A Multi-Objective Genetic Algorithm for determining efcientRisk-Based Inspection programs

Mrcio das Chagas Moura a,n, Isis Didier Lins a, Enrique Lpez Droguett b,Rodrigo Ferreira Soares c, Rodrigo Pascual d

a CEERMA Center for Risk Analysis, Reliability and Environmental Modeling, Federal University of Pernambuco, Recife, PE, Brazilb Center for Risk and Reliability, Mechanical Engineering Department, University of Maryland, College Park, USAc PETROBRAS S.A., Brazild Physical Asset Management Lab, Department of Mining Engineering, Ponticia Universidad Catlica de Chile, Santiago, Chile

a r t i c l e i n f o

Article history:Received 31 January 2014Received in revised form17 August 2014Accepted 15 September 2014Available online 28 September 2014

Keywords:Inspection programsRisk reductionRisk-Based InspectionMulti-Objective Genetic Algorithm

a b s t r a c t

This paper proposes a coupling between Risk-Based Inspection (RBI) methodology and Multi-ObjectiveGenetic Algorithm (MOGA) for dening efcient inspection programs in terms of inspection costs andrisk level, which also comply with restrictions imposed by international standards and/or localgovernment regulations. The proposed RBIMOGA approach has the following advantages: (i) a user-dened risk target is not required; (ii) it is not necessary to estimate the consequences of failures;(iii) the inspection expenditures become more manageable, which allows assessing the impact ofprevention investments on the risk level; (iv) the proposed framework directly provides, as part of thesolution, the information on how the inspection budget should be efciently spent. Then, geneticoperators are tailored for solving this problem given the huge size of the search space. The ability of theproposed RBIMOGA in providing efcient solutions is evaluated by means of two examples, one ofthem involving an oil and gas separator vessel subject to internal and external corrosion that causethinning. The obtained results indicate that the proposed genetic operators signicantly reduce thesearch space to be explored and RBIMOGA is a valuable method to support decisions concerning themechanical integrity of plant equipment.

& 2014 Elsevier Ltd. All rights reserved.

1. Introduction

Past accidents in several types of industries have demonstratedthat equipment malfunction is one of the major causes of unex-pected and undesirable events such as toxic and inammabledischarges, re and explosions. Failures to function properly areusually due to inadequate integrity management systems thatmay result in cracks, holes, ruptures, and consequently loss ofcontainment of dangerous substances. Therefore, integrity controlhas been used for guaranteeing aging machineries work in anappropriate manner, assuring plant safety against adverse occur-rences [1].

In this context, inspection has been used as a technique toexamine the real situation of equipment exposed to damagemechanisms (e.g., thinning, stress corrosion cracking, high-temperature hydrogen attack, mechanical fatigue, brittle fracture),thus reducing the uncertainty of its condition. The aim is toidentify these potential damage mechanisms and steer efforts in

order to prevent failures by prioritizing systems that need moreattention.

Decisions about which equipment should be investigated,which inspection approach will be performed, and when thisevent will take place have become intricate problems due to thecomplexity of the involved processes, especially in reneries andpetrochemical industries. Thus, Risk-Based Inspection (RBI) hasbeen used to support the decision makers in managing theschedule of those interventions. The fundamental principle ofRBI is quite simple: after a user-dened risk target Rt (i.e. theacceptable risk) has been chosen, the inspection program isdetermined in order to not allow the risk level to exceed Rt ,thereby avoiding loss of containment and, subsequently, unwel-come effects [2].

Thus, RBI deals with the consequences of holes and ruptures inpressurized equipment in terms of the area affected by the out-come of the possible release of dangerous materials, and then theexpenses to execute mitigation solutions to the problems causedby these occurrences. Then, a baseline curve for the risk levelR k Pf k UFC is estimated over time k by combining the prob-ability of failure Pf k and the respective nancial consequence FCfor each equipment under analysis.

Contents lists available at ScienceDirect

journal homepage: www.elsevier.com/locate/ress

Reliability Engineering and System Safety

http://dx.doi.org/10.1016/j.ress.2014.09.0180951-8320/& 2014 Elsevier Ltd. All rights reserved.

n Corresponding author. Tel./fax: 55 81 2126 7112.E-mail address: marcio@ceerma.org (M.d.C. Moura).

Reliability Engineering and System Safety 133 (2015) 253265

In this context, Singh and Markeset [3] proposed an RBIplanning based on fuzzy logic approach for oil and gas carbonsteel pipelines subject to CO2 corrosion. Khan et al. [4] used the RBImethodology to develop inspection and maintenance strategiesthat maximize system availability; the approach is applied to thesteam generating system of an oil eld thermal power plant. Chienet al. [5] developed a semi-quantitative RBI analysis for pressuresafety valves (PSV) used in lubricant process units. Li et al. [6]developed an RBI theoretical framework for ship structures using adecision tree method. In Tien et al. [7], an RBI-based model forpiping systems has been built in accordance with internationalstandards and local government regulations; the purpose was toprovide inspection-related personnel with the optimal planningtools, to enable effective predictions of potential piping risks, andthen to enhance the degree of safety in petrochemical industries.Marangone and Freire [8] applied the RBI methodology in themanagement of mechanical integrity of an oil and gas separatorvessel subject to corrosion mechanisms. Vinod et al. [9] appliedthe RBI methodology for an H2S-based process plant along with anapproach devised for handling the inuence factor related to thequantity of H2S released. Shuai et al. [10] used the RBI technologyto assess quantitatively the risk of crude oil tanks in an oil depotin China.

RBI quantitative analysis yields a tool that enables the recognitionof the actual equipment's situation, and hence the intervention needsto reduce the risk exposure. Then, the estimation of the risk level R k is updated from the data gathered at each inspection epoch in order tocontinue representing the current condition of the system. In this way,the recommended practice [11] provides guidance on developing anRBI program for xed equipment (including pressure vessel, piping,tankage, pressure relief devices, and heat exchanger tube bundles) inrening, petrochemical, and chemical process plants. Thus, Ref. [11]aims at providing quantitative calculation methods to determine aninspection plan. Nevertheless, all the aforementioned works have fourmain disadvantages:

(i) The user-dened threshold Rt for risk level is not taken intoaccount as an objective to be optimized. In other words, therisk measure should be maintained below Rt , but nothingguarantees that this parameter is chosen in the most efcientway. On the contrary, the decision maker solves this problemthrough a trial-and-error method by changing the inspectionprogram until the risk target is no longer reached.

(ii) This process of not allowing the risk level R k to go above thepre-set target Rt also disregards the costs associated with theassigned inspection program. For instance, the risk limit Rt mayrequire an unreasonably high budget if it is chosen to be too low.

(iii) The calculation of the risk measure R k Pf k UFC at sometime k involves the determination of Pf k along with FCconsidering the loss of containment of a particular equipment.Even though the screening of critical equipment is usuallycarried out using a simplied qualitative approach, Vinodet al. [9] pointed out that, in general, the number of compo-nents to be considered for a quantitative RBI assessment isstill very large. Furthermore, the estimation of FC is a verylaborious task because of the amount of information required.In fact, determining FC involves the estimation of costs ofequipment repair and replacement, costs of damage to sur-rounding equipment in affected areas, costs associated withproduction losses and business interruption because of down-time to repair or replace damaged equipment, costs due topotential injuries associated with a failure and environmentalcleanup costs. These categories of costs are added up in orderto estimate FC.

(iv) Finally, it is not possible to point out how and when theinspection resources should be spent. This means that no

guideline on how to plan the inspections is provided, i.e., howto determine which techniques have to be adopted and whenthey have to be performed in full compliance with interna-tional standards and/or local government regulations. Forexample, decision makers may face problems on how tocombine inspection techniques: is it better to perform anumber of low-cost/low-effective inspections or fewerinspections with higher effectiveness, but more expensive?By effectiveness of an inspection technique, we mean theability of detecting and measuring damage mechanisms.

Therefore, this paper proposes an original RBI multi-objective-based framework, which aims at minimizing both the total risklevel and the costs related to the inspection program. Hence, atrade-off analysis is required since both objectives are conicting.In other words, given a planning horizon, the idea is to nd theoptimal compromise between risk and inspection costs, and thusovercome the aforementioned drawbacks as follows:

(i) The risk target Rt is no longer required a priori because risk isnow an objective to be minimized. In this way, the decisionmaker will not be concerned about the inspection policy thatmaintains the risk level below Rt . In fact, the inspectionprogram will be one of the results of the proposed approach.Moreover, even if the risk must be below a preset target valueRt (possibly to comply with safety regulations), the proposedmulti-objective problem also allows taking into account a riskconstraint.

(ii) The inspection costs are also handled as an objective. There-fore, as both risk and expenditures with inspection activitiesare now considered, the resulting inspection program will beof great signicance on balancing safety, availability andinspection cost requirements.

(iii) Despite the large number of equipment that should beprioritized in a rening or petrochemical facility as well asthe information requirements to estimate the nancial con-sequences, note that FC is considered constant for a particularequipment according to Ref. [11]. In this way, only Pf k variesover time k and is updated based on data collected frominspection, implying that Pf k and R k curves have the sameshape. Thus, in our multi-objective approach, the demandingstep of computing FC is no longer necessary because we willdirectly work on Pf k instead of R k , which is equivalent;even if a risk constraint has to be satised, as commented initem (i), it can be considered a posteriori as FC becomesavailable;

(iv) Finally, the proposed framework provides the decision-makerwith the information on which inspection technique shouldor should not be performed at each time-step, which in turndenes the inspection program. This piece of information willbe associated with each pair of solution (risk or probability offailure; inspection costs), directly identifying which actionsshould be followed for managing risk to a minimal level.

Thus, in the context of RBI, the multi-objective approachemerges as an alternative to handle the conicting objectives ofrisk (or probability of failure) and inspection costs so as to createefcient inspection policies that comply with regulation standards.In a multi-objective optimization, a solution that optimizes allobjectives concurrently is very difcult to be reached or it simplydoes not exist. In this way, instead of having a unique solution asin single objective cases, one may obtain a set with multiplesolutions. These solutions, named non-dominated, present acompromise among objectives and usually do not yield an optimalvalue for either of them individually. Once this set is obtained,

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265254

decision makers can choose any of its elements based on theirpreferences, and then implement the selected solution.

Depending on the number of periods considered within theinspection planning horizon and on the quantity of inspectiontechniques available, the number of possible inspection plans canbe prohibitively large for an exhaustive evaluation of their perfor-mance. Therefore, a probabilistic approach will be developed forthe quest of inspection programs representing the optimal com-promise between both objectives. Heuristic optimization methods,such as Genetic Algorithms (GAs), have interesting characteristicsto handle multi-objective optimization problems [12] because(i) they are population-based, i.e., many potential solutions aresimultaneously considered; (ii) they permit a separated treatmentof different objectives, thus not requiring any transformation ofthe multiple objectives into a unique function. GAs [13] attempt toimitate computationally the natural evolution process in which thettest individuals are more likely to remain in the population. Inthe optimization context, an individual is a potential solution ofthe considered problem and a set of individuals is the population,which evolves according to some genetic-based operators, such asselection, crossover and mutation.

Then, in this work, a novel Multi-Objective Genetic Algorithm(MOGA) is developed to minimize both likelihood of failure andcost subject to constraints imposed by international standardsand/or local regulations. The generation of the initial population,crossover and mutation are operators devised to create onlyfeasible inspection plans. In this way, the search space to beexplored by MOGA is reduced, unnecessary evaluations of theobjectives are circumvented and penalty functions are notrequired to handle unfeasible solutions.

The remainder of the paper is organized as follows. Section 2summarizes the RBI methodology. The multi-objective problem ischaracterized and formulated in Section 3. Section 4 presents theMOGA along with the genetic operators tailored for solving theproblem and an overview of the coupling RBIMOGA. In Section 5,the ability of the proposed RBIMOGA in providing accurate solutionsis rst evaluated for a hypothetical example. Then, in Section 6, theproposed RBIMOGA approach is applied to an oil and gas separatorvessel subject to internal and external corrosion causing thinning.Finally, Section 7 provides some concluding remarks.

2. Risk-Based Inspection

Usually in an RBI study, a qualitative assessment is primarilyperformed in order to obtain a categorized risk level for the consideredequipment. Probabilities and consequences of failures are assigned topre-set categories, and then combined into a risk matrix. In general,equipment with medium high and high risk levels are submitted to amore detailed quantitative risk analysis [14]. Then, inspectionresources should be allocated by prioritizing these items.

Therefore, the objective of this section is to present the back-ground of the quantitative RBI methodology that draws from Ref.[11]. More specically, it is summarized how the likelihood offailure Pf k and nancial consequences FC are estimated in orderto provide the risk level R k over time k.

2.1. Probability of failure

The probability of failure for a given damage mechanism w isdened as

Phf _w k gf f h UDhf _wkUFMS; 1

where k is a given time period, h is the different release hole sizes.Four values for h are here considered: 1=4'', 1'', 4'' and 16'', whichcorrespond to small, medium, large and rupture, respectively,

gf f h generic failure frequency for a given equipment and holesize h and is obtained from a representative failure database, andgf f total hgf f h, Dhf _wk damage factor related to the applicabledamage mechanism w and it modies the gf f h to make it specicto the equipment under evaluation, FMS is management systemfactor that accounts for the inuence of the facility's managementsystem on the mechanical integrity of the plant and is oftenobtained by the application of a questionnaire, through which ascore in 0;1000 is measured. Then, FMS 100:02:pscore1, wherepscore 0:1score.

Thus, Phf _w k is computed for a given type of damage mechan-ism w and for the different hole sizes h. As it can be seen in Eq. (1),

Dhf _wk is the only factor that makes Phf _w k vary over time, whilegf f h and FMS are kept constant. It is assumed here that theequipment of interest is subject to both internal (w1) and external(w2) corrosion causing thinning.

2.2. Damage factor, inspection effectiveness and Bayesian updating

The damage factor Dhf _wk is computed with available datagathered from inspection. Fig. 1 (Step 1Step 6) shows a owdiagram for determination of the thinning damage factor. Note,however, that inspection programs (the combination of Non-Destructive Evaluation (NDE) methods such as visual, ultrasonicand/or hydrostatic test, used to determine the equipment

Step 2: Determine the time-in-service( ) since the last inspection reading.age

Step 5: Determine damage factor usingTable 2.

Step 3: Determine the corrosion rate .r

Step 4: Determine using Equation (2).Art

Step 1: Determine the number ofinspections and the correspondinginspection effectiveness categoryfor all past inspections. For all pastinspections, combine inspections tothe highest effectiveness performed.

Step 6:

Determine the adjustment factors:- Online Monitoring- Injection/Mix Points- Dead Legs- Welded Construction- Maintenance- Settlement

Determine damage factor forthinning using Equation (3).

Step 7: Update the degree ofconfidence by using Equation (4) andestimate the probability of failure atfor the hole size via Equation (5).k h

Obs: Note that thedamage factor is computed

for the three damage states 1 ( ),2 (2 ) and 3 (4 ).

rr r

Step 8: Compute the total probabilityof failure at time through

Equation (6).k

Fig. 1. Determination of the probability of failure.

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265 255

condition) vary in their effectiveness for locating and sizingdamage, and therefore for determining corrosion rates and therespective damage factor. These limitations may result from theinability to cover 100% of the areas subject to damage, inappropri-ate training of personnel as well as from inherent inadequacy ofsome test methods to identify and estimate damage [15].

In this way, the corrosion rate r, which is determined byinspection, is uncertain, and such an uncertainty is propagatedto Dhf _wk and Phf _w k . Therefore, it is recommended to useinspection techniques of adequate effectiveness to increase thedegree of condence on the observed r. Table 1 classies theinspection effectiveness into ve categories from highly effective(A) to ineffective (E). In fact, the more thorough the inspectionprogram, the smaller the uncertainty on r.

However, decision makers may not assign inspection plans onlycomposed of the highest effective techniques available because ofbudget constraints. In fact, they combine over equipment's life low-cost/low-effective inspections with higher effective, but more expen-sive inspections. In Fig. 1 Step 1, note that we need to determine thenumber of all past inspections and their corresponding effectivenesscategory to estimate Dhf _wk. It is also possible to combine inspectionsto the highest effectiveness performed as 2B 1A, 2C 1B and2D 1C. Note that these rules are not applied to category E.

Next, in Fig. 1 Step 4, we estimate the metal loss parameterArt , which is determined from age (time in service since the lastinspection) given in Fig. 1 Step 2, and the corrosion rate r that isestimated in Fig. 1 Step 3, as follows:

Art max 1 trdr:agetminCallow

; 0:0

; 2

where trd is the thickness reading, tmin is the minimum requiredwall thickness, Callow is the corrosion allowance.

Then, the damage factor Dhnf _wk (Fig. 1 Step 5) is based on thenumber of highest effectiveness inspections (Fig. 1 Step 1) andthe value of Art (Fig. 1 Step 4). Thus, depending on these twopieces of information, Dhnf _wk is chosen from Table 2. Moreover, asshown in Fig. 1 Step 6, we may take into account adjustmentfactors for on-line monitoring FOM , injection/mix points FIP , deadlegs FDL, welded construction FWD, maintenance FMA and settle-ment FSM in order to update D

hnf _wk, as follows in Eq. (3):

Dhf _w k Dhnf w k :FIP :FDL:FWD:FMA:FSM

FOM: 3

As we argued previously, the corrosion rate r is a random variableand because of imperfect inspections, the estimated r may differfrom the actual corrosion rate. Additionally, even for k 0 (at thebeginning of equipment's life), when useful data may not beavailable, we need to predict Dhf _wk at a point in the future.

Given this uncertainty on r, a conservative standpoint isadopted since it is assumed that it is possible to observe corrosionrates twice or even four times higher than the one estimatedby the inspection technique; we call these situations: damagestates 1, 2 and 3 for the cases for which the corrosion rates are r, 2r

and 4r, respectively. Generally, these higher-than-expected corro-sion rates are localized in some points of equipment, but theyusually remain undetected until failure occurs [15]. However, thebetter the quality of reliability data, the lower the chance ofoccurrence of damage states 2 and 3.

Table 3 shows the degree of condence, 0 r , that the actualcorrosion rate r falls into these three possible discrete damagestates i 1; 2; 3; 0 r is assigned based on the source and qualityof the data available at k 0. Thus, the information given inTable 3 may be used as a priori degree of condence on thecorrosion rate r at k 0, which should be updated in order toconsider the current damage state of the equipment whenevernew inspections are performed at some time k40 in the future.This updating step, which measures the impact of the inspectionprogram on the degree of condence on r (and on the statedamage), may be done through Bayesian inference [16] as follows:

k rijr Lk rjri Uk1 ri

Lk rjr1 Uk1 r1 Lk rjr2 Uk1 r2 Lk rjr3 Uk1 r3 ;

4where i 1; 2; 3 is the damage state, k 1; ; m is the time step,m is the number of time steps considered in the planning horizon, ris the observed corrosion rate estimated from inspection, r1 r,r2 2r and r3 4r is the corrosion rates related to damage states 1,2 and 3, respectively, k1 ri is the prior probability of the damagestate i at time k, Lk rjri is the likelihood of observing the result r ofan inspection performed at k given that the equipment item isunder the damage state i, k rijr is the posterior distribution for thedamage state i. Note that k rijr becomes the prior distributionwhen the next inspection takes place, which permits the Bayesianupdating of the degree of condence on r.

The likelihood Lk rjri depends on the effectiveness of theinspection technique. Indeed, Table 4 quantitatively expresses thisclassication as the likelihood that the observed damage state(collected from an inspection program) actually represents thetrue state. Thus, Eq. (4) provides a manner to update the degree ofcondence based on the inspection effectiveness. In this way, it isexpected that the knowledge acquired from the inspection pro-gram reduces the uncertainty about the actual deterioration stateof the equipment, and this information is used to bring up-to-datethe corrosion rate r, the damage factor Dhf _wk, and then Phf _wk.

In fact, there will exist a different damage factor Dhf _wk; ri foreach damage state 1 r1 r), 2 (r2 2r) and 3 (r3 4r) as it isindicated in a remark in Fig. 1. Then, by modifying Eq. (1), itfollows that

Phf _w k; ri gf f h UDhf _w k; ri UFMS:

Then, Phf _w k is estimated for the hole size h as follows:

Phf _w k 3

i 1Phf _w k; ri k ri ; for k 0;

Phf _w k 3

i 1Phf _w k; ri k rijr ; otherwise: 5

Table 1Inspection effectiveness categories.Source: Ref. [11]

Qualitative inspectioneffectiveness category

Description

(A) Highly effective The inspection methods will correctly identify the true damage state in nearly every case (or 80100% condence).(B) Usually effective The inspection methods will correctly identify the true damage state most of the time (or 6080% condence).(C) Fairly effective The inspection methods will correctly identify the true damage state about half of the time (or 4060% condence).(D) Poorly effective The inspection methods will provide little information to correctly identify the true damage state (or 2040% condence).(E) Ineffective The inspection method will provide no or almost no information that will correctly identify the true damage state and are

considered ineffective for detecting the specic damage mechanism (less than 20% condence).

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265256

Table 2Thinning damage factors.Source: Ref. [11]

Art Inspection effectiveness

E 1 Inspection 2 Inspections 3 Inspections

D C B A D C B A D C B A

0.02 1 1 1 1 1 1 1 1 1 1 1 1 10.04 1 1 1 1 1 1 1 1 1 1 1 1 10.06 1 1 1 1 1 1 1 1 1 1 1 1 10.08 1 1 1 1 1 1 1 1 1 1 1 1 10.1 2 2 1 1 1 1 1 1 1 1 1 1 10.12 6 5 3 2 1 4 2 1 1 3 1 1 10.14 20 17 10 6 1 13 6 1 1 10 3 1 10.16 90 70 50 20 3 50 20 4 1 40 10 1 10.18 250 200 130 70 7 170 70 10 1 130 35 3 10.2 400 300 210 110 15 290 120 20 1 260 60 5 10.25 520 450 290 150 20 350 170 30 2 240 80 6 10.3 650 550 400 200 30 400 200 40 4 320 110 9 20.35 750 650 550 300 80 600 300 80 10 540 150 20 50.4 900 800 700 400 130 700 400 120 30 600 200 50 100.45 1050 900 810 500 200 800 500 160 40 700 270 60 200.5 1200 1100 970 600 270 1000 600 200 60 900 360 80 400.55 1350 1200 1130 700 350 1100 750 300 100 1000 500 130 900.6 1500 1400 1250 850 500 1300 900 400 230 1200 620 250 2100.65 1900 1700 1400 1000 700 1600 1105 670 530 1300 880 550 500

0.02 1 1 1 1 1 1 1 1 1 1 1 1 10.04 1 1 1 1 1 1 1 1 1 1 1 1 10.06 1 1 1 1 1 1 1 1 1 1 1 1 10.08 1 1 1 1 1 1 1 1 1 1 1 1 10.1 2 1 1 1 1 1 1 1 1 1 1 1 10.12 6 2 1 1 1 2 1 1 1 1 1 1 10.14 20 7 2 1 1 5 1 1 1 4 1 1 10.16 90 30 5 1 1 20 2 1 1 14 1 1 10.18 250 100 15 1 1 70 7 1 1 50 3 1 10.2 400 180 20 2 1 120 10 1 1 100 6 1 10.25 520 200 30 2 1 150 15 2 1 120 7 1 10.3 650 240 50 4 2 180 25 3 2 150 10 2 20.35 750 440 90 10 4 350 70 6 4 280 40 5 40.4 900 500 140 20 8 400 110 10 8 350 90 9 80.45 1050 600 200 30 15 500 160 20 15 400 130 20 150.5 1200 800 270 50 40 700 210 40 40 600 180 40 400.55 1350 900 350 100 90 800 260 90 90 700 240 90 900.6 1500 1000 450 220 210 900 360 210 210 800 300 210 2100.65 1900 1200 700 530 500 1100 640 500 500 1000 600 500 500

Table 3Condence in predicted damage rate.Source: Ref. [15]

Damage state category Example-general corrosion Actualdamagerate range

Low-reliabilitydata

Moderate-reliabilitydata

High-reliability data

Damage State 1: The damage in the equipmentis no worse than what is expected based ondamage rate models or experience.

The rate of general corrosion is less than orequal to the rate predicted by past inspectionrecords, or historical data if no inspectionshave been performed.

Predictedrate (r) orless

0.50 0.70 0.80

Damage State 2: The damage in the equipmentis somewhat worse than anticipated. Thislevel of damage is sometimes seen in similarequipment items.

The rate of general corrosion is as much astwice the predicted rate.

Predictedrate (r) totwo timesrate (2r)

0.30 0.20 0.15

Damage State 3: The damage in the equipmentis considerably worse than anticipated. Thislevel of damage is rarely seen in similarequipment items, but has been observed onoccasion industry-wide.

The rate of general corrosion is as much asfour times the predicted rate.

Two (2r) tofour times(4r)predictedrate

0.20 0.10 0.05

Examples (a) Publisheddata

(a) Laboratorytesting

(a) Field data

(b) Corrosionrate tables

(b) Coupon datareecting ve or moreyears of experiencewith the processequipment

(b) Limitedcouponcorrosiontesting

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265 257

First part of Eq. (5) allows propagating the uncertainty on the statedamage to Phf _w k at k 0, when just information given in Table 3is available. As an inspection technique is performed at k40, weupdate the degree of condence on the state damage based oninformation in Table 4 and via Eq. (4), which yields k rijr , andthen we estimate Phf _w k . In this way, the effectiveness of theinspection techniques performed at each period k, which isdetermined in the adopted inspection program, directly inuencesthe computation of Phf _w k . Thus, Eq. (5) provides (Fig. 1 Step 7)the up-to-date Phf _w k for one damage mechanism w, for whichthe total probability is given in Fig. 1 Step 8 as follows:

Pf _w k hPhf _w k : 6

However, note that the procedure of Fig. 1 should be repeatedtwice as the equipment of interest is subject to internal (w1 IC)and external (w2EC) corrosion. Thus, Pf _wi k (i 1; 2) should beestimated for both types by considering the internal (rw1 ) andexternal (rw2 ) corrosion rates. Then, by assuming w1 and w2 areindependent mechanisms, it follows that

Pf k Pf _w1 k Pf _w2 k Pf _w1 k :Pf _w2 k : 7

2.3. Consequence of failure

In accordance with the API-RBI methodology, the consequencesof failures may be expressed in nancial terms (FC). According to[11], the steps of a consequence analysis for a xed pressurizedequipment are as follows:

determine the representative uid; select a set of release hole sizes; calculate theoretical release rate/mass; estimate uid inventory; establish release type; estimate impact of detection and isolation systems; calculate adjusted release rate/mass; determine ammable/explosive consequences; determine toxic consequences; determine non-ammable and non-toxic consequences; determine component damage and personnel injury conse-quence areas (CA);

determine FC.

The underlying idea of a level 1 consequence analysis is toestimate the consequences of releases of hazardous uids at thehole size h level for which there are several costs to take intoaccount. First, the API-RBI methodology recommends that weconsider the costs of repair and replacement (FCrep) of damaged

equipment, which are calculated as

FCrep hgf f

h:holecosth

gf f total

!:matcost;

where holecosth is the equipment repair costs ($) based on carbonsteel prices and matcost is a material cost factor to adjust FCrep toother materials. Costs of damage to surrounding equipment inaffected areas (FCaf f a) should also be included if the failure resultsin a ammable (or explosive) event. In fact, these costs are given as

FCaf f a CAcmd:equipcost;where CAcmd is the nal damage consequence area (m2) andequipcost is the process unit replacement cost for components($=m2).

Costs associated with production losses and business interrup-tion as a result of downtime for repair or replacement of damagedequipment (FCprod) are also considered. These costs are deter-mined based on the amount of downtime associated with thespecic equipment that were subject to a loss of containment andall equipment also affected by the release in the consequence area.Then, this cost is given as

FCprod OutagecmdOutageaf f a

:prodcost;

where Outagecmd hgf f h:Outageh=gf f total

:Outagemult is the

weighted (on release hole size) number of days of downtimerequired to repair the specic piece of equipment that is beingevaluated (days), Outageh is the number of downtime days torepair damage associated with the h release hole size (days),Outagemult is the equipment outage multiplier, Outageaf f a numberof days of downtime required to repair damage to the surroundingequipment (days), prodcost cost of lost production due to down-time to repair equipment ($=days).

Other costs to consider are those due to potential casualties ofpersonnel and/or of communities in the vicinity, which are given as

FCinj CAinj:poddens:injcost;

where CAinj is the nal personnel injury consequence area (m2),poddens is the population density of personnel or employees in theunit (personnel=m2), and injcost is the cost associated with seriousinjury of fatality of personnel ($). Finally, the environmental cleanup

costs (FCenv) are also estimated as FCenv hgf f h:volhenv=gf f total

:

envcost ,where envcost is the environmental clean-up costs ($=barrel),

volhenv is the spill volume in barrels to be cleaned up calculated foreach of the 4 release hole sizes selected. The fraction of the released

liquid pool that evaporates is also needed to estimate volhenv.Then, FC may be estimated adding up all abovementioned

individual costs as in Eq. (8):

FC FCrepFCaf f aFCprodFCinjFCenv: 8Even though the consequence of failure FC needs to be evaluatedonly once for a particular equipment, this step of a quantitative RBIassessment is still very demanding. First, because of the largeamount of information requirements necessary to feed the equa-tions previously presented even in a level 1 consequence analysis.Indeed, note that these expressions are given in a summarizedformat since they encapsulate other pieces of information. Forexample, volhenv depends on the fraction of material that willevaporate, the uid liquid density, and the normal boiling point.Moreover, giving the same level of attention to all equipment ispractically impossible due to the huge number of components inreneries and petrochemical industries; even after prioritizingequipment based on a preliminary qualitative risk analysis, thenumber of components to be evaluated quantitatively is stillvery large.

Table 4General corrosioninspection effectiveness.Source: Ref. [15]

Damage ratestate

Range of factual damage rate Likelihood thatinspection resultdetermines the truedamage

A B C D/E

1 Measured rate or less 0.90 0.70 0.50 0.332 Measured rate to 2 measured

rate0.09 0.20 0.30 0.33

3 24 measured rate 0.01 0.10 0.20 0.33

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265258

Note that, in order to obtain efcient inspection programs, theproposed RBI multi-objective framework does not require thecalculation of FC. In fact, since FC is kept constant over time(API-RBI methodology [11]), only the damage factor needs to bere-computed at every k, which then allows updating Pf k . Thus,this feature results in a considerable reduction of effort.

3. Problem statement and formulation

Let an inspection program x be represented by the followingvector:

x x1;1; ; x1;k; ; x1;m; ; xj;1; ; xj;k; ; xj;m; ;xn;1; ; xn;k; ; xn;m; 9

where n is the number of available NDE inspection techniques andm is the number of time steps considered in the planning horizon.Each element xj;k of x is either 0 or 1, j 1;;n and k 1;;m. Ifxj;k 1, then the inspection technique j is performed at k. Other-wise, there is no inspection of type j at k. In this way, at period k, atmost one inspection using technique j is allowed. Notice thatvarious inspection methods are allowed in the same period k, asthey may provide different information about the actual state ofequipment. In this case, however, we apply the Bayesian updatinggiven in Eq. (4) considering the inspection technique of highesteffectiveness.

The multi-objective optimization problem, which consists ofselecting efcient inspection programs x that represent the com-promise between C x and Pf x is formally dened as follows:

min C x n

j 1cj

m

k 1xj;k

!cp

n

j 1m

k 1xj;kcd

jA J'm

k 1xj;k; 10

min Pf x m

k 1Pf k ; 11

s:t: xj;1xj; tj; max1Z1; 8 j: 12

The inspection cost objective function (Eq. (10)) is related to theinspection activity, where cj is the cost of performing inspectionusing technique j, cp is the cost of qualied personnel perinspection, cd is the downtime cost per period, and J' is the setof intrusive inspection techniques that require entry into theequipment, causing downtime. Eq. (11) corresponds to the totalPf x associated with an inspection program x within the planninghorizon m; it is the sum of Pf k that comes from Eq. (7). Note thatPf k directly depends on the damage factor and on the effective-ness of the inspections that compose program x, as explained inSection 2.2.

Yet, international standards and/or local government regula-tions (such as the Brazilian Regulation Standard ([17]) generallyestablish that an inspection technique j should be performed atleast once within a given time period. In this way, it is possible todene a maximum allowed interval (tj; max, j 1;;n) betweenconsecutive inspections. By taking this into account, Eq. (12) iswritten, where represents a period with an inspection (xj; 1)and can possibly assume any of the values 1;;mtj; max1.Thus, the constraints in Eq. (12) concern the summations ofinspections over groups of tj; max1 periods, which have to be atleast 1, i.e., at least one inspection technique j has to be performedin such an interval.

A risk constraint, i.e. RxrRt or equivalently Pf x rRt=FC,could be added to the multi-objective formulations (10)(12). Inthis case, the knowledge of FC would be required a priori and allthe obtained solutions (inspection plans) would presentPf x rRt=FC. Indeed, such solutions are a subset of the set ofinspection plans resulting from the problems (10)(12) as it is

presented, with no upper limiting value for R x . Therefore, theproposed approach is general, allowing the consideration of a riskconstraint in a posterior step, as soon as FC has been computed.Thus, the identication of the valid inspection plans is a simpletask as they would be in the region of the Pareto front dened bythe risk constraint. This characteristic will be shown in theapplication example in Section 6.

4. Proposed Multi-Objective Genetic Algorithm

In a multi-objective optimization, a set of non-dominatedsolutions is obtained representing the compromise among objec-tives. Thus, the concept of (non-)dominance relation plays acentral role in multi-objective techniques. A solution is non-dominated if, for all objectives, it has a performance at least asgood as that of the other solutions and, at least for one of theobjectives, its performance overcomes that of the others. On theother hand, the dominance relation is mathematically dened asfollows:

x1gx23 f i x1 r f i x2 ; 8 i and f i x1 o f ix2 for some i;

13where g denotes dominance, x1 is a non-dominated solution fora minimization problem and x2 is a dominated solution for thesame problem; f i denotes the ith objective function (e.g.,C x ; Pf x). If one of the conditions on the right-hand side ofEq. (13) is not satised, both x1 and x2 are said to be non-dominated. That is, for a number of objectives, x1 overcomes theperformance of x2 and, for the remaining objectives, x2 overcomesthe performance of x1. The non-dominance relation is alsoobserved when x1 x2.

In this section, the proposed MOGA is tailored for solvingproblems (10)(12). First, one of the characteristic of this approachis that the genetic operators provide only feasible inspectionprograms as outcomes. This feature has the following advantages:(i) the search space to be explored by the MOGA is reduced; (ii) theMOGA is prevented from getting stuck into an unfeasible part ofthe search space; (iii) unnecessary tness evaluations of unfeasibleindividuals are avoided; and (iv) the use of penalty functions dueto unfeasibility is not required.

For the problem characterized in Section 3, the total number ofsolutions in the search space, when the constraints in Eq. (12) arenot taken into account, is given by 2n:m. The number of feasibleinspection plans for a given technique j is am;pj xm f pj x, whichis dened as the coefcient of xm in the x-power series expansionof f pj x, where

f pj x 2 xx2xpj xpj1xx2xpj ;

for pj tj;max1. Hence, the percentage of the search spaceconcerning feasible inspection plans is given by

am;p1 Uam;p2 UUam;pn2m Un

100%:

As an illustration, suppose n 1, m 20, p 3 (thus, t1;max 2).The x-power series expansion of f pj x is2x4x27x313x424x5

44x681x7149x8274x9504x10927x11

1;705x123;136x135;768x1410;609x1519;513x16

35;890x1766;012x18

121;415x19223;317x20:Therefore, the number of feasible inspection programs isa20;3 223;317 and it represents about 21:3% of the search space.

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265 259

For further details on enumeration techniques, the interestedreader is referred to [18].

The next sections detail the individual representation alongwith the proposed genetic operators for the generation of initialpopulation, crossover and mutation. Recursive algorithms aredeveloped for the elaboration of inspection plans. Feasibilityevaluation of xj;1, , xj; tj; max1 is required whenever aninspection takes place (i.e., xj; 1) and for every techniquej 1;;n. The selection and update of the auxiliary populationPaux are the same as those presented in Ref. [19]. The selection isbased on the (non-)dominance relation among solutions. Domi-nated solutions are eliminated from the current population andthe non-dominated ones are stored in Paux. In order to recover thenumber of individuals N in population, solutions from Paux arerandomly chosen. Paux is updated at every iteration of the algo-rithm. For further details, the reader is referred to [19].

4.1. Individual representation

An individual is represented by the vector in Eq. (9), whoseentries are either 1 or 0 if an inspection using the related techniqueis either or not performed in the associated period, respectively.Here, an integer representation of individuals is adopted.

For the sake of illustration, consider n 3, m 6, t1;max 2,t2;max 3, t3;max 4 and the inspection plan in Table 5, indicatingan inspection plan such that: (i) the rst technique should beperformed at periods 2 and 5; (ii) the second technique should beperformed at periods 1, 3 and 4; and (iii) the third techniqueshould be performed at periods 1 and 6.

4.2. Generation of initial population

Each of the N individuals of the initial population is randomlygenerated according to a discrete uniform distribution with addi-tional features to handle unfeasibility, which are presented in thealgorithm of Fig. 2. The underlying idea of the algorithm is that, fora given technique j, every time an inspection is established(xj; 1), a new group of values for the future periods xj;1,,xj; tj; max1 is generated for feasibility investigation. In this way,an inspection to be carried out at period requires the restart ofthe algorithm from 1.

Indeed, groups of tj;max1 periods, starting from 1, areconsidered one at a time. The values xj;b, b 1;;tj;max1are randomly set either to 0 or to 1, and whenever xj;b 1, arecursion of the algorithm starting from b1 is required. If all xj;bare equal to 0, then no inspection is performed within theconsidered period (S 0), and the constraint in Eq. (12) is violated.In order to tackle the unfeasibility, a position p among1;; tj;max1 is selected and the corresponding value isset to 1; then, a recursion with p as argument is called. These stepsare repeated until the nal period m is reached. Once thisreasoning is applied for each of the n considered techniques, afeasible individual is generated.

4.3. Crossover and replacement

Since the values of xj;b are either 0 or 1, the usual binarycrossover [20] is performed between two individuals (parents, e.g.,

x1 and x2). Such an operator is combined to a procedure devised toevaluate the offspring feasibility and to transform unfeasibleindividuals that might have been created into feasible ones. Theparents' positions are interchanged at randomly chosen cut points(c) so that to generate two new individuals: child 1 and child2 that are, respectively, the modied x1 and x2, since the replace-ment is automatically performed (children replace parents). Fig. 3adepicts the crossover between two individuals when n 3, m 6,c 4, t1;max 2, t2;max 3, and t3;max 4. Then, the investigationand handling of an eventual unfeasibility for each new individual,per technique, take place.

The algorithm used to perform these tasks is essentiallythe same as in Fig. 2; the only exception is step 1(b), given thatin the crossover the values xj;b are not created. Note that for theillustrated example, the crossover procedure generated an unfea-sible offspring (child 2) that violated the maximum number ofperiods without an inspection using technique 1. In Fig. 3b, theunfeasibility is identied and a possible solution is given. As anoutcome, child 2 becomes feasible.

4.4. Mutation

As in the crossover, given that either xj;k 0 or xj;k 1, 8 j and8k, the binary mutation [20] combined to a mechanism to rendereventual unfeasible individuals into feasible ones is applied. Forevery position, a uniform random number uA 0;1 is generated;given a position j; k, if u is less than or equal to the mutation

Table 5Individual representation for MOGA (inspection plan).

Technique 1 Technique 2 Technique 3

Period 1 2 3 4 5 6 1 2 3 4 5 6 1 2 3 4 5 6Inspection plan 0 1 0 0 1 0 1 0 1 1 0 0 1 0 0 0 0 1

Fig. 2. Generation of a feasible plan for a given technique.

Fig. 3. (a) Example of binary crossover procedure and (b) solving unfeasibility ofchild 2.

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265260

probability (pm), the value of xj;k is changed either (i) from 0 to 1 or(ii) from 1 to 0; otherwise, xj;k remains the same.

Note that only mutations of type (ii) generate unfeasibility,since additional inspections due to type (i) mutations do not harmthe individual's feasibility. In this way, whenever a mutation oftype (ii) occurs, the related technique and period are stored invectors it and ip, respectively. Once all positions of an individualhave been submitted to the binary mutation procedure, it and ipare of the same length (jitj jipj). If it and ip are both empty,which means no mutations of type (ii) have happened, the relatedindividual is still feasible.

On the other hand, if jitj jipj40, it is necessary to investigateeventual unfeasibility arising due to type (ii) mutations. If techni-que j and period k are, respectively, at the same positions of it andip and the corresponding mutation resulted in an unfeasibility(a greater number of periods without inspections using technique jthan permitted), the xj;k value is restored to 1 as if no mutation hadtaken place at position j; k. Otherwise, if a mutation of type(ii) has occurred but has not generated an unfeasibility, the productof the mutation remains unchanged, i.e. xj;k 0. The idea is to modifyindividuals as least as possible after the mutation operator has beenapplied in order to preserve the MOGA evolution trend.

The algorithm of Fig. 4 summarizes the investigation procedurefor unfeasibility over an individual for a given technique as well astheir associated treatment in order to render the inspection planfeasible. Note that steps until (iii) are basically the same as inalgorithm of Fig. 2. These steps are necessary because of altera-tions in feasibility analysis due to possible 1's provided bymutations of type (i), which also demand the recursion of thealgorithm starting from the immediate subsequent position. Theelements of it and ip that are eliminated in steps 4 and 5 are thoseinvolving already solved unfeasibility. Thus, at the end, ifjitj jipj40, the remaining elements refer to positions that havebeen submitted to type (ii) mutations but have not generatedunfeasibility.

4.5. Overview of the proposed RBIMOGA framework

The proposed approach couples the RBI methodology describedin Section 2 to the MOGA-based optimization procedure pre-viously presented, which entails constraints to comply withpossible existing international standards and/or regulations. Anoverview of RBIMOGA is provided in the owchart of Fig. 5.

5. Numerical experiments

In this section, a numerical example is solved by the proposedRBIMOGA approach in order to compare the obtained resultsagainst the real non-dominated inspection plans, which are in turnprovided by an exhaustive recursive algorithm. A planning horizonof m 10 years is considered, n 3 inspection techniques areavailable, and two damage mechanisms act on the equipment(internal and external corrosion) both causing thinning. Techni-ques 2 and 3 require equipment shutdown; thus they generatedowntime costs. This example has 113,092,992 feasible inspectionplans, which represent 10.53% of the entire search space, and 46non-dominated solutions.

The required parameters for computing C x (Eq. (10)) and Pf x (Eq. (11)) are presented in Table 6; consider also that low-reliability data (see Table 3) was available at k 0 to estimatethe corrosion rates. The gf f hfor h1/4, 1, 4 and 16 are,respectively, 8 106; 2 105; 2 106 and 6 107 fail-ures per year and FMS 1. Table 7 presents the MOGA parameters.

In order to evaluate the stochastic behavior of RBIMOGA, weran 100 replications. Some descriptive statistics are shown inTable 8. In all cases, RBIMOGA was able to nd almost allsolutions from the true Pareto front. In the worst case, about91% of the exact solutions were provided by RBIMOGA. Such aproportion is approximately 98% for the best case. The exhaustiveFig. 4. Evaluation and solution of eventual unfeasibility after mutation.

MOGA+RBI

Selection andupdatePaux

Mutation

No

Yes

Replacement

Crossover

End

Start

Generation ofinitial population

Obtain ,= 1/4, 1, 4, 16,and via RBI

gffh

F

h

MS

Update Paux

Maximumnumber of generations is

reached?

Fitnesse

valuation

iN

=1,...,

Generationnumber =

0

C x( )i

P xf ( ) via RBI(Sections 2.1 and 2.2)

i

Fig. 5. Proposed RBIMOGA.

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265 261

recursive algorithm required 33 minutes to return the true Paretofront in a Windows operating system, Intels CoreTM i7 2.20 GHzprocessor and 8 GB of RAM, while each run of RBIMOGA tookonly about 2.5 s, which is around 0.13% of the time needed by theexhaustive algorithm. Fig. 6 depicts the true Pareto front alongwith the worst and best cases. It can be observed that even theworst RBIMOGA front is near the true one.

6. Application example: oil and gas separator vessel

In this section, the proposed RBIMOGA is applied to obtainnon-dominated inspection programs for a separator vessel of oiland gas by considering n 3 inspection techniques (1: externalexam; 2: internal exam; 3: hydrostatic test) and a horizon ofm 20 years. This equipment item is exposed to internal andexternal corrosions that cause thinning. It is here considered thatexternal exams are ineffective (E) to evaluate internal corrosion,while they are usually effective (B) to measure thinning due toexternal corrosion. Internal exams are treated as usually effective(B) for internal and external corrosions, and the hydrostatic test ishighly effective (A) for both damage mechanisms. Both internalexam and hydrostatic test are intrusive techniques; thus theygenerate downtime costs.

The Brazilian Regulation Standard ([17]) establishes maximumtimes to perform at least one inspection for these three techni-ques: 4, 8 and 16 years, respectively. Thus, t1;max 3, t2;max 7, andt3;max 15 years; it was considered a Type II vessel and a plant thathas its Own Service of Inspection (see Ref. [17]). The same gf f h

and FMS values used in the previous example are here adopted.

Inspection costs along with the characteristics of the damagemechanisms, which are used to calculate C x , Art , Dhf _wk, Pf k and Pf x , are summarized in Table 9. The MOGA parameters arethe same as in Table 7, but the number of cut points is c 15. Forthis problem setting, the number of feasible inspection programsis in the order of 1017 and it represents 50.77% of the entire searchspace. The exhaustive evaluation of these feasible programs isimpossible in practice. Then, we need to resort to the MOGAalgorithm developed in Section 4.

For this application, the plan with inspection activities per-formed as late as possible in accordance with [17] (see Table 10)was forced to be in the initial population so as to guarantee that itwould be evaluated by RBIMOGA. The gray cells in Table 10represent that an inspection is to be performed in the associatedperiod (column) using a specic technique (row). Note that suchan inspection program is not the only one suggested by [17], but itis the rst that comes to mind, as it would be, at rst glance, thecheapest one that still complies with this particular regulationstandard.

For this example, RBIMOGAwas replicated 30 times and eachrun required approximately 5 s to be performed. All fronts weresimilar and some descriptive statistics are shown in Table 11.However, instead of using one of these 30 fronts, an evaluation ofthe (non) dominance relation among the solutions of all fronts wasperformed. The resulting Pareto front contains 122 solutions and ispresented in Fig. 7.

The inspection programs (IPi; i 1; 2; 3) associated with thesolutions indicated in Fig. 7 are presented in Table 12. If solutionIP1 and the one presented in Table 10 are compared, one mayconclude that in spite of having the same inspection cost for the20 years, a slight modication in the schedule of techniques1 and 2 resulted in a smaller Pf x for solution IP1. Thus, theinspection plan of Table 10 is dominated by solution IP1.

For the sake of illustration, Fig. 8 exemplies how Pf k forsolution IP1 varies over time because of the damage factor andbased on the Bayesian updating procedure given in Section 2. First,note that Pf k is not necessarily a monotone function. This

Table 6RBI parameters and inspection costs, validation example.

Technique tj; max (years) cj Damage mechanism Thickness (mm)

Internal corrosion External corrosion Initial Minimum (tmin)Effectiveness

1 1 1000 E B 12 102 3 5000 B B3 7 10,000 A A

cp cd Corrosion rate r (mm/year) Corrosion allowance Callow (mm)100 500 rIC 0:4 rEC 0:6 1FOM FIP FDL FWD FMA FSM 1

Table 7MOGA parameters.

Parameter Value

Population size (N) 250Number of generations (Ngen) 500Probability of crossover (pc) 0.95Number of cut points (c) 8Probability of mutation (pm) 0.05

Table 8Results for validation example: 100 replications of RBIMOGA.

Statistics Number of solutions Number of exact solutions

Minimum 43 42Median 46 44Maximum 46 45Mean 45.57 44.28Std. dev. 0.5730 0.5333

64 108

0.00

0.02

0.04

0.06

0.08

C(x) (in 104)P

f(x)

Fig. 6. Exact and simulated Pareto fronts for validation example.

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265262

happens because the relatively low-cost/low-effective inspectiontechniques 1 and 2 are performed in earlier steps (ko16 ofequipment's life, whereas the high-cost/high-effective inspectiontechnique 3 is just adopted at k 16. Indeed, for this case, despitethe expected better condition of the equipment at ko16, theuncertainty on the corrosion rate is then high since little helpfulinformation is available at that period. For instance, consider Pf k at k 12 and the dip at k 16 in Fig. 8. Note that even though amore severe corrosion rate would be expected at k 16, moreconservative estimates for Pf k are provided at k 12 becausemore condence is put on state damages 2 and 3 at k 12 sinceless relevant information is available. On the other hand, as aninspection with higher effectiveness is carried out at k 16 onehas more condence in the observed corrosion rate r1 related tostate damage 1.

A return on investment (ROI) analysis can aid the decision forthe adoption and implementation of an inspection plan from the

Pareto front:

ROI Pf xj

Pf xi C xj C xi ;

where i and j are different solutions from the Pareto front. Forexample, each monetary unit invested in inspection activities to gofrom solution IP1 to IP2 corresponds to a reduction of 3:43 106in Pf x . On the other hand, from solution IP2 to IP3 each additionalmonetary unit would reduce Pf x by 2:94 107. Thus, highinvestments in inspection do not necessarily mean signicantreductions on the total Pf x .

The obtained Pf x can be used to compute the risk R x associated with every inspection program x from the Pareto frontas the nancial consequence FC is available. In order to illustrate, aconsequence analysis was performed according to Ref. [11] forthe oil and gas separator vessel and FC $ 2;246;908:17 wasestimated as given in Section 2.3. The Pareto front presentingthe trade-off between C x and R x is given in Fig. 9. Note that thefronts in Figs. 7 and 9 have the same shape and, as expected, theonly difference between them is the scale factor FC, which isreected in the values of the vertical axis.

If the risk must be smaller than a preset target value Rt ,possibly to comply with safety regulations, i.e., RxrRt orequivalently Pf x rRt=FC, Pareto solutions satisfying such a con-straint are in the region below the corresponding horizontal linedened by Rt or by Rt=FC in the graphs C x vs. Rx or C x vs. Pf x ,respectively. As an illustration, for the present example, ifRxrRt 45;000 and consequently Pf x r0:02, there are 87valid solutions (all of them are under the horizontal lines shownin Figs. 7 and 9).

It is important to emphasize that in order to obtain the mostefcient inspection programs regarding both C x and R x throughthe proposed RBIMOGA approach, it is not necessary to developthe very demanding task of assessing the consequences of failuresince the only component that makes the risk level vary over timeis Pf x . Thus, the effort to accomplish the analysis is fairly reduced.Even if a risk constraint is mandatory, it can be considered in aposterior step, when FC becomes available. This is possiblebecause, as Pf x is an objective to be minimized, such a constraint

Table 9RBI parameters and inspection costs, application example

Technique tj; max (years) cj Damage mechanism Thickness (mm)

Internal corrosion External corrosion Initial Minimum (tmin)Effectiveness

1 3 1000 E B 16 122 7 5000 B B3 15 10,000 A A

cp cd Corrosion rate r (mm/year) Corrosion allowance Callow (mm)300 1000 rIC 0:200 rEC 0:454 1FOM FIP FDL FWD FMA FSM 1

Table 10Plan with inspections performed as late as possible in accordance with [17].

Table 11Descriptive statistics for the number of solutions per front (30 replications).

Minimum Median Maximum Mean Std. dev.

112 116 121 116.4 2.2664

50000 100000 1500000.00

0.02

0.04

0.06

0.08

0.10

0.12

C(x)

Pf(x

)

IP1

IP2

IP3

Fig. 7. Pareto front for application example and some selected solutions: C x vs.Pf x

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265 263

is a cut in the obtained Pareto front and the solutions of interestcan be easily identied.

7. Conclusion

In this paper, an original RBIMOGA methodology was devel-oped in order to provide the decision maker with efcientinspection programs in terms of both inspection costs C x andrisk R x (by the direct minimization of Pf x ). The RBI methodol-ogy was used to assess Pf x related to the candidate inspectionprograms x provided by MOGA.

The fact of directly considering Pf x as an objective to beoptimized has two advantages: (i) rst, the user-dened risk targetRt was no longer required as established in [11]; (ii) the step ofestimating the nancial consequences FC of failures may beskipped, saving a lot of effort and time. Moreover, as C x is also

taken as an objective, the inspection expenditures become man-ageable and it was possible to assess the impact of preventioninvestments on Pf x , and then on R x ; this would not be possibleif only RBI methodology had been adopted.

In the MOGA portion, the genetic operators were adapted forthe creation of only feasible inspection programs, which should bein compliance with restrictions that might be imposed by inter-national standard and/or local regulations. In this way, MOGAexplored the search space in a more efcient way, as only itsfeasible portion had been taken into account.

The proposed RBIMOGA was applied to two examples, one ofthem involving an oil and gas separator vessel. For these cases,it was possible to provide information on how the inspectionbudget should be spent more efciently, which involves deningthe whole inspection program associated with each pair (Pf x ,C x ). An ROI analysis was performed on the obtained non-dominated inspection programs and it could be inferred that highinvestments in inspection do not necessarily yield a signicantreduction of Pf x (thus, R x ). Finally, the results suggest that theRBIMOGA with the post-optimization ROI analysis is an effectivetool to support efcient decisions related to mechanical integrityof equipment.

Acknowledgments

The rst three authors thank the Brazilian research-fundingagency Conselho Nacional de Desenvolvimento Cientco e Tecno-lgico (CNPq) for the nancial support through research grants.

References

[1] Bragatto PA, Pittiglio P, Ansaldi S. The management of mechanical integrityinspections at small-sized Seveso facilities. Reliab Eng Syst Saf 2009;94:4127.

[2] Conley M. Integrating risk-based inspection into risk management plans.Process Saf Prog 2005;24:23646.

[3] Singh M, Markeset T. A methodology for risk-based inspection planning of oiland gas pipes based on fuzzy logic framework. Eng Fail Anal 2009;16:2098113.

[4] Khan FI, Haddara M, Krishnasamy L. A new methodology for risk-basedavailability analysis. IEEE Trans Reliab 2008;57(1):10312.

[5] Chien C-H, Chen C-H, Chao YJ. A strategy for the risk-based inspection ofpressure safety valves. Reliab Eng Syst Saf 2009;94(4):8108.

[6] Li D, Zhang S, Tang W. Risk based inspection planning for ship structures usinga decision tree method. Nav Eng J 2004;116(2):7384.

[7] Tien S-W, Hwang W-T, Tsai C-H. Study of a risk-based piping inspectionguideline system. ISA Trans 2007;46:11926.

50000 100000 1500000

50000

150000

250000

C(x)

R(x

)

IP1

IP2

IP3

Fig. 9. Pareto front for application example and some selected solutions: C x vs. R x

Table 12Selected solutions from Pareto front.

105 15 20

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

k

Pf(k

) x 1

02

Fig. 8. Probability Pf k

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265264

[8] Marangone FC, Freire JLF. Management of the integrity of a pressure vesselusing risk-based inspection (in Portuguese). In: 8a Conferncia sobre Tecno-logia de Equipamentos; 2005.

[9] Vinod G, Sharma PK, Santosh TV, Prasad MH, Vaze KK. New approach for riskbased inspection of H2S based process plants. Ann Nucl Energy 2014;66:139.

[10] Shuai J, Han K, Xu X. Risk-based inspection for large-scale crude oil tanks. JLoss Prev Process Ind 2012;25(1):16675.

[11] API-RBI-581. API (American Petroleum Institute) recommended practice 581:risk-based inspection technology, 2nd ed. Washington, DC; 2008.

[12] Deb K. Evolutionary algorithms for multicriterion optimization in engineeringdesign. In: Proceedings of evolutionary algorithms in engineering and com-puter science (EUROGEN'99); 1999.

[13] Goldberg DE. Genetic algorithms in search, optimization, and machine learn-ing. Reading: Addison-Wesley; 1989.

[14] Modarres M. Risk analysis in engineering: techniques, tools and trends. Boca-Raton: Taylor & Francis; 2006.

[15] API-RBI-581. API (American Petroleum Institute) publication 581: risk-basedinspection base resource document. Washington, DC; 2000.

[16] Bernardo JM, Smith AFM. Bayesian theory. London, UK: John Wiley & SonsLtd.; 1994.

[17] NR-13. Regulamentation standard NR-13 pressure vessels and boilers(in Portuguese). Ministrio do Trabalho e Emprego do Brasil; 2008.

[18] Lins S. Principles of enumeration (in Portuguese). Rio de Janeiro: Instituto deMatemtica Pura e Aplicada; 1981.

[19] Lins ID, Droguett EL. Redundancy allocation problems considering systemswith imperfect repairs using multi-objective genetic algorithms and discreteevent simulation. Simul Model Pract Theory 2011;19:36281.

[20] Michalewicz Z. Genetic algorithmsdata structuresevolution programs. 3rded. Berlin: Springer; 1996.

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265 265

A Multi-Objective Genetic Algorithm for determining efficient Risk-Based Inspection programsIntroductionRisk-Based InspectionProbability of failureDamage factor, inspection effectiveness and Bayesian updatingConsequence of failure

Problem statement and formulationProposed Multi-Objective Genetic AlgorithmIndividual representationGeneration of initial populationCrossover and replacementMutationOverview of the proposed RBI+MOGA framework

Numerical experimentsApplication example: oil and gas separator vesselConclusionAcknowledgmentsReferences