Introduction

An unplanned crude unit shutdown caused by one overhead line leak can cost a refinery $400,000 USD or more per day in lost margin, before repair costs, flaring, and incident investigation. Most of these leaks occur in equipment that was inspected on schedule. While the inspection happened, however, it looked in the wrong place, used a technique that could not detect the active damage mechanism, or followed a calendar that did not reflect how fast the damage was progressing.

Risk-based inspection (RBI) is a risk assessment and management process focused on loss of containment of pressurized equipment in processing facilities due to material deterioration. These risks are managed primarily through equipment inspection. A corrosion control document (CCD) is a document that captures the overall strategy for monitoring and control of various forms of degradation that could result in equipment failures in a process unit. An integrity operating window (IOW) establishes limits for process variables (parameters) that can affect the integrity of the equipment if the process operation deviates from the established limits for a predetermined length of time. Together, they tell an engineer what to inspect, where, how, and when to change the plan.

New engineers meet these tools early. Process engineers normally receive IOW exceedance notifications. Inspection engineers inherit RBI plans. Project engineers see management of change (MOC) reviews that cite the CCD. Reliability engineers get asked why a vessel was added or removed from the turnaround scope. This article explains how RBI, CCDs, and IOWs fit together, which standards govern each, and how to read an inspection plan as a technical argument rather than a schedule.

Core Concepts: How Inspection Priorities Are Set

How Does RBI Rank Equipment?

API RP 580 (4th Edition, 2025) defines the elements of an RBI program, and API RP 581 (4th Edition, 2025) supplies the quantitative calculation methods. Both rest on one relationship: risk equals probability of failure (POF) times consequence of failure (COF). In API RP 581, POF is a generic failure frequency for the equipment type, multiplied by a damage factor for each active damage mechanism and a management systems factor. COF is expressed as an affected area in square feet for safety or in dollars for financial impact, and it depends on inventory, fluid, operating pressure, and detection and isolation capability.

The two results plot on a risk matrix, and the ranked list shows where the relative risk of loss of containment concentrates. At a typical refinery, a small fraction of equipment items carry most of the calculated risk. That concentration is the reason RBI exists: it moves inspection hours from low-risk items to the few that justify more effective inspection.

API RP 581 rates an inspection method from Category A (highly effective) to Category E (ineffective) based on how reliably it detects the active damage mechanism at the expected location. Inspection does not reduce risk by itself; it reduces uncertainty about the damage state, which lowers the damage factor when the finding is favorable. Repair, replacement, or a process change reduces risk when the finding is not.

What Does a Corrosion Control Document Add?

RBI is only as accurate as the damage mechanisms assigned to each item. A CCD, developed under API RP 970 (2nd Edition, 2023), divides a process unit into corrosion loops: groups of equipment and piping with common process chemistry, metallurgy, and damage rates. For each loop the CCD documents the materials of construction, the active and potential damage mechanisms, expected corrosion rates, and areas of inspection emphasis. It takes the generic mechanisms listed in API RP 571 (3rd Edition, 2020) and makes them specific to the unit.

The CCD is a precursor to RBI because it defines which damage mechanisms the RBI model applies and which rates it uses. Equity Engineering practice is to refresh a CCD every five years, concurrent with the process hazard analysis (PHA) revalidation, or after a major turnaround, and to cover all fixed equipment in the unit rather than vessels alone.

How Do IOWs Protect the RBI Assumptions?

An RBI plan assumes the unit operates inside the conditions the CCD describes. API RP 584 (2nd Edition, 2021) defines IOWs as limits on the process variables that keep damage rates predictable, such as desalter outlet salt content, overhead water pH and chloride, minimum temperature margin above the water dew point, or hydrogen partial pressure. API RP 584 classifies IOWs as critical, standard, or informational, and each class carries a defined response. Equity Engineering guidance is to alarm very few IOWs and choose parameters that operations can control.

The IOW is the guardrail. Operation outside the limit for a defined duration invalidates the corrosion rate behind the inspection interval, so the exceedance triggers an inspection review instead of waiting for the next scheduled turn. The table separates what each tool answers and which standard governs it.

Tool	Question it answers	Key standard	Output and typical owner
RBI	What gets inspected first, with what method, and how often?	API RP 580-2025; API RP 581-2025	Risk-ranked equipment list and inspection plan; inspection and mechanical integrity group
CCD	Which damage mechanisms are active, and how fast do they progress?	API RP 970-2023; API RP 571-2020	Corrosion loops, damage mechanisms, expected rates; materials and corrosion engineer
IOW	Which process limits keep damage rates predictable?	API RP 584-2021	Limits by critical, standard, or informational class, with response actions; operations with inspection
In-service codes	What are the minimum scope, maximum interval, and personnel qualifications?	API 510-2022; API 570-2024	Required inspection practices and default intervals, adjustable by RBI; authorized inspector

Why Does This Matter Beyond Inspection?

Safety and compliance. OSHA process safety management, 29 CFR 1910.119(j)(4)(iii), requires inspection and testing frequency consistent with good engineering practice and more frequent when operating experience dictates. An IOW exceedance is operating experience. EPA Risk Management Program, 40 CFR 68.73, carries the same mechanical integrity requirement, and California refineries also operate under 8 CCR 5189.1, which adds a damage mechanism review. Auditors ask for the technical basis behind each interval, and “we inspected every five years” does not provide one.

Operations and projects. IOWs make integrity an operations responsibility. A desalter upset that an operator treats as a throughput problem is, in the CCD, a corrosion rate multiplier on downstream equipment. Changes in crude slate, feed sulfur or nitrogen, or operating temperature are MOC items under 29 CFR 1910.119(l), and each one can add damage mechanisms that the current CCD and RBI do not cover. A project engineer who skips the CCD review during MOC introduces unmodeled damage into a plan that still appears current.

Planning and budget. Turnaround scope follows the risk ranking. Deferring a low-ranked vessel is technically justified when the RBI inputs are current but is a gap once the CCD is eight years old. RBI also does not replace API 510-2022 or API 570-2024. Those codes allow owner-users to set intervals from an RBI assessment performed per API RP 580, but minimum program elements, inspector qualifications, and jurisdictional requirements still apply.

Case Study: An IOW Exceedance on a Crude Unit Overhead Line

Background

A 100,000 barrel-per-day crude unit operates an 8-inch (203.2 mm) NPS atmospheric tower overhead vapor line in ASTM A106 Grade B carbon steel, Schedule 40 (0.322-inch [8.179 mm] nominal wall), designed for 150 psig at 450°F (232°C). The line entered service in 1998 and operates at 22 psig and 275°F. Pressure design thickness is 0.032 inches (0.813 mm), so the governing retirement thickness is the site structural minimum of 0.100 inches (2.54 mm). The site’s 2019 RBI study ranked 2,300 piping circuits and 410 pressure vessels, and scored this circuit medium risk based on a measured corrosion rate of 1.4 mils per year (mpy), from 0.322 inches (8.179 mm) nominal to 0.292 inches (7.417 mm) measured over 21 years. Twelve thickness measurement locations (TMLs) were inspected by ultrasonic thickness (UT) on a five-year interval.

Problem and Trigger

The 2024 CCD refresh treated the overhead as its own corrosion loop and identified hydrochloric acid corrosion and ammonium chloride under-deposit corrosion as the governing mechanisms. Expected corrosion rate is 2 mpy inside the IOWs and above 25 mpy outside them. The team set critical IOWs on overhead boot water pH (below 5.0), boot water chloride (above 50 ppm), and tower top temperature (less than 25°F [-3.89°C] above the water dew point), plus a standard IOW on desalter outlet salt of 1.0 pound per thousand barrels (PTB). In the first quarter after implementation, a desalter interface level problem cut desalting efficiency. Boot water pH fell as low as 4.4, chloride reached 140 ppm, and the critical IOW stayed exceeded for a cumulative 38 days.

Analysis and Assessment

The IOW response procedure required an inspection review within five business days. Rather than wait for the next five-year interval, the inspector and corrosion engineer ran a targeted UT scan of four elbows and 10 feet (3.048 m) of straight run downstream of the condenser inlet. Minimum thickness at the second elbow was 0.231 inches (5.867 mm), against 0.286 inches (7.264 mm) in the 2024 turnaround data: a loss of 0.055 inches (1.397 mm) in about 12 months, or 55 mpy. Remaining life to the 0.100-inch (2.54 mm) retirement thickness was (0.231 − 0.100) ÷ 0.055 = 2.4 years. The same calculation at the historical 1.4 mpy rate gave more than 90 years. Per API 570-2024, the next inspection interval cannot exceed half the remaining life, or about 14 months. The RBI analysis was recalculated with the CCD rate, the POF category moved from 2 to 4, and the circuit moved from medium to high risk.

Three options went to the unit manager. Option 1 restored the desalter and kept the five-year interval at no added cost, but left a leak exposure inside the 2.4-year remaining life; an unplanned eight-day shutdown at $450,000 per day in lost margin is $3.6 million before repair. Option 2 restored IOW compliance through wash water and neutralizer optimization ($140,000), added an online pH and chloride analyzer with two electrical resistance probes ($85,000), set semiannual UT at 14 TMLs ($30,000 per year), and scheduled replacement of the elbow and a 40-foot (12.192 m) spool in Alloy 825 at the next turnaround, 20 months out ($260,000 installed). Option 3 replaced 120 feet (36.576 m) of line immediately for $1.4 million installed plus a six-day outage at $450,000 per day ($2.7 million), a $4.1 million total.

Outcome

The unit chose Option 2 within 30 days. Desalter outlet salt returned to 1.0 PTB or below within six weeks, with boot water pH holding between 5.8 and 6.2 and chloride between 12 and 25 ppm. The six-month UT showed 0.229 inches (5.817 mm) at the same elbow, a loss of 0.002 inches (0.051 mm), or 4 mpy, which is within the CCD expected range for operation inside the IOWs. The elbow and spool were replaced at month 20, and the POF category returned to 2.

Key Point

The RBI analysis told the site where to inspect and the inspection method to use. The CCD documented the specifics of managing the asset’s degradation of an asset. The IOW provided recommendations on response or monitoring actions when process units exceed the established operational limits. Had the upset continued, the line would have reached retirement thickness before the next scheduled UT. Each decision was supported by the analysis and documented against API RP 580, API RP 970, and API 570.

What Do New Engineers Get Wrong?

• Treating the RBI output as the schedule. An RBI result is only as valid as its inputs. A plan built on generic API RP 571 mechanisms without a CCD can assign 1.4 mpy to a circuit where the unit chemistry supports 25 mpy or more, and the plan will look correct on paper.
• Reading low risk as no inspection. A low ranking sets priority and method, not exemption. API 510-2022, API 570-2024, and jurisdictional rules still set the minimum scope, and a low-risk item with an unknown damage state needs at least one effective baseline inspection.
• Overloading the IOW list. A unit with 80 alarmed IOWs trains operators to ignore them. Select the few parameters that drive the damage rate, that operations can adjust, and that have a documented response with a named owner.
• Setting a corrosion rate from one pair of readings. Two UT readings taken at slightly different locations or with different equipment can produce a rate that is off by an order of magnitude. Trend at least three data points across multiple TMLs and verify outliers before the rate enters RBI.
• Counting inspection quantity as inspection effectiveness. Fifty single-point UT readings do not detect localized under-deposit corrosion. RBI credit depends on whether the method finds the active mechanism at the right location, so match the technique, such as scanning UT or profile radiography, to the damage.

What Should I Learn Next?

• API RP 580 (2025) and API RP 581 (2025), Parts 1 and 2. Read RP 580 for program structure, then work the RP 581 thinning damage factor example by hand. Changing the corrosion rate input and watching the damage factor move builds intuition quickly.
• API RP 571 (2020). Learn the damage mechanisms active in your unit before reading anything else about it. Hydrochloric acid corrosion and ammonium chloride corrosion in overhead systems are a good start.
• API RP 970 (2023) and API RP 584 (2021). Pull the CCD and IOW list for your unit. Find the critical IOWs, the notification chain, and the last revision date.
• API 510 (2022), API 570 (2024), and API 579-1/ASME FFS-1 (2021). The codes set the inspection floor, and API 579 tells you what to do when inspection finds damage. The Engineering 101 article on FFS assessments and turnaround repairs picks up where this one ends.
• 29 CFR 1910.119(j) and (l) and your site MOC procedure. Trace one recent MOC through to the CCD and RBI update. The Engineering 101 article on codes and standards explains how the regulatory and consensus layers connect.

Closing: Reading an Inspection Plan Critically

RBI decides where inspection effort goes. The CCD explains what damage to look for and how fast it progresses. IOWs keep the process inside the conditions those answers assume. Remove any one and the inspection plan loses its technical basis, even when every inspection is completed on time.

Build one habit early. Each time you open an inspection plan, ask which damage mechanism the inspection is designed to find, which process condition controls its rate, and which limit tells you that condition has changed. If you cannot answer all three from the CCD, the RBI report, and the IOW list, find the gap and report it before the next turnaround scope is set.