See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/223008544

Development of Risk-Based Inspection and Maintenance procedures for an oil

refinery

Article  in  Journal of Loss Prevention in the Process Industries · March 2009

DOI: 10.1016/j.jlp.2009.01.003

CITATIONS READS

62 1,895

4 authors:

Massimo Bertolini Maurizio Bevilacqua

Università di Parma Università Politecnica delle Marche
74 PUBLICATIONS   1,023 CITATIONS    132 PUBLICATIONS   2,546 CITATIONS   

SEE PROFILE SEE PROFILE

Filippo Emanuele Ciarapica G. Giacchetta

Università Politecnica delle Marche Università Politecnica delle Marche
105 PUBLICATIONS   1,229 CITATIONS    36 PUBLICATIONS   884 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

SERAMIS - Sensor-Enabled Real-world Awareness for Management Information Systems View project

SMILE (Smart Manufacturing Innovation for Lean Excellence centre): I4MS Digital Innovation Hub View project

All content following this page was uploaded by Filippo Emanuele Ciarapica on 23 November 2017.

The user has requested enhancement of the downloaded file.

 Journal of Loss Prevention in the Process Industries 22 (2009) 244–253

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

Development of Risk-Based Inspection and Maintenance procedures

for an oil refinery
M. Bertolini a,1, M. Bevilacqua b, 2, F.E. Ciarapica b, *, G. Giacchetta b, 3
a
Department of Industrial Engineering, University of Parma, Viale delle Scienze, 181/A 43100 Parma, Italy
b
Energy Department, University Politecnica delle Marche, via Brecce Bianche, 60100 Ancona, Italy

a r t i c l e i n f o a b s t r a c t

Article history: The management of failure analysis has a strategic importance within a refinery from the organizational,
Received 16 January 2007 engineering and economic point of view. The determination of an algorithm, that allows a methodical
Received in revised form and as far as possible automatic approach to management of failure data, can make substantial
10 January 2009
improvements in the organization of work and in the decision-making processes.
Accepted 19 January 2009
A panel of expert, made up of academicians and refinery operators, was formed in order to develop
a Risk-Based Inspection and Maintenance (RBI&M) procedure. RBI&M procedure developed comprises six
Keywords:
modules: identification of the scope, functional analysis, risk assessment, risk evaluation, operation
Risk management
Safety management selection and planning, J-factor computation and operation realization. Taking into consideration
Maintenance historical data regarding Near Accidents, Operating Drawbacks, Occupational and Environmental Acci-
Work order management dents occurred in refinery over the last years the panel of expert defined a risk matrix in order to
evaluate the risk associated to critical events and maintenance activities. Five probability classes and five
severity categories, that take into account four impact categories (Health and Safety, Environmental,
Economic and Reputation), have been defined.
This paper reports the application of the RBI&M method to two specific stages in the maintenance
activities of the refinery, i.e. the oil refinery turnaround and work orders management.
The panel of expert developed heuristic methods in order to apply RBI&M procedure to the two cases
allowing the refinery to minimize the overall risk taking into consideration the limits in term of time and
budget (in turnaround case) and of human resources (in the management of work orders). The results
have highlighted a clear improvement in the indices which measure the quality of maintenance.
Ó 2009 Elsevier Ltd. All rights reserved.

1. Introduction system design, frequent preventive maintenance, and early

Safety in a refinery relies, among other things, on the adopted
management criteria. They affect all the plant life-cycle: from plant
design and construction, throughout the production activity, until
possible dismantling. Safety management strategies for critical
systems involve multiple dimensions including design philosophy,
maintenance policies, and procedures of personnel hiring, training,
and evaluation (Cowing, Cornell, & Glynn, 2004). At one end of the
spectrum, the most conservative approaches rely on a robust
* Corresponding author. Tel.: þ39 071 2204435; fax: þ39 071 2204770.
E-mail addresses: massimo.bertolini@unipr.it (M. Bertolini), m.bevilacqua@
univpm.it (M. Bevilacqua), f.ciarapica@univpm.it (F.E. Ciarapica), g.giacchetta@
univpm.it (G. Giacchetta).
1
Tel.: þ39 0521 905861; fax: þ39 0521 905705.
2
Tel.: þ39 071 2204874; fax þ39 071 2204770.
3
Tel.: þ39 071 2204763; fax: þ39 071 2204770.
response to warnings. At the other end, aggressive strategies are
driven by demanding production schedules, single-string system
designs, and minimal inspection and maintenance to obtain
maximum production with minimum interruptions. The difference,
of course, lies in the immediate costs and in the resulting level of
system failure risk (Baron & Cornell, 1999). According to Krishnas-
amy, Khan, and Haddara (2005), a Risk-based maintenance (RBM)
approach helps in designing an alternative strategy to minimize the
risk resulting from breakdowns or failures. Adapting a risk-based
maintenance strategy is essential in developing cost-effective
maintenance policies. Critical equipment can be identified based on
the level of risk and a pre-selected acceptable level of risk. Main-
tenance of equipment is prioritised based on the risk, which helps
in reducing the overall risk of the plant.
In this paper we propose a Risk-Based Inspection and Mainte-
nance (RBI&M) methodology that, using the synergies provided
by the simultaneous adoption of risk analysis and reliability

0950-4230/$ – see front matter Ó 2009 Elsevier Ltd. All rights reserved.
doi:10.1016/j.jlp.2009.01.003
 M. Bertolini et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 244–253
management methods, enables considerable changes to be made
with a view to the production of servicing plans that ensure greater
reliability at the lowest possible cost. Particularly two applications
of the RBI&M method to two specific stages in the maintenance
activities of a refinery, i.e. the oil refinery turnaround and the work
orders management, are reported in this work. The refinery ana-
lysed in this work, is sited in Ancona (Italy), and can currently count
on a processing capacity amounting to 3,900,000 ton/year of crude
oil, a storage capacity of more than 1,500,000 m3 and the ability to
receive tankers and super-tankers up to a tonnage of 400,000 tons.
Processing at the refinery is based essentially on a topping, catalytic
reforming, isomerisation, vacuum, visbreaking, and thermal
cracking cycle, which is organized in a series of operational sections
that form interconnected functional units (Fig. 1). The plant has
a closed loop water system which is able to deliver up to 7000 m3/h,
and a fire fighting system which is able to supply up to 3000 m3/h
of sea water. An integrated gasification combined cycle plant of
287 MW power is actually starting up its operations. This plant
burns a synthesis gas obtained from a heavy oil refining products
gasification plant, whose production capacity is equal to 1250 ton/
day. This plant has auxiliary oxygen production, gas washing,
sulphur recovery, effluent treatment and heavy metals recovery
utilities. The monthly feed of 340,000 ton to the primary distillation
process (Topping) comprises 300,000 ton of oil and 40,000 primary
residuum. The main oil refinery processing plants are formed by
two recently introduced distillation units: an atmospheric one,
with a production capacity of 10,500 ton per day and a vacuum one,
whose distillation capacity is equal to 2500 ton/day.
The light distillation fractions, mainly formed by liquid petro-
leum gas (LPG) and petrol, feed a hydrogenation process (Unifin-
ing), which is used to stabilise some components and to remove
undesired elements such as sulphur. After the hydrogenation
process, LPG is ready for use while petrol undergoes further pro-
cessing to enhance its octane number (isomerisation, to produce
light petrol without aromatics, and platforming, to obtain a very
high octane number). The middle distillation fraction (kerosene,
light and heavy gas oil) is subjected to a desulphurisation process
(HDS1 and HDS2 plants), while heavy fraction and the distillation
residuum are processed through cracking plants (thermal cracking
Fig. 1. Oil refinery simplified cycle.
245
and visbreaking), to improve the oil conversion increasing the
production of light products.
The rest of the paper is organized as follows. Section 2 is divided
into three parts, in the first the organization of the team that has
developed the methodology proposed in this paper is described; in
Section 2.1 a bibliographical analysis of existing work about risk
analysis and maintenance prioritization is presented; in Section 2.2
the RBI&M procedures are discussed. In Section 3, two case studies
on the API refinery are used to illustrate the application of the
proposed method. Finally, the conclusions are presented in Section 4.
2. Materials and methods
The development of RBI&M procedures and the application to
two specific stages in the maintenance activities of a medium-sized
refinery was carried out by a panel of experts.
A panel of experts was formed in order to encourage commu-
nication and meetings where the operators could contribute their
knowledge and information about the processes. The panel was
made up of 15 participants, and included 3 academics, whose
research studies are mainly focused on risk analysis and mainte-
nance management, 4 technical operators and 5 managerial oper-
ators involved in the maintenance processes, 3 ApiSoi operators.
The re-engineering of inspection maintenance and processes was
also prompted by the arrival of a third party at the refinery (ApiSoi),
called in to manage the maintenance activities on the basis of
a global service contract. This number of participants, which at first
sight may seem rather large, derives from the Delphi technique
(Linstone & Turoff, 1975) adopted for working with panels. The
Delphi technique is a structured process which investigates
a complex or ill-defined issue by means of a panel of experts. This
methodology proves to be an appropriate research design for this
type of research and permits individual opinions to be obtained
within a structured group and using a communicative process. The
panel worked for a period of about two weeks, and the sessions
were planned on a three-round Delphi process. At first a series of
statements concerning the requirements of the turnaround process
were generated individually and anonymously by the experts. All
the statements were then collected and delivered to the members
246 M. Bertolini et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 244–253
of the panel, who were required to indicate their level of agree-
ment; answers were finally fedback to the panel.
2.1. General characteristics of Risk-Based Inspection and
Maintenance systems
Over the past few decades, maintenance strategies have pro-
gressed from primitive breakdown maintenance to more sophisti-
cated strategies like condition monitoring and reliability-centred
maintenance (Khan & Haddara, 2004). Another link in this chain of
progress has recently been added by the introduction of a risk-
based approach to maintenance. This approach has been suggested
as a new vision for asset integrity management (ASME, 2000).
Some authors (Krishnasamy et al., 2005; Kumar, 1998; Van Heel,
Knegtering, & Brombacher, 1999) developed Risk-based mainte-
nance strategies to provide a basis not only for taking the reliability
of a system into consideration when making decisions regarding
the type and the time for maintenance actions, but also to be able to
take into consideration the risk that would result as a consequence
of an unexpected failure. Most of the previous studies focused on
a particular system and were either quantitative or semi-quanti-
tative. In this work a Risk-Based Inspection and Maintenance
methodology is proposed which integrates classic Reliability-Cen-
tred Maintenance (RCM) analysis with models of risk analysis and
develops a system which takes into consideration not only reli-
ability and economic aspects, but also the company’s reputation
and environmental impact.
There are different risk-based approaches reported in literature
ranging from the purely qualitative to the highly quantitative.
A brief review of some of the most frequently used approaches is
presented here. Many authors used probabilistic risk assessment
(PRA) as a tool for maintenance prioritization (Vesely, Belhadj, &
Rezos, 1993). Balkey and Art (1998) developed a methodology,
which includes risk-based ranking methods, beginning with the
use of plant PRA, for the determination of risk-significant and less
risk-significant components for inspection and the determination
of similar populations for pump and valve in-service testing. This
methodology integrates non-destructive examination data, struc-
tural reliability/risk assessment results, PRA results, failure data
and expert opinions. Cowing et al. (2004) presented and illustrated
a dynamic probabilistic model designed to describe the long-term
evolution of such a system through the different phases of opera-
tion, shutdown, and possible accident. In addition to PRA, they used
a Markov model to track the evolution of the system and its
components through different performance phases.
Apeland and Scarf (2003) presented alternative probabilistic
frameworks for optimisation of risk-based inspection using
a Bayesian approach. The fully Bayesian approach discussed in this
paper provides straightforward means of presenting to decision
makers the uncertainty related to future events. This approach is
described in the context of an inspection maintenance decision
problem, and is contrasted with the classic probabilistic approach
(Baker & Wang, 1992; Christer, Wang, Baker, & Sharp, 1995) that
assumes the existence of true probabilities and probability distri-
butions which have to be estimated. Wang and Christer (1998)
proposed a model of safety inspection process, for the expected
consequence of inspections over a finite time horizon. A single
dominant failure mode is modelled, which has considerable safety
or risk consequences assumed to be measurable either in cost terms
or in terms of the probability of failure over the time horizon. The
paper establishes a pragmatic procedure for formulating objective
functions which may be optimised to determine the optimal
inspection intervals.
There has been an increased focus on risk-based maintenance
optimisation in the offshore industry prompted by the recent
functional regulations on risk. Bevilacqua, Braglia, and Gabbrielli
(2000) presented a new tool for failure mode and effect analysis
developed for a new Integrated Gasification and Combined Cycle
plant in an important Italian oil refinery. The methodology is based
on the integration between a modified Failure Mode Effect and
Criticality Analysis (FMECA) and a Monte Carlo simulation as
a method for testing the weights assigned for the measurement of
risk priority numbers (RPNs). Harnly (1998) developed a risk
ranked inspection recommendation procedure that is used in one
of Exxon’s chemical plants to prioritise repairs that are identified
during equipment inspection. The equipment is prioritised based
on the severity index, which is failure potential combined with
consequences of failure. Dey (2001) presented a risk-based model
for inspection and maintenance of a cross-country petroleum
pipeline that reduces the amount of time spent on inspection.
Risk-based maintenance strategies can also be used to improve
the existing maintenance policies through optimal decision
procedures in different phases of the risk cycle of a system. Studies
by Khan and Abbasi (1998), Kumar (1998) and Todinov (2003) show
a strong relationship between maintenance practices and the
occurrence of serious accidents. An assessment of the impact of
preventive maintenance on the failure characteristics of a piece of
equipment in the field of competing risks was discussed by Bedford
(2004). Profitability is closely related to the availability and reli-
ability of the equipment. Khan and Haddara (2004) introduced
a risk-based maintenance methodology. This methodology aims at
reducing the overall risk that may result as a consequence of
unexpected failures of operating facilities. By assessing the level of
risk caused by the failure of each component, one can prioritise the
maintenance tasks for the components of the system. The same
authors (Khan, Sadiq, & Haddara, 2004) proposed a risk-based
maintenance and inspection approach to improve maintenance
operations schedule and minimize failure risk by developing an
optimal inspection strategy. They present a structured approach for
equipment risk analysis using fuzzy method. Four case studies are
developed and they show that the robustness of the results
depends firstly on human expertise. They also point out the impact
of the risk formalism on the assessment of occurrence, conse-
quences and then the judgement of risk level.
Arunraj and Maiti (2007) made a synthesis of 25 RBM methods,
presenting the different steps and describing their main drawbacks.
The review of these methods showed that there is no unique way to
perform risk analysis and risk-based maintenance. The application
of these methodologies highly depends on the depth of the anal-
ysis, area of application and quality of results. According to these
authors, other than this, the experience of the analysts to use these
methodologies is an important factor to consider.
More recently Meel et al. (2007) presented dynamic analyses of
incidents that have occurred in the USA chemical plants. Probability
density distributions were formulated for their causes (e.g., equip-
ment failures, operator errors, etc.), and associated equipment items
utilized within a particular industry. Bayesian techniques provided
posterior estimates of the cause and equipment-failure probabili-
ties. Other authors (Mili, Bassetto, Siadat, & Tollenaere, 2009) have
proposed a new approach to the use of FMECA as an operational tool
which unveils productivity improvement areas. They demonstrated
that it is possible to use FMECA method in a more dynamic envi-
ronment, continuously updated by operational events. The article
proposes a risk-based maintenance method, which relies on the
regular and automatic update of equipments risk analyses including
equipment-failure history.
The more recent papers point out that efforts need to be focused
on data retrieval and update – as automatic as possible – in order to
prevent risks analyses obsolescence. In particular, source of infor-
mation, update frequency and risk estimation method must be
 M. Bertolini et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 244–253 247

redefined continuously. This literature reveals also that risk anal-
yses are considered through the perspective of its sustaining tools
and methods. Particular attention has also been paid to connect as
smooth as possible, events and preliminary risks analyses.
In this work taking into consideration historical data regarding
critical events occurred in refinery over the last years the panel of
expert defined a procedure in order to evaluate the risk associated
to critical items and maintenance activities. The most interesting
part is the application of the RBI&M procedure to two specific cases
in the maintenance activities of the refinery, i.e. the oil refinery
turnaround and work orders management. The panel of expert
developed heuristic methods in order to apply RBI&M procedure to
the two cases allowing the refinery to minimize the overall risk
taking into consideration the limits in term of time and budget (in
turnaround case) and of human resources (in the management of
work orders).
2.2. Risk-Based Inspection and Maintenance procedure
RBI&M analysis is carried out by means of a sequence of steps, as
shown in Fig. 2.
2.2.1. Identification of the scope
The aims and scope of the analysis must be defined and clas-
sified: environmental aspects connected with the operational
activities carried out, safety risk, investment, work orders
management, etc. For this reason the requirements, regulations
and adequacy criteria of the plant concerning safety and environ-
mental protection must be made clear, since they are considered
‘‘boundary conditions’’ in RBI&M analysis. It is at this stage that the
systems to which the RBI&M plan is to be applied are described:
the respective ‘‘hierarchical models’’ of these systems are devel-
oped, identifying the plant as a whole and the role of each system
within it, together with the sub-systems, single items and their
components.
2.2.2. Functional analysis
Standard functions and performance: the functions of each piece
of equipment are defined and their standard performance is iden-
tified so as to be able to recognise immediately if there is deviation
from this performance. Prior to the real analysis of functional
failure of the identified items it is necessary to determine their
respective functions, distinguishing between:

Standard functions and performance Identification

of the scope
Functional failures

Failure mode
Functional
Effects of failure analysis

p c
r e o Health & Safety
o x n Risk
b p s
e Environmental assessment
a o impact
b s q
i u u
e Reputation
l r n
i e c Economic loss
t e
y
Risk
s
evaluation

Acceptable Yes
risk ?

No
Set Task Feedback
Repair Task Choice of
action
Substitution Task

On condition Task

Default action
J-factor
Failure tracing definition
Redesign

Action
Planning

Fig. 2. Steps in RBI&M methodology.

248 M. Bertolini et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 244–253

Table 1 Table 2
Assigning probability. Indices of severity for Health and Safety, Environmental and Reputation categories.

Class Key word Description of 1 time Absolute Examples Severity Impact Description Examples
probability every x. value category
years 1 Health and Medication or injury with Grazes, first degree burns of
A Very rare Virtually >20 0.001 Fatal accident on the Safety possible absence from work limited extent
impossible workplace; double of between 1 and 3 days/
emergency; Aircraft accident; discomfort in carrying out
Accident caused by lightening. work
B Rare Unlikely 3–20 0.05 Malfunctioning of a control Environmental No perceptible Slight discharge of vapour
valve; Electric motor out of environmental impact from a coupling – smelly
order; Accident on a plant outside the workplace emissions within the
with serious economic loss; refinery area
Permanent injury; Reputation Minimal impact – no Slight discharge of vapour
Environmental damage. external impact on from a coupling visible
C Occasional May happen 1–3 0.3 Unexpected breakdown of reputation outside the workplace
a few times, at a pump; Black out; Leakage
2 Health and Injury or poor health with Sprains, dislocation, skin
least once from a heat exchanger;
Safety loss of ability to work and irritation
Instrument out of order;
possible absence from work
Spills; Injury to a person on
for up to 10 days
the workplace.
Environmental Brief duration/intensity Slight but totally recoverable
D Probable May happen Once 0.5 Unexpected shutdown (see
above the self-imposed spill of product – slight
several times every six Appendix 1); Limited losses;
limits, but reversible release of smelly but non-
months Opening of safety valve;
toxic and harmless product
Unpleasant smells.
noticed outside the
E Frequent May happen >Once 1 Slow down; Violation of traffic
workplace
often every six regulations; Samples in
Reputation Impact of brief duration and/ Limited flaring caused by
months unsuitable or polluted
or programmable entity a planned plant shutdown
containers.
3 Health and Injury or occupational Torn muscle, second degree
Safety disease with loss of ability to burns, fracture
work for an extended period
of up to 30 days/
- essential function: a function required of a given element and occupational disease with
for which it has been specifically installed; reversible consequences
Environmental Brief duration/intensity Partially recoverable spill of
- auxiliary function: a support function for the essential function; above the self-imposed product, value of daily SOx/
- protective function: a function aimed at protecting people, the limits, but reversible within NOx emission note above the
plant and the environment when the item is working; the legal limits limits, but recoverable in the
- information function: a function of monitoring and reporting monthly emission note
Reputation Local impact – impact of Limited flaring caused by an
operational parameters;
brief duration and/or unexpected plant shutdown
- interface function: an interface function between different unexpected entity
items;
4 Health and Injury to more than one Multiple fracture, third
- superfluous function: a function which the item is able to Safety person/Injury with loss of degree burns
perform but which is not relevant in the specific context. ability to work for a period of
more than 30 days and with
The functions can also be classified as: possible multiple injuries
caused by the same initial
event; it includes any
- on-line function: a function operating continuously or so permanent physical or
frequently that the user is constantly aware of its state (this health impediments
leads to evident failure); Environmental Exceeding self-imposed Prolonged emission of bad
- off-line function: a function which is used intermittently or not environmental limits smells, smoke, vapour, flame
or loud noises noticeable
frequently and which is not possible to be aware of except by outside the workplace
means of specific assessments and tests (this leads to hidden Reputation Regional impact – impact of Cleaning of a heater causing
failure). considerable duration and/ noise which can be heard
or programmable entity outside the workplace
Functional failures: in general for each function it is possible to 5 Health and It includes the extreme Deaths
determine a certain number of functional failures which means Safety possibility of death to
that the equipment is unable to perform its standard operations. individuals or groups due to
the same initial event/Lethal
Failure Mode: a functional failure may occur for various reasons.
exposure
Knowing the cause means that the way to avoid the failure can be Environmental Exceeding legal Release of toxic-harmful
identified. In doing this, however, it is important not to enter into environmental limits products
too much unnecessary detail so as to avoid time-wasting. Reputation National impact – impact of Fire in a heater
considerable duration and/
Effects of failure: Several effects can be associated with failure
or unexpected entity
mode, that is to say, what could happen if the failure mode being
examined should occur.

2.2.3. Risk analysis  Initial evaluation of probability: In the case of the refinery
In order to analyse how critical a given functional failure is, it is a team of experts defined some criteria, which are illustrated
necessary to carry out an initial evaluation of probability and an in Table 1, in order to create five probability classes, quanti-
initial evaluation of consequences: fying the probability that an event will occur, assigning a level,
 M. Bertolini et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 244–253 249

Table 3
Decision matrix.

Severity Key word Consequences Probabilities

Health and Safety Economic Environmental Reputation VR R O P F

impact impact
Very rare Rare Occasional Probable Frequent

Virtually Unlikely May happen May happen May

impossible a few times (1) several happen
times often
1 Minor Discomfort: Medication/ <10,000 V Minimal Within 1 2 3 4 10 (2)
Accidents 1–3 days Area/Dept impact company
confines
2 Moderate Poor health 3–10 days 10,000– Short-term Surrounding 2 4 6 16 (2) 30 (3)
100,000 impact areas
V Dept
3 Severe Occupational disease: 100,000 to Short-term Local 3 6 18 (2) 36 (3) 60 (4)
Reversible in 10–30 days 1 million V impact noted territory
Refinery outside
4 Very severe Permanent damage to health: 1–10 million Transient Regional 4 16 (2) 36 (3) 64 (4) 80 (4)
>30 days/Accident involving V Branches reversible
several people damage
5 Catastrophic Lethal exposures: >10 million Permanent National 10 (2) 30 (3) 60 (4) 80 (4) 100 (4)
fatal accident V Group environmental
damage

from A to E, to the possible scenario. Several examples were
defined for every probability class analysing refinery historical
data. The same work was carried out in order to create and to
explain the categories of consequences.
 Initial evaluation of consequences: 4 categories of possible
consequences have been considered by the expert: effects in
terms of potential injuries (Health and Safety), environmental
impact, loss of reputation and economic loss. A level of
severity, from 1 to 5, was then assigned to each impact cate-
gory. The severity of the event can be decided with reference
to Table 2.
The economic impact of failure is considered in the annual
balance and in relation to production:
- damage to property results in costs for the repair and substi-
tution of the equipment;
- the costs associated with the value of the product are loss of
production, start-up costs, etc.
The decision-making criteria are illustrated in the ‘‘Economic
impact’’ column of Table 3.
2.2.4. Risk evaluation
Risk evaluation is based on the decision-making matrix illus-
trated in Table 3 which summarises all the previously defined items
of risk analysis.
The risk score which should be considered in the case of several
competing items is the highest score found among the items
considered. There is also a multiplication factor f in the matrix
which allows the risk to be indicated numerically on a scale of from
1 to 100; factor  2 main diagonal (Medium to Low Risk); factor  3
(Medium to High Risk); factor  4 (High Risk).
In this context a risk is the product of 3 factors, i.e.:
Probability  Exposure  Consequence:
Probability: the likelihood of the considered event occurring;
Exposure: the possible duration of the event;
Consequence: the outcome of the event.
Some guidelines, shown in Table 4, have been defined in order to
evaluate exposure. This is a factor which may lessen the risk and it
allows us to bear in mind how long people are subjected to
a possible event.
2.2.5. Choice of action and calculation of the J-factor
If the team of experts considers that the level of risk evaluated
is too high, either preventive action (action which reduces the
probability of an event) or mitigating action (action which reduces
the consequences of an event) is necessary. When possible, using
a logical decision-making process based on the findings and on
the limits of efficiency and functionality, the action to be taken
should be identified (repair task, replacement task and on
condition task).
If this is not possible ‘‘default’’ action should be decided, which
may involve the re-designing of components, unscheduled main-
tenance or modifications to maintenance procedures.
For each improvement choice identified it is necessary to
reconfirm the conditions of probability, consequence and exposure
in order to determine the efficacy of preventive and mitigating
action. In addition to the previously defined conditions, the team
must also assess the most profitable alternative (that is to say, the
one which reduces the maximum risk per invested euro) as
opposed to taking no action at all. An index called Justificator
Factor (or J-factor) has been used in order to help this type of
analysis4:
J  factor ¼ ðoriginalrisk  newriskÞ=cost
in which original risk is the initial risk calculated for the threat
(Alternative 0), new risk is the risk of the alternative when
completely implemented, and cost is the cost of implementing the
alternative. The J-factor indicates the amount of risk reduction by
euro invested for each alternative. It can therefore be used as
a criterion for choosing between the various alternatives. The team
must look for the alternative that produces the maximum reduc-
tion of risk per euro, that is to say, a high J-factor value. Finally on
the basis of the indications provided by J-factor calculation the
chosen action can be scheduled.
4
This type of J-factor was defined in accordance with an internal procedure
applied by the Shell Company (S-RCM, 2000) which was specifically created for the
refinery sector.
250 M. Bertolini et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 244–253

Table 4
Assessment of Exposure.
Key word Exposure Examples
Constant 1 Emissions from a chimney
Frequent – Daily 0.6 Loading operations
Occasional – Weekly 0.3 Machine alternation
Unusual – Monthly 0.2 Transfer of fluid
Rare – Sometimes 0.1 A non-routine operation
Very Rare – Annual or less 0.05 Replacement of a catalyst
3. Two case studies
This works reports on the application of the RBI&M method to
two specific stages in the maintenance activities of the API refinery,
the annual turnaround and the work orders management.
3.1. Oil refinery turnaround (T/A)
Routine maintenance on the plant at the refinery, called a turn-
around, consists in changing and/or restoring the plant’s working
conditions by taking action on its component parts in order to
improve their efficiency. This servicing process affects both the
equipment that cannot be isolated while the plant is in normal
operation, Items in T/A, and any equipment that does not need to be
emptied and cleaned, but that has posed problems in operation or
needs to be inspected regularly, Items not in T/A. The aim of the
process is to restore or improve energy efficiency, guarantee
smooth operation, ensure the integrity of the safety systems, and
contain wear and tear in order to prolong the equipment’s working
life as far as possible and ensure a clean working environment.
In practical terms, depending on the objectives, these measures
become necessary to: increase production by means of overhauls
and improvements, modernize the plant with the aid of more
advanced technologies, remove load limitations, change the cata-
lysts, enable essential inspections, improve plant performance by
means of large-scale changes, overhaul some parts (e.g. pumps and/
or compressors), inspect critical containers, evaluate the residual
life of components involved in the turnaround, clean the equip-
ment, and deal with any leaks that have developed during opera-
tion of the machinery. In many ways, managing a turnaround is like
managing a design project, but it is even more demanding because
all the measures have to be planned to fit into a very tight schedule
(generally 3–4 weeks), during which time all the resources –
human, material, technical and economic – must be efficiently
amalgamated and adequately supported.
The RBI&M methodology has been used to overcome the habit of
considering all the items that cannot be isolated while the plant is
running as T/A items and all the items ‘‘conventionally’’ included in
the work schedule as non-T/A items.
Using methods to facilitate the cost-risk–benefit assessment
enables us to eliminate several items from the list of T/A equipment.
The RBI&M method used for the Risk-Based Investigation helps us
to evaluate the failure risk and the benefits deriving from any
preventive measures (the product of the cost of the measures
multiplied by the new probability of the failure’s occurrence) and
thus compare the failure risks. Fig. 3 shows a summary of the
decision-making method applied for an optimal definition of the
list of T/A equipment.
3.1.1. Discussion
To give an idea of the significance of operations it is important to
remember that in 2003 the API refinery turnaround lasted 18 days
in all, maintenance activities involved a daily average of 500
workers, with peaks of up to 700, for a total of 100,000 h worked
and about ten million euro of investment. That is why we imple-
mented an RBI&M method that, starting from the way the turn-
around had been done until 2003, led to the identification of the
action needed to reorganize the turnaround and highlighted
measures that could be taken to achieve better and better results in
terms of performance and flexibility.
The performance control of the new proposed turnaround
management process is essential for its effective implementation.
The validation of the new model focused on two main aspects: the
attainment of the set targets and the absence of negative influence
of the new procedure on the previous turnaround management,
from an economic point of view.
Such controls were facilitated by the use of the Activity-Based
Costing tool, which allowed us to estimate the turnaround process
indicators. Table 5 reports the outcome of analysis, relative to the
2003 / 2004 and 2004 / 2005 oil refinery turnaround.
It is also important to point out that the re-definition of T/A
items allowed the company to decrease the amount of items
included in the turnaround by 23% in 2004 and 9.5% in 2005, with
respect to the 2003 situation. These results were accomplished by

Risk reduction decision

List of Premises matrix
works
Alternatives A B C D
Risk Scores . .. … … …
High Alternatives to reduce
Risk of NOT doing the risk and residual Musts
the work risk scores … … ... … …
(J factor calculation) … … … … …
Low Wants
… … … … …
… … … … …
Exclude from T/A

Step 1: Risk definition Best alternative

Step 2: List of alternatives included in the T/A
Step 3: Calculation of residual risk (J factor)
Step 4: Definition of Musts (conditions that are essential/consistent with premises)
Definition of Wants (desirable conditions associated with desirability indexes [Low, Medium , High])
Step 5: Evaluation and choice of the best alternative using weight factors

Fig. 3. Decision-making method

 M. Bertolini et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 244–253 251

Table 5 that, by identifying the causes and determining corrective action,

Percentage variation in working hours and costs through RBI&M. the analysis of undesired events leads to the introduction of
Description 2003 / 2004 2004 / 2005 a continuous improvement process, which is typical of manage-
Variation in working hours 20% 14% ment systems. On the basis of these analyses the ME Department
Variation in costs 18% 9% will be able to develop maintenance plans (predictive and
preventive maintenance) and optimise the procedures and main-
tenance techniques to be adopted.
shifting to current maintenance the ‘‘non-core activities’’ i.e., the The procedure for work order management starts with
ones that from the point of view of technical difficulty and asso- a comparison of all work orders inserted in the Computerised
ciated risk do not require a plant shutdown. Maintenance Management System (CMMS) of the refinery. CMMS
collects also the design and feature of all items (equipments, plants,
etc.) to manage (see in the top left-hand corner of Fig. 4).
3.2. Work orders management In order to decide the priorities for thorough investigation the
work orders must go through a comparison process which is
This work proposes a use of RBI&M methodology which aims at articulated in several steps:
defining a strategy for the management of ‘‘work orders’’ which are
received by the Maintenance Engineering Department. The term - the work orders provided by the CMMS must first be filtered by
‘‘work orders’’ refers to a whole set of activities such as replacement comparing them with the list of all the items present in the
of components, plant servicing, orders to purchase new compo- refinery, so as to concentrate only on those types of mainte-
nents, failure analysis, etc. The responsibilities identified for the nance which refer to a specific and unambiguous item. Some
correct functioning of the procedure involve both the workers and examples of work orders which do not concern the ME
the Maintenance Engineering (ME) Department of the refinery. As Department are those which refer to work which must be
far as the workers are concerned, each head of a shift, when issuing carried out by administration, the warehouse, road mainte-
a work order (WO) in the light of a Near Accident, Operational nance, insulation, repair of motor vehicles, etc.
Accident, Injury or Environmental Accident (see Appendix 1), must - Further to this preliminary step of selecting only those work
fill in properly all the items required by the Computerised Main- orders which concern a well-identified item there is a second
tenance Management System (CMMS) present in the refinery. The skimming to select only those tasks which satisfy at least one of
ME Department must compare all the internal reports of non- the following conditions (see Appendix 1):
conformity drawn up for each function of the refinery with the a) Associated with a Critical Item
work orders on the CMMS. b) Associated with a Bad Actor
This procedure, which must be repeated weekly, allows the c) Maintenance costs of over V10,000
identification of those critical items which RBI&M methodology d) Cause of plant shutdown or slowdown
must be applied to (Fig. 4). The procedure is based on the concept e) Issued in an emergency or urgent situation

CMMS

Work orders List of items

Critical item in processes

Unplanned shutdown and

Emergency and urgency

Cost > 10000 euro

Comparison
Bad Actors

slowdown

W.O. associated with equipment yes

no
Satisfies at least
W.O. follows its path no one condition

yes

Low risk Prioritising of events with the

decision matrix

Maintenance Critical failure analysis to Failure

plan be investigated analysis

ME

Fig. 4. Algorithm for work orders management.

252 M. Bertolini et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 244–253

Table 6 213 to Critical Items in processes, 199 unplanned shutdown and

Time-scale for carrying out work order analysis. slowdown, 1166 items have a non-significant impact on the envi-
Risk values Priority ronment (env), safety (sfty), process shutdown (sd), reduction in
Risk between 81 and 100 Analysis must be carried out immediately quality (qlty) or loss of quantity of the product (qnty), 600 items
Risk between 36 and 80 Analysis must be started within 24 h have a cost of greater than 10,000 Euro, and 25 near accidents are
Risk between 17 and 36 Analysis must be started within 48 h reported. The same simulation was repeated using the data for
Risk between 1 and 16 Analysis must be started within one week
2004 and 2005.
Experience has shown that the application of the decision-
making matrix for drawing up CFA is a very selective method, and
The task requests identified in this way converge with the
on average only 50% of possible candidates pass through this filter.
indications provided by the non-conformity reports to form a list of
Consequently the weekly number of failure analyses to be per-
cases to analyse using RBI&M methodology.
formed by the Reliability Department was 33.2 in 2003, 28 in 2004
As well as identifying the phenomena of critical failure to be
and 27.4 in 2005, with an average value of 6.64, 5.6 and 5.48 failure
failure analysed, the investigation carried out using the decision-
analyses respectively for the years 2003, 2004 and 2005. On dis-
making matrix determines the priorities, i.e. the deadline for
starting analysis of the event and maintenance plan according to cussing the results obtained with the head of the Reliability
Department, we found that this average number corresponds with
the criteria shown in Table 6. This table defines the time-scale for
carrying out work order and failure analysis. expectations and with the true capacity expected of the staff
employed (5 people), and is also in line with the current work load.
The decreasing values of the work orders and of the all indexes
3.2.1. Discussion
analysed demonstrate that the proposed procedure has not
Although apparently extremely simple the algorithm illustrated
involved contraindications from reliability point of view while it
in the previous chapter is the result of a whole series of attempts and
improvements. In fact it was also necessary to bear in mind the allowed to reliability department important advantages from
economical and management point of view.
organizational aspects of the work including the number of tech-
nicians employed in the Reliability Department, the number of daily
working hours, the average time taken to perform a single failure
4. Conclusions
analysis, etc. The work organization in the reality of the refinery
studied can be described as follows: in the Reliability Department 5
The RBI&M method proposed in this work was developed in
people generally work on drawing up failure analysis, each working
order to solve two important problems of reliability department of
day is of 8 h, the weeks worked during the year are 52 minus 5
the refinery analysed:
working weeks (26 days of holiday), minus another two weeks,
considering the average value of national holidays and days of sick
leave. Therefore the number of work orders (WO) computed with 1) The personnel available for the analysis of critical items and
events is limited and it is not able to assess in detail all the
the algorithm must equate with forty-five working weeks. Since
events occurred;
resources are limited, it is necessary to determine how they should
2) once defined the critical level of an item or event, reliability
be distributed, so that no important works remain neglected while
more resources are concentrated on the most critical work orders. department has to decide the best maintenance actions and
work orders to carry out.
By applying the algorithm to data regarding WO issued in 2003,
2004 and 2005, we obtained the results shown in Table 7.
The target reached was that of identifying the really critical
To explain to procedure it is possible to take into consideration
the data of 2003. Simulation using data from 2003 results in 2988 events, items and work orders in terms of safety, environment,
plant availability, quality of the product and maintenance costs, so
candidates for Critical Failure Analysis (CFA) to be controlled with
the decision-making matrix, out of a total 7128 examined, which is as to be able to proceed, in a systematic way, with failure analysis
and thereby with the performance of subsequent corrective action.
equal to about 42%. Of these, 767 must be attributed to Bad Actors,
The application of the procedure to two specific stages in the
maintenance activities of the refinery has shown how the use of
Table 7 risk-based inspection techniques leads to an improvement in the
Results of the simulations performed.
indices which measure maintenance quality (Tables 5 and 7). The
Year 2003 Year 2004 Year 2005 scheduling of necessary operations is made on the basis of risk
Total work orders 7128 4849 4807 estimation, cost of the alternative but first of all on the basis of
examined (TE) resources available. Tests carried out by panel of expert have
Total candidates for Critical 2988 2525 2469
allowed to improve and to standardize the method due to the
Failure Analysis (CFA)
Percentage of total (%tot) 42% 52% 51% specific application field of petrochemical plants.
Work orders involving env, 1166 1165 1104 The decision-making matrix has proved to be a tool which
sd, qnty, qlty, sfty quantifies the risk and can lead to the fixing of priorities and can
(1 failure per year) justify choices in terms of ‘‘action/event risk – associated risks –
n. Bad Actors (BA) 767 568 573
n. Action on Critical 231 104 99
possible improvements – resources used – result’’.
Items (CI) Decision-making assessment using the risk matrix must be
Unplanned shut/ 199 101 91 carried out by a special ‘‘team’’ whose experience must guarantee
slowdown (SD) thorough competency concerning all aspects of the specific oper-
n. WO with estimated 600 552 568
ation being examined. The work procedure which was developed
cost > 10 thousand V
(>10,000) has also led to a common and easily comprehensible technical
n. Near Accidents (NA) 25 35 34 language which is used by all the people who interact on the plants.
CFA candidates/week 2988/45 z 66.4 2525/45 z 56.1 2469/45 z 54.8 It has improved the understanding of the way in which the plant
CFA/week 66.4  0.5 z 33.2 56.1  0.5 z 28 54.8  0.5 z 27.4 works and has made improvements possible both in the mainte-
CFA/(week  employee) 33.2/5 ¼ 6.64 28/5 ¼ 5.6 27.4/5 ¼ 5.48
nance and the running processes of the plant.
 M. Bertolini et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 244–253
The failure of a system is rarely the result of a single cause, but
rather the result of a combination or a series of interacting events.
As a result, Risk-based Inspection & Maintenance must not be
perceived as a static exercise to be performed only once. It is
a dynamic process, which must be continuously updated as addi-
tional information becomes available.
RBI&M methodology proposed in this paper can be adapted
and used in many situations which may arise in a refinery. Using
this methodology it is possible to make not only a failure analysis
but also to estimate the environmental aspects connected with
operational activities, the safety risk, and to make an investment
analysis, etc.
Appendix 1
Definitions
Item: equipment or device characterized by a conventional
progressive number, subject to maintenance.
Critical Item: item identified with specific operational func-
tions. Its malfunctioning compromises the operations of the
plant in which it is used; in other words the unavailability of
this equipment or device has implications for safety or may
cause plant shutdown or may prevent the loading of products
via land or sea.
Bad actor: an item which has had two or more failures in
a year or which is defined as such because of its technical
functions.
Critical Failure Analysis: a real or potential event, subject to
failure analysis.
Near Accidents: Near accidents are those events which have
been a source of risk or danger, potentially provoking injuries
and accidents; damage to the health of the workers or the
population; damage to the environment; damage to company
or third party property.
Operational Accidents: Operational accidents are those events
which have resulted in operational targets not being reached
following ‘‘upsets’’ or ‘‘mal operation’’.
Environmental Accidents: Environmental accidents are those
events which have led to a lack of conditions which respect
the environment.
Injuries: Injuries according to Italian Law (Art.2 DPR 1124 of
20/6/65) ‘‘occur because of violent events in the workplace
and cause death, complete or partial permanent work
disablement leading to absence from work or reduced
performance’’. Accidents are defined as those events which
cause damage to people, the environment or property.
Shutdown: total shutdown of operations in a plant due to any
type of anomaly.
Slowdown: reduced working capacity of the plant, less than
75% of the expected value.
View publication stats
253
References
American Society of Mechanical Engineers Code Committee SC6000. (2000).
Hazardous release protection. New York, NY: ASME.
Apeland, S., & Scarf, P. A. (2003). A fully subjective approach to modelling inspection
maintenance. European Journal of Operational Research, 148, 410–425.
Arunraj, N. S., & Maiti, J. (2007). Risk-based maintenance – techniques and appli-
cations. Journal of Hazardous Materials, 142(3), 653–661.
Baker, R. D., & Wang, W. (1992). Estimating the delay-time distribution of faults in
repairable machinery from failure data. IMA Journal of Mathematics Applied in
Business and Industry, 3, 259–281.
Balkey, R. K., & Art, J. R. (1998). ASME risk-based in service inspection and testing:
an outlook to the future. Society for Risk Analysis, 18(4).
Baron, M. M., & Cornell, M. E. P. (1999). Designing risk-management strategies for
critical engineering systems. IEEE Transactions on Engineering Management, 46,
87–100.
Bedford, T. (2004). Assessing the impact of preventive maintenance based on
censored data. Quality and Reliability Engineering International, 20, 247–254.
Bevilacqua, M., Braglia, M., & Gabbrielli, R. (2000). Monte Carlo simulation approach
for a modified FMECA in a power plant. Quality and Reliability Engineering
International, 16, 313–324.
Christer, A. H., Wang, W., Baker, R. D., & Sharp, J. (1995). Modelling maintenance
practice of production plant using the delay-time concept. IMA Journal of
Mathematics Applied in Business and Industry, 6, 67–83.
Cowing, M. M., Cornell, M. E. P., & Glynn, P. W. (2004). Dynamic modeling of the
tradeoff between productivity and safety in critical engineering systems. Reli-
ability Engineering and System Safety, 86, 269–284.
Dey, P. M. (2001). A risk-based model for inspection and maintenance of cross-
country petroleum pipeline. Journal of Quality in Maintenance Engineering,
40(4), 24–31.
Harnly, A. J. (1998). Risk based prioritization of maintenance repair work. Process
Safety Progress, 17(1), 32–38.
Khan, F. I., & Abbasi, S. A. (1998). Risk assessment in chemical process industries:
Advance techniques. New Delhi: Discovery Publishing House. XC376.
Khan, F. I., & Haddara, M. R. (2004). Risk-based maintenance of ethylene oxide
production facilities. Journal of Hazardous Materials, A108, 147–159.
Khan, K., Sadiq, R., & Haddara, M. (2004). Risk-based inspection and maintenance
(RBIM): multi-attribute decision making with aggregative risk analysis. Process
Safety and Environmental Protection, 82, 398–411.
Krishnasamy, L., Khan, F., & Haddara, M. (2005). Development of a risk-based
maintenance (RBM) strategy for a power-generating plant. Journal of Loss
Prevention in the Process Industries, 18, 69–81.
Kumar, U. (1998). Maintenance strategies for mechanized and automated mining
systems: a reliability and risk analysis based approach. Journal of Mines, Metals
and Fuels, 46(11–12), 343–347.
Linstone, H. A., & Turoff, M. (1975). The Delphi method techniques and application.
London: Addison-Wesley.
Meel, A., O’Neill, L. M., Levin, J. H., Seider, W. D., Oktem, U., & Keren, N. (2007).
Operational risk assessment of chemical industries by exploiting accident
databases. Journal of Loss Prevention in the Process Industries, 20(2007),
113–127.
Mili, A., Bassetto, S., Siadat, A., & Tollenaere, M. (2009). Dynamic risk management
unveil productivity improvements. Journal of Loss Prevention in the Process
Industries, 22(2009), 25–34.
S-RCM Training Guide. (2000). Shell-reliability centered maintenance. Shell Global
Solution International.
Todinov, M. T. (2003). Setting reliability requirements based on minimum failure-
free operating periods. Quality and Reliability Engineering International, 20,
273–287.
Van Heel, K. A. L., Knegtering, B., & Brombacher, A. C. (1999). Safety lifecycle
management. A flowchart presentation of the IEC 61508 overall safety lifecycle
model. Quality and Reliability Engineering International, 15, 493–500.
Vesely, W. E., Belhadj, M., & Rezos, J. T. (1993). PRA importance measures for
maintenance prioritization applications. Reliability Engineering and System
Safety, 43, 307–318.
Wang, W., & Christer, A. H. (1998). A modelling procedure to optimize component
safety inspection over a finite time horizon. Quality and Reliability Engineering
International, 13, 217–224.