Mixed Uncertainty Analysis in Pressure Systems Inspection Applications Free

High-pressure fluids are needed in many industrial processes. The consequences of losing containment of a fluid held under high pressure can be severe, especially if the fluid is in the gas phase (e.g., steam), toxic or flammable. Accordingly, the static equipment used to contain these fluids within pressurized systems (pressure vessels, piping, valves, etc.) is carefully designed, constructed, and operated to reduce the likelihood of failure, which ensures the risk of operating the system is tolerable once it is commissioned and any ‘infant mortality’ failures have been rectified [1]. However, pressure system assets are subject to degradation resulting from age-related deterioration mechanisms including corrosion, fatigue, and erosion. In addition, as time in service increases, the likelihood increases that deterioration mechanisms that occur at random (such as mechanical damage) will manifest themselves. Fortunately, as engineered systems are usually designed with generous safety margins, degradation initially has little impact on asset integrity or “the ability of an asset to perform its required function effectively and efficiently whilst protecting health, safety, and the environment” [2].

The challenge comes when a pressure system asset reaches the “aging” phase of its life. Aging equipment is “equipment for which there is evidence or likelihood of significant deterioration and damage taking place since new, or for which there is insufficient information and knowledge available to know the extent to which this possibility exists.” [3]. Once subsystems, equipment items, and components begin aging, they are no longer able to perform their required function safely and reliably indefinitely without intervention; the integrity of the asset needs to be more actively managed. Asset integrity management is “the means of ensuring that the people, systems, processes, and resources that deliver integrity are in place, in use and will perform when required over the whole lifecycle of the asset” [2]. Development of reliability engineering tools and techniques to support asset integrity management is becoming an urgent area for research due to the increasing prevalence of aging plant in industry [4].

Once an operational plant is in the aging phase, the condition of its assets can vary much more extensively in comparison to its initial condition, which resulted from manufacturing under controlled conditions. This variation makes inspection of equipment more challenging; we can be less certain about how well any one sample inspection location represents the whole. Moreover, tools and techniques used to inspect equipment condition are not completely accurate, which means that even if every single part of a pressure system were inspected, we could still not predict with certainty when and where failure would occur. In the face of this uncertainty, inspectors must first decide if any intervention is needed to allow equipment to continue to operate following an inspection, and then decide when it must next be inspected. There is therefore an opportunity to apply mixed uncertainty reliability analysis methodologies to industrial inspection.

This paper introduces pressure systems inspection and explains its importance. It then reviews the importance of understanding uncertainty when planning inspections, analyzing inspection data, and when using inspection data analysis to assess the integrity of pressure systems. To show the benefits of applying uncertainty quantification and analysis techniques in inspection applications, a worked example using simulated thickness data measurements shows how uncertainty in inspection data can be represented using an imprecise probability approach. This is used to present the advantages of making decisions where the uncertainty in the underlying data is made explicit. The discussion section considers additional challenges when developing uncertainty quantification methodologies for use in the field with real data. The paper's final contribution is to identify remaining research challenges and tentatively set out requirements for an analysis framework to manage mixed uncertainty in inspection data.

Inspection forms an important part of an asset integrity management system. In many countries, periodic in-service inspection of pressure systems to examine their condition is a legal requirement, due to the potential consequences of their failure on people, the environment, and property. The Pressure Systems Safety Regulations in UK law defines the examination done during inspection and its purposes as follows [5].

““[E]xamination” means a careful and critical scrutiny of a pressure system or part of a pressure system, in or out of service as appropriate, using suitable techniques, including testing where appropriate, to assess–

• its actual condition; and

• whether, for the period up to the next examination, it will not cause danger when properly used if normal maintenance is carried out, and for this purpose “normal maintenance” means such maintenance as it is reasonable to expect the user (in the case of an installed system) or owner (in the case of a mobile system) to ensure is carried out independently of any advice from the competent person making the examination;”

Suitable inspection techniques include visual inspection methods and nondestructive testing (NDT). NDT techniques such as ultrasonics and radiography can be used either as screening tools to identify defects or as measurement tools to characterize them. Although visual techniques can be more effective, NDT is often the preferred or indeed the only means of assessing the surface condition. The internal surface of pipework, for example, can only be inspected visually close to flange connections. In-service inspection using visual and NDT techniques is done in two main contexts [6].

1. Degradation is not expected (or no further deterioration is expected since a previous inspection) and the purpose of the inspection is to validate this hypothesis.

2. Degradation is expected, and the purpose of the inspection is to characterize the degree of degradation to allow the integrity of the equipment to be assessed.

For both contexts, once inspection has determined the actual condition of the equipment, any change in condition over time can be assessed, likely degradation into the future evaluated, and a suitable interval until the next inspection can be determined. Where equipment is found to not be degrading, this evaluation is more straightforward.

Uncertainty is at the heart of pressure system inspection. Beyond achieving regulatory compliance, an inspection has value because the information gained from it can reduce uncertainty about the condition of equipment and the hazard presented by its potential failure. It can confirm whether deterioration mechanisms are active or not, and if active, can provide insight about the extent of degradation and the rate at which it is progressing [7]. The value of this information in reducing uncertainty is demonstrated by UK operators of pressure systems often including nonpressurized storage tanks into the scope of their inspection programs even though there is no legal requirement to do so. Inspection does not directly reduce the likelihood or consequence of failure, as separate preventative actions are needed to reduce likelihood, and mitigating actions are needed to reduce consequence. However, inspection still reduces risk because risk can be defined as “the effect of uncertainty on objectives” [8]. Following an inspection, the asset owner or system user can be more certain about their objectives (e.g., continue to operate the pressure system safely and reliably for a further 10 years).

Inspection reduces uncertainty, but not necessarily from a starting point of total ignorance about equipment condition. Before inspection, it is possible to reduce uncertainty about the integrity of a pressure system by conducting a risk assessment. A Risk-Based Inspection study (RBI) will seek to understand the design of the pressure system, how it is operated and maintained, and the findings of any previous inspections [9]. This review will be used to identify credible deterioration mechanisms and failure modes, locations susceptible to deterioration, and the likelihood and consequence of failure scenarios. Based on this information, an inspector will develop a targeted inspection strategy using appropriate techniques. As the number of inspections increases over time, the amount of prior information increases, and uncertainty and risk are generally reduced further. However, additional data may fail to reduce uncertainty if it is sufficiently imprecise [10]. Inspection data should be obtained through an accredited inspection body by certified inspectors following defined processes. If these quality assurances are not in place, then the resulting inspection data may increase uncertainty even if it has high stated precision. Similarly, historical inspection records can only contribute to uncertainty reduction if they are accessible, or the data has been summarized in a format that can be subsequently queried and analyzed. Adoption of ‘big data’ practices is still limited within industry and there is no widely adopted open standard for inspection data. Development of digital inspection workflows including standardized inspection information models and NDT data exchange protocols is therefore an active topic for research (e.g., Ref. [11]) The topic is important because there is still “a long way to go” for industry to adopt what has been termed “NDE 4.0” [12] and the increasing use of drones and continuous online inspection devices will create new sources of epistemic uncertainty that will have to be managed in the pressure systems inspection process.

Inspection reduces risk but it does not eliminate it. Uncertainty remains associated with both the inspection data and the interpretation of its uncertainty, which can be aleatory or epistemic in character [13]. The remainder of this section introduces both classes of uncertainty in context of inspection data.

The condition of a pressure system naturally varies across the equipment surfaces (both internal and external). Some areas will be in better condition than others, even though these differences may be small and have a negligible impact on the assets' integrity overall. Some of this variance is understandable and can be predicted, modeled, or measured effectively. However, despite engineers' best efforts, some degree of irreducible randomness or stochasticity relating to the asset condition and its effect on asset integrity remains [13]. Indeed, there will be a degree of variation in the asset condition within a “fleet” of similarly designed and operated equipment items. The variable nature of equipment condition “that for practical purposes cannot be predicted” no matter how much data collection and modeling is done is a form of aleatory uncertainty [14]. This aleatory uncertainty arises for two main reasons. The first reason is that the original, as-built condition of equipment is not uniform. The dimensions and properties of pressure vessel materials of construction are subject to variance within acceptable tolerances. For example, the wall thickness both along and around a newly installed piping spool will not be completely uniform. Moreover, even though fabrication processes such as forming, welding, and painting are also performed in accordance with quality assurance procedures, they introduce additional variance to the condition of equipment at distinct locations. For example, properties such as strength and toughness will vary in areas near welds in welded pressure vessels following fabrication [15].

The second reason for aleatory uncertainty surrounding the condition of pressure systems is that asset condition does not deteriorate uniformly with time in service. Degradation will initiate at varying points in time at different locations and then progress at different rates [16]. In the case of corrosion-driven degradation, additional variability arises from the coverage of degradation (the spatial distribution of locations where corrosion initiates and develops over the equipment surfaces) and the morphology of degradation (the form each individual corrosion defect takes in three dimensions), further contributing to the aleatory uncertainty [17]. Although aleatory uncertainty means the actual condition of each element of a pressure system equipment item cannot be predicted, collectively the values will form a distribution that can be modeled using frequentist probability theory [13].

In addition to the irreducible aleatory uncertainty surrounding the actual condition of equipment described above, additional uncertainty is introduced when attempting to measure this condition. The uncertainty stems from a lack of knowledge rather than randomness. In theory, this uncertainty can be reduced by gathering more and better inspection information, so it is known as epistemic uncertainty [18]. Epistemic uncertainty can be a combination of sample uncertainty, measurement uncertainty, and model uncertainty.

It is usually not economically feasible nor technically necessary to inspect the entirety of a pressure system. Consequently, a partial coverage inspection strategy is typically adopted [19], which means that inspection data is only captured from a sample area of the overall “population” of areas over the equipment surfaces. This introduces sample uncertainty; uncertainty about how well the sampled values represent the population.

Both visual inspection and NDT inspection techniques suffer from imperfect mensuration, censoring, and missing values, which all introduce measurement uncertainty [18]. Like all measurement methods, they are neither totally accurate nor repeatable. Mensuration, or the act or process of taking a measurement [18], done during an inspection is influenced by many factors that contribute to uncertainty (see Fig. 1 in Ref. [20]). In addition, inspection techniques do not detect defects with 100% reliability. Certain damage morphologies have a lower probability of detection (PoD) and below a certain defect size (dictated by the measurement technique) flaws cannot be reliably detected without false positives becoming an issue [21,22]. This is known as left-censoring [18]. Another type of censoring is interval-censoring, when data is binned, or placed into groups. Missing data could arise from some surface locations being inaccessible and therefore unmeasurable, or from human factors.

Finally, when statistical techniques are used to analyze inspection data, another type of epistemic uncertainty is introduced: model uncertainty. To allow inferences and extrapolations to be made from the limited measured data, a statistical model is required. Once fitted to the empirical data the model can approximate, but not fully reproduce, the underlying probability distribution that generated the measured data. This approximation creates further uncertainty when inferring values between measured data points or making extrapolations beyond them.

Insofar as epistemic uncertainty is characterized by ignorance, it can be appropriate to represent it using an interval value rather than a distribution because the interval makes no unwarranted assertions about what the value is beyond defining its upper and lower bounds [13] (such assertions could be the central tendency or distributional shape, e.g., assuming a uniform or normal distribution between the intervals). The interval is defined by a lower bound and an upper bound, which could be constrained uncontroversially by theoretical knowledge (such as it not being physically possible for thickness to be below zero). Where there is no known theoretical limit, historical field data, laboratory experiments or expert elicitation could be used to define the interval. Care would have to be taken with all these approaches to ensure that the interval fully covers the possible range of values rather than just the historically observed or likely range. Vagueness can be considered a third type of uncertainty. It can be argued that interval bounds are arbitrarily specific when used to characterize epistemic uncertainty, and a truer representation of the measurement uncertainty would be given by a “fuzzy” bound [23]. This bound would give a graded characterization of what values a measurand might have rather than a binary characterization (for example, within range, possible, outside range, impossible).

This section introduces three inspection activities where it would be beneficial to have the ability to concurrently analyze several types of uncertainty, as it would enable decision-making based on a more complete understanding of risk. It demonstrates that application of mixed uncertainty analysis methods would extend the current state of the art in at least three aspects of inspection and asset integrity management practice: inspection planning, inspection data analysis, and integrity assessment.

Effective inspection requires planning to ensure that enough inspection of the right type is done to allow robust conclusions to be reached about equipment condition, while avoiding excessive inspection that increases costs but yields negligible additional information or is otherwise not technically necessary. When planning an inspection, inspectors must select one or more suitable inspection techniques to detect and characterize each type of degradation that has been identified as credible and posing sufficient risk to warrant mitigation by inclusion in the inspection plan. Consideration needs to be given to factors that could affect inspection performance [6], leading to increasing amounts of epistemic uncertainty over and above that presented by the theoretical limitations of inspection techniques. These could include human factors that reduce the accuracy and repeatability of an inspection technique applied in the field compared to under laboratory conditions, factors related to the inspection method, or factors relating to the material being inspected, such as the degree of roughness on surfaces [20]. Inspection planning also has to consider the locations where each technique will be applied and the amount of inspection coverage required to achieve the inspection objective [6]. Aleatory uncertainty will be an important consideration when determining suitable inspection locations and degree of coverage of the equipment surface. If the expected degradation is both spatially homogenous and results in defects with a reasonable density across the surface, then less coverage will be required to characterize it with the same degree of statistical confidence as degradation that is highly heterogeneous and localized (for example, only occurring at internal surface locations subject to higher-velocity flow).

An example scenario for inspection planning would be to decide which of two different NDT techniques to deploy in a pressure vessel inspection. Technique A is a cheap but inaccurate technique, whereas Technique B is more accurate but more expensive. When presented with these two options, an inspection planning method that incorporated mixed uncertainty would be able to determine the best decision in terms of cost and risk. For example, it could be used to assess, for a given budget and expected degradation, whether uncertainty about asset condition (and consequently risk) is minimized overall through prioritizing either

1. sample uncertainty by using technique A to obtain a greater number of less accurate measurements, or

2. measurement uncertainty by using technique B to obtain fewer, more accurate measurements.

When analyzing data collected from inspection, it is important to understand the sources of uncertainty to ensure the correct conclusions are drawn about equipment condition. Not being explicit about the uncertainty in inspection data or being unable to communicate the uncertainty in a way understandable to a nonspecialist audience can lead to misinterpretation of inspection findings (Whoever heard of a pipe getting thicker? is a comment one author has heard several times mentioned by someone who has failed to consider the effect of measurement uncertainty).

As the integrity of a pressure system is determined by its weakest point, an important goal in inspection data analysis is often to understand the extreme values of the condition rather than the central tendency. For some types of degradation, the extreme of interest could be in the upper tail of the distribution, such as determining the likelihood of there being a crack greater than a particular length, rather than the mean size of all cracks. Alternatively, the feature of interest could be in the lower tail of a distribution parameter, such as estimating the minimum wall thickness of a component. Extreme value analysis of distribution tails requires different statistical techniques from those used to analyze the central tendency.

A good example of where understanding how uncertainty in distribution tails affects analysis is the oversizing bias phenomenon that occurs in pipeline inspection data collected by pipeline inspection gauges (pigs), where the depth of corrosion pits is the parameter of interest [24]. Pipelines are periodically inspected to monitor corrosion. Efforts are typically made to match defects between successive inspections, effectively adopting a paired sampling approach to reduce sample uncertainty. Corrosion rates can then be calculated from the change in measured thickness and the time between the two inspections. This calculation is sensitive to measurement uncertainty and can lead to excessive conservativeness [17] because the top percentiles of the measured corrosion rates are dominated by sample pairs where the defect was undersized in the first inspection and oversized in the second. The effect of the measurement uncertainty is not symmetrical due to the depth of corrosion defects being bounded between zero and the thickness of the pipeline wall, which leads to an oversizing bias and excessive conservatism if the bias is not corrected [24].

Once inspection data has provided information about the condition of an equipment item in a pressure system, the effect of this condition on “the ability of an asset to perform its required function effectively and efficiently whilst protecting health, safety and the environment” [2] should be assessed. If the inspection analysis concludes that no degradation has occurred, then the assessment could be trivial. However, if an inspection identifies flaws or damage in a pressure system component, an assessment will have to be done to inform a decision about running, repairing, or replacing the component and the timescales involved [25]. Even where the degradation presents no immediate risk, for planning and budgeting purposes it can be beneficial to estimate the equipment's remaining useful life [26]. These types of assessments usually consider four factors.

1. The maximum possible loading on the asset during operation.

2. The minimum resistance required to withstand the loading and below which the asset will fail.

3. The current resistance or condition of the asset.

4. The rate at which the resistance or condition of the asset is deteriorating.

The loading could be static or dynamic, and related to the fluid pressure or the structural loading on the asset. Loading can vary considerably between normal operation and process excursions or extreme environmental events. Resistance could include properties such as strength, elasticity, or toughness. There will clearly be many epistemic uncertainties associated with these values, so conservative assumptions are often applied to the first two factors to simplify integrity assessment in the first instance. The maximum possible loading during operation is typically set to the design condition (e.g., maximum design pressure) and the strength below which the asset will fail is usually based on a limit or alert value often based on a nominal performance standard or safety factor. Only once a first-level assessment using these criteria fails will a more realistic assessment be conducted using a minimum strength calculation based on an analysis done from first principles. Such Fitness For Service assessments are codified in API 579-1/ASME FFS-1 [25]. However, while it allows the use of probabilistic methods and sensitivities, the methodologies documented in the standard are deterministic and it does not describe any uncertainty quantification techniques. There would therefore be clear benefit in developing fitness for service methods that quantify mixed uncertainties. Examples would be methods to estimate the Future Corrosion Allowance based on an uncertain corrosion rate, an uncertain measured minimum thickness, and uncertain minimum required thickness, incorporating mixed uncertainty into the resulting Future Corrosion Allowance value.

The example in this section applies uncertainty quantification techniques based on imprecise probability to analysis of ultrasonic thickness readings of a pressure system subject to thinning caused by corrosion. It demonstrates that concurrent analysis of several types of uncertainty enables decision-making based on a more complete understanding of risk. The analysis uses simulated data akin to the data that would be taken during an in-service inspection by an inspector using an ultrasonic thickness probe. The outcome is an estimate of the thickness distribution bounded by several types of uncertainty. The “ideal” nature of the simulated data demonstrates how the techniques can be applied and the results interpreted. A simplified corrosion model and a representative partial coverage inspection sampling strategy were developed to generate the simulated dataset.

Corrosion is the phenomenon whereby a material (generally metal) reacts electrochemically with its environment [27]. The reaction results in the metal being transformed into corrosion products at locations where corrosion defects initiate. These products have different properties to the original material, and less volume of the original material remains as a result of the corrosion reaction. Depending on the context, this reaction can be considered to either transform or deteriorate the metal [28]. The ability to withstand forces is the most important property of materials used in pressure equipment in process industry applications. As engineered components subjected to deteriorating corrosion corrode and get thinner, their ability to withstand loads decreases over time. A corroding component will eventually fail when its thickness is below the minimum required to withstand the pressure or structural loads to which it is subjected. The failure mode could be a “pin hole” resulting in a small leak, or a more catastrophic failure leading to a much greater release of fluid and potentially stored energy. Corrosion is an important age-related degradation mechanism that is estimated to cost US$2.5 trillion annually worldwide [29]. Pressure system components can be subject to internal and external corrosion. Ultrasonic NDT techniques are often used during in-service inspection to measure the wall thickness of equipment when corrosion occurs internally, or where the external surface of equipment is inaccessible due to it being buried or insulated.

The analysis method uses confidence bands to represent mixed uncertainty. The use of confidence bands extends the methodologies to analyze pressure equipment thickness data based on empirical cumulative distribution functions (ECDFs) proposed by both industry recommended practice [6,17] and academic contributions (e.g., Refs. [19] and [30]). The cited approaches consider aleatory uncertainty, and epistemic uncertainty arising from sample and model-form uncertainties. However, they do not address epistemic uncertainty resulting from measurement uncertainty (caused by imprecision or nondetects). A confidence band allows both epistemic and aleatory uncertainties to be rigorously combined in one statistical representation and so is a contribution to extend prior art. With further mathematical manipulation, the band can be converted into a more comprehensive confidence structure, which can be used in mathematical models and analytical calculations. This makes them useful in a robust engineering analysis workflow where the analyses are “phrased only in terms of falsifiable claims,” rather than contestable beliefs of the analyst [31]. The starting point is plotting the inspection data as an empirical cumulative distribution function, which represents aleatory uncertainty in the data by showing summarizing it as a monotonically increasing distribution that steps up at each data value (as opposed to reducing the data to some point-value statistic like a mean, or a mean and an error term or confidence interval). Epistemic uncertainty is then represented by extending the precise distribution into a pair of imprecise distributions, forming a probability box. A probability box characterizes what is known about an imprecisely defined probability distribution and the breadth between the two distributions characterizes that imprecision [32]. Confidence bands are a special kind of probability box such that, with some prescribed level of confidence (often 95%), the true distribution will fall entirely within the bounds. That is, over many calculations of such confidence bands the true distribution will be inside the respective bounds at least as often as the stated confidence level. The breadth of the bounds corresponds to the uncertainty arising from incomplete sampling, and it decreases with larger sample sizes. When measurement uncertainty is expressed in the form of intervals, such as with plus-and-minus ranges, the outer bounds of confidence bands will widen further with increasing imprecision of the individual measurements. In the limit, with perfectly precise measurements and very large sample sizes, the confidence bands approach a precise empirical distribution.

By using intervals to represent measurement uncertainty, no assumptions are made about the distribution and dependence of the influencing factors that contribute to the measurement uncertainty within the limits of the interval. Table C2 in EN ISO 16809:2019 [33] indicates that using this approach (referred to as 'Method a' in the standard) gives an error of 0.296 mm for a corrosion probe on a smooth steel plate 10 mm thick in controlled conditions. There are multiple sources of uncertainty when taking ultrasonic thickness measurements ([Fig. 1 in Ref. [20], Table C2 in Ref. [33]) and uncertainty increases for in-service equipment measurements taken in the field, rather than laboratory, conditions. The HOIS-G-028 Guidance on inspection of uninsulated external corrosion scabs (a very difficult measurement scenario) found that the “most accurate” techniques for measuring the thickness of remaining ligatures under corrosion scabs gave an accuracy of ±10% of the uncorroded wall thickness [34]. Nothing was found in more recent literature to refute a claim that “the very best that can be reliably achieved in the field on corrosion measurement, is about 0.5 mm” [35]. This corresponds with a laboratory condition accuracy of 0.296 mm and so the interval used in this example to represent measurement uncertainty is ±0.5 mm for a 10 mm thickness, which falls within the ±10% value quoted for the challenging measurement scenario. The interval uncertainty is represented in a probability box by setting the left and right bounds as ECDFs with each step 0.5 mm below and above the corresponding measured thickness ECDF value, respectively.

where D_α is the critical value setting the bound of the Kolmogorov–Smirnov test for goodness-of-fit for the observed median, α is the specified significance level (e.g., 0.05 for 95% confidence interval), and n is the number of samples.

where S_LN(X) is the fraction of the left endpoints of the values in the data set that are at or below the magnitude X and S_RN(X) is the analogous fraction of right endpoints in the data that are at or below X.

These confidence limits imply that, provided the bounds are constructed from independent data selected randomly from a common, continuous distribution, the true distribution function the samples were drawn from will fall within this bound on 100*(1–α)% of the occasions these bounds are constructed [18]. Accordingly, given a 95% confidence level, the true distribution can be expected to fall within the confidence bounds 95 times out of 100 repetitions of the inspection, provided the sampling strategy achieves measurements that are independent and identically distributed (iid). The confidence limits are applied to the outer bounds of the probability box constructed to represent the measurement uncertainty, forming an imprecise confidence band with a larger area between the left and right bounds that represent the combined epistemic uncertainties.

Several types of corrosion growth model could be used to generate simulated inspection data [37].

• A single-value corrosion growth rate (SVCR) model uses a single, unchanging value for the corrosion rate taken from a data book or standard.

• A linear corrosion growth rate (LCR) model uses the previous wall thickness loss over time (either taking average or minimum values) to determine the prior corrosion rate, which is then used as the future corrosion rate.

• A non-linear corrosion growth rate (NLCR) model determines the future corrosion rate using knowledge of the active corrosion mechanisms and one or more parameters of the equipment and its environment.

• A probabilistic corrosion rate (PCR) model uses statistical techniques to determine corrosion rates.

A probabilistic model was chosen to generate the simulated wall thickness data. The use of imprecise probabilities in probabilistic corrosion modeling has previously been demonstrated by Zhang et al. [38]. As previously discussed, corrosion does not usually have a uniform impact over the surface of a pressure system; there is spatial variance in corrosion coverage. A detailed model would take this into account. However, spatial effects can be discounted by assuming that the inspection sampling strategy selects inspection locations from a sufficiently representative area (i.e., corrosion is not clustered in certain areas). As this simplifying assumption allows the spatial aspects to be ignored, the two-dimensional surface area can be collapsed into a one-dimensional vector of surface locations because a matrix of x and y coordinates no longer adds additional information. Corrosion growth can be modeled using two parameters [16].

1. Corrosion initiation

2. Corrosion growth

where is the F is the proportion (cumulative density) of the surface area where corrosion has initiated, x is the elapsed time, μ is the location parameter, $σW$ is the scale parameter (for the Weibull distribution), and λ is the shape parameter.

The location parameter models an initial period of no corrosion to reflect the reality that components are often protected by coatings to prevent corrosion. The protective coating eventually degrades, allowing corrosion to start occurring. The proportion of the surface area affected by corrosion then begins to increase as the coating progressively degrades. Finally, the initiation rate begins to decline so it takes a long time for the remaining fraction of surface area to be affected by corrosion. A shape parameter greater than one will model this corrosion initiation behavior, while the scale parameter dictates the time at which the initiation rate reaches its peak.

where, f is the probability density of the corrosion rate, y is the corrosion rate, and $σE$ is the scale parameter (for the exponential distribution).

When a simple PCR model is used to simulate the effect of corrosion growth on wall thickness over time, three different distributions within the model create a new thickness distribution to represent aleatory uncertainty.

1. The original thickness distribution over the component surface.

2. The distribution of times at which corrosion initiates at different points over the component surface.

3. The distribution of the corrosion rate at different points over the component surface.

The shape of the new distribution changes at each time-step in the simulation. Table 1 shows the details of the parameters used to generate the simulated data.

10 mm was chosen for the mean initial wall thickness because this is a plausible thickness for piping but more convenient than the nominal thicknesses of 9.53 mm or 10.31 mm to which ASME standard pipe can be manufactured. 0.25 was chosen for the standard deviation of the initial thickness because this value puts five standard deviations between the mean thickness and the allowed ‘mill tolerance’ for seamless piping of 87.5% of nominal thickness. This simulates a well-controlled manufacturing process where the extremely low likelihood of the thickness being below the tolerance (2.86 × 10⁻⁷) means that the distribution does not have to be truncated at 8.75 mm to represent a quality control process removing out of tolerance pipes from the population. 10 mm is also a common thickness for the plate used to manufacture pressure vessels and plate is manufactured to tighter tolerances than seamless pipe, which means that the simulated data could be used to represent data from a piping system or a pressure vessel.

The simulation to generate the thickness data implemented the six steps below in a script written in the Julia Language [40] using a Pluto Notebook [41]. It outputs the matrix of values T, as represented in Eq. (6).

1. Create an array of initial thickness values t (in mm) for M surface locations of an equipment item by sampling from a normal distribution with the parameters in row 1 of Table 1.

2. Create an array of M corrosion initiation times (in years) by sampling from the three-parameter Weibull distribution in Eq. (4) with the parameters in row 2 of Table 1.

3. Create an array of M corrosion growth values (in mm/year) by sampling from the exponential distribution in Eq. (4) with the parameters in row 3 of Table 1.

4. Use an inner FOR loop to calculate for 1 to M surface locations:

   • the corrosion at year i, where corrosion is the corrosion growth value multiplied by i minus the corrosion initiation value, or zero if the corrosion initiation value is greater than time i; and

   • the thickness at year i, where the thickness is the initial thickness value minus the corrosion, or zero if the thickness would otherwise be negative.

5. Use an outer for loop to calculate M thickness values for 1 to N successive years.

6. Return T an M by N matrix of surface thickness values for each year of the simulation

The resultant behavior from these three parameters acting together creates a mixed distribution that evolves over time within the output matrix. Initially, the data follows a normal distribution until corrosion initiation begins (determined by the location parameter in the Weibull distribution). Over time, the lower tail of the thickness distribution begins to shift to the left as the more severely corroded areas (locations with an early corrosion initiation value and a high corrosion growth value) begin to thin. This tail is “heavy” and greater than exponential in character due to the compounding effect of the upper tails of the Weibull and Exponential distributions acting together.

Figure 1(a) shows the thickness distributions generated over a 35-year simulation of 2,304,000 data points (which, if considered as unique 1 mm by 1 mm surface locations, would represent a surface area of 2.3 m², equivalent to a 2.4 m length of 300 mm diameter pipe²) using the parameters in Table 1 on a linear scale. The region of interest in the wall thickness distribution is the lower tail, as the thinnest location drives the risk of failure. Consequently, recommended practice is to magnify this tail using a logarithmic scale [6]. The substantial number of simulated points was chosen to ensure that the simulated data appears as a smooth distribution very far into the extreme lower tail of the distribution, especially when plotted as a cumulative distribution on a chart with a logarithmic scale on the y (cumulative probability) axis. Figure 1(b) shows the same data on a logarithmic scale. These figures show how the distribution evolves from the first year in the simulation to the 35th and final year. The thickness distribution at year 18 is highlighted. By this time, the likelihood of any one surface location being below 7 mm (equivalent to the loss of a 3 mm corrosion allowance on a nominal 10 mm thickness) is around 1 in 10 000, and the likelihood of the thickness being less than half the nominal thickness is less one in a million (1 × 10⁻⁶). These are low likelihoods, but industrial facilities can contain thousands of square meters of surface area so each small probability can add up.

To generate inspection data from the simulated thickness data, a sample is taken from the population of wall thickness data. A grid-based sampling approach is used, mimicking a strategy that could be used in a real inspection situation. During an inspection, the equipment surface is divided into grids of equal surface area (usually using pen or chalk) and a sampling regime to select which grid squares to measure is devised. The thickness within a selected grid square is measured by scanning a probe across the surface. The minimum thickness value found by the scan is recorded as the thickness value for that grid square. Ultrasonic thickness probes are scanned either manually across a surface by a technician or by a robotic device. Taking the minimum thickness value in each grid square is equivalent to the Block Maxima method used in extreme value approaches. This sampling strategy would allow extreme value theory to be used to extrapolate beyond the measured thicknesses to estimate the minimum thickness of the overall population of wall thicknesses over the equipment surface.

The simulated data provided by the corrosion model is one-dimensional, so the idea of measuring the minimum value within a two-dimensional “grid” sample can be replaced by the idea of measuring the minimum value within a one-dimensional “length” sample from the array of thickness readings. For a given population of data points in the simulation, there is a tradeoff between the length of each sample from which the minimum is selected and the total number of samples generated, assuming the overall proportion of the total population sampled does not change. The effect of this tradeoff is explored for grids by Benstock and Celga [19], who found that using relatively larger block sizes to generate relatively fewer minima gives better results. The length resolution of each sample can be assumed to equal 1 mm. The total population of simulated thickness points is 2,304,000, which can be assumed to represent an area of 2,304,000 mm × 1 mm. The proportion of the simulated thickness points measured is 1/20th of the total, equivalent to 5% of the surface being inspected (which would be a typical coverage requirement for an inspection scheme). This means that 115,200 surface locations have to be sampled from the total “population” of 2.304 × 10⁶ surface locations. The 115,200 surface locations to sample must be divided into blocks of equal length from which the minima can be extracted. A run length of 1600 values was chosen. This is equivalent to a relatively large grid size of 40 mm × 40 mm, which was found in Ref. [19] to give a good balance between the ability of a generalized extreme value model fitted to the data to correctly estimate the true minimum thickness and the width of the confidence interval associated with the minimum thickness estimate. Consequently, the 2,304,000 total surface locations were divided into 1440 lengths of 1600, and the minimum thickness values out of each length of 1600 were taken from 72 of these 1440 lengths (chosen at random) to achieve 5% inspection coverage. At the same 5% level of coverage, a smaller run length would yield a greater number of minima that would have a greater average thickness thus resulting in an ECDF that when used to fit a generalized extreme value model would tend to underestimate the minimum thickness. A larger run length would yield a smaller number of minima and so there would be more uncertainty when a model is fitted to the values, reflected by wider confidence intervals [30].

Figure 2(a) shows an ECDF constructed with data from the inspection simulation algorithm at year 18 of a simulation run. The same data is plotted on a logarithmic y-axis scale in Fig. 2(b). Uncertainty is not considered. The smallest of the 72 minimum thickness values is 6.2 mm and largest is 8.4 mm.

The simulated inspection data can now be used to demonstrate the value of applying a mixed uncertainty analysis approach to the problem of analyzing inspection data and using it to assess asset integrity.

The data shown in Fig. 2 is shown in Fig. 3 but now with K–S limits applied at the 95% confidence level to represent the sample uncertainty. Equations (1) and (2) were used in a for loop to generate the y-values for the lefthand K–S limit at each value of S_LN(X) for the set of measured minimum thicknesses. Equations (1) and (3) were similarly used to create the righthand y-values for the K–S limit at each value of S_RN(X). The x-values are equal to the x-values for the measured value ECDF. Additional horizontal lines were drawn using the plotting package to extend the lower end of both K–S limit lines to the left of the charts and extend the upper end of both K–S limits to the right of the chart. The limits get wider in the distribution tail. This is partly because fewer samples lie in this area of the ECDF, which results in a lower degree of certainty surrounding the distribution tails and consequently wider K–S limits. It is also due to the K–S limits not making any assumptions about the shape of the distribution, the effect of which is most apparent in the distribution tails. Without the K–S limits there would be little indication of how far the measured minimum thickness could be from the population minimum thickness. However, when K–S limits are added to show the sample uncertainty, up to 20% of the population thickness could be less than 6.5 mm due to the amount of sampling uncertainty. When creating the K–S limits around the empirical data points, an assumption had to be made about the range of the K–S limits and where to truncate the confidence band [42]. The limits would be plus and minus infinity unless there is information that can be used to tighten the limits. In this case, the thickness cannot be negative, so the lower limit could be truncated at zero (to make the figures clearer for the reader, the limits have been set to 1 mm lower than the smallest measured thickness value and 1 mm greater than the largest measured value).

Figure 4(a) shows 100 repeated measurements of the same population of thickness data, overlayed on top of the initial inspection data and calculated K–S limits from Fig. 3(b) (measurement incertitude is not considered). This was done by resampling from the simulated thickness model 100 times. The limits give a good indication of the range of potential sets of readings that could be taken by chance, as they bound the vast majority of the alternative ECDFs (as could be expected with the K–S limits set at the 95% confidence interval). This demonstrates the value of including the K-S limits to indicate the amount of sample uncertainty surrounding any one inspection. Moreover, the figure shows how perfectly possible for the minimum thickness to have been lower than that identified in the first measurement.

Figure 4(b) presents the statistically correct interpretation by producing 100 sets of K–S limits from the 100 repeated measurements (at the 95% level) and plotting the true (but unknowable in reality) population thickness distribution between them. It shows that the distribution limits do bound the true distribution about 95% of the time.

To show the issues that measurement uncertainty poses for interpreting the thickness data it is instructive to look at the change in thickness of a representative surface location. Figure 5 shows the true thickness generated by the simulated wall thickness model for an example surface location at each of the 35 years of the simulation (values t_7,1 … t_7,35 in matrix T shown in Eq. (6), the seventh row being chosen as it showed the effect of uncertainty more clearly than the first few rows), with a superimposed “ribbon” to represent what this true value could be measured using an ultrasonic thickness technique with a measurement uncertainty of ±0.5 mm. For the location in Fig. 5, the initial thickness is 9.97 mm, corrosion initiation occurs at 12.1 years, and the corrosion rate is 0.07 mm/yr once initiated. The earliest time corrosion can be conclusively confirmed as being active is in year 26, when more than 1 mm of wall thickness has been lost, as by this time the maximum possible measurement result is smaller than the minimum possible measurement result of the original thickness. Including measurement uncertainty in the inspection data assessment when considering changes in inspection helps to avoid both undue confidence that corrosion is occurring, and that corrosion is not occurring. It also helps to avoid misinterpretation of results that find the wall thickness to be increasing. Measurement uncertainty limits the value of paired sampling approaches in field-based inspections compared to approaches that consider changes in the measured thickness distribution [17].

Figure 6 combines both the sample and measurement uncertainty into one distribution band and shows thickness measurements taken at 18 and 23 years. To generate these figures, each measured minimum value in empirical distribution was first extended to an interval to represent ±0.5 mm of measurement uncertainty. The lower and K-S limits were then applied to the outer bound of the lower and upper intervals, respectively using Eqs. (1)–(3), in the same manner as described in Section 5.3.1. The band is now wider with both types of epistemic uncertainty being considered. The true cumulative distribution could now take many forms while falling within this wide band. It is clear to see that there is wide overlap between the thickness confidence bands at 18 and 23 years. This means that even with an inspection interval as long as 5 years, careful consideration has to be given to the uncertainties to make sure that any analysis finding that changes in the measured thickness distribution does not do so simply by chance (i.e., the change in measured thickness is significant), even after a period of five years in operation.

Uncertainty is a feature of inspection data. Whether aleatory, epistemic, or mixed uncertainty is considered during inspection engineering activities is for industry to choose. The application example has shown that doing so is beneficial. Applying imprecise probability techniques to pressure system inspection thickness data analysis can improve the quality of the analysis by characterizing the epistemic and aleatory uncertainties associated with estimated thickness values or corrosion rates. Imprecise probability offers a more elegant and comprehensive characterization of uncertainty beyond the somewhat crude characterization largely practiced in industry to calculate and compare both “long-term” corrosion rates based on the change in the measured thickness from the nominal thickness over the equipment operating life, and “short-term” corrosion rates based on the change in measured thickness between inspections. The additional information from a more comprehensive analysis gives context to the “as measured” values that will be useful when using the analysis to make decisions, such as determining the next inspection date and scope or deciding on a suitable maintenance intervention. Perhaps more importantly, considering data uncertainties also helps to avoid misinterpretation of inspection data, which can lead to people discounting findings as physically impossible (“the pipe cannot get thicker”), repeating measurements until they achieve a “logical” result, or even commissioning additional inspections to gather more “trustworthy” data [43]. The use of a methodology to characterize mixed uncertainty that is based on a frequentist paradigm avoids a key problem faced when applying uncertainty quantification techniques in engineering applications. It does not rely on subjective model assumptions that can vary from analyst to analyst and are “immune from empirical scrutiny” [44]. This means that the methods can be written into a procedure, consistently and rigorously applied through and across organizations, and assessed against common standards.

Once proceduralized, the methodology shown in the example would not be too difficult for a trained inspector or engineer to apply, especially as software tools could be used to automate much of the process of analyzing the data and generating the figures. Nevertheless, the process of interpreting the output cannot be automated. For the approach to be an effective contribution to risk management, inspection professionals would have to correctly understand the mixed uncertainty information as represented by the probability structures in the figures. Although visual methods are more straightforward to interpret than numeric ones, they still rely on correct perception, cognition, and evaluation of the uncertainty and other information provided by the figures, which can be a challenge even for experts [45]. While inspection standards allow the application of statistical approaches (e.g., Ref. [46]), no methodologies are specified. Moreover, the most widely used API recommended practice guide does not provide figures to show how to interpret statistical plots and gives limited background information surrounding uncertainty and confidence intervals [47] (the HOIS recommended practice documents are much more comprehensive in this aspect but have a smaller, UK-focused audience [6,17]). Consequently, although inspection professionals implicitly deal with uncertainty already in their work, further research is needed to understand how effective the probability-box representation of mixed uncertainty is as a visualization tool for inspectors working in industry with a typical education and training pathway. This is especially true in the example shown, which has the added complication of the use of a logarithmic scale on the y-axis of the charts to magnify the lower tail of the distribution at the expense of distorting the usual shape that the bulk of the distribution would appear with on a linear axis.

Although it is both feasible and beneficial to apply imprecise probability methods to analyze mixed uncertainties in inspection data, there are key limitations in the available methods. These limitations present research opportunities.

Figure 6(a) shows that the confidence band surrounding the lower tail of the thickness distribution is very wide, indicating the uncertainty about how much thinner the thinnest overall surface location could be compared to the smallest measured thickness value. One approach to characterizing the uncertainty about a cumulative distribution is to construct a confidence band that will contain, with a high confidence level, the entire unknown distribution. The classical Kolmogorov–Smirnov (K–S) confidence bands have been used in this work to do this. As they are very general and make no assumption about the shape of the underlying distribution except that it is continuous, they tend to have wider uncertainty in the tails than analysts expect. Cheng and Iles [48,49] suggest that confidence bands for parametric distributions be constructed as probability boxes that envelop all distributions corresponding to parameter sets within the confidence region for the parameters. They give formulas for the special cases of normal, lognormal, extreme-value, and Weibull distributions. By making a shape assumption, the uncertainty of the tails is very much narrower than the K-S band. In general, there could be values of the parameters outside the confidence region that correspond to distributions lying entirely within the confidence band, meaning the band is conservative. Cheng and Iles show this does not apply for the special cases they describe because of their particular properties. By assuming the shape of the distribution for the measured minimum thicknesses follows the extreme value distribution, which is a plausible assumption for the lower tail given the block minima sampling approach, the confidence band for the extreme value model can be implemented using the approach in Ref. [49]. This would achieve a narrower confidence band than the K–S limits in Figs. 3 and 6. The effect of assuming the whole distribution as following an extreme value would have to be investigated in any future work on this because the bulk of the distribution would be expected to be normally distributed. The uncertainty about the shape of the lower tail could be further reduced by making further statistical assumptions to extrapolate from the measured minimum thicknesses of the inspected area to estimate the potential minimum thickness in the uninspected area. Extreme value analysis is a potential method to achieve this. The research opportunity is to enhance existing extreme value approaches proposed for analyzing inspection data [6,17,19] by factoring epistemic uncertainty into the analysis using intervals or confidence boxes [50].

The second limitation is seen by comparing Figs. 6(a) with 6(c). The large confidence bands make it difficult to determine with any certainty whether any significant thickness loss has occurred in the 5 years between the two inspections, even methods that succeed in reducing the area inside the confidence bands will not be able to eliminate this overlapping area. This limitation presents two research opportunities. One is to develop a method that can determine whether two inspection datasets taken from the same equipment item at separate times have any significant difference in thickness, even when epistemic uncertainties are considered. The contribution of Destercke and Strauss [51] is a promising starting point. The other opportunity is to develop a method to calculate imprecise corrosion rates. The imprecise regression method proposed by Tretiak et al. [52] and the interval predictor model [53,54] offer a way forward.

A further limitation of this paper is that it has used simulated data. Simulated data has the advantages of explainability, repeatability, and comprehensiveness compared with empirical data. To demonstrate that the simulated inspection data realistically represents reality, the ECDFs in Fig. 7 were created with inspection data taken from a pressure vessel and from a corrosion loop within a piping system on different industrial sites. A similar pattern to the simulated data can be seen, with some data points thicker than the nominal thickness with a plausibly normal distribution and a heavy lower tail, with a small proportion of readings with much higher wall loss than the bulk of the distribution. However, this merely gives an indication that the corrosion model is plausible in certain scenarios. A considerable research effort would be needed to compile a set of empirical data that would be suitable for validating the simulation model and verifying that the mixed uncertainty methods are suitable for adoption in industry.

A final research opportunity would be to extend the treatment of measurement uncertainty to include fuzzy probabilities [23]. Fuzzy probabilities could be used to represent PoD, which was briefly introduced in Sec. 3. PoD refers to the likelihood of detecting a defect or surface discontinuity during an inspection. The likelihood reduces with the flaw size (defect or discontinuity in the surface) and below a given size threshold a NDT technique becomes unreliable in a particular application [21]. A fuzzy approach could graduate from the interval used to represent the measurement uncertainty, showing a greater amount of vagueness as the measurement passes the minimum reliable size threshold for the technique and approaches zero.

Once methodologies have been developed, there are additional challenges to consider when applying them in real industry settings. Beer et al. [23] capture the nature of data used in engineering practice, which describes inspection data very well.

“Information is often not available in the form of precise models and parameter values; it rather appears as imprecise, diffuse, fluctuating, incomplete, fragmentary, vague, ambiguous, dubious, or linguistic. Moreover, information may variously be objective or subjective, possibly including random sample data and theoretical constraints but also expert opinion or team consensus. Sources of information may vary in nature and trustworthiness and include maps, plans, measurements, observations, professional experience, prior knowledge, and so forth.”

These challenges were demonstrated in the processing and plotting of the data shown in Fig. 7. The data used to generate these figures exhibit many of the characteristics described in the above quote and could be described as “bad data” [55].

• There is extremely limited data for the vessel considering its size (four thickness readings are taken at cardinal points at regularly spaced elevations up to the 11 m high vessel column).

• There is missing data: each inspection does not contain measurements for every thickness monitoring location (for three inspections it was recorded that there was no access to some of the locations toward the middle of the column but there is no explanation for other missing data).

• It is believed that for some inspections the wrong type of probe was used for the vessel's material grade, giving biased thickness measurements.

• The inspection engineers have made a subjective assessment and reached consensus to split the vessel into three “zones,” each with a different likely corrosion rate based on their knowledge of the equipment and the process.

• Most of the measurements are reported as scalar values but at six locations the thickness measurements are reported as intervals.

• The data is captured in a spreadsheet rather than a database, which makes it harder to verify the integrity of the data. For example, the lineage or provenance of the values in the pressure vessel dataset is ambiguous. It is not clear whether the stated thicknesses are single point values, an average value from several readings taken at the inspection location, or a minimum value from several readings taken at the inspection location (fortunately for the piping data the values are stated as being the “min[imum] found”).

The impact of all these limitations must be considered and the data preprocessed accordingly before the numbers can be “plugged in” to a statistical analysis tool. Indeed, many readings in the pressure vessel and piping system thickness data were not included in Fig. 7 because they could not easily be preprocessed into a format suitable for displaying in the ECDF charts.

The example in this paper only considered wall thickness loss. Although wall thickness loss can be caused by many different degradation mechanisms (diverse types of corrosion and erosion), it is just one of many types of failure modes that affect pressure system reliability, such as fatigue cracking or embrittlement. The biggest challenge for achieving wider adoption of uncertainty-aware analysis methods in the inspection engineering discipline could be that a comprehensive risk assessment would need to manage uncertainties relating to several failure modes. Any analysis of the overall reliability would need to consider each of these uncertainties concurrently. This is not a trivial task and goes far beyond the state of the art. For example, the current industry recommended practice for quantitative inspection analysis API 581 [7] gives very limited consideration to uncertainty in probability of failure calculations and primarily in a section specific to calculating the probability of failure of heat exchanger bundles, which are just one component within one type of pressure system equipment.

A framework would be useful to help resolve the remaining difficulties in assessing pressure system reliability with mixed uncertainty analysis methods that have been discussed. In addition to concurrent analysis of both aleatory and epistemic uncertainties, it is proposed that any inspection data analysis framework that incorporated mixed uncertainty should also

1. work from the “outside in” so that even a limited amount of poor-quality data can generate a result, albeit conservative;

2. allow scope to progressively narrow the bounds on results as and when more information is obtained, or because of engineering judgment and assumptions being applied;

3. accept data from diverse sources, including both traditional visual inspection and NDT methods, and data from emerging technologies like drone and robotic inspection, permanently mounted sensors, and advanced NDT techniques;

4. allow both “good” and “bad” data to be used, potentially “pooling” data with high uncertainty and low uncertainty [10];

5. cater for the ability to assess the effect of spatial and temporal uncertainties;

6. encompass a means to conserve metadata, including uncertainty, data provenance [56], quality assurance, and data specification (e.g., units), alongside analysis results to enable efficient reuse of data and findings between inspection planning, inspection analysis, and integrity assessment activities; and

7. be suitable for being written into a standard procedure to allow rigorous, repeatable, reproducible, and transparent application across the varied industries that operate pressure systems.

This paper has demonstrated the fundamental importance of uncertainty in inspection data. The purpose of inspection is to reduce the risk of loss by reducing uncertainty about equipment condition. However, the uncertainty can never be fully eliminated for reasons that are both theoretical and pragmatic. Despite this, existing methodologies used in inspection applications either ignore uncertainty or focus on one dimension of it. They are not capable of concurrently accounting for both aleatory and epistemic uncertainties arising from random variation, sample uncertainty, and measurement uncertainty. Methods based on imprecise probability have been shown in this work to be capable of representing epistemic and aleatory uncertainty together. This was done through an example analysis using simulated equipment wall thickness data measured with a simulated ultrasonic inspection. The analysis applied an ECDF structure to represent aleatory uncertainty and then extended prior art in the inspection discipline by using an interval approach to extend this from being a line describing a single thickness distribution to an area representing a set of many possible thickness distributions. This approach will provide a basis for conducting mixed uncertainty analyses in inspection applications if the identified research opportunities can be addressed to (1) better bound the tails of these imprecise thickness distributions, (2) develop statistical tools to allow rigorous comparison of imprecise thickness distributions through time, and (3) allow addition of a fuzzy interval to represent the uncertainty associated with NDT techniques that results from the size-dependent probability of detection of a defect. Provided these methods are used within a framework similar to the one outlined in the discussion that addresses the practical challenges of working with imperfect empirical field data, they will allow more informed inspection planning and analysis to be done, leading to greater trust in the resulting inspection data. The estimated risks would approximate the true risks more closely, which would lead to improved assessment and management of integrity. Tangible benefits to industry of this will be more focused inspection programs, better decision-making about when to maintain or retire pressure system equipment, and resulting safer and more reliable operations.

We thank Adolphus Lye, Alexander Wimbush, Leonardo Michels, Nick Gray, Enrique Miralles-Dolz, and Vladimir Stepanov for their contributions to discussions on this topic. We also thank the research funders for their support.

• TÜV Rheinland and ABB (Funder ID: 10.13039/501100002670).

$B_(X)$ =

lower (left) bound of the sample uncertainty confidence limit

$B¯(X)$ =

upper (right) bound of the sample uncertainty confidence limit

D_α =

critical value setting the bound of the Kolmogorov–Smirnov test for goodness-of-fit for the observed median

f =

probability density of the corrosion rate (forming an Exponential distribution)

F =

proportion (cumulative density) of the surface area where corrosion has initiated (forming a Weibull distribution)

i =

iterator in the for loop that iterates from year 1 to year N

M =

number of surface locations in the simulation model

n =

number of samples

N =

total number of years over which the simulation model is run

S_LN(X) =

fraction of the left endpoints of the values in the data set that are at or below the magnitude X

S_RN(X) =

fraction of right endpoints of the values in the data set that are at or below the magnitude X

t =

thickness in mm

T =

M by N matrix of wall thickness values generated by the corrosion simulation model

x =

is the elapsed time in years

X =

magnitude of the measured parameter (i.e., thickness)

y =

is the corrosion rate in mm/year

α =

specified significance level (e.g., 0.05 for 95% confidence interval)

λ =

shape parameter (for the Weibull distribution)

μ =

location parameter (for the Weibull distribution)

$σE$ =

scale parameter (for the exponential distribution)

$σW$ =

scale parameter (for the Weibull distribution)