Risk-Based Inspection, Safety and Integrity Management

Introduction

Hazardous assets—such as pressure vessels, boilers, pipelines, storage tanks, rotating equipment, lifting appliances, and safety-instrumented systems—can fail in ways that injure people, damage the environment, interrupt production, and create legal liability. Maintenance engineering therefore extends beyond repairing defects. It must identify credible failure mechanisms, estimate risk, preserve containment and protective functions, and demonstrate compliance with applicable law and recognized engineering practice.

Risk-based inspection (RBI) provides a systematic method for deciding what to inspect, where to inspect, how often to inspect, and which inspection technique to use. It does not eliminate the need for sound design, competent operation, preventive maintenance, or statutory examination. Rather, it allocates inspection effort according to the likelihood and consequence of failure.

Integrity management links technical activities throughout the asset life cycle: design, procurement, construction, commissioning, operation, inspection, maintenance, modification, decommissioning, and learning from incidents. Functional safety addresses whether automatic protection systems perform their required safety functions when demanded. Mechanical integrity addresses the continuing ability of equipment to contain fluids and withstand imposed loads.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain probability of failure, consequence of failure, and risk.
2. Identify degradation mechanisms and estimate inspection effectiveness.
3. Construct and interpret qualitative and semi-quantitative risk matrices.
4. Develop an inspection plan based on credible damage mechanisms.
5. Distinguish RBI, mechanical integrity, process safety, and functional safety.
6. Explain the role of standards, legislation, competence, records, and management of change.
7. Evaluate the limitations and ethical responsibilities associated with risk-based decisions.

1. Risk as the Basis for Inspection Decisions

Risk is commonly expressed as the combination of the probability of an unwanted event and its consequence. For a defined time interval and consequence category:

where R is risk, P(F) is the probability of failure during the specified interval, and C(F) is the consequence if failure occurs. Probability may be expressed as a dimensionless frequency or probability; consequence may be measured in financial loss, fatalities, environmental damage, or a multidimensional score. The expression is meaningful only when the time basis, system boundary, failure definition, and consequence measure are clearly specified.

For multiple mutually exclusive failure scenarios, expected loss can be represented as:

Here, E[L] is expected loss, Fᵢ is scenario i, P(Fᵢ) is its probability within the defined period, and Cᵢ is its consequence. This calculation is useful for economic comparison, but a low average loss must not be used to justify an intolerable individual accident scenario. Catastrophic low-probability events require explicit treatment.

Risk is not a property of equipment alone. It depends on operating conditions, inventory, occupancy, safeguards, exposure, detectability, emergency response, and the quality of available evidence. A credible risk assessment therefore states its assumptions and uncertainty.

1.1 Probability of Failure

Probability of failure may be estimated from:

• historical failure data;
• generic industry databases;
• equipment reliability models;
• degradation-rate measurements;
• condition-monitoring trends;
• expert judgment; and
• probabilistic consequence and event-tree analysis.

For a constant failure rate λ, the reliability of a non-repairable item over time t is:

and the probability of failure by time t is:

where λ has units of failures per unit time. These relationships assume a constant hazard rate, statistically appropriate data, and a defined population. They are not automatically valid for equipment subject to wear-out, corrosion acceleration, changing duty, or planned restoration. For small λt, the approximation F(t) ≈ λt may be used because higher-order terms are negligible.

In RBI, the probability of failure is often decomposed into a baseline likelihood modified by equipment-specific evidence:

where P₀ is a reference probability and the M terms are documented modifiers for damage, condition, inspection effectiveness, and operation. This is a modelling structure rather than a universal law. The modifiers must be defined by the chosen RBI methodology and must not be multiplied indiscriminately or counted twice.

1.2 Consequence of Failure

Consequence analysis considers the physical event and its effects. Relevant outcomes include:

• toxic exposure;
• fire or explosion;
• blast overpressure;
• loss of containment and environmental release;
• falling loads or rotating-equipment projectiles;
• loss of production;
• damage to adjacent equipment; and
• reputational, legal, and social effects.

A consequence assessment should consider inventory, pressure, temperature, fluid properties, release rate, isolation time, ignition probability, dispersion, population exposure, and emergency arrangements. Worst credible consequence is preferable to an implausible worst-case scenario, while still recognizing escalation and common-cause failures.

2. Hazard Identification and Failure Mechanisms

An inspection plan is only as good as its damage-mechanism assessment. A visual examination cannot reliably detect every form of degradation, and increasing inspection frequency cannot compensate for selecting the wrong technique.

Typical degradation mechanisms include:

The engineer should ask four questions:

1. What can degrade?
2. Why can it degrade under the actual service conditions?
3. What is the credible failure mode and location?
4. Which inspection method can detect it before loss of containment or loss of function?

Damage mechanisms may interact. For example, corrosion may reduce wall thickness, while cyclic pressure causes fatigue growth at a pit. A credible assessment therefore considers damage coupling, not merely an isolated catalogue of mechanisms.

3. Risk Matrices and Risk Criteria

A risk matrix ranks combinations of likelihood and consequence. A typical five-by-five matrix uses likelihood categories from rare to frequent and consequence categories from minor to catastrophic.

The numerical score is generally ordinal, not a true probability. A score of 12 is not necessarily twice the risk of a score of 6. Organizations should define action bands, for example:

• low: managed through routine controls;
• medium: additional inspection or engineering review required;
• high: prompt risk reduction and management approval required; and
• extreme: unacceptable until reduced or formally justified under the governing risk framework.

Matrix limitations include category compression, subjective boundaries, failure to distinguish uncertainty, and the possibility that different combinations receive the same score. A consequence-ranked hazard with very low likelihood may deserve greater attention than its matrix cell suggests. Quantitative analysis, bow-tie analysis, layers-of-protection analysis, or specialist review should be used when decisions are safety-critical or uncertainty is high.

4. Risk-Based Inspection Methodology

A defensible RBI study usually follows these stages.

4.1 Define Scope and Data Quality

Define the plant boundary, equipment population, operating envelope, assessment period, failure definition, and decision authority. Gather design drawings, material certificates, process data, pressure and temperature histories, previous inspection reports, repairs, alterations, relief-device records, operating deviations, and incident history.

Data quality should be graded. Missing thickness readings, uncertain materials, undocumented repairs, or unreliable process conditions should increase uncertainty and may justify conservative assumptions or immediate inspection.

4.2 Identify Failure Scenarios

For each item, identify credible loss-of-containment and loss-of-function scenarios. Consider normal operation, startup, shutdown, upset conditions, utility loss, external fire, overpressure, vacuum, thermal shock, and human error. Link each scenario to a damage mechanism and a consequence pathway.

4.3 Estimate Probability and Consequence

Use the selected RBI method consistently. Determine current condition, degradation rate, remaining life, inspection confidence, and protection-system availability. Consequence analysis should include people, environment, business, and equipment impacts where required by the organization.

4.4 Select Inspection Strategy

Inspection should be optimized, not merely increased. A strategy may include:

• external visual inspection;
• ultrasonic thickness readings at defined locations;
• radiography or computed radiography;
• magnetic-particle or dye-penetrant examination;
• eddy-current examination for heat-exchanger tubes;
• guided-wave ultrasonics for screening long pipe sections;
• acoustic emission monitoring;
• internal inspection during shutdown;
• online process and corrosion monitoring; and
• functional tests of protective devices.

Inspection effectiveness depends on method capability, access, surface condition, coverage, personnel competence, calibration, and interpretation. “Inspected” does not mean “known to be sound” unless the method is capable of finding the relevant defect at the relevant location and size.

4.5 Set Interval and Acceptance Criteria

Inspection intervals should reflect degradation kinetics, uncertainty, regulatory requirements, and the time needed to detect and manage a defect before it reaches a critical condition. For approximately linear wall thinning, a measured corrosion rate may be estimated by:

where CR is the thickness-loss rate, t₁ and t₂ are thicknesses at times T₁ and T₂, and the result has units such as mm/year. The equation assumes comparable measurement locations and conditions and should account for measurement uncertainty, coating effects, and local pitting. It is unsafe to extrapolate a linear rate through a known change in chemistry, velocity, temperature, or operating regime.

If the minimum acceptable thickness is t_min, a simple remaining-life estimate is:

where L is time to the assumed limit. This is a screening estimate, not a substitute for a code-based fitness-for-service assessment. If CR is zero or negative because of measurement scatter, the result cannot be interpreted as infinite life.

Worked Example: Corroding Vessel

A vessel wall measured 12.4 mm in 2021 and 11.8 mm at the same locations in 2024. The minimum allowable thickness is 10.5 mm.

The estimated rate is:

The estimated remaining life is:

This result is valid only under the stated assumptions. Measurement error, localized pitting, future process changes, stress concentration, and code margins may reduce the practical inspection interval. The engineer should also determine whether the readings represent the thinnest areas and whether a fitness-for-service assessment is required.

5. Mechanical Integrity Management

Mechanical integrity is the disciplined assurance that equipment is designed, fabricated, installed, operated, inspected, tested, maintained, and repaired so it remains fit for service. A mechanical-integrity program commonly covers:

• pressure vessels, piping, tanks, and relief systems;
• rotating equipment and guards;
• electrical equipment in hazardous areas;
• fire protection and detection systems;
• emergency shutdown systems;
• instrumented protective systems;
• structures, lifting equipment, and safety-critical valves.

An effective program assigns ownership, defines inspection and test procedures, establishes acceptance criteria, controls overdue work, verifies defect disposition, and retains traceable records. Defects should be classified by technical significance and managed through repair, rerating, monitoring, operating restriction, or retirement.

Fitness-for-service assessment determines whether equipment with a flaw can safely continue operating. It may address general metal loss, local metal loss, pitting, crack-like flaws, distortion, creep, fatigue, and brittle fracture. Such assessment must use an appropriate recognized procedure and competent personnel; it is not equivalent to accepting a defect because the equipment has operated without failure.

6. Functional Safety and Layers of Protection

Functional safety concerns the ability of a system to achieve or maintain a safe state in response to specified dangerous conditions. Examples include high-pressure trips, high-level shutdowns, burner-management systems, overspeed trips, and emergency depressurization.

Protection is often represented as independent layers:

1. inherently safer design;
2. basic process control;
3. alarms and operator response;
4. automatic safety-instrumented functions;
5. physical protection, such as relief devices;
6. containment and detection;
7. emergency response; and
8. land-use planning or community protection.

Independence is essential. Two safeguards that depend on the same transmitter, power supply, software failure mode, or operator may not be independent. Functional-safety work includes hazard analysis, allocation of safety functions, specification, design, verification, validation, proof testing, bypass control, change management, and documentation across the safety life cycle.

For a simple independent protection layer model, if initiating-event frequency is f₀ and the probability of failure on demand of each independent protection layer is PFDᵢ, the residual frequency may be approximated by:

This approximation assumes independence, adequate demand definitions, valid probabilities, and no common-cause or systematic failures. Real analyses must account for test intervals, dangerous undetected failures, repair times, voting architectures, common utilities, human actions, and dependence between layers.

Mechanical integrity and functional safety are related but distinct. A relief valve may have a mechanical-integrity requirement for inspection and set-pressure testing, while a shutdown system has functional-safety requirements for sensing, logic, final action, and proof testing. A failed sensor can defeat functional safety even when the pressure vessel is mechanically sound.

7. Regulation, Standards, and Governance

Legal requirements vary by jurisdiction and asset type. They may address pressure equipment, occupational safety, environmental emissions, hazardous substances, lifting equipment, electrical installations, and reporting of incidents. Recognized standards and recommended practices provide technical methods, but they do not replace legislation or professional judgment.

A responsible organization should maintain a compliance register identifying:

• applicable laws, permits, and inspection authorities;
• mandatory examination intervals and certificates;
• responsible persons and competent inspectors;
• design and operating limits;
• required records and retention periods;
• reporting duties; and
• actions for nonconformance.

Ethical practice requires truthful records, transparent assumptions, escalation of intolerable risk, and refusal to approve work outside one’s competence. Production pressure must not override a safety-critical acceptance criterion. Risk acceptance should be assigned to an authorized level of management and should consider affected workers, contractors, the public, and the environment—not only financial return.

Management of change is central to integrity. Changes in feedstock, temperature, pressure, control logic, materials, inspection interval, staffing, or operating envelope can invalidate the original risk assessment. Every change should be screened, technically reviewed, approved, implemented, and verified before operation.

8. Case Study: Illustrative Refinery Hydrocarbon Line

Background

An illustrative refinery transfers hot hydrocarbon through a carbon-steel line. Historical inspections show gradual wall thinning near an elbow downstream of a control valve. The line operates continuously, and release could produce a flammable vapor cloud near occupied facilities.

Problem

A routine plan proposed inspection every five years using a few ultrasonic readings on straight pipe. Operators had also reported intermittent high flow during process upsets. The proposed plan did not explicitly address erosion-corrosion at the elbow or the high consequence of ignition.

Analysis

The RBI team reviewed process conditions, flow history, material, geometry, previous thickness maps, inspection uncertainty, ignition sources, occupancy, isolation time, and emergency response. The elbow was identified as a high-turbulence location. The team concluded that general corrosion alone was not an adequate damage model; erosion-corrosion and localized thinning were credible. The consequence category was major because a release could escalate to fire and affect personnel.

Approach and Solution

The team implemented the following controls:

• a detailed ultrasonic thickness grid at the elbow and adjacent welds;
• temporary process monitoring to identify high-flow episodes;
• verification of material and design limits;
• review of valve characteristics and flow control;
• shorter inspection interval based on the measured rate and uncertainty;
• external visual examination for vibration, support damage, and insulation-related corrosion;
• updated emergency-isolation testing; and
• a management-of-change review for future throughput increases.

Inspection data were trended by location rather than averaged across the line. A thin area was repaired during a planned outage, and the operating procedure was revised to limit excessive flow excursions.

Outcome

The revised plan addressed the actual damage mechanism and reduced both probability and consequence. It also demonstrated that inspection alone was not sufficient: process control, design review, emergency isolation, and repair were necessary risk controls.

Learning Points

1. Consequence affects inspection priority even when measured degradation is modest.
2. Damage mechanisms are location-specific.
3. A small number of readings can miss local thinning.
4. Risk reduction may require operating and design changes, not more inspection.
5. Inspection findings should update the RBI model and operating knowledge.

9. Technology, Data, and Contemporary Practice

Digital inspection systems can link asset registers, inspection locations, photographs, thickness data, work orders, alarms, and certificates. Analytics can identify abnormal trends, prioritize overdue tasks, and compare actual operating conditions with the design envelope. Remote visual inspection, robotic crawlers, drones, permanently installed sensors, and digital twins can improve access and frequency.

Artificial intelligence may assist image classification, anomaly detection, corrosion-rate estimation, and maintenance prioritization. It should be treated as decision support, not an autonomous authority. Training-data bias, false negatives, changing process conditions, cyber compromise, and poor explainability can create new risks. Critical findings require qualified human verification, traceable evidence, and controlled software validation.

10. Challenges and Limitations

RBI is powerful but not infallible. Important limitations include:

• incomplete or biased failure data;
• uncertainty in degradation rates;
• inaccurate consequence modelling;
• changing process chemistry and operating patterns;
• dependence between safeguards;
• overconfidence in numerical scores;
• inspection-access constraints;
• human and organizational failures; and
• misuse of risk reduction to defer legally required inspection.

A mature program treats uncertainty explicitly. Conservative assumptions, sensitivity analysis, independent review, increased monitoring, and prompt reassessment after abnormal events are appropriate responses. Risk-based prioritization should never become risk-based neglect.

Best-Practice Checklist

Before approving an RBI inspection plan, verify that:

• the asset boundary and failure definition are clear;
• current process conditions and materials are known;
• all credible damage mechanisms have been considered;
• inspection methods can detect the anticipated flaws;
• consequence categories include people, environment, and escalation;
• uncertainty and data quality are documented;
• statutory requirements are satisfied;
• safety functions and mechanical-integrity tasks are linked;
• acceptance criteria and escalation rules are explicit;
• overdue inspections and temporary repairs are controlled;
• management of change is active; and
• findings are fed back into the risk assessment.

Chapter Summary

Risk-based inspection allocates inspection resources according to probability and consequence of failure. Probability depends on equipment condition, degradation mechanisms, operating history, inspection confidence, and safeguards; consequence depends on inventory, energy, hazardous properties, exposure, escalation, and response capability. Risk matrices support prioritization but use ordinal categories and cannot replace engineering judgment for high-consequence or uncertain situations.

A sound RBI process defines scope, identifies damage mechanisms, estimates probability and consequence, selects capable inspection methods, sets justified intervals, and updates the plan when conditions change. Mechanical integrity assures continuing fitness of equipment, while functional safety assures that specified protective functions operate when demanded. Both require competent people, testing, records, independent verification, and management of change.

Regulations establish minimum obligations, whereas standards provide recognized technical methods. Ethical integrity requires transparent assumptions, accurate records, timely escalation, and protection of workers, the public, and the environment. Digital tools and AI can improve monitoring and prioritization, but they require validation and human oversight. The central professional principle is that inspection must be connected to credible failure mechanisms and effective risk reduction—not performed as a routine exercise without a decision purpose.

Key Terms

Risk: Combination of the probability of an event and its consequence.

Probability of failure: Likelihood that defined equipment failure occurs within a specified time basis.

Consequence of failure: Effect of a failure on people, environment, assets, production, or reputation.

Risk-based inspection: Method for prioritizing inspection according to failure risk.

Damage mechanism: Physical or chemical process that causes degradation.

Loss of containment: Unintended release of a process fluid from its containment boundary.

Corrosion rate: Rate at which material thickness is lost, commonly expressed in mm/year.

Remaining life: Estimated time before a component reaches a defined limiting condition.

Inspection effectiveness: Capability of an inspection method to detect relevant flaws.

Risk matrix: Table combining likelihood and consequence categories.

Mechanical integrity: Assurance that equipment remains fit for safe service.

Fitness for service: Engineering assessment of whether flawed equipment can continue operating safely.

Functional safety: Ability of a system to achieve or maintain a safe state in response to hazardous conditions.

Safety-instrumented function: Defined sensor, logic, and final-element action intended to reduce risk.

Proof test: Test intended to reveal dangerous failures not detected during normal operation.

Independent protection layer: Safeguard sufficiently independent to reduce the frequency of a hazardous scenario.

Management of change: Formal control of technical, organizational, or operational changes.

Common-cause failure: Failure of multiple safeguards due to a shared cause.

Competent person: Individual with suitable knowledge, training, experience, and authority for the assigned task.

Integrity management: Life-cycle system for preserving asset containment, function, and compliance.

Review Questions

Short Answer Questions

1. Define risk and identify the two primary components used in its basic expression.
2. Why must an inspection plan be linked to specific damage mechanisms?
3. State two limitations of a conventional risk matrix.
4. Distinguish mechanical integrity from functional safety.
5. What is the purpose of management of change in an integrity program?

Long Answer Questions

1. Explain the stages of a risk-based inspection study from scope definition through feedback of inspection results.
2. Discuss how consequence analysis should account for people, environment, escalation, and emergency response.
3. Compare general corrosion, erosion-corrosion, fatigue cracking, and stress-corrosion cracking in terms of conditions and inspection methods.
4. Explain why independence is important when evaluating layers of protection.
5. Discuss the ethical and governance responsibilities of an engineer approving an inspection interval.

Analytical / Application Questions

1. A pipe measures 9.6 mm in 2022 and 9.0 mm in 2025. Its limiting thickness is 8.1 mm. Calculate the average thickness-loss rate and screening estimate of remaining life, then identify at least three reasons why the estimate must not be used without engineering review.
2. Construct a qualitative risk assessment for a pressurized toxic-gas vessel with possible localized corrosion. Identify the failure scenario, probability factors, consequence factors, safeguards, inspection methods, and actions for high risk.
3. An automatic high-pressure shutdown and a relief valve share the same pressure transmitter impulse line. Assess whether they should be treated as fully independent protection layers and explain what additional information is required.

Multiple Choice Questions with Answers

Question 1

Which expression represents the basic risk relationship used in this chapter?

A. Risk = probability × consequence

B. Risk = pressure × temperature

C. Risk = thickness ÷ corrosion rate

D. Risk = reliability + availability

Correct Answer: A. Risk = probability × consequence

Question 2

A wall decreases from 12.4 mm to 11.8 mm over three years. What is the average thickness-loss rate?

A. 0.02 mm/year

B. 0.20 mm/year

C. 1.80 mm/year

D. 6.00 mm/year

Correct Answer: B. 0.20 mm/year

Question 3

Which inspection method is most directly suited to detecting surface-breaking cracks in a suitable conductive material?

A. Magnetic-particle examination

B. Flow measurement

C. Thermography only

D. Pressure relief testing

Correct Answer: A. Magnetic-particle examination

Question 4

Why is a risk-matrix score generally considered ordinal?

A. Its numerical values necessarily equal probabilities

B. A score of 12 is always twice a score of 6

C. The categories rank risk but do not establish proportional magnitude

D. It can only be used for financial consequences

Correct Answer: C. The categories rank risk but do not establish proportional magnitude

Question 5

What is the principal purpose of a proof test in functional safety?

A. To increase process throughput

B. To reveal dangerous failures not detected during normal operation

C. To measure corrosion rate

D. To replace all preventive maintenance

Correct Answer: B. To reveal dangerous failures not detected during normal operation

Question 6

Which condition most directly challenges the assumption of a constant failure rate in the exponential reliability model?

A. A clearly defined time interval

B. A stable operating population

C. Wear-out degradation with increasing hazard

D. Consistent units of time

Correct Answer: C. Wear-out degradation with increasing hazard

Question 7

A vessel has current thickness 11.8 mm, limiting thickness 10.5 mm, and corrosion rate 0.20 mm/year. What is the screening remaining life?

A. 0.26 years

B. 1.30 years

C. 6.50 years

D. 22.30 years

Correct Answer: C. 6.50 years

Question 8

Which statement best describes mechanical integrity?

A. It concerns only software logic

B. It assures equipment remains fit for safe service through its life cycle

C. It eliminates the need for statutory inspections

D. It is identical to consequence analysis

Correct Answer: B. It assures equipment remains fit for safe service through its life cycle

Question 9

Two safeguards share the same power supply and impulse line. What is the principal concern?

A. Their independence may be overstated because of common-cause failure

B. Their consequences must be zero

C. Their inspection intervals become irrelevant

D. Their probability of failure is automatically independent

Correct Answer: A. Their independence may be overstated because of common-cause failure

Question 10

Which action is most appropriate when a process change alters temperature and chemistry beyond the original design basis?

A. Continue the original RBI plan without review

B. Delete previous inspection records

C. Initiate management of change and reassess degradation and risk

D. Reduce inspection coverage to avoid bias

Correct Answer: C. Initiate management of change and reassess degradation and risk