What’s Really at Stake  

When a shell-and-tube heat exchanger operates with a large pressure differential between the tube side and shell side, one of the most important engineering questions is deceptively simple: Could a tube rupture happen here? In many cases, the concern is overpressure of the low-pressure side. But a tube rupture can also be consequential for a different reason entirely: the uncontrolled mixing of incompatible fluids. A high-pressure hydrocarbon stream suddenly entering a cooling water circuit, or a toxic process fluid breaching into a utility system, can create safety, environmental, and operational consequences that go well beyond the pressure relief question. Both scenarios mean the credibility of a tube rupture must be rigorously assessed. 

API 521, Pressure-Relieving and Depressuring Systems, allows plant owners to either forgo dedicated pressure-relieving devices on the low-pressure side of an exchanger or avoid having to size the low-pressure side relief system for the tube rupture scenario, but only if a rigorous analysis of the heat exchanger design demonstrates that a full-bore tube rupture is sufficiently remote to be classified as non-credible. That analysis is the tube rupture credibility assessment, or TRCA, and it draws on multiple engineering disciplines to reach its conclusion. 

The financial implications of a tube rupture scenario are significant. During pressure safety valve (PSV) revalidation studies, engineering contractors commonly find that the low-pressure side relief system is inadequate for the tube rupture scenario. The typical remedies — larger relief valves, conversion to rupture disks, upsized piping, and sometimes physical modifications to the exchanger shell — can represent substantial capital expenditure, especially on existing systems. The cost of a TRCA, in contrast, is often an order of magnitude less than the capital outlay required to upgrade a relief system for the full-bore tube rupture case. A well-executed TRCA can eliminate the tube rupture scenario altogether, potentially avoiding these costs while maintaining full compliance with API 521. Before committing capital to relief system upgrades, it is well worth determining whether the scenario is non-credible in the first place. 

A TRCA is not a single calculation; it is a multidisciplinary assessment that integrates several pillars: mechanical design analysis, tube vibration evaluation, tube-to-tubesheet joint integrity, metallurgical and corrosion review, inspection program evaluation, and process technology considerations. Each of these contributes to the final credibility determination. A vibration analysis may reveal that flow-induced excitation poses a risk to the tubes. An assessment of the tube-to-tubesheet joint may identify conditions under which tube pullout could occur from pressure or thermal loading. Mechanical evaluations address tube buckling, collapse, and ductile overload. These are all essential, as a tube can rupture through purely mechanical means even without any corrosion or cracking present. 

Among these pillars, the metallurgical and corrosion review, or damage mechanism review (DMR), occupies a unique position: it connects the metallurgical and process realities of the exchanger to nearly every other aspect of the assessment. This article examines in further detail the role of damage mechanisms within the context of a TRCA. 

Where the Assessment Is Won or Lost 

Every pillar of the TRCA contributes to the overall credibility determination, but the DMR has an especially broad reach because its conclusions shape so many of the other elements; the inspection program, the monitoring recommendations, and the ongoing management-of-change (MOC) considerations all flow from it. 

The goal of this portion of the assessment is to determine whether any active or plausible degradation mechanism could produce an instantaneous, full-bore tube failure. This is a fundamentally different question than “Is this tube corroding?” Damage mechanisms that cause modest, predictable metal loss – general corrosion, for example – can typically be managed through periodic inspection and leak detection if the corrosion mechanism is particularly aggressive. They are not expected to cause sudden ruptures because the damage develops gradually and is detectable well before integrity is compromised. 

The mechanisms that elevate concern are those capable of producing rapid, catastrophic failure with little or no warning. Environmental stress corrosion cracking (SCC), brittle fracture, creep, and certain high-temperature degradation modes fall into this category. When these mechanisms are credible for a given exchanger’s materials and operating conditions, the tube rupture scenario becomes much harder to dismiss, regardless of what the mechanical and vibration analyses may show. Importantly, the DMR must account for more than just normal steady-state operation. Start-up, shutdown, and other transient conditions can introduce thermal cycling, temperature excursions, and temporary chemistry changes that activate mechanisms not present during routine service, and these operating modes must be captured in the assessment. 

This is where the quality of the damage mechanism expertise matters most. An assessment driven by conservatism, one that defaults to worst-case assumptions where detailed knowledge is lacking, will tend to classify mechanisms as credible when they may not be. The result is unnecessary capital expenditure on relief system upgrades or overly burdensome inspection requirements. Subject matter experts (SMEs) with deep, practical experience in API 571 damage mechanisms and decades of direct exposure to real exchanger services can draw finer distinctions. They understand which mechanisms are genuinely active versus merely theoretically possible, and they evaluate the interplay between materials, process conditions, and operating history with a nuance that conservatism alone cannot replicate. Equity Engineering has successfully completed over 200 TRCAs across a wide range of industries, exchanger types, and service conditions, and while the TRCA is most commonly associated with shell-and-tube exchangers, Equity’s breadth of mechanical, process, and materials engineering capabilities has allowed the methodology to be extended to other exchanger configurations where the same tube rupture or barrier failure questions apply. 

Each identified damage mechanism is evaluated for its applicability and assessed for its rupture potential, ranging from “not credible” to a higher level of concern that demands specific mitigation. The assessment examines tube side and shell side conditions independently because the damage environment on each side can be dramatically different. 

Before the Steel Is Cut 

TRCAs are most commonly associated with existing exchangers, often triggered by a PSV revalidation finding. However, the same methodology can be applied during the design phase of a new exchanger, and the benefits of doing so can be substantial. 

When an engineering contractor designs an exchanger with a high pressure differential, most typically the default approach is to size the low-pressure side relief system assuming a full-bore tube rupture will occur. This can lead to oversized relief devices, large relief nozzles that force the shell to be extended, and complex piping collection systems, all adding cost, weight, and footprint to the design. In some cases, the relief system requirements fundamentally alter the exchanger’s geometry and layout. 

Performing a TRCA during the design phase allows the owner to evaluate whether the tube rupture scenario can be classified as non-credible before the exchanger is fabricated. If the combination of materials selection, tube mechanical design, expected damage mechanisms, and a planned inspection program renders the full-bore rupture scenario remote, the oversized relief infrastructure can be eliminated from the design entirely. Beyond cost savings, this also creates the opportunity to make informed material or design changes while they are still straightforward and inexpensive to implement. Waiting until the exchanger is in service to discover that a TRCA could have simplified the design is a missed opportunity that is difficult and costly to recover from. 

What the Records Reveal 

A DMR does not happen in a vacuum. One of the most critical inputs is the exchanger’s inspection and repair history. Past inspection reports provide direct evidence of what damage has or has not been occurring. They reveal whether expected mechanisms and/or unexpected degradation have manifested as well as if the inspection methods used were even capable of detecting the mechanisms of concern. 

Equally telling is the absence of records. A lack of inspection history is a red flag, because without evidence that the tubes have been examined for the relevant damage mechanisms, there is simply no basis for confidence. Likewise, if there have been tube failures or retubing events, the associated failure analysis reports should be reviewed. A history of failures without corresponding root cause investigations signals that the owner’s understanding of active degradation may be incomplete — and that gap directly undermines the credibility determination. 

Repair history matters for the same reason. Repeated repairs to the same area, a pattern of plug-and-go responses without addressing underlying causes, or the absence of metallurgical examination of failed tubes all point to unresolved damage mechanisms that may be progressing unchecked. These documentation gaps do not just weaken the DMR, they also limit the ability to validate mechanical assessments such as vibration or tube joint integrity, since the root cause of past failures may not be clear. 

Keeping the Chemistry in Check 

Many of the most aggressive damage mechanisms in heat exchanger tubes are directly tied to process chemistry. Whether the driver is trace contaminants, shifts in stream composition, or loss of chemical treatment effectiveness, the severity of a given mechanism (and sometimes whether it is active at all) depends on the composition and control of the fluids on both sides of the exchanger. 

This is why streams’ purity monitoring and process control programs are integral to the TRCA’s conclusions. When a damage mechanism is assessed as having low rupture potential, that assessment often rests on the assumption that process conditions remain within defined limits. 

This principle extends beyond the primary process fluid. Cooling water systems, heat transfer fluids and hot oil loops, steam and boiler water circuits, glycol systems, tempered water loops, brine circuits, and other closed-loop utilities all carry their own damage mechanism profiles. Each can introduce or accelerate tube degradation if fluid chemistry drifts or treatment programs lapse. The common misconception is that closed-loop or utility service equals low risk, but a controlled environment only remains benign if it is actually being monitored and maintained. 

A TRCA conclusion of “non-credible” is not permanent; it is conditional. If process conditions change, if feed quality shifts, if utility system chemistry drifts outside its control band, or if a treatment program lapses, damage mechanisms that were assessed as benign may become aggressive. This is precisely why the TRCA process emphasizes that any change in operating conditions should trigger a management-of-change (MOC) review to determine whether the credibility assessment needs to be revisited. 

From Assessment to Action 

API 521 considers an appropriate inspection program, along with the other assessments that make up the TRCA, to be the administrative procedures that allow elimination of the tube rupture scenario. Inspection is not just a way to gather data; it is itself a mitigation measure, and its adequacy is one of the conditions upon which a “non-credible” determination rests. The TRCA evaluates whether the owner’s current inspection program is sufficient for the identified damage mechanisms and mechanical integrity concerns, and where it falls short, recommends modifications going forward. 

This evaluation goes beyond asking whether inspections are being performed. It examines whether the right inspection techniques are being used for the right damage mechanisms. Each NDE method has its own strengths and limitations, and matching the technique to the suspected degradation mode is essential; a program that relies solely on one method may be blind to the very mechanism that poses the greatest rupture risk. The inspection program must also address concerns identified by other pillars of the TRCA, such as vibration-induced wear at baffle contacts or tube joint degradation at the tubesheet. 

The frequency of inspection is equally important and should match the severity and expected progression rate of the identified mechanisms. Some may warrant inspection at every turnaround. Others — particularly those assessed as unlikely based on materials compatibility and process conditions — may only require a baseline inspection to confirm their absence, with longer intervals thereafter. The TRCA provides the technical basis for these frequency recommendations by tying them directly to the damage mechanism assessment. 

Tailoring this program to a specific site requires accounting for the realistic capabilities of the owner’s inspection organization, the accessibility of the bundle, and the practical constraints of turnaround schedules. It also requires the ability to translate a broad range of damage mechanism knowledge into NDE method selection and inspection intervals that are both technically sound and practically executable. This is an area where Equity’s SMEs bring particular value, as the experience gained across over 200 TRCAs in diverse services, materials, and operating environments allows inspection recommendations to be grounded in decades of field observation, not just what is theoretically possible. 

One of the most valuable outputs of the TRCA is the recommended forward-looking inspection plan. This is where the DMR, together with the findings from the mechanical, vibration, and tube joint analyses, translates into actionable guidance for the asset owner. Rather than a generic checklist, the plan is tailored to the specific exchanger based on its materials, operating conditions, process environment, and the full range of concerns identified across all pillars of the assessment. It addresses which NDE methods should be employed and why, what locations within the bundle should receive focused attention, what frequency is appropriate for each inspection type, and what acceptance criteria should be applied. It also incorporates monitoring recommendations that complement the physical inspections, such as early warning systems that can flag changes in damage mechanism activity or mechanical degradation between inspection intervals. 

This forward-looking plan is especially important for exchangers assessed during the design phase, where no inspection history yet exists. In these cases, the plan is the primary administrative control that supports the credibility determination from the moment the exchanger enters service. Defining the right inspection strategy before the equipment is built ensures that the owner is prepared to validate the TRCA’s conclusions from the first turnaround onward, rather than discovering gaps after the exchanger has already been operating without an adequate program in place. 

The Whole Picture 

The TRCA is a structured exercise in determining whether a catastrophic tube failure is credible for a given heat exchanger. It achieves this through the combined strength of multiple analytical pillars: vibration assessment, tube-to-tubesheet joint evaluation, mechanical design checks, metallurgical and corrosion review, inspection program evaluation, and process technology analysis. No single pillar carries the conclusion alone. 

Within that framework, the DMR serves as a connective thread. Past inspections tell us what has happened. Repair history tells us what has gone wrong. Process control and streams purity monitoring tell us whether the conditions that govern damage mechanism severity are being maintained. And the forward-looking inspection plan ensures that the right techniques are deployed at the right intervals to catch degradation, whether from corrosion, cracking, or mechanical wear, before it becomes a rupture. 

When all these elements come together, assessed by engineers whose experience spans hundreds of completed evaluations rather than conservative defaults, the TRCA delivers its greatest value: a defensible, technically grounded determination of tube rupture credibility that protects both plant safety and operational economics.

Any questions for Equity experts can be submitted via the form below: