8.3 Risk Uncertainty, Sensitivity Analysis, and Risk Acceptance Thresholds

8.3 Risk Uncertainty, Sensitivity Analysis, and Risk Acceptance Thresholds

Understanding Data Uncertainty in RBI Assessments (API RP 580 Sections 12 & 13)

In API Recommended Practice 580 (4th Edition, August 2023 with Addenda 1, March 2025), Section 12 ("Risk Determination, Assessment, and Management") and Section 13 ("Risk Management with Inspection Activities") address the fundamental reality that all risk assessments operate under conditions of imperfect knowledge and data uncertainty. Risk calculations are estimates of future physical events; therefore, quantifying, managing, and reducing uncertainty is a core requirement of a compliant RBI program.

Uncertainty directly expands the probability density functions of both POF and COF. When data quality is poor, API RP 580 requires risk analysts to apply conservative assumptions. This conservatism inflates calculated risk values, ensuring that data gaps do not result in unmitigated physical hazards.

---

Sources of Risk Uncertainty

API RP 580 classifies data uncertainty into five primary operational domains:

1. Equipment Design and Construction Data Uncertainty:

   • Missing Material Test Reports (MTRs), unverified trace chemistry (e.g., carbon equivalent, trace elements like tramp elements affecting hydrogen attack susceptibility).
   • Unknown original wall thickness due to missing fabrication drawings or vessel nameplate data.

2. Process and Operating History Uncertainty:

   • Incomplete recording of past operating excursions outside established Integrity Operating Windows (IOWs, per API RP 584).
   • Unmonitored process chemistry variations (e.g., sudden spikes in feed sulfur content, chloride levels, or naphthenic acid concentration).

3. Damage Mechanism Kinetics Uncertainty:

   • Variable corrosion rates caused by fluid velocity turbulence, multi-phase flow regimes, or localized condensation zones.
   • Uncertain initiation thresholds for environmental cracking mechanisms (e.g., Wet \text{H}_2\text{S} cracking, Amine SCC, Polythionic Acid SCC, Caustic SCC).

4. Inspection and NDE Uncertainty:

   • Low-effectiveness historical inspections (e.g., Category D or E inspections with minimal coverage percentage or non-calibrated tools).
   • Detection limits of non-destructive testing techniques (e.g., spot ultrasonic thickness testing failing to detect localized pitting or CUI).

5. Consequence Modeling Uncertainty:

   • Simplifying assumptions in fluid release rates, atmospheric dispersion modeling, toxic threshold limits (IDLH vs ERPG-2), and financial downtime cost projections.

---

Sensitivity Analysis Methodology and Risk Drivers

Sensitivity Analysis is the analytical technique used to evaluate how changes in specific input variables affect the calculated POF, COF, and overall risk classification. API RP 580 Section 12 mandates performing sensitivity analysis to identify Risk Drivers—the critical parameters that exert the strongest control over equipment risk.

Execution Protocol for RBI Sensitivity Analysis

1. Identify Key Input Parameters: Select variables subject to operational fluctuation or data uncertainty (e.g., corrosion rate, fluid temperature, toxic chemical percentage, NDE inspection effectiveness).
2. Apply Parameter Variances: Systematically adjust each input variable above and below its baseline value (e.g., $\pm 25%$, $\pm 50%$, $2\times$, or $5\times$).
3. Recalculate Risk Profiles: Run the RBI quantitative model to observe shifts in calculated POF, COF, and matrix cell assignments.
4. Identify Primary Risk Drivers: Categorize parameters based on their impact severity. If a 20% increase in corrosion rate shifts an asset from Medium Risk (2C) to High Risk (4C), corrosion rate is established as the primary risk driver.

┌───────────────────────────────────────────────────────────────────────────┐
│                    SENSITIVITY ANALYSIS WORKFLOW                          │
├───────────────────────────────────────────────────────────────────────────┤
│ 1. Baseline Input Data  ──► POF(t) & COF Baseline Risk (e.g., Cell 2C)    │
├───────────────────────────────────────────────────────────────────────────┤
│ 2. Vary Inputs (±50%)   ──► Corrosion Rate, Fluid H2S %, NDE Confidence   │
├───────────────────────────────────────────────────────────────────────────┤
│ 3. Evaluate Output      ──► Assess Matrix Shift (e.g., Cell 2C ➔ Cell 4C) │
├───────────────────────────────────────────────────────────────────────────┤
│ 4. Focus Mitigation     ──► Implement Targeted NDE or IOW Alert Limits    │
└───────────────────────────────────────────────────────────────────────────┘

---

Establishing Facility Risk Acceptance Thresholds (Target Risk)

An Acceptable Risk Threshold (also called Target Risk, $\text{Risk}_{\text{target}}$) is the maximum level of risk a facility is willing to accept for an operating equipment item or piping circuit. API RP 580 does not dictate a single universal numerical risk limit; rather, it requires each operating company to formally define its own risk acceptance criteria aligned with corporate safety guidelines, environmental standards, and financial risk tolerance.

Types of Target Risk Limits

1. Area Target Risk (\text{ft}^2/\text{yr} or \text{m}^2/\text{yr}): Typically established between $10 \text{ ft}^2/\text{yr}$ and $100 \text{ ft}^2/\text{yr}$ for flammable or toxic releases to protect plant personnel.
2. Financial Target Risk ($/\text{yr}): Typically established between $$10,000/\text{yr}$ and $$100,000/\text{yr}$ per equipment item to limit business interruption and property loss.

Determining Inspection Intervals via Target Risk

The RBI target inspection date ($t_{\text{target}}$) is calculated as the exact future operating time when calculated equipment risk intersects the Target Risk threshold: $\text{Risk}(t_{\text{target}}) = \text{Risk}_{\text{target}}$

API RP 580 requires that the planned inspection interval shall not exceed $t_{\text{target}}$. Furthermore, jurisdictional standards (API 510, API 570, API 653) impose maximum calendar interval caps (e.g., 10 years or half remaining life for pressure vessels) as outer safety limits even if calculated $t_{\text{target}}$ exceeds those limits.

---

The ALARP (As Low As Reasonably Practicable) Principle in RBI

API RP 580 incorporates the ALARP (As Low As Reasonably Practicable) principle to guide risk reduction decisions. Under ALARP, risks are divided into three distinct regions:

1. Intolerable Risk Region: Risk levels above corporate upper thresholds. Risk reduction is mandatory regardless of financial cost. Operations must be shut down, depressured, or immediately mitigated.
2. ALARP (Tolerable) Region: Risk levels fall between the intolerable threshold and the broadly acceptable limit. Risk reduction measures (such as targeted NDE, chemical injection, or material upgrades) MUST be implemented UNLESS the cost of mitigation is grossly disproportionate to the risk reduction achieved.
3. Broadly Acceptable Region: Low risk levels where routine monitoring is sufficient and additional expenditure for risk reduction is unwarranted.

---

Worked Engineering Case Study: Sensitivity Analysis and ALARP Trade-Off Evaluation

Scenario Statement

A Hydrotreater Reactor Effluent Air Cooler (REAC) piping circuit constructed of Carbon Steel operates under active Ammonium Bisulfide (\text{NH}_4\text{HS}) Corrosion and Alkaline Sour Water Corrosion.

• Baseline Corrosion Rate: $12 \text{ mpy}$ ($0.305 \text{ mm/yr}$).
• Nominal Wall Thickness: $0.375 \text{ in}$ ($9.525 \text{ mm}$); Minimum Required Thickness ($t_{\text{min}}$): $0.180 \text{ in}$ ($4.572 \text{ mm}$).
• Current Wall Thickness: $0.255 \text{ in}$ ($6.477 \text{ mm}$).
• Consequence of Failure: Toxic \text{H}_2\text{S} / Flammable area $\text{COF} = 45,000 \text{ ft}^2$ (Category D).
• Facility Area Target Risk: $\text{Risk}_{\text{target}} = 50 \text{ ft}^2/\text{yr}$.

Step 1: Sensitivity Analysis of Corrosion Rate Variations

The process team evaluates the sensitivity of equipment risk to process fluid velocity and \text{NH}_4\text{HS} concentration spikes:

Sensitivity Finding: Corrosion rate is an extreme risk driver. A 50% increase in corrosion rate nearly triples calculated risk and accelerates the target inspection date from 6.2 years down to 2.5 years.

Step 2: ALARP Mitigation Option Evaluation

The engineering team evaluates three ALARP risk reduction options:

1. Option A: High-Effectiveness NDE Inspection

   • Perform 100% PAUT profile thickness mapping across all high-turbulence elbows every 2 years.
   • Cost: $$25,000$ per inspection.
   • Risk Impact: Reduces POF uncertainty, lowering calculated risk back to $30 \text{ ft}^2/\text{yr}$ (ALARP Region).

2. Option B: Integrity Operating Window (IOW) Process Control

   • Install continuous wash water injection flow transmitters and online $\text{pH}$ / velocity monitoring (API RP 584).
   • Cost: $$60,000$ capital expenditure.
   • Risk Impact: Prevents corrosion rate excursions, capping corrosion rate at $12 \text{ mpy}$ and maintaining risk at $36 \text{ ft}^2/\text{yr}$.

3. Option C: Material Upgrade to Duplex Stainless Steel (2205 SS)

   • Replace REAC piping circuit with 2205 Duplex Stainless Steel during next turnaround.
   • Cost: $$450,000$.
   • Risk Impact: Eliminates \text{NH}_4\text{HS} corrosion mechanism ($\text{POF} \approx 1.0 \times 10^{-6}$), reducing risk to $0.045 \text{ ft}^2/\text{yr}$ (Broadly Acceptable Region).

Decision Rationale under API RP 580 ALARP

Implementing Option B (IOW controls) combined with Option A (targeted PAUT inspections) reduces equipment risk below the target threshold of $50 \text{ ft}^2/\text{yr}$ at a total cost of $$85,000$. Option C ($$450,000$ material upgrade) is determined to be disproportionately costly relative to the risk reduction achieved while the asset remains in the ALARP region, validating the selection of Option A + B as the optimal RBI mitigation strategy.