16991

BS EN 16991:2018
BSI Standards Publication
Risk-based inspection framework

BS EN 16991:2018 BRITISH STANDARD
National foreword
This British Standard is the UK implementation of EN 16991:2018.

The UK participation in its preparation was entrusted to Technical
Committee DS/1, Dependability.
A list of organizations represented on this committee can be obtained on
request to its secretary.
This publication does not purport to include all the necessary provisions
of a contract. Users are responsible for its correct application.
© The British Standards Institution 2018
Published by BSI Standards Limited 2018
ISBN 978 0 580 93394 3
ICS 03.100.01
Compliance with a B ritish Standard cannot confer immunity from
legal obligations .
This British Standard was published under the authority of the

Standards Policy and Strategy Committee on 31 May 2018.
Amendments/corrigenda issued since publication
Date Text affected

Get more FREE standards from Standard Sharing Group and our chats
EUROPEAN STANDARD EN 16991
NORME EUROPÉENNE
EUROPÄISCHE NORM April 2018
ICS 0 3 .1 0 0 .0 1
English Version
Risk-based inspection framework
Cadre d'inspection basée sur les risques Risikobasierte Inspektion (RBIF)
This European Standard was approved by CEN on 22 October 2017.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving
this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre
or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language
made by translation under the responsibility of a CEN member into its own language and noti fied to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark,
Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain,
Sweden, Switzerland, Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION

COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
C E N - C E N E L E C M a n a ge ment C entre : Avenue M a r n i x 17, B -10 0 0 B r u s s el s
© 2 018 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN 1 6991 : 2 01 8: E
worldwide for CEN national Members
BS EN 16991:2018
EN 16991:2018 (E)
Contents Page
European foreword ................................................... ................................................... ................................................... ................................................... .. 4

Introduction .................................................. ................................................... ................................................... ................................................... ...................... 5
1 Scope .................................................. ................................................... ................................................... ................................................... ...................... 6
2 Normative references .................................................. ................................................... ................................................... .............................. 6
3 Terms and definitions .................................................. ................................................... ................................................... ............................. 6
4 Abbreviated terms .................................................. ................................................... ................................................... ...................................... 8
5 The RBI framework .................................................. ................................................... ................................................... .................................... 9
5.1 RBIF principles ................................................... ................................................... ................................................... .............................. 9
5.2 RBIF requirements ................................................... ................................................... ................................................... .................. 10
5.2.1 General requirements .................................................. ................................................... .......................................... 10
5.2.2 Plant and process documentation .................................................. ................................................... ............ 11
5.2.3 Personnel requirements .................................................. ................................................... .................................... 12
5.2.4 Requirements for performing CoF analysis .................................................. ......................................... 12
5.2.5 Requirements for performing PoF analysis .................................................. ......................................... 14
5.2.6 Requirements for risk assessment .................................................. ................................................... ........... 15
5.3 RBIF within the overall management system ................................................... ................................................... ..... 15
5.4 Compatibility with other known approaches ................................................... ................................................... ...... 16
6 The RBIF process .................................................. ................................................... ................................................... ....................................... 16
7 Initial analysis and planning .................................................. ................................................... ................................................... ......... 19
7.1 General description and scope .................................................. ................................................... .......................................... 19
7.1.1 General ................................................... ................................................... ................................................... .......................... 19
7.1.2Get Planning
more FREE andstandards
the preliminary from Standard analysis ..................................................
Sharing Group and ...................................................
our chats . 19
7.1.3 De finition of objectives .................................................. ................................................... ....................................... 19
7.1.4 De finition of systems, sub-systems (loops) and equipment to be considered ........ 20
7.1.5 De finition of the scope of analysis .................................................. ................................................... ............ 20
7.1.6 De finition of data sources available .................................................. ................................................... ........ 20
7.1.7 De finition of regulations to be considered .................................................. ........................................... 21
7.1.8 Team speci fications .................................................. ................................................... ............................................... 21
7.1.9 Tools to be used .................................................. ................................................... ................................................... ..... 21
7.1.10 Accuracy of the acceptance of the methodology .................................................. ............................. 22
7.2 Requirements .................................................. ................................................... ................................................... ................................ 22
7.3 Inputs .................................................. ................................................... ................................................... ................................................... 22
7.4 Procedure .................................................. ................................................... ................................................... ......................................... 23
7.5 Output .................................................. ................................................... ................................................... .................................................. 23
7.6 Warnings and applicability limits .................................................. ................................................... ................................... 23
8 Data collection and validation ................................................... ................................................... ................................................... .... 24
8.2 Requirements .................................................. ................................................... ................................................... ................................ 24
8.3 Input .................................................. ................................................... ................................................... ................................................... ... 25
8.3.1 General ................................................... ................................................... ................................................... .......................... 25
8.3.2 Collect and validate documented data .................................................. ................................................... .. 25
8.3.3 Collect relevant non-documented data ................................................... .................................................. 26
8.4 Procedure .................................................. ................................................... ................................................... ......................................... 26
8.5 Output .................................................. ................................................... ................................................... .................................................. 26
9 Multilevel risk analysis (ranging from screening to detailed) .................................................. ......................... 27
9.2 Risk analysis — screening level .................................................. ................................................... ........................................ 28
9.2.1 General ................................................... ................................................... ................................................... .......................... 28
9.2.2 Inputs .................................................. ................................................... ................................................... .............................. 28
9.2.3 Procedure .................................................. ................................................... ................................................... .................... 28
2
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
9.2.4 Output ................................................... ................................................... ................................................... ........................... 28

9.3 Risk analysis — detailed assessment .................................................. ................................................... .......................... 29
9.3.1 General ................................................... ................................................... ................................................... .......................... 29
9.3.2 Requirements ................................................... ................................................... ................................................... ......... 30
9.3.3 Inputs .................................................. ................................................... ................................................... .............................. 31
9.3.4 Procedure .................................................. ................................................... ................................................... .................... 31
9.3.5 Output ................................................... ................................................... ................................................... ........................... 33
10 Decision making/action plan .................................................. ................................................... ................................................... ....... 3 5
10.2 Requirements .................................................. ................................................... ................................................... ................................ 35
10.3 Inputs .................................................. ................................................... ................................................... ................................................... 36
10.4 Procedure .................................................. ................................................... ................................................... ........................................ 36
10.4.1 General ................................................... ................................................... ................................................... .......................... 36
10.4.2 De fine degradation groups and relevant susceptible areas .................................................. . 37
10.5 Output .................................................. ................................................... ................................................... .................................................. 38
11 Execution and reporting .................................................. ................................................... ................................................... ................... 3 9
11.2 Input .................................................. ................................................... ................................................... ................................................... ... 40
11.3 Procedure .................................................. ................................................... ................................................... ......................................... 40
11.4 Output .................................................. ................................................... ................................................... .................................................. 42
11.5 Warning/ application limits .................................................. ................................................... ................................................ 42
12 Performance review/Evergreening phase .................................................. ................................................... ......................... 42
General description and scope .................................................. ................................................... .......................................... 42
12.1
12.2
Requirements .................................................. ................................................... ................................................... ................................ 43
12.3
Inputs .................................................. ................................................... ................................................... ................................................... 43
Procedure .................................................. ................................................... ................................................... ......................................... 44
12.4
12.4.1 General ................................................... ................................................... ................................................... .......................... 44
12.4.2 Work process efficiency benchmarking ................................................... ............................................... 45
Annex A (informative) Assessments ................................................... ................................................... ................................................... ......... 47
Bibliography .................................................. ................................................... ................................................... ................................................... .................. 76
© ISO ISO pub-date year – All rights reserved 3

BS EN 16991:2018
EN 16991:2018 (E)
European foreword
This document (EN 16991:2018) has been prepared by Technical Committee CEN/TC 319 “Maintenance”,
the secretariat of which is held by UNI.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by October 2018 and con f licting national standards shall
be withdrawn at the latest by October 2018.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this Eur opean Standard: Austria, Belgium, Bulgaria, Croatia ,
Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France,
Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands,
Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and
the United Kingdom.
4
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Introduction
Since the late 1990s, inspection and maintenance approaches in industry have been globally moving
from prescriptive, time-based towards risk-based ones. This trend has clearly been established by the
wish to increase the on-stream production time, to reduce unscheduled downtime due to corrective
maintenance, to avoid shutdown due to equipment failure and/or to reduce undesirable impacts on
process safety.
This European Standard provides the essential elements of risk-based assessment of industrial assets
according to the approach developed and demonstrated in the European pre-standardization document
CWA 15740:2008 [1]. The CWA 15740 document was updated in 2011, and from 2014 its further
development continued within this document and the corresponding EU Project RIMAP (Risk-Based
Inspection and Maintenance Procedures for European Industry) [2] [3].
The document is intended for managers and engineers establishing the RBIM (Risk-based Inspection
and Maintenance) policies in the process, power, steel and other relevant industries. This document
is intended to be used in conjunction with the relevant internationally accepted practices, national
regulations and RBI company policies. The document aims to provide a common reference for
formulating the RBI policies and developing the corresponding inspection and maintenance programs.
The background of the RBIM methodology is provided by the EU project RIMAP (Risk-based Inspection
and Maintenance Procedures for European Industry) [4]. In this project, the industry independent
methodology has been validated for chemical, petrochemical, power and steel industries and
summarized in the respective RIMAP Application Workbooks [4] .
The main goal of this European Standard and the former RIMAP project is to support the establishment
and application of risk-based inspection and mainte nance programs in industrial plants in a documented
and efficient way, while at the same time maintaining or improving safety, health and environment
performance.
The RBIF addresses primarily static pressure equipment (e.g. tanks, piping), but is also applicable to
dynamic/rotating equipment (e.g. pumps, turbines, valves) and pressure relief devices, and it can be
extended to other types of equipment, if appropriate. It addresses primarily the equipment and/or
systems in the in-service phase of the operation, but can also be applied in the design-phase for analysis
and/or determination of maintenance/inspection strategies or life extension phases. Application of this
RBIF in industry will take into account also the general developments in the industry and maintenance
practices (e.g. The Industry 4.0).
5
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
1 Scope
This European Standard speci fies the Risk-Based Inspection Framework (RBIF) and gives guidelines
for Risk-Based Inspection and Maintenance (RBIM) in hydrocarbon and chemical process industries,
power generation and other industries where RBI is applicable.
Although RBIF encompasses both inspection and maintenance, this document focuses primarily on
Risk-Based Inspection (RBI) and its applicability within the context of RBIM. The RBIF thereby supports
optimization of operations and maintenance as well as asset integrity management.
2 Normative references
There are no normative references in this document.
3 Terms and definitions

For the purposes of this document, the following terms and de finitions apply.
3 .1
risk
combination of the probability of occurrence of harm and the severity of that harm
Note 1 to entry: The probability of occurrence includes the exposure to a hazardous situation, the occurrence of a
hazardous event, and the possibility to limit the harm.
Note 2 to entry: Other de finitions, e.g. the one from ISO 31000 are recognized, but not used practically in
the document.
[SOURCE: ISO/IEC Get
Guide 51:2014,
more FREE 3.9]
standards from Standard Sharing Group and our chats
3.2
risk management
coordinated activities to direct and control an organization with regard to risk
NOTE Systematic application of management policies, procedures, and practices to the tasks of analysing,
evaluating and controlling risk.
[SOURCE: ISO Guide 73:2009, 2.1, ISO 31000:2009, 2.2]
3.3
equipment
individual item that is part of a system, equipment is comprised of an assemblage of components
Examples include pressure vessels, pressure relief devices, piping, boilers and heaters.
[SOURCE: API RP 581:2016, 3.1.23]
3 .4
inspection
examination for conformity by measuring, observing or testing the relevant characteristics of an item
[SOURCE: EN 13306:2010, 8.1]
3.5
maintenance
combination of all technical, administrative and managerial actions during the life cycle of an item
intended to retain it in, or restore it to, a state in which it can perform the required function
[SOURCE: EN 13306:2010, 2.1]
6
BS EN 16991:2018
EN 16991:2018 (E)
3.6
integrity operating window
IOW
established limits for process variables (parameters) that can affect the integrity of the equipment if
the process operation deviates from the established limits for a predetermined length of time (includes
critical, standard and informational IOW’s)
[SOURCE: API RP 584, 3.6]
3.7
preventive maintenance
maintenance carried out at predetermined intervals or according to prescribed criteria and intended to
reduce the probability of failure or the degradation of the functioning of an item
[SOURCE: EN 13306:2010, 7.1]
3.8
corrective maintenance
maintenance carried out after fault recognition and intended to put an item into a state in which it can
perform required function
[SOURCE: EN 13306:2010, 7.5]
3.9
reliability centred maintenance
method to identify and select failure management policies to efficiently and effectively achieve the
required safety, availability and economical operation
[SOURCE: EN 60300-3-11:2009, 3.1.23]
3.10
risk based inspection
RBI
risk assessment and management process to plan, implement and evaluate inspections in a structured
and documented way
3.11
probability of failure
PoF
likelihood of an equipment or component failure due to a single damage mechanism or multiple
mechanisms occurring under speci fic operating conditions
[SOURCE: API RP 581:2016, 3.1.57]
3.12
consequence of failure
CoF
outcome of a failure can be expressed in terms of safety to personnel, economic loss, and/or damage to
the environment
[SOURCE: EN 60300-3-11:2009, 3.1.23]
3.13
evergreening
dynamic process of keeping records and analysis updated and relevant for the current situation
3.14
area susceptible to damage/susceptible area
area in a plant where a certain degradation is more probable to occur
[SOURCE: API RP 581:2016, part 2]
7
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
3 .15
degradation
detrimental change in physical condition, with time, use or external cause
Note 1 to entry: Degradation may lead to a failure.
Note 2 to entry: In a system context, degradation may also be caused by failures within the system.
[SOURCE: SOURCE : EN 13306:2010, 5.6]
3 .16
degradation group
group of piping or equipment items exposed to the same internal/external environment and
operating conditions, with the same material selection and/or design, thus having the same potential
degradation mechanisms.
Note 1 to entry: Degradation grouping can allow the use of inspection data from any equipment in the selection to
assess the condition of the entire degradation group. Equipment in a degradation group are normally physically
connected to each other.
Note 2 to entry: Corrosion group and/or corrosion circuit and/or corrosion loop is also used if the relevant
degradation is corrosion type.
[SOURCE: adapted from DNV RP-G101: 2010]
3 .17
condition monitoring locations
CM L
designated areas on pressure vessels where periodic examinations are conducted. Previously, they
were normally referred to as “thickness monitoring locations (TMLs)”
[SOURCE: API 510:2006]
4 Abbreviated terms
Table 1 — Abbreviated terms
Abbreviated term Definition

ALARP As Low As Reasonably Practicable
API American Petroleum Institute
ASME American Society of Mechanical Engineers
CAD Computer Aided Design
CAM Computer Aided Manufacturing
CCD Corrosion Control Document
CMMS Computerized Maintenance Management System
CML Condition Monitoring Location
CoF Consequence of Failure
CUI Corrosion Under Insulation
ESV Emergency Shut-off Valves
FME(C)A Failure Mode, Effects (and Criticality) Analysis
HAZOP HAZard and OPerability (study/analysis)
HCF/LCF High Cycle Fatigue/Low Cycle Fatigue
HFF/LFF High Fluid Flow/Low Fluid Flow
HS(S)E Health, Safety (Security) and Environment
HSE Health, Safety and Environment
8
BS EN 16991:2018
EN 16991:2018 (E)
Abbreviated term Definition

HT High Temperature
IOW Integrity Operating Window
IPF Instrument Protective Function
KKS Kraftwerk-Kennzeichensystem, Power Plant Classi fication System [18]
KPI Key Performance Indicators
LoF Likelihood of Failure
NOTE: also referred to as Probability of Failure (PoF) in some cases
LoPC Loss of Primary Containment
MEI Maintenance Execution Inspection
MOC Management Of Change
MOTBF Mean Operating Time Between Failure
NCR Non Conformity Report
NDT Non-Destructive Testing/inspection
NII Non-Intrusive Inspection
PFD Process Flow Diagrams
P&ID Piping and Instrumentation Diagram
PHA Process Hazard Analysis
PoD Probability of Detection
PoF Probability of Failure
NOTE also referred to as Likelihood of Failure (LoF) in some cases
PRV Pressure Relief Valve
QA Quality Assurance
QRA Quantitative Risk Assessment
QMS Quality Management System
RBI Risk Based Inspection
RBIF Risk Based Inspection Framework
RBIM Risk Based Inspection and Maintenance
RBWS Risk Based Work Selection
RCA/RCFA Root Cause Analysis/Root Cause Failure Analysis
RCM Reliability Centred Maintenance
RIMAP Risk based Inspection and Maintenance Procedures
5 The RBI framework

5.1 RBIF principles
The risk-based approach shall apply a multidisciplinary engineering analysis to ensure that targets
related to health, safety, business and environment criteria are met. These targets shall be met by
implementing optimized inspection, monitoring and maintenance programs based on an appropriate
risk-based methodology covering the following items:
— planning of the primary work products of RBI assessments and management approach in such a
way that risks at system and/or equipment level are managed, considering risks from the Health,
Safety & Environment (HSE) and/or the economic/business perspective;
— de fining the RBI framework which meets the requirements of good engineering practices and
industrial reference standards in handling hazardous materials and containment;
9
BS EN 16991:2018
EN 16991:2018 (E)
— complying with applicable legal or normative regulations and guidelines.
5.2 RBIF requirements

5.2.1 General requirements
The general requirements of the RBIF are:
— the objectives and risk criteria shall be clearly de fined;
— the assessment and the applied procedure shall comply with the applicable legal and regulatory
requirements;
— an adequate level of input information shall be available for the assessment;
— the assessment shall be performed by a multidisciplinary team including personnel with the
appropriate required competence and quali fications;
— the integrity and safety assessment and the applied procedures shall provide results, which are:
a) realistic, but with conservative treatment of uncertainties and assumptions;
b) representable in a risk matrix, auditable and consistent with both the objectives and applied
risk criteria supporting RBI planning and decision making on the target system or equipment.
— the assessment shall re flect the real conditions in the plant and be kept in “evergreening” status;
— change management shall be made according to an accepted and recognized standard − such as
EN ISO 9000 [5];
— in the case when computer models/tools are used, these shall be validated and their decision logic
shall be documented and authorized by the risk managers.
The RBI process is divided into the main RBI application level and an inspection and maintenance
strategy level. The main RBI application level is shown in Figure 1 and takes into account the
following factors:
— the level of risk;
— the opportunity to eliminate failure causes;
— the risk to personnel during execution of inspection and maintenance;
— the risk of introducing new failure causes while trying to eliminate the existing ones.
In cases where change of the inspection and maintenance strategy is not possible, technical (e.g.
robotics) or organizational (e.g. training) measures may be introduced to reduce the risk and to avoid
introducing any new failures.
The decision tree serves three important purposes:
— to ensure a systematic evaluation of needs for inspection and maintenance activities;
— to ensure consistency of the evaluation between different units, plant systems and similar units at
different locations;
— to simplify the documentation of reached conclusions.
When the inspection and maintenance strategy has been determined, the method, intervals, and extent
of inspection shall be determined so that risks remain acceptable and costs are optimized (ALARP).
This needs to be aligned to the organization’s asset management strategy and kept up-to-date. This is
achieved by establishing risk reduction measures for the items that exceed the acceptance limits and,
where possible, by mitigating measures like inspections and maintenance for items that remain below
10
BS EN 16991:2018
EN 16991:2018 (E)
these limits for the period of assessment. The risk reduction effect of alternative measures as well as
the costs of these measures shall also be determined.
Figure 1 — Main RBI application level and decision tree
The approaches and methodologies used in RBIF can be compatible with the generic requirements
resulting from basic ISO Standards such as EN ISO 9000-series[5] , EN ISO 14000-series [6] , ISO 55000
[7] and in-particular, ISO 31000-series [8] (IEC/ISO 31010 [9] , ISO/IEC Guide 51 [10] , ISO Guide 73 [11] ).
Other standards with which RBIF can also be compatible are EN 13306 [12] , ISO/DIS 45001, ISO 22301
[13] , IEC 61508/ IEC 61511 [14] [15] and ISO/IEC 17020 [16].
5.2.2 Plant and process documentation

The development of a Risk-Based Inspection plan for different equipment items shall follow a well-
de fined, rigorous, and logical process to ensure that all pertinent information has been considered, and
no critical factors are overlooked.
The RBI process shall be clearly documented in a written procedure. This documented procedure shall
be referenced, approved and controlled. The procedure shall de fine each step to be taken during the
risk assessment process including the data journey and data quality needs of all data sets used for the
risk assessment. The procedure shall explain in detail how PoF and CoF are established, and how this is
used to determine the risk level and inspection plans.
It is essential that all RBI assessments are clearly documented, with all factors contributing to the final
risk assessment de fined. The minimum documentation shall include:
— team members performing the assessment and their competence;
— previous assessment date;
— reassessment interval;
— list of factors used to determine risk (severity, probability of failure and exposure);
11
BS EN 16991:2018
EN 16991:2018 (E)
— list of assumptions made during the assessment;

— risk assessment results for unmitigated risks;
— actions required to move to new mitigated risk levels; and
— optionally: risk assessment results for mitigated risks levels.
The aforementioned documents will help to review the processes, the changes in the processes and to
update the inspection related information.
5.2.3 Personnel requirements

The RBIF requires competent personnel at all levels as well as appropriate routines for the execution
of the assessment. The RBI program shall de fine the personnel participating in each stage of the risk
assessment, including their required quali fications, training, plant-speci fic knowledge and experience.
The RBI team should include:
— a team leader (facilitator);
— a materials and damage mechanism specialist with sufficient quali fication and experience to
understand the process, predict failure mechanisms and identify limitations in inspection techniques;
— an inspection/NDT and maintenance specialist;
— a plant operation and process specialist;
— reliability, risk assessment, HSE, financial and business personnel; and
— other specialist(s) as needed.
However, not every competence area has to be covered by a different person, as individuals may possess
competence in multiple disciplines.
The RBI team shall include with written evidence the following areas of expertise: inspection,
maintenance, materials and damage mechanism, process technology, RBI, operations and facilitation.
For each area of expertise, requirements related to competence and experience shall be de fined,
allowing for the case that some persons may provide expertise in multiple disciplines/areas.
In particular cases, depending on the type of industry, the personnel may require other special
competencies. In addition, local rules and legislation may set competency requirements. Due
consideration should also be given to the independency of the RBI team members and width of
background skills and expertise collated in the team. Although one or more of the skills may be
possessed by one person, but it is emphasized that RBI planning is a team effort and usually needs a
facilitator.
5.2.4 Requirements for performing CoF analysis

5.2.4.1 General requirements
The CoF assessment shall start with a good description of the system or item that is considered in the
RBI process. Relevant system data such as location, dimensions, materials and process data such as
temperature, pressure and fluid/gas properties shall be available.
The actual analysis is done on relevant damage mechanisms and failure modes of the system or
equipment. The analysis should then lead to a credible classi fication of the potential consequences of
that failure mode.
The HSE aspects shall be included, as a minimum, in order to assess the CoF. If the RBI process is used
for assuring HSE rather than for financial optimization, the averaging of individual aspects (HSE and/or
business consequences) is not allowed.
12
BS EN 16991:2018
EN 16991:2018 (E)
A potentially hazardous event will only lead to health and safety consequences if people are present
in the hazardous zone at that time and have no means of averting or protecting themselves against
the hazard. It is therefore essential to take these two “mitigating” factors into account for a realistic
consequence assessment of a failure mode. However, sometimes a hazardous event can lead to a domino
effect involving complex situations which should be considered.
Consequence values might be derived from existing quantitative risk assessments or other risk
assessment analysis considering consequences of release. For assessing the CoFsafety, CoF health and
CoF environment the mass of f luid, which is released due to a leak, is usually the main factor. In the case
of release, the inventory of isolatable sections of a process plant shall be considered. The inventory is
the total mass of the fluid present in a single isolatable section. The mass (volume, density) of the whole
inventory shall be utilized in the assessment instead of the individual smaller mass of fluid in each
item of equipment. These sections are often de fined by Emergency Shut-off Valves (ESVs). The main CoF
requirements [4] for RBIF are explained in the subchapters below.
5.2.4.2 Recognized models

The CoF assessment method shall be veri fied/benchmarked against state–of-the-art (established)
consequence models which are generally being used, accepted and referred to in open literature such as
IEC/ISO 31010 [9].
5.2.4.3 Requirements related to CoF safety

The CoFsafety assessment shall be documented and approved by the responsible authorities recognized
a in accordance with the applicable (e.g. national) regulations, if necessary.
The methods can be based on at least one or more of the following aspects (depending on the type of
equipment and fluid):
— released mass flow rate;
— type of release (instantaneous discharge of total c ontained quantity or by leakage at a speci fied rate);
— f lammability;
— toxicity;
— energy release (pressure or heat); and
— kinetic energy ofprojectiles (kinetic energy of eq uipment fragments with a potential of domino effect ).
5.2.4.4 Requirements related to CoF health

The CoF health assessment shall be documented and approved by the responsible authorities recognized
in accordance with the applicable (e.g. national) regulations, if necessary, as in 5.2.4.3 .
The methods can be based on at least one or more of the following aspects (depending on the type of
equipment and release):
— properties of the release that affect health;
— released mass; and
— acute or long-term effects on persons / population.
5.2.4.5 Requirements related to CoF environment

The CoF environment assessment shall be documented and if necessary approved by the responsible
authorities recognized in accordance with the applicable (e.g. national) regulations as in 5.2.4.3 .
The environmental impact shall include effects on soil, air, surface water and ground water.
13
BS EN 16991:2018
EN 16991:2018 (E)
The methods can be based on at-least one or more of the following aspects (depending on the type of
equipment and release):
— properties of the release that affect the environment;
— released mass;
— direct and indirect effect on flora and fauna; and
— remediation effort.
5.2.4.6 Requirements related to CoF business

The CoF business assessment should be documented in a similar manner to the other consequences.
It is required to consider the financial effect of a failure on assets and total or partial loss of production.
Damage to assets typically includes material and labour costs of repair and/or replacement of
equipment. Costs associated with product value could be: lost revenues caused by production losses
due to shutdown and/or loss of containment, reduced margin in case of off-spec products or reduced
throughput and reprocessing costs, etc. The consequences of failure can also result in financial impact
on so-called 'intangible' assets such as reputation.
5.2.5 Requirements for performing PoF analysis

5.2.5.1 General requirements
The main RBIF requirements for the PoF analysis are:
1) recognized models;
2) conservatism of simpli fied approaches;
3) auditability of results;
4) multi-level approaches (screening – detailed, in level of asset hierarchy); and
5) additional aspects to be considered.
These requirements are explained in detail below.
5.2.5.2 Recognized models

The PoF assessment method shall be veri fied/benchmarked against a recognized (established)
degradation model, which is generally being used, accepted and referred to in open literature (e.g. the
standards like IEC/ISO 31010) [9] .
5.2.5.3 Conservatism o f simplified approaches

Available methods for assessing Probability of Failure may vary in their level of detail. The results from
a simpli fied approach such as risk screening shall be conservative when compared to the results from a
more detailed analysis.
5.2.5.4 Auditability of results

The results shall be auditable by peer review; therefore the methodology, the input data, the decision
criteria and the results shall be documented (the results may be recorded in an approved document).
14
BS EN 16991:2018
EN 16991:2018 (E)
5.2.5.5 Multi-level approaches (screening — detailed, in level of asset hierarchy)

Qualitative, semi-quantitative or quantitative approaches (ranging from screening to detailed) shall be
used. The use of descriptive terms, such as “very high” to “very low” or similar can be used only if an
objective interpretation of these terms is provided. The approach can be multi-level both in terms of
“qualitative/quantitative” and in terms of level of asset hierarchy.
5.2.5.6 Additional aspects to be considered

The PoF assessment shall be structured with well-de fined boundary conditions. The PoF assessment
should be performed in such a way that the following aspects are covered, to screen the operation and
identify the relevant degradation mechanisms:
— identify susceptibility to degradation mechanisms;
— establish realistic (“best estimate”) damage rates;
— determine the susceptibility to failure and/or assess the probability that a given level of damage
will exceed the damage tolerance of the equipment and result in a failure;
— analyse possible interaction or synergy effects for all active and potential degradation mechanisms;
— assess the effect of the inspection and monitoring program in the past as well as the one planned
for the future;
— determine the con fidence level in the damage rate e.g. considering the following aspects:
a) inspection history and effectiveness;
b) process parameters and available process data;
c) degradation models, their applicability and shortcomings;
d) effectiveness of mitigation such as the effect of inhibitors and recoating; and
e) Update the con fidence level after inspection.
— determine the PoF with respect to the planned interval for the next inspection; and
— determine the PoF with respect to risk acceptance criteria.
5.2.6 Requirements for risk assessment

The requirements speci fied for personnel, PoF assessment and CoF assessment apply also to risk
assessment [4]. The additional requirements, beyond the ones already given, shall be:
1) The development of a scenario for each failure mode is a critical step. Techniques such as fault tree
analysis, event tree analysis, Bayesian networks, cause and effect methods, bow tie and similar
should be considered;
2) The efficiency of the risk mitigating activities shall be connected to identi fied failure modes and
the projected risk reduction should be estimated and/or follow ALARP principles.
5.3 RBIF within the overall management system

The development and implementation of a RBIM plan requires resources (e.g. personnel, budget,
spare parts and documentation etc.). The management shall assess the effectiveness of the RBIM by
monitoring performance indicators such as completeness of implementation, leaks and near leaks,
overdue inspection/maintenance tasks, reliability, costs and similar.
The RBIM planning requires a multidisciplinary team with a range of engineering competency. The
management shall identify and de fine the objectives related to acceptable levels of risk in inspection
15
BS EN 16991:2018
EN 16991:2018 (E)
and maintenance activities. The objectives should be transparent and support the company’s overall
objectives, with respect to health, safety, environment, production, quality and reputation etc. The
objectives should also be in-line with the national or other normative requirements, and/or possible
other requirements (e.g. the contractual etc.).
The RBIM strategy shall ensure that risk mitigating actions are identi fied and implemented before the
health, safety or environmental (HSE) risks associated with an equipment failure become unacceptable.
If the HSE risks are tolerable/acceptable, actions to reduce economic/ business risks may still be needed.
The RBIM framework shall be seen as a part of the overall Maintenance Execution Inspection (MEI)
working process and the Quality Management System (QMS) taking into account the following:
— de finition of objectives, goals and requirements;
— establishment of inspection and maintenance program(s);
— planning of tasks and activities in inspection and maintenance;
— execution of work orders;
— reporting about failures and status;
— preparing and performing improvement/corrective actions;
— asset management;
— management of change;
— ensuring safe production and safe work practices;
— emergency response andFREE
Get more controls;
standards from Standard Sharing Group and our chats
— investigation of incidents;
— training; and
— control and quality assurance.
5.4 Compatibility with other known approaches

The overall RBIF approach proposed in this standard, based on CWA 15740:2008 [1] , is generally
compatible with other major risk-based approaches such as API [17] , VGB [18] and ASME [19] [20] , and
it follows similar goals. However, while the principles are largely similar, the users are warned against
expecting identical results. Use of different approaches for the same plant, case or system may result in
variations in results.
6 The RBIF process

The RBIF process provides guidance for developing and maintaining a risk-based inspection and
maintenance program, preferably embedded into a hig her level quality or risk management environment
such as Asset Integrity Management System (AIMS), Integrated Risk Management (IRM) and Process
Safety Management System (PSMS). The RBIF process is applicable to many industries and to different
types of equipment. It primarily applies to static pressure equipment, but is also applicable to rotating
equipment, safety systems and electrical/instrument equipment; the steps of the process are the same
for all cases, even if the models and tools for assessing probability or consequence of failure may vary
from one application to another.
The RBIF process includes the following main steps:
1) initial analysis and planning;
2) data collection and validation;
16
BS EN 16991:2018
EN 16991:2018 (E)
3) multilevel risk analysis (risk assessment);

4) decision making and action plan;
5) execution and reporting; and
6) performance review/evergreening phase.
An overview of the RBIF including Reliability Centred Maintenance (RCM, [36] ) for functional failure
is shown in Figure 2. Functional failure is included to demonstrate that RCM follows the same route as
RBI and results in proactive maintenance planning.
17
BS EN 16991:2018
EN 16991:2018 (E)
Figure 2 — Framework of RBIM procedure within the overall management system
18
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
7 Initial analysis and planning
7.1 General description and scope
7.1 .1 General
Initial analysis and planning is a key step in the RBIF. In this step the objectives of the RBIF, scope
of the RBIF (in terms of systems and sub-systems) and relevant criteria for the assessment shall be
adequately de fined.
7.1 .2 Planning and the preliminary analysis
The initial analysis and planning phase starts immediately after the decision to implement RBI at a
location (or in a particular plant or area) is made. This phase consists of the following steps:
1) de finition of objectives (e.g. company health and safety objectives, optimized timing/prioritization
and extent of next inspection);
2) de finition of systems, sub-systems (loops) and equipment to be considered, as well as the respective
boundaries (e.g.: preheating system from inlet x to outlet y [P&ID No. xyz] including pressure
vessels xyz, heat-exchangers xyz, and pumps xyz, etc.);
3) de finition of the scope of analysis, including normal operating conditions and exceptional situations
to be considered (e.g. start-up/shutdown, disturbances, accidents etc.), as well as the operating
periods covered;
4) de finition of data sources available (e.g. design data, equipment history, equipment/component
inspection data, PHA studies, etc.);
5) de finition of regulations to be considered;
6) speci fication of the team;
7) speci fication of the tools (including software) to be used;
8) agreement on the methodology and objectives with relevant actors concerned (e.g. management,
external bodies and/or authorities).
In the following sub-clauses, these steps will be described in more detail.
7.1.3 Definition o f objectives

At this stage, the management shall clearly de fine measurable objectives of the assessment and
con firm the applied procedure suggested by the assessment team. These objectives are largely de fined
in terms of health, safety, environment and business impact. In particular, risk-based inspection and
maintenance when applied to a plant shall address one or more of the following objectives:
— meeting the requirements of health, safety and environmental regulations by reducing the
corresponding risks to at least ALARP level or lower;
— improving the safety and reliability of the plant;
— optimizing inspection and maintenance (possibly also production and quality) cost; and
— extending the useful service life of the plant, e.g. beyond its design life, and implementing an
appropriate end of life strategy.
19
BS EN 16991:2018
EN 16991:2018 (E)
7 . 1 . 4 D e fi n i ti o n o f
s ys te m s , s u b - s ys te m s ( l o o p s ) a n d e q u i p m e n t to b e c o n s i d e re d
The RBI analysis can focus on multiple plants, a single plant, certain systems (unit operations) of a
plant, certain equipment or even components of an individual item of equipment. The first step consists
of de fining the systems and/or sub-systems (loops) of interest.
Systems are generally de fined based on the functions they perform. The sub-systems shall be
manageable and meaningful to allow for assessment of speci fic issues related to them, e.g. according
to particular degradation mechanisms, process fluids, process functions, process conditions, materials
selection, inventory groups, etc. The level of detail of systems, equipment and their components, and
their hierarchy may differ depending on the chosen methodology (RBI/RCM). Inventory is the total mass
of fluid available for release through a leak in an isolatable section of a process plant (inventory group).
By dividing a process unit into systems, sub-systems, etc., the equipment can be screened together to
save time compared to treating each item of equipment separately. In the case when the risks of each
item of equipment in the system show a common sensitivity to changes in process conditions, screening
can establish one Integrity Operating Window (IOW, [21]) with common variables and ranges for the
entire system. This is a practical way to describe, understand and monitor degradation in a system.
Every system and sub-system should be clearly de fined in terms of its boundaries, i.e. where its
starts/stops, which equipment and components are included etc. The functional boundaries of a system
can depend on the mode of plant operation.
Generally, the system to be assessed should not be de fined too broadly. The complete picture of
safety and integrity can be clouded by complexity or too much information, resulting in confusion
and misinterpretation. Conversely, too narrow a de finition may lose sight of the impact of a failure or
process upset in one sub-system with respect to other sub-systems [27].
In order to establish the hierarchy, every system is divided into sub-systems, equipment and/or
locations that might relate to a system failure. This ‘decomposition’ shall continue until the smallest
Get more
components for which FREE
sufficient standards
data from Standard
from inspections, Sharing Group
maintenance, and our
and failure chats
history are available
or may be collected. In certain cases, Condition Monitoring Locations (CMLs) can be also be used to
enhance/ optimize the monitoring and maintenance of equipment.
7 . 1 . 5 D e fi n i ti o n o f
th e s c o p e o f a n a l ys i s
For the systems, sub-systems (loops) and equipment to be assessed, the scope of the analysis including
operating conditions, loads and exceptional situations (e.g. upsets), as well as the operating period
considered shall be determined.
7 . 1 . 6 D e fi n i ti o n o f
d a ta s o u r c e s ava i l a b l e
The data sources available shall be identi fied. The data, as a minimum, shall include:
— design data;
— operating data; and
— historical data (maintenance and inspection records), where available/applicable.
The data should be balanced in respect to the needs of the application (system or equipment), the scope
of the assessment, the expected level of detail (or acceptable uncertainty) in the results, and foreseen
future service.
Preceding an initial analysis a brief overview of the plant or unit and its operation as a whole shall be
given, including, if available, the following information:
— process/operating history;
— speci fic process/operating requirements for plant items within the scope;
— routine operation;
20
BS EN 16991:2018
EN 16991:2018 (E)
— speci fic limiting factors for plant items within the scope;
— factors that can result in abnormal and upset conditions;
— possible future process/operating issues;
— potential degradation mechanisms and in fluential process variables and usual methods of mit igation;
— inspection history overview, including repair and alterations; and
— Management Of Change (MOC) list (plant, field changes).
Where no data exists (e.g. inspection history, because the plant or unit is still in the design phase), a
conservative risk approach shall be applied based on the RBI teams’ expertise and experience.
7 . 1 . 7 D e fi n i ti o n o f r e g u l a ti o n s to b e c o n s i d e re d
The applicable regulatory requirements shall be identi fied. These requirements may include the
quali fication of team members, software tools to be used (see 7.1.8 and 7.1.9 below), prescribed
inspection intervals, etc.
7 . 1 . 8 Te a m s p e c i fi c a ti o n s
A successful risk-based assessment requires competent technical inputs and perspectives from various
disciplines. This can practically be achieved only through a team effort. To setup the procedure, the
required expertise of the team should be de fined. The RBI team shall have competencies within:
— inspection and maintenance;
— speci fic equipment disciplines (e.g. materials, corrosion, electrical, instrumentation and control,
fixed and rotating equipment, etc.);
— health, safety and environmental issues;

— plant operation and processes;
— reliability, risk assessment and business impact.
However, not every competence area has to be covered by a different person, as individuals may possess
competence in multiple disciplines.
Attention should be paid to the selection of the competent team and the RBI facilitator, both being a
key element in successful risk-based assessment. No amount of sophistication or level of detail in the
procedure or other tools can compensate for de ficiencies in the team. An incomplete or insufficiently
experienced team can affect the quality of input information, the foreseen failure scenarios and the
conclusions of the assessment.
Managing a risk-based inspection and maintenance programme requires experienced personnel at all
levels, as well as appropriate routines for implementation (see 5.2.3).
The plant speci fic knowledge should be available in-house. Where in-house experience is non-existing
or unavailable, an appropriate external resource may be consulted.
Depending on the type of industry and the local rules and legislation, speci fic personnel requirements
and competencies may be required. Due consideration shall be given to the depth of background skills
and expertise collected in the team.
7.1.9 Tools to be used
It can be difficult to perform a detailed risk assessment without the support of dedicated software
tools. Such tools are used for managing the input data, performing the operations and calculations
required for risk assessment and supporting decision making. Additionally computerized systems are
21
BS EN 16991:2018
EN 16991:2018 (E)
used to store the data and analyse results or other related information when the need for reassessment
arises. Dedicated software tools are widely used to manage the large amounts of input data that will be
collected from the systems to be assessed. In such cases it is advantageous, but not necessary, to utilize
a tool which can interface with the existing data collection systems of the plant, e.g. such as those used
for inspection and maintenance.
The RBI team shall make sure that the software to be used is able to comply with the scope and
targets given for the assessment and that the basic analysis methodologies comply, e.g., with local legal
requirements.
7.1.10 Accuracy of the acceptance of the methodology

The RBI team and plant management should have a basic understanding of the level of commitment
and resources required for a successful implementation of the procedure, and about the time frame to
produce the intermediate and final assessment results. The responsible team shall take all necessary
actions to ensure the acceptance of the procedure and its objectives by the essential stakeholders, such
as the plant owner, plant management, authorities and competent noti fied or accredited bodies.
In order to include the HSE risks, the metric for risk-based decisions shall be de fined via company
standards and/or national legislation. For the process industry in general, three main risk criteria
should be used:
— plant worker safety and health;
— 3 rd party safety (people outside the plant boundary); and
— environmental damage, short and long term.
In case of business risk/impact, no absolute limits are provided by the regulatory framework or
comparable practices.
Get Instead, the business
more FREE standardsimpact
from associated with theGroup
Standard Sharing assessed
andrisk
ourischats
to be compared
with the competing alternatives in monetary terms. Financial limits shall be expressed by plant
management well within the initial stage of the assessment process and provided to the RBI team.
The risk acceptance criteria are used to derive the required inspection and maintenance activities
within the given time frame. For degradation mechanisms developing over time, the degradation
rate and acceptance limit provides an upper bound on the timescale for preventive maintenance or
inspection activities. For non-trendable degradation mechanisms, the acceptance limit has no clear
time scale, and prevention (through design), or early detection through proper measures (inspection,
maintenance, operation) and process monitoring shall be demonstrated. In all cases, the effectiveness
of selected inspection methods for detecting degradation mechanisms and damage extent shall
be considered.
7.2 Requirements
The RBI team shall take all necessary actions to ensure the acceptance of the RBI process and its
objectives by the plant owner, plant management and the responsible authorities.
7.3 Inputs
From an applicability and accuracy point of view, it can be more useful to perform a relatively thorough
analysis of a smaller well-de fined area of a plant rather than an incomprehensive assessment of much
wider area. However, in general, in the first step, the screening analysis should be made to pinpoint the
areas which require more detailed assessment [23] .
Stakeholder support should be seen as mandatory for meaningful assessment. Inadequate stakeholder
support or indifference to the objectives and procedure of the assessment can seriously limit the
applicability of the effort.
22
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
7.4 Procedure
For the de finition of credible failure scenarios, the team responsible for the implementation of the
procedure should agree what, within the context of their industry, is considered a failure of an item of
equipment. This activity should be a company issue.
Whenever a plant operates with different modes, it is necessary to de fine failure criteria that take into
account the speci fics of each operational mode.
7.5 Output
The expected output from the preparatory work shall be at least:

— selection of the applied procedure, competent assessment team and supporting tools;
— de fined boundaries and hierarchy for the areas, systems, sub-systems, loops and/or equipment
of interest;
— objectives, scope and methods of the effort, as well as con firmation of stakeholder support;
— collected regulatory requirements to set boundaries for the assessment and decisions affected by
the results; and
— collected risk assessment criteria from foreseen HSE, business and other impacts.
7.6 Warnings and applicability limits
The essential parts of planning, including the requirements, inputs, procedure and output involve
speci fic applicability limits or items of caution. Some of the most common ones are outlined below:
Speci fic issues related to static equipment:
Many static items of equipment are subject to mandatory national regulations, e.g. pressure equipment
and storage vessels containing hazardous fluids with a potential of toxic release, fire or other
environmental impact. In such cases the competent team shall include, or otherwise have access to
sufficient expertise on the regulations in effect at the time of the assessment. These regulations will
often require consideration of HSE criteria. The underlying potential hazards will frequently de fine the
risk scenarios to be considered within the risk assessment.
Speci fic issues related to dynamic (rotating) equipment:
Dynamic equipment such as turbines, pumps, motors, compressors, generators, fans, valves and gears
are often subjected to signi ficant loading in service, and form important parts of critical systems or
sub-systems. They should be considered within the assessment according their share to the overall risk
of the assessed unit/system/sub-system.
Dynamic equipment in particular can have more than one mode of operation. This necessitates
de finition of unique failure rates, taking each possible mode of operation into account.
Speci fic issues related to inspection deferral:
Situations in which the need to defer planned inspections beyond the set date may arise. In these cases
the following approach shall be adhered to:
1) Inform the correct level of management regarding the situation;
2) Identify the potential consequences of the deferred inspection;
Consequences might be direct such as increased safety risk and/or indirect such as effects of
mitigation e.g. reduced production or increased cost due to necessary mitigating actions.
3) Pursue mitigation measures to reduce consequences or reduce probability of failure;
23
BS EN 16991:2018
EN 16991:2018 (E)
Examples of mitigation measures might be: performing other types of inspections, reduction of
operating pressure, re-routing or other process changes, restriction of access to an area, monitoring
of relevant parameters, performing maintenance activities, performing temporary repairs, etc.
Mitigation can also be achieved in terms of more detailed analysis which might challenge the
conservatism in the existing evaluations.
4) Make a new plan for next inspection;
A new plan shall include the date and extent of the next inspection, as well as mitigation actions to
ensure that the risk is acceptable.
5) Obtain approval at the correct managerial level to defer the inspection based on the mitigation plan;
6) If necessary, obtain approval of the regulator for inspection deferral based on planed actions.
The work process for inspection deferral shall be well documented and approved at relevant
organizational level.
8 Data collection and validation

The collection and organization of relevant data and information (e.g. about design, operation, failure
information, etc.) is mandatory in risk-based analysis. The data used to assess both the probability and
consequence (and thus the risk) should be validated.
Where the data are sparse or of poor quality, the uncertainty associated with the risk analysis should
be assessed and possibly quanti fied. In such cases, the conclusion and assessments shall be on the
conservative side with respect
Get more to consequences
FREE andStandard
standards from probabilities.
Sharing Group and our chats
The RBI team shall specify the data requirements in order to plan the data collection process and to
assess the effort required. All collected data should be stored in a format such as a database, which will
facilitate the assessment, additional updating and auditing during the RBI process.
8.2 Requirements
Data collected for the implementation of the RBIF process shall include at least:
— plant level data;
— design and available manufacturing and construction data;
— operating data;
— maintenance and inspection;
— safety systems (e.g. fire detection systems, etc.);
— relevant international available experience; and
— business related economic data (optional).
In addition to reviewing documents, e.g. Process Flow Diagrams (PFDs), Piping and Instrumentation
Diagrams (P&IDs), inspection, maintenance and operating records and procedures, etc. the team shall
ensure that relevant non-documented data are collected.
The team shall have access to plant personnel who can provide an understanding of the actual plant
con figuration and operating conditions, the effectiveness of the plant inspection and maintenance
programs, and the identi fication of problems particular to the investigated plant. Involvement of
plant personnel can effectively contribute to their positive acceptance of the outcome of the risk-
based analysis.
24
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
8.3 Input
8.3 .1 General
It is recommended that the established RBI team follows the data collection and validation procedure
outlined below. Before this step the team shall have initially estimated the rough quality and quantity
of data that is needed for the analysis. The collected data shall be veri fied and stored, when used for
RBI analysis and documentation.
8.3 .2 Collect and validate documented data
The collection and validation of documented relevant data shall as a minimum include the
following elements:
1) Design, manufacturing and construction data:
These data are largely plant and equipment speci fic and in the form of numerical data or diagrams
and drawings of the process and systems, equipment, material selection and corrosion controls,
as well as safety systems. These background data also describe the functional requirements and
intended loadings, and can indicate potential locations of failures. Data validation may be performed
by internal cross-comparisons, comparison to physical and technical limits of the process and by
cross-comparison to expert opinion.
2) Inspection and maintenance history (including failure analysis):
These data are plant and equipment speci fic, and typically include records of inspection results
and of possible corrective actions such as repairs or modi fications to the original system or
equipment. The records shall also include experience on the mode and causes of failures or other
process anomalies. The most recent data updates any preceding information, and it may be possible
to construct time series from these data. Records of previous engineering and failure analyses,
as well as data and results from other process safety risk assessments (e.g. RCM, QRA, PHA,
HAZOP, etc.) may be considered as input to the RBI analysis. Data validation may be performed as
described above.
3) Operational history:
These data are plant and equipment speci fic, and may include at least some records of operator logs
to identify operating periods, transients outside the integrity operating window (IOW), start-ups,
trips and other shut-downs, and load levels during different phases of operation. These records also
indicate to what extent the actual operation has possibly deviated from that intended in design. For
predicting the future performance it is imperative to consider the future mode of operation, if it is
foreseen to be different from that in the past. Data validation may be performed as described above.
4) Safety systems:
Measures or barriers intended to prevent or control any hazard which may arise during plant
operation, or to mitigate the consequences in case of hazardous release. These measures or barriers
mainly comprise of:
— plant safety devices such as e.g. pressure relief s ystems, spill, fire and gas detection systems; and
— people and procedures e.g. operators, operating procedures, training and competency.
5) Generic failure and operational data for similar cases or equipment:
Generic data about failures in similar cases and equipment is available from various sources
[4] [24]. Generic data and information from operational experience are partly included in these
sources, although the available information can vary widely depending on case and equipment.
Data validation can be mainly performed by comparison of such sources and by expert opinion.
6) Economic data:
25
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
These data can in principle be plant and equipment speci fic, but are also often taken as generic for
each equipment type or type of action to be performed on it. Data validation may be performed by
cross-comparisons or by asking for quotations from suppliers. The required information should
also include cost of loss of production and indirect losses due to e.g. fines, refurbishment, etc.
8.3 .3 Collect relevant non-documented data
Relevant, non-documented data are generally available from most of the sources listed in 8.3.2 above.
Non-documented data typically consist of personnel knowledge and opinions, which can be a very
important source of information for the RBI analysis. Therefore, the team shall have access to the
personnel that can provide an understanding of the actual system, equipment con figuration, operating
conditions, the effectiveness of the inspection and maintenance programs, and identi fication of speci fic
problem issues. An interview process with the personnel (subsequently referred to as “expert”) is
recommended, and should include the following aspects:
1) expert opinion on his/her general experience with the equipment or system;
2) expert opinion on the perceived consequences (inclu ding personal) of unforeseen equipment failure;
3) expert opinion on the earliest possible time of failure;
4) expert opinion on the longest possible life (for a single item of equipment), or (for multi-component
items of equipment) on a time when repair is no longer economic/feasible; and
5) expert opinion on reasonable time intervals between shortest and longest failure times. Agreement
on the intervals is important, because too coarse a scale will not reveal uncertainty, and too fine a
scale may require excessively detailed analysis.
8.4 Procedure
The collected data shall be validated and stored, when used for RBI analysis and documentation.
Comparison to externally available information may also help, e.g. data on technical details, or cost
from the equipment suppliers, etc.
Data and results from other procedures, e.g. RCM, QRA, PHA, and HAZOP or, other previously performed
risk-based assessments (if available) should also be considered as input for the RBI analysis.
Documented background data are often available in the form of diagrams and drawings of processes
and systems, equipment, controls and instruments, safety systems, maintenance and operating records
and procedures. Useful operational and other plant speci fic data can include severity, mode and causes
of failures, and operator records to identify operating periods, transients, start-ups, trips and other
shut-downs, and load levels during different phases of operation.
Relevant non-documented data and information are typically available as personnel knowledge
and opinions. To obtain this information the RBI team shall have access to plant personnel that can
provide information of the actual plant con figuration, operational history, maintenance effort, and
current/future condition.
8.5 Output
The output of the data collection and validation process shall be an assessment of all relevant and
representative data, which are needed for the risk calculation of the equipment of interest. These data
shall be collated in an appropriate way, e.g. by storage in an electronic database, etc.
Depending on the availability of data, a change in the system/equipment boundaries identi fied during
the initial analysis and planning may be needed. In addition, insufficient data may require additional
effort to obtain new data through engineering analysis or by other means. In such cases, data
revalidation and reassessment shall be performed.
26
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The output of data collection and validation mainly consists of raw (or processed) technical data and
information related to failure probabilities and consequences. The de fined objectives and the system to
be assessed can largely dictate the depth and extent of the data collection.
Support of plant management and involvement of plant personnel are important and contribute
positively to their acceptance of the risk-based analysis results. Further, active engagement of
management and plant personnel has a positive in fluence on the quality of collected and processed data.
8.6 Warnings and applicability limits
Data related to design, manufacturing and construction (assembly) cannot always be updated
according to later modi fications. This is particularly likely for older equipment that has been used for
many decades and originates from the time before modern CAD/CAM documentation. The same can
also apply to controls and instrumentation, and to operational and maintenance history records for
similar reasons. The expert opinion of plant personnel about these issues can be essential.
One problem in data collection is the quality of generic databases – and particularly their failure
frequencies, from the point of including information related to inspections, maintenance and operating
conditions of equipment. Thus, these databases shall be used with care, and quali fied for use in each
case. Their applicability depends greatly on the following parameters:
— type of plant/equipment (size and fuel type);
— manufacturer;
— process fluid (including chemical control, corrosion, erosion);
— operating parameters (process pressure and temperature, vibration etc.);
— operating environment (moisture, temperature, etc.);
— operating constraints (load fluctuations vs. steady-state);
— inspection system/program/techniques; and
— geographic area (environment and external in fluences).
In order to obtain a reasonable probability or likelihood within the process the generic data have to
be modi fied (i.e. to calculate equivalent data) by taking into account all conditions pertaining to the
speci fic problem of interest (see [4]). It is recommended that different sources (e.g. several databases)
are consulted in order to incorporate the aforementioned issues 1) .
9 Multilevel risk analysis (ranging from screening to detailed)
Risk analysis consists of the following steps:

1) identify hazards;
2) identify relevant degradation mechanisms and failure modes;
3) determine Consequence of Failure (CoF);
4) determine Probability of Failure (PoF); and
1) For example, the NERC-GADS [25] system is only concerned with “de-rating” and forced plant outages;
equipment failures not associated with “de-rating” or forced plant outages go unreported [24] . A similar case is seen
in the VGB KISSY database [26] .
27
BS EN 16991:2018
EN 16991:2018 (E)
5) determine risk and classify equipment e.g. on CoF/PoF risk maps or iso-risk (equal-risk)
curves [17] [20] .
Multilevel risk analysis de fines the risk assessment in terms of complexity of the analysis (e.g. from the
simpli fied/screening analysis to the detailed one), and in terms of plant hierarchy level (depth).
An example of a multilevel risk analysis is provided in A.1. The inputs usually required for each step of
the screening and detailed phases of risk assessment are given in A.2 .
9.2 Risk analysis — screening level

9.2.1 General
Risk screening is particularly suited for plants with a limited set of data and for the initial evaluation
phase. Risk screening divides the systems and groups of equipment into two groups: high/medium-risk
items and low risk items. The high/medium risk items should be analysed in detail. The low risk items
should only require minimal surveillance to verify and ensure that the assumptions made during the
screening process remain true (see Figure 3). If information is missing during the screening, preventing
the determination of risk associated with the equipment, the equipment shall be regarded with a
conservative approach as having the worst conditions.
The following requirements shall be ful filled for risk analysis:
1) The decision criteria shall be de fined and recorded in writing;
2) The PoF shall be established for a given (prede fined) time frame based on a prediction of damage
development for operation within a speci fied operating window. The speci fied operating window
shall include factors, which can be in fluenced by the operation of the process (e.g. temperature,
pressure) as well
Getasmore
factors which
FREE cannot be
standards in fluenced
from bySharing
Standard the operation
Group(e.g.
andseismic zone, climate);
our chats
3) The health, safety, environment and business effects shall be included in order to assess the
consequence. In addition, the consequence results should be such that the highest (dominant)
CoF for one of the individual aspects (health, safety, environment and/or business consequences)
determines the final score (no averaging);
4) The methodology, the input data, the decision criteria and the results shall be documented;
5) The results shall be auditable by peer review.
9.2.2 Inputs
An example of the details required is shown in A.2 .
9.2.3 Procedure
The main purpose of the risk screening is to identify the low risk items (see Figure 3) and remove them
from further analysis. It is important to avoid making false negatives when classifying equipment in
the risk categories (e.g. to avoid classifying high risk equipment in low or medium risk categories). The
screening level of analysis is often sufficient to identify/highlight areas with high probability/frequency
of failure in the plant (units/systems), in which case further analysis is needed.
9.2.4 Output
Typical results from these tasks are:
— low risk items/systems which can be considered for minimum surveillance and regular veri fication
of assumptions and assessment;
— high/medium risk items/systems for further evaluation;
28
BS EN 16991:2018
EN 16991:2018 (E)
— risk value or category for the item of equipment under consideration in the screening risk matrix
shown in the left part of Figure 3; and
— warnings and applicability limits.
On the screening level, PoF assessments are usually more resource/cost intensive than CoF assessments.
Therefore, it may be preferable to screen systems and groups of equipment on consequence of failure
only. This is also acceptable, even if in this report other types of screening are suggested.
Figure 3 — Example screening risk matrix 2)
9.3 Risk analysis — detailed assessment

9.3.1 General
The detailed assessment differs from screening in the depth of detail required for analysis and hence
involves considerably more effort. The detailed assessment shall be applied to the high/medium risk
systems and groups of equipment identi fied in risk screening and to all equipment within the scope
of work if no risk screening has been performed. For each system or group of equipment, the relevant
degradation mechanisms shall be identi fied and the extent of damage shall be estimated. Furthermore,
the most likely damage development shall be determined. Based on this information, the maximum time
interval to the next inspection/maintenance activity shall be determined subject to the condition that
the health, safety, environmental and business risks remain acceptable (as de fined in the acceptance
criteria). This should then be combined with inspection/maintenance cost and inspection/maintenance
effectiveness to derive cost optimal maintenance/inspection intervals such that the health, safety, and
environmental, risks are acceptable, i.e. the acceptance criteria are satis fied.
2) For further details of the Generic RBI process, refer to detailed guidelines such as, e.g. [27] .
29
BS EN 16991:2018
EN 16991:2018 (E)
The detailed analysis consists of the following main tasks (Figure 2):
1) identify hazards, relevant degradation mechanisms and failure modes;
2) determine probabilities of failure (both unmitigated and in those later mitigated);
3) determine consequence of failure (both unmitigated and in those later mitigated);
4) assess risk.
9.3.2 Requirements
The main requirements for identifying and considering degradation mechanisms are:
— identify the degradation mechanisms according to the systematic example given in Figure 4. The
degradation mechanism can be active in a given system/equipment;
— the plant breakdown, identi fication of degradation mechanisms and analysis process shall be
duly documented;
— the plant management shall ensure that the knowledge of service and maintenance history and all
known degradation mechanisms in the plant is considered in the analysis;
— the responsible person(s) involved in the analysis shall ensure that all available knowledge about
the degradation mechanisms and experience from similar plants is considered in the analysis;
— all emerging degradation mechanisms not taken into account under the speci fic categories are
taken into account under “other” degradation mechanism.
In addition:
The analysis of failure modes increases the level of detail in the CoF assessment. If it is not undertaken,
a conservative approach shall be followed. A conservative approach may, e.g., assume that the complete
inventory escapes instantaneously.
The PoF shall be established for a given (prede fined) time frame based on a prediction of damage
development for operation within a speci fied operating window. The speci fied operating window shall
include parameters which may vary during operation (e.g. temperature, pressure) as well as parameters
which cannot be changed (e.g. seismic zone, climate).
The prediction of lifetime may come from the result of one of the following: measured inspection
data, calculation making use of operating conditions or expert opinion. If so desired, speci fic analysis
tools may be used, e.g. probabilistic (safety) analysis and/or fitness for service analysis. For all non-
trendable degradation mechanisms, for which degradation progress cannot be properly monitored
or predicted, prevention (through design), or early detection through proper measures (inspection,
maintenance, operation) and process monitoring shall be demonstrated. A methodology should be
available in which the relation between the effectiveness of measures (type, scope and frequency) and
the likelihood/probability of failure is given.
The CoF analysis shall focus onto the highest (dominant) aspect from the individual ones (health, safety,
environment and/or business). The averaging of these aspects shall not be done.
The decision criteria shall be de fined and recorded in writing. The methodology should be veri fied/
benchmarked. CoF safety can be benchmarked against existing and recognized methods. 3)
The task should be performed by the competent RBI team (see 6.2, Initial analysis and planning).
The results should be auditable by peer review; therefore, the methodology, the input data, the decision
criteria and the results shall be documented (the results shall be recorded in an authorized document).
3) Examples of established methods for CoF safety are given as references [29] , [30] .
30
BS EN 16991:2018
EN 16991:2018 (E)
9.3.3 Inputs
The details required for performing the steps of risk assessment in detailed level are shown in A.2 .
9.3.4 Procedure
9.3.4.1 General
Detailed assessment is an elaborate procedure involving multiple activities for carrying out the
individual steps.
A number of tools can be used for identifying hazards. In this case, it is recommended to carry out
a system level failure mode and effects (criticality) analysis, or FME(C)A according to the available
standards [28]. There are also a number of software tools that can support FME(C)A. In addition, other
analysis methods exist, such as HAZOP [58] or those listed in IEC/ISO 31010 [9] .
The next step in the procedure is the identi fication of the relevant degradation mechanisms and
failure modes per system, sub-system or degradation loop. A failure mode is any possible state where
a de fined function cannot meet the desired performance requirement. The main failure mode for static
pressure equipment is “loss of containment”. The listing of failure modes is made easier if the functional
breakdown is well described.
All probable failure causes for the identi fied failure modes should be listed for the system, sub-system
or degradation loop (see Figure 4). These could be failures dealt with by the current maintenance
program, historical failures and possible future failures. The RBIF methodology aims to foresee these
and prevent them. The failure cause list should include all events that are likely to be linked to the
identi fied failure modes. This should include equipment wear/deterioration, human factor impact, asset
design etc.
The root cause phase investigates the underlying causes connected to the failure modes. Establishing
the root causes increases the possibility of finding the appropriate tasks for preventing these failure
modes. The hierarchical breakdown and the root cause phase in Root Cause Failure Analysis (RCFA)
can provide better insights into relevant damage mechanism.
Annex A.6 presents the various types of in-service damage and their speci fication. The hierarchy of
degradation mechanisms in relation to the plant equipment hierarchies is also shown in A.7, with an
example case.
The approach proposed in A.8 lists the damage mechanism systematics with inspection methods and
combinations of PoD (Probability of Detection), effectiveness and FCP (False Calls Probability).
31
BS EN 16991:2018
EN 16991:2018 (E)
Figure 4 — Damage types that may be considered, appearing as failures or root

failure causes [4]
9.3.4.2 Risk Assessment

In order to assess the health, safety, environment, and business risks, the PoF (see A.9) and CoF (see
A.10) shall be determined. The results can be plotted in risk matrices (Table 3) for presentation
and comparison. Separate matrices should be used for each risk type unless it is appropriate to
compare/combine the risk types. Note that the risk matrix presents the risk for a prede fined time period.
It is generally useful to rank the evaluated equipment or components by risk level (see Table 2), because
this will provide guidance on where to concentrate the inspection/maintenance effort and where such
activities can be reduced. If risks are measured in monetary terms, the expected need for mitigation
32
BS EN 16991:2018
EN 16991:2018 (E)
investment as well as savings resulting from avoidance of unnecessary inspection and maintenance
become apparent. This requires the setting of a reasonable cut-off level for the evaluated risk criteria.
Table 2 — Example of decision/action criteria for various risk levels in risk matrix [4]
Risk Level Decision/Action criteria
Very high De fine required immediate measures to reduce risk e.g. consider equipment repair/ re -
placement. A possible re-design may also be considered.
High De fine required inspection and maintenance program to reduce risk (Note: it can be ac-
ceptable if the driver is economic loss, security, image loss and public disruption).
Medium Reduce the risk through mitigation measures as low as reasonably practical (ALARP). For
business risk, find the optimal cost.
Low If no inspection and maintenance program plan exists, it is not mandatory to establish
one. Otherwise, fine tune the program to find the optimal costs and follow the ALARP
principle.
Very Low No Action
9.3.5 Output
Typical results from these tasks are:
— the PoF value for the item of equipment under consideration;
— the CoF value for the item of equipment under consideration;
— risk value or category from Table 2; and
— warnings and applicability limits.
33
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Table 3 — E xample of the risk matri x for detailed assessment, involving H SE and economic
r i s k s w i t h fi ve r i s k l i m i t c a t e g o r i e s , i n c l u d i n g e x a m p l e s o f
t h e v a l u e s o n t h e s c a l e s (t h e s c a l e
and values to be determined in each particular application) , adapted from [4] [2 7 ]
PoF Qualita-
MOTBF annu- tive Description
al
In a small population*,
one or more failures
can be expected annu- Very
<1 Very prob- ally.
> 10 −2 5 high
year able
Failure has occurred risk
several times a year in

location.
In a large population**,
one or more failures
can be expected annu-
1–5 10 −3 to ally. H igh
Probable 4
years 10 −2 risk
Failure has occurred
several times a year in
operating company.
Several failures may
occur during the life
of the installation for
5–25 10 −4 to a system comprising Medium
Possible of a small number of 3
years 10 −3 risk
equipment
Failure
Get more FREE hasstandards
occurred infrom Standard Sharing Group and our chats
company.
Several failures may
occur during the life
of the installation for
25– a system comprising
10 −5 to
100 Unlikely of a large number of 2 Low risk
10 −4
years equipment
Failure has occurred in
industry.
Failure is not expected. Very
> 100 Very un- Low,
< 10 −5
Failure has not oc- 1
years likely (negligi-
curred in industry. ble risk)
Notes: Consequence of Failure
* Small population = 20 to 50 items of equipment.

A B C D E
** Large population = More than 50 items of equipment.
Serious
Limited
Tem- impact
Warning impact
Warning porary on public
issued on public
Health effects issued
Possible
health
prob-
health,
health,
life
No effect threat of
impact lems, threat-
chronic
curable ening
diseases
illness
(or)
34
BS EN 16991:2018
EN 16991:2018 (E)
PoF Qualita-
MOTBF annu- tive Description
al
No aid
First aid Tem- Perma-
needed
needed
Safety effects Work
No work
porary
work
nent
work
Fatalities
disrup-
disability disability disability
tion
(or)
Impact Off-site
Minor
Negli- (e.g. damage
Environment gible spill)
impact On-site
(e.g. damage
Long
impact con- term
spill)
tained effect
(or)
Business (€) < 10k€
10–100
k€
0,1–1 M€ 1–10 M€ > 10 M€
(or)
Security None
On-site On-site
(Local) (General)
Off site
Society
threat
(or)
Loss of reputation None Minor
Bad pub- Company Political
licity issue issue
(or)
Small Large
Public disruption None
Negligi-
ble
Minor commu- commu-
nity nity
10 Decision making/action plan

This sub-clause describes the proposed decision framework for optimizing and updating the inspection
and maintenance strategy. The following factors necessitate the optimization and updating of the
strategy (plan):
— material degradation;
— unreliability of equipment/machinery;
— human error in the operation, maintenance or inspection of the equipment/machinery;
— legislation and other regulatory requirements;
— external hazards such as earthquakes, harsh weather etc.; and
— unacceptable risk, as de fined by the acceptance criteria.
10.2 Requirements
Adequate competencies, understanding, knowledge and experience relevant for:
— RBI and knowledge of how the RBI results relate to inspection activities;
— degradation mechanisms and inspection methods including their application and limitations;
35
BS EN 16991:2018
EN 16991:2018 (E)
— legislative requirements and facility speci fic procedures and requirements; and
— relevant acceptance criteria and codes.
The work process shall be auditable by peers and well documented.
The inspection and monitoring plan:
— shall consider relevant degradation mechanisms for all systems included in the scope.
— shall meet the relevant legislative requirements;
— should be veri fied in the field and adjusted for accessibility, removal of insulation and other
preparatory work;
— shall be veri fied by personnel with a similar or higher competence level than the personnel
establishing the plan.
10.3 Inputs
The minimum required input to establish a risk-based inspection and maintenance plan are:
— results from RBI analysis including degradation mechanisms, PoF, CoF, risk ranking and the time
interval of inspection and maintenance plans;
— historical inspection and maintenance data;
— design and operational data including necessary technical documentation; and
— general turn-around plans and availability of the relevant systems/equipment.
10.4 Procedure
10.4.1 General
The following steps can be followed to prepare an inspection program based on the RBIF methodology:
— identify items with risk above the risk acceptance limit;
— de fine actions for the different degradation mechanisms;
— de fine degradation groups and relevant areas susceptible to damage (i.e. susceptible areas);
— select inspection points/locations.
These steps do not take into account other documentation/information that is required to optimize the
inspection program. Such information might be:
— monitoring results, including IOW;
— process changes;
— operational irregularities (upsets);
— non-conformities from fabrication; and
— legislative requirements.
The above mentioned documentation might change the RBI results and hence alter the inspection
program. Such information should be incorporated in a RBI re-analysis/evergreening to re f lect the
actual situation in the best possible way.
36
BS EN 16991:2018
EN 16991:2018 (E)
The analysed equipment should be ranked according to risk. Equipment exceeding the risk limits soon
after the planned inspection period should also be included into the planning. This step can help to
better prioritize the actions.
Following the results of the RBI analysis, the applicable degradation mechanisms shall be identi fied
and relevant inspection methods shall be de fined for each type of mechanism. The following shall be
evaluated (see also Figure 5):
— next inspection, maintenance or monitoring interval;
— inspection method and required coverage to achieve reliable results;
— probability of detection (PoD);
— typical inspection locations (consideration of weakness and locations for corrosion control i.e.
susceptible areas); and
— inspection cost; and
— case and application speci fic issues and limitations e.g. consider NII when dealing with sensitized
austenitic steel equipment.
This information can be used as basis for a company-speci fic guideline which controls the handling of
different degradation mechanisms.
1 0 . 4 . 2 D e fi n e d e g ra d a ti o n g r o u p s a n d r e l e va n t s u s c e p ti b l e a r e a s
Figure 5 provides the suggested general work f low of the work process from RBI analysis to a risk based
detailed inspection plan. In order to achieve an effective inspection program the inspections should be
organized according to the degradation groups, as illustrated by step #2 in Figure 5. This utilizes the
correlation between items within same degradation group to achieve reliable and updated degradation
rates. A degradation group might suffer from several types of degradation, with several sets of
susceptible areas; these should be assessed and planned separately, as shown by step #3 in Figure 5.
37
BS EN 16991:2018
EN 16991:2018 (E)
F i g u r e 5 — E x a m p l e o f
g e n e r a l wo r k f l o w o f
t h e R B I p r o c e s s
The inspection coverage with respect to number of susceptible areas should be assessed according to
the entire degradation group – all susceptible areas within the group shall be identi fied to understand
what constitutes the full “100 % inspection” for the relevant degradation, as shown by step #4
in Figure 5.
Based on de fined representative areas within a degradation group and de fined inspection methods
for different degradation mechanisms the accurate inspection points (e.g. CML’s), as shown by step #5
in Figure 5, and inspection method as shown by step #6 in Figure 5, shall be applied. The inspection
and inspection effectiveness table given in [31] , Appendix F may be used as a guideline to decide on
inspection extent.
The inspection program should be veri fied on site to optimize the program with respect to access and
other relevant conditions, normally outside the RBI analysis. This input shall also be utilized to plan for
preparatory work, as shown by step #7 in Figure 5.
10.5 Output
The decision logic gives guidance for the establishment of preferred inspection and maintenance
strategies on the basis of the risk assessment, detectability of damage and the failure characteristics.
38
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The inspection and maintenance plan shall be plant speci fic. Such a plan shall include but not be
limited to, the following elements (the same holds true for dead-legs and piping with irregular flow e.g.
bypasses, drains, etc.):
— details of inspection methods (e.g. UT scan), locations (e.g. Nozzle G 6°° position) and interval
(e.g. 24 months);
— time and condition based maintenance (preventive/predictive);
— on-stream inspection and maintenance;
— planned corrective actions (e.g. replace nozzle);
— identi fication of degradation and damage (e.g. general corrosion 0,2 mm/year and erosion); and
— regular functional testing (PRV) and monitoring (IOW);
— the RBI inspection plan shall ensure timely and effective inspection, which correctly detects and
identities the degradation, and reduces the uncertainty by increasing knowledge about the actual
equipment state.
1 0.6 Warnings and applicability limits
The RBIF applies primarily to systems and equipment during the in-service phase of the operation, but can
also be applied in the design-phase for analysis an d determination of maintenance/inspection strategie s.
Relevant limitations and regulations need to be taken into account when creating the RBI action plan
and might impose changes in the inspection interval, inspection extent and methodology, etc.
Even in the case of evaluation and veri fication of the RBI plan by personnel with the required
competence and/or authority, the inspection planner should re-evaluate and rectify the results of
items showing a short time to next inspection. In general, the analysis is conservative in that, whenever
there is information missing, the “worst case” scenario is assumed. Such assumptions might result in a
relatively short time to next inspection, and extra effort should be made to clarify this.
Wherever possible, the inspection planner should also compare the RBI analysis results to earlier
results from similar installations, known failures in existing plants and historical inspection data. This
will highlight any signi ficant differences which may indicate errors or oversights.
Items such as branch piping without its own tag number, dead-legs and piping with irregular flow (e.g.
bypasses, drains etc.) are often not assessed in the RBI-analysis. This type of piping usually has thinner
walls than the “main” pipe and this will, for some degradation mechanisms, result in a higher PoF value.
Whenever possible, these items should be identi fied so they can be treated separately.
11 Execution and reporting
1 1 .1 General description and scope
The output of a RBIM plan is the input for the planning and scheduling for all involved departments,
disciplines and contractors for the maintenance and inspection work at a facility including the plant
outages ("turnaround"). The output of the development of the RBIM plan will be based around
maintainable items. It will allow management of risk and lead to knowledge based decisions. The
RBIM output will allow for a broad variety of strategies such as the reduction or mitigation of the risk
through monitoring, functional testing and improvement of procedures for process, operation and/or
maintenance, inspection, modi fication, repair, replacement, or operation to failure. The maintenance
work can be split into three main categories shown in Table 4.
39
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Table 4 — Principal categories of inspection/maintenance
Type of maintenance Typical pro cedure B y whom
1a. On-stream/in-service No plant nor item shutdown required Operating / own staff /
(Non-Intrusive), OS/NI specialists / contracting com-
panies
1b. On-stream/not in-service Item shutdown required, but no plant shut- Operating / own staff /
(Intrusive), OS/I down specialists / contracting com-
panies
2. Short shutdown Shutdown to change worn equipment, or Own staff / specialists / con-
changes called by process (catalysts, molecular tracting companies
sieves, etc.)
3. Turnaround/general over- Larger plant stops for major upgrades, repair, Own staff and contracting
haul inspection, process upgrades companies
1 1 .2 Input
The main input to the planning and execution is a RBI process including all equipment in scope. From
this risk assessment the following results are expected:
— risk ranking of the plant(s)/equipment/component(s) including, but not necessarily limited to static
equipment, piping and pressure relief devices;
— type of inspection and maintenance. This can be a high level inspection plan as usually delivered by
the RBI software or a detailed inspection plan, including speci fic inspection locations and methods
as usually delivered by an inspection expert;
— timing for activity/planned inspection date – typically by condition based or time-based scheduling;
— required work and skills to perform the tasks, and estimated time per task;
— requirement for total or partial plant shutdown, intrusive or non-intrusive inspection;
— dependencies between work on the evaluated unit and other equipment/components;
— tools, personnel expertise and spare parts required.
1 1 .3 Procedure
The maintenance (or inspection) work normally consists of work generated from 3 different sources
(see Figure 6 ) and involves activities speci fied in Table 5:
1) Preventive plans generated by RBIM assessments (condition based and/or scheduled maintenance),
even if these only refer to inspection;
2) Corrective maintenance calls from observed failures or emerging problems;
3) Failures identi fied via condition monitoring.
40
BS EN 16991:2018
EN 16991:2018 (E)
Figure 6 — Maintenance Planning. Example of RBWS priority setting for work order planning
(short and long-term), EN 13306 [12]
Table 5 — Activities in execution and reporting

Activity Description
Risk-Based Work RBWS is used to prioritize the work on daily or weekly basis, both for the corrective and
Selection (RBWS) preventive tasks. In some cases, it may be possible to postpone corrective tasks. Thus, the
RBWS activity deals with the optimum selection and timing of the tasks to be performed.
However, RBWS should not replace the RBIM risk analysis, nor postpone maintenance tasks
for too long.
Work execution The work execution involves:
• Issuing a work order;
• Availability of support documentation;
• HSE – toolbox talk, risk assessment;
• Control of work executed.
Tools and data- A modern maintenance organization will use a Computerized Maintenance Management Sys-
bases tem (CMMS) as the key tool in managing the maintenance function. The CMMS system will
typically contain the following information/modules:
• Plant equipment breakdown (functional location hierarchy);
• Key technical information;
• Maintenance plans;
• Work order m a n agement (wo rk f low, s ign atu re) ;
• Maintenance reporting;
• Reporting and analysis module.
In the context of RBIM information (failure modes, failure rates and associated consequenc-
es), a minimum requirement for the CMMS systems is that it should contain or link to the risk
information from the risk assessment.
41
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Activity Description
Reporting and The purpose of documentation of the executed maintenance work is:
documentation of
work • The documentation of the equipment state, before and after the work. Information on type
of degradation, extend of damage – information to be used for future planning. A combination
of failure coding, text and pictures is recommended;
• Cost and time control – how many man-hours were used, spares – type and cost – used,
tools used.
Accurate reporting is key to the analysis and updating of the inspection and maintenance
plans. Inadequate quality of this part of the work will cause the future risk-based planning
to be sub-optimal.
Analysis The results from the maintenance work done, should be analysed and fed back into the RBIM
system on a regular basis, typically via monthly, quarterly and yearly maintenance and in-
spection reports. These reports should typically contain information on:
• Backlog – work performed versus the planned work;
• Breakdown work (non-planned work);
• Availability for the main production system, and maintenance related losses;
• Reliability of the safety systems;
• Trending of key parameters related to availability, integrity and reliability.
1 1 .4 Output
The output from the maintenance execution work is a plant management system where the preventive
maintenance is based on RBI analyses and corrective maintenance is also managed using risk-based
principles. As a result, the risk of failure is under control and reduced to an acceptable level and the
reliability, and therefore the availability,
Get more FREE standardsis a known parameter.Sharing Group and our chats
from Standard
A Corrosion Control Document (CCD) can also be part of a RBIM program. Such a document refers to
the degradation mechanisms speci fic for a process unit of a plant/site. Such a document furthermore
explains how equipment degrades and how to locate and mitigate or avoid the damage.
1 1 .5 Warning/ application limits
The quality and capability of a RBIM plan depends on the input. To achieve a successful RBIM plan it
is crucial to include input data from operation, process, maintenance and other experts. It is essential
to ensure that the RBIM plan adheres to the applicable international and European Union (or other
national) regulations and company policies. If required, a second opinion from independent experts
should be sought in reviewing the successful execution of plans.
1 2 Performance review/Evergreening phase
1 2 .1 General description and scope
The purpose of the evaluation of the RBIM process is to assess its effectiveness and impact in
establishing the inspection and maintenance programs. This will allow the identi fication of areas where
modi fications and improvements are needed. Speci fically, evaluation consists of the following tasks:
— assessment of the effectiveness of the RBIM process in achieving the intended goals (assessment of
effectiveness);
— updating the RBIM process by taking into account possible plant changes (additions, new units,
changes) and available new knowledge (reassessment of the risk);
— periodical re-evaluation of existing RBI plans in order to discuss eventual changes in:
a) design requirements;
42
BS EN 16991:2018
EN 16991:2018 (E)
b) process parameters, operational conditions;

c) actions after non-planned maintenance (e.g. plant integrity failures);
d) actions after turnaround (shutdown) maintenance and inspection; and
e) actions after legal and compliance issues.
— frequent discussion on inspection and/or maintenance findings in order to update to RBIM plans
based on the newly acquired data;
— re-evaluation of data based on experience from industry or other plants with similar units and
process conditions, including relevant references and regulatory documents since last review;
— periodical re-evaluation of CoF, based on the periodical re-evaluation of HAZOP, etc. or financial
factors, e.g. through change in long term spare part availability, reputation or product value.
12.2 Requirements
The evergreening process involves both internal and external assessment conducted by the plant
organization (RBI team) and by independent experts, respectively.
The internal evaluation by the plant organization is an integral part of every RBI activity and should be
considered as a living process within the overall risk decision making process. The internal evaluation
can take place in any moment of RBI, especially when:
— discrepancy from any expectation or requirement is found, e.g. design requirements, process
parameters, operational conditions, leaks, non-planned maintenance that has been performed etc.;
— new knowledge or acquired data, e.g. inspection and/or maintenance findings is available or plant
changes occur.
In both cases, a detailed analysis of the importance of the involved item shall be conducted in order
to assess whether it has a signi ficant impact on the RBIM process including the inspection and
maintenance planning, and some corrective action should be undertaken. In the latter case a thorough
analysis of the causes leading to discrepancy or of the effects of the new knowledge/plant changes shall
be performed.
The external evaluation can be executed through independent reviews by independent third parties,
by the owner, or regulatory bodies (e.g. audits). Independent reviews provide an opportunity to
complement the internal evaluation with a different and neutral perspective. A point to note is that
the value of information provided by the independent review is directly proportional to the openness
and collaboration that the external experts will find in the audited organization. The integration of
independent reviews with internal evaluation will allow the identi fication of necessary actions for
improvement.
12.3 Inputs
For assessment of effectiveness, the following can be used:
— de finition of risk decision-making process goals (risk may be expressed in one or more of the following
terms: business impact, e.g. unit reliability, availability and safety, health, environment impact);
— de finition of performance indicators as a measure of t he RBI process achievements against the above
given goals. (Note that in order to enable a meaningful evaluation of the performance, consideration
should be given to the appropriate time frame applied for the various performance indicators. This
is especially true when a relation is identi fied between the performance and potential causes; it may
be more meaningful when certain quantities are assessed for a longer period of time. For example,
the cost of inspection and maintenance in year X affects the availability in a certain period of time
after year X);
43
BS EN 16991:2018
EN 16991:2018 (E)
— reference to existing (industry, regulatory and company) standards;

— benchmarking with similar operating units/plants/organizations.
For reassessment of risk in the evergreening process, the following is needed:
1) Plant information:
— changes in design;
— changes in plant operation (mission, operational re gime and production parameters, production
rate, capacity, internal and external environment);
— time dependent operating conditions in order to evaluate whether such conditions can lead to
e.g. fatigue, cracks, etc.;
— change in level of personnel training, new control instrumentation and methods, and whether
these can lead to integrity risks;
— inspection results including relevant damage, degradation mechanisms and corrosion rates,
conditions of coating or insulation, etc.;
— maintenance records, spare parts;
— failure history of actual systems/equipment;
— mitigation actions and their effectiveness; and
— revalidation of CoF.
2) New knowledge:
— applicable research and industry-wide development;
— newly improved risk analysis, RBI software changes affecting risk. Advanced inspection
methods and techniques, e.g. robotics, new data on inspection and testing effectiveness and
limitations;
— feedback from industry-wide operational experience or other, similar units at different locations
within the company; and
— newly discovered degradation mechanisms (absence/presence of unanticipated degradation
mechanisms), new limits from industrial best practice, e.g. CUI temperature limits.
12.4 Procedure
12.4.1 General
Assessment of efficiency is a combination of good reporting including the aspects concerning business
targets and audit of the plant. This audit can be performed by internal resources (typical for large
organizations), by the owner, or by an independent third party. Methods or approaches applied in such
an assessment are described below.
The performance indicators are used for the measurement of the business performance of a plant. The
Key Performance Indicators (KPIs) should re f lect important goals for the plant, company or owner, and
may change with time. For example, a plant in its post start-up period may focus on availability and
at a later stage on maintenance cost. An example of a set of KPIs from the owner’s point of view is
provided in A.11.
44
BS EN 16991:2018
EN 16991:2018 (E)
1 2 . 4 . 2 Wo r k p ro c e s s e f
fi c i e n c y b e n c h m a r ki n g
The RBI process should be benchmarked against best practices in the same plant, company or industrial
sector. This can be done in parallel and as part of evergreening, or separately, in order to prepare a
management report.
An internal evaluation resulting from the team’s experience with the RBI process can be further
supported by an external evaluation, part of an audit or view of authorities.
Since RBI is not a project in itself but a process, its implementation should partly be handled as
change management and be sustainable. The outcome of a RBI process is a risk analysis including PoF
and CoF, potential damages and damage rates, IOW as well as a detailed inspection plan, including
inspection locations, methods, reasoning for the chosen methods (PoD), coverage and maximum
inspection interval.
The following key elements shall exist after this phase:
— management system for maintaining documentation, data, IOW, analysis updates;
— documented method for determining the PoF and CoF; and
— documented method for managing risk through mitigation strategies (inspection and other).
The RBI process is supposed to generate/identify/consider (as appropriate):
— potential and active damage mechanism;
— IOW parameters and limits;
— risk ranking of all evaluated assets/equipment;
— detailed inspection plan, incl. methods, locations, coverage, interval; and
— description of other mitigation activities, e.g. IOW monitoring, hazard effect control.
Immediately after the above outcome of the detailed inspection plan, the evergreening phase begins.
This phase usually includes following steps:
— inspection work pack initiation;
— inspection execution;
— evaluation of inspection data and entry into RBI database;
— feedback and NCR initiation;
— updates from units, if changes in equipment, process changes or process upsets have occurred (this
information needs to be made available by operations to inspection, maintenance and RBI teams);
— risk calculation;
— update of active damage mechanisms (corrosion rate, remaining life) and inspection plans;
— consultation of technical supervision organizations (if applicable);
— follow up on NCRs;
— con firmation of correction/repair;
— reminder of non-completed repairs and inspection due dates; and
— distribution of the RBI plan to the planning department.
45
BS EN 16991:2018
EN 16991:2018 (E)
The risk management and replacement strategy can be used in order to assess the optimum time
for replacements, according to cost of risk (this usually increases with time, but also with market
f luctuations, e.g. in case of high demand for the product, the cost of risk increases), cost of not performing
the maintenance, labour and material costs, value of lost production during maintenance. Such RBI
cost-bene fit analyses serve as the economic basis for inspection decisions and optimal replacement
strategies in line with the turnarounds.
46
BS EN 16991:2018
EN 16991:2018 (E)
Annex A
(informative)
Assessments
A.1 Example of a multilevel RBI analysis in power industry
Figure A.1 — Multilevel Risk Analysis (see also Table A.1)
47
Table A.1 — Explanation for the levels in the Multilevel Risk Analysis (see Figure A.1)
48
EN 16991:2018 (E)
BS EN 16991:2018
Explanation for the levels in the Multilevel Risk Analysis (see Figure A.1)
Level 1 Explanation
We look at both critical damage, unacceptable for further operation and failure statistics, and how this knowledge
P.L1–1. Damage/failure statistics in f luences the Generic Failure Frequency (GFF). Example: if a vessel has GFF of 5·10 −4 , the high level of damages and
failures can increase the PoF to e.g. 8·10 −4 .
This factor considers whether there is an increased probability of failure (or critical damage unacceptable for fur-
P.L1–2. Damage related to design, material
or assembly
ther operation) in the first years of operation of the equipment, due to the equipment design, material of construc -
tion or the assembly.
P.L1–3. Damage caused by operating con- Takes into account damage arising from the operating conditions or the combination of process f luid and material
ditions used and also the frequency of this damage occurring.
This factor considers whether this equipment or component (e.g. weld, bend) has been inspected within the pre-
scribed periods for internal and external inspection and pressure testing, as applicable. It considers whether dam-
P.L1–4. Inspection status and findings age or degradation has been discovered by the inspection. Furthermore, it also conservatively considers equipment
deserving special attention, if no inspection has previously been performed.
C.L1–1. Health and safety consequences Takes into account the possible health and safety impact on persons.
C.L1–2. Environmental consequences Takes into account the possible environmental impact.
C.L1–3. Economic consequences Takes into account the possible economic impact resulting from loss of production and damage/repair costs.
Level 2 Explanation
This factor FREE
Get more takes into account the
standards fromcondition of the
Standard water chemistry.
Sharing Group and A review of historical reports shall be carried
our chats
P.L2–3.1. Quality of water/steam chemistry
out, and it shall be determined whether the water chemistry is typically within the set limits.
For piping systems which may be susceptible to fatigue either mechanical or thermo-mechanical in nature e.g.
P.L2–3.2. Potential for mechanical fatigue
stress
concerns over the f lexibility of a piping run or high level of starts and stops or poorly supported pipe connections to
vessels or valves.
This is aimed at highlighting any equipment that may be susceptible to high thermal stresses i.e. thick-walled equip-
P.L2–3.3. Potential for thermal fatigue ment subject to large temperature differences over a short time would be considered “likely” to experience thermal
stresses stresses. A thick-walled item of equipment with small temperature gradients would be considered “unlikely” Thin-
walled equipment rarely has high thermal stresses unless suddenly quenched.
If it is considered that any region of an item of equipment may be subjected to higher stresses than those allowed
by design, then it should be highlighted here e.g. if a piping system is poorly supported then it is “likely” that some
P.L2–3.4. Local mechanical over-stressing
regions will be over stressed. Similarly, if the support system is not regularly checked the over stressing should be
considered “possible”.
P.L2–3.5. Local hot spots
This criterion generally refers to boiler tubing or headers where uneven firing/gas streaming etc. can result in local -
ized hot spots.
P.L2–3.6. Nominal operating temperature This relates to the design operating temperature. It is mainly important for high temperature equipment operating
(relative to design operating temperature) in the creep range.
Table A.1 (continued)
Explanation for the levels in the Multilevel Risk Analysis (see Figure A.1)
Level 1 Explanation
P.L2–3.7. Corrosion susceptibility due to If the combination of operating conditions and/or material type may result in corrosion or in the case of high tem-
operating conditions perature equipment high temperature corrosion/oxidation.
Thermal excursions considers the number of equivalent hours the equipment operates above a set reference temper-
ature per month. The number of equivalent hours should take into account:
The calculated reference temperature, based on the material type of the equipment, determined from e.g. PD 6525 or
P.L2–3.8. Temperature excursions ISO, and the highest calculated stress for the equipment, determined from e.g. TRD 301;
The number of actual hours per month in excursion;
The equivalent ∆Θ.
P.L2–3.9. Number of cold start-ups or shut-
This factor gives a ratio of the real number of cold start-ups or shutdowns to the number allowed by design accord-
downs over design number according to
ing to the standard.
the standard [%]
P.L2–3.10. Number of warm start-ups or
This factor gives a ratio of the real number of warm start-ups or shutdowns to the number allowed by design accord-
shutdowns over design acc. to standard
ing to the standard.
[%]
P.L2–3.11. Number of hot start-ups or
This factor gives a ratio of the real number of hot start-ups or shutdowns to the number allowed by design according
shutdowns over design according to the
to the standard.
standard [%]
The start-up rate or loading rate is aimed at establishing if the equipment may be experiencing high thermal stress-
es. Thermal stress is a function of the wall thickness of the equipment, the temperature difference between the
P.L2–3.12. Typical start-up rate/loading
inside and outside of the wall and the material of construction. Where temperatures are measured the actual rate
rate
should be determined and the thermal stress relative to the yield strength of the material evaluated. Where possible,
the ramp rates should be determined on a per-equipment basis.
P.L2–3.13. Calculated exhaustion (creep, This factor is based on the calculated exhaustion due to Creep and Fatigue [%] . The values in the factor are given as
fatigue) ranges.
EN 16991:2018 (E)
BS EN 16991:2018
49
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
A.2 Example of screening and detailed risk assessment
50
Topic Screening risk assessment Common activities for both screening Activities in- Detailed risk assessment needs <?>
and detailed risk assessment volved in de-
tailed risk as-
sessment
A. Identify haz- Identify the relevant hazards for each Input from initial analysis and
ards system within the boundaries of the scope planning.
of work. See 9.3.4
Identify the relevant hazards for
each system within the boundaries
of the scope of work.
B. Identify Determine the operating conditions. Review the applicability of Damage Determine operating and design conditions,
relevant degra- Upsets, likely excursions, as well as future mechanism classi fication (e.g. upset conditions.
dation mech- process conditions should be taken into ac- RIMAP [4] , OREDA [31] , API [33] )
anisms and count to identify the possible degradation and exclude those mechanisms Determine susceptibility windows of degrada-
failure modes and/or failure likely to occur. which do not apply. tion mechanisms.
Characteristics of potential degradation
mechanisms, e.g. local or overall degradation,
See 9.3.4
possibility of cracking, detectability (in early
or final stage).
Mechanical loading conditions.
Geometry and structure of each piece of equip-
ment from the point of view of susceptibility to
degradation mechanism.
EN 16991:2018 (E)
BS EN 16991:2018
51
(continued)
52
EN 16991:2018 (E)
BS EN 16991:2018
[c o u l d n o t fi n d t a b l e t i t l e ]
tailed risk as-
sessment
C. Determine The worst possible outcome of a failure Composition of the contained f luid Characteristics of the relevant degradation
Consequence of shall be established. The health, safety, and its physical/chemical proper- mechanisms, e.g. local or overall degradation,
Failure (CoF) environment and business consequences ties. possibility of cracking, detectability (in early
shall be considered. Other consequences or final stage).
such as quality of production and business Pressure, temperature and total
amount of f luid available for re - If containment is considered, the composition
impact may also be included.
lease. of the contained f luid and its physical/chem -
When the CoF has been assessed it shall be ical properties, the pressure, temperature
decided whether it is high or low, depend- Depending on national regulations and total amount of f luid available of release
ing on whether the CoF is above or below a more data, e.g. the final phase shall be available. Obtaining satisfactory CoF
of the f luid on release into the
prede fined limit. assessments may in this case often require
atmosphere, the dispersal char- de fining a number of scenarios, e.g. small leak-
Possible limits are as follows: acteristics of the f luid at the site,
age, large leakage, and full rupture.
mitigation systems such as water
Safety consequences: any failure which curtains, measures for detection of Credit may be taken for passive mitigating
may lead to injury of personnel.
the leak/break. systems.
Environmental consequence: release of If the potentially affected area Consequences shall also be assessed for hidden
toxic substances. from a leak/break is desired, then failures and test independent failures
FREEthe SeeGroup
A.10 and our chats
Business consequence: anyGet more
failure leading failure mode
standards fromand the pipe/ves-
Standard Sharing
sel size shall be entered. Identify barriers.
to loss of production or assets.
If the business impact is desired,
then the financial effect of produc -
tion loss as well as repair/replace-
ment costs shall be entered.
If publicity damage resulting from
a hazardous release is desired,
then a financial value shall be
entered expressing the negative
effect on future business.
For failures with consequences
other than f luid release, appro -
priate information on the nature
and extent of the consequence is
required.
[c o u l d n o t fi n d t a b l e t i t l e ] (continued)
tailed risk as-
sessment
D. Determine For each failure identi fied in each system, Prede fined time frame (from ini - Value of expected residual lifetime.
Probability of the PoF shall be assessed. tial analysis and planning).
Failure (PoF) Weighing system/factor to take account of the
PoF shall be determined for the pre-de- Maintenance and inspection histo- uncertainty of prediction.
fined time frame. ry of the item of equipment under
consideration. Prediction of lifetime based on measured
The estimate shall be conservative and inspection data, a calculation making use of
based on the available information and Speci fication of the operating operating conditions, or expert opinion. Spe-
expert judgment. window including factors which ci fic analysis tools may be used, e.g. probabil -
can be in f luenced by the operation istic (safety) analysis and/or fitness for service
When the PoF has been determined, it shall of the process (e.g. temperature, analysis.
be assessed whether the PoF is high or low. pressure) as well as factors which
For non-trendable degradation mechanisms
If this is difficult one may set the PoF equal cannot be in f luenced by the opera - See A.9
for which progress cannot be properly moni-
to 1 and perform a consequence screening. tion (e.g. seismic zone, climate). tored or predicted (e.g. stress corrosion crack-
Experience with similar equip- ing), it shall be demonstrated that degradation
ment, e.g. average probability data is prevented (through design) or detected
from a relevant database. early by means of sufficient measures to be
taken (inspection, maintenance, operation). A
Plant speci fic experience (data/in -
methodology shall be available in which the
formation/general knowledge). relation between the effectiveness of measures
(type, scope and frequency) and probability of
failure is given.
Handling of unknown degradation mechanism.
EN 16991:2018 (E)
BS EN 16991:2018
53
(continued)
54
EN 16991:2018 (E)
BS EN 16991:2018
tailed risk as-
sessment
E. Determine Determine the categories in which PoF and Risk acceptance criteria (input Determine risk to people (including plant per-
risk and classify CoF are classi fied using the risk matrix from initial analysis and planning). sonnel, contractors, public, etc.).
equipment shown in Figure 3.
Determine the risk category of the equip-
ment.
Based on the screening results the systems
or groups of equipment should be given a
low, medium or high risk.
Systems or groups of equipment with a
high risk should be considered in a detailed
assessment. See 9.3.4.2
Finally, for the low risk systems or groups
of equipment the assumptions should be
periodically checked. This may amount
to verifying that the basic assumptions
are satis fied, e.g. coating is Get
satisfactory
more FREE standards from Standard Sharing Group and our chats
or that the operating conditions remain
unchanged. For low risk systems minimum
surveillance is required.
High risk systems should be considered in
the detailed analysis. In all cases, regulato-
ry requirements should be considered.
BS EN 16991:2018
EN 16991:2018 (E)
A.3 Reliability of risk assessment results in the screening phase

Reliability of assessment results
Criteria
Low Medium High Very high
RBI team compe-
low medium high very high
tence
Overall Plant con-
poor average good very good
dition
Damage propaga-
rough estimate exact determination mode-based exact de-
tion (e.g. corrosion no forecast possible
possible possible termination possible
rate)
assessment based on
Life time assess- rough assessment assessment based on
not possible models and exact cal-
ment possible statistics possible
culations possible
veri fied and proven
Data quality and no useful data is useful data partly useful data completely
data completely avail-
availability available available available
able
Adapted from VGB-Standard-S-506-R-00; 2012–03 [18].
A.4 Example of assessment of damage/failure probability

Probability/Likelihood of failure
(PoF)
Very Low Medi- High Very
Low um High
Damage/failure statistics
A1.1 Shows no evidence of failure * **
A1.2 Isolated cases only (internal or external statistics)
A1.3 Failures have occurred in similar equipment (internally or exter-
nally)
A1.4 Damage regularly occurs in similar equipment
A1.5 Failures regularly occur in similar equipment/statistics not
available
Damage/failure related to design, material or assembly
A2.1 Not expected * **
A2.2 Early-life damage/failure related to design, material or assembly
sporadically expected
A2.3 Early-life damage/failure related to design, material or assembly
regularly expected
A2.4 Increased rate of early-life damage/failure related to design,
material or assembly expected
Damage/failure caused by operating conditions
A3.1 Not susceptible under all foreseeable and known operating condi- * **
tions/not expected due to the f luid and material used
A3.2 Susceptible due to the known operating conditions/damage may
occasionally occur due to process f luids and materials used
A3.3 Expected to occur due to the known operating conditions/ dam-
age expected due to the f luids and the material used
A3.4 Increased rate of damage due to the known operating conditions/
very probable due to the f luids and materials used
* Long operating experience
55
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
P rob ability/Likeliho od of fai lure

(PoF )
Very Medi- Very

Low H igh
Low um H igh
** Short operating experience

Example adapted from VGB-Standard-S-506-R-00; 2012–03 [18] .
A.5 Example of probability and consequence factors for qualitative analysis on

the screening and detailed levels
Risk Assessment – Screening Risk Assessment – Detailed

Probability factors Assessment criteria Probability factors Assessment criteria
Age (since in- High: Less than 50k or Age (since in- Very Low: 30k to 99k hours
stalled) more than 150k hours of stalled) Low: 100k to 149k hours
operation Medium: 150k to 199k hours
Low: Between 50k and High: 200k to 250k hours
150k hours of operation Very High: < 30k or > 250k hours
Material issues High: Known Material issues
Very Low: No
Low: Not known Medium: Possible
High: Yes
Last inspection High: > 6 years ago Total starts per Very Low: < 10
Low: < 6 years ago year Low: 10 to 49
Medium: 50 to 99
High: 100 to 200
Very
Get more FREE standards from Standard Sharing High:and
Group > 200
our chats
Damage/ degrada- High: Yes Repairs/damage Very Low: No repairs
tion present Low: No Medium: Possible repairs
High: Knows repairs
Consequence Assessment criteria Consequence fac- Assessment criteria
factors tors
Failure type High: Burst Failure type Very Low: Pin hole leak
Low: Leak Low: Minor leak
Medium: Medium leak
High: Major leak
Very High: Burst
Safety High: Likely fatalities Estimated area Very Low: 5m diameter
Low: Unlikely fatalities affected by failure Low: 6–10 m diameter
Medium: 11–20m diameter
High: 21–40m diameter
Very High: over 40m diameter
Health High: Major implications No. of people in Very Low: 1 person
Low: Minor or No implica- area Low: 2–3 persons
tions Medium: 4–5 persons
High: 6–7 persons
Very High: > 8 persons
Environment High: Major Impact Time in area Very Low: Up to 1 h
Low: Minor or No impact Low: 1–2 h
Medium: 3–4 h
High: 5–6 h
Very High: > 6 h
56
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
A . 6 E xa m p l e s o f
typ e s o f
i n - s e r vi c e d a m a g e a n d th e i r s p e c i fi c a ti o n s
I D and type
of damage or
E vent, prob - dis turb ances f
**
S u b t y p e s / s p e c i fi c s / u r t h e r d e t a i l s /
Common terms
lem, iss ues / deviations , examples
functional prob -
lems
I. Corrosion/erosion/environment related damage, leading

to:
I.A Volumetric I.A1 General corrosion, oxidation, erosion,
EC, E, FAC
loss of material wear, extended thinning
on surface (e.g. I.A2 Localized (pitting, crevice or galvan-
thinning) IC
ic) corrosion
I.B Cracking (on I.B1 Stress corrosion (chloride, caustic,
SCC
surface, mainly) etc.), cracking
I.B2 Hydrogen induced damage (incl. blis-
tering and HT hydrogen attack)
I.B3 Corrosion fatigue CF
I.C Material I.C1 Thermal degradation (spheroidiza-
weakening and/ tion, graphitization, etc. incl. incipient
or embrittlement melting)
I.C2 Carburization, decarburization, deal-
loying
MATERIAL I.C3 Embrittlement (incl. hardening, strain
DAMAGE aging, temper embrittlement, liquid metal EMB
RELATED embrittlement, etc.)
PROBLEMS II. Mechanical or thermo-mechanical loads related, leading
to:
II.A Wear II.A1 Sliding wear W
II.A2 Cavitational wear E
II.B Strain / di- II.B1 Overloading, creep C
mensional chang- II.B2 Handling damage
es / instability / PC
collapse
II.C Microvoid II.C1 Creep C
formation II.C2 Creep-fatigue
II.D Micro-crack- II.D1 Fatigue (HCF, LCF), thermal fatigue,
F, VF, TF, CF, TMF
ing, cracking (corrosion fatigue)
II.D2 Thermal shock, creep, creep-fatigue LTCCG
II.E Fracture II.E1 Overloading
II.E2 Brittle fracture BF
III. Other structural damage mechanisms G, GC, SRF, WD, CB, DMW
57
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
I D and type
of damage or
Event, prob - dis turb ances f
**
S u b t y p e s / s p e c i fi c s / u r t h e r d e t a i l s /
Common terms
lem, iss ues / deviations , examples
functional prob -
lems
DISTUR- IV. Fouling / deposits (without f luid f low disturbances)

BANCES / V Fluid f low disturbances
DEVIATIONS
/ PROBLEMS V.A High / low f luid f low (HFF/LFF)
(not related V.B No f luid f low (NFF)
to structural
V.C Other f luid f low problems (OFFP)
materials)
VI. Vibration (VIB)
VII. Improper dimensioning, improper clearances
VIII. Man-made disturbance (deliberate and unintentional)
IX. Fires, explosions and similar
X. Damage and/or loss of function due to other causes
X.A External leakage (EXL*)
X.B Improper start or stop - failed to start/stop (FTS*)
X.C Failed while running (FWR*)
X.D Overheated (OHE*)
X.E Other (OTH*)
* acronyms broadly corresponding to those used in OREDA [31]
** Damage mechanisms labelling as commonly used in practical RBI – analysis (here a power plant example), EC –
External Corrosion, E – Erosion, FAC – Flow Accelerated Corrosion, IC – Internal Corrosion, SCC – Stress Corrosion
Cracking, CF – Corrosion Fatigue, EMB – Embrittlement, W – Wear/Fretting, C – Creep, PC – Plastic Collapse, F –
Fatigue, VF – Vibration related Fatigue, TF – Thermal Fatigue, TMF – Thermo/mechanical Fatigue, LTCCG – Low
Temperature Creep Crack Growth, BF – Brittle Fracture, G – Graphitisation, GC – Graphitic Corrosion, SRF – Stress
Relief Cracking, OH – Overheating, WD – Welding Defect, CB – Casting Defect, DMW – Dissimilar Metal Weld Failure
58
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
A . 7 E xa m p l e o f
va r i o u s typ e s o f d a m a g e a n d th e i r s p e c i fi c a ti o n s i n r e l a ti o n to
hierarchical structure of the plant
H ierarchical s tructure of the

plant: e. g. according to KKS
Sys tem: B oiler
I D and type
Equipment: Econom-
of damage or
izer
E vent, prob - dis turb ances S u b t y p e s / s p e c i fi c s / f
u r t h e r d e t a i l s /
lem, iss ues / deviations, examples Component:

functional Header
problems
Component:
Tubing
Header Tubing
I. Corrosion/erosion/environment related damage, leading
to:
I.A Volumetric I.A1 General corrosion, oxidation, erosion,
loss of material wear, extended thinning
★ ★
on surface (e.g. I.A2 Localized (pitting, crevice or galvan-
thinning) ic) corrosion
★
I.B Cracking I.B1 Stress corrosion (chloride, caustic,
(on surface, etc.), cracking
mainly) I.B2 Hydrogen induced damage (incl. blis-
tering and HT hydrogen attack)
I.B3 Corrosion fatigue ★
I.C Material I.C1 Thermal degradation (spheroidiza-
weakening tion, graphitization, etc. incl. incipient
and/or embrit- melting)
tlement I.C2 Carburization, decarburization, deal-
loying
I.C3 Embrittlement (incl. hardening,
MATERIAL strain aging, temper embrittlement, liquid
DAMAGE metal embrittlement, etc.)
RELATED
PROBLEMS II. Mechanical or thermo-mechanical loads related, leading
to:
II.A Wear II.A1 Sliding wear ★
II.A2 Cavitational wear ★
II.B Strain / II.B1 Overloading, creep ★
dimensional II.B2 Handling damage
changes /
instability /
collapse
II.C Microvoid II.C1 Creep ★★
formation II.C2 Creep-fatigue ★
II.D Mi- II.D1 Fatigue (HCF, LCF), thermal fatigue,
cro-cracking, (corrosion fatigue)
★★ ★★
cracking II.D2 Thermal shock, creep, creep-fatigue
II.E Fracture II.E1 Overloading
II.E2 Brittle fracture
III. Other structural damage mechanisms
59
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
H ierarchical s tructure of the

plant: e. g. according to KKS
Sys tem: Boiler
I D and type
Equipment: Econom-
of damage or
izer
Event, prob - dis turb ances S u b t y p e s / s p e c i fi c s / f
u r t h e r d e t a i l s /
lem, iss ues / deviations , examples Component:

functional Header
problems
Component:
Tubing
Header Tubing
IV. Fouling / deposits (without f luid f low disturbances) ★
V Fluid f low disturbances
V.A High / low f luid f low (HFF/LFF)
V.B No f luid f low (NFF)
V.C Other f luid f low problems (OFFP)
DISTUR- VI. Vibration (VIB)
BANCES /
DEVIATIONS VII. Improper dimensioning, improper clearances
/ PROBLEMS VIII. Man-made disturbance (deliberate and unintentional)
(not related IX. Fires, explosions and similar
to structural
materials) X. Damage and/or loss of function due to other causes
X.A External leakage (EXL*)
X.B Improper start or stop - failed to start/stop (FTS*)
X.CGet
Failed while
more running
FREE (FWR*) from Standard Sharing Group and our chats
standards
X.D Overheated (OHE*)
X.E Other (OTH*)
NOTE Details on fatigue problems in component XYZ including priorities, PoF/ LoF data and references
are provided in RIMAP Work books, in this particular case RIMAP Workbook Part I, section 3, page 73. Overall
number of items covered in RIMAP Work book for Power plants approximates to 500, the stars (★) indicate
presence of corresponding damage mechanisms. Two or more stars (★★, ★★★) indicate more important or more
likely events, problems, issues.
A . 8 E xa m p l e o f
c l a s s i fi c a ti o n o f ty p e o f d a m a g e vs . p r i o r i ti z e d m e th o d s
of inspection
60
What type of damage How to look for it Measure of uncertainty/risk for selected/preferred method <?>
PoD for defect size of or size for FCP 6 ; com-
most cost selected
Identi fier and Type of damage Damage speci fics, damage mechanism best PoD <?> ments, exam-
effective method 1 mm 3 mm 90 % PoD ples
I. Corrosion/erosion/environment related damage, equating or leading to:

I.A Volumetric loss of material I. A1 General corrosion, oxidation, erosion, DiM, VT, ET,
UT, (VT), DiM UT 30 ÷ 70 % 50 ÷ 90 % 2 mm
on surface (e.g. thinning) wear solid particle erosion UT<?>
I. A2 Localized (pitting, crevice or galvanic)
corrosion UT, DiM, ET VT, UT UT 30 ÷ 70 % 40 ÷ 90 % 2 mm see <?>
I.B Cracking (on surface, mainly) I.B1 Stress corrosion (chloride, caustic, etc.)
MT, PT, ET MT, PT, ET ET max 85 % 40 ÷ 90 % 4 ± 2 mm < 5 % <?>
I.B2 Hydrogen induced damage (incl. blister-

ing and HT hydrogen attack) MT, PT<?> ,
UT, MT, PT, ET UT na na na na
MT<?>
I.B3 Corrosion fatigue 3 ± 1 mm

80 ÷ 96 % <?> 50 ÷ 99 % 12 ,<?> 12 ,<?>
MT, PT, ET, VT MT, PT, UT UT
86 ÷ 98 % <?> 95 ÷ 99 % ,14
0,8 ± 0,4 mm ,<?>
I.C1 Thermal degradation (spheroidization,
graphitization, etc. incl. incipient melting) MeT MeT MeT (microscopy) ~100 % PoD for cracks > 1 mm, 90 % PoD crack ca.
0,05 mm; main “reliability related problems” linked to wrong sam-
pling, wrong preparation and wrong interpretation of replicas (all
I.C Material weakening and/or I.C2 Carburization, decarburization, deal- numbers are estimates)
loying MeT MeT MeT
embrittlement
I.C3 Embrittlement (incl. hardening, strain
aging, temper embrittlement, liquid metal MST MST MST na na na
embrittlement, etc.)
II. Mechanical or thermomechanical loads related, leading to:

II.A Wear II.A1 Sliding wear VT, DiM, ET VT, UT
II.A2 Cavitational wear
II.B Strain / dimensional chang- II.B1 Overloading, creep
es / instability / collapse required reso-
II.B2 Handling damage
EN 16991:2018 (E)
DiM DiM DiM na na na lution ≤ 0,1 mm
BS EN 16991:2018
or 0,5 %
II.C Microvoid formation II.C1 Creep MeT (UT), MeT

II.C2 Creep-fatigue
61
(continued)
62
EN 16991:2018 (E)
BS EN 16991:2018
What type of damage How to look for it Measure of uncertainty/risk for selected/preferred method <?>
PoD for defect size of or size for FCP 6 ; com-
most cost selected
Identi fier and Type of damage Damage speci fics, damage mechanism best PoD <?> ments, exam-
effective method 1 mm 3 mm 90 % PoD ples
II.D Microcracking, cracking II.D1 Fatigue (HCF, LCF), thermal fatigue,
(corrosion fatigue) PT max 90 % 20 ÷ 90 % 1,5 ÷ 6,5 mm <?>
UT, (MT/PT),
MT/PT
II.D2 thermal shock, creep, creep-fatigue ET, VT
MT 5 ÷ 90 % 50 ÷ 90 % 2,5 ÷ 10 mm <?>
II.E Fracture II.E1 Overloading VT, DiM VT VT analysis of

na na na
II.E2 Brittle fracture causes
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
A.9 Example for determination of PoF
The current probability of failure and the PoF development over time shall be assessed for all relevant
degradation mechanisms. The development of the PoF over time is an important parameter to consider
when the maintenance/inspection strategies and intervals are determined later in the analysis. The
probability of failure shall also be linked to the appropriate end event in the bow tie model [29] to
ensure that each consequence is assigned the correct probability of failure. In addition, the uncertainty
in the PoF assessment shall be determined.
For introducing the PoF according to RBI procedure, three different types of source can be used. One
common reference source is taken from statistical analysis of historical data (H/S) on failures in
comparable equipment. A second common source is based on forecasting or modelling (F/M) of the
foreseen failure mode in the equipment considered. The third source is expert judgment (E/J), whereby
human expertise is applied to extract the best estimate of PoF (see Figure A.2). The individual sources
for overall PoF determination are combined as outlined in Figure A.2 . The elements from different
kinds of sources can be modi fied according to factors related to source reliability and application.
Figure A. 2 — Elements of PoF determination
The logic involves the following steps:

1. To assess the failure scenarios the user may opt for two types of models:
— data-based models considering uncertainties in mate rial data, NDT results, geometry, loads, etc.;
— life models calculating the remaining life of equipment based on the relevant
degradation mechanism.
NOTE There are several methods that can be also used when more than one failure scenario is considered
e.g.: Monte-Carlo simulation, decision trees, fault-tree analysis, fuzzy rules, etc.
2. Assess, check, calibrate and correct basic failure frequencies by using expert judgment.
These corrections can include factors like:
— similar damage already appearing elsewhere in the same plant or in a similar plant;
— any qualitative indications and/or symptoms like irregularities in observations;
— higher loading than planned, unexpected loads (e.g. vibrations);
— changes in the operating conditions (e.g. operation mode); and
63
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
— any known problems with design or manufacturing.

This approach allows the combining of different levels and methods like expert judgment and
probabilistic analysis consistently, also when applied for different or same equipment. The proposed
approach is comparable and consistent with previously established approaches, extending them in
several aspects. The extension is done by considering applicability in different industries, first by
implementing relations between equipment in a plant and degradation mechanism, and by associating
and suggesting appropriate inspection methods depending on the damage type and assessing the
reliability of selected inspection method
A.1 0 Example for determination of CoF
The failure of the pressure containing boundary of pressurized equipment, and the associated discharge
of hazardous fluids can result in health, safety, environmental and business related consequences.
Other consequences, such as image loss or public disruption may also be considered.
A methodology to quantify CoF for safety and health can be found in [1] , [32].
API 581 provides methodologies for the calculation of the consequences of a leak or rupture from
pressurized equipment, expressed in terms of impact area or in financial terms [34] . The simpli fied
Level 1 methodology (Figure A.3), allows for the estimation of the consequence area based on lookup
tables for a limited number of modelled representative fluids. A more rigorous Level 2 methodology is
available, with a comprehensive calculation procedure which can be applied to a wider range of fluids.
For the example depicted in the Figure A.3 , the input data includes the fluid properties of the selected
representative fluid, and a selection of release hole sizes for the considered failure scenarios.
For the selected representative fluid (that most closely matches the actual contents of the item of
pressure equipment),
Getthe required
more FREEproperties
standards are
fromestimated
Standarddepending on theand
Sharing Group stored
ourphase
chatsof the f luid:
1. Stored Liquid
— Normal Boiling Point, NBP
— Density, ρ l
— Auto Ignition Temperature, AIT
2. Stored Vapour or Gas
— Normal Boiling Point, NBP
— Molecular Weight, MW
— Ideal Gas Speci fic Heat Capacity Ratio, k
— Constant Pressure Speci fic Heat, Cp
— Auto-Ignition Temperature, AIT
Depending on the stored fluid phase, properties and the operating conditions, the fluid phase
after release can be a gas, liquid or two-phase mixture, which will greatly in fluence the dispersion
characteristics and the probability of consequence events (e.g. pool fire, jet fire, vapour cloud explosion,
safe dispersion etc). In the presented simpli fied example, the fluid phase upon release is assumed to be
a liquid or a gas only.
A discrete set of hole sizes is used for the analysis, depending on the equipment/component type (and
hence size), which adequately represents the range of possible outcomes: 6,35 mm (0,25 inch), 25,4 mm
(1 inch), 101,6 mm (4 inch) and rupture – limited to a maximum diameter of 406,4 mm (16 inch). A total
64
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
generic failure frequency for the range of possible outcomes can be computed from the generic failure
frequencies associated with the respective hole sizes (n) using the formula:
(A.1)
Figure A. 3 — E xample of level 1 consequences analysis procedure [3 6] [3 2 ]
65
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The fluid release rate Wn is calculated by selecting the appropriate release rate formula (for liquid
release or sonic/subsonic vapour release), based on the physical properties of the stored fluid, its initial
phase, the process operating conditions and the applicable release area. The liquid and vapour release
rate and associated formulae are provided in API 581 Part 3 [34].
For each applicable hole size, the release area A n is calculated, based on the hole diameter d n :
(A.2)
The maximum mass available for release mass avail,n , for each applicable hole size (n), is estimated as the
lesser of two values, according to the formula:
(A.3)
Where
mass inv the Inventory Group Mass – the sum of inventory available for release in all (n) equipment in
the inventory group to which the analysed equipment belongs, used as the upper limit of the fluid mass
available for release:
(A.4)
Where
mass comp the Component Mass
Get more – thestandards
FREE f luid mass available
from for release
Standard SharinginGroup
the analysed
and ourequipment
chats plus an
additional mass mass add,n , which takes into account the f luid mass released from connected equipment
in the inventory group.
The additional mass can be calculated assuming the same flow rate from the leaking equipment, for the
applicable hole sizes, however it is limited to a 203 mm (8 inch) hole size:
(A.5)
In the API methodology, two release types are modelled: instantaneous release and continuous release.
The determination of the release type for each applicable release hole size (n) is based on two criteria:
1. limiting hole size – if the release hole size is 6,35 mm (0,25 inch) or less, the release type
is continuous;
2. the amount of time required to release 4536 kg of fluid tn . If tn ≤ 180 sec, and the release mass is
greater than 4536 kg, then the release is instantaneous; otherwise it is continuous.
(A.6)
The determination of the final release rate (for continuous releases) and mass (for instantaneous
releases) in the consequence of failure calculation takes into account the effect of installed detection,
isolation and mitigation systems. Guidance on the assignment of qualitative ratings (A, B, C) to the
detection and isolation systems is provided in tables in API 581 Part 3 [34].
Table A. 2 — Detection and isolation s ys tem rating guide [3 4]
Type of detection system detection classi fication
66
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Instrumentation designed speci fically to detect material losses by changes in op - A

erating conditions (i.e., loss of pressure or f low) in the system.
Suitably located detectors to determine when the material is present outside the B
pressure-containing envelope.
Visual detection, cameras, or detectors with marginal coverage. C
Type of isolation system isolation classi fication
Isolation or shutdown systems activated directly from process instrumentation or A
detectors, with no operator intervention.
Isolation or shutdown systems activated by operators in the control room or other B
suitable locations remote from the leak.
Isolation dependent on manually-operated valves. C
Table A.3 — Adjustments to release rate based on detection and isolation systems [34]
System classi fications Release magnitude adjustment Reduction
Detection Isolation factor, factdi
A A Reduce release rate or mass by 25 % 0,25
A B Reduce release rate or mass by 20 % 0,20
A or B C Reduce release rate or mass by 10 % 0,10
B B Reduce release rate or mass by 15 % 0,15
C C No adjustment to release rate or mass 0,00
The final release rate formula (for continuous releases) for the n th size hole, after adjustment for
detection and isolation systems is therefore:
(A.7)
Table A.4 — Leak duration b ased on detection and isolation s ys tems [3 4]
Detection system Isolation system Maximum leak duration, ld max

rating rating
20 min for 6,4 mm leaks
A A 10 min for 25 mm leaks
5 min for 102 mm leaks
A B 20 min for 25 mm leaks
A C 30 min for 25 mm leaks
B A or B 30 min for 25 mm leaks
1 h for 6,4 mm leaks
B C 30 min for 25 mm leaks
67
BS EN 16991:2018
EN 16991:2018 (E)
Detection system Isolation system Maximum leak duration, ld max

rating rating
1 h for 6,4 mm leaks
C A, B or C 40 min for 25 mm leaks
The final release mass (for instantaneous releases), and the leak duration for the n th hole size, after
adjustment for detection and isolation devices is shown by A.8 and A.9, respectively:
(A.8)
(A.9)
For the Level 1 methodology, procedures to calculate the flammable, explosive, toxic and non- flammable,
non-toxic (e.g. steam leaks) consequences are provided in detail in API 581, Part 3 and Annex 3.A [34]. In
this example, an overview of the generic and final formulae for flammable and explosive consequences
is provided.
For the determination of the flammable and explosive consequence area for each release hole size (n),
two initial generic formulae are given:
a) For Continuous Release:
(A.10)
b) For Instantaneous Release:
(A.11)
In both cases, the coefficients used in the formulae are given in the respective tables in API 581 Part 3
[34]. The overall consequence area is calculated in a 3-step process:
1. The possible events are assessed in an event tree, and estimates for the probability of occurrence of
each event are provided. In the case of flammable material releases, the principal factors de fining
the path on the event tree area the probability of ignition and the timing of ignition;
2. The consequence areas resulting from each event on the tree are calculated;
3. The consequence areas of each individual event on the tree are combined into a single final
probability weighted formula.
68
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Figure A.4 — CoF event tree for instantons-type release [3 4]
The final probability weighted formulae for the flammable and explosive consequences are given for
the equipment damage area and personnel injury area.
(A.12)
(A.13)
The final flammable and explosive consequence area is taken as the maximum of these two areas.
Similar procedures are used for determining the consequences associated with releases of toxic
chemicals, as well as non- flammable, non-toxic (but otherwise hazardous) releases. The final overall
consequence area is taken as the maximum (driving) value between the assessed (flammable and/or
toxic and/or non- flammable, non-toxic) consequence areas. The numerical values associated with the
Area-Based CoF categories, as given in API 581 Part 1 are shown in the Table A.5.
Table A. 5 — Numerical values associated with Area-B ased CoF categories [3 4]
Category Range (m 2 )
A CA ≤ 9,29
B 9,29 < CA ≤ 92,9
C 92,9 < CA ≤929
D 929 < CA ≤ 9290
E CA > 9290
69
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
The API 581 methodology allows for the calculation of financial consequences associated with the
release of hazardous substances, on the basis of the calculated flammable, toxic and non- flammable,
non-toxic consequence areas and other related factors. These include, but are not limited to:
1. Costs of repair and/or replacement of equipment, FC cmd ;
2. Cost of damage to surrounding equipment in affected area, FCaffa ;
3. Costs associated with losses of production or business interruptions resulting from downtime to
repair or replace the damaged equipment, FCprod;
4. Costs related to potential injuries or fatalities associated with the failure, FCinj;
5. Costs of environmental clean-up, FCenviron .
The financial consequences of failure can be determined by summing up the (applicable) individual
costs given above:
(A.14)
The details of each individual factor, and the formulas and procedures used for calculation are given in
API 581 Part 3 [34]. The numerical values associated with the Financial-Based CoF categories, as given
in API 581 Part 1 are shown in Table A.6.
Table A.6 — Numerical values associated with Financial-B ased CoF categories [3 4]
Category Range ($)

A FC ≤ 10000
10000 <Sharing
Get moreBFREE standards from Standard FC ≤ 100000
Group and our chats
C 100000 < FC ≤ 1000000
D 1000000 < FC ≤ 10000000
E FC > 10000000
A . 1 1 E xa m p l e o f
KP I s a n d o b j e c ti ve s f o r s e l e c ti o n
Key Performance Indicators (KPIs) are management tools to measure and react on speci fic
developments within a plant. In general events one can count events that have occurred and can be
classi fied as the so called lagging KPIs (e.g. Loss of Primary Containment (LoPC) events). Indicators
that are more predictive are considered leading indicators. In API 754 [33] a hierarchy of lagging and
leading indicators is shown using the Process Safety Metric Pyramid.
Examples of KPIs and a template for KPI development are shown in Table A.7 and Table A.8, respectively.
T a b l e A . 7 — E x a m p l e s o f
K P I s a n d o b j e c t i ve o f
s e l e c t i o n
O b j e c t i ve KPI
Improve safety and environmental conditions. It is Number of overall safety and environmental incidents
recommended to distinguish between severe leakag- with focus on LoPC events.
es and those with a minor severity; (see for instance
Tier 1 and Tier 2 events in [33] ).
70
BS EN 16991:2018
EN 16991:2018 (E)
O b j e c t i ve KPI
Indicator of integrity management system efficiency. Leaks and Near Leaks with a pressure equipment im-
pact that result from a breach of the pressure-retaining
boundary:
— # leaks / near leaks by internal corrosion;
— # leaks / near leaks by external corrosion;
— # leaks / near leaks by mechanical damage;
— # leaks / near leaks from gasket/packing;
— # leaks / near leaks by other cause.
Legal or internal compliance. Number of overdue Inspection Schedules on Static
Equipment, Piping and PRVs.
Integrity/compliance management. Number of overdue Noti fications for once-off inspection
jobs (non-recurring jobs)
Track progress against RBI plan (Loss of control of % of static equipment and piping covered by RBI
RBI plan and unquanti fied level of risk).
Follow through on exceedances. Number of IOW corrective actions (completed and
outstanding)
Performance measure of operational control of key Number of critical IOW exceedance (12 months rolling
RBI assumptions. average)
Integrity Control: Ensure compliance to RBI assump- Actual % implemented of monitoring points of agreed
tions. IOW
Asset/plant utilization. Unplanned downtime (%)
Unplanned down time per equipment type (%), plant
(%) and Unit utilization (%)
Assessment of the RBI inspection plan. # inspection findings according to the RBI inspection
plan
Table A.8 — Example of a KPI template

KPI # Process Team: Description:
P r o c e s s D e fi n i t i o n :
What is the purpose of this KPI?

What is the consequence of not having this KPI?
What are the parameters required to measure this KPI?
What is the formula for this KPI?
Who is the owner of KPI?
Who makes use of this KPI?
What corrective action(s) can be taken in case of signi ficant deviation between target and measured values?
Where does the data come from? (e.g. applications)
What is the reporting frequency of KPI? (monthly, quarterly etc.)
A.12 Example of a RBI management system evaluation questionnaire [34]

Mechanical Integrity*
71
BS EN 16991:2018
EN 16991:2018 (E)
1. Has a written inspection plan for the process unit been developed that includes the follow-
ing elements:
a. All equipment needing inspection has been identi fied?
b. The responsibilities to conduct the inspections have been assigned?
c. Inspection frequencies have been established?
d. The inspection methods and locations have been speci fied?
e. Inspection reporting requirements have been de fined?
2. Does the inspection plan referred to in 1 include a formal, external visual inspection pro-
gram for all process units?
a. Are all the following factors considered in the visual inspection program: the condi-
tion of the outside of equipment, insulation, painting/coatings, supports and attachments,
and identifying mechanical damage, corrosion, vibration, leakage or improper components
or repairs?
b. Based on the inspection plan referred to in 1, do all pressure vessels in the unit re-
ceive such a visual external inspection at least every xx years?
c. Based on this inspection plan, do all on-site piping systems that handle volatile,
f lammable products, toxins, acids and caustics, and other similar materials receive a visual
external inspection at least every xx years?
3. Based on the inspection plan, do all pressure vessels in the unit receive an internal or de-
tailed inspection using appropriate nondestructive examination procedures at least every
xx years?
4. Has each item of process equipment been reviewed by appropriate personnel to identify
the probable causes of deterioration or failure?
a. Has this information been used to establish the inspection methods, locations, and
frequencies and the preventive maintenance programs?
b. Have defect limits been established, based on fitness for service considerations?
5. Is a formal program for thickness measurements of piping as well as vessels being used?
a. When the locations for thickness measurements are chosen:
i. Is the likelihood and consequence of failure a major factor?
ii. Is localized corrosion and erosion a consideration?
b. Are thickness measurement locations clearly marked on inspection drawings and on
the vessel or piping system to allow repetitive measurements at precisely the same loca-
tions?
c. Are thickness surveys up to date?
d. Are the results used to predict remaining life and adjust future inspection frequency?
6. Is there a written procedure that requires an appropriate level of review and authorization
prior to any changes in inspection frequencies or methods and testing procedures?
7. Inspection checklists:
a. Have adequate inspection checklists been developed and are they being used?
b. Are they periodically reviewed and updated as equipment or processes change?
72
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
8. Documentation:
a. Are all inspections, tests and repairs performed on the process equipment being
promptly documented?
b. Does the documentation include all of the following information? 1. The date of the
inspection 2. The name of the person who performed the inspection 3. Identi fication of
the equipment inspected 4. A description of the inspection or testing 5. The results of the
inspection 6. All recommendations resulting from the inspection 7. A date and description
of all maintenance performed
9. Have all employees involved in maintaining and inspecting the process equipment been
trained in an overview of the process and its hazards?
*For more details of the above example see the Management Systems Work Book (Annex 2.A) [34]
A.1 3 Example of formulation and degradation of components,

structures and systems
Risk-Based Inspections are carried out in discrete time steps within the life cycle of a component,
structure or industrial system. In order to describe the changes within each time step a mathematical
formulation of degradation (i.e. ageing) of the asset is de fined.
A basic model with de fined uncertainties, which is improved step by step through introduction and
evaluation of new knowledge gained about a structure or system is presented here. The ideal result
is a precise assessment of the condition with reasonable margins of uncertainty. The model is able to
show the successive impact during the long-term deterioration process as well as the effect of sudden
changes in condition. It is recognized that the individual results from inspection and assessment will
in fluence the quality of the prediction.
The concept is to give a common understanding on structural ageing in general, which can be
incorporated into different industrial applications and adapted regarding the industry-speci fic
demands. Figure A.5 illustrates a simplistic ageing model with the uncertainty bounds around the
design life of a component, structure or industrial system.
73
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Figure A. 5 — General concept of s tructural ageing
All important Key Performance Indicators (KPIs) related to the aspects that potentially can have an
impact on the performance or durability of a structural member are to be considered. These data sets
are implemented into a probabilistic model for service life calculations of the individual items, to cover
occurring uncertainties which have to be considered within the established maintenance plans in
terms of lower and upper bound of service life expectancy.
The starting point of the asset’s service life is mainly based on the applied design code and the
underlying safety consideration in the course of the design calculations, while the ageing process in
general depends on certain major sources of impact:
— operating time since manufacture/construction;
— system robustness;
— material properties;
— type of structure.
To describe the individual deterioration process properly the following additional aspects are of
relevance with regard to structural performance over time:
— direct loading frequency;
— direct loading intensity;
— quality in manufacturing;
— environmental in f luences (such as temperature, radiation, corrosive environment);
— chemical exposure.
74
BS EN 16991:2018
EN 16991:2018 (E)
The basis for the service life expectancy considerations is expressed in terms of structural conditions.
After being put into operation, each member’s range of ratings represents the available (total) capacity,
which is consumed over time during the entire service life.
The process can be described by the formulae such as those proposed by CWA 63: 2012 [35]. The
so-called deterioration capacity Ci(t) for an analysed component is determined by the following
formula expression:
(A.15)
with
(A.16)
where
is the initial condition;
is the slope of deterioration;
is the current year of service life;
is the initial year of service life;
is the deterioration power exponent; empirical, constant value derived from sensitivity analysis for bridge
components c = 3 is established;
is the final condition (early-warning level);
is the final (assumed) year of service life.
75
BS EN 16991:2018
EN 1 6991 : 2 01 8 (E)
Bibliography
[1] EUROPEAN COMMITTEE FOR STANDARDIZATION. CWA 15740:2008; Risk-Based Inspection

and Maintenance Procedures for European Industry (RIMAP). CEN, Brussels, 2008
[2] JOVANOVIC. A. (2004). Overview of RIMAP project and its deliverables in the area of power plants.
Int. J. Press. Vessels Piping. 2004, 81 (10-11) pp. 815–824
[3] JOVANOVIC. A. ( 2000). Extending the concept of Risk-based Inspection (RBI) to Risk-based Life,
Management (RBLM). State-of-the-art Resource Document prepared for and under a subcontract
of JRC, Petten, May 2000, EU DGIII (EUR report), Luxembourg, pp. 174
[4] RIMAP. Risk-Based Inspection and Maintenance Procedures for European industry, EU FP5-
GROWTH project, Project ID: G1RD-CT-2001-03008 (available on CORDIS)
[5] ISO 9000:2015, Quality management systems - Fundamentals and vocabulary
[6] EN ISO 14000 (series), Environmental management
[7] ISO 55000, Asset management - Overview, principles and terminology
[8] ISO 31000, Risk management - Principles and guidelines
[9] IEC/ISO 31010, Risk Management — Risk assessment techniques
[10] ISO/IEC Guide 51, Safety aspects - Guidelines for their inclusion in standards
[11] ISO Guide 73, Risk management - Vocabulary
[12] EN 13306:2010, Maintenance — Maintenance terminology
[13] ISO 22301:2012, Societal security - Business continuity management systems — Requirements
[14] IEC 61508:2010, Functional safety of electrical/ electronic/ programmable electronic safety-
related systems
[15] IEC 61511:2016, Functional safety — safety instrumented systems for the process industry sector
[16] EN ISO/IEC 17020:2012, Conformity assessment — Requirements for the operation of various types
of bodies performing inspection (ISO/IEC 17020:201 2)
[17] API 580:2016, Risk-Based Inspection

[18] VGB S-506. Condition Monitoring and inspection of components of steam boiler plants, pressure
vessels installations and high-pressure water and steam pipes, VGB-S-506-R-00;201 2-03
[19] ASME/CR TD-41, Risk-based Methods for Equipment Life Management: An Application Handbook.
New York: ASME International, 2003. Vol. 41
[20] ASME PCC-3-2007, Inspection Planning Using Risk-based Methods. New York: ASME
International, 2008
[21] API 584:2014, Integrity Operating Window

[22] Det Norske Veritas. Erosive Wear in Piping Systems . Recommended Practice. DNV, 1996. Rev.
1999. RPO501
[23] WINTLE. J.B., KENZIE, B.W., AMPHLETT, G.J. and others. Best practice for Risk Based Inspection
as a part of Plant Integrity Management. Health and Safety Executive. HSE Books, 2001
76
BS EN 16991:2018
EN 16991:2018 (E)
[24] JOVANOVIC. A.S., AUERKARI, P. and GIRIBONE, R. RIMAP WP4, D4. Application Workbook for
Power Plants, GROWTH project GIRD-CT-2001-03008. RIMAP RTD Consortium, 2003. Ver.: 2
[25] N orth A meric an E lec tric R eli abili t y C ouncil . Generating availability data system .
NERC, USA, 2002
[26] VGB P owerT ech e . V. Research and Development Project. Reliability Indicators with KISSY. VGB
PowerTech Service, Germany, 2014
[27] DNV-RP-G101:2010, Risk based inspection of offshore topside static mechanical equipment .
[28] EN 60812, Analysis techniques for system reliability — Procedure for failure mode and effects
analysis (FMEA) (IEC 6081 2)
[29] TNO P ri ns M auri tis R ese arch L aboratory. TNO EFFECTS: A software for Hazard Assessment .
TNO, The Netherlands, 1991
[30] D e t N orske Veri tas . PHAST Risk, Software for the risk assessment of Flammable, explosive and
toxic impact . DNV, 2002
[31] SINTEF T ech nology and S ocie t y. Offshore Reliability Data . 4th edition handbook. OREDA, 2002
[32] Praktijkregels voor drukapparatuur – Katern 2.3: Periodieke herbeoordeling, May 2011 - version
3 Sdu Uitgevers bv Den Haag, 2011
[33] API 754:2010, Process Safety Performance Indicators for the Re fining and Petrochemical Industries
[34] API 581:2016, Risk Based Inspection Technology
[35] CWA 63:2012, Ageing behaviour of Structural Components with regards to integrated Lifetime
Assessment and subsequent Asset Management of constructed Facilities. CEN, June 201 2
[36] EN 60300-3-11:2009, Dependability management — Part 3-11: Application guide — Reliability

centred maintenance (IEC 60300-3-11:2009)
[37] Van den B ossch C.J.H. and WETERINGS, R.A.P.M ed. Methods for the calculations of Physical
Effects: Resulting from Releases of Hazardous Materials (TNO ‘Yellow Book’ ). The Hauge, the
Netherlands: Committee for the Prevention of Disasters, 2005
[38] Engineering Equipment and Materials Users Association (EEMUA). Risk Based Inspection - Guide
to Effective Use of the RBI process. EEMUA Publication 206, 2006
[39] E ngi neering E quipmen t and M ateri als U sers A ssoci ation . Users' Guide to the Inspection,
Maintenance and Repair of Above Ground Vertical Cylindrical Steel Storage Tanks. 3rd edition.
EEMUA Publication 159, 2003
[40] ANSI/API RP 530:2003, Calculation of heater-tube thickness in petroleum re fineries
[41] KRAFTWERKSTECHNIK GmbH. KKS Kraftwerk-Kennzeichensystem Richtlinie zur Anwendung und
Schlüsselteil . VGB, 2007. ArtNr.: 105E. English version: KKS Power Plant Classi fication System -
Guidelines for Application and Key Part
[42] THE NORWEGIAN PETROLEUM DIRECTORATE. Maintenance baseline study - A method for self-
assessment of maintenance management systems. NO: The Norwegian Petroleum Directorate,
1998. Rev. 0
[43] UIJT de HAAG. P.A.M. and ALE, B.J.M. Guidelines for quantitative risk assessment (‘Purple Book’).
Committee for the Prevention of Disasters, The Hague, the Netherlands, First Edition, 1999
[44] PGS 2, (formerly CPR14E), Methods for the calculation of physical effects -due to the release of
hazardous materials (liquids and gases) (‘Yellow Book’). 3rd edition, second revised. The Hague, the
77
BS EN 16991:2018
EN 16991:2018 (E)
[45] PGS 1, (formerly CPR16E), Methods for the determination of possible damage to people and
objects resulting from releases of hazardous materials (‘Green Book’). 1 st edition. The Hague, the
[46] ISO 14040:2006, Environmental management - Life cycle assessment - Principles and framework
[47] ISO 14044:2006, Environmental management - Life cycle assessment - Requirements and guidelines
[48] CWA 16649:2013, Managing emerging technology-related risks
[49] CWA 16633:2013, Ageing behaviour of Structural Components with regard to Integrated Lifetime
Assessment and subsequent Asset Management of Constructed Facilities
[50] EN ISO 9712:2012, Non-destructive testing — Qualification and certification of NDT personnel
(ISO 971 2:201 2)
[51] EN ISO 14224:2016, Petroleum, petrochemical and natural gas industries — Collection and exchange
of reliability and maintenance data for equipment (ISO 14224:2016, Corrected version 2016-10-01)
[52] EN ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and
certification of management systems — Part 1: Requirements (ISO/IEC 17021-1:2015)
[53] EN ISO/IEC 17024:2012, Conformity assessment — General requirements for bodies operating
certification of persons (ISO/IEC 17024:2012)
[54] EN ISO/IEC 17025:2005, General requirements for the competence of testing and calibration
laboratories (ISO/IEC 17025:2005)
[55] EN 15341:2007, Maintenance — Maintenance Key Performance Indicators

[56] EN 15628:2014, Maintenance
Get more — Qualification
FREE standards of maintenance
from Standard personnel
Sharing Group and our chats
[57] EN 16646:2014, Maintenance — Maintenance within physical asset management
[58] EN 61882, Hazard and operability studies (HAZOP studies) — Application guide (IEC 61882)
[59] CEN/TR 14748:2004, Non-destructive testing — Methodology for qualification of non-
destructive tests
[60] IEC 812:2011, Rubber, vulcanized or thermoplastic — Determination oflow-temperature brittleness

[61] NACE/TM 0248:2011, Evaluation of pipeline and pressure vessel steels for resistance to hydrogen
induced cracking
[62] SAE JA 1011:1998, Evaluation Criteria for Guide to the Reliability Centred Maintenance
(RCM) Processes
[63] SAE JA 1012A:2002, Guide to the Reliability Centred Maintenance (RCM) Standard
[64] API 571:2003, Damage Mechanisms Affecting Fixed Equipment in the Re fining Industry
[65] API 583:2014, Corrosion Under Insulation and Fireproo fing
[66] API 585:2014, Pressure Equipment Integrity Incident Investigation
[67] API 579-1/ASME, FFS-1:2007, Fitness-For-Service
[68] OHSAS 18001, Occupational Health and Safety Management
78
This page deliberately left blank
NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAW
British Standards Institution (BSI)

BSI is the national body responsible for preparing British Standards and other
standards-related publications, information and services.
BSI is incorporated by Royal Charter. British Standards and other standardization
products are published by BSI Standards Limited.
About us Reproducing extracts

We bring together business, industry, government, consumers, innovators For permission to reproduce content from BSI publications contact the BSI
and others to shape their combined experience and expertise into standards Copyright & Licensing team.
-based solutions.
The knowledge embodied in our standards has been carefully assembled in Subscriptions
a dependable format and re f ned through our open consultation process. Our range of subscription services are designed to make using standards
Organizations of all sizes and across all sectors choose standards to help easier for you. For further information on our subscription products go to
them achieve their goals. bsigroup.com/subscriptions.
With British Standards Online (BSOL) you’ll have instant access to over 55,000
Information on standards British and adopted European and international standards from your desktop.
We can provide you with the knowledge that your organization needs It’s available 24/7 and is refreshed daily so you’ll always be up to date.
to succeed. Find out more about British Standards by visiting our website at You can keep in touch with standards developments and receive substantial
bsigroup.com/standards or contacting our Customer Services team or discounts on the purchase price of standards, both in single copy and subscription
Knowledge Centre. format, by becoming a BSI Subscribing Member .
Buying standards PLUS is an updating service exclusive to BSI Subscribing Members. You will
automatically receive the latest hard copy of your standards when they’re
You can buy and download PDF versions of BSI publications, including British revised or replaced.
and adopted European and international standards, through our website at
To f nd out more about becoming a BSI Subscribing Member and the bene f ts
Get more FREE standards from Standard
bsigroup.com/shop, where hard copies can also be purchased. Sharing Group and our chats
of membership, please visit bsigroup.com/shop.
If you need international and foreign standards from other Standards Development
Organizations, hard copies can be ordered from our Customer Services team. With a Multi-User Network Licence (MUNL) you are able to host standards
publications on your intranet. Licences can cover as few or as many users as you
Copyright in BSI publications wish. With updates supplied as soon as they’re available, you can be sure your
documentation is current. For further information, email subscriptions@bsigroup.com.
All the content in BSI publications, including British Standards, is the property
of and copyrighted by BSI or some person or entity that owns copyright in the
information used (such as the international standardization bodies) and has
Revisions
formally licensed such information to BSI for commercial publication and use. Our British Standards and other publications are updated by amendment or revision.
Save for the provisions below, you may not transfer, share or disseminate any We continually improve the quality of our products and services to bene f t your
portion of the standard to any other person. You may not adapt, distribute, business. If you f nd an inaccuracy or ambiguity within a British Standard or other
commercially exploit, or publicly display the standard or any portion thereof in any BSI publication please inform the Knowledge Centre.
manner whatsoever without BSI’s prior written consent.
Useful Contacts
Storing and using standards Customer Services
Standards purchased in soft copy format: Tel: +44 345 086 9001
• A British Standard purchased in soft copy format is licensed to a sole named Email (orders): orders@bsigroup. com
user for personal or internal company use only. Email (enquiries): cservices@bsigroup. com
• The standard may be stored on more than 1 device provided that it is accessible Subscriptions
by the sole named user only and that only 1 copy is accessed at any one time. Tel: +44 345 086 9001
• A single paper copy may be printed for personal or internal company use only. Email: subscriptions@bsigroup. com
• Standards purchased in hard copy format:
Knowledge Centre
• A British Standard purchased in hard copy format is for personal or internal Tel: +44 20 8996 7004
company use only.
Email: knowledgecentre@bsigroup. com
• It may not be further reproduced – in any format – to create an additional copy.
This includes scanning of the document. Copyright & Licensing
If you need more than 1 copy of the document, or if you wish to share the Tel: +44 20 8996 7070
document on an internal network, you can save money by choosing a subscription Email: copyright@bsigroup. com
product (see ‘Subscriptions’).
BSI Group Headquarters
389 Chiswick High Road London W4 4AL UK
This page deliberately left blank

16991

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

16991

Uploaded by

Copyright:

Available Formats

BS EN 16991:2018

BSI Standards Publication

Risk-based inspection framework

This British Standard is the UK implementation of EN 16991:2018.

This British Standard was published under the authority of the

Amendments/corrigenda issued since publication

Date Text affected

Risk-based inspection framework

Cadre d'inspection basée sur les risques Risikobasierte Inspektion (RBIF)

This European Standard was approved by CEN on 22 October 2017.

EUROPEAN COMMITTEE FOR STANDARDIZATION

C E N - C E N E L E C M a n a ge ment C entre : Avenue M a r n i x 17, B -10 0 0 B r u s s el s

European foreword ................................................... ................................................... ................................................... ................................................... .. 4

9.2.4 Output ................................................... ................................................... ................................................... ........................... 28

Bibliography .................................................. ................................................... ................................................... ................................................... .................. 76

© ISO ISO pub-date year – All rights reserved 3

There are no normative references in this document.

3 Terms and definitions

Table 1 — Abbreviated terms

Abbreviated term Definition

Abbreviated term Definition

5 The RBI framework

— complying with applicable legal or normative regulations and guidelines.

5.2 RBIF requirements

Figure 1 — Main RBI application level and decision tree

5.2.2 Plant and process documentation

— list of assumptions made during the assessment;

5.2.3 Personnel requirements

5.2.4 Requirements for performing CoF analysis

5.2.4.2 Recognized models

5.2.4.3 Requirements related to CoF safety

5.2.4.4 Requirements related to CoF health

5.2.4.5 Requirements related to CoF environment

5.2.4.6 Requirements related to CoF business

5.2.5 Requirements for performing PoF analysis

5.2.5.2 Recognized models

5.2.5.3 Conservatism o f simplified approaches

5.2.5.4 Auditability of results

5.2.5.5 Multi-level approaches (screening — detailed, in level of asset hierarchy)

5.2.5.6 Additional aspects to be considered

5.2.6 Requirements for risk assessment

5.3 RBIF within the overall management system

5.4 Compatibility with other known approaches

6 The RBIF process

3) multilevel risk analysis (risk assessment);

Figure 2 — Framework of RBIM procedure within the overall management system

7 Initial analysis and planning

7.1 General description and scope

7.1 .2 Planning and the preliminary analysis

7.1.3 Definition o f objectives

— health, safety and environmental issues;

7.1.9 Tools to be used

7.1.10 Accuracy of the acceptance of the methodology

The expected output from the preparatory work shall be at least:

7.6 Warnings and applicability limits

8 Data collection and validation

8.3 .2 Collect and validate documented data

8.3 .3 Collect relevant non-documented data

8.6 Warnings and applicability limits

9 Multilevel risk analysis (ranging from screening to detailed)

9.1 General description and scope

Risk analysis consists of the following steps:

9.2 Risk analysis — screening level

Figure 3 — Example screening risk matrix 2)