Reliability Engineering and System Safety 133 (2015) 253265

Contents lists available at ScienceDirect

Reliability Engineering and System Safety

journal homepage: www.elsevier.com/locate/ress

A Multi-Objective Genetic Algorithm for determining efcient

Risk-Based Inspection programs
Mrcio das Chagas Moura a,n, Isis Didier Lins a, Enrique Lpez Droguett b,
Rodrigo Ferreira Soares c, Rodrigo Pascual d
a

CEERMA Center for Risk Analysis, Reliability and Environmental Modeling, Federal University of Pernambuco, Recife, PE, Brazil
Center for Risk and Reliability, Mechanical Engineering Department, University of Maryland, College Park, USA
c
PETROBRAS S.A., Brazil
d
Physical Asset Management Lab, Department of Mining Engineering, Ponticia Universidad Catlica de Chile, Santiago, Chile
b

art ic l e i nf o

a b s t r a c t

Article history:
Received 31 January 2014
Received in revised form
17 August 2014
Accepted 15 September 2014
Available online 28 September 2014

This paper proposes a coupling between Risk-Based Inspection (RBI) methodology and Multi-Objective
Genetic Algorithm (MOGA) for dening efcient inspection programs in terms of inspection costs and
risk level, which also comply with restrictions imposed by international standards and/or local
government regulations. The proposed RBI MOGA approach has the following advantages: (i) a userdened risk target is not required; (ii) it is not necessary to estimate the consequences of failures;
(iii) the inspection expenditures become more manageable, which allows assessing the impact of
prevention investments on the risk level; (iv) the proposed framework directly provides, as part of the
solution, the information on how the inspection budget should be efciently spent. Then, genetic
operators are tailored for solving this problem given the huge size of the search space. The ability of the
proposed RBIMOGA in providing efcient solutions is evaluated by means of two examples, one of
them involving an oil and gas separator vessel subject to internal and external corrosion that cause
thinning. The obtained results indicate that the proposed genetic operators signicantly reduce the
search space to be explored and RBIMOGA is a valuable method to support decisions concerning the
mechanical integrity of plant equipment.
& 2014 Elsevier Ltd. All rights reserved.

Keywords:
Inspection programs
Risk reduction
Risk-Based Inspection
Multi-Objective Genetic Algorithm

1. Introduction
Past accidents in several types of industries have demonstrated
that equipment malfunction is one of the major causes of unexpected and undesirable events such as toxic and inammable
discharges, re and explosions. Failures to function properly are
usually due to inadequate integrity management systems that
may result in cracks, holes, ruptures, and consequently loss of
containment of dangerous substances. Therefore, integrity control
has been used for guaranteeing aging machineries work in an
appropriate manner, assuring plant safety against adverse occurrences [1].
In this context, inspection has been used as a technique to
examine the real situation of equipment exposed to damage
mechanisms (e.g., thinning, stress corrosion cracking, hightemperature hydrogen attack, mechanical fatigue, brittle fracture),
thus reducing the uncertainty of its condition. The aim is to
identify these potential damage mechanisms and steer efforts in

Corresponding author. Tel./fax: 55 81 2126 7112.

E-mail address: marcio@ceerma.org (M.d.C. Moura).

http://dx.doi.org/10.1016/j.ress.2014.09.018
0951-8320/& 2014 Elsevier Ltd. All rights reserved.

order to prevent failures by prioritizing systems that need more

attention.
Decisions about which equipment should be investigated,
which inspection approach will be performed, and when this
event will take place have become intricate problems due to the
complexity of the involved processes, especially in reneries and
petrochemical industries. Thus, Risk-Based Inspection (RBI) has
been used to support the decision makers in managing the
schedule of those interventions. The fundamental principle of
RBI is quite simple: after a user-dened risk target Rt (i.e. the
acceptable risk) has been chosen, the inspection program is
determined in order to not allow the risk level to exceed Rt ,
thereby avoiding loss of containment and, subsequently, unwelcome effects [2].
Thus, RBI deals with the consequences of holes and ruptures in
pressurized equipment in terms of the area affected by the outcome of the possible release of dangerous materials, and then the
expenses to execute mitigation solutions to the problems caused
by these occurrences. Then, a baseline curve for the risk level
Rk P f k U FC is estimated over time k by combining the probability of failure P f k and the respective nancial consequence FC
for each equipment under analysis.

254

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

In this context, Singh and Markeset [3] proposed an RBI

planning based on fuzzy logic approach for oil and gas carbon
steel pipelines subject to CO2 corrosion. Khan et al. [4] used the RBI
methodology to develop inspection and maintenance strategies
that maximize system availability; the approach is applied to the
steam generating system of an oil eld thermal power plant. Chien
et al. [5] developed a semi-quantitative RBI analysis for pressure
safety valves (PSV) used in lubricant process units. Li et al. [6]
developed an RBI theoretical framework for ship structures using a
decision tree method. In Tien et al. [7], an RBI-based model for
piping systems has been built in accordance with international
standards and local government regulations; the purpose was to
provide inspection-related personnel with the optimal planning
tools, to enable effective predictions of potential piping risks, and
then to enhance the degree of safety in petrochemical industries.
Marangone and Freire [8] applied the RBI methodology in the
management of mechanical integrity of an oil and gas separator
vessel subject to corrosion mechanisms. Vinod et al. [9] applied
the RBI methodology for an H2S-based process plant along with an
approach devised for handling the inuence factor related to the
quantity of H2S released. Shuai et al. [10] used the RBI technology
to assess quantitatively the risk of crude oil tanks in an oil depot
in China.
RBI quantitative analysis yields a tool that enables the recognition
of the actual equipment's situation, and hence the intervention needs
to reduce the risk exposure. Then, the estimation of the risk level Rk
is updated from the data gathered at each inspection epoch in order to
continue representing the current condition of the system. In this way,
the recommended practice [11] provides guidance on developing an
RBI program for xed equipment (including pressure vessel, piping,
tankage, pressure relief devices, and heat exchanger tube bundles) in
rening, petrochemical, and chemical process plants. Thus, Ref. [11]
aims at providing quantitative calculation methods to determine an
inspection plan. Nevertheless, all the aforementioned works have four
main disadvantages:
(i) The user-dened threshold Rt for risk level is not taken into
account as an objective to be optimized. In other words, the
risk measure should be maintained below Rt , but nothing
guarantees that this parameter is chosen in the most efcient
way. On the contrary, the decision maker solves this problem
through a trial-and-error method by changing the inspection
program until the risk target is no longer reached.
(ii) This process of not allowing the risk level Rk to go above the
pre-set target Rt also disregards the costs associated with the
assigned inspection program. For instance, the risk limit Rt may
require an unreasonably high budget if it is chosen to be too low.
(iii) The calculation of the risk measure Rk P f k U FC at some
time k involves the determination of P f k along with FC
considering the loss of containment of a particular equipment.
Even though the screening of critical equipment is usually
carried out using a simplied qualitative approach, Vinod
et al. [9] pointed out that, in general, the number of components to be considered for a quantitative RBI assessment is
still very large. Furthermore, the estimation of FC is a very
laborious task because of the amount of information required.
In fact, determining FC involves the estimation of costs of
equipment repair and replacement, costs of damage to surrounding equipment in affected areas, costs associated with
production losses and business interruption because of downtime to repair or replace damaged equipment, costs due to
potential injuries associated with a failure and environmental
cleanup costs. These categories of costs are added up in order
to estimate FC.
(iv) Finally, it is not possible to point out how and when the
inspection resources should be spent. This means that no

guideline on how to plan the inspections is provided, i.e., how

to determine which techniques have to be adopted and when
they have to be performed in full compliance with international standards and/or local government regulations. For
example, decision makers may face problems on how to
combine inspection techniques: is it better to perform a
number of low-cost/low-effective inspections or fewer
inspections with higher effectiveness, but more expensive?
By effectiveness of an inspection technique, we mean the
ability of detecting and measuring damage mechanisms.
Therefore, this paper proposes an original RBI multi-objectivebased framework, which aims at minimizing both the total risk
level and the costs related to the inspection program. Hence, a
trade-off analysis is required since both objectives are conicting.
In other words, given a planning horizon, the idea is to nd the
optimal compromise between risk and inspection costs, and thus
overcome the aforementioned drawbacks as follows:
(i) The risk target Rt is no longer required a priori because risk is
now an objective to be minimized. In this way, the decision
maker will not be concerned about the inspection policy that
maintains the risk level below Rt . In fact, the inspection
program will be one of the results of the proposed approach.
Moreover, even if the risk must be below a preset target value
Rt (possibly to comply with safety regulations), the proposed
multi-objective problem also allows taking into account a risk
constraint.
(ii) The inspection costs are also handled as an objective. Therefore, as both risk and expenditures with inspection activities
are now considered, the resulting inspection program will be
of great signicance on balancing safety, availability and
inspection cost requirements.
(iii) Despite the large number of equipment that should be
prioritized in a rening or petrochemical facility as well as
the information requirements to estimate the nancial consequences, note that FC is considered constant for a particular
equipment according to Ref. [11]. In this way, only P f k varies
over time k and is updated based on data collected from
inspection, implying that P f k and Rk curves have the same
shape. Thus, in our multi-objective approach, the demanding
step of computing FC is no longer necessary because we will
directly work on P f k instead of Rk, which is equivalent;
even if a risk constraint has to be satised, as commented in
item (i), it can be considered a posteriori as FC becomes
available;
(iv) Finally, the proposed framework provides the decision-maker
with the information on which inspection technique should
or should not be performed at each time-step, which in turn
denes the inspection program. This piece of information will
be associated with each pair of solution (risk or probability of
failure; inspection costs), directly identifying which actions
should be followed for managing risk to a minimal level.
Thus, in the context of RBI, the multi-objective approach
emerges as an alternative to handle the conicting objectives of
risk (or probability of failure) and inspection costs so as to create
efcient inspection policies that comply with regulation standards.
In a multi-objective optimization, a solution that optimizes all
objectives concurrently is very difcult to be reached or it simply
does not exist. In this way, instead of having a unique solution as
in single objective cases, one may obtain a set with multiple
solutions. These solutions, named non-dominated, present a
compromise among objectives and usually do not yield an optimal
value for either of them individually. Once this set is obtained,

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

decision makers can choose any of its elements based on their

preferences, and then implement the selected solution.
Depending on the number of periods considered within the
inspection planning horizon and on the quantity of inspection
techniques available, the number of possible inspection plans can
be prohibitively large for an exhaustive evaluation of their performance. Therefore, a probabilistic approach will be developed for
the quest of inspection programs representing the optimal compromise between both objectives. Heuristic optimization methods,
such as Genetic Algorithms (GAs), have interesting characteristics
to handle multi-objective optimization problems [12] because
(i) they are population-based, i.e., many potential solutions are
simultaneously considered; (ii) they permit a separated treatment
of different objectives, thus not requiring any transformation of
the multiple objectives into a unique function. GAs [13] attempt to
imitate computationally the natural evolution process in which the
ttest individuals are more likely to remain in the population. In
the optimization context, an individual is a potential solution of
the considered problem and a set of individuals is the population,
which evolves according to some genetic-based operators, such as
selection, crossover and mutation.
Then, in this work, a novel Multi-Objective Genetic Algorithm
(MOGA) is developed to minimize both likelihood of failure and
cost subject to constraints imposed by international standards
and/or local regulations. The generation of the initial population,
crossover and mutation are operators devised to create only
feasible inspection plans. In this way, the search space to be
explored by MOGA is reduced, unnecessary evaluations of the
objectives are circumvented and penalty functions are not
required to handle unfeasible solutions.
The remainder of the paper is organized as follows. Section 2
summarizes the RBI methodology. The multi-objective problem is
characterized and formulated in Section 3. Section 4 presents the
MOGA along with the genetic operators tailored for solving the
problem and an overview of the coupling RBIMOGA. In Section 5,
the ability of the proposed RBIMOGA in providing accurate solutions
is rst evaluated for a hypothetical example. Then, in Section 6, the
proposed RBI MOGA approach is applied to an oil and gas separator
vessel subject to internal and external corrosion causing thinning.
Finally, Section 7 provides some concluding remarks.

Usually in an RBI study, a qualitative assessment is primarily

performed in order to obtain a categorized risk level for the considered
equipment. Probabilities and consequences of failures are assigned to
pre-set categories, and then combined into a risk matrix. In general,
equipment with medium high and high risk levels are submitted to a
more detailed quantitative risk analysis [14]. Then, inspection
resources should be allocated by prioritizing these items.
Therefore, the objective of this section is to present the background of the quantitative RBI methodology that draws from Ref.
[11]. More specically, it is summarized how the likelihood of
failure P f k and nancial consequences FC are estimated in order
to provide the risk level Rk over time k.
2.1. Probability of failure
The probability of failure for a given damage mechanism w is
dened as
h

gf f  generic failure frequency for a given equipment and hole

size h and is obtained from a representative failure database, and
h
gf f total h gf f , Dhf_w k  damage factor related to the applicable
h
damage mechanism w and it modies the gf f to make it specic
to the equipment under evaluation, F MS is management system
factor that accounts for the inuence of the facility's management
system on the mechanical integrity of the plant and is often
obtained by the application of a questionnaire, through which a
score in 0; 1000 is measured. Then, F MS 10  0:02:pscore 1 , where
pscore 0:1score.
Thus, P hf_w k is computed for a given type of damage mechanism w and for the different hole sizes h. As it can be seen in Eq. (1),
Dhf_w k is the only factor that makes P hf_w k vary over time, while
h

gf f and F MS are kept constant. It is assumed here that the

equipment of interest is subject to both internal (w1 ) and external
(w2 ) corrosion causing thinning.
2.2. Damage factor, inspection effectiveness and Bayesian updating
The damage factor Dhf_w k is computed with available data
gathered from inspection. Fig. 1 (Step 1Step 6) shows a ow
diagram for determination of the thinning damage factor. Note,
however, that inspection programs (the combination of NonDestructive Evaluation (NDE) methods such as visual, ultrasonic
and/or hydrostatic test, used to determine the equipment
Step 1: Determine the number of
inspections and the corresponding
inspection effectiveness category
for all past inspections. For all past
inspections, combine inspections to
the highest effectiveness performed.
Step 2: Determine the time-in-service
(age) since the last inspection reading.

Step 3: Determine the corrosion rate r.

Step 4: Determine Art using Equation (2).
Step 5: Determine damage factor using
Table 2.

2. Risk-Based Inspection

P hf_w k gf f U Dhf_w k U F MS ;

255

where k is a given time period, h is the different release hole sizes.

Four values for h are here considered: 1=4'', 1'', 4'' and 16'', which
correspond to small, medium, large and rupture, respectively,

Step 6:
Determine the adjustment factors:
- Online Monitoring
- Injection/Mix Points
- Dead Legs
- Welded Construction
- Maintenance
- Settlement

Determine damage factor for

thinning using Equation (3).

Obs: Note that the

damage factor is computed
for the three damage states 1 (r),
2 (2r) and 3 (4r).

Step 7: Update the degree of

confidence by using Equation (4) and
estimate the probability of failure at
k for the hole size h via Equation (5).
Step 8: Compute the total probability
of failure at time k through
Equation (6).
Fig. 1. Determination of the probability of failure.

256

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

condition) vary in their effectiveness for locating and sizing

damage, and therefore for determining corrosion rates and the
respective damage factor. These limitations may result from the
inability to cover 100% of the areas subject to damage, inappropriate training of personnel as well as from inherent inadequacy of
some test methods to identify and estimate damage [15].
In this way, the corrosion rate r, which is determined by
inspection, is uncertain, and such an uncertainty is propagated
to Dhf_w k and P hf_w k. Therefore, it is recommended to use
inspection techniques of adequate effectiveness to increase the
degree of condence on the observed r. Table 1 classies the
inspection effectiveness into ve categories from highly effective
(A) to ineffective (E). In fact, the more thorough the inspection
program, the smaller the uncertainty on r.
However, decision makers may not assign inspection plans only
composed of the highest effective techniques available because of
budget constraints. In fact, they combine over equipment's life lowcost/low-effective inspections with higher effective, but more expensive inspections. In Fig. 1 Step 1, note that we need to determine the
number of all past inspections and their corresponding effectiveness
category to estimate Dhf_w k. It is also possible to combine inspections
to the highest effectiveness performed as 2B 1A, 2C 1B and
2D 1C. Note that these rules are not applied to category E.
Next, in Fig. 1 Step 4, we estimate the metal loss parameter
Art , which is determined from age (time in service since the last
inspection) given in Fig. 1 Step 2, and the corrosion rate r that is
estimated in Fig. 1 Step 3, as follows:




t  r:age
Art max 1  rd
; 0:0 ;
2
t min C allow
where t rd is the thickness reading, t min is the minimum required
wall thickness, C allow is the corrosion allowance.
n
Then, the damage factor Dhf _w
k (Fig. 1 Step 5) is based on the
number of highest effectiveness inspections (Fig. 1 Step 1) and
the value of Art (Fig. 1 Step 4). Thus, depending on these two
n
pieces of information, Dhf _w
k is chosen from Table 2. Moreover, as
shown in Fig. 1 Step 6, we may take into account adjustment
factors for on-line monitoring F OM , injection/mix points F IP , dead
legs F DL , welded construction F WD , maintenance F MA and settlen
ment F SM in order to update Dhf _w
k, as follows in Eq. (3):
Dhf_w k

Dhf wn k:F IP :F DL :F WD :F MA :F SM
F OM

As we argued previously, the corrosion rate r is a random variable

and because of imperfect inspections, the estimated r may differ
from the actual corrosion rate. Additionally, even for k 0 (at the
beginning of equipment's life), when useful data may not be
available, we need to predict Dhf_w k at a point in the future.
Given this uncertainty on r, a conservative standpoint is
adopted since it is assumed that it is possible to observe corrosion
rates twice or even four times higher than the one estimated
by the inspection technique; we call these situations: damage
states 1, 2 and 3 for the cases for which the corrosion rates are r, 2r

and 4r, respectively. Generally, these higher-than-expected corrosion rates are localized in some points of equipment, but they
usually remain undetected until failure occurs [15]. However, the
better the quality of reliability data, the lower the chance of
occurrence of damage states 2 and 3.
Table 3 shows the degree of condence, 0 r , that the actual
corrosion rate r falls into these three possible discrete damage
states i 1; 2; 3; 0 r is assigned based on the source and quality
of the data available at k 0. Thus, the information given in
Table 3 may be used as a priori degree of condence on the
corrosion rate r at k 0, which should be updated in order to
consider the current damage state of the equipment whenever
new inspections are performed at some time k 4 0 in the future.
This updating step, which measures the impact of the inspection
program on the degree of condence on r (and on the state
damage), may be done through Bayesian inference [16] as follows:
k r i jr

Lk rjr i U k  1 r i
;
Lk rjr 1 U k  1 r 1 Lk rjr 2 U k  1 r 2 Lk rjr 3 U k  1 r 3
4

where i 1; 2; 3 is the damage state, k 1; ; m is the time step,

m is the number of time steps considered in the planning horizon, r
is the observed corrosion rate estimated from inspection, r 1 r,
r 2 2r and r 3 4r is the corrosion rates related to damage states 1,
2 and 3, respectively, k  1 r i is the prior probability of the damage
state i at time k, Lk rjr i is the likelihood of observing the result r of
an inspection performed at k given that the equipment item is
under the damage state i, k r i jr is the posterior distribution for the
damage state i. Note that k r i jr becomes the prior distribution
when the next inspection takes place, which permits the Bayesian
updating of the degree of condence on r.
The likelihood Lk rjr i depends on the effectiveness of the
inspection technique. Indeed, Table 4 quantitatively expresses this
classication as the likelihood that the observed damage state
(collected from an inspection program) actually represents the
true state. Thus, Eq. (4) provides a manner to update the degree of
condence based on the inspection effectiveness. In this way, it is
expected that the knowledge acquired from the inspection program reduces the uncertainty about the actual deterioration state
of the equipment, and this information is used to bring up-to-date
the corrosion rate r, the damage factor Dhf_w k, and then P hf_w k.
In fact, there will exist a different damage factor Dhf_w k; r i for
each damage state 1 r 1 r), 2 (r 2 2r) and 3 (r 3 4r) as it is
indicated in a remark in Fig. 1. Then, by modifying Eq. (1), it
follows that
h

P hf_w k; r i gf f U Dhf_w k; r i U F MS :
Then, P hf_w k is estimated for the hole size h as follows:
3

P hf_w k P hf_w k; r i k r i ;
i1

for

k 0;

P hf_w k P hf_w k; r i k r i jr ;

otherwise:

i1

Table 1
Inspection effectiveness categories.
Source: Ref. [11]
Qualitative inspection
effectiveness category

Description

(A) Highly effective

(B) Usually effective
(C) Fairly effective
(D) Poorly effective
(E) Ineffective

The inspection methods will correctly identify the true damage state in nearly every case (or 80100% condence).
The inspection methods will correctly identify the true damage state most of the time (or 6080% condence).
The inspection methods will correctly identify the true damage state about half of the time (or 4060% condence).
The inspection methods will provide little information to correctly identify the true damage state (or 2040% condence).
The inspection method will provide no or almost no information that will correctly identify the true damage state and are
considered ineffective for detecting the specic damage mechanism (less than 20% condence).

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

257

Table 2
Thinning damage factors.
Source: Ref. [11]
Art

Inspection effectiveness
E

1 Inspection

2 Inspections

3 Inspections

0.02
0.04
0.06
0.08
0.1
0.12
0.14
0.16
0.18
0.2
0.25
0.3
0.35
0.4
0.45
0.5
0.55
0.6
0.65

1
1
1
1
2
6
20
90
250
400
520
650
750
900
1050
1200
1350
1500
1900

1
1
1
1
2
5
17
70
200
300
450
550
650
800
900
1100
1200
1400
1700

1
1
1
1
1
3
10
50
130
210
290
400
550
700
810
970
1130
1250
1400

1
1
1
1
1
2
6
20
70
110
150
200
300
400
500
600
700
850
1000

1
1
1
1
1
1
1
3
7
15
20
30
80
130
200
270
350
500
700

1
1
1
1
1
4
13
50
170
290
350
400
600
700
800
1000
1100
1300
1600

1
1
1
1
1
2
6
20
70
120
170
200
300
400
500
600
750
900
1105

1
1
1
1
1
1
1
4
10
20
30
40
80
120
160
200
300
400
670

1
1
1
1
1
1
1
1
1
1
2
4
10
30
40
60
100
230
530

1
1
1
1
1
3
10
40
130
260
240
320
540
600
700
900
1000
1200
1300

1
1
1
1
1
1
3
10
35
60
80
110
150
200
270
360
500
620
880

1
1
1
1
1
1
1
1
3
5
6
9
20
50
60
80
130
250
550

1
1
1
1
1
1
1
1
1
1
1
2
5
10
20
40
90
210
500

0.02
0.04
0.06
0.08
0.1
0.12
0.14
0.16
0.18
0.2
0.25
0.3
0.35
0.4
0.45
0.5
0.55
0.6
0.65

1
1
1
1
2
6
20
90
250
400
520
650
750
900
1050
1200
1350
1500
1900

1
1
1
1
1
2
7
30
100
180
200
240
440
500
600
800
900
1000
1200

1
1
1
1
1
1
2
5
15
20
30
50
90
140
200
270
350
450
700

1
1
1
1
1
1
1
1
1
2
2
4
10
20
30
50
100
220
530

1
1
1
1
1
1
1
1
1
1
1
2
4
8
15
40
90
210
500

1
1
1
1
1
2
5
20
70
120
150
180
350
400
500
700
800
900
1100

1
1
1
1
1
1
1
2
7
10
15
25
70
110
160
210
260
360
640

1
1
1
1
1
1
1
1
1
1
2
3
6
10
20
40
90
210
500

1
1
1
1
1
1
1
1
1
1
1
2
4
8
15
40
90
210
500

1
1
1
1
1
1
4
14
50
100
120
150
280
350
400
600
700
800
1000

1
1
1
1
1
1
1
1
3
6
7
10
40
90
130
180
240
300
600

1
1
1
1
1
1
1
1
1
1
1
2
5
9
20
40
90
210
500

1
1
1
1
1
1
1
1
1
1
1
2
4
8
15
40
90
210
500

Table 3
Condence in predicted damage rate.
Source: Ref. [15]
Lowreliability
data

Moderatereliability
data

High-reliability data

Predicted
Damage State 1: The damage in the equipment The rate of general corrosion is less than or
is no worse than what is expected based on equal to the rate predicted by past inspection rate (r) or
less
records, or historical data if no inspections
damage rate models or experience.
have been performed.

0.50

0.70

0.80

Damage State 2: The damage in the equipment The rate of general corrosion is as much as
twice the predicted rate.
is somewhat worse than anticipated. This
level of damage is sometimes seen in similar
equipment items.

Predicted
rate (r) to
two times
rate (2r)

0.30

0.20

0.15

Damage State 3: The damage in the equipment The rate of general corrosion is as much as
is considerably worse than anticipated. This four times the predicted rate.
level of damage is rarely seen in similar
equipment items, but has been observed on
occasion industry-wide.

Two (2r) to
four times
(4r)
predicted
rate

0.20

0.10

0.05

(a) Published
data
(b) Corrosion
rate tables

(a) Laboratory
testing
(b) Limited
coupon
corrosion
testing

(a) Field data

Damage state category

Examples

Example-general corrosion

Actual
damage
rate range

(b) Coupon data

reecting ve or more
years of experience
with the process
equipment

258

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

Table 4
General corrosioninspection effectiveness.
Source: Ref. [15]
Damage rate
state

Range of factual damage rate

Likelihood that
inspection result
determines the true
damage
A

1
2

Measured rate or less

Measured rate to 2  measured
rate
24  measured rate

D/E

0.90 0.70 0.50 0.33

0.09 0.20 0.30 0.33
0.01 0.10 0.20 0.33

First part of Eq. (5) allows propagating the uncertainty on the state
damage to P hf_w k at k 0, when just information given in Table 3
is available. As an inspection technique is performed at k 4 0, we
update the degree of condence on the state damage based on
information in Table 4 and via Eq. (4), which yields k r i jr , and
then we estimate P hf_w k. In this way, the effectiveness of the
inspection techniques performed at each period k, which is
determined in the adopted inspection program, directly inuences
the computation of P hf_w k. Thus, Eq. (5) provides (Fig. 1 Step 7)
the up-to-date P hf_w k for one damage mechanism w, for which
the total probability is given in Fig. 1 Step 8 as follows:
P f _w k P hf_w k:

However, note that the procedure of Fig. 1 should be repeated

twice as the equipment of interest is subject to internal (w1 IC)
and external (w2 EC) corrosion. Thus, P f _wi k (i 1; 2) should be
estimated for both types by considering the internal (r w1 ) and
external (r w2 ) corrosion rates. Then, by assuming w1 and w2 are
independent mechanisms, it follows that
P f k P f _w1 k P f _w2 k  P f _w1 k:P f _w2 k:

2.3. Consequence of failure

In accordance with the API-RBI methodology, the consequences
of failures may be expressed in nancial terms (FC). According to
[11], the steps of a consequence analysis for a xed pressurized
equipment are as follows:

determine the representative uid;

select a set of release hole sizes;
calculate theoretical release rate/mass;
estimate uid inventory;
establish release type;
estimate impact of detection and isolation systems;
calculate adjusted release rate/mass;
determine ammable/explosive consequences;
determine toxic consequences;
determine non-ammable and non-toxic consequences;
determine component damage and personnel injury consequence areas (CA);
determine FC.

The underlying idea of a level 1 consequence analysis is to

estimate the consequences of releases of hazardous uids at the
hole size h level for which there are several costs to take into
account. First, the API-RBI methodology recommends that we
consider the costs of repair and replacement (FC rep ) of damaged

equipment, which are calculated as

!
h
h gf f :holecost h
FC rep
:matcost;
gf f total
where holecost h is the equipment repair costs ($) based on carbon
steel prices and matcost is a material cost factor to adjust FC rep to
other materials. Costs of damage to surrounding equipment in
affected areas (FC af f a ) should also be included if the failure results
in a ammable (or explosive) event. In fact, these costs are given as
FC af f a CAcmd :equipcost;
where CAcmd is the nal damage consequence area (m2 ) and
equipcost is the process unit replacement cost for components
($=m2 ).
Costs associated with production losses and business interruption as a result of downtime for repair or replacement of damaged
equipment (FC prod ) are also considered. These costs are determined based on the amount of downtime associated with the
specic equipment that were subject to a loss of containment and
all equipment also affected by the release in the consequence area.
Then, this cost is given as


FC prod Outagecmd Outageaf f a :prodcost;


h
where Outagecmd h gf f :Outageh =gf f total :Outagemult is the
weighted (on release hole size) number of days of downtime
required to repair the specic piece of equipment that is being
evaluated (days), Outageh is the number of downtime days to
repair damage associated with the h release hole size (days),
Outagemult is the equipment outage multiplier, Outageaf f a number
of days of downtime required to repair damage to the surrounding
equipment (days), prodcost cost of lost production due to downtime to repair equipment ($=days).
Other costs to consider are those due to potential casualties of
personnel and/or of communities in the vicinity, which are given as
FC inj CAinj :poddens:injcost;
where CAinj is the nal personnel injury consequence area (m2 ),
poddens is the population density of personnel or employees in the
unit (personnel=m2 ), and injcost is the cost associated with serious
injury of fatality of personnel ($). Finally, the environmental cleanup


h
h
costs (FC env ) are also estimated as FC env h gf f :volenv =gf f total :
envcost ,where envcost is the environmental clean-up costs ($=barrel),
h

volenv is the spill volume in barrels to be cleaned up calculated for

each of the 4 release hole sizes selected. The fraction of the released
h

liquid pool that evaporates is also needed to estimate volenv .

Then, FC may be estimated adding up all abovementioned
individual costs as in Eq. (8):
FC FC rep FC af f a FC prod FC inj FC env :

Even though the consequence of failure FC needs to be evaluated

only once for a particular equipment, this step of a quantitative RBI
assessment is still very demanding. First, because of the large
amount of information requirements necessary to feed the equations previously presented even in a level 1 consequence analysis.
Indeed, note that these expressions are given in a summarized
format since they encapsulate other pieces of information. For
h
example, volenv depends on the fraction of material that will
evaporate, the uid liquid density, and the normal boiling point.
Moreover, giving the same level of attention to all equipment is
practically impossible due to the huge number of components in
reneries and petrochemical industries; even after prioritizing
equipment based on a preliminary qualitative risk analysis, the
number of components to be evaluated quantitatively is still
very large.

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

Note that, in order to obtain efcient inspection programs, the

proposed RBI multi-objective framework does not require the
calculation of FC. In fact, since FC is kept constant over time
(API-RBI methodology [11]), only the damage factor needs to be
re-computed at every k, which then allows updating P f k. Thus,
this feature results in a considerable reduction of effort.

259

presented, with no upper limiting value for Rx. Therefore, the

proposed approach is general, allowing the consideration of a risk
constraint in a posterior step, as soon as FC has been computed.
Thus, the identication of the valid inspection plans is a simple
task as they would be in the region of the Pareto front dened by
the risk constraint. This characteristic will be shown in the
application example in Section 6.

3. Problem statement and formulation

4. Proposed Multi-Objective Genetic Algorithm
Let an inspection program x be represented by the following
vector:
x x1;1 ; ; x1;k ; ; x1;m ; ; xj;1 ; ; xj;k ; ; xj;m ; ;
xn;1 ; ; xn;k ; ; xn;m ;

where n is the number of available NDE inspection techniques and

m is the number of time steps considered in the planning horizon.
Each element xj;k of x is either 0 or 1, j 1; ; n and k 1; ; m. If
xj;k 1, then the inspection technique j is performed at k. Otherwise, there is no inspection of type j at k. In this way, at period k, at
most one inspection using technique j is allowed. Notice that
various inspection methods are allowed in the same period k, as
they may provide different information about the actual state of
equipment. In this case, however, we apply the Bayesian updating
given in Eq. (4) considering the inspection technique of highest
effectiveness.
The multi-objective optimization problem, which consists of
selecting efcient inspection programs x that represent the compromise between C x and P f x is formally dened as follows:
!
n

min C x

j1

cj xj;k cp xj;k cd xj;k ;

j1k1
k1
j A J' k 1

10

min P f x P f k;

11

s:t: xj; 1 xj; t j; max 1 Z1; 8 j:

12

k1

The inspection cost objective function (Eq. (10)) is related to the

inspection activity, where cj is the cost of performing inspection
using technique j, cp is the cost of qualied personnel per
inspection, cd is the downtime cost per period, and J' is the set
of intrusive inspection techniques that require entry into the
equipment, causing downtime. Eq. (11) corresponds to the total
P f x associated with an inspection program x within the planning
horizon m; it is the sum of P f k that comes from Eq. (7). Note that
P f k directly depends on the damage factor and on the effectiveness of the inspections that compose program x, as explained in
Section 2.2.
Yet, international standards and/or local government regulations (such as the Brazilian Regulation Standard ([17]) generally
establish that an inspection technique j should be performed at
least once within a given time period. In this way, it is possible to
dene a maximum allowed interval (t j; max , j 1; ; n) between
consecutive inspections. By taking this into account, Eq. (12) is
written, where represents a period with an inspection (xj; 1)
and can possibly assume any of the values 1; ; m  t j; max  1.
Thus, the constraints in Eq. (12) concern the summations of
inspections over groups of t j; max 1 periods, which have to be at
least 1, i.e., at least one inspection technique j has to be performed
in such an interval.
A risk constraint, i.e. Rx r Rt or equivalently P f x r Rt =FC,
could be added to the multi-objective formulations (10)(12). In
this case, the knowledge of FC would be required a priori and all
the obtained solutions (inspection plans) would present
P f x r Rt =FC. Indeed, such solutions are a subset of the set of
inspection plans resulting from the problems (10)(12) as it is

In a multi-objective optimization, a set of non-dominated

solutions is obtained representing the compromise among objectives. Thus, the concept of (non-)dominance relation plays a
central role in multi-objective techniques. A solution is nondominated if, for all objectives, it has a performance at least as
good as that of the other solutions and, at least for one of the
objectives, its performance overcomes that of the others. On the
other hand, the dominance relation is mathematically dened as
follows:
 
 
 
x1 g x2 3 f i x1 r f i x2 ; 8 i and f i x1 o f i x2 for some i;
13
where g denotes dominance, x1 is a non-dominated solution for
a minimization problem and x2 is a dominated solution for the
same problem; f i denotes the ith objective function (e.g.,
C x; P f x). If one of the conditions on the right-hand side of
Eq. (13) is not satised, both x1 and x2 are said to be nondominated. That is, for a number of objectives, x1 overcomes the
performance of x2 and, for the remaining objectives, x2 overcomes
the performance of x1 . The non-dominance relation is also
observed when x1 x2 .
In this section, the proposed MOGA is tailored for solving
problems (10)(12). First, one of the characteristic of this approach
is that the genetic operators provide only feasible inspection
programs as outcomes. This feature has the following advantages:
(i) the search space to be explored by the MOGA is reduced; (ii) the
MOGA is prevented from getting stuck into an unfeasible part of
the search space; (iii) unnecessary tness evaluations of unfeasible
individuals are avoided; and (iv) the use of penalty functions due
to unfeasibility is not required.
For the problem characterized in Section 3, the total number of
solutions in the search space, when the constraints in Eq. (12) are
not taken into account, is given by 2n:m . The number of feasible
inspection plans for a given technique j is am;pj xm f pj x, which
is dened as the coefcient of xm in the x-power series expansion
of f pj x, where


2 x x2 xpj  xpj
;
f pj x
1 x  x2   xpj
for pj t j;max 1. Hence, the percentage of the search space
concerning feasible inspection plans is given by
am;p1 U am;p2 U U am;pn
 100%:
2m U n
As an illustration, suppose n 1, m 20, p 3 (thus, t 1;max 2).
The x-power series expansion of f pj x is
2x 4x2 7x3 13x4 24x5
44x6 81x7 149x8 274x9 504x10 927x11
1; 705x12 3; 136x13 5; 768x14 10; 609x15 19; 513x16
35; 890x17 66; 012x18
121; 415x19 223; 317x20 :
Therefore, the number of feasible inspection programs is
a20;3 223; 317 and it represents about 21:3% of the search space.

260

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

For further details on enumeration techniques, the interested

reader is referred to [18].
The next sections detail the individual representation along
with the proposed genetic operators for the generation of initial
population, crossover and mutation. Recursive algorithms are
developed for the elaboration of inspection plans. Feasibility
evaluation of xj; 1 , , xj; t j; max 1 is required whenever an
inspection takes place (i.e., xj; 1) and for every technique
j 1; ; n. The selection and update of the auxiliary population
P aux are the same as those presented in Ref. [19]. The selection is
based on the (non-)dominance relation among solutions. Dominated solutions are eliminated from the current population and
the non-dominated ones are stored in P aux . In order to recover the
number of individuals N in population, solutions from P aux are
randomly chosen. P aux is updated at every iteration of the algorithm. For further details, the reader is referred to [19].
Fig. 2. Generation of a feasible plan for a given technique.

4.1. Individual representation

An individual is represented by the vector in Eq. (9), whose
entries are either 1 or 0 if an inspection using the related technique
is either or not performed in the associated period, respectively.
Here, an integer representation of individuals is adopted.
For the sake of illustration, consider n 3, m 6, t 1;max 2,
t 2;max 3, t 3;max 4 and the inspection plan in Table 5, indicating
an inspection plan such that: (i) the rst technique should be
performed at periods 2 and 5; (ii) the second technique should be
performed at periods 1, 3 and 4; and (iii) the third technique
should be performed at periods 1 and 6.
4.2. Generation of initial population
Each of the N individuals of the initial population is randomly
generated according to a discrete uniform distribution with additional features to handle unfeasibility, which are presented in the
algorithm of Fig. 2. The underlying idea of the algorithm is that, for
a given technique j, every time an inspection is established
(xj; 1), a new group of values for the future periods xj; 1 ,
,xj; t j; max 1 is generated for feasibility investigation. In this way,
an inspection to be carried out at period requires the restart of
the algorithm from 1.
Indeed, groups of t j;max 1 periods, starting from 1, are
considered one at a time. The values xj;b , b 1; ; t j;max 1
are randomly set either to 0 or to 1, and whenever xj;b 1, a
recursion of the algorithm starting from b 1 is required. If all xj;b
are equal to 0, then no inspection is performed within the
considered period (S 0), and the constraint in Eq. (12) is violated.
In order to tackle the unfeasibility, a position p among
1; ; t j;max 1 is selected and the corresponding value is
set to 1; then, a recursion with p as argument is called. These steps
are repeated until the nal period m is reached. Once this
reasoning is applied for each of the n considered techniques, a
feasible individual is generated.
4.3. Crossover and replacement
Since the values of xj;b are either 0 or 1, the usual binary
crossover [20] is performed between two individuals (parents, e.g.,

Period
Inspection plan

1
0

2
1

3
0

4
0

Technique 2
5
1

6
0

1
1

2
0

3
1

4
1

x1 and x2 ). Such an operator is combined to a procedure devised to

evaluate the offspring feasibility and to transform unfeasible
individuals that might have been created into feasible ones. The
parents' positions are interchanged at randomly chosen cut points
(c) so that to generate two new individuals: child 1 and child
2 that are, respectively, the modied x1 and x2 , since the replacement is automatically performed (children replace parents). Fig. 3a
depicts the crossover between two individuals when n 3, m 6,
c 4, t 1;max 2, t 2;max 3, and t 3;max 4. Then, the investigation
and handling of an eventual unfeasibility for each new individual,
per technique, take place.
The algorithm used to perform these tasks is essentially
the same as in Fig. 2; the only exception is step 1(b), given that
in the crossover the values xj;b are not created. Note that for the
illustrated example, the crossover procedure generated an unfeasible offspring (child 2) that violated the maximum number of
periods without an inspection using technique 1. In Fig. 3b, the
unfeasibility is identied and a possible solution is given. As an
outcome, child 2 becomes feasible.

4.4. Mutation

Table 5
Individual representation for MOGA (inspection plan).
Technique 1

Fig. 3. (a) Example of binary crossover procedure and (b) solving unfeasibility of
child 2.

Technique 3
5
0

6
0

1
1

2
0

3
0

4
0

5
0

6
1

As in the crossover, given that either xj;k 0 or xj;k 1, 8 j and

8 k, the binary mutation [20] combined to a mechanism to render
eventual unfeasible individuals into feasible ones is applied. For
every position, a uniform random number u A 0; 1 is generated;
given a position j; k, if u is less than or equal to the mutation

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

MOGA+RBI
h

Obtain gff ,
h = 1/4, 1, 4, 16,
and FMS via RBI

Start

Generation of
initial population
Selection and
Paux update

Generation number = 0

Crossover
Replacement

Mutation

No

Pf (x ) via RBI
(Sections 2.1 and 2.2)
C(xi)

i = 1, ..., N

Fitness evaluation

probability (pm ), the value of xj;k is changed either (i) from 0 to 1 or

(ii) from 1 to 0; otherwise, xj;k remains the same.
Note that only mutations of type (ii) generate unfeasibility,
since additional inspections due to type (i) mutations do not harm
the individual's feasibility. In this way, whenever a mutation of
type (ii) occurs, the related technique and period are stored in
vectors it and ip, respectively. Once all positions of an individual
have been submitted to the binary mutation procedure, it and ip
are of the same length (jitj jipj). If it and ip are both empty,
which means no mutations of type (ii) have happened, the related
individual is still feasible.
On the other hand, if jitj jipj 4 0, it is necessary to investigate
eventual unfeasibility arising due to type (ii) mutations. If technique j and period k are, respectively, at the same positions of it and
ip and the corresponding mutation resulted in an unfeasibility
(a greater number of periods without inspections using technique j
than permitted), the xj;k value is restored to 1 as if no mutation had
taken place at position j; k. Otherwise, if a mutation of type
(ii) has occurred but has not generated an unfeasibility, the product
of the mutation remains unchanged, i.e. xj;k 0. The idea is to modify
individuals as least as possible after the mutation operator has been
applied in order to preserve the MOGA evolution trend.
The algorithm of Fig. 4 summarizes the investigation procedure
for unfeasibility over an individual for a given technique as well as
their associated treatment in order to render the inspection plan
feasible. Note that steps until (iii) are basically the same as in
algorithm of Fig. 2. These steps are necessary because of alterations in feasibility analysis due to possible 1's provided by
mutations of type (i), which also demand the recursion of the
algorithm starting from the immediate subsequent position. The
elements of it and ip that are eliminated in steps 4 and 5 are those
involving already solved unfeasibility. Thus, at the end, if
jitj jipj 4 0, the remaining elements refer to positions that have
been submitted to type (ii) mutations but have not generated
unfeasibility.

261

Maximum
number of generations is
reached?

Yes
Update Paux

4.5. Overview of the proposed RBI MOGA framework

The proposed approach couples the RBI methodology described
in Section 2 to the MOGA-based optimization procedure previously presented, which entails constraints to comply with
possible existing international standards and/or regulations. An
overview of RBI MOGA is provided in the owchart of Fig. 5.

Fig. 4. Evaluation and solution of eventual unfeasibility after mutation.

End

Fig. 5. Proposed RBI MOGA.

5. Numerical experiments
In this section, a numerical example is solved by the proposed
RBI MOGA approach in order to compare the obtained results
against the real non-dominated inspection plans, which are in turn
provided by an exhaustive recursive algorithm. A planning horizon
of m 10 years is considered, n 3 inspection techniques are
available, and two damage mechanisms act on the equipment
(internal and external corrosion) both causing thinning. Techniques 2 and 3 require equipment shutdown; thus they generate
downtime costs. This example has 113,092,992 feasible inspection
plans, which represent 10.53% of the entire search space, and 46
non-dominated solutions.
The required parameters for computing C x (Eq. (10)) and P f x
(Eq. (11)) are presented in Table 6; consider also that lowreliability data (see Table 3) was available at k 0 to estimate
h
the corrosion rates. The gf f for h 1/4, 1, 4 and 16 are,
respectively, 8  10  6 ; 2  10  5 ; 2  10  6 and 6  10  7 failures per year and F MS 1. Table 7 presents the MOGA parameters.
In order to evaluate the stochastic behavior of RBI MOGA, we
ran 100 replications. Some descriptive statistics are shown in
Table 8. In all cases, RBI MOGA was able to nd almost all
solutions from the true Pareto front. In the worst case, about
91% of the exact solutions were provided by RBI MOGA. Such a
proportion is approximately 98% for the best case. The exhaustive

262

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

Table 6
RBI parameters and inspection costs, validation example.
Technique

1
2
3

t j; max (years)

1
3
7

cj

1000
5000
10,000

cp
cd
100
500
F OM F IP F DL F WD F MA F SM 1

Damage mechanism

Thickness (mm)

Internal corrosion
Effectiveness

External corrosion

Initial

E
B
A

B
B
A

12

Corrosion rate r (mm/year)

r IC 0:4

0.08
0.06

Value
size (N)
generations (Ngen)
of crossover (pc)
cut points (c)
of mutation (pm)

250
500
0.95
8
0.05

Pf(x)

Population
Number of
Probability
Number of
Probability

10

Corrosion allowance C allow (mm)

1

r EC 0:6

Table 7
MOGA parameters.
Parameter

Minimum (t min )

0.04
0.02
0.00
4

10

C(x) (in 104)

Table 8
Results for validation example: 100 replications of RBI MOGA.
Statistics

Number of solutions

Number of exact solutions

Minimum
Median
Maximum
Mean
Std. dev.

43
46
46
45.57
0.5730

42
44
45
44.28
0.5333

recursive algorithm required 33 minutes to return the true Pareto

front in a Windows operating system, Intels CoreTM i7 2.20 GHz
processor and 8 GB of RAM, while each run of RBI MOGA took
only about 2.5 s, which is around 0.13% of the time needed by the
exhaustive algorithm. Fig. 6 depicts the true Pareto front along
with the worst and best cases. It can be observed that even the
worst RBI MOGA front is near the true one.

6. Application example: oil and gas separator vessel

In this section, the proposed RBI MOGA is applied to obtain
non-dominated inspection programs for a separator vessel of oil
and gas by considering n 3 inspection techniques (1: external
exam; 2: internal exam; 3: hydrostatic test) and a horizon of
m 20 years. This equipment item is exposed to internal and
external corrosions that cause thinning. It is here considered that
external exams are ineffective (E) to evaluate internal corrosion,
while they are usually effective (B) to measure thinning due to
external corrosion. Internal exams are treated as usually effective
(B) for internal and external corrosions, and the hydrostatic test is
highly effective (A) for both damage mechanisms. Both internal
exam and hydrostatic test are intrusive techniques; thus they
generate downtime costs.
The Brazilian Regulation Standard ([17]) establishes maximum
times to perform at least one inspection for these three techniques: 4, 8 and 16 years, respectively. Thus, t 1;max 3, t 2;max 7, and
t 3;max 15 years; it was considered a Type II vessel and a plant that
h
has its Own Service of Inspection (see Ref. [17]). The same gf f
and F MS values used in the previous example are here adopted.

Fig. 6. Exact and simulated Pareto fronts for validation example.

Inspection costs along with the characteristics of the damage

mechanisms, which are used to calculate C x, Art , Dhf_w k, P f k
and P f x, are summarized in Table 9. The MOGA parameters are
the same as in Table 7, but the number of cut points is c 15. For
this problem setting, the number of feasible inspection programs
is in the order of 1017 and it represents 50.77% of the entire search
space. The exhaustive evaluation of these feasible programs is
impossible in practice. Then, we need to resort to the MOGA
algorithm developed in Section 4.
For this application, the plan with inspection activities performed as late as possible in accordance with [17] (see Table 10)
was forced to be in the initial population so as to guarantee that it
would be evaluated by RBI MOGA. The gray cells in Table 10
represent that an inspection is to be performed in the associated
period (column) using a specic technique (row). Note that such
an inspection program is not the only one suggested by [17], but it
is the rst that comes to mind, as it would be, at rst glance, the
cheapest one that still complies with this particular regulation
standard.
For this example, RBI MOGA was replicated 30 times and each
run required approximately 5 s to be performed. All fronts were
similar and some descriptive statistics are shown in Table 11.
However, instead of using one of these 30 fronts, an evaluation of
the (non) dominance relation among the solutions of all fronts was
performed. The resulting Pareto front contains 122 solutions and is
presented in Fig. 7.
The inspection programs (IP i ; i 1; 2; 3) associated with the
solutions indicated in Fig. 7 are presented in Table 12. If solution
IP 1 and the one presented in Table 10 are compared, one may
conclude that in spite of having the same inspection cost for the
20 years, a slight modication in the schedule of techniques
1 and 2 resulted in a smaller P f x for solution IP 1 . Thus, the
inspection plan of Table 10 is dominated by solution IP 1 .
For the sake of illustration, Fig. 8 exemplies how P f k for
solution IP 1 varies over time because of the damage factor and
based on the Bayesian updating procedure given in Section 2. First,
note that P f k is not necessarily a monotone function. This

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

263

Table 9
RBI parameters and inspection costs, application example
Technique

t j; max (years)

1
2
3

cj

3
7
15

Damage mechanism

1000
5000
10,000

cp
cd
300
1000
F OM F IP F DL F WD F MA F SM 1

Thickness (mm)

Internal corrosion
Effectiveness

External corrosion

Initial

Minimum (t min )

E
B
A

B
B
A

16

12

Corrosion rate r (mm/year)

r IC 0:200

r EC 0:454

Corrosion allowance C allow (mm)

1

Table 10
Plan with inspections performed as late as possible in accordance with [17].

Pareto front:

Table 11
Descriptive statistics for the number of solutions per front (30 replications).
Minimum

Median

Maximum

Mean

Std. dev.

112

116

121

116.4

2.2664

0.12

IP1

0.10

Pf(x)

0.08
0.06
0.04

IP2

0.02
IP3

0.00
50000

100000

150000

C(x)
Fig. 7. Pareto front for application example and some selected solutions: C x vs.
P f x

happens because the relatively low-cost/low-effective inspection

techniques 1 and 2 are performed in earlier steps (k o 16 of
equipment's life, whereas the high-cost/high-effective inspection
technique 3 is just adopted at k 16. Indeed, for this case, despite
the expected better condition of the equipment at k o 16, the
uncertainty on the corrosion rate is then high since little helpful
information is available at that period. For instance, consider P f k
at k 12 and the dip at k 16 in Fig. 8. Note that even though a
more severe corrosion rate would be expected at k 16, more
conservative estimates for P f k are provided at k 12 because
more condence is put on state damages 2 and 3 at k 12 since
less relevant information is available. On the other hand, as an
inspection with higher effectiveness is carried out at k 16 one
has more condence in the observed corrosion rate r 1 related to
state damage 1.
A return on investment (ROI) analysis can aid the decision for
the adoption and implementation of an inspection plan from the

ROI

 
 
P f xj  P f xi
 
 ;
C xj  C xi

where i and j are different solutions from the Pareto front. For
example, each monetary unit invested in inspection activities to go
from solution IP 1 to IP 2 corresponds to a reduction of 3:43  10  6
in P f x. On the other hand, from solution IP 2 to IP 3 each additional
monetary unit would reduce P f x by 2:94  10  7 . Thus, high
investments in inspection do not necessarily mean signicant
reductions on the total P f x.
The obtained P f x can be used to compute the risk Rx
associated with every inspection program x from the Pareto front
as the nancial consequence FC is available. In order to illustrate, a
consequence analysis was performed according to Ref. [11] for
the oil and gas separator vessel and FC $ 2; 246; 908:17 was
estimated as given in Section 2.3. The Pareto front presenting
the trade-off between C x and Rx is given in Fig. 9. Note that the
fronts in Figs. 7 and 9 have the same shape and, as expected, the
only difference between them is the scale factor FC, which is
reected in the values of the vertical axis.
If the risk must be smaller than a preset target value Rt ,
possibly to comply with safety regulations, i.e., Rx r Rt or
equivalently P f x r Rt =FC, Pareto solutions satisfying such a constraint are in the region below the corresponding horizontal line
dened by Rt or by Rt =FC in the graphs C x vs. Rx or C x vs. P f x,
respectively. As an illustration, for the present example, if
Rx rRt 45; 000 and consequently P f x r 0:02, there are 87
valid solutions (all of them are under the horizontal lines shown
in Figs. 7 and 9).
It is important to emphasize that in order to obtain the most
efcient inspection programs regarding both C x and Rx through
the proposed RBI MOGA approach, it is not necessary to develop
the very demanding task of assessing the consequences of failure
since the only component that makes the risk level vary over time
is P f x. Thus, the effort to accomplish the analysis is fairly reduced.
Even if a risk constraint is mandatory, it can be considered in a
posterior step, when FC becomes available. This is possible
because, as P f x is an objective to be minimized, such a constraint

264

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

Table 12
Selected solutions from Pareto front.

3.5

Pf(k) x 102

3.0
2.5
2.0
1.5
1.0
0.5
0.0
5

10

15

20

k
Fig. 8. Probability P f k

R(x)

250000

IP1

150000
IP2
50000

taken as an objective, the inspection expenditures become manageable and it was possible to assess the impact of prevention
investments on P f x, and then on Rx; this would not be possible
if only RBI methodology had been adopted.
In the MOGA portion, the genetic operators were adapted for
the creation of only feasible inspection programs, which should be
in compliance with restrictions that might be imposed by international standard and/or local regulations. In this way, MOGA
explored the search space in a more efcient way, as only its
feasible portion had been taken into account.
The proposed RBI MOGA was applied to two examples, one of
them involving an oil and gas separator vessel. For these cases,
it was possible to provide information on how the inspection
budget should be spent more efciently, which involves dening
the whole inspection program associated with each pair (P f x,
C x). An ROI analysis was performed on the obtained nondominated inspection programs and it could be inferred that high
investments in inspection do not necessarily yield a signicant
reduction of P f x (thus, Rx). Finally, the results suggest that the
RBI MOGA with the post-optimization ROI analysis is an effective
tool to support efcient decisions related to mechanical integrity
of equipment.

IP3

0
50000

100000

150000

C(x)
Fig. 9. Pareto front for application example and some selected solutions: C x vs. Rx

is a cut in the obtained Pareto front and the solutions of interest

can be easily identied.

Acknowledgments
The rst three authors thank the Brazilian research-funding
agency Conselho Nacional de Desenvolvimento Cientco e Tecnolgico (CNPq) for the nancial support through research grants.
References

7. Conclusion
In this paper, an original RBI MOGA methodology was developed in order to provide the decision maker with efcient
inspection programs in terms of both inspection costs C x and
risk Rx (by the direct minimization of P f x). The RBI methodology was used to assess P f x related to the candidate inspection
programs x provided by MOGA.
The fact of directly considering P f x as an objective to be
optimized has two advantages: (i) rst, the user-dened risk target
Rt was no longer required as established in [11]; (ii) the step of
estimating the nancial consequences FC of failures may be
skipped, saving a lot of effort and time. Moreover, as C x is also

[1] Bragatto PA, Pittiglio P, Ansaldi S. The management of mechanical integrity

inspections at small-sized Seveso facilities. Reliab Eng Syst Saf 2009;94:
4127.
[2] Conley M. Integrating risk-based inspection into risk management plans.
Process Saf Prog 2005;24:23646.
[3] Singh M, Markeset T. A methodology for risk-based inspection planning of oil
and gas pipes based on fuzzy logic framework. Eng Fail Anal 2009;16:
2098113.
[4] Khan FI, Haddara M, Krishnasamy L. A new methodology for risk-based
availability analysis. IEEE Trans Reliab 2008;57(1):10312.
[5] Chien C-H, Chen C-H, Chao YJ. A strategy for the risk-based inspection of
pressure safety valves. Reliab Eng Syst Saf 2009;94(4):8108.
[6] Li D, Zhang S, Tang W. Risk based inspection planning for ship structures using
a decision tree method. Nav Eng J 2004;116(2):7384.
[7] Tien S-W, Hwang W-T, Tsai C-H. Study of a risk-based piping inspection
guideline system. ISA Trans 2007;46:11926.

M.d.C. Moura et al. / Reliability Engineering and System Safety 133 (2015) 253265

[8] Marangone FC, Freire JLF. Management of the integrity of a pressure vessel
using risk-based inspection (in Portuguese). In: 8a Conferncia sobre Tecnologia de Equipamentos; 2005.
[9] Vinod G, Sharma PK, Santosh TV, Prasad MH, Vaze KK. New approach for risk
based inspection of H2S based process plants. Ann Nucl Energy 2014;66:139.
[10] Shuai J, Han K, Xu X. Risk-based inspection for large-scale crude oil tanks. J
Loss Prev Process Ind 2012;25(1):16675.
[11] API-RBI-581. API (American Petroleum Institute) recommended practice 581:
risk-based inspection technology, 2nd ed. Washington, DC; 2008.
[12] Deb K. Evolutionary algorithms for multicriterion optimization in engineering
design. In: Proceedings of evolutionary algorithms in engineering and computer science (EUROGEN'99); 1999.
[13] Goldberg DE. Genetic algorithms in search, optimization, and machine learning. Reading: Addison-Wesley; 1989.
[14] Modarres M. Risk analysis in engineering: techniques, tools and trends. BocaRaton: Taylor & Francis; 2006.
[15] API-RBI-581. API (American Petroleum Institute) publication 581: risk-based
inspection base resource document. Washington, DC; 2000.

265

[16] Bernardo JM, Smith AFM. Bayesian theory. London, UK: John Wiley & Sons
Ltd.; 1994.
[17] NR-13. Regulamentation standard NR-13 pressure vessels and boilers
(in Portuguese). Ministrio do Trabalho e Emprego do Brasil; 2008.
[18] Lins S. Principles of enumeration (in Portuguese). Rio de Janeiro: Instituto de
Matemtica Pura e Aplicada; 1981.
[19] Lins ID, Droguett EL. Redundancy allocation problems considering systems
with imperfect repairs using multi-objective genetic algorithms and discrete
event simulation. Simul Model Pract Theory 2011;19:36281.
[20] Michalewicz Z. Genetic algorithms data structures evolution programs. 3rd
ed. Berlin: Springer; 1996.