RRM Manual

CONFIDENTIAL September 1999
Risk and Reliability Management (RRM)

Manual
This document is for scope of work assessment only.
This document is confidential. Neither the whole nor any part of this document may be disclosed to any third party without
the prior written consent of Shell International Oil Products B.V., The Hague, the Netherlands.
The copyright of this document is vested with Shell International Oil Products B.V., The Hague, the Netherlands. All rights
reserved. Neither the whole nor any part of this document or software may be reproduced, stored in any retrieval system or
transmitted in any form or by any means (electronic, mechanical, reprographic, recording or otherwise) without the prior
written consent of the copyright owner.
SHELL INTERNATIONAL OIL PRODUCTS B.V.

SHELL GLOBAL SOLUTIONS, THE HAGUE
Risk and Reliability Management (RRM) Manual CONFIDENTIAL
Table of Contents
1. PREFACE ............................................................................................................................ 5
2. RISK AND RELIABILITY MANAGEMENT (RRM).................................................... 7

2.1 Introduction ........................................................................................................................... 7
2.2 Overview of RRM ................................................................................................................. 8
2.3 Criticality Assessment......................................................................................................... 10
3. CONSEQUENCE OF FAILURE ASSESSMENT ......................................................... 13

3.1 Introduction ......................................................................................................................... 13
3.2 Economic Consequences ..................................................................................................... 14
3.3 Health and Safety Consequences ........................................................................................ 14
3.4 Environment Consequences ................................................................................................ 15
3.5 Usage and Limitations......................................................................................................... 16
4. RELIABILITY CENTRED MAINTENANCE (S-RCM).............................................. 17
5. RISK BASED INSPECTION (S-RBI)............................................................................. 19

5.1 Introduction ......................................................................................................................... 19
5.2 Overview of the S-RBI methodology .................................................................................. 20
5.3 RBI-specific data collection ................................................................................................ 22
5.4 Susceptibility to Failure and Criticality Assessment .......................................................... 24
5.5 Remnant Life Determination............................................................................................... 27
5.6 Allocation of Confidence Rating......................................................................................... 29
5.7 Inspection / monitoring plan................................................................................................ 30
6. INSTRUMENTED PROTECTIVE FUNCTIONS (IPF) .............................................. 35
7. RRM IMPLEMENTATION ............................................................................................ 37

7.1 Application of the Different Methodologies ....................................................................... 37
7.2 Skills Required for the Analysis.......................................................................................... 38
7.3 Task Harmonisation ............................................................................................................ 38
7.4 Maintenance Management System (MMS)......................................................................... 39
7.5 Asset Information Management (AIM)............................................................................... 39
7.6 Initiating a review................................................................................................................ 41
8. REFERENCES .................................................................................................................. 43
Page 2  Shell Global Solutions RRM Manual

CONFIDENTIAL Risk and Reliability Management (RRM) Manual
RRM Manual  Shell Global Solutions Page 3

1. PREFACE
This document is a summary from the Risk and Reliability Management (RRM) manual and its
underlying methodologies.
This document serves to estimate the scope of work for a S-RBI implementation, including
the necessary resources. It should not be applied as a full methodology manual.
The RRM system is a tool for determining planned proactive maintenance tasks, developing risk
based inspection plans and classifying and implementing instrumented safeguarding.
It is based on three existing underlying methodologies:
• Reliability Centred Maintenance (S-RCM),
• Risk Based Inspection (S-RBI) and
• Instrumented Protective Functions (IPF).
Within RRM these methodologies have been improved and the criticality assessment parts have
been harmonised.
The first two (2, 3) and the last (8) chapters are common to all of the methodologies. A general
description of each of the methodologies is given in separate chapters (4, 5 and 6).
A general overview of RRM can be obtained by reading Chapter 2. If some more detail is required,
Chapters 3 and 8 and the first two sections of Chapters 4, 5 and 6 can be read. The reader studying
the underlying methodologies is advised to read the common chapters, the relevant methodology
chapter and on consequence assessment. It is emphasised that each of the three underlying
methodologies can be applied separately and in any preferred sequence (we advise to do S-RCM
after performing S-RBI hence you have already defined the longest available T/A cycle based on
the integrity assessments).
References are listed at the end of the main text. Specific terminology and all abbreviations are
listed in the glossary.
The introduction of an RRM methodology can be supported through a workshop facilitated by
Shell Global Solutions staff. The benefits of such an approach are that:
• it ensures that a methodology is applied correctly from the start (including proven facilitation
techniques required for an efficient implantation in client’s organisation);
• it can be used to train and teach staff of the Operating Unit;
• current practices are challenged;
• best practices are exchanged.

2. RISK AND RELIABILITY MANAGEMENT (RRM)
2.1 Introduction
Risk based decision making processes have become increasingly important as tools for managing
company’s activities, processes, products and services. Risk and Reliability Management (RRM) is
one such a risk-based tool for determining preventive maintenance and monitoring tasks required
to achieve necessary plant availability with optimal effort. It is not intended as a rigorous method
to determine design criteria, except for instrumented safeguarding systems.
RRM, as described in this Manual, is intended to be applied to equipment in the process industry;
i.e. refineries, gas plants, chemical plants, oil and gas production facilities, (what about power
generation and industrial market?) etc. This recently developed system is based on existing and
applied maintenance, inspection and protective functions methodologies. It covers the following
interconnected but essentially independent methodologies:
• S-RCM, Shell Reliability Centred Maintenance (Ref. 1) is a methodology for optimising
maintenance efforts. It is a streamlined and more economically driven version of the traditional
RCM process.
• S-RBI, Shell Risk Based Inspection (Ref. 2) is a methodology for optimising inspection and
monitoring efforts. It is used to manage the integrity of the pressure envelope.
• IPF, Instrumented Protective Functions is a classification and implementation methodology for
instrumented safeguarding. It is intended to guide users to a safe, cost-effective and consistent
design, implementation and maintenance strategy for IPFs.
Balanced
Risk Activity
DETERMINE PRO-ACTIVE ACTIONS
+ PREVENTIVE MAINTENANCE
TASKS + REDESIGN
S-RCM
CONDITION MONITORING
S-RBI + INSPECTION
RRM + TESTING
Cost Effective
IPF Maintenance
Figure 2-1 Deliverables of RRM
RRM brings a consistent methodology of risk assessment to maintenance, inspection and

safeguarding. The detailed generation of the actual tasks will be delivered by S-RCM, S-RBI and
IPF, see Figure 2-1. Each method focuses on specific areas thus providing maximum efficiency in
the generation of tasks. The main benefits of having such an aligned approach are:
• There is now a consistent and uniform way of assessing risk. This adds clarity to the
organisation as well as when dealing with regulatory bodies.
• It reduces workload because the analysis results of one methodology can be more easily used in
another.
• It enhances synergy of underlying methodologies. As a result the benefits of a full RRM study
will be greater than the sum of the methodology benefits in their previous versions.
• It allows a better understanding and application of risk based activities among the staff with
different specialisation in the operating units.
It should be noted that these benefits are realised in addition to those achieved by application of
the methodologies independently which are:
• Optimal asset reliability and availability to the business.

• Maintenance costs reduced.

• Technical integrity of installations ensured.
• Compliance with changing HSE (Health, Safety & Environment) and legal requirements.
• Cross-functional “reliability” team building.
• Identification and exchange of best practices.
• Single source for registering and support maintenance and inspection plans decisions including,
the facilities to support the feedback and continuous improvement loop.
2.2 Overview of RRM

An RRM analysis is a team exercise performed by a relevant group of specialists from operations,
maintenance, technology, materials/corrosion, inspection, safety, electrical and instrumentation.
A simplified overview of the RRM system, valid for all three methodologies, is presented in Figure
2-2.
DATA HANDLING
CRITICALITY
ASSESSMENT
REVIEW/FEEDBACK
TASK SELECTION
AND PLANNING
TASK EXECUTION
Figure 2-2 The main steps of the RRM process
Data handling
An RRM analysis starts by selecting the unit or plant that will be analysed and defining its
boundaries precisely, both mechanically and electrically. All equipment outside the boundaries is
assumed to function properly. Normally, an RRM analysis will apply one methodology at a time,
i.e. either S-RCM, S-RBI or IPF, but use can certainly be made of the information and outcome of
a previous analysis from one of the other methodologies.
The next step is to gather all relevant data and information necessary for an analysis, for instance
process and engineering design data, historical maintenance and inspection information, PEFS etc.
In most cases the unit will be subdivided into systems (i.e. functional systems, corrosion loops or
IPF loops). Preferably, this should be completed before the team convenes for the rest of the
analysis.
Criticality assessment
Risk is defined as the probability of occurrence of a defined hazard and the consequences of that
hazard. Equipment failure mode is translated into a hazard for the purposes of RRM. The term
criticality is used to denote the initial risk, i.e. risk when the effects of maintenance, inspection and
IPFs are disregarded. A criticality assessment will be carried out for each dominant failure mode of
an equipment item. Whereas the probability that a failure mode occurs is determined by each

methodology separately, the consequence of failure will be assessed in a uniform way across all
methodologies.
Criticality is assessed in a semi-quantitative way by estimating a probability and a consequence
class, which combined in a matrix, leads to a criticality class. More detailed information on
criticality assessment will be given in the next section (2.3).

Task selection and planning

Criticality class will affect the type, extent and/or frequency of the equipment maintenance,
inspection or testing tasks. The process in this phase is very much methodology dependent.
Within S-RCM appropriate pro-active maintenance (PM) tasks are selected on the basis of a
financial cost-benefit analysis. S-RBI determines the inspection interval of an item on the basis of
criticality and by estimating additional parameters like remnant life and confidence therein. With
account being taken of the coverage and inspection techniques to be used, this results in an
inspection plan of that item. In IPF there is a direct relationship between criticality and IPF class,
which in turn determines the implementation and/or testing frequency of the IPF elements.
Task execution
The planned and scheduled maintenance and condition monitoring (including inspection and
testing) tasks are carried out. Some of these might result in repairs. Management of these tasks lies
outside the scope of the RRM Manual and is described in the relevant maintenance [Refs. 3 and 4],
inspection (Ref. 5) and instrumentation management guidelines.
Review/Update
After the tasks have been executed it is important to update the asset database. Information like
inspection and test results, condition monitoring data and actual condition revealed during PM
tasks should be fed back into the system. A review of the RRM analysis is recommended if actual
conditions differ significantly from expected ones. Such a review is also required when operating
conditions have changed significantly.
2.3 Criticality Assessment

A cornerstone of RRM is the assessment of an item’s criticality, since all three methodologies are
risk-based. It is based on the Risk Assessment Matrix (RAM) document issued by the Shell Health,
Safety and Environment Committee (Ref. 6). RAM was developed in conjunction with the Hazards
and Effects Management Process (HEMP) of the HSE management system, as a tool for visibly
expressing company policy and demonstrating compliance with the risk tolerability and ALARP
principle (As Low As Reasonably Practicable).
The original HSE-RAM has been slightly modified for RRM, see Figure 2-3. The 5x6 HSE-RAM
has been reduced to a 4x5 RRM matrix by combining both the two lowest probability rows and the
StF
Criticality
H High L MH H E E
PROBABILITY CLASS
M Medium L M MH H E
L Low N L M MH H
N Neglible N N L M MH
no/slight damage minor damage local damage major damage extensive

ECONOMICS (US$)
CONSEQUENCE
(<10k) (10-100k) (0.1-1m) (1-10m) damage (>10m)

CATEGORY
HEALTH & SAFETY no/slight injury minor injury major injury single fatality multiple fatalities
ENVIRONMENT no/slight effect minor effect local effect major effect massive effect
CONSEQUENCE CLASS NEGLIGIBLE LOW MEDIUM HIGH EXTREME
Figure 2-3 RRM criticality matrix. It has six levels of criticality: Negligible, Low, Medium,
Medium High, High & Extreme.
two lowest consequence columns. In addition, the general definitions of the probability classes in
the HSE-RAM have been “translated” for each methodology separately. The consequence and
probability classes are: Negligible (N), Low (L), Medium (M), High (H) and Extreme (E). There
are six criticality classes: N, L, M, H, E (with their usual meaning) and Intolerable (X). The
distribution of criticality levels in the matrix is based on the recommended risk management
overlay of the HSE RAM.
First the probability of the failure mode analysed is estimated in the steps leading to criticality
assessment. Depending on the failure mode, one out of the three methodologies will be used to
estimate the probability class. S-RCM uses the estimated time between failures (ETBF) if no
maintenance whatsoever is carried out, as a measure of probability. IPF uses the demand rate (DR,
also known as frequency of demand) of an IPF loop. Susceptibility to Failure (StF) is the measure
of probability in S-RBI. More information on probability classification is given in the relevant
methodology chapters.
Three consequence categories can be considered for a failure mode: economic, health/safety and
environment. The worst case determines overall consequence class, even if the score in each of the
categories is equal. More detailed information on consequence assessment is given in the next
chapter. Item failure mode criticality is then determined by the intersection of the relevant
probability row and consequence columns in Figure 2-3. An item can have multiple criticalities,
one for each failure mode.
The way probability is defined above leads to the following definition of criticality in RRM:
Measure of annual risk of an item under the following assumptions:
i) no maintenance,
ii) independent of inspection, and
iii) unrevealed failure of the protective function.
Criticality is therefore static and not changed by the tasks that result from this assessment.
Actually, these tasks are meant to reduce the initial risk, which is equal to criticality, to an
acceptable level (residual risk). Generally, the higher the criticality, the more effort is needed to
reduce that risk. An intolerable criticality (X) cannot be accepted as an initial risk (unless it can be
sufficiently reduced by proactive maintenance tasks) and therefore leads to a recommendation for
re-design.

3. CONSEQUENCE OF FAILURE ASSESSMENT
3.1 Introduction
As discussed in section 2.2, criticality is failure mode related, i.e. for each important failure mode
a failure probability and consequence have to be determined. Three consequence categories can be
considered for a failure mode; economics, health/safety and environment. The worst case
determines the overall consequence class, even if the score in each of the categories is equal. For
each consequence category class in the RRM Criticality Matrix, short descriptions are given which
are identical to those in the Shell-HSE Risk Assessment Matrix (RAM) document (Ref. 6). The
HSE RAM also includes a reputation category but it was decided not to use this in RRM. It was
felt that the added benefit did not outweigh the time spent on this assessment because no or very
few RRM incidents will result in a reputation score higher than for the three other consequence
categories. In addition this category is difficult to assess by the people typically present in an RRM
team (instead sometimes is diverted to fines, risk of loosing the license to operate, etc and even in
these cases they are not easy to evaluate).
Consequence assessment should start with a good description of the plant or unit that is considered
in the RRM analysis. Relevant item data such as location, dimensions and materials and process
data such as temperature, pressure and fluid/gas properties should be readily at hand. The analysis
is carried out by the RRM team which always consists of the plant/unit operator and, depending on
the methodology (S-RCM, S-RBI, IPF), is supplemented by a process technologist, maintenance
engineer, inspector, material and corrosion engineer, instrument engineer, process control or safety
engineer.
The actual analysis starts by describing a dominant failure mode of a particular item. Consequence
analysis should then lead to a credible classification of the potential consequences of that failure
mode. It is important to only consider realistic consequence scenarios and not to focus on unlikely
high consequence scenarios. This concept is schematically represented in Figure 3-1. Each failure
mode can have a range of possible consequences and within RRM it is aimed to select a high but
still credible consequence that is called “estimated consequence”. As a rule of thumb the actual
consequence should be lower than the estimated consequence in about 80% of the cases (see
Figure 3-1).
Estimated
Consequence
Consequence severity frequency
80% 20%
Consequence severity range
Figure 3-1 Concept of potential consequence (each bar could represent one class)

Three levels of consequence assessment are available in RRM:

1. A direct selection of consequence class based on the RAM descriptions.
2. Use of a “simple” questionnaire. It is still based on the RAM descriptions but now split over the
important aspects of each category. For instance, the important aspects of health and safety are
fire, explosion and toxic effects of a failure, which are now assessed separately.
3. Use of a “detailed” questionnaire. It asks a couple of questions on relevant process and
equipment data for each aspect to arrive at an estimate of consequence class. It is meant to give
greater guidance and consistency in consequence analysis, which is especially useful if no HSE
staff is present in the RRM team.
The consequence questionnaires are presented in the software.
3.2 Economic Consequences

Economic consequences of a failure are one of the three consequence categories relevant for RRM.
They basically consider the financial effect of a failure on assets and production. Damage to assets
typically includes material and labour costs of repair and/or replacement of equipment. Costs
associated with product value could be: lost production due to shutdown and/or loss of containment,
reduced margin in case of off-spec products or reduced throughput, reprocessing costs, etc. (What
about fines, considering excessive flaring, sound, etc?)
Costs associated with the consequences of the other two categories (safety and environment)
should not be taken into account in this category (for example: clean-up costs of spillage or
medical costs of an injury).
The RAM document provides guidance on the relation between the potential impact and the
associated cost bracket. Table 3-1 shows this relation and also gives generic descriptions of the
potential impact. Using this table, consequence class can now be established once total costs have
been estimated.
Table 3-1 Economic consequence definitions as given in the HSE RAM document
Class Potential Impact Description
N Slight damage No disruption to operation

< 10 kUSD
L Minor damage Brief disruption
10-100 kUSD
M Local damage Partial shutdown that can be restarted
0.1-1 MUSD
H Major damage Partial operation loss (2 weeks shutdown)
1 - 10 MUSD
E Extensive damage Substantial or total loss of operation
> 10 MUSD
3.3 Health and Safety Consequences

Failure of refinery equipment can result in health and safety consequences because hazardous
substances and/or high pressures are involved. Injuries might be the result of the thermal, toxic or
impact effects on humans resulting from an equipment failure. In determining the potential
consequence mitigating factors should be taken into account. In the context of this questionnaire,
two important mitigating factors are considered: i) frequency of presence and duration of exposure
of people in the hazardous zone and ii) the possibility of averting the hazardous event.

Table 3-2 Health/Safety consequence definitions as given in the HSE RAM document

N No/Slight injury First aid case and medical treatment case. Not affecting work
performance or causing disability.
Lost time injury. Affecting work performance, such as
L Minor injury restriction to activities or a need to take a few days to fully
recover (maximum one week).
Including permanent partial disability. Affecting work
M Major injury performance in the longer term, such as prolonged absence
from work. Irreversible health damage without loss of life,
e.g. noise induced hearing loss, chronic back injuries.
H Single fatality Also includes the possibility of multiple fatalities (maximum 3)
in close succession due to the incident, e.g. explosion.
May include 4 fatalities in close succession due to the
E Multiple fatalities incident, or multiple fatalities (4 or more) each at different
points and/or with different activities.
Only acute effects of a toxic release are considered in RRM, i.e. long term health effects of
exposure to (small) quantities of toxic (e.g. carcinogenic) substances are not taken into account.
Table 3-2 gives definitions and descriptions of potential health and safety consequences taken
from the RAM document.
3.4 Environment Consequences

The environmental consequences of an incident are becoming increasingly important. Within
RRM, it is one of three categories that determine overall consequence classification. Two
important mechanisms for damage to the environment are considered. First the release of liquids,
which may lead to soil and water pollution and second, the release of gas which may result in
pollution of the atmosphere.
Table 3-3 Environmental consequence definitions as given in the HSE RAM document
N No/Slight effect Local environmental damage. Within the fence and within systems.
Negligible financial consequences.
Contamination; damage sufficiently large to attack the environment;
L Minor effect single exceed of statutory or prescribed criterion; single complaint.
No permanent effect on the environment.
Limited loss of discharges of known toxicity; repeated exceed of
M Localised effect statutory or prescribed limits. Affecting neighbourhood beyond the
fence.
Severe environmental damage. The company is required to take
H Major effect extensive measures to restore the contaminated environment to its
original state. Extended exceed of statutory or prescribed limits.
Persistent severe environmental damage or severe nuisance
E Massive effect extending over a large area. In terms of commercial or recreational
use or nature conservancy, a major loss for the company. Constant,
high exceed of statutory or prescribed limits.

Again three levels of consequence assessment are available; direct, simple questionnaire and
detailed questionnaire. Table 3-3 gives definitions and descriptions of potential environmental
consequences taken from the RAM document.
3.5 Usage and Limitations

How and with what level of detail a consequence assessment will be performed to a certain extend
depends on the methodology used (S-RCM, S-RBI or IPF) and the experience of the people in the
team. For instance, an S-RCM study will always use the detailed economic questionnaire but in
many cases health/safety and environment assessment are not required. Furthermore, people with a
lot of knowledge and experience in HSE consequence assessment will not need the detailed
questionnaire and can probably give a good estimate on the basis of the failure effects as agreed by
the RRM team.
The detailed health/safety and environment questionnaires are meant to provide guidance and
consistency in consequence assessment, especially if no HSE staff is present in the team. However,
there are a number of limitations which one should keep in mind when using a detailed
questionnaire:
• It is meant to provide an estimate of consequence class (i.e. one out of five) with the associated
degree of accuracy. It is not a QRA (Quantitative Risk Assessment) method, which requires
detailed physical modelling to determine consequence.
• It is specifically geared to assess potential incidents related to maintenance, inspection and
safeguarding of process plants and it is not meant for use outside RRM.
• It is a rather mechanistic procedure, with the benefit of being consistent, but with the risk of
being applied thoughtlessly. The team should always review the outcome and consider seeking
specialist advice in case of doubt.
• There are quantitative consequence assessment methods available, like the FRED (Ref. 7)
program developed by Shell HSE experts. The use of these should be considered in cases with
a higher criticality.
The RRM methodology should not be used for cases with a potential consequence outside the
matrix, i.e. with a very high consequence that is, for instance, more than a factor 10 higher than the
dividing line between High and Extensive. These should be covered by a dedicated risk analysis
involving HSE/QRA specialists.

4. RELIABILITY CENTRED MAINTENANCE (S-RCM)

Intentionally removed.

5. RISK BASED INSPECTION (S-RBI)

The method described in this Manual will improve the availability of assets at the lowest possible
cost and at the same time ensure that the integrity, including safety, of equipment is properly
addressed. Most attention is paid to those items in the higher risk categories, which need to be
monitored closely. The method will likewise help to optimise demands imposed on the technical,
operating and financial resources of production units.
Note that the criticality (and underlying probability and consequence) values resulting from this
method are used to optimise inspection and maintenance programmes. These values are not
deterministic and should not be used for other purposes.
An inspection plan, operational window and monitoring scheme can be developed using this
method during the design phase (see also Ref. 8) of an installation or at a later stage and must be
updated when changes occur.
5.1 Introduction
Internationally there is a trend to apply flexible periodic inspection programmes using “Risk-
assessments”, based on operational, material, construction, environmental parameters and the
actual conditions of the equipment. This approach is called “Risk Based Inspection” and is
replacing “time-based inspection” systems.
The S-RBI (Shell - Risk Based Inspection) method gives recommendations for the development
and implementation of a risk-based inspection programme in the process industry in general - and
refineries and petrochemical facilities specifically - and should be applied to determine inspection
plans for the pressure containing parts of all static pressurised equipment, including vessels and
piping.
The method is based on the best practices as developed within Shell and is designed to comply
with the future API Recommended Practice on Risk Based Inspection (API RP 580, Ref. 9).
Technical integrity is maintained by executing inspections and process monitoring with suitable
techniques, extent, (critical) location and frequency. These inspection techniques can be either
non-intrusive (on-stream) or intrusive (off-stream scheduled inspections).
The RBI method takes into account only those degradation mechanisms affecting pressure
containment which are related to the operation of an installation (corrosion, fatigue, etc.). Failures
as a result of excursions outside the defined operating window are not considered.
The inspection intervals derived from the S-RBI procedure may be longer than the maximum
permissible inspection interval that is prescribed by local legislation and is definitive. In such
cases the results of the S-RBI study shall be discussed with the local legislative authorities for each
site to make the new insights regarding S-RBI more widely understood and obtain permission for
optimum inspection intervals.
The method includes the option for a qualitative criticality assessment to identify areas with
negligible criticality or negligible consequences of failure, which do not need a full criticality
assessment on an item by item basis. A more detailed (semi-quantitative) criticality assessment,
should be carried out for the areas c.q. items with non-negligible criticality.
The end deliverable of S-RBI is a complete and thorough inspection and process monitoring plan
for an asset, which results in:

• Increased reliability and therefore increased safety and availability

S-RBI is a proactive tool for identifying critical items of equipment. Better understanding of the
susceptibility to and consequences of failure will lead to more effective means of control being
practised. This will directly reduce the probability of failure and as a result will directly
increase the safety, reliability and availability of the asset.
• Reduced scope of work for shutdown inspection
Moreover, S-RBI provides the analysis for lengthening inspection intervals and/or reducing the
maintenance and inspection scope of less critical items. Additionally, many equipment items
may be monitored by on-stream methods instead of traditional off-stream methods. This will
result in shorter and/or less frequent shutdowns, which reduces direct costs and allows higher
unit availability.
5.2 Overview of the S-RBI methodology

The concept of the S-RBI process is shown in Figure 5-1.
Asset Integrity
Database
Corrosion Loop Analysis /Review

Definition Feedback
Criticality
Assessment
Confidence
Task Execution
Assessment
Inspection/Monitoring
Planning
Figure 5-1 The main steps of the S-RBI process
5.2.1 Asset Integrity Database

The Asset Integrity Database should be compiled or checked as part of the RBI process and should
contain all data relevant for evaluating integrity such as:
• process data, including the specification of operating windows;
• engineering / design data;
• description and evaluation of degradation mechanisms;
• a compilation of inspection history and degradation analysis.
In order to structure the integrity data and the criticality assessment, it is recommended - but
optional - to define corrosion loops.
S-RBI is a “living” programme and must include updating of the Asset Integrity Database with the
results of inspections, monitoring and process/asset changes. Since S-RBI reflects the state of the
assets at the time the data is collected and evaluated, it is essential to keep S-RBI data up to date
with asset changes and inspections results. This will progressively remove uncertainties in
assessments and calculations, and result in a more effective inspection programme.

5.2.2 Criticality Assessment

To ensure that all relevant information is captured and that all parties involved are familiar with
the parameters, a competent team, having relevant experience with the asset under consideration,
should be given the responsibility for the criticality assessment. Typically such a team should
consist of the following members:
• materials / corrosion engineer (SIOP or local staff);
• inspector;
• operator;
• technologist;
• maintenance engineer.
This team, the so-called RBI team, takes responsibility for the whole S-RBI process. The inspector
is usually the co-ordinator of and responsible for the S-RBI programme. The input from the
operator / process engineer, corrosion engineer and the maintenance engineer is required on a part
time basis.
5.2.2.1 Criticality
Criticality is defined as the combination of two parameters - susceptibility to failure and the
consequences of a failure - and is presented in the form of a matrix. In RRM a 4×5 criticality
matrix is used, with six criticality levels see Figure 5-2.
StF
Criticality
H High L MH H E E
PROBABILITY CLASS
M Medium L M MH H E
L Low N L M MH H
N Neglible N N L M MH
no/slight damage minor damage local damage major damage extensive

ECONOMICS (US$)
CONSEQUENCE
(<10k) (10-100k) (0.1-1m) (1-10m) damage (>10m)

CATEGORY
Figure 5-2 Criticality matrix showing how the criticality rating is derived
5.2.2.2 Susceptibility to Failure (StF)

The Susceptibility to Failure is sub-divided into 4 classes: “Negligible”, “Low”, “Medium” and
“High” and is assessed using “questionnaires”, which use relevant information regarding process
conditions and degradation mechanisms for the systems concerned. A distinction is made between
age-related mechanisms such as wall thinning by internal corrosion, and non-age-related
degradation mechanisms such as chloride stress corrosion cracking.
For age-related degradation the combination of Criticality and Confidence Rating is used to
derive the Inspection Interval Factor, which is multiplied by the Remnant Life to determine the
maximum inspection interval (maximum inspection interval = Interval Factor x Remnant Life).
The Remnant Life is calculated on the basis of wall loss degradation mechanisms using the actual
and minimum allowable wall thickness and the established corrosion rate.

For non-age-related degradation mechanisms it is not usually possible to estimate a Remnant

Life, as this form of degradation is more dependent on process conditions and it is very difficult to
establish a time-dependent corrosion/degradation rate. Therefore careful monitoring and control of
all relevant process parameters is required to ensure that those types of degradation are under
control. The Criticality Rating and the Confidence Rating are applied to indicate if the system
considered can be operated safely with monitoring and opportunistic inspections or if re-design is
required.
5.2.2.3 Consequence of Failure (CoF)

The “questionnaire” for consequences of a failure takes account of consequences in the areas of
safety, environment, economics and is presented in Chapter 3 of this manual.
5.2.3 Confidence Rating

The Confidence Rating reflects the confidence that the inspector and the materials / corrosion
engineer have in the assessment of Susceptibility to Failure and for age-related degradation the
Remnant Life, and as such depends on:
• their judgement on the stability and control of the degradation mechanisms;
• the number and quality of inspections carried out;
• whether reliable process monitoring is carried out.
5.2.4 Inspection Planning

Both off-stream and on-stream monitoring of critical items and process parameters is part of the
inspection plan. The inspection plan includes:
• inspection interval;
• inspection technique(s) to be used;
• inspection location;
• coverage of the inspection measurements/visual inspection.
Inspection techniques and tools to be used depend on the failure mode and the type of equipment
to be inspected. The Degradation Modules (Ref. 10) and the NDT Handbook (Ref. 11)give
guidance for the selection of the appropriate technique.
5.2.5 Execution of Inspection and Maintenance

5.2.6 Review/Feedback
At the start of the Review/Feedback step, the Asset Integrity Database shall be reviewed and the
contents accepted by the RBI team.
The Asset Integrity Database needs to be updated after Inspection and/or Maintenance activities.
The data are reviewed by the RBI team, and the review is to be officially recorded in the Database
itself. Any operational changes shall also be treated in this way.
5.2.7 Flowchart
A flowchart of the S-RBI process is given in section 5.4.1
5.3 RBI-specific data collection

The Asset Integrity Database is used to collate the necessary data for all items to which the
analysis process is to be applied and to record the results of the analysis. It is advisable to structure
this data base according to the Corrosion Loop approach, i.e. to divide the unit into Corrosion
Loops, each of which:

• operates under similar conditions;

• is exposed to specific corrosion phenomena;
• consists of similar materials.
Corrosion Loop data are based on the outcome of the Corrosion Analysis process, which is an
assessment of the potential chemical and mechanical failure mechanisms derived from
consideration of the Technical and Operational Data. The results of such an assessment can be
documented in a Corrosion Manual; where such plant specific corrosion manuals are not available,
Materials Engineering Philosophy (MEP) documents can be used, which include a description of
the potential degradation mechanisms, typical level of inspection and examples of general
experience and SIOP Standardised Corrosion Loops for refinery units and main chemical plants.
The verification of the input data as well as the regular updating of the data (after inspection,
repair, and process or installation changes) is described as the Review/Feedback process, since it
reviews inspection, maintenance and operational data collected by the RBI team which is then fed
back into the Integrity Database.
Inspection results are reviewed to determine whether or not the predicted degradation, e.g. due to
corrosion, is realistic and to enable the actual condition of the equipment items to be described.
For age-related degradation the data will be evaluated so that a predicted corrosion rate is
obtained. Preferably this is based on inspection data supported by corrosion models which are
available in the form of the Degradation Modules. However, in the absence of reliable
measurements the analyses should be based on available models together with corrosion
monitoring data (where available) and/or “generic” data, from either similar plants, the
Degradation Modules or literature. A flow scheme for selecting the corrosion rate (CR), that will
be used in Remnant Life assessment, is shown Error! Reference source not found..
Y N (default)
start historical override*
data
N (flag) Y
theoretical N
model * Based on
experience/
generic data
Y
Y
override*
N
Theoretical Experience Historic
CR based* CR CR
Selected
CR
Figure 5-3 Definition of the selected corrosion rate (CR)

To obtain realistic assessments of corrosion rates consultation between the inspector and the
corrosion engineer is often required.
Where the corrosion rate is based upon measured data, care should be taken regarding the validity
and inaccuracies of measurements and inaccuracies originating from trending analysis. If there is
only limited and/or unreliable monitoring data available to allow calculation of the corrosion rate,
the predicted rate derived from modelling or a conservative assessment based on general
experience/expert knowledge may be used.
5.4 Susceptibility to Failure and Criticality Assessment
5.4.1 Corrosion Loop Criticality Assessment

Parts of the installations which do not require regular inspections, since they are not critical in
operational and HSE terms, can be dealt with in a qualitative assessment of subsections of the
installation, so-called Corrosion Loops, to reduce the scope of Criticality Assessment work.
Qualitative in this context means an assessment on a more global (Corrosion Loop) scale as
opposed to semi-quantitative assessment on an item by item basis. All items in a Corrosion Loop
with a “negligible criticality” can be pre-selected in this way and further activities are not required
for these items. All other Corrosion Loops should be assessed using the semi-quantitative
approach, i.e. on a item by item basis. This scheme is outlined in
Asset
Integrity
Database
Corrosion Loop Investigative

definition Inspection
(Tag) criticality Feed back &

Criticality = N
assessment Analyse
StF
Criticality Mitigate
H CR > 4*CRd L MH H E E
Risk
PROBABILITY CLASS
M CR = 1 - 4*CRd L M MH H E
No inspection L CR = 0,5 - 1 CRd N L M MH H Detailed

N CR < 0,5*CRd N N L M MH Analysis Execute
periodic review
no/slight damage minor damage local damage major damage extensive Inspection Plan
only ECONOMICS (US$)
CONSEQUENCE
(<10k) (10-100k) (0.1-1m) (1-10m) damage (>10m)

CATEGORY
Remnant Life
Confidence Inspection &
(Age Related
Rating Monitoring Plan
only)
Figure 5-4 Qualitative and Semi-Quantitative routes of applying RBI

Asset
Integrity
Database
Corrosion Loop Investigative

definition Inspection
(Tag) criticality Feed back &

Criticality = N
assessment Analyse
StF
Criticality Mitigate
H CR > 4*CRd L MH H E E
Risk
PROBABILITY CLASS
M CR = 1 - 4*CRd L M MH H E
No inspection L CR = 0,5 - 1 CRd N L M MH H Detailed

CR < 0,5*CRd Analysis Execute
periodic review N N N L M MH
no/slight damage minor damage local damage major damage extensive Inspection Plan
only ECONOMICS (US$)
CONSEQUENCE
(<10k) (10-100k) (0.1-1m) (1-10m) damage (>10m)

CATEGORY
Remnant Life
Confidence Inspection &
(Age Related
Rating Monitoring Plan
only)
Figure 5-4.
5.4.1.1 Qualitative Criticality Assessment

After a Corrosion Loop has been defined by the team, the Consequences of Failure and
Susceptibility to Failure are determined by treating the loop as an entity. The Criticality of the loop
is then determined which is defined as the Corrosion Loop’s degradation mechanism with the
highest likelihood of occurrence combined with the most severe consequence.
Corrosion Loops where “Negligible” criticality is established or where the Consequence of Failure
is “Negligible”, are not analysed further. These loops should be part of S-RCM studies to optimise
maintenance. All other loops are analysed item by item.
Note that if a Corrosion Loop contains equipment under statutory supervision, these items should
be separately mentioned and analysed in the Corrosion Loop.
5.4.1.2 Derivation of a Corrosion Loop’s Susceptibility to Failure and Criticality

The Susceptibility to Failure of the Corrosion Loop is determined by assessing whether or not the
chemical and mechanical deterioration mechanisms identified by the corrosion analysis are likely
to affect the containment of the loop. The possible Corrosion Loop degradation mechanisms shall
be mentioned including their most likely location of occurrence within the Corrosion loop, and
analysed using the questionnaires where necessary. All degradation mechanisms with a higher than
negligible likelihood of occurrence will be considered for that Corrosion Loop and their
susceptibility is described by High. Medium or Low. A negligible susceptibility means that there is
no foreseeable susceptibility to failure.
The Consequence of Failure for the loop is reviewed based on the method as explained in
Chapter 3 and where needed by using the questionnaires. Using the worst case Susceptibility to
Failure and Consequence ratings, the Corrosion Loop Criticality Rating is determined from the
criticality matrix (Figure 5-2).
Those Corrosion Loops having a Criticality Rating “Negligible” or a Consequence of Failure
rating “Negligible” are categorised as subject to inspection only at the discretion of the
maintenance engineer. They do however remain in the Asset Integrity Database and will be
subjected to periodic review as defined in Section 5.7.7.

All other Corrosion Loops, having a Criticality Rating of E, H, MH, M or L, are subjected to a
detailed semi-quantitative assessment (Individual Consequence and Susceptibility to Failure
analysis)
5.4.2 Equipment Susceptibility to Failure

The semi-quantitative approach is applied to individual items in a Corrosion Loop where the
Criticality or consequence rating of the loop exceeds “Negligible”.
The Susceptibility to the individual failure mechanisms appropriate to the equipment is evaluated
using a Questionnaire.
For details on the degradation mechanisms and assistance in deriving the susceptibility rating,
SIOP-standard degradation mechanism descriptions are available in the form of Degradation
Modules (Ref. 10).
It should be noted that an equipment item can be part of more than one Corrosion Loop, e.g. a
piece of equipment, such as a vessel or column, may be subdivided into more segments each of
which is part of a seperate Corrosion Loop according to anticipated degradation mechanisms.
Since the assessment procedure involves knowledge of materials, corrosion and inspection matters,
its execution should be the responsibility of a team having the necessary expertise and knowledge.

Determination of the Susceptibility to Failure is based on the relevance of all degradation

mechanisms that may potentially affect the items. There are cases where several degradation
mechanisms can occur and each shall be evaluated and noted in the questionnaire. These ratings
will be used to derive the criticality - and later inspection frequency and scope - for each of the
identified degradation mechanism c.q. failure mode.
5.4.3 Equipment Consequence of Failure

The Consequence of Failure for each item in the Corrosion Loop is determined according to the
method as described in Chapter 3 and, or where preferred, by using the questionnaires. For each
failure mode, the applicable Consequence of Failure should be listed in order to derive the
criticalities for each of the identified failure modes.
5.4.4 Equipment Criticality Rating

In the assessment of an equipment item within one or more Corrosion Loops, the Criticality Rating
combines the Consequences of Failure rating (Section 3) and the Susceptibility to Failure rating
(Section 5.2) for that item, in the same way as for the Corrosion Loop. These ratings are entered
into the criticality matrix in order to establish the Criticality Rating, see Figure 5-2. A Criticality
Rating is established for all identified degradation mechanisms, c.q. failure modes.
Intolerable criticality shall be rectified (and the result shall be documented) to reduce the risk. In
addition it is strongly recommended to consider corrective actions for the “extreme” cases and
where monitoring of operating conditions for non-age-related degradation is not feasible.
5.5 Remnant Life Determination

Essential for the S-RBI process is the assessment of the Remnant Life of items with regard to the
relevant degradation mechanism and its failure characteristic.
For non-age-related failure characteristics the Remnant Life cannot be assessed because the onset
and rate of degradation cannot be predicted. These failure characteristics require a separate
approach based on control of internal and/or external operating conditions. A proper monitoring
scheme should be agreed for such cases based on the information in the Degradation Library
(Ref. 10).
Degradation mechanisms with an age characteristic allow a quantitative determination of the
Remnant Life.
Degradation mechanisms that result in wall thinning (e.g. sulphur corrosion, erosion) can be
assessed by considering the corrosion allowance and the corrosion rate. The first step in such a
Remnant Life determination is to consider the remaining corrosion allowance from the design.
The Remnant life is then defined as the remaining corrosion allowance divided by the assessed
corrosion rate.
If the corrosion allowance from design is not considered sufficient for the remaining life of the
equipment, a detailed and documented fitness for purpose assessment can be carried out to
determine the actually available corrosion allowance of the equipment. Such an approach can also
be used where there is no design corrosion allowance, or if the corrosion allowance has already
been consumed. In this case the Remnant Life is defined as the calculated corrosion allowance
divided by the assessed corrosion rate. The principle of this approach to Remnant Life
determination is given in Figure 5-5.
Where an item’s failure mechanism is a result of simultaneous degradation, calculation of the
Remnant Life is to be based on the worst case corrosion rate, e.g. by adding internal and external
corrosion rates.
When all failure modes are grouped, the minimum of all calculated Remnant Lives is used for
determining the inspection interval of the asset . Remnant Life is in general limited to 20 years.

Determine Failure Characteristic
Failure Characteristic: Failure Characteristic :

age-related non-age-related
Thinning Creep Cracking

HIC
Mechanical
Remnant Life = Specific
Remaining CA / CR Assessment Methods
Determine Susceptibility
Step 1: Rem. CA = Rem.Design CA based on questionnaire
and the Degradation
Step 2: Rem. CA = t(last) - t(min)
Modules.
Redesign if required.
CR is the derived Corrosion
Rate according to the flow Process Monitoring +
scheme of Figure 5.3. Opportunity Inspection
(Remnant Life concept not used here)
Figure 5-5 Flow chart for determination of Remnant Life
5.5.1 Determination of the Corrosion Allowance

Assessment of the corrosion allowance is based on the maximum allowable wall loss. This value
may be derived by determining the difference between the minimum allowable wall thickness
required to ensure integrity and the nominal or measured wall thickness.
For piping the minimum allowable wall thickness is the greater of the following values:
a) pressure retention thickness calculated using the Code rules (see for instance, Ref. 12 and Ref.
13) and based on the maximum allowable operating pressure;
b) the thickness needed to withstand external forces, thermal expansion, buckling, etc.
For equipment such as vessels the following rule should be used.
CAdesign = tnom - tmin - fabrication tolerance
The fabrication tolerance is set at zero by default and can be adjusted according to local
conditions. When this wall thickness redundancy has been consumed a detailed analysis is needed
to determine the remaining margin.
An exception to this may be made where a pressure vessel or any of its components have been
subject to a design appraisal arising from either an increase or decrease in the severity of the
operating conditions or where a vessel has been downrated on account of corrosion or other
degradation. In this case the corrosion allowance will be the difference between the re-calculated
design minimum wall thickness and the measured wall thickness.
For equipment internally clad with corrosion resistant materials the corrosion allowance is equal to
the cladding thickness. For equipment with internal coating the Remnant Life will be calculated as
if no coating were present, unless justified otherwise.

5.6 Allocation of Confidence Rating

The Confidence Rating reflects the confidence that the inspector and the materials / corrosion
engineer have in the assessment of Susceptibility to Failure and for age-related degradation the
Remnant Life, and as such depends on:
• their judgement on the stability and control of the degradation mechanisms;
• the number and quality of inspections carried out;
• whether reliable process monitoring is carried out.
The confidence rating ranges from very high (VH) to very low (VL) (see Table 5-1) and is one of
the parameters that determine inspection intervals. For a consistent approach to determine
confidence rating the questionnaires as shown in Table 5-2 and Table 5-4 are used. The scores are
arithmetically summed to determine the total score, which is limited to a maximum of 0.2.
Table 5-1 Confidence Rating total scores

Confidence Rating total score Confidence Rating
+ 0.2 VH – Very High
+ 0.1 H – High
0 M - Medium
- 0.1 L – Low
- 0,2 VL – Very Low
Table 5-2 Determination of the Confidence Rating adjustment scores

for age-related degradation mechanisms
Age-related-degradation confidence questions
Degradation mechanism is stable and can be properly Yes Intermediate No
controlled
Multiple reliable inspections have been carried out Yes Intermediate No
Relevant process parameters are reliably monitored Yes Intermediate No
Table 5-3 Determination of the Confidence Rating adjustment scores

for non-age-related degradation mechanisms
Non-age-related degradation confidence questions
Degradation mechanism can be properly controlled Yes Intermediate No
Relevant process parameters are reliably monitored Yes Intermediate No
Reliable inspections have been carried out Yes Intermediate No
The method for determining the Confidence Rating can be applied to both new and existing items.
Where a new item replaces an item in a system which had a Confidence Rating, then transferring
this credit to the new item may be considered in the light of local experience or Company
experience with that specific type of equipment. Similarly, in new projects and plants, equipment
items may be given a higher Confidence Rating in the light of Company experience. Where such a
credit for a Confidence Rating is allocated, the reasons must be recorded in the initial inspection
report.

5.7 Inspection / monitoring plan
5.7.1 Age-related degradation

The Criticality values derived from the semi-quantitative assessment process together with the
Confidence Rating of an item are used to determine the Inspection Interval as a fraction of the
Remnant Life. An Inspection Interval Factor is derived by combining the Confidence Rating and
Criticality as shown in Table 5-4.
Table 5-4 Derivation of the Interval Factor for age-related degradation
Interval Factor Confidence Rating
Criticality Very Low Low Medium High Very High
X #value #value #value #value #value
E #value #value #value #value #value
H #value #value #value #value #value
M #value #value #value #value #value
L #value #value #value #value #value
N (review only) #value #value #value #value #value
A recommended maximum inspection interval defined by local or national legislation may only be
departed from after approval by the statutory body.
The Remnant Life is multiplied by the interval factor in order to derive a maximum Inspection
Interval:
Maximum Inspection Interval = Interval Factor x Remnant Life
Even for an item with a ‘Negligible’ criticality an interval factor is defined, which results in a
review close to the end of its (inherently long) derived Remnant Life. This review should be
carried out to check the need for replacement of the item at the end of the Remnant Life.
5.7.2 Non-age-related degradation

It is not possible to estimate a Remnant Life for non-age-related degradation, as this form of
degradation is more dependent on process conditions and it is very difficult to establish a time-
dependent corrosion/degradation rate. Very high corrosion/degradation rates and fast changes are
possible if the process conditions are not properly controlled. For this reason it should be
recognised that, in most cases, time based inspections of the asset cannot play an important role in
preventing failure of this asset. Process monitoring is most essential here.
Table 5-5 Regimes for non-age-related degradation mechanisms

Confidence Rating
E
H
MH
M
L
N

However it is possible to utilise a rule-based approach incorporating our best practises’ and
directly derived from the Criticality Rating and the Confidence Rating, see example in Table 5-5.
Re-design is required for the Intolerable and Extreme Criticality items whereas run-to-failure is
acceptable for some of the Low and all the Negligible Criticality items. Extensive monitoring is
required for the remainder.
5.7.3 Inspection tasks

For the development of an inspection plan reference is made to the SIOP Inspection Management
Guidelines (Ref. 5), the SIOP reference manual for the periodic inspection of static mechanical
plant equipment (Ref. Error! Bookmark not defined.), the SIOP Handbook of Non-Destructive
Testing (Ref. 11 and also available on the Shell Wide Web) and an Australian standard on in-
service inspection of boilers and pressure vessels (Ref. 14). The process is outlined in Figure 5-6.
Figure 5-6 Scheme for the development of an inspection plan
5.7.4 Inspection Techniques & Coverage

The S-RBI process offers criteria for selecting the most appropriate inspection methods, extent,
location and interval.
• Criticality, in combination with the Confidence Rating and Remnant Life determines the
maximum inspection intervals for age-related degradation mechanisms.
• The expected degradation mechanisms should be identified to select the most appropriate
inspections and NDT methods.

• The most likely locations of those degradation mechanisms should be identified to select the
most appropriate inspection locations and extent.
• The coverage (extent of application) of the appropriate technique(s) should be derived from the
criticality level.
Sound engineering judgement is required in order to select those areas most susceptible to the
relevant degradation mechanism. The inspection tasks are normally derived during the Corrosion
Loop assessment. The inspection tasks should be based on the Susceptibility to Failure ratings for
each of the possible failure modes.
Guidance on the inspection method and techniques is also given in the Degradation Library for the
degradation mechanisms discussed, see Table 5-6. The methods associated with A and B are
indicated for each failure mode in the degradation library.
Table 5-6 Guidance on recommended inspection methods

Criticality Inspection Methods
(as per Degradation Module)
H Category A
MH Category A
M Category A or B*
L Category A or B*
N Category A or B*
* Inspection to the higher class, i.e. “Category A” is advised
Recommendations for inspection coverage are given in Table 5-7 and may be adjusted according
to the outcome of an inspection. In such a case it may also be necessary to introduce another
inspection method, either to quantify a defect or to determine the extent of the damage or to
confirm that no other type of defect exists as well.
Table 5-7 Inspection Coverage (in % of affected area/items)

Confidence Rating
E
H
MH
M
L
N
5.7.5 Optimising Inspection Planning

It should be noted that different inspection intervals may be assigned to different sections of one
item of equipment, especially if the item is divided over more than one Corrosion Loop.
Inspection tasks comprise external visual inspection, internal visual inspection and a range of non-
intrusive non-destructive testing techniques, the nature and extent of which may be described by a
work instruction or inspection procedure. The aim should be to use non-intrusive inspection
techniques either on-stream or off-stream, while recognising that internal visual inspection is a
powerful tool. Internal visual inspection supports external NDT techniques and may be needed in

certain cases e.g. if a detailed scope of inspection is needed to obtain a required level of
confidence.
Items in a Corrosion Loop may be grouped to represent a part of the loop where all parameters
determining a single degradation mechanism are identical. In this group the condition of one item
(for this degradation mechanism only) will represent the whole group. Criticality and Maximum
Inspection Interval will be applicable to the whole group in such cases.
5.7.6 Overdue Procedure

The inspection plan of each item determines the date by which the scheduled Inspection Task
should be carried out. The date is scheduled as a month or year, that is an item will not become
overdue until the last day of that month or year. It is anticipated that even with this flexibility, at
some time it will prove either impossible or impracticable to release an item for inspection due to
operational constraints within the due month/year. There should be an auditable, systematic and
technically sound ‘overdue’ procedure to ensure that all appropriate technical, legislative and
safety aspects are taken into account when deferment of an item or system inspection is necessary.
5.7.7 Review / Feedback

The Review/Feedback process, which is carried out by the RBI team as a whole, serves both to
introduce new items into the Asset Integrity Database and to review the findings of monitoring,
inspection and NDT activities prior to feeding these back to the S-RBI process.
The Review/Feedback process is outlined in Error! Reference source not found..
The RBI team shall have a review meeting at regular intervals, e.g. every year, to ensure that the
data in the system is still valid and to discuss the impact of deviations. The RBI team should
consider more frequent review for critical assets, or older assets, which have exceeded or will soon
exceed their original design life.
Furthermore the inspector shall initiate a review if:
• deviations from the agreed operating conditions occur or have occurred;
• the basis of an evaluation is found to be incorrect (e.g. degradation via unexpected mechanisms
has occurred, or actual degradation is significantly faster than predicted);
• major modifications have been made.
The purpose of the Review/Feedback is threefold:
• to establish the actual condition of items and their fitness for purpose;
• to establish the observed degradation mechanisms, their rates of progress and hence Remnant
Life;
• to confirm or re-establish the Confidence Rating for that item.
The Review/Feedback process may result in an update of the inspection plan. It is essential that the
Asset Integrity Database is kept up to date.
5.7.7.1 Design, Construction and Operational Data

All available operating data is reviewed with the design and construction data for each item to
ensure that it is still valid.
Where such data does not exist, the design itself and construction materials should be checked
against the process conditions, otherwise the assessment cannot be completed.
Similarly the process and operating conditions (past, present and future) are reviewed to ensure
that any assessment of consequences and susceptibility to failure based on historical evidence is
actually validated and will remain valid in the future.
5.7.7.2 Inspection & Test Data since last review

A tabulated summary of the Inspection and Test data since last Review is then prepared which
includes the nature and extent of each visual inspection (i.e. internal; external; limited, etc.)

together with the nature and extent of any associated NDT which may have been carried out. It is
important for particular attention to be paid to verifying that work carried out is appropriate to the
predicted degradation mechanisms on which the Criticality Assessment is based.
Where routine condition monitoring data has been collected, the outcome should be reviewed.
It may be necessary to carry out additional analysis should the conclusions be unclear.
In the case of thickness measurements, invalid results ought to be excluded from any analysis
before the rates of degradation are evaluated. So-called invalid results should be recorded,
evaluated and dismissed as invalid during the Review/Feedback process.
Where corrosion rates based on previous inspection and subsequent monitoring results have been
validated, these measured rates and the last measured wall thickness are to be used to re-assess
predicted Remnant Lives.
5.7.7.3 Maintenance of Asset Integrity Data Base

The data held in the Asset Integrity Database is the basis for all assessments and unless it is
properly maintained, the resulting Criticality and S-RBI Strategy cannot be correct. The data
should therefore be reviewed at regular intervals to ensure that all data remains valid and that
historical inspection and maintenance data has been incorporated. Any changes, additions or
deletions to the Asset Integrity Database or its data are to be recorded to ensure auditability.
If a change of any questionnaire or reference table is believed necessary, a comprehensive
assessment of the basis for the proposed change and the likely effects of such a change is to be
carried out since changes will affect all items covered by the questionnaire or table. When a
change is carried out it should be recorded to ensure auditability.

6. INSTRUMENTED PROTECTIVE FUNCTIONS (IPF)


7. RRM IMPLEMENTATION
In order to realise the full benefits from the RRM process, it is necessary to link the output of the
RRM methodologies to maintenance management processes. This will enable the workflow to be
managed, equipment condition to be recorded and performance trends to be analysed.
In addition, it is essential to understand where the different methodologies are used and to define
the roles of the various disciplines that execute the methodologies.
Finally, since the maintenance and inspection efforts from the RRM process are largely defined by
the process conditions at the time of the analysis, there is a need for a review of these strategies if
operating or process conditions have changed.
This Chapter describes:
• Application of the different methodologies.
• Skill requirements needed for the analysis.
• How RRM tasks can be harmonised.
• How maintenance and inspection tasks are managed through a maintenance management
system (MMS).
• The essentials of an asset information management system (AIM) for information storage to
enable trend and performance monitoring.
• The mechanisms to be adopted to initiate a review.
It should be noted that descriptions of MMS and AIM in the following sections are in the context
of RRM only.
7.1 Application of the Different Methodologies

In the context of maintenance and inspection, each RRM methodology has a specific purpose in
optimising efforts for maintenance, inspection and instrumentation. The failure mode and/or
equipment under consideration determine which methodology to use.
7.1.1 S-RCM
Intentionally removed
7.1.2 S-RBI
S-RBI covers the combination of static equipment with material degradation related failure modes.
This degradation can be of a chemical nature (e.g. corrosion, cracking, embrittlement) or
mechanical nature (e.g. fatigue, creep, erosion). The number of failure modes considered is
limited. Other static equipment failure modes like fouling should be analysed with S-RCM.
S-RBI is a strategy for optimising inspection and monitoring efforts, where the consequence of a
sub-optimal plan could be a loss of containment. The S-RBI methodology is used to manage the
integrity of the pressure envelope. It is an objective tool for determining the inspection scope for
planned shutdowns and the exact part(s) of static equipment that need to be opened for inspection.
It can also be used for determining the on-line inspections outside a shutdown. In a similar way to
S-RCM, it can also be used in the development of projects to assist in determining materials of
construction, again in terms of optimum reliability and life cycle costs.
7.1.3 IPF

7.2 Skills Required for the Analysis

The methodologies used in RRM very often require the same or similar skills. It is recommended
that where a skill is common to all methodologies, people should experience all three processes
and, in order to enhance the RRM skill base, as many people as possible should experience one or
more of the RRM methodologies. Table 7-1 illustrates the skill requirement for each methodology.
Table 7-1 Skills required for each methodology (p.t. = part time)
Skill / Discipline S-RCM S-RBI IPF

Technologist (p.t)
Process safety
Operations
Process control technologist
Instrument engineer (p.t)
Electrical engineer (p.t.)
Mechanical engineer (p.t.) (p.t.) (p.t.)
Plant Inspector (p.t.)
Materials/Corrosion engineer
Mechanical technician (p.t.)
Instrument technician (p.t.)
Electrical technician (p.t.)
7.3 Task Harmonisation

The outputs from an RRM analysis include the chosen maintenance and monitoring tasks for
different items of plant equipment. Some equipment may have been analysed by more than one
methodology. In addition, the maintenance plan of a specific piece of equipment may have
implications for maintenance of equipment connected or related to this one. It is therefore
important to harmonise and review all tasks once multiple studies have been completed before
entering it into a MMS. Such a harmonisation step could include the following actions:
• To rationalise and align frequencies of tasks of a particular item that has been analysed with
different methodologies. This will make maintenance more efficient and will ensure minimal
interruption to item operation.
• To align the interval of major overhauls and shutdown inspections of equipments that belong to
the same unit.
• When analysing an item, sometimes, certain assumptions on maintenance and reliability of
connected equipment has to be made. These assumptions should be verified in this step. This is
particular true for IPFs, which rely on the correct working of, for instance, non-return valves
(NRV) and pressure relief valves (PRV).
• To check whether all relevant equipment has been analysed.
To achieve optimum reliability, in addition to the planned maintenance tasks, it is also necessary to
have procedures and policies in place for installation, start-up, shutdown and restoration of
equipment.

7.4 Maintenance Management System (MMS)

Once a maintenance task is chosen, it needs to be managed through an MMS and it is important to
take the time to schedule RRM maintenance tasks effectively. For instance, the time taken to
schedule S-RCM tasks into the MMS can take from 25% to 100% of the S-RCM analysis time,
depending on how state-of-the-art the MMS is. There are a variety of MMSs in use within
refineries today. Whether they are manual, electronic or a combination, the basic workflow should
be similar.
This Section will describe a typical MMS workflow designed to ensure timely execution of
maintenance tasks, test schedules and the recording of essential history.
7.4.1 Origin of work

Work can originate from a number sources; reactive (breakdown or run-to-failure), scheduled and
discovered tasks. Discovered tasks are the result of scheduled inspection or monitoring tasks.
Figure 7-1 is a simplified flow diagram of the process.
RRM analysis Review / feedback
Discovered tasks Execute tasks
Scheduled tasks
Planning in MMS
Reactive tasks
Figure 7-1 MMS work flow diagram
7.4.2 Acceptance of work

With the exception of minor breakdown work, which can normally be remedied by the person who
discovered the failure, all maintenance tasks should be managed in the MMS. Major breakdown
tasks should be jointly challenged for validity by maintenance and operations. All scheduled tasks,
which are the result of an RRM analysis are valid and should be accepted by definition.
Work that has been discovered as part of an inspection routine enters the workflow at a different
point. The essential difference is that the relevant engineer is responsible for assessing the impact
of the task and accepting or rejecting it.
Once a task has been accepted, it goes into the planning process. At this stage some tasks may be
deferred to the next shutdown. The work plan is then produced and executed.
7.5 Asset Information Management (AIM)

In the context of RRM, an AIM system manages the information in the relevant database(s) and
any revisions to the data. The database(s) should typically store equipment performance history,
process data, design data, integrity operating windows and IPF classifications.
In addition, the database(s) should store input information required for all the RRM methodologies
and the analysis output. This will allow common information and outputs to be used in all

methodologies and reduce the need for repetitive work. Table 7-2 illustrates where information and
outputs are common to all methodologies.
Ideally, a single RRM database should be established and structured for the 3 methodologies.
Table 7-2 Comparison of information between the methodologies

Inputs S-RCM S-RBI IPF
Equipment lists
Equipment history
Process flow schemes
Process engineering flow schemes (PEFSs)
Safeguarding memorandum
Safeguarding and control narratives
Cause and effect matrix
Process safeguarding flow schemes (PSFs)
Materials Engineering Philosophy (MEP)
Materials Selection Schemes
Inspection results
Operating Conditions
Outputs
Failure probability
Failure rate
Consequence of failure
Maintenance plan
Inspection plan
Frequency and scope of tests

7.5.1 Type of information to record

When a task is closed out, the following information should be recorded in the relevant database:
• condition of equipment at the start of the repair task (including fouling status when applicable);
• the type of repair executed (may be in the form of a code);
• material, contracts and labour costs (may be part of Finance, Contracting and Procurement
(FCP) module);
• spare parts used;
• the results from scheduled tests.
When a S-RBI event is completed, either monitoring, NDT or inspection, the following
information should be recorded:
• deviations from an agreed operating condition;
• unexpected degradation;
• discovered work.
7.5.2 Executive Information System (EIS)

The information managed by an AIM system can be used by an executive information system
(EIS) to analyse equipment performance by trends, maintenance costs and availability. This
information should be in a hierarchical format, drilling down through site, unit, plant and
individual equipment performance levels.
In order to improve equipment performance it is necessary to set realistic improvement targets and
to review and publish these targets against actuals on a regular basis.
7.6 Initiating a review

From time to time it will be necessary to check the validity of the various analyses. The main
reason for a review is the availability of new information, e.g. obtained during a shutdown. It can
also be needed for a variety of other reasons, including unexpected degradation mechanisms and,
as optimum maintenance is achieved, reliability improvements. Significant changes from the
original premise, including plant changes, will influence the results of the analyses in S-RCM,
S-RBI and IPF.
The validity of the analysis for all methodologies is dependent on process conditions remaining
within defined limits. Significant deviations from these limits over a defined period of time can
undermine the maintenance and inspection strategies derived from the analysis.
It is strongly recommended to establish a monitoring procedure/system for operating/process
conditions to give an early warning to the maintenance and inspection engineer responsible for the
review of the RRM analysis. Systems currently in operation have been developed specifically to
assure static equipment integrity by monitoring process parameters in order to confirm inspection
planning. Depending on the systems available, the scope can be extended by complimenting
condition monitoring, used as part of the maintenance plan.
It is not the intention to apply integrity monitoring to every measured process parameter.
Typically, 5% of static equipment will require integrity monitoring windows. The advantages of
this process are:
• increased confidence in the predicted degradation mechanisms;
• reduced inspection scope through focused inspection;
• confirmation of optimum inspection schedules;
• increased operations awareness of integrity issues.
Once an integrity management system has been established, it can be readily extended to produce
executive information, specific performance monitoring and management of critical product
quality parameters.

For S-RCM and IPF a review should also be initiated once measured failure rates/MTBF deviates
from the values in the specific analysis. The best practice is to establish performance indicators
with a set target based on the expectations of the initial analysis. Thus regular updating of these
performance indicators not only allows trending of reliability improvement initiatives but can also
be used to trigger a review.

8. REFERENCES
1. Shell Reliability Centred Maintenance, OP 97-30100, H.C. van Iersel and M.C.J. van Pul.
2. S-RBI Manual - Guidelines for Risk-Based Inspection, OP 97-30007, M.M. Festen and
M.H. Ravestein.
3. Management of Maintenance and Reliability: Best Practices Guidelines, OP 96-30333,
O.L.F. Oey
4. Maintenance Management Guidelines, OP 98-30021, M.C. Das and O.L.F. Oey
5. Inspection Management Guidelines, MF 95-0920, G.J. Lutje Schipholt and T.J. Alberda
6. Risk Assessment Matrix 2/96, HSE 029, Shell Health, Safety and Environment Committee.
7. FRED user manual, version 2.3, OP 97-47088, A.J. Carsley and M.S.P. de Groot
8. Reliability-centred Maintenance, John Moubray, 2nd ed. Butterworth-Heinemann.
9. Maintenance Strategy Review, 3806-004A (Shell UK Expro), V. Narayan
10. Materials Engineering in Projects, OP.98.30320, K.R. Lewis.
11. Base Resource Document on Risk Based Inspection (Revision March 1997), API Publication
581, American Petroleum Institute
12. Materials Degradation Library, OGBM/0354/98, SIOP-OGBM
13. Non-Destructive Testing Handbook, MF 95-1233, SIOP-OGBM
14. Reference manual for the periodic inspection of static mechanical equipment, OP 98-30320,
T.J. Alberda
15. Chemical plant and petroleum refinery piping, ANSI/ASME B31.3, American Society of
Mechanical Engineers
16. Gas Transmission and distribution piping systems, ANSI/ASME B31.8, American Society of
Mechanical Engineers
17. Boilers and Pressure Vessels - In-service inspection, AS 3788 - 1996, Australian Standard
18. Control Technology; Fundamental Safety Aspects to be considered for Measurement and
Control Equipment, DIN V 19250, German Standard
19. Functional safety of safety-related systems, parts 1-7, IEC/SC65A draft 61508, International
Electrotechnical Commission
20. Risk & Reliability Management - Revised IPF validation, OP.98.30433, J.A.M. Wiegerinck
and P.B.J. van de Camp
21. Instrumentation for Ultimate Safeguarding Protection - Philosophy and Application
Guidelines, EP 95-1745, SIPM EPD/42.

Appendices have been intentionally removed.

RRM Manual

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

RRM Manual

Uploaded by

Copyright:

Available Formats

CONFIDENTIAL September 1999

Risk and Reliability Management (RRM)

This document is for scope of work assessment only.

SHELL INTERNATIONAL OIL PRODUCTS B.V.

2. RISK AND RELIABILITY MANAGEMENT (RRM).................................................... 7

3. CONSEQUENCE OF FAILURE ASSESSMENT ......................................................... 13

4. RELIABILITY CENTRED MAINTENANCE (S-RCM).............................................. 17

5. RISK BASED INSPECTION (S-RBI)............................................................................. 19

6. INSTRUMENTED PROTECTIVE FUNCTIONS (IPF) .............................................. 35

7. RRM IMPLEMENTATION ............................................................................................ 37

Page 2  Shell Global Solutions RRM Manual

RRM Manual  Shell Global Solutions Page 3

RRM Manual  Shell Global Solutions Page 5

2. RISK AND RELIABILITY MANAGEMENT (RRM)

Figure 2-1 Deliverables of RRM

RRM brings a consistent methodology of risk assessment to maintenance, inspection and

RRM Manual  Shell Global Solutions Page 7

• Maintenance costs reduced.

2.2 Overview of RRM

Figure 2-2 The main steps of the RRM process

Page 8  Shell Global Solutions RRM Manual

RRM Manual  Shell Global Solutions Page 9

Task selection and planning

2.3 Criticality Assessment

no/slight damage minor damage local damage major damage extensive

(<10k) (10-100k) (0.1-1m) (1-10m) damage (>10m)

CONSEQUENCE CLASS NEGLIGIBLE LOW MEDIUM HIGH EXTREME

RRM Manual  Shell Global Solutions Page 11

3. CONSEQUENCE OF FAILURE ASSESSMENT

Consequence severity range

RRM Manual  Shell Global Solutions Page 13

Three levels of consequence assessment are available in RRM:

3.2 Economic Consequences

N Slight damage No disruption to operation

3.3 Health and Safety Consequences

Page 14  Shell Global Solutions RRM Manual

Class Potential Impact Description

3.4 Environment Consequences

RRM Manual  Shell Global Solutions Page 15

3.5 Usage and Limitations

Page 16  Shell Global Solutions RRM Manual

4. RELIABILITY CENTRED MAINTENANCE (S-RCM)

RRM Manual  Shell Global Solutions Page 17

5. RISK BASED INSPECTION (S-RBI)

RRM Manual  Shell Global Solutions Page 19

• Increased reliability and therefore increased safety and availability

5.2 Overview of the S-RBI methodology

Corrosion Loop Analysis /Review

Figure 5-1 The main steps of the S-RBI process

5.2.1 Asset Integrity Database

Page 20  Shell Global Solutions RRM Manual

5.2.2 Criticality Assessment

no/slight damage minor damage local damage major damage extensive

(<10k) (10-100k) (0.1-1m) (1-10m) damage (>10m)

CONSEQUENCE CLASS NEGLIGIBLE LOW MEDIUM HIGH EXTREME

5.2.2.2 Susceptibility to Failure (StF)

RRM Manual  Shell Global Solutions Page 21

For non-age-related degradation mechanisms it is not usually possible to estimate a Remnant

5.2.2.3 Consequence of Failure (CoF)

5.2.3 Confidence Rating

5.2.4 Inspection Planning

5.2.5 Execution of Inspection and Maintenance

5.3 RBI-specific data collection