are competent to do so. They will need to understand enough about the tool and the built-in assumptions and so on, to fully appreciate its limitations and the significance of the inputs.

35. The RBI team should review the historical and generic data relevant to each item of plant requiring inspection. This will include a consideration of previous inspection reports and the known or expected failure mechanisms. The RBI team will also need to consider the effect of specific plant failure on the safety of the installation as a whole.

36. A qualitative risk assessment is usually carried out using a simple risk matrix, with likelihood and consequences of failure on separate axes. The RBI team may use their expert judgement to estimate likelihood and consequence as either high, medium or low. The estimated likelihood of failure is increased where there is a lack of knowledge about the equipment, its operation, or current condition.

37. The corresponding consequence analysis should consider factors such as; financial implications, effects of failure on the whole installation, release of hazardous fluids, release of pressure energy, environmental impact and mitigating factors such as the provision of leak detectors, water curtains or isolation valves, for example. The results of the analysis are plotted on the risk matrix to identify priorities for inspection. Care needs to be exercised where financial and safety implications are averaged in the consequence analysis.

38. More sophisticated (quantified) RBI techniques will require the estimation of failure frequencies for each identified failure mode. In many cases accurate and applicable failure frequency data will not be available and an element of expert judgement will be required to provide estimates.

Background Information: CRR 363/2001, Chapter 6

How has the inspection plan been developed and how does it fit within the overall integrity management strategy?

39. Note that in-service inspection forms one part of the integrity management strategy for the site, and should be considered in conjunction with other measures, such as corrosion control and operating condition monitoring.

40. From the findings of the risk assessment, a plan for the inspection of the equipment can be put together covering not just the frequency of inspection but also the appropriate methods to be used - these should be chosen according to the identified degradation mechanism(s).

41. The success of RBI can be critically dependent on identification of the correct degradation mechanism(s) and sites. The inspection plan should include sample checks for unanticipated degradation processes.

42. Under the Pressure Systems Safety Regulations 2000 (PSSR), every pressure system requires a written scheme of examination (WSE) covering all relevant parts of the system and either written or certified as suitable by the Competent Person. The WSE specifies the nature and frequency of examinations and any special measures needed to prepare the system for safe examination.

43. The application of RBI may lead to recommendations to modify the WSE, possibly calling for longer or shorter periods between examinations and/or changes to the nature of the examinations. These recommendations may, with the agreement of the Competent Person, be incorporated in the WSE. Examination intervals in the WSE should have an element of conservatism commensurate with the degree of uncertainty associated with the data available and the consequences of a failure.

44. Where the recommendation is to shorten the interval between examinations because high safety risks from equipment failure have been revealed, then this reduced interval should be implemented as soon as reasonably practicable commensurate with the risks.

45. It should be borne in mind that PSSR equipment should not continue in operation beyond the date of next examination as specified in the report of examination issued by the competent person, PSSR Regulation 9. Thus in cases where the RBI recommendation is to extend the interval between examinations in the WSE, the next examination of the equipment must still take place on or before the date of next scheduled examination specified in the current report of examination issued by the competent person, unless a formal postponement is made in line with PSSR Regulation 9, which includes the duty holder notifying HSE of the postponement. HSE upholds this principle to prevent less diligent operators reviewing WSEs prior to inconvenient 'next examinations' on a continued basis.

46. The timing of the first examination for new equipment is very important. It is usual to specify a shorter interval for the first in-service examination. This is because service conditions may be more onerous than envisaged and previously undetected manufacturing defects could become significant under the conditions of service. New equipment must be assumed to have a conservatively high likelihood of failure until favourable operating experience has been established by the first in-service inspection or by other means.

47. It will be very rare indeed that a convincing case can be made for no examinations at all for the life of the equipment. Inspectors presented with arguments of this nature by duty holders should refer them to a mechanical integrity specialist.

Background Information: CRR 363/2001, Chapter 7

Is the method of examination appropriate to achieve effective and reliable detection of defects?

48. A wide range of inspection techniques is available. These include invasive, non-invasive, metallurgical and non-destructive methods. RBI should specify the techniques that are most effective for the type of in-service deterioration predicted.

49. The limits to the effectiveness and performance of the inspection techniques and the quality of data from previous inspections should be clearly understood. When assessing the current condition, the RBI team should be able to demonstrate that all relevant factors have been taken into account in specifying the inspection techniques. The performance and reliability of the inspection and NDT needs to be commensurate with the risk from failure of the components/equipment inspected.

50. Personnel involved in inspection and NDT must be competent and have the appropriate training and qualifications for the tasks to be carried out. Inspection equipment should be checked before use to ensure that it is functioning and calibrated correctly.

51. Capability assessment should be a requirement for new or specialised inspection techniques (particularly for non-invasive, long range, or remote techniques) where these are being used in situations where prior evidence and experience of capability is not available. In particular where there is change from an internal examination strategy to an alternative external examination using non-invasive techniques then the competent person should be able to robustly demonstrate that the non-invasive inspection is as effective as the invasive inspection it replaces.

52. Inspection techniques, including NDT methods, are a specialised topic. HSE has published guidance in this area. Further guidance will become available in the near future; in an update to the permanent manual supporting the technical assessment of COMAH safety reports. But any concerns should be discussed with a mechanical integrity specialist.

Background Information: CRR 363/2001, Chapter 8

How are the examination results used to assess the continuing fitness-for-service of the equipment?

53. The assessment should determine the current condition of the equipment and identify any changes relative to the design specification, the condition as fabricated and that at the last inspection.

54. Duty holders are expected to assess fitness-for-service by reference to design specifications, fitness-for-service calculations or other suitable means. Equipment is normally fit-for-service as long as it will remain within the minimum design basis taking into account the predicted degradation over the period to the next scheduled examination.

55. Deterioration rates and rates of growth of defects can be very variable. Suitable conservatism and allowance for uncertainty needs to be built into fitness-for-service assessment.

56. The fitness-for-service assessment may lead to recommendations for repair, modification or replacement of system components; or for changes to operating conditions to reduce the rate of degradation. Appropriate deadlines for implementation of repairs and other changes should be set, and adhered to.

Are the results of the examination fed back into a re-assessment of the risk and if necessary, revisions to the inspection plan?

57. There should be procedures in place to feed back the examination results into the plant database so that a re-assessment of the risk and the inspection plan can take place. The RBI team must be informed of any repairs or modifications to plant so that the impact of these on active or potential degradation mechanisms can be properly assessed. Lines of communication between the plant operators and the RBI assessment team should be clearly identified and remain open while the plant is operating. This is of particular importance where changes to the operating parameters of a plant have the potential to affect the degradation mechanisms for that plant.

58. Evidence of risk re-assessment after examination should be available. Changes to the initial risk assessment following re-assessment should be documented. Any remaining uncertainty should be allowed for in future inspection plans.

Background Information: CRR 363/2001, Chapter 9

What are the arrangements for audit and review of the integrity management process?

59. It is beyond the scope of this SPC to provide a guide to inspection of the whole integrity management process, which should be subject to periodic audit and review. But inspection planning, and hence RBI, is an integral part of that integrity management process. Evidence should be available that RBI arrangements are included in the audit and review process.

60. Within RBI, the data and processes used for making judgements and assessments of risk should be given particular scrutiny. Information availability, flow, and transparency of decision-making are especially important.

61. As a result of the audit and review, Duty Holders should develop programmes to improve their management arrangements where this is necessary.

Background Information: CRR 363/2001, Chapter 10

Further information

For further information regarding this circular contact:

HID CI Mechanical Engineering Team (CI 1F) 0131 247 2027

References

1. "Best practice for risk based inspection as a part of plant integrity management" TWI and Royal & Sun Alliance Engineering, CRR 363/2001.
   • Full Report (including Appendices) [3MB]
2. "Risk Based Inspection - A Case Study Evaluation of Onshore Process Plant", HSL/2002/20, W Geary PhD MIM C. Eng.
3. HSE Technology Division Report, "Best Practice for the Procurement and Conduct of Non-destructive Testing:" Part 1: Manual Ultrasonic Inspection, November 2000; Part 2: Magnetic Particle and Dye Penetrant Inspection, April 2002
4. Risk Based Inspection, American Petroleum Institute Recommended Practice, RP 580, Revision 02, [API Catalogue ref: C58001]
5. Base Resource Document on Risk Based Inspection, American Petroleum Institute, PUBL 581, [API Catalogue ref: C581001]
6. Risk-based Inspection of Offshore Topside Static Mechanical Equipment, Det Norske Veritas (DNV) Recommended Practice, DNV-RP-G101
7. Level 3 Guidance for the Assessment of the Technical Aspects of COMAH Safety Reports: Technical Measures Document - Inspection/Non-Destructive Testing (NDT) [An extensively updated and revised version of this document is expected to appear in the next update to this manual in January 2004]