Risk-Based Inspection and Maintenance: Feedback/User Needs

Paper presented at Risk Based Management Seminar, IoM, London, 21-23 October 2002

Abstract

This keynote paper considers the current level of industry uptake of risk-based inspection and maintenance (RBI/RBM). The safety and commercial benefits of RBM as an asset management tool are becoming clearer and are gaining acceptance by safety regulators. The needs and perception of RBM however vary across industry sectors. After a review of current regulations and guidelines, a summary of the results of an industry survey carried out as part of a TWI Joint Industry Project is presented. The technical and organisational requirements of RBM are illustrated by reference to a 'best practice' guidance document developed by TWI in association with the UK Health & Safety Executive. The key issues for effective implementation of RBM tools are accordingly identified. The importance of user friendliness and a formal link to inspection periodicity are highlighted. The latter issues are illustrated by application of TWI's RISKWISE ^TM product.

Introduction

The assessment of risk forms part of what is increasingly known as 'asset management'. The principle of asset management is to assist companies in adopting a holistic approach to performance improvement which deals not only with the technical or commercial risks themselves but also the context in which they exist.

Regardless of the industry sector, the objectives of the exercise are often related to improvements in: safety, availability, productivity, O&Mmp;M costs, shareholder value, etc. Once the objectives are set, a formal risk assessment of existing systems will reveal those areas where risk mitigation is necessary or where performance can be improved. A risk-cost optimisation process then allows selection of the most cost-effective risk management measures.

In the context of safety as well as economics, risk is a combination of the probability of occurrence of a hazardous or detrimental event and the magnitude of the consequences of the event. Risk is defined by three components: the event, probability of the event occurring, and the undesirable consequences. Perception of risk is often strongly influenced by the consequences rather than probability.

From the viewpoint of integrity management of plant and machinery, the practice of risk-based life management is complex. A balanced approach to life management is to consider all political, economic, commercial, technological and human aspects. In this process, a wide range of pertinent issues should be considered, including:

• The nature and tolerability of risk,
• Principles of management of health and safety at work,
• Process of and methods for risk assessment and management,
• Industry guidelines on risk-based plant safety, availability and inspection,
• Risk related decision making, and
• Fitness-for-service.

Industry is recognising that benefit may be gained from adopting formal risk-based approaches to plant integrity management through improved targeting and scheduling of inspections and maintenance activities. The primary benefits of RBI and RBM are: improved health and safety management; cost savings derived from extending inspection intervals, avoiding unnecessary inspection; increasing plant availability; and optimum repair and replacement scheduling.

Regulations and guidelines

Overview of regulations governing industrial risks

The European Commission has introduced a series of European Health and Safety Directives which are law and are becoming implemented by every Member State within the EU. In the United Kingdom, the law requires industries to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all their employees and to conduct their operations in such a way to ensure, so far as is reasonable, that the public is not exposed to risks to their health and safety. The Health and Safety Executive (HSE) in the UK is responsible for drawing up the guidelines on tolerability limits of risk at work. ^[1] The HSE requires the risks within the tolerable limits to be reduced as low as reasonably practical, commonly known as the ALARP principles. Practices of industrial risk regulation and management have been under continuous development over the last three decades. One of the challenges today in industrial risk management is that society becomes less tolerant of risks. Industrial operations are expected to work to a much lower level of risk than that associated with daily life activities. It is therefore crucially important to understand that risk can only be reduced to ALARP.

Risk assessment and management must answer the following questions:

• What can go wrong?
• What are the causes?
• What are the consequences?
• How likely is it?
• How safe is safe enough?
• How can risks be reduced?

There are three generic steps in the risk assessment and management process:

• Identification of hazards,
• Assessment of the risk
• Reduction of risk.

Industry guidelines on plant safety and risk-based methods

Nuclear safety assessment principles in the UK are set within the 'Tolerability of risk from nuclear power stations (TOR)' and the 'Safety assessment principles for nuclear plants (SAPs)'. ^[2] The SAPs require that all potential accidents be identified in a systematic manner. For the analysis of accidents, the SAPs use a three-pronged approach. This requires the deterministic analysis of: (a) both design basis accidents (DBAs); (b) beyond design basis accidents (BDBAs), including severe accidents; and (c) probabilistic safety assessment (PSA). PSA has been used for many years in the UK in licensing and regulation and is now an established feature of safety cases.

A framework of risk-related decision support has been published by the UK offshore oil & gas industry. ^[3] It recognises the need to reach a risk-related decision with a combination of technical and value-based approaches including:

• Engineering codes and standards,
• Good practice,
• Engineering judgement,
• Risk-based assessments, and
• Value based approaches.

The framework provides a means to determine the relative importance of the various methods of assessing risk by referencing the role of standards, quantitative risk assessment (QRA), societal values, etc. Operators are required to judge which combination of these methods is best used to determine whether the risks are tolerable and ALARP.

In 1991 ASME published a general document on the use of risk-based technology for the development of inspection guidelines. ^[4] This document presented an overall risk-based inspection process. It described techniques and tools to be used at each stage of the process. It also presented examples throughout the text to illustrate the use of those tools.

In 1992 ASME published a second document, Volume 2 - Part 1 Light water reactor (LWR) for nuclear power plant components, in a series covering the development of guidelines for risk-based inspection. ^[5] Volume 2 is an application of the general methodology in Volume 1, for the inspection of nuclear power plant components. Nuclear power plants are different from any other industry installations in that multiple levels of safety protection are designed and built into plant systems on the principle of 'defence-in-depth'. This means that combinations of unlikely events must occur to cause the breach of the defence and to result in a significant public harm. Since the potential consequences of a nuclear release are severe, and the chain of interacting events leading to the final event of core damage is complex, rigorous probabilistic risk assessments (PRA) are required. PRA have been performed in nuclear safety assessments for many nuclear power plants in the UK. The use of this extensive PRA information is a key feature of the methodology presented in Volume 2 in the quantitative risk assessments.

In 1994 ASME published a third document, Volume 3, covering fossil fuel-fired electric power generation station applications. ^[6] It addresses the in-service inspection (ISI) of components in fossil fuel-fired electric power generating stations. It considers application of a risk-based methodology to all fossil power plant components that contribute to plant unavailability, but the primary focus of inspection is on components that maintain a pressure boundary.

The ASME approach ^[4] comprises a qualitative risk ranking as well as a quantitative assessment applied to individual components or equipment items. The quantitative approach recommends that a full FMECA (Failure Modes Effects Criticality Analysis) should be conducted. The use of operating experience databases and analytical damage models together with their probabilistic application is also recommended. The latter is required for establishing inspection periods, although detailed examples of the analytical process are not given.

API BRD 581 'Base resource document on risk-based inspection' (preliminary draft) was published by the American Petroleum Institute in 2000. ^[7] It was produced for the oil & gas production, oil refining and petrochemical industry conforming to American regulation and industry practice. It was intended for equipment designed and constructed to the ASME and ANSI codes, as well as the in-service inspection guidelines of API RP 510, RP 653, and RP 570. It was mainly for inspection on pressure maintaining equipment such as pressure vessels and piping, but also for other equipment such as heat exchangers and the pressure-retaining components of pumps.

API BRD 581 ^[7] comprises qualitative and quantitative approaches. The qualitative approach is based on a series of failure likelihood and failure consequence factors and delivers equipment positioning within a five by five risk matrix. For the quantitative method in API BRD 581 the likelihood evaluation process starts with a generic failure frequency for the type of equipment in question. This value is then modified by factors relating to: the specific equipment (F _E) and the safety management regime (F _M). F _E takes account of items such as damage type, inspection effectiveness, condition, design and fabrication, process control and safety management and F _M addresses the potential impact on mechanical integrity of all process safety management issues from API RP 750. The factors F _E and F _M are obtained from an exhaustive scoring system based on questionnaires or workbooks. The quantitative assessment of failure consequence within API BRD 581 is based on a systematic multi-stage process to determine costs relating to explosive release, toxic consequences, environmental clean-up and business interruption.

The API and ASME approaches are similar in that they both advocate progression from a relatively simple qualitative risk ranking method to a far more complex quantitative method requiring significant effort and expertise to execute. Although the ASME approach considers the time dependence of failure probability, neither approach offers clear and formal methods to translate risks into inspection frequencies.

Guidelines on assessment of inspection frequency

The Safety Assessment Federation (SAFed) in 1997 produced a set of guidelines on the periodicity of inspections. ^[8] The guidelines adopt a basic qualitative risk assessment approach and further state that they should only be adopted after proper consideration of individual circumstances pertaining to each pressure system. The European Confederation of Organisations for Testing, Inspection, Certification and Prevention (CEOC) has developed advisory guidelines aimed at harmonisation within the EU with respect to inspection frequency of boilers and pressure vessels. ^[9] An approach is proposed whereby likelihood of failure scores are used to establish position on a risk matrix. The maximum period between inspections is then related to the assessed risk. The UK's Institute of Petroleum (IP) has also issued a code of practice for inspection of pressure vessels in the petroleum industry. ^[10] This approach groups equipment into different categories, e.g. process pressure vessels, storage vessels, etc. and uses a grading system to assign inspection intervals. The grade is set by the operator after the first examination. If operational practices are uncertain or if the rate of degradation is expected to be high, then the inspection interval can be reduced by the operator. For cases where the degradation rate is as expected and more predictable the grade achieved allows an extended inspection interval.

In summary, the regulatory environment in the UK is such that where reliable damage rate predictability exists, there is scope for operators to adopt formal methods for determining inspection periods based on risk and remaining life considerations.

Industry feedback survey

As part of a major joint industry project, TWI carried out a questionnaire-based survey to gain a better understanding of the needs of plant operators. Approximately 90% of the questionnaires that were distributed worldwide, were completed and returned to TWI.

The majority of respondents were based in the oil & gas refining, fossil power, chemical and petrochemical industries. The nuclear power generation, oil & gas transportation and onshore oil & gas production industries were under-represented.

The majority of respondents classified themselves as producers, operators or manufacturers and engineering service contractors. Engineering insurers, equipment manufacturers or suppliers and safety regulating authorities were under-represented in the survey.

A summary of the indications and directions resulting from the survey is given below. ^[11]

• The majority of all respondents' companies (69%) had 'Previously implemented' RBI/RBM, or were 'Currently implementing' RBI/RBM. Several respondents, in all sectors, indicated that they were currently implementing RBI/RBM. Fossilfuel power generation, petrochemical, oil & gas refining, and chemical companies had the largest proportion of respondents that were considering implementation.
• The only sectors in which respondents had indicated that senior management was 'Unconvinced' that an RBI/RBM program would be beneficial to their company' were the petrochemical, offshore oil & gas production and chemical sectors. Approximately 60% of all respondents indicated that senior management was 'Convinced' or 'Very convinced' that an RBI/RBM program would be beneficial to their company.
• Approximately 98% of all respondents (whose company's had previously undertaken a RBI/RBM assessment), indicated that the results of their RBI/RBM program had 'Met expectations' or 'Exceeded the expectations' of their company.
• General pressure vessels, piping and heat exchangers are the types of equipment to which RBI/RBM is more often applied. Structures, safety relief valves and pumps, turbines and compressors are the equipment to which RBI/RBM is least often applied.
• Approximately 20% of all respondents indicated that their company had established and documented a uniform RBI/RBM policy or guidance for application throughout their company. In the fossil power generation sector respondents indicated that their company has not, and is not preparing to, produce a uniform policy or guidance document.
• With regard to how many people were currently responsible for managing the day-to-day introduction of RBI/RBM, 47%, 10%, 28% and 15% of respondents across all sectors indicated that their company had set up a 'Part time -Individual', 'Full time - Individual', 'Part time - Project team', and 'Full time - Project team', respectively.
• Approximately 60% of all respondents whose company is currently using, or intends to use RBI/RBM software, indicated that their software was not linked to any other electronic data management system, or other software system.
• Approximately 24% of all respondents indicated that both the input variables and output results of their RBI/RBM software were linked to another data management or software system.
• Respondents indicated that there is no substantial increase in the accuracy of semi-quantitative compared to qualitative (subjective) RBI/RBM methods. However, respondents believe that qualitative methods were substantially faster to apply than semi-quantitative RBI/RBM methods. Quantitative (probabilistic) methods were considered to be the most accurate of the three methods, but also the slowest of the three RBI/RBM methods to apply.
• Approximately 57% of all respondents indicated that their Safety Regulating Authority accepted RBI/RBM as an alternative basis for determining inspection and maintenance intervals. However, there was no one region of the world in which RBI/RBM was entirely accepted as an alternative basis for determining inspection and maintenance intervals.
• For those respondents that had previously undertaken RBI/RBM assessments, the two most important reasons for implementing a RBI/RBM program were: (a) improving the overall safety of critical plant; and (b) reducing the duration of inspection or maintenance outages.
• Similarly, for those respondents that were currently undertaking RBI/RBM assessments the two most important reasons for implementing a RBI/RBM program were: (a) improving the overall safety of critical plant; and (b) extending the interval between inspection or maintenance outages.
• The two overall least significant reasons for implementing a RBI/RBM program were: Classification of plant in terms of potential for environmental damage; and reducing the duration of inspection or maintenance outages.
• For those respondents that had previously undertaken RBI/RBM assessments, the most critical success factors for RBI/RBM implementation programs were: (a) having the 'right' people in the assessment team; (b) appointing a suitable assessment team leader; and (c) reliability of the RBI/RBM analysis methodology.
• For those respondents that were currently undertaking RBI/RBM assessments, the most critical success factors were: (a) having the 'right' people in the assessment team; (b) reliability of the RBI/RBM analysis methodology; and (c)appointing a suitable assessment team leader.
• The overall least important success factor was considered to be the 'speed of undertaking RBI/RBM assessments'.
• For those respondents that currently use and intend to use RBI/RBM software, the most important attributes of the assessment software were: (a) overall user-friendliness of the software system; and (b) based on well-known or published model or methodology.
• For those respondents that have not and do not intend to use RBI/RBM software, the most important attributes were: (a) based on well-known or published model or methodology; and (b) tracking system for actions.
• The overall least important attributes of RBI/RBM software program were the software vendor's operation and maintenance costs and the incorporation of a help feature based on 'expert rules' or 'knowledge base' within the software.

Effective RBI/RBM implementation

The process of RBI/RBM should form part of an integrated strategy for managing the integrity of all assets and systems throughout the plant or facility. RBI/RBM is a logical and systematic process of planning and evaluation. From the 'Best Practice Guideline' developed by TWI in association with the UK Health & Safety Executive the major steps within the process are as follows ^[12] :

• Establish requirements and clear statement of objectives,
• Define systems, system boundaries and equipment to be addressed,
• Specify the RBI management team and responsibilities,
• Assemble plant database,
• Evaluate failure scenarios, damage mechanisms and uncertainties,
• Perform risk audit based on event probability or likelihood and event consequence analyses,
• Review risk management measures and develop risk-focused inspection plan,
• Implement inspection plan and any associated operational or maintenance measures,
• Assessment of inspection findings in terms of remaining life and fitness-for-service,
• Update and feedback to plant database, risk audit and inspection plan on a continuous basis.

For control purposes and to ensure best practice the plant manager should exercise a 'performance audit' on each of the above steps in the RBI process.

The steps are intended to assist industry to evaluate the processes being used for integrity management and inspection planning of pressure systems and other systems containing hazardous materials.

Some of the main requirements and critical issues for the effective implementation of RBI which should be recognised by suppliers of RBI programmes and software products, are summarised below. ^[13]

 

User-friendly software

It is essential that the RBI tool is fully understood and accepted by the user and is easily used without undue complexity. For increased efficiency, the software could be linked with inspection or corrosion data management systems where these are installed such that plant data can be efficiently accessed.

Incorporation of all damage mechanisms

The RBI process should take account of all deterioration mechanisms and failure modes to a level of state-of-the-art understanding. Failure databases derived from plant experience together with available material models and associated databases are important input. It should be recognised however, that comprehensive 'expert systems' or prescriptive modules based on knowledge of nominal service conditions, to predict all failure scenarios do not currently exist. Expert judgement in association with technical guidance is the key issue.

Audit team approach

The risk audit, the evaluation of risk management options and inspection planning stages requires a multi-disciplinary input covering a range of competences. Therefore, it is best performed by a team of experienced plant engineers. The team should include plant personnel with technical expertise covering the following areas: risk analysis, process hazards and business consequences, local safety management, plant design and materials, operations, inspection and maintenance functions, and inspection and NDE techniques.

The complexity of the plant or facility should determine the size of the team. Safety implications should be addressed by individuals in the team who can demonstrate professional competence. The team leader should preferably be remote from pressures associated with plant production. Consensus is required on all major decisions and a complete record must be kept of all judgements and decisions made. Auditability is essential through all stages from plant data capture to inspection planning rationale.

Further benefits of an interactive audit team approach are the on-the-job training and transference of assessment know-how implicit within the approach.

Risk management measures

RBI tools, which only output a relative risk ranking, no matter how comprehensive, do not necessarily provide the solution that operators are looking for. A more holistic approach is increasingly being required whereby the operator is systematically directed through a series of risk management options. These options should not be restricted to inspection or maintenance actions but should also lead the operator to other measures such as, design or engineering modifications, operational changes, etc. The impact of each risk management action should be retained by the software so that cost-risk optimisation can subsequently be undertaken.

Formal link to inspection frequency

RBI tools which only outputs a relative risk ranking, whether qualitative or quantitative, leave the user with the problem of selecting an appropriate and safe inspection period.

Health and safety regulations do not specifically prescribe inspection intervals. In the self-regulating environment in the UK, a competent person is expected to use judgement and experience in deciding inspection and maintenance intervals. The UK's Institute of Petroleum ^[10] and SAFed ^[8] have issued guidelines on maximum service intervals between inspections.

In spite of the above, to be effective the RBI tool should offer formal guidance on the inspection frequency based on the risk audit undertaken. The inspection frequency determination must include formal consideration of remaining life for all critical time dependent damage mechanisms. A failure probability route to estimate the remaining life based on established rules (e.g. ASME RBI Guidelines ^[4] ) within a practical user-oriented approach is preferable. ^[13]

 

RISKWISE ^TM software

RISKWISE ^TM is TWI's RBM software for optimising plant maintenance planning. RISKWISE ^TM has been developed and continuously updated to meet the foregoing requirements of both users and regulators. ^[11,13] Specific outputs are:

• Unit-wide risk audit enables repair and maintenance resources to be risk-focused.
• Safe inspection periods are formerly obtained based on an implicit time dimension of risk.
• Risk mitigation measures are signalled and selected to meet maintenance frequency targets.

RISKWISE ^TM has the following functionality:

• assesses the likelihood and consequence of failure for equipment items and produces an itemised risk and remaining life profile for each plant unit
• is convenient to use and can be easily learned as the risk model allows qualitative as well as quantitative input
• includes a regularly updated database with all relevant damage mechanisms, as well as guidance on formulating the likelihood or probability and the consequence of failure
• allows the user to appraise or focus/defocus the probability and consequence attributes for each component, e.g the level of inspection and maintenance and thus mitigate the risk of loss or optimise the current inspection programme
• identifies the most likely damage locations in each component and allows inspection to be properly targeted
• determines the risk of failure with time which provides a formal basis for assessing remaining life and hence establishing the maximum period between major inspection outages.

Key features of RISKWISE ^TM include:

• user friendly software, fully transparent - ensures buy in by users
• uses an audit team approach - accommodates plant experience
• readily interfaces with computerised maintenance management systems
• incorporates a time-based risk auditing module enabling equipment to be ranked by risk and remaining life
• determines inspection/maintenance frequency based on a practical treatment of formal reliability rules - remaining life indicator (RLI) module
• A risk-management or focus/defocus module - facilitates selection of optimum mitigation measures
• fully auditable output - acceptability to insurers/regulators
• suite of products includes application to power generation, pipelines, storage facilities and process plants

The keynote lecture will include a software demonstration illustrating the above features.

Concluding remarks

Risk-based approaches are an integral part of holistic asset management aimed at all aspects of improved safety and business performance.

The benefits of risk-based methods for inspection and repair or replacement optimisation are recognised by different industry sectors. However, an industry survey indicates a lack of established and documented uniform RBI policy or guidance for application throughout the industry sectors.

API and ASME guidelines however are based on relatively simple qualitative risk ranking followed by exhaustive quantitative routes, which often involve specialists and significant resource commitment.

Expert judgement is essential in identifying all potential damage mechanisms. In addition to the risk audit itself; RBI/RBM assessment software should lead the audit team to consider all risk mitigation measures, as well as optimal inspection activities.

The requirement to retain application efficiency and user friendliness is an important issue in RBI/RBM software tools. The concept of the Remaining Life Indicator (RLI) incorporated in RISKWISE ^TM can demonstrate that the single semi-quantitative approach could be sufficient for plant-wide inspection planning as well as establishing risk management measures.

Incorporation of fully quantitative tools in risk-based methods in most cases should be considered only as a refinement in terms of inspection planning although such approaches have their place where the remaining life is critical.

Acknowledgments

This paper is published with the permission of TWI. The author is also indebted to the TWI joint industry project sponsors, who are all Members of TWI.

References

1. 'The tolerability of risk from nuclear power stations'. Health and Safety Executive, HMSO, 1992.

2. 'Safety assessment principles for nuclear plants'. Health and Safety Executive, HMSO, 1992.

3. 'Industry guidelines on a framework for risk related decision support'. UK Offshore Operator Association, Issue No.1, May 1999.'Risk-based inspection - development of guidelines, Vol. 1,

4. 'Risk-based inspection - development of guidelines, Volume 1, General guidance document'. An ASME Research Report CRTD-Vol. 20-1, ASME, 1991.

5. 'Risk-based inspection - development of guidelines, Volume 2, Light water reactor (LWR) nuclear power plant components'. An ASME Research Report CRTD-Vol. 20-2, ASME, 1992.

6. 'Risk-based inspection - development of guidelines, Volume 3, Fossil fuel-fired electric power generation station applications'. An ASME Research Report CRTD-Vol. 20-3, ASME, 1994.

7. Risk-Based Inspection Base Resource Document, 2000 API Publication 581, Primary Draft, American Petroleum Institute, May 2000.

8. SAFed 1997 - Guidelines on Periodicity of Examinations, Safety Assessment Federation, SAFed/BtB//1000/V97.

9. CEOC - Periodicity of Inspections of Boilers and Pressure Vessels. Confederation Europeenne d'Organismes de Controle, R 47/CEOC/CP 83 Def.

10. Institute of Petroleum 1993 - Pressure Vessel Examination Model Code of Safe Practice Part 12 Second Edition. The Institute of Petroleum.

11. Speck J B and Iravani A T M: 'Industry survey of risk-based life management practices' ASME PV&Pmp;P Conf. August 2002.

12. Wintle J B, Kenzie B W, Amphlett G and Smalleys: 'Best practice for plant integrity management by risk-based inspection'. TWI Public Report No. 12289/1/01, March 2001. Produced for the UK Health and Safety Executive (HSE).

13. Cane B J 2001: 'User oriented risk-based integrity management tools'. WTIA Conference, Australia.