16991
16991
16991
National foreword
NORME EUROPÉENNE
EUROPÄISCHE NORM April 2018
ICS 0 3 .1 0 0 .0 1
English Version
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving
this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre
or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language
made by translation under the responsibility of a CEN member into its own language and noti fied to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark,
Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain,
Sweden, Switzerland, Turkey and United Kingdom.
© 2 018 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN 1 6991 : 2 01 8: E
worldwide for CEN national Members
BS EN 16991:2018
EN 16991:2018 (E)
Contents Page
2
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
European foreword
This document (EN 16991:2018) has been prepared by Technical Committee CEN/TC 319 “Maintenance”,
the secretariat of which is held by UNI.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by October 2018 and con f licting national standards shall
be withdrawn at the latest by October 2018.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this Eur opean Standard: Austria, Belgium, Bulgaria, Croatia ,
Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France,
Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands,
Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and
the United Kingdom.
Get more FREE standards from Standard Sharing Group and our chats
4
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Introduction
Since the late 1990s, inspection and maintenance approaches in industry have been globally moving
from prescriptive, time-based towards risk-based ones. This trend has clearly been established by the
wish to increase the on-stream production time, to reduce unscheduled downtime due to corrective
maintenance, to avoid shutdown due to equipment failure and/or to reduce undesirable impacts on
process safety.
This European Standard provides the essential elements of risk-based assessment of industrial assets
according to the approach developed and demonstrated in the European pre-standardization document
CWA 15740:2008 [1]. The CWA 15740 document was updated in 2011, and from 2014 its further
development continued within this document and the corresponding EU Project RIMAP (Risk-Based
Inspection and Maintenance Procedures for European Industry) [2] [3].
The document is intended for managers and engineers establishing the RBIM (Risk-based Inspection
and Maintenance) policies in the process, power, steel and other relevant industries. This document
is intended to be used in conjunction with the relevant internationally accepted practices, national
regulations and RBI company policies. The document aims to provide a common reference for
formulating the RBI policies and developing the corresponding inspection and maintenance programs.
The background of the RBIM methodology is provided by the EU project RIMAP (Risk-based Inspection
and Maintenance Procedures for European Industry) [4]. In this project, the industry independent
methodology has been validated for chemical, petrochemical, power and steel industries and
summarized in the respective RIMAP Application Workbooks [4] .
The main goal of this European Standard and the former RIMAP project is to support the establishment
and application of risk-based inspection and mainte nance programs in industrial plants in a documented
and efficient way, while at the same time maintaining or improving safety, health and environment
performance.
The RBIF addresses primarily static pressure equipment (e.g. tanks, piping), but is also applicable to
dynamic/rotating equipment (e.g. pumps, turbines, valves) and pressure relief devices, and it can be
extended to other types of equipment, if appropriate. It addresses primarily the equipment and/or
systems in the in-service phase of the operation, but can also be applied in the design-phase for analysis
and/or determination of maintenance/inspection strategies or life extension phases. Application of this
RBIF in industry will take into account also the general developments in the industry and maintenance
practices (e.g. The Industry 4.0).
5
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
1 Scope
This European Standard speci fies the Risk-Based Inspection Framework (RBIF) and gives guidelines
for Risk-Based Inspection and Maintenance (RBIM) in hydrocarbon and chemical process industries,
power generation and other industries where RBI is applicable.
Although RBIF encompasses both inspection and maintenance, this document focuses primarily on
Risk-Based Inspection (RBI) and its applicability within the context of RBIM. The RBIF thereby supports
optimization of operations and maintenance as well as asset integrity management.
2 Normative references
3.2
risk management
coordinated activities to direct and control an organization with regard to risk
NOTE Systematic application of management policies, procedures, and practices to the tasks of analysing,
evaluating and controlling risk.
[SOURCE: ISO Guide 73:2009, 2.1, ISO 31000:2009, 2.2]
3.3
equipment
individual item that is part of a system, equipment is comprised of an assemblage of components
Examples include pressure vessels, pressure relief devices, piping, boilers and heaters.
[SOURCE: API RP 581:2016, 3.1.23]
3 .4
inspection
examination for conformity by measuring, observing or testing the relevant characteristics of an item
[SOURCE: EN 13306:2010, 8.1]
3.5
maintenance
combination of all technical, administrative and managerial actions during the life cycle of an item
intended to retain it in, or restore it to, a state in which it can perform the required function
[SOURCE: EN 13306:2010, 2.1]
6
BS EN 16991:2018
EN 16991:2018 (E)
3.6
integrity operating window
IOW
established limits for process variables (parameters) that can affect the integrity of the equipment if
the process operation deviates from the established limits for a predetermined length of time (includes
critical, standard and informational IOW’s)
[SOURCE: API RP 584, 3.6]
3.7
preventive maintenance
maintenance carried out at predetermined intervals or according to prescribed criteria and intended to
reduce the probability of failure or the degradation of the functioning of an item
[SOURCE: EN 13306:2010, 7.1]
3.8
corrective maintenance
maintenance carried out after fault recognition and intended to put an item into a state in which it can
perform required function
[SOURCE: EN 13306:2010, 7.5]
3.9
reliability centred maintenance
method to identify and select failure management policies to efficiently and effectively achieve the
required safety, availability and economical operation
[SOURCE: EN 60300-3-11:2009, 3.1.23]
3.10
risk based inspection
RBI
risk assessment and management process to plan, implement and evaluate inspections in a structured
and documented way
3.11
probability of failure
PoF
likelihood of an equipment or component failure due to a single damage mechanism or multiple
mechanisms occurring under speci fic operating conditions
[SOURCE: API RP 581:2016, 3.1.57]
3.12
consequence of failure
CoF
outcome of a failure can be expressed in terms of safety to personnel, economic loss, and/or damage to
the environment
[SOURCE: EN 60300-3-11:2009, 3.1.23]
3.13
evergreening
dynamic process of keeping records and analysis updated and relevant for the current situation
3.14
area susceptible to damage/susceptible area
area in a plant where a certain degradation is more probable to occur
[SOURCE: API RP 581:2016, part 2]
7
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
3 .15
degradation
detrimental change in physical condition, with time, use or external cause
Note 1 to entry: Degradation may lead to a failure.
Note 2 to entry: In a system context, degradation may also be caused by failures within the system.
[SOURCE: SOURCE : EN 13306:2010, 5.6]
3 .16
degradation group
group of piping or equipment items exposed to the same internal/external environment and
operating conditions, with the same material selection and/or design, thus having the same potential
degradation mechanisms.
Note 1 to entry: Degradation grouping can allow the use of inspection data from any equipment in the selection to
assess the condition of the entire degradation group. Equipment in a degradation group are normally physically
connected to each other.
Note 2 to entry: Corrosion group and/or corrosion circuit and/or corrosion loop is also used if the relevant
degradation is corrosion type.
[SOURCE: adapted from DNV RP-G101: 2010]
3 .17
condition monitoring locations
CM L
designated areas on pressure vessels where periodic examinations are conducted. Previously, they
were normally referred to as “thickness monitoring locations (TMLs)”
Get more FREE standards from Standard Sharing Group and our chats
[SOURCE: API 510:2006]
4 Abbreviated terms
8
BS EN 16991:2018
EN 16991:2018 (E)
9
BS EN 16991:2018
EN 16991:2018 (E)
10
BS EN 16991:2018
EN 16991:2018 (E)
these limits for the period of assessment. The risk reduction effect of alternative measures as well as
the costs of these measures shall also be determined.
The approaches and methodologies used in RBIF can be compatible with the generic requirements
resulting from basic ISO Standards such as EN ISO 9000-series[5] , EN ISO 14000-series [6] , ISO 55000
[7] and in-particular, ISO 31000-series [8] (IEC/ISO 31010 [9] , ISO/IEC Guide 51 [10] , ISO Guide 73 [11] ).
Other standards with which RBIF can also be compatible are EN 13306 [12] , ISO/DIS 45001, ISO 22301
[13] , IEC 61508/ IEC 61511 [14] [15] and ISO/IEC 17020 [16].
11
BS EN 16991:2018
EN 16991:2018 (E)
12
BS EN 16991:2018
EN 16991:2018 (E)
A potentially hazardous event will only lead to health and safety consequences if people are present
in the hazardous zone at that time and have no means of averting or protecting themselves against
the hazard. It is therefore essential to take these two “mitigating” factors into account for a realistic
consequence assessment of a failure mode. However, sometimes a hazardous event can lead to a domino
effect involving complex situations which should be considered.
Consequence values might be derived from existing quantitative risk assessments or other risk
assessment analysis considering consequences of release. For assessing the CoFsafety, CoF health and
CoF environment the mass of f luid, which is released due to a leak, is usually the main factor. In the case
of release, the inventory of isolatable sections of a process plant shall be considered. The inventory is
the total mass of the fluid present in a single isolatable section. The mass (volume, density) of the whole
inventory shall be utilized in the assessment instead of the individual smaller mass of fluid in each
item of equipment. These sections are often de fined by Emergency Shut-off Valves (ESVs). The main CoF
requirements [4] for RBIF are explained in the subchapters below.
13
BS EN 16991:2018
EN 16991:2018 (E)
The methods can be based on at-least one or more of the following aspects (depending on the type of
equipment and release):
— properties of the release that affect the environment;
— released mass;
— direct and indirect effect on flora and fauna; and
— remediation effort.
14
BS EN 16991:2018
EN 16991:2018 (E)
15
BS EN 16991:2018
EN 16991:2018 (E)
and maintenance activities. The objectives should be transparent and support the company’s overall
objectives, with respect to health, safety, environment, production, quality and reputation etc. The
objectives should also be in-line with the national or other normative requirements, and/or possible
other requirements (e.g. the contractual etc.).
The RBIM strategy shall ensure that risk mitigating actions are identi fied and implemented before the
health, safety or environmental (HSE) risks associated with an equipment failure become unacceptable.
If the HSE risks are tolerable/acceptable, actions to reduce economic/ business risks may still be needed.
The RBIM framework shall be seen as a part of the overall Maintenance Execution Inspection (MEI)
working process and the Quality Management System (QMS) taking into account the following:
— de finition of objectives, goals and requirements;
— establishment of inspection and maintenance program(s);
— planning of tasks and activities in inspection and maintenance;
— execution of work orders;
— reporting about failures and status;
— preparing and performing improvement/corrective actions;
— asset management;
— management of change;
— ensuring safe production and safe work practices;
— emergency response andFREE
Get more controls;
standards from Standard Sharing Group and our chats
— investigation of incidents;
— training; and
— control and quality assurance.
16
BS EN 16991:2018
EN 16991:2018 (E)
17
BS EN 16991:2018
EN 16991:2018 (E)
Get more FREE standards from Standard Sharing Group and our chats
18
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
7.1 .1 General
Initial analysis and planning is a key step in the RBIF. In this step the objectives of the RBIF, scope
of the RBIF (in terms of systems and sub-systems) and relevant criteria for the assessment shall be
adequately de fined.
The initial analysis and planning phase starts immediately after the decision to implement RBI at a
location (or in a particular plant or area) is made. This phase consists of the following steps:
1) de finition of objectives (e.g. company health and safety objectives, optimized timing/prioritization
and extent of next inspection);
2) de finition of systems, sub-systems (loops) and equipment to be considered, as well as the respective
boundaries (e.g.: preheating system from inlet x to outlet y [P&ID No. xyz] including pressure
vessels xyz, heat-exchangers xyz, and pumps xyz, etc.);
3) de finition of the scope of analysis, including normal operating conditions and exceptional situations
to be considered (e.g. start-up/shutdown, disturbances, accidents etc.), as well as the operating
periods covered;
4) de finition of data sources available (e.g. design data, equipment history, equipment/component
inspection data, PHA studies, etc.);
5) de finition of regulations to be considered;
6) speci fication of the team;
7) speci fication of the tools (including software) to be used;
8) agreement on the methodology and objectives with relevant actors concerned (e.g. management,
external bodies and/or authorities).
In the following sub-clauses, these steps will be described in more detail.
19
BS EN 16991:2018
EN 16991:2018 (E)
7 . 1 . 4 D e fi n i ti o n o f
s ys te m s , s u b - s ys te m s ( l o o p s ) a n d e q u i p m e n t to b e c o n s i d e re d
The RBI analysis can focus on multiple plants, a single plant, certain systems (unit operations) of a
plant, certain equipment or even components of an individual item of equipment. The first step consists
of de fining the systems and/or sub-systems (loops) of interest.
Systems are generally de fined based on the functions they perform. The sub-systems shall be
manageable and meaningful to allow for assessment of speci fic issues related to them, e.g. according
to particular degradation mechanisms, process fluids, process functions, process conditions, materials
selection, inventory groups, etc. The level of detail of systems, equipment and their components, and
their hierarchy may differ depending on the chosen methodology (RBI/RCM). Inventory is the total mass
of fluid available for release through a leak in an isolatable section of a process plant (inventory group).
By dividing a process unit into systems, sub-systems, etc., the equipment can be screened together to
save time compared to treating each item of equipment separately. In the case when the risks of each
item of equipment in the system show a common sensitivity to changes in process conditions, screening
can establish one Integrity Operating Window (IOW, [21]) with common variables and ranges for the
entire system. This is a practical way to describe, understand and monitor degradation in a system.
Every system and sub-system should be clearly de fined in terms of its boundaries, i.e. where its
starts/stops, which equipment and components are included etc. The functional boundaries of a system
can depend on the mode of plant operation.
Generally, the system to be assessed should not be de fined too broadly. The complete picture of
safety and integrity can be clouded by complexity or too much information, resulting in confusion
and misinterpretation. Conversely, too narrow a de finition may lose sight of the impact of a failure or
process upset in one sub-system with respect to other sub-systems [27].
In order to establish the hierarchy, every system is divided into sub-systems, equipment and/or
locations that might relate to a system failure. This ‘decomposition’ shall continue until the smallest
Get more
components for which FREE
sufficient standards
data from Standard
from inspections, Sharing Group
maintenance, and our
and failure chats
history are available
or may be collected. In certain cases, Condition Monitoring Locations (CMLs) can be also be used to
enhance/ optimize the monitoring and maintenance of equipment.
7 . 1 . 5 D e fi n i ti o n o f
th e s c o p e o f a n a l ys i s
For the systems, sub-systems (loops) and equipment to be assessed, the scope of the analysis including
operating conditions, loads and exceptional situations (e.g. upsets), as well as the operating period
considered shall be determined.
7 . 1 . 6 D e fi n i ti o n o f
d a ta s o u r c e s ava i l a b l e
The data sources available shall be identi fied. The data, as a minimum, shall include:
— design data;
— operating data; and
— historical data (maintenance and inspection records), where available/applicable.
The data should be balanced in respect to the needs of the application (system or equipment), the scope
of the assessment, the expected level of detail (or acceptable uncertainty) in the results, and foreseen
future service.
Preceding an initial analysis a brief overview of the plant or unit and its operation as a whole shall be
given, including, if available, the following information:
— process/operating history;
— speci fic process/operating requirements for plant items within the scope;
— routine operation;
20
BS EN 16991:2018
EN 16991:2018 (E)
— speci fic limiting factors for plant items within the scope;
— factors that can result in abnormal and upset conditions;
— possible future process/operating issues;
— potential degradation mechanisms and in fluential process variables and usual methods of mit igation;
— inspection history overview, including repair and alterations; and
— Management Of Change (MOC) list (plant, field changes).
Where no data exists (e.g. inspection history, because the plant or unit is still in the design phase), a
conservative risk approach shall be applied based on the RBI teams’ expertise and experience.
7 . 1 . 7 D e fi n i ti o n o f r e g u l a ti o n s to b e c o n s i d e re d
The applicable regulatory requirements shall be identi fied. These requirements may include the
quali fication of team members, software tools to be used (see 7.1.8 and 7.1.9 below), prescribed
inspection intervals, etc.
7 . 1 . 8 Te a m s p e c i fi c a ti o n s
A successful risk-based assessment requires competent technical inputs and perspectives from various
disciplines. This can practically be achieved only through a team effort. To setup the procedure, the
required expertise of the team should be de fined. The RBI team shall have competencies within:
— inspection and maintenance;
— speci fic equipment disciplines (e.g. materials, corrosion, electrical, instrumentation and control,
fixed and rotating equipment, etc.);
It can be difficult to perform a detailed risk assessment without the support of dedicated software
tools. Such tools are used for managing the input data, performing the operations and calculations
required for risk assessment and supporting decision making. Additionally computerized systems are
21
BS EN 16991:2018
EN 16991:2018 (E)
used to store the data and analyse results or other related information when the need for reassessment
arises. Dedicated software tools are widely used to manage the large amounts of input data that will be
collected from the systems to be assessed. In such cases it is advantageous, but not necessary, to utilize
a tool which can interface with the existing data collection systems of the plant, e.g. such as those used
for inspection and maintenance.
The RBI team shall make sure that the software to be used is able to comply with the scope and
targets given for the assessment and that the basic analysis methodologies comply, e.g., with local legal
requirements.
7.2 Requirements
The RBI team shall take all necessary actions to ensure the acceptance of the RBI process and its
objectives by the plant owner, plant management and the responsible authorities.
7.3 Inputs
From an applicability and accuracy point of view, it can be more useful to perform a relatively thorough
analysis of a smaller well-de fined area of a plant rather than an incomprehensive assessment of much
wider area. However, in general, in the first step, the screening analysis should be made to pinpoint the
areas which require more detailed assessment [23] .
Stakeholder support should be seen as mandatory for meaningful assessment. Inadequate stakeholder
support or indifference to the objectives and procedure of the assessment can seriously limit the
applicability of the effort.
22
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
7.4 Procedure
For the de finition of credible failure scenarios, the team responsible for the implementation of the
procedure should agree what, within the context of their industry, is considered a failure of an item of
equipment. This activity should be a company issue.
Whenever a plant operates with different modes, it is necessary to de fine failure criteria that take into
account the speci fics of each operational mode.
7.5 Output
The essential parts of planning, including the requirements, inputs, procedure and output involve
speci fic applicability limits or items of caution. Some of the most common ones are outlined below:
Speci fic issues related to static equipment:
Many static items of equipment are subject to mandatory national regulations, e.g. pressure equipment
and storage vessels containing hazardous fluids with a potential of toxic release, fire or other
environmental impact. In such cases the competent team shall include, or otherwise have access to
sufficient expertise on the regulations in effect at the time of the assessment. These regulations will
often require consideration of HSE criteria. The underlying potential hazards will frequently de fine the
risk scenarios to be considered within the risk assessment.
Speci fic issues related to dynamic (rotating) equipment:
Dynamic equipment such as turbines, pumps, motors, compressors, generators, fans, valves and gears
are often subjected to signi ficant loading in service, and form important parts of critical systems or
sub-systems. They should be considered within the assessment according their share to the overall risk
of the assessed unit/system/sub-system.
Dynamic equipment in particular can have more than one mode of operation. This necessitates
de finition of unique failure rates, taking each possible mode of operation into account.
Speci fic issues related to inspection deferral:
Situations in which the need to defer planned inspections beyond the set date may arise. In these cases
the following approach shall be adhered to:
1) Inform the correct level of management regarding the situation;
2) Identify the potential consequences of the deferred inspection;
Consequences might be direct such as increased safety risk and/or indirect such as effects of
mitigation e.g. reduced production or increased cost due to necessary mitigating actions.
3) Pursue mitigation measures to reduce consequences or reduce probability of failure;
23
BS EN 16991:2018
EN 16991:2018 (E)
Examples of mitigation measures might be: performing other types of inspections, reduction of
operating pressure, re-routing or other process changes, restriction of access to an area, monitoring
of relevant parameters, performing maintenance activities, performing temporary repairs, etc.
Mitigation can also be achieved in terms of more detailed analysis which might challenge the
conservatism in the existing evaluations.
4) Make a new plan for next inspection;
A new plan shall include the date and extent of the next inspection, as well as mitigation actions to
ensure that the risk is acceptable.
5) Obtain approval at the correct managerial level to defer the inspection based on the mitigation plan;
6) If necessary, obtain approval of the regulator for inspection deferral based on planed actions.
The work process for inspection deferral shall be well documented and approved at relevant
organizational level.
8.2 Requirements
Data collected for the implementation of the RBIF process shall include at least:
— plant level data;
— design and available manufacturing and construction data;
— operating data;
— maintenance and inspection;
— safety systems (e.g. fire detection systems, etc.);
— relevant international available experience; and
— business related economic data (optional).
In addition to reviewing documents, e.g. Process Flow Diagrams (PFDs), Piping and Instrumentation
Diagrams (P&IDs), inspection, maintenance and operating records and procedures, etc. the team shall
ensure that relevant non-documented data are collected.
The team shall have access to plant personnel who can provide an understanding of the actual plant
con figuration and operating conditions, the effectiveness of the plant inspection and maintenance
programs, and the identi fication of problems particular to the investigated plant. Involvement of
plant personnel can effectively contribute to their positive acceptance of the outcome of the risk-
based analysis.
24
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
8.3 Input
8.3 .1 General
It is recommended that the established RBI team follows the data collection and validation procedure
outlined below. Before this step the team shall have initially estimated the rough quality and quantity
of data that is needed for the analysis. The collected data shall be veri fied and stored, when used for
RBI analysis and documentation.
The collection and validation of documented relevant data shall as a minimum include the
following elements:
1) Design, manufacturing and construction data:
These data are largely plant and equipment speci fic and in the form of numerical data or diagrams
and drawings of the process and systems, equipment, material selection and corrosion controls,
as well as safety systems. These background data also describe the functional requirements and
intended loadings, and can indicate potential locations of failures. Data validation may be performed
by internal cross-comparisons, comparison to physical and technical limits of the process and by
cross-comparison to expert opinion.
2) Inspection and maintenance history (including failure analysis):
These data are plant and equipment speci fic, and typically include records of inspection results
and of possible corrective actions such as repairs or modi fications to the original system or
equipment. The records shall also include experience on the mode and causes of failures or other
process anomalies. The most recent data updates any preceding information, and it may be possible
to construct time series from these data. Records of previous engineering and failure analyses,
as well as data and results from other process safety risk assessments (e.g. RCM, QRA, PHA,
HAZOP, etc.) may be considered as input to the RBI analysis. Data validation may be performed as
described above.
3) Operational history:
These data are plant and equipment speci fic, and may include at least some records of operator logs
to identify operating periods, transients outside the integrity operating window (IOW), start-ups,
trips and other shut-downs, and load levels during different phases of operation. These records also
indicate to what extent the actual operation has possibly deviated from that intended in design. For
predicting the future performance it is imperative to consider the future mode of operation, if it is
foreseen to be different from that in the past. Data validation may be performed as described above.
4) Safety systems:
Measures or barriers intended to prevent or control any hazard which may arise during plant
operation, or to mitigate the consequences in case of hazardous release. These measures or barriers
mainly comprise of:
— plant safety devices such as e.g. pressure relief s ystems, spill, fire and gas detection systems; and
— people and procedures e.g. operators, operating procedures, training and competency.
5) Generic failure and operational data for similar cases or equipment:
Generic data about failures in similar cases and equipment is available from various sources
[4] [24]. Generic data and information from operational experience are partly included in these
sources, although the available information can vary widely depending on case and equipment.
Data validation can be mainly performed by comparison of such sources and by expert opinion.
6) Economic data:
25
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
These data can in principle be plant and equipment speci fic, but are also often taken as generic for
each equipment type or type of action to be performed on it. Data validation may be performed by
cross-comparisons or by asking for quotations from suppliers. The required information should
also include cost of loss of production and indirect losses due to e.g. fines, refurbishment, etc.
Relevant, non-documented data are generally available from most of the sources listed in 8.3.2 above.
Non-documented data typically consist of personnel knowledge and opinions, which can be a very
important source of information for the RBI analysis. Therefore, the team shall have access to the
personnel that can provide an understanding of the actual system, equipment con figuration, operating
conditions, the effectiveness of the inspection and maintenance programs, and identi fication of speci fic
problem issues. An interview process with the personnel (subsequently referred to as “expert”) is
recommended, and should include the following aspects:
1) expert opinion on his/her general experience with the equipment or system;
2) expert opinion on the perceived consequences (inclu ding personal) of unforeseen equipment failure;
3) expert opinion on the earliest possible time of failure;
4) expert opinion on the longest possible life (for a single item of equipment), or (for multi-component
items of equipment) on a time when repair is no longer economic/feasible; and
5) expert opinion on reasonable time intervals between shortest and longest failure times. Agreement
on the intervals is important, because too coarse a scale will not reveal uncertainty, and too fine a
scale may require excessively detailed analysis.
8.4 Procedure
Get more FREE standards from Standard Sharing Group and our chats
The collected data shall be validated and stored, when used for RBI analysis and documentation.
Comparison to externally available information may also help, e.g. data on technical details, or cost
from the equipment suppliers, etc.
Data and results from other procedures, e.g. RCM, QRA, PHA, and HAZOP or, other previously performed
risk-based assessments (if available) should also be considered as input for the RBI analysis.
Documented background data are often available in the form of diagrams and drawings of processes
and systems, equipment, controls and instruments, safety systems, maintenance and operating records
and procedures. Useful operational and other plant speci fic data can include severity, mode and causes
of failures, and operator records to identify operating periods, transients, start-ups, trips and other
shut-downs, and load levels during different phases of operation.
Relevant non-documented data and information are typically available as personnel knowledge
and opinions. To obtain this information the RBI team shall have access to plant personnel that can
provide information of the actual plant con figuration, operational history, maintenance effort, and
current/future condition.
8.5 Output
The output of the data collection and validation process shall be an assessment of all relevant and
representative data, which are needed for the risk calculation of the equipment of interest. These data
shall be collated in an appropriate way, e.g. by storage in an electronic database, etc.
Depending on the availability of data, a change in the system/equipment boundaries identi fied during
the initial analysis and planning may be needed. In addition, insufficient data may require additional
effort to obtain new data through engineering analysis or by other means. In such cases, data
revalidation and reassessment shall be performed.
26
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The output of data collection and validation mainly consists of raw (or processed) technical data and
information related to failure probabilities and consequences. The de fined objectives and the system to
be assessed can largely dictate the depth and extent of the data collection.
Support of plant management and involvement of plant personnel are important and contribute
positively to their acceptance of the risk-based analysis results. Further, active engagement of
management and plant personnel has a positive in fluence on the quality of collected and processed data.
Data related to design, manufacturing and construction (assembly) cannot always be updated
according to later modi fications. This is particularly likely for older equipment that has been used for
many decades and originates from the time before modern CAD/CAM documentation. The same can
also apply to controls and instrumentation, and to operational and maintenance history records for
similar reasons. The expert opinion of plant personnel about these issues can be essential.
One problem in data collection is the quality of generic databases – and particularly their failure
frequencies, from the point of including information related to inspections, maintenance and operating
conditions of equipment. Thus, these databases shall be used with care, and quali fied for use in each
case. Their applicability depends greatly on the following parameters:
— type of plant/equipment (size and fuel type);
— manufacturer;
— process fluid (including chemical control, corrosion, erosion);
— operating parameters (process pressure and temperature, vibration etc.);
— operating environment (moisture, temperature, etc.);
— operating constraints (load fluctuations vs. steady-state);
— inspection system/program/techniques; and
— geographic area (environment and external in fluences).
In order to obtain a reasonable probability or likelihood within the process the generic data have to
be modi fied (i.e. to calculate equivalent data) by taking into account all conditions pertaining to the
speci fic problem of interest (see [4]). It is recommended that different sources (e.g. several databases)
are consulted in order to incorporate the aforementioned issues 1) .
1) For example, the NERC-GADS [25] system is only concerned with “de-rating” and forced plant outages;
equipment failures not associated with “de-rating” or forced plant outages go unreported [24] . A similar case is seen
in the VGB KISSY database [26] .
27
BS EN 16991:2018
EN 16991:2018 (E)
5) determine risk and classify equipment e.g. on CoF/PoF risk maps or iso-risk (equal-risk)
curves [17] [20] .
Multilevel risk analysis de fines the risk assessment in terms of complexity of the analysis (e.g. from the
simpli fied/screening analysis to the detailed one), and in terms of plant hierarchy level (depth).
An example of a multilevel risk analysis is provided in A.1. The inputs usually required for each step of
the screening and detailed phases of risk assessment are given in A.2 .
9.2.2 Inputs
An example of the details required is shown in A.2 .
9.2.3 Procedure
The main purpose of the risk screening is to identify the low risk items (see Figure 3) and remove them
from further analysis. It is important to avoid making false negatives when classifying equipment in
the risk categories (e.g. to avoid classifying high risk equipment in low or medium risk categories). The
screening level of analysis is often sufficient to identify/highlight areas with high probability/frequency
of failure in the plant (units/systems), in which case further analysis is needed.
9.2.4 Output
Typical results from these tasks are:
— low risk items/systems which can be considered for minimum surveillance and regular veri fication
of assumptions and assessment;
— high/medium risk items/systems for further evaluation;
28
BS EN 16991:2018
EN 16991:2018 (E)
— risk value or category for the item of equipment under consideration in the screening risk matrix
shown in the left part of Figure 3; and
— warnings and applicability limits.
On the screening level, PoF assessments are usually more resource/cost intensive than CoF assessments.
Therefore, it may be preferable to screen systems and groups of equipment on consequence of failure
only. This is also acceptable, even if in this report other types of screening are suggested.
2) For further details of the Generic RBI process, refer to detailed guidelines such as, e.g. [27] .
29
BS EN 16991:2018
EN 16991:2018 (E)
The detailed analysis consists of the following main tasks (Figure 2):
1) identify hazards, relevant degradation mechanisms and failure modes;
2) determine probabilities of failure (both unmitigated and in those later mitigated);
3) determine consequence of failure (both unmitigated and in those later mitigated);
4) assess risk.
9.3.2 Requirements
The main requirements for identifying and considering degradation mechanisms are:
— identify the degradation mechanisms according to the systematic example given in Figure 4. The
degradation mechanism can be active in a given system/equipment;
— the plant breakdown, identi fication of degradation mechanisms and analysis process shall be
duly documented;
— the plant management shall ensure that the knowledge of service and maintenance history and all
known degradation mechanisms in the plant is considered in the analysis;
— the responsible person(s) involved in the analysis shall ensure that all available knowledge about
the degradation mechanisms and experience from similar plants is considered in the analysis;
— all emerging degradation mechanisms not taken into account under the speci fic categories are
taken into account under “other” degradation mechanism.
In addition:
Get more FREE standards from Standard Sharing Group and our chats
The analysis of failure modes increases the level of detail in the CoF assessment. If it is not undertaken,
a conservative approach shall be followed. A conservative approach may, e.g., assume that the complete
inventory escapes instantaneously.
The PoF shall be established for a given (prede fined) time frame based on a prediction of damage
development for operation within a speci fied operating window. The speci fied operating window shall
include parameters which may vary during operation (e.g. temperature, pressure) as well as parameters
which cannot be changed (e.g. seismic zone, climate).
The prediction of lifetime may come from the result of one of the following: measured inspection
data, calculation making use of operating conditions or expert opinion. If so desired, speci fic analysis
tools may be used, e.g. probabilistic (safety) analysis and/or fitness for service analysis. For all non-
trendable degradation mechanisms, for which degradation progress cannot be properly monitored
or predicted, prevention (through design), or early detection through proper measures (inspection,
maintenance, operation) and process monitoring shall be demonstrated. A methodology should be
available in which the relation between the effectiveness of measures (type, scope and frequency) and
the likelihood/probability of failure is given.
The CoF analysis shall focus onto the highest (dominant) aspect from the individual ones (health, safety,
environment and/or business). The averaging of these aspects shall not be done.
The decision criteria shall be de fined and recorded in writing. The methodology should be veri fied/
benchmarked. CoF safety can be benchmarked against existing and recognized methods. 3)
The task should be performed by the competent RBI team (see 6.2, Initial analysis and planning).
The results should be auditable by peer review; therefore, the methodology, the input data, the decision
criteria and the results shall be documented (the results shall be recorded in an authorized document).
3) Examples of established methods for CoF safety are given as references [29] , [30] .
30
BS EN 16991:2018
EN 16991:2018 (E)
9.3.3 Inputs
The details required for performing the steps of risk assessment in detailed level are shown in A.2 .
9.3.4 Procedure
9.3.4.1 General
Detailed assessment is an elaborate procedure involving multiple activities for carrying out the
individual steps.
A number of tools can be used for identifying hazards. In this case, it is recommended to carry out
a system level failure mode and effects (criticality) analysis, or FME(C)A according to the available
standards [28]. There are also a number of software tools that can support FME(C)A. In addition, other
analysis methods exist, such as HAZOP [58] or those listed in IEC/ISO 31010 [9] .
The next step in the procedure is the identi fication of the relevant degradation mechanisms and
failure modes per system, sub-system or degradation loop. A failure mode is any possible state where
a de fined function cannot meet the desired performance requirement. The main failure mode for static
pressure equipment is “loss of containment”. The listing of failure modes is made easier if the functional
breakdown is well described.
All probable failure causes for the identi fied failure modes should be listed for the system, sub-system
or degradation loop (see Figure 4). These could be failures dealt with by the current maintenance
program, historical failures and possible future failures. The RBIF methodology aims to foresee these
and prevent them. The failure cause list should include all events that are likely to be linked to the
identi fied failure modes. This should include equipment wear/deterioration, human factor impact, asset
design etc.
The root cause phase investigates the underlying causes connected to the failure modes. Establishing
the root causes increases the possibility of finding the appropriate tasks for preventing these failure
modes. The hierarchical breakdown and the root cause phase in Root Cause Failure Analysis (RCFA)
can provide better insights into relevant damage mechanism.
Annex A.6 presents the various types of in-service damage and their speci fication. The hierarchy of
degradation mechanisms in relation to the plant equipment hierarchies is also shown in A.7, with an
example case.
The approach proposed in A.8 lists the damage mechanism systematics with inspection methods and
combinations of PoD (Probability of Detection), effectiveness and FCP (False Calls Probability).
31
BS EN 16991:2018
EN 16991:2018 (E)
Get more FREE standards from Standard Sharing Group and our chats
32
BS EN 16991:2018
EN 16991:2018 (E)
investment as well as savings resulting from avoidance of unnecessary inspection and maintenance
become apparent. This requires the setting of a reasonable cut-off level for the evaluated risk criteria.
Table 2 — Example of decision/action criteria for various risk levels in risk matrix [4]
Risk Level Decision/Action criteria
Very high De fine required immediate measures to reduce risk e.g. consider equipment repair/ re -
placement. A possible re-design may also be considered.
High De fine required inspection and maintenance program to reduce risk (Note: it can be ac-
ceptable if the driver is economic loss, security, image loss and public disruption).
Medium Reduce the risk through mitigation measures as low as reasonably practical (ALARP). For
business risk, find the optimal cost.
Low If no inspection and maintenance program plan exists, it is not mandatory to establish
one. Otherwise, fine tune the program to find the optimal costs and follow the ALARP
principle.
Very Low No Action
9.3.5 Output
Typical results from these tasks are:
— the PoF value for the item of equipment under consideration;
— the CoF value for the item of equipment under consideration;
— risk value or category from Table 2; and
— warnings and applicability limits.
33
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Table 3 — E xample of the risk matri x for detailed assessment, involving H SE and economic
r i s k s w i t h fi ve r i s k l i m i t c a t e g o r i e s , i n c l u d i n g e x a m p l e s o f
t h e v a l u e s o n t h e s c a l e s (t h e s c a l e
PoF Qualita-
MOTBF annu- tive Description
al
In a small population*,
one or more failures
can be expected annu- Very
<1 Very prob- ally.
> 10 −2 5 high
year able
Failure has occurred risk
34
BS EN 16991:2018
EN 16991:2018 (E)
PoF Qualita-
MOTBF annu- tive Description
al
No aid
First aid Tem- Perma-
needed
needed
Safety effects Work
No work
porary
work
nent
work
Fatalities
disrup-
disability disability disability
tion
(or)
Impact Off-site
Minor
Negli- (e.g. damage
Environment gible spill)
impact On-site
(e.g. damage
Long
impact con- term
spill)
tained effect
(or)
Business (€) < 10k€
10–100
k€
0,1–1 M€ 1–10 M€ > 10 M€
(or)
Security None
On-site On-site
(Local) (General)
Off site
Society
threat
(or)
Loss of reputation None Minor
Bad pub- Company Political
licity issue issue
(or)
Small Large
Public disruption None
Negligi-
ble
Minor commu- commu-
nity nity
10.2 Requirements
Adequate competencies, understanding, knowledge and experience relevant for:
— RBI and knowledge of how the RBI results relate to inspection activities;
— degradation mechanisms and inspection methods including their application and limitations;
35
BS EN 16991:2018
EN 16991:2018 (E)
— legislative requirements and facility speci fic procedures and requirements; and
— relevant acceptance criteria and codes.
The work process shall be auditable by peers and well documented.
The inspection and monitoring plan:
— shall consider relevant degradation mechanisms for all systems included in the scope.
— shall meet the relevant legislative requirements;
— should be veri fied in the field and adjusted for accessibility, removal of insulation and other
preparatory work;
— shall be veri fied by personnel with a similar or higher competence level than the personnel
establishing the plan.
10.3 Inputs
The minimum required input to establish a risk-based inspection and maintenance plan are:
— results from RBI analysis including degradation mechanisms, PoF, CoF, risk ranking and the time
interval of inspection and maintenance plans;
— historical inspection and maintenance data;
— design and operational data including necessary technical documentation; and
— general turn-around plans and availability of the relevant systems/equipment.
Get more FREE standards from Standard Sharing Group and our chats
10.4 Procedure
10.4.1 General
The following steps can be followed to prepare an inspection program based on the RBIF methodology:
— identify items with risk above the risk acceptance limit;
— de fine actions for the different degradation mechanisms;
— de fine degradation groups and relevant areas susceptible to damage (i.e. susceptible areas);
— select inspection points/locations.
These steps do not take into account other documentation/information that is required to optimize the
inspection program. Such information might be:
— monitoring results, including IOW;
— process changes;
— operational irregularities (upsets);
— non-conformities from fabrication; and
— legislative requirements.
The above mentioned documentation might change the RBI results and hence alter the inspection
program. Such information should be incorporated in a RBI re-analysis/evergreening to re f lect the
actual situation in the best possible way.
36
BS EN 16991:2018
EN 16991:2018 (E)
The analysed equipment should be ranked according to risk. Equipment exceeding the risk limits soon
after the planned inspection period should also be included into the planning. This step can help to
better prioritize the actions.
Following the results of the RBI analysis, the applicable degradation mechanisms shall be identi fied
and relevant inspection methods shall be de fined for each type of mechanism. The following shall be
evaluated (see also Figure 5):
— next inspection, maintenance or monitoring interval;
— inspection method and required coverage to achieve reliable results;
— probability of detection (PoD);
— typical inspection locations (consideration of weakness and locations for corrosion control i.e.
susceptible areas); and
— inspection cost; and
— case and application speci fic issues and limitations e.g. consider NII when dealing with sensitized
austenitic steel equipment.
This information can be used as basis for a company-speci fic guideline which controls the handling of
different degradation mechanisms.
1 0 . 4 . 2 D e fi n e d e g ra d a ti o n g r o u p s a n d r e l e va n t s u s c e p ti b l e a r e a s
Figure 5 provides the suggested general work f low of the work process from RBI analysis to a risk based
detailed inspection plan. In order to achieve an effective inspection program the inspections should be
organized according to the degradation groups, as illustrated by step #2 in Figure 5. This utilizes the
correlation between items within same degradation group to achieve reliable and updated degradation
rates. A degradation group might suffer from several types of degradation, with several sets of
susceptible areas; these should be assessed and planned separately, as shown by step #3 in Figure 5.
37
BS EN 16991:2018
EN 16991:2018 (E)
Get more FREE standards from Standard Sharing Group and our chats
F i g u r e 5 — E x a m p l e o f
g e n e r a l wo r k f l o w o f
t h e R B I p r o c e s s
The inspection coverage with respect to number of susceptible areas should be assessed according to
the entire degradation group – all susceptible areas within the group shall be identi fied to understand
what constitutes the full “100 % inspection” for the relevant degradation, as shown by step #4
in Figure 5.
Based on de fined representative areas within a degradation group and de fined inspection methods
for different degradation mechanisms the accurate inspection points (e.g. CML’s), as shown by step #5
in Figure 5, and inspection method as shown by step #6 in Figure 5, shall be applied. The inspection
and inspection effectiveness table given in [31] , Appendix F may be used as a guideline to decide on
inspection extent.
The inspection program should be veri fied on site to optimize the program with respect to access and
other relevant conditions, normally outside the RBI analysis. This input shall also be utilized to plan for
preparatory work, as shown by step #7 in Figure 5.
10.5 Output
The decision logic gives guidance for the establishment of preferred inspection and maintenance
strategies on the basis of the risk assessment, detectability of damage and the failure characteristics.
38
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The inspection and maintenance plan shall be plant speci fic. Such a plan shall include but not be
limited to, the following elements (the same holds true for dead-legs and piping with irregular flow e.g.
bypasses, drains, etc.):
— details of inspection methods (e.g. UT scan), locations (e.g. Nozzle G 6°° position) and interval
(e.g. 24 months);
— time and condition based maintenance (preventive/predictive);
— on-stream inspection and maintenance;
— planned corrective actions (e.g. replace nozzle);
— identi fication of degradation and damage (e.g. general corrosion 0,2 mm/year and erosion); and
— regular functional testing (PRV) and monitoring (IOW);
— the RBI inspection plan shall ensure timely and effective inspection, which correctly detects and
identities the degradation, and reduces the uncertainty by increasing knowledge about the actual
equipment state.
The RBIF applies primarily to systems and equipment during the in-service phase of the operation, but can
also be applied in the design-phase for analysis an d determination of maintenance/inspection strategie s.
Relevant limitations and regulations need to be taken into account when creating the RBI action plan
and might impose changes in the inspection interval, inspection extent and methodology, etc.
Even in the case of evaluation and veri fication of the RBI plan by personnel with the required
competence and/or authority, the inspection planner should re-evaluate and rectify the results of
items showing a short time to next inspection. In general, the analysis is conservative in that, whenever
there is information missing, the “worst case” scenario is assumed. Such assumptions might result in a
relatively short time to next inspection, and extra effort should be made to clarify this.
Wherever possible, the inspection planner should also compare the RBI analysis results to earlier
results from similar installations, known failures in existing plants and historical inspection data. This
will highlight any signi ficant differences which may indicate errors or oversights.
Items such as branch piping without its own tag number, dead-legs and piping with irregular flow (e.g.
bypasses, drains etc.) are often not assessed in the RBI-analysis. This type of piping usually has thinner
walls than the “main” pipe and this will, for some degradation mechanisms, result in a higher PoF value.
Whenever possible, these items should be identi fied so they can be treated separately.
The output of a RBIM plan is the input for the planning and scheduling for all involved departments,
disciplines and contractors for the maintenance and inspection work at a facility including the plant
outages ("turnaround"). The output of the development of the RBIM plan will be based around
maintainable items. It will allow management of risk and lead to knowledge based decisions. The
RBIM output will allow for a broad variety of strategies such as the reduction or mitigation of the risk
through monitoring, functional testing and improvement of procedures for process, operation and/or
maintenance, inspection, modi fication, repair, replacement, or operation to failure. The maintenance
work can be split into three main categories shown in Table 4.
39
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
1a. On-stream/in-service No plant nor item shutdown required Operating / own staff /
(Non-Intrusive), OS/NI specialists / contracting com-
panies
1b. On-stream/not in-service Item shutdown required, but no plant shut- Operating / own staff /
(Intrusive), OS/I down specialists / contracting com-
panies
2. Short shutdown Shutdown to change worn equipment, or Own staff / specialists / con-
changes called by process (catalysts, molecular tracting companies
sieves, etc.)
3. Turnaround/general over- Larger plant stops for major upgrades, repair, Own staff and contracting
haul inspection, process upgrades companies
1 1 .2 Input
The main input to the planning and execution is a RBI process including all equipment in scope. From
this risk assessment the following results are expected:
— risk ranking of the plant(s)/equipment/component(s) including, but not necessarily limited to static
equipment, piping and pressure relief devices;
— type of inspection and maintenance. This can be a high level inspection plan as usually delivered by
the RBI software or a detailed inspection plan, including speci fic inspection locations and methods
as usually delivered by an inspection expert;
— timing for activity/planned inspection date – typically by condition based or time-based scheduling;
Get more FREE standards from Standard Sharing Group and our chats
— required work and skills to perform the tasks, and estimated time per task;
— requirement for total or partial plant shutdown, intrusive or non-intrusive inspection;
— dependencies between work on the evaluated unit and other equipment/components;
— tools, personnel expertise and spare parts required.
1 1 .3 Procedure
The maintenance (or inspection) work normally consists of work generated from 3 different sources
(see Figure 6 ) and involves activities speci fied in Table 5:
1) Preventive plans generated by RBIM assessments (condition based and/or scheduled maintenance),
even if these only refer to inspection;
2) Corrective maintenance calls from observed failures or emerging problems;
3) Failures identi fied via condition monitoring.
40
BS EN 16991:2018
EN 16991:2018 (E)
Figure 6 — Maintenance Planning. Example of RBWS priority setting for work order planning
(short and long-term), EN 13306 [12]
• Maintenance reporting;
• Reporting and analysis module.
In the context of RBIM information (failure modes, failure rates and associated consequenc-
es), a minimum requirement for the CMMS systems is that it should contain or link to the risk
information from the risk assessment.
41
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Activity Description
Reporting and The purpose of documentation of the executed maintenance work is:
documentation of
work • The documentation of the equipment state, before and after the work. Information on type
of degradation, extend of damage – information to be used for future planning. A combination
of failure coding, text and pictures is recommended;
• Cost and time control – how many man-hours were used, spares – type and cost – used,
tools used.
Accurate reporting is key to the analysis and updating of the inspection and maintenance
plans. Inadequate quality of this part of the work will cause the future risk-based planning
to be sub-optimal.
Analysis The results from the maintenance work done, should be analysed and fed back into the RBIM
system on a regular basis, typically via monthly, quarterly and yearly maintenance and in-
spection reports. These reports should typically contain information on:
• Backlog – work performed versus the planned work;
• Breakdown work (non-planned work);
• Availability for the main production system, and maintenance related losses;
• Reliability of the safety systems;
• Trending of key parameters related to availability, integrity and reliability.
1 1 .4 Output
The output from the maintenance execution work is a plant management system where the preventive
maintenance is based on RBI analyses and corrective maintenance is also managed using risk-based
principles. As a result, the risk of failure is under control and reduced to an acceptable level and the
reliability, and therefore the availability,
Get more FREE standardsis a known parameter.Sharing Group and our chats
from Standard
A Corrosion Control Document (CCD) can also be part of a RBIM program. Such a document refers to
the degradation mechanisms speci fic for a process unit of a plant/site. Such a document furthermore
explains how equipment degrades and how to locate and mitigate or avoid the damage.
The quality and capability of a RBIM plan depends on the input. To achieve a successful RBIM plan it
is crucial to include input data from operation, process, maintenance and other experts. It is essential
to ensure that the RBIM plan adheres to the applicable international and European Union (or other
national) regulations and company policies. If required, a second opinion from independent experts
should be sought in reviewing the successful execution of plans.
The purpose of the evaluation of the RBIM process is to assess its effectiveness and impact in
establishing the inspection and maintenance programs. This will allow the identi fication of areas where
modi fications and improvements are needed. Speci fically, evaluation consists of the following tasks:
— assessment of the effectiveness of the RBIM process in achieving the intended goals (assessment of
effectiveness);
— updating the RBIM process by taking into account possible plant changes (additions, new units,
changes) and available new knowledge (reassessment of the risk);
— periodical re-evaluation of existing RBI plans in order to discuss eventual changes in:
a) design requirements;
42
BS EN 16991:2018
EN 16991:2018 (E)
12.2 Requirements
The evergreening process involves both internal and external assessment conducted by the plant
organization (RBI team) and by independent experts, respectively.
The internal evaluation by the plant organization is an integral part of every RBI activity and should be
considered as a living process within the overall risk decision making process. The internal evaluation
can take place in any moment of RBI, especially when:
— discrepancy from any expectation or requirement is found, e.g. design requirements, process
parameters, operational conditions, leaks, non-planned maintenance that has been performed etc.;
— new knowledge or acquired data, e.g. inspection and/or maintenance findings is available or plant
changes occur.
In both cases, a detailed analysis of the importance of the involved item shall be conducted in order
to assess whether it has a signi ficant impact on the RBIM process including the inspection and
maintenance planning, and some corrective action should be undertaken. In the latter case a thorough
analysis of the causes leading to discrepancy or of the effects of the new knowledge/plant changes shall
be performed.
The external evaluation can be executed through independent reviews by independent third parties,
by the owner, or regulatory bodies (e.g. audits). Independent reviews provide an opportunity to
complement the internal evaluation with a different and neutral perspective. A point to note is that
the value of information provided by the independent review is directly proportional to the openness
and collaboration that the external experts will find in the audited organization. The integration of
independent reviews with internal evaluation will allow the identi fication of necessary actions for
improvement.
12.3 Inputs
For assessment of effectiveness, the following can be used:
— de finition of risk decision-making process goals (risk may be expressed in one or more of the following
terms: business impact, e.g. unit reliability, availability and safety, health, environment impact);
— de finition of performance indicators as a measure of t he RBI process achievements against the above
given goals. (Note that in order to enable a meaningful evaluation of the performance, consideration
should be given to the appropriate time frame applied for the various performance indicators. This
is especially true when a relation is identi fied between the performance and potential causes; it may
be more meaningful when certain quantities are assessed for a longer period of time. For example,
the cost of inspection and maintenance in year X affects the availability in a certain period of time
after year X);
43
BS EN 16991:2018
EN 16991:2018 (E)
12.4 Procedure
12.4.1 General
Assessment of efficiency is a combination of good reporting including the aspects concerning business
targets and audit of the plant. This audit can be performed by internal resources (typical for large
organizations), by the owner, or by an independent third party. Methods or approaches applied in such
an assessment are described below.
The performance indicators are used for the measurement of the business performance of a plant. The
Key Performance Indicators (KPIs) should re f lect important goals for the plant, company or owner, and
may change with time. For example, a plant in its post start-up period may focus on availability and
at a later stage on maintenance cost. An example of a set of KPIs from the owner’s point of view is
provided in A.11.
44
BS EN 16991:2018
EN 16991:2018 (E)
1 2 . 4 . 2 Wo r k p ro c e s s e f
fi c i e n c y b e n c h m a r ki n g
The RBI process should be benchmarked against best practices in the same plant, company or industrial
sector. This can be done in parallel and as part of evergreening, or separately, in order to prepare a
management report.
An internal evaluation resulting from the team’s experience with the RBI process can be further
supported by an external evaluation, part of an audit or view of authorities.
Since RBI is not a project in itself but a process, its implementation should partly be handled as
change management and be sustainable. The outcome of a RBI process is a risk analysis including PoF
and CoF, potential damages and damage rates, IOW as well as a detailed inspection plan, including
inspection locations, methods, reasoning for the chosen methods (PoD), coverage and maximum
inspection interval.
The following key elements shall exist after this phase:
— management system for maintaining documentation, data, IOW, analysis updates;
— documented method for determining the PoF and CoF; and
— documented method for managing risk through mitigation strategies (inspection and other).
The RBI process is supposed to generate/identify/consider (as appropriate):
— potential and active damage mechanism;
— IOW parameters and limits;
— risk ranking of all evaluated assets/equipment;
— detailed inspection plan, incl. methods, locations, coverage, interval; and
— description of other mitigation activities, e.g. IOW monitoring, hazard effect control.
Immediately after the above outcome of the detailed inspection plan, the evergreening phase begins.
This phase usually includes following steps:
— inspection work pack initiation;
— inspection execution;
— evaluation of inspection data and entry into RBI database;
— feedback and NCR initiation;
— updates from units, if changes in equipment, process changes or process upsets have occurred (this
information needs to be made available by operations to inspection, maintenance and RBI teams);
— risk calculation;
— update of active damage mechanisms (corrosion rate, remaining life) and inspection plans;
— consultation of technical supervision organizations (if applicable);
— follow up on NCRs;
— con firmation of correction/repair;
— reminder of non-completed repairs and inspection due dates; and
— distribution of the RBI plan to the planning department.
45
BS EN 16991:2018
EN 16991:2018 (E)
The risk management and replacement strategy can be used in order to assess the optimum time
for replacements, according to cost of risk (this usually increases with time, but also with market
f luctuations, e.g. in case of high demand for the product, the cost of risk increases), cost of not performing
the maintenance, labour and material costs, value of lost production during maintenance. Such RBI
cost-bene fit analyses serve as the economic basis for inspection decisions and optimal replacement
strategies in line with the turnarounds.
Get more FREE standards from Standard Sharing Group and our chats
46
BS EN 16991:2018
EN 16991:2018 (E)
Annex A
(informative)
Assessments
47
Table A.1 — Explanation for the levels in the Multilevel Risk Analysis (see Figure A.1)
48
EN 16991:2018 (E)
BS EN 16991:2018
Explanation for the levels in the Multilevel Risk Analysis (see Figure A.1)
Level 1 Explanation
We look at both critical damage, unacceptable for further operation and failure statistics, and how this knowledge
P.L1–1. Damage/failure statistics in f luences the Generic Failure Frequency (GFF). Example: if a vessel has GFF of 5·10 −4 , the high level of damages and
failures can increase the PoF to e.g. 8·10 −4 .
This factor considers whether there is an increased probability of failure (or critical damage unacceptable for fur-
P.L1–2. Damage related to design, material
or assembly
ther operation) in the first years of operation of the equipment, due to the equipment design, material of construc -
tion or the assembly.
P.L1–3. Damage caused by operating con- Takes into account damage arising from the operating conditions or the combination of process f luid and material
ditions used and also the frequency of this damage occurring.
This factor considers whether this equipment or component (e.g. weld, bend) has been inspected within the pre-
scribed periods for internal and external inspection and pressure testing, as applicable. It considers whether dam-
P.L1–4. Inspection status and findings age or degradation has been discovered by the inspection. Furthermore, it also conservatively considers equipment
deserving special attention, if no inspection has previously been performed.
C.L1–1. Health and safety consequences Takes into account the possible health and safety impact on persons.
C.L1–2. Environmental consequences Takes into account the possible environmental impact.
C.L1–3. Economic consequences Takes into account the possible economic impact resulting from loss of production and damage/repair costs.
Level 2 Explanation
This factor FREE
Get more takes into account the
standards fromcondition of the
Standard water chemistry.
Sharing Group and A review of historical reports shall be carried
our chats
P.L2–3.1. Quality of water/steam chemistry
out, and it shall be determined whether the water chemistry is typically within the set limits.
For piping systems which may be susceptible to fatigue either mechanical or thermo-mechanical in nature e.g.
P.L2–3.2. Potential for mechanical fatigue
stress
concerns over the f lexibility of a piping run or high level of starts and stops or poorly supported pipe connections to
vessels or valves.
This is aimed at highlighting any equipment that may be susceptible to high thermal stresses i.e. thick-walled equip-
P.L2–3.3. Potential for thermal fatigue ment subject to large temperature differences over a short time would be considered “likely” to experience thermal
stresses stresses. A thick-walled item of equipment with small temperature gradients would be considered “unlikely” Thin-
walled equipment rarely has high thermal stresses unless suddenly quenched.
If it is considered that any region of an item of equipment may be subjected to higher stresses than those allowed
by design, then it should be highlighted here e.g. if a piping system is poorly supported then it is “likely” that some
P.L2–3.4. Local mechanical over-stressing
regions will be over stressed. Similarly, if the support system is not regularly checked the over stressing should be
considered “possible”.
P.L2–3.5. Local hot spots
This criterion generally refers to boiler tubing or headers where uneven firing/gas streaming etc. can result in local -
ized hot spots.
P.L2–3.6. Nominal operating temperature This relates to the design operating temperature. It is mainly important for high temperature equipment operating
(relative to design operating temperature) in the creep range.
Table A.1 (continued)
Explanation for the levels in the Multilevel Risk Analysis (see Figure A.1)
Level 1 Explanation
P.L2–3.7. Corrosion susceptibility due to If the combination of operating conditions and/or material type may result in corrosion or in the case of high tem-
operating conditions perature equipment high temperature corrosion/oxidation.
Thermal excursions considers the number of equivalent hours the equipment operates above a set reference temper-
ature per month. The number of equivalent hours should take into account:
The calculated reference temperature, based on the material type of the equipment, determined from e.g. PD 6525 or
P.L2–3.8. Temperature excursions ISO, and the highest calculated stress for the equipment, determined from e.g. TRD 301;
The number of actual hours per month in excursion;
The equivalent ∆Θ.
P.L2–3.9. Number of cold start-ups or shut-
This factor gives a ratio of the real number of cold start-ups or shutdowns to the number allowed by design accord-
downs over design number according to
ing to the standard.
the standard [%]
P.L2–3.10. Number of warm start-ups or
This factor gives a ratio of the real number of warm start-ups or shutdowns to the number allowed by design accord-
shutdowns over design acc. to standard
ing to the standard.
[%]
P.L2–3.11. Number of hot start-ups or
This factor gives a ratio of the real number of hot start-ups or shutdowns to the number allowed by design according
shutdowns over design according to the
to the standard.
standard [%]
The start-up rate or loading rate is aimed at establishing if the equipment may be experiencing high thermal stress-
es. Thermal stress is a function of the wall thickness of the equipment, the temperature difference between the
P.L2–3.12. Typical start-up rate/loading
inside and outside of the wall and the material of construction. Where temperatures are measured the actual rate
rate
should be determined and the thermal stress relative to the yield strength of the material evaluated. Where possible,
the ramp rates should be determined on a per-equipment basis.
P.L2–3.13. Calculated exhaustion (creep, This factor is based on the calculated exhaustion due to Creep and Fatigue [%] . The values in the factor are given as
fatigue) ranges.
EN 16991:2018 (E)
BS EN 16991:2018
49
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Get more FREE standards from Standard Sharing Group and our chats
50
Topic Screening risk assessment Common activities for both screening Activities in- Detailed risk assessment needs <?>
and detailed risk assessment volved in de-
tailed risk as-
sessment
A. Identify haz- Identify the relevant hazards for each Input from initial analysis and
ards system within the boundaries of the scope planning.
of work. See 9.3.4
Identify the relevant hazards for
each system within the boundaries
of the scope of work.
B. Identify Determine the operating conditions. Review the applicability of Damage Determine operating and design conditions,
relevant degra- Upsets, likely excursions, as well as future mechanism classi fication (e.g. upset conditions.
dation mech- process conditions should be taken into ac- RIMAP [4] , OREDA [31] , API [33] )
anisms and count to identify the possible degradation and exclude those mechanisms Determine susceptibility windows of degrada-
failure modes and/or failure likely to occur. which do not apply. tion mechanisms.
Characteristics of potential degradation
mechanisms, e.g. local or overall degradation,
See 9.3.4
possibility of cracking, detectability (in early
or final stage).
Mechanical loading conditions.
Geometry and structure of each piece of equip-
ment from the point of view of susceptibility to
degradation mechanism.
EN 16991:2018 (E)
BS EN 16991:2018
51
(continued)
52
EN 16991:2018 (E)
BS EN 16991:2018
[c o u l d n o t fi n d t a b l e t i t l e ]
Topic Screening risk assessment Common activities for both screening Activities in- Detailed risk assessment needs <?>
and detailed risk assessment volved in de-
tailed risk as-
sessment
C. Determine The worst possible outcome of a failure Composition of the contained f luid Characteristics of the relevant degradation
Consequence of shall be established. The health, safety, and its physical/chemical proper- mechanisms, e.g. local or overall degradation,
Failure (CoF) environment and business consequences ties. possibility of cracking, detectability (in early
shall be considered. Other consequences or final stage).
such as quality of production and business Pressure, temperature and total
amount of f luid available for re - If containment is considered, the composition
impact may also be included.
lease. of the contained f luid and its physical/chem -
When the CoF has been assessed it shall be ical properties, the pressure, temperature
decided whether it is high or low, depend- Depending on national regulations and total amount of f luid available of release
ing on whether the CoF is above or below a more data, e.g. the final phase shall be available. Obtaining satisfactory CoF
of the f luid on release into the
prede fined limit. assessments may in this case often require
atmosphere, the dispersal char- de fining a number of scenarios, e.g. small leak-
Possible limits are as follows: acteristics of the f luid at the site,
age, large leakage, and full rupture.
mitigation systems such as water
Safety consequences: any failure which curtains, measures for detection of Credit may be taken for passive mitigating
may lead to injury of personnel.
the leak/break. systems.
Environmental consequence: release of If the potentially affected area Consequences shall also be assessed for hidden
toxic substances. from a leak/break is desired, then failures and test independent failures
FREEthe SeeGroup
A.10 and our chats
Business consequence: anyGet more
failure leading failure mode
standards fromand the pipe/ves-
Standard Sharing
sel size shall be entered. Identify barriers.
to loss of production or assets.
If the business impact is desired,
then the financial effect of produc -
tion loss as well as repair/replace-
ment costs shall be entered.
If publicity damage resulting from
a hazardous release is desired,
then a financial value shall be
entered expressing the negative
effect on future business.
For failures with consequences
other than f luid release, appro -
priate information on the nature
and extent of the consequence is
required.
[c o u l d n o t fi n d t a b l e t i t l e ] (continued)
Topic Screening risk assessment Common activities for both screening Activities in- Detailed risk assessment needs <?>
and detailed risk assessment volved in de-
tailed risk as-
sessment
D. Determine For each failure identi fied in each system, Prede fined time frame (from ini - Value of expected residual lifetime.
Probability of the PoF shall be assessed. tial analysis and planning).
Failure (PoF) Weighing system/factor to take account of the
PoF shall be determined for the pre-de- Maintenance and inspection histo- uncertainty of prediction.
fined time frame. ry of the item of equipment under
consideration. Prediction of lifetime based on measured
The estimate shall be conservative and inspection data, a calculation making use of
based on the available information and Speci fication of the operating operating conditions, or expert opinion. Spe-
expert judgment. window including factors which ci fic analysis tools may be used, e.g. probabil -
can be in f luenced by the operation istic (safety) analysis and/or fitness for service
When the PoF has been determined, it shall of the process (e.g. temperature, analysis.
be assessed whether the PoF is high or low. pressure) as well as factors which
For non-trendable degradation mechanisms
If this is difficult one may set the PoF equal cannot be in f luenced by the opera - See A.9
for which progress cannot be properly moni-
to 1 and perform a consequence screening. tion (e.g. seismic zone, climate). tored or predicted (e.g. stress corrosion crack-
Experience with similar equip- ing), it shall be demonstrated that degradation
ment, e.g. average probability data is prevented (through design) or detected
from a relevant database. early by means of sufficient measures to be
taken (inspection, maintenance, operation). A
Plant speci fic experience (data/in -
methodology shall be available in which the
formation/general knowledge). relation between the effectiveness of measures
(type, scope and frequency) and probability of
failure is given.
Handling of unknown degradation mechanism.
EN 16991:2018 (E)
BS EN 16991:2018
53
(continued)
54
EN 16991:2018 (E)
BS EN 16991:2018
[c o u l d n o t fi n d t a b l e t i t l e ]
Topic Screening risk assessment Common activities for both screening Activities in- Detailed risk assessment needs <?>
and detailed risk assessment volved in de-
tailed risk as-
sessment
E. Determine Determine the categories in which PoF and Risk acceptance criteria (input Determine risk to people (including plant per-
risk and classify CoF are classi fied using the risk matrix from initial analysis and planning). sonnel, contractors, public, etc.).
equipment shown in Figure 3.
Determine the risk category of the equip-
ment.
Based on the screening results the systems
or groups of equipment should be given a
low, medium or high risk.
Systems or groups of equipment with a
high risk should be considered in a detailed
assessment. See 9.3.4.2
Finally, for the low risk systems or groups
of equipment the assumptions should be
periodically checked. This may amount
to verifying that the basic assumptions
are satis fied, e.g. coating is Get
satisfactory
more FREE standards from Standard Sharing Group and our chats
or that the operating conditions remain
unchanged. For low risk systems minimum
surveillance is required.
High risk systems should be considered in
the detailed analysis. In all cases, regulato-
ry requirements should be considered.
BS EN 16991:2018
EN 16991:2018 (E)
55
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
56
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
A . 6 E xa m p l e s o f
typ e s o f
i n - s e r vi c e d a m a g e a n d th e i r s p e c i fi c a ti o n s
I D and type
of damage or
E vent, prob - dis turb ances f
**
S u b t y p e s / s p e c i fi c s / u r t h e r d e t a i l s /
Common terms
lem, iss ues / deviations , examples
functional prob -
lems
57
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
I D and type
of damage or
Event, prob - dis turb ances f
**
S u b t y p e s / s p e c i fi c s / u r t h e r d e t a i l s /
Common terms
lem, iss ues / deviations , examples
functional prob -
lems
58
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
A . 7 E xa m p l e o f
va r i o u s typ e s o f d a m a g e a n d th e i r s p e c i fi c a ti o n s i n r e l a ti o n to
I D and type
Equipment: Econom-
of damage or
izer
E vent, prob - dis turb ances S u b t y p e s / s p e c i fi c s / f
u r t h e r d e t a i l s /
59
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
I D and type
Equipment: Econom-
of damage or
izer
Event, prob - dis turb ances S u b t y p e s / s p e c i fi c s / f
u r t h e r d e t a i l s /
A . 8 E xa m p l e o f
c l a s s i fi c a ti o n o f ty p e o f d a m a g e vs . p r i o r i ti z e d m e th o d s
of inspection
60
What type of damage How to look for it Measure of uncertainty/risk for selected/preferred method <?>
PoD for defect size of or size for FCP 6 ; com-
most cost selected
Identi fier and Type of damage Damage speci fics, damage mechanism best PoD <?> ments, exam-
effective method 1 mm 3 mm 90 % PoD ples
I.B Cracking (on surface, mainly) I.B1 Stress corrosion (chloride, caustic, etc.)
MT, PT, ET MT, PT, ET ET max 85 % 40 ÷ 90 % 4 ± 2 mm < 5 % <?>
EN 16991:2018 (E)
DiM DiM DiM na na na lution ≤ 0,1 mm
BS EN 16991:2018
or 0,5 %
EN 16991:2018 (E)
BS EN 16991:2018
[c o u l d n o t fi n d t a b l e t i t l e ]
What type of damage How to look for it Measure of uncertainty/risk for selected/preferred method <?>
PoD for defect size of or size for FCP 6 ; com-
most cost selected
Identi fier and Type of damage Damage speci fics, damage mechanism best PoD <?> ments, exam-
effective method 1 mm 3 mm 90 % PoD ples
II.D Microcracking, cracking II.D1 Fatigue (HCF, LCF), thermal fatigue,
(corrosion fatigue) PT max 90 % 20 ÷ 90 % 1,5 ÷ 6,5 mm <?>
UT, (MT/PT),
MT/PT
II.D2 thermal shock, creep, creep-fatigue ET, VT
MT 5 ÷ 90 % 50 ÷ 90 % 2,5 ÷ 10 mm <?>
Get more FREE standards from Standard Sharing Group and our chats
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The current probability of failure and the PoF development over time shall be assessed for all relevant
degradation mechanisms. The development of the PoF over time is an important parameter to consider
when the maintenance/inspection strategies and intervals are determined later in the analysis. The
probability of failure shall also be linked to the appropriate end event in the bow tie model [29] to
ensure that each consequence is assigned the correct probability of failure. In addition, the uncertainty
in the PoF assessment shall be determined.
For introducing the PoF according to RBI procedure, three different types of source can be used. One
common reference source is taken from statistical analysis of historical data (H/S) on failures in
comparable equipment. A second common source is based on forecasting or modelling (F/M) of the
foreseen failure mode in the equipment considered. The third source is expert judgment (E/J), whereby
human expertise is applied to extract the best estimate of PoF (see Figure A.2). The individual sources
for overall PoF determination are combined as outlined in Figure A.2 . The elements from different
kinds of sources can be modi fied according to factors related to source reliability and application.
63
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The failure of the pressure containing boundary of pressurized equipment, and the associated discharge
of hazardous fluids can result in health, safety, environmental and business related consequences.
Other consequences, such as image loss or public disruption may also be considered.
A methodology to quantify CoF for safety and health can be found in [1] , [32].
API 581 provides methodologies for the calculation of the consequences of a leak or rupture from
pressurized equipment, expressed in terms of impact area or in financial terms [34] . The simpli fied
Level 1 methodology (Figure A.3), allows for the estimation of the consequence area based on lookup
tables for a limited number of modelled representative fluids. A more rigorous Level 2 methodology is
available, with a comprehensive calculation procedure which can be applied to a wider range of fluids.
For the example depicted in the Figure A.3 , the input data includes the fluid properties of the selected
representative fluid, and a selection of release hole sizes for the considered failure scenarios.
For the selected representative fluid (that most closely matches the actual contents of the item of
pressure equipment),
Getthe required
more FREEproperties
standards are
fromestimated
Standarddepending on theand
Sharing Group stored
ourphase
chatsof the f luid:
1. Stored Liquid
— Normal Boiling Point, NBP
— Density, ρ l
— Auto Ignition Temperature, AIT
2. Stored Vapour or Gas
— Normal Boiling Point, NBP
— Molecular Weight, MW
— Ideal Gas Speci fic Heat Capacity Ratio, k
— Constant Pressure Speci fic Heat, Cp
— Auto-Ignition Temperature, AIT
Depending on the stored fluid phase, properties and the operating conditions, the fluid phase
after release can be a gas, liquid or two-phase mixture, which will greatly in fluence the dispersion
characteristics and the probability of consequence events (e.g. pool fire, jet fire, vapour cloud explosion,
safe dispersion etc). In the presented simpli fied example, the fluid phase upon release is assumed to be
a liquid or a gas only.
A discrete set of hole sizes is used for the analysis, depending on the equipment/component type (and
hence size), which adequately represents the range of possible outcomes: 6,35 mm (0,25 inch), 25,4 mm
(1 inch), 101,6 mm (4 inch) and rupture – limited to a maximum diameter of 406,4 mm (16 inch). A total
64
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
generic failure frequency for the range of possible outcomes can be computed from the generic failure
frequencies associated with the respective hole sizes (n) using the formula:
(A.1)
65
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The fluid release rate Wn is calculated by selecting the appropriate release rate formula (for liquid
release or sonic/subsonic vapour release), based on the physical properties of the stored fluid, its initial
phase, the process operating conditions and the applicable release area. The liquid and vapour release
rate and associated formulae are provided in API 581 Part 3 [34].
For each applicable hole size, the release area A n is calculated, based on the hole diameter d n :
(A.2)
The maximum mass available for release mass avail,n , for each applicable hole size (n), is estimated as the
lesser of two values, according to the formula:
(A.3)
Where
mass inv the Inventory Group Mass – the sum of inventory available for release in all (n) equipment in
the inventory group to which the analysed equipment belongs, used as the upper limit of the fluid mass
available for release:
(A.4)
Where
mass comp the Component Mass
Get more – thestandards
FREE f luid mass available
from for release
Standard SharinginGroup
the analysed
and ourequipment
chats plus an
additional mass mass add,n , which takes into account the f luid mass released from connected equipment
in the inventory group.
The additional mass can be calculated assuming the same flow rate from the leaking equipment, for the
applicable hole sizes, however it is limited to a 203 mm (8 inch) hole size:
(A.5)
In the API methodology, two release types are modelled: instantaneous release and continuous release.
The determination of the release type for each applicable release hole size (n) is based on two criteria:
1. limiting hole size – if the release hole size is 6,35 mm (0,25 inch) or less, the release type
is continuous;
2. the amount of time required to release 4536 kg of fluid tn . If tn ≤ 180 sec, and the release mass is
greater than 4536 kg, then the release is instantaneous; otherwise it is continuous.
(A.6)
The determination of the final release rate (for continuous releases) and mass (for instantaneous
releases) in the consequence of failure calculation takes into account the effect of installed detection,
isolation and mitigation systems. Guidance on the assignment of qualitative ratings (A, B, C) to the
detection and isolation systems is provided in tables in API 581 Part 3 [34].
66
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Table A.3 — Adjustments to release rate based on detection and isolation systems [34]
System classi fications Release magnitude adjustment Reduction
Detection Isolation factor, factdi
A A Reduce release rate or mass by 25 % 0,25
A B Reduce release rate or mass by 20 % 0,20
A or B C Reduce release rate or mass by 10 % 0,10
B B Reduce release rate or mass by 15 % 0,15
C C No adjustment to release rate or mass 0,00
The final release rate formula (for continuous releases) for the n th size hole, after adjustment for
detection and isolation systems is therefore:
(A.7)
67
BS EN 16991:2018
EN 16991:2018 (E)
The final release mass (for instantaneous releases), and the leak duration for the n th hole size, after
adjustment for detection and isolation devices is shown by A.8 and A.9, respectively:
(A.8)
(A.9)
For the Level 1 methodology, procedures to calculate the flammable, explosive, toxic and non- flammable,
non-toxic (e.g. steam leaks) consequences are provided in detail in API 581, Part 3 and Annex 3.A [34]. In
this example, an overview of the generic and final formulae for flammable and explosive consequences
is provided.
For the determination of the flammable and explosive consequence area for each release hole size (n),
two initial generic formulae are given:
a) For Continuous Release:
(A.10)
Get more FREE standards from Standard Sharing Group and our chats
(A.11)
In both cases, the coefficients used in the formulae are given in the respective tables in API 581 Part 3
[34]. The overall consequence area is calculated in a 3-step process:
1. The possible events are assessed in an event tree, and estimates for the probability of occurrence of
each event are provided. In the case of flammable material releases, the principal factors de fining
the path on the event tree area the probability of ignition and the timing of ignition;
2. The consequence areas resulting from each event on the tree are calculated;
3. The consequence areas of each individual event on the tree are combined into a single final
probability weighted formula.
68
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The final probability weighted formulae for the flammable and explosive consequences are given for
the equipment damage area and personnel injury area.
(A.12)
(A.13)
The final flammable and explosive consequence area is taken as the maximum of these two areas.
Similar procedures are used for determining the consequences associated with releases of toxic
chemicals, as well as non- flammable, non-toxic (but otherwise hazardous) releases. The final overall
consequence area is taken as the maximum (driving) value between the assessed (flammable and/or
toxic and/or non- flammable, non-toxic) consequence areas. The numerical values associated with the
Area-Based CoF categories, as given in API 581 Part 1 are shown in the Table A.5.
Category Range (m 2 )
A CA ≤ 9,29
B 9,29 < CA ≤ 92,9
C 92,9 < CA ≤929
D 929 < CA ≤ 9290
E CA > 9290
69
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The API 581 methodology allows for the calculation of financial consequences associated with the
release of hazardous substances, on the basis of the calculated flammable, toxic and non- flammable,
non-toxic consequence areas and other related factors. These include, but are not limited to:
1. Costs of repair and/or replacement of equipment, FC cmd ;
2. Cost of damage to surrounding equipment in affected area, FCaffa ;
3. Costs associated with losses of production or business interruptions resulting from downtime to
repair or replace the damaged equipment, FCprod;
4. Costs related to potential injuries or fatalities associated with the failure, FCinj;
5. Costs of environmental clean-up, FCenviron .
The financial consequences of failure can be determined by summing up the (applicable) individual
costs given above:
(A.14)
The details of each individual factor, and the formulas and procedures used for calculation are given in
API 581 Part 3 [34]. The numerical values associated with the Financial-Based CoF categories, as given
in API 581 Part 1 are shown in Table A.6.
Table A.6 — Numerical values associated with Financial-B ased CoF categories [3 4]
A . 1 1 E xa m p l e o f
KP I s a n d o b j e c ti ve s f o r s e l e c ti o n
Key Performance Indicators (KPIs) are management tools to measure and react on speci fic
developments within a plant. In general events one can count events that have occurred and can be
classi fied as the so called lagging KPIs (e.g. Loss of Primary Containment (LoPC) events). Indicators
that are more predictive are considered leading indicators. In API 754 [33] a hierarchy of lagging and
leading indicators is shown using the Process Safety Metric Pyramid.
Examples of KPIs and a template for KPI development are shown in Table A.7 and Table A.8, respectively.
T a b l e A . 7 — E x a m p l e s o f
K P I s a n d o b j e c t i ve o f
s e l e c t i o n
O b j e c t i ve KPI
Improve safety and environmental conditions. It is Number of overall safety and environmental incidents
recommended to distinguish between severe leakag- with focus on LoPC events.
es and those with a minor severity; (see for instance
Tier 1 and Tier 2 events in [33] ).
70
BS EN 16991:2018
EN 16991:2018 (E)
O b j e c t i ve KPI
Indicator of integrity management system efficiency. Leaks and Near Leaks with a pressure equipment im-
pact that result from a breach of the pressure-retaining
boundary:
— # leaks / near leaks by internal corrosion;
— # leaks / near leaks by external corrosion;
— # leaks / near leaks by mechanical damage;
— # leaks / near leaks from gasket/packing;
— # leaks / near leaks by other cause.
Legal or internal compliance. Number of overdue Inspection Schedules on Static
Equipment, Piping and PRVs.
Integrity/compliance management. Number of overdue Noti fications for once-off inspection
jobs (non-recurring jobs)
Track progress against RBI plan (Loss of control of % of static equipment and piping covered by RBI
RBI plan and unquanti fied level of risk).
Follow through on exceedances. Number of IOW corrective actions (completed and
outstanding)
Performance measure of operational control of key Number of critical IOW exceedance (12 months rolling
RBI assumptions. average)
Integrity Control: Ensure compliance to RBI assump- Actual % implemented of monitoring points of agreed
tions. IOW
Asset/plant utilization. Unplanned downtime (%)
Unplanned down time per equipment type (%), plant
(%) and Unit utilization (%)
Assessment of the RBI inspection plan. # inspection findings according to the RBI inspection
plan
71
BS EN 16991:2018
EN 16991:2018 (E)
1. Has a written inspection plan for the process unit been developed that includes the follow-
ing elements:
a. All equipment needing inspection has been identi fied?
b. The responsibilities to conduct the inspections have been assigned?
c. Inspection frequencies have been established?
d. The inspection methods and locations have been speci fied?
e. Inspection reporting requirements have been de fined?
2. Does the inspection plan referred to in 1 include a formal, external visual inspection pro-
gram for all process units?
a. Are all the following factors considered in the visual inspection program: the condi-
tion of the outside of equipment, insulation, painting/coatings, supports and attachments,
and identifying mechanical damage, corrosion, vibration, leakage or improper components
or repairs?
b. Based on the inspection plan referred to in 1, do all pressure vessels in the unit re-
ceive such a visual external inspection at least every xx years?
c. Based on this inspection plan, do all on-site piping systems that handle volatile,
f lammable products, toxins, acids and caustics, and other similar materials receive a visual
external inspection at least every xx years?
3. Based on the inspection plan, do all pressure vessels in the unit receive an internal or de-
tailed inspection using appropriate nondestructive examination procedures at least every
xx years?
4. Has each item of process equipment been reviewed by appropriate personnel to identify
the probable causes of deterioration or failure?
Get more FREE standards from Standard Sharing Group and our chats
a. Has this information been used to establish the inspection methods, locations, and
frequencies and the preventive maintenance programs?
b. Have defect limits been established, based on fitness for service considerations?
5. Is a formal program for thickness measurements of piping as well as vessels being used?
a. When the locations for thickness measurements are chosen:
i. Is the likelihood and consequence of failure a major factor?
ii. Is localized corrosion and erosion a consideration?
b. Are thickness measurement locations clearly marked on inspection drawings and on
the vessel or piping system to allow repetitive measurements at precisely the same loca-
tions?
c. Are thickness surveys up to date?
d. Are the results used to predict remaining life and adjust future inspection frequency?
6. Is there a written procedure that requires an appropriate level of review and authorization
prior to any changes in inspection frequencies or methods and testing procedures?
7. Inspection checklists:
a. Have adequate inspection checklists been developed and are they being used?
b. Are they periodically reviewed and updated as equipment or processes change?
72
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
8. Documentation:
a. Are all inspections, tests and repairs performed on the process equipment being
promptly documented?
b. Does the documentation include all of the following information? 1. The date of the
inspection 2. The name of the person who performed the inspection 3. Identi fication of
the equipment inspected 4. A description of the inspection or testing 5. The results of the
inspection 6. All recommendations resulting from the inspection 7. A date and description
of all maintenance performed
9. Have all employees involved in maintaining and inspecting the process equipment been
trained in an overview of the process and its hazards?
*For more details of the above example see the Management Systems Work Book (Annex 2.A) [34]
Risk-Based Inspections are carried out in discrete time steps within the life cycle of a component,
structure or industrial system. In order to describe the changes within each time step a mathematical
formulation of degradation (i.e. ageing) of the asset is de fined.
A basic model with de fined uncertainties, which is improved step by step through introduction and
evaluation of new knowledge gained about a structure or system is presented here. The ideal result
is a precise assessment of the condition with reasonable margins of uncertainty. The model is able to
show the successive impact during the long-term deterioration process as well as the effect of sudden
changes in condition. It is recognized that the individual results from inspection and assessment will
in fluence the quality of the prediction.
The concept is to give a common understanding on structural ageing in general, which can be
incorporated into different industrial applications and adapted regarding the industry-speci fic
demands. Figure A.5 illustrates a simplistic ageing model with the uncertainty bounds around the
design life of a component, structure or industrial system.
73
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Get more FREE standards from Standard Sharing Group and our chats
All important Key Performance Indicators (KPIs) related to the aspects that potentially can have an
impact on the performance or durability of a structural member are to be considered. These data sets
are implemented into a probabilistic model for service life calculations of the individual items, to cover
occurring uncertainties which have to be considered within the established maintenance plans in
terms of lower and upper bound of service life expectancy.
The starting point of the asset’s service life is mainly based on the applied design code and the
underlying safety consideration in the course of the design calculations, while the ageing process in
general depends on certain major sources of impact:
— operating time since manufacture/construction;
— system robustness;
— material properties;
— type of structure.
To describe the individual deterioration process properly the following additional aspects are of
relevance with regard to structural performance over time:
— direct loading frequency;
— direct loading intensity;
— quality in manufacturing;
— environmental in f luences (such as temperature, radiation, corrosive environment);
— chemical exposure.
74
BS EN 16991:2018
EN 16991:2018 (E)
The basis for the service life expectancy considerations is expressed in terms of structural conditions.
After being put into operation, each member’s range of ratings represents the available (total) capacity,
which is consumed over time during the entire service life.
The process can be described by the formulae such as those proposed by CWA 63: 2012 [35]. The
so-called deterioration capacity Ci(t) for an analysed component is determined by the following
formula expression:
(A.15)
with
(A.16)
where
is the initial condition;
is the slope of deterioration;
is the current year of service life;
is the initial year of service life;
is the deterioration power exponent; empirical, constant value derived from sensitivity analysis for bridge
components c = 3 is established;
is the final condition (early-warning level);
is the final (assumed) year of service life.
75
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Bibliography
[15] IEC 61511:2016, Functional safety — safety instrumented systems for the process industry sector
[16] EN ISO/IEC 17020:2012, Conformity assessment — Requirements for the operation of various types
of bodies performing inspection (ISO/IEC 17020:201 2)
[19] ASME/CR TD-41, Risk-based Methods for Equipment Life Management: An Application Handbook.
New York: ASME International, 2003. Vol. 41
[20] ASME PCC-3-2007, Inspection Planning Using Risk-based Methods. New York: ASME
International, 2008
76
BS EN 16991:2018
EN 16991:2018 (E)
[24] JOVANOVIC. A.S., AUERKARI, P. and GIRIBONE, R. RIMAP WP4, D4. Application Workbook for
Power Plants, GROWTH project GIRD-CT-2001-03008. RIMAP RTD Consortium, 2003. Ver.: 2
[25] N orth A meric an E lec tric R eli abili t y C ouncil . Generating availability data system .
NERC, USA, 2002
[26] VGB P owerT ech e . V. Research and Development Project. Reliability Indicators with KISSY. VGB
PowerTech Service, Germany, 2014
[27] DNV-RP-G101:2010, Risk based inspection of offshore topside static mechanical equipment .
[28] EN 60812, Analysis techniques for system reliability — Procedure for failure mode and effects
analysis (FMEA) (IEC 6081 2)
[29] TNO P ri ns M auri tis R ese arch L aboratory. TNO EFFECTS: A software for Hazard Assessment .
TNO, The Netherlands, 1991
[30] D e t N orske Veri tas . PHAST Risk, Software for the risk assessment of Flammable, explosive and
toxic impact . DNV, 2002
[31] SINTEF T ech nology and S ocie t y. Offshore Reliability Data . 4th edition handbook. OREDA, 2002
[32] Praktijkregels voor drukapparatuur – Katern 2.3: Periodieke herbeoordeling, May 2011 - version
3 Sdu Uitgevers bv Den Haag, 2011
[33] API 754:2010, Process Safety Performance Indicators for the Re fining and Petrochemical Industries
[34] API 581:2016, Risk Based Inspection Technology
[35] CWA 63:2012, Ageing behaviour of Structural Components with regards to integrated Lifetime
Assessment and subsequent Asset Management of constructed Facilities. CEN, June 201 2
[37] Van den B ossch C.J.H. and WETERINGS, R.A.P.M ed. Methods for the calculations of Physical
Effects: Resulting from Releases of Hazardous Materials (TNO ‘Yellow Book’ ). The Hauge, the
Netherlands: Committee for the Prevention of Disasters, 2005
[38] Engineering Equipment and Materials Users Association (EEMUA). Risk Based Inspection - Guide
to Effective Use of the RBI process. EEMUA Publication 206, 2006
[39] E ngi neering E quipmen t and M ateri als U sers A ssoci ation . Users' Guide to the Inspection,
Maintenance and Repair of Above Ground Vertical Cylindrical Steel Storage Tanks. 3rd edition.
EEMUA Publication 159, 2003
[40] ANSI/API RP 530:2003, Calculation of heater-tube thickness in petroleum re fineries
[41] KRAFTWERKSTECHNIK GmbH. KKS Kraftwerk-Kennzeichensystem Richtlinie zur Anwendung und
Schlüsselteil . VGB, 2007. ArtNr.: 105E. English version: KKS Power Plant Classi fication System -
Guidelines for Application and Key Part
[42] THE NORWEGIAN PETROLEUM DIRECTORATE. Maintenance baseline study - A method for self-
assessment of maintenance management systems. NO: The Norwegian Petroleum Directorate,
1998. Rev. 0
[43] UIJT de HAAG. P.A.M. and ALE, B.J.M. Guidelines for quantitative risk assessment (‘Purple Book’).
Committee for the Prevention of Disasters, The Hague, the Netherlands, First Edition, 1999
[44] PGS 2, (formerly CPR14E), Methods for the calculation of physical effects -due to the release of
hazardous materials (liquids and gases) (‘Yellow Book’). 3rd edition, second revised. The Hague, the
Netherlands: Committee for the Prevention of Disasters, 2000
77
BS EN 16991:2018
EN 16991:2018 (E)
[45] PGS 1, (formerly CPR16E), Methods for the determination of possible damage to people and
objects resulting from releases of hazardous materials (‘Green Book’). 1 st edition. The Hague, the
Netherlands: Committee for the Prevention of Disasters, 1992
[46] ISO 14040:2006, Environmental management - Life cycle assessment - Principles and framework
[47] ISO 14044:2006, Environmental management - Life cycle assessment - Requirements and guidelines
[48] CWA 16649:2013, Managing emerging technology-related risks
[49] CWA 16633:2013, Ageing behaviour of Structural Components with regard to Integrated Lifetime
Assessment and subsequent Asset Management of Constructed Facilities
[50] EN ISO 9712:2012, Non-destructive testing — Qualification and certification of NDT personnel
(ISO 971 2:201 2)
[51] EN ISO 14224:2016, Petroleum, petrochemical and natural gas industries — Collection and exchange
of reliability and maintenance data for equipment (ISO 14224:2016, Corrected version 2016-10-01)
[52] EN ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and
certification of management systems — Part 1: Requirements (ISO/IEC 17021-1:2015)
[53] EN ISO/IEC 17024:2012, Conformity assessment — General requirements for bodies operating
certification of persons (ISO/IEC 17024:2012)
[54] EN ISO/IEC 17025:2005, General requirements for the competence of testing and calibration
laboratories (ISO/IEC 17025:2005)
[62] SAE JA 1011:1998, Evaluation Criteria for Guide to the Reliability Centred Maintenance
(RCM) Processes
[63] SAE JA 1012A:2002, Guide to the Reliability Centred Maintenance (RCM) Standard
[64] API 571:2003, Damage Mechanisms Affecting Fixed Equipment in the Re fining Industry
[65] API 583:2014, Corrosion Under Insulation and Fireproo fing
[66] API 585:2014, Pressure Equipment Integrity Incident Investigation
[67] API 579-1/ASME, FFS-1:2007, Fitness-For-Service
[68] OHSAS 18001, Occupational Health and Safety Management
78
This page deliberately left blank
NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAW
Buying standards PLUS is an updating service exclusive to BSI Subscribing Members. You will
automatically receive the latest hard copy of your standards when they’re
You can buy and download PDF versions of BSI publications, including British revised or replaced.
and adopted European and international standards, through our website at
To f nd out more about becoming a BSI Subscribing Member and the bene f ts
Get more FREE standards from Standard
bsigroup.com/shop, where hard copies can also be purchased. Sharing Group and our chats
of membership, please visit bsigroup.com/shop.
If you need international and foreign standards from other Standards Development
Organizations, hard copies can be ordered from our Customer Services team. With a Multi-User Network Licence (MUNL) you are able to host standards
publications on your intranet. Licences can cover as few or as many users as you
Copyright in BSI publications wish. With updates supplied as soon as they’re available, you can be sure your
documentation is current. For further information, email subscriptions@bsigroup.com.
All the content in BSI publications, including British Standards, is the property
of and copyrighted by BSI or some person or entity that owns copyright in the
information used (such as the international standardization bodies) and has
Revisions
formally licensed such information to BSI for commercial publication and use. Our British Standards and other publications are updated by amendment or revision.
Save for the provisions below, you may not transfer, share or disseminate any We continually improve the quality of our products and services to bene f t your
portion of the standard to any other person. You may not adapt, distribute, business. If you f nd an inaccuracy or ambiguity within a British Standard or other
commercially exploit, or publicly display the standard or any portion thereof in any BSI publication please inform the Knowledge Centre.
manner whatsoever without BSI’s prior written consent.
Useful Contacts
Storing and using standards Customer Services
Standards purchased in soft copy format: Tel: +44 345 086 9001
• A British Standard purchased in soft copy format is licensed to a sole named Email (orders): orders@bsigroup. com
user for personal or internal company use only. Email (enquiries): cservices@bsigroup. com
• The standard may be stored on more than 1 device provided that it is accessible Subscriptions
by the sole named user only and that only 1 copy is accessed at any one time. Tel: +44 345 086 9001
• A single paper copy may be printed for personal or internal company use only. Email: subscriptions@bsigroup. com
• Standards purchased in hard copy format:
Knowledge Centre
• A British Standard purchased in hard copy format is for personal or internal Tel: +44 20 8996 7004
company use only.
Email: knowledgecentre@bsigroup. com
• It may not be further reproduced – in any format – to create an additional copy.
This includes scanning of the document. Copyright & Licensing
If you need more than 1 copy of the document, or if you wish to share the Tel: +44 20 8996 7070
document on an internal network, you can save money by choosing a subscription Email: copyright@bsigroup. com
product (see ‘Subscriptions’).
BSI Group Headquarters
389 Chiswick High Road London W4 4AL UK