- Email: [email protected]
A Bayesian network-based approach for the assessment and management of ageing in major hazard establishments
Journal Pre-proof A Bayesian network-based approach for the assessment and management of ageing in major hazard establishments Giuseppa Ancione, Paolo Bragatto, Maria Francesca Milazzo PII:
S0950-4230(19)31051-4
DOI:
https://doi.org/10.1016/j.jlp.2020.104080
Reference:
JLPP 104080
To appear in:
Journal of Loss Prevention in the Process Industries
Received Date: 20 December 2019 Revised Date:
12 February 2020
Accepted Date: 19 February 2020
Please cite this article as: Ancione, G., Bragatto, P., Milazzo, M.F., A Bayesian network-based approach for the assessment and management of ageing in major hazard establishments, Journal of Loss Prevention in the Process Industries (2020), doi: https://doi.org/10.1016/j.jlp.2020.104080. This is a PDF file of an article that has undergone enhancements after acceptance, such as the addition of a cover page and metadata, and formatting for readability, but it is not yet the definitive version of record. This version will undergo additional copyediting, typesetting and review before it is published in its final form, but we are providing this version to give early visibility of the article. Please note that, during the production process, errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain. © 2020 Published by Elsevier Ltd.
A Bayesian network-based approach for the assessment and management of ageing in major hazard establishments
Giuseppa Ancione1, Paolo Bragatto2, Maria Francesca Milazzo1* 1
Dipartimento di Ingegneria, University of Messina – Contrada Di Dio, 98166 – Messina – Italy
2
Dipartimento Innovazioni Tecnologiche, INAIL – via Fontana Candida, 1, – Monteporzio, Roma – Italy
*corresponding author: email [email protected]; phone +39 090 6765595
Abstract Currently, there is an increasing attention towards ageing of industrial equipment, as the phenomenon has been recognised a cause of severe accidents, recorded in the last years in many process establishments. Recent studies described ageing through a number of key-factors affecting the phenomenon by accelerating or slowing it down. The Italian Competent Authority for the prevention of Chemical Accidents (Seveso III Directive) adopted a short-cut method, accounting for the assessment of these factors, to evaluate the adequateness of ageing management during inspections at Seveso sites. In this paper, a Bayesian Network was developed, by using the data gathered during the first application of the short-cut method, with the aim to verify the robustness of the approach for ageing assessment and the validity of the a priori assumptions used in assessing the key-factors. The structure of the Bayesian network was established by using experts’ knowledge, whereas the Counting Learning algorithm was adopted to execute the parameter learning by means of the software Netica. The results showed that this network could effectively explore the complex logical and uncertain relationships amongst factors affecting equipment ageing. Results of the present study have been exploited to improve the short-cut method. Keywords: Equipment Ageing; Major Accident Hazard; Seveso Directive; Deterioration Mechanism; Risk-based Inspection; Bayesian Network. Highlights •
Ageing is as a significant cause of major accidents in chemical industries
•
The Bayesian network theory verified the robustness of an ageing assessment method
•
A cross-validation demonstrated a high accuracy of the network in ageing predicting
1. Introduction In 2012, the EU Commission stressed the issue of “equipment ageing” and, in the framework of the new Directive for the prevention of chemical accidents (Seveso III Directive), required the member countries to take actions controlling the hazards due to equipment deterioration. In 2015, after the implementation of the Directive in the Italian legislation, ageing became a priority for the National Seveso Competent Authorities. Since twenty years, a pillar of the Seveso Directives has been the system of “on-site” inspections, which the Competent Authorities must organise to verify the adequateness of the activities done to control major hazards in chemical and process industry. Accordingly, in Italy, more than one third of Seveso establishments are inspected every year. Inspectors must verify several items that are relevant to safety, including policy, organisation, training programs, risk assessment, maintenance programs, management of changes, permits to work, emergency planning, accidents and near-misses investigation, performance indicators, etc. This causes that the time dedicated to ageing assessment is limited, therefore, in formulating decisions for the management of the phenomenon, the answer to the following questions is relevant, i.e. how can inspectors understand the condition of all equipment in a such a short time? is it possible to get a fair evaluation, make reasonable recommendations and eventually give prescriptions to the operators? Furthermore, no statistical data about the actual ageing conditions of equipment in Seveso establishments is available for the Authority to support its assessment, even though the concern for the issue is high both for industrial operators and regulators. To answer these questions, the Italian Competent Authority provided the inspectors with a short-cut method, developed by a working group, including regulators, industrial managers and representatives from academia. The method is an index approach (so-called Ageing FishBone method), which includes the assessment of a number of quantitative key-factors that are assumed to contribute to equipment ageing. These key-factors include age or in-service time, deterioration mechanisms, failures, accidents/near-misses, damages, stops, audits, the integrity management system, adequacy controls (techniques and competences of personnel), inspection results (results of integrity and function verifications and inspection scheduling), physical protections and the process control. Currently, the method has been applied to the primary static containment systems that are classified as critical equipment in the mandatory risk assessment required by the Seveso legislation. The assessment of the key-factors has been discussed in a previous paper by the scientific leaders of working group (Milazzo & Bragatto, 2019). In order to have an approach, shared by all the stakeholders, many trade-offs have been accepted and various a priori assumptions have been made. Due to the lack of data about the actual equipment conditions in the Seveso establishments
throughout Italy, the working group had to trust only on its expertise. As a result, an evaluation method has been delivered that is based on a number of objective synthetic data that are easy to collect during inspections. The scientific literature shows some statistics and analyses of accidents (Fabiano & Currò, 2012; Wood et al., 2013; Pittiglio et al., 2015; Gyenes & Wood, 2016; Kieskamp et al., 2019), but no previous study has been focused on complete definition of an approach for ageing assessment, neither by industry nor by regulators. Since early 2000s, most European national legislations fixed the inspection intervals for pressurised equipment, assuming them independent on their age and conditions. A decade ago, the RBI approach was slowly adopted, therefore, inspection intervals started to be based on conditions, deterioration mechanisms and failure rates (Bragatto et al. 2012). Even this approach was popular in nuclear industry (IAEA, 2009), it was very innovative in chemical and process industry; nevertheless, it allowed adequately facing ageing, by adapting both the type and interval of inspections. A number of papers were consequently published, discussing the issue of extending the equipment lifetime beyond its originally design lifetime (given by the manufacturer), through an intensification of maintenance and inspection activities. Relevant papers to this scope are described in the following. Candreva & Houari (2013) presented a screening tool assessing the adverse impact of ageing on the global plant performance, as well as the collateral impact on major accident prevention programs; it was proposed a score approach aimed at providing a risk profile, which included the adverse effects of ageing. Sobral & Pereira (2015) proposed a methodology to determine the optimal inspection intervals for assets affected by ageing. Ossai et al. (2016) used Markov techniques to address a program of inspection of corroded pipelines at different stages of the corrosion growth; in addition, Monte Carlo simulations and degradation models were applied to determine the depth and growth of future corrosion defects and to establish periodic inspections and repairs procedures. Azipurua at al. (2017) developed an on-line predictive diagnosis algorithm for the prediction of the health of systems; by means of this the operators were provided by suggestions for inspection and maintenance of both critical and non-critical equipment. Andrews & Fecarotti (2017) developed a method aimed at assessing equipment ageing, which considered different factors relevant for ageing (including age, use, condition, inspection, repair and modifications), then, through its combination with a Petri net and a Bayesian network approach, it was able to predict the effect of the various factors. Mohamed et al (2019) identified, ranked, prioritised and grouped 28 critical factors for the successful implementation of RBI; the proposed method was suitable for addressing the ageing management based on an RBI approach. The contribution of the technical literature is highly also valuable and a few reports worth a mention. The British Health and Safety Executive had a pioneer role, with the technical reports RR509
(Wintle et. al 2006) and RR823 (Horrock et al. 2010), which were two pillars of ageing management at Seveso plants over fifteen years, as well as the report of the French INERIS (Prod’homme & Richomme 2010). Even if in the literature, there are several studies about process equipment ageing (Horrocks et al., 2010; Wood et al., 2013; OECD, 2017), as well as about inspection techniques and optimal maintenance decisions, available data are limited and information about key-factors affecting ageing cannot be easily extracted . The application of the Ageing FishBone method represents the first attempt to gather such data in a systematic way. The aim of the present work is to understand if the initial assumptions of the working group are reasonable and, then, if it is possible to update and tune the method by exploiting data gathered during the first inspections. Data collected after this testing period is enough for a first revision the method, i.e. to verify the credibility of the a priori assumptions and adjust them. A typical Bayesian approach supports these objectives. During the first application of the approach, a number of a priori assumptions, based on feeling and experience, are used to gather data and make effective decisions; whereas during the second application, collected evidences are exploited to verify , update assumptions and improve the process of decision-making. Finally, the new data, gathered for each new inspection, could improve recursively the process. Therefore, in this study, a Bayesian network was used to give a general picture of the different factors contributing to ageing, highlighting their actual distributions and relationships. The network was established by using experts’ knowledge, whereas the Counting Learning algorithm was adopted to execute the parameter learning by means of the software Netica (Norsys, 2019). The paper is organised as follows: Section 2 illustrates the construction of the Bayesian network model, based on the Ageing FishBone model; Section 3 presents the case-study used for the development of the Bayesian network model; Section 4 summarised the findings of this study; finally, Section 5 gives some conclusions.
2. The Ageing Bayesian Network model 2.1. Basic concepts of Bayesian Network A Bayesian Network BN (also called Bayes net or belief network and sometimes causal network) is a probabilistic graphical model that can be used for a wide range of activities, including prediction, anomaly detection, diagnostics, automated insight, reasoning, time series prediction and decision making under uncertainty. It is a directed acyclic graph (DAG), consisting of a set of nodes and directed links, that represents a set of variables and the dependences amongst variables; these
dependences are described by using conditional probabilities (Pearls, 1986). A typical mathematical representation of a Bayesian Network is BN =(G, Θ), where BN is a Bayesian network, G is a directed acyclic graph, in which its nodes X1, X2, …Xn represents random variables and its links represent direct dependencies between these variables (the absence of direct connections between two nodes does not imply total independence between them), and Θ represents the set of BN parameters, i.e. the set P(Xi|Ai) (i = 1, 2, …, n) for each realisation of Xi conditioned on the set of Ai (parents of Xi in G). Given G and a probability distribution for each node of G, Equation (1) expresses the conditional dependence and P(X) denotes the joint probability distribution (JPD): n
P ( X ) = ∏ P ( X i Ai )
(1)
i =1
The construction of a BN includes two steps. Firstly, the structure learning determines the variables (nodes) related to the study and the relationships between nodes (dependences or independences). Then, the parameter learning, based on the constructed BN structure, learns the conditional probability distribution (CPD) at each node. An effective structure learning is the key to construct the optimal network structure. It can be made in three ways: (i) based on experts’ experience and prior knowledge; (ii) by unsupervised machine learning algorithm; (iii) based on supervised machine learning of data. The parameter learning follows the definition of the topological structure of the BN. The BN learns by experiences (past and present) and updates probability distributions of the variables (Koski & Noble, 2009). The aim of this step is to improve the causal model and perform a better forecast of the future behaviour of the studied system (Pearson, 1920). Through a sensitivity analysis, the influence of multiple causes (nodes) on the result (target node) can be determined (Pearl, 1988; Cover & Thomas, 2006). This can be made by measuring the mutual information., i.e. the volume of information flow between two nodes or the expected information gained about one node after observing the values of the other one (Cover & Thomas, 2006; Khakzad et al., 2015). Assuming two variables A and B, the mutual information I(A,B) and the conditional mutual information I(A,B|C), with respect the node C, are given by: I( A, B ) = ∑ P ( a, b) log a ,b
I( A, B | C ) =
P (a, b) P ( a ) P (b) P( a, b | c)
∑ P(a, b, c) log P(a | c) P(b | c)
a ,b , c
(2)
(3)
Finally, a Bayesian network needs to be validated. Cross-validation is a commonly used statistical approach to assess how well a model will predict new data. In practice, it consists in training the model with different subsets of the available data and averaging over how well each trained model predicts the corresponding hold-out dataset. In this paper, the leave-k-out procedure was adopted (Arlot and Celisse, 2010). The behaviour of the Bayesian network is examined k times and, to apply the procedure, each subset is “left out” from the initial sample (available dataset). The behaviour of the network is studied by varying the distribution of the nodes having greater influence on the target node, as identified through the sensitivity analysis. 2.2. Ageing modelling The Bayesian network was chosen as an adequate approach to give a general picture of the different key-factors contributing to ageing, to verify the reasonability of initial assumptions included in the method for ageing assessment and its update. The Ageing FishBone model was inspiring (Bragatto & Milazzo, 2016) in developing the BN model, which took advantages of the opinion of different stakeholders and experts in satisfying the requirement of the Directive Seveso III. The Ageing FishBone model also offers a valuable support to auditors in understanding in a very short time the adequateness of the activities that slowing-down deterioration mechanisms. It is an index method, which defines equipment ageing based on accelerating and slowing down factors and consists in assigning a score to each factor, in the form of a penalty or a compensation. As shown in Figure 1, accelerating factors include age/in-service time, deterioration mechanisms, defects/damages, failures, stops and accidents/near-misses; and retarding factors include integrity management system, audits SMS, adequacy controls, inspection results, process control and physical protections. These are defined as given below: -
Age/In-service time: The ratio between the current age and the expected age, as given by the manufacturer, or the ratio between current operating hours and the maximum allowed inservice hours.
-
Stops: The ratio between the number of unplanned stops and the total number stops over a reference period.
-
Failures: The ratio between the actual number of equipment failures over a reference period and the number of expected failures according to generic failure rates used in the risk assessment document required by the Seveso Directive (e.g. Safety Report).
-
Accidents/Near-misses: The ratio between the number of accidents and near misses due to ageing and the total number of recorded events over a reference period.
-
Deterioration mechanisms: The average value amongst three scores related to the consequences of the deterioration mechanisms (i.e. dimension of leakage), the ability to detect the main mechanisms (by an inspection technique) and the velocity of propagation of the phenomena.
-
Defects/Damages: The percentage of serious damage detected over the reference period, compared to the number of critical equipment.
-
Audits (of Safety Management System, SMS): The combination of two scores analysing the number of major and minor non-conformities in the audits of the SMS for major accident prevention (SMS-MAP), as required by the Seveso Directive.
-
Integrity management system: The performance level of inspection management procedures (e.g. periodical, risk-based inspections RBI, dynamic RBI, etc.).
-
Inspection results: The combination of three scores accounting for the inspections planning and the results of tests that verify the functionality and integrity of the system.
-
Adequacy control: The combination of two scores accounting for the extension and degree of coverage of techniques and qualification of inspectors (e.g. ISO 9712, ASNT, etc.).
-
Process control: The performance level of the process control system (e.g. automated inter blocks, certified IEC 61508 and IEC 61511, etc.).
-
Physical protections: The average value between two scores accounting for the frequency of controls and the actual condition of the protective systems (e.g. lining, coating, cathodic protection, etc.).
Figure 1: Factors included in the Ageing Fishbone model. Each score (penalty or compensation) is assigned by referring to a four-level scale: 1 = low; 2 = medium; 3 = medium-high; 4 = high. Assignment criteria for the scores and sub-scores are given by Milazzo & Bragatto (2019). A sign will be also associated with the score that will be negative for penalties and positive for compensations. The average of the penalties and compensations express, respectively, the ageing index (Ia) and the longevity index (Il): I a = mean(ai ) I l = mean(l j )
(4)
where: ai represents the score for the i-th ageing factor; and lj represents the score for the j-th longevity factor. If the absolute value of the average compensations is greater or equal to the absolute value of the average penalties, the activities that are in place for the ageing management are adequate. Therefore, the results could also be given in the form of an overall adequacy index (Ioverall):
I overall = I a + Il
(5)
Given that ageing cannot be eliminated, but can only be slowed down, and since accelerating factors contribute to deteriorate equipment and retarding factors contrast the deterioration, it is possible to measure the extent of the reduction of the phenomenon propagation (ageing reduction rate), after defining the relationships between factors and quantifying the effects amongst them. The ageing reduction rate (ARR) is closely related to the overall adequacy index, as elaborated through the Ageing FishBone model. Table 1 gives the classes of ageing reduction rate and related range of values. Table 1. Adequacy of ageing management and ageing reduction rate. Adequacy of ageing management Inadequate management Improvable management Adequate management
Range of values (adequacy of ageing management) - 3 ≤ Ioverall < 0 0 ≤ Ioverall < + 1 + 1 ≤ Ioverall < + 3
Ageing reduction rate
Range of value (ageing reduction rate)
Low Medium High
ARR ≤ 1 1 < ARR ≤ 2 ARR > 2
4. Case-study In Italy, since the issuing date of the guideline for the verification of the adequacy of ageing management plans, operators of major hazard establishments and inspectors started to apply the Ageing FishBone model. In the last six months of 2018 and during the first six months of 2019, 28 establishments were investigated (see Table 2). They include refineries, liquid fuel and LPG depots, costal depots, thermoelectric power plants and other chemical establishments. Table 2. List of investigated establishments. Establishment Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 Case 7 Case 8 Case 9 Case 10 Case 11
Type
Number of critical equipment Liquid fuels depot 13 atmospheric tanks Production of additives for liquid 11 atmospheric tanks fuels 2 pressurised tanks 66 atmospheric tanks Storage unit of a refinery 5 pressurised tanks Liquid fuels depot 2 atmospheric tanks Liquid fuels storage unit of a 9 pressurised tanks petrochemical industry LPG depot 4 pressurised tanks LPG depot 12 pressurised tanks LPG depot 10 pressurised tanks LPG depot 6 pressurised tanks Liquid fuels storage unit of a 6 atmospheric tanks thermoelectric power plant Production of expanded 6 atmospheric tanks
Ageing index (Ia) -1.42
Longevity index (Il) 3.12
-1.9
3.54
-1.64
2.75
1.33
3.33
-2.33
2.7
-2.48 -1.42 -1.77 -2.48
2.74 2.16 2.83 2.87
-1.72
1.83
-1.5
2.25
Case 15 Case 16 Case 17 Case 18 Case 19 Case 20 Case 21 Case 22 Case 23 Case 24 Case 25 Case 26 Case 27
polyurethane Liquid fuels depot Liquid fuels depot Storage tank of a petrochemical industry Refinery Liquid fuels depot Liquid fuels depot LPG depot Production of resins Refinery Liquid fuels depot LPG depot Polymerisation process Polymerisation process Polymerisation process Polymerisation process Chloralkaline process
Case 28
Chloralkaline process
Case 12 Case 13 Case 14
78 atmospheric tanks 3 atmospheric tanks
-1.48 -1.33
2.3 2.4
1 pressurised tank
-1.67
2.33
38 pressurised tanks 15 atmospheric tanks 18 atmospheric tanks 3 pressurised tanks 3 atmospheric tanks 53 pressurised tanks 25 atmospheric tanks 13 pressurised tanks 37 pressurised tanks 8 pressurised tanks 30 pressurised tanks 15 pressurised tanks 4 atmospheric tanks 3 atmospheric tanks 1 pressurised tank
-1.8 -2.17 -1.51 -1.67 -1 -2.52 -2.51 -1.25 -2.01 -1.31 -1.38 -1.8 -1.67
2.95 3.25 2.71 2.83 2.2 3.65 2.53 2.3 3.21 3.11 3.08 2.97 2.85
-1.72
2.3
4.1. Definition of the system The dataset for the definition of the system includes data from one-year inspections (July 2018 – June 2019), i.e. 253 records for atmospheric storage tanks were collected and 247 for pressurised storage tanks and process equipment. The whole dataset was used for the construction of the Bayesian network model and the calibration. Recent works (Milazzo et al., 2018; Milazzo & Bragatto, 2019) provided some useful guide for selecting, discretising and classifying variables that must be included in the BN. Fourteen variables were selected as having significant influence on equipment ageing (Table 3-5); amongst these, there are the factors described in Section 2, except inspections results (INS), which was split in sub-factors (i.e. functionality test results INS1, integrity test results INS2, and inspection scheduling INS3), and defects/damages that was not included because it is already reflected in the results of integrity tests. A variable that measure the ageing reduction rate (ARR) was included that gives the effects of retarding factors on the deterioration. Bayesian networks can process both continuous and discrete variables, but as the variables from the Ageing FishBone model are discrete or can be discretised by defining some ranges, discrete variables were adopted in this study. The values for the variables (states) and related descriptions are shown in Tables 3-5, whereas criteria for discretisation are those used by Milazzo & Bragatto (2019). Table 3. Variables representing the adequateness of ageing management. Variable class -
Variable name
Range of values for
Value description
characteristics Target variable - Ageing reduction continuous rate (ARR)
discretisation (R) R≤1 12
Low Medium High
Table 4. Variables affecting equipment ageing and discretisation of value. Variable class characteristics
Variable name
Accelerating factor continuous
Age/In-service time (AGE)
Accelerating factor continuous
Stops (STP)
Accelerating factor continuous
Failures (FR)
Accelerating factor continuous
Accidents/Nearmisses (EVE)
Accelerating factor continuous
Deterioration mechanisms (DET)
Range of values for discretisation (R) R ≤ 90% 90 % < R ≤ 100% 100 % < R ≤ 125% R > 125% R ≤ 10% 10 % < R ≤ 25% 25 % < R ≤ 60% R > 60% R ≤ 0.5 0.5 < R ≤ 1 12 R ≤ 5% 5 % < R ≤ 15% 15 % < R ≤ 35% R > 35% R≤1 1%3
Value description Young Mature Old Very old Low Medium-low Medium-high High Low Medium-low Medium-high High Low Medium-low Medium-high High Slight Medium High Very high
Table 5. Variables affecting equipment longevity and discretisation of value. Variable class characteristics
Variable name
Retarding factor Audit SMS (AUD) continuous Integrity Retarding factor management system discrete (IMS) Retarding factor - Integrity test results continuous (INS2)
Retarding factor - Inspection continuous scheduling (INS3)
Retarding factor - Functionality test continuous results (INS1)
Retarding factor - Adequacy control discrete (EFF)
Retarding factor Process control (PC) discrete
Retarding factor - Physical protections continuous (PHY)
Range of values for discretisation (R) R≤1 13 R=1 R=2 R=3 R =4 R ≤ 98% 98 % < R ≤ 99% 99 % < R ≤ 99.5% R > 99.5% R ≤ 90% 90 % < R ≤ 95% 95 % < R ≤ 99% R > 99% R ≤ 90% 90 % < R ≤ 95% 95 % < R ≤ 99% R > 99% R=1 R=2 R=3 R =4 R=1 R=2 R=3 R =4 R≤1 13
Value description High no-conformities Medium-high no-conformities Medium-low no-conformities Low no-conformities Compliant with legislation According to RBI Updated after changes Periodically updated Poor Medium Good Excellent Poor compliance Adequate compliance Good compliance Total compliance Poor Medium Good Excellent Adequate Efficient Very efficient Best Unregistering local control system Control system with data recording Control system with data recording + automatic blockage Certified SIL Poor conditions Medium-poor conditions Medium-good conditions Good conditions
4.2. Structure learning Factors, having a significant role in defining ageing, were described, this allowed identifying the variables that are independent or dependent on each other. In this paper, the BN was derived by using the experts’ experience of the Italian working group, that defined the guideline supporting the verification of the adequacy of ageing management plans at Seveso establishments. By referring to the factors (variables), given in Section 2, the cause-effect relationships amongst them and the equipment conditions were identified. These relationships were obtained by means of a prior knowledge and observations of the system; hence, they were reported in the network. The BN was constructed by the software Netica.
4.3. Parameter learning The use of Netica supported the execution of the parameter learning by means of the Counting Learning algorithm, which gave the conditional probability distribution of nodes of the Bayesian network, based on the acquired evidences, i.e. it works by modifying the conditional probabilities of the node for which an evidence is acquired and provides the values for all its parents (Norsys website). To validate the model, a sensitivity analysis was used to identify sensitive factors (nodes) with a significant impact on the target node. In this work, the ageing reduction rate was selected as target node and the sensitivity analysis function of Netica was used. Finally, the leave-k-out cross-validation procedure was adopted to verify the accuracy of the model in fitting and predicting the ageing reduction rate. The process was performed according to the following steps. Firstly, the list of collected equipment (with respect to each equipment class) was rearranged in a random order to extract as many heterogeneous sub-sets as possible, then, atmospheric tanks were subdivided in 11 subsets and pressurised tanks and process equipment in 13. Subsequently, a subset at a time was removed and the network was trained with the remaining data. The network behaviour was verified by modifying the states’ distribution of the most sensitive nodes. 5. Results and discussion 5.1. Bayesian network model and validation Experts’ knowledge allowed formulating the Bayesian network structure given in Figure 2. The network is composed by 14 nodes, which refer to 14 variables, and several links indicating the relationships among the variables. Some variables have hierarchical relations in affecting others and being affected by others. The number of nodes becomes 13 for atmospheric equipment. Two accelerating factors, i.e. accidents/near-misses and stops, affect the final ageing reduction rate index. Both represent undesirable events, which cause stress to the equipment materials and, therefore, promote ageing. These events are caused by failures, which are identified as losses of containment due to the presence of defects/damage. The correlation between failures and defects/damages is highlighted by connecting the first one with the factor integrity test results (subfactor of inspections results). For pressurised/process equipment, also the correlation between failures and functionality test results (sub-factor of inspections results) must be included (see dashed box in Figure 2). The results of the integrity and functionality tests are affected by inspection scheduling (sub-factor of inspections results), which in in turn is affected by the integrity
management system. Defects/damages are the result of deterioration mechanisms, although the chronological age (age/in-service time) also contributes to their appearance. At the same time, defects/damages can be managed through adequate controls (adequacy control). The integrity management system and audits of SMS act on the adequacy of the controls. In addition, deterioration mechanisms are slowed down by physical protections, therefore their conditions and the frequency of their inspections are very important. Finally, the process control has the function to avoid the variability of operating parameters, which could accelerate many damage mechanisms; such a variability is then reflected on the defects/damages.
Figure 2: Bayesian network structure for atmospheric equipment and pressurised/process equipment. Table 6 gives the distribution of states for each factor, in term of frequency and percentage, and equipment type. The Bayesian network of Figure 2 was created in Netica, then, parameter learning gave the conditional probability distribution of nodes and the model for ageing causation analysis. The results are shown in Figures 3 and 4, respectively, for atmospheric tanks and pressurised/process equipment. By means of the sensitivity analysis, the impact degrees of other nodes on ageing reduction rate was calculated and given in a descending order.
Table 6. Distribution of states. Variable name
AGE
STP
FR
EVE
DET
AUD
IMS
INS1
Value description Young Mature Old Very old Low Medium-low Medium-high High Low Medium-low Medium-high High Low Medium-low Medium-high High Slight Medium High Very high High no-conformities Medium-high no-conformities Medium-low no-conformities Low no-conformities Compliant with legislation According to RBI Updated after changes Periodically updated Poor Medium Good Excellent
Atmospheric tanks Frequency 215 22 4 12 243 4 5 1 34 122 66 31 130 28 81 14 56 88 70 39 84 43 93 33 69 49 120 15 0 5 0 64
% 84.98 8.70 1.58 4.74 96.05 1.58 1.98 0.40 13.44 48.22 26.09 12.25 51.38 11.07 32.02 5.53 22.13 34.78 27.67 15.42 33.20 17.00 36.76 13.04 27.27 19.37 47.43 5.93 0.00 7.25 0.00 92.75
Pressurised/process equipment Frequency % 192 77.73 34 13.77 13 5.26 8 3.24 145 58.70 9 3.64 39 15.79 54 21.86 148 59.92 89 36.03 0 0.00 10 4.05 130 52.63 37 14.98 53 21.46 27 10.93 49 20.16 31 12.76 43 17.70 120 49.38 3 1.21 47 19.03 45 18.22 152 61.54 58 23.48 134 54.25 55 22.27 0 0.00 0 0.00 0 0.00 0 0.00 218 100.00
INS2
INS3
EFF
PC
PHY
Poor Medium Good Excellent Poor compliance Adequate compliance Good compliance Total compliance Adequate Efficient Very efficient Best Unregistering local control system Control system with data recording Control system with data recording + automatic blockage Certified SIL Poor conditions Medium-poor conditions Medium-good conditions Good conditions
10 1 0 144 41 0 0 146 90 32 49 82 27 114
6.45 0.65 0.00 92.90 21.93 0.00 0.00 78.07 35.57 12.65 19.37 32.41 10.67 45.06
0 0 0 207 25 4 0 218 9 33 179 26 26 1
0.00 0.00 0.00 100.00 10.12 1.62 0.00 88.26 3.64 13.36 72.47 10.53 10.53 0.40
97
38.34
155
62.75
15 98 80 73 2
5.93 38.74 31.62 28.85 0.79
65 86 31 74 56
26.32 34.82 12.55 29.96 22.67
Figure 3: Bayesian network model for atmospheric tanks after parameter learning.
Figure 4: Bayesian network model for pressurised/process equipment after parameter learning.
The results of sensitivity analysis are shown Figure 5, which gives a comparison amongst mutual information of the various equipment, i.e. the direct or indirect information flow rate and, thus, measures the degree of dependence between each node and the target one. Based on these results, nodes with the relatively greater contribution to the ageing reduction rate were identified: stops, accidents/near-misses, failures and integrity test results are the most relevant for each type of equipment. The trend of the results can be explained on the basis of the following considerations. All these undesired events (such as stops, near-misses and accidents) give the greatest contribution to the increase of the ageing rate. The identification of defects/damages (integrity test results) significantly helps to prevent the stresses that these events cause to the equipment. The contributions of the other factors are minimal for the atmospheric or pressurised/process equipment, whereas a small not negligible contribution to the ageing reduction, for pressurised equipment, is given by the functionality test results.
Figure 5: Results of sensitivity analysis.
The cross-validation process was performed as described in Section 4.3. The network behaviour was verified by modifying the state distributions of two of the most sensitive nodes, i.e. integrity test results (INS2) and stops (STP), and comparing the results with the initial distributions. The following elaborations were made with respect to the target node: (i) a priori elaboration: -
calculation of the average a priori probability distribution of ARR, which is obtained by averaging the a priori distributions derived from the initial dataset and from which a subset at a time, of those defined in Section 4.3 (11 for atmospheric and 13 tanks for pressurized tanks / process equipment), is excluded.
-
calculation of the maximum mean absolute error (MAE), which is the maximum MAE for the target node;
-
calculation of the standard deviation at each state of ARR.
(ii) a posteriori elaboration: -
calculation of the average a posteriori probability distribution of ARR, which is obtained, after an evidence is entered at a sensitive node (INS2 and STP), by averaging the a posteriori distributions derived from the initial dataset and from which a subset at a time is excluded (see Section 4.3). An evidence is entered at each state of the sensitive node;
-
calculation of the maximum mean absolute error (MAE), which is the maximum MAE for the target node after an evidence is entered at each state of sensitive node;
-
calculation the standard deviation at each state of ARR.
Results of cross-validation are shown in Figures 6 and 7. Figure 6(a-b) shows the average a priori and a posteriori distributions for the ageing reduction rate, calculated for atmospheric tanks, respectively, when an evidence is entered at each state of the nodes integrity test results (INS2) and stops (STP). The values of the standard deviation are also shown on each histogram. The maximum MAE is 0.51 % in elaborating the a priori distribution of ARR, whereas it assumes the values 0.99 % and 2.44 % in the a posteriori prediction of ARR, respectively, when the distribution of integrity test results and stops is modified by entering an evidence at each state. Similarly, Figure 7(a-b) shows the average a priori and a posteriori distributions for the ageing reduction rate, calculated for pressurised/process equipment again when an evidence is entered at each state of the nodes integrity test results (INS2) and stops (STP). Also, in this case the values of the standard deviation are shown on each histogram. The maximum MAE is 0.46 % in elaborating the a priori distribution of ARR, whereas it assumes the values 0.46 % and 0.87 % in the a posteriori prediction of ARR, respectively, when the distribution of integrity test results and stops is modified by entering an evidence at each
state. These results suggest that the Bayesian network model has both very high accuracy in fitting data and predicting ageing reduction rate for atmospheric tanks and pressurised/process equipment.
(a)
(b) Figure 6: Cross-validation results for atmospheric tanks: average a priori and a posteriori probability distribution when (a) the node integrity test results assumes 100% at each state (MAE = 0.99%) and (b) the node stops assumes 100% at each state (MAE = 2.44%).
(a)
(b) Figure 7: Cross-validation results for pressurised/process equipment: average a priori and a posteriori probability distribution when (a) the node integrity test results assumes 100% at each state (MAE = 0.46%) and (b) the node accidents/near-misses assumes 100% at each state (MAE = 0.87%).
5.2. Discussion The results presented in Section 5.1 were used to make some considerations with respect to the application of the Ageing FishBone method. As mentioned in the introduction, to have a method shared by industry and regulators, many a priori assumptions were made. The main significant assumption are: 1. the distributions of four states are assumed to be uniform or normal with a high standard deviation for all factors; 2. all factors have the same weight in contributing to the overall adequacy index. Some factors are split in two or three sub-factors, but again each of them has the same weight. 3. even though a few factors are not independent each other, data are assumed to be independent. Damages and inspection results, for instance, could be linked each other, as well as failures and accidents/near-misses. By exploiting the data, gathered during the initial applications of the model for inspections, it was possible to understand if the initial assumption were reasonable and if updates and/or enhancements are needed. To verifying the credibility of the a priori assumptions, it was necessary to answer the following questions: 1. which is the actual factors’ distribution? if the actual distribution is very different from a priori ones, the score should be deeply revised. Revisions may be done to the interval or even to the linear score conversion. 2. which factors may be considered actually independent? which factors may be considered “causal”? 3. which factors are effect or duplication of others? in this case could they be anyway useful for a cross check? 4. are decisions, based on a priori assumptions, acceptable as experimental applications of the method? The application of the Ageing FishBone model was very wide, thus, very different establishments were analysed (e.g. refineries, petrochemical plants, tank farms, LPG depots, large and small chemical plants), with different equipment types (e.g. pressurised vessels, atmospheric vessels, drum, heat exchangers, etc.). Some discriminations were reasonable, firstly pressurised vessels and atmospheric tanks were distinguished, as the first ones are regulated by the EU PED Directive and by the Italian legislation, which define technical verifications, supervised by regulators and
providing trustable standardised data, whilst the second typologies are ruled by voluntary codes and data are less uniform. To answer the first question above, the state distributions were examined by means of the Bayesian networks given in Figures 3 and 4. These distributions are identified to be similar to those indicated in Table 7. Table 7. States’ distribution in the Bayesian networks (in bracket the state with highest value) Factor AGE STP FR EVE DET IMS AUD EFF INS2 INS3 INS1 PC PHY
States distribution for atmospheric tanks Exponential (1) Exponential (1) Exponential (1) Uniform Uniform Uniform Uniform Uniform Uniform Uniform No applicable Exponential (3) Uniform
States distribution for pressurised/process equipment Exponential (1) Exponential (1) Exponential (1) Uniform Uniform Uniform Normal (the value 4 does not exist) Normal Uniform Exponential (4) Exponential (4) Exponential (3) Normal
It can be observed that the distribution of states for the factor age (AGE) is unbalanced, this is due to evidence that the design age, due to the loss of documentation provided by the manufacturer, is not realistic and most operators assume high values. The assigned data should be reviewed. For the factor stops (STP), it is always observed that the lowest value of the state is little influential. It should be noted that the factor is not always applicable, therefore, it should be eliminated where it does not appear significant or it should be associated with a reduced weight. For the factor failures (FR), the distribution is centred on the lowest value, however it follows a regular trend, thus, it could be useful to better centre the four scale values. For the factors safety management system (AUD) and adequacy controls (EFF) distributions are credible, as well as adhering to the standard. Also, the factors deterioration mechanisms (DET) and accidents/near-misses (EVE) appear to be based on reasonable a priori hypotheses. For the factors integrity management system (IMS), integrity test results (INS2) and physical protections (PHY), the distributions are valid with a low approximation. However, they are not applied to all cases. The factors functionality tests results (INS1) appears having a little influence, as these checks can only be applied to pressurised equipment/process equipment. The factor inspection scheduling (INS3) is also not very influential. For the factor process control an almost complete uniformity on the third state is observed,
probably the factor must be better specified, since in this way it is little influential. From this analysis the less important factors are process control (PC), inspections scheduling (INS3), functionality test results (INS1), audits (AUD) and the integrity management system (IMS). These considerations are in line with the results of the sensitivity analysis. The answer to the second question is provided directly by the results of cross-validation and sensitivity. The variation of the most sensitive nodes shows very small errors (MAE), which confirm the robustness of the relationships built in these networks. Concerning the third question, a redundancy was identified, this regards the factor damages which is reflected in integrity test results, as well as other adjustments suggested in the discussion above. Finally, the answer to the fourth question is a summary of all observations. It can be surely confirmed that, even some revisions are needed, the method based on the previously discussed a priori assumptions is valid and robust in assessing ageing. 6. Conclusions The Italian Seveso Competent Authority has well addressed the emerging issue of ageing in Seveso establishments. Starting from very poor data on the real conditions of the equipment in Italy, a simplified method (Ageing FishBone model) was derived, based on expert judgments and a priori assumptions. The method allowed the inspectors making decisions during on-site inspections and the Italian Authorities starting collecting systematic data on equipment ageing conditions in chemical and oil industries. Collected data was analysed through a Bayesian Network, which provided a confirmation of the substantial adequacy of the method and suggested a few valuable suggestions to improve the method. During the period 2018-19, the method was applied in some Italian regions and only to static containment equipment (e.g. pipeworks and vessels), but in the future it will be used also for other typologies and be likely extended to the analysis of dynamic systems (e.g. pumps and compressors). In this way, within a few years the regulators will have a detailed and updated e picture of national Seveso sites’ condition from the point of view of deterioration. The Competent Authority will analyse the new data through the methods described in the present paper and, thus, will be support by useful information for a right decision-making about ageing management. Unfortunately, in the next years, large investments for radical establishment renewals are not expected, therefore, the issue of ageing will consequently continue to be a priority for Seveso Authority. Acknowledgment
The work was partially funded by INAIL within the call BRIC/2016, ID = 15, SMARTBENCH project. References Aizpurua, J.I., Catterson, V.M., Papadopoulos, Y., Chiacchio, F., D'Urso, D., 2017. Supporting group maintenance through prognostics-enhanced dynamic dependability prediction. Reliability Engineering and System Safety 168, 171-188. Andrews, J., Fecarotti, C., 2017. System design and maintenance modelling for safety in extended life operation. Reliability Engineering and System Safety 163, 95-108. Arlot, S., Celisse, A., 2010. A survey of cross-validation procedures for model selection. Statistics Surveys, 4, 40-79. Bragatto P.A., Milazzo, M.F., 2016. Risk due to the ageing of equipment: Assessment and management. Chemical Engineering Transactions 53, 253-258. Bragatto, P., Delle Site, C., Faragnoli, A., 2012. Opportunities and Threats of Risk Based Inspections: the new Italian Legislation on Pressure Equipment Inspection. Chemical Engineering Transactions 26, 177-182. Candreva, F., Houari, M., 2013. Plant screening for ageing impact in the process industry. Chemical Engineering Transactions 31, 253-258. Cover, T.M, Thomas, J.A., 2006. Elements of information theory. Wiley. Fabiano, B., Currò, F., 2012. From a survey on accidents in the downstream oil industry to the development of a detailed near-miss reporting system. Process Safety and Environmental Protection 90(5), 357-367. Gyenes, Z., Wood, M.H., 2016. Lessons learned from major accidents relating to ageing of chemical plants. Chemical Engineering Transactions 48, 733-738. Horrocks, P., Mansfield, D., Thomson, J., Parkerv, K., Winter, P., 2010. Plant Ageing Study Phase 1 Report. Health and Safety Executive Report no. RR823. International Atomic Energy Agency (IAEA), 2009. Ageing Management for Nuclear Power Plants. IAEA Safety Standards Series NS-G-2.12. Khakzad, N., Khan, F., Amyotte P., 2015. Major Accidents (Gray Swans) Likelihood Modeling UsingAccident Precursors and Approximate Reasoning. Risk Analysis 35(7), 1336-1347. Kieskamp, K.K., Heezen, P.A.M., Geus, E.C.J., 2019. Ageing (- Seveso installations) in the Netherlands. Chemical Engineering Transactions, 75 (in press). Koski, T., Noble, J.M., 2009. Bayesian Networks: An Introduction. Wiley Series in Probability and Statistics. Milazzo, M.F., Ancione, G., Scionti, G., Bragatto, P.A., 2018. Assessment and Management of Ageing of critical Equipment at Seveso site. Safety and reliability – Safe societies in a changing world. Proceedings of the 28th International European Safety and Reliability Conference ESREL2018, pp. 1629-1636.
Milazzo, M.F., Bragatto, P.A., 2019. A framework addressing a safe ageing management in complex industrial sites: The Italian experience in «Seveso» establishments. Journal of Loss Prevention in the Process Industries 58, 70-81. Mohamed, R., Che Hassan, C.R., Hamid, M.D., 2019. Critical success factors of risk-based inspection. Process Safety Progress 38 (1), 4-20. Norsys website: https://www.norsys.com/ (accessed on the 11th August 2019). Organisation for Economic Cooperation and Development (OECD), 2017. Ageing of Hazardous Installations. OECD Environment, Health and Safety Publications – Series on Chemical Accidents no. 29. Ossai, C.I., Boswell, B., Davies, I.J., 2016. Stochastic modelling of perfect inspection and repair actions for leak-failure prone internal corroded pipelines. Engineering Failure Analysis 60, 4056. Pearl, J., 1986. Fusion, propagation, and structuring in belief networks. Artificial Intelligence 29(3), 241-288. Pearl, J., 1988. Probabilistic Reasoning in Intelligent Systems - Networks of Plausible Inference. Morgan Kaufmann. Pearson, K., 1920. The fundamental problem of practical statistics. Biometrika 13, 1-16. Pittiglio, P., Bragatto, P., Delle Site, C. 2014. Updated failure rates and risk management in process industries. Energy Procedia 45, 1364-1371. Prod’homme, G., Richomme, S. Industrial installation ageing management Refinery storage benchmark. Document no. DRA-09-102957-08289B. Accessed on the 11th February 2020: https://www.ineris.fr/sites/ineris.fr/files/contribution/Documents/dra-09-102957-08289bmedde-1357657410.pdf Sobral, J., Ferreira, L., 2015. Establishment of optimal physical assets inspection frequency based on risk principles. Maintenance and Reliability, 17(2), 243-249. Wintle, J., Moore, P., Henry, N., Smalley, S., Amphlett, G., 2006. Plant ageing. Management of equipment containing hazardous fluids or pressure. Health and Safety Executive Report no. RR509. Wood, M.H., Arellano, A.V., Van Wijk, L., 2013. Corrosion Related Accidents in Petroleum Refineries. European Commission Joint Research Centre Report no. EUR 26331.
Author Statement: Giuseppa Ancione: Conceptualization, Methodology, Software, Validation Paolo Bragatto: Methodology, Original draft preparation, Data curation Maria Francesca Milazzo: Methodology, Supervision; Original draft preparation, WritingReviewing and Editing
Declaration of interests ☒ The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. ☒The authors declare the following financial interests/personal relationships which may be considered as potential competing interests: None
Messina, 20 December 2019
Signature
S0950-4230(19)31051-4
DOI:
https://doi.org/10.1016/j.jlp.2020.104080
Reference:
JLPP 104080
To appear in:
Journal of Loss Prevention in the Process Industries
Received Date: 20 December 2019 Revised Date:
12 February 2020
Accepted Date: 19 February 2020
Please cite this article as: Ancione, G., Bragatto, P., Milazzo, M.F., A Bayesian network-based approach for the assessment and management of ageing in major hazard establishments, Journal of Loss Prevention in the Process Industries (2020), doi: https://doi.org/10.1016/j.jlp.2020.104080. This is a PDF file of an article that has undergone enhancements after acceptance, such as the addition of a cover page and metadata, and formatting for readability, but it is not yet the definitive version of record. This version will undergo additional copyediting, typesetting and review before it is published in its final form, but we are providing this version to give early visibility of the article. Please note that, during the production process, errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain. © 2020 Published by Elsevier Ltd.
A Bayesian network-based approach for the assessment and management of ageing in major hazard establishments
Giuseppa Ancione1, Paolo Bragatto2, Maria Francesca Milazzo1* 1
Dipartimento di Ingegneria, University of Messina – Contrada Di Dio, 98166 – Messina – Italy
2
Dipartimento Innovazioni Tecnologiche, INAIL – via Fontana Candida, 1, – Monteporzio, Roma – Italy
*corresponding author: email [email protected]; phone +39 090 6765595
Abstract Currently, there is an increasing attention towards ageing of industrial equipment, as the phenomenon has been recognised a cause of severe accidents, recorded in the last years in many process establishments. Recent studies described ageing through a number of key-factors affecting the phenomenon by accelerating or slowing it down. The Italian Competent Authority for the prevention of Chemical Accidents (Seveso III Directive) adopted a short-cut method, accounting for the assessment of these factors, to evaluate the adequateness of ageing management during inspections at Seveso sites. In this paper, a Bayesian Network was developed, by using the data gathered during the first application of the short-cut method, with the aim to verify the robustness of the approach for ageing assessment and the validity of the a priori assumptions used in assessing the key-factors. The structure of the Bayesian network was established by using experts’ knowledge, whereas the Counting Learning algorithm was adopted to execute the parameter learning by means of the software Netica. The results showed that this network could effectively explore the complex logical and uncertain relationships amongst factors affecting equipment ageing. Results of the present study have been exploited to improve the short-cut method. Keywords: Equipment Ageing; Major Accident Hazard; Seveso Directive; Deterioration Mechanism; Risk-based Inspection; Bayesian Network. Highlights •
Ageing is as a significant cause of major accidents in chemical industries
•
The Bayesian network theory verified the robustness of an ageing assessment method
•
A cross-validation demonstrated a high accuracy of the network in ageing predicting
1. Introduction In 2012, the EU Commission stressed the issue of “equipment ageing” and, in the framework of the new Directive for the prevention of chemical accidents (Seveso III Directive), required the member countries to take actions controlling the hazards due to equipment deterioration. In 2015, after the implementation of the Directive in the Italian legislation, ageing became a priority for the National Seveso Competent Authorities. Since twenty years, a pillar of the Seveso Directives has been the system of “on-site” inspections, which the Competent Authorities must organise to verify the adequateness of the activities done to control major hazards in chemical and process industry. Accordingly, in Italy, more than one third of Seveso establishments are inspected every year. Inspectors must verify several items that are relevant to safety, including policy, organisation, training programs, risk assessment, maintenance programs, management of changes, permits to work, emergency planning, accidents and near-misses investigation, performance indicators, etc. This causes that the time dedicated to ageing assessment is limited, therefore, in formulating decisions for the management of the phenomenon, the answer to the following questions is relevant, i.e. how can inspectors understand the condition of all equipment in a such a short time? is it possible to get a fair evaluation, make reasonable recommendations and eventually give prescriptions to the operators? Furthermore, no statistical data about the actual ageing conditions of equipment in Seveso establishments is available for the Authority to support its assessment, even though the concern for the issue is high both for industrial operators and regulators. To answer these questions, the Italian Competent Authority provided the inspectors with a short-cut method, developed by a working group, including regulators, industrial managers and representatives from academia. The method is an index approach (so-called Ageing FishBone method), which includes the assessment of a number of quantitative key-factors that are assumed to contribute to equipment ageing. These key-factors include age or in-service time, deterioration mechanisms, failures, accidents/near-misses, damages, stops, audits, the integrity management system, adequacy controls (techniques and competences of personnel), inspection results (results of integrity and function verifications and inspection scheduling), physical protections and the process control. Currently, the method has been applied to the primary static containment systems that are classified as critical equipment in the mandatory risk assessment required by the Seveso legislation. The assessment of the key-factors has been discussed in a previous paper by the scientific leaders of working group (Milazzo & Bragatto, 2019). In order to have an approach, shared by all the stakeholders, many trade-offs have been accepted and various a priori assumptions have been made. Due to the lack of data about the actual equipment conditions in the Seveso establishments
throughout Italy, the working group had to trust only on its expertise. As a result, an evaluation method has been delivered that is based on a number of objective synthetic data that are easy to collect during inspections. The scientific literature shows some statistics and analyses of accidents (Fabiano & Currò, 2012; Wood et al., 2013; Pittiglio et al., 2015; Gyenes & Wood, 2016; Kieskamp et al., 2019), but no previous study has been focused on complete definition of an approach for ageing assessment, neither by industry nor by regulators. Since early 2000s, most European national legislations fixed the inspection intervals for pressurised equipment, assuming them independent on their age and conditions. A decade ago, the RBI approach was slowly adopted, therefore, inspection intervals started to be based on conditions, deterioration mechanisms and failure rates (Bragatto et al. 2012). Even this approach was popular in nuclear industry (IAEA, 2009), it was very innovative in chemical and process industry; nevertheless, it allowed adequately facing ageing, by adapting both the type and interval of inspections. A number of papers were consequently published, discussing the issue of extending the equipment lifetime beyond its originally design lifetime (given by the manufacturer), through an intensification of maintenance and inspection activities. Relevant papers to this scope are described in the following. Candreva & Houari (2013) presented a screening tool assessing the adverse impact of ageing on the global plant performance, as well as the collateral impact on major accident prevention programs; it was proposed a score approach aimed at providing a risk profile, which included the adverse effects of ageing. Sobral & Pereira (2015) proposed a methodology to determine the optimal inspection intervals for assets affected by ageing. Ossai et al. (2016) used Markov techniques to address a program of inspection of corroded pipelines at different stages of the corrosion growth; in addition, Monte Carlo simulations and degradation models were applied to determine the depth and growth of future corrosion defects and to establish periodic inspections and repairs procedures. Azipurua at al. (2017) developed an on-line predictive diagnosis algorithm for the prediction of the health of systems; by means of this the operators were provided by suggestions for inspection and maintenance of both critical and non-critical equipment. Andrews & Fecarotti (2017) developed a method aimed at assessing equipment ageing, which considered different factors relevant for ageing (including age, use, condition, inspection, repair and modifications), then, through its combination with a Petri net and a Bayesian network approach, it was able to predict the effect of the various factors. Mohamed et al (2019) identified, ranked, prioritised and grouped 28 critical factors for the successful implementation of RBI; the proposed method was suitable for addressing the ageing management based on an RBI approach. The contribution of the technical literature is highly also valuable and a few reports worth a mention. The British Health and Safety Executive had a pioneer role, with the technical reports RR509
(Wintle et. al 2006) and RR823 (Horrock et al. 2010), which were two pillars of ageing management at Seveso plants over fifteen years, as well as the report of the French INERIS (Prod’homme & Richomme 2010). Even if in the literature, there are several studies about process equipment ageing (Horrocks et al., 2010; Wood et al., 2013; OECD, 2017), as well as about inspection techniques and optimal maintenance decisions, available data are limited and information about key-factors affecting ageing cannot be easily extracted . The application of the Ageing FishBone method represents the first attempt to gather such data in a systematic way. The aim of the present work is to understand if the initial assumptions of the working group are reasonable and, then, if it is possible to update and tune the method by exploiting data gathered during the first inspections. Data collected after this testing period is enough for a first revision the method, i.e. to verify the credibility of the a priori assumptions and adjust them. A typical Bayesian approach supports these objectives. During the first application of the approach, a number of a priori assumptions, based on feeling and experience, are used to gather data and make effective decisions; whereas during the second application, collected evidences are exploited to verify , update assumptions and improve the process of decision-making. Finally, the new data, gathered for each new inspection, could improve recursively the process. Therefore, in this study, a Bayesian network was used to give a general picture of the different factors contributing to ageing, highlighting their actual distributions and relationships. The network was established by using experts’ knowledge, whereas the Counting Learning algorithm was adopted to execute the parameter learning by means of the software Netica (Norsys, 2019). The paper is organised as follows: Section 2 illustrates the construction of the Bayesian network model, based on the Ageing FishBone model; Section 3 presents the case-study used for the development of the Bayesian network model; Section 4 summarised the findings of this study; finally, Section 5 gives some conclusions.
2. The Ageing Bayesian Network model 2.1. Basic concepts of Bayesian Network A Bayesian Network BN (also called Bayes net or belief network and sometimes causal network) is a probabilistic graphical model that can be used for a wide range of activities, including prediction, anomaly detection, diagnostics, automated insight, reasoning, time series prediction and decision making under uncertainty. It is a directed acyclic graph (DAG), consisting of a set of nodes and directed links, that represents a set of variables and the dependences amongst variables; these
dependences are described by using conditional probabilities (Pearls, 1986). A typical mathematical representation of a Bayesian Network is BN =(G, Θ), where BN is a Bayesian network, G is a directed acyclic graph, in which its nodes X1, X2, …Xn represents random variables and its links represent direct dependencies between these variables (the absence of direct connections between two nodes does not imply total independence between them), and Θ represents the set of BN parameters, i.e. the set P(Xi|Ai) (i = 1, 2, …, n) for each realisation of Xi conditioned on the set of Ai (parents of Xi in G). Given G and a probability distribution for each node of G, Equation (1) expresses the conditional dependence and P(X) denotes the joint probability distribution (JPD): n
P ( X ) = ∏ P ( X i Ai )
(1)
i =1
The construction of a BN includes two steps. Firstly, the structure learning determines the variables (nodes) related to the study and the relationships between nodes (dependences or independences). Then, the parameter learning, based on the constructed BN structure, learns the conditional probability distribution (CPD) at each node. An effective structure learning is the key to construct the optimal network structure. It can be made in three ways: (i) based on experts’ experience and prior knowledge; (ii) by unsupervised machine learning algorithm; (iii) based on supervised machine learning of data. The parameter learning follows the definition of the topological structure of the BN. The BN learns by experiences (past and present) and updates probability distributions of the variables (Koski & Noble, 2009). The aim of this step is to improve the causal model and perform a better forecast of the future behaviour of the studied system (Pearson, 1920). Through a sensitivity analysis, the influence of multiple causes (nodes) on the result (target node) can be determined (Pearl, 1988; Cover & Thomas, 2006). This can be made by measuring the mutual information., i.e. the volume of information flow between two nodes or the expected information gained about one node after observing the values of the other one (Cover & Thomas, 2006; Khakzad et al., 2015). Assuming two variables A and B, the mutual information I(A,B) and the conditional mutual information I(A,B|C), with respect the node C, are given by: I( A, B ) = ∑ P ( a, b) log a ,b
I( A, B | C ) =
P (a, b) P ( a ) P (b) P( a, b | c)
∑ P(a, b, c) log P(a | c) P(b | c)
a ,b , c
(2)
(3)
Finally, a Bayesian network needs to be validated. Cross-validation is a commonly used statistical approach to assess how well a model will predict new data. In practice, it consists in training the model with different subsets of the available data and averaging over how well each trained model predicts the corresponding hold-out dataset. In this paper, the leave-k-out procedure was adopted (Arlot and Celisse, 2010). The behaviour of the Bayesian network is examined k times and, to apply the procedure, each subset is “left out” from the initial sample (available dataset). The behaviour of the network is studied by varying the distribution of the nodes having greater influence on the target node, as identified through the sensitivity analysis. 2.2. Ageing modelling The Bayesian network was chosen as an adequate approach to give a general picture of the different key-factors contributing to ageing, to verify the reasonability of initial assumptions included in the method for ageing assessment and its update. The Ageing FishBone model was inspiring (Bragatto & Milazzo, 2016) in developing the BN model, which took advantages of the opinion of different stakeholders and experts in satisfying the requirement of the Directive Seveso III. The Ageing FishBone model also offers a valuable support to auditors in understanding in a very short time the adequateness of the activities that slowing-down deterioration mechanisms. It is an index method, which defines equipment ageing based on accelerating and slowing down factors and consists in assigning a score to each factor, in the form of a penalty or a compensation. As shown in Figure 1, accelerating factors include age/in-service time, deterioration mechanisms, defects/damages, failures, stops and accidents/near-misses; and retarding factors include integrity management system, audits SMS, adequacy controls, inspection results, process control and physical protections. These are defined as given below: -
Age/In-service time: The ratio between the current age and the expected age, as given by the manufacturer, or the ratio between current operating hours and the maximum allowed inservice hours.
-
Stops: The ratio between the number of unplanned stops and the total number stops over a reference period.
-
Failures: The ratio between the actual number of equipment failures over a reference period and the number of expected failures according to generic failure rates used in the risk assessment document required by the Seveso Directive (e.g. Safety Report).
-
Accidents/Near-misses: The ratio between the number of accidents and near misses due to ageing and the total number of recorded events over a reference period.
-
Deterioration mechanisms: The average value amongst three scores related to the consequences of the deterioration mechanisms (i.e. dimension of leakage), the ability to detect the main mechanisms (by an inspection technique) and the velocity of propagation of the phenomena.
-
Defects/Damages: The percentage of serious damage detected over the reference period, compared to the number of critical equipment.
-
Audits (of Safety Management System, SMS): The combination of two scores analysing the number of major and minor non-conformities in the audits of the SMS for major accident prevention (SMS-MAP), as required by the Seveso Directive.
-
Integrity management system: The performance level of inspection management procedures (e.g. periodical, risk-based inspections RBI, dynamic RBI, etc.).
-
Inspection results: The combination of three scores accounting for the inspections planning and the results of tests that verify the functionality and integrity of the system.
-
Adequacy control: The combination of two scores accounting for the extension and degree of coverage of techniques and qualification of inspectors (e.g. ISO 9712, ASNT, etc.).
-
Process control: The performance level of the process control system (e.g. automated inter blocks, certified IEC 61508 and IEC 61511, etc.).
-
Physical protections: The average value between two scores accounting for the frequency of controls and the actual condition of the protective systems (e.g. lining, coating, cathodic protection, etc.).
Figure 1: Factors included in the Ageing Fishbone model. Each score (penalty or compensation) is assigned by referring to a four-level scale: 1 = low; 2 = medium; 3 = medium-high; 4 = high. Assignment criteria for the scores and sub-scores are given by Milazzo & Bragatto (2019). A sign will be also associated with the score that will be negative for penalties and positive for compensations. The average of the penalties and compensations express, respectively, the ageing index (Ia) and the longevity index (Il): I a = mean(ai ) I l = mean(l j )
(4)
where: ai represents the score for the i-th ageing factor; and lj represents the score for the j-th longevity factor. If the absolute value of the average compensations is greater or equal to the absolute value of the average penalties, the activities that are in place for the ageing management are adequate. Therefore, the results could also be given in the form of an overall adequacy index (Ioverall):
I overall = I a + Il
(5)
Given that ageing cannot be eliminated, but can only be slowed down, and since accelerating factors contribute to deteriorate equipment and retarding factors contrast the deterioration, it is possible to measure the extent of the reduction of the phenomenon propagation (ageing reduction rate), after defining the relationships between factors and quantifying the effects amongst them. The ageing reduction rate (ARR) is closely related to the overall adequacy index, as elaborated through the Ageing FishBone model. Table 1 gives the classes of ageing reduction rate and related range of values. Table 1. Adequacy of ageing management and ageing reduction rate. Adequacy of ageing management Inadequate management Improvable management Adequate management
Range of values (adequacy of ageing management) - 3 ≤ Ioverall < 0 0 ≤ Ioverall < + 1 + 1 ≤ Ioverall < + 3
Ageing reduction rate
Range of value (ageing reduction rate)
Low Medium High
ARR ≤ 1 1 < ARR ≤ 2 ARR > 2
4. Case-study In Italy, since the issuing date of the guideline for the verification of the adequacy of ageing management plans, operators of major hazard establishments and inspectors started to apply the Ageing FishBone model. In the last six months of 2018 and during the first six months of 2019, 28 establishments were investigated (see Table 2). They include refineries, liquid fuel and LPG depots, costal depots, thermoelectric power plants and other chemical establishments. Table 2. List of investigated establishments. Establishment Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 Case 7 Case 8 Case 9 Case 10 Case 11
Type
Number of critical equipment Liquid fuels depot 13 atmospheric tanks Production of additives for liquid 11 atmospheric tanks fuels 2 pressurised tanks 66 atmospheric tanks Storage unit of a refinery 5 pressurised tanks Liquid fuels depot 2 atmospheric tanks Liquid fuels storage unit of a 9 pressurised tanks petrochemical industry LPG depot 4 pressurised tanks LPG depot 12 pressurised tanks LPG depot 10 pressurised tanks LPG depot 6 pressurised tanks Liquid fuels storage unit of a 6 atmospheric tanks thermoelectric power plant Production of expanded 6 atmospheric tanks
Ageing index (Ia) -1.42
Longevity index (Il) 3.12
-1.9
3.54
-1.64
2.75
1.33
3.33
-2.33
2.7
-2.48 -1.42 -1.77 -2.48
2.74 2.16 2.83 2.87
-1.72
1.83
-1.5
2.25
Case 15 Case 16 Case 17 Case 18 Case 19 Case 20 Case 21 Case 22 Case 23 Case 24 Case 25 Case 26 Case 27
polyurethane Liquid fuels depot Liquid fuels depot Storage tank of a petrochemical industry Refinery Liquid fuels depot Liquid fuels depot LPG depot Production of resins Refinery Liquid fuels depot LPG depot Polymerisation process Polymerisation process Polymerisation process Polymerisation process Chloralkaline process
Case 28
Chloralkaline process
Case 12 Case 13 Case 14
78 atmospheric tanks 3 atmospheric tanks
-1.48 -1.33
2.3 2.4
1 pressurised tank
-1.67
2.33
38 pressurised tanks 15 atmospheric tanks 18 atmospheric tanks 3 pressurised tanks 3 atmospheric tanks 53 pressurised tanks 25 atmospheric tanks 13 pressurised tanks 37 pressurised tanks 8 pressurised tanks 30 pressurised tanks 15 pressurised tanks 4 atmospheric tanks 3 atmospheric tanks 1 pressurised tank
-1.8 -2.17 -1.51 -1.67 -1 -2.52 -2.51 -1.25 -2.01 -1.31 -1.38 -1.8 -1.67
2.95 3.25 2.71 2.83 2.2 3.65 2.53 2.3 3.21 3.11 3.08 2.97 2.85
-1.72
2.3
4.1. Definition of the system The dataset for the definition of the system includes data from one-year inspections (July 2018 – June 2019), i.e. 253 records for atmospheric storage tanks were collected and 247 for pressurised storage tanks and process equipment. The whole dataset was used for the construction of the Bayesian network model and the calibration. Recent works (Milazzo et al., 2018; Milazzo & Bragatto, 2019) provided some useful guide for selecting, discretising and classifying variables that must be included in the BN. Fourteen variables were selected as having significant influence on equipment ageing (Table 3-5); amongst these, there are the factors described in Section 2, except inspections results (INS), which was split in sub-factors (i.e. functionality test results INS1, integrity test results INS2, and inspection scheduling INS3), and defects/damages that was not included because it is already reflected in the results of integrity tests. A variable that measure the ageing reduction rate (ARR) was included that gives the effects of retarding factors on the deterioration. Bayesian networks can process both continuous and discrete variables, but as the variables from the Ageing FishBone model are discrete or can be discretised by defining some ranges, discrete variables were adopted in this study. The values for the variables (states) and related descriptions are shown in Tables 3-5, whereas criteria for discretisation are those used by Milazzo & Bragatto (2019). Table 3. Variables representing the adequateness of ageing management. Variable class -
Variable name
Range of values for
Value description
characteristics Target variable - Ageing reduction continuous rate (ARR)
discretisation (R) R≤1 1
Low Medium High
Table 4. Variables affecting equipment ageing and discretisation of value. Variable class characteristics
Variable name
Accelerating factor continuous
Age/In-service time (AGE)
Accelerating factor continuous
Stops (STP)
Accelerating factor continuous
Failures (FR)
Accelerating factor continuous
Accidents/Nearmisses (EVE)
Accelerating factor continuous
Deterioration mechanisms (DET)
Range of values for discretisation (R) R ≤ 90% 90 % < R ≤ 100% 100 % < R ≤ 125% R > 125% R ≤ 10% 10 % < R ≤ 25% 25 % < R ≤ 60% R > 60% R ≤ 0.5 0.5 < R ≤ 1 1
Value description Young Mature Old Very old Low Medium-low Medium-high High Low Medium-low Medium-high High Low Medium-low Medium-high High Slight Medium High Very high
Table 5. Variables affecting equipment longevity and discretisation of value. Variable class characteristics
Variable name
Retarding factor Audit SMS (AUD) continuous Integrity Retarding factor management system discrete (IMS) Retarding factor - Integrity test results continuous (INS2)
Retarding factor - Inspection continuous scheduling (INS3)
Retarding factor - Functionality test continuous results (INS1)
Retarding factor - Adequacy control discrete (EFF)
Retarding factor Process control (PC) discrete
Retarding factor - Physical protections continuous (PHY)
Range of values for discretisation (R) R≤1 1
Value description High no-conformities Medium-high no-conformities Medium-low no-conformities Low no-conformities Compliant with legislation According to RBI Updated after changes Periodically updated Poor Medium Good Excellent Poor compliance Adequate compliance Good compliance Total compliance Poor Medium Good Excellent Adequate Efficient Very efficient Best Unregistering local control system Control system with data recording Control system with data recording + automatic blockage Certified SIL Poor conditions Medium-poor conditions Medium-good conditions Good conditions
4.2. Structure learning Factors, having a significant role in defining ageing, were described, this allowed identifying the variables that are independent or dependent on each other. In this paper, the BN was derived by using the experts’ experience of the Italian working group, that defined the guideline supporting the verification of the adequacy of ageing management plans at Seveso establishments. By referring to the factors (variables), given in Section 2, the cause-effect relationships amongst them and the equipment conditions were identified. These relationships were obtained by means of a prior knowledge and observations of the system; hence, they were reported in the network. The BN was constructed by the software Netica.
4.3. Parameter learning The use of Netica supported the execution of the parameter learning by means of the Counting Learning algorithm, which gave the conditional probability distribution of nodes of the Bayesian network, based on the acquired evidences, i.e. it works by modifying the conditional probabilities of the node for which an evidence is acquired and provides the values for all its parents (Norsys website). To validate the model, a sensitivity analysis was used to identify sensitive factors (nodes) with a significant impact on the target node. In this work, the ageing reduction rate was selected as target node and the sensitivity analysis function of Netica was used. Finally, the leave-k-out cross-validation procedure was adopted to verify the accuracy of the model in fitting and predicting the ageing reduction rate. The process was performed according to the following steps. Firstly, the list of collected equipment (with respect to each equipment class) was rearranged in a random order to extract as many heterogeneous sub-sets as possible, then, atmospheric tanks were subdivided in 11 subsets and pressurised tanks and process equipment in 13. Subsequently, a subset at a time was removed and the network was trained with the remaining data. The network behaviour was verified by modifying the states’ distribution of the most sensitive nodes. 5. Results and discussion 5.1. Bayesian network model and validation Experts’ knowledge allowed formulating the Bayesian network structure given in Figure 2. The network is composed by 14 nodes, which refer to 14 variables, and several links indicating the relationships among the variables. Some variables have hierarchical relations in affecting others and being affected by others. The number of nodes becomes 13 for atmospheric equipment. Two accelerating factors, i.e. accidents/near-misses and stops, affect the final ageing reduction rate index. Both represent undesirable events, which cause stress to the equipment materials and, therefore, promote ageing. These events are caused by failures, which are identified as losses of containment due to the presence of defects/damage. The correlation between failures and defects/damages is highlighted by connecting the first one with the factor integrity test results (subfactor of inspections results). For pressurised/process equipment, also the correlation between failures and functionality test results (sub-factor of inspections results) must be included (see dashed box in Figure 2). The results of the integrity and functionality tests are affected by inspection scheduling (sub-factor of inspections results), which in in turn is affected by the integrity
management system. Defects/damages are the result of deterioration mechanisms, although the chronological age (age/in-service time) also contributes to their appearance. At the same time, defects/damages can be managed through adequate controls (adequacy control). The integrity management system and audits of SMS act on the adequacy of the controls. In addition, deterioration mechanisms are slowed down by physical protections, therefore their conditions and the frequency of their inspections are very important. Finally, the process control has the function to avoid the variability of operating parameters, which could accelerate many damage mechanisms; such a variability is then reflected on the defects/damages.
Figure 2: Bayesian network structure for atmospheric equipment and pressurised/process equipment. Table 6 gives the distribution of states for each factor, in term of frequency and percentage, and equipment type. The Bayesian network of Figure 2 was created in Netica, then, parameter learning gave the conditional probability distribution of nodes and the model for ageing causation analysis. The results are shown in Figures 3 and 4, respectively, for atmospheric tanks and pressurised/process equipment. By means of the sensitivity analysis, the impact degrees of other nodes on ageing reduction rate was calculated and given in a descending order.
Table 6. Distribution of states. Variable name
AGE
STP
FR
EVE
DET
AUD
IMS
INS1
Value description Young Mature Old Very old Low Medium-low Medium-high High Low Medium-low Medium-high High Low Medium-low Medium-high High Slight Medium High Very high High no-conformities Medium-high no-conformities Medium-low no-conformities Low no-conformities Compliant with legislation According to RBI Updated after changes Periodically updated Poor Medium Good Excellent
Atmospheric tanks Frequency 215 22 4 12 243 4 5 1 34 122 66 31 130 28 81 14 56 88 70 39 84 43 93 33 69 49 120 15 0 5 0 64
% 84.98 8.70 1.58 4.74 96.05 1.58 1.98 0.40 13.44 48.22 26.09 12.25 51.38 11.07 32.02 5.53 22.13 34.78 27.67 15.42 33.20 17.00 36.76 13.04 27.27 19.37 47.43 5.93 0.00 7.25 0.00 92.75
Pressurised/process equipment Frequency % 192 77.73 34 13.77 13 5.26 8 3.24 145 58.70 9 3.64 39 15.79 54 21.86 148 59.92 89 36.03 0 0.00 10 4.05 130 52.63 37 14.98 53 21.46 27 10.93 49 20.16 31 12.76 43 17.70 120 49.38 3 1.21 47 19.03 45 18.22 152 61.54 58 23.48 134 54.25 55 22.27 0 0.00 0 0.00 0 0.00 0 0.00 218 100.00
INS2
INS3
EFF
PC
PHY
Poor Medium Good Excellent Poor compliance Adequate compliance Good compliance Total compliance Adequate Efficient Very efficient Best Unregistering local control system Control system with data recording Control system with data recording + automatic blockage Certified SIL Poor conditions Medium-poor conditions Medium-good conditions Good conditions
10 1 0 144 41 0 0 146 90 32 49 82 27 114
6.45 0.65 0.00 92.90 21.93 0.00 0.00 78.07 35.57 12.65 19.37 32.41 10.67 45.06
0 0 0 207 25 4 0 218 9 33 179 26 26 1
0.00 0.00 0.00 100.00 10.12 1.62 0.00 88.26 3.64 13.36 72.47 10.53 10.53 0.40
97
38.34
155
62.75
15 98 80 73 2
5.93 38.74 31.62 28.85 0.79
65 86 31 74 56
26.32 34.82 12.55 29.96 22.67
Figure 3: Bayesian network model for atmospheric tanks after parameter learning.
Figure 4: Bayesian network model for pressurised/process equipment after parameter learning.
The results of sensitivity analysis are shown Figure 5, which gives a comparison amongst mutual information of the various equipment, i.e. the direct or indirect information flow rate and, thus, measures the degree of dependence between each node and the target one. Based on these results, nodes with the relatively greater contribution to the ageing reduction rate were identified: stops, accidents/near-misses, failures and integrity test results are the most relevant for each type of equipment. The trend of the results can be explained on the basis of the following considerations. All these undesired events (such as stops, near-misses and accidents) give the greatest contribution to the increase of the ageing rate. The identification of defects/damages (integrity test results) significantly helps to prevent the stresses that these events cause to the equipment. The contributions of the other factors are minimal for the atmospheric or pressurised/process equipment, whereas a small not negligible contribution to the ageing reduction, for pressurised equipment, is given by the functionality test results.
Figure 5: Results of sensitivity analysis.
The cross-validation process was performed as described in Section 4.3. The network behaviour was verified by modifying the state distributions of two of the most sensitive nodes, i.e. integrity test results (INS2) and stops (STP), and comparing the results with the initial distributions. The following elaborations were made with respect to the target node: (i) a priori elaboration: -
calculation of the average a priori probability distribution of ARR, which is obtained by averaging the a priori distributions derived from the initial dataset and from which a subset at a time, of those defined in Section 4.3 (11 for atmospheric and 13 tanks for pressurized tanks / process equipment), is excluded.
-
calculation of the maximum mean absolute error (MAE), which is the maximum MAE for the target node;
-
calculation of the standard deviation at each state of ARR.
(ii) a posteriori elaboration: -
calculation of the average a posteriori probability distribution of ARR, which is obtained, after an evidence is entered at a sensitive node (INS2 and STP), by averaging the a posteriori distributions derived from the initial dataset and from which a subset at a time is excluded (see Section 4.3). An evidence is entered at each state of the sensitive node;
-
calculation of the maximum mean absolute error (MAE), which is the maximum MAE for the target node after an evidence is entered at each state of sensitive node;
-
calculation the standard deviation at each state of ARR.
Results of cross-validation are shown in Figures 6 and 7. Figure 6(a-b) shows the average a priori and a posteriori distributions for the ageing reduction rate, calculated for atmospheric tanks, respectively, when an evidence is entered at each state of the nodes integrity test results (INS2) and stops (STP). The values of the standard deviation are also shown on each histogram. The maximum MAE is 0.51 % in elaborating the a priori distribution of ARR, whereas it assumes the values 0.99 % and 2.44 % in the a posteriori prediction of ARR, respectively, when the distribution of integrity test results and stops is modified by entering an evidence at each state. Similarly, Figure 7(a-b) shows the average a priori and a posteriori distributions for the ageing reduction rate, calculated for pressurised/process equipment again when an evidence is entered at each state of the nodes integrity test results (INS2) and stops (STP). Also, in this case the values of the standard deviation are shown on each histogram. The maximum MAE is 0.46 % in elaborating the a priori distribution of ARR, whereas it assumes the values 0.46 % and 0.87 % in the a posteriori prediction of ARR, respectively, when the distribution of integrity test results and stops is modified by entering an evidence at each
state. These results suggest that the Bayesian network model has both very high accuracy in fitting data and predicting ageing reduction rate for atmospheric tanks and pressurised/process equipment.
(a)
(b) Figure 6: Cross-validation results for atmospheric tanks: average a priori and a posteriori probability distribution when (a) the node integrity test results assumes 100% at each state (MAE = 0.99%) and (b) the node stops assumes 100% at each state (MAE = 2.44%).
(a)
(b) Figure 7: Cross-validation results for pressurised/process equipment: average a priori and a posteriori probability distribution when (a) the node integrity test results assumes 100% at each state (MAE = 0.46%) and (b) the node accidents/near-misses assumes 100% at each state (MAE = 0.87%).
5.2. Discussion The results presented in Section 5.1 were used to make some considerations with respect to the application of the Ageing FishBone method. As mentioned in the introduction, to have a method shared by industry and regulators, many a priori assumptions were made. The main significant assumption are: 1. the distributions of four states are assumed to be uniform or normal with a high standard deviation for all factors; 2. all factors have the same weight in contributing to the overall adequacy index. Some factors are split in two or three sub-factors, but again each of them has the same weight. 3. even though a few factors are not independent each other, data are assumed to be independent. Damages and inspection results, for instance, could be linked each other, as well as failures and accidents/near-misses. By exploiting the data, gathered during the initial applications of the model for inspections, it was possible to understand if the initial assumption were reasonable and if updates and/or enhancements are needed. To verifying the credibility of the a priori assumptions, it was necessary to answer the following questions: 1. which is the actual factors’ distribution? if the actual distribution is very different from a priori ones, the score should be deeply revised. Revisions may be done to the interval or even to the linear score conversion. 2. which factors may be considered actually independent? which factors may be considered “causal”? 3. which factors are effect or duplication of others? in this case could they be anyway useful for a cross check? 4. are decisions, based on a priori assumptions, acceptable as experimental applications of the method? The application of the Ageing FishBone model was very wide, thus, very different establishments were analysed (e.g. refineries, petrochemical plants, tank farms, LPG depots, large and small chemical plants), with different equipment types (e.g. pressurised vessels, atmospheric vessels, drum, heat exchangers, etc.). Some discriminations were reasonable, firstly pressurised vessels and atmospheric tanks were distinguished, as the first ones are regulated by the EU PED Directive and by the Italian legislation, which define technical verifications, supervised by regulators and
providing trustable standardised data, whilst the second typologies are ruled by voluntary codes and data are less uniform. To answer the first question above, the state distributions were examined by means of the Bayesian networks given in Figures 3 and 4. These distributions are identified to be similar to those indicated in Table 7. Table 7. States’ distribution in the Bayesian networks (in bracket the state with highest value) Factor AGE STP FR EVE DET IMS AUD EFF INS2 INS3 INS1 PC PHY
States distribution for atmospheric tanks Exponential (1) Exponential (1) Exponential (1) Uniform Uniform Uniform Uniform Uniform Uniform Uniform No applicable Exponential (3) Uniform
States distribution for pressurised/process equipment Exponential (1) Exponential (1) Exponential (1) Uniform Uniform Uniform Normal (the value 4 does not exist) Normal Uniform Exponential (4) Exponential (4) Exponential (3) Normal
It can be observed that the distribution of states for the factor age (AGE) is unbalanced, this is due to evidence that the design age, due to the loss of documentation provided by the manufacturer, is not realistic and most operators assume high values. The assigned data should be reviewed. For the factor stops (STP), it is always observed that the lowest value of the state is little influential. It should be noted that the factor is not always applicable, therefore, it should be eliminated where it does not appear significant or it should be associated with a reduced weight. For the factor failures (FR), the distribution is centred on the lowest value, however it follows a regular trend, thus, it could be useful to better centre the four scale values. For the factors safety management system (AUD) and adequacy controls (EFF) distributions are credible, as well as adhering to the standard. Also, the factors deterioration mechanisms (DET) and accidents/near-misses (EVE) appear to be based on reasonable a priori hypotheses. For the factors integrity management system (IMS), integrity test results (INS2) and physical protections (PHY), the distributions are valid with a low approximation. However, they are not applied to all cases. The factors functionality tests results (INS1) appears having a little influence, as these checks can only be applied to pressurised equipment/process equipment. The factor inspection scheduling (INS3) is also not very influential. For the factor process control an almost complete uniformity on the third state is observed,
probably the factor must be better specified, since in this way it is little influential. From this analysis the less important factors are process control (PC), inspections scheduling (INS3), functionality test results (INS1), audits (AUD) and the integrity management system (IMS). These considerations are in line with the results of the sensitivity analysis. The answer to the second question is provided directly by the results of cross-validation and sensitivity. The variation of the most sensitive nodes shows very small errors (MAE), which confirm the robustness of the relationships built in these networks. Concerning the third question, a redundancy was identified, this regards the factor damages which is reflected in integrity test results, as well as other adjustments suggested in the discussion above. Finally, the answer to the fourth question is a summary of all observations. It can be surely confirmed that, even some revisions are needed, the method based on the previously discussed a priori assumptions is valid and robust in assessing ageing. 6. Conclusions The Italian Seveso Competent Authority has well addressed the emerging issue of ageing in Seveso establishments. Starting from very poor data on the real conditions of the equipment in Italy, a simplified method (Ageing FishBone model) was derived, based on expert judgments and a priori assumptions. The method allowed the inspectors making decisions during on-site inspections and the Italian Authorities starting collecting systematic data on equipment ageing conditions in chemical and oil industries. Collected data was analysed through a Bayesian Network, which provided a confirmation of the substantial adequacy of the method and suggested a few valuable suggestions to improve the method. During the period 2018-19, the method was applied in some Italian regions and only to static containment equipment (e.g. pipeworks and vessels), but in the future it will be used also for other typologies and be likely extended to the analysis of dynamic systems (e.g. pumps and compressors). In this way, within a few years the regulators will have a detailed and updated e picture of national Seveso sites’ condition from the point of view of deterioration. The Competent Authority will analyse the new data through the methods described in the present paper and, thus, will be support by useful information for a right decision-making about ageing management. Unfortunately, in the next years, large investments for radical establishment renewals are not expected, therefore, the issue of ageing will consequently continue to be a priority for Seveso Authority. Acknowledgment
The work was partially funded by INAIL within the call BRIC/2016, ID = 15, SMARTBENCH project. References Aizpurua, J.I., Catterson, V.M., Papadopoulos, Y., Chiacchio, F., D'Urso, D., 2017. Supporting group maintenance through prognostics-enhanced dynamic dependability prediction. Reliability Engineering and System Safety 168, 171-188. Andrews, J., Fecarotti, C., 2017. System design and maintenance modelling for safety in extended life operation. Reliability Engineering and System Safety 163, 95-108. Arlot, S., Celisse, A., 2010. A survey of cross-validation procedures for model selection. Statistics Surveys, 4, 40-79. Bragatto P.A., Milazzo, M.F., 2016. Risk due to the ageing of equipment: Assessment and management. Chemical Engineering Transactions 53, 253-258. Bragatto, P., Delle Site, C., Faragnoli, A., 2012. Opportunities and Threats of Risk Based Inspections: the new Italian Legislation on Pressure Equipment Inspection. Chemical Engineering Transactions 26, 177-182. Candreva, F., Houari, M., 2013. Plant screening for ageing impact in the process industry. Chemical Engineering Transactions 31, 253-258. Cover, T.M, Thomas, J.A., 2006. Elements of information theory. Wiley. Fabiano, B., Currò, F., 2012. From a survey on accidents in the downstream oil industry to the development of a detailed near-miss reporting system. Process Safety and Environmental Protection 90(5), 357-367. Gyenes, Z., Wood, M.H., 2016. Lessons learned from major accidents relating to ageing of chemical plants. Chemical Engineering Transactions 48, 733-738. Horrocks, P., Mansfield, D., Thomson, J., Parkerv, K., Winter, P., 2010. Plant Ageing Study Phase 1 Report. Health and Safety Executive Report no. RR823. International Atomic Energy Agency (IAEA), 2009. Ageing Management for Nuclear Power Plants. IAEA Safety Standards Series NS-G-2.12. Khakzad, N., Khan, F., Amyotte P., 2015. Major Accidents (Gray Swans) Likelihood Modeling UsingAccident Precursors and Approximate Reasoning. Risk Analysis 35(7), 1336-1347. Kieskamp, K.K., Heezen, P.A.M., Geus, E.C.J., 2019. Ageing (- Seveso installations) in the Netherlands. Chemical Engineering Transactions, 75 (in press). Koski, T., Noble, J.M., 2009. Bayesian Networks: An Introduction. Wiley Series in Probability and Statistics. Milazzo, M.F., Ancione, G., Scionti, G., Bragatto, P.A., 2018. Assessment and Management of Ageing of critical Equipment at Seveso site. Safety and reliability – Safe societies in a changing world. Proceedings of the 28th International European Safety and Reliability Conference ESREL2018, pp. 1629-1636.
Milazzo, M.F., Bragatto, P.A., 2019. A framework addressing a safe ageing management in complex industrial sites: The Italian experience in «Seveso» establishments. Journal of Loss Prevention in the Process Industries 58, 70-81. Mohamed, R., Che Hassan, C.R., Hamid, M.D., 2019. Critical success factors of risk-based inspection. Process Safety Progress 38 (1), 4-20. Norsys website: https://www.norsys.com/ (accessed on the 11th August 2019). Organisation for Economic Cooperation and Development (OECD), 2017. Ageing of Hazardous Installations. OECD Environment, Health and Safety Publications – Series on Chemical Accidents no. 29. Ossai, C.I., Boswell, B., Davies, I.J., 2016. Stochastic modelling of perfect inspection and repair actions for leak-failure prone internal corroded pipelines. Engineering Failure Analysis 60, 4056. Pearl, J., 1986. Fusion, propagation, and structuring in belief networks. Artificial Intelligence 29(3), 241-288. Pearl, J., 1988. Probabilistic Reasoning in Intelligent Systems - Networks of Plausible Inference. Morgan Kaufmann. Pearson, K., 1920. The fundamental problem of practical statistics. Biometrika 13, 1-16. Pittiglio, P., Bragatto, P., Delle Site, C. 2014. Updated failure rates and risk management in process industries. Energy Procedia 45, 1364-1371. Prod’homme, G., Richomme, S. Industrial installation ageing management Refinery storage benchmark. Document no. DRA-09-102957-08289B. Accessed on the 11th February 2020: https://www.ineris.fr/sites/ineris.fr/files/contribution/Documents/dra-09-102957-08289bmedde-1357657410.pdf Sobral, J., Ferreira, L., 2015. Establishment of optimal physical assets inspection frequency based on risk principles. Maintenance and Reliability, 17(2), 243-249. Wintle, J., Moore, P., Henry, N., Smalley, S., Amphlett, G., 2006. Plant ageing. Management of equipment containing hazardous fluids or pressure. Health and Safety Executive Report no. RR509. Wood, M.H., Arellano, A.V., Van Wijk, L., 2013. Corrosion Related Accidents in Petroleum Refineries. European Commission Joint Research Centre Report no. EUR 26331.
Author Statement: Giuseppa Ancione: Conceptualization, Methodology, Software, Validation Paolo Bragatto: Methodology, Original draft preparation, Data curation Maria Francesca Milazzo: Methodology, Supervision; Original draft preparation, WritingReviewing and Editing
Declaration of interests ☒ The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. ☒The authors declare the following financial interests/personal relationships which may be considered as potential competing interests: None
Messina, 20 December 2019
Signature