Probabilistic Risk Assessments for Static Equipment Integrity

Abstract

The mechanical integrity of batch-produced machinery is successfully safeguarded using online condition monitoring and reliability theory principles. However, the integrity of nonreplaceable static equipment (pressure vessels, cranes, bridges, and other critical infrastructure) is still widely assured and managed using basic equations (e.g., safety factors and design loads), with no or little regard to the probabilistic nature of their operational damage. The gap between the deterministic “remnant life” assumptions and the probabilistic reality restrains the implementation of new asset integrity technologies (advanced condition monitoring and asset management) because these novel tools are not supported by a numeric cost/benefit analysis in many practical cases. The latter is impossible to implement confidently, while the probability of failure (PoF) versus time remains unquantified. The solution to this problem is holistic and logical: individual equipment integrity analysis now needs to be upgraded to the probabilistic terms at all the stages of life. Even well-known asset integrity technologies can help achieve this goal, providing that they are considered and utilized from the standpoint of harmonizing and aligning their outputs with risk owner’s actual decision-making. This chapter shows real-life case studies to briefly illustrate how the existing integrity engineering tools can be advanced via further PoF considerations, in order to provide the outputs needed for a cost/benefit-based confident and compliant risk control.

1. Introduction

A safe, reliable, and sustainable operation of an industrial plant is in the best interest of all the involved stakeholders. The sizes of modern hazardous process plants as well as their potential failure consequences can be enormous. One major challenge in their integrity risk management are the multiple equipment units experiencing specific operational and damage conditions, that is, one storage tank’s corrosion damage is different from another due to different contents, one truck chassis cracking progress is different from another due to traveling on different roads, and one crane structure fatigue damage is different from another due to different histories of these cargo cycles. These examples explain the term “individual” equipment and render a batch reliability data or, especially, the “big data” not well applicable to them due to unit-specific load and damage spectra acting in a real operation.

Historically, the first approach to safeguarding equipment integrity was reactive: failures were rectified as they happen, but it was not a responsible strategy for hazardous equipment. A transition to proactive maintenance occurred over the automotive industry development, as we are familiar from the time/mileage-based car servicing. That solution obviously improved the reliability, but its cost control efficiency in practice can vary. In parallel, statistical quality control principles were implemented in manufacture to ensure a uniform endurance of production batches and facilitate the reliability theory [1] applications.

In contrast, there was not such a scientific breakthrough in the domain of static equipment, which is hardly maintainable or replaceable, nonredundant, and not suitable for collecting failure statistics due to high consequences thereof. The static equipment integrity is traditionally addressed via time-based (fixed interval) diagnostics, often using visual in-service inspections, as in the oil and gas industry. In this way, an inspector takes responsibility for the equipment fail-safe operation during a future fixed term, while no in-depth analysis is actually done for a scope damage potential (mostly a form of corrosion and cracking or, more occasionally, metallurgical changes and material properties degradation).

The potential of missing or misinterpreting a damage condition was effectively alleviated by adopting the risk-based inspection (RBI) principles two decades ago. The main idea of RBI is proportioning the risk control efforts to the individual risk levels, that is, prioritizing the equipment units for reinspections according to their relative risks across the plant. But how to measure risk levels without excessive analysis budgets in a context of a large plant? The widely adopted robust solution is the semiquantitative (Semi-Q) RBI, which uses corporate risk matrices to unify and compare relative failure risks unit by unit:

$$\text{Risk}=\mathrm{LoF}·\mathrm{CoF}$$E1

where LoF is the likelihood of failure and the CoF is the consequence of failure.

The size of the risk matrices is usually 5×5, and the LoF and CoF enter Eq. (1) as dimensionless multipliers ranging from 1 to 5; thus, the product risk varies from 1 to 25. CoF ratings are mapped from considering safety, financial, and environmental impacts of the unit failure, which are confidently assigned using plant operations’ personnel knowledge. LoF ratings are mapped from the anticipated “remnant life” (RL). In corrosion problems, RL is calculated from dividing a corrosion allowance CA by a corrosion rate CR:

$$\mathrm{RL}\left[\text{years}\right]=\frac{\mathrm{CA}\left[\mathrm{mm}\right]}{\mathrm{CR}\left[\frac{\mathrm{mm}}{\text{year}}\right]}$$E2

It is paramount that the risk ratings from Eq. (1) are dimensionless, and their evolution in the future remains unknown. This simplification disables a numeric cost/benefit analysis in terms of dollars and fatalities, and, thus, the asset management aspirations. In turn, it provides no justification for implementing advanced nondestructive testing (NDT) tools, as the figures entering Eq. (2) are available from basic and low-cost ultrasonic thickness (UT) gauge inspections. A numeric comparison of risk control options is not supported either.

Other fitness-for-service (FFS) problems [2], such as fatigue life, crack propagation intervals, tolerance to mechanical defects and imperfections in a wide spectrum of stress, and environmental conditions, all involve some form of stress field measurement or modeling. Stress modeling can be done using finite-element analysis (FEA), with an added benefit of reducing an uncertainty in stress concentration factors (SCF) and of performing a relatively quick analysis even for very complex geometries. But again, FFS and FEA studies often output constant figure “remnant lives”; thus, the above limitations apply.

As a matter of big picture, there are many advanced integrity assessment technologies developed to date, but they are not well aligned to each other or to the common umbrella of the asset management concept [3], by the major reason of providing single-figure outputs. Namely, a single-figure “remnant life” does not exist. What exists in reality is an individual probability of failure (PoF), which grows over time due to the mechanical damage accumulation. This applies to corrosion, fatigue, and other mechanical strength problems. Next examples show how a simple transition from the single figure to the PoF(t) function contributes to the risk owner’s decision-making process both numerically and qualitatively, thereby aligning the asset integrity technologies together to provide numeric cost/benefit outputs.

2. PoF estimates in harmonic vibration

Over the past century, machinery has become much more powerful and high speed. More power leads to more energy losses, which are dissipated mostly in the forms of heat, vibration, and noise. Mechanical excitation from reciprocating machinery is not the only vibration source in a modern plant. Acoustically induced vibration (AIV) and flow-induced vibration (FIV) also occur in power circuits of compressors and pumps. An excellent overview of these vibration mechanisms is given in the UK Energy Institute Guidelines [4]. FIV and AIV often occur at no flow piping branches, such as small bore fittings (SBF) (Figure 1), designed for process probes, ancillary access, or for draining and venting purposes.

Figure 1.

A small bore fitting (SBF) and its FEA model.

Real-life case: High vibration levels were measured on SBFs of 11 compressor pulsation bottles during a gas plant commissioning. AIV velocities of up to 29.5 mm/sec root mean square (RMS) at 150 Hz were recorded using portable vibration equipment. These figures were screened using the chart of [4] and, accordingly, classified as a “concern” region. The commissioning was continued, and all 11 pulsation bottles failed within 500 hours (Table 1).

Unit	A	B	C	D	E	F	G	H	I	J	K
TTF [hours]	341	382	188	385	373	505	449	290	50	299	455

Table 1.

SBF failure statistics; TTF stands for time to failure.

In this example, the SBF tends vibrating at its natural frequency about the zero mean (M) level harmonically, and its displacement peaks follow the Gaussian probability distribution. The RMS vibration displacement (of 31 micron here) is equal to one standard deviation (SD) of this random displacement. This displacement can be converted into the weld root bending stress amplitude (see the red spot in Figure 1) even manually—using simple beam theory of materials strength in view of this particular geometry simplicity. The nominal stress amplitude of 12.2 MPa RMS was estimated, and the whole stress spectrum was reconstructed analytically to obey a zero-mean Gaussian law having this very SD value.

The nominal bending stress formulation is compatible with the BS 7608 [5] standard material fatigue data (category F), which data were formerly obtained from large-scale testing or real weld details. Other standards (ASME VIII [6] and EN 13445 [7]) require more complex stress formulations, which would normally involve finite-element analysis.

In the risk owner’s context, the problem is: “How long will it last?” Answers can vary:

1. Using constant stress amplitude (such as 1·SD, 2·SD or 3·SD) with single-figure standard fatigue data is here typical, but an incorrect approach. Material fatigue analysis does not tolerate simplifications and/or factors due to the high nonlinearity of the fatigue life in function of the stress level. If a structure is subjected to a spectrum of stresses, then each tower of the stress histogram has to be input into the fatigue analysis, and the total damage should be calculated as a sum of contributions from each tower according to the Miner’s rule [see Eq. (4)].

2. Using the whole stress spectrum (as suggested just above) is a step forward indeed, but in conjunction with a single-figure fatigue strength value, it will lead us to the same pitfall: a single-figure remnant life output with an unknown risk evolution in time. The solution is found in the fatigue damage physics: Material strength is a random variable statistically independent from the live stress spectrum it experiences, as illustrated by the two probability density functions (PDFs) in Figure 2. This simple schematic of the load and resistance interaction can be found in reliability theory textbooks (such as [1]) and is often called “bell shape” curves.

3. Since these two variables, P(stress) and P(strength), are statistically independent, a simultaneous occurrence of a certain stress level x and a certain strength level x is a product of their PDFs. The “Monte Carlo” method [8] can be used for generating such random variables. An analytical expression for determining the PoF is, similarly, a product of the two probabilities, but the cumulative density functions (CDFs) are applicable instead:

   $$\mathrm{PoF}=P\left(\mathit{\text{stress}}>x\right)·P\left(\mathit{\text{strength}}<x\right)=P\left(\mathit{\text{stress}}>\mathit{\text{strength}}\right)$$E3

   In this example, the reconstruction of the Gaussian stress spectrum enabled the use of the whole red “camelback” shape from Figure 2. The spread of fatigue strength properties is naturally available from specimens testing data and manifests itself as a change in a fatigue curve position as the number of standard deviations (SDs) around mean (M) is varied. Thus, replacing the green shape in Figure 2 by a histogram of discrete P(strength) levels and repeating the fatigue calculations over the whole stress spectrum provides a robust solution for approximating the PoF(t).

   The above solution for the analysis upgrade is not only reflecting the damage physics more precisely (than a “single-figure” route), but also enables seamless cost/benefit considerations made from converting the PoF(t) (left in Figure 3) into $risk(t) and safety_exposure(t). The PoF(t) function multiplied by a likely financial impact of the failure gives the cost of risk in dollar terms (left in Figure 2). The likely $100,000 cost of failure due to delayed commissioning was applied here. The clearly visualized growth of the dollar risk versus hours in operation suggests that the risk should have been mitigated within few days. Yet, another effect of this failure can be workers’ safety exposure, to be safeguarded by the owner via setting a PoF limit, example of which is shown in Section 5.2 (right in Figure 11)

   According to Figure 2, the stress histogram was used with fatigue curves at seven (M ± i·SD) levels of the weld detail fatigue strength results with the output shown in Table 2.

   Some final remarks to this study can also be useful for other practical applications:

4. Particulars of fatigue methodologies vary across the standards, as shown on the right in Figure 3. A benchmarking study has been done for this problem and published on the ResearchGate network [9]. It has concluded that the BS 7608 [5] standard in conjunction with its simple input data requirements performed best in this particular problem, showing slightly conservative outputs. Notably, if two standards output different figures, then one would be closer to the reality and another further away from it. The benchmark in Figure 3 quantifies this example effect. The reasons for fatigue methodology differences across similar application domain standards were earlier investigated in yet another ResearchGate paper [10].

5. The mean time to failure (TTF) in this example is 338 hours at 150-Hz frequency, that is, 1.8×10⁸ stress cycles, or a “gigacycle fatigue” (GCF) regime. The term “gigacycle” was introduced by the fundamental research published in [11, 12]. Its major conclusion was that a “fatigue limit beyond which fatigue failures of steels do not occur” does not exist as a physical phenomenon. Fatigue failures of steels do occur beyond 10⁸, 10⁹, and 10¹⁰ load cycles even at small stress amplitudes. Failure data Table 1 also confirm this. Modern standards extrapolate fatigue testing data to 10⁸–10⁹ cycles, and this approximation showed itself well applicable to vibration.

Figure 2.

“Bell shape” curves showing the product of probabilities.

Figure 3.

SBF-estimated PoF(t) function and a benchmark of popular fatigue standards.

BS 7608 P(strength)	1.4%	2.3%	16%	50%	84%	97.7%	98.6%
Predicted TTF [hours]	29	61	112	219	431	982	2276

Table 2.

Example of PoF(t) predictions for a harmonic vibration case.

3. PoF predictions from strain gauging data

3.1 Constant amplitude response

Strain gauges [13] (left in Figure 4) can be attached to structures to record mechanical strains and further convert them into material stresses. This technique provides the most reliable information on the live stress spectra in real operation of industrial equipment. Care should be taken to ensure that the recorded process is representative of the dominant operation.

Figure 4.

Strain gauges attached to a pressure vessel nozzle and its FEA model.

This real-life example deals with temperature- and pressure-induced stresses in a glycol pump pulsation dampener nozzle. The pump run-up cycle stresses were strain gauged in a typical pump “mission,” as shown in Figure 5.

Figure 5.

Nozzle stresses recorded during the glycol pump run-up cycle.

Accordingly, the bending stress range of up to 56 MPa occurs in each run-up/shut-down cycle due to the increase in pressure by 112 barg and the piping heating up from 27°C to 70°C, which is representative for this particular plant process. There is one major stress cycle of this magnitude occurring during each run-up event; thus, the stress spectrum (Figure 2) collapses into a single vertical red line in lieu of the whole red bell shape P(stress).

Statistical variation of the material (SA 106 B) properties still needs to be considered. This is done similarly to the previous example via usage of fatigue curves corresponding to varying probability levels of the material fatigue strength (green vertical lines in Figure 2).

One nuance here is that strain gauges cannot be positioned exactly on stress “hot spots” as the latter usually occur at structural discontinuities visible in Figure 4. The pressure vessel design code EN 13445 [7] contains a provision for stress extrapolation in such cases using readings from two locations of strain gauges (or of an FEA mesh). The above measurement had only one strain gauge at each location; however, an FEA model of the dampeners (right in Figure 4) provided the figures of stress gradient along the nozzle length helpful for such an extrapolation. It is evident from Figure 4 that the stress concentration effect in this case does not exceed 1.25, and thus, the extrapolated stress range should not be more that 70 MPa (zero to peak). The weld detail classifies as the Category 32 (fillet and partial penetration welds) fatigue curve given in [7]. By varying the number of standard deviations (SDs) of the CAT 32 fatigue data, we get the varying number of cycles to failure straight away.

Since the frequency of the pump run-up/shutdown cycles is no more often than once a day, the number of cycles in Table 3 maps directly into the number of days, that is, 288 years at the lower bound failure probability. Hence, the equipment should not fail by the nozzle fatigue mechanism until the end of the offshore platform life, providing that the recorded constant amplitude conditions were representative for the whole operation of the pump.

EN 13445 PoF	0.0135 (M – 3·SD)	0.023 (M – 2·SD)	0.156 (M – 1·SD)	0.50 (M – 0·SD)
Cycles to failure	1.07e5	1.24e5	1.5e5	1.2e6

Table 3.

PoF(t) prediction in the nozzle strain gauging case study.

This example simplicity is due to the actual constant amplitude loading. It shows how the probabilistic integrity analysis unambiguously supports the asset management decision-making process. One remaining safeguard is performing a penetrant inspection (PI) of the nozzle to ensure that there are no cracks from other reasons (transportation, impacts, etc.).

3.2 Variable amplitude response

This example illustrates a more complex situation where strain gauging provided a true stress spectrum for a mining truck tray hot spot. A total of 18 potential hot spots were strain gauged using triaxial rosettes during a typical truck mission involving: loading rocks in the tray, travel, emptying, and returning to mine site several times during a 7-hour-long shift. The most critical location of the tray was identified as a result and is shown in Figure 6.

Figure 6.

Mining truck tray and its critical location identified from strain gauging.

Signal processing software was used for the analysis, and the output fatigue damage spectrum is shown in the left of Figure 7. The maximum principal stress range was used, as the fatigue crack growth is governed by the maximum stress component opening the crack.

Figure 7.

Tray damage spectrum accumulated during one shift and the PoF(t) estimate.

The majority of fatigue damage in the left of Figure 7 occurred in the low-stress area; however, few spikes up to 290 MPa were recorded infrequently during the tray loading. The whole damage spectrum is a good illustration of a variable amplitude fatigue loading, and the damage introduced by each stress range i is calculated according to Miner’s rule [14]:

$$D=\sum _{i=1}^n\frac{n_i}{N_i}$$E4

where n_i is the number of cycles brought at the ith stress level and N_i is the number of cycles to failure at this very stress level obtained from a relevant fatigue curve.

Unlike the previous example where the stress field extrapolation was required by the standard [7], the present example used BS 7608 fatigue data [5]. The philosophy of the latter is slightly different: real weld details were tested for fatigue with the output of nominal structural stresses. In turn, nominal stresses are used with the fatigue curve of [5], e.g., those stresses reasonably away from hot spots, as it was attempted to collect by placing rosettes at a small distance from the stress raisers (refer Figure 6). The BS 7608 detail Category G Class 5.5 fatigue data were used at two levels of its probability (Table 4).

BS 7608 PoF	0.05 (M – 2·SD)	0.50 (M – 0·SD)
Time to failure [hours]	2374	5150

Table 4.

PoF(t) prediction for the mining truck tray hot spot.

Material testing data for the M and M – 2·SD levels can be found in technical literature most often, and these two points can be used to approximate the PoF(t) S-shaped curve up to the 50% level even by a smooth curve manual fitting, considering that the third point is

$$\mathrm{PoF}\left(t=0\right)=0$$E5

The vendor’s guarantee on the tray life was 20,000 hours, and this worst-case location was recommended for reinforcement as an outcome from the above analysis. A self-explanatory picture of the PoF(t) function was obtained from a manual fitting of a typical S-shaped cumulative density function (CDF) to these two estimates, as shown in the right of Figure 7. Using more PoF levels would further improve the PoF(t) curve shape accuracy if needed. This is an example of a design support made from the records of a pilot exemplar operation.

4. PoF considerations in fitness-for-service problems

The term fitness for service (FFS) is used where damage in excess of a design tolerance has already been found in the equipment, and this analysis aims at replying two questions:

1. How critical is the defect at the moment of its characterization?

2. How long will that equipment last in view of this defect future growth?

The first question triggers a pass/fail or a screening-type output, and the second drives a fixed “remnant life” figure in many studies. While the FFS methods do use empirical methods (such as crack growth laws), applications of FFS analysis are unfortunately narrow. This is mostly due to their complexity and timing, while risk owners need prompt decisions in such critical situations. The same upgrade idea can be used to output the damaged equipment PoF versus time and add more value through visualizing the risk evolution.

4.1 Crack propagation problems

Port cranes (left in Figure 8) showed three failures by fracture of the boom top shelf (right in Figure 8), which resulted in catastrophic consequences. Since then, the manufacturer has reinforced the boom design. However, a life extension decision was required in the late 1990s, and that decision needed a scientific substantiation in view of potential failure implications.

Figure 8.

Port crane structure and an FEA model of its cargo boom.

As it was mentioned in the introduction, cranes are highly individual structures in the sense of their loading, and a screening using a conventional fatigue theory showed that a “generic” port crane has a life expectancy of 25 years ± 30 years spread, which outcome is not practical.

The solution was in adopting the damage tolerance approach: cracking inspections to be implemented at individual intervals. If cracks are not found, then it is assumed that a crack of a nondetectable length (less than 5 mm) is nevertheless present. A life extension is then warranted for a safety factored period needed by that crack to grow to a critical size. This scenario required only basic visual inspections, but had a good potential to control the risk. An earlier application of a similar method for bridges life extension can be found in [15].

The relevant science apparatus is the fracture mechanics empirical laws of crack growth detailed for example in the BS 7910 FFS standard [2]. Since this theory is a rather uncommon specialist knowledge, a simplistic introduction follows here.

In function of the material, temperature, and the strain rate, there is a variable-size plastic zone at a crack tip. Thus, the stresses there are singular, and the fatigue theory term “stress range” is not straight applicable to predict the crack growth rate. Instead, a stress intensity factor (SIF) range ΔK [MPa·√m] is used to correlate a “nominal” stress range Δσ away from the crack tip with the empirical crack behavior:

$$∆K=F·∆\sigma ·\sqrt{\pi ·a}$$E6

where F is a geometry constraint correction and a is the half-length of the crack.

Cracks grow nonlinearly; they accelerate as they grow starting from microns per cycle and ending with a catastrophic growth rate. The empirical Paris law approximates this process:

$$\frac{\mathit{da}}{\mathit{dN}}=C·∆K^m$$E7

where the left-side derivative is the crack growth rate, N is the number of cycles, and C and m are material properties–probabilistic variables known from statistical treatment of test data.

Using mathematical transformations, the system of Eqs. (6) and (7) yields the crack length increase (from size a_i to a_i+1), which can be estimated in each stress cycle, one after another:

$$a_{i+1}=\sqrt[1-\frac{m}{2}]{C·∆{\sigma }^m·{\pi }^{m/2}·F^m·\left(1-\frac{m}{2}\right)+{a_i}^{1-m/2}}$$E8

Eq. (8) is suitable for simulating the crack growth cycle by cycle using the Monte Carlo method. Nuances are numerous, but two of them are sometimes overlooked in practice:

• Cracking often initiates in heat-affected zones (HAZ) of welds, where residual tensile stresses originate from welding and do affect the crack tip opening.

• Structural stress gradients affect the nominal stress range Δσ as the crack grows.

To include these stress gradients, a cycle-by-cycle Monte Carlo simulation has been performed, and the results compared with the output of the simplified equations below, which estimate the total (e.g., integral) number of stress cycles N_C necessary for the crack to grow from an initial size a₀ to the critical size a_C:

$$N_c=\frac{1}{C·∆{\sigma }_{\mathit{eq}}^m·{\pi }^{m/2}·F^m·\left(1-\frac{m}{2}\right)}·\left[a_c^{1-\frac{m}{2}}-a_0^{1-\frac{m}{2}}\right]$$E9

where F is the geometry constraint correction, C and m are the probabilistic fracture resistance characteristics of the material (we will vary them just below), and Δσ_eq is the equivalent nominal stress range derived from the measured stress spectrum as follows:

$$∆{\sigma }_{\mathit{eq}}=\sqrt[m]{{\sum }_{i=1}^j\left(∆{\sigma }_i^m·f_i\right)}$$E10

where Δσ_i is an ith tower of the stress spectrum histogram and f_i is its occurrence frequency.

The Monte Carlo validation proved Eqs. (9) and (10) being correct and underestimated the crack propagation life by some 30% compared to the stress gradients included. The equivalent nominal stress range Δσ_eq = 99 [MPa] resulted from strain gauging and FEA for the original, not reinforced design of the boom. The left plot in Figure 9 reads as the number of daylong crane shifts in function of a detected crack length in various crane missions (e.g., cargo cycles). Consider a 5-mm-long crack at the hot spot of concern: the number of shifts till failure varies from 22 to 123 depending on the duty cycle severity.

Figure 9.

Crane boom PoF(t) due to crack growth from 5 to 80 mm length in a worst mission.

Now, let us enrich this research project from the early 2000s by considering two probability levels of the steel fracture resistance parameters C and m, similarly to the previous example (Table 5).

P(fracture properties)	5% (original study)	50% (present study)
C	5.97e–11	1.44e–14
m	2.25	4.72

Table 5.

Carbon Steel (St38b2) fracture resistance parameters at two levels of their probability.

The account of material properties variation also gives an order of magnitude change in life predictions, resulting in 112 shifts using the mean properties, as opposed to 22 shifts resulted from the lower bound data (taken for the worst-case cargo cycle—the brown curve in the left of Figure 9). Similarly, manual fitting of an S-shaped curve to these two data points produces a smooth PoF(t) function (right in Figure 9) to visualize the failure chance.

Multiplying the PoF(t) by the likely cost of the crane replacement and the penalties involved will estimate the $Risk(t) for a cost/benefit decision-making. Safety implications here are also severe and can likely lead to one or two fatalities (one docker and one crane operator). Providing that the risk owner has a safety limit, it should be used as a cutoff on the PoF.

4.2 Other damage mechanics relevant to the FFS scope

Getting back to the FFS scope of problems [2], in majority of cases, these are:

1. Fatigue and crack propagation governed damage (addressed above)

2. Creep (empirical analysis apparatus generally similar to the present fracture mechanics example, which is suitable for a similar probabilistic analysis approach)

3. Corrosion and/or erosion driven material wastage (discussed in next section)

4. Gross defects affecting the distribution of loads and strains (modeled by FEA and then analyzed versus operational stress spectra similarly to examples in Section 3).

Thus, the majority of operational damage cases can be quantified using the PoF(t) strategy.

5. PoF estimates from corrosion data

The problem of corrosion failures, surprisingly, is the most technically challenging for estimating the PoF(t) function. This is because spatial distributions of corrosion damage are also probabilistic, further aggravated by the practical inability to inspect 100% of the equipment surface. The challenge of equipment internal corrosion risk control is major in petrochemical industries, and failure implications are severe, as well as the inspection costs.

5.1 The “state of the art” in assessing pressure equipment corrosion

The most natural and straightforward corrosion risk analysis methodology was outlined in the introduction to this chapter and is called “Semi-Q” risk-based inspection (RBI) planning. It is very robust for large plants and does output a relative risk ranking. However, the dimensionless risk levels are not aligned with a numeric cost/benefit analysis and personnel safety demonstration in this context and, thus, require an upgrade.

Another popular RBI methodology API RP 581 (refer [16] for technical background) is used in most RBI software. For a simplistic explanation, their POF values originate chiefly from

$$\mathrm{PoF}=\mathit{GFF}·\mathit{DF}=\mathit{GFF}·\left(\frac{1}{\mathit{EFF}}\right)·f\left(\frac{\mathit{AGE}·\mathit{CR}}{\mathit{THK}}\right)$$E11

where GFF is a constant generic failure frequency by equipment and damage morphology, EFF is an inspection efficiency factor reduced for each next year by 10%, and f is tabulated as a function of the parameters in brackets: equipment age (AGE) at the inspection time, the estimated corrosion rate (CR), and the wall thickness (THK) available for wastage.

The meaning of f is, thus, a ratio of the wall loss (WL) “as inspected” to the remnant THK:

$$\mathit{AGE}\left[\text{years}\right]·\mathit{CR}\left[\frac{\mathit{mm}}{\text{year}}\right]=\mathit{AGE}\left[\text{years}\right]·\frac{\mathit{WL}\left[\mathrm{mm}\right]}{\mathit{AGE}\left[\text{years}\right]}=\mathit{WL}\left[\mathrm{mm}\right]$$E12

The recent API 581 editions change from second to third refined the THK calculations to consider the minimum required wall thickness (MRWT) parameter and that increased the conservatism (refer to the left chart in Figure 11). API 581 offers useful data for non-age-related damage mechanisms, but its thinning assessment method has two strategic pitfalls:

1. using generic constant frequencies GFF for individually damaged equipment

2. using a single “worst-case” corrosion location, thus neglecting the rest of them.

The latter is a clear indication of distorting an actual PoF because a pool of thickness readings did contain the intrinsic corrosion distribution information. This information cannot be restored if it was collapsed into a “worst-case” data point; hence, an analysis done from a single location will not produce a true PoF, as one of probabilistic distributions was ignored.

Quite apart stands the DnV-RP-G101 [17] RBI methodology, which extensively uses PoF terms for age-related (time-driven) and non-age-related (process-parameter-driven) damage mechanisms. The terms are linked to the quantitative consequence assessment, and three levels of assessment detail are recognized too. One major simplification, again, is using generic PoF varied by a damage mechanism type there. PoF data in [17], thus, enables PoF estimates with no inspection data involvement whatsoever. This is useful for design, but quite confusing for assessment purposes. We observe the same attempt of generalizing failure probabilities for individual equipment and neglecting the true spatial distribution the damage. Hence, same as above pitfalls 1) and 2) apply in the DnV-RP-G101 method too.

Perhaps, the most comprehensive statistical treatment of corrosion data is outlined in Appendix B of the Nonintrusive Inspection guideline DnV-RP-G103 [18]. This guideline resulted from the HOIS Joint Industry Project to assist implementation of advanced NDT tools (such as large coverage corrosion mapping) in the oil and gas industry. It introduces the extreme value analysis (EVA) [19] applications to large samples of corrosion data. In brief, the data points x are first statistically plotted on a probability paper having custom scaled axes; second, a probabilistic distribution CDF(x) is fitted and is then extrapolated to a “survivor function” SUR(x) using the ratio of the total equipment area to the inspected area [20]:

$$\mathrm{SUR}\left(x\right)={\left[1-\mathrm{CDF}\left(x\right)\right]}^{\text{Total Area}/\text{Inspected Area}}$$E13

Finally, a “worst-case” reading is found from the survivor function at a target level of its occurrence probability, say 1%. Thus, the whole data are collapsed into a single point again.

Seemingly, there is psychological antagonism in such a scenario: advanced NDT providers aim supplying more and better data, but collapse it to a single value, as they are asked by the risk owner to produce a “worst location.” This is because RBI methods require a single location for a corrosion assessment, and thus, advanced NDT applications add little more value.

5.2 Proposed method for corrosion risk analysis

The solution proposed here (and previously reported at few industrial conferences) is using the same bell shape curves product principle (right in Figure 10) for corrosion risk assessments. In contrast to the above methods, it retains all the relevant inspection data points and uses the corrosion damage distribution “as is” (left in Figure 10), without any fixed value extrapolation or user factoring involved:

Figure 10.

Product of probabilities in corrosion problems.

The brown points are the corrosion data “as measured” with a Gumbel distribution fitted (dashed line), and the green curve is the cumulative density function (CDF) of this individual corrosion distribution. The probability of failure in this case is also a product of two events:

$$\mathit{PoF}=P\left(\mathit{THK}\mathit{\text{occurence}}\right)·P\left(\mathit{\text{Failure}}\mathit{at}\mathit{\text{that}}\mathit{THK}\right)$$E14

The probability of failure at a certain thickness level is also equipment individual. It can be quantified as in the above examples or even more simplistically. The PoF in Eq. (14) is instantaneous at the moment of inspection. To assess the PoF(t) evolution in time, the evidential corrosion rate is simulated for the future time instances, and that effectively shifts the green bell shape in Figure 10 to the left. The blue overlap area grows, and so does the PoF obtained from Eq. (14).

A PoF(t) function predicted from a real-life pressure piping case study is shown on the left of Figure 11 (solid blue line). The safety exposure limit of one fatality in 1000 workers per year is shown by the red-dotted line. Their intersection means the safety limit breach. Operation past this time instance will not be compliant with it. Finally, the transition from a PoF(t) to the risk dollar cost is multiplying PoF by the anticipated total cost of the failure consequences (near $1 million here due to nonredundancy and collateral damage potential). This is shown by the solid blue line in the right of Figure 11, with the cost being read from the left vertical axis, and it obviously increases over time.

Figure 11.

Corrosion PoF(t) predictions benchmark and cost/benefit analysis.

A surprisingly common confusion is that inspections affect PoF or risks. This is not the case until actual risk controls have been implemented following the inspection and do physically minimize or mitigate risks, similarly to the resource restoration in the reliability theory [1].

The dashed-dotted line depicts the cost of all inspections done, totaled toward the end of equipment life, in function of the variable inspection interval (horizontal axis). The sum of the solid and dashed-dotted lines is the total cost (of risk and inspections), which has a minimum at 6 years since the last inspection here. It should be used to reinspect or set other relevant risk controls (replacement, barriers, and process changes), providing that they occur prior to the safety limit breach at 7.5 years in this example. Otherwise, the safety limit must prevail.

The cost/benefit plotting shown on the right of Figure 11 is especially useful for building effective asset management frameworks, as it facilitates an unambiguous budget allocation made from the numeric figures of risk exposure and their comparison with mitigation costs.

6. The upgrade potential and way forward

The above material illustrates an integrity analysis upgrade potential resulting from the new strategic premise that every operational integrity assessment should output PoF(t) to assist justified decision-making regarding individual equipment maintenance and risk control.

The asset management concept [3] offers a common umbrella for all integrity risk control decision-making, including the adoption of advanced condition monitoring (CM) tools and digitalization technologies on the basis of their cost and safety control efficiency. In turn, the latter is assisted by providing an adequate level of data analysis using the PoF(t) strategy, while this very strategy also enables the cost/benefit charting. In this way, the presented research and development was not occasional or voluntary, but triggered by the challenges in implementing advanced technologies (RBI, FFS, FEA, and NDT). Therefore, this chapter aimed at showing the big picture of these problems and our holistic PoF(t) solution to them.

The methodology is regarded complete as the following has been achieved to date:

• The concept of estimating PoF(t) as the product of two statistically independent events was applied to a range of damage physics, as illustrated above.

• The shown real-life examples of all the output predictions were consistent with operational experience and were well agreed upon by experienced professionals in this field, e.g., inspection and integrity engineers responsible for those particular problems troubleshooting. No artificial factors were used, but these studies have output very sensible figures. This reinforces the validity of the methodology.

• The transition to the cost of risk and safety exposure tolerance was made using likely consequences of failure. Estimating CoF is usually done at ease by the relevant site personnel. A further refinement of CoF is feasible using a Layers of Protection Analysis (LOPA) if this is warranted by risk levels and control systems.

• The rightful concept of risk-based integrity control was applied to all the studied problems. In other words, the level of analysis should be proportional to the problem criticality. The PoF(t) concept is relevant to high criticality problems and interacts synergistically with simpler practices relevant to lower risk objects. In this way, the analysis depth can be escalated through several levels as the risk estimate is being refined and does indicate a requirement for an escalation.

• The methodology also does not contradict with any modern inspection and risk analysis standards, but supplements their capabilities via more advanced data analysis and aligns the particular data collection and analysis apparatus with the asset management aspirations of cost and risk control.

• The implementation of the method does not demand for an instant step change in condition monitoring tools, as wide spread technologies (spot check UT, strain gauging, and vibration accelerometers [13]) are sufficient to support its initial implementation as shown above. In turn, this implementation will provide a numeric cost/benefit basis for advanced CM tool implementation consideration.

• The PoF(t) concept is based on the actual damage physics, and since a particular material behavior (material fatigue, crack propagation, and corrosion mechanisms) describe the nature laws, their application is universal across industries and life stages. This is a holistic solution able to support asset integrity in any industry.

• Finally, the upgrade is not too cumbersome technically, as the most labor in static equipment operational integrity assessments is spent on measuring and modeling the damage phenomena, while the addition of multi-PoF analysis only requires repeating certain calculations few times and visualizing the new results.

And the way forward is obviously to expand trials of this methodology across industries, work through particular nuances where required, and validate its application benefits. The concept implementation now became feasible thanks to the cross-industry adoption of precise measurement techniques applicable to integrity problems, although not yet fully realized.

One misconception found in practice is applying design premises to operational integrity assessments. The “design life” concept has another purpose, and it is still open for further improvements [15] via evidential data. Reliable data originate from in situ measurements ever expanding in their capabilities over the past two decades. The only major challenge in implementing more and better monitoring is the financial justification, which can be resolved using the above methodology to maintain the static “nonmaintainable” equipment.

To conclude, the following quote from Galileo Galilei outlines the general research concept eventually reinforced here: “Measure what is measurable, and make measurable what is not so.”

Acknowledgments

The author is sincerely grateful to his teachers who guided his work on the thesis (section 4.1). He also very much appreciates the hard work of field engineers, who were collecting the live data (Sections 2 and 3) during his times at SVT Engineering Consultants (Perth). The R&D work on implementing the PoF(t) and Risk Cost terms into integrity assessments was undertaken by Quanty Pty. Ltd. at own expense with no finance or influencing by others.

Conflict of interest

None exist.

Disclaimer

The information in this chapter aims at highlighting a big picture of the probabilistic analysis process and its implementation potential made in a simple language. It does not show all the nuances or technical details of these examples. Since the scope problems are individual, the above data and simplified equations should not be applied to other individual equipment cases. We disclaim any liability resulting from an application of this information by others.