See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/290581514

Inspections on safety management systems and integrity controls at

"Seveso" facilities

Article · January 2006

CITATIONS READS

2 290

4 authors, including:

Paolo Bragatto
INAIL Istituto Nazionale per l'Assicurazione contro gli Infortuni sul Lavoro
133 PUBLICATIONS   433 CITATIONS   

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

valanghe View project

Saf€ra View project

All content following this page was uploaded by Paolo Bragatto on 15 March 2017.

The user has requested enhancement of the downloaded file.

 Safety and Reliability for Managing Risk – Guedes Soares & Zio (eds)
© 2006 Taylor & Francis Group, London, ISBN 0-415-41620-5

Inspections on safety management systems and integrity controls at

“Seveso” facilities

P. Bragatto & P. Pittiglio

ISPESL – DIPIA Centro Ricerche Monteporzio, Roma, Italia

D. Geraci & E. Pichini

ISPESL – DTS Roma Italia

ABSTRACT: Inspections organized by Italian Competent Authorities to comply with art.18 of Seveso II
Directive are very effective for a systematic understanding of the organisational and managerial systems being
employed at the establishment. The examination of technical systems is instead a weak point of Seveso inspec-
tions. At a Seveso process plant there is a high number of apparatuses, subjected to planned integrity controls,
which in most cases are ruled by statutory regulations. In practical experience Seveso inspections program is
definitely separated from mechanical integrity inspections program. The paper presents a tool that could be
shared between authorities and operators, aimed to reduce the gap between integrity inspections, required by
safety technical rules, and inspections required by Seveso II Directive.

1 INTRODUCTION are considered just in an implicit and indirect way.

Council Directive 96/82/EC (Seveso II) on the pre-
vention of major accidents involving dangerous sub-
stances includes a requirement for the Competent
Authorities to organise a system of ongoing inspections
to examine whether plant operators are complying with
their duties under the Directive. The requirements for
“Inspections” under the responsibility of the Compe-
tent Authorities had been strongly reinforced in the
art.18 of “Seveso II” Directive, in recognition that
an effective inspection regime in Member States is
necessary to achieve the objectives of the Directive.
The basic purpose of inspections is to periodically
check whether establishments are being operated in the
manner envisaged by the Directive, in other words if
a high level of protection for man and environment
is being achieved and it is capable of being main-
tained. Inspections must be sufficient for a planned
and systematic examination of the systems being
employed at the establishment, whether of a technical,
organisational or managerial nature.
In the implementation of the Seveso II Directive
in the Italian legislation, inspections program focuses
just on the safety management system (SMS). The
main advantage of this choice is the possibility to
circumscribe and to define exactly the activity of
inspectors, excluding all the technical aspects, which
In this way Competent Authorities have been able
to carry out, on all establishments, the first inspec-
tions round, which otherwise would have required
enormous resources. Furthermore, small sized enter-
prises, which, differently from major firms, had not
implemented a SMS, have been stimulated to organize
themselves in this direction. Technical systems may be
anyway inspected during the proceeding phase, aimed
to the safety report approval, which is scheduled every
five years (Wood 2005, Basso et al. 2004).
In a chemical process plant, hazardous compounds
are contained in a high number of pressure vessels. By
definition, all pressure vessels are designed for mat-
ter and energy containment, but in the case of Seveso
establishment, they have also the duty to contain haz-
ardous materials. In any case, pressure equipment
are subjected to planned mechanical integrity (MI)
controls, ruled by statutory regulations and aimed,
basically, to prevent accidents of mechanical or ther-
mal nature. In the case of a Seveso establishment,
MI programs prevent also fires, explosions and toxic
releases, which could happen for a loss of hazardous
materials (API510 2000, Higgs et al. 2004).
Concerning to pressure systems – that must be
manufactured in accordance to the essential safety
requirements established by the Pressure Equipment
Directive (PED) – Italian legislation obliges an initial

1163
control of the equipment to assure its well and safe
installation; this control can be performed and certi-
fied by the owner or by a Notified Body according
to the equipment and its level of danger. Following
inspections are performed by Competent Authorities
with modalities and time intervals that depend on the
type of the equipment too. For example: pressure ves-
sels built in III or IV PED categories (PED categories
are defined in §4.1) must be subjected to a functional-
ity test every two years, and to an integrity test every
ten years. On the contrary, industrial pipelines built in
I, II or III PED categories must be subjected to a func-
tionality test every five years, and to an integrity test
every ten years.
Either the first inspection of the equipment as
installed or the following inspections to assure the
maintenance of safety are established by the Italian
decree DM 329/04.
2 PLANT OPERATION AND SAFETY
MANAGEMENT SYSTEM
The SMS is a “super structure”, which covers “the
real” operation system of the establishment. The “real
system” is very complex, as well very flexible and
adaptive. Its documentation is confidential and may be
implicit or incomplete. It is completely different from
one establishment to the other. In industrial establish-
ments, this system drives all operations. It has many
aims: to maximize product amount and quality, to min-
imize resources consumption, to minimize wastes, to
reduce costs and to assure asset integrity. The system
is not driven by statutory rules or by standard codes
and it is not subjected to external controls.
Contrary of the operation system, the SMS is a rela-
tively simple, completely documented and transparent
to external parties. It has definitely only one goal:
to reduce major accident risks. It is relatively rigid
and well defined by standard national codes, such as
BS8800 in UK or UNI10616 in Italy. SMS is manda-
tory in Seveso establishments and it is periodically
inspected. In many EU countries Seveso Competent
Authorities adopted special checklists, analogous to
those introduced by the ISO 14000 standard code.
SMS addresses the following elements: organisa-
tion and personnel, identification and evaluation of
major hazards, operational control, management of
change, planning for emergencies, monitoring perfor-
mances, audits and reviews.
SMS should be linked to real operation systems,
but often SMS becomes only a formal system. SMS
inspector should detect major discrepancies between
formal safety management system and real operation
management system. Anyway SMS inspections cannot
become a complete technical audit of the entire estab-
lishment, as too many resources should be required.
1164
According to a current opinion, Seveso inspections
program has not to double or substitute techni-
cal inspection programs, which had been providing
adequate safety and reliability for long years (Kuusisto
2000).
3 SAFETY MANAGEMENT SYSTEM
AN MECHANICAL INTEGRITY
INSPECTIONS
3.1 Mechanical integrity inspections at Seveso
establishments
Typical Seveso establishments, like refineries and
chemical process plants, have thousands of compo-
nents like pipelines, columns, heat exchangers, steam
vessels, etc., which operate under significant pressure
and temperature with corrosive chemicals. Pressure
and temperature, combined with the corrosive nature
of the fluids inside the systems and the exposure to
the weather on the outside, will degrade the quality of
the construction material of the items. The most com-
mon degradation mechanisms are internal and external
thinning, stress corrosion cracking, brittle fracture and
fatigue.
MI inspections on equipment are aimed to pre-
vent equipment failure, which could lead to major
accidents.
Poor mechanical conditions are still the causes of
many misses and accidents in process plant. For this
reason, statutory inspections under Safety and Health
legislation have long been a requirement for boilers,
pressure systems and other safety critical equipment.
Human and economic resources spent by operators and
public bodies to perform MI controls are much higher
than resources for SMS inspections.
Many techniques are used in MI inspections, start-
ing from visual ones, whose interpretation is immedi-
ate, up to the more sophisticated modern methods of
analysis such as infrared imaging.
Never forgetting that the eyes (and the ears) of a
skill operator are the most sensible detectors, a well
done maintenance program will always include peri-
odic visual inspections: by means of check lists, the
upkeeper will sign all the irregularities he will note in
the equipment or in the devices, in their aspect such as
in their working noise.
Other analyses that can be performed continuously
are the vibration recording and the tribology tests: both
the methods allow the integrity control of elements
such as bearings, shafts and stirrers. If the track of the
vibrations recorded during the normal activity presents
irregularities, or if the lubrication oil presents particles
over an extent (for their number, or dimension, or type)
it could means that the element is going to failure. Also
a crack in a rotor or a wear in a bearing housing may
be detected from their beginning through vibration and
tribology analysis.
During the planned maintenance stops, the most
common pressure equipment MI inspection tech-
niques are ultrasonic tests to verify the integrity of
vessels (to reveal corrosion zones or exfoliations) and
X-rays imaging to see cracks or other defects in the
welded joints. Also pneumatic tests with bubbling
solutions to reveal leaks from joins or to check wet
seals can be performed.
In the last years also the infrared imaging is spread-
ing as an easy and fast technique for MI inspection:
is well-known that a body with temperature above 0
Kelvin gives out heat and radiations in the infrared
spectrum. Therefore, to look at a surface through a sys-
tem able to see the infrared emissions means to have the
temperature distribution on that surface. But the distri-
bution of the temperature on a surface depends on the
temperature inside and from heat conduction parame-
ters such as the thermal diffusivity and the thickness
of the crossed layer. With these assumptions it is easy
to understand that the thermal (infrared) image of a
shell will reveal the point where the shell is thinner or
where scales are growing inside.
Extra inspections (non statutory) may be decided
in order to increase safety levels and to prolong ser-
vice time for pressure equipment, as well as to comply
with some voluntary codes. Public bodies often per-
form these controls, as well as independent and private
bodies authorized by Competent Authorities. Records
of all obliged activities are kept, but the management of
such record is not systematic. Furthermore MI controls
programs, as required by present legislation, consider
just the classification of each single appliance and
do not mind whether it is operated inside a Seveso
establishment.
3.2 The gap between SMS inspections and
MI inspections
In practice SMS inspections and MI inspections are
absolutely independent each other and no informa-
tion is exchanged between SMS and MI inspectors.
Application of MI statutory inspection programs to
Seveso establishment is quite inflexible, as inspection
frequency depends basically on equipment features
and it does not consider explicitly major accidents
hazard. Furthermore operators could exploit better MI
results for major accident prevention purpose, to mon-
itor plant conditions and to reconsider continuously
risk. Otherwise present SMS inspections are not able
to understand general components mechanical con-
ditions, which could lead to increase major accident
likelihood.
A wide “grey area” in real establishment operation
is covered neither by MI inspections nor SMS inspec-
tions. In establishments where risk based inspection
1165
(RBI) methodology has been adopted, mechanical
integrity controls are managed in a smarter way.
According RBI method, inspection frequency should
not depend on the component typology, but on the risk
score, based on initial risk analysis and on previous
inspections results (API580 2003). Anyway RBI is a
quite sophisticated method and it is adopted just in a
few major plants. Furthermore RBI method is volun-
tary at all and does not cover statutory inspections.
So a Seveso inspector visiting a typical Italian pro-
cess plant, usually cannot thrust in a MI inspections
program implemented according API 580, but he is
absolutely sure to find a good series of MI inspections
performed on a number of components, as required by
laws and regulations.
4 HANDLING OF PRESSURE EQUIPMENT
INSPECTION PROGRAM AT A SEVESO
FACILITY
4.1 Statutory inspections on pressure equipment
The Pressure Systems Regulations have been in force
in Italy for long years. They were aimed to prevent
serious injury from the hazard of stored energy as a
result of the failure of a pressure system or one of its
component parts and do not consider the hazardous
properties of the system contents released following
failure.
In order to remove barriers for pressure equip-
ment trading, EU commission published the Directive
97/23/CE on Pressure Equipment (PED directive).
Italian legislation implemented this Directive, on
February 25th 2000 by the Decree n◦ 93. The PED leg-
islation defines requirements for the design, the man-
ufacture and the conformity assessment of pressure
equipment and assemblies of pressure equipment with
a maximum allowable pressure greater than 0.5 bar.
In the framework of PED directive implementation,
the Ministry of Productive Activities on December 1st
2004 published the Decree n◦ 329, which fixed duties
and obligation on pressure equipment as defined by
PED directive during their life and operation.
In the past legislation, equipment classification was
based pressure per volume product. No fluid features
were considered, but corrosiveness. New PED leg-
islation resumes equipment classification based on
pressure per volume product, but tells non-hazardous
fluids from hazardous ones: more specifically, the
PED differentiates between two groups of fluids
– Group 1: dangerous fluids (toxic, flammable,
explosive)
– Group 2: all other fluids
PED legislation assigns “hazard” categories to prod-
ucts: four categories are defined (lowest is category
I, highest is category IV), differentiated by the
Table 1. Periodic inspections frequency for pressure equipments.
Pressure equipment
Equipment containing group 1 fluids
III or IV PED category equipment, all PED category vessels
containing unstable gas, furnaces for chemical industries
and similar, generators and vessels for superheated liquids
other than water
I or II PED category vessels
I, II or III ED category pipelines for gas, vapours or
superheated liquids
I, II or III PED category pipelines for liquids
I, II or III PED categoryvessels for liquids
Equipment containing group 2 fluids
III or IV PED category equipments containing pressured,
liquefied or dissolved gas, or containing vapours other
then water vapour; all PED category water vapour and
superheated water vapour vessels
I or II PED category equipment containing pressured,
liquefied or dissolved gas, or containing vapours other
then water vapour
Water vapour generators
III PED category pipelines for gas, vapours and superheated
liquids
ranges of Pressure × Volume product. Equipment
below category I comes under SEP (Sound Engi-
neering Practice) and is not subject to conformity
assessment.
Therefore risk is measured in terms of the amount of
stored energy (P × V product; larger is P × V, higher
is the risk category) and the hazard represented by
the contained fluid. Of course, higher control frequen-
cies will be require for equipments that contain fluids
belonging the Group 1 (hazardous fluids), but it is not
an aim for the PED: the PED exclusively concerns the
equipment construction and does not define inspec-
tions periodicity, which instead are fixed by the Italian
Decree DM 329/04.
Table 1 shows the types and the frequencies of the
inspections as fixed by the Italian Decree DM 329/04.
But the control of toxic, flammable or explosive
fluids, where they may create further major accident
hazard independently from the energy stored by the
equipment, is nor a matter of PED legislation nor a
matter of the Italian Decree 329/04, as the Seveso
legislation deals with such issues.
1166
Inspection type and frequency
- every 2 years: operation inspection
- every 10 years: integrity inspection
- every 4 years: operation inspection
- every 10 years: integrity inspection
- every 5 years: operation inspection
- every 10 years: integrity inspection
- every 5 years: operation inspection
- every 10 years: integrity inspection
- every 5 years: operation inspection
- every 10 years: integrity inspection
- every 3 years: operation inspection
- every 10 years: integrity inspection
- every 4 years: operation inspection
- every 10 years: integrity inspection
- every 2 years: operation and internal inspection
- every 10 years: integrity inspection
- if TS ? 350◦ C, every 10 years: integrity inspection
- if TS >350◦ C < every 5 years: operation inspection
every 10 years: integrity inspection
4.2 MI inspection and SMS inspections
Seveso Competent Authorities should encourage a
stronger link between SMS and MI controls system.
In this way management issues and technical issues
could be integrated and harmonized, avoiding any con-
fusion in roles and responsibilities. SMS inspections
basically consider safety from management point of
view and find potential weakness in policy, in pro-
cedures, in personnel, in training and in emergency
planning, while integrity inspections consider safety
just from a technical point of view. Integrity controls
are wide, but not systematic, as performed by differ-
ent bodies at different times. Their integration in SMS
should be very useful indeed. This improvement does
not require additional costs or higher organizational
models. It allows owners to exploit integrity control
results to manage the overall safety.
SMS inspectors should evaluate the management
of integrity controls, in order to have also a general
understanding of plants physical condition.
Integration between pressure equipment inspec-
tions program and SMS inspection program could be

Figure 1. Inspection prioritization based on a Qualitative
Risk Scoring for a pressure vessel in a process plant.
the first step for a tighter integration of technical sys-
tems into the scoping of Seveso inspection program.
A system to manage MI inspections during equip-
ment lifecycle should be essential in order to put into
practice the idea of the proposed integration.
Each inspection and each test on process equip-
ment should be documented, identifying the date of
the inspection or test, the name of the person who
performed the inspection or test, the serial number or
other identification mark of the equipment on which
the inspection or test was performed, a description of
the inspection or test performed, and the results of the
inspection or test (Kahn & Mahmoud 2004, Wintle &
Kenzie 2001, Venkatasubramanian 2005).
For each pressure component, the MI inspection
management system should have a single folder con-
taining all documents that are useful to follow all
its life. At start-up time the folder should be filled
with design documents and data. After any inspec-
tion, data and documents produced by non-destructive
tests should be recorded in the archive. The system
should consider main NDT techniques, such as x-rays
for the control of the permanent splices, ultrasounds
for the control of the thickness, pneumatic tests,
visual surveying or thermal mapping, extensometric
or vibrations analyses.
For every pressure apparatus in service, operator
will have a folder, which will show its complete history,
from beginning till now. This folder may be considered
the “clinic folder” or, rather, the “equipment fitness
folder”.
4.3 The Italian case
In Italy, in the past, pressure equipment mechanical
integrity inspections were exclusive of ISPESL, the
national body that has responsibility for safety and
health at work. As ISPESL has participating Seveso
Inspection Programs too, information sharing between
MI inspector’s ad Seveso inspectors was implicit and
when it was possible, ISPESL inspectors used to play
1167
both the roles at the same establishment at different
moments. For a few years PED directive implementa-
tion in Italy has been changing this scenario, as public
and private bodies share the market of PED in ser-
vice inspections. In such a way, Seveso Inspections
in Italy are loosing also this weak link with technical
systems and an interface between physical inspections
and safety management system inspections at major
hazard accidents establishments become more urgent
in Italy. Tools aimed to implement this interface could
be useful indeed.
5 EXAMPLES OF INTEGRATION
In recent years a few powerful software have been
developed to manage MI of process plant equip-
ment; these software collect in a data base a large
amount of information about each equipment (piping,
vessels, exchangers, instrumentation, pressure safety
valves) and integrate these data, the relevant outputs
and technical decisions within the SMS. These soft-
ware systems are designed to support the full API
580 RBI methodology application. They are used at
major establishments, such as refineries and petro-
chemical plants; they are able to perform several key
functions, from risk analysis to inspection scheduling,
from inspection working flow control to data logging.
(credosoft), (dnv), (api) Most companies in Italy con-
sider these software products too sophisticated for
their needs, as well too expensive for their budget.
For demonstrating the feasibility of exploiting in an
easier way MI inspections result for SMS inspections,
we experimented a free software, developed to inte-
grate plant and component digital representations and
safety management (Bragatto et al. 2005, Ansaldi et al.
2006).
It is nicknamed PELM, from “Pressure Equip-
ment Lifecycle Management”. It helps to decide what,
where, how and when to inspect. It stores the plant
design data, the process data and the equipment history
in order to decide what and where look for potential
deterioration. It helps to establish how to look for the
damage by reviewing the damage density and variabil-
ity, inspection sample validity, sample size, detection
capability.
The frequency of inspections should conform to
statutory regulations, or more frequently if determined
to be necessary by basic risk consideration or by
operating experience.
A technical description of this software is not a goal
of this paper, anyway some features may highlighted.
Basically PELM is a database, which handles pres-
sure vessels 2D and 3D digital models, process haz-
ard study representations, inspections results records
along the plant lifetime. For the digital representa-
tion of plants and equipments, it may import digital
Figure 2. The history of the inspections on a Tube Sheet. In
the last inspection a few holes are fouled.
Figure 3. IR Thermal image of a pressure vessel. (NDT
test).
representations coming from AUTOCAD© as well as
digital images. The prototype is a “toolbox”, orga-
nized in modules for the design, start-up, and operation
phases. PELM is able to verify equipment with design
codes, to prepare inspections scheduling, consider-
ing statutory obligations and priorities based both on
experience and also on qualitative risk evaluation, if
necessary. It stores a short report of each inspection,
complete with data arrays or images. Data and images
may be retrieved from the database and compared each
other. It is possible to study inspections performed
at different times on the same equipment, inspections
performed on comparable equipments of the same age,
inspections on all components in a unit and so on.
Inspection results may be compared with project data,
verification rules, construction rules, and installation
records. A feeling of PELM use for pressure vessels is
given in figures from 1 to 4.
PELM has been tested, in order to share informa-
tion between MI inspectors and Seveso inspectors.
Reports of MI inspections are orderly stored in PELM
database and Seveso inspectors may retrieve from
PELM data, images and other document produced dur-
ing MI inspections. Seveso Inspectors have a good
1168
Figure 4. Corrosion evidence on a pressure vessel.
look of actual plant mechanical condition, by query-
ing the MI inspections database. To do this job, Seveso
inspectors should not waste too much time, as they may
retrieve every needed document from PELM database.
In such a way, Seveso inspectors shall not double the
job of MI inspectors but, anyway, they approach the
“real world”. Furthermore, by using typical database
query capabilities, at any time, inspectors should focus
different issues, according to a long-term inspection
program. For instance a first Seveso inspection con-
siders documents on heath exchangers inspections, a
second one considers reactors inspection documents,
a third one considers pipeline inspection documents
and so on.
This solution should affect very little direct Seveso
inspections costs, which are paid by establishments’
operators. Operators, anyway, should pay an indirect
cost, as they have to store all inspections data in such
a way to demonstrate all MI control activities during
SMS inspection. Furthermore operators could exploit
MI inspections database, using data for many pur-
poses, such as addressing extra inspections programs
on critical components, addressing a maintenance pro-
gram based on equipment conditions and monitoring
equipment fitness and extending equipment lifetime.
6 CONCLUSIONS
Definitely at a Seveso establishment a well-organized
database of MI controls has to be always present, in
order to share all data about integrity condition with
the Safety Management System. Major advantages of
sharing data between SMS and MI database are:
1) Statutory inspections on SMS Seveso establish-
ments could cover in a better way also technical
systems;
2) Results of MI inspections could be exploited to
drive an internal inspection policy and to improve
operation safety and reliability.
 For this purpose, some software tools could be use-
ful. Major companies use sophisticated and expensive
products, but for most establishments, much easier
and cheaper solutions are possible, as demonstrated
by PELM experiment.
REFERENCES
Ansaldi, S., Bragatto, P., Giannini, F., Monti, M. &
Pittiglio, P. 2006 A Knowledge-based Tool for Risk Pre-
vention on Pressure Equipment Computer-Aided Design
& Applications:3(1-4): 99–108.
API 510 2000 Pressure Vessel Inspection Code – Inspec-
tion, Repair,Alteration, and Rerating American Petroleum
Institute Washington DC.
API 580 2003 Risk Based Inspection American Petroleum
Institute Washington DC.
Basso, B., Carpegna, C., Dibitonto, C., Gaido, G. &
Robotto, A. 2004 Reviewing the safety management sys-
tem by incident investigation and performance indicators
J. of Loss Prevention in the Process Industry: 17(3):
225–231.
1169
Bragatto, P. Pittiglio, P. &Ansaldi, S. 2005. Knowledge Based
CAD for Pressure Vessel Stability Verification Proceeding
of SRA Europe Conference.
Higgs, P.A. Parkin, R., Jackson, M., Al-Habaibeh, A.,
Zorriassatine, F. & Coy, J. 2004 A Survey On Condition
Monitoring Systems In Industry Proceedings of ESDA
Manchester, UK.
Kahn, F. & Mahmoud, H. 2004 Risk Dased Maintenance A
new approach for Process Plant Inspection and Mainte-
nance Process Safety Progress: 23(4) 252–265.
Kuusisto, A. 2000 Safety Management Systems Audit Tools
and reliability Auditing. Publication 428 Espoo: VTT.
Venkatasubramanian, V. 2005 Prognostic and diagnostic
monitoring of complex systems for product lifecycle man-
agement: Challenges and opportunities. Computers and
Chemical Engineering: 29(6) 1253–1263.
Wintle, J.B. & Kenzie, B.W. 2001 Best practice for risk based
inspection as a part of plant integrity management HSE
Book.
Wood, M. 2005 The Mutual Joint Visit Programme on
Inspections under Seveso II: Exchanging lessons learned
on inspections best practices, Institution of Chemical
Engineers Symposium Series: 150, 977–994.
View publication stats