Mechanical integrity and inspection

Most major process accidents end in a loss of containment: something that should have held the hazardous material inside failed. Vessels, piping, tanks, relief devices, pumps, instruments and emergency shutdown systems all deteriorate with time and use. Mechanical integrity is the part of process safety management that keeps this equipment fit for service through design, inspection, testing, maintenance and repair. This lesson explains common damage mechanisms, how inspection programs are planned, how remaining life and inspection intervals are estimated, and how deficiencies are handled. It draws on two accidents investigated by the US Chemical Safety Board, at Tesoro Anacortes in 2010 and at Chevron Richmond in 2012.

Which equipment is covered

A mechanical integrity program covers equipment whose failure could cause or fail to prevent a major accident. The list usually includes pressure vessels and storage tanks, piping systems and their components, relief and vent systems, emergency shutdown systems, controls including monitoring devices, sensors, alarms and interlocks, and pumps and compressors. Each item needs written procedures for inspection, testing and maintenance, trained people to do the work, and records of what was found.

In the United States, OSHA PSM at 29 CFR 1910.119(j) requires a mechanical integrity program for covered equipment, with written procedures, training, inspection and testing that follow recognized and generally accepted good engineering practices (RAGAGEP), documentation, correction of deficiencies before further use or in a safe and timely manner, and quality assurance for new equipment and spare parts. Most states adopt the ASME Boiler and Pressure Vessel Code and the National Board Inspection Code (NBIC) for boilers and pressure vessels. Pipelines fall under the Pipeline and Hazardous Materials Safety Administration (PHMSA), which has its own integrity management rules.

Damage mechanisms

Inspection is only useful if inspectors know what to look for and where. Damage mechanisms depend on the material, the fluid, the temperature, the pressure and the history of the equipment. API RP 571 describes more than 60 mechanisms affecting equipment in the refining and petrochemical industry. A few common ones are summarized below.

Two accidents

On 2 April 2010, a heat exchanger in the naphtha hydrotreater unit at the Tesoro refinery in Anacortes, Washington, ruptured during a startup step. The release of hydrogen and naphtha ignited and killed seven workers. The CSB found that the exchanger had been weakened by high temperature hydrogen attack. The carbon steel exchanger had been operating in conditions where HTHA was possible, and industry guidance for avoiding it, the Nelson curves in API RP 941, had been shown by incidents to be unreliable for carbon steel. The CSB also noted that the exchangers had a history of leaks during startup that workers had come to see as normal.

On 6 August 2012, a pipe carrying hot light gas oil in the crude unit at the Chevron refinery in Richmond, California, ruptured because of sulfidation corrosion. The pipe had thinned severely, particularly in sections of low-silicon carbon steel, which corrodes much faster in sulfidation service. The released oil formed a large vapor cloud that ignited; 19 workers escaped the cloud, and around 15,000 people from the surrounding community sought medical treatment. The CSB found that recommendations to inspect every component of the line, or to upgrade to more resistant alloy, had been made over the years but not acted on, and that inspection points had missed the thinnest components.

Planning inspections

Inspection programs used to be based on fixed time intervals. Modern programs increasingly use risk-based inspection (RBI), which ranks equipment by the probability of failure, from its damage mechanisms and condition, and the consequence of failure, from the fluid, inventory and location. High-risk items are inspected more often and with methods suited to the expected damage; low-risk items less often. API RP 580 sets out the principles of RBI, and API RP 581 gives a quantitative method. Inspection codes such as API 510 for pressure vessels, API 570 for piping and API 653 for aboveground storage tanks set rules for inspection, repair and alteration in the oil and petrochemical sectors.

Corrosion rate, remaining life and inspection interval

Thickness measurements taken at the same points over time give a corrosion rate. The minimum required thickness, from the design code and the operating pressure, sets the limit. The remaining life is the margin above minimum divided by the corrosion rate.

A common rule in inspection codes such as API 510 and API 570 is that the next inspection should take place at no more than half the remaining life, subject to maximum intervals. This leaves time for at least one more measurement before the limit is reached, so that an unexpected increase in corrosion rate can be caught.

# Corrosion rate, remaining life and inspection interval for a piping circuit (seeded data).
import random
random.seed(311)
years = list(range(2016, 2027, 2))
true_rate = 0.19   # mm/yr
t0 = 9.5
readings = [round(t0 - true_rate * (y - years[0]) + random.gauss(0, 0.05), 2) for y in years]
for y, t in zip(years, readings):
    print(f"{y}: {t:.2f} mm")

# Long-term rate from first and last readings, short-term rate from the last two
lt_rate = (readings[0] - readings[-1]) / (years[-1] - years[0])
st_rate = (readings[-2] - readings[-1]) / (years[-1] - years[-2])
rate = max(lt_rate, st_rate)        # use the more conservative rate
t_min = 5.0
remaining = (readings[-1] - t_min) / rate
print(f"Long-term rate {lt_rate:.3f} mm/yr, short-term rate {st_rate:.3f} mm/yr")
print(f"Remaining life {remaining:.1f} years using {rate:.3f} mm/yr")
print(f"Next inspection no later than {years[-1] + remaining / 2:.1f}")

2016: 9.52 mm
2018: 9.09 mm
2020: 8.79 mm
2022: 8.38 mm
2024: 8.01 mm
2026: 7.59 mm
Long-term rate 0.193 mm/yr, short-term rate 0.210 mm/yr
Remaining life 12.3 years using 0.210 mm/yr
Next inspection no later than 2032.2

Using the higher of the long-term and short-term rates is a conservative choice that guards against an accelerating trend. The calculation is only as good as the inspection locations: if the thinnest point is never measured, as at Chevron Richmond, the remaining life will be overestimated.

Deficiencies, quality assurance and the integrity operating window

When an inspection finds equipment outside acceptable limits, the deficiency must be corrected before further use, or the equipment must be operated under documented temporary measures that keep it safe until repair, such as a lower pressure limit and more frequent monitoring. Quality assurance makes sure that new equipment, spare parts and repairs are suitable for the service: for example, positive material identification to catch a carbon steel fitting installed in an alloy line. Integrity operating windows (IOWs) set limits on process variables, such as temperature, pH or chloride content, beyond which damage accelerates. Exceeding an IOW should trigger an alert to the integrity engineer, not only to operations, because the damage may not be visible until much later.

# Flag integrity operating window excursions in a day of hourly readings (seeded data).
import random
random.seed(11)
limits = {"outlet temperature C": (None, 345.0), "wash water pH": (6.0, 8.5)}
temps = [random.gauss(341, 3) for _ in range(24)]
ph = [random.gauss(7.2, 0.7) for _ in range(24)]
for name, series in [("outlet temperature C", temps), ("wash water pH", ph)]:
    lo, hi = limits[name]
    bad = [(h, v) for h, v in enumerate(series)
           if (lo is not None and v < lo) or (hi is not None and v > hi)]
    print(f"{name}: {len(bad)} excursion hours")
    for h, v in bad:
        print(f"   hour {h:02d}: {v:.1f}")

outlet temperature C: 2 excursion hours
   hour 12: 345.6
   hour 16: 348.7
wash water pH: 2 excursion hours
   hour 04: 5.9
   hour 12: 9.5

Who does mechanical integrity work

Mechanical integrity depends on several groups working together. Inspectors, often certified under schemes such as the API individual certification programs or provincial and state inspector licensing, plan and carry out inspections and judge fitness for service. Maintenance technicians repair and test equipment, and need training in the procedures for the equipment they work on. Integrity or corrosion engineers set inspection strategies, review damage mechanisms and integrity operating windows, and approve deferrals. Operators are often the first to notice leaks, vibration or abnormal conditions, and their observations should feed into the program. Clear roles, and a single system for recording findings and tracking actions, stop deficiencies falling between these groups.