General Meeting Presentation Feature:
Assuring Safety with Focused Integrity: A Well-Run Pressure Equipment Integrity Program
Assures Safety, Environmental Stewardship, and the Right to Operate
The following presentation was delivered at the 79th General Meeting Monday afternoon session, May 3rd, by Tom Wylie and Steve Roberts, representatives of Shell Global Solutions.
Mr. Wylie is an asset integrity engineer working from Shell's Westhollow Technology Center in Houston. His career at Shell has spanned over 30 years, primarily in the fields of inspection and integrity management. During his first 20 years, he held inspection engineering and management roles at five different refineries and chemical plants in the United States and Saudi Arabia.
Mr. Roberts is a senior standards engineer for Shell and a registered professional engineer in the state of Texas. Fifteen of his twenty years of professional experience have involved pressure vessels. A member of the Texas Boiler Board from 2001 to 2006, Mr. Roberts has been active for over ten years on ASME's Boiler and Pressure Vessel Committee as Chairman of Section Vlll's Subgroup General Requirements. Additionally he is a member of ASME's Subgroup Design for Section Vlll as well as Section Vlll's Standards Committees. In 2008 he was named an ASME Fellow.
MR. ROBERTS: Thank you for the opportunity to come discuss how we believe a well-run pressure equipment integrity management program will help refining operators remove assumptions about their assets and replace them with a level of assurance, and this level of assurance can translate to the general public and give them a safe feeling about refineries operating in their communities.
One assumption my colleague and I do want to make today, however, is that material we present is of general information only. We are offering no specific advice on the topic at hand. Now, of course, a major part of all refining operations is pressure-retaining equipment. Pressure vessels, piping, heat exchangers, and similar equipment make up for millions of dollars of investment in a single refinery, and as such it's of vital importance to keep these assets operating well.
A well-run pressure equipment integrity program can even raise the level of performance of these assets and can enhance operation of a refinery. But it's not just enhancement in production. It's enhancement in critical areas such as safety, environmental performance, and the so-called right to operate that translates to the general public a better feeling about operating a refinery in their community. There is no doubt about need for energy in today’s world. It's what drives our nation.
The oil, gasoline, and other fuels coming from energy are vital to our everyday life, as well as the derivatives coming from oil to provide chemicals that go into the manufacture of a variety of products we use. Chemicals are used in different products for personal care; they are used in products and manufactured goods that go into automobiles and household goods. Energy is used to warm us on cold winter days. Energy is used to cool us in the hot Texas suns. Energy, and we believe particularly oil, is going to drive our country for the future for many years to come.
What does this mean to us today? Let's take a quick look at refining capacity. By spending a bit of time at the U.S. Energy's website on energy information administration, I found there are 17.6 million barrels of oil per day refined in the U.S. as of 2008. A little bit deeper digging and I found Canada was doing about 3.4 million barrels of oil at the same time. Now, out of this U.S. production, 43 percent comes from just five operators: Exxon Mobil, Conoco-Phillips, Shell, BP and Chevron. 43 percent.
What this means is there has been a drop in the amount of refineries from 1981 at a peak of 324, but only 5 percent reduction in production of oil. It went from 18.6 million barrels a day down to just 17.6 million barrels per day. Likewise, utilization of refineries has gone from 66 percent all the way above 86 percent in that same time frame. We believe asset integrity has played a critical role in helping us do more with less. But production is just part of the story. There are other critical things owners have to keep in consideration today: community safety; employee safety; environmental stewardship; and legislative requirements we have to deal with, such as in the United States the OSHA PSM laws.
All of these are critical factors facing refining operators today, and we believe these factors epitomize need for asset integrity. So what is asset integrity? It's an overall management program covering design, construction, maintenance, inspection, and repair of assets in accordance with recognized and generally-accepted good engineering practices (what all of us know as RAGAGEP).
What does it do for us? Why is it important? It reduces downtime, but more importantly it reduces downtime because it reduces asset damage—asset damage coming from different types of damage mechanisms. By reducing harm associated with damage mechanisms, it can stop loss of containment. By stopping loss of containment, you avoid spills. By avoiding spills, you avoid environmental damage. It also helps avoid fires. It avoids explosions. It avoids potential injuries that can happen both inside the refinery and outside the refinery.
There is a lot riding on a good quality asset management program. And I think it's going to behoove us to take a look at this in depth today. So for that I'm going to turn the program over to Mr. Tom Wylie who, as you heard, is an advisor to Shell Global Solutions. He's one of our most trusted asset integrity engineers.
MR. WYLIE: We are going to cover basically five points that comprise what we will call an asset integrity program (in terms of asset integrity management). The first one we’ll touch on today is fabrication integrity.
How we build equipment comes down to design and construction. We will look at maintaining asset integrity through application of design standards and construction codes, as well as our own company standards and specs we use to build equipment. Typically in our industry, design standards are ASME and other special standards for other equipment we may use. Fabricators we will use go through our program. We look for ASME-certified shops but also there is an internal program we use to qualify people or choose fabricators both from a commercial standpoint, but also from a technical standpoint.
I want to talk about the following areas—first, personnel in the inspection process. This may be a little different than you are used to thinking about from the inspection standpoint. Second, typical inspection activities we perform today in this industry (and this is going to deal with a different twist than we have done in the past). And finally, inspection planning and how it is changing now versus what we have done in the past. We'll also talk a little bit on inspection data management and why it’s more important today than in the past.
First is personnel in the inspection process. Typically when we talk about inspection, we talk about inspectors—the guys in the field who do the work, come back, and read records. It’s a key part of the inspection process in an operating facility. Another key part in today’s world is corrosion materials engineering specialists. Operations and process engineering folks actually have a role in inspection; a stronger role than they probably had in the past. And you must have management personnel support to have a strong inspection program. Maintenance involvement helps support inspection activities. Examples are procurement, such as purchasing the right materials, positive show of identification, and control of materials in the warehouse. Last but not least are NE technicians. Those are the guys that oftentimes dive in the hole, get the readings, and get data we need to be able to make some kind of decision on integrity of the equipment.
There are other key players in addition to inspectors. Collectively, I call them the big four: inspectors, gross materials engineers, operations people, and the process engineer. We typically talk about field activities from an inspection standpoint; the nonintrusive inspections. We deal with external inspections so often. We also do on-stream inspections while equipment is in service. We can do more inspection on-stream than we might have done in the past, like thickness readings, with advances made in NDE. And then we have intrusive inspections where we take equipment out of service, isolate it, open it up, clean it, and do an actual visual inspection on the internal.
So field work is not that unusual. The point here is we are doing a lot more on-streams than we have in the past. From our office standpoint, I want to make that distinction. Data pool is key. The inspector's role is changing in the process industries from what it has been in the past. Inspectors retrieved a lot of data in the past, but nowadays inspectors have to do more data analysis. For example, they make sure they match their inspection plan to expected degradation.
When we went from paper records to computerized records, we thought more data is good data; right? So we would take a lot of data, but really, was it the right data? So part of the inspector's role is to take data, do some analysis (what does it really mean), but also determine if the data matches expected degradation.
Next is corrosion control monitoring. This is something we are trying to take to the next level in the process industries, where once you identify a degradation mechanism, you do a better job of monitoring variables affecting degradation, for example, to help determine predictable life of equipment. Corrosion control monitoring is of more emphasis.
Here are three types of inspection plans: time-based, condition-based, and risk-based. In the 1980s time-based meant we shut down a unit in an oil refinery. We opened all equipment and looked at everything to try and figure out problems. Now (and from the late '80s), we shifted to more condition-based—taking better thickness readings, computer predictions, etc.—and using that data to set an inspection interval based on remaining life, etc.
Risk-based is applied to set intervals to things like vessels, piping systems, heat exchanger bundles, and so on. Today we still use all three types of intervals. An example would be a boiler for a time based-interval; opening it up every so often, etc.
From an industry standpoint regarding risk-based inspection (RBI) we follow API 580, which is a document I call a 20,000-foot-level document. It lays out basic elements of what you do for a risk-based approach. You need certain participants and certain types of data; you have to work to understand the likelihoods of failure and consequence of failure.
API 580, from our industry's standpoint, is where elements of RBI are outlined. Even when you do a risk-based approach, you will still set an interval basis when you come back and send folks to perform an inspection. You still fit within any jurisdictional requirements, as those are obviously overriding from an RBI standpoint. But one reason we use it more today is we actually make better decisions. Picture this: we used to have an inspector sitting in his office, taking data, and saying, “the next time we do this type of inspection it will be in so many years,” but he's setting that in his world, in his office. He sets the interval and that sets the plan. To take a risk-based approach today means taking a team approach and that is what API 580 spells out. It goes back to the big four. Inspection, operations, process engineering, and corrosion materials all play a key part in setting inspection interval and deciding what happens with equipment.
Let's talk about some basic elements as to why the big four, why a multi-discipline team? What happens in an RBI process? In a case where we go through a processing unit and there are many different types of equipment, things change. As you take in the feed to the unit, it goes through some form of processing, heating, cooling, what have you. Product comes out at the end of the unit. But it goes through a series of changes. From an RBI standpoint you walk through a process from front to end. If you have a crude unit where oil comes in one end and kerosene goes out the other end, you have to go through the whole process and define degradation that will occur.
Different parts of the process have different forms of degradation, be it internal corrosion, localized-type corrosion you expect in certain parts, or generalized corrosion affecting other areas. The whole idea gets back to having the big four together to identify how you expect materials to corrode or degrade over time per each piece of equipment as you go through the cycle.
The second thing we do as part of RBI planning is review operating corrosion control limits and trends in operating data. It is not that different than having certain limits on your blowdowns and solids on a boiler. From a degradation standpoint we may have limits in terms of pressures or temperatures or in terms of salt content (it could be sulfur content in the feed, etc.). But different constraints or limits staying within those ranges help us predict corrosion. A key to risk-based approach is the ability to predict what's going to happen with degradation. When we go through the whole process we must review: operating corrosion control limits, where we have been operating, what's been going on, what's happening, how close we are to our limits, and have we been trending up within our ranges, because these affect degradation. Then translate it with the history from an operating standpoint into some form of information for our inspection interval.
So you can see through this process that operations people have to bring data to the table along with process engineers. It's not something inspectors are always going to have appreciation of or data to support. That's why those people become an important part of an RBI group to help set an inspection plan. I'm not keeping inspectors out of it. I'm an inspection guy myself. This is where I live. Through the course of a run we get inspection data; thickness readings, etc., to understand the condition of equipment. We open some equipment and do our internal inspection—it’s all important to relating to the condition of equipment as we go through the plant. Ultimately, you come down to probability of failure combined with consequence of failure.
Consequence of failure is not good, but it's just one part of the equation. An example I can give you would be if I had a 1,500-pound boiler and a 300-pound boiler. I'm going to have different consequences of failure if a tube blew out. Either scenario isn't good, but a 1,500-pound blow-out would typically be more serious. Probability of failure is something where we live with RBI—we talk about things that would affect probability of failure.
Let's just say I’ve done my inspection and looked at the inspection history. As I'm reviewing it, I expect an isolated localized corrosion and dead legs in my piping, for example, and I look at my inspection data and I say, “Well, all I have done is taken some spot ETs here and there on these dead legs, so I really don't have a lot of data to tie in my degradation to my equipment.” What do I do about probability of failure? I'm going to determine I don't have good data—I haven't done a good job inspecting. And what happens? Probability of failure goes up—the risk of my equation drives it up. When I tie that with my consequence, it should drive my action to address low or high probability of failure.
So what do we do? We go through this exercise, we’ve got the big four, and hopefully you can see how they all tie together to give us an inspection interval. You can see how the inspector's job changed, right? It's more than just reading inspection data or going around and taking thickness readings and saying, “Well, I'm going to do it again in a year.” You’ve got to get other folks involved to figure out what's really going on so you can set an interval. Once you’ve gone through an RBI analysis, you come out with how to manage risk. What am I going to do with results? There are three things an RBI analysis will generate.
You can do an inspection and set your interval for when you do your next inspection. Do I perform a nonintrusive and turn around with a planned shutdown of equipment—a planned event? Or do I have a shutdown? Say I find something and I have to shut down equipment and react to a problem. Or, can I do something different? Match degradation mechanisms to proper inspection technique. As I mentioned, we try to do more nonintrusive stuff with NDE equipment inservice. In today's world we can get a lot better information than we have in the past and we can do a good job of getting useful information nonintrusively.
So inspection is one answer. Another is process control. I talked about changes in feed quality. For example, if my sulfur content goes up, what can I do? I can adjust feed quality. That's another level you pull from an RBI analysis. There are other levels as well as other operating procedures, training, etc. And design change. We are coming into instances where, for example, you run a new feed and can't do much about expected degradation. It seems to be faster than expected. Maybe it's uneconomic; you have a heat exchanger bundle that only lasts a short period of time. So your decision will be to do something different. And then we fall back to design phase and come up with either a process change, material change, or building a new bundle. You can see how an RBI analysis drives you to look at a number of different ways to mitigate risk. It tends to result in a better decision because you’ve got more people involved and you’re not relying solely on an inspector getting data reactively and deciding what to do and then coming out and setting some inspection interval. From an RBI standpoint, the whole idea is better decision making and getting a better proactive handle on how we manage integrity over equipment.
Next: Inspection data management. Key is having a dedicated inspection management tool. Many companies use a maintenance management system like SAP. Inspection data should be kept separate and control away from another control inspection group so you have the ability to keep data pristine. The idea is to analyze data and predict the life. In a case where there is a little degradation rate/thinning corrosion over time, RBI would give an interval-based risk. RBI would predict a rate, just like you would do if you had a condition-based interval. The difference is that the inspection due date may change—it may be shorter or longer after your RBI analysis basis, type of input you had, and how certain you are of the likelihood of predicting the condition of the equipment.
Let's talk about the third component, fitness for service. If an inspection is conducted and something is found either expected or not expected—there are a number of ways to approach it. Say a destructive examination is a failure. You can look at a detailed failure analysis and all it entails. You can do a fitness for service, or decide if you can keep equipment in service, etc. Or if it’s an unexpected failure, you can do some form of investigation to understand the failure and hopefully learn from it.
A destructive examination is really in-depth. You look for a root cause to determine why the component failed. Oftentimes that can be anything from a detailed stress analysis damage examination. For example, if a nozzle failed, we call the inspector to tell him that it is broken and get help. But typically when we do failure analysis, we do things like field metallography. You can do field metallography in the lab. We do a lot in the field nowadays, actually. We will go outside to the equipment and use field metallography to get replicas and a closer peek at what's going on if we find a crack or something.
Typically, if we do fitness for service in the industry, it's going to be based on API 579. It's done at three different levels. First level is done in the plant. Second level may or may not be done in the plant if they have engineering facilities. Third level is where you kick it out to more of the specialists in a central office. Fitness for service (I call it sharpening the engineering pencil) is the ability to get more data, and we do a better job of predicting remaining life and condition of equipment if we continue to operate.
Another example here would be a level two fitness for service, a little maximum allowable working pressure, and external degrading where there is some misalignment. This is something that could come up. You hope to catch this in fabrication, but in this example we caught it on the run. You would go through a reference log/get background information to do an analysis.
Obviously there are different codes and standards. API 579 is just one we would use to work an issue. Bottom line, we would come out with something for the site for what you could do in terms of operating conditions. This is typically a level three-type analysis requiring central office or heavy engineering input.
Failures are key. Failure doesn't necessarily mean loss of containment. Failure could mean it doesn't meet the premised run. For example, I have to take a piece of equipment or piping out of service early and do something to fix or replace it. The idea on failure is you need to find out why it happened, determine root cause, and apply that to the site so you don't obviously repeat the error. When you do your inspection, your RBI comes back with analysis and you will go through the unit again, what failures you’ve had, what failures others had, what you can learn from it, and how can it be put into our inspection journals.
Next, repairs: the basis for repairs and when to repair, and the repairs that we do on site. There was a good presentation this morning on pressure testing versus hydro testing. That always comes up when we talk about repairs. We will follow the National Board, API, ISO— it depends on what part of the world we are operating in, but also various codes and standards we use for guidance on how we do those repairs. We also follow internal company standards in terms of repairs.
When to repair, online repairs, or shut down for immediate repairs can introduce safety risks or you wait for a turnaround. If you wait for a turnaround, the plan is shut down. Online repair typically is not something you do on many pieces of equipment. It's something you may do more on piping where you have a localized thin area. You use ASME code, you have to design clamps, go through rigorous testing where you check that kind of thing before you put a temporary repair in place.
You have to weigh the risk of an online repair versus taking the piece of piping out of service, for example, because that does play into shutdown for immediate repairs where there is some risk—inherent risk in shutting down a unit versus leaving it running and putting online repair in place.
As part of an integrity program we have walked through a little of the design phase, inspection phase, fabrication, inspection, putting a plan in place, doing an inspection, doing a failure analysis and repair, and now we close the gap at the tail end with management oversight and issues like measuring the process with key process indicators and critical considerations. Management system review is something we use.
Basically this is a very thorough review of integrity programs we go through at each site. We look at how a site manages their integrity program. We go through everything from the manager responsible for the site to resources they have in place; skill, engineers, inspectors, and procedures and practices the site has in place; quality assurance and quality control on how they do projects or how they do repairs; how they control materials at the site; engineering support; and how they handle certain types of equipment, be it a cooling water tower, boiler, or heat exchanger bundles.
Prevention and control has to do with material they measure for corrosion and what the site has in place to maintain it. The last thing we will look at are records, tools, and references. From a maintaining standpoint/management system review, make sure your program is whole. Go through it with a fine tooth comb every so often to make sure all elements are in place to ensure a healthy program.
In terms of key process indicators, we talk about management of an integrity program. We make sure of a plan, what's coming due for inspection, if we have plans in place to address certain bad actors, reliability problems, etc., and what's going on with those. It's something that always feeds up the food chain to the site management.
MR. ROBERTS: Thanks, Tom. Really appreciate your in-depth review of overall pressure equipment asset management programs. Much is involved. It allows operators to zero in on potential problems they face in their operations on a day-to-day basis. It looks at all key areas of the operations, but I think most specifically it looks at how to safely operate your assets and how to safely extend the life of assets by reducing asset damages. Additionally, it looks at how to improve overall reliability of your program and production of your refinery.
But especially and most importantly, it's going to help employees of the refinery and people in general understand all the different facets associated with asset integrity and how they can help eliminate some assumptions that go on and replace them with a better understanding of details and comprehensive requirements a successful program implementation requires.
Just as our theme today states that, "Safety is Assumed, Never Assured," no one can ever be given 100 percent assurance they are going to be free from harm 100 percent of the time. But we believe a well-run pressure equipment asset integrity management program can eliminate these assumptions and can help our neighbors have a better understanding and a better level of assurance that a refinery is running in a safe and environmentally sound manner.
All of us here are professionals related to pressure equipment integrity, and all understand people living in neighborhoods where we operate and where you perform your professional duties as inspectors. These people have the right to assume they are safe and their families and loved ones are free from harm. All of us here today have a professional and personal responsibility to make sure trust is not misplaced.