RBI: probability, consequence, and the matrix

Every site has more equipment than inspection budget, and the question is not whether to prioritize but how to defend the priority. Risk-based inspection answers that by ranking equipment on the product of two estimates: how likely it is to fail, and how bad the failure would be. API 580 sets out the principles a program must follow. API 581 provides one methodology for computing the numbers. The matrix that results looks simple. What sits behind each cell is a set of judgements about damage mechanisms, corrosion rates, inspection history, fluid inventory and location, each of which must be recorded well enough to be reassessed when something changes. This paper explains what goes into probability, what goes into consequence, how the matrix is used, and where programs go wrong.

What is risk-based inspection under API 580?

API 580 defines RBI as a risk assessment and management process focused on loss of containment of pressurized equipment due to material deterioration. The recommended practice sets minimum elements for a program:

• A defined scope and team with the required competencies.
• Data collection, including design, process, inspection history and failure data.
• Identification of damage mechanisms and failure modes (API 571 is the reference for mechanisms in refining and petrochemical service).
• Assessment of probability of failure and consequence of failure.
• Risk determination, ranking and evaluation against acceptable levels.
• An inspection plan derived from the risk, with other mitigation where inspection alone is insufficient.
• Reassessment when conditions change and at defined intervals.
• Roles, responsibilities, training and documentation.

Risk is probability times consequence. The assessment can be qualitative (expert ranking against criteria), semi-quantitative (scored scales combined on a matrix) or quantitative (API 581 damage factors, generic failure frequencies and consequence area or financial models). Most programs run semi-quantitative screening across the whole population and reserve quantitative work for high-risk or borderline items.

The standard is explicit that RBI is not a way to inspect less. It is a way to inspect where it matters, which sometimes means more inspection on items that a calendar program was treating lightly.

How is probability of failure built?

Probability of failure asks: given the damage mechanisms acting on this item, the rate at which they act, and what we know from inspection, how likely is a loss of containment in the period considered?

In API 581 the structure is a generic failure frequency for the equipment type, multiplied by a damage factor that reflects the damage state, multiplied by a management systems factor. The damage factor is where the engineering lives:

• Thinning. Driven by the corrosion rate and the time since the last thickness inspection, relative to the thickness available above tMin. The factor also depends on how many inspections have been done and how effective each was at finding thinning.
• Stress corrosion cracking. Driven by susceptibility (material, environment, temperature, stress) and inspection effectiveness for cracking, which is a different technique set than for thinning.
• External damage including corrosion under insulation, keyed to the temperature range, environment and coating and insulation condition.
• High temperature hydrogen attack, brittle fracture, fatigue, creep and others, each with its own susceptibility logic.

Inspection effectiveness matters as much as the reading. API 581 assigns each past inspection a category from highly effective to ineffective for the mechanism in question. Two vessels with identical last readings can carry very different probabilities if one has three highly effective internal inspections in its history and the other has one external visual. Uncertainty is probability.

In a semi-quantitative scheme the same logic is compressed to a scored scale, commonly 1 to 5: the mechanisms present, the corrosion rate relative to the remaining wall, the time since inspection, and the confidence in the data each move the score. The scoring criteria must be written down, because the score is only defensible if two engineers applying the criteria to the same record get the same number.

How is consequence of failure built?

Consequence asks: if this item loses containment, what happens? API 581 provides two models.

• Area-based consequence estimates the release (fluid, phase, inventory available, hole size distribution), its behavior (flammable, toxic, both), and the area affected by fire, explosion or toxic exposure. The result is an area, which stands in for people and equipment at risk.
• Financial consequence adds equipment damage, production loss from the outage, environmental cleanup and personnel injury cost.

The inputs that move consequence most are the fluid (its flammability and toxicity), the inventory that can be released before isolation, the operating pressure and temperature (which govern release rate and phase), detection and isolation systems, and location relative to people and other equipment. Consequence changes rarely: a process change, an inventory change, a new control room location, a new isolation valve. Otherwise it is stable across reassessments, which is why programs that recompute probability every inspection can leave consequence alone until something in the plant changes.

The semi-quantitative version scores consequence 1 to 5 on the same kinds of criteria: fluid hazard class, inventory band, pressure band, proximity to occupied areas, and business interruption. As with probability, the criteria are written, and the score is traceable to the inputs.

How is the risk matrix used to plan inspection?

The matrix places each item by its probability score and consequence score. A 5 by 5 matrix is common, with risk bands (low, medium, medium-high, high) drawn across it. The bands drive the plan:

• High risk items get the most effective inspection for their dominant mechanism at the shortest interval, plus consideration of mitigation that reduces probability (a coating, an inhibitor, a material change) or consequence (inventory reduction, isolation).
• Medium risk items get inspection planned to bring probability down, typically by improving effectiveness (an internal inspection where the history is all external, for example).
• Low risk items may run to the standard's maximum interval, or have their monitoring reduced under the provisions API 570 and API 510 allow.

The inspection plan is the output that matters: for each item, what damage mechanisms are being inspected for, what technique achieves the required effectiveness, where on the item, and when. A ranking without a plan is a chart. A plan the field cannot execute (a technique the site does not have, a location that requires a shutdown the schedule does not include) is a wish.

API 510 and API 570 permit intervals set by a documented RBI assessment in place of the half-life rule, provided the assessment follows API 580 and is reassessed at the interval the standards specify and whenever inputs change. The inspection date that comes out of RBI is therefore only as good as the reassessment discipline behind it.

Where do RBI programs go wrong?

The failures are consistent across sites:

• Inputs from memory. Corrosion rates typed into the RBI tool rather than read from the CML history, so the assessment and the record disagree.
• Consequence inflated or deflated to reach a target. A matrix cell chosen first and inputs adjusted to land there.
• Inspection effectiveness overstated. An external visual recorded as an effective inspection for internal thinning.
• No reassessment trigger. A process change, a finding or a repair that should have moved the score, and did not, because no one was notified.
• Interval extended, plan not executed. RBI set a longer interval; the planned inspection with the required effectiveness was then descoped in the turnaround, leaving the extension without its basis.
• Assessment not attached to the equipment. The RBI results live in a separate tool, and the inspector planning the next turnaround cannot see why the interval is what it is.
• Scoring criteria undocumented. Two engineers, two scores, no way to reconcile them.

Each is a record problem before it is an engineering problem. The assessment must be attached to the equipment record it assesses, draw its inputs from that record, and be visible to the person who plans and executes the inspection it produced.

How intelliSPEC handles it

intelliINTEGRITY provides API 580 and API 581 semi-quantitative RBI scoring: probability times consequence, ranked 1 to 5, computed against the equipment record rather than a separate spreadsheet. The inputs are already there. Damage mechanisms (thinning, cracking) are first-class records on the equipment. Each CML carries nominal thickness, tMin and its method, latest thickness and three corrosion rates, with the maximum governing by default. tMin routes by equipment type to ASME B31.3, ASME Section VIII Division 1 or API 653 and returns the code and formula with the number. Remaining life and the API 510 or API 570 half-life interval are computed alongside, so a reviewer can see what the RBI interval is replacing. Every result is provisional until an engineer verifies it, and the product never auto-derates equipment. API 579 Part 5 Level 1 is deliberately not implemented pending licensed-engineer verification.

The asset graph (company, site, facility, asset, component, weld) places each assessed item in its hierarchy, and node-level data entitlement controls who can see and change assessments. Inspection execution in intelliINSPECT and intelliNDT writes to the same record, so the effectiveness claimed for an inspection can be checked against the technique and technician qualification actually recorded. Completed records pin the configuration they were executed with, and every change to a score or an input lands on a hash-chained audit trail with actor, time and reason, which is the reassessment trail an auditor asks for. Spectra can answer a question such as which items moved risk band since the last assessment, and every answer cites the source record. Terms used here are defined in the glossary.