Running an RBI assessment — from data to an inspection plan that happens

By the time an assessment runs, the thinking has already been done: the corrosion loops and circuits are drawn, the damage mechanisms are named, the CMLs are placed and the baseline readings are in.

What remains is to turn that into two numbers per component, and then into work that actually happens. The second part is where programmes fail.

Probability of failure

Probability follows from three things: what can damage this item, how fast that damage is progressing against the thickness available, and how well the damage state is actually known.

Note what is absent. Age is not an input. A thirty-year-old line in benign service may be in better condition than a five-year-old one carrying wet chlorides, and an assessment driven by age would get both wrong.

Consequence of failure

Consequence asks what happens if this item releases its contents — measured across personnel injury, business interruption and environmental harm.

Two inputs dominate, and neither is a property of the item itself.

An opened pressure vessel manway during a turnaround, the heavy bolted cover swung aside on its davit arm with the gasket face exposed, scaffolding erected around the vessel, a string of inspection lights hung inside and yellow ventilation ducting running in through the opening. — This is what a recommendation costs once it reaches a turnaround: scaffolding, isolation, purging, ventilation, lighting and an entry permit. Which is why the assessment has to be right about whether it was needed.

What inspection actually changes

Inspection effectiveness categoriesSource: Structured after API RP 581. The category depends on the method, the coverage and whether the technique actually detects the mechanism in question — all three, not just the method.


Highly effective	Correctly identifies the true damage state in nearly every case	Extensive automated ultrasonic scanning with high coverage of the susceptible area
Usually effective	Correctly identifies the true damage state most of the time	A substantial grid of manual ultrasonic readings covering the areas of concern
Fairly effective	Correctly identifies the true damage state about half the time	A limited set of spot readings at nominated monitoring locations
Poorly effective	Provides little information about the true damage state	External visual inspection only, on a line whose damage is internal
Ineffective	Provides no useful information about this mechanism at all	Thickness readings on a line whose credible mechanism is stress corrosion cracking

Effectiveness describes how much the inspection reduces uncertainty about the damage state. A highly effective inspection for one mechanism can be useless for another, so the category is always assigned against a named damage mechanism.

And effectiveness is always against a named mechanism. A dense thickness grid is powerful evidence about general thinning and tells you essentially nothing about stress corrosion cracking. Recording an inspection as “highly effective” without saying what it was effective for is how a cracking mechanism ends up marked as well covered by a survey that could never have found it.

Ranking, and what the matrix is for

A five by five risk matrix with probability of failure on one axis and consequence of failure on the other, bands shaded from low risk in the lower left through medium to high risk in the upper right, with plotted points representing assessed components. — The matrix is a way of ordering work, not a verdict. Two items in the same box can need entirely different responses — one because it is likely to leak, the other because it would matter enormously if it did.

The position tells you why an item is where it is, and that governs the response. High probability with modest consequence is an inspection and repair problem. Low probability with severe consequence is usually a detection, isolation or inventory problem, and no amount of inspection will move it far.

Recommendations, and the step that gets skipped

The assessment produces recommendations: what to inspect, by which method, over what extent, and by when.

Risk is reduced by inspecting, repairing, isolating or changing something. Assessing reduces nothing. A study whose recommendations are not implemented has consumed budget and delivered no integrity benefit whatever.

Updates and revalidations

An assessment is a snapshot of the data available on the day it ran.

It is re-run when the inputs change: new thickness readings, a feed or throughput change, a modification through management of change, an incident or leak, an IOW exceedance, or simply the elapse of the review period.

What to take away

Probability comes from mechanism, rate and confidence in the damage state — not from age.
Consequence is dominated by the inventory group and the detection and isolation time, neither of which is a property of the item.
Inspection reduces uncertainty, not damage. Diligent inspection with no repair has not reduced risk.
Effectiveness is assigned against a named mechanism, or it means nothing.
The matrix orders work; why an item sits where it does decides the response.
Programmes fail at converting recommendations into owned, scheduled tasks and at feeding results back.
Update it, and revalidate it. An assessment that is never re-run describes the plant as it used to be.