DNV RP-G101 Risk Based Inspection

RECOMMENDED PRACTICE

DET NORSKE VERITAS

DNV-RP-G101

RISK BASED INSPECTION OFOFFSHORE TOPSIDES STATIC

MECHANICAL EQUIPMENT

JANUARY 2002

Comments may be sent by e-mail to [email protected] subscription orders or information about subscription terms, please use [email protected] information about DNV services, research and publications can be found at http://www.dnv.com, or can be obtained from DNV, Veritas-veien 1, N-1322 Høvik, Norway; Tel +47 67 57 99 00, Fax +47 67 57 99 11.

© Det Norske Veritas. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, including pho-tocopying and recording, without the prior written consent of Det Norske Veritas.

Computer Typesetting (FM+SGML) by Det Norske Veritas.Printed in Norway by GCS AS.

If any person suffers loss or damage which is proved to have been caused by any negligent act or omission of Det Norske Veritas, then Det Norske Veritas shall pay compensation to such personfor his proved direct loss or damage. However, the compensation shall not exceed an amount equal to ten times the fee charged for the service in question, provided that the maximum compen-sation shall never exceed USD 2 million.In this provision "Det Norske Veritas" shall mean the Foundation Det Norske Veritas as well as all its subsidiaries, directors, officers, employees, agents and any other acting on behalf of DetNorske Veritas.

FOREWORD

DET NORSKE VERITAS (DNV) is an autonomous and independent foundation with the objectives of safeguarding life, prop-erty and the environment, at sea and onshore. DNV undertakes classification, certification, and other verification and consultancyservices relating to quality of ships, offshore units and installations, and onshore industries worldwide, and carries out researchin relation to these functions.

DNV Offshore Codes consist of a three level hierarchy of documents:

— Offshore Service Specifications. Provide principles and procedures of DNV classification, certification, verification and con-sultancy services.

— Offshore Standards. Provide technical provisions and acceptance criteria for general use by the offshore industry as well asthe technical basis for DNV offshore services.

— Recommended Practices. Provide proven technology and sound engineering practice as well as guidance for the higher levelOffshore Service Specifications and Offshore Standards.

DNV Offshore Codes are offered within the following areas:

A) Qualification, Quality and Safety Methodology

B) Materials Technology

C) Structures

D) Systems

E) Special Facilities

F) Pipelines and Risers

G) Asset Operation

DET NORSKE VERITAS

Recommended Practice DNV-RP-G101, January 2002

CONTENTS

1. GENERAL .............................................................. 5

1.1 Objective of this document .....................................5

1.2 Application ...............................................................5

1.3 Limitations ...............................................................5

1.4 Relationship to other codes and standards ...........5

1.5 Definitions, symbols and abbreviations.................51.5.1 Definitions of terms ............................................................ 61.5.2 Abbreviations...................................................................... 7

2. REFERENCES ....................................................... 7

3. RISK BASED INSPECTION CONCEPT ........... 8

3.1 Risk management ....................................................8

3.2 Inspection management ..........................................8

3.3 Fabrication inspection and in-service inspection .8

3.4 RBI team competence .............................................8

4. RISK TERMINOLOGY AND PRESENTATION....................................................................................9

4.1 General .....................................................................9

4.2 Risk ...........................................................................94.2.1 Risk definition .................................................................... 94.2.2 Risk acceptance criteria ...................................................... 94.2.3 Risk presentation ................................................................ 9

4.3 Qualitative and quantitative RBI...........................9

4.4 Probability of failure .............................................104.4.1 Probability of failure definition ........................................ 104.4.2 Probability of failure presentation ....................................104.4.3 Probability of failure modelling........................................ 10

4.5 Consequence of failure ..........................................104.5.1 Consequence of failure definition.....................................104.5.2 Consequence of failure presentation................................. 104.5.3 Safety consequence modelling .........................................104.5.4 Economic consequence modelling ...................................104.5.5 Environmental consequence modelling............................11

5. WORKING PROCESS........................................ 11

5.1 Objective.................................................................11

5.2 Outline of the process............................................11

5.3 Acceptance criteria ................................................11

5.4 Information gathering...........................................11

6. RISK SCREENING ............................................. 12

6.1 Working process ....................................................12

6.2 Screening team.......................................................12

6.3 Consequence of failure evaluation .......................126.3.1 Safety consequence...........................................................126.3.2 Economic consequence.....................................................126.3.3 Environmental consequence .............................................126.3.4 Other consequences ..........................................................12

6.4 Probability of failure evaluation ..........................126.4.1 Probability of failure – internal.........................................136.4.2 Probability of failure - external.........................................136.4.3 Probability of failure - fatigue ..........................................136.4.4 Probability of failure - other .............................................13

6.5 Risk assessment......................................................13

6.6 Results of Screening ..............................................13

6.7 Revision of screening.............................................13

7. DETAILED ASSESSMENT ............................... 13

7.1 Objective ................................................................ 13

7.2 General ................................................................... 13

7.3 Detailed RBI: Analysis detail level ...................... 13

7.4 Consequence of failure modelling........................ 147.4.1 Objective........................................................................... 147.4.2 Working process ............................................................... 147.4.3 Establish the event tree ..................................................... 157.4.4 Ignited consequences........................................................ 157.4.5 Unignited consequences ................................................... 15

7.5 Probability of failure modelling........................... 167.5.1 Objective........................................................................... 167.5.2 Working process ............................................................... 167.5.3 Probability of failure acceptance limit.............................. 167.5.4 Allocation of degradation mechanisms ............................ 167.5.5 Internal damage – systems/service/materials ................... 167.5.6 External damage ............................................................... 177.5.7 Mechanical damage .......................................................... 177.5.8 Lower limit on calculation of PoF.................................... 177.5.9 Insignificant model ........................................................... 177.5.10 Susceptibility model ......................................................... 177.5.11 Rate model ........................................................................ 17

7.6 Leak hole size......................................................... 18

7.7 Estimation of risk .................................................. 18

7.8 Reporting of the assessment ................................. 19

7.9 Revision of assessment with new information .... 19

8. USE OF INSPECTION AND MONITORING . 19

8.1 Use of inspection results ....................................... 19

8.2 Validity check for inspection data ....................... 19

8.3 Use of corrosion monitoring results .................... 20

8.4 Use of process monitoring .................................... 20

9. INSPECTION PLANNING ................................ 20

9.1 Inspection scheduling............................................ 20

9.2 Inspection procedures........................................... 20

10. FITNESS FOR SERVICE................................... 21

APP. ASCREENING ..................................................................... 22

A.1 Guidance for use....................................................... 22A.2 RBI Screening Form................................................. 23A.3 RBI screening briefing ............................................. 24A.3.1 Consequence of failure....................................................... 24A.3.2 Probability of failure .......................................................... 24

APP. BCONSEQUENCE OF FAILURE EVALUATION......... 25

B.1 General ..................................................................... 25B.2 Introduction .............................................................. 25B.3 Use of QRA data ...................................................... 25B.4 Method of overview ................................................. 25B.4.1 General ............................................................................... 25B.4.2 Steps in consequence assessment....................................... 25B.4.3 Use of Event Trees ............................................................. 26B.5 System description ................................................... 26B.6 Mass leak rates for gas and oil ................................. 26B.7 Dispersion modelling ............................................... 27B.8 Effect assessment of flammable releases ................. 27B.8.1 Calculation method ............................................................ 27B.8.2 Step 1: Development of an event tree ................................ 27B.8.3 Step 2: Event tree branch probabilities .............................. 28

DET NORSKE VERITAS


B.8.4 Step 3: Consequence of failure for end events ................... 29B.8.5 Steps 4 and 5: Total consequence of failure ....................... 31B.9 Assessment of the effect of Toxic releases ............. 31B.9.1 General ............................................................................... 31B.9.2 Asphyxiating fluids ............................................................ 31B.9.3 Hydrogen sulphide.............................................................. 31B.10 References ................................................................ 32

APP. CPRODUCT SERVICE CODES, MATERIALSDEGRADATION AND DAMAGE MECHANISMS..... 33

C.1 Introduction .............................................................. 33C.2 Internal degradation.................................................. 33C.3 External degradation................................................. 33C.4 Materials definition .................................................. 33C.5 Product service code definition ................................ 34C.6 Degradation mechanisms and damage modelling .... 36C.6.1 Steps in modelling .............................................................. 36C.6.2 Degradation mechanisms - hydrocarbon systems .............. 36C.6.3 Degradation mechanisms - water systems.......................... 38C.6.4 Degradation mechanisms - chemicals ................................ 41

C.6.5 Insignificant ........................................................................ 41C.6.6 Unknown ............................................................................ 41C.6.7 Degradation mechanisms - vent systems............................ 41C.6.8 Degradation mechanisms water - injection systems........... 41C.6.9 Degradation mechanisms - external corrosion ................... 41C.6.10 Fatigue ................................................................................ 44

APP. DINSPECTION PLANNING AND DATA ANALYSIS... 45

D.1 Inspection planning .................................................. 45D.1.1 Definition of inspection effectiveness ................................ 45D.1.2 Inspection techniques ......................................................... 45D.1.3 Damage mechanism and inspection effectiveness ............. 45D.2 Inspection data analysis ........................................... 50D.2.1 Grouping of data................................................................. 50D.2.2 Data quality checks ............................................................ 50D.2.3 Degradation mechanisms/morphology............................... 50D.2.4 Inspection method .............................................................. 50D.2.5 Corrosion monitoring data.................................................. 50D.2.6 Statistical evaluation of data............................................... 50D.2.7 Application of mata between corrosion circuits ................. 50

DET NORSKE VERITAS


1. General

1.1 Objective of this documentThe objective of this recommended practice is to describe amethod by which a risk based inspection (RBI) plan may be es-tablished for offshore production systems. The document out-lines methods for evaluating probability and consequence offailure, making an assessment of the risk level, and concludingon the appropriate actions such as inspection that can be takento manage that risk. These activities have been carried out byinspection engineers for many years, and this document there-fore describes a quantification and systematisation of workingmethods rather than a new process. It should be noted that RBIis an inspection planning tool.

The reasons for selecting a risk based approach to inspectionplanning are:

— to focus inspection effort on items where the safety, eco-nomic or environmental risks are identified as being high,whilst similarly reducing the effort applied to low risk sys-tems

— to ensure that the overall installation risk does not exceedthe risk acceptance criteria, set by the operator, at any time

— to identify the optimal inspection or monitoring methodsaccording to the identified degradation mechanisms.

The RBI assessment should assess all relevant degradationmechanisms. This document addresses the most commonly ex-perienced degradation mechanisms found on offshore installa-tions, but the user should make themselves aware of anyspecial circumstances that are relevant to an individual instal-lation and that are not included in this recommended practice.These special circumstances must be treated separately.

1.2 ApplicationThis recommended practice is primarily intended used for theplanning of in-service inspection for offshore topsides staticmechanical pressure systems when considering failures by lossof containment of the pressure envelope. The system bounda-ries for applicability of the methods are the Christmas treewing valve through to the export pipeline topsides ESD valve.These systems involve the following types of components:

— piping systems comprising straight pipe, bends, elbows,tees, fittings, reducers

— pressure vessels and atmospheric tanks— pig launchers and receivers— heat exchangers— unfired reboilers— valves

— pump casings— compressor casings.

1.3 LimitationsExcluded from the scope of the recommended practice are:

— structural items including supports, skirts and saddles— seals, gaskets, flanged connections— plate and compact-type heat exchangers— failure of internal components and fittings— instrumentation.

Failure modes, such as failure to operate on demand, leakagethrough gaskets, flanged connections, valve stem packing, to-gether with valve passing and tube clogging are not addressedin this document. The probability of such failures is not expect-ed to be affected by inspection, and so should be addressed asa part of a reliability centred maintenance (RCM) assessmentof the systems. Note that the consequences of failure deter-mined using this recommended practice can be useful in suchRCM analyses.

1.4 Relationship to other codes and standardsRisk based inspection methods and applications are describedin documents prepared by ASME and API /1/2/. Inspectionplanning and execution standards and recommended practicesare published by ASME.

There are a number of design codes covering pressurised pip-ing, vessels and heat exchangers, and these should be soughtwhere needed. A number of codes have also been developedregarding the assessment of fitness-for-service and remaininglife, and these may be used to justify continued service whendamage is found during inspection.

It should be noted that the use of risk-based principles ac-knowledges explicitly that it is cost-effective to allow somesystems to fail as long as the consequences of that failure arelow. This also implies that some systems may have such highconsequences of failure that failure is wholly unacceptable,and therefore these should receive most attention. This princi-ple challenges some accepted design codes based on determin-istic design and fitness-for-service codes, particularly whereworst-case scenarios are used in the calculations. It is likelythat a discrepancy in the requirements for inspection and reme-dial action will arise if risk-based and deterministic methodsare directly compared.

1.5 Definitions, symbols and abbreviationsThe following terms are used in this document with the specif-ic definitions as listed in 1.5.1 and 1.5.2.

DET NORSKE VERITAS


1.5.1 Definitions of terms

Term DefinitionComponent The individual parts that are used to con-

struct a piping system or item of equipment,such as nozzles, flanges, elbows, straightpieces of pipe, tubes, shells, and similar.

Condition Monitor-ing

Monitoring of plant physical conditionswhich may indicate the operation of givendegradation mechanisms. Examples are vis-ual examination of painting, corrosion mon-itoring, crack monitoring, wall thicknessmonitoring.

Confidence CoV A quantitative description of the uncertaintyin the data used in analyses, indicating thespread in the distribution of values. A dataset in which the assessor has high confidencecan be given a low CoV.

Consequence of fail-ure (CoF)

The outcomes of a failure. This may be ex-pressed, for example, in terms of safety topersonnel, economic loss, damage to the en-vironment.

Consequence of fail-ure ranking

A qualitative statement of the consequenceof failure. Often expressed as a textual de-scription (High, medium, low) or numericalrank (1, 2, 3).

Consequence of fail-ure type

The description of consequences of failureexpressed as safety, environment or eco-nomic consequence.

Corrosion Group A group of components or parts of compo-nents that are exposed to the same internaland/or external environment and made of thesame material, thus having the same poten-tial degradation mechanisms.Groups should be defined such that inspec-tion results made on one part of the groupcan be related to all the parts of the samegroup.

Coefficient of Varia-tion(CoV)

The CoV indicates the spread of a distribu-tion. The greater the CoV the greater the dis-tribution is spread and therefore the greaterthe uncertainty in any value within that dis-tribution. CoV is calculated as the standarddeviation of a distribution divided by themean value of that distribution.

Damage (type) The observed effect on a component of theaction of a degradation mechanism. Thedamage type gives rise to the failure mecha-nism of a component. Examples of damageinclude cracking, uniform wall thinning, andpitting.

Damage model A mathematical and/or heuristic representa-tion of the results of degradation. This mayexpress the accumulation of damage overtime as functions of physical or chemical pa-rameters, and normally includes the estima-tion of the conditions that give rise to failure.

Damage rate The development of damage over time.Degradation The reduction of a component’s ability to

carry out its function.Degradation mecha-nism

The means by which a component degrades.Degradation mechanisms, may be chemicalor physical in nature, and may be time orevent driven. The degradation mechanismscovered by this recommended practice are:

— internal and external corrosion— sand erosion— fatigue— stress corrosion cracking.

Economic risk An expression of the occurrence and out-come of a failure given in financial terms,with units of (currency per year). This is cal-culated as the product of the probability offailure and the financial consequences ofthat failure, and can include (but is not limit-ed to) the value of deferred production, thecost of repairs to equipment and structure,materials and man-time used in repair.

Environmental risk An expression of the occurrence and out-come of a failure given in terms relevant toenvironmental damage. This may be ex-pressed in units relevant to the installation,such as volume per year or currency peryear.

Equipment Equipment carries out a process function onoffshore topsides that is not limited to trans-port of a medium from one place to another,and therefore comprises but is not limited to:pressure vessels, heat exchangers, pumps,valves, filters.

ESD segment See ‘Segment’.Failure The point at which a component ceases to

fulfil its function and the limits placed on it.The failure condition must be clearly definedin its relationship to the component. Failurecan be expressed, for example, in terms ofnon-compliance with design codes, or ex-ceedance of a set risk limit, neither of whichnecessarily imply leakage.

Failure mechanism The means by which a component fails dueto the progression of damage beyond the setlimits imposed by the operator (such as a riskacceptance limit) or by physical limits suchas a breach of the component wall.

Failure mode The method by which failure occurs. Exam-ples are: Brittle fracture, plastic collapse andpinhole leak.

Fatal Accident Rate(FAR)

Potential loss of life per 100 000 000 hours.

Hot spot A location on pipe or equipment where thecondition being discussed is expected to bemost severe. For example, a ‘hot spot’ formicrobial corrosion is an area of stagnantflow.

Inspection An activity carried out periodically and usedto assess the progression of damage in acomponent. Inspection can be by means oftechnical instruments (NDT) or as a visualexamination.

Inspection effective-ness

A description of the ability of the inspectionmethod to detect the damage type inspectedfor.

Inspection methods The means by which inspection can be car-ried out such as visual, ultrasonic, radio-graphic.

Inspection pro-gramme

A summary of inspection activities mainlyused as an overview of inspection activityfor several years into the future.

Inspection plan Detail of inspection activity giving the pre-cise location, type and timing of activity foreach individual inspection action that isplanned.

Inspection tech-niques

A combination of inspection method and themeans by which it is to be applied, concern-ing surface and equipment preparation, exe-cution of inspection with a given method,and area of coverage.

Limit state A mathematical description where the lossof pressure containment is calculated. This isan expression involving consideration of themagnitude of the applied loading in relationto the ability to resist that load.

Term Definition

DET NORSKE VERITAS


1.5.2 AbbreviationsThe following abbreviations are used in this document:

API American Petroleum InstituteASME American Society for Mechanical EngineersASNT American Society for Non-destructive TestingCoF Consequence of failureDNV Det Norske VeritasESD(V) Emergency shut down (Valve)FAR Fatal accident rateFORM First order reliability methodPFD Process flow diagramPLL Potential loss of lifePoD Probability of detectionPoF Probability of failureP&ID Piping and utilities diagramQRA Quantitative risk analysisRBI Risk based inspectionRCM Reliability centred maintenanceUFD Utilities flow diagram

2. References

/1/ "Fossil Fuel Fired Electric Power Generating StationApplications, Risk-Based Inspection Development andGuidelines" ASME Research Report, CRTD, Vol. 20-3. ASME, New York,1994.

/2/ API 579; Recommended Practice for Fitness-for-Serv-ice evaluation. January 2000.

/3/ API 510; Pressure Vessel Inspection Code; Mainte-nance Inspection, rating, Repair, and Alteration.8th ed., January 1999.

/4/ API 570; Piping Inspection Code; Maintenance Inspec-tion, rating, Repair, and Alternation. 2nd ed., February2000.

/5/ API 581, Base Resource Document - Risk Based In-spection, 2nd Edition, May 2000.

/6/ API 574: Inspection Practices for Piping System Com-ponents, 2nd Edition, June 1998

/7/ Accidents; DNV Technical report C3560/1./8/ Dow Fire and Explosion Index. Hazard Classification

Guide, 6th ed. 1987./9/ Technical Elements of Risk-Informed Inspection Pro-

grams for Piping. Draft Report, U.S. Nuclear regulatoryCommission. Nureg-1661.

/10/ OREDA: Offshore Reliability Data Handbook, DNV,1999.

/11/ API RP 580 "Risk Based Inspection” 4th draft.

Limit state design Limit state design identifies explicitly thedifferent failure modes and provides a spe-cific design check to ensure that failure doesnot occur. This implies that the component’scapacity is characterised by the actual capac-ity for each individual failure mode (i.e. limitstate) and that the design check is more di-rectly related to the actual failure mecha-nism.

Monitoring An activity carried out over time wherebythe amount of damage is not directly meas-ured but is inferred by measurement of fac-tors that affect that damage. An examplewould be the monitoring of CO2 content in aprocess stream in relation to CO2 corrosion.

NDT Non-destructive testing. Inspection of com-ponents using equipment to reveal the de-fects, such as magnetic particles orultrasonic methods.

Operator The organisation responsible for operationof the installation, and having responsibilityfor safety and environment.

Potential loss of life(PLL)

Potential loss of life is expressed as thenumber of personnel who may lose theirlives as a consequence of failure of a compo-nent.

Probability A quantitative description of the chance ofan event occurring within a given period.

Probability of Detec-tion (PoD)

Probability that a given damage in a compo-nent will be detected using a given inspec-tion method. PoD usually varies with the sizeor extent of damage and inspection method.

Probability of Fail-ure (PoF)

The probability that failure of a componentwill occur within a defined time period.

Probability of failureranking

A comparative listing of probability of fail-ure for one item against another, without ref-erence to an absolute value for probability offailure.

Process monitoring Monitoring of process conditions which maygive rise to given degradation mechanisms.Examples are monitoring of dew point in agas line, monitoring temperature, sand mon-itoring.

QRA Quantitative risk assessment: The process ofhazard identification followed by numericalevaluation of event consequences and fre-quencies and their combination into an over-all measure of risk.

Risk Risk is a measure of possible loss or injury,and is expressed as the product of the inci-dent probability and its consequences. Acomponent may have several associated risklevels depending on the different conse-quences of failure and the different probabil-ities of those failures occurring.

Risk Based Inspec-tion (RBI)

A decision making technique for inspectionplanning based on risk – comprising theprobability of failure and consequence offailure.

Risk type Risk expressed for a specific outcome, suchas safety for personnel, economic loss or en-vironmental damage.

Safety Risk Risk to personnel safety expressed in termsof potential loss of life (PLL) per year.

Term DefinitionSegment A number of components forming part of the

same pressure system, consisting of pipes,valves, vessels, etc., which can be automati-cally closed-in by emergency shut-downvalves. The segment defines the maximumvolume of fluid or gas that can released fromthat system in the event of a failure in any ofthe components. Some segments containboth liquid and gas which may be considereddifferently regarding consequence effects.Note that it is normal to assume that the ESDisolation functions on demand, but this maynot be applicable to all cases.

System A combination of piping and equipment in-tended to have the same or similar functionwithin the process. This may be, for exam-ple, instrument air supply, or low pressuregas compression.

Tag, tag number The unique identification of a part, compo-nent, pipe or equipment.

Time to failure The duration from a specified point in timeuntil the component suffers failure.

Term Definition

DET NORSKE VERITAS


3. Risk based inspection concept

3.1 Risk managementRisk based inspection is based on the premise that the risk offailure can be assessed in relation to a level that is acceptable,and that inspection and repair, or other actions can be used tomanage the risk such that it is maintained below that accept-ance limit.

The risk associated with a failure is calculated as the productof probability of failure and consequence of failure. Probabili-ty of failure and consequence of failure are defined inSection 4.4 and Section 4.5 respectively.

Probability of failure and consequence of failure can be giveneither as a ranking (in qualitative RBI) or numerically (in quan-titative RBI). A combination of both can be used to quickly fo-cus on components where the risk levels are significant.

The design and operation of offshore process systems is usual-ly based on the avoidance of degradation. This is achieved bythe combination of materials selection and dimensioning, useof chemicals, coatings and linings. Traditionally, design isbased on deterministic principles, where the ’worst case’ com-binations of corrosivity and loading are considered in the de-sign basis. Despite this, failures still occur, often as a result oferrors in the design, fabrication or operation of the system, ordue to changes in the operating conditions that were not fore-seen by the designer, with resultant unadvertised failure of cor-rosion control. Consequently, inspection has been specified inthe past to confirm whether the degradation rate is as expectedand that integrity can be maintained.

The advantage of using risk-based principles over traditionalmethods is two-fold:

1) Probabilistic methods are used in calculating the extent ofdegradation and hence allow variations in process param-eters, corrosivity, and thus degradation rates, to be ac-counted for.

2) Consequences of failure are considered, so that attentioncan be focused where it will have significant effect.

One result is that the stipulated risk limit may be met before theend of the deterministic remaining life. This will depend on theuncertainty in the degradation of the component, and the con-sequence of failure for that component. In other cases the de-terministic remaining life may be used up before the risk hasapproached the acceptance limit. Both cases would indicatethat inspection is still required to monitor the process of degra-dation (as the inputs to the degradation models are often onlyapproximately known), but that the timing of that inspectionwould be different for the deterministic and probabilistic as-sessments.

The process of estimating consequence of failure can highlightareas where measures can be taken that would reduce theseconsequences, thereby reducing risk levels. However, this isoutside the scope of this recommended practice.

Consequence of failure values can also be used to focus atten-tion in areas where the probability of failure estimation is dif-ficult, indicating that alternatives to inspection should beconsidered to manage risk.

3.2 Inspection managementThe role of inspection in risk management is to confirm wheth-er degradation is occurring, and to measure the progress of thatdegradation. This has the effect of reducing uncertainty in theassessment of the condition of the component, thereby reduc-ing the estimated probability of failure. It is emphasised thatinspection on its own does not reduce the actual risks of failure,so risk management must include actions to repair or replacecomponents when inspection reveals that the risk is unaccept-able.

The objective of RBI is to aid the development of optimised in-spection, monitoring and testing plans for production systems.To get the best effect from RBI, inspection planning, executionand evaluation should be a continuous process where informa-tion and data from the process and the inspection / maintenance/operation activities are fed back to the planning, as indicatedin Figure 3-1.

Figure 3-1Inspection management process

Optimisation should take account of safety / environmentaland economic / financial risks, as well as the inspection costs.

It should also be noted that degradation in many corrosion-re-sistant materials does not progress at a steady rate, but insteadinitiates and progresses quickly to failure once unfavourableconditions have become established. In addition, some degra-dation mechanisms give rise to damage that is not readily de-tected using conventional inspection methods. Consequently,the degradation mechanism and resulting probability of failurecan be used to indicate whether process monitoring or mainte-nance activity is a more cost-effective alternative to inspection.

3.3 Fabrication inspection and in-service inspectionThe quality control process in fabrication comprises control ofmaterials, components, consumables, fabrication processesand inspection and testing. The extent of fabrication inspectionis determined by the fabrication code, which may include alimited consequence assessment when specifying the extent ofinspection. The acceptance limit for defects that are detected isbased upon the ability of the inspection method to detect thatdefect type, and the extent of inspection is often adjusted to ac-count for historical experience as to the abilities of fabricatorsto deliver defect-free work.

It must be recognised that not all defects are detected by fabri-cation inspection, and, although many fabrication defects canbe present without causing or contributing to a failure, anumber of failures can occur when bringing the system intoservice. Adoption of a risk-based approach to inspection at theearly design stage and carried through commissioning and intoservice would allow effective targeting of areas where materi-als verification and cross-check inspection should be carriedout. This approach would contribute to optimisation of whole-of-life costs.

3.4 RBI team competenceRBI and inspection management requires experienced person-nel at all levels as well as appropriate working routines for theexecution of the work. There are no formal requirements to theplanning function defined in any current standards, althoughrequirements for inspection execution are handled by the in-spector qualification schemes, such as those in accordancewith ASNT requirements, and the European standard EN 473.

It must be understood that RBI analysis and inspection plan-ning is a multidisciplinary activity, and the following qualifiedand experienced disciplines should be involved:

Probability of FailureMaterials/Environment and Strength

Inspection Programme

Method, Timing, Coverage, Location,Cost

Consequence of Failure

Safety, Environment,Assets Loss

Owner goals

Inspection Plan

Inspection details, planning, logistics

Inspection and testing

Execution & Reporting

Inspection data evaluation

Analysis of results

Risk Evaluation

Inspection Management

Acceptance Criteria

DET NORSKE VERITAS


— inspection engineers with hands-on experience of inspec-tion of piping, pressure vessels, heat exchangers, both in-service and during construction

— materials/corrosion personnel with expertise in materialsselection, corrosion monitoring and control, chemicaltreatments, fitness-for-service assessments, coatings andlinings

— safety/consequence personnel with experience in formalrisk analysis covering personnel safety, economic and en-vironmental disciplines

— plant operation (process) and maintenance personnel withdetailed knowledge of the installation to be analysed.

Due consideration should be given to the wide background col-lated in such a team; for example, different aspects of the RBImethod will appear as ‘obvious’ or ‘difficult’, depending onthe individuals previous training and experience.

4. Risk terminology and presentation

4.1 General

This chapter defines probability of failure, consequence of fail-ure and risk terms as used in this document, together with whatis involved in their estimation. Reporting methods are also giv-en. The following chapters give details of the working processfor estimating probability of failure, consequence of failure,risk and the resulting inspection plan.

4.2 Risk

4.2.1 Risk definition

The risk associated with failure is defined as the product ofprobability of failure and consequence of failure. Consequenceof failure can be expressed in terms of different outcomes (CoFtypes), and risk types are defined similarly. The units of riskare the consequence units per unit time.

4.2.2 Risk acceptance criteria

Risk acceptance criteria are the limits above which the opera-tor will not tolerate risk on the installation. These criteria mustbe defined for each type of risk to be assessed.

The risk acceptance criteria are used to derive the timing of in-spection, such that inspection is carried out prior to the accept-ance limit being breached. This would allow either thereassessment of the risk level based upon better information,detailed evaluation of any damage, or the timely repair or re-placement of the degraded component.

Derivation of risk acceptance criteria is described inSection 5.3.

4.2.3 Risk presentation

Risk is most conveniently presented as a matrix. This allowsthe relative contribution of both factors to be seen.

Separate matrices for each risk type are required. The matrixshould be standardised for each operator/field in order to sim-plify communication and the decision process. To achieve ad-equate resolution of detail, a 5 x 5 matrix is recommended asshown in Figure 4-1.

Figure 4-1Example of risk matrix

The matrix has probability of failure on the vertical axis, andconsequence of failure on the horizontal. The divisions be-tween the categories of each should be chosen taking into con-sideration the absolute magnitude of the values, their ranges,and the need for consistent reporting when comparing differentinstallations.

The matrix scales should be as described in sections 4.4.2 and4.5.2 of this recommended practice.

4.3 Qualitative and quantitative RBIQualitative or quantitative RBI are the extremes at which RBIcan be carried out, and the definition and advantages of eachare given below. In practice the distinction is not so clear cut,and most RBI is a blend of both.

1) Qualitative: A numerical value is not assigned, but insteada descriptive ranking is given, such as low, medium orhigh, or a numerical ranking such as 1, 2 or 3. Qualitativeranking is usually the result of using a judgement-basedapproach to the assessment.

2) Quantitative: A numerical value is calculated with units ofmeasurement. Quantitative values can be expressed anddisplayed in qualitative terms for simplicity by assigningbands for probability of failure and consequence of failure,and assigning risk values to risk ranks.

The advantage of using a qualitative approach is that the as-sessment can be completed quickly and at low initial cost,there is little need for detailed information, and the results areeasily presented and understood. However, the results are sub-jective, based on the opinions and experience of the RBI team,and are not easily updated following inspection. It is not easyto obtain results other than a ranking of items in terms of risk;the variation of risk with time allowing estimation of inspec-tion interval based on the risk acceptance limit is not possible.An example of qualitative RBI is the screening method, (albeitwith quantitative risk criteria) described in Chapter 6 of thisrecommended practice, which is used to quickly assign high,medium or low risk levels.

The advantage of the quantitative approach is that the resultscan be used to calculate with some precision, when the risk ac-ceptance limit will be breached. The method is systematic,consistent and documented, and lends itself to easy updatingbased on inspection findings. The quantitative approach typi-cally involves the use of a computer to calculate the risk andthe inspection programme. This can be initially data-intensive,but removes much repetitive detailed work from the traditionalinspection planning process.

An example of largely quantitative RBI is the method de-scribed in Chapter 7, which is used to calculate risk levels in aconsistent manner.

CAT ANNUAL PROBABILITY OF

FAILURE

5 > 10-2 expected failure4 10-3-10-2 high

Consequence Category A B C D EConsequence of Failure

2 10-5 to 10-4 low1 < 10-5 virtually nil

3 10-4 to 10-3 medium

DET NORSKE VERITAS


4.4 Probability of failure

4.4.1 Probability of failure definitionProbability of Failure (PoF) is estimated on the basis of thecomponent degradation. PoF is related to the extent of, and un-certainty in, the degradation related to the component’s resist-ance to its loading. PoF is the probability of an event occurringper unit time (e.g. annual probability).

4.4.2 Probability of failure presentationQuantitative probability of failure values have a wide rangefrom zero to unity, and therefore a logarithmic scale is recom-mended for displaying the results graphically.

The recommended probability of failure scale used in the con-text of this recommended practice is as shown in Table 4-1.The table also shows the recommended qualitative rankingscale assigned to the quantitative probability of failure values.

In the above table, a ’small population’ comprises in the orderof 20 to 50 components, a ‘large population’ 200 to 500 com-ponents.

4.4.3 Probability of failure modellingDegradation models describe the damage incurred by a com-ponent. A number of models and their application to the esti-mation of probability of failure are described in Appendix C.These models have been classified with the following descrip-tions as shown schematically in Figure 4-2.

— Rate model. Damage accumulates over time. This model isusually amenable to inspection as the relatively low dam-age rate often allows for a number of inspections beforefailure.

— Susceptibility model. Damage occurs very quickly after adelay of unknown duration, and is triggered by an externalevent. This is not amenable to inspection, but instead mon-itoring of the key controlling parameter(s) is recommend-ed.

— Insignificant model. No degradation is expected for thecomponent.

Figure 4-2Schematic of degradation modelling

4.5 Consequence of failure

4.5.1 Consequence of failure definitionConsequence of failure is evaluated as the outcome of a failurebased on the assumption that such a failure will occur. Conse-quence of failure is defined for all consequences that are of im-portance to the operator, such as safety, economy andenvironment. Each should be assessed separately giving dueaccount to cases where leaks result in a fire or explosion (i.e.ignited leak) and those that do not (i.e. non-ignited leak).

4.5.2 Consequence of failure presentationConsequence of failure values or rankings should be presentedseparately depending on the consequence type.

Safety consequence should be expressed in terms of potentialloss of life (PLL) for personnel.

Economic consequence should be expressed in financial termsusing appropriate currency units.

Environmental consequences can be expressed in terms ofmass or volume of a pollutant released to the environment, orin financial terms as the cost of cleaning up the spill, includingconsideration of fines and other compensation.

The consequence scale used in matrices and other presenta-tions is necessarily different for PLL and currency, and shouldbe selected to account for the full range of values. For consist-ency of approach, consideration should be given to adopting aharmonised scale for all installations located in one field, orowned by one operator.

The consequence of failure scale should advance in decadesfor each category, where the lowest category includes valuesup to the risk acceptance limit assuming that probability offailure ≈ 1.0.

4.5.3 Safety consequence modellingThe evaluation of safety consequences comprise an estimationof the consequences to the safety of personnel on the installa-tion. For the purposes of RBI this should be expressed in termsof PLL given that a leak will occur.

Safety consequence is usually estimated for failures that leadto fire, explosion or toxic release, with the effects of escalationincluded in the assessment. Failure of components containingany high pressure gases or fluids should also be considered.

When estimating safety consequence, the changes in manninglevels that occur as a result of different phases of operationmust be considered.

4.5.4 Economic consequence modellingThe economic consequences of failure are calculated as thesum of the cost of repairs to equipment and structures damagedas a result of the failed component and the cost of productiondown-time.

Table 4-1 Probability of failure description

CatAnnual failure probability

DescriptionQuantitative Qualitative

5 > 10-2 failure expect-ed

In a small population, one ormore failures can be expect-ed annually

4 10-3 to 10-2 highIn a large population, one ormore failures can be expect-ed annually

3 10-4 to 10-3 medium

In a small population, one ormore failures can be expect-ed over the lifetime of theinstallation

2 10-5 to 10-4 low

In a large population, one ormore failures can be expect-ed over the lifetime of theinstallation

1 < 10-5 negligible Failure is not expected.

PoF

TimeNow

SusceptibilitySusceptibility

1.0

10-5

Rate modelRate model

InsignificantInsignificant

DET NORSKE VERITAS


When considering the cost of production down-time, the indi-vidual conditions for the installation and system should be con-sidered. Some systems have little or no effect on production, orhave at least a partial redundancy in capacity. Similarly, someinstallations are not required to produce continuously or havespare capacity that can be substituted. Oilfield economics us-ing discounted cash flows and assigned financial expectationsto an installation, usually imply that production deferredmeans production ‘lost’.

The cost of repairs to the installation and equipment onboardshall also be considered, covering material cost, fabrication,installation and commissioning of the replacement equipment

4.5.5 Environmental consequence modelling

The evaluation of environmental consequence includes bothshort term (cleanup) and long-term effects both globally andlocally. Environmental issues may receive very high media at-tention that can affect an operator more than the ‘real’ value ofthe damage caused, so this should be given consideration in theevaluation. An environmental assessment for RBI is intendedas a simplified and rational approach to include the effect with-in inspection planning and is not a substitute for a more thor-ough environmental analysis required by authorities.

The definition of the units (financial, volumetric) for environ-mental consequence will depend on the operator’s philosophyand acceptance criteria.

As a general principle, leaks arising from topsides process sys-tems, either gas or oil, are considered to represent a minorthreat to the environment due to the limited volume of hydro-carbons that can be released. However, releases from flowlines(live crude), drilling activities, and from storage vessels ortanks represent a larger problem, as the enclosed inventoriesare much larger.

An oil spill onto the surface of the water is readily visible andmay result in punitive action by the regulator, as well as clean-up cost. Direct costs for oil releases are mainly related to theclean-up costs if the spill drifts towards shore. The actual effectwill then depend on the location of the field in relation to theshore, oil drift conditions, temperature and evaporation.

Note that the regulator may give permission to discharge treat-ed produced water where the oil content is below a specifiedlevel, and therefore this liquid is not considered to be polluting.

The loss of toxic chemicals into the environment must be con-sidered separately, as in some cases a small volume of chemi-cals can have a widespread effect on the environment. For thepurpose of inspection planning, environmental effects of gasreleases are considered insignificant. It should be noted thatthere may be financial consequences due to government im-posed CO2 taxation.

5. Working process

5.1 ObjectiveThe objective of this working process is to lead the RBI teammembers through methods used to prepare a risk and cost-op-timised inspection plan. Figure 5-1 presents an overview of theworking process in the form of a flow chart. Section numbersare given to cross-refer to the activity descriptions.

5.2 Outline of the processThe working process has been divided into two stages:

1) Risk screening, which is intended to address risks per sys-tem and is aimed at sorting piping and equipment intohigh, medium and low risk, following the methods de-scribed in Chapter 6. Generally, low and medium riskitems will require minimal inspection supported by main-

tenance. High risk items will require a more detailed eval-uation which is the subject of the second stage.

2) Detailed quantitative analysis with methods that can be ap-plied at various level as considered appropriate for anygiven case; e.g. ranging from utilisation of generaliseddata for an entire system, to the specific evaluation of in-dividual, parts or inspection points.

The approach is also adaptable to cases where judgement mustbe used if controlling factors are not well defined. The methodsemployed in these step are given in Chapter 7, included guid-ance to selecting a suitable detailed level for analysis.

This analysis provides a full inspection plan including inspec-tion methods, and timings, that is readily updated as inspectiondata becomes available.

Figure 5-1Overview of RBI working process

5.3 Acceptance criteriaTo be able to manage installation risk so that it lies below thelimits acceptable to the operator, the acceptance limits for eachtype of risk must be defined. The contribution to the total riskfrom inspectable events related to the systems undergoinganalysis should be found, and this divided over the componentat which the RBI is to be carried out, such as a piping system,process stream, process segment, pressure vessel or pipe tag.

As there are several acceptance criteria, it is necessary to havea decision logic regarding the order of importance of these lim-its in deciding which limit is to govern the time to inspection.This order of importance should be recorded.

The acceptance criteria must be the same for both stages of theprocess so that all the work refers to the same limits i.e. in bothscreening and detailed RBI. For presentation purposes it maybe useful to translate the numerical values into descriptive lim-its.

5.4 Information gatheringThe following sources of information should be available tothe engineers carrying out the RBI evaluations at the screening

Develop and agree riskacceptance criteria

(Chapter 5.3)

Gather information(Chapter 5.4)

Carry out screening(Chapter 6)

Risk level High

Risk levelMedium / Low

Adequate data availablefor detailed analysis? NoYes

PoF model available?

Yes

Detailed Quantitative analysis(Chapter 7)

Inspection Plan(Chapter 8, 9)

Maintenance actions

Set PoF to cat 5 & calculateCoFor

Set CoF to cat E and calculate PoF

Risk levelacceptable?

No Yes

Inspection planacceptable ?

No Yes

Execute plan

No

Create PoFModel

DET NORSKE VERITAS


and detailed RBI stages as noted in Table 5-1.

The appendices show the details of the information required inorder to be able to estimate both the consequence and probabil-ity of failure for given degradation mechanisms and materials.In the absence of such information, assumptions may be basedon judgement and experience. All such assumptions must berecorded.

6. Risk screeningThe purpose of the screening process is to identify those sys-tems that are judged to give a significant contribution to the in-stallation risk levels. This ensures that further data gatheringand assessment efforts can be focused on these systems.

6.1 Working process

Screening is carried out in a qualitative manner that involvesidentification of risk on a system by system, group by group ormajor equipment item basis. On the basis of knowledge of theinstallation history and future plans and possible components'degradation, the consequence of failure and probability of fail-ure are each assessed separately to be either ‘high’ or ‘low’ asdefined in 6.3.1 to 6.4.2 inclusive. The results of screeningshould be recorded; a recording proforma with guidance is giv-en in Appendix A. The actions required as a result of screeningare shown in Table 6-1.

Inspection data is used only as general guidance, as the screen-ing is intended to identify systems, groups and equipmentwhere it is cost-effective to use more time-consuming detailedassessment.

6.2 Screening team

It is essential that all necessary expertise is available to thescreening team, and therefore the personnel identified inSection 3.4 should be present.

6.3 Consequence of failure evaluation

Consider the worst-case outcome of the likely failure, andcompare that against the risk acceptance limit making the as-

sumption that failure will occur, i.e. probability offailure = 1.0. If the outcome is greater than the acceptance lim-it, then rank the consequence of failure as ‘high’, otherwiserank it as ‘low’.

6.3.1 Safety consequence

Acceptance criteria at a tag level are not always intuitively as-sessable in the screening session: experience shows that theboundary between ‘low’ and ‘high’ safety consequence can betaken as the possibility of personnel exposure leading to injuryand a lost-time incident.

Guidance note:A release of a fluid that is normally accepted as being difficult toignite, such as diesel fuel, can still result in ignition due to im-pingement on hot surfaces. Also a high pressure leak may resultin formation of a mist that can readily ignite in the presence ofequipment or work that may generate sparks.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---

Typically the loss of any flammable or toxic fluid or gas wouldbe expected to give a ‘high’ safety consequence.

6.3.2 Economic consequence

A production shut-down would normally be expected to give a‘high’ economic consequence. However, due considerationmust be given to the installation operational economics such asfield production profile, system redundancies and penaltiesthat might arise from contractual production guarantees.

6.3.3 Environmental consequence

The release onto the sea of any hydrocarbon liquid or processchemical (unless specifically known to be benign, or of lowvolume) would be expected to give a ‘high’ environmentalconsequence. Releases of gases into the air should be consid-ered in the light of local regulations.

6.3.4 Other consequences

If required, other consequences can be assessed, such as thepolitical consequence (in terms of adverse press coverage orloss of share value) that could arise from a spill or fire. The def-initions of these other consequences must be discussed duringagreement of the acceptance criteria.

6.4 Probability of failure evaluationConsider whether there is any possibility of failure, under theknown operating conditions and taking into account the ap-proximate chemical composition, the temperatures of the flu-ids and the effects of time. The boundary between low and highprobability of failure has been set to approximately 10-5 peryear, i.e. no significant degradation is expected with PoF of10-5 or less.

It is not the intention to carry out a detailed evaluation, but toassess whether these conditions are likely to give rise to negli-gible degradation (‘low’) or degradation rates that are not neg-ligible (‘high’).

Care should be taken to ensure that the consideration of proc-ess conditions accounts for future variations as the reservoirbecomes depleted, such as increase in water cut, temperatures,or H2S evolution. It is important also to account for likely ex-cursions in process parameters due to upset conditions.

Guidance note:Data requirements and screening guidance for probability of fail-ure are given in the Appendices that treat each degradation mech-anism. Appendix C should be consulted for the applicablemechanism. Care should be taken when using the Appendices forguidance on probability of failure to ensure that the assumptionsmade regarding the conditions under which the components op-erate are applicable to the systems in question.


Table 5-1 Information requirements

Information source Screening DetailedRBI

Coating specifications xCorrosion protection philosophy xDesign accidental load analysis xDFI resume xEquipment data and vessel sheets xESD logic diagrams xInspection/failure/replacement details xInspection/failure/replacement historyknowledge x x

Insulation specifications xLayout drawings xMass balance sheets xMaterial design specification & selectionreport x x

Materials selection reports xP&IDs x xPFDs x xPiping data sheets xProduction data (past and future) xQRA x xSystem descriptions manual x xUFDs x x

DET NORSKE VERITAS


6.4.1 Probability of failure – internalConsider the probability of failure due to combinations of ma-terials, fluids, gases, temperatures and pressures, also includ-ing degradation due to erosion and the passage of chemicalswithin the systems. Consider also likely changes in the use ofthe system – such as use of water injection pipework for oilproduction.

6.4.2 Probability of failure - externalConsider the probability of failure for each material that mightarise as a result of the external environment, taking account oftemperatures, coatings, the presence of water-retaining insula-tion and the effects of time.

6.4.3 Probability of failure - fatigueThe possibility of failure due to fatigue can be considered. Ar-eas where there are known or suspected problems should beevaluated, for example small diameter side-branches of stain-less steel. The significance of vibration sources should also beconsidered, such as poor or damaged support systems, recipro-cating equipment, unbalanced rotating equipment and fluidhammer.

6.4.4 Probability of failure - otherAny other causes of failure can be included in the assessment.This can include any known or suspected abnormal conditionsthat can cause concern.

6.5 Risk assessmentAfter assignment of the probabilities and consequences, thesystem or vessel is assigned to detailed RBI or to maintenanceactivities as shown in Table 6-1. The most severe result for anyof the consequence categories taken with the most severe resultfor the probability categories is used to stipulate the final out-come.

It is essential to assess whether the piping and vessels within asystem experience different conditions, such as the possibilityof water condensation within a vessel but not in the piping sys-tems, and the effect of flow rates in piping and vessels on sanderosion.

The recommendations for action as shown in Table 6-1 are de-veloped on the basis that inspection is only effective in reduc-ing the probability of failure. There may be other causes offailure with significant consequences that have not been con-sidered because they are not within the scope of inspection.

6.6 Results of ScreeningThe results of the screening process are that systems, groups orequipment items are assessed as having either, ‘high’, ‘medi-um‘ or ‘low’ risk:

a) Items with high risk should be evaluated further using themore detailed method in Chapter 7.

b) Items with medium or low risk should be considered formaintenance activity as noted in Table 6-1.

c) High consequence items should also undergo checks fordegradation mechanisms not considered in the screening.

The consequence of failure evaluation can also be used as inputto RCM analyses and for additional consequence mitigationactivities, such as installation of dropped object protection.

6.7 Revision of screeningThe screening process should be periodically revised as part ofthe overall inspection management process to ensure that theassumptions used in the evaluations remain valid. Changes inprocess or other conditions may result in systems or equipmentmoving to high risk and therefore should be subject to detailedRBI.

7. Detailed assessment

7.1 ObjectiveThe objective of the detailed RBI assessment is to identify therelevant degradation mechanisms for each component, esti-mate the extent of damage, calculate when inspection shouldbe carried out, and propose what inspection technique shouldbe used to ensure that the risk level for that component does notexceed the acceptable risk limit.

7.2 GeneralThe process for detailed RBI evaluation is outlined below.This refers to the appendices of the recommended practice fordetailed estimation of probability of failure and consequenceof failure.

As the analysis level becomes more detailed, it is clear that thenumber of calculations will also increase. For this reason, as

well as facilitating the updating of the analysis after inspection,the use of a computer is recommended.

7.3 Detailed RBI: Analysis detail levelDetailed assessment is based on defining groups of compo-nents so that the analysis for one component can be applied toall the others within that group. Grouping is typically carriedout with reference to PFDs and P&IDs. It is likely that differentgroups will be defined for the assessment of probability of fail-ure and consequence of failure.

Before beginning the evaluations, the level of detail at whichthese evaluations are to be carried out should be established.This should account for the level of detail required by the in-spection planners who are to work with the results of the anal-ysis, as well as the amount and level of input data available.This is summarised in Table 7-1. The level of detailing will of-ten be increased for the high risk items, i.e. the analysis processwill start at systems level and proceed to tag level for selected

Table 6-1 Risk matrix for screeningProbability of Failure Risk Categories and Screening Actions

5

> 10-5Significant

probability offailure

Medium risk High risk4 Inspection can be used to reduce the risk, but is unlike-

ly to be cost-effective; the cheapest solution is often tocarry out corrective maintenance upon failure.

Detailed analysis of both consequence and proba-bility of failure.3

2

1 < 10-5 Negligible

Low risk Medium riskMinimum surveillance, with corrective maintenance,if any. Check that assumptions used in the damage as-sessment remain valid, e.g. due to changes in operat-ing conditions.

Consequence is high so actions (such as preventa-tive maintenance) should be considered to ensurecontinued low probability as small changes inconditions can increase PoF and give high risk.

Consequence category A B C D EAcceptable consequence of failure. Unacceptable consequence of failure

DET NORSKE VERITAS


items.

It should be noted that inspection planning is concerned withthe smallest level of detail (inspection point) and so if the RBI

analysis is carried out at a system, segment or group level,more time will be used in the inspection planning process thanif the RBI is executed at detailed tag level.

7.4 Consequence of failure modelling

7.4.1 ObjectiveConsequence of failure is calculated for each consequencetype to facilitate calculation of equipment and damage-specificrisk.

7.4.2 Working processIt is generally expected that consequence modelling can drawon the results of other analyses developed for the installation;typically QRA and RAM analyses. However, if these docu-ments are not available then the simplified methods given inAppendix B can be used. In all cases it is recommended thatrisk engineers are involved in this part of the RBI analysis.

The consequences of a release that leads to a fire or explosiondemand different consideration from a release of a fluid or gasthat does not ignite. This section addresses the consequencecalculations for ignited and unignited releases separately and

hence their different outcomes with respect to safety, econom-ic and environmental consequences.

For the purposes of RBI, the consequence of failure is definedas the outcome of a leak given that the leak occurs. The calcu-lation methods used in a QRA usually include generic proba-bility of leak data that are not necessarily specific to theinstallation, material or the degradation mechanisms. Thesedata must be removed and replaced with probability of failureof 1.0.

Table 7-2 gives an overview of the factors to consider whencalculating the consequence of failure.

Consideration should also be given to the probabilities of dif-ferent outcomes from each leak. This is best described using anevent tree, where the sequences of outcomes is given by appro-priate branch probabilities.

The steps shown in sections 7.4.3 to 7.4.5.4 should be followedto estimate consequence of failure.

Table 7-1 Analysis detail levelSmallest component analysed Advantage Disadvantage

SystemESD segment

— Relatively small amount of data required— General data can be used— Relatively few calculations, so can be done quickly— Fits well with existing QRA analyses— Low initial investment

— May contain several corrosion groups, so beingoverlay conservative with regard to degrada-tion Lacks detail needed for inspection plan-ning.

— May overlook some parts.— Needs detailed review of components to ensure

worst case materials and dimensions have beenevaluated.

— Output requires significant work in inspectionplanning to add the detail.

— May be little gain when updating from inspec-tion findings.

Corrosion group

— Relatively small amount of data required— Relatively few calculations, so can be done quickly

— Lacks detail needed for inspection planning.— May overlook some parts.— May infer excessive inspection in larger

groups.— Needs detailed review of components to ensure

worst case materials and dimensions have beenevaluated.

— Output requires significant work in inspectionplanning to add the detail.

Pipe tag, inspection point orVessel part (e.g. nozzle, weld)

— All sizes of the part and materials are considered.— Unlikely that parts will be overlooked.— Output is directly useful to inspection planners.— All parts of the vessel/tag are considered.— Allows unusual cases, and well understood equip-

ment and degradation mechanisms to be includedseparately.

— Identification of high risk parts of vessel may saveintrusive inspection.

— Separate degradation mechanisms found in specificlocations in the vessel/tag are evaluated separately.

— Greatest precision in updating analysis with inspec-tion findings.

— Requires large amount of data.— Computer calculation required.— Data may not be available in physical or elec-

tronic format.

DET NORSKE VERITAS


7.4.3 Establish the event tree

An event tree describing the sequence of events following aleak should be established. Event trees are used to calculate theprobability of each end event occurring, and are commonlyfound in QRA or Safety Case documents. If these documentsare not available a simple version is given in Appendix B.

The effects of the end events on the safety, economic or envi-ronment consequence should be chosen to reflect the particturcircumstances of the installation.

7.4.4 Ignited consequences

Ignited consequences consider the effects of an ignited gas orliquid release on personnel, the cost of damage to the installa-tion by fire and blast, the cost of deferred production, and sub-sequent environmental consequences. It is recommended thatthese consequence calculations are based on leak rates thattake account of the leak hole sizes that would be expected as aresult of the given degradation mechanism. This ensures thatthe calculated consequences can more fully reflect the actualcircumstances of the leak. Typical hole sizes are discussed inSection 7.6 and guidance about hole sizes is included in the ap-pendices for each degradation mechanism.

7.4.4.1 Personnel safety: Fire & Blast

The probability of ignition and probability of explosion, givena leak, should be calculated in each segment using the eventtree. The probability of the size of the resulting fire is used to-gether with the population density in the module to estimatethe loss of life. In the case of an explosion, the explosion over-pressure can be used to estimate the resulting loss of life. Thesedata should be contained within the QRA or Safety Case,though Appendix B can be used to determine approximate val-ues if they are otherwise unavailable.

7.4.4.2 Economic consequences: Damage to the installation

Damage to the installation may be confined to a single module,or if the fire or blast is of sufficient magnitude, additional mod-ules or the whole installation may be damaged or lost.

— In the case of a jet fire, it is expected that any items withinthe radius of the fire may be damaged or destroyed.

— In the case of a pool fire, all equipment that stands withinthe pool should be considered damaged or destroyed.

— Where equipment subject to fire loading also contains sig-nificant amounts of hydrocarbons, the effects of the fireloading and duration should be used to estimate knock-oneffects. In these cases, passive and active fire protectioncan be considered as mitigating factors.

— The blow-down capability, i.e. reducing pressure and vol-ume of fluid available to fuel the fire, should be considered

for both the leaking equipment and other equipment sub-ject to fire loading; the effects of the fire should be adjust-ed accordingly.

— Further mitigating factors, such as fire and gas detection,deluge and sprinklers, together with the philosophy fortheir use (e.g. deluge start on confirmed gas detection andbefore fire detection), should be taken into account.

These points may be contained within the QRA or Safety Case,though Appendix B gives simplified calculations where theseare needed.

Assessment of the costs associated with repairs is described inSection 7.4.5.2 and Section 7.4.5.3.

7.4.4.3 Environmental consequences

In the case of ignited leaks, it is not expected that significantvolumes of liquids will be deposited on the sea during the fire.However, the condition of the installation following an explo-sion or a severe fire may be such that wells or storage tankswill leak.

In addition, the large amount of smoke generated by such firesmay be a concern. As yet there are no criteria developed or cal-culation methods for estimating the consequence; this willhave to be treated qualitatively. Financial penalties may be ap-plicable in certain cases.

Further, there may be a political element to the environmentalconsequence once there has been press exposure. Considera-tion should also be given to loss of reputation and loss of sharevalue.

7.4.5 Unignited consequences

Unignited consequences consider the effects of any toxic re-lease on personnel, the economic costs of deferred productionand repairs, and the environmental consequence of a liquidspill on the sea.

7.4.5.1 Personnel safety: Toxic/asphyxiant release

This requires the estimation of the rate of build-up of toxic lev-els of gas within a module and consideration of the escape ofthose personnel working within the module. Mitigating factorssuch as toxic gas detectors and system blow-down should alsobe considered.

It must be noted that the major toxic gas encountered offshore,H2S, has a greater explosive limit range than methane.

The release of asphyxiant gas should also be considered. Sucha release may occur from a liquid nitrogen plant located withinthe hull space of an installation, resulting in undetected lowlevels of oxygen that may cause asphyxiation of personnel inthe vicinity.

Table 7-2 Factors to consider in consequence assessment.Ignited leakSafety Consequence Economic Consequence Environmental ConsequenceConsider loss of life due to:

— burns to personnel— direct blast effects to personnel— indirect blast effects to personnel (mis-

siles, falling objects)— injuries sustained during escape and

evacuation

Consider the costs of:

— repair of damage to equipment and struc-ture

— replacement of equipment and structuralitems

— deferred production— damage to reputation

Consider the effects of:

— toxic gas release— smoke

Unignited leakSafety Consequence Economic Consequence Environmental ConsequenceConsider loss of life due to:

— Toxic gas release— Asphyxiating gas release— Impingement of high pressure fluids on

personnel

Consider the costs of:

— deferred production— repairs

Consider the effects of:

— hydrocarbon liquids spilled onto the sea

DET NORSKE VERITAS


7.4.5.2 Economic consequences: Cost of deferred production

The value of deferred production is calculated as the value ofproduction per hour multiplied by the number of hours at thereduced production rate. This can be expressed as a net presentvalue using a suitable discount rate, or as a fixed currency sum.

The amount of deferred production will depend strongly on thedesign of the installation process system(s) and their interac-tion. Production systems with several parallel trains can usual-ly be operated with one train isolated so that the installationwill be able to produce at a reduced rate until the damaged trainis repaired and recommissioned. The value of deferred produc-tion will therefore be less than for a single-train installationwhere any leak will require full production stop during the en-tire extent of repair.

The time-profile of deferred production for each part of thepressure-retaining systems should be defined so that it can beapplied to all parts of that system or part-system.

The profile should take into account the time taken in repairand the individual process and well characteristics for restor-ing production from the stop or partial-production condition.

7.4.5.3 Economic consequences: Cost of repairs

The cost of repairs in terms of deferred production should becontained within the production loss profiles described in Sec-tion 6.3.3, making sure that the specific repair methods are ad-dressed where these will have an effect on the repair time. Inaddition, the costs of materials, man-time, mobilisation of per-sonnel and equipment to the installation, provision of specialistservices, cleaning of the work area, and similar, should be es-timated in financial terms and added to the cost of deferredproduction.

7.4.5.4 Environmental consequences: Liquid spill

In the case where environmental consequences are to be meas-ured in volume of liquids lost to the sea, then it is necessary toestimate this figure for each relevant system and segment.

It will be necessary to determine the amount of liquid that willfall onto the sea and not be contained within bunding or byplated decks and drains; this will depend strongly on the designof the installation as well as the position of the leaking part, thepressure within the system, the monitoring devices, and thevolume that can be lost.

A coarse approximation that can be used: Assume that all liq-uid contained within a system or segment is released by a leak,resulting in a pool of the same volume of liquid as was con-tained within the system or segment. An estimation of the ca-pacity of the drains to handle such a volume withoutoverflowing to the sea should be made if the decking in thearea is plated. Where the deck is made from grating, then theentire spilled volume should be assumed to fall through; ifplated deck is beneath, then estimate the drains capacity as pre-viously.

Where the estimated volume of liquids reaching the sea is un-acceptable, then a more detailed estimation can be made on thebasis of expected leak size and location. This will couple theconsequence estimation to the degradation mechanism for leaksize and location, and can account for a slower leak rates thanthat used in the coarse approximation.

7.5 Probability of failure modelling

7.5.1 ObjectiveThe purpose of probability of failure modelling is to determinewhich degradation mechanisms are likely to be found in eachpart, assess the current probability of failure for each relevantdegradation mechanism, and evaluate the development ofdamage, and hence PoF, with time.

The objective is to derive a PoF limit that is used to indicate thetime interval in which inspection should be carried out and re-

vise these intervals as inspection and monitoring data becomesavailable.

7.5.2 Working process

The working process for detailed probability of failure calcu-lation is listed in Sections 7.5.3 to 7.5.11.

The sections follow the process; determining the probability offailure acceptance limit based on the risk limit, determiningwhich degradation mechanisms are relevant to the part in ques-tion, and then calculating the probability of failure for thosemechanisms. The calculated probability of failure can be com-pared against inspection data and corrected if the data is foundto be valid. Finally, the change of probability of failure withtime is used to calculate when the risk acceptance limit will bebreached.

Note that consequence of failure can depend on the hole sizeused in the leak calculation, and that the hole size depends onthe degradation mechanism.

7.5.3 Probability of failure acceptance limit

To allow the time to inspection to be calculated, the risk ac-ceptance limit must be converted to a probability of failure lim-it. This limit must be expressed for each type of riskconsidered.

The PoF limit is given by:

Note that the same part may have more than one probability offailure limit depending on the consequence type.

7.5.4 Allocation of degradation mechanisms

The degradation mechanisms affecting a part depend on thecombination of the material of construction, the contents of thepart, the environment surrounding the part, the operating con-ditions and any protective measures.

Internal and external degradation mechanisms should be de-fined for each part by reference to the tables in Appendix C.The degradation mechanisms are labelled as (see 4.4.3); insig-nificant model, susceptibility model or rate model. Their use incalculating probability of failure is discussed individually inSection 7.5.9, Section 7.5.10 and Section 7.5.11.

The tables in Appendix C have a number of assumptions asso-ciated with them that shall be checked and confirmed to be ap-plicable for the circumstances related to the individual part. Ifthe assumptions are not valid, then specialist assistance shouldbe sought to evaluate the specific circumstances.

The applicable degradation mechanisms shall be listed foreach part together with the reasons for selection.

7.5.5 Internal damage – systems/service/materialsMechanisms are addressed according to ‘groups’ of systemsthat define the overall product or media in that system. Thisconcept is essential to the selection of relevant mechanisms forthe analyses. The objective is to determine which degradationmechanisms are possible for each of the materials expectedused in a given service. This is an assessment that is based ongeneral experience and fundamental knowledge of materialsand service. The result is a listing of product/materials/possibledegradation mechanisms, that in practice will include moremechanisms than are actually expected in a specific analysis.

Appendix C shows such a list of the most relevant services,materials and degradation mechanisms for internal damage.The list is based on general knowledge gathered among oper-ating companies and open literature. All combinations of ma-terials and services are not listed, and expert evaluations may

PoFLimit, Type

RiskLimit, Type

CoFType-----------------------------------=

DET NORSKE VERITAS


be needed where these are missing.

Past inspection results and experienced failures from the spe-cific installation or any similar installations may add to the listof possible mechanisms.

7.5.6 External damage

External damage is only related to the external environmentand condition of the surface protection. The damage can eitherbe of the type ‘rate’ or ‘susceptibility’ as described in 4.4.3.Appendix C describes the assessment for external damage.

7.5.7 Mechanical damage

Mechanical damage caused by vibration, ship/platform move-ment, flow effects, or other sources, may cause fatigue crackgrowth and fracture. For piping systems, the damage is oftenlocated in local hot-spots, such as welded connections, branch-es, clamps, or vessel nozzles, where the design gives a highstress concentration factor and restraint may also increaseloading locally.

Fatigue in piping systems caused by high frequency vibrations(such as from reciprocating machinery) is expected to propa-gate rapidly to failure once a crack is initiated, and is thereforenot readily amenable to monitoring and control by inspection.In such situations, it is recommended that the local vibrationamplitude and the local stresses are measured, rather than cal-culating the crack growth.

Where the source of vibration is low frequency, such as fromship motion, then inspection may be used to measure the devel-opment of damage.

Appendix C describes the assessment procedure for mechani-cal damage.

7.5.8 Lower limit on calculation of PoF

The proposed scale for probability of failure is as shown in Ta-ble 4-1 and elsewhere in this document.

A cut-off point is set for PoF below 10-5 as probabilities belowthis number are both very difficult to model and observe, andwill usually represent an insignificant risk.

7.5.9 Insignificant model

This model is based on the expectation that no damage will oc-cur, yet it allows a risk value to be calculated. The model allo-cates a fixed probability of failure value, regardless of time, asbelow.

PoF = 10-5 per year.

Inspection is not relevant for this model expect for checkingthat any premises remain valid.

Appendix C should be consulted for guidance about typicalmaterials and fluids combinations where this model is expect-ed to be applicable.

7.5.10 Susceptibility model

This model gives a value for probability of failure dependingon factors relating to operating conditions. For a given set ofconditions that are constant over time, the probability of failurealso remains constant over time. This implies that the onset anddevelopment of damage are not readily amenable to inspec-tion. However, actions can be related to monitoring of keyprocess parameters, such as excursions or a change of condi-tions, that can be used to trigger inspection.

Appendix C provides guidance about typical materials and en-vironmental conditions where this model is expected to be ap-plicable and suggests values for PoF for typical conditions.

If PoF > PoFlimit, type, then immediate action must be taken.This action may be one or a combination of:

— assess and repair any damage— change or treat the contents so that it is less damaging— reduction of operating temperature— exclusion of damaging environment (e.g. coating, lining,

exclusion of water from insulation)— change of material type.

7.5.11 Rate model

This model assumes that the extent of damage increases as afunction of time, and therefore probability of failure also in-creases with time. This implies that the development of degra-dation can be measured by inspection, and that the inspectionresults can be used to adjust the rate model to suit the actual sit-uation. The resulting damage is normally a local or generalwall thinning of the component.

Appendix C should be consulted for guidance about typicalmaterials and fluids combinations where this model is expect-ed to be applicable. The appendix also suggests mean andstandard deviations for damage rates and the distribution typeto be applied for different degradation mechanisms.

The failure probability increases over time as the wall thins andis dependent on the loading in the material. The controllingfactors include:

— damage rate— wall thickness— size of damage— material properties— operational pressure (as the primary load).

Additionally, each degradation mechanism is itself controlledby a number of factors, such as temperature and pH.

All these factors vary somewhat, and a full probabilistic anal-ysis should consider every factor as a stochastic variable. Inpractice, however, the uncertainties associated with the dam-age rate, and any measured damage, tend to outweigh the un-certainties of the other variables. This allows somesimplification to be used without significant loss of precision.

A more accurate calculation of probability of failure is ob-tained from First Order Reliability Methods (FORM) usingdistributions for all the most important factors. FORM is bestcarried out using computer techniques and is likely to requirea specialist in mathematical and statistical techniques to devel-op the algorithms. A number of suitable software tools areavailable that include these methods as part of RBI calcula-tions.

A further simplification is outlined in the method given below.This uses pre-defined distributions, as referenced inAppendix C, and assumes that the mean damage rate is theonly uncertainty variable. For mechanisms other then CO2-corrosion, PoF scale factor curves are given for three coeffi-cients of variance (CoV) of corrosion rate only: 2.0, 1.0 and0.33, representing high, medium and low spread respectively.

This method facilitates calculation of PoF at any point in time,based on the mean damage rate and the difference between agiven wall thickness and wall thickness at which a release isexpected.

Rearranging the equations allows approximate results to be ob-tained for:

— The latest time at which inspection should be carried outto check that risk acceptance limit is not exceeded.

— Approximate results can be obtained for:

— the current PoF— expected defect size at any point in time— timing corresponding to other action triggers, e.g. cor-

rosion allowance expected to be consumed; wallthickness expected to fail to meet code compliance.

DET NORSKE VERITAS


The process steps are:

1) Determine the maximum acceptable probability of failurefor the item using the consequence of failure for that itemand the type of Risk acceptance criterion (e.g. for safety,or economic risk): refer to 7.5.3 i.e.

2) Determine the wall thickness at which a release is expect-ed : t release.This can be derived from first principals, or from a appro-priate codes or formula such as ANSI/ASME B31.3ANSI/ASME B31.G, BS 5500, ASME VIII, and DNV-RP-F101, using relevant operational loads.

a) Due consideration should be given to the degradationmorphology: Code formula generally assume a uni-form wall thinning, although some include defect sizeassessment. For localised damage that does not affectthe wall stresses, it may be acceptable to set the re-lease wall thickness close to, or as zero, i.e. the releasedue to uniform wall loss will occur at thicker wall thanlocal wall loss.

b) It may be desirable to include other wall thickness cri-teria in the inspection plan, e.g. to check compliancewith authorites' requirements. If other failure criteriaare defined, such as consumption of corrosion allow-ance, the purpose of the evaluation should be consid-ered and the consequences adjusted to suit, e.g. cost ofremedial action, rather than a release.

c) Some code formula include optional explict safetyfactors: it is suggested that these are removed for thepurpose of RBI as margins are implicitly included inthe calculations and vary with risk.

d) The code formulae give wall thickness requirementsfor pressure retaining purposes. Other loads shouldalso be considered and a thicker limit should be stipu-lated if the code suggests an impractically thin wall forgeneral thinning.

3) Determine the time until PoFLimit, Type is expected to beexceeded:

Where:

a) Determine the mean damage rate from measured val-ues, expert judgement, or using the guidance in Ap-pendix C.

b) Select the curve in that is appropriate to the degrada-tion mechanism, including a CoV. Selection can bebased on measured values, expert judgement, or usingthe guidance in Appendix C. The curves in Figure 7-1, other than those marked CO2-Corrosion, apply tonormal or log-normal distributions. The CO2-Corro-sion curves include the CoV value.

c) Use the selected curve, take the PoFLimit,Type on thehorizontal axis and read off the corresponding ’scalefactor’ on the other axis.

d) Apply the ’scale factor’ in the above equation to deter-mine the Time to PoF Limit.

e) determine the Time to PoFLimit

Figure 7-1Scale factor against PoFLimit

4) Determine the time to inspection.The inspection must be scheduled to occur no later thanthe Time to PoFLimit.It may be preferred to calculate the Time to PoFLimit foreach Risk Type for the component of interest with the in-spection scheduled for the earliest result.

7.6 Leak hole sizeThe hole size of a leak has a significant effect on the releaserate of the contained fluid. The degradation mechanism is re-lated to the consequence of failure via the expected hole sizewhich may vary from a ’pinhole’, to a complete breach of thecomponent, depending on the degradation mechanism.

The consequence calculations should be carried out for a givenset of pre-defined hole sizes that are related to those given forthe degradation mechanisms. The expected percentage ofholes falling within each category can be estimated or judgedfor each mechanism. Table 7-3 shows the recommended holesizes that are referenced in both the consequence calculationsand the degradation mechanisms described in the appendices.

7.7 Estimation of riskOnce the probability of failure and consequence of failure havebeen estimated, the data points can be plotted on the appropri-ate matrices for viewing and comparison purposes.

A separate matrix for each risk type should be developed, withthe probability of failure and consequence of failure scales setas described in section 4.2.3.

The matrix is a static picture of risk calculated for any onetime, but matrices can be prepared for different years to illus-trate development of risk.

It is recommended that the results are checked for the validityof any assumptions that were made during the assessments, thecorrectness of data used, and that the risk outputs are broadlyin agreement with those given in any relevant safety case,QRA or similar documentation.

a = PoF scale factor, derived as given below.dmean = mean damage rate (mm/year)t0 = current wall thickness (mm)trelease = wall thickness at which a release is expected

(mm)

PoFLimit, Type

RiskLimit,Type

CoFType--------------------------------=

Time to PoFLimit, Type at0 trelease–

dmean-------------------------= Table 7-3 Hole size template: Equivalent hole diameters

Small Holes Medium Holes Large Holes Rupture

5mm and lessAbove 5 mmand not morethan 25 mm

Above 25 mmMaximum di-ameter of com-ponent

If the hole size exceeds the diameter of the compo-nent then Rupture shall be used

0.1

1.0

1.E-06 1.E-05 1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Probability of Failure Limit

Sca

lefa

cto

r,a

CoV = 0.33

CoV = 1.0

CoV = 2.0

CO2 local

CO2 Uniform

PoFLimit

DET NORSKE VERITAS


Guidance note:QRA/Safety cases studies and RBI studies have different objec-tives, and hence utilise somewhat different data and equations.Consequently, it is likely that results from the different studieswill not be in exact agreement.


7.8 Reporting of the assessmentThe results from this part of the assessment provide the basisfor the detailed inspection planning. A report must be focusedon the needs of the inspection planner. Typically, the reportwill comprise the risk results collated with any intermediatecalculations related to part and process data. Additional con-sideration should be given to the data requirements and capa-bilities of any inspection planning tool that are used.

The assessment and underlying assumptions should be docu-mented together with a combination of the following informa-tion/data, as required, related to each item:

— component/system identification— materials of construction, fluid type, operational condi-

tions, design limits— equipment/segment volumes, economic data related to

lost/deferred production— inspection and operating history— degradation mechanisms and failure mode, damage rate,

uncertainty and basis— safety risk, economic risk, and risk categories— risk in relation to the acceptance criteria— time to reach risk limits— key indicators for risk change (temperature, process

changes)— recommendations that the part be subject to inspection,

maintenance activities or monitoring of process or otherparameters

— recommendations for additional activities in verifying thedata and assumptions used in the analyses.

7.9 Revision of assessment with new informationThe assessment should be reviewed on a regular basis, and re-vised as necessary to account for any significant changes in theinput information, e.g. in process and operational data, new de-sign conditions, changes in field economy.

For most offshore processing systems the operational condi-tions are subject to both short term and long term changes dueto operational practices and reservoir characteristics. It is es-sential to track such changes and to make appropriate actionsbased on these. Some changes can be anticipated, such as a tie-in to new well of different composition. The economic basisfor the installation can also be affected by changes in operationand the price of oil.

8. Use of inspection and monitoring

8.1 Use of inspection resultsDegradation modelling allows a theoretical damage extent tobe calculated that can be considered to be an estimate of the ac-tual conditions, that is then corroborated or corrected using re-sults of inspection. Corrections can be made to:

— the extent of damage only— the degradation rate only— both the extent of damage and the degradation rate.

Inspection results for process equipment usually compriseswall thickness measurements and reports of coating condition.Crack sizes are not normally monitored but repaired as soon asthey are found. In all cases, inspection data must be evaluatedcarefully, using the guidance in the next section, before it is

used to correct the estimates.

Note that the corrections can result in either an increase or adecrease in the predicted probability of failure, depending onthe inspection outcome.

Where no baseline inspection data is available, it will be diffi-cult to estimate a corrosion rate as the actual original startingthickness may be unknown and manufacturing tolerances areoften large. Note that a comparison between adjacent areas ofdamaged and sound material can provide an adequate baselinein some cases.

On the basis that the inspection data has been evaluated andfound valid, the wall thickness should be updated to the meas-ured thickness. The probability of failure should be re-calculat-ed using the new thickness data but the original corrosion rate.

Where trending of the data is considered valid and is expectedto continue into the future, then the wall thickness should becorrected and a revised corrosion rate should be used to recal-culate the probability of failure.

8.2 Validity check for inspection dataWhere historical data is available from past inspections, thiscan be used to substantiate or correct the previously expected(calculated) damage extent. However, great care should be tak-en when evaluating the inspection data, to ensure that it is di-rectly applicable to the situation under consideration. It shouldalso be noted that past data is no guarantee of future perform-ance, as conditions will change.

In evaluating the inspection data, the following must be con-sidered:

1) Is the data directly applicable to the situation under evalu-ation?

a) Is the data taken precisely from the part being evalu-ated, or from the same corrosion group?

b) Where within the part has the data been taken – thick-ness measurements made on an elbow will not be cor-related to the thickness of a straight pipe?

2) Can the data be related to the expected degradation mech-anisms?

a) Is the measurement location relevant for the expecteddegradation mechanisms?

b) Does the data relate to internal or external degrada-tion?

c) Does the data measure one or more degradation mech-anisms (e.g. CO2 corrosion and erosion simultaneous-ly at an elbow)?

3) Has the data been measured and reported in a manner thatit can be evaluated?

a) Are numerical values given for thickness or damagedepth?

b) Is there an adequate reference to the original thick-ness?

c) Is the extent of damage to coatings given in relation toa numerical scale?

d) What inspection technique has been used, and what isits effectiveness in measuring the expected degrada-tion?

e) Has sufficient area of the part been inspected to pro-vide such confidence that the result is applicable?

f) Can the results be related to identifiable locationswithin the part?

g) Are any past data points taken from the precisely samelocation so that trending might be meaningful?

DET NORSKE VERITAS


h) Has the inspection been carried out where the degra-dation would be expected?

When evaluating the results of trended data for wall thicknesswith a view to finding corrosion rates, care must be taken to en-sure that the data is assessed critically. For example, it is com-mon that there is a wide scatter in ultrasonic wall thicknessmeasurements resulting from the inherent inaccuracy of thetechnique, slight changes in calibration from one inspection tothe next, variations due to the operator, and variations due tonon-repeatability in location.

Two-point trending can show marked wall thickness loss ratesor wall thickness increase rates. Increasing the number ofpoints used in trending gives a better result, and it is stronglyrecommended that all relevant data points be plotted so that thebest trend can be evaluated by eye as well as spreadsheet algo-rithm.

The evaluation must also include knowledge of relevant instal-lation history. For example, if many years of operation with ef-fective corrosion inhibition have shown almost no wall loss,yet recently the inhibition equipment has failed, then the lowcorrosion rate cannot be expected to continue into the futureunless inhibition is reinstated.

Updating of the RBI assessments using inspection data is de-scribed together with inspection planning in Section 9.

8.3 Use of corrosion monitoring results

Monitoring probes and coupons are generally not intended toprovide quantitative degradation rates, but rather to monitor in-hibitor performance or ensure corrosion rates are within spec-ified limits. However, data may be used for this purpose if it isgiven critical evaluation:

1) Have the probes or coupons been located in the correct po-sition within the system, where the corrosion is expectedto occur?

The siting of a coupon in the top of a pipe where CO2 cor-rosion is expected to occur in the water phase runningalong the bottom will give falsely optimistic results if thecoupon does not lie in the water.

2) Has the data been collected and reported correctly?

This includes the calculation of pH from samples, the cor-relation of probe / coupon results with process conditions,use of the correct procedure to measure material loss fromcoupons or relate the signal change in a probe to corrosiv-ity.

Where doubt exists in the use of these data, it should be dis-counted and new good quality data collected under the super-vision of an experienced corrosion engineer. In the meantime,the corrosion rates estimated from the degradation modelsshould be applied until the new, validated data is available.

8.4 Use of process monitoring

Monitoring of key process parameters that control the rate oronset of degradation can be used to detect changes in the oper-ating conditions that can effect the probability of failure.

Set points can be specified for relevant parameters and used fortriggering inspection based on the PoF limit, rather than regu-lar inspections. For example, temperature is a key parameterfor external stress corrosion cracking of stainless steels underwet insulation. Similarly, process instrumentation can be usedto indicate when the basis for the RBI analysis is no longer val-id – For example, measurement of export gas CO2 levels canbe used as an indicator regarding the CO2 content throughoutthe process, with a reanalysis to be carried out when there is asignificant change.

9. Inspection planningInspection measures the extent of degradation and thus allowsthe calculation of probability of failure based on the actualdamage condition as opposed to the estimated damage condi-tion.

The RBI analysis is used to generate an inspection plan at thedesired level of detail. The probability of failure assessment al-lows the following parameters to be estimated for each part:

— Degradation mechanism, and hence possible inspectionmethods, morphology of damage and the expected extentor size of the damage.

— When to apply the inspection – the time when the risk limitis crossed.

The inspection plan should contain the following informationas a minimum:

— part identification— inspection location / inspection point— inspection technique— time when inspection is to be carried out— expected damage morphology, location and extent— drawing references— reporting requirements.

Reference should also be made to minimum operator qualifi-cations, equipment type and calibration requirements, inspec-tion procedure to be used, applicable codes and standards, andother quality-related information.

When carrying out the detailed inspection planning, the fol-lowing points should also be considered:

— access requirements— the need for shutdown of the process during inspection— requirements for detailed inspection drawings— reporting format and reporting limits.

9.1 Inspection schedulingFor the time-dependent rate models, inspection should bescheduled such that the risk limit is not exceeded, with ade-quate time allowed for any remedial action.

Preparation of a detailed inspection, monitoring and mainte-nance plan must also consider other factors that can effect thescheduling; included but limited to:

a) A component may be subject to different degradationmechanisms that are expected to reach their risk limits atdifferent times. The inspection schedule should take ac-count of these differences by rationalising the timings intosuitable groups to avoid otherwise frequent activities onthe same components.

b) As discussed in Section 4.4.3, the non-time dependentmechanisms are not considered suitable for direct controlby inspection, but may require general visual inspection tocheck that any premises used in the analysis remain valid;such as good coating.

c) The operator’s policy and/or legislation regulating the op-eration of a field may set specific requirements with re-spect to inspection. These requirements may be in the formof:

— how often to inspect certain types of equipment— acceptable condition after an inspection, i.e. wall

thickness limits.

9.2 Inspection proceduresThe probability of failure evaluation gives an estimation oflikely degradation mechanisms, together with their morpholo-gy and the data required to estimate the resulting probability of

DET NORSKE VERITAS


failure. This information can be used to optimise the inspectionprocedures and techniques, and to select which data should berecorded so that the RBI analysis can be updated after an in-spection.

The choice of inspection technique is based on optimising sev-eral factors that characterise each technique:

— confidence in detecting the expected damage state— cost of technique, including manpower and equipment— extent of maintenance support required (scaffolding, proc-

ess shutdown, opening of equipment).

1) Refer to Table 9-1 for the Confidence level for the tech-nique chosen.

2) Estimate the cost of carrying out the inspection using thechosen technique.

3) Determine the probability of detection (PoD) for the meanextent of damage expected at the inspection time.

4) Select the technique with the highest value of:

Normally, the technique that gives the greatest efficiency indetection should be chosen. However, it may be more cost-ef-fective to apply a less efficient technique more frequently, anda the choice of technique can be based on the following simplecost-benefit analysis:

The above method is applicable to the first inspection sched-uled after the RBI analysis. Prediction of the next inspectiontiming is estimated once the inspection has been performed,and the above steps repeated using the inspection results.

Note that the inspection procedure should include strict re-quirements regarding reporting of inspection results, so thatthe data reported is relevant to, and can be readily used to up-date the RBI analyses and hence plan the next inspection.

10. Fitness for serviceFitness for service calculations should be carried out where theinspection reveals damage of such significance that a rigorousassessment is necessary to evaluate whether further operationof the component is justifiable.

Several standards address these calculations, the most compre-hensive being API RP 579, with DNV RP F-101 and ANSIB31.G also appropriate for piping.

PoDCost Confidence CoV⋅( )

------------------------------------------------------------------

Table 9-1 Definition of confidence levelsConfidence

level Description

High

Service conditions are well known and do not fluctu-ate appreciably.

Inspection results show a consistent trend, with a highcorrelation coefficient when plotted against time.

A Highly Efficient inspection method is used and themeasured results are validated.

Degradation models are derived from many datasources showing results that are generally consistent;where probabilistic models are given, the standard de-viation is low; Confidence CoV ≈ 0.33.

Medium

Service conditions are well known and fluctuations areof a moderate nature.

Inspection results show a consistent trend, with somescatter and a reasonable correlation coefficient whenplotted.

A Normally Efficient inspection method is used andthe measured results are validated.

Degradation models are derived from only a smallnumber of data sources showing results that are gener-ally consistent; where probabilistic models are given,the standard deviation is moderate; Confidence CoV ≈1.0.

Low

Service conditions are not well known or have a con-siderable variation in pressures, temperatures or con-centration of corrosive substances.

There are no inspection results, or if they exist thenthey show only a general trend, with extensive scatterand a low correlation coefficient when plotted.

A Fairly Efficient inspection method is used and themeasured results are validated.

Degradation models are derived from one data sourceonly; where probabilistic models are given, the stand-ard deviation is high; Confidence CoV ≈ 2.0.

DET NORSKE VERITAS


APPENDIX ASCREENING

A.1 Guidance for use

It is recommended that the attached form is used together withthe briefing notes, to guide and document the risk based in-spection screening process. Typically, one form is used persystem.

The purpose of the screening is to identify components/sys-tems, and sort them into two groups i.e.:

— those that have a low risk, such that only limited follow-upby inspection/maintenance is anticipated

— those of higher risk, that should be examined in more de-tail.

Additionally the screening session should identify conditionsthat are not otherwise included in the RBI guidelines. For ex-ample, reports of failure, operational upsets unusual or novelmaterials.

It is recommended that the riskbased inspection screeningprocess is carried out as a working-session amongst suitablyqualified personnel, including staff with specific knowledge ofthe asset in question. The following type of personnel shouldbe involved:

— materials/corrosion— inspection— process/production— safety.

DET NORSKE VERITAS


A.2 RBI Screening Form

Installation: Rev:

System No: Description:

Function & boundaries:

Dependent systems:

Process & Materials information

ProductServiceCode

Material Op.Temp.°C

Op. Pressbar.g Chemical information/Comment/Reference

Consequence evaluation

Consequence High/Low Justification / reasoning / reference

Safety

Economic

Environment

Other

Probability evaluation

Probability High/Low Model (s) Justification / reasoning / reference

Internal

External

Fatigue

Notes / comments:

Further Actions:

Agreement to evaluation

Team Date

Verification Date

DET NORSKE VERITAS


A.3 RBI screening briefingThe following are prompt questions to aid thought and discus-sions. These are by no means exhaustive.

— A combination of ‘High’ probability and ‘High’ conse-quence goes for detailed RBI.

— A score of ‘Low’ for either is a recommendation for main-tenance activity.

— A scope of ‘Low’ for both is a recommendation for ‘NoFurther Action’.

Guidance note:If the assessment has any cause for doubt, or information is lack-ing, a ‘High’ rating should be assigned and detailed assessmentcarried out if the result is ‘detailed RBI’.


A.3.1 Consequence of failureConsider the following points for assessing the consequencesfor failure. The worst case scenario regarding leak is usuallythe best case to consider – do NOT include consideration ofprobability in the consequence!

Safety consequence

1) What is the effect of a leak?

2) Is the fluid poisonous, will there be ignition and / or explo-sion that might affect personnel?

3) What is the likely population around any part of the systemthat might leak – might there be deaths or injuries?

Economic consequence (installation damage, productionloss)

4) What is the likely reaction to the detection of a leak? Willthe platform shut down production, or partially shutdown?

5) Will there be damage to the installation, by fire and / orexplosion, or acid attack, resulting in replacement costsand lost production?

6) Are there clean-up costs associated with the leak?

A.3.2 Probability of failureConsider the following for present time, their change withtime, and what might happen in upset or start-up conditions.Think also of what went on in the past, including testing duringconstruction and commissioning, as well as past service. DoNOT include consideration of consequence in the probability!

External degradation

1) Coating: Is there a coating, what type is it, what is its qual-ity, how long does it take to degrade significantly?

2) Insulation: Is there insulation, does it retain water, is thereheat tracing (temperature effect on both internal & exter-nal degradation).

3) Is there any data that indicates current condition – inspec-tion reports, for example.

Internal degradation

4) Consider possible degradation mechanisms arising frommaterials and fluids combinations. What about CRA orpolymeric linings? Internal anodes?

5) What are the effects of temperatures and pressures, alsopartial pressures? Note these may change through the sys-tem, and metal temperatures can be affected by heat trac-ing.

6) Consider excursions in all process parameters.7) Consider sand production rates, proppant production,

acidising acid production.8) Consider water breakthrough over time.9) Consider increases in CO2 with time if there is gas rein-

jection.10) Is there any data that indicates current condition – inspec-

tion reports, for example

Fatigue

11) Are there areas where vibrations are expected, or havebeen observed.

12) Have any failures occurred?

DET NORSKE VERITAS


APPENDIX BCONSEQUENCE OF FAILURE EVALUATION

B.1 General

The calculation of Consequence of Failure (CoF) is best car-ried out using Quantitative Risk Assessment (QRA) methodol-ogies commonly used as part of the safety review and safetymanagement of offshore installations. The following steps arerecommended:

1) Review system description.

2) Calculate release rate.

3) Calculate dispersion.

4) Effect modelling.

In line with commonly accepted QRA methodologies, it is fur-ther recommended to use Event Tree Analysis (ETA) as the ba-sis for the consequence assessment.

In safety QRA an event tree is applied to help structure andmodel the probability and consequences of a hazardous event,including possible ignition and escalation. The root of the treerepresents the initial hazardous event (e.g. a release of hazard-ous fluid), and the ‘branches’ of the tree indicate that the initialevent can develop in different ways, depending on the likeli-hood of ignition, explosion or escalation.

In RBI, the consequences are measured in terms of safety (lossof life), environmental impact (spill of oil), or economics (lossof production and equipment/installation damage or repair). Ifa QRA is available, the results may be used as input to the RBICoF analysis. The QRA is usually focused on safety conse-quences, which implies that the environmental and economiceffects will still need to be considered separately.

B.2 Introduction

This appendix is intended to allow the calculation of the safety,economic and environmental Consequences of Failure (CoF)in sufficient detail and with adequate precision so that a RBIanalysis can be completed where a QRA is not available. Therisk is determined by assessment of both probability and con-sequence of failure, but the component inspection programme(inspection effectiveness, Probability of Detection, time tonext inspection) is too a large extent based on the modelling ofdegradation mechanisms, and are therefore associated with theProbability of Failure (PoF). The CoF determines the magni-tude of the risk associated with degrading and failing compo-nents, but it is justifiable to use simplified effect methods forRBI purposes.

The methodology proposed in this document for the RBI (safe-ty) CoF calculation is less complex than that used in QRA, butit possible to use the QRA results as input to the RBI assess-ment.

QRA generally uses generic failure data and a generic hole sizedistribution, which are not specific to material or degradationmechanisms. This is because QRA covers both accidentalevents induced by material degradation, and those that can beattributed to other causes (e.g. mechanical impact, operator er-ror). The RBI analysis is focussed on specific degradationmechanisms, so that the failure frequency (e.g. the expectedleak frequency per year) and the hole size distribution (e.g.small, medium, large, rupture) must be derived for the specificdegradation mechanisms. The consequences for these degrada-tion mechanisms will be different, and hence event trees are re-quired for the hole sizes relevant to the degradationmechanisms. By doing this, the overall consequences derivedfrom the event tree –and hence the inspection programme- willbe related to the actual damage mechanisms.

B.3 Use of QRA dataIn the case where a QRA is available, the results can be used inthe RBI. However, the following comments must be made:

— If a QRA is available, the results may be used as input tothe RBI CoF analysis. However, often the QRA is fo-cussed on safety consequences, which implies that the en-vironmental and economic impact will still need to beconsidered separately.

— It must be noted that QRA analyses are usually based upongeneric failure frequencies. RBI should not be based onthese generic data, since the failure frequency should bespecific to the degradation mechanisms of specific compo-nents. Therefore, these generic failure frequencies shouldbe removed and replaced with the specific probability offailure calculated using this recommended practice (seeAppendix C). In addition, care must be taken in that theQRA may not apply the same hole size distribution asthose used in the recommended practice, i.e. only the con-sequence assessment of the QRA should be maintained;the failure frequencies and hole size distribution should bereplaced based on specific degradation mechanisms (seeAppendix C).

B.4 Method of overview

B.4.1 GeneralThe method described in this appendix covers calculation ofconsequence of failure resulting from an ignited and an unig-nited leak in terms of safety, economic and environmental con-sequences. The relationship between the consequences andignition is shown in Figure B-1.

Figure B-1Calculation of consequence of failure

B.4.2 Steps in consequence assessmentThe following calculation steps are required to assess the con-sequences to personnel safety, environment and asset damage:

1) System description. Define the system parameters of inter-est for the CoF assessment. Generally the ‘system’ willconsist of the topsides of an offshore installation, or part ofit. More guidance is given in Section B5.

2) Release rate calculation. Determine the leak rate or re-lease rate. The leak rate is a function of the fluid released(oil or gas), phase, pressure and temperature. More guid-ance on leak rate calculation is given in Section B6.

3) Dispersion calculation. Model the dispersion of fluid orgas. Gaseous releases will mix with air, liquid releases canform aerosols (spray release) or form as pools, whichcould evaporate. Dispersion is required in order to form aflammable or toxic vapour cloud, which can affect person-

Leak

Ignited Unignited

Safety Economic Environment

Deferredproduction

Damage toeqpt & structure

DET NORSKE VERITAS


nel and equipment. Dispersion calculations generally re-quire the use of detailed computer simulation models, butsome simplified models are presented in Section B7.

4) Effect Modelling. If the vapour cloud is flammable, and itsconcentration is within the flammable range, a sufficientlystrong ignition source could ignite the cloud. This wouldresult in a fire or explosion, the latter generally being moresevere as escalation could occur. Whether or not a cloudcould explode depends on the properties on the flammablegas (type of fuel, fuel concentration), the size and locationof the cloud, the location and strength of the ignitionsource, and the physical properties of the module/level(e.g. confinement, obstacles) in which the cloud is present.If the contents of the cloud is flammable, then both ignitedand unignited consequences should be evaluated, other-wise (i.e. for toxic releases) unignited consequences alonecan be evaluated. Flammable releases are further dis-cussed in Section B8; toxic releases are discussed in Sec-tion B9. It must be noted that some fluids (e.g. hydrogensulphide) are both flammable and toxic, and that other flu-ids are mixtures (e.g. methane, ethane, carbon dioxide andhydrogen sulphide).

It must be noted that the equations and graphs given in the sec-tions below represent a large simplification of a complex set ofcalculations, and are presented so that manual calculation canbe used to arrive at a reasonable evaluation. If accuracy is re-quired, then the user should refer to standard QRA methodol-ogies and algorithms.

It should further be noted that the consequences of failure aredependent on the size of the leak, both for ignited and unignit-ed consequences. The expected hole size as a function of deg-radation mechanism can be found by reference to Appendix C,and thus the consequences tailored to the actual degradationexperienced by the part evaluated. The implication of this isthat some degradation mechanisms may require earlier inspec-tion on the grounds of higher consequence despite having alower probability of failure than others.

B.4.3 Use of Event Trees

The calculation of Consequence of Failure (CoF) is best car-ried out using Quantitative Risk Assessment (QRA) methodol-ogies commonly used as part of the safety management ofoffshore installations. In particular, it is recommended to useEvent Tree Analysis (ETA) as the basis for the consequenceassessment.

B.5 System descriptionThe system description involves a review and description ofthe following parameters.

1) Modules. Topsides of offshore installations are usuallybuilt with discrete modules or levels, having specific func-tions, and active and passive barriers that contain or miti-gate effects of failures. It is therefore general practice toaddress the consequences for each’module’. For eachmodule it is necessary to identify the dimensions, ventila-tion rates (natural or forced), and the type of barriers(walls, floor) applied. In particular the explosion and fireresistance of the barriers needs to be reviewed.

2) Isolatable sections. The isolatable section (or inventorygroup) is associated with the (maximum) amount of haz-ardous fluid that can be released in the event of a leak. Theamount of hazardous fluid contained in an isolatable sec-tion depends on the inventory of process equipment andpiping, and the location of emergency shut-in valves.These valves (often called Emergency Shutdown Valves,or ESDVs) serve to isolate a leak and hence contain the re-lease of hazardous fluid. ESDVs are generally found at theimport and export risers, and at strategic locations e.g. toisolate the separator(s), and the gas compression section.

3) Representative fluid. For each isolatable section a repre-sentative fluid will need to be chosen, i.e. the accidentallyreleased fluid that will be modelled. A fluid is modelled asflammable or toxic, but it must be noted that some fluids(e.g. hydrogen sulphide) are both flammable and toxic. Al-so, some fluids are mixtures (e.g. methane, ethane, carbondioxide and hydrogen sulphide), which requires the use of“representative fluids”. Care must be taken in selecting theappropriate representative fluid, in particular when a pre-dominantly flammable mixture (e.g. well gas) has a highconcentration of toxic fluid (e.g. hydrogen sulphide). Incase the fluid is a mixture of hydrocarbons, it is recom-mended to use the hydrocarbon with highest mol%, or an“weighted” hydrocarbon based on the average molecularweight of the mixture.

4) Ignition sources. The ignition sources in the modules mustbe counted (‘equipment count’), in particular the numberof pumps, compressors and generators. In addition thenumber of hot work hours must be estimated in relation toactual platform practices.

B.6 Mass leak rates for gas and oilMass leak rates (or: release rates) are given as a function ofpressure and hole size in Figure B-2 and Figure B-3, for gasand oil respectively, based on representative fluid and gas den-sities.

From the figures it can be concluded that the releases rates aresubstantially affected by the hole size. Therefore separateevent trees must be developed for different hole sizes. Also, theselection of the hole size distribution (i.e. distribution of small,medium, large holes) must be done with care. Reference ismade to Appendix C for the appropriate leak sizes as input tothe calculations.

Figure B-2Mass leak rate gas

Figure B-3Mass leak rate oil

Gas

1.0E-03

1.0E-02

1.0E-01

1.0E+00

1.0E+01

1.0E+02

1.0E+03

1.0E+04

1 10 100 1000Pressure, bar.g

Lea

kra

tekg

/s

300 mm rupture

50 mm leak

25 mm leak

5 mm leak

Oil

1.0E-03

1.0E-02

1.0E-01

1.0E+00

1.0E+01

1.0E+02

1.0E+03

1.0E+04

1 10 100 1000Pressure, bar.g

Leak

rate

kg/s

300 mm rupture

50 mm leak

25 mm leak

5 mm leak

DET NORSKE VERITAS


B.7 Dispersion modellingOnce the leak rates have been determined, the next step is tomodel the dispersion of fluid. Pressurised gaseous releases willmix with air, liquid releases can form aerosols (spray release)or form as pools, which could evaporate. Dispersion is re-quired in order to form a flammable or toxic vapour cloud, andwhich affect personnel and equipment. Dispersion calculationsgenerally require the use of detailed computer simulation mod-els, but if these are not available the simplified methodologypresented below can be used.

The model requires the following information:

— volume of the module, (m3)— air change rate (number of air changes per hour)— gas density, of leaking fluid, (kg/m3)— flash fraction (of gas from the leaking oil) (-)— mass leak rate, (kg/s)— equipment count (-).

The volume of the module should be corrected for major ‘ob-stacles’ present in the module (e.g. separate rooms, largeequipment).

If the module is mechanically ventilated, the air change ratecan be based on the design capacity of the HVAC system. Ifthe module is naturally ventilated, the air change rate is often afunction of the geometry of the module, wind speed and pre-dominant wind direction. If no data is available it is recom-mended to use an air change rate of 30 Air Changes per Hour.

Mass leak rate is a function of leak hole size, pressure and flu-id, reference is made to Figure B-2 or Figure B-3.

Flash Fraction refers to the fraction of volume released that isgas phase, and is therefore equal to 1 for gas. The value for oilwill depend on the fraction of gas within the process stream.

The concentration of flammable or toxic gas in the module iscalculated as follows:

If the ventilation rate exceeds the leak rate, then the averageconcentration of gas in the module will be approximately zero.However, note that ventilation is not uniform within a module,and areas will exist where the concentration of gas is differentto that calculated. It is therefore possible that the concentrationin a sheltered part of the module will exceed the LEL, giving afinite probability of ignition.

The time limit over which the concentration is relevant can betaken as that used in detection of gas and de-energising ofequipment within the module.

The concentration calculated above is applied as input to deter-mine the ignition probability (for flammable releases), and theconsequences to personnel (for toxic releases). This is furtherexplained in Section B8 and Section B9 respectively.

B.8 Effect assessment of flammable releases

B.8.1 Calculation methodThe following steps should be followed to determine the ignit-ed consequence of failure:

1) Development of an event tree.

2) Calculation/estimation of event tree branch probabilities.

3) Calculation of the consequences for all end event tree out-comes; CoF could be measured in terms of loss of life(safety), economics (asset damage, deferred production),and environmental impact.

4) Calculation of the CoF contribution of all end event treeoutcomes.

5) Sum all CoF contributions to calculate the weighed totalexpected consequences for safety, economics and environ-mental impact.

Calculations should be made for each combination of isolata-ble section, module and leak size that are to be assessed. Thisis because the consequences of an ignited event are determinedby what equipment is within the module to be damaged as wellas the amount of flammable and explosive species released; theprobability of ignition and explosion is dependent on the igni-tion sources within the module.

This means that the steps given above and described belowmust be repeated for each combination of:

— isolatable section— module— leak size.

B.8.2 Step 1: Development of an event tree

The simplified Event Tree Analysis (ETA) used is shown inFigure B-4. The ETA considers the events of ignition and sub-sequent escalation by explosion to adjacent modules only, giv-en that a leak occurs (i.e. PoF = 1.00). This is a conservativesimplification that ignores the possibility of smaller explosionsthat will be contained within the module where the ignition oc-curred.

Figure B-4Simplified event tree

Section B8.4 describes the calculation of branch probabilitiesfor these events so that the probability of occurrence of eachend event can be calculated.

The probability of occurrence of each end event multiplied bythe consequence of that end event (End Event 1, 2, or 3 in Fig-ure B-4) give the Consequence of Failure (CoF) contributionof that end event. The CoF contributions summed for all con-ditions and hole sizes then becomes the total CoF associatedwith the degradation mechanism causing the release. This is il-lustrated in Figure B-5, and further explained in Section B8.5and Section B9.

��

�

��

�

�

��

�

��

�

��

��

•−��

��

•

ModuleofVolume

3600ModuleofVolumeHourperChangesAirNo.

DensityGasgasFractionFlashRateLeakMass

TimeC = •

Endevent 1

Endevent 2

Endevent 3

Ignition ?

Escalationby

explosion ?

YesNo

Leak

YesNo

DET NORSKE VERITAS


The end events numbered in Figure B-4 are described inTable B-1:

— end events 2 and 3 are associated with ignited events— end event 1 is a non-ignited event.

PIgn = Probability of ignition PEsc = Probability of escalation.

Figure B-5CoF calculation for Simplified Event Tree: One event tree for each hole size

B.8.3 Step 2: Event tree branch probabilities

B.8.3.1 General

The probability of ignition, given that a leak occurs, is a func-tion of the leak rate, concentration of flammable species, andthe number of ignition sources within each module. The calcu-lations in this section are related to the leak hole size and coverthe following:

— concentration factor, Pv— ignition factor related to continuously present sources, Pc— ignition factor related to random discrete sources, Pd.

The calculation should be performed for each combination ofrepresentative fluid in an isolatable section, leak hole size, andmodule, and therefore the use of a spreadsheet program is rec-ommended.

The effects of the above terms are such that the probability ofignition increases as the concentration of the gas approachesthe Lower Explosive Limit (LEL) of the gas concerned. How-ever, the calculated concentration is an average value, andpockets of higher and lower concentration will occur withinthe module as the leak progresses, thereby affecting ignition.

In addition, sources of ignition are required. These should havebeen identified in the System Description, see Section B5.These are accounted for by the ignition factors Pc and Pd, in-creasing the ignition probability as the numbers of equipmentitems and hot work hours increases. It is assumed in the calcu-lations that electrical ignition sources are de-energised after amaximum of 10 minutes (i.e. 600 seconds) after the leak starts.

B.8.3.2 Calculation of concentration factor, Pv

The concentration factor, Pv is calculated by:

Pv = C / LEL

If C > LEL then Pv = 1.00

Where:

LEL is the Lower Explosive Limit for the gas concerned,typically 5% for methane and 2% for propane.

C is the concentration of the gas concerned, given as afunction of time (in seconds), mass leak rate and ventila-tion rate. C has been calculated in the dispersion phase, seeSection B7.

B.8.3.3 Calculation of ignition factor, Pc

This accounts for contact between the flammable substancesand hot surfaces or other continuously available sources of ig-nition. It is based on the expectation that equipment Ex-ratingsare largely in accordance with mainstream international stand-ards.

Pc = 1 – [(1 – Q1*Area) • (1 – Q2*Hot Work hours) • (1 –(Q3A*Pumps + Q3B*Compressors + Q3C*Genera-tors) ) • (1 – Q4*Area)]

The constants Q1 through Q4 are listed in Table B-2.

B.8.3.4 Calculation of ignition factor, Pd

This accounts for contact between the flammable substancesand equipment which fails randomly, (i.e. discrete failures)giving access to the ignition sources. It is based on the expec-

Table B-1 Description of End Events for Figure B-4

End event No. Description Occurrenceprobability

1 There is a leak, but neither ignition nor explosion occurs. P1 = (1 – P Ign )2 There is a leak, and the leaking gas is ignited. However, there is no explosion, only a fire. P2 = P Ign • (1 – P Esc)

3There is a leak and the leaking gas is ignited. This is followed by an explosion, giving ablast overpressure that exceeds the design capacity of the blast wall, causing damage tothe neighbouring module.

P3 = P Ign • P Esc

Probability ofOccurrence Safety Economics Environm. Safety Economics Environm.

Leak End Event 3 P3 S3 B3 E3 P3 x S3 P3 x B3 P3 x E3

(PoF = 1.00) Yes YesEnd Event 2 P2 S2 B2 E2 P2 x S2 P2 x B2 P2 x E2

NoEnd Event 1 P1 S1 B1 E1 P1 x S1 P1 x B1 P1 x E1

No

TotalCoF

(P1 x S1) +(P2 x S2) +(P3 x S3)

(P1 x B1) +(P2 x B2) +(P3 x B3)

(P1 x E1) +(P2 x E2) +(P3 x E3)

Contribution CoFIgnition?

Escalation

byE

xplosion?

CoF of End Events

Table B-2 Constants for calculation of Pc

Constant Oil GasQ1 5.7 x 10-5 3.3 x 10-6

Q2 5.7 x 10-5 5.7 x 10-5

Q3A 4.4 x 10-3 6.5 x 10-5

Q3B 1.5 x 10-2 1.5 x 10-3

Q3C 3.5 x 10-2 3.5 x 10-3

Q4 6.7 x 10-4 2.0 x 10-5

DET NORSKE VERITAS


tation that equipment Ex ratings are largely in accordance withmainstream international standards.

Pd = 1 – [ (1 – R1*Area) • (1 – (R3A*Pumps + R3B*Com-pressors + R3C*Generators) ) • (1 – (R4A + R4B*Ar-ea))]

The constants R1 through R4B are listed in Table B-3.

B.8.3.5 Calculation of probability of ignition, PIgn

Probability of Ignition, given that a leak occurs, is given by:

PIgn = Pv•( Pc + Pd – Pc Pd )

Correlation of the mass leak rates with the respective leak holesizes implies that the probability of ignition, and subsequentconsequences, are related to the damage mechanism. It istherefore necessary to calculate consequences for each rele-vant leak hole size according to the expected degradationmechanism.

B.8.3.6 Probability of escalation by explosion, Pesc

An explosion that occurs after an ignition in one module, mayresult in a fire or blast that causes substantial damage in neigh-bouring modules, even when these are separated by blast/fire-walls. Calculation of the blast overpressure is a complexprocess outwith the scope of this document, and therefore theresults of a dedicated explosion analysis should be used to findthe estimated blast overpressures. If such information is notavailable, then a conservative procedure for estimating theprobability of escalation by explosion are given in the rules be-low.

The probability of such escalation to the neighbouring moduleby explosion is given by the following equation, which isbased on a number of ProExp simulations:

PEsc= A•EXP[B]•Blast Overpressure / Blast Wall DesignPressure

PEsc =1 if:

— the Blast Overpressure > 14 • Blast Wall Design Pressure— the Blast Wall Design Pressure is unknown— the Blast Overpressure is unknown

Where Blast Overpressure and Blast Wall Design Pressure aregiven in bar.g, and A and B are given in Table B-4 as functionsof the mass leak rate of gas:

B.8.4 Step 3: Consequence of failure for end events

B.8.4.1 Safety consequences

The safety consequences are calculated based on the averagenumber of personnel present in the module that is impaired, ei-ther immediately (i.e. the leak occurs in this module) or de-layed (i.e. due to escalation). In calculating the average

number of fatalities, any difference in night and daytime pop-ulation must be accounted for. Note also that a toxic or asphyx-iating release may give fatalities despite ignition being absent.

The CoF are determined for the event tree outcomes, i.e. S1, S2and S3 in Figure B-5.

B 8.4.1.1 Ignited end events

As a conservative assumption, it must be assumed that all per-sonnel remaining in the impaired module are fatally injured.

B 8.4.1.2 Non-ignited end events

Safety consequences are not addressed specifically, as they aredependent on personnel being in the vicinity of failure at thefailure instant. A number of issues that may cause death or in-jury should be considered:

— An explosion may release high velocity fragments, shrap-nel, etc.

— A high-pressure release may direct a jet of liquid or gas di-rectly at a person.

— There may be a release of toxic gases, e.g. hydrogen sul-phide (see Section B9).

B.8.4.2 Economic consequences

Generally economic consequence can be estimated from threecomponents:

— materials required for repairs— manpower and mobilisations— deferred production caused by taking part or all of the in-

stallation out of service.

The very high value revenue streams from offshore installa-tions usually imply that deferred production is the major con-tributor to economic consequences.

The economic consequences are calculated as the sum of theloss of production (deferred production) and the costs (includ-ing manpower and mobilisation) associated with repairing orreplacement of equipment as a result of the initial leak or sub-sequent explosion. ‘Deferred production costs’ and ‘repaircosts’ are discussed separately below.

The CoF are determined for the event tree outcomes, i.e. B1,B2 and B3 in Figure B-5.

B 8.4.2.1 Cost of repairs to the module for ignited end events

It will be necessary to judge the extent of damage within amodule, and therefore the cost of repairs and replacement, as aresult of a fire or explosion.

These costs can be taken from the project new-building datacorrected for inflation and net present value, or it can be esti-mated on the basis of general industry knowledge. It should ac-count for repairs and replacement of structural, electrical,HVAC, control, piping, equipment (pumps, compressors etc.).Note that the cost of deferred production is not included in therepair cost.

B 8.4.2.2 Cost of deferred production for ignited end events

It is likely that production will not be possible whilst repairstake place. The downtime can be based on judgement, other-wise Figure B-6 can be used to estimate the number of daysdowntime. The cost of the lost or deferred production is de-rived as product of downtime and deferred production.

Production loss related to major damage caused by ignitedevents is determined by the reconstruction and repair time,which is plant/project specific. It is largely determined bylong-lead items such as compressors, pressure vessels and heatexchangers made of special materials.

For ignited cases (i.e. End Events 2 and 3 in Figure B-4 andFigure B-5) the downtime can be related to the amount of dam-age sustained, if no other data is available. A relationship de-

Table B-3 Constants for calculation of Pd

Constant Oil GasR1 3.5 x 10-4 2.0 x 10-5

R3A 2.0 x 10-3 7.6 x 10-5

R3B 1.6 x 10-2 1.6 x 10-3

R3C 3.7 x 10-2 3.7 x 10-3

R4A 9.0 x 10-5 5.0 x 10-6

R4B 3.5 x 10-4 1.7 x 10-5

Table B-4 Constants for use in calculation of P ESC

Mass leak rate kg/s A B< 1 0.5403 -38.193

1 to 10 0.9174 -4.5544> 10 1.0538 -2.6494

DET NORSKE VERITAS


rived from the ’Dow Fire and Explosion Index’ is consideredto give a reasonable correlation between property damage andrepair/outage time, see Figure B-6. This figure can be used to-

gether with the value of daily production, to estimate the valueof deferred production arising from shutdown during the repairperiod.

Figure B-6Days outage as a function of damage cost (from Dow 3)

B 8.4.2.3 Cost of repairs to the module for non-ignited endevents

Similar to ignited end events, it will be necessary to judge theextent of damage within a module, and therefore the cost of re-pairs and replacement, as a result of the leak. Very often theseare limited to the failing equipment/piping itself, or the equip-ment/piping in its direct vicinity. Generally these costs will besmall compared to the cost of deferred production, see below.

B 8.4.2.4 Cost of deferred production for non-ignited endevents

It is recommended that a number of downtime profiles associ-ated with deferred production are defined such that each partof the installations systems that has an effect on production canbe assigned a profile. These profiles describe the amount ofproduction that can occur from the time a leak begins, until thecompletion of repairs and resumption of normal operations.The profiles can then be used as representative for the loss ofproduction over time for individual equipment and piping.

The calculation below can be based on the PFDs and P&IDsfor the installation. It involves reviewing the production proc-ess from well to export facilities, and determining what the ef-fect on production would be if a leak arose in each section ofpiping and each piece of equipment, and developing the de-ferred production profiles on this basis.

Utilities systems should be included because in many casestheir failure will cause failure of the process (e.g. water injec-tion, instrument air, chemical injection) or require shutdown(e.g. unserviceable firewater).

The following steps should be followed:

1) Review the contents of the part. If hydrocarbon-contain-ing, a leak is likely to give rise to an alarm and productionshutdown. There may be a delay whilst the area is de-gassed and made safe. If the contents are non-hazardous,then there may not be a shutdown, but if there is, then theremay be some time taken in finding and eliminating theleak.

2) If there are parallel trains that can be isolated from theleaking section, then after isolation, production may be

able to recommence at a lower rate – depending on the ca-pacity of the parallel trains.

3) The time taken to increase production from one level (e.g.from run-up, partial run-up) to another is individual to theinstallation and reservoir conditions, and should be deter-mined though consultation with the Operations personnelfor the installation.

4) Estimate the repair or replacement times that are likely, in-clude availability of repair / replacement equipment, di-mensions of the piping and equipment to be repaired, theservice of the equipment (hazardous/non-hazardous), ma-terials of construction, the size of the leak, and the compa-ny maintenance and repair strategy.

B.8.4.3 Environmental consequences

In considering environmental consequences, releases can beclassified as oil (including condensate), gas or chemical. Theseare further discussed below.

Chemical releases are usually subject to legislative, or compa-ny imposed limits for releases into the environment. The con-sequences of exceeding these limits are typically case by casefines.

The CoF are determined for the event tree outcomes, i.e. E1,E2 and E3 in Figure B-5. Environmental consequences are of-ten related to non-ignited cases, i.e. end events E1 only.

B 8.4.3.1 Measurement units and acceptance criteria

The measurement units for environmental consequences canbe volume or mass released, or units of currency. The accept-ance limit must be given in the same units.

The use of mass or volume released facilitates calculation, asthe contents, phase and volume of the ESD segment of theprocess are used elsewhere in consequence calculations.

B 8.4.3.2 Oil releases

The consequences of oil releases can be associated with polit-ical repercussions, a damaged reputation and clean-up costs.Environmental consequences from offshore topside oil leaksare considered to present only a minor damage to global andlocal biotopes. Generally, the volume that can be released is

ymax= 28.18x0.6

ymean= 20.87x0.6

1

10

100

1000

0,1 1 10 100

Property Damage ($MM)

Day

sO

uta

ge

70% Probability Range}

DET NORSKE VERITAS


limited to the contents of the equipment and even more so bythe contents of an isolatable segment. Releases from pipelines,drilling activities, and from storage vessels represent a signifi-cantly larger volume and must be considered separately.

Direct costs related to oil releases are mainly related to theclean-up costs if the spill drifts towards shore. The actual effectwill depend on the location of the field, oil type, oil drift con-ditions, temperature, evaporation, etc. For a given case a fixedmoney value per tonne of oil released may be used.

The cost of clean-up for ship accidents may vary between US$700 to US$ 50 000 per tonne released, typically for accidentsclose to shore. Offshore platforms are usually located severalmiles offshore and, where no other basis is available, e.g. com-pany goals, $10 000/ton is suggested as a conservative valuefor application in a coarse evaluation: i.e. the cost consequencefor oil release, in monetary units per volume unit is given by:

Cenvironment= Vrelease • ( Ccleanup + Clostproduct)

Where:

Vrelease = Volume of oil released on to the seaCcleanup = Cost of clean-up, monetary units per released

volume unitsClostproduct= Value of oil that is lost in the release, monetary

units per volume

Note that the Vrelease can be adjusted to account for specificfactors on the installation, for example:

— the volume of oil released will be affected by the phases inthe isolatable segment. For example, in two-phase system,the oil content will be less than total volume

— consideration should be given to possible oil release re-sulting from systems such as produced water, oily water

— not all oil from a release may reach the sea: drains, floor-ing (open, closed), etc. may reduce the volume reachingthe sea.

B 8.4.3.3 Gas release

Gas releases to the atmosphere have received less attentionthan oil releases and are more typically controlled releases sub-ject to taxation or concessions for flaring or venting. Acciden-tal releases may be subject to fines issued on a case by casebasis depending on specific circumstances.

It is recommended that the consequences of gas releasesshould be considered as part of the screening process. Any sys-tems appearing to have an unacceptable release consequenceshould be referred to more detailed evaluation.

B 8.4.3.4 Other fluids/chemicals

A number of chemicals are used offshore for inhibition, chem-ical treatment, etc. that may be harmful to the environment.Chemical releases are usually subject to legislative, or compa-ny imposed limits for release of certain chemicals into the en-vironment. The consequence of exceeding these limits istypically fines that are stipulated on a case by case basis de-pending on the circumstances.

It is recommended that the consequences of chemical releasesshould be considered as part of the screening process. Any sys-tems appearing to have an unacceptable release consequenceshould be referred to more detailed evaluation.

B.8.5 Steps 4 and 5: Total consequence of failure

B.8.5.1 Safety consequences

The consequences to personnel safety for each end event (S1,S2, and S3) determined in step 3 are multiplied by the proba-bility of occurrence (P1, P2, and P3) of each end event, in orderto give the CoF contributions. This is shown in Figure B-5.

The total safety consequence of failure is the sum of the end

event consequences.

It must be stressed that this calculation must be repeated for allisolatable sections, hole sizes and modules, in order to correct-ly model the risk contribution of individual degradation mech-anisms.

B.8.5.2 Economic consequences

The economic consequences for each end event (B1, B2, andB3) determined in step 3 are multiplied by the probability ofoccurrence (P1, P2, and P3) of each end event. This is illustrat-ed in Figure B-5.

The total economic consequence of failure is the sum of theend event consequences.

B.8.5.3 Environmental Consequences

The environmental impact for each end event (E1, E2, and E3)determined in step 3 is multiplied by the probability of occur-rence (P1, P2, and P3) of each end event. This is illustrated inFigure B-5.

The total environmental consequence of failure is the sum ofthe end event consequences.

B.9 Assessment of the effect of Toxic releases

B.9.1 GeneralGenerally pure toxic substances are not present in large quan-tities on offshore installations. Hydrogen sulphide is a highlytoxic substance, but generally does not exist in pure form on anoffshore installation. Hydrogen sulphide is mostly found as acomponent of a mixture of predominantly hydrocarbons.

Note that nitrogen and carbon dioxide can have an asphyxiat-ing effect since they replace the oxygen available in air. Hencein high concentrations (generally in confined areas), thesecould cause fatal injury to personnel.

B.9.2 Asphyxiating fluidsThe modelling is similar to that for gas and oil, and involvesrelease rate calculation, dispersion, and consequence/impactassessment.

The release rate can be estimated by using Figure B-2 andFigure B-3, depending on the phase of the fluid during release.

The gas dispersion (and hence the gas concentration) can bemodelled as indicated in Section B7. For conservatism, a flashfraction of 100% can be assumed.

The consequences can be assessed by considering the releaseof the asphyxiating fluid as a non-ignited event, described inSection B8. This means that only End Event 1 in Figure B-4and Figure B-5 needs to be considered.

— Reference is made to Section B8 ‘Non-Ignited Events’ forcalculation of the economical and environmental conse-quences.

— The safety consequences are determined by the remainingconcentration of oxygen in the air: it is recommended toassume (100%) fatalities in a module if the oxygen con-centration reduces to less than 15 vol.%.

B.9.3 Hydrogen sulphide

The modelling is similar to that for gas and oil, and involvesrelease rate calculation, dispersion, and consequence/impactassessment. Note that H2S ignites readily, as it has a lowerLEL and wider explosive limit range than methane.

The release rate can be estimated by using Figure B-2 andFigure B-3, depending on the phase of the fluid during release.

The gas dispersion (and hence the gas concentration) can bemodelled as indicated in Section B7. For conservatism, a flashfraction of 100% can be assumed, i.e. all hydrogen sulphide re-leased becomes airborne.

DET NORSKE VERITAS


The consequences should be assessed by considering the re-lease of hydrogen sulphide as both a non-ignited and ignitedevent.

The safety consequences for the non-ignited event are deter-mined by the concentration of hydrogen sulphide and the ex-posure time. The fatality rate is normally calculated from afluid specific Probit relation, which requires the concentrationof toxic gas in the confined area (in this case the module) andthe exposure time as input. For the simplified RBI method pro-posed it is recommended to work with a single value criterion,i.e. to relate the fatality fraction to the concentration only. Aperson exposed to a hydrogen sulphide vapour with a concen-tration between 500-1000 ppm (parts per million) will sufferfrom eye irritation, vomiting and possibly immediate acutepoisoning (/4/). LC50 values (i.e. concentration at which 50%of exposed population is killed) for 30 minute exposure are inthe range of 450 to 1600 ppm, depending on which literaturesource is quoted. In the absence of specific limits given by the

Operator for tolerable exposure to H2S, it is recommended touse a concentration of 690 ppm as criterion: if the concentra-tion of hydrogen sulphide in the module exceeds this value, allpersons remaining in the module are assumed to be killed. Be-low this criterion, no fatalities occur.

B.10 References

/1/ Guidelines for Chemical Process Quantitative RiskAnalysis. American Institute of Chemical Engineers,NY, 1989.

/2/ Kostnadsanalyse og måltall, Norsk sokkels konkurans-esituasjon, NORSOK 1995.

/3/ Dow Fire and Explosion Index. Hazard ClassificationGuide, 6th ed. 1987.

/4/ Activity Responsibility Function, Guideline for Quan-titative Risk Assessment, DNV, 1998.

DET NORSKE VERITAS


APPENDIX CPRODUCT SERVICE CODES, MATERIALS DEGRADATION AND DAMAGE

MECHANISMS

C.1 Introduction

The purpose of this appendix is to guide the RBI analyst with:

— identifying which degradation mechanisms can be expect-ed where

— determining damage rates and/or probability of failure forspecific materials exposed to specified service conditions.

This appendix presents a number of simplified models for in-ternal and external degradation. The damage rates are probabi-listic and are thus given as a distribution type with a meanvalue, standard deviation, or equivalent. It is emphasised thatthese degradation models are not exhaustive but are recom-mended used to secure a consistent and documented method-ology when better data is not available.

Although the product service codes are used to determine whatdegradation mechanisms can be expected, this is a simplifica-tion and the limitations must be recognised, and accounted forin each analysis:

— The product service code does not always provide suffi-cient differentiation with respect due to fluid corrosive-ness. It is necessary to review the system and split intomore detailed areas, e.g. to identify where hydrocarbongas is dry and wet.

— The product service code may not reflect some operationalpractices, e.g. closed drains may be used as a by-pass sys-tem.

— The product service code may not reflect content, e.g.closed drains may be used as a by-pass system.

— Some of the product service codes are so unspecific or var-iable that the contents must be assessed by suitably quali-fied personnel.

— The materials listed are intended to give general and con-servative results. The calculations can be improved ifmore precise materials specifications are used.

— The models have limits on their applicability, and it shouldbe verified that the model is applicable to the situation athand; in all cases, there is an upper temperature limit of150°C.

— Where the conditions given in this appendix do not matchthose found in the plant, then specialist advice must besought.

C.2 Internal degradation

The internal degradation models allow calculation of probabil-ity of failure for different materials in most fluids as defined byproduct service codes that are used on offshore topside sys-tems. The product service codes have been arranged in groupswhere similar degradation mechanisms are expected:

— insignificant— chemicals— hydrocarbons— waters.— vents.

The user is strongly advised to ensure that the conditions on theasset in question match those listed in the section before usingthe models; deviations should be referred to a specialist for ad-vice.

The calculation of probability of failure due to internal degra-dation follows the process below:

1) Define the material type, as given in Table C-1.

2) Define the appropriate Product Service Code and identifythe potentially corrosive contents. Refer to Table C-2.

3) Determine the service conditions applicable to the part inquestion, comprising temperatures, pressures, amounts ofcorrosive species.

4) Go to the section shown in Table C-2 that is relevant forthe Product Service Code (Sections C.6.2 to C6.8) and cal-culate the degradation rate or probability of failure as ap-plicable.

C.3 External degradation

The external degradation models allow calculation of probabil-ity of failure for different materials on the assumption thatthese are exposed to the marine atmosphere, or otherwise ex-pected to be wetted by seawater, e.g. deluge system. Any coat-ings and insulation should be evaluated for their protectivecapability. Insulation may retain and concentrate salt water onthe material surface, thereby promoting corrosion and/orcracking. Seawater may also collect on pipe supports andclamps and similar locations, promoting corrosion damage onuninsulated piping.

The calculation of external degradation follows the process be-low:

1) Define the material type as given in Table C-1.

2) Determine the service conditions applicable to the part inquestion, comprising temperatures, pressures, presenceand condition of coating, presence and water-retentive ca-pacity of insulation.

3) Go to Section C.6.9 and calculate the degradation rate orprobability of failure as applicable.

C.4 Materials definition

The following type of materials are used in this documents. Ta-ble C-1 below links the abbreviations used and the specificnames.

Table C-1 Definition of materialsMaterial

Type Description Includes

CS Carbon SteelCarbon and Carbon-Manganese steels,low alloy steels with SMYS less than 420Mpa

SS Stainless Steel

Austenitic stainless steels types UNSS304xx, UNS S316xx, UNS S321xx orsimilar22Cr duplex UNS S31803 and 25Cr su-per-duplex UNS S32550, UNS S32750stainless steels or similarSuper austenitic stainless steel type 6Mo,UNS S31254

Ti Titanium Wrought titanium alloys

CuNi CopperNickel alloys

90/10 Cu-Ni or similar

FRPFibre

ReinforcedPolymer

Fibre Reinforced Polymer materials withpolyester or epoxy matrix and glass orcarbon fibre reinforcement

Ni Nickel basedalloys

Nickel based alloys

Other Material otherthan the above

All other materials not described above

DET NORSKE VERITAS


C.5 Product service code definitionTable C-2 lists the two character Product Service Codes andthe contents that are assumed as the basis for internal degrada-tion models.

Different product codes designations will be encountered fordifferent operators and installations. It is important that instal-

lation specific codes are checked and matched to the descrip-tions given in the table. Incorrect evaluations with thedegradation mechanisms may occur if the fluids do not con-form exactly with the descriptions below such that specialistadvice should be sought if there is are any discrepancies.

Table C-2 Product Service Code with descriptions and degradation mechanism groupProductServiceCode

Description Degrada-tion Group

AI Air InstrumentCompressed air system for pneumatic controllers and valve actuators and purging of electrical motors and panels.Comprises dry, inert gas

Insignificant

AP Air PlantCompressed air system for air hoists/winches, air motors, sand blasting, spray painting, air tools and motor purg-ing. Typically, not dried, so parts may contain water vapour and condensation. Condensed water can be consideredas being fresh

Waters

BC Bulk CementCement powder, generally in dry form

Chemicals

BL Cement Liquid AdditiveMay be proprietary liquids. Plasticisers, accelerators and retarders added as liquid to liquid cement to adjust theflow and curing characteristics

Chemicals

CA Chemical MethanolUsed to prevent and dissolve hydrates in water containing hydrocarbon gas systems.. Should contain less than 2%water by volume. May be used as water scavenger

Insignificant

CB Chemical, BiocideMay be proprietary fluid biocide such as glutaraldehyde, or chlorine (from electrolysis of seawater or from additionof sodium hypochlorite, etc.)

Chemicals

CC Chemical, CatalystMay be proprietary fluid catalyst for chemical reaction control

Chemicals

CD Chemical, Scale inhibitorMay be proprietary scale inhibitor used to prevent scale problems arising from BaSO4 (typically downhole) andCaCO3 (typically surface and heater problems)

Chemicals

CE Chemical, demulsifier or defoamentMay be proprietary fluid defoament / emulsion breaker for water content control in oil by aiding separation of oiland water

Chemicals

CF Chemical, surface active fluidMay be proprietary fluid surfactant with dual hydrocarbon and polar character and dissolves partly in hydrocarbonand partly in aqueous phases

Chemicals

CG Chemical, Glycol100% glycol, which is not considered corrosive

Insignificant

CH Chemical, AFFFFire fighting foam additive to firewater

Insignificant

CJ pH ControllerMay be proprietary chemical for buffers typically to raise the pH

Chemicals

CK Corrosion InhibitorMay be proprietary fluid for injection as corrosion protection. Usually not corrosive in undiluted concentration

Insignificant

CM Cement High/Low PressureCement mixed with a carrier, usually seawater, and used downhole. Likely to be erosive

Chemicals

CN Chemical, Mud AdditiveTypically mud acids (e.g. HCl, HF)

Chemicals

CO Chemical, Oxygen ScavengerOxygen scavenger. (Typically, sodium bisulphite Na2S). Corrosiveness depends on type, and possibly concentra-tion and temperature. Moderate to low concentrations can be tolerated in a variety of materials, but high concen-trations may be corrosive.

Chemicals

CP Chemical, Polyelectrolyte/ FlocculentMay be proprietary fluid flocculent for oil content control in produced water

Chemicals

CS Chemical, Sodium Hypochlorite SolutionConcentrated NaClO for supply to each consumer. Corrosiveness depends on concentration and temperature

Chemicals

CV Chemical, Wax InhibitorMay be proprietary wax inhibitor for use in produced liquids to hinder formation of waxes as temperatures are re-duced.

Chemicals

CW Chemical Glycol/Water (Rich Glycol to regenerator)Regeneration system to remove water from glycol/water. Part of the gas drying system. The system is in contactwith hydrocarbons. This, and the rich part of the regenerator, is likely to be the most corrosive area of the system.System fluids are regularly checked for pH due to glycol breakdown.Note: Lean glycol corrosiveness is dependent on water content and composition

Chemicals

DET NORSKE VERITAS


DC Closed Drain SystemHydrocarbon liquids drains from platform equipment and piping, collected in a closed vessel. Intermittent use orlow flow rates leading to stagnation. May have fuel gas blanket at low pressure. Liquids comprise hydrocarbon oil,gas, water, in proportions according to the equipment drained. There is potential for microbial action

Hydrocar-bons

DO Drain, OpenDrain from helideck, roof drain and drain from test lines, etc. Mostly seawater and rainwater, but some oil likely.Under atmospheric pressure

Waters

DS Drain, Sewer/SanitaryClosed system. Drain from living quarters containing domestic sewage

Waters

DW Drain Water/StormOpen system. Accumulated water from sea spray and rain led to floor gullies

Waters

FC Completion Fluid High/Low Pressure ChemicalsFJ Fuel, Jet

Clean, water-free aviation fuel (kerosene) for helicoptersInsignificant

GA Gas Fire fighting/CO2Dry, typically bottled, CO2 used as extinguishing gas

Insignificant

GF Gas FuelProcess gas used to fuel compressors and generators. Dried hydrocarbon gas with CO2 and H2S in the same quan-tities as the process system

Insignificant

GI Gas InertInert gas, such as nitrogen or dry CO2. Note: Some installations use exhaust gas for inerting storage tanks with thisproduct service code, and these should be considered as cold exhaust gas

Insignificant

GW Gas Waste/FlueProducts of burning hydrocarbon gas or diesel fuel. Acidic combustion products may condense in exhaust pipingcausing high corrosion rates

Vents

MB Mud, Bulk/SolidStorage of mud components prior to mixing

Chemicals

MH Mud, high pressureHigh pressure mud pumping system for deliverance of drilling and completion fluids in normal use. May containwell intervention fluids, Completion and packer brine fluids, Mud acids (HCl, HF), well stimulation fluids, scaleinhibitors, methanol, diesel, varying densities of byrites or other solids

Chemicals

MK Mud, KillMud pumped into the well for well control purposes. May contain heavy densities of byrites or other solids

Chemicals

ML Mud, low pressureAs MH

Chemicals

OF Oil Fuel (Diesel oil)Diesel fuel for use in cranes, generators and well pressure equalisation. Usually dry, but may contain water andorganic matter that settles in low / stagnant points

Insignificant

OH Oil hydraulicClean, dry, filtered hydraulic oil for actuators

Insignificant

OL Oil lubricatingClean, dry, filtered oil for lubrication purposes

Insignificant

OS Oil sealClean, dry, filtered seal oil for gas compressors. May contain amounts of dissolved process gas

Insignificant

PB Process Blow downWet hydrocarbon gas. Parts of system are Vents and Flare. Will contain CO2 and H2S in the same proportions asthe systems blown down. Normally purged with fuel gas at low pressure

Hydrocar-bons

PL Process Hydrocarbons LiquidUntreated liquid hydrocarbons (Post inlet separator).Contains some gas but mostly hydrocarbon liquid with somewater, dissolved CO2 and H2S, potential for sand. May also contain small amounts of CO2 corrosion inhibitor,scale inhibitor, emulsion breaker and other chemicals. Water contains high levels of dissolved salts from the res-ervoir. If water injection is part of the process, may contain bacteria that can colonise stagnant areas

Hydrocar-bons

PS Process Hydrocarbons Vapour WetWet untreated gas where water vapour is expected to condense into liquid. Contains CO2 and H2S in the same pro-portions as the reservoir

Hydrocar-bons

PT Process Hydrocarbons Two PhaseUntreated two phase flow upstream of inlet separator. Contains oil, gas, water, sand, also CO2 and H2S in the sameproportions as the reservoir. May also have inhibitor and stabilisation chemicals injected close to wellhead. If waterinjection is part of the process, may contain bacteria that can colonise stagnant areas

Hydrocar-bons

PV Process Hydrocarbons VapourDry hydrocarbon gas where water is not expected to condense as liquid. (Post separator). Contains CO2 and H2Sin the same proportions as the reservoir

Hydrocar-bons

PW Produced water systemWater from the production separators. It contains water with dissolved CO2 and H2S in the same proportions asthe reservoir, and some oil. Sand may be carried over from the separator

Hydrocar-bons

SP Steam, Process Not Includ-ed

Table C-2 Product Service Code with descriptions and degradation mechanism group (Continued)ProductServiceCode


DET NORSKE VERITAS


C.6 Degradation mechanisms and damage modelling

C.6.1 Steps in modelling

The damage models for the degradation mechanisms given inthis appendix follow the process given below. The same basicsteps should be used if alternative models or other degradationmechanisms are applied in the RBI analysis:

1) Assess whether a mechanism is expected in a given case.

2) Determine damage rate and/or failure probability:

— Time dependent mechanisms require; distributiontype with a mean value, standard deviation or equiva-lent. PoF is derived from the rate and structural relia-bility calculations.

— Susceptibility mechanisms do not have a rate, but PoFis derived directly from key parameters.

3) Determine damage morphology: Three types are defined:

— Local: Localised damage that does not interfere withthe load bearing capacity of the equipment wall. PoFrefers to a small leak at wall penetration

— Uniform: Damage of such a large area that it affectsthe load bearing capacity of the equipment wall. PoFrefers to the state when the wall ligament cannot ac-commodate the loading, as calculated using structuralreliability analyses. Typically a larger release results.

— Cracking: A crack that penetrates the wall. A virtualcrack is assigned a single size and checked for ’leak

before break’, giving leak or rupture failure respec-tively.

4) Define hole sizes expected on failure:

— Expected hole sizes at failure for each degradationmechanism are stipulated in accordance with a stand-ard hole size distribution template.

C.6.2 Degradation mechanisms - hydrocarbon systems

Hydrocarbon bearing systems, including produced water,closed drains and similar, must be evaluated with respect tocorrosion and cracking due to the gases CO2 and H2S respec-tively, that can be dissolved in any water present with the hy-drocarbons. In some circumstances Microbially InfluencedCorrosion (MIC) can also occur. Additionally, any sand that isentrained in the system can cause sand erosion where the flowimpinges on the pipe or equipment surface.

The presence and composition of water varies through theprocessing train such that the product service codes have lim-ited value in guiding expected degradation. It is necessary tostudy the process flow to identify, split and group equipmentwith similar environmental and operational loading. The fol-lowing points should also be considered:

— Chemical treatment (inhibition) is commonly used to limitCO2 corrosion in carbon steel and injection points and in-hibitor performance must be evaluated.

— Hydrocarbon production processes are expected to changeover time and these must be considered when planning in-spection, e.g. lower pressure, water breakthrough.

SU Steam, Utility/Plant Not Includ-ed

VA Vent, Atmospheric VentsVF Vent, Flare VentsWA Water, Sea anti-liquefaction WatersWB Water, Sea Ballast/Grout

Oxygen rich seawater that may be treated with biocides / chlorinationWaters

WC Water, Fresh/Glycol Cooling MediumA closed system where direct seawater cooling is not applicable. Fresh or desalinated water treated with TEG reg-ularly checked for low pH arising from breakdown of the TEG

Waters

WD Water, Fresh PotableOxygen rich, chlorinated fresh water often with small amounts of salts added for palatability. Max Cl- ions con-centration 200 ppm

Waters

WF Water, Sea Fire fightingClosed seawater system treated with biocides / chlorination

Waters

WG Water, Grouting SystemsUsed for makeup of cementitious grout during installation or drilling operations. May be either raw seawater ordesalinated seawater

Waters

WH Water, Fresh/Glycol (TEG) Heating MediumHeating medium providing required heat load to process and utility equipment.Fresh or desalinated water mixed with TEG. May also contain corrosion inhibitor. Regularly checked for pH dueto breakdown of the TEG

Waters

WI Water, InjectionInjected water used for enhanced reservoir recovery. May be treated produced water, treated seawater, or combi-nation

Water Injec-tion

WJ Water, JetJet water supply for removing of sand from separators, cleaning of tanks etc. May be supplied from produced wa-ter, fresh water, disinfected, or treated seawater. May also require addition of anti-scale chemicals

Waters

WP Water, Fresh, RawDesalinated, oxygen rich, untreated water

Waters

WQ Water, Fresh, Hot (closed circuit)Fresh or desalinated, oxygen rich, untreated hot water for living quarter and equivalent

Waters

WS Water, SeaOxygen rich, seawater for distribution to the various platform users. May be treated with chlorination to preventbiological growth within the system

Waters

Table C-2 Product Service Code with descriptions and degradation mechanism group (Continued)ProductServiceCode


DET NORSKE VERITAS


— Hydrocarbon systems usually employ various types ofcorrosion monitoring and have traditionally received highinspection focus. Service data (condition, integrity andprocess data) may be available for installations that havebeen in service, and these data should evaluated and usedtogether with the models given here.

Expected damage can be calculated for various degradationmechanisms using the following factors for guidance:

— Assess the presence of water and its composition and pH.— Assess the equivalent partial pressure of CO2 and H2S gas-

es in a water phase.— Assess possible presence and effects of MIC— Determine PoF due to HPIC/SOHIC due to presence of

H2S.— Determine PoF due to SSC— Determine PoF due to CO2 -corrosion.— Assess effects of chemical treatments, internal organic

coatings and cathodic protection.— Determine PoF due to sand erosion

C.6.2.1 Damage Rates

CO2 model:

Assess both ’local’ and ‘uniform’ damage. (‘uniform’ refers tolarger areas of damage typically 6 o'clock corrosion). Use theNORSOK model, reference /3/ or DeWaard & Milliams, refer-ence /6/ or similar to calculate a basis corrosion rate. The holesize distribution is given in Table C-3.

Local:

Use the calculated value as the mean rate in a Weibulldistribution with coefficient of variance 0.45, for localcorrosion.PoF is calculated as for a ’local’ damage morphology.

Uniform:

Use the calculated value as 0.4 x mean rate in a Weibulldistribution with coefficient of variance 0.8, for ’uni-form’ corrosion.PoF is calculated as for a ’uniform’ damage morpholo-gy.

Chemical treatment (inhibitor):

Preferably, inhibitor effectiveness should be modelledas a probabilistic distribution. e.g. as Weibull distribu-tion with nominal efficiency as the mean and coeffi-cient of variance based on an evaluation of theperformance in service. As a simplification the nominalinhibitor factor can be used to reduce the mean corro-sion rate used in the Weibull distributions given above.

H2S cracking:

All forms of cracking due to H2S should be preventedby correct materials selection.See reference /1/ and /2/. If materials and welding arewithin limits set by these documents, probability of fail-ure = 10-5, otherwise probability of failure = 1.00 anddetailed manual assessment will be required.No further PoF calculations are required. Damage mor-phology is ‘cracking’. The hole size distribution is giv-en in Table C-4.

Erosion model:

See reference /5/ for a mean value in a normal distribu-tion using coefficient of variance of 20%.PoF is calculated as for a ‘Uniform’ damage morpholo-gy. The hole size distribution is given in Table C-5.

Microbial corrosion:

Note that microbial corrosion is generally not expectedin other materials than carbon steels in anaerobic hy-drocarbon systems. However, this should be evaluatedfor each installation, with the conclusion and assump-tions documented. Figure C-1 shows a suggested plotfor PoF as function of temperature. Derive a PoF valuefrom the figure and divide by wall thickness in mm.Damage morphology is ’leak’. The hole size distribu-tion is given in Table C-6.

Figure C-1PoF against temperature for microbial corrosion

Table C-3 CO2 Uniform and local corrosion hole sizedistributions

Equivalent hole diameter% Distribution

Uniform LocalLess than and = 5 mm 0 50Above 5 mm to 25 mm 0 50Greater than 25 mm 0 0Rupture (full release) 100 0

Table C-4 H2S cracking: Stable and unstable cracks hole sizedistributions.


Stable (’leak’) Unstable (’burst’)Less than and = 5 mm 0 0Above 5 mm to 25 mm 100 0Greater than 25 mm 0 0Rupture (full release) 0 100

Table C-5 Erosion hole size distributionEquivalent hole diameter % DistributionLess than and = 5 mm 0Above 5 mm to 25 mm 0Greater than 25 mm 0Rupture (full release) 100

Table C-6 Microbial corrosion hole size distribution

Equivalent hole diameter

% DistributionCarbon steel andcopper based ma-

terialsStainless steels

Less than and = 5 mm 0 90Above 5 mm to 25 mm 100 10Greater than 25 mm 0 0Rupture (full release) 0 0

0 10 20 30 40 50 60 70 9080

Temperature, oC

10-5

10-4

10-3

10-2

10-1

100

Prob

abili

tyof

Failu

r epe

rm

mw

a ll

thic

knes

s

DET NORSKE VERITAS


C.6.2.2 Reference documents

The following references may be used for guidance in the as-sessment:

/1/ EFC 16 "Guidelines on Materials Requirements forLow Alloy Steels for H2S -Containing Environments inOil and Gas Production". Pub. The Institute of Materi-als.

/2/ NACE MR0175-00: Standard Material Requirements.Sulphide Stress Corrosion Cracking Resistant MetallicMaterials for Oilfield Equipment. NACE, Texas, USA.

/3/ NORSOK STANDARD: CO2 CORROSION RATECALCULATION MODEL: M-506: Rev. 1, June 1998.

/4/ EFC 17 "Corrosion Resistant Alloys for Oil and GasProduction: Guidance on General Requirements andTest Methods for H2S Service". Pub. The Institute ofMaterials.

/5/ DNV Recommended Practice RP-O 501: “ErosiveWear in Piping Systems”, pub. Det Norske Veritas, Hø-vik 1996.

/6/ NACE TM0248: "Evaluation of Pipeline and PressureVessel Steels for Resistance to Hydrogen InducedCracking". NACE, Texas, USA.

C.6.3 Degradation mechanisms - water systemsWater systems use ‘water’ of varying corrosiveness, rangingfrom untreated seawater to potable water. The product codesfor the water containing systems are not sufficient to define thewater type with respect to corrosiveness, and do not accountfor changes that can occur during processing, for example asan intake of ‘raw seawater’ is treated and changed to ‘fresh wa-ter’.

A number of water categories that are commonly encounteredin offshore installations have been defined as given in TableC-7. It is necessary to determine the best match between a wa-ter category and the product service code used in each watersystem, or part of a system. This can be established duringscreening discussions and/or with reference to process draw-ings.

Appropriate corrosion mechanisms have been assigned foreach of the water categories. These include:

— Local corrosion such as pitting and crevice corrosion isexpected in stainless steels in oxygenated waters. Thesedegradation mechanisms return a PoF based on suscepti-bility and is constant over time for given operational pa-rameters.

— Uniform corrosion is assumed in carbon steels which isaccentuated by higher wall shear stresses (i.e. high flowrates), and the PoF is derived from wall thinning rate andhence loss of structural integrity over time.

— Bacterial corrosion (MIC) in waters where organic lifecan be sustained and no effective biocides are used.

Note that:

— produced water is included with hydrocarbon systems— water injection systems use various types of treatment, and

must be considered on a case for case basis.

C.6.3.1 Carbon steel damage models

The following models show carbon steel corrosion by watertype for given temperature and flow conditions. All use a Nor-mal distribution. The rates are also applicable to carbon steelwhere an organic coating is damaged. The resulting damage isa uniform wall thinning.

Notes with factors to consider are given in Table C-10. Thehole size distribution is given in Table C-9.

Table C-7 Water categories definition and descriptionWater category Description

Raw Seawater Seawater: Untreated, normal oxygen, bacteria,marine flora etc.

Seawater low oxy-gen

Seawater: Deoxygenated to max. 50 ppb O2 .No other treatment.

Seawater low oxy-gen + Biocide

Seawater: Deoxygenated, max. 50 ppb O2treated with UV/filtered or bactericide.No chlorination.

Seawater low oxy-gen + Biocide +Chlorination

Seawater: Deoxygenated, max. 50 ppb O2treated with UV/filtered or bactericide.Chlorination.

Fresh water

Desalinated water: typically prepared by con-densation of seawater. Basis for plant water forsteam generation etc. Low salt content. Nor-mal oxygen

Closed loop Closed loop systems. Desalinated systems thathave intrinsically ’low’ oxygen content.

Exposed DrainsOpen systems that collect water from drains,sluices, deluge, etc, and are assumed to containuntreated seawater.

Sanitary Drains Drains from sanitary systems. Fresh waterwith high bacteria and organic matter content

Table C-8 Carbon steel corrosion rates by water category

Water category Corrosion rate mean and standard devia-tion

Raw SeawaterSeawater with biocide /chlorinationExposed drains

Flow dependent: Rates from, standard de-viation 0.1 mm/yrSee Figure C-2

Seawater low oxygenSeawater low oxygenwith biocide / chlorina-tionClosed loop

Mean rate 0.01 mm/yr. standard deviation0.01 mm/yr

Fresh water or potablewater, Cl- less than 200ppmSanitary drains

Mean rate 0.25 mm/yr. Standard deviation0.1 mm/yr

DET NORSKE VERITAS


Figure C-2Carbon steel corrosion rates variation with flow rate

C.6.3.2 Stainless steel in water, damage models

Degradation of stainless steels in water results in local attacktypically pitting or crevice corrosion; the onset of which is as-sumed to be controlled by temperature, given that the waterconditions are as specified in Table C-7. The probability offailure per unit wall thickness for the different materials andwater types is given as a function of temperature in.

The assessment procedure is as below:

1) Select appropriate water category in Table C-7.

2) Select curve for material in Figure C-3. Read off failureprobability for given temperature.

3) Divide result by wall thickness in mm, to give PoF.

Table C-9 Carbon steel hole sizes distribution for aqueouscorrosionEquivalent hole diameter % Distribution

Less than and = 5 mm 05 mm to 25 mm 0Greater than 25 mm 100Rupture (full release) 0

Table C-10 Notes regarding carbon steels assessment in watersystemsConsidera-

tion Notes

Galvanisedsteel/zinc

Internal galvanisation is rarely effective in long-termcorrosion control, and so no credit should be given togalvanised steel: it is treated as carbon steel. Bewareclogging of nozzles due to zinc corrosion products.

CementLinings

No credit should be given for these linings: it is treatedas carbon steel. Inspection should include proceduresfor examining the condition of the lining.

Organic lin-ings

Organic lining should be identified, their performancemust be estimated on a case for case basis. A degrada-tion profile may be defined and applied to the corro-sion rates given in this document. A procedure fordefining a degradation profile is given in external cor-rosion models.

Cathodicprotection

The theoretical performance of sacrificial anode sys-tems can be checked by reference to procedures suchas NORSOK and DNV RP-B 401, whilst monitoring/inspection of the anode consumption should give agood indication of their effectiveness in practice.Note that, to be effective, anodes should be placed sothey lie in the water phase

Galvaniccorrosion

Galvanic corrosion may occur with certain materialcombinations, typically between carbon steel andstainless steel. The extent of damage is dependent onthe relative areas of the materials, and the resistivity ofthe media. In some cases this is advantageous, for ex-ample, where pumps and valves with lower gradestainless steel housings are used in carbon steel pipe-work the stainless steel will be ‘protected’ by the car-bon steel. In other cases, for example, where there is alarge cathodic area, high corrosion rates can be ex-pected.Correct assignment of anode and cathode for manycommon material combination is strongly affected bylocal conditions, thus any abrupt changes in materialsshould be identified and referred to a specialist forevaluation.

Welds

Corrosion of welds in carbon steel water bearing sys-tems is variable. All or part of the weldment may beattacked. Initial inspection should target welds andparent materials. Inspection findings, if any, can be re-viewed to determine where future inspections can befocused. These comments also suggest that data fromon line monitoring, e.g. corrosion probes, iron counts,should be used with caution, preferably as a supple-ment to some inspection.

Table C-11 Stainless steel hole size distribution for aqueouscorrosion of stainless steelEquivalent hole diameter % DistributionLess than and = 5 mm 100Above 5 mm to 25 mm 0Greater than 25 mm 0Rupture (full release) 0

Table C-10 Notes regarding carbon steels assessment in watersystems (Continued)Considera-

tion Notes

DET NORSKE VERITAS


Figure C-3PoF by water category for stainless steels

C.6.3.3 Aqueous corrosion of titanium

No degradation of Titanium is expected in the water categoriesdescribed, and so a fixed probability of failure of 10-5 shouldbe assigned, with hole sizes, to facilitate calculation of conse-quence, as given in Table C-11.

C.6.3.4 Copper based materials

Little corrosion is expected in desalinated and potable watercategories. Many copper based alloys have good or reasonablecorrosion resistance to quiet seawater, but high rates of corro-sion (erosion-corrosion) can occur in flowing seawater. Stag-nant conditions supporting sulphate reducing bacteria, can leadto high local corrosion rates.

Determine the probability of failure as follows:

1) If flow rate is above 2 m/s then set PoF = 1.0 and refer toa specialist.

2) Identify water category from the systems and water cate-gories Table C-7.

3) If materials are not included in Table C-12, then setPoF = 1.0 and refer to specialist.

4) Select mean rate and standard distributions as directed inTable C-12.

5) PoF is calculated using the ‘uniform’ damage morpholo-gy.

6) Select hole sizes as given in Table C-13.

C.6.3.5 FRP Materials in water systems

Design, fabrication, installation and testing should be carriedout in accordance with FRP piping specifications, supports forpipe and heavy fittings, jointing design and constructionshould be checked. FRP piping is susceptible to mechanicaldamage due to being stood on, used as a support for ladders,and damage due to welding spatter falling from welding andcutting operations. In addition, FRP is susceptible to degrada-tion of the polymer matrix due to exposure to ultraviolet radi-ation from sunlight and welding.

Local Corrosion: Raw Seawater

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1.E+00

0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150

Temp °C

Failu

reP

roba

bilit

y

316 DSS 6MoLocal Corrosion: Fresh Water

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1.E+00

0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150

Temp °C

Fai

lure

Pro

bab

ility

316 DSS 6Mo

Local Corrosion: Closed Loop

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1.E+00

0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150

Temp °C

Failu

reP

roba

bilit

y

316 DSS 6MoLocal Corrosion: Seawater Low Oxygen ( /biocide/chlorination)

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1.E+00

0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150

Temp °C

Failu

reP

roba

bilit

y

316 DSS 6Mo

Table C-12 Corrosion rates in copper based alloysWater categoryname Material: 90/10 Cu/NiRaw seawaterSeawater with biocide/chlorina-tionExposed drains

Flow rate less than 1 m/s: 0.08mm/yr; standard deviation0.01 mm/yrFlow rate above 1 m/s: 0.2 mm/yr; standard deviation 0.1 mm/yr

Seawater low oxygenSeawater low oxygen + biocide /chlorination

0.02 mm/yr; standard deviation0.02 mm/yr

Fresh waterPotable waterClosed loop

0.015 mm/yr, standard deviation0.05 mm/yr

Sanitary drains 0.05 mm/yr; standard deviation0.05 mm/yr

Table C-13 Hole size distribution for Cu-Ni alloysEquivalent hole diameter % DistributionLess than 5 mm 05 mm to 25 mm 0Greater than 25 mm 100Rupture (full release) 0

DET NORSKE VERITAS


In the absence of sound degradation models, and unless the an-alyst has access to experience with FRP it is recommended thatFRP is allocated a low reliability, i.e. PoF = 1.0, and risk cal-culated on this basis. This focuses on resultant high risk equip-ment for assessment by specialists.

The hole sizes for FRP required to calculate consequences aregiven in Table C-14.

C.6.4 Degradation mechanisms - chemicals

Chemicals can be split in to three groups:

Proprietary chemicals:

These include, but are not limited to, corrosion inhibi-tors, flocculants, bactericides.

Drilling chemicals:

These have limited interest on a production installation.

Identifiable chemicals:

These are common chemicals, but corrosiveness is de-pendent on concentration and temperature.

The first two groups may have chemicals given by trade namesonly. In many cases they may be non-corrosive and innocuousin service conditions, however, in other cases, particularly athigh concentrations, they can be highly corrosive and/or toxic.

The third group includes chemicals, for which general corro-sion data is more readily available, although the possible vari-ation in type and concentration implies that corrosiveness mustbe evaluated on a case by case basis. These are typically sys-tems that should be discussed during screening; the conse-quence is expected to be low in most cases and manycomponents can be expected to be screened out with very littlefurther effort required.

It is common that chemical systems can be assessed as either’insignificant’ or ‘unknown’ systems outlined below.

C.6.5 Insignificant

Where no insignificant degradation is expected, a fixed proba-bility of failure of 10-5 should be assigned. Hole sizes for anal-ysis of consequences are given in Table C-15 and areconsidered generally applicable in offshore systems.

C.6.6 Unknown

Where the product is an unknown substance, or the combina-tion of materials and product has no defined model, then ini-

tially a probability of failure of 1.00 should be assigned and theneed for further investigation driven by the consequence offailure – where a high consequence of failure will give a highrisk, indicating that it will be beneficial in spending furthertime in investigation of product and materials. The hole sizesfor required to calculate consequences are given in Table C-16.

C.6.7 Degradation mechanisms - vent systems

The vent system collates vapour phase from various parts ofthe process. Each part of the vent system must be evaluatedwith respect to what is being vented. Generally, the vent lineswill be subject to the same degradation mechanisms as vapourphase in the equipment being vented. Vent system equipment,such as knock-out drums may collate vapours from several ar-eas and should be considered with respect to the compositionof any liquid phases that may be collect.

C.6.8 Degradation mechanisms water - injection systems

Water injection systems usually use large volumes of treatedwater. This may be based on seawater, produced water, or acombination of these. Treatment typically includes de-oxygen-ation or de-aeration, chlorination or similar biocide, pH buff-ering, anti-scaling. Significant amounts of CO2 may bedissolved in the water. High injection rates imply that flow-re-lated damage can arise. A variety of materials are deployed inwater injection systems, and correct treatment (relative to thematerials) is essential. It is recommended that water injectionsystems are addressed on a case for case basis; however, inmany cases the water injection system can be evaluated asequivalent to a water system and/or produced water.

C.6.9 Degradation mechanisms - external corrosion

External corrosion applies to all product service codes, and isevaluated independently of any internal degradation and dam-age. It applies to all metallic materials with and without coat-ings and with and without insulation. See Table C-17.

— corrosion of carbon and low alloy steel in marine atmos-phere

— corrosion of carbon and low alloy steel under insulation— localised corrosion of stainless steels in marine atmos-

phere— localised corrosion of stainless steels under insulation— localised corrosion of stainless steels under insulation— external stress corrosion cracking of stainless steels under

insulation.

It is assumed for the models presented here that the parts areexposed to a marine atmosphere.

Carbon steels suffer marked corrosion in atmospheric expo-sure, but are usually protected by a coating. Stainless steelshave generally good resistance to exposure in marine atmos-phere and suffer only incipient corrosion although, local accu-mulation of salts can lead to severe corrosion, and such areasmust be focused during inspection.

Surfaces under insulation are not readily available for visualaccess, and if water penetrates the weather protection, high saltconcentrations can accumulate on the metal surface leading topossible locally severe corrosion in all carbon steels and stain-less steels. Stress corrosion cracking can also occur in stainlesssteels at elevated temperatures. Inspection of the insulationcondition itself is a very important means of controlling dam-age under insulation.

Table C-14 FRP hole size distribution for water systemsEquivalent hole diameter % DistributionLess than and = 5 mm 0Above 5 mm to 25 mm 0Greater than 25 mm 0Rupture (full release) 100

Table C-15 Hole size distribution for ‘insignificant’ systems

Equivalent holediameter

% Distribution

Carbon steels

Stainlesssteels and

nickel basedalloys

Titaniumbased alloys

Less than and = 5mm 0 0 100

Above 5 mm to25 mm 0 100 0

Greater than 25mm 100 0 0

Rupture (full re-lease) 0 0 0

Table C-16 Hole size distribution for ‘unknown’ systemsEquivalent hole diameter % DistributionLess than and = 5 mm 0Above 5 mm to 25 mm 0Greater than 25 mm 0Rupture (full release) 100

DET NORSKE VERITAS


In all cases coatings may be used to mitigate corrosion. Coat-ing deterioration should be included in the evaluations and the

RBI results should be linked to coating maintenance pro-grammes.

C.6.9.1 Coatings

The corrosion rate per year may be reduced according to the ef-fectiveness of a coating system applied to the part. Coating ef-fectiveness can assumed to be near-perfect for a short periodwhen new, and then deteriorates over a longer period to havingno value. A default coating effectiveness model is given in Fig-ure C-4. The deterioration pattern can be changed to accountfor different coating systems and any fabric maintenance.

The uncoated degradation rate is reduced by a factor equal to(100 – effectiveness)/100 to give the coated corrosion rate foreach year.

Figure C-4Coating degradation as a function of time in years

C.6.9.2 Carbon steel external corrosion

Uninsulated and uncoated corrosion rate is a function of tem-perature as shown in Table C-18.

Table C-17 External corrosion descriptionsMechanism Material Morphology Inspection guidanceCorrosion underinsulation

CS Damage as patches of attack wherewater can collect in insulation.Coatings may be used.

Damage controlled by water ingress through insulation. Deteriora-tion of any coating will affect overall resistance. Visual inspectionof weather protection, for leaks to locate potential areas. RT andUT can be used for sizing and monitoring.

Stainless steelsnickel based

As above, welds likely to havelower resistance that parent mate-rial. Coatings may be used.

As above. Monitoring of damage by inspection is not recommend-ed, due to rapid growth period. Corrective maintenance, for dam-age and preventative maintenance, of weather protection systems,is more important.

Titanium No damage expected. Minimum surveillance.External stresscracking underinsulation

Stainless steels(not 6Mo type)

Surface cracks where water cancollect at elevated temperaturesunder insulation. Welds particular-ly susceptible.

Damage controlled by water ingress through insulation. Deteriora-tion of any coating will affect overall resistance. Visual inspectionof weather protection, for leaks to locate potential areas. DP, RTand UT can be used to find cracks. Monitoring of damage by in-spection is not recommended, due to rapid growth period. Correc-tive maintenance for damage, and preventative maintenance ofweather protection systems, is more important.

Atmosphericcorrosion

CS Patches of damage leading tosmaller size holes. Usually associ-ated with coating damage and de-terioration. Enhanced in areaswhere wetting is prolonged, in-cluding condensation.

Minimum surveillance is required to periodically confirm initial as-sumptions, particularly coating condition.

Stainless steelsnickel based

Incipient attack, but small sizeholes associated with local attackwhere geometry allows damp saltsto collect.

Visual surveillance is required to check conditions. Attention fo-cused on geometry, clips, supports, etc. that can collect water andpromote crevice attack. Coatings, if used should be checked.

Titanium No damage expected. Minimum surveillance.

0

20

40

60

80

100

120

0 5 10 15 20

Age

Are

aC

over

edby

Coa

ting

%

DET NORSKE VERITAS


C.6.9.2.2 Hole sizes

Atmospheric corrosion of carbon steel is assumed to be ‘uni-form wall thinning’ occurring in areas or ‘patches’, althoughthe leak hole may be small, these usually occur in connectionwith a patch. The hole is interpreted as a ‘burst’ occurring atthe thinnest part of the patch when the local stress exceeds thematerials strength. The hole size distribution is given inTable C-19.

C.6.9.2.3 Rates: Under insulation

Corrosion Under Insulation (CUI) can occur when the insula-tion traps moisture against the material surface. This is mod-elled as a normal distribution with mean and standarddeviations as in Table C-20 on the assumption that salt water(from deluge) is wetting the insulation. If the insulation isshown not to be wet, then CUI does not apply. The rates can bereduced by the coating efficiency.

C.6.9.2.4 Hole sizes

CUI is expected to occur in patches where conducive condi-tions occur. The damage is not expected to interfere signifi-cantly with wall stresses and leak, rather than burst is expected.Hole sizes are expected as given in Table C-21.

C.6.9.3 Stainless steel external corrosion

C.6.9.3.1 Uninsulated surfaces

Uncoated stainless steels can be expected to have a probabilityof failure of 10-4 per mm wall thickness. Note that the exces-sive presence of deposits, and water traps under clamps, labelsetc. should be given special attention and may justify manualevaluation of the PoF.

The coating effectiveness given in Figure C-4 can be used toreduce the estimated Probability of failure by multiplying theuncoated probability of failure with a factor equal to (100-ef-fectiveness)/100.

The hole size distribution should be taken as given in TableC-22.

C.6.9.3.2 Under insulation

Where the stainless steel is insulated, the effect of salt watertrapped against the metal can result in pitting at moderate tem-peratures. At higher temperatures and stress corrosion crack-ing occurs in some stainless types under conducive conditions:i.e. at areas of high stress, such as welds and heavy cold work.Both local corrosion and cracking must be considered.

Local corrosion

The onset of local corrosion is controlled by temperature, giv-en that the conducive conditions are present. The probability offailure per unit wall thickness for the different materials is giv-en as a function of temperature in Figure C-5. The hole sizedistribution is given in Table C-23.

1) Select curve for material in Figure C-5. Read off failureprobability for given temperature.

2) Divide result by wall thickness in mm, to give PoF

3) The coating effectiveness given in Figure C-4 can be usedto reduce the estimated probability of failure by multiply-ing the uncoated probability of failure with a factor equalto (100-effectiveness)/100, with a minimum of 10-5.

Table C-18 Carbon steel atmospheric corrosion rateTemperaturerange Mean mm/yr Standard devi-

ation mm/yr Notes

Below –5°C Not applicable Not applicable Probability offailure = 10-5

-5°C to 20°C 0.1 0.0520°C to 100°C 0.3547 x Ln

(temperature)– 0.9334

0.3929 x Ln(temperature)– 1.0093

Over 100°C Surface dryingoccurs and willaffect the corro-sion rate. Referto a specialist.

Table C-19 Hole size distribution for atmospheric corrosion ofcarbon steelEquivalent hole diameter % DistributionLess than and = 5 mm 90Above 5 mm to 25 mm 9Greater than 25 mm 1Rupture (full release) 0

Table C-20 CUI model for carbon steelTemperaturerange

Mean mm/yr Standarddeviationmm/yr

Notes

Below –5°C Probability of failure= 10-5

-5°C to 20°C As 20°C 0.286 May overestimaterate, but failuresfound at low tempera-tures

20°C to 150°C 0.0067x tem-perature + 0.3

0.286

Over 150°C Refer to a specialist.

Table C-21 Hole size distribution for CUI of carbon steelEquivalent hole diameter % DistributionLess than and = 5 mm 80Above 5 mm to 25 mm 20Greater than 25 mm 0Rupture (full release) 0

Table C-22 Stainless steel atmospheric corrosion hole sizesEquivalent hole diameter % DistributionLess than and = 5 mm 100Above 5 mm to 25 mm 0Greater than 25 mm 0Rupture (full release) 0

DET NORSKE VERITAS


Figure C-5PoF for local corrosion of stainless steel under insulation

External Stress Corrosion Cracking (ESCC)

The onset of ESCC is controlled by temperature, given that theconducive conditions are present. The probability of failure fordifferent materials is given as a function of temperature inFigure C-6, with the hole size distribution given in Table C-24.Note that material type 6Mo is not included in the figure: Thereare suggestions that ESCC may be possible at elevated temper-atures. If possible, a specialist should be consulted if this iscause for concern.

The coating effectiveness given in Figure C-5 can be used toreduce the estimated Probability of failure by multiplying theuncoated probability of failure with a factor equal to (100-ef-fectiveness)/100, with a minimum value of 10-5.

Figure C-6PoF for stress corrosion cracking of stainless steel under insula-tion

Before concluding on hole size, an assessment of leak-before-break should be made, as duplex stainless steels may suffer a

toughness transition when subjected to low temperatures –such as may be found during blowdown. This may lead to arupture of the part. Otherwise, the high toughness generallyfound in stainless steels will prevent unstable fracture.

C.6.10 Fatigue

The failure probability due to fatigue and fracture, caused byhigh and low frequency fatigue is assessed for a given compo-nent, based on its geometry, dimensions, materials of construc-tion, loading and other operational conditions.

Guidance note:It should be noted that this document differentiates between highand low frequency fatigue and not high and low cycle fatigue.


High Frequency Load Ranges

With load ranges acting on components at typical machineryvibration frequencies, cracks may grow rapidly to criticalcrack size. The time interval between the crack reaching a sizewhere its probability of detection by inspection is high, and thecrack reaching a critical size where leakage or unstable failureoccurs, is very short and can be of the order of weeks. Fracturemechanics crack growth analyses are of little use and high fre-quency fatigue can be considered as a ‘susceptibility’ model(there is either an intact pressure boundary, or a failure is im-minent), and so is not amenable to measurement or monitoringof the crack size by inspection. The approach used for othersusceptibility models in the recommended practice is adopted,whereby measuring of the controlling parameters is recom-mended in place of NDT.

The physical measurable quantities of interest are the vibrationvelocities, and stresses (strains) in the piping. The strain canfurther be converted to stress and compared to appropriate S-N curves. Recommended locations for measurement are listedin Appendix D. The prioritisation of locations should be basedon the consequence of failure.

Low Frequency Fatigue

Low frequency cyclic loading, such as that caused by ship/platform motions, infers a crack growth duration that is suffi-ciently long to allow monitoring by NDT. An approach usingS-N curves or fracture mechanics analyses can be applied todetermine when to inspect.

References

1) “Fatigue Strength Analysis for Mobile Offshore Units”,DNV Classification Note 30.2, Det Norske Veritas, Au-gust 1984.

2) BS 7910:1999, “Guide on methods for assessing the ac-ceptability of flaws in structures”.

Table C-23 Hole size distribution for local corrosion ofstainless steelEquivalent hole diameter % DistributionLess than and = 5 mm 100Above 5 mm to 25 mm 0Greater than 25 mm 0Rupture (full release) 0

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1.E+00

0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150

Temp °C

Failu

repr

obab

ility

for

1m

mw

all

thic

knes

s

DSS 316 6Mo

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1.E+00

0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150

Temp °C

Failu

repr

obab

ility

316 DSS

Table C-24 ESCC: Stable (‘leak’) and Unstable (‘burst’)cracks hole size distribution


Stable (’leak’) Unstable(’burst’)

Less than and = 5 mm 0 0Above 5 mm to 25 mm 100 0Greater than 25 mm 0 0Rupture (full release) 0 100

DET NORSKE VERITAS


APPENDIX DINSPECTION PLANNING AND DATA ANALYSIS

D.1 Inspection planningThe following table is developed as an aid to select inspectionmethods and coverage based on the results from RBI analyses.The methods and coverage in this table are aimed only at de-tecting the degradation; all indications of defects found duringinspection should therefore be followed up by necessary ac-tions to determine the extent of damage and defect sizes as wellas an evaluation of need for changes in inspection program.

Where different methods are suggested for the same degrada-tion mechanism, the methods should be considered as alterna-tives to each other unless they are placed under the same point.

D.1.1 Definition of inspection effectivenessThe following inspection effectiveness have been definedbased upon the examination of hot spots or suspect areas as de-scribed in Table D-1:

Highly Effective The inspection method will correctlyidentify the actual damage state in nearlyevery case

Usually Effective The inspection method will correctlyidentify the actual damage state most ofthe time.

Fairly Effective The inspection method will correctlyidentify the actual damage state abouthalf of the time.

Note that the effect of PoD for the inspection method should beconsidered, as a small amount of damage may cause the risk topass the risk limit, yet such damage may not be reliably detect-ed due to giving low values of PoD. In such an instance, otherrisk management methods should be considered.

D.1.2 Inspection techniquesThe following abbreviations are used in Table D-1.

UT-CHIME Creeping/Head wave inspection methodCVI Close visual inspectionPT Dye penetrant testingET Eddy current testingUT-IRIS Internal rotating inspection system (ultrasonic)MT Magnetic particle inspectionET-RFEC Remote field eddy currentRT Radiographic testingRT-RTR Real time radiographyUT Ultrasonic testing

D.1.3 Damage mechanism and inspection effectiveness

The following table is valid under the following assumptions:

— The inspection methods are used within their recognisedlimitations with respect to dimensions and materials ofconstruction for the component subject to inspection.

— Inspection is carried out according to qualified proceduresand by qualified personnel.

— All indications of defects found during inspection are fol-lowed up by necessary actions to determine defect size andneed for increase in extent of inspection.

— When identifying a limited selection of hot spots, it shouldbe recognised that some of the degradation mechanismswill have different PoF for the different types of hot spotslisted. The focus should be on the hot spots that are judgedto have the highest PoF, but samples of hot spots with alower PoF should be included for completeness.

— No differentiation is made between the various methodslisted for a damage mechanism with respect to PoD in thistable, i.e. all methods have been treated as having a PoDof 1 if they have been found suitable to detect the expecteddamage. Further differentiation in inspection efficiencyfor the different methods can be made with reference toPoD curves.

Recom

endedP

racticeD

NV

-RP

-G101,

January2002

Page

46

DE

TN

OR

SK

EV

ER

ITA

S

Table D-1 Inspection and inspection effectiveness

Damage mechanism Damage description Inspection method Highlyefficient

Usuallyefficient

Fairlyefficient Comments

Uniform CO2 corro-sion

Internal thinning of considerable areasHot spots:6 o’clock position in piping with laminar flowBottom of deadlegs and other low points wherewater can accumulate

UT 30% of hot spots 10% of hot spots 3% of hot spots CVT and video inspection: Internal surfaceshave to be cleaned with ultra high pressure wa-ter jetting (> 1000 bar) or grit blasting beforeinspection. Has to be complemented by UTthickness checks in low points and corroded ar-eas.

RTCVTVideo inspectionLong range UT

Local CO2 corro-sion

Local internal thinning.Hot spots:Welds incl. HAZT-sections (depending on flow directions), O-letsand other branch connections and first pipe diame-ter downstreamBend and following 2 pipe diameters downstreamTurbulent area up to 2 pipe diameters downstreamof chokes, control valves, thermowells and othercomponents causing turbulent flow.Reducers and following 2 pipe diameters down-streamInlet nozzle and impingement or turbulence areasin vessels

UT 100% of hot spots 30% of hot spots 10% of hot spots CVT and video inspection: Internal surfaceshave to be cleaned with ultra high pressure wa-ter jetting (> 1000 bar) or grit blasting beforeinspection.

RTCVTVideo inspection

Sulphide stresscracking

Internal surface breaking crack.Hot spots:Welds incl. HAZ, particularly repair welds

UT 100% of hot spots 30% of hot spots 10% of hot spots Susceptibility type PoF-model. Inspection willnot give significant reduction in PoF.MT

RT(CP)ETAT

Hydrogen InducedCracking, StepwiseCracking

Subsurface laminations or blisters, parallel to sur-face, or combination of such laminations/ blistersand subsurface of surface breaking cracks normalor parallel to surface.Hot spots:Rolled plate materialWalls with indications of laminations or blisters

UT 100% of hot spots 30% of hot spots 10% of hot spots Inspection methods for screening for hot spots:Internal and external CVT.If inspection is not complemented by internaland external CVT, the total equipment surfaceshould be considered as suspect area.

ETRT(CP)ATMagnetic FluxLeakage

MicrobiologicallyInfluenced Corro-sion (MIC) in CS

Internal local corrosion randomly distributed.Probability of attack increases with reduced flow.Local thinningHot spots:Dead legsAreas where debris can accumulate

UT 100% of equip-ment surfaces

100% of hot spots Susceptibility type PoF-model. Inspection willnot give significant reduction in PoF, but mon-itoring for bacteria in the fluid will give indica-tion whether MIC is a problem or not.CVT and video inspection: Internal surfaceshave to be cleaned with ultra high pressure wa-ter jetting (> 1000 bar) or grit blasting beforeinspection.


Recom

endedP

racticeD

NV

-RP

-G101,

January2002

Page

47

DE

TN

OR

SK

EV

ER

ITA

S

MicrobiologicallyInfluenced Corro-sion (MIC) in stain-less steels

Internal local corrosion randomly distributed.Local thinning.Hot spots:Welds incl. HAZ in dead legs and areas where de-bris can accumulate

UT 100% of hot spots 30% of hot spots Susceptibility type PoF-model. Inspection willnot give significant reduction in PoF, but mon-itoring for bacteria in the fluid will give indica-tion whether MIC is a problem or not.CVT and video inspection: Internal surfaceshave to be cleaned with ultra high pressure wa-ter jetting (> 1000 bar) or grit blasting beforeinspection.


Erosion Internal wear of equipment surfaces due to sand inprocess stream.Thinning over an area corresponding to impinge-ment.Hot spots:T-sections (depending on flow directions), O-letsand other branch connections and first pipe diame-ter downstream.Bend and following 2 pipe diameters downstream.Turbulent area up to 2 pipe diameters downstreamof chokes, control valves, thermowells and othercomponents causing turbulent flow.Reducers and following 2 pipe diameters down-streamInlet nozzle and impingement or turbulence areasin vessels.Areas subject to impingement from jet-nozzles

UT 30% of hot spots 10% of hot spots 3% of hot spotsRTCVTVideo inspectionLong range UT

General corrosionof CS in utility wa-ter systems

Internal thinning.Hot spots:Total equipment surface (dependent on type of wa-ter)High flow areas

UT 100% of hot spots 30% of hot spots 10% of hot spots For water systems with higher predictability inlocation of most severe corrosion, the extent ofhot spots can be reduced.CVT and video inspection: Internal surfaceshave to be cleaned with ultra high pressure wa-ter jetting (> 1000 bar) or grit blasting beforeinspection.


Local corrosion ofstainless steels inutility water sys-tems

Internal pittingHot spots:Welds incl. HAZ

CVT 100% of hot spots 30% of hot spots 10% of hot spots Susceptibility type PoF-model. Inspection willnot give significant reduction in PoF.

UTRT

Internal thinning in concealed faces forming acrevice.Hot spots:Flanges, screwed connections and other compo-nents forming crevices

Disassembly andCVT

100% of hot spots Susceptibility type PoF-model. Inspection willnot give significant reduction in PoF.RT: Only valid for screwed connections.RT

Table D-1 Inspection and inspection effectiveness (Continued)


Usuallyefficient


Recom

endedP

racticeD

NV

-RP

-G101,

January2002

Page

48

DE

TN

OR

SK

EV

ER

ITA

S

CUI, CS Local corrosion of external surfaces under insula-tion.Thinning; in patchesHot spots: Unpainted surfaces and surfaces withpainting in poor condition in:Areas subject to water ingress due to poor installa-tion or condition of vapour barrier or design ofequipmentLow points and water entry pointsCorners where water can collectAreas where water condenseField welds

Deinsulation andCVT

100% of equip-ment surfaces

100% of hot spots 30% of hot spots Inspection methods for screening for hot spots:CVT, thermography, humidity measurementsin insulation.Real time profile RT: Only valid for piping.Scan of horizontal piping has to show bottomprofile of piping. Scan of piping of other orien-tation has to show profiles of piping at two op-posite sides.

RTReal time profileRTLong rang UT

CUI, stainless steels Local corrosion and pitting of external surfaces un-der insulation.Local Pitting.Hot spots: Welds incl. HAZ and areas subject toheavy cold work that are unpainted or with paint-ing in poor condition, located in following loca-tions:Areas subject to water ingress due to poor installa-tion or condition of vapour barrier or design ofequipmentLow points and water entry pointsCorners where water can collectAreas where water condense

Deinsulation andCVT

100% of hot spots Susceptibility type PoF-model. Inspection forcorrosion will not give significant reduction inPoF but inspection for conditions causing cor-rosion followed by actions to remove causemight give reduction in PoF.Inspection methods for screening for hot spots:CVT, thermography, humidity measurementsin insulation.

RT

ESCC under insula-tion

External surface breaking crack.Hot spots: Welds incl. HAZ and areas subject toheavy cold work that are unpainted or with paint-ing in poor condition, located in following loca-tions:Areas subject to water ingress due to poor installa-tion or condition of vapour barrier or design ofequipmentLow points, corners and other places where intrud-ing water can collect

Deinsulation andET

100% of hot spots 30% of hot spots 10% of hot spots Susceptibility type PoF-model. Inspection forcorrosion will not give significant reduction inPoF but inspection for conditions causing cor-rosion followed by actions to remove causemight give reduction in PoF.Inspection methods for screening for hot spots:CVT, thermography, humidity measurementsin insulation.

Deinsulation andPTDeinsulation andcreep wave UT

External corrosionof uninsulated CS

Uniform and local corrosion of external surfaces.Thinning in patches.Hot spots: Unpainted surfaces or surfaces withpainting in poor condition with the following con-ditions:Corners where water can collectAreas where water condensesUnder deposits of dirt etc.Drips onto hot piping

CVT 100% of equip-ment surfaces



Usuallyefficient


Recom

endedP

racticeD

NV

-RP

-G101,

January2002

Page

49

DE

TN

OR

SK

EV

ER

ITA

S

External corrosionof uninsulated stain-less steels or titani-umExternal crevicecorrosion

Local corrosion and pitting of external surfaces.Local pitting.Hot spots: Discolouration. Welds incl. HAZ, areassubject to heavy cold work or areas contaminatedwith CS material from grinding etc., without paint-ing or with painting in poor condition and the fol-lowing conditions:Corners where water can collectAreas where water condensesUnder deposits of dirt etc.Drips onto hot piping

CVT 100% of hot spots Inspection methods for screening for hot spots:GVI

Local thinning in concealed faces forming a crev-iceHot spots:Flanges and other details forming crevicesUnder clampsUnder adhesive tape or other markings

Disassembly andCVT

100% of hot spots RT: Only valid for screwed connections.CVT combined with creep wave or long rangeUT: Only valid under clamps, supports andsimilar components. CVT to be followed up bycreep wave or long range UT if visual indica-tions of corrosion is detected.

RTCVT combinedwith creep wave orlong range UT

Fatigue Cracking of cyclically stressed components.Surface breaking crack from external surface orfrom pre-existing defect.Hot spots: Welds in systems with cyclic loads inconnection with:Clamped supports, branching points nozzle attach-ments and other fixing pointsMarked changes in dimensions’Sock-olets’ for heavy equipment mounted to pip-ing through smaller dimension pipingSmaller diameter branching connections

Measurement ofoscillating stresses

100% of hot spots Susceptibility type PoF-model. Inspection forcracking will not give significant reduction inPoF for components with unacceptable oscil-lating stresses, but inspection for conditionscausing corrosion followed by actions to re-move cause might give reduction in PoF.Inspection methods for screening for hot spots:GVI



Usuallyefficient


DET NORSKE VERITAS


D.2 Inspection data analysisA general procedure for statistical analysis of inspection datafor use in inspection planning is given below. This Appendixshould be used a checklist rather than a complete procedure foranalysis. With the points should be considered with the generalmaterials knowledge discussed elsewhere in this document.

D.2.1 Grouping of dataThe data should be grouped according to one of the followingcategories:

— material and service (or corrosion circuit)— component type; pipe, vessel, heat-exchanger, etc.— age of component if replaced— time period if there has been a change in process parame-

ters; water content and chemistry, temperature, fluid com-position.

D.2.2 Data quality checksCheck the quality of the data. Remove data from the data-setbased on one or several of the following:

— too high rate (i.e. failure within a few months)— data for measurement vs. component replacement and age

(check that replacement is taken into account)— measured thickness vs. nominal wall thickness (data

showing an increasing wall thickness may be removedfrom data-set).

D.2.3 Degradation mechanisms/morphologyCheck the expected degradation mechanisms for the compo-nent in question and the location of damage.

— damage type and expected location of damage (top/bot-tom, welds, components)

— internal/external damage— variation of degradation with time.

D.2.4 Inspection methodResults from different inspection methods may not be handledin the same data-set. Make sure the method, procedure, cali-bration etc., are the same.

— type of instrument— local measurement vs. scanning— coverage— location of equipment.

Any error in the inspection technique should be included in theestimation of corrosion rates.

D.2.5 Corrosion monitoring data

Corrosion monitoring data may be used in conjunction with theinspection data to give an picture of the actual situation. Thetype of data of interest may be:

— corrosion coupons— direct corrosion rate measurement (LP— chemical analysis of the HC-fluid and the water.

D.2.6 Statistical evaluation of data

A number of statistical techniques may be used to evaluate thedata, the following may be most relevant:

— regression (trending) analysis of wall thickness— estimation of statistical quantities (mean, standard-devia-

tion, skewness, kurtosis) for estimation of extreme values.For further details, see for example Kowaka, 1994.

— Weibull analysis— statistical plotting.

In all cases it is recommended to plot the results in a propergraphs, as this will reveal any abnormalities in the data.

D.2.7 Application of mata between corrosion circuits

Corrosion rate data from one part of the plant may be used forother plants if the conditions are comparable.

References:

M. Kowaka

Introduction to Life Prediction of Industrial Plant Materials.Application of extreme value Statistical Method for CorrosionAnalysis. Allerton Press, Inc., New York, 1994, ISBN 0-89864-073-3.

DNV RP-G101 Risk Based Inspection

Documents

Transcript of DNV RP-G101 Risk Based Inspection