DNV RP-G101 Risk Based Inspection

RECOMMENDED PRACTICE DNV-RP-G101

RISK BASED INSPECTION OF OFFSHORE TOPSIDES STATIC MECHANICAL EQUIPMENT JANUARY 2002

DET NORSKE VERITAS

FOREWORD DET NORSKE VERITAS (DNV) is an autonomous and independent foundation with the objectives of safeguarding life, property and the environment, at sea and onshore. DNV undertakes classification, certification, and other verification and consultancy services relating to quality of ships, offshore units and installations, and onshore industries worldwide, and carries out research in relation to these functions. DNV Offshore Codes consist of a three level hierarchy of documents: — Offshore Service Specifications. Provide principles and procedures of DNV classification, certification, verification and consultancy services. — Offshore Standards. Provide technical provisions and acceptance criteria for general use by the offshore industry as well as the technical basis for DNV offshore services. — Recommended Practices. Provide proven technology and sound engineering practice as well as guidance for the higher level Offshore Service Specifications and Offshore Standards. DNV Offshore Codes are offered within the following areas: A) Qualification, Quality and Safety Methodology B) Materials Technology C) Structures D) Systems E) Special Facilities F) Pipelines and Risers G) Asset Operation

Comments may be sent by e-mail to [email protected] For subscription orders or information about subscription terms, please use [email protected] Comprehensive information about DNV services, research and publications can be found at http://www.dnv.com, or can be obtained from DNV, Veritasveien 1, N-1322 Høvik, Norway; Tel +47 67 57 99 00, Fax +47 67 57 99 11.

© Det Norske Veritas. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, including photocopying and recording, without the prior written consent of Det Norske Veritas. Computer Typesetting (FM+SGML) by Det Norske Veritas. Printed in Norway by GCS AS.

If any person suffers loss or damage which is proved to have been caused by any negligent act or omission of Det Norske Veritas, then Det Norske Veritas shall pay compensation to such person for his proved direct loss or damage. However, the compensation shall not exceed an amount equal to ten times the fee charged for the service in question, provided that the maximum compensation shall never exceed USD 2 million. In this provision "Det Norske Veritas" shall mean the Foundation Det Norske Veritas as well as all its subsidiaries, directors, officers, employees, agents and any other acting on behalf of Det Norske Veritas.

Recommended Practice DNV-RP-G101, January 2002 Page 3

CONTENTS 1.

GENERAL .............................................................. 5

1.1

Objective of this document .....................................5

1.2

Application ...............................................................5

1.3

Limitations ...............................................................5

1.4

Relationship to other codes and standards ...........5

1.5

Definitions, symbols and abbreviations.................5

1.5.1 1.5.2

Definitions of terms ............................................................ 6 Abbreviations...................................................................... 7

2.

REFERENCES ....................................................... 7

3.

RISK BASED INSPECTION CONCEPT ........... 8

3.1

Risk management ....................................................8

3.2

Inspection management ..........................................8

3.3

Fabrication inspection and in-service inspection .8

3.4

RBI team competence .............................................8

4.

RISK TERMINOLOGY AND PRESENTATION. ...................................................................................9

4.1

General .....................................................................9

4.2

Risk ...........................................................................9

4.2.1 4.2.2 4.2.3

Risk definition .................................................................... 9 Risk acceptance criteria ...................................................... 9 Risk presentation ................................................................ 9

4.3

Qualitative and quantitative RBI...........................9

4.4

Probability of failure .............................................10

4.4.1 4.4.2 4.4.3

Probability of failure definition ........................................ 10 Probability of failure presentation .................................... 10 Probability of failure modelling........................................ 10

7. 7.1 7.2 7.3 7.4

DETAILED ASSESSMENT ............................... 13 Objective ................................................................ 13 General................................................................... 13 Detailed RBI: Analysis detail level ...................... 13 Consequence of failure modelling........................ 14

7.4.1 7.4.2 7.4.3 7.4.4 7.4.5

Objective........................................................................... 14 Working process ............................................................... 14 Establish the event tree ..................................................... 15 Ignited consequences........................................................ 15 Unignited consequences ................................................... 15

7.5

Probability of failure modelling........................... 16

7.5.1 7.5.2 7.5.3 7.5.4 7.5.5 7.5.6 7.5.7 7.5.8 7.5.9 7.5.10 7.5.11

Objective........................................................................... 16 Working process ............................................................... 16 Probability of failure acceptance limit.............................. 16 Allocation of degradation mechanisms ............................ 16 Internal damage – systems/service/materials ................... 16 External damage ............................................................... 17 Mechanical damage .......................................................... 17 Lower limit on calculation of PoF.................................... 17 Insignificant model ........................................................... 17 Susceptibility model ......................................................... 17 Rate model........................................................................ 17

7.6 7.7 7.8 7.9

Leak hole size......................................................... 18 Estimation of risk .................................................. 18 Reporting of the assessment ................................. 19 Revision of assessment with new information .... 19

8. 8.1 8.2 8.3 8.4

USE OF INSPECTION AND MONITORING . 19 Use of inspection results ....................................... 19 Validity check for inspection data ....................... 19 Use of corrosion monitoring results .................... 20 Use of process monitoring .................................... 20

9. 9.1 9.2

INSPECTION PLANNING ................................ 20 Inspection scheduling............................................ 20 Inspection procedures........................................... 20 FITNESS FOR SERVICE................................... 21

4.5

Consequence of failure ..........................................10

4.5.1 4.5.2 4.5.3 4.5.4 4.5.5

Consequence of failure definition..................................... 10 Consequence of failure presentation................................. 10 Safety consequence modelling ......................................... 10 Economic consequence modelling ................................... 10 Environmental consequence modelling ............................ 11

5.

WORKING PROCESS ........................................ 11

10.

5.1

Objective.................................................................11

5.2

Outline of the process............................................11

APP. A SCREENING ..................................................................... 22

5.3

Acceptance criteria ................................................11

5.4

Information gathering...........................................11

6.

RISK SCREENING ............................................. 12

6.1

Working process ....................................................12

6.2

Screening team.......................................................12

A.1 A.2 A.3

Guidance for use....................................................... 22 RBI Screening Form................................................. 23 RBI screening briefing ............................................. 24

A.3.1 Consequence of failure....................................................... 24 A.3.2 Probability of failure .......................................................... 24

APP. B CONSEQUENCE OF FAILURE EVALUATION......... 25

6.3

Consequence of failure evaluation .......................12

6.3.1 6.3.2 6.3.3 6.3.4

Safety consequence........................................................... 12 Economic consequence..................................................... 12 Environmental consequence ............................................. 12 Other consequences .......................................................... 12

B.1 B.2 B.3 B.4

6.4

Probability of failure evaluation ..........................12

6.4.1 6.4.2 6.4.3 6.4.4

Probability of failure – internal......................................... 13 Probability of failure - external......................................... 13 Probability of failure - fatigue .......................................... 13 Probability of failure - other ............................................. 13

B.4.1 General ............................................................................... 25 B.4.2 Steps in consequence assessment....................................... 25 B.4.3 Use of Event Trees ............................................................. 26

6.5

Risk assessment......................................................13

6.6

Results of Screening ..............................................13

6.7

Revision of screening.............................................13

B.5 B.6 B.7 B.8

General ..................................................................... Introduction .............................................................. Use of QRA data ...................................................... Method of overview .................................................

System description ................................................... Mass leak rates for gas and oil ................................. Dispersion modelling ............................................... Effect assessment of flammable releases .................

25 25 25 25

26 26 27 27

B.8.1 Calculation method ............................................................ 27 B.8.2 Step 1: Development of an event tree ................................ 27 B.8.3 Step 2: Event tree branch probabilities .............................. 28

DET NORSKE VERITAS


B.8.4 Step 3: Consequence of failure for end events ................... 29 B.8.5 Steps 4 and 5: Total consequence of failure ....................... 31

B.9

Assessment of the effect of Toxic releases ............. 31

B.9.1 General ............................................................................... 31 B.9.2 Asphyxiating fluids ............................................................ 31 B.9.3 Hydrogen sulphide.............................................................. 31

B.10 References ................................................................ 32 APP. C PRODUCT SERVICE CODES, MATERIALS DEGRADATION AND DAMAGE MECHANISMS ..... 33 C.1 C.2 C.3 C.4 C.5 C.6

Introduction .............................................................. Internal degradation.................................................. External degradation................................................. Materials definition .................................................. Product service code definition ................................ Degradation mechanisms and damage modelling ....

33 33 33 33 34 36

C.6.1 C.6.2 C.6.3 C.6.4

Steps in modelling .............................................................. 36 Degradation mechanisms - hydrocarbon systems .............. 36 Degradation mechanisms - water systems.......................... 38 Degradation mechanisms - chemicals ................................ 41

C.6.5 C.6.6 C.6.7 C.6.8 C.6.9 C.6.10

Insignificant........................................................................ 41 Unknown ............................................................................ 41 Degradation mechanisms - vent systems............................ 41 Degradation mechanisms water - injection systems........... 41 Degradation mechanisms - external corrosion ................... 41 Fatigue ................................................................................ 44

APP. D INSPECTION PLANNING AND DATA ANALYSIS... 45 D.1

Inspection planning .................................................. 45

D.1.1 Definition of inspection effectiveness ................................ 45 D.1.2 Inspection techniques ......................................................... 45 D.1.3 Damage mechanism and inspection effectiveness ............. 45

D.2

Inspection data analysis ........................................... 50

D.2.1 D.2.2 D.2.3 D.2.4 D.2.5 D.2.6 D.2.7

Grouping of data................................................................. 50 Data quality checks ............................................................ 50 Degradation mechanisms/morphology............................... 50 Inspection method .............................................................. 50 Corrosion monitoring data.................................................. 50 Statistical evaluation of data............................................... 50 Application of mata between corrosion circuits................. 50

DET NORSKE VERITAS


1. General

— pump casings — compressor casings.

1.1 Objective of this document The objective of this recommended practice is to describe a method by which a risk based inspection (RBI) plan may be established for offshore production systems. The document outlines methods for evaluating probability and consequence of failure, making an assessment of the risk level, and concluding on the appropriate actions such as inspection that can be taken to manage that risk. These activities have been carried out by inspection engineers for many years, and this document therefore describes a quantification and systematisation of working methods rather than a new process. It should be noted that RBI is an inspection planning tool. The reasons for selecting a risk based approach to inspection planning are: — to focus inspection effort on items where the safety, economic or environmental risks are identified as being high, whilst similarly reducing the effort applied to low risk systems — to ensure that the overall installation risk does not exceed the risk acceptance criteria, set by the operator, at any time — to identify the optimal inspection or monitoring methods according to the identified degradation mechanisms. The RBI assessment should assess all relevant degradation mechanisms. This document addresses the most commonly experienced degradation mechanisms found on offshore installations, but the user should make themselves aware of any special circumstances that are relevant to an individual installation and that are not included in this recommended practice. These special circumstances must be treated separately.

1.2 Application This recommended practice is primarily intended used for the planning of in-service inspection for offshore topsides static mechanical pressure systems when considering failures by loss of containment of the pressure envelope. The system boundaries for applicability of the methods are the Christmas tree wing valve through to the export pipeline topsides ESD valve. These systems involve the following types of components: — piping systems comprising straight pipe, bends, elbows, tees, fittings, reducers — pressure vessels and atmospheric tanks — pig launchers and receivers — heat exchangers — unfired reboilers — valves

1.3 Limitations Excluded from the scope of the recommended practice are: — — — — —

structural items including supports, skirts and saddles seals, gaskets, flanged connections plate and compact-type heat exchangers failure of internal components and fittings instrumentation.

Failure modes, such as failure to operate on demand, leakage through gaskets, flanged connections, valve stem packing, together with valve passing and tube clogging are not addressed in this document. The probability of such failures is not expected to be affected by inspection, and so should be addressed as a part of a reliability centred maintenance (RCM) assessment of the systems. Note that the consequences of failure determined using this recommended practice can be useful in such RCM analyses.

1.4 Relationship to other codes and standards Risk based inspection methods and applications are described in documents prepared by ASME and API /1/2/. Inspection planning and execution standards and recommended practices are published by ASME. There are a number of design codes covering pressurised piping, vessels and heat exchangers, and these should be sought where needed. A number of codes have also been developed regarding the assessment of fitness-for-service and remaining life, and these may be used to justify continued service when damage is found during inspection. It should be noted that the use of risk-based principles acknowledges explicitly that it is cost-effective to allow some systems to fail as long as the consequences of that failure are low. This also implies that some systems may have such high consequences of failure that failure is wholly unacceptable, and therefore these should receive most attention. This principle challenges some accepted design codes based on deterministic design and fitness-for-service codes, particularly where worst-case scenarios are used in the calculations. It is likely that a discrepancy in the requirements for inspection and remedial action will arise if risk-based and deterministic methods are directly compared.

1.5 Definitions, symbols and abbreviations The following terms are used in this document with the specific definitions as listed in 1.5.1 and 1.5.2.

DET NORSKE VERITAS


1.5.1 Definitions of terms Term Component

Condition Monitoring

Confidence CoV

Consequence of failure (CoF) Consequence of failure ranking Consequence of failure type Corrosion Group

Coefficient of Variation (CoV)

Damage (type)

Damage model

Damage rate Degradation Degradation mechanism

Definition The individual parts that are used to construct a piping system or item of equipment, such as nozzles, flanges, elbows, straight pieces of pipe, tubes, shells, and similar. Monitoring of plant physical conditions which may indicate the operation of given degradation mechanisms. Examples are visual examination of painting, corrosion monitoring, crack monitoring, wall thickness monitoring. A quantitative description of the uncertainty in the data used in analyses, indicating the spread in the distribution of values. A data set in which the assessor has high confidence can be given a low CoV. The outcomes of a failure. This may be expressed, for example, in terms of safety to personnel, economic loss, damage to the environment. A qualitative statement of the consequence of failure. Often expressed as a textual description (High, medium, low) or numerical rank (1, 2, 3). The description of consequences of failure expressed as safety, environment or economic consequence. A group of components or parts of components that are exposed to the same internal and/or external environment and made of the same material, thus having the same potential degradation mechanisms. Groups should be defined such that inspection results made on one part of the group can be related to all the parts of the same group. The CoV indicates the spread of a distribution. The greater the CoV the greater the distribution is spread and therefore the greater the uncertainty in any value within that distribution. CoV is calculated as the standard deviation of a distribution divided by the mean value of that distribution. The observed effect on a component of the action of a degradation mechanism. The damage type gives rise to the failure mechanism of a component. Examples of damage include cracking, uniform wall thinning, and pitting. A mathematical and/or heuristic representation of the results of degradation. This may express the accumulation of damage over time as functions of physical or chemical parameters, and normally includes the estimation of the conditions that give rise to failure. The development of damage over time. The reduction of a component’s ability to carry out its function. The means by which a component degrades. Degradation mechanisms, may be chemical or physical in nature, and may be time or event driven. The degradation mechanisms covered by this recommended practice are: — — — —

internal and external corrosion sand erosion fatigue stress corrosion cracking.

Term Economic risk

Environmental risk

Equipment

ESD segment Failure

Failure mechanism

Failure mode Fatal Accident Rate (FAR) Hot spot

Inspection

Inspection effectiveness Inspection methods Inspection programme Inspection plan

Inspection techniques

Limit state

DET NORSKE VERITAS

Definition An expression of the occurrence and outcome of a failure given in financial terms, with units of (currency per year). This is calculated as the product of the probability of failure and the financial consequences of that failure, and can include (but is not limited to) the value of deferred production, the cost of repairs to equipment and structure, materials and man-time used in repair. An expression of the occurrence and outcome of a failure given in terms relevant to environmental damage. This may be expressed in units relevant to the installation, such as volume per year or currency per year. Equipment carries out a process function on offshore topsides that is not limited to transport of a medium from one place to another, and therefore comprises but is not limited to: pressure vessels, heat exchangers, pumps, valves, filters. See ‘Segment’. The point at which a component ceases to fulfil its function and the limits placed on it. The failure condition must be clearly defined in its relationship to the component. Failure can be expressed, for example, in terms of non-compliance with design codes, or exceedance of a set risk limit, neither of which necessarily imply leakage. The means by which a component fails due to the progression of damage beyond the set limits imposed by the operator (such as a risk acceptance limit) or by physical limits such as a breach of the component wall. The method by which failure occurs. Examples are: Brittle fracture, plastic collapse and pinhole leak. Potential loss of life per 100 000 000 hours. A location on pipe or equipment where the condition being discussed is expected to be most severe. For example, a ‘hot spot’ for microbial corrosion is an area of stagnant flow. An activity carried out periodically and used to assess the progression of damage in a component. Inspection can be by means of technical instruments (NDT) or as a visual examination. A description of the ability of the inspection method to detect the damage type inspected for. The means by which inspection can be carried out such as visual, ultrasonic, radiographic. A summary of inspection activities mainly used as an overview of inspection activity for several years into the future. Detail of inspection activity giving the precise location, type and timing of activity for each individual inspection action that is planned. A combination of inspection method and the means by which it is to be applied, concerning surface and equipment preparation, execution of inspection with a given method, and area of coverage. A mathematical description where the loss of pressure containment is calculated. This is an expression involving consideration of the magnitude of the applied loading in relation to the ability to resist that load.


Term Limit state design

Definition Limit state design identifies explicitly the different failure modes and provides a specific design check to ensure that failure does not occur. This implies that the component’s capacity is characterised by the actual capacity for each individual failure mode (i.e. limit state) and that the design check is more directly related to the actual failure mechanism. Monitoring An activity carried out over time whereby the amount of damage is not directly measured but is inferred by measurement of factors that affect that damage. An example would be the monitoring of CO2 content in a process stream in relation to CO2 corrosion. NDT Non-destructive testing. Inspection of components using equipment to reveal the defects, such as magnetic particles or ultrasonic methods. Operator The organisation responsible for operation of the installation, and having responsibility for safety and environment. Potential loss of life Potential loss of life is expressed as the (PLL) number of personnel who may lose their lives as a consequence of failure of a component. Probability A quantitative description of the chance of an event occurring within a given period. Probability of Detec- Probability that a given damage in a compotion (PoD) nent will be detected using a given inspection method. PoD usually varies with the size or extent of damage and inspection method. Probability of Fail- The probability that failure of a component ure (PoF) will occur within a defined time period. Probability of failure A comparative listing of probability of failranking ure for one item against another, without reference to an absolute value for probability of failure. Process monitoring Monitoring of process conditions which may give rise to given degradation mechanisms. Examples are monitoring of dew point in a gas line, monitoring temperature, sand monitoring. QRA Quantitative risk assessment: The process of hazard identification followed by numerical evaluation of event consequences and frequencies and their combination into an overall measure of risk. Risk Risk is a measure of possible loss or injury, and is expressed as the product of the incident probability and its consequences. A component may have several associated risk levels depending on the different consequences of failure and the different probabilities of those failures occurring. Risk Based InspecA decision making technique for inspection tion (RBI) planning based on risk – comprising the probability of failure and consequence of failure. Risk type Risk expressed for a specific outcome, such as safety for personnel, economic loss or environmental damage. Safety Risk Risk to personnel safety expressed in terms of potential loss of life (PLL) per year.

Term Segment

System

Tag, tag number Time to failure

Definition A number of components forming part of the same pressure system, consisting of pipes, valves, vessels, etc., which can be automatically closed-in by emergency shut-down valves. The segment defines the maximum volume of fluid or gas that can released from that system in the event of a failure in any of the components. Some segments contain both liquid and gas which may be considered differently regarding consequence effects. Note that it is normal to assume that the ESD isolation functions on demand, but this may not be applicable to all cases. A combination of piping and equipment intended to have the same or similar function within the process. This may be, for example, instrument air supply, or low pressure gas compression. The unique identification of a part, component, pipe or equipment. The duration from a specified point in time until the component suffers failure.

1.5.2 Abbreviations The following abbreviations are used in this document: API ASME ASNT CoF DNV ESD(V) FAR FORM PFD PLL PoD PoF P&ID QRA RBI RCM UFD

American Petroleum Institute American Society for Mechanical Engineers American Society for Non-destructive Testing Consequence of failure Det Norske Veritas Emergency shut down (Valve) Fatal accident rate First order reliability method Process flow diagram Potential loss of life Probability of detection Probability of failure Piping and utilities diagram Quantitative risk analysis Risk based inspection Reliability centred maintenance Utilities flow diagram

2. References /1/

/2/ /3/ /4/ /5/ /6/ /7/ /8/ /9/ /10/ /11/

"Fossil Fuel Fired Electric Power Generating Station Applications, Risk-Based Inspection Development and Guidelines" ASME Research Report, CRTD, Vol. 203. ASME, New York,1994. API 579; Recommended Practice for Fitness-for-Service evaluation. January 2000. API 510; Pressure Vessel Inspection Code; Maintenance Inspection, rating, Repair, and Alteration. 8th ed., January 1999. API 570; Piping Inspection Code; Maintenance Inspection, rating, Repair, and Alternation. 2nd ed., February 2000. API 581, Base Resource Document - Risk Based Inspection, 2nd Edition, May 2000. API 574: Inspection Practices for Piping System Components, 2nd Edition, June 1998 Accidents; DNV Technical report C3560/1. Dow Fire and Explosion Index. Hazard Classification Guide, 6th ed. 1987. Technical Elements of Risk-Informed Inspection Programs for Piping. Draft Report, U.S. Nuclear regulatory Commission. Nureg-1661. OREDA: Offshore Reliability Data Handbook, DNV, 1999. API RP 580 "Risk Based Inspection” 4th draft.

DET NORSKE VERITAS


3. Risk based inspection concept 3.1 Risk management Risk based inspection is based on the premise that the risk of failure can be assessed in relation to a level that is acceptable, and that inspection and repair, or other actions can be used to manage the risk such that it is maintained below that acceptance limit. The risk associated with a failure is calculated as the product of probability of failure and consequence of failure. Probability of failure and consequence of failure are defined in Section 4.4 and Section 4.5 respectively. Probability of failure and consequence of failure can be given either as a ranking (in qualitative RBI) or numerically (in quantitative RBI). A combination of both can be used to quickly focus on components where the risk levels are significant. The design and operation of offshore process systems is usually based on the avoidance of degradation. This is achieved by the combination of materials selection and dimensioning, use of chemicals, coatings and linings. Traditionally, design is based on deterministic principles, where the ’worst case’ combinations of corrosivity and loading are considered in the design basis. Despite this, failures still occur, often as a result of errors in the design, fabrication or operation of the system, or due to changes in the operating conditions that were not foreseen by the designer, with resultant unadvertised failure of corrosion control. Consequently, inspection has been specified in the past to confirm whether the degradation rate is as expected and that integrity can be maintained. The advantage of using risk-based principles over traditional methods is two-fold: 1) Probabilistic methods are used in calculating the extent of degradation and hence allow variations in process parameters, corrosivity, and thus degradation rates, to be accounted for. 2) Consequences of failure are considered, so that attention can be focused where it will have significant effect. One result is that the stipulated risk limit may be met before the end of the deterministic remaining life. This will depend on the uncertainty in the degradation of the component, and the consequence of failure for that component. In other cases the deterministic remaining life may be used up before the risk has approached the acceptance limit. Both cases would indicate that inspection is still required to monitor the process of degradation (as the inputs to the degradation models are often only approximately known), but that the timing of that inspection would be different for the deterministic and probabilistic assessments. The process of estimating consequence of failure can highlight areas where measures can be taken that would reduce these consequences, thereby reducing risk levels. However, this is outside the scope of this recommended practice. Consequence of failure values can also be used to focus attention in areas where the probability of failure estimation is difficult, indicating that alternatives to inspection should be considered to manage risk.

3.2 Inspection management The role of inspection in risk management is to confirm whether degradation is occurring, and to measure the progress of that degradation. This has the effect of reducing uncertainty in the assessment of the condition of the component, thereby reducing the estimated probability of failure. It is emphasised that inspection on its own does not reduce the actual risks of failure, so risk management must include actions to repair or replace components when inspection reveals that the risk is unacceptable.

The objective of RBI is to aid the development of optimised inspection, monitoring and testing plans for production systems. To get the best effect from RBI, inspection planning, execution and evaluation should be a continuous process where information and data from the process and the inspection / maintenance /operation activities are fed back to the planning, as indicated in Figure 3-1. Owner goals Acceptance Criteria

Inspection data evaluation

Consequence of Failure

Analysis of results

Safety, Environment, Assets Loss Inspection and testing Execution & Reporting

Inspection Management Probability of Failure Materials/Environment and Strength

Inspection Plan Inspection details, planning, logistics

Risk Evaluation Inspection Programme

Method, Timing, Coverage, Location, Cost

Figure 3-1 Inspection management process

Optimisation should take account of safety / environmental and economic / financial risks, as well as the inspection costs. It should also be noted that degradation in many corrosion-resistant materials does not progress at a steady rate, but instead initiates and progresses quickly to failure once unfavourable conditions have become established. In addition, some degradation mechanisms give rise to damage that is not readily detected using conventional inspection methods. Consequently, the degradation mechanism and resulting probability of failure can be used to indicate whether process monitoring or maintenance activity is a more cost-effective alternative to inspection.

3.3 Fabrication inspection and in-service inspection The quality control process in fabrication comprises control of materials, components, consumables, fabrication processes and inspection and testing. The extent of fabrication inspection is determined by the fabrication code, which may include a limited consequence assessment when specifying the extent of inspection. The acceptance limit for defects that are detected is based upon the ability of the inspection method to detect that defect type, and the extent of inspection is often adjusted to account for historical experience as to the abilities of fabricators to deliver defect-free work. It must be recognised that not all defects are detected by fabrication inspection, and, although many fabrication defects can be present without causing or contributing to a failure, a number of failures can occur when bringing the system into service. Adoption of a risk-based approach to inspection at the early design stage and carried through commissioning and into service would allow effective targeting of areas where materials verification and cross-check inspection should be carried out. This approach would contribute to optimisation of wholeof-life costs.

3.4 RBI team competence RBI and inspection management requires experienced personnel at all levels as well as appropriate working routines for the execution of the work. There are no formal requirements to the planning function defined in any current standards, although requirements for inspection execution are handled by the inspector qualification schemes, such as those in accordance with ASNT requirements, and the European standard EN 473. It must be understood that RBI analysis and inspection planning is a multidisciplinary activity, and the following qualified and experienced disciplines should be involved:

DET NORSKE VERITAS


— inspection engineers with hands-on experience of inspection of piping, pressure vessels, heat exchangers, both inservice and during construction — materials/corrosion personnel with expertise in materials selection, corrosion monitoring and control, chemical treatments, fitness-for-service assessments, coatings and linings — safety/consequence personnel with experience in formal risk analysis covering personnel safety, economic and environmental disciplines — plant operation (process) and maintenance personnel with detailed knowledge of the installation to be analysed. Due consideration should be given to the wide background collated in such a team; for example, different aspects of the RBI method will appear as ‘obvious’ or ‘difficult’, depending on the individuals previous training and experience.

4. Risk terminology and presentation 4.1 General This chapter defines probability of failure, consequence of failure and risk terms as used in this document, together with what is involved in their estimation. Reporting methods are also given. The following chapters give details of the working process for estimating probability of failure, consequence of failure, risk and the resulting inspection plan.

4.2 Risk 4.2.1 Risk definition The risk associated with failure is defined as the product of probability of failure and consequence of failure. Consequence of failure can be expressed in terms of different outcomes (CoF types), and risk types are defined similarly. The units of risk are the consequence units per unit time. 4.2.2 Risk acceptance criteria Risk acceptance criteria are the limits above which the operator will not tolerate risk on the installation. These criteria must be defined for each type of risk to be assessed. The risk acceptance criteria are used to derive the timing of inspection, such that inspection is carried out prior to the acceptance limit being breached. This would allow either the reassessment of the risk level based upon better information, detailed evaluation of any damage, or the timely repair or replacement of the degraded component. Derivation of risk acceptance criteria is described in Section 5.3. 4.2.3 Risk presentation Risk is most conveniently presented as a matrix. This allows the relative contribution of both factors to be seen. Separate matrices for each risk type are required. The matrix should be standardised for each operator/field in order to simplify communication and the decision process. To achieve adequate resolution of detail, a 5 x 5 matrix is recommended as shown in Figure 4-1.

CAT 5 4 3 2 1

ANNUAL PROBABILITY OF FAILURE > 10-2 expected failure 10-3-10-2 high 10-4 to 10-3 medium 10-5 to 10-4 low < 10-5 virtually nil Consequence Category Consequence of Failure

A

B

C

D

E

Figure 4-1 Example of risk matrix

The matrix has probability of failure on the vertical axis, and consequence of failure on the horizontal. The divisions between the categories of each should be chosen taking into consideration the absolute magnitude of the values, their ranges, and the need for consistent reporting when comparing different installations. The matrix scales should be as described in sections 4.4.2 and 4.5.2 of this recommended practice.

4.3 Qualitative and quantitative RBI Qualitative or quantitative RBI are the extremes at which RBI can be carried out, and the definition and advantages of each are given below. In practice the distinction is not so clear cut, and most RBI is a blend of both. 1) Qualitative: A numerical value is not assigned, but instead a descriptive ranking is given, such as low, medium or high, or a numerical ranking such as 1, 2 or 3. Qualitative ranking is usually the result of using a judgement-based approach to the assessment. 2) Quantitative: A numerical value is calculated with units of measurement. Quantitative values can be expressed and displayed in qualitative terms for simplicity by assigning bands for probability of failure and consequence of failure, and assigning risk values to risk ranks. The advantage of using a qualitative approach is that the assessment can be completed quickly and at low initial cost, there is little need for detailed information, and the results are easily presented and understood. However, the results are subjective, based on the opinions and experience of the RBI team, and are not easily updated following inspection. It is not easy to obtain results other than a ranking of items in terms of risk; the variation of risk with time allowing estimation of inspection interval based on the risk acceptance limit is not possible. An example of qualitative RBI is the screening method, (albeit with quantitative risk criteria) described in Chapter 6 of this recommended practice, which is used to quickly assign high, medium or low risk levels. The advantage of the quantitative approach is that the results can be used to calculate with some precision, when the risk acceptance limit will be breached. The method is systematic, consistent and documented, and lends itself to easy updating based on inspection findings. The quantitative approach typically involves the use of a computer to calculate the risk and the inspection programme. This can be initially data-intensive, but removes much repetitive detailed work from the traditional inspection planning process. An example of largely quantitative RBI is the method described in Chapter 7, which is used to calculate risk levels in a consistent manner.

DET NORSKE VERITAS


4.4 Probability of failure

PoF

4.4.1 Probability of failure definition Probability of Failure (PoF) is estimated on the basis of the component degradation. PoF is related to the extent of, and uncertainty in, the degradation related to the component’s resistance to its loading. PoF is the probability of an event occurring per unit time (e.g. annual probability). 4.4.2 Probability of failure presentation Quantitative probability of failure values have a wide range from zero to unity, and therefore a logarithmic scale is recommended for displaying the results graphically. The recommended probability of failure scale used in the context of this recommended practice is as shown in Table 4-1. The table also shows the recommended qualitative ranking scale assigned to the quantitative probability of failure values.

1.0

Rate Ratemodel model

Insignificant Insignificant

10 -5

Now

Time Susceptibility Susceptibility

Figure 4-2 Schematic of degradation modelling

4.5 Consequence of failure Table 4-1 Probability of failure description Annual failure probability Cat Description Quantitative Qualitative In a small population, one or failure expect- more failures can be expect5 > 10-2 ed ed annually In a large population, one or 4 10-3 to 10-2 high more failures can be expected annually In a small population, one or more failures can be expectmedium 3 10-4 to 10-3 ed over the lifetime of the installation In a large population, one or more failures can be expect2 10-5 to 10-4 low ed over the lifetime of the installation 1 < 10-5 negligible Failure is not expected.

In the above table, a ’small population’ comprises in the order of 20 to 50 components, a ‘large population’ 200 to 500 components. 4.4.3 Probability of failure modelling Degradation models describe the damage incurred by a component. A number of models and their application to the estimation of probability of failure are described in Appendix C. These models have been classified with the following descriptions as shown schematically in Figure 4-2. — Rate model. Damage accumulates over time. This model is usually amenable to inspection as the relatively low damage rate often allows for a number of inspections before failure. — Susceptibility model. Damage occurs very quickly after a delay of unknown duration, and is triggered by an external event. This is not amenable to inspection, but instead monitoring of the key controlling parameter(s) is recommended. — Insignificant model. No degradation is expected for the component.

4.5.1 Consequence of failure definition Consequence of failure is evaluated as the outcome of a failure based on the assumption that such a failure will occur. Consequence of failure is defined for all consequences that are of importance to the operator, such as safety, economy and environment. Each should be assessed separately giving due account to cases where leaks result in a fire or explosion (i.e. ignited leak) and those that do not (i.e. non-ignited leak). 4.5.2 Consequence of failure presentation Consequence of failure values or rankings should be presented separately depending on the consequence type. Safety consequence should be expressed in terms of potential loss of life (PLL) for personnel. Economic consequence should be expressed in financial terms using appropriate currency units. Environmental consequences can be expressed in terms of mass or volume of a pollutant released to the environment, or in financial terms as the cost of cleaning up the spill, including consideration of fines and other compensation. The consequence scale used in matrices and other presentations is necessarily different for PLL and currency, and should be selected to account for the full range of values. For consistency of approach, consideration should be given to adopting a harmonised scale for all installations located in one field, or owned by one operator. The consequence of failure scale should advance in decades for each category, where the lowest category includes values up to the risk acceptance limit assuming that probability of failure ≈ 1.0. 4.5.3 Safety consequence modelling The evaluation of safety consequences comprise an estimation of the consequences to the safety of personnel on the installation. For the purposes of RBI this should be expressed in terms of PLL given that a leak will occur. Safety consequence is usually estimated for failures that lead to fire, explosion or toxic release, with the effects of escalation included in the assessment. Failure of components containing any high pressure gases or fluids should also be considered. When estimating safety consequence, the changes in manning levels that occur as a result of different phases of operation must be considered. 4.5.4 Economic consequence modelling The economic consequences of failure are calculated as the sum of the cost of repairs to equipment and structures damaged as a result of the failed component and the cost of production down-time.

DET NORSKE VERITAS


When considering the cost of production down-time, the individual conditions for the installation and system should be considered. Some systems have little or no effect on production, or have at least a partial redundancy in capacity. Similarly, some installations are not required to produce continuously or have spare capacity that can be substituted. Oilfield economics using discounted cash flows and assigned financial expectations to an installation, usually imply that production deferred means production ‘lost’. The cost of repairs to the installation and equipment onboard shall also be considered, covering material cost, fabrication, installation and commissioning of the replacement equipment 4.5.5 Environmental consequence modelling The evaluation of environmental consequence includes both short term (cleanup) and long-term effects both globally and locally. Environmental issues may receive very high media attention that can affect an operator more than the ‘real’ value of the damage caused, so this should be given consideration in the evaluation. An environmental assessment for RBI is intended as a simplified and rational approach to include the effect within inspection planning and is not a substitute for a more thorough environmental analysis required by authorities.

tenance. High risk items will require a more detailed evaluation which is the subject of the second stage. 2) Detailed quantitative analysis with methods that can be applied at various level as considered appropriate for any given case; e.g. ranging from utilisation of generalised data for an entire system, to the specific evaluation of individual, parts or inspection points. The approach is also adaptable to cases where judgement must be used if controlling factors are not well defined. The methods employed in these step are given in Chapter 7, included guidance to selecting a suitable detailed level for analysis. This analysis provides a full inspection plan including inspection methods, and timings, that is readily updated as inspection data becomes available. Develop and agree risk acceptance criteria (Chapter 5.3)

Gather information (Chapter 5.4)

Carry out screening (Chapter 6)

Risk level Medium / Low

Risk level High

Maintenance actions

Yes

Adequate data available for detailed analysis?

No

PoF model available?

No

Set PoF to cat 5 & calculate CoF or Set CoF to cat E and calculate PoF

The definition of the units (financial, volumetric) for environmental consequence will depend on the operator’s philosophy and acceptance criteria. As a general principle, leaks arising from topsides process systems, either gas or oil, are considered to represent a minor threat to the environment due to the limited volume of hydrocarbons that can be released. However, releases from flowlines (live crude), drilling activities, and from storage vessels or tanks represent a larger problem, as the enclosed inventories are much larger. An oil spill onto the surface of the water is readily visible and may result in punitive action by the regulator, as well as cleanup cost. Direct costs for oil releases are mainly related to the clean-up costs if the spill drifts towards shore. The actual effect will then depend on the location of the field in relation to the shore, oil drift conditions, temperature and evaporation.

Yes

Detailed Quantitative analysis (Chapter 7)

5. Working process 5.1 Objective The objective of this working process is to lead the RBI team members through methods used to prepare a risk and cost-optimised inspection plan. Figure 5-1 presents an overview of the working process in the form of a flow chart. Section numbers are given to cross-refer to the activity descriptions.

5.2 Outline of the process The working process has been divided into two stages: 1) Risk screening, which is intended to address risks per system and is aimed at sorting piping and equipment into high, medium and low risk, following the methods described in Chapter 6. Generally, low and medium risk items will require minimal inspection supported by main-

No

Risk level acceptable?

Yes

Inspection Plan (Chapter 8, 9)

Note that the regulator may give permission to discharge treated produced water where the oil content is below a specified level, and therefore this liquid is not considered to be polluting. The loss of toxic chemicals into the environment must be considered separately, as in some cases a small volume of chemicals can have a widespread effect on the environment. For the purpose of inspection planning, environmental effects of gas releases are considered insignificant. It should be noted that there may be financial consequences due to government imposed CO2 taxation.

Create PoF Model

No

Inspection plan acceptable ?

Yes

Execute plan

Figure 5-1 Overview of RBI working process

5.3 Acceptance criteria To be able to manage installation risk so that it lies below the limits acceptable to the operator, the acceptance limits for each type of risk must be defined. The contribution to the total risk from inspectable events related to the systems undergoing analysis should be found, and this divided over the component at which the RBI is to be carried out, such as a piping system, process stream, process segment, pressure vessel or pipe tag. As there are several acceptance criteria, it is necessary to have a decision logic regarding the order of importance of these limits in deciding which limit is to govern the time to inspection. This order of importance should be recorded. The acceptance criteria must be the same for both stages of the process so that all the work refers to the same limits i.e. in both screening and detailed RBI. For presentation purposes it may be useful to translate the numerical values into descriptive limits.

5.4 Information gathering The following sources of information should be available to the engineers carrying out the RBI evaluations at the screening

DET NORSKE VERITAS


and detailed RBI stages as noted in Table 5-1. The appendices show the details of the information required in order to be able to estimate both the consequence and probability of failure for given degradation mechanisms and materials. In the absence of such information, assumptions may be based on judgement and experience. All such assumptions must be recorded. Table 5-1 Information requirements Information source

Screening

Coating specifications Corrosion protection philosophy Design accidental load analysis DFI resume Equipment data and vessel sheets ESD logic diagrams Inspection/failure/replacement details Inspection/failure/replacement history knowledge Insulation specifications Layout drawings Mass balance sheets Material design specification & selection report Materials selection reports P&IDs PFDs Piping data sheets Production data (past and future) QRA System descriptions manual UFDs

x

Detailed RBI x x x x x x x x x x x

x x x

x x x

x x x x x x x x x

6. Risk screening The purpose of the screening process is to identify those systems that are judged to give a significant contribution to the installation risk levels. This ensures that further data gathering and assessment efforts can be focused on these systems.

6.1 Working process Screening is carried out in a qualitative manner that involves identification of risk on a system by system, group by group or major equipment item basis. On the basis of knowledge of the installation history and future plans and possible components' degradation, the consequence of failure and probability of failure are each assessed separately to be either ‘high’ or ‘low’ as defined in 6.3.1 to 6.4.2 inclusive. The results of screening should be recorded; a recording proforma with guidance is given in Appendix A. The actions required as a result of screening are shown in Table 6-1. Inspection data is used only as general guidance, as the screening is intended to identify systems, groups and equipment where it is cost-effective to use more time-consuming detailed assessment.

6.2 Screening team It is essential that all necessary expertise is available to the screening team, and therefore the personnel identified in Section 3.4 should be present.

6.3 Consequence of failure evaluation Consider the worst-case outcome of the likely failure, and compare that against the risk acceptance limit making the as-

sumption that failure will occur, i.e. probability of failure = 1.0. If the outcome is greater than the acceptance limit, then rank the consequence of failure as ‘high’, otherwise rank it as ‘low’. 6.3.1 Safety consequence Acceptance criteria at a tag level are not always intuitively assessable in the screening session: experience shows that the boundary between ‘low’ and ‘high’ safety consequence can be taken as the possibility of personnel exposure leading to injury and a lost-time incident. Guidance note: A release of a fluid that is normally accepted as being difficult to ignite, such as diesel fuel, can still result in ignition due to impingement on hot surfaces. Also a high pressure leak may result in formation of a mist that can readily ignite in the presence of equipment or work that may generate sparks. ---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---

Typically the loss of any flammable or toxic fluid or gas would be expected to give a ‘high’ safety consequence. 6.3.2 Economic consequence A production shut-down would normally be expected to give a ‘high’ economic consequence. However, due consideration must be given to the installation operational economics such as field production profile, system redundancies and penalties that might arise from contractual production guarantees. 6.3.3 Environmental consequence The release onto the sea of any hydrocarbon liquid or process chemical (unless specifically known to be benign, or of low volume) would be expected to give a ‘high’ environmental consequence. Releases of gases into the air should be considered in the light of local regulations. 6.3.4 Other consequences If required, other consequences can be assessed, such as the political consequence (in terms of adverse press coverage or loss of share value) that could arise from a spill or fire. The definitions of these other consequences must be discussed during agreement of the acceptance criteria.

6.4 Probability of failure evaluation Consider whether there is any possibility of failure, under the known operating conditions and taking into account the approximate chemical composition, the temperatures of the fluids and the effects of time. The boundary between low and high probability of failure has been set to approximately 10-5 per year, i.e. no significant degradation is expected with PoF of 10-5 or less. It is not the intention to carry out a detailed evaluation, but to assess whether these conditions are likely to give rise to negligible degradation (‘low’) or degradation rates that are not negligible (‘high’). Care should be taken to ensure that the consideration of process conditions accounts for future variations as the reservoir becomes depleted, such as increase in water cut, temperatures, or H2S evolution. It is important also to account for likely excursions in process parameters due to upset conditions. Guidance note: Data requirements and screening guidance for probability of failure are given in the Appendices that treat each degradation mechanism. Appendix C should be consulted for the applicable mechanism. Care should be taken when using the Appendices for guidance on probability of failure to ensure that the assumptions made regarding the conditions under which the components operate are applicable to the systems in question.

DET NORSKE VERITAS

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---


6.4.1 Probability of failure – internal Consider the probability of failure due to combinations of materials, fluids, gases, temperatures and pressures, also including degradation due to erosion and the passage of chemicals within the systems. Consider also likely changes in the use of the system – such as use of water injection pipework for oil production. 6.4.2 Probability of failure - external Consider the probability of failure for each material that might arise as a result of the external environment, taking account of temperatures, coatings, the presence of water-retaining insulation and the effects of time. 6.4.3 Probability of failure - fatigue The possibility of failure due to fatigue can be considered. Areas where there are known or suspected problems should be evaluated, for example small diameter side-branches of stainless steel. The significance of vibration sources should also be considered, such as poor or damaged support systems, reciprocating equipment, unbalanced rotating equipment and fluid hammer. 6.4.4 Probability of failure - other Any other causes of failure can be included in the assessment. This can include any known or suspected abnormal conditions that can cause concern.

It is essential to assess whether the piping and vessels within a system experience different conditions, such as the possibility of water condensation within a vessel but not in the piping systems, and the effect of flow rates in piping and vessels on sand erosion. The recommendations for action as shown in Table 6-1 are developed on the basis that inspection is only effective in reducing the probability of failure. There may be other causes of failure with significant consequences that have not been considered because they are not within the scope of inspection.

6.6 Results of Screening The results of the screening process are that systems, groups or equipment items are assessed as having either, ‘high’, ‘medium‘ or ‘low’ risk: a) Items with high risk should be evaluated further using the more detailed method in Chapter 7. b) Items with medium or low risk should be considered for maintenance activity as noted in Table 6-1. c) High consequence items should also undergo checks for degradation mechanisms not considered in the screening. The consequence of failure evaluation can also be used as input to RCM analyses and for additional consequence mitigation activities, such as installation of dropped object protection.

6.5 Risk assessment

6.7 Revision of screening

After assignment of the probabilities and consequences, the system or vessel is assigned to detailed RBI or to maintenance activities as shown in Table 6-1. The most severe result for any of the consequence categories taken with the most severe result for the probability categories is used to stipulate the final outcome.

The screening process should be periodically revised as part of the overall inspection management process to ensure that the assumptions used in the evaluations remain valid. Changes in process or other conditions may result in systems or equipment moving to high risk and therefore should be subject to detailed RBI.

Table 6-1 Risk matrix for screening Probability of Failure Risk Categories and Screening Actions 5 Medium risk High risk Significant Inspection can be used to reduce the risk, but is unlike- Detailed analysis of both consequence and proba4 -5 > 10 probability of ly to be cost-effective; the cheapest solution is often to bility of failure. 3 failure carry out corrective maintenance upon failure. 2 Low risk Medium risk Minimum surveillance, with corrective maintenance, Consequence is high so actions (such as preventa1 < 10-5 Negligible if any. Check that assumptions used in the damage as- tive maintenance) should be considered to ensure sessment remain valid, e.g. due to changes in operat- continued low probability as small changes in ing conditions. conditions can increase PoF and give high risk. Consequence category A B C D E Acceptable consequence of failure. Unacceptable consequence of failure

7. Detailed assessment

well as facilitating the updating of the analysis after inspection, the use of a computer is recommended.

7.1 Objective

7.3 Detailed RBI: Analysis detail level

The objective of the detailed RBI assessment is to identify the relevant degradation mechanisms for each component, estimate the extent of damage, calculate when inspection should be carried out, and propose what inspection technique should be used to ensure that the risk level for that component does not exceed the acceptable risk limit.

7.2 General The process for detailed RBI evaluation is outlined below. This refers to the appendices of the recommended practice for detailed estimation of probability of failure and consequence of failure. As the analysis level becomes more detailed, it is clear that the number of calculations will also increase. For this reason, as

Detailed assessment is based on defining groups of components so that the analysis for one component can be applied to all the others within that group. Grouping is typically carried out with reference to PFDs and P&IDs. It is likely that different groups will be defined for the assessment of probability of failure and consequence of failure. Before beginning the evaluations, the level of detail at which these evaluations are to be carried out should be established. This should account for the level of detail required by the inspection planners who are to work with the results of the analysis, as well as the amount and level of input data available. This is summarised in Table 7-1. The level of detailing will often be increased for the high risk items, i.e. the analysis process will start at systems level and proceed to tag level for selected

DET NORSKE VERITAS


items. It should be noted that inspection planning is concerned with the smallest level of detail (inspection point) and so if the RBI

analysis is carried out at a system, segment or group level, more time will be used in the inspection planning process than if the RBI is executed at detailed tag level.

Table 7-1 Analysis detail level Smallest component analysed Advantage — Relatively small amount of data required — General data can be used — Relatively few calculations, so can be done quickly — Fits well with existing QRA analyses — Low initial investment System ESD segment

— — Corrosion group

— — — — — Pipe tag, inspection point or Vessel part (e.g. nozzle, weld)

— — —

Disadvantage — May contain several corrosion groups, so being overlay conservative with regard to degradation Lacks detail needed for inspection planning. — May overlook some parts. — Needs detailed review of components to ensure worst case materials and dimensions have been evaluated. — Output requires significant work in inspection planning to add the detail. — May be little gain when updating from inspection findings. Relatively small amount of data required — Lacks detail needed for inspection planning. Relatively few calculations, so can be done quickly — May overlook some parts. — May infer excessive inspection in larger groups. — Needs detailed review of components to ensure worst case materials and dimensions have been evaluated. — Output requires significant work in inspection planning to add the detail. All sizes of the part and materials are considered. — Requires large amount of data. Unlikely that parts will be overlooked. — Computer calculation required. Output is directly useful to inspection planners. — Data may not be available in physical or elecAll parts of the vessel/tag are considered. tronic format. Allows unusual cases, and well understood equipment and degradation mechanisms to be included separately. Identification of high risk parts of vessel may save intrusive inspection. Separate degradation mechanisms found in specific locations in the vessel/tag are evaluated separately. Greatest precision in updating analysis with inspection findings.

7.4 Consequence of failure modelling 7.4.1 Objective Consequence of failure is calculated for each consequence type to facilitate calculation of equipment and damage-specific risk. 7.4.2 Working process It is generally expected that consequence modelling can draw on the results of other analyses developed for the installation; typically QRA and RAM analyses. However, if these documents are not available then the simplified methods given in Appendix B can be used. In all cases it is recommended that risk engineers are involved in this part of the RBI analysis. The consequences of a release that leads to a fire or explosion demand different consideration from a release of a fluid or gas that does not ignite. This section addresses the consequence calculations for ignited and unignited releases separately and

hence their different outcomes with respect to safety, economic and environmental consequences. For the purposes of RBI, the consequence of failure is defined as the outcome of a leak given that the leak occurs. The calculation methods used in a QRA usually include generic probability of leak data that are not necessarily specific to the installation, material or the degradation mechanisms. These data must be removed and replaced with probability of failure of 1.0. Table 7-2 gives an overview of the factors to consider when calculating the consequence of failure. Consideration should also be given to the probabilities of different outcomes from each leak. This is best described using an event tree, where the sequences of outcomes is given by appropriate branch probabilities. The steps shown in sections 7.4.3 to 7.4.5.4 should be followed to estimate consequence of failure.

DET NORSKE VERITAS


Table 7-2 Factors to consider in consequence assessment. Ignited leak Safety Consequence Economic Consequence Consider loss of life due to: Consider the costs of:

Environmental Consequence Consider the effects of:

— burns to personnel — direct blast effects to personnel — indirect blast effects to personnel (missiles, falling objects) — injuries sustained during escape and evacuation Unignited leak Safety Consequence Consider loss of life due to:

Economic Consequence Consider the costs of:

Environmental Consequence Consider the effects of:

— deferred production — repairs

— hydrocarbon liquids spilled onto the sea

— Toxic gas release — Asphyxiating gas release — Impingement of high pressure fluids on personnel

— repair of damage to equipment and struc- — toxic gas release ture — smoke — replacement of equipment and structural items — deferred production — damage to reputation

7.4.3 Establish the event tree An event tree describing the sequence of events following a leak should be established. Event trees are used to calculate the probability of each end event occurring, and are commonly found in QRA or Safety Case documents. If these documents are not available a simple version is given in Appendix B. The effects of the end events on the safety, economic or environment consequence should be chosen to reflect the partictur circumstances of the installation. 7.4.4 Ignited consequences Ignited consequences consider the effects of an ignited gas or liquid release on personnel, the cost of damage to the installation by fire and blast, the cost of deferred production, and subsequent environmental consequences. It is recommended that these consequence calculations are based on leak rates that take account of the leak hole sizes that would be expected as a result of the given degradation mechanism. This ensures that the calculated consequences can more fully reflect the actual circumstances of the leak. Typical hole sizes are discussed in Section 7.6 and guidance about hole sizes is included in the appendices for each degradation mechanism. 7.4.4.1 Personnel safety: Fire & Blast The probability of ignition and probability of explosion, given a leak, should be calculated in each segment using the event tree. The probability of the size of the resulting fire is used together with the population density in the module to estimate the loss of life. In the case of an explosion, the explosion overpressure can be used to estimate the resulting loss of life. These data should be contained within the QRA or Safety Case, though Appendix B can be used to determine approximate values if they are otherwise unavailable. 7.4.4.2 Economic consequences: Damage to the installation Damage to the installation may be confined to a single module, or if the fire or blast is of sufficient magnitude, additional modules or the whole installation may be damaged or lost. — In the case of a jet fire, it is expected that any items within the radius of the fire may be damaged or destroyed. — In the case of a pool fire, all equipment that stands within the pool should be considered damaged or destroyed. — Where equipment subject to fire loading also contains significant amounts of hydrocarbons, the effects of the fire loading and duration should be used to estimate knock-on effects. In these cases, passive and active fire protection can be considered as mitigating factors. — The blow-down capability, i.e. reducing pressure and volume of fluid available to fuel the fire, should be considered

for both the leaking equipment and other equipment subject to fire loading; the effects of the fire should be adjusted accordingly. — Further mitigating factors, such as fire and gas detection, deluge and sprinklers, together with the philosophy for their use (e.g. deluge start on confirmed gas detection and before fire detection), should be taken into account. These points may be contained within the QRA or Safety Case, though Appendix B gives simplified calculations where these are needed. Assessment of the costs associated with repairs is described in Section 7.4.5.2 and Section 7.4.5.3. 7.4.4.3 Environmental consequences In the case of ignited leaks, it is not expected that significant volumes of liquids will be deposited on the sea during the fire. However, the condition of the installation following an explosion or a severe fire may be such that wells or storage tanks will leak. In addition, the large amount of smoke generated by such fires may be a concern. As yet there are no criteria developed or calculation methods for estimating the consequence; this will have to be treated qualitatively. Financial penalties may be applicable in certain cases. Further, there may be a political element to the environmental consequence once there has been press exposure. Consideration should also be given to loss of reputation and loss of share value. 7.4.5 Unignited consequences Unignited consequences consider the effects of any toxic release on personnel, the economic costs of deferred production and repairs, and the environmental consequence of a liquid spill on the sea. 7.4.5.1 Personnel safety: Toxic/asphyxiant release This requires the estimation of the rate of build-up of toxic levels of gas within a module and consideration of the escape of those personnel working within the module. Mitigating factors such as toxic gas detectors and system blow-down should also be considered. It must be noted that the major toxic gas encountered offshore, H2S, has a greater explosive limit range than methane. The release of asphyxiant gas should also be considered. Such a release may occur from a liquid nitrogen plant located within the hull space of an installation, resulting in undetected low levels of oxygen that may cause asphyxiation of personnel in the vicinity.

DET NORSKE VERITAS


7.4.5.2 Economic consequences: Cost of deferred production The value of deferred production is calculated as the value of production per hour multiplied by the number of hours at the reduced production rate. This can be expressed as a net present value using a suitable discount rate, or as a fixed currency sum. The amount of deferred production will depend strongly on the design of the installation process system(s) and their interaction. Production systems with several parallel trains can usually be operated with one train isolated so that the installation will be able to produce at a reduced rate until the damaged train is repaired and recommissioned. The value of deferred production will therefore be less than for a single-train installation where any leak will require full production stop during the entire extent of repair. The time-profile of deferred production for each part of the pressure-retaining systems should be defined so that it can be applied to all parts of that system or part-system. The profile should take into account the time taken in repair and the individual process and well characteristics for restoring production from the stop or partial-production condition. 7.4.5.3 Economic consequences: Cost of repairs The cost of repairs in terms of deferred production should be contained within the production loss profiles described in Section 6.3.3, making sure that the specific repair methods are addressed where these will have an effect on the repair time. In addition, the costs of materials, man-time, mobilisation of personnel and equipment to the installation, provision of specialist services, cleaning of the work area, and similar, should be estimated in financial terms and added to the cost of deferred production. 7.4.5.4 Environmental consequences: Liquid spill In the case where environmental consequences are to be measured in volume of liquids lost to the sea, then it is necessary to estimate this figure for each relevant system and segment. It will be necessary to determine the amount of liquid that will fall onto the sea and not be contained within bunding or by plated decks and drains; this will depend strongly on the design of the installation as well as the position of the leaking part, the pressure within the system, the monitoring devices, and the volume that can be lost. A coarse approximation that can be used: Assume that all liquid contained within a system or segment is released by a leak, resulting in a pool of the same volume of liquid as was contained within the system or segment. An estimation of the capacity of the drains to handle such a volume without overflowing to the sea should be made if the decking in the area is plated. Where the deck is made from grating, then the entire spilled volume should be assumed to fall through; if plated deck is beneath, then estimate the drains capacity as previously. Where the estimated volume of liquids reaching the sea is unacceptable, then a more detailed estimation can be made on the basis of expected leak size and location. This will couple the consequence estimation to the degradation mechanism for leak size and location, and can account for a slower leak rates than that used in the coarse approximation.

7.5 Probability of failure modelling 7.5.1 Objective The purpose of probability of failure modelling is to determine which degradation mechanisms are likely to be found in each part, assess the current probability of failure for each relevant degradation mechanism, and evaluate the development of damage, and hence PoF, with time. The objective is to derive a PoF limit that is used to indicate the time interval in which inspection should be carried out and re-

vise these intervals as inspection and monitoring data becomes available. 7.5.2 Working process The working process for detailed probability of failure calculation is listed in Sections 7.5.3 to 7.5.11. The sections follow the process; determining the probability of failure acceptance limit based on the risk limit, determining which degradation mechanisms are relevant to the part in question, and then calculating the probability of failure for those mechanisms. The calculated probability of failure can be compared against inspection data and corrected if the data is found to be valid. Finally, the change of probability of failure with time is used to calculate when the risk acceptance limit will be breached. Note that consequence of failure can depend on the hole size used in the leak calculation, and that the hole size depends on the degradation mechanism. 7.5.3 Probability of failure acceptance limit To allow the time to inspection to be calculated, the risk acceptance limit must be converted to a probability of failure limit. This limit must be expressed for each type of risk considered. The PoF limit is given by: Risk Limit, Type PoF Limit, Type = ----------------------------------CoF Type Note that the same part may have more than one probability of failure limit depending on the consequence type. 7.5.4 Allocation of degradation mechanisms The degradation mechanisms affecting a part depend on the combination of the material of construction, the contents of the part, the environment surrounding the part, the operating conditions and any protective measures. Internal and external degradation mechanisms should be defined for each part by reference to the tables in Appendix C. The degradation mechanisms are labelled as (see 4.4.3); insignificant model, susceptibility model or rate model. Their use in calculating probability of failure is discussed individually in Section 7.5.9, Section 7.5.10 and Section 7.5.11. The tables in Appendix C have a number of assumptions associated with them that shall be checked and confirmed to be applicable for the circumstances related to the individual part. If the assumptions are not valid, then specialist assistance should be sought to evaluate the specific circumstances. The applicable degradation mechanisms shall be listed for each part together with the reasons for selection. 7.5.5 Internal damage – systems/service/materials Mechanisms are addressed according to ‘groups’ of systems that define the overall product or media in that system. This concept is essential to the selection of relevant mechanisms for the analyses. The objective is to determine which degradation mechanisms are possible for each of the materials expected used in a given service. This is an assessment that is based on general experience and fundamental knowledge of materials and service. The result is a listing of product/materials/possible degradation mechanisms, that in practice will include more mechanisms than are actually expected in a specific analysis. Appendix C shows such a list of the most relevant services, materials and degradation mechanisms for internal damage. The list is based on general knowledge gathered among operating companies and open literature. All combinations of materials and services are not listed, and expert evaluations may

DET NORSKE VERITAS


be needed where these are missing. Past inspection results and experienced failures from the specific installation or any similar installations may add to the list of possible mechanisms. 7.5.6 External damage External damage is only related to the external environment and condition of the surface protection. The damage can either be of the type ‘rate’ or ‘susceptibility’ as described in 4.4.3. Appendix C describes the assessment for external damage. 7.5.7 Mechanical damage Mechanical damage caused by vibration, ship/platform movement, flow effects, or other sources, may cause fatigue crack growth and fracture. For piping systems, the damage is often located in local hot-spots, such as welded connections, branches, clamps, or vessel nozzles, where the design gives a high stress concentration factor and restraint may also increase loading locally. Fatigue in piping systems caused by high frequency vibrations (such as from reciprocating machinery) is expected to propagate rapidly to failure once a crack is initiated, and is therefore not readily amenable to monitoring and control by inspection. In such situations, it is recommended that the local vibration amplitude and the local stresses are measured, rather than calculating the crack growth. Where the source of vibration is low frequency, such as from ship motion, then inspection may be used to measure the development of damage. Appendix C describes the assessment procedure for mechanical damage. 7.5.8 Lower limit on calculation of PoF The proposed scale for probability of failure is as shown in Table 4-1 and elsewhere in this document. A cut-off point is set for PoF below 10-5 as probabilities below this number are both very difficult to model and observe, and will usually represent an insignificant risk. 7.5.9 Insignificant model This model is based on the expectation that no damage will occur, yet it allows a risk value to be calculated. The model allocates a fixed probability of failure value, regardless of time, as below. PoF = 10-5 per year. Inspection is not relevant for this model expect for checking that any premises remain valid. Appendix C should be consulted for guidance about typical materials and fluids combinations where this model is expected to be applicable. 7.5.10 Susceptibility model This model gives a value for probability of failure depending on factors relating to operating conditions. For a given set of conditions that are constant over time, the probability of failure also remains constant over time. This implies that the onset and development of damage are not readily amenable to inspection. However, actions can be related to monitoring of key process parameters, such as excursions or a change of conditions, that can be used to trigger inspection. Appendix C provides guidance about typical materials and environmental conditions where this model is expected to be applicable and suggests values for PoF for typical conditions. If PoF > PoFlimit, type, then immediate action must be taken. This action may be one or a combination of:

— — — —

assess and repair any damage change or treat the contents so that it is less damaging reduction of operating temperature exclusion of damaging environment (e.g. coating, lining, exclusion of water from insulation) — change of material type. 7.5.11 Rate model This model assumes that the extent of damage increases as a function of time, and therefore probability of failure also increases with time. This implies that the development of degradation can be measured by inspection, and that the inspection results can be used to adjust the rate model to suit the actual situation. The resulting damage is normally a local or general wall thinning of the component. Appendix C should be consulted for guidance about typical materials and fluids combinations where this model is expected to be applicable. The appendix also suggests mean and standard deviations for damage rates and the distribution type to be applied for different degradation mechanisms. The failure probability increases over time as the wall thins and is dependent on the loading in the material. The controlling factors include: — — — — —

damage rate wall thickness size of damage material properties operational pressure (as the primary load).

Additionally, each degradation mechanism is itself controlled by a number of factors, such as temperature and pH. All these factors vary somewhat, and a full probabilistic analysis should consider every factor as a stochastic variable. In practice, however, the uncertainties associated with the damage rate, and any measured damage, tend to outweigh the uncertainties of the other variables. This allows some simplification to be used without significant loss of precision. A more accurate calculation of probability of failure is obtained from First Order Reliability Methods (FORM) using distributions for all the most important factors. FORM is best carried out using computer techniques and is likely to require a specialist in mathematical and statistical techniques to develop the algorithms. A number of suitable software tools are available that include these methods as part of RBI calculations. A further simplification is outlined in the method given below. This uses pre-defined distributions, as referenced in Appendix C, and assumes that the mean damage rate is the only uncertainty variable. For mechanisms other then CO2corrosion, PoF scale factor curves are given for three coefficients of variance (CoV) of corrosion rate only: 2.0, 1.0 and 0.33, representing high, medium and low spread respectively. This method facilitates calculation of PoF at any point in time, based on the mean damage rate and the difference between a given wall thickness and wall thickness at which a release is expected. Rearranging the equations allows approximate results to be obtained for: — The latest time at which inspection should be carried out to check that risk acceptance limit is not exceeded. — Approximate results can be obtained for: — the current PoF — expected defect size at any point in time — timing corresponding to other action triggers, e.g. corrosion allowance expected to be consumed; wall thickness expected to fail to meet code compliance.

DET NORSKE VERITAS


1) Determine the maximum acceptable probability of failure for the item using the consequence of failure for that item and the type of Risk acceptance criterion (e.g. for safety, or economic risk): refer to 7.5.3 i.e. Risk Limit,Type PoF Limit, Type = -------------------------------CoF Type 2) Determine the wall thickness at which a release is expected : t release. This can be derived from first principals, or from a appropriate codes or formula such as ANSI/ASME B31.3 ANSI/ASME B31.G, BS 5500, ASME VIII, and DNVRP-F101, using relevant operational loads. a) Due consideration should be given to the degradation morphology: Code formula generally assume a uniform wall thinning, although some include defect size assessment. For localised damage that does not affect the wall stresses, it may be acceptable to set the release wall thickness close to, or as zero, i.e. the release due to uniform wall loss will occur at thicker wall than local wall loss. b) It may be desirable to include other wall thickness criteria in the inspection plan, e.g. to check compliance with authorites' requirements. If other failure criteria are defined, such as consumption of corrosion allowance, the purpose of the evaluation should be considered and the consequences adjusted to suit, e.g. cost of remedial action, rather than a release. c) Some code formula include optional explict safety factors: it is suggested that these are removed for the purpose of RBI as margins are implicitly included in the calculations and vary with risk. d) The code formulae give wall thickness requirements for pressure retaining purposes. Other loads should also be considered and a thicker limit should be stipulated if the code suggests an impractically thin wall for general thinning. 3) Determine the time until PoFLimit, Type is expected to be exceeded: t 0 – t release Time to PoF Limit, Type = a ------------------------d mean Where: a dmean t0 trelease

= = = =

PoF scale factor, derived as given below. mean damage rate (mm/year) current wall thickness (mm) wall thickness at which a release is expected (mm)

a) Determine the mean damage rate from measured values, expert judgement, or using the guidance in Appendix C. b) Select the curve in that is appropriate to the degradation mechanism, including a CoV. Selection can be based on measured values, expert judgement, or using the guidance in Appendix C. The curves in Figure 71, other than those marked CO2-Corrosion, apply to normal or log-normal distributions. The CO2-Corrosion curves include the CoV value. c) Use the selected curve, take the PoFLimit,Type on the horizontal axis and read off the corresponding ’scale factor’ on the other axis.

d) Apply the ’scale factor’ in the above equation to determine the Time to PoF Limit. e) determine the Time to PoFLimit 1.0

Scale factor, a

The process steps are:

CoV = 0.33

CO2 local CoV = 1.0

CO2 Uniform

0.1 1.E-06

CoV = 2.0

1.E-05 1.E-04

1.E-03 1.E-02 1.E-01 1.E+00 PoF Probability of Limit Failure Limit

Figure 7-1 Scale factor against PoFLimit

4) Determine the time to inspection. The inspection must be scheduled to occur no later than the Time to PoFLimit. It may be preferred to calculate the Time to PoFLimit for each Risk Type for the component of interest with the inspection scheduled for the earliest result.

7.6 Leak hole size The hole size of a leak has a significant effect on the release rate of the contained fluid. The degradation mechanism is related to the consequence of failure via the expected hole size which may vary from a ’pinhole’, to a complete breach of the component, depending on the degradation mechanism. The consequence calculations should be carried out for a given set of pre-defined hole sizes that are related to those given for the degradation mechanisms. The expected percentage of holes falling within each category can be estimated or judged for each mechanism. Table 7-3 shows the recommended hole sizes that are referenced in both the consequence calculations and the degradation mechanisms described in the appendices. Table 7-3 Hole size template: Equivalent hole diameters Small Holes Medium Holes Large Holes Rupture Above 5 mm Maximum di5mm and less and not more Above 25 mm ameter of comthan 25 mm ponent If the hole size exceeds the diameter of the component then Rupture shall be used

7.7 Estimation of risk Once the probability of failure and consequence of failure have been estimated, the data points can be plotted on the appropriate matrices for viewing and comparison purposes. A separate matrix for each risk type should be developed, with the probability of failure and consequence of failure scales set as described in section 4.2.3. The matrix is a static picture of risk calculated for any one time, but matrices can be prepared for different years to illustrate development of risk. It is recommended that the results are checked for the validity of any assumptions that were made during the assessments, the correctness of data used, and that the risk outputs are broadly in agreement with those given in any relevant safety case, QRA or similar documentation.

DET NORSKE VERITAS


Guidance note: QRA/Safety cases studies and RBI studies have different objectives, and hence utilise somewhat different data and equations. Consequently, it is likely that results from the different studies will not be in exact agreement. ---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---

7.8 Reporting of the assessment The results from this part of the assessment provide the basis for the detailed inspection planning. A report must be focused on the needs of the inspection planner. Typically, the report will comprise the risk results collated with any intermediate calculations related to part and process data. Additional consideration should be given to the data requirements and capabilities of any inspection planning tool that are used. The assessment and underlying assumptions should be documented together with a combination of the following information/data, as required, related to each item: — component/system identification — materials of construction, fluid type, operational conditions, design limits — equipment/segment volumes, economic data related to lost/deferred production — inspection and operating history — degradation mechanisms and failure mode, damage rate, uncertainty and basis — safety risk, economic risk, and risk categories — risk in relation to the acceptance criteria — time to reach risk limits — key indicators for risk change (temperature, process changes) — recommendations that the part be subject to inspection, maintenance activities or monitoring of process or other parameters — recommendations for additional activities in verifying the data and assumptions used in the analyses.

7.9 Revision of assessment with new information The assessment should be reviewed on a regular basis, and revised as necessary to account for any significant changes in the input information, e.g. in process and operational data, new design conditions, changes in field economy. For most offshore processing systems the operational conditions are subject to both short term and long term changes due to operational practices and reservoir characteristics. It is essential to track such changes and to make appropriate actions based on these. Some changes can be anticipated, such as a tiein to new well of different composition. The economic basis for the installation can also be affected by changes in operation and the price of oil.

8. Use of inspection and monitoring 8.1 Use of inspection results Degradation modelling allows a theoretical damage extent to be calculated that can be considered to be an estimate of the actual conditions, that is then corroborated or corrected using results of inspection. Corrections can be made to: — the extent of damage only — the degradation rate only — both the extent of damage and the degradation rate. Inspection results for process equipment usually comprises wall thickness measurements and reports of coating condition. Crack sizes are not normally monitored but repaired as soon as they are found. In all cases, inspection data must be evaluated carefully, using the guidance in the next section, before it is

used to correct the estimates. Note that the corrections can result in either an increase or a decrease in the predicted probability of failure, depending on the inspection outcome. Where no baseline inspection data is available, it will be difficult to estimate a corrosion rate as the actual original starting thickness may be unknown and manufacturing tolerances are often large. Note that a comparison between adjacent areas of damaged and sound material can provide an adequate baseline in some cases. On the basis that the inspection data has been evaluated and found valid, the wall thickness should be updated to the measured thickness. The probability of failure should be re-calculated using the new thickness data but the original corrosion rate. Where trending of the data is considered valid and is expected to continue into the future, then the wall thickness should be corrected and a revised corrosion rate should be used to recalculate the probability of failure.

8.2 Validity check for inspection data Where historical data is available from past inspections, this can be used to substantiate or correct the previously expected (calculated) damage extent. However, great care should be taken when evaluating the inspection data, to ensure that it is directly applicable to the situation under consideration. It should also be noted that past data is no guarantee of future performance, as conditions will change. In evaluating the inspection data, the following must be considered: 1) Is the data directly applicable to the situation under evaluation? a) Is the data taken precisely from the part being evaluated, or from the same corrosion group? b) Where within the part has the data been taken – thickness measurements made on an elbow will not be correlated to the thickness of a straight pipe? 2) Can the data be related to the expected degradation mechanisms? a) Is the measurement location relevant for the expected degradation mechanisms? b) Does the data relate to internal or external degradation? c) Does the data measure one or more degradation mechanisms (e.g. CO2 corrosion and erosion simultaneously at an elbow)? 3) Has the data been measured and reported in a manner that it can be evaluated? a) Are numerical values given for thickness or damage depth? b) Is there an adequate reference to the original thickness? c) Is the extent of damage to coatings given in relation to a numerical scale? d) What inspection technique has been used, and what is its effectiveness in measuring the expected degradation? e) Has sufficient area of the part been inspected to provide such confidence that the result is applicable? f) Can the results be related to identifiable locations within the part? g) Are any past data points taken from the precisely same location so that trending might be meaningful?

DET NORSKE VERITAS


h) Has the inspection been carried out where the degradation would be expected? When evaluating the results of trended data for wall thickness with a view to finding corrosion rates, care must be taken to ensure that the data is assessed critically. For example, it is common that there is a wide scatter in ultrasonic wall thickness measurements resulting from the inherent inaccuracy of the technique, slight changes in calibration from one inspection to the next, variations due to the operator, and variations due to non-repeatability in location. Two-point trending can show marked wall thickness loss rates or wall thickness increase rates. Increasing the number of points used in trending gives a better result, and it is strongly recommended that all relevant data points be plotted so that the best trend can be evaluated by eye as well as spreadsheet algorithm. The evaluation must also include knowledge of relevant installation history. For example, if many years of operation with effective corrosion inhibition have shown almost no wall loss, yet recently the inhibition equipment has failed, then the low corrosion rate cannot be expected to continue into the future unless inhibition is reinstated. Updating of the RBI assessments using inspection data is described together with inspection planning in Section 9.

8.3 Use of corrosion monitoring results Monitoring probes and coupons are generally not intended to provide quantitative degradation rates, but rather to monitor inhibitor performance or ensure corrosion rates are within specified limits. However, data may be used for this purpose if it is given critical evaluation: 1) Have the probes or coupons been located in the correct position within the system, where the corrosion is expected to occur? The siting of a coupon in the top of a pipe where CO2 corrosion is expected to occur in the water phase running along the bottom will give falsely optimistic results if the coupon does not lie in the water. 2) Has the data been collected and reported correctly? This includes the calculation of pH from samples, the correlation of probe / coupon results with process conditions, use of the correct procedure to measure material loss from coupons or relate the signal change in a probe to corrosivity. Where doubt exists in the use of these data, it should be discounted and new good quality data collected under the supervision of an experienced corrosion engineer. In the meantime, the corrosion rates estimated from the degradation models should be applied until the new, validated data is available.

8.4 Use of process monitoring Monitoring of key process parameters that control the rate or onset of degradation can be used to detect changes in the operating conditions that can effect the probability of failure. Set points can be specified for relevant parameters and used for triggering inspection based on the PoF limit, rather than regular inspections. For example, temperature is a key parameter for external stress corrosion cracking of stainless steels under wet insulation. Similarly, process instrumentation can be used to indicate when the basis for the RBI analysis is no longer valid – For example, measurement of export gas CO2 levels can be used as an indicator regarding the CO2 content throughout the process, with a reanalysis to be carried out when there is a significant change.

9. Inspection planning Inspection measures the extent of degradation and thus allows the calculation of probability of failure based on the actual damage condition as opposed to the estimated damage condition. The RBI analysis is used to generate an inspection plan at the desired level of detail. The probability of failure assessment allows the following parameters to be estimated for each part: — Degradation mechanism, and hence possible inspection methods, morphology of damage and the expected extent or size of the damage. — When to apply the inspection – the time when the risk limit is crossed. The inspection plan should contain the following information as a minimum: — — — — — — —

part identification inspection location / inspection point inspection technique time when inspection is to be carried out expected damage morphology, location and extent drawing references reporting requirements.

Reference should also be made to minimum operator qualifications, equipment type and calibration requirements, inspection procedure to be used, applicable codes and standards, and other quality-related information. When carrying out the detailed inspection planning, the following points should also be considered: — — — —

access requirements the need for shutdown of the process during inspection requirements for detailed inspection drawings reporting format and reporting limits.

9.1 Inspection scheduling For the time-dependent rate models, inspection should be scheduled such that the risk limit is not exceeded, with adequate time allowed for any remedial action. Preparation of a detailed inspection, monitoring and maintenance plan must also consider other factors that can effect the scheduling; included but limited to: a) A component may be subject to different degradation mechanisms that are expected to reach their risk limits at different times. The inspection schedule should take account of these differences by rationalising the timings into suitable groups to avoid otherwise frequent activities on the same components. b) As discussed in Section 4.4.3, the non-time dependent mechanisms are not considered suitable for direct control by inspection, but may require general visual inspection to check that any premises used in the analysis remain valid; such as good coating. c) The operator’s policy and/or legislation regulating the operation of a field may set specific requirements with respect to inspection. These requirements may be in the form of: — how often to inspect certain types of equipment — acceptable condition after an inspection, i.e. wall thickness limits.

9.2 Inspection procedures The probability of failure evaluation gives an estimation of likely degradation mechanisms, together with their morphology and the data required to estimate the resulting probability of

DET NORSKE VERITAS


failure. This information can be used to optimise the inspection procedures and techniques, and to select which data should be recorded so that the RBI analysis can be updated after an inspection. The choice of inspection technique is based on optimising several factors that characterise each technique: — confidence in detecting the expected damage state — cost of technique, including manpower and equipment — extent of maintenance support required (scaffolding, process shutdown, opening of equipment). 1) Refer to Table 9-1 for the Confidence level for the technique chosen. 2) Estimate the cost of carrying out the inspection using the chosen technique. 3) Determine the probability of detection (PoD) for the mean extent of damage expected at the inspection time. 4) Select the technique with the highest value of:

Note that the inspection procedure should include strict requirements regarding reporting of inspection results, so that the data reported is relevant to, and can be readily used to update the RBI analyses and hence plan the next inspection. Table 9-1 Definition of confidence levels Confidence Description level Service conditions are well known and do not fluctuate appreciably. Inspection results show a consistent trend, with a high correlation coefficient when plotted against time. High

Degradation models are derived from many data sources showing results that are generally consistent; where probabilistic models are given, the standard deviation is low; Confidence CoV ≈ 0.33. Service conditions are well known and fluctuations are of a moderate nature.

PoD -----------------------------------------------------------------( Cost ⋅ Confidence CoV ) Normally, the technique that gives the greatest efficiency in detection should be chosen. However, it may be more cost-effective to apply a less efficient technique more frequently, and a the choice of technique can be based on the following simple cost-benefit analysis: The above method is applicable to the first inspection scheduled after the RBI analysis. Prediction of the next inspection timing is estimated once the inspection has been performed, and the above steps repeated using the inspection results.

A Highly Efficient inspection method is used and the measured results are validated.

Inspection results show a consistent trend, with some scatter and a reasonable correlation coefficient when plotted. Medium

A Normally Efficient inspection method is used and the measured results are validated. Degradation models are derived from only a small number of data sources showing results that are generally consistent; where probabilistic models are given, the standard deviation is moderate; Confidence CoV ≈ 1.0. Service conditions are not well known or have a considerable variation in pressures, temperatures or concentration of corrosive substances.

Low

There are no inspection results, or if they exist then they show only a general trend, with extensive scatter and a low correlation coefficient when plotted. A Fairly Efficient inspection method is used and the measured results are validated. Degradation models are derived from one data source only; where probabilistic models are given, the standard deviation is high; Confidence CoV ≈ 2.0.

10. Fitness for service Fitness for service calculations should be carried out where the inspection reveals damage of such significance that a rigorous assessment is necessary to evaluate whether further operation of the component is justifiable. Several standards address these calculations, the most comprehensive being API RP 579, with DNV RP F-101 and ANSI B31.G also appropriate for piping.

DET NORSKE VERITAS


APPENDIX A SCREENING A.1 Guidance for use It is recommended that the attached form is used together with the briefing notes, to guide and document the risk based inspection screening process. Typically, one form is used per system. The purpose of the screening is to identify components/systems, and sort them into two groups i.e.: — those that have a low risk, such that only limited follow-up by inspection/maintenance is anticipated — those of higher risk, that should be examined in more detail.

Additionally the screening session should identify conditions that are not otherwise included in the RBI guidelines. For example, reports of failure, operational upsets unusual or novel materials. It is recommended that the riskbased inspection screening process is carried out as a working-session amongst suitably qualified personnel, including staff with specific knowledge of the asset in question. The following type of personnel should be involved: — — — —

materials/corrosion inspection process/production safety.

DET NORSKE VERITAS


A.2 RBI Screening Form Installation:

Rev:

System No:

Description:

Function & boundaries: Dependent systems: Process & Materials information Product Service Code

Material

Op.Temp. °C

Op. Press bar.g

Chemical information/Comment/Reference

Consequence evaluation Consequence

High/Low

Justification / reasoning / reference

High/Low

Model (s)

Safety Economic Environment Other Probability evaluation Probability

Justification / reasoning / reference

Internal External Fatigue

Notes / comments:

Further Actions:

Agreement to evaluation Team

Date

Verification

Date

DET NORSKE VERITAS


A.3 RBI screening briefing

6)

The following are prompt questions to aid thought and discussions. These are by no means exhaustive.

A.3.2 Probability of failure Consider the following for present time, their change with time, and what might happen in upset or start-up conditions. Think also of what went on in the past, including testing during construction and commissioning, as well as past service. Do NOT include consideration of consequence in the probability! External degradation

— A combination of ‘High’ probability and ‘High’ consequence goes for detailed RBI. — A score of ‘Low’ for either is a recommendation for maintenance activity. — A scope of ‘Low’ for both is a recommendation for ‘No Further Action’. Guidance note: If the assessment has any cause for doubt, or information is lacking, a ‘High’ rating should be assigned and detailed assessment carried out if the result is ‘detailed RBI’. ---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---

A.3.1 Consequence of failure Consider the following points for assessing the consequences for failure. The worst case scenario regarding leak is usually the best case to consider – do NOT include consideration of probability in the consequence! Safety consequence 1) What is the effect of a leak? 2) Is the fluid poisonous, will there be ignition and / or explosion that might affect personnel? 3) What is the likely population around any part of the system that might leak – might there be deaths or injuries? Economic consequence (installation damage, production loss) 4) 5)

What is the likely reaction to the detection of a leak? Will the platform shut down production, or partially shut down? Will there be damage to the installation, by fire and / or explosion, or acid attack, resulting in replacement costs and lost production?

Are there clean-up costs associated with the leak?

1)

Coating: Is there a coating, what type is it, what is its quality, how long does it take to degrade significantly? 2) Insulation: Is there insulation, does it retain water, is there heat tracing (temperature effect on both internal & external degradation). 3) Is there any data that indicates current condition – inspection reports, for example. Internal degradation 4)

Consider possible degradation mechanisms arising from materials and fluids combinations. What about CRA or polymeric linings? Internal anodes? 5) What are the effects of temperatures and pressures, also partial pressures? Note these may change through the system, and metal temperatures can be affected by heat tracing. 6) Consider excursions in all process parameters. 7) Consider sand production rates, proppant production, acidising acid production. 8) Consider water breakthrough over time. 9) Consider increases in CO2 with time if there is gas reinjection. 10) Is there any data that indicates current condition – inspection reports, for example Fatigue 11) Are there areas where vibrations are expected, or have been observed. 12) Have any failures occurred?

DET NORSKE VERITAS


APPENDIX B CONSEQUENCE OF FAILURE EVALUATION B.1 General

B.3 Use of QRA data

The calculation of Consequence of Failure (CoF) is best carried out using Quantitative Risk Assessment (QRA) methodologies commonly used as part of the safety review and safety management of offshore installations. The following steps are recommended:

In the case where a QRA is available, the results can be used in the RBI. However, the following comments must be made:

1) Review system description. 2) Calculate release rate. 3) Calculate dispersion. 4) Effect modelling. In line with commonly accepted QRA methodologies, it is further recommended to use Event Tree Analysis (ETA) as the basis for the consequence assessment. In safety QRA an event tree is applied to help structure and model the probability and consequences of a hazardous event, including possible ignition and escalation. The root of the tree represents the initial hazardous event (e.g. a release of hazardous fluid), and the ‘branches’ of the tree indicate that the initial event can develop in different ways, depending on the likelihood of ignition, explosion or escalation. In RBI, the consequences are measured in terms of safety (loss of life), environmental impact (spill of oil), or economics (loss of production and equipment/installation damage or repair). If a QRA is available, the results may be used as input to the RBI CoF analysis. The QRA is usually focused on safety consequences, which implies that the environmental and economic effects will still need to be considered separately.

— If a QRA is available, the results may be used as input to the RBI CoF analysis. However, often the QRA is focussed on safety consequences, which implies that the environmental and economic impact will still need to be considered separately. — It must be noted that QRA analyses are usually based upon generic failure frequencies. RBI should not be based on these generic data, since the failure frequency should be specific to the degradation mechanisms of specific components. Therefore, these generic failure frequencies should be removed and replaced with the specific probability of failure calculated using this recommended practice (see Appendix C). In addition, care must be taken in that the QRA may not apply the same hole size distribution as those used in the recommended practice, i.e. only the consequence assessment of the QRA should be maintained; the failure frequencies and hole size distribution should be replaced based on specific degradation mechanisms (see Appendix C).

B.4 Method of overview B.4.1 General The method described in this appendix covers calculation of consequence of failure resulting from an ignited and an unignited leak in terms of safety, economic and environmental consequences. The relationship between the consequences and ignition is shown in Figure B-1.

B.2 Introduction

Leak

This appendix is intended to allow the calculation of the safety, economic and environmental Consequences of Failure (CoF) in sufficient detail and with adequate precision so that a RBI analysis can be completed where a QRA is not available. The risk is determined by assessment of both probability and consequence of failure, but the component inspection programme (inspection effectiveness, Probability of Detection, time to next inspection) is too a large extent based on the modelling of degradation mechanisms, and are therefore associated with the Probability of Failure (PoF). The CoF determines the magnitude of the risk associated with degrading and failing components, but it is justifiable to use simplified effect methods for RBI purposes. The methodology proposed in this document for the RBI (safety) CoF calculation is less complex than that used in QRA, but it possible to use the QRA results as input to the RBI assessment. QRA generally uses generic failure data and a generic hole size distribution, which are not specific to material or degradation mechanisms. This is because QRA covers both accidental events induced by material degradation, and those that can be attributed to other causes (e.g. mechanical impact, operator error). The RBI analysis is focussed on specific degradation mechanisms, so that the failure frequency (e.g. the expected leak frequency per year) and the hole size distribution (e.g. small, medium, large, rupture) must be derived for the specific degradation mechanisms. The consequences for these degradation mechanisms will be different, and hence event trees are required for the hole sizes relevant to the degradation mechanisms. By doing this, the overall consequences derived from the event tree –and hence the inspection programme- will be related to the actual damage mechanisms.

Ignited Safety

Unignited Economic

Deferred production

Environment

Damage to eqpt & structure

Figure B-1 Calculation of consequence of failure

B.4.2 Steps in consequence assessment The following calculation steps are required to assess the consequences to personnel safety, environment and asset damage: 1) System description. Define the system parameters of interest for the CoF assessment. Generally the ‘system’ will consist of the topsides of an offshore installation, or part of it. More guidance is given in Section B5. 2) Release rate calculation. Determine the leak rate or release rate. The leak rate is a function of the fluid released (oil or gas), phase, pressure and temperature. More guidance on leak rate calculation is given in Section B6. 3) Dispersion calculation. Model the dispersion of fluid or gas. Gaseous releases will mix with air, liquid releases can form aerosols (spray release) or form as pools, which could evaporate. Dispersion is required in order to form a flammable or toxic vapour cloud, which can affect person-

DET NORSKE VERITAS


nel and equipment. Dispersion calculations generally require the use of detailed computer simulation models, but some simplified models are presented in Section B7. 4) Effect Modelling. If the vapour cloud is flammable, and its concentration is within the flammable range, a sufficiently strong ignition source could ignite the cloud. This would result in a fire or explosion, the latter generally being more severe as escalation could occur. Whether or not a cloud could explode depends on the properties on the flammable gas (type of fuel, fuel concentration), the size and location of the cloud, the location and strength of the ignition source, and the physical properties of the module/level (e.g. confinement, obstacles) in which the cloud is present. If the contents of the cloud is flammable, then both ignited and unignited consequences should be evaluated, otherwise (i.e. for toxic releases) unignited consequences alone can be evaluated. Flammable releases are further discussed in Section B8; toxic releases are discussed in Section B9. It must be noted that some fluids (e.g. hydrogen sulphide) are both flammable and toxic, and that other fluids are mixtures (e.g. methane, ethane, carbon dioxide and hydrogen sulphide).

3) Representative fluid. For each isolatable section a representative fluid will need to be chosen, i.e. the accidentally released fluid that will be modelled. A fluid is modelled as flammable or toxic, but it must be noted that some fluids (e.g. hydrogen sulphide) are both flammable and toxic. Also, some fluids are mixtures (e.g. methane, ethane, carbon dioxide and hydrogen sulphide), which requires the use of “representative fluids”. Care must be taken in selecting the appropriate representative fluid, in particular when a predominantly flammable mixture (e.g. well gas) has a high concentration of toxic fluid (e.g. hydrogen sulphide). In case the fluid is a mixture of hydrocarbons, it is recommended to use the hydrocarbon with highest mol%, or an “weighted” hydrocarbon based on the average molecular weight of the mixture. 4) Ignition sources. The ignition sources in the modules must be counted (‘equipment count’), in particular the number of pumps, compressors and generators. In addition the number of hot work hours must be estimated in relation to actual platform practices.

It must be noted that the equations and graphs given in the sections below represent a large simplification of a complex set of calculations, and are presented so that manual calculation can be used to arrive at a reasonable evaluation. If accuracy is required, then the user should refer to standard QRA methodologies and algorithms. It should further be noted that the consequences of failure are dependent on the size of the leak, both for ignited and unignited consequences. The expected hole size as a function of degradation mechanism can be found by reference to Appendix C, and thus the consequences tailored to the actual degradation experienced by the part evaluated. The implication of this is that some degradation mechanisms may require earlier inspection on the grounds of higher consequence despite having a lower probability of failure than others.

Mass leak rates (or: release rates) are given as a function of pressure and hole size in Figure B-2 and Figure B-3, for gas and oil respectively, based on representative fluid and gas densities. From the figures it can be concluded that the releases rates are substantially affected by the hole size. Therefore separate event trees must be developed for different hole sizes. Also, the selection of the hole size distribution (i.e. distribution of small, medium, large holes) must be done with care. Reference is made to Appendix C for the appropriate leak sizes as input to the calculations. 1.0E+04

Gas 1.0E+03 Leak rate kg/s

B.4.3 Use of Event Trees The calculation of Consequence of Failure (CoF) is best carried out using Quantitative Risk Assessment (QRA) methodologies commonly used as part of the safety management of offshore installations. In particular, it is recommended to use Event Tree Analysis (ETA) as the basis for the consequence assessment.

B.6 Mass leak rates for gas and oil

300 mm rupture

1.0E+02

50 mm leak 25 mm leak

1.0E+01 1.0E+00

5 mm leak

1.0E-01 1.0E-02 1.0E-03

B.5 System description

1

1) Modules. Topsides of offshore installations are usually built with discrete modules or levels, having specific functions, and active and passive barriers that contain or mitigate effects of failures. It is therefore general practice to address the consequences for each’module’. For each module it is necessary to identify the dimensions, ventilation rates (natural or forced), and the type of barriers (walls, floor) applied. In particular the explosion and fire resistance of the barriers needs to be reviewed. 2) Isolatable sections. The isolatable section (or inventory group) is associated with the (maximum) amount of hazardous fluid that can be released in the event of a leak. The amount of hazardous fluid contained in an isolatable section depends on the inventory of process equipment and piping, and the location of emergency shut-in valves. These valves (often called Emergency Shutdown Valves, or ESDVs) serve to isolate a leak and hence contain the release of hazardous fluid. ESDVs are generally found at the import and export risers, and at strategic locations e.g. to isolate the separator(s), and the gas compression section.

10 100 Pressure, bar.g

1000

Figure B-2 Mass leak rate gas

1.0E+04

Oil

300 mm rupture

1.0E+03 Leak rate kg/s

The system description involves a review and description of the following parameters.

50 mm leak

1.0E+02

25 mm leak

1.0E+01 5 mm leak

1.0E+00 1.0E-01 1.0E-02 1.0E-03 1

Figure B-3 Mass leak rate oil

DET NORSKE VERITAS

10 100 Pressure, bar.g

1000


B.7 Dispersion modelling Once the leak rates have been determined, the next step is to model the dispersion of fluid. Pressurised gaseous releases will mix with air, liquid releases can form aerosols (spray release) or form as pools, which could evaporate. Dispersion is required in order to form a flammable or toxic vapour cloud, and which affect personnel and equipment. Dispersion calculations generally require the use of detailed computer simulation models, but if these are not available the simplified methodology presented below can be used. The model requires the following information: — — — — — —

volume of the module, (m3) air change rate (number of air changes per hour) gas density, of leaking fluid, (kg/m3) flash fraction (of gas from the leaking oil) (-) mass leak rate, (kg/s) equipment count (-).

The volume of the module should be corrected for major ‘obstacles’ present in the module (e.g. separate rooms, large equipment). If the module is mechanically ventilated, the air change rate can be based on the design capacity of the HVAC system. If the module is naturally ventilated, the air change rate is often a function of the geometry of the module, wind speed and predominant wind direction. If no data is available it is recommended to use an air change rate of 30 Air Changes per Hour. Mass leak rate is a function of leak hole size, pressure and fluid, reference is made to Figure B-2 or Figure B-3. Flash Fraction refers to the fraction of volume released that is gas phase, and is therefore equal to 1 for gas. The value for oil will depend on the fraction of gas within the process stream. The concentration of flammable or toxic gas in the module is calculated as follows:

ì é Mass Leak Rate • Flash Fraction gas ù é No. Air Changes per Hour • Volume of Module ù ü ïê ú−ê úï Gas Density 3600 úû ë ï êë ûï C= í ý • Time Volume of Module ï ï ï ï î þ

If the ventilation rate exceeds the leak rate, then the average concentration of gas in the module will be approximately zero. However, note that ventilation is not uniform within a module, and areas will exist where the concentration of gas is different to that calculated. It is therefore possible that the concentration in a sheltered part of the module will exceed the LEL, giving a finite probability of ignition. The time limit over which the concentration is relevant can be taken as that used in detection of gas and de-energising of equipment within the module. The concentration calculated above is applied as input to determine the ignition probability (for flammable releases), and the consequences to personnel (for toxic releases). This is further explained in Section B8 and Section B9 respectively.

— isolatable section — module — leak size. B.8.2 Step 1: Development of an event tree The simplified Event Tree Analysis (ETA) used is shown in Figure B-4. The ETA considers the events of ignition and subsequent escalation by explosion to adjacent modules only, given that a leak occurs (i.e. PoF = 1.00). This is a conservative simplification that ignores the possibility of smaller explosions that will be contained within the module where the ignition occurred. Leak

B.8 Effect assessment of flammable releases

Ignition ? No

B.8.1 Calculation method The following steps should be followed to determine the ignited consequence of failure: 1) Development of an event tree. 2) Calculation/estimation of event tree branch probabilities. 3) Calculation of the consequences for all end event tree outcomes; CoF could be measured in terms of loss of life (safety), economics (asset damage, deferred production), and environmental impact. 4) Calculation of the CoF contribution of all end event tree outcomes. 5) Sum all CoF contributions to calculate the weighed total expected consequences for safety, economics and environmental impact. Calculations should be made for each combination of isolatable section, module and leak size that are to be assessed. This is because the consequences of an ignited event are determined by what equipment is within the module to be damaged as well as the amount of flammable and explosive species released; the probability of ignition and explosion is dependent on the ignition sources within the module. This means that the steps given above and described below must be repeated for each combination of:

Yes Escalation by explosion ?

End event 1

No

Yes

End event 2

End event 3

Figure B-4 Simplified event tree

Section B8.4 describes the calculation of branch probabilities for these events so that the probability of occurrence of each end event can be calculated. The probability of occurrence of each end event multiplied by the consequence of that end event (End Event 1, 2, or 3 in Figure B-4) give the Consequence of Failure (CoF) contribution of that end event. The CoF contributions summed for all conditions and hole sizes then becomes the total CoF associated with the degradation mechanism causing the release. This is illustrated in Figure B-5, and further explained in Section B8.5 and Section B9.

DET NORSKE VERITAS


The end events numbered in Figure B-4 are described in Table B-1:

— end events 2 and 3 are associated with ignited events — end event 1 is a non-ignited event.

Table B-1 Description of End Events for Figure B-4 Occurrence probability P1 = (1 – P Ign ) P2 = P Ign • (1 – P Esc)

End event No. Description 1 2 3

There is a leak, but neither ignition nor explosion occurs. There is a leak, and the leaking gas is ignited. However, there is no explosion, only a fire. There is a leak and the leaking gas is ignited. This is followed by an explosion, giving a blast overpressure that exceeds the design capacity of the blast wall, causing damage to the neighbouring module.

PIgn = Probability of ignition

PEsc = Probability of escalation.

Escalation by Explosion ?

Ignition ? Leak (PoF = 1.00)

Yes

P3 = P Ign • P Esc

CoF of End Events Probability of Occurrence Safety Economics Environm.

Contribution CoF Safety

Economics Environm.

End Event 3

P3

S3

B3

E3

P3 x S3

P3 x B3

P3 x E3

End Event 2

P2

S2

B2

E2

P2 x S2

P2 x B2

P2 x E2

End Event 1

P1

S1

B1

E1

P1 x S1

P1 x B1

P1 x E1

Yes No

No Total CoF

(P1 x S1) + (P1 x B1) + (P1 x E1) + (P2 x S2) + (P2 x B2) + (P2 x E2) + (P3 x S3) (P3 x B3) (P3 x E3)

Figure B-5 CoF calculation for Simplified Event Tree: One event tree for each hole size

B.8.3 Step 2: Event tree branch probabilities B.8.3.1 General The probability of ignition, given that a leak occurs, is a function of the leak rate, concentration of flammable species, and the number of ignition sources within each module. The calculations in this section are related to the leak hole size and cover the following: — concentration factor, Pv — ignition factor related to continuously present sources, Pc — ignition factor related to random discrete sources, Pd. The calculation should be performed for each combination of representative fluid in an isolatable section, leak hole size, and module, and therefore the use of a spreadsheet program is recommended. The effects of the above terms are such that the probability of ignition increases as the concentration of the gas approaches the Lower Explosive Limit (LEL) of the gas concerned. However, the calculated concentration is an average value, and pockets of higher and lower concentration will occur within the module as the leak progresses, thereby affecting ignition. In addition, sources of ignition are required. These should have been identified in the System Description, see Section B5. These are accounted for by the ignition factors Pc and Pd, increasing the ignition probability as the numbers of equipment items and hot work hours increases. It is assumed in the calculations that electrical ignition sources are de-energised after a maximum of 10 minutes (i.e. 600 seconds) after the leak starts. B.8.3.2 Calculation of concentration factor, Pv The concentration factor, Pv is calculated by: Pv = C / LEL If C > LEL then Pv = 1.00

Where: LEL is the Lower Explosive Limit for the gas concerned, typically 5% for methane and 2% for propane. C is the concentration of the gas concerned, given as a function of time (in seconds), mass leak rate and ventilation rate. C has been calculated in the dispersion phase, see Section B7. B.8.3.3 Calculation of ignition factor, Pc This accounts for contact between the flammable substances and hot surfaces or other continuously available sources of ignition. It is based on the expectation that equipment Ex-ratings are largely in accordance with mainstream international standards. Pc = 1 – [(1 – Q1*Area) • (1 – Q2*Hot Work hours) • (1 – (Q3A*Pumps + Q3B*Compressors + Q3C*Generators) ) • (1 – Q4*Area)] The constants Q1 through Q4 are listed in Table B-2. Table B-2 Constants for calculation of Pc Constant Q1 Q2 Q3A Q3B Q3C Q4

Oil 5.7 x 10-5 5.7 x 10-5 4.4 x 10-3 1.5 x 10-2 3.5 x 10-2 6.7 x 10-4

Gas 3.3 x 10-6 5.7 x 10-5 6.5 x 10-5 1.5 x 10-3 3.5 x 10-3 2.0 x 10-5

B.8.3.4 Calculation of ignition factor, Pd This accounts for contact between the flammable substances and equipment which fails randomly, (i.e. discrete failures) giving access to the ignition sources. It is based on the expecDET NORSKE VERITAS


tation that equipment Ex ratings are largely in accordance with mainstream international standards. Pd = 1 – [ (1 – R1*Area) • (1 – (R3A*Pumps + R3B*Compressors + R3C*Generators) ) • (1 – (R4A + R4B*Area))] The constants R1 through R4B are listed in Table B-3. Table B-3 Constants for calculation of Pd Constant R1 R3A R3B R3C R4A R4B

Oil 3.5 x 10-4 2.0 x 10-3 1.6 x 10-2 3.7 x 10-2 9.0 x 10-5 3.5 x 10-4

Gas 2.0 x 10-5 7.6 x 10-5 1.6 x 10-3 3.7 x 10-3 5.0 x 10-6 1.7 x 10-5

B.8.3.5 Calculation of probability of ignition, PIgn Probability of Ignition, given that a leak occurs, is given by: PIgn

= Pv•( Pc + Pd – Pc Pd )

Correlation of the mass leak rates with the respective leak hole sizes implies that the probability of ignition, and subsequent consequences, are related to the damage mechanism. It is therefore necessary to calculate consequences for each relevant leak hole size according to the expected degradation mechanism. B.8.3.6 Probability of escalation by explosion, Pesc An explosion that occurs after an ignition in one module, may result in a fire or blast that causes substantial damage in neighbouring modules, even when these are separated by blast/firewalls. Calculation of the blast overpressure is a complex process outwith the scope of this document, and therefore the results of a dedicated explosion analysis should be used to find the estimated blast overpressures. If such information is not available, then a conservative procedure for estimating the probability of escalation by explosion are given in the rules below. The probability of such escalation to the neighbouring module by explosion is given by the following equation, which is based on a number of ProExp simulations: PEsc= A•EXP[B]•Blast Overpressure / Blast Wall Design Pressure PEsc =1 if: — the Blast Overpressure > 14 • Blast Wall Design Pressure — the Blast Wall Design Pressure is unknown — the Blast Overpressure is unknown Where Blast Overpressure and Blast Wall Design Pressure are given in bar.g, and A and B are given in Table B-4 as functions of the mass leak rate of gas: Table B-4 Constants for use in calculation of P ESC Mass leak rate kg/s <1 1 to 10 > 10

A 0.5403 0.9174 1.0538

B -38.193 -4.5544 -2.6494

B.8.4 Step 3: Consequence of failure for end events B.8.4.1 Safety consequences The safety consequences are calculated based on the average number of personnel present in the module that is impaired, either immediately (i.e. the leak occurs in this module) or delayed (i.e. due to escalation). In calculating the average

number of fatalities, any difference in night and daytime population must be accounted for. Note also that a toxic or asphyxiating release may give fatalities despite ignition being absent. The CoF are determined for the event tree outcomes, i.e. S1, S2 and S3 in Figure B-5. B 8.4.1.1 Ignited end events As a conservative assumption, it must be assumed that all personnel remaining in the impaired module are fatally injured. B 8.4.1.2 Non-ignited end events Safety consequences are not addressed specifically, as they are dependent on personnel being in the vicinity of failure at the failure instant. A number of issues that may cause death or injury should be considered: — An explosion may release high velocity fragments, shrapnel, etc. — A high-pressure release may direct a jet of liquid or gas directly at a person. — There may be a release of toxic gases, e.g. hydrogen sulphide (see Section B9). B.8.4.2 Economic consequences Generally economic consequence can be estimated from three components: — materials required for repairs — manpower and mobilisations — deferred production caused by taking part or all of the installation out of service. The very high value revenue streams from offshore installations usually imply that deferred production is the major contributor to economic consequences. The economic consequences are calculated as the sum of the loss of production (deferred production) and the costs (including manpower and mobilisation) associated with repairing or replacement of equipment as a result of the initial leak or subsequent explosion. ‘Deferred production costs’ and ‘repair costs’ are discussed separately below. The CoF are determined for the event tree outcomes, i.e. B1, B2 and B3 in Figure B-5. B 8.4.2.1 Cost of repairs to the module for ignited end events It will be necessary to judge the extent of damage within a module, and therefore the cost of repairs and replacement, as a result of a fire or explosion. These costs can be taken from the project new-building data corrected for inflation and net present value, or it can be estimated on the basis of general industry knowledge. It should account for repairs and replacement of structural, electrical, HVAC, control, piping, equipment (pumps, compressors etc.). Note that the cost of deferred production is not included in the repair cost. B 8.4.2.2 Cost of deferred production for ignited end events It is likely that production will not be possible whilst repairs take place. The downtime can be based on judgement, otherwise Figure B-6 can be used to estimate the number of days downtime. The cost of the lost or deferred production is derived as product of downtime and deferred production. Production loss related to major damage caused by ignited events is determined by the reconstruction and repair time, which is plant/project specific. It is largely determined by long-lead items such as compressors, pressure vessels and heat exchangers made of special materials. For ignited cases (i.e. End Events 2 and 3 in Figure B-4 and Figure B-5) the downtime can be related to the amount of damage sustained, if no other data is available. A relationship de-

DET NORSKE VERITAS


rived from the ’Dow Fire and Explosion Index’ is considered to give a reasonable correlation between property damage and repair/outage time, see Figure B-6. This figure can be used to-

gether with the value of daily production, to estimate the value of deferred production arising from shutdown during the repair period.

1000 0.6

Days Outage

ymax = 28.18x 100

0.6

ymean= 20.87x

}

10

70% Probability Range

1 0,1

1

10

100

Property Damage ($MM)

Figure B-6 Days outage as a function of damage cost (from Dow 3)

B 8.4.2.3 Cost of repairs to the module for non-ignited end events Similar to ignited end events, it will be necessary to judge the extent of damage within a module, and therefore the cost of repairs and replacement, as a result of the leak. Very often these are limited to the failing equipment/piping itself, or the equipment/piping in its direct vicinity. Generally these costs will be small compared to the cost of deferred production, see below. B 8.4.2.4 Cost of deferred production for non-ignited end events It is recommended that a number of downtime profiles associated with deferred production are defined such that each part of the installations systems that has an effect on production can be assigned a profile. These profiles describe the amount of production that can occur from the time a leak begins, until the completion of repairs and resumption of normal operations. The profiles can then be used as representative for the loss of production over time for individual equipment and piping. The calculation below can be based on the PFDs and P&IDs for the installation. It involves reviewing the production process from well to export facilities, and determining what the effect on production would be if a leak arose in each section of piping and each piece of equipment, and developing the deferred production profiles on this basis. Utilities systems should be included because in many cases their failure will cause failure of the process (e.g. water injection, instrument air, chemical injection) or require shutdown (e.g. unserviceable firewater). The following steps should be followed: 1) Review the contents of the part. If hydrocarbon-containing, a leak is likely to give rise to an alarm and production shutdown. There may be a delay whilst the area is degassed and made safe. If the contents are non-hazardous, then there may not be a shutdown, but if there is, then there may be some time taken in finding and eliminating the leak. 2) If there are parallel trains that can be isolated from the leaking section, then after isolation, production may be

able to recommence at a lower rate – depending on the capacity of the parallel trains. 3) The time taken to increase production from one level (e.g. from run-up, partial run-up) to another is individual to the installation and reservoir conditions, and should be determined though consultation with the Operations personnel for the installation. 4) Estimate the repair or replacement times that are likely, include availability of repair / replacement equipment, dimensions of the piping and equipment to be repaired, the service of the equipment (hazardous/non-hazardous), materials of construction, the size of the leak, and the company maintenance and repair strategy. B.8.4.3 Environmental consequences In considering environmental consequences, releases can be classified as oil (including condensate), gas or chemical. These are further discussed below. Chemical releases are usually subject to legislative, or company imposed limits for releases into the environment. The consequences of exceeding these limits are typically case by case fines. The CoF are determined for the event tree outcomes, i.e. E1, E2 and E3 in Figure B-5. Environmental consequences are often related to non-ignited cases, i.e. end events E1 only. B 8.4.3.1 Measurement units and acceptance criteria The measurement units for environmental consequences can be volume or mass released, or units of currency. The acceptance limit must be given in the same units. The use of mass or volume released facilitates calculation, as the contents, phase and volume of the ESD segment of the process are used elsewhere in consequence calculations. B 8.4.3.2 Oil releases The consequences of oil releases can be associated with political repercussions, a damaged reputation and clean-up costs. Environmental consequences from offshore topside oil leaks are considered to present only a minor damage to global and local biotopes. Generally, the volume that can be released is

DET NORSKE VERITAS


limited to the contents of the equipment and even more so by the contents of an isolatable segment. Releases from pipelines, drilling activities, and from storage vessels represent a significantly larger volume and must be considered separately. Direct costs related to oil releases are mainly related to the clean-up costs if the spill drifts towards shore. The actual effect will depend on the location of the field, oil type, oil drift conditions, temperature, evaporation, etc. For a given case a fixed money value per tonne of oil released may be used. The cost of clean-up for ship accidents may vary between US$ 700 to US$ 50 000 per tonne released, typically for accidents close to shore. Offshore platforms are usually located several miles offshore and, where no other basis is available, e.g. company goals, $10 000/ton is suggested as a conservative value for application in a coarse evaluation: i.e. the cost consequence for oil release, in monetary units per volume unit is given by: Cenvironment= Vrelease • ( Ccleanup + Clostproduct) Where: Vrelease Ccleanup

= Volume of oil released on to the sea = Cost of clean-up, monetary units per released volume units Clostproduct= Value of oil that is lost in the release, monetary units per volume Note that the Vrelease can be adjusted to account for specific factors on the installation, for example: — the volume of oil released will be affected by the phases in the isolatable segment. For example, in two-phase system, the oil content will be less than total volume — consideration should be given to possible oil release resulting from systems such as produced water, oily water — not all oil from a release may reach the sea: drains, flooring (open, closed), etc. may reduce the volume reaching the sea. B 8.4.3.3 Gas release Gas releases to the atmosphere have received less attention than oil releases and are more typically controlled releases subject to taxation or concessions for flaring or venting. Accidental releases may be subject to fines issued on a case by case basis depending on specific circumstances. It is recommended that the consequences of gas releases should be considered as part of the screening process. Any systems appearing to have an unacceptable release consequence should be referred to more detailed evaluation. B 8.4.3.4 Other fluids/chemicals A number of chemicals are used offshore for inhibition, chemical treatment, etc. that may be harmful to the environment. Chemical releases are usually subject to legislative, or company imposed limits for release of certain chemicals into the environment. The consequence of exceeding these limits is typically fines that are stipulated on a case by case basis depending on the circumstances. It is recommended that the consequences of chemical releases should be considered as part of the screening process. Any systems appearing to have an unacceptable release consequence should be referred to more detailed evaluation. B.8.5 Steps 4 and 5: Total consequence of failure B.8.5.1 Safety consequences The consequences to personnel safety for each end event (S1, S2, and S3) determined in step 3 are multiplied by the probability of occurrence (P1, P2, and P3) of each end event, in order to give the CoF contributions. This is shown in Figure B-5. The total safety consequence of failure is the sum of the end

event consequences. It must be stressed that this calculation must be repeated for all isolatable sections, hole sizes and modules, in order to correctly model the risk contribution of individual degradation mechanisms. B.8.5.2 Economic consequences The economic consequences for each end event (B1, B2, and B3) determined in step 3 are multiplied by the probability of occurrence (P1, P2, and P3) of each end event. This is illustrated in Figure B-5. The total economic consequence of failure is the sum of the end event consequences. B.8.5.3 Environmental Consequences The environmental impact for each end event (E1, E2, and E3) determined in step 3 is multiplied by the probability of occurrence (P1, P2, and P3) of each end event. This is illustrated in Figure B-5. The total environmental consequence of failure is the sum of the end event consequences.

B.9 Assessment of the effect of Toxic releases B.9.1 General Generally pure toxic substances are not present in large quantities on offshore installations. Hydrogen sulphide is a highly toxic substance, but generally does not exist in pure form on an offshore installation. Hydrogen sulphide is mostly found as a component of a mixture of predominantly hydrocarbons. Note that nitrogen and carbon dioxide can have an asphyxiating effect since they replace the oxygen available in air. Hence in high concentrations (generally in confined areas), these could cause fatal injury to personnel. B.9.2 Asphyxiating fluids The modelling is similar to that for gas and oil, and involves release rate calculation, dispersion, and consequence/impact assessment. The release rate can be estimated by using Figure B-2 and Figure B-3, depending on the phase of the fluid during release. The gas dispersion (and hence the gas concentration) can be modelled as indicated in Section B7. For conservatism, a flash fraction of 100% can be assumed. The consequences can be assessed by considering the release of the asphyxiating fluid as a non-ignited event, described in Section B8. This means that only End Event 1 in Figure B-4 and Figure B-5 needs to be considered. — Reference is made to Section B8 ‘Non-Ignited Events’ for calculation of the economical and environmental consequences. — The safety consequences are determined by the remaining concentration of oxygen in the air: it is recommended to assume (100%) fatalities in a module if the oxygen concentration reduces to less than 15 vol.%. B.9.3 Hydrogen sulphide The modelling is similar to that for gas and oil, and involves release rate calculation, dispersion, and consequence/impact assessment. Note that H2S ignites readily, as it has a lower LEL and wider explosive limit range than methane. The release rate can be estimated by using Figure B-2 and Figure B-3, depending on the phase of the fluid during release. The gas dispersion (and hence the gas concentration) can be modelled as indicated in Section B7. For conservatism, a flash fraction of 100% can be assumed, i.e. all hydrogen sulphide released becomes airborne.

DET NORSKE VERITAS


The consequences should be assessed by considering the release of hydrogen sulphide as both a non-ignited and ignited event. The safety consequences for the non-ignited event are determined by the concentration of hydrogen sulphide and the exposure time. The fatality rate is normally calculated from a fluid specific Probit relation, which requires the concentration of toxic gas in the confined area (in this case the module) and the exposure time as input. For the simplified RBI method proposed it is recommended to work with a single value criterion, i.e. to relate the fatality fraction to the concentration only. A person exposed to a hydrogen sulphide vapour with a concentration between 500-1000 ppm (parts per million) will suffer from eye irritation, vomiting and possibly immediate acute poisoning (/4/). LC50 values (i.e. concentration at which 50% of exposed population is killed) for 30 minute exposure are in the range of 450 to 1600 ppm, depending on which literature source is quoted. In the absence of specific limits given by the

Operator for tolerable exposure to H2S, it is recommended to use a concentration of 690 ppm as criterion: if the concentration of hydrogen sulphide in the module exceeds this value, all persons remaining in the module are assumed to be killed. Below this criterion, no fatalities occur.

B.10 References /1/ /2/ /3/ /4/

Guidelines for Chemical Process Quantitative Risk Analysis. American Institute of Chemical Engineers, NY, 1989. Kostnadsanalyse og måltall, Norsk sokkels konkuransesituasjon, NORSOK 1995. Dow Fire and Explosion Index. Hazard Classification Guide, 6th ed. 1987. Activity Responsibility Function, Guideline for Quantitative Risk Assessment, DNV, 1998.

DET NORSKE VERITAS


APPENDIX C PRODUCT SERVICE CODES, MATERIALS DEGRADATION AND DAMAGE MECHANISMS C.1 Introduction

1) Define the material type, as given in Table C-1.

The purpose of this appendix is to guide the RBI analyst with:

2) Define the appropriate Product Service Code and identify the potentially corrosive contents. Refer to Table C-2.

— identifying which degradation mechanisms can be expected where — determining damage rates and/or probability of failure for specific materials exposed to specified service conditions.

3) Determine the service conditions applicable to the part in question, comprising temperatures, pressures, amounts of corrosive species.

This appendix presents a number of simplified models for internal and external degradation. The damage rates are probabilistic and are thus given as a distribution type with a mean value, standard deviation, or equivalent. It is emphasised that these degradation models are not exhaustive but are recommended used to secure a consistent and documented methodology when better data is not available. Although the product service codes are used to determine what degradation mechanisms can be expected, this is a simplification and the limitations must be recognised, and accounted for in each analysis: — The product service code does not always provide sufficient differentiation with respect due to fluid corrosiveness. It is necessary to review the system and split into more detailed areas, e.g. to identify where hydrocarbon gas is dry and wet. — The product service code may not reflect some operational practices, e.g. closed drains may be used as a by-pass system. — The product service code may not reflect content, e.g. closed drains may be used as a by-pass system. — Some of the product service codes are so unspecific or variable that the contents must be assessed by suitably qualified personnel. — The materials listed are intended to give general and conservative results. The calculations can be improved if more precise materials specifications are used. — The models have limits on their applicability, and it should be verified that the model is applicable to the situation at hand; in all cases, there is an upper temperature limit of 150°C. — Where the conditions given in this appendix do not match those found in the plant, then specialist advice must be sought.

C.2 Internal degradation The internal degradation models allow calculation of probability of failure for different materials in most fluids as defined by product service codes that are used on offshore topside systems. The product service codes have been arranged in groups where similar degradation mechanisms are expected: — — — — —

insignificant chemicals hydrocarbons waters. vents.

The user is strongly advised to ensure that the conditions on the asset in question match those listed in the section before using the models; deviations should be referred to a specialist for advice. The calculation of probability of failure due to internal degradation follows the process below:

4) Go to the section shown in Table C-2 that is relevant for the Product Service Code (Sections C.6.2 to C6.8) and calculate the degradation rate or probability of failure as applicable.

C.3 External degradation The external degradation models allow calculation of probability of failure for different materials on the assumption that these are exposed to the marine atmosphere, or otherwise expected to be wetted by seawater, e.g. deluge system. Any coatings and insulation should be evaluated for their protective capability. Insulation may retain and concentrate salt water on the material surface, thereby promoting corrosion and/or cracking. Seawater may also collect on pipe supports and clamps and similar locations, promoting corrosion damage on uninsulated piping. The calculation of external degradation follows the process below: 1) Define the material type as given in Table C-1. 2) Determine the service conditions applicable to the part in question, comprising temperatures, pressures, presence and condition of coating, presence and water-retentive capacity of insulation. 3) Go to Section C.6.9 and calculate the degradation rate or probability of failure as applicable.

C.4 Materials definition The following type of materials are used in this documents. Table C-1 below links the abbreviations used and the specific names. Table C-1 Definition of materials Material Description Includes Type Carbon and Carbon-Manganese steels, CS Carbon Steel low alloy steels with SMYS less than 420 Mpa Austenitic stainless steels types UNS S304xx, UNS S316xx, UNS S321xx or similar 22Cr duplex UNS S31803 and 25Cr suSS Stainless Steel per-duplex UNS S32550, UNS S32750 stainless steels or similar Super austenitic stainless steel type 6Mo, UNS S31254 Ti Titanium Wrought titanium alloys Copper 90/10 Cu-Ni or similar CuNi Nickel alloys Fibre Fibre Reinforced Polymer materials with FRP Reinforced polyester or epoxy matrix and glass or Polymer carbon fibre reinforcement Nickel based Nickel based alloys Ni alloys Material other All other materials not described above Other than the above

DET NORSKE VERITAS


C.5 Product service code definition Table C-2 lists the two character Product Service Codes and the contents that are assumed as the basis for internal degradation models. Different product codes designations will be encountered for different operators and installations. It is important that instal-

lation specific codes are checked and matched to the descriptions given in the table. Incorrect evaluations with the degradation mechanisms may occur if the fluids do not conform exactly with the descriptions below such that specialist advice should be sought if there is are any discrepancies.

Table C-2 Product Service Code with descriptions and degradation mechanism group Product Service Description Code AI Air Instrument Compressed air system for pneumatic controllers and valve actuators and purging of electrical motors and panels. Comprises dry, inert gas AP Air Plant Compressed air system for air hoists/winches, air motors, sand blasting, spray painting, air tools and motor purging. Typically, not dried, so parts may contain water vapour and condensation. Condensed water can be considered as being fresh BC Bulk Cement Cement powder, generally in dry form BL Cement Liquid Additive May be proprietary liquids. Plasticisers, accelerators and retarders added as liquid to liquid cement to adjust the flow and curing characteristics CA Chemical Methanol Used to prevent and dissolve hydrates in water containing hydrocarbon gas systems.. Should contain less than 2% water by volume. May be used as water scavenger CB Chemical, Biocide May be proprietary fluid biocide such as glutaraldehyde, or chlorine (from electrolysis of seawater or from addition of sodium hypochlorite, etc.) CC Chemical, Catalyst May be proprietary fluid catalyst for chemical reaction control CD Chemical, Scale inhibitor May be proprietary scale inhibitor used to prevent scale problems arising from BaSO4 (typically downhole) and CaCO3 (typically surface and heater problems) CE Chemical, demulsifier or defoament May be proprietary fluid defoament / emulsion breaker for water content control in oil by aiding separation of oil and water CF Chemical, surface active fluid May be proprietary fluid surfactant with dual hydrocarbon and polar character and dissolves partly in hydrocarbon and partly in aqueous phases CG Chemical, Glycol 100% glycol, which is not considered corrosive CH Chemical, AFFF Fire fighting foam additive to firewater CJ pH Controller May be proprietary chemical for buffers typically to raise the pH CK Corrosion Inhibitor May be proprietary fluid for injection as corrosion protection. Usually not corrosive in undiluted concentration CM Cement High/Low Pressure Cement mixed with a carrier, usually seawater, and used downhole. Likely to be erosive CN Chemical, Mud Additive Typically mud acids (e.g. HCl, HF) CO Chemical, Oxygen Scavenger Oxygen scavenger. (Typically, sodium bisulphite Na2S). Corrosiveness depends on type, and possibly concentration and temperature. Moderate to low concentrations can be tolerated in a variety of materials, but high concentrations may be corrosive. CP Chemical, Polyelectrolyte/ Flocculent May be proprietary fluid flocculent for oil content control in produced water CS Chemical, Sodium Hypochlorite Solution Concentrated NaClO for supply to each consumer. Corrosiveness depends on concentration and temperature CV Chemical, Wax Inhibitor May be proprietary wax inhibitor for use in produced liquids to hinder formation of waxes as temperatures are reduced. CW Chemical Glycol/Water (Rich Glycol to regenerator) Regeneration system to remove water from glycol/water. Part of the gas drying system. The system is in contact with hydrocarbons. This, and the rich part of the regenerator, is likely to be the most corrosive area of the system. System fluids are regularly checked for pH due to glycol breakdown. Note: Lean glycol corrosiveness is dependent on water content and composition

DET NORSKE VERITAS

Degradation Group Insignificant Waters

Chemicals Chemicals Insignificant Chemicals Chemicals Chemicals Chemicals Chemicals Insignificant Insignificant Chemicals Insignificant Chemicals Chemicals Chemicals

Chemicals Chemicals Chemicals Chemicals


Table C-2 Product Service Code with descriptions and degradation mechanism group (Continued) Product Service Description Code DC Closed Drain System Hydrocarbon liquids drains from platform equipment and piping, collected in a closed vessel. Intermittent use or low flow rates leading to stagnation. May have fuel gas blanket at low pressure. Liquids comprise hydrocarbon oil, gas, water, in proportions according to the equipment drained. There is potential for microbial action DO Drain, Open Drain from helideck, roof drain and drain from test lines, etc. Mostly seawater and rainwater, but some oil likely. Under atmospheric pressure DS Drain, Sewer/Sanitary Closed system. Drain from living quarters containing domestic sewage DW Drain Water/Storm Open system. Accumulated water from sea spray and rain led to floor gullies FC Completion Fluid High/Low Pressure FJ Fuel, Jet Clean, water-free aviation fuel (kerosene) for helicopters GA Gas Fire fighting/CO2 Dry, typically bottled, CO2 used as extinguishing gas GF Gas Fuel Process gas used to fuel compressors and generators. Dried hydrocarbon gas with CO2 and H2S in the same quantities as the process system GI Gas Inert Inert gas, such as nitrogen or dry CO2. Note: Some installations use exhaust gas for inerting storage tanks with this product service code, and these should be considered as cold exhaust gas GW Gas Waste/Flue Products of burning hydrocarbon gas or diesel fuel. Acidic combustion products may condense in exhaust piping causing high corrosion rates MB Mud, Bulk/Solid Storage of mud components prior to mixing MH Mud, high pressure High pressure mud pumping system for deliverance of drilling and completion fluids in normal use. May contain well intervention fluids, Completion and packer brine fluids, Mud acids (HCl, HF), well stimulation fluids, scale inhibitors, methanol, diesel, varying densities of byrites or other solids MK Mud, Kill Mud pumped into the well for well control purposes. May contain heavy densities of byrites or other solids ML Mud, low pressure As MH OF Oil Fuel (Diesel oil) Diesel fuel for use in cranes, generators and well pressure equalisation. Usually dry, but may contain water and organic matter that settles in low / stagnant points OH Oil hydraulic Clean, dry, filtered hydraulic oil for actuators OL Oil lubricating Clean, dry, filtered oil for lubrication purposes OS Oil seal Clean, dry, filtered seal oil for gas compressors. May contain amounts of dissolved process gas PB Process Blow down Wet hydrocarbon gas. Parts of system are Vents and Flare. Will contain CO2 and H2S in the same proportions as the systems blown down. Normally purged with fuel gas at low pressure PL Process Hydrocarbons Liquid Untreated liquid hydrocarbons (Post inlet separator).Contains some gas but mostly hydrocarbon liquid with some water, dissolved CO2 and H2S, potential for sand. May also contain small amounts of CO2 corrosion inhibitor, scale inhibitor, emulsion breaker and other chemicals. Water contains high levels of dissolved salts from the reservoir. If water injection is part of the process, may contain bacteria that can colonise stagnant areas PS Process Hydrocarbons Vapour Wet Wet untreated gas where water vapour is expected to condense into liquid. Contains CO2 and H2S in the same proportions as the reservoir PT Process Hydrocarbons Two Phase Untreated two phase flow upstream of inlet separator. Contains oil, gas, water, sand, also CO2 and H2S in the same proportions as the reservoir. May also have inhibitor and stabilisation chemicals injected close to wellhead. If water injection is part of the process, may contain bacteria that can colonise stagnant areas PV Process Hydrocarbons Vapour Dry hydrocarbon gas where water is not expected to condense as liquid. (Post separator). Contains CO2 and H2S in the same proportions as the reservoir PW Produced water system Water from the production separators. It contains water with dissolved CO2 and H2S in the same proportions as the reservoir, and some oil. Sand may be carried over from the separator SP Steam, Process

DET NORSKE VERITAS

Degradation Group Hydrocarbons Waters Waters Waters Chemicals Insignificant Insignificant Insignificant Insignificant Vents Chemicals Chemicals

Chemicals Chemicals Insignificant Insignificant Insignificant Insignificant Hydrocarbons Hydrocarbons

Hydrocarbons Hydrocarbons Hydrocarbons Hydrocarbons Not Included


Table C-2 Product Service Code with descriptions and degradation mechanism group (Continued) Product Service Description Code SU Steam, Utility/Plant VA VF WA WB WC WD WF WG WH

WI WJ WP WQ WS

Degradation Group Not Included Vents Vents Waters Waters

Vent, Atmospheric Vent, Flare Water, Sea anti-liquefaction Water, Sea Ballast/Grout Oxygen rich seawater that may be treated with biocides / chlorination Water, Fresh/Glycol Cooling Medium Waters A closed system where direct seawater cooling is not applicable. Fresh or desalinated water treated with TEG regularly checked for low pH arising from breakdown of the TEG Water, Fresh Potable Waters Oxygen rich, chlorinated fresh water often with small amounts of salts added for palatability. Max Cl- ions concentration 200 ppm Water, Sea Fire fighting Waters Closed seawater system treated with biocides / chlorination Water, Grouting Systems Waters Used for makeup of cementitious grout during installation or drilling operations. May be either raw seawater or desalinated seawater Water, Fresh/Glycol (TEG) Heating Medium Waters Heating medium providing required heat load to process and utility equipment. Fresh or desalinated water mixed with TEG. May also contain corrosion inhibitor. Regularly checked for pH due to breakdown of the TEG Water, Injection Water InjecInjected water used for enhanced reservoir recovery. May be treated produced water, treated seawater, or combition nation Water, Jet Waters Jet water supply for removing of sand from separators, cleaning of tanks etc. May be supplied from produced water, fresh water, disinfected, or treated seawater. May also require addition of anti-scale chemicals Waters Water, Fresh, Raw Desalinated, oxygen rich, untreated water Water, Fresh, Hot (closed circuit) Waters Fresh or desalinated, oxygen rich, untreated hot water for living quarter and equivalent Water, Sea Waters Oxygen rich, seawater for distribution to the various platform users. May be treated with chlorination to prevent biological growth within the system

C.6 Degradation mechanisms and damage modelling C.6.1 Steps in modelling The damage models for the degradation mechanisms given in this appendix follow the process given below. The same basic steps should be used if alternative models or other degradation mechanisms are applied in the RBI analysis:

before break’, giving leak or rupture failure respectively. 4) Define hole sizes expected on failure: — Expected hole sizes at failure for each degradation mechanism are stipulated in accordance with a standard hole size distribution template.

1) Assess whether a mechanism is expected in a given case.

C.6.2 Degradation mechanisms - hydrocarbon systems

2) Determine damage rate and/or failure probability:

Hydrocarbon bearing systems, including produced water, closed drains and similar, must be evaluated with respect to corrosion and cracking due to the gases CO2 and H2S respectively, that can be dissolved in any water present with the hydrocarbons. In some circumstances Microbially Influenced Corrosion (MIC) can also occur. Additionally, any sand that is entrained in the system can cause sand erosion where the flow impinges on the pipe or equipment surface.

— Time dependent mechanisms require; distribution type with a mean value, standard deviation or equivalent. PoF is derived from the rate and structural reliability calculations. — Susceptibility mechanisms do not have a rate, but PoF is derived directly from key parameters. 3) Determine damage morphology: Three types are defined: — Local: Localised damage that does not interfere with the load bearing capacity of the equipment wall. PoF refers to a small leak at wall penetration — Uniform: Damage of such a large area that it affects the load bearing capacity of the equipment wall. PoF refers to the state when the wall ligament cannot accommodate the loading, as calculated using structural reliability analyses. Typically a larger release results. — Cracking: A crack that penetrates the wall. A virtual crack is assigned a single size and checked for ’leak

The presence and composition of water varies through the processing train such that the product service codes have limited value in guiding expected degradation. It is necessary to study the process flow to identify, split and group equipment with similar environmental and operational loading. The following points should also be considered: — Chemical treatment (inhibition) is commonly used to limit CO2 corrosion in carbon steel and injection points and inhibitor performance must be evaluated. — Hydrocarbon production processes are expected to change over time and these must be considered when planning inspection, e.g. lower pressure, water breakthrough.

DET NORSKE VERITAS


— Hydrocarbon systems usually employ various types of corrosion monitoring and have traditionally received high inspection focus. Service data (condition, integrity and process data) may be available for installations that have been in service, and these data should evaluated and used together with the models given here.

Microbial corrosion:

Note that microbial corrosion is generally not expected in other materials than carbon steels in anaerobic hydrocarbon systems. However, this should be evaluated for each installation, with the conclusion and assumptions documented. Figure C-1 shows a suggested plot for PoF as function of temperature. Derive a PoF value from the figure and divide by wall thickness in mm. Damage morphology is ’leak’. The hole size distribution is given in Table C-6.

— Assess the presence of water and its composition and pH. — Assess the equivalent partial pressure of CO2 and H2S gases in a water phase. — Assess possible presence and effects of MIC — Determine PoF due to HPIC/SOHIC due to presence of H2S. — Determine PoF due to SSC — Determine PoF due to CO2 -corrosion. — Assess effects of chemical treatments, internal organic coatings and cathodic protection. — Determine PoF due to sand erosion C.6.2.1 Damage Rates CO2 model:

Assess both ’local’ and ‘uniform’ damage. (‘uniform’ refers to larger areas of damage typically 6 o'clock corrosion). Use the NORSOK model, reference /3/ or DeWaard & Milliams, reference /6/ or similar to calculate a basis corrosion rate. The hole size distribution is given in Table C-3. Local: Use the calculated value as the mean rate in a Weibull distribution with coefficient of variance 0.45, for local corrosion. PoF is calculated as for a ’local’ damage morphology. Uniform: Use the calculated value as 0.4 x mean rate in a Weibull distribution with coefficient of variance 0.8, for ’uniform’ corrosion. PoF is calculated as for a ’uniform’ damage morphology. Chemical treatment (inhibitor): Preferably, inhibitor effectiveness should be modelled as a probabilistic distribution. e.g. as Weibull distribution with nominal efficiency as the mean and coefficient of variance based on an evaluation of the performance in service. As a simplification the nominal inhibitor factor can be used to reduce the mean corrosion rate used in the Weibull distributions given above. H2S cracking:

All forms of cracking due to H2S should be prevented by correct materials selection. See reference /1/ and /2/. If materials and welding are within limits set by these documents, probability of failure = 10-5, otherwise probability of failure = 1.00 and detailed manual assessment will be required. No further PoF calculations are required. Damage morphology is ‘cracking’. The hole size distribution is given in Table C-4. Erosion model:

See reference /5/ for a mean value in a normal distribution using coefficient of variance of 20%. PoF is calculated as for a ‘Uniform’ damage morphology. The hole size distribution is given in Table C-5.

Probability of Failure per mm wall thickness

Expected damage can be calculated for various degradation mechanisms using the following factors for guidance:

100 10-1 10-2 10-3 10-4 10-5 0

10

20

30

40

50

60

70

80

90

Temperature, oC Figure C-1 PoF against temperature for microbial corrosion

Table C-3 CO2 Uniform and local corrosion hole size distributions % Distribution Equivalent hole diameter Uniform Local Less than and = 5 mm 0 50 Above 5 mm to 25 mm 0 50 Greater than 25 mm 0 0 Rupture (full release) 100 0 Table C-4 H2S cracking: Stable and unstable cracks hole size distributions. % Distribution Equivalent hole diameter Stable (’leak’) Unstable (’burst’) Less than and = 5 mm 0 0 Above 5 mm to 25 mm 100 0 Greater than 25 mm 0 0 Rupture (full release) 0 100 Table C-5 Erosion hole size distribution Equivalent hole diameter % Distribution Less than and = 5 mm 0 Above 5 mm to 25 mm 0 Greater than 25 mm 0 Rupture (full release) 100 Table C-6 Microbial corrosion hole size distribution % Distribution Carbon steel and Equivalent hole diameter copper based ma- Stainless steels terials Less than and = 5 mm 0 90 Above 5 mm to 25 mm 100 10 Greater than 25 mm 0 0 Rupture (full release) 0 0

DET NORSKE VERITAS


C.6.2.2 Reference documents The following references may be used for guidance in the assessment: /1/

/2/ /3/ /4/

/5/ /6/

EFC 16 "Guidelines on Materials Requirements for Low Alloy Steels for H2S -Containing Environments in Oil and Gas Production". Pub. The Institute of Materials. NACE MR0175-00: Standard Material Requirements. Sulphide Stress Corrosion Cracking Resistant Metallic Materials for Oilfield Equipment. NACE, Texas, USA. NORSOK STANDARD: CO2 CORROSION RATE CALCULATION MODEL: M-506: Rev. 1, June 1998. EFC 17 "Corrosion Resistant Alloys for Oil and Gas Production: Guidance on General Requirements and Test Methods for H2S Service". Pub. The Institute of Materials. DNV Recommended Practice RP-O 501: “Erosive Wear in Piping Systems”, pub. Det Norske Veritas, Høvik 1996. NACE TM0248: "Evaluation of Pipeline and Pressure Vessel Steels for Resistance to Hydrogen Induced Cracking". NACE, Texas, USA.

C.6.3 Degradation mechanisms - water systems Water systems use ‘water’ of varying corrosiveness, ranging from untreated seawater to potable water. The product codes for the water containing systems are not sufficient to define the water type with respect to corrosiveness, and do not account for changes that can occur during processing, for example as an intake of ‘raw seawater’ is treated and changed to ‘fresh water’. A number of water categories that are commonly encountered in offshore installations have been defined as given in Table C-7. It is necessary to determine the best match between a water category and the product service code used in each water system, or part of a system. This can be established during screening discussions and/or with reference to process drawings. Appropriate corrosion mechanisms have been assigned for each of the water categories. These include: — Local corrosion such as pitting and crevice corrosion is expected in stainless steels in oxygenated waters. These degradation mechanisms return a PoF based on susceptibility and is constant over time for given operational parameters. — Uniform corrosion is assumed in carbon steels which is accentuated by higher wall shear stresses (i.e. high flow rates), and the PoF is derived from wall thinning rate and hence loss of structural integrity over time. — Bacterial corrosion (MIC) in waters where organic life can be sustained and no effective biocides are used.

Table C-7 Water categories definition and description Water category Description Seawater: Untreated, normal oxygen, bacteria, Raw Seawater marine flora etc. Seawater low oxy- Seawater: Deoxygenated to max. 50 ppb O2 . gen No other treatment. Seawater low oxy- Seawater: Deoxygenated, max. 50 ppb O2 treated with UV/filtered or bactericide. gen + Biocide No chlorination. Seawater low oxy- Seawater: Deoxygenated, max. 50 ppb O2 gen + Biocide + treated with UV/filtered or bactericide. Chlorination Chlorination. Desalinated water: typically prepared by condensation of seawater. Basis for plant water for Fresh water steam generation etc. Low salt content. Normal oxygen Closed loop systems. Desalinated systems that Closed loop have intrinsically ’low’ oxygen content. Open systems that collect water from drains, Exposed Drains sluices, deluge, etc, and are assumed to contain untreated seawater. Drains from sanitary systems. Fresh water Sanitary Drains with high bacteria and organic matter content

C.6.3.1 Carbon steel damage models The following models show carbon steel corrosion by water type for given temperature and flow conditions. All use a Normal distribution. The rates are also applicable to carbon steel where an organic coating is damaged. The resulting damage is a uniform wall thinning. Notes with factors to consider are given in Table C-10. The hole size distribution is given in Table C-9. Table C-8 Carbon steel corrosion rates by water category Corrosion rate mean and standard deviaWater category tion Raw Seawater Flow dependent: Rates from, standard deSeawater with biocide / viation 0.1 mm/yr chlorination See Figure C-2 Exposed drains Seawater low oxygen Seawater low oxygen Mean rate 0.01 mm/yr. standard deviation with biocide / chlorina- 0.01 mm/yr tion Closed loop Fresh water or potable water, Cl- less than 200 Mean rate 0.25 mm/yr. Standard deviation ppm 0.1 mm/yr Sanitary drains

Note that: — produced water is included with hydrocarbon systems — water injection systems use various types of treatment, and must be considered on a case for case basis.

DET NORSKE VERITAS


Figure C-2 Carbon steel corrosion rates variation with flow rate

Table C-9 Carbon steel hole sizes distribution for aqueous corrosion Equivalent hole diameter % Distribution Less than and = 5 mm 0 5 mm to 25 mm 0 Greater than 25 mm 100 Rupture (full release) 0 Table C-10 Notes regarding carbon steels assessment in water systems ConsideraNotes tion Internal galvanisation is rarely effective in long-term Galvanised corrosion control, and so no credit should be given to steel/zinc galvanised steel: it is treated as carbon steel. Beware clogging of nozzles due to zinc corrosion products. No credit should be given for these linings: it is treated Cement as carbon steel. Inspection should include procedures Linings for examining the condition of the lining.

Table C-10 Notes regarding carbon steels assessment in water systems (Continued) ConsideraNotes tion Organic lining should be identified, their performance must be estimated on a case for case basis. A degradaOrganic lin- tion profile may be defined and applied to the corroings sion rates given in this document. A procedure for defining a degradation profile is given in external corrosion models. The theoretical performance of sacrificial anode systems can be checked by reference to procedures such Cathodic as NORSOK and DNV RP-B 401, whilst monitoring/ protection inspection of the anode consumption should give a good indication of their effectiveness in practice. Note that, to be effective, anodes should be placed so they lie in the water phase Galvanic corrosion may occur with certain material combinations, typically between carbon steel and stainless steel. The extent of damage is dependent on the relative areas of the materials, and the resistivity of the media. In some cases this is advantageous, for example, where pumps and valves with lower grade stainless steel housings are used in carbon steel pipeGalvanic work the stainless steel will be ‘protected’ by the carcorrosion bon steel. In other cases, for example, where there is a large cathodic area, high corrosion rates can be expected. Correct assignment of anode and cathode for many common material combination is strongly affected by local conditions, thus any abrupt changes in materials should be identified and referred to a specialist for evaluation. Corrosion of welds in carbon steel water bearing systems is variable. All or part of the weldment may be attacked. Initial inspection should target welds and parent materials. Inspection findings, if any, can be reWelds viewed to determine where future inspections can be focused. These comments also suggest that data from on line monitoring, e.g. corrosion probes, iron counts, should be used with caution, preferably as a supplement to some inspection.

C.6.3.2 Stainless steel in water, damage models Degradation of stainless steels in water results in local attack typically pitting or crevice corrosion; the onset of which is assumed to be controlled by temperature, given that the water conditions are as specified in Table C-7. The probability of failure per unit wall thickness for the different materials and water types is given as a function of temperature in. The assessment procedure is as below: 1) Select appropriate water category in Table C-7. 2) Select curve for material in Figure C-3. Read off failure probability for given temperature. 3) Divide result by wall thickness in mm, to give PoF. Table C-11 Stainless steel hole size distribution for aqueous corrosion of stainless steel Equivalent hole diameter % Distribution Less than and = 5 mm 100 Above 5 mm to 25 mm 0 Greater than 25 mm 0 Rupture (full release) 0

DET NORSKE VERITAS


Local Corrosion: Raw Seawater

316

DSS

6Mo

316

Failure Probability

1.E-01 1.E-02 1.E-03 1.E-04

6Mo

1.E-01 1.E-02 1.E-03 1.E-04 1.E-05

1.E-05 0

10 20 30 40 50 60 70 80 90 100 110 120 130 140 150

0

10 20 30 40 50 60 70 80 90 100 110 120 130 140 150

Temp °C Local Corrosion: Seawater Low Oxygen ( /biocide/chlorination)

Temp °C

316

DSS

6Mo

1.E+00

Local Corrosion: Closed Loop

316

DSS

6Mo

1.E+00

1.E-01

Failure Probability

Failure Probability

DSS

1.E+00

1.E+00 Failure Probability

Local Corrosion: Fresh Water

1.E-02 1.E-03 1.E-04 1.E-05

1.E-01 1.E-02 1.E-03 1.E-04 1.E-05

0

10 20 30 40 50 60 70 80 90 100 110 120 130 140 150

0

Temp °C

10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 Temp °C

Figure C-3 PoF by water category for stainless steels

C.6.3.3 Aqueous corrosion of titanium No degradation of Titanium is expected in the water categories described, and so a fixed probability of failure of 10-5 should be assigned, with hole sizes, to facilitate calculation of consequence, as given in Table C-11. C.6.3.4 Copper based materials Little corrosion is expected in desalinated and potable water categories. Many copper based alloys have good or reasonable corrosion resistance to quiet seawater, but high rates of corrosion (erosion-corrosion) can occur in flowing seawater. Stagnant conditions supporting sulphate reducing bacteria, can lead to high local corrosion rates. Determine the probability of failure as follows: 1) If flow rate is above 2 m/s then set PoF = 1.0 and refer to a specialist. 2) Identify water category from the systems and water categories Table C-7. 3) If materials are not included in Table C-12, then set PoF = 1.0 and refer to specialist. 4) Select mean rate and standard distributions as directed in Table C-12. 5) PoF is calculated using the ‘uniform’ damage morphology.

6) Select hole sizes as given in Table C-13. Table C-12 Corrosion rates in copper based alloys Water categoryname Material: 90/10 Cu/Ni Raw seawater Flow rate less than 1 m/s: 0.08 Seawater with biocide/chlorina- mm/yr; standard deviation tion 0.01 mm/yr Exposed drains Flow rate above 1 m/s: 0.2 mm/ yr; standard deviation 0.1 mm/yr Seawater low oxygen Seawater low oxygen + biocide / 0.02 mm/yr; standard deviation 0.02 mm/yr chlorination Fresh water 0.015 mm/yr, standard deviation Potable water 0.05 mm/yr Closed loop 0.05 mm/yr; standard deviation Sanitary drains 0.05 mm/yr Table C-13 Hole size distribution for Cu-Ni alloys Equivalent hole diameter % Distribution Less than 5 mm 0 5 mm to 25 mm 0 Greater than 25 mm 100 Rupture (full release) 0

C.6.3.5 FRP Materials in water systems Design, fabrication, installation and testing should be carried out in accordance with FRP piping specifications, supports for pipe and heavy fittings, jointing design and construction should be checked. FRP piping is susceptible to mechanical damage due to being stood on, used as a support for ladders, and damage due to welding spatter falling from welding and cutting operations. In addition, FRP is susceptible to degradation of the polymer matrix due to exposure to ultraviolet radiation from sunlight and welding.

DET NORSKE VERITAS


In the absence of sound degradation models, and unless the analyst has access to experience with FRP it is recommended that FRP is allocated a low reliability, i.e. PoF = 1.0, and risk calculated on this basis. This focuses on resultant high risk equipment for assessment by specialists. The hole sizes for FRP required to calculate consequences are given in Table C-14. Table C-14 FRP hole size distribution for water systems Equivalent hole diameter % Distribution Less than and = 5 mm 0 Above 5 mm to 25 mm 0 Greater than 25 mm 0 Rupture (full release) 100

C.6.4 Degradation mechanisms - chemicals Chemicals can be split in to three groups: Proprietary chemicals: These include, but are not limited to, corrosion inhibitors, flocculants, bactericides. Drilling chemicals: These have limited interest on a production installation. Identifiable chemicals: These are common chemicals, but corrosiveness is dependent on concentration and temperature. The first two groups may have chemicals given by trade names only. In many cases they may be non-corrosive and innocuous in service conditions, however, in other cases, particularly at high concentrations, they can be highly corrosive and/or toxic. The third group includes chemicals, for which general corrosion data is more readily available, although the possible variation in type and concentration implies that corrosiveness must be evaluated on a case by case basis. These are typically systems that should be discussed during screening; the consequence is expected to be low in most cases and many components can be expected to be screened out with very little further effort required. It is common that chemical systems can be assessed as either ’insignificant’ or ‘unknown’ systems outlined below. C.6.5 Insignificant Where no insignificant degradation is expected, a fixed probability of failure of 10-5 should be assigned. Hole sizes for analysis of consequences are given in Table C-15 and are considered generally applicable in offshore systems. Table C-15 Hole size distribution for ‘insignificant’ systems % Distribution Stainless Equivalent hole steels and Titanium diameter Carbon steels nickel based based alloys alloys Less than and = 5 0 0 100 mm Above 5 mm to 0 100 0 25 mm Greater than 25 100 0 0 mm Rupture (full re0 0 0 lease)

C.6.6 Unknown Where the product is an unknown substance, or the combination of materials and product has no defined model, then ini-

tially a probability of failure of 1.00 should be assigned and the need for further investigation driven by the consequence of failure – where a high consequence of failure will give a high risk, indicating that it will be beneficial in spending further time in investigation of product and materials. The hole sizes for required to calculate consequences are given in Table C-16. Table C-16 Hole size distribution for ‘unknown’ systems Equivalent hole diameter % Distribution Less than and = 5 mm 0 Above 5 mm to 25 mm 0 Greater than 25 mm 0 Rupture (full release) 100

C.6.7 Degradation mechanisms - vent systems The vent system collates vapour phase from various parts of the process. Each part of the vent system must be evaluated with respect to what is being vented. Generally, the vent lines will be subject to the same degradation mechanisms as vapour phase in the equipment being vented. Vent system equipment, such as knock-out drums may collate vapours from several areas and should be considered with respect to the composition of any liquid phases that may be collect. C.6.8 Degradation mechanisms water - injection systems Water injection systems usually use large volumes of treated water. This may be based on seawater, produced water, or a combination of these. Treatment typically includes de-oxygenation or de-aeration, chlorination or similar biocide, pH buffering, anti-scaling. Significant amounts of CO2 may be dissolved in the water. High injection rates imply that flow-related damage can arise. A variety of materials are deployed in water injection systems, and correct treatment (relative to the materials) is essential. It is recommended that water injection systems are addressed on a case for case basis; however, in many cases the water injection system can be evaluated as equivalent to a water system and/or produced water. C.6.9 Degradation mechanisms - external corrosion External corrosion applies to all product service codes, and is evaluated independently of any internal degradation and damage. It applies to all metallic materials with and without coatings and with and without insulation. See Table C-17. — corrosion of carbon and low alloy steel in marine atmosphere — corrosion of carbon and low alloy steel under insulation — localised corrosion of stainless steels in marine atmosphere — localised corrosion of stainless steels under insulation — localised corrosion of stainless steels under insulation — external stress corrosion cracking of stainless steels under insulation. It is assumed for the models presented here that the parts are exposed to a marine atmosphere. Carbon steels suffer marked corrosion in atmospheric exposure, but are usually protected by a coating. Stainless steels have generally good resistance to exposure in marine atmosphere and suffer only incipient corrosion although, local accumulation of salts can lead to severe corrosion, and such areas must be focused during inspection. Surfaces under insulation are not readily available for visual access, and if water penetrates the weather protection, high salt concentrations can accumulate on the metal surface leading to possible locally severe corrosion in all carbon steels and stainless steels. Stress corrosion cracking can also occur in stainless steels at elevated temperatures. Inspection of the insulation condition itself is a very important means of controlling damage under insulation.

DET NORSKE VERITAS


In all cases coatings may be used to mitigate corrosion. Coating deterioration should be included in the evaluations and the

RBI results should be linked to coating maintenance programmes.

Table C-17 External corrosion descriptions Mechanism Material Morphology Corrosion under CS Damage as patches of attack where insulation water can collect in insulation. Coatings may be used.

External stress cracking under insulation

Atmospheric corrosion

Titanium Stainless steels (not 6Mo type)

CS

Stainless steels nickel based Titanium

C.6.9.1 Coatings The corrosion rate per year may be reduced according to the effectiveness of a coating system applied to the part. Coating effectiveness can assumed to be near-perfect for a short period when new, and then deteriorates over a longer period to having no value. A default coating effectiveness model is given in Figure C-4. The deterioration pattern can be changed to account for different coating systems and any fabric maintenance. The uncoated degradation rate is reduced by a factor equal to (100 – effectiveness)/100 to give the coated corrosion rate for each year.

Area Covered by Coating %

Stainless steels nickel based

Inspection guidance Damage controlled by water ingress through insulation. Deterioration of any coating will affect overall resistance. Visual inspection of weather protection, for leaks to locate potential areas. RT and UT can be used for sizing and monitoring. As above, welds likely to have As above. Monitoring of damage by inspection is not recommendlower resistance that parent mate- ed, due to rapid growth period. Corrective maintenance, for damrial. Coatings may be used. age and preventative maintenance, of weather protection systems, is more important. No damage expected. Minimum surveillance. Surface cracks where water can Damage controlled by water ingress through insulation. Deterioracollect at elevated temperatures tion of any coating will affect overall resistance. Visual inspection under insulation. Welds particular- of weather protection, for leaks to locate potential areas. DP, RT ly susceptible. and UT can be used to find cracks. Monitoring of damage by inspection is not recommended, due to rapid growth period. Corrective maintenance for damage, and preventative maintenance of weather protection systems, is more important. Patches of damage leading to Minimum surveillance is required to periodically confirm initial assmaller size holes. Usually associ- sumptions, particularly coating condition. ated with coating damage and deterioration. Enhanced in areas where wetting is prolonged, including condensation. Incipient attack, but small size Visual surveillance is required to check conditions. Attention foholes associated with local attack cused on geometry, clips, supports, etc. that can collect water and where geometry allows damp salts promote crevice attack. Coatings, if used should be checked. to collect. No damage expected. Minimum surveillance.

120 100 80 60 40 20 0 0

5

10

15

20

Age

Figure C-4 Coating degradation as a function of time in years

C.6.9.2 Carbon steel external corrosion Uninsulated and uncoated corrosion rate is a function of temperature as shown in Table C-18.

DET NORSKE VERITAS


Table C-18 Carbon steel atmospheric corrosion rate Temperature Standard deviMean mm/yr Notes range ation mm/yr Below –5°C Not applicable Not applicable Probability of failure = 10-5 -5°C to 20°C 0.1 0.05 20°C to 100°C 0.3547 x Ln 0.3929 x Ln (temperature) (temperature) – 0.9334 – 1.0093 Over 100°C Surface drying occurs and will affect the corrosion rate. Refer to a specialist.

C.6.9.2.2 Hole sizes Atmospheric corrosion of carbon steel is assumed to be ‘uniform wall thinning’ occurring in areas or ‘patches’, although the leak hole may be small, these usually occur in connection with a patch. The hole is interpreted as a ‘burst’ occurring at the thinnest part of the patch when the local stress exceeds the materials strength. The hole size distribution is given in Table C-19. Table C-19 Hole size distribution for atmospheric corrosion of carbon steel Equivalent hole diameter % Distribution Less than and = 5 mm 90 Above 5 mm to 25 mm 9 Greater than 25 mm 1 Rupture (full release) 0

C.6.9.2.3 Rates: Under insulation Corrosion Under Insulation (CUI) can occur when the insulation traps moisture against the material surface. This is modelled as a normal distribution with mean and standard deviations as in Table C-20 on the assumption that salt water (from deluge) is wetting the insulation. If the insulation is shown not to be wet, then CUI does not apply. The rates can be reduced by the coating efficiency. Table C-20 CUI model for carbon steel Temperature Mean mm/yr Standard range deviation mm/yr Below –5°C -5°C to 20°C

As 20°C

20°C to 150°C 0.0067x temperature + 0.3 Over 150°C

0.286

Notes Probability of failure = 10-5 May overestimate rate, but failures found at low temperatures

0.286 Refer to a specialist.

C.6.9.2.4 Hole sizes CUI is expected to occur in patches where conducive conditions occur. The damage is not expected to interfere significantly with wall stresses and leak, rather than burst is expected. Hole sizes are expected as given in Table C-21. Table C-21 Hole size distribution for CUI of carbon steel Equivalent hole diameter % Distribution Less than and = 5 mm 80 Above 5 mm to 25 mm 20 Greater than 25 mm 0 Rupture (full release) 0

C.6.9.3 Stainless steel external corrosion C.6.9.3.1 Uninsulated surfaces Uncoated stainless steels can be expected to have a probability of failure of 10-4 per mm wall thickness. Note that the excessive presence of deposits, and water traps under clamps, labels etc. should be given special attention and may justify manual evaluation of the PoF. The coating effectiveness given in Figure C-4 can be used to reduce the estimated Probability of failure by multiplying the uncoated probability of failure with a factor equal to (100-effectiveness)/100. The hole size distribution should be taken as given in Table C-22. Table C-22 Stainless steel atmospheric corrosion hole sizes Equivalent hole diameter % Distribution Less than and = 5 mm 100 Above 5 mm to 25 mm 0 Greater than 25 mm 0 Rupture (full release) 0

C.6.9.3.2 Under insulation Where the stainless steel is insulated, the effect of salt water trapped against the metal can result in pitting at moderate temperatures. At higher temperatures and stress corrosion cracking occurs in some stainless types under conducive conditions: i.e. at areas of high stress, such as welds and heavy cold work. Both local corrosion and cracking must be considered. Local corrosion The onset of local corrosion is controlled by temperature, given that the conducive conditions are present. The probability of failure per unit wall thickness for the different materials is given as a function of temperature in Figure C-5. The hole size distribution is given in Table C-23. 1) Select curve for material in Figure C-5. Read off failure probability for given temperature. 2) Divide result by wall thickness in mm, to give PoF 3) The coating effectiveness given in Figure C-4 can be used to reduce the estimated probability of failure by multiplying the uncoated probability of failure with a factor equal to (100-effectiveness)/100, with a minimum of 10-5.

DET NORSKE VERITAS


Failure probability for 1 mm wall thickness

DSS

316

toughness transition when subjected to low temperatures – such as may be found during blowdown. This may lead to a rupture of the part. Otherwise, the high toughness generally found in stainless steels will prevent unstable fracture.

6Mo

1.E+00

1.E-01

1.E-02

1.E-03

1.E-04

1.E-05 0

10

20

30

40

50

60

70

80

90

100

110

120

130

140

150

Temp °C

Figure C-5 PoF for local corrosion of stainless steel under insulation

Table C-23 Hole size distribution for local corrosion of stainless steel Equivalent hole diameter % Distribution Less than and = 5 mm 100 Above 5 mm to 25 mm 0 Greater than 25 mm 0 Rupture (full release) 0

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---

DSS

1.E+00

Failure probability

1.E-01

1.E-02

1.E-03

1.E-04

1.E-05 0

10

20

30

40

50

60

70

80

90

100

110

120

130

140

C.6.10 Fatigue The failure probability due to fatigue and fracture, caused by high and low frequency fatigue is assessed for a given component, based on its geometry, dimensions, materials of construction, loading and other operational conditions. Guidance note: It should be noted that this document differentiates between high and low frequency fatigue and not high and low cycle fatigue.

External Stress Corrosion Cracking (ESCC) The onset of ESCC is controlled by temperature, given that the conducive conditions are present. The probability of failure for different materials is given as a function of temperature in Figure C-6, with the hole size distribution given in Table C-24. Note that material type 6Mo is not included in the figure: There are suggestions that ESCC may be possible at elevated temperatures. If possible, a specialist should be consulted if this is cause for concern. The coating effectiveness given in Figure C-5 can be used to reduce the estimated Probability of failure by multiplying the uncoated probability of failure with a factor equal to (100-effectiveness)/100, with a minimum value of 10-5. 316

Table C-24 ESCC: Stable (‘leak’) and Unstable (‘burst’) cracks hole size distribution % Distribution Equivalent hole diameter Stable (’leak’) Unstable (’burst’) Less than and = 5 mm 0 0 Above 5 mm to 25 mm 100 0 Greater than 25 mm 0 0 Rupture (full release) 0 100

150

Temp °C

Figure C-6 PoF for stress corrosion cracking of stainless steel under insulation

Before concluding on hole size, an assessment of leak-beforebreak should be made, as duplex stainless steels may suffer a

High Frequency Load Ranges With load ranges acting on components at typical machinery vibration frequencies, cracks may grow rapidly to critical crack size. The time interval between the crack reaching a size where its probability of detection by inspection is high, and the crack reaching a critical size where leakage or unstable failure occurs, is very short and can be of the order of weeks. Fracture mechanics crack growth analyses are of little use and high frequency fatigue can be considered as a ‘susceptibility’ model (there is either an intact pressure boundary, or a failure is imminent), and so is not amenable to measurement or monitoring of the crack size by inspection. The approach used for other susceptibility models in the recommended practice is adopted, whereby measuring of the controlling parameters is recommended in place of NDT. The physical measurable quantities of interest are the vibration velocities, and stresses (strains) in the piping. The strain can further be converted to stress and compared to appropriate SN curves. Recommended locations for measurement are listed in Appendix D. The prioritisation of locations should be based on the consequence of failure. Low Frequency Fatigue Low frequency cyclic loading, such as that caused by ship/ platform motions, infers a crack growth duration that is sufficiently long to allow monitoring by NDT. An approach using S-N curves or fracture mechanics analyses can be applied to determine when to inspect. References 1) “Fatigue Strength Analysis for Mobile Offshore Units”, DNV Classification Note 30.2, Det Norske Veritas, August 1984. 2) BS 7910:1999, “Guide on methods for assessing the acceptability of flaws in structures”.

DET NORSKE VERITAS


APPENDIX D INSPECTION PLANNING AND DATA ANALYSIS D.1 Inspection planning The following table is developed as an aid to select inspection methods and coverage based on the results from RBI analyses. The methods and coverage in this table are aimed only at detecting the degradation; all indications of defects found during inspection should therefore be followed up by necessary actions to determine the extent of damage and defect sizes as well as an evaluation of need for changes in inspection program. Where different methods are suggested for the same degradation mechanism, the methods should be considered as alternatives to each other unless they are placed under the same point. D.1.1 Definition of inspection effectiveness The following inspection effectiveness have been defined based upon the examination of hot spots or suspect areas as described in Table D-1: Highly Effective

The inspection method will correctly identify the actual damage state in nearly every case Usually Effective The inspection method will correctly identify the actual damage state most of the time. Fairly Effective The inspection method will correctly identify the actual damage state about half of the time. Note that the effect of PoD for the inspection method should be considered, as a small amount of damage may cause the risk to pass the risk limit, yet such damage may not be reliably detected due to giving low values of PoD. In such an instance, other risk management methods should be considered. D.1.2 Inspection techniques The following abbreviations are used in Table D-1.

UT-CHIME CVI PT ET UT-IRIS MT ET-RFEC RT RT-RTR UT

Creeping/Head wave inspection method Close visual inspection Dye penetrant testing Eddy current testing Internal rotating inspection system (ultrasonic) Magnetic particle inspection Remote field eddy current Radiographic testing Real time radiography Ultrasonic testing

D.1.3 Damage mechanism and inspection effectiveness The following table is valid under the following assumptions: — The inspection methods are used within their recognised limitations with respect to dimensions and materials of construction for the component subject to inspection. — Inspection is carried out according to qualified procedures and by qualified personnel. — All indications of defects found during inspection are followed up by necessary actions to determine defect size and need for increase in extent of inspection. — When identifying a limited selection of hot spots, it should be recognised that some of the degradation mechanisms will have different PoF for the different types of hot spots listed. The focus should be on the hot spots that are judged to have the highest PoF, but samples of hot spots with a lower PoF should be included for completeness. — No differentiation is made between the various methods listed for a damage mechanism with respect to PoD in this table, i.e. all methods have been treated as having a PoD of 1 if they have been found suitable to detect the expected damage. Further differentiation in inspection efficiency for the different methods can be made with reference to PoD curves.

DET NORSKE VERITAS

Damage mechanism Damage description Uniform CO2 corro- Internal thinning of considerable areas sion Hot spots: 6 o’clock position in piping with laminar flow Bottom of deadlegs and other low points where water can accumulate Local CO2 corrosion

DET NORSKE VERITAS

Sulphide stress cracking

Hydrogen Induced Cracking, Stepwise Cracking

Microbiologically Influenced Corrosion (MIC) in CS

Inspection method

UT RT CVT Video inspection Long range UT Local internal thinning. UT Hot spots: RT Welds incl. HAZ T-sections (depending on flow directions), O-lets CVT and other branch connections and first pipe diame- Video inspection ter downstream Bend and following 2 pipe diameters downstream Turbulent area up to 2 pipe diameters downstream of chokes, control valves, thermowells and other components causing turbulent flow. Reducers and following 2 pipe diameters downstream Inlet nozzle and impingement or turbulence areas in vessels Internal surface breaking crack. UT Hot spots: MT Welds incl. HAZ, particularly repair welds RT(CP) ET AT Subsurface laminations or blisters, parallel to sur- UT face, or combination of such laminations/ blisters ET and subsurface of surface breaking cracks normal RT(CP) or parallel to surface. AT Hot spots: Rolled plate material Magnetic Flux Walls with indications of laminations or blisters Leakage UT Internal local corrosion randomly distributed. Probability of attack increases with reduced flow. RT Local thinning CVT Hot spots: Video inspection Dead legs Areas where debris can accumulate

Highly efficient 30% of hot spots

Usually efficient 10% of hot spots

Fairly efficient 3% of hot spots

100% of hot spots

30% of hot spots

10% of hot spots

CVT and video inspection: Internal surfaces have to be cleaned with ultra high pressure water jetting (> 1000 bar) or grit blasting before inspection.

100% of hot spots

30% of hot spots

10% of hot spots

Susceptibility type PoF-model. Inspection will not give significant reduction in PoF.

100% of hot spots

30% of hot spots

10% of hot spots

Inspection methods for screening for hot spots: Internal and external CVT. If inspection is not complemented by internal and external CVT, the total equipment surface should be considered as suspect area.

100% of equipment surfaces

Comments CVT and video inspection: Internal surfaces have to be cleaned with ultra high pressure water jetting (> 1000 bar) or grit blasting before inspection. Has to be complemented by UT thickness checks in low points and corroded areas.

100% of hot spots Susceptibility type PoF-model. Inspection will not give significant reduction in PoF, but monitoring for bacteria in the fluid will give indication whether MIC is a problem or not. CVT and video inspection: Internal surfaces have to be cleaned with ultra high pressure water jetting (> 1000 bar) or grit blasting before inspection.

Recomended Practice DNV-RP-G101, January 2002 Page 46

Table D-1 Inspection and inspection effectiveness

Table D-1 Inspection and inspection effectiveness (Continued) Usually efficient

UT RT CVT Video inspection Long range UT

30% of hot spots

10% of hot spots

3% of hot spots

UT RT CVT Video inspection

100% of hot spots

30% of hot spots

10% of hot spots

CVT

100% of hot spots

30% of hot spots

10% of hot spots

UT RT Disassembly and CVT RT

100% of hot spots

Inspection method

Microbiologically Influenced Corrosion (MIC) in stainless steels

Internal local corrosion randomly distributed. Local thinning. Hot spots: Welds incl. HAZ in dead legs and areas where debris can accumulate

UT RT CVT Video inspection

Erosion

Internal wear of equipment surfaces due to sand in process stream. Thinning over an area corresponding to impingement. Hot spots: T-sections (depending on flow directions), O-lets and other branch connections and first pipe diameter downstream. Bend and following 2 pipe diameters downstream. Turbulent area up to 2 pipe diameters downstream of chokes, control valves, thermowells and other components causing turbulent flow. Reducers and following 2 pipe diameters downstream Inlet nozzle and impingement or turbulence areas in vessels. Areas subject to impingement from jet-nozzles Internal thinning. Hot spots: Total equipment surface (dependent on type of water) High flow areas Internal pitting Hot spots: Welds incl. HAZ

General corrosion of CS in utility water systems

Local corrosion of stainless steels in utility water systems

Internal thinning in concealed faces forming a crevice. Hot spots: Flanges, screwed connections and other components forming crevices

Fairly efficient 30% of hot spots

Comments Susceptibility type PoF-model. Inspection will not give significant reduction in PoF, but monitoring for bacteria in the fluid will give indication whether MIC is a problem or not. CVT and video inspection: Internal surfaces have to be cleaned with ultra high pressure water jetting (> 1000 bar) or grit blasting before inspection.

For water systems with higher predictability in location of most severe corrosion, the extent of hot spots can be reduced. CVT and video inspection: Internal surfaces have to be cleaned with ultra high pressure water jetting (> 1000 bar) or grit blasting before inspection. Susceptibility type PoF-model. Inspection will not give significant reduction in PoF.

Susceptibility type PoF-model. Inspection will not give significant reduction in PoF. RT: Only valid for screwed connections.


DET NORSKE VERITAS


Damage mechanism Damage description

Damage mechanism Damage description

Inspection method

CUI, CS

Deinsulation and CVT RT Real time profile RT Long rang UT

DET NORSKE VERITAS

Local corrosion of external surfaces under insulation. Thinning; in patches Hot spots: Unpainted surfaces and surfaces with painting in poor condition in: Areas subject to water ingress due to poor installation or condition of vapour barrier or design of equipment Low points and water entry points Corners where water can collect Areas where water condense Field welds CUI, stainless steels Local corrosion and pitting of external surfaces under insulation. Local Pitting. Hot spots: Welds incl. HAZ and areas subject to heavy cold work that are unpainted or with painting in poor condition, located in following locations: Areas subject to water ingress due to poor installation or condition of vapour barrier or design of equipment Low points and water entry points Corners where water can collect Areas where water condense ESCC under insula- External surface breaking crack. tion Hot spots: Welds incl. HAZ and areas subject to heavy cold work that are unpainted or with painting in poor condition, located in following locations: Areas subject to water ingress due to poor installation or condition of vapour barrier or design of equipment Low points, corners and other places where intruding water can collect External corrosion Uniform and local corrosion of external surfaces. of uninsulated CS Thinning in patches. Hot spots: Unpainted surfaces or surfaces with painting in poor condition with the following conditions: Corners where water can collect Areas where water condenses Under deposits of dirt etc. Drips onto hot piping

Highly efficient 100% of equipment surfaces

Deinsulation and CVT RT

100% of hot spots

Deinsulation and ET Deinsulation and PT Deinsulation and creep wave UT

100% of hot spots

CVT

100% of equipment surfaces

Usually Fairly efficient efficient 100% of hot spots 30% of hot spots

Comments Inspection methods for screening for hot spots: CVT, thermography, humidity measurements in insulation. Real time profile RT: Only valid for piping. Scan of horizontal piping has to show bottom profile of piping. Scan of piping of other orientation has to show profiles of piping at two opposite sides.

Susceptibility type PoF-model. Inspection for corrosion will not give significant reduction in PoF but inspection for conditions causing corrosion followed by actions to remove cause might give reduction in PoF. Inspection methods for screening for hot spots: CVT, thermography, humidity measurements in insulation.

30% of hot spots

10% of hot spots

Susceptibility type PoF-model. Inspection for corrosion will not give significant reduction in PoF but inspection for conditions causing corrosion followed by actions to remove cause might give reduction in PoF. Inspection methods for screening for hot spots: CVT, thermography, humidity measurements in insulation.


Table D-1 Inspection and inspection effectiveness (Continued)

Table D-1 Inspection and inspection effectiveness (Continued) Damage mechanism Damage description

Inspection method

External corrosion of uninsulated stainless steels or titanium External crevice corrosion

CVT

Fatigue

Local corrosion and pitting of external surfaces. Local pitting. Hot spots: Discolouration. Welds incl. HAZ, areas subject to heavy cold work or areas contaminated with CS material from grinding etc., without painting or with painting in poor condition and the following conditions: Corners where water can collect Areas where water condenses Under deposits of dirt etc. Drips onto hot piping Local thinning in concealed faces forming a crevice Hot spots: Flanges and other details forming crevices Under clamps Under adhesive tape or other markings

Disassembly and 100% of hot spots CVT RT CVT combined with creep wave or long range UT Measurement of oscillating stresses

Usually efficient

Fairly efficient

Comments Inspection methods for screening for hot spots: GVI

RT: Only valid for screwed connections. CVT combined with creep wave or long range UT: Only valid under clamps, supports and similar components. CVT to be followed up by creep wave or long range UT if visual indications of corrosion is detected. 100% of hot spots

Susceptibility type PoF-model. Inspection for cracking will not give significant reduction in PoF for components with unacceptable oscillating stresses, but inspection for conditions causing corrosion followed by actions to remove cause might give reduction in PoF. Inspection methods for screening for hot spots: GVI


DET NORSKE VERITAS

Cracking of cyclically stressed components. Surface breaking crack from external surface or from pre-existing defect. Hot spots: Welds in systems with cyclic loads in connection with: Clamped supports, branching points nozzle attachments and other fixing points Marked changes in dimensions ’Sock-olets’ for heavy equipment mounted to piping through smaller dimension piping Smaller diameter branching connections



D.2 Inspection data analysis A general procedure for statistical analysis of inspection data for use in inspection planning is given below. This Appendix should be used a checklist rather than a complete procedure for analysis. With the points should be considered with the general materials knowledge discussed elsewhere in this document. D.2.1 Grouping of data The data should be grouped according to one of the following categories: — — — —

material and service (or corrosion circuit) component type; pipe, vessel, heat-exchanger, etc. age of component if replaced time period if there has been a change in process parameters; water content and chemistry, temperature, fluid composition.

D.2.2 Data quality checks Check the quality of the data. Remove data from the data-set based on one or several of the following: — too high rate (i.e. failure within a few months) — data for measurement vs. component replacement and age (check that replacement is taken into account) — measured thickness vs. nominal wall thickness (data showing an increasing wall thickness may be removed from data-set). D.2.3 Degradation mechanisms/morphology Check the expected degradation mechanisms for the component in question and the location of damage. — damage type and expected location of damage (top/bottom, welds, components) — internal/external damage — variation of degradation with time. D.2.4 Inspection method Results from different inspection methods may not be handled in the same data-set. Make sure the method, procedure, calibration etc., are the same.

— — — —

type of instrument local measurement vs. scanning coverage location of equipment.

Any error in the inspection technique should be included in the estimation of corrosion rates. D.2.5 Corrosion monitoring data Corrosion monitoring data may be used in conjunction with the inspection data to give an picture of the actual situation. The type of data of interest may be: — corrosion coupons — direct corrosion rate measurement (LP — chemical analysis of the HC-fluid and the water. D.2.6 Statistical evaluation of data A number of statistical techniques may be used to evaluate the data, the following may be most relevant: — regression (trending) analysis of wall thickness — estimation of statistical quantities (mean, standard-deviation, skewness, kurtosis) for estimation of extreme values. For further details, see for example Kowaka, 1994. — Weibull analysis — statistical plotting. In all cases it is recommended to plot the results in a proper graphs, as this will reveal any abnormalities in the data. D.2.7 Application of mata between corrosion circuits Corrosion rate data from one part of the plant may be used for other plants if the conditions are comparable. References: M. Kowaka Introduction to Life Prediction of Industrial Plant Materials. Application of extreme value Statistical Method for Corrosion Analysis. Allerton Press, Inc., New York, 1994, ISBN 089864-073-3.

DET NORSKE VERITAS

DNV RP-G101 Risk Based Inspection

Recommend Documents