36.2.1 Scope of the Program

In developing an F-IMP, it is important to clearly identify the scope of the program. As noted above, the F-IMP should cover the piping that contains the commodity (gas/oil/other) that the overall pipeline is transporting and that will be returned to the customer at the delivery point. Much of the other equipment within the fence-line could be included in the F-IMP. The scope of the F-IMP must be decided upon and documented. This must be done to prevent gaps in integrity/maintenance activities related to these systems from developing. If certain types of equipment are to be excluded from the scope of the F-IMP, its integrity must be managed by other programs run by the operator.

One approach to scoping an F-IMP is to, at least in early stages of implementation, confine it to process safety critical (PSC) equipment. This has been defined by some to be the equipment that contains service fluids and whose failure would result in or exacerbate a process safety incident. Examples of PSC equipment include

• Above/below ground piping (often greater than some decided upon nominal diameter)
  
• Fired and unfired pressure vessels
  
• Storage tanks
  
• Manifolds

Focusing a F-IMP on such equipment can make implementation of an F-IMP more manageable by not trying to do everything at once while still covering off the most critical facility equipment. Once the F-IMP has been effectively implemented for the PSC equipment, the operator can then consider the merits of expanding the scope of the F-IMP to include other equipment within its facilities. Alternately, an F-IMP that addresses only PSC equipment may be all that is needed to manage the integrity of some operators’ facilities adequately.

36.2.2 Goals of the Program

It is critical to identify the goals of the F-IMP. P-IMP goals often utilize the management of both individual and societal risks to defined quantitative limits and compare against an accepted measure of As Low As Reasonably Practicable (ALARP). Managing to ALARP becomes a primary goal of their plans. These are not yet goals in common use for F-IMPs. The goals of a F-IMP are as straightforward as fixing identified failures when they occur within defined timelines to a complete intolerance for any loss of containment events occurring in a given period of time. Historically, F-IMP or the inspection and maintenance programs that have been in place at facilities whether documented as F-IMP or not have embraced goals such as:

• Meeting scheduled maintenance requirements (from OEM or by experience),
  
• Achieving certain equipment reliability targets,
  
• Improving equipment reliability by specified amounts or
  
• Optimizing maintenance costs.

These goals will inevitably be managed considering maintenance costs and reliability requirements to address what is reasonable or practical for individual operators. Use of a tiered performance metrics approach such as those discussed in CSA Z260 or API RP 754 may be useful in balancing these goals.

Ultimately, the management within operating companies need to have ways of determining if their F-IMPs (and P-IMPs) are being effective. This is best achieved by setting F-IMP goals against which its performance can objectively be measured.

A note of caution is required here. These must go beyond being regulatorily compliant. Such compliance is the operator’s price of entry to be in the industry. It is the law, is non-negotiable, and is therefore an inappropriate goal for an F-IMP. The goal must be something measurable so that the performance/adequacy/effectiveness of the F-IMP can be judged. Goals could be

• As simple as that all required scheduled maintenance activities on process safety equipment in a select number of facilities have been completed. Or
  
• That the same level of completed maintenance is achieved at all facilities. Or
  
• It could be that a certain level of reliability/availability has been achieved. Or,
  
• If risk management is in play, then it could be maintaining the risk for specific equipment/facilities below some established threshold value.

Operators can no longer afford the simple target of reducing pipeline facilities’ annual number of loss of containment events. The industry’s stakeholders are demanding better.

36.2.3 Threat Identification/Management

A process for identifying and reviewing/verifying threats to facility and facility equipment integrity is an integral part of any F-IMP. It is required to develop and implement specific corresponding processes and procedures for the monitoring, control, and mitigation of the threats to prevent them from resulting in breaches of an operator’s facility integrity.

Facilities have multiple asset types, and each asset type requires its own threat and hazard assessment in the management of facilities integrity. A standard operating practice is required allowing similar analytical treatments to be applied to like facilities in an operator’s inventory of facilities but recognizes when alternate analyses are needed for dissimilar facilities or equipment

Developers of F-IMPs may find guidance for threat identification in Section 2.2 of B31.8S, which identifies three (3) categories of threats:

• Time dependent
  
• Resident
  
• Random or time independent.

These are further broken down to nine (9) subclassifications of threats. The B31.8S threats have been used extensively by the pipeline industry for the identification of threats needing to be managed under their P-IMPs. Their use has also been successfully extended to F-IMPs but often require augmentation by operators’ subject matter experts (SMEs) for the unique operating environments and situations found within facilities. Appendix A-1 through A-9 of B31.8S also provide helpful guidance for addressing each of the nine LOF threats, while Section 3 is helpful with understanding and scoping the consequences of loss of containment events.

Alternately, more detailed guidance can be found in ASME’s PCC-3 Inspection Planning Using Risk-Based Methods. Section 6 Damage Mechanisms and Failures Modes provides a listing of eighty-eight (88) “… credible damage mechanisms and failure modes of pressure boundary metallic components” [8]. Appendix A contains an extensive table providing descriptions for each of the damage mechanism. This table is intended to be used in conjunction with the table found in Appendix B which offers a means of screening for each of the damage mechanisms against types of operations, processes, and mechanical environments. For some operators, the more granular damage mechanisms described in PCC-3 may be of greater assistance than those found in B31.8S when trying to identify the threats to their facilities and equipment in those facilities requiring management under their F-IMP.

A caution is required here. Developers of F-IMPs must keep in mind that failures can not only arise from the individual threats identified but also by the interaction of one or more of the threats. An example could be

Coating damage that occurred during construction that is coincident with a pipe long seam weld anomaly that occurred during manufacturing (facility pipe is equally susceptible to manufacturing threats as that found in pipelines). This could lead to corrosion being coincident with a crack which would behave differently than simple corrosion.

Developing strategies for addressing potentially interacting threats are part of the threat identification/management process.

Means of developing and verifying the list of threats of concern should also consider including reviewing:

• Maintenance practices and records
  
• Process hazard assessment (e.g., HAZOPs)
  
• Root cause analyses
  
• Historic operator failure reports
  
• Historic industry failure reports
  
• Bow-tie analyses

When consulting these records, operators should check that the failure analyses, especially those having a root cause analysis, all ensure the failures are properly classified. It must also be acknowledged that while history has proven to be a good indicator, it is hard to have a successful plan by only looking in the rear-view mirror. Efforts are required to anticipate and include prevention and mitigation processes for low frequency, high consequence possibilities.

Finally, the F-IMP must include a process that regularly reviews the previously identified threats of concern. It is likely that during the operational life of a facility that operating conditions will change. When those changes occur, they have the potential to introduce new threats for which no monitoring, control or mitigation processes have been developed. The regular review offers operators the opportunity to develop such processes before a new threat has resulted in an integrity breach in one of their facilities. Guidance for process safety metric threat reviews can be found in API 754 and CSA Z260.

Other chapters in this Handbook provide helpful information on determining the magnitude of threats and assistance for prevention and mitigation strategies.

Management of the identified threats of concern will largely involve monitoring/inspection processes. No one inspection technique can find all threats. In most cases, the congestion inside a facility complicates the interpretation of aboveground external corrosion direct assessment (ECDA [9]) inspections and therefore demands other complementary techniques such as guided wave, in an excavation or above ground, to locate and evaluate wall thinning. A combination of ECDA principles, internal corrosion direct assessment (ICDA [10]) principles, bell hole inspections with ultrasonic, guided wave, and X-ray inspections have been integrated and used to provide these inspection relationships and help the operator complete the integrity and risk assessment of their congested facility. Inspection technology guidance can be found in the ASME PCC3 and API 1183 tables.

Examining historic failure records allow some generalizations to be made that should be considered when undertaking F-IMP threat (re-)assessments. More than half the liquid releases reported in the United States occur and are contained inside the fences of facilities (see PRCI L52317 in the essential reading). This is expected because:

• These facilities are all very diverse and equipment is concentrated.
  
• There are more bolted joints and other mechanical fittings that can leak or rupture. Furthermore, liquid facilities tend to have many more valves than gas systems as these extra valves assist in batching product for shipment.
  
• Facilities are generally designed with on-property secondary and tertiary spill containment systems

Releases are reported and are generally small and compared to pipeline rupture releases along the right-of-way, are confined and remain within the fence line on the operator property. As the number of pipeline ruptures are expected to trend down, operators expect that facility issues will become a much greater focus in performance management and regulation.

Many incidents can be related to operator error and mitigating the threat largely requires the development of documented procedures, training to ensure these standard operating procedures (SOPs) are understood by personnel and monitoring to confirm they are consistently followed. A wide range of operational activities associated with all manner of facility equipment require the development of written procedures for:

• Assembly
  
• Operations
  
• Preventative maintenance
  
• Repair

These concerns helped drive the move beyond facility and pipeline integrity management to incorporate the wider safety and loss management systems that it is hoped will help industry achieve its goal of zero failures.

More large incidents have occurred along the right-of-way than within gas or liquid transmission facilities; however, injuries, fires, and explosions are much more common in the small mileages of these facilities. This is to be expected because there are more reliefs, mechanical joints, and fittings, and it is much more likely that people are present when these incidents occur or are harmed by activities. Many of the incidents can be related to control and relief equipment failures, sometimes a result of incorrect operations. These threats require periodically improving SOPs in planning and acquiring purchases, fabricating installations, and conducting maintenance activities. Periodic retraining helps ensure these SOPs are consistently followed in the materials supply, construction, operations, and repair of the wide range of components that make up the facility. In the past, operators have gathered to share incident data to locate systemic problems.

Product compression and expansion generates temperature differences. Temperature changes can result in static stresses on the piping and connections. Excess heat if not removed will damage the anticorrosion coatings. Natural gas transfer connections also include a pressure reduction, and this expansion necessitates auxiliary heating equipment to heat the cold gas expansion and minimize condensation and freezing hazards on the pipe or in control/sensing devices.

Pump and compressor station facilities contain redundant, complex, and congested interconnects. Similarly, custody transfer and metering interconnects, pressure reduction equipment, and product conditioning facilities are located inside a facility with a perimeter fence. The yard plumbing generally consists of multiple runs of buried and above ground heavier wall pipe plus cast or forged fittings, complex ILI pig tool launchers and receivers, valve complexes such as the suction and discharge headers feeding multiple compressors and pumps including bolted joints plus all the associated electronic detection and control functions.

If there is a loss of containment, refined products represent a hazard to the potable water supplies, agricultural, scenic, and wetland ecosystems. Liquid spills, if beyond the planned confinement perimeter, are not round but form a more complicated polygon shape with the boundary controlled by the local geography and elevation changes as gravity drives the liquid pool perimeter into an HCA. The intersection of the polygon determines if there is an impact to adjacent structures or locations of interest. Liquid leaks and ruptures may feed a pool fire and thermal radiation damage can spread as the pool drains downhill if the outflow is not naturally confined. For facilities, a berm or ditch is used to mitigate any migration with the added concern of inspection and maintenance of sluice valves and surface water runoff concerns.

Simply, if a neighboring structure can be impacted by thermal damage from a burning source inside the facility, then there is a possible consequence. Similarly, if a polygon path from a leak interacts with a structure or crosses a potable water source, then those sites need to be part of the operator’s risk management plan for the facility.

Threats causing loss of containment and their identification have always been managed by operators and many pipe oriented prevention and mitigation options can be found in ASME B31.8S Table 7.1-1. Similarly, Table C-1 in Appendix C of ASME PCC-3 offers examination/monitoring methods for all the damage mechanisms described in that standard.

36.2.4 Risk Assessment/Management

Consequences tend to be driven by location, surrounding activities, economic, and natural forces. Consequences have different prevention and mitigation options.

Ultimately, a means of prioritizing F-IMP related activities is required. Commonly, this is achieved by employing risk assessment/management processes. In the context of F-IMP, risk assessment being a means of determining the levels of risk posed by various threats to various equipment at various facilities; risk management being the process of prioritizing which actions will (and will not) be taken to take to address the levels of risk identified by the risk assessments.

Mathematically, “risk” is the product of the individual likelihood of failure (LOF) frequencies multiplied by the consequences of the failures (COFs). There are many ways to develop each of the products in this equation that range from SME judgement to simple relative relationships to those that employ sophisticated Bayesian Analyses [11]. Examples and discussion of risk management can be found throughout this Handbook, particularly in Part IX, as well as individual assessments in Parts VII and VIII in numerous chapters, and in Part II.

The implementation of successful risk assessment/management processes most often starts with simpler approaches. Trying to be toosophisticated (i.e., quantitative or probabilistic) too soon has often led to a dead end for operators due to limitations on the available detailed data that such techniques demand. If sophisticated approaches are ultimately desired, starting more basically offers the opportunity to better understand what data will eventually be needed, identify gaps in existing data sources or collection methods and resources that may be required to remedy identified issues. A plan can then be developed and thoughtfully implemented that creates incremental but continuous improvement that achieves the desired end state.

Inspections and other routine maintenance data flows may be used to greatly simplify data sharing and reduce uncertainties in the information capture. Risk needs to be comparable across assets to compete fairly for corporate resources. The goal is to achieve non-conflicting scheduling of prevention and mitigation P-IMP and F-IMP activities and other departmental divisions across different forms of energy transmission, distribution, and generation.

Consequences from incidents occurring at facilities vary and can arise from any number of events. They can include such things as:

• Production interruptions or shutdowns
  
• Spills
  
• Fires
  
• Explosions
  
• Death or injury of employees and/or members of the public
  
• The need to exercise force majeure clauses of contracts

System reliability is affected if incidents occur at compressor/pump stations/terminals. The effect of losing one or more stations due to (for example) lighting or other weather and outside force (WOF) cause will reduce the throughput all along the line. Although it might not look to be much, a 5% reduction in mass flow might have a significant impact on an operator’s revenues.

Some lines, if shut in, will remove customers from their energy supply. Businesses depend on reliable supplies of energy and there are contractual penalties for interruptions. In the United States, identified sites as defined in ASME B31.8S, 49 CFR 192 Subpart O (i.e., high and medium consequence areas) and 49CFR195.6 (i.e., high consequence and unusually sensitive areas) are locations where we expect to find individuals with impaired mobility such as daycares, retirement homes, hospitals, schools, prisons, or critical environmental receptors like municipal potable water sources. Alternate energy sources would be required for extended outage durations especially to hospitals and prisons where evacuation is so much more complicated. Providing alternate sources of drinking water for large numbers of people for the extended time to fully remediate a hazardous liquids release (if it is possible at all) is a highly complicated and costly undertaking.

Sometimes the site of an incident impacts vehicle and transportation routes. Incidents have been known to shut down high-tension electrical transmission lines, rail lines, or major interstate highways. This related interactive damage is an inconvenience for the public and if extended can generate deteriorating general business consequences. Fire can spread and extend in an area while the emergency responders are restrained by these exceptionally large fires., While they are held back, the fuel in the pipeline continues to drain and feed the fire before and after isolation valves have been closed. The fire thermal energy magnitude needs to significantly reduce before they can safely begin to control the damage and search for victims. Thermal radiation has been known to cause exposed pipelines or other adjacent containers of combustible material to overheat, burst (i.e., boiling liquid expanding vapor explosions, BLEVE), which can greatly add to the burning volumes of fuel and causing further delay and hindrance for emergency response and mitigation.

Newsworthiness is a simple concept. The incident reputational damage factor increases from local newsworthiness to regional news casts, to statewide TV footage, to national TV coverage, and to worldwide TV coverage. The number of days that the incident remains in the news increases the adverse consequences. Although this consequence is difficult to quantify, it is a very significant consideration in developing a complete description of the consequences to be used in a risk assessment of any probable event.

Balancing the prevention of all the potential consequences described above while maintaining an operable system requires an overall company-wide operational risk matrix plan to help manage facilities in context of all the other corporate risks being managed.

A more recent industry development has been growing regulatory pressure for industry to use common risk assessment methods [12] that would allow company to company risk comparisons to be made. Rate case commissions and their critics need to ensure tax revenues are appropriately allocated to reduce risk (failures and consequences) to the public and other nearby infrastructures. These utilities are relied upon to keep national services and systems running smoothly. Satisfying these pressures will require some manner of industry standardization of risk assessment/management processes. This end state is likely a long-term concern but retaining flexibility in whatever risk assessment/management approaches are chosen will facilitate making those future company adjustments whatever may be required.

36.2.5 Monitoring Inspections and Integrity Assessments

Once threats have been identified, operators must establish methods to be used to monitor threats for all those determined to be within scope of the F-IMP. They then must determine whether the methods will be undertaken by developing internal resources or employing outside expertise and equipment. Finally, establishing and implementing scheduled plans for monitoring activities and creating the necessary internal processes/expertise for assessing the results of the monitoring activities will follow.

The use of two (2) or more noninvasive inspections can help improve the geometrical characterization of imperfections and in many cases allow their predicted failure pressures to be calculated. One of the better tables of inspection technologies and summaries of their various applications used for examination and monitoring are available in ASME PCC-3, Nonmandatory Appendix C.

In addition to visual and other routine inspection methods to detect imperfections, there are four accepted integrity assessment methodologies. To be considered a methodology the process requires finding anomalies/defects, then conducting fitness for service (FFS) assessment, followed by responding to imperfections that fail the acceptance criteria. Examples of complete methodologies would include

• Pressure testing
  
• Robotic and product driven in-line inspections
  
• Direct assessment (i.e., ECDA, ICDA, and SCCDA)
  
• New technologies

The first new technology to be approved by a regulatory agency as a standalone integrity assessment system was in October 2019 into 49CFR192 as Appendix F Criteria for Conducting Integrity Assessments Using Guided Wave Ultrasonic Testing (GWUT); however, there are two additional useful guided wave standards NACE¹ SP0313 and ASTM E2775. Trials with magnetic tomography look promising.

36.2.6 Quality Control

Codes and standards have long required standards for purchasing material to ensure that the products received will meet the contract expectation. Prequalification of suppliers has long been a requirement supplemented by site visits to ensure the processes and manpower are qualified. Inspectors have been hired to conduct quality measurements at the factory site and increased regulation has led to tighter record keeping ensuring traceable, verifiable, and complete (TVC) records for every piece of capital equipment installed and ensuring this inspection and record keeping was done using qualified individuals. In many instances, the vendor’s suppliers receive site visits to confirm that subcomponents also meet the TVC documentation requirements of the contract.

Construction records have grown in a similar fashion and contracts for the contractors contain requirements for quality control checks plus independent confirmation by third-party contract inspectors, who document and report to the operator their observations and measurements. These observations ensure the quality assurance expected in these contracts were met or exceeded. Similar quality checks are required before ordered materials are accepted at the operator’s construction or storage location.

It is incumbent upon operators to extend these practices of establishing quality control methods and quality assurance checks to all elements of the F-IMP. Requirements and guidance in this regard are not yet extensive nor detailed leaving operators considerable discretion in developing approaches that best meet the unique needs of their individual circumstances.

36.2.7 Communications

As with every process, there is a communications expectation which in the past may have been ad hoc but is outlined in the definitions in a RACI model below:

Responsible: The individual(s) or group(s) who actually complete the task. The degree of responsibility is defined by the accountable person. Responsibilities can be assigned to more than one individual or group (i.e., shared). Are involved in two-way communications.

Accountable: “The buck stops here.”—The individual or groups who are ultimately answerable for decisions made and outcomes achieved. Includes yes/no and power of veto. Only one “A” can be assigned to any task. Are involved in two-way communications.

Consulted: “In the loop.”—The individual(s) or group(s), often SMEs, that act as counsel and who may be consulted in decisions or actions being taken. Usually are involved in two-way communications.

Informed: “Keep in the picture.”—The individual(s) or group(s) who need to be informed after a decision is made. Usually only involved in one-way communications.

The RACI model helps ensure that the project information is continually transferred between employees that are involved and across multiple levels. Communication can be formal as written reports or informal such as tailgate meetings but need to follow procedures that are referenced in the applicable F-IMP program and SOP procedures. Those that are responsible have others to help such as supervisors, analysts, planners, technicians, specialists, engineers, etc. and these all need to be included for smooth information flow and awareness of how the information flows to each. These one- and two-way communication flows ensure successful, timely executions of F-IMP related activities. All those involved in such activities (and replacements) need to have their roles defined in terms of their individual RACI roles to best maintain understanding of what is expected of them and to prevent overlapping roles which can lead to duplicative or even contradictory efforts/outcomes.

36.3.1 Where to Start?

Once the F-IMP’s scope, goals, and elements have been established, it is possible to start slotting the existing company processes into the framework thus creating a draft F-IMP. Evaluation of the draft will identify and begin to close gaps. As discussed in Section 36.2.2, the setting of measurable goals is important for guiding the future evolution of the F-IMP. If outcomes are not meeting goals, then that will suggest concrete areas for improvement.

In addition to evaluating whether F-IMP goals are being met, the analysis of maintenance and failure records will help establish priority locations that will likely address 80% of the possible future failure sites. Risk assessment will then allow prioritization of those sites and the equipment within them which are to be targeted for the execution of F-IMP related activities. This will create a prioritized plan for implementation and iterative improvement of the F-IMP.

The following series of steps to can be used to construct such plan:

• Study the facility drawings, including the design of the facility. These design parameters are essential in predicting where problems and hazards may be expected.
  
• Review the mass flow as material moves in and out of the system and other parameters for weak points.
  
• Produce a comprehensive inspection program.

Many facilities will already have in place inspection, operation, and maintenance plans that have been developed over time to address incidents. Incorporating these are critical as these help in identifying threats that may not be readily apparent in a desktop exercise.

• Walk the site to validate details in the inspection program.

For pipeline operators with a geographically wide footprint and facilities of many eras and ages, establishing and attaining the minimum records requirements for the piping and equipment that are covered by the F-IMP and having a secure and accurate repository of this information is an important part of this step.

• Supply an inspection plan overview, with essential inspection protocols, and procedures including setting maximum deterioration limits, requiring safe prevention and mitigation responses, with expected maximum intervals.
  
• Inspect to measure and develop a baseline survey of the facility.

As with the requirements for minimum and accurate static data about the facility, a secure and usable repository for inspection data is also critical. This data will often come in via inspection reports which have some quantitative data but also qualitative data about the condition of the facility or its equipment. Achieving a measure of consistent reporting of this information early in the development of the F-IMP will reduce uncertainty and aid in analysis of data trends as the plan becomes more mature. These feed the PDCA cycle that is critical to a long-term reduction in incidents.

36.3.2 Continuous Improvement

API 581 and ASME PCC-3 describe RBI, and it is used in many facilities to inspect and measure, evaluate, and then help decide how to monitor or repair any large damage before it becomes a safety problem. A good system-based approach will attempt to include in the inspection plan the principles found in the simple PDCA continuous improvement circle principle illustrated in Figure 36.3.

These four actions form a continuous circle and each trip around the loop drives the risk ever down toward the goal of no leaks and ruptures. This system-based PDCA approach underlies most plans and provides continuous improvement of the F-IMP.

PCC-3 addresses many generic varieties of facilities such as rotating equipment, pumps, and compressors. It suggests inspection approaches for RBI programs. Rotating equipment generally includes the monitoring and detection of excess vibration and includes processes to detect accelerated wear by monitoring/analysis of suspended particulates in the lubrication systems. Similarly, not all connections are welded. In many cases, flanges are used to join sections of fabricated piping or components. Inspection includes monitoring that the bolting sequence and bolt torque, for the range of compressed gasket materials are followed. If these steps were done poorly, the flanges become more probable sources of future leaks. Valves, pressure controls, pressure reliefs, and other mechanical systems and associated electronic controls provide safety but can also become a potential source of leaks if not inspected and maintained regularly to work properly.

The incoming product sometimes contains gas and solid impurities and condensed water that need to be removed before compression/pumping. Internal corrosion threats are discussed in this Handbook in Part VII, “Threats to Integrity and Safety,” and protection and mitigation against threats are discussed in Part VIII, “Protection.” Treatment requires chemical conditioning technologies to remove water, CO₂, H₂S, and other corrosive/erosive impurities. These pressurized reaction vessel facilities can be tall structures that consist of counter flow towers, absorption chambers, or other chemical processes to remove water, sour gas, and other harmful impurities. These chemicals are fed by pressurized headers into the absorption chambers counter current to the incoming product. The cleaner product streams back into the pipeline system to be pumped downstream, while the chemical reagent is collected for recycling. Any chemical processes used for product conditioning such as the removal of water and H₂S are not pipe but follow pressure vessel designs using similar codes and standards. When using other pressure containment design standards, including those for bolted connections, the same risk-based principles found in B31.8S or PCC-3 can be consistently applied.

API 579/ASME FFS-l Fitness for Service 2021

Repair Criteria—FFS assessment is a multidisciplinary engineering approach that is used to determine if equipment may continue operation for some desired future period. The equipment may contain flaws, have sustained damage, or have aged so that it cannot be evaluated by use of the original construction codes. API 579-1/ASME FFS-1 is a comprehensive, consensus, industry recommended practice, that can be used to analyze, evaluate, and monitor equipment for continued operation. The main types of equipment covered by this standard are pressure vessels, piping, and tanks.

API 580 Recommended Practice for Risk-Based Inspection 2020

Risk Based Inspection API Recommended Practice 580 provides users with the basic elements for developing, implementing, and maintaining an RBI program. It provides guidance to owners, operators, and designers of pressure-containing equipment for developing and implementing an inspection program. These guidelines include means for assessing an inspection program and its plan. The approach emphasizes safe and reliable operation through risk-prioritized inspection. A spectrum of complementary risk analysis approaches (qualitative through fully quantitative) can be considered part of the inspection planning process. RBI guideline issues covered include an introduction to the concepts and principles of RBI for risk management; and individual sections that describe the steps in applying these principles within the framework of the RBI process.

Increasing failure rates, combined with pressures in meeting regulatory and corporate compliance (safety, environmental, and business), are causing the refining and petrochemical sectors, to place an increased emphasis on enhancing RBI.

This API standard contains the basic concepts of risk assessment typically targeted within a fence perimeter. There is a threat assessment process, a consequence assessment, and a plan to manage risk through inspection and mitigation. There are three main approaches:

1. Simplified adjustment factor, which is less data intensive.
   
2. Reliability relies on inspection, design, materials, and operating data.
   
3. Appendix C provides a workbook for quantitative RBI analysis.

This document is a supplement to API 510 Pressure Vessel Inspection, API RP570 Piping Inspection, and API RP653 Tank Inspection Repair Alteration. Qualitative risk analysis for facilities is analogous to system-wide qualitative risk assessment of pipeline assets, while quantitative risk analysis supports optimization of risk mitigation through risk sensitivity studies and cost–benefit analysis.

API 581 Base Resource Document on RBI 2020 Risk-Based Inspection

This document is typical for refining and petrochemical plants. It is very detailed and descriptive. It details the procedures and methodology in RBI. RBI is an integrated methodology that uses risk as a basis for prioritizing and managing an in-service equipment inspection program by combining both the LOF and the COF. Utilizing the output of the RBI, the user can design an inspection program that manages or maintains the risk of equipment failures. The following are three major goals of the RBI program:

• Provide the capability to define and quantify the risk of process equipment failure, creating an effective tool for managing many of the important elements of a process plant.
  
• Allow management to review safety, environmental, and business-interruption risks in an integrated, cost-effective manner.
  
• Systematically reduce the likelihood and consequence of failure by allocating monitoring and inspection resources to high-risk equipment.

The RBI methodology provides the basis for managing risk, by making informed decisions on the inspection method, coverage required and frequency of inspections. In most plants, a large percent of the total unit risk will be concentrated in a relatively small percent of the equipment items. These potential high-risk components may require greater attention, perhaps through a revised inspection plan. With an RBI program in place, inspections will continue to be conducted as defined in existing working documents but priorities and frequencies will be guided by the RBI procedure. The RBI analysis looks not only at inspection, equipment design, and maintenance records but also at numerous process safety management issues and all other significant issues that can affect the overall mechanical integrity and safety of a process unit.

The API RBI procedure has three levels of analysis:

• Level I: screening tool that quickly highlights the high-risk equipment, which users may wish to assess in greater detail.
  
• Level II: a step closer to being a quantitative analysis than Level I, and it is a scaled down approach of Level III. Provides most of the benefit of Level III analysis, but it requires less input than Level III.
  
• Level III: quantitative approach to RBI providing the most detailed analysis of the three levels.

An API 581 assessment helps operators:

• Evaluate current inspection plans to determine priorities for inspections.
  
• Evaluate future plans for decision-making.
  
• Evaluate changes to basic operations as they affect equipment integrity.
  
• Identify critical contributors to risk that may otherwise be overlooked.
  
• Establish economic optimum levels of inspection as weighed against risk reduction.
  
• Incorporate “acceptable risk” levels.

API 650 Welded Tanks for Oil Storage 2020

API 653 Tank Inspection Repair, Alteration, and Reconstruction 2020

API 754 Process Safety Leading and Lagging Metrics 2011

This document describes the recommendations assembled by the Center for Chemical Process Safety (CCPS) Process Safety Metric committee for a common set of company and industry leading and lagging metrics.

API 1160 API Managing System Integrity for Hazardous Liquid Pipelines 2019

API 1188 Integrity Management of Facilities 2022

This standard provides initial guidance on a comprehensive hazard analysis to develop high consequence area (HCA) impacts [an expansion on unusually sensitive areas (USAs)]. The standard contains suggestions for data integration by using alternate referencing technologies for correlating maps with facilities drawings, products used, materials, design, and construction records, operational data, historical inspections, and maintenance records and near miss and incident reports and locating then finding and filling recognized gaps. Threat identification comes from visual and other inspections, historical reports, and local knowledge of time-dependent and time-independent threats for the nine prescriptive threats with erosion/corrosion broken out as a tenth. Risk assessment requires product of the LOF and COF after a threat scenario analysis to assure applicability. Various risk quantification methodologies are suggested from relative to qualitative to quantitative/probabilistic comparisons. A heat map is suggested to help organize the data presentation. To help risk-based decision-making, it introduces the concepts of as low as reasonably practicable (ALARP) or major accident hazard (MAH) investigations into the what if scenarios. Bow-tie constructions are introduced. These analysis tools and methods provide outputs used in decision making.

Inspection methods are discussed for gathering additional information and filling monitoring/reinspection needs. These records help decide if the prevention and mitigation decisions for both LOF and COF are performing as expected, including smaller consequences due to leaks. A good program evaluation and continuous improvement process provides solid guidance including self-audits, tracking, and trending for individual sections. It would be strengthened with the addition of guidance on developing a communications plan, a management of change plan, and an overall quality control plan.

ASME B31.4 Pipeline Transportation Systems for Liquids and Slurries 2019

ASME B31.8 Gas Transmission and Distribution Piping Systems 2020

ASME B31.8 S Managing System Integrity of Gas Pipelines 2020

ASME PCC 2 Repair of Pressure Equipment and Piping 2018

This standard provides methods for repair of equipment and piping within the scope of ASME Pressure Technology Codes and Standards after it has been placed in service. These repair methods include relevant design, fabrication, examination, and testing practices and may be temporary or permanent, depending on the circumstances. The methods provided in this standard address the repair of components, when repair is deemed necessary, based on appropriate inspection and flaw assessment. These inspection and flaw evaluation methods are not covered in this document but are covered in other postconstruction codes and standards.

ASME PCC-3 Inspection Planning Using Risk-Based Methods 2022

This provides the most general guidance and there are selections for different facilities. The document provides guidance to owners, operators, and designers of pressure-containing equipment for developing and implementing an inspection program. These guidelines include means for assessing an RBI program and its plan. The approach emphasizes safe and reliable operation through cost-effective inspection. A spectrum of complimentary risk analysis approaches (qualitative through fully quantitative) should be considered part of the inspection planning process.

Many operators already have facility integrity plans developed from guidance in API 580, API 581, and/or ASME PCC-3, all for RBI/methods. F-IMP incorporates and/or builds on these existing company processes for maintaining its process equipment. The key components remain the same as API 1188 but again are detailed differently:

1. Program scope
   
2. Corporate policies, goals, goals
   
3. Description of facilities
   
4. Records and data
   
5. Change management
   
6. Competency and training
   
7. Hazard identification and control
   
8. Risk assessment
   
9. Facilities Integrity Management Program (F-IMP) program planning
   
10. Evaluation of inspection, testing, patrols, and monitoring
    
11. Mitigation and repair
    
12. Continual improvement
    
13. Incident investigations.

Additional threats more common inside a facility will be related to fatigue and mechanical connections such as flange and threaded connection tightening and the potential for loosening during operation.

49CFR192

Code of Federal Regulations Part 192—Transportation of Natural and Other Gas by Pipeline: Minimum Federal Safety Standards prescribes the minimum safety requirements for pipeline facilities and the transportation of gas, including pipeline facilities in the United States. It includes by reference many of the documents discussed in this chapter.

49CFR195

Code of Federal Regulations Part 152—Transportation of Hazardous Liquids by Pipeline prescribes the safety standards and reporting requirements for pipeline facilities used in the transportation of hazardous liquids or carbon dioxide in the United States. It includes by reference many of the documents discussed in this chapter.