Introduction
Mechanical integrity is one of the most important barriers between normal refinery operation and a major accident.
In simple terms, mechanical integrity is the assurance that pressure equipment, piping, tanks, heaters, valves, flanges, small-bore connections and associated components are suitable for their intended service and remain fit for continued operation.
It is not just about inspection.
It is not just about maintenance.
And it is certainly not just about reacting when something has already failed.
Mechanical integrity is a complete lifecycle discipline. It starts with design, material selection, fabrication, installation and commissioning. It continues through operation, inspection, monitoring, repair, alteration, revalidation and eventual replacement.
When recent publicly reported refinery and refinery-adjacent incidents are reviewed from this perspective, a clear pattern emerges.
Many serious events are not caused by complex or unusual damage mechanisms alone. They often begin at ordinary mechanical integrity weak points:
- valves;
- flanges;
- pressure gauges;
- small-bore connections;
- instrument tappings;
- fired heater tubes;
- tank shells and roofs;
- reactor pressure boundaries;
- temporary blinds and isolation points;
- pressure-boundary components opened during work.
These components may appear routine, but they are often where the mechanical integrity system is truly tested.
The observations in this article are based on a public-source review of reported refinery and refinery-adjacent incidents over the last three years.
This is not presented as a complete global accident database. Public information varies significantly by country, operator and regulator. Some incidents are investigated in considerable detail, while others are only reported through company statements, regulator notices or media sources.
However, even with those limitations, the recurring mechanical integrity themes are clear and highly relevant to refinery operators, inspection engineers, pressure equipment specialists, process safety teams and plant leadership.
The recurring mechanical integrity pattern
The strongest recurring theme is this:
Major refinery incidents often occur where pressure containment, degradation, mechanical design, inspection coverage and operational reality do not fully align.
That may sound simple, but it is a critical point.
A refinery can have inspection plans, thickness monitoring locations, corrosion circuits, relief devices, equipment registers and risk-based inspection programmes. However, if the plant’s actual condition, the process conditions, and the installed components are not properly understood, confidence in mechanical integrity can be misleading.
The problem is not always that no inspection was carried out.
The problem may be that the inspection programme was not looking for the right damage mechanism, did not cover the vulnerable location, did not account for changed operating conditions, or did not recognise that a small component had become a major loss-of-containment risk.
Mechanical integrity is more than corrosion management
When mechanical integrity is discussed, the conversation often moves quickly to corrosion.
Corrosion is extremely important. It remains one of the most significant threats to refinery equipment, especially where ageing assets, changing feedstocks, sour service, high temperatures, water contamination, insulation systems and process contaminants are involved.
However, recent incidents show that mechanical integrity failures are broader than corrosion alone.
A robust mechanical integrity programme must also consider:
- thermal damage;
- creep;
- fatigue;
- vibration;
- corrosion fatigue;
- short-term overheating;
- brittle fracture;
- gasket and bolting integrity;
- valve soft-goods compatibility;
- small-bore piping vulnerability;
- instrument connection integrity;
- pressure-boundary opening risks;
- fired heater tube performance;
- tank integrity;
- reactor and vessel cracking mechanisms;
- incorrect materials or components in service;
- post-modification mechanical assurance.
This is why a mechanical integrity programme must be built around credible damage mechanisms and credible failure modes, not just generic inspection intervals.
Ordinary components can become major accident initiators
One of the strongest lessons from recent incidents is that ordinary refinery components can become the initiating point for serious events.
A flange is not just a flange when it contains hot, pressurised hydrocarbon.
A pressure gauge is not minor when it is connected to toxic or flammable inventory.
A small-bore connection is not low risk simply because it is physically small.
A valve is not suitable simply because it fits the line and has the correct pressure class.
A fired heater tube is not safe simply because it passed a previous inspection.
Mechanical integrity requires the organisation to understand the function, condition and risk significance of each component in its actual service.
That means asking:
- What process fluid is present?
- What pressure and temperature can the component experience?
- What degradation mechanisms are credible?
- What mechanical loads are present?
- Is vibration possible?
- Is the connection adequately supported?
- Are the installed materials suitable?
- Are gaskets, packing and soft goods compatible with the service?
- Has the component been modified, replaced or disturbed?
- Is the inspection method capable of finding the expected damage?
- Does the inspection location actually cover the likely point of failure?
These are mechanical integrity questions before they are maintenance questions.
Pressure-boundary interfaces deserve more attention
Many mechanical integrity programmes are strong when dealing with large pressure vessels, mainline piping circuits and major storage tanks. However, some of the highest-risk locations are the smaller and more localised pressure-boundary interfaces.
These include:
- valve bonnets;
- flange joints;
- pressure gauges;
- instrument tappings;
- transmitter connections;
- sample points;
- drains and vents;
- small-bore branch connections;
- temporary blinds;
- spectacle blinds;
- threaded fittings;
- tubing connections.
These areas can be vulnerable because they may be disturbed more frequently, be subject to vibration, have limited thickness monitoring or visual inspection, and receive less engineering attention than major equipment items.
From a mechanical integrity perspective, that is a weakness.
A small-bore connection for hydrogen, H₂S, LPG, naphtha, hot oil, or high-pressure hydrocarbon service can pose a major risk of accident. Its size should not determine its importance. Its service, energy, location, susceptibility to degradation, and consequences of failure should be considered.
Fired heater integrity remains a critical threat area
Fired heaters deserve particular attention within mechanical integrity programmes.
They combine several risk factors:
- high temperature;
- process inventory;
- flame;
- thermal gradients;
- tube metal temperature limits;
- risk of low flow;
- risk of coking or fouling;
- potential for tube thinning;
- creep damage;
- start-up and shutdown transients;
- risk of short-term overheating.
A fired heater tube can fail rapidly if operated outside its intended envelope. In some cases, short-term overheating can be more significant than long-term corrosion.
For mechanical integrity teams, this means heater assurance should not rely only on periodic inspection. It should include a clear understanding of:
- tube design conditions;
- tube material limits;
- tube metal temperature monitoring;
- process flow distribution;
- pass balancing;
- credible low-flow scenarios;
- coking and fouling tendency;
- burner performance;
- tube support condition;
- creep susceptibility;
- inspection effectiveness;
- safe operating limits.
A fired heater is not just an item for inspection during turnaround. It is a dynamic mechanical integrity risk that depends on both physical condition and operation within defined limits.
Material compatibility is a mechanical integrity issue
Another important theme is material compatibility.
Mechanical integrity can be compromised when an installed component is physically correct in size and rating, but unsuitable for the actual service.
This is especially important for:
- valve packing;
- gaskets;
- soft seats;
- PTFE components;
- elastomers;
- bolting;
- trim materials;
- tubing materials;
- small-bore fittings;
- replacement valves;
- temporary components.
A valve may have the correct flange rating, bore size and tag number but still be unsuitable if its internal components are not rated for the process temperature or chemical environment.
Likewise, a gasket may fit the flange but be unsuitable for the fluid, pressure, temperature, thermal cycling or fire-risk scenario.
This is why mechanical integrity needs strong materials assurance.
The key question is not simply:
“Does it fit?”
The better question is:
“Is every pressure-retaining and pressure-containing component suitable for the real service conditions it will experience?”
That includes the parts that are not always obvious from the outside.
Damage mechanism reviews must reflect real plant conditions
A mechanical integrity programme is only as good as its understanding of credible damage mechanisms.
Generic corrosion circuits are not enough.
Damage mechanism reviews should reflect actual refinery conditions, including:
- feedstock changes;
- sulphur content;
- chloride exposure;
- water content;
- amine contamination;
- hydrogen partial pressure;
- temperature cycling;
- start-up and shutdown history;
- vibration;
- process upsets;
- local hot spots;
- deadlegs;
- stagnant areas;
- injection points;
- mix points;
- insulation condition;
- support condition;
- previous repairs and alterations;
- known industry failure experience.
If the wrong damage mechanisms are identified, the inspection plan may give false confidence.
For example, a component may be inspected for general wall thinning while the real threat is cracking. Another may be monitored for corrosion, while the dominant threats are fatigue, creep, overheating, gasket failure, or vibration-induced failure.
Mechanical integrity depends on aligning the inspection strategy with the actual failure modes.
Inspection effectiveness matters as much as inspection frequency
A common mistake is to assume that more inspection automatically means better mechanical integrity.
It does not.
Inspection only adds value if it is capable of detecting the relevant damage at the relevant location before failure.
That requires good decisions on:
- inspection method;
- inspection coverage;
- inspection frequency;
- access requirements;
- surface condition;
- insulation removal;
- NDT technique selection;
- technician competence;
- acceptance criteria;
- data quality;
- trend analysis;
- anomaly assessment;
- fitness-for-service evaluation.
A thickness reading taken at the wrong location may not manage the risk.
A visual inspection that cannot access the vulnerable area may not manage the risk.
A corrosion circuit that does not include the actual damage mechanism may not manage the risk.
A pressure test may prove short-term leak tightness but may not identify certain forms of cracking, creep damage, local thinning or material degradation.
Mechanical integrity is not demonstrated by having inspection records alone. It is demonstrated by having inspection records that are technically relevant to the credible failure modes.
Mechanical integrity and fitness for service
When damage or deterioration is found, the next question is whether the equipment remains fit for continued operation.
This is where fitness-for-service assessment becomes an important part of the mechanical integrity system.
Not every flaw requires immediate replacement. But every significant flaw requires proper engineering evaluation.
That evaluation may need to consider:
- remaining wall thickness;
- corrosion rate;
- local metal loss;
- crack-like flaws;
- pitting;
- laminations;
- creep damage;
- bulging;
- distortion;
- denting;
- fire damage;
- brittle fracture risk;
- operating pressure;
- operating temperature;
- cyclic loading;
- future corrosion allowance;
- inspection uncertainty;
- consequence of failure.
Fitness-for-service should not be used to justify continued operation without proper controls. It should be used to make technically defensible decisions about continued use, repair, replacement, monitoring or derating.
Where equipment remains in service with known degradation, the mechanical integrity programme should clearly define the operating limits, inspection intervals, monitoring requirements and retirement criteria.
Mechanical integrity operating windows
Mechanical integrity is closely linked to operating limits.
Equipment may be mechanically suitable within one operating envelope but vulnerable outside it.
This is why integrity operating windows are important.
They help define the process conditions that protect the equipment from known damage mechanisms. These may include limits for:
- temperature;
- pressure;
- pH;
- chloride concentration;
- sulphur content;
- water content;
- velocity;
- hydrogen partial pressure;
- flow rate;
- tube metal temperature;
- oxygen ingress;
- contaminant concentration;
- start-up and shutdown conditions.
If you operate equipment outside its integrity window, it may degrade more quickly, or a failure mode may become credible.
For example, fired heater tubes may be vulnerable to short-term overheating under low-flow conditions. Piping may be vulnerable to erosion-corrosion if velocity increases. Stainless steels may become vulnerable to chloride stress corrosion cracking under certain conditions. Carbon steel may corrode rapidly if water and acidic contaminants are present.
Mechanical integrity is therefore not separate from operation. The equipment must be operated within the conditions assumed by the integrity assessment.
Ageing assets require active mechanical integrity governance
Many refineries are operating equipment that has been in service for decades. Ageing equipment can remain safe and reliable, but only if ageing is actively managed.
Ageing asset management should include:
- up-to-date equipment registers;
- accurate design and material records;
- corrosion circuit reviews;
- deadleg identification;
- CUI risk assessment;
- relief system verification;
- inspection history review;
- repair and alteration history;
- obsolescence review;
- temporary repair tracking;
- fitness-for-service assessments;
- remaining life assessments;
- replacement planning;
- critical equipment ranking.
The key risk with ageing assets is not age alone.
The key risk is uncertainty.
Uncertainty about materials.
Uncertainty about damage mechanisms.
Uncertainty about inspection coverage.
Uncertainty about previous modifications.
Uncertainty about actual operating conditions.
Uncertainty about remaining life.
A mature mechanical integrity programme should progressively reduce that uncertainty.
The central lesson
The central lesson from recent refinery incidents is that mechanical integrity must be treated as a live risk-control system, not a static inspection schedule.
The question is not simply:
“Has this equipment been inspected?”
The better questions are:
- Do we understand how this equipment can fail?
- Are we inspecting for the right damage mechanisms?
- Are vulnerable interfaces included?
- Are small-bore connections treated with appropriate risk significance?
- Are fired heater tubes protected against credible overheating scenarios?
- Are installed materials and soft goods suitable for actual service?
- Are operating limits aligned with mechanical integrity assumptions?
- Are known defects evaluated and controlled?
- Do we understand the remaining life of ageing equipment?
- Can we prove the equipment remains fit for service?
These questions move the discussion from compliance to real mechanical integrity assurance.
Practical actions for refinery mechanical integrity teams
Recent incidents suggest several practical priorities.
1. Reassess pressure-boundary interfaces
Review valves, flanges, instrument tappings, small-bore connections, drains, vents, pressure gauges and temporary isolation points in high-consequence services.
Do not allow these items to be treated as minor accessories if they are connected to hazardous inventory.
2. Strengthen small-bore piping assurance
Identify small-bore connections in vibration-prone, high-pressure, high-temperature, toxic or flammable service.
Review support, geometry, threaded fittings, inspection coverage, historical leaks and susceptibility to fatigue.
3. Improve fired heater mechanical integrity reviews
Review fired heater tube damage mechanisms, tube metal temperature limits, low-flow vulnerability, creep susceptibility, coking tendency, pass balancing and start-up conditions.
Ensure inspection plans reflect both long-term degradation and short-term overheating risk.
4. Verify material compatibility
Confirm that valves, gaskets, packing, trim, bolting, tubing and soft goods are suitable for actual process conditions.
Pay particular attention to replacement components, temporary installations and items procured outside normal channels.
5. Refresh damage mechanism reviews
Damage mechanism reviews should be updated when feedstocks, process conditions, operating modes, temperatures, supports, repairs or equipment histories change.
The inspection plan should follow the damage mechanism review, not the other way around.
6. Review inspection effectiveness
Challenge whether current inspection methods can actually detect the expected damage at the expected location.
Inspection frequency is important, but inspection effectiveness is more important.
7. Connect fitness-for-service to operating limits
Where equipment operates with known degradation, define clear limits for continued operation.
The assessment should specify inspection intervals, monitoring requirements, acceptable conditions and actions required if conditions change.
8. Reduce uncertainty in ageing assets
Prioritise equipment where design data, material records, inspection history or modification history are incomplete.
Mechanical integrity improves when uncertainty is reduced.
Conclusion
Recent refinery incidents reinforce a simple but important message:
Mechanical integrity failures often occur at the point where pressure containment, degradation, materials, inspection coverage and operating conditions do not align.
The initiating component may be ordinary: a flange, a valve, a pressure gauge, a small-bore connection, a fired heater tube or a tank section.
But the underlying issue is rarely ordinary.
It is usually a weakness in the mechanical integrity system’s ability to understand and control the real condition of the asset.
For refineries, the challenge is not only to inspect equipment. It is to ensure that equipment remains mechanically suitable for its actual service throughout its life.