2013 ANSI/AAMI ES60601-1:2005 & A1:2012 “Medical Electrical Equipment, Oxygen-Rich Environment,” sub-clause b) 3) says,
“The cause of the hazardous situation is: a leak occurs and is not detected, some time later an electrical failure occurs that starts an ignition. The time interval tc for checking the seals can be calculated as follows: 
tc = r/(0.5*pe*po) where r is "acceptable" risk of fire, pe is spark rate, and po is oxygen leak rate
Formula is wrong. Correct is tc = r/((po/(po+pe))*pe*po) assuming independence and constant failure rates. I notified the relevant IEC committee representatives and submitted an article to QP. ASQ RD Newsletter published a version. I have never heard back from IEC and still don't know if they've fixed it. The correction is an oversimplification.
It doesn’t account for the occurrences before inspection time tc. Both those tc formulas result in too long inspection times. 
If you want more info on RBI, inspection time, and fire safety, let me know. RBI standards contain very detailed corrosion guidance, but I have not seen inspection time recommendations for possible fuel and ignition inspection times.