Fitness-for-Service Assessments: When API 579 Analysis Is Required

When a Flaw Doesn't Automatically Mean Repair or Replace

A turnaround UT crew finds a thin spot on a crude unit heat exchanger shell. The reading is below the corrosion allowance the original design assumed, but the shell isn't down to minimum required thickness yet. Someone on the inspection and reliability team now has to make a call: run it as-is, derate it, repair it, or pull the bundle and replace it. That decision does not belong in ASME Section VIII Division 1 or ASME B31.3. Those are construction codes. They tell a fabricator how to design and build a new pressure vessel or piping system with an adequate safety margin against failure on day one. Neither one tells an owner-operator what to do with equipment that is already in service, already has years of thermal cycling and corrosion behind it, and now has an identified flaw in the wall. That is the gap API 579-1/ASME FFS-1, Fitness-For-Service, exists to close.

Too many facilities still treat every UT finding, every gouge from a dropped tool, every pitting cluster on a tank floor as an automatic repair-or-replace decision. Sometimes that is the right call. But API 579-1/ASME FFS-1 gives inspection and reliability engineers a formal, code-recognized methodology to determine whether a component with a known flaw can keep running safely, run with a restriction such as a reduced Maximum Allowable Working Pressure (MAWP), be scheduled for repair at the next planned outage, or needs to come out of service now. Knowing which flaws clear a simple screening calculation and which ones need a full engineering study is one of the more consequential judgment calls an inspection program makes, and it is one that shows up constantly in refining, petrochemical, and pipeline operations across the Gulf Coast and beyond.

What API 579-1/ASME FFS-1 Actually Is

API 579-1/ASME FFS-1 is a jointly published API and ASME standard, and it is deliberately written as a companion document to the construction codes rather than a replacement for them. Where ASME Section VIII, ASME B31.3, ASME B31.1, and API 650/653 govern how equipment is designed, fabricated, and inspected when new, API 579 governs what happens after damage is found in equipment that has already been placed in service. It gives an engineer a structured, defensible way to answer one question: given this specific flaw, in this specific component, under these specific operating conditions, is the equipment fit for continued service?

Four Possible Outcomes, Not Two

The value of a formal FFS assessment is that it replaces a binary repair-or-replace mindset with four real options. Equipment can be found fit for continued service at current operating conditions with no changes. It can be found fit for continued service only at a restricted condition, most commonly a reduced MAWP, reduced temperature, or a shortened remaining-life window with a defined re-inspection date. It can be scheduled for repair, often at the next planned turnaround rather than an emergency shutdown. Or it can be found unfit for continued service and retired. That third option — run it safely at a restricted condition until the next planned outage — is often the practical, economically sound outcome of a Level 1 or Level 2 assessment, and it is the option that never gets talked about when people assume every flaw automatically forces a shutdown.

The Three Levels of FFS Assessment

API 579-1/ASME FFS-1 organizes assessments into three levels of increasing rigor, increasing data requirements, and decreasing conservatism. Choosing the right level for the situation is itself part of the engineering judgment involved.

• Level 1 — simplified screening. Level 1 assessments use conservative, closed-form screening criteria that can be applied by an inspector or engineer with basic field data: nominal thickness, measured thickness, corrosion allowance, and design pressure. They are intentionally conservative so that a flaw passing Level 1 can be accepted with confidence and minimal engineering time. A flaw that fails Level 1 is not automatically unfit for service — it simply means the screening margin wasn't enough and the assessment needs to move to Level 2.
• Level 2 — detailed engineering calculation. Level 2 assessments require more precise flaw characterization and stress data than Level 1, and they are typically performed by a qualified engineer rather than an inspector. The calculation methodology is more detailed and the acceptance margins are less conservative than Level 1, which means components that fail a Level 1 screen often still pass at Level 2 once actual measured geometry and stress states are used instead of conservative defaults.
• Level 3 — advanced numerical analysis. Level 3 is reserved for complex geometries, complex loading, or situations where Level 1 and Level 2 methods either don't apply or the component doesn't pass. Level 3 typically involves finite element analysis (FEA) and usually requires specialist engineering support beyond what a plant reliability engineer would run in-house. It is the most rigorous and the most expensive tier, but it is also the tier that can justify continued operation of a component that a simplified screen would have condemned unnecessarily.

In practice, most day-to-day FFS work in a refinery or petrochemical plant lives at Level 1 and Level 2. Level 3 gets reserved for high-consequence equipment, unusual geometries like nozzle-to-shell intersections with crack-like indications, or cases where a Level 2 result comes back marginal and the cost of an unnecessary shutdown justifies the extra engineering spend.

Matching the Flaw to the Right Part of API 579

API 579-1/ASME FFS-1 is organized by damage mechanism, and each Part of the standard addresses a distinct category of flaw with its own assessment procedure. Knowing which Part applies is the first step in scoping any FFS study.

• Part 4 — General Metal Loss. Covers broad, relatively uniform wall loss across a large area, the classic case being generalized corrosion on a vessel shell or piping run where thickness has dropped fairly evenly over a wide region.
• Part 5 — Local Metal Loss. Covers isolated thin areas, such as a localized thin spot produced by a cluster of corrosion pits that have coalesced into a single depressed region, distinct from the broad uniform loss addressed in Part 4.
• Part 6 — Pitting Corrosion. Covers discrete, scattered pits rather than a single coalesced thin area — common on tank bottoms, piping low points, and anywhere localized under-deposit or microbiologically influenced corrosion occurs.
• Part 7 — Hydrogen Blisters and HIC/SOHIC Damage. Covers hydrogen-induced cracking and stress-oriented hydrogen-induced cracking, common in wet H2S service such as sour water strippers, amine units, and certain crude units where hydrogen damage accumulates in the steel matrix.
• Part 8 — Weld Misalignment and Shell Distortion. Covers geometric imperfections from fabrication or in-service deformation, such as peaking, ovality, or weld offset that increases local bending stress beyond what the original design geometry assumed.
• Part 9 — Crack-Like Flaws. Covers cracks and crack-like indications using failure assessment diagram (FAD) methodology, which plots a combination of flaw size and material toughness on one axis against applied stress on the other to determine whether a specific crack is acceptable to leave in service or needs repair.
• Part 10 — Creep Damage. Covers components operating in the creep range, common in fired heaters, hot piping, and high-temperature reactor equipment where prolonged exposure to elevated temperature under stress causes progressive material degradation.
• Part 11 — Fire Damage. Covers assessment of equipment exposed to a fire event, where the engineering question is whether elevated temperature exposure has degraded material properties enough to compromise fitness for continued service.
• Part 12 — Dents, Gouges, and Dent-Gouge Combinations. Covers mechanical damage, frequently from third-party excavation damage on pipelines or dropped-object impacts in plants, including the more severe combined case where a dent and a gouge occur at the same location.

A single FFS study sometimes has to combine methodologies — for example, a local thin area found near a weld with some misalignment might pull from both Part 5 and Part 8 — which is exactly the kind of scoping decision that benefits from an engineer experienced across multiple damage mechanisms rather than someone running a single canned calculation.

Remaining Strength Factor: The Number That Decides Run, Derate, or Repair

Most Level 1 and Level 2 assessments for metal-loss damage mechanisms (Parts 4, 5, and 6) come down to a single governing concept: the Remaining Strength Factor, or RSF. RSF is the ratio comparing the load-carrying strength of the damaged component to the strength of the same component in its undamaged, nominal condition. An RSF of 1.0 means the flaw has had essentially no effect on strength; an RSF of 0.70 means the component retains roughly 70 percent of its original strength at that location.

A commonly cited acceptance threshold in Level 1 and Level 2 assessments is an RSF of 0.90 or higher, meaning the component needs to retain at least 90 percent of its undamaged strength to be accepted without further restriction. This is common practice rather than a single universal number written into every clause of the standard — the actual allowable RSF can shift depending on the specific part of API 579 being applied, the consequence of failure, and engineering judgment on the specific case. When the calculated RSF comes in below the allowable threshold, the engineer has three practical paths forward: derate the equipment by recalculating and lowering the MAWP to a pressure the damaged section can still support at an acceptable margin, repair the affected area, or accept continued operation only under a defined remaining-life limit paired with a monitoring and re-inspection plan that tracks whether the damage is still progressing.

MAWP Recalculation: Keeping Equipment Running at a Restricted Condition

One of the most operationally useful outcomes of a Level 1 or Level 2 FFS assessment is a recalculated MAWP rather than an immediate shutdown. Instead of treating a below-threshold RSF as an automatic stop-work order, the assessment determines the maximum pressure the component can safely handle given its current, damaged condition — and that number is very often lower than the original design MAWP, but still well above zero. A vessel originally rated for a given design pressure might come back from an FFS study rated for a meaningfully lower MAWP, with a defined re-inspection interval attached, and that is enough to keep it running safely through the current operating cycle instead of forcing an unplanned shutdown mid-run.

This is where FFS earns its keep economically as well as technically. An unplanned shutdown on a crude unit or a cracker has costs that go well beyond the repair itself — lost production, restart risk, and schedule disruption across connected units. A defensible, code-based derate that lets the unit run safely to the next planned turnaround, backed by a documented monitoring plan, is very often the outcome that protects both safety and uptime at the same time.

Four Scenarios That Should Trigger an FFS Study

In practice, a handful of recurring situations are what push a flaw from "note it in the inspection report" to "commission a formal FFS study." Recognizing these early keeps a reliability program ahead of the decision instead of scrambling during a turnaround.

A Turnaround UT Scan Finds a Thin Area Below Corrosion Allowance

The most common trigger. A scheduled UT survey during a turnaround finds a local thin area where the measured thickness has eaten into, or gone below, the corrosion allowance built into the original design — but the component isn't yet at t-min, the minimum required thickness for the design pressure. This is squarely a Part 4 or Part 5 situation, and it's exactly the case where a Level 1 screen can often clear the component for continued run, sometimes with a restricted MAWP, without forcing an unplanned extension of the turnaround scope.

An RBI Study Flags High Probability of Failure

Risk-based inspection under API 581 calculates a probability of failure (POF) and consequence of failure for each piece of covered equipment, and when a component's calculated POF crosses into a high-risk category, the standard response is a follow-up engineering study before the next inspection interval is finalized. An FFS assessment is frequently that follow-up study — it takes the RBI program's risk flag and turns it into an actual fitness determination that either confirms the current inspection interval is still appropriate or shortens it.

An Incident or Near-Miss Requires Disposition Before Restart

Mechanical damage during maintenance — a gouge from a dropped tool, contact damage from rigging, a near-miss where equipment was struck but didn't leak — creates an immediate need for engineering disposition before the unit can be restarted. This is Part 12 territory for dents and gouges, and it's a case where the FFS study isn't optional scheduling; it's a gating item standing between the incident and restart.

Life-Extension Studies as Equipment Approaches Design Life

As equipment approaches or exceeds its original design life, owners increasingly want a documented technical basis for continuing to run it rather than defaulting to replacement. A life-extension FFS study pulls together corrosion rate trending, current condition data, and remaining-life calculations to give the owner a defensible answer on how much longer the asset can run and under what conditions — a decision with obvious capital implications on assets that would otherwise be replaced purely on age.

Why NDT Sizing Accuracy Makes or Breaks the FFS Conclusion

An FFS study is only as good as the flaw data that goes into it. This is the point that gets underweighted outside the inspection community: the engineering calculation itself is well established and repeatable, but the calculation is entirely downstream of how accurately the flaw was sized in the field. In a Part 9 crack-like flaw assessment, the position of the flaw on the failure assessment diagram is set directly by the measured crack height and length. PAUT and TOFD flaw-height and length sizing accuracy is not a minor detail here — it is the single input that determines whether the point on the FAD lands inside the acceptable region or outside it. In a Part 4 or Part 5 metal-loss assessment, the RSF calculation depends on an accurate thickness contour of the damaged area, meaning the resolution and coverage of the UT grid or scan directly shapes the result.

Get the sizing wrong in either direction and the consequences run opposite ways. Sloppy or low-resolution field data that oversizes a flaw produces an unnecessarily conservative conclusion — a repair or shutdown gets forced on equipment that was actually fine, burning turnaround time and capital for no real safety gain. Data that undersizes a flaw produces a non-conservative conclusion — the study clears equipment that shouldn't have been cleared, which is the far more dangerous failure mode. Both outcomes trace back to the same root cause: inspection technique and data quality that weren't good enough to support the level of assessment being performed.

This is exactly the kind of engagement where bringing in ASNT Level III consulting oversight of the inspection technique and data quality earns its cost back many times over. A Level III can review the PAUT/TOFD procedure before the outage, confirm the scan plan actually resolves flaw geometry to the precision the engineering study needs, and sign off on the technique used to generate the sizing data the FFS engineer will build the calculation on. An FFS conclusion is only as defensible as the weakest link in the chain from field data to final report, and that weak link is very often the sizing technique, not the engineering math.

Who Signs the Assessment: Engineer, Level III, and Level II Roles

API 579-1/ASME FFS-1 assessments involve a clear division of labor, and mixing up who does what is a common source of weak studies. The formal FFS assessment itself — the calculation, the level selection, the final fitness determination — is signed by a qualified engineer, typically a licensed professional engineer with demonstrated competency in the relevant damage mechanism and assessment methodology. That engineer is not usually the person standing at the vessel with a probe.

Field data collection is the domain of Level II NDT technicians, who run the actual UT, PAUT, TOFD, or other examination in accordance with a written procedure and record the raw thickness, flaw location, and flaw sizing data the engineer will use. Between those two roles sits the ASNT Level III, whose job is technique and quality oversight: writing or approving the inspection procedure, confirming the technique is appropriate for the damage mechanism and flaw type in question, reviewing the Level II's data for consistency and technical soundness, and in many organizations acting as the technical liaison between the field inspection team and the FFS engineer so that what the engineer receives is data they can actually trust. On a well-run FFS engagement, the engineer who signs the assessment is working closely with the Level III on the NDT and sizing side, not receiving a spreadsheet of numbers from an unknown source.

Building FFS Into a Reliability and Inspection Program

The plants that get the most value out of API 579 don't treat it as a one-off emergency study — they build the trigger conditions into their standing inspection and reliability workflow so an FFS need gets flagged the moment the data suggests one, rather than getting discovered during a scramble at turnaround. That means RBI outputs, UT survey results, and incident reports all need to land somewhere they can be tracked against FFS trigger criteria over time, not buried in a folder of individual PDF reports.

This is where the software side of an inspection program starts to matter as much as the engineering side. Capturing PAUT and TOFD flaw data in a structured, traceable format — with a documented chain of custody from raw scan data to final sizing figures — is exactly the discipline an FFS engineer needs to trust the numbers going into a Part 9 or Part 5 calculation, and it's a core reason plants move off scattered spreadsheets and PDFs into purpose-built NDT reporting software that keeps field data structured and auditable from collection through final report. Tracking corrosion rate trends, RBI risk categories, and FFS trigger conditions across hundreds of pieces of equipment is a job an NDT-focused ERP is built for, tying inspection history, calibration records, and turnaround scheduling together so nothing falls through the cracks between inspection cycles. And for owners running life-extension studies on aging assets, a digital twin platform that carries the full inspection and damage history against a 3D model of the actual equipment gives the FFS engineer and the reliability team a shared, current picture of exactly where every flaw sits and how it has trended over time.

None of that software replaces the engineering judgment API 579 requires. What it does is make sure the engineer doing that judgment is working from complete, accurate, well-documented field data instead of reconstructing history from whatever inspection reports happen to still be on file. Given how directly sizing accuracy drives the FFS conclusion, that data discipline is not a nice-to-have — it's part of what makes the fitness determination defensible in the first place.

Fitness-for-service assessment sits at the intersection of two disciplines that don't always talk to each other as closely as they should: field NDT and engineering analysis. Getting an API 579 study right means getting both halves right — a qualified engineer applying the correct Part and assessment level, and field data accurate enough to support the conclusion that engineer reaches. When a flaw shows up that's outside routine screening criteria, that's the moment to bring in both sides of that equation rather than defaulting to the nearest repair crew or the nearest replacement quote.

Atlantis NDT Products & Services

Atlantis NDT pairs field expertise with software: NDT inspection management software — Atlantis ERP, a digital twin platform for asset integrity, and NDT reporting software. Build your team with NDT training & certification (ASNT SNT-TC-1A) and ASNT certification pathways, or bring in ASNT Level III consulting. Affordable, accessible, fully customizable — book a free consultation.