Microsoft Word - 35fakandu.docx CHEMICAL ENGINEERING TRANSACTIONS VOL. 53, 2016 A publication of The Italian Association of Chemical Engineering Online at www.aidic.it/cet Guest Editors: Valerio Cozzani, Eddy De Rademaeker, Davide Manca Copyright © 2016, AIDIC Servizi S.r.l., ISBN 978-88-95608-44-0; ISSN 2283-9216 Risk due to the Ageing of Equipment: Assessment and Management Paolo Bragatto*a, Maria Francesca Milazzob a INAIL, Dipartimento Innovazioni Tecnologiche, Centro Ricerca, via Fontana Candida, 1, 00040, Monteporzio, Italy b Dipartimento di Ingegneria (Dip.Inge.), University of Messina, contrada Di Dio, 98166, Messina, Italy p.bragatto@inail.it Within the current risk assessment practice, generic failure frequencies are used although it is recognised that data related to certain equipment types (including pressurised equipment) are not updated. Public databases do not take into account the ageing of materials, the newer quality systems and the different maintenance management. Failure frequencies are used to develop fault trees, thus lack in such data may lead to questionable decisions regarding facilities’ licensing, land use and emergency planning. To overcome this limit there are two complementary ways: 1) to collect new data on equipment failures, 2) to introduce corrective parameters, which balance the uncertainties induced by the use of general frequencies. The Directive Seveso III, in force since July 2015, explicitly calls for the introduction of a safe ageing management of critical facilities. To deal with this issue, managers currently adopt Risk-Based Inspection (RBI) standards (ASME, API or RIMAP), based on the use of some compensatory factors, which are subjectively defined by managers. The new Directive imposes to demonstrate the appropriateness of the choices to the Control Authorities. This paper aims at verifying if the RBI procedures comply with some essential requirements of the Directive Seveso III; then guidance will be provided to auditors on how to verify the management of risk arising from plants’ ageing in chemical industry. 1. Introduction The term ageing does not refer to how old equipment is, but it is related to its condition and how it is changing over time (Wintle et al. 2006). Ageing of a component is revealed as some form of material deterioration and damage, usually associated with time in service, and causes an increasing probability of failure over the lifetime. Ageing increases the risk of loss of containment and other failures and it has been shown to be an important factor of incidents and accidents (Horrocks et al. 2010; De Rademaeker et al., 2014). The Directive Seveso III, about Major Accident prevention (EU Council, 2012), explicitly calls for the introduction of a safe ageing management of critical facilities, which are subject to various corrosion and fatigue processes. This directive forces to an integrated view of both the issues “risk assessment” and “ageing management”, which were completely separated in the previous legislations. To deal with this issue, plant operators may adopt different approaches, including Life Cycle Management (CEN 2013) and Asset Management (ISO 2015). In the process industry, the most popular approach is the Risk-Based Inspection (RBI), as defined by standard codes, including API 580/581 Risk Based Inspection (API 2009; API 2008) and RIMAP (CEN 2008). The RBI, as well as other methods, was born to optimise inspections’ costs by comparing them with safety levels. Thus an effort is always necessary to adapt this approach to the ageing management at Seveso establishments. In this frame, only a few Competent Authorities have published general guidelines for ageing management (Wintle et al. 2006, INERIS, 2009). These follow the same approach proposed by RBI and do not supersede the use of standard codes. RBI codes introduce some compensatory factors in the computation process of the likelihood of failure (LOF), in order to account for the plants’ specificity, complexity, damage mechanisms, management system, etc. The use of such factors is subjectively made by plant operators, but the new Directive imposes to demonstrate to Control Authorities the adequateness of the choices. The need to share with Authorities some aspects of risk management increases the need to reduce the uncertainties of the RBI models. The first uncertainty comes from the inadequate knowledge about the DOI: 10.3303/CET1653043 Please cite this article as: Bragatto P., Milazzo M.F., 2016, Risk due to the ageing of equipment: assessment and management, Chemical Engineering Transactions, 53, 253-258 DOI: 10.3303/CET1653043 253 failure modes and related probabilities; further uncertainties are added at any step of the application of the method, as discussed by many scholars (Milazzo and Aven, 2012; Flage and Aven, 2009). The possible deterioration mechanisms may include erosion, environmental corrosion, internal corrosion, mechanical fatigue, thermal fatigue, etc. At least 63 mechanisms have to be taken into account in a typical oil refinery (API, 2011). In most case the deterioration process is a slow mechanism, thus the failure probability appears constant for a sufficiently long time, before significantly increasing, due to the inexorable progress of the various forms of deterioration. The assumption of no-dependence of fault probability vs. equipment age, based on the well known “bath-tube curve”, falls close to the end of equipment life (Figure 1). Therefore, when assessing risk, some top events, which were not considered credible because having a frequency < 10-6 event/year, could become credible as failure probabilities are higher due to ageing. Figure 1: Dependence of failure probability vs. time (bath-tube curve). With respect to available procedures in the literature (e.g. 580/81 API, ASME, ISPESL etc.), Section 2 of this paper aims at verifying: (i) the consistency between the assessment of risk made in Safety Reports (according the Seveso III Directive) and that carried out through the RBI; (ii) the compatibility with the standards in force in the field of risk management (ISO 31000 and ISO 55000); (iii) the consistency between the results of inspections imposed by the Directive Seveso III and those planned by the RBI. Results are essential in Section 3 to define a method checking ageing management procedures, which is suitable to be included in the protocol of the inspection visits, required by the newer Seveso Directive. It is out of the scope of this paper to discuss which standard is the most suitable for the ageing management. The industrial manager is free to choose amongst those available, whereas it is important for Control Authorities to be able to verify the effectiveness of the ageing management. 2. Methodology A literature review allowed examining the characteristics of available procedures for ageing assessment and identifying all the factors that contribute to phenomenon. As discussed above, approaches used in chemical industry to manage the risk associated with the equipment deterioration recall the RBI scheme. Within this scheme, the inspection schedule (time and techniques) are determined on the basis of a detailed knowledge of deterioration mechanisms exhibited by the equipment. The maintenance program can be defined according to similar criteria to those used by Control Authorities. Theoretical deterioration models provide theoretical predictions of the equipment residual life by using some measured inputs; the time and subsequent inspection types are selected in order to maintain the risk level (defined as the combination of failure probability and severity of consequence) within the limits. Before Seveso III Directive, the management of the equipment integrity was performed with a certain freedom, limited by obligations of periodical checks, as prescribed by legislations for a few critical equipment types (e.g. pressured vessels and piping). The new legislation increases checking and testing duties, in order to control the hazards due to ageing and corrosion. Thus the integrity management is closely linked to the penal liability due to the occurrence of major accidents. As said above, several factors, used within a RBI approach, 254 inevitably introduce uncertainties; therefore, it is essential to ensure that the propagation of such uncertainties is controlled and planned controlling activities are adequate to maintain the risk below the acceptability levels. RBI approach should be named “knowledge based inspection” approach, as the real strength and the major challenge is to know in detail all potential degradation mechanism in a plant and consequently make all the measurements necessary to control the status of all items. RBI is challenging the safety research because for many new materials, introduced in recent decades, the long term behaviour is not well known. The potential of open data to overcome knowledge’s weaknesses in applying RBI was discussed recently by Bragatto et al. (2015). Whereas the application of new inspection technologies, more versatile and less invasive, is a further open issue of RBI research (e.g. Catterson et al., 2013). Thus there are currently two research lines, the first aims at improving the theoretical models and second points at data acquisition. It must be pointed that API 580/581 obviously do not take into account the “Seveso legislation” as those are American standards, whereas the European document CEN CWA 15740 (2008) and the corresponding RIMAP “Risk-Based Inspection and Maintenance Procedures for European Industry” account for this normative. One of the main goals of this latter standard has been to make more cost-efficient inspection and maintenance programs while, at the same time, safety, health, and environmental performance is maintained or improved. They differ in two main aspects: (i) scope (no-process plants are included) and (ii) compatibility with the EU regulations and ISO standards (9000, 14000, 31000, 55000). In this frame the Italian UNI standardisation body has recently published a technical specification (UNI 11325) integrating RBI with the legal obligations, with respect to both verification of PED equipment and Seveso plants. The new code is contained in a set of publication about pressure equipment lifecycle management. 3. Approach to ageing assessment and management at Seveso plants Ageing management methods implies: (i) Identification of components and degradation to be organised into a hierarchy; (ii) Conditions assessment, depending on the state of the structure and the potential failure modes (probability and consequences); (iii) Decisions related to actions (inspection or repairs) for ageing management. Given the conservativeness of failure frequencies, some compensation/penalty factors are introduced to account for specific aspects such as the process, equipment, fluid characteristics, organisation (including management system) and performed inspection type (Figure 2). Figure 2. Relationship between compensation/penalty factors and safe conditions (upper circles refer to accelerating factors, lower ones give controlling factors). 255 In Figure 2, inspections refer to the verification of the mechanical integrity of the systems. The inspection aspect is particularly relevant because the use of more accurate and reliable techniques is rewarded as these reduce the uncertainty related to the actual condition of materials at the time of the last performed inspection. The factor related to inspection effectiveness and specific deterioration mechanisms (e.g. high temperature/pressures, corrosive fluids, chemical agents, etc.) are well defined in part 2 of API 581 (2008) at least for 21 deterioration types of process industry. API 581 is specific for the petroleum sector, thus equipment and deterioration mechanisms are those related to the petrochemical industry. Deterioration mechanisms not explicitly covered by the standard need to be modelled on the basis of available knowledge. Two factors, which do not refer to directly measurable entities, are related to the complexity and the management system; these are qualitatively estimated. The management system factor depends on the results of independent audits carried out on the management system. The general fault frequencies are subject to a high level of uncertainty and usually tend to be conservative. Rating levels of uncertainty introduced for the various compensation/penalty factors must be used in RBI procedures. Thus in this work four categories are defined: 1 = low; 2 = medium; 3 = medium-high; 4 = high. These levels are marked by either a positive or a negative sign, depending on their effects on the safe conditions, i.e. if they are accelerating or controlling ageing phenomena. Table 1: Compensation/penalty factors Factor Description Range Effect Score (f) Age In-service time Ratio “age/designed age” Ratio “in-service time/designed in service time” 0 ÷ 150% + ageing (1)  f ≤ 90% (2)  90 < f ≤ 100 % (3)  100 < f ≤ 120 % (4)  f > 120% Shut-downs Ratio “no. unexpected shutdowns/no. total shutdowns” 0 ÷ 0.7 + ageing (1)  f ≤ 0.1 (2)  0.1 < f ≤ 0.25 (3)  0.25 < f ≤ 0.5 (4) f > 0.60 Mechanical failures Failure rate 0÷1 + ageing (1)  f ≤ 10-3 (2)  10-3 < f ≤ 0.5·10-3 (3)  0.5·10-3 < f ≤ 10-2 (4)  f > 10-2 Identified damages Related to the percentage of damaged components (detected by inspections) and the entity of the defects. see Table 2 + ageing see Table 2 Deterioration mechanisms Related to the damage’s detection capability, the damage propagation velocity, the level of variability and knowledge of the phenomenon see Table 3 + ageing see Table 3 Management system It could be compliant with the normative, integrated (partially or totally) with the inspection and maintenance management systems or a risk-based asset management system 1÷5 - ageing (1)  compliant (2)  partial integrated (3)  total integrated (4)  risk-based Mechanical integrity’s inspections Related to the inspections’ planning and the results of functional tests and of systems’ integrity tests see Table 4 - ageing see Table 4 Audit Related to the audit frequency and its results see Table 5 - ageing see Table 5 Ageing accelerating factors (+ ageing) include: - age and in-service time: These factors have be considered one the alternative of the other one as they refer to the duration of plant operations, thus the real age of the system should be subtracted by the shut-down periods. The factors are respectively defined as the ratio “age/designed age” and “in-service time/designed in-service time”. For each component, the most representative parameter must be 256 distinguished (i.e. for refineries reference may be made to age, whereas for boilers the operating hours must be accounted for). A range of variability 0÷150% must be assumed. - Shut-downs: This factor is the ratio “no. unexpected shutdowns/no. total shutdowns”. It is evident that numerous shut-downs accelerate the ageing of the installation, on the basis of the experience if the number of unexpected stops is more than 2/3 of the total it can reasonably be assumed that the system is out of control. The range 0÷0.7 can be assumed. - Accidents/incidents and anomalies (failures): This factor includes only mechanical failures and is quantitatively given by the failure rate. The range of variability is 0÷1. - Identified damages: This factor refers to the damage of components, which are detected by inspections and do not compromise their function. It is related to the percentage of damaged components and the entity of the defects, these sub-factors contribute in line as indicate in Table 2. Defects are classified as light and severe, respectively, depending on if they comprise the stability of operations or they need to be repaired. - Deterioration mechanisms: This factor is related to the damage’s detection capability of the main mechanisms (by inspection), the damage propagation velocity, the level of variability and knowledge of the phenomenon as given in Table 3. The level of variability of the mechanism refers about the dependence on variables that can be controlled (e.g. operating parameters, chemical composition of fluid streams, etc.) or not (e.g. external pollution, contamination of inputs, etc.). The level of knowledge of the mechanism relates to its comprehension and, thus, the availability of technique to achieve its control. The contribution of each sub-factor of Table 3 is not in line, this time the final factor is given by the product of each parameter. Table 2: Score for “Identified damages” Score Damaged components (1÷10%) Light defects (0÷100%) Severe defects (0÷100%) 1 1% 100% 0% 2 3% 75% 25% 3 5% 50% 50% 4 7% 25% 75% Table 3: Score for main “Deterioration mechanisms” Score Damage’s detection capability Damage propagation Level of variability (0÷100%) Level of knowledge (0÷100%) 1 Visual examination 40 years 0% 0% 2 Possible monitoring 15 years 30% 30% 3 Simple instruments 5 years 60% 60% 4 Complex instruments 1 year 100% 100% Ageing controlling factors (- ageing) include: - General management system: This factor relates to the structure of the general management system; it could be compliant with the normative, integrated (partially or totally) with the inspection and maintenance management systems or a risk-based asset management system (not certified but under an external control). The score for this factor is assigned by accounting for the level of information included. - Mechanical integrity’s inspections: This factor is related to the inspections’ planning and the results of tests verifying the functionality and the integrity of the system (as given in Table 4). Inspections can be planned as imposed by legislations (minimum number), according to good practices or guidelines and, finally according to a risk-based approach. Results of tests verifying the functionality and the integrity of the system respectively provide the percentage of components without light damages, (i.e. for which the operability is not compromised) and percentage of components whose integrity is compromised. The contribution of each sub-factor is not in line and the final factor is given by the product of each parameter. - Audits: This factor refers to the conduction of audits; it includes an assessment of their frequency and of their results (non-compliance detected using a check-list), as shown in Table 5. The frequency of audits could be compliant with the normative (an internal annual audit and an external each three years), planned at the signal of anomalies or their increased and under an external auditor. The contribution of each sub-factor of Table 5 is not in line, the final factor is the product of them. 257 Table 4: Score for “Mechanical integrity’s inspections” Score Inspection planning Results of functionality tests (% not damaged components) Results of integrity tests (% not damaged components) 1 Obligations 96% 98% 2 Good practices 97% 98.5% 3 Guidelines 98% 99% 4 Risk-based 99% 99.5% Table 5: Score for “Audits” Score Audit frequency Results (No-compliances 0÷5%) [%] 1 Obligations 5% 2 Signal of anomalies 3% 3 Twice per year 2% 4 An external audit per year 1% 4. Conclusions This paper, through a careful examination of the literature related to the assessment and management of the ageing, allowed the identification of the factors that contribute to the ageing of plants; these act either accelerating or controlling the phenomenon. The qualitative definition of the uncertainties associated with these factors, by means of a classification in four levels and through the experience gained in the chemical industry, allowed deriving a useful guideline to be adopted by the Control Authorities in order to verify whether the plant aging is operated safely and according to the latest Directive Seveso III. Reference API 580, 2009, Risk Based Inspection, Washington, D.C., US. API 581, 2008, Risk Based Inspection, Base Resource Document, Washington, D.C., US. API, 2011, Damage Mechanisms Affecting Fixed Equipment in the Refining Industry, Washington D.C., US. Bragatto P., Agnello P., Ansaldi S., Artenio E., Delle Site C., 2015, Reviving knowledge on equipment failures and improving risk management at industrial sites, J Appl. Eng. Sci. 13 (4), 271-276. Bragatto P., Della Site C., Faragnoli A., 2012, Opportunities and threats of risk based inspections: The new italian legislation on pressure equipment inspection, Chemical Engineering Transactions 26, 177-182. Catterson V.M., Costello J.J.A., West G.M., McArthur S.D.J., Wallace C.J., 2013, Increasing the Adoption of Prognostic Systems for Health Management in the Power Industry, Chemical Engineering Transactions 33, 271-276. CEN/CWA16633, 2013, Ageing behavior of Structural Components with regard to Integrated Lifetime Assessment and subsequent Asset Management of Constructed Facilities, Brussel, BE. CEN/CWA15740, 2008, Risk-based inspection & maintenance procedures for European industry, Brussel, BE. De Rademaeker E., Suter G., Pasman H., Fabiano B., 2014, A review of the past, present and future of the European loss prevention and safety promotion in the process industries, Process Safe. Environ. 92(4), 280-291. EU Council, 2012, Directive 2012/18/EU on the control of major-accident hazards involving dangerous substances, Official Journal of the European Union, L197/1-37. Flage R., Aven T., 2009, Expressing and communicating uncertainty in relation to quantitative risk analysis (QRA), Reliab. Risk Anal. Theor. Appl. 2(13), 9-18. Horrocks P., Mansfield D., Thomson J., Parkerv K., Winter P., 2010, Plant Ageing Study Phase 1 Report., Health and Safety Executive Report no. RR823. INERIS, 2009, Rapport final - Benchmark international sur les réglementations et pratiques de maîtrise du vieillissement des installations industrielles, Report no. DRA-09-102957-07985C (in French). ISO 55001, 2014, Asset management - Management systems - Requirements, Geneva, CH. Milazzo M.F., Aven, T., 2012, An extended risk assessment approach for chemical plants applied to a study related to pipe ruptures, Reliab. Eng. Syst. Safe. 99, 183-192. UNI/TS 11325-8, 2013, Planning of maintenance of pressure equipment through methodologies based on risk assessment (RBI), Milano, IT (in Italian). Wintle J., Moore P., Henry N., Smalley S., Amphlett G., 2006, Plant ageing. Management of equipment containing hazardous fluids or pressure, Health and Safety Executive Report no. RR509. 258