Equipment inspection intervals: what regulation fixes, and what it leaves to you

The question always arrives in the same order. Someone asks first "how often do we need to inspect this piece of equipment", gets a figure, and that figure becomes a house rule nobody ever reopens. Ten years later, the same interval still applies to equipment whose process, product and condition have each changed three times over.

The problem is not the figure. The problem is that three families of texts answer this question without ever overlapping, and that none of them answers on its own.

Three families of texts, three logics

The first family sets calendar ceilings. This is the regulation covering pressure equipment, storage tanks and lifting appliances. It says: not beyond so many years.

The second calculates an interval from measured degradation. These are the approved industry guides and the inspection codes. It says: here is how to derive a due date from what you have measured.

The third requires periodic inspection without ever fixing its frequency. These are the hygiene and quality standards, in food and beverage as much as in pharmaceuticals. It says: you must inspect at predetermined intervals, and it is you who predetermines them.

An inspection plan that draws only on the first family is a calendar plan that never looks at the equipment. A plan that draws only on the second walks past risks that wall thickness cannot measure. A plan that draws only on the third has no method at all. The overall approach is described in the risk-based preventive maintenance plan.

What French regulation actually fixes

Pressure equipment

The order of 20 November 2017 on in-service monitoring sets two distinct due dates.

Periodic inspection, article 15. Two years for steam generators and vessels with a quick-release removable closure. Four years for other equipment excluding piping, with a first inspection brought forward to three years after commissioning or a significant modification. One year for diving cylinders and non-metallic transportable receptacles.

Periodic requalification, article 18. Ten years for vessels, piping and steam generators. But six years where the fluid is toxic within the meaning of the classification, or corrosive towards the walls. And three years for a named list of nine particularly aggressive fluids, among them fluorine, hydrogen fluoride, phosgene and hydrogen sulphide, where the equipment cannot be guaranteed free of corrosive impurities.

This is the only place in French regulation where the nature of the fluid directly changes the interval. Everywhere else, it passes through the operator's judgement.

Article 13 opens a door. An inspection plan drawn up under an approved industry guide allows the intervals to be extended to six and twelve years, seven and fourteen for catalyst units. These guides are listed in annex 2 of the order: the technical documents of UFIP and UIC, the EDF guides, those from Storengy, those from Copacel for the paper industry. The plan is written under the operator's responsibility and approved by an authorised body within eighteen months of commissioning.

The case of piping, where there is nothing

Article 15 refers piping to an inspection programme drawn up by the operator within the year following commissioning. The nature of the checks and the maximum period are both defined by the operator.

In other words, on the most extensive component of an installation, the hardest to locate and the most often forgotten, the regulation gives no figure. The only available reference points are industry ones: the DT 96 guide proposes sixty months for class 1, one hundred and eight for class 2, one hundred and forty-four for class 3, and case-by-case treatment for class 4, in the absence of a formalised risk analysis. These classes are defined by the consequences of a leak, not by the condition of the piping.

Aboveground storage tanks

The order of 3 October 2010, article 29, requires an inspection plan for any flammable-liquid tank larger than ten cubic metres. Routine visits at one year at most. Detailed external inspections at least every five years, covering wall thickness, verticality and deformation. Out-of-service inspections at least every ten years for tanks larger than one hundred cubic metres.

The text adds two points that hold for everything else in this article: any deferral cannot exceed ten years and is under no circumstances renewable, and the deadlines shorten if an intermediate inspection reveals an anomaly.

A useful counter-example: lifting

Lifting appliances follow the opposite logic. The order of 1 March 2004 sets a general periodic examination every twelve months, six months for certain appliances, three months for those driven by human force that raise a working platform. Purely calendar-based, independent of condition.

This is the only field where the calendar is enough on its own. It is worth knowing that it is the exception, not the rule.

How an interval is calculated when you have measurements

The DT 94 guide, devoted to aboveground tanks and approved under the regulation, gives the most complete calculation chain available in French.

The remaining useful life equals the margin left divided by the rate of degradation: the minimum measured thickness minus the retirement thickness, all divided by the rate. The rate can come from the history of the tank itself, from that of a reference tank, or from the literature where measurements are lacking. Unless justified otherwise, you take the most penalising of the values drawn from the histories. The detail of the calculation is covered in how to calculate a corrosion rate.

This remaining useful life is then multiplied by a confidence factor between 0.5 and 1. This factor does not depend on the equipment but on the quality of what you know about it: number of prior inspections, interval of the previous one, quality of the data and of the methods used, results obtained, preventive maintenance carried out, repairs performed, changes of service.

Finally, and this is the point most often lost, the calculation is carried out section by section. Bottom, shell and roof give three intervals. The interval retained is the shortest of the three.

The American codes proceed differently but arrive at the same spirit. API 510 takes half the remaining useful life, capped at ten years, and switches to the full life capped at two years once the remaining life falls below four years. API 653 uses a quarter of the remaining life for the external inspection of tanks, not half: this is a frequent error in second-hand literature.

These codes also say what to do when you do not know. Corrosion rate unknown and no comparable experience: five years at most for thickness measurement, ten years at most for internal inspection. Lacking data does not license you to space out, it obliges you to tighten up.

The criteria that make an interval vary

The French industry guides organise these criteria into two blocks. DT 84 retains five probability factors and five consequence factors, and DT 32 sums up the logic in one sentence I have not found better put anywhere else: monitoring actions are "all the more frequent, thorough and complete the higher the criticality of the equipment".

What relates to the equipment itself. Its design and geometric complexity, how well its manufacturing file is known, its material, its age, the level of damage observed on it, the quality of the interventions it has undergone. A piece of equipment whose construction file is incomplete is not in the same situation as a documented one, even if the two are identical.

What relates to the process. Stability of the parameters, risk of excursion outside the normal envelope, transient shutdown and start-up conditions, knowledge of the fluids and their impurities. DT 32 stresses the occasional presence, in the product, of elements liable to cause degradation. This is often where the gap between the calculated rate and the real rate is decided.

What relates to the consequences. Quantity and state of the released fluid, energy available for release, flammability, toxicity, unavailability of the installation, knock-on effects on neighbouring equipment and on the people present. The data from the hazard study is directly usable.

What relates to the inspection itself. This is the most counter-intuitive factor. The quality of your past checks feeds into the calculation of your next due date. Methods relevant to the expected mechanisms, representative condition monitoring locations, reproducible referencing from one campaign to the next, the ability to quantify damage and not merely detect it. An inspection that cannot say by how much the equipment has degraded does not allow you to extend anything. The subject is covered in the placement of thickness condition monitoring locations.

What relates to accessibility. Beware the reverse reasoning. Difficult access never lengthens an interval: it changes the method, under strict conditions. The codes allow an internal inspection to be replaced by external checks, but by listing cumulative conditions, not by granting a deferral.

Insulation, finally, neither shortens nor lengthens: it determines what you see. Without removal, an external inspection proves nothing about the wall. DT 84 organises a progressive deepening: partial removal of insulation is authorised up to the third requalification, total removal at the fourth, then at every second requalification thereafter. And API 570 sets numerical extents for corrosion under insulation: on class 1 piping, seventy-five per cent of the zones with damaged insulation must be checked, fifty per cent in class 2, twenty-five in class 3.

The risk no thickness measurement will ever see

Everything above measures a wall growing thinner. A whole family of risks escapes that reasoning, and it is the one that costs the most when it materialises.

The reference case

In 1987, a paper in The Lancet documented an outbreak of salmonellosis linked to an infant milk powder. The source was traced to the drying tower at the plant, which had a hole in its internal lining. Powder escaped through the defect, came into contact with the contaminated insulating material, and returned into the flow.

One figure from that investigation deserves to be kept in mind by anyone who relies on release testing: despite intensive searching, the strain was isolated in only four sealed packets out of two hundred and sixty-seven. Sporadic contamination does not show up in a sampling plan. It is prevented at the source, through the integrity of the equipment.

Mechanically, that hole was nothing. No structural calculation would have flagged it. In hygiene terms, it closed a plant.

What the hygiene texts say, and what they do not

The result is counter-intuitive: no audit standard sets a frequency.

BRCGS, in clause 4.7.2, requires that where there is a risk of product contamination by foreign bodies arising from equipment degradation, the equipment be inspected at predetermined intervals, the results documented and the actions taken. The interval is not given. IFS Food requires a documented maintenance plan covering all critical equipment, and requires that failures of equipment essential to food safety be identified, documented and reviewed in order to improve the plan. No frequency either. FSSC 22000 addresses hygienic design at procurement and imposes a change-management process, without any requirement for periodic integrity checking.

A search through the texts of these three standards confirms it: the word "dryer" does not appear.

The Codex, by contrast, names things. Its code of practice for powdered infant formulae asks that equipment be designed, constructed and maintained so as to avoid cracks, crevices, rough welds, hollow tubes, tight fittings, metal-to-plastic interfaces and poorly fitted or poorly maintained insulation. Its code for low-moisture foods goes further still: preventive maintenance must be in place to identify and correct microcracks in temperature-controlled jacketed equipment, and the water in those jackets must be potable, precisely because a microcrack would let it enter the product.

Two authorities, two opposing strategies

On plate heat exchangers, the comparison is instructive.

The Canadian food inspection authority asks that the integrity of all heat exchange surfaces be verified at least once a year, for each of the three sections of a pasteuriser, for example by dye recirculation or pressure holding. It also asks for a programme monitoring the condition of the plates, taking into account running hours, wear and history, and requires that if a pinhole is found on one plate, all the plates in the same section be checked.

The American pasteurised milk ordinance prescribes nothing of the sort. It requires that raw milk be permanently at a pressure lower than the pasteurised milk in the regenerator, and has the pressure switches verified at least every three months. The public-health reasoning is written into the text: this pressure barrier protects should defects appear in the metal or in the gaskets.

Canada checks the integrity. The United States accepts that the defect may exist and checks the barrier. Both logics are defensible, and a plan that keeps only one of them should at least know which.

When an interval stops being the right answer

One last example, on culinary steam. The 3-A practice describing its production imposes no calendar check on the filter. It imposes a means of measuring the differential pressure across the filter medium, which signals when replacement is needed.

The interval is replaced there by a measured condition. BRCGS in fact accepts condition monitoring as an alternative to planned maintenance. A tool that calculates intervals must know how to say when the interval is not the right answer.

The product being made changes how critical the defect is

Precision matters here, because the intuition is correct but the source does not say what it is often made to say.

The clearest text comes from the European standard for the manufacture of sterile medicines. Its 2022 revision states that the classification and criticality of defects must be determined during qualification, on a risk basis, and that the factors to consider include the potential impact of the defect on the patient and the route of administration. The international quality risk management guide sets out two principles of its own: the evaluation ultimately links back to protection of the patient, and the level of effort and formality should be proportionate to the level of risk.

These texts speak of the defect in relation to the product, not of the equipment interval. The move from one to the other is a deduction, defensible and documentable, but a deduction. No text consulted says "equipment in contact with infant nutrition equals inspection every X months".

What the pharmaceutical qualification standard does say, and which is directly usable, is this: equipment and utilities must be assessed at an appropriate frequency, and where periodic requalification is performed, the period must be justified. This is the foundation for moving from an inherited calendar to an argued interval. It gives no figure. It demands a justification.

One text goes further still, and it is the medical devices one: the sector's quality management standard requires the maintenance requirements to be documented including their frequency where they may affect product quality, and the records to be retained. The interval itself becomes a documentary deliverable.

What regulation does not fix, and what you must fill in

The list is longer than people think, and it is here that the value of the work is decided.

The real interval, as long as it stays below the ceiling. The whole interval question for pressure piping. The nature, extent and location of the checks. Whether or not to use a formalised risk analysis, which remains a voluntary step. The choice between short-term and long-term corrosion rate, which the codes ask you to compare and then justify, without imposing a rule. The decision thresholds, that is, from what margin, what finding or what exceedance you tighten up. And the whole population of equipment outside the pressure regulation: drying towers, exchangers below the thresholds, atmospheric vessels, cleaning circuits.

One point deserves to be known: the industry guides explicitly foresee that their provisions may be applied to equipment outside the regulatory field. This is the most direct bridge between the inspection method for pressure equipment and the process equipment critical to food safety, which has no method of its own.

• Taking the regulatory ceiling for the right interval.The order writes "as often as necessary" and requires shortening where the condition warrants it. The ceiling is a limit, not a target.
• Applying the thickness formula to a localised mechanism.The piping inspection code writes it in black and white: statistical treatment of point measurements is not applicable to systems affected by unpredictable localised corrosion. This is the sharpest limit of the whole calculation.
• Retaining a single interval for a whole piece of equipment.The guides calculate by section and keep the minimum. A tank bottom and its roof do not have the same due date.
• Counting the remaining useful life from today.It is counted from the date of the last reading. The error is frequent and always in the dangerous direction.
• Spacing out because you lack data.The codes do the opposite: with no known rate, the ceilings fall to five and ten years.
• Confusing interval with extent.An inspection on the right date in the wrong place detects nothing. The sensitive zones listed by the guides are worth at least as much as the date.
• Waiting out the interval after works.Works, modification, repair and change of service reset the analysis. The Codex even asks for monitoring frequency to be increased during and after works.