5. ESTABLISHMENT AND ADMINISTRATION OF FOREIGN MATERIAL
5.5. Establishing and describing administrative controls
5.5.5. Inspection requirements and controls
104
5.5.4.2. Permanent foreign material control devices
As discussed in Section 3.2, in anticipation and considerations at design phase, engineered FMC devices/components/equipment are incorporated into the facility design for FM prevention and protection of SSCs. These FMC devices are designed and permanently installed to prevent ingress and transportation of FM. These devices are mainly in forms of filtration, ventilation, flashing and purification systems (e.g. filters, strainers, fuel guards/grids, drains) but also include structuring of particular parts of the system elements, such as debris traps, vent orientations, carefully sized tolerances and shapes in the openings and transportation paths.
It is needed to clearly identify the analysis and design of features that address specific design aspects of permanent FMCs in the original plant design documents. The plant owner and operator later can use this information to establish and incorporate into their comprehensive FMMP during operation. Therefore, design methodologies and tools, as well as the design and operation requirements and functions of permanent FMC devices, need to be clearly defined in the design documents and incorporated in the operational procedures, as applicable. It may also be a good practice to provide a list of particular design features that serve as the permanent FMC control device in the FMMP documents.
However, existence of such design features ought not to lead to complacency or justification for the use (or not use) of temporary FMC devices since the design basis input and assumptions address only specific functions and conditions applicability for designed and permanently installed FMCs.
Methods of inspections range from visual to use of simple or hi-tech devices, such as mirrors, borescopes, video cameras, metal detectors, X ray, radiography, fibreoptic technologies, as applicable. Inspections can also include verification and validation of processes, such as controls and procedures, specifications, vendor certification for cleanliness, housekeeping by observing worker behaviours and document reviews.
Regardless of the inspection type, method, performance stage or place, there are two typical roles and responsibilities:
— Activity performers: In any FMMP, it needs to be required to have the activity performers to conduct the one-layer inspection, i.e. self-inspection/verification of SSC, tool and work cleanliness, in every activity as a minimum. The activity performer makes certain that the work area, SSC and equipment and tools are clean from a FMM perspective and ensures that the possibility for FMI threat, hazard or incident is minimised or eliminated before, during and after the activity.
For one-layer inspections, the FMMP governing procedure needs to identify and define key aspects of conducting such inspection as to their scope, extent and recording requirements in accordance with the corporate policy and level of FMM culture, as applicable (particularly the level of awareness, ownership, cleaning and housekeeping traits). These aspects, then, could be described and the instructions could be structured in the implementing procedures for the specific activities;
— Independent inspectors: While a one-layer inspection is required in every activity as a minimum, independent inspectors would witness the conditions of work area, SSC and equipment and tools with trained eyes and attest to that the possibility for FMI threat, hazard or incident is minimised or eliminated. This, in turn, provide assurance in a qualified and/or certified manner by an independent second party verification. As such, the FMMP governing procedure needs to identify the specific activities where additional second party inspections are required and define the associated requirements. As a good practice, FM inspections performed by independent second party inspectors could be considered in all cases.
The independent second party inspections, whether onsite or offsite, are to be performed and documented by trained and qualified personnel and the requirements for training and qualification of inspectors needs to be defined for specific activities. It is necessary that the inspectors are familiar and knowledgeable with the activity and the SSCs which are being work on, as well as their surroundings in order not to adversely interfere with activity and to take appropriate precautions to prevent and protect FMs from entering systems, equipment, parts, material or components during inspections.
It also needs to be emphasised that the one-layer inspections ensure the cleanliness (and other requirements of FMM) of the SSCs, equipment and areas. As such, self-inspections make certain that SSCs are free of FM or the risk of FMI incident is minimised or eliminated. The independent second party inspections, on the other hand, are there to verify and validate that FMM requirements and expectations are ensured.
It is essential that the inspectors (both self and independent ones) are familiar and knowledgeable with the SSCs to recognise, identify and interpret FM in and around them. This importance was apparent in aforementioned event of imploding demineralised water storage tank as a result of FMC device being left on the vent line:
“It was also noted in the collapsed and ruptured tank incident that, although the personnel were FMM trained and qualified they were not familiar with
106
the design of the tank or did not have any design drawings. Owing to this missing knowledge and information, they did not recognise that the FMC device (butterfly FME cover), which was blocking the vent valve, was not a part of the tank per design, and in fact it had become a foreign material for the SSC”.
Common to all inspection requirements, any unknown and foreign material or any non-conforming/non-satisfactory condition discovered during the independent second party as-left inspections will be documented, logged, reported and removed before proceeding with the activity. Additionally, it may be a good practice to keep a record of any unusual findings during the cleaning (and one-layer inspections by the activity performers) to be further discussed in the post job briefing and to be used in future activity planning and performance. Regardless of the inspection/inspector, if there is discovery of a non-compliance with the requirements during the inspections, the finding has to be reported in accordance with the applicable condition reporting processes and entered into the CAP.
From OPEX, some lessons learned and good practices to be considered in establishing inspection requirements and expectation include:
— Maintaining FM diaries is essential in the execution of FM free activity requirements, including keeping a good record of inspection performance and findings;
— Recording and documenting the inspection results with photos or videos (particularly in case of bad inspection findings, e.g. not meeting the cleanliness requirements, which would require preserved evidence in photos and videos) for evaluation of causes as such visual material is useful for training purposes to demonstrate what good and bad look like, as well as for analysing and learning to improve the deficient or failed parts of the FMMP;
— In some activities, there may be cases and periods where some components or systems could be inaccessible for independent inspection. In such occasions, strict monitoring of uninspected work could be necessary, as well as continuous tracking of activity steps and documentation, in order to ensure that the uninspected work is performed in accordance with the FMM requirements and conditions to identify the first available time when they become accessible for inspection.
The following Sections discuss particular characteristics of various inspections governed by the FMMP. It should be noted that this is not a complete and explicit list of all types of FMM inspections performed. For example, the security inspection is not listed as a separate inspection type but discussed in Section 5.5.5.6 as coupled with the receipt inspections. Also, in some organisations, as-left and final inspections (Sections 5.5.5.4 and 5.5.5.5) are defined as one inspection, typically named as closeout inspection.
5.5.5.1. Initial inspection
In order to prevent FM from existing and entering the system while it is being opened, it is necessary to perform a thorough inspection and verification of cleanliness and conditions of the work area before the work starts and system/equipment is ready to be opened for the activity.
This initial inspection also involves verification of requirements and controls to ensure that the system is ready from FMM perspective, i.e. FMM and cleanliness requirements are met. The initial inspection also verifies that the work area is free of dirt, dust, debris, oil, lose or flaking rust and residue from grinding, chipping, welding, blasting, or other prior or ongoing activities.
The initial inspection is a stage for verifying that all items, that are being introduced in/on (or nearby) the SSC breach point, are identified and recorded to be later accounted for and removed prior to system closure. As such, it also confirms that the only required tools, materials and objects that belong to the activity (and that they are in good condition from the FM aspects, i.e.
generating or becoming FM), are brought near the SSC opening. Accordingly, all items that are to be used in the activity (including in-place FMM measures, such as FMC devices, FMCA barriers and signs, etc.), as well as any substance that may potentially become FM, are logged as the baseline material log (see Section 5.5.3) for later reconciliation which will be the method to ensure and/or verify meeting the system closure requirements.
The initial inspection and confirmation of system opening requirements being met is the end of all general activities or people/equipment movement in the zone before the system is opened, except the ones required for the activity. Also, the findings of initial inspection need to be resolved before the system opening. Therefore, it requires an advance planning of activities in and around the work area to prevent any non-activity related people and equipment.
5.5.5.2. ‘As found’ inspection
Immediately after dismantling a component or opening a system, a FM as-found inspection needs to be conducted on and in the SSC or equipment that is opened, to ensure that the component or system is clean and free of FM. As-found inspections also identify unexpected/abnormal system conditions, such as excessive amounts of silt, corrosion, broken internals or unknown material which does not belong to the system, component and equipment, i.e. pre-existing foreign material in there.
‘As found’ inspections apply to new or refurbished parts or components prior to installation in the system, as well. As aforementioned, although FMC devices are typically factory (or warehouse) installed to keep internals clean during transportation or storage, new or refurbished parts may still come with debris or other FMs inside. Thorough inspections at the work site to confirm internal cleanliness, as well as the removal of shipping and storage FMCs of new parts/components to be used can prevent future equipment failures (such as, aforementioned, ‘shipping plugs’ and ‘butterfly FME cover’ events).
In addition to documenting, logging and reporting the unexpected/abnormal system as-found conditions in accordance with the applicable condition reporting processes and entering them into the CAP, the engineering/technical support organisation also need to be notified when system, equipment of material degradation indications (for example, unexpected silt, corrosion, broken internals or unknown material) are discovered. Unknown and foreign material after recording it in photos and/or videos is to be analysed and assessed and will eventually need to be removed to proceed with the activity. However, it may be necessary to preserve them for subsequent engineering evaluation to determine cause or origination of the FM and to identify the impact from/to design and operation of SSC for corrective action and improvement.
5.5.5.3. Checkpoint inspections
During the course of activity, there may be some planned or unplanned stages, check or hold points or change in status of work at hand and nearby activities where the activity, work area, system, component and equipment inspection need to be performed to confirm to proceed with the next tasks of the activity. These checkpoint inspections are typically marked and performed when, for example:
108
— FMRLs are changed and FMCA can be transitioning to different category (see Section 5.5.9.2);
— Unexpected conditions are encountered;
— Work stopped for some time to accommodate other plant evolution;
— SSC configuration is changed;
— Next level of work in the internals of opened system or component is starting;
— A new equipment with the necessity of packing or assembly brought into the work area;
— Occurrences which may affect or compromise the original FMM plan (see Section 5.5.9) happened.
Requirements for checkpoint inspections throughout the activity depending on the area, system and component status and they may also include specifically required/requested inspections.
For example, technical support (engineering) organisation may determine some hold and checkpoints for special system inspections.
In addition to the generic requirements, special requirements for checkpoint inspections as to their timing, extent, performers and performance methods need to be defined in the FMMP governing document. The activity plan further needs to specify special inspections and their milestones, entry conditions with the associated key verifications, while the work plans and order need to place check or hold points in the activity instructions to stop work and perform inspections in accordance with the specific needs and the general requirements set in the governing FMMP procedure.
5.5.5.4. ‘As left’ inspections
Upon the completion of work on an opened component or a system, a thorough cleaning of the SSC/equipment and its immediate surrounding is performed in order to prevent any FM from remaining and migrating through the plant SSCs. This includes the removal of tools and materials, internal and external barriers and other FMC devices used in the activity, as well as any substance that is (or eventually may become) a FM, such as dirt, dust, debris, oil, lose or flaking rust and residue from grinding, chipping, welding, blasting or other maintenance activities.
Subsequently, a FM as-left inspection is conducted on and in the SSC and equipment to verify that the internals and immediate surrounding is being left clean and free of FM and the open component or system is ready to be closed.
As-left inspection is the final barrier for detecting FM intrusion. During the final inspection it is checked and verified that all foreign substance that were introduced to the SSC/equipment and its immediate surrounding have been removed.
The importance of as-left inspections (self or independent second party) could be seen in the example of FMI event provided in Section 1.1.2 as one of the industry’s most significant FMI events when:
“A unit was taken off-line due to several SG tube leaks which determined to be caused by an accelerated stress corrosion cracking as a result of a high content of lead. Visual inspections (after the event/during investigation) found debris in the form of metal grommets from two lead blankets used during an earlier activity which could have been discovered during the as-left inspection of the SSC”.
On the other hand, there are ‘success’ examples of proper as-left inspections, such as the following one that was reported by one plant:
“Following a maintenance outage, a final cleanliness video inspection of the steam generator cold header found a 4x8 mm stainless steel bolt; 15x2 mm piece of plastic clamp; two 10x10 mm pieces of black coloured reinforced hose. This final inspection prevented what could have been significant damage to primary components had the unit started with these items left in the system”.
It should be added that the as-left inspections also need to confirm that any material to be left in the plant SSC(s) is thoroughly evaluated and concluded to be so, as discussed in Section 7.
5.5.5.5. Final inspections
In order to prevent FM from existing and entering the system while it is being closed and to ensure that SSC or equipment is closed and returned to service in a clean and FM-free condition, it is necessary to remove all equipment and tools (except the ones needed to close the system) including in place FMM measures, such as temporary FMC devices and internal/external barriers. Also, any potential FM substance in the area needs to be removed/cleaned in order to ensure that the work area for closure activities is free of FM. This also includes that all material which were identified and recorded in the baseline material log (see Section 5.5.3), and by any updates to the material log thereafter, are accounted for and conciliated prior to system closure to ensure meeting the system closure requirements.
Subsequently, a following thorough final inspection at and around the open SSC/equipment and the surrounding work area needs to be conducted to verify that all tools and material, that were introduced in/on (or nearby) the SSC breach point and the surrounding area (i.e. FMCA and adjacent areas), have been removed from the FMCA and adjacent areas upon overall work task completion. The final inspection also validates the conciliation of material log during the initial inspection (Section 5.5.5.1).
The final/closeout inspection is the last confirmation that the open system can be closed and returned to service without a possibility of any FM remaining or entering. Therefore, the final inspection, i.e. the verification and validation of system closing requirements being met, has to be the end of all activities other than those needed for the system closure. After the completion of inspection of compliance with the system closure requirements, no people/equipment except the ones required for the system closure activity/steps will be permitted to enter or move in and around the zone. This requires an advance planning that all activities in and around the area are completed between the final inspection and the system/equipment closure.
5.5.5.6. Factory inspections
Generation and ingress of FM in parts, components and equipment can occur at any stage of manufacturing process, e.g. during the production, assembly or storage by the manufacturer.
Factory inspections are also conducted for the verification of foreign material free parts, components and equipment before packing and shipment by the factory. These inspections, accordingly, are performed at the manufacturer’s site or factory by the trained and qualified staff, typically, of the manufacturer under their management system. Therefore, it is important for the project/plant owner/operating organisation to establish an interface and mechanisms to control FMM aspects (or to ensure their control) with manufacturers/vendors, including the factory inspections, utilising:
110
— Procurement contracts that define and set (with supplier’s agreement) the process obligations, requirements, specifications and expectation for the supplier (and their subcontractors) to articulate the FMM requirements, specifications and expectation, including those for factory inspections;
— Vendor/manufacturer qualification to ensure that the suppliers have a management system (i.e. QAP) that includes acceptable verification, confirmation and validation processes for manufacturing, including FMC aspects;
— Project/plant personnel of the owner/operating organisation to perform, to participate in performance or to observe the factory inspections during manufacturing, packing and shipment of component or equipment that are critical to safety or economics, such as fuel assemblies, steam generators, primary system components, e.g. safety valves, pumps, piping;
— Vendor certification of ‘foreign material free product’ and/or the factory inspection report provided by the manufacturer to verify compliance with FMM in the factory. Here, it is important that:
The supplier’s factory inspection report needs to include a list (with types, recognition signs, such as colours, tags, writings, and locations) of internally and externally installed FMC devices to ensure removal before the installation and operation of material, parts, components and equipment;
The report also needs to describe existing tamper-proof and tamper-evident packaging material on the item such that they can be verified in receiving inspection as to remaining intact during shipping and transportation in controlling intentional and unintentional FM contamination.
Regardless of the methods and tools for FMC by/with manufacturer, an effective FMMP of the owner/operating organisation still requires a systematic approach to offsite inspection/verification process. Therefore, the FM factory inspection criteria, conditions, requirements, methods, mechanisms and responsibilities needs to be defined and described in the FMMP administrative procedure or, as a typical practice in the industry, they are referenced to other processes and procedures, such as QAP’s procurement process. However, in the latter case, FMMP administrators need to ensure that the factory inspection requirements, methods, tools, criteria and instructions are acceptable and incorporated or reflected in those processes and procedures. Additionally, in such cases, the criteria and requirements for designation and interface with such process and procedures need to be defined in the FMMP governing procedure.
5.5.5.7. Receipt inspection
Receipt inspection are performed at the plant/project site to verify that there has not been any FM generation and ingress (or possibility and potential FM generation and ingress) in the systems, components, parts, materials and equipment during shipping.
Typically, the FM prevention, protection and control requirements and specifications for packing and shipping by the manufacturer/vendor are developed and included in the contracts for the procurement of materials, equipment and components. However, FM hazards and unintentional/unexpected FM ingress and generation may occur owing to, for example: