A Multiscale Reliability Framework Combining Surrogate Models and Bayesian Networks for a Deep-Water Subsea Separation System

Abstract

Reliability assessments of subsea systems are generally performed at two levels: structural reliability analysis of individual components and functional reliability analysis of the overall system using generic failure-rate databases. This study develops a component-to-system multi-scale framework that integrates these two levels for a subsea separation system operating at 3000 m water depth. At the component level, a Gaussian process regression (GPR) surrogate is developed from 474 finite element simulations of a vertical gravity separator. First-order reliability method (FORM) and Monte Carlo simulation (MCS) are then employed to assess the structural reliability, followed by a time-variant reliability analysis that accounts for corrosion effects. At the system level, the structural reliability model is integrated with functional failure rates through a Bayesian network that considers five equipment items and relevant risk-influencing factors. The surrogate model accurately predicts collapse pressure with an R² value of 0.996. The intact separator achieves a reliability index of 4.55, satisfying the DNV high-safety-class target, with the structural failure mode contributing only 0.0034% of the separator failure rate. Under a corrosion rate of 0.4 mm/year, the reliability index decreases to 3.12 over a 25-year service period. The structural failure rate crosses the DNV medium-safety-class target of 10⁻⁴ per year at year 12, increasing the structural contribution to the overall system failure frequency to 0.33%. Sensitivity analysis indicates that initial ovality and wall thickness are the most influential parameters affecting structural reliability and should therefore be prioritized in design and integrity management strategies. The framework is demonstrated on this physics-consistent dataset; validation against independent nonlinear finite element analyses and experimental collapse data is identified as the necessary next step before the results are used for design.

1. Introduction

A subsea processing system is a system in which separation, boosting and injection of the well stream are performed at the seabed instead of topside. It has become a key technology for deep- and ultra-deep-water field development, improving recovery, reducing topside production liabilities and mitigating flow assurance risk [1,2].

Placing key equipment of a subsea separation system, such as the separator, at water depths of around 3000 m, however, exposes it to extreme external hydrostatic pressure, low temperature and severely restricted intervention access. Failures under these conditions carry large production, environmental and intervention-cost consequences [3,4]. Quantitative reliability assessment is therefore central to the design and integrity management of subsea separation systems. Research in this context strives to address two qualitatively different questions: how often the equipment fails to perform its function, and how likely it is to collapse structurally.

The first question is traditionally answered with reliability methods based on generic failure-rate databases such as OREDA [5]. Because field experience for novel subsea equipment is scarce, several authors have proposed adjusting topside-derived failure rates through risk influencing factors (RIFs) [6], and Rahimi and Rausand formalized a practical procedure for predicting failure rates of new subsea systems from such factors [7]. Bayesian networks (BNs) have proven particularly attractive for propagating the associated uncertainties and for diagnostic reasoning, with obvious advantages over static fault trees [8,9], and they have been applied to subsea blowout preventer control systems [10], subsea X-mas trees [11], subsea control modules coupled with digital twins [12] and general system-level evaluation combined with machine learning [13]. Fault-tree-based treatments of subsea production systems, including fuzzy extensions and system optimization, complement this research work in the present context [14,15,16]. Within this line of research, and in the author’s own earlier work, a Bayesian framework was developed for the reliability prediction of subsea processing systems, quantifying the influence of nine RIFs on the failure rates of a five-equipment subsea separation system (SSS) and reporting a year-one system failure probability of 0.4195 with an approximately ±15% failure-rate envelope across RIF states [17]. A recent study illustrates the trend towards physics-informed condition monitoring of subsea safety systems [18].

The collapse or local buckling of tubular structures such as subsea cylindrical equipment is a classical problem of instability [19], for which Windenburg and Trilling derived a widely used finite-length elastic collapse equation [20], and modern research work combines elastic and plastic collapse and geometric imperfections through interaction equations of the type adopted in offshore design codes [21,22,23]. Corrosion-induced wall loss is a dominant degradation mechanism for such components: it reduces collapse capacity [24], drives the time-variant reliability of pipelines [25] and introduces substantial model uncertainty into strength predictions [26]. Accurate capacity evaluation for realistic geometries generally requires nonlinear finite element analysis (FEA), whose computational cost is prohibitive for the limit-state evaluations required by sampling-based reliability methods. This computational burden has recently motivated the use of machine-learning models for predicting burst and collapse failure in subsea pipeline systems [27].

Surrogate modelling is considered to bridge this gap. Response surfaces were introduced for structural reliability by Bucher and Bourgund [28], and Gaussian process (Kriging) surrogates [29] have since become the reference approach. These methods have demonstrated efficiency for marine structural reliability problems [30], active-learning variants such as AK-MCS that adaptively enrich the design of experiments near the limit state [31], and a mature body of survey literature [32]. Meta-model-driven reliability analyses are now also being applied to complete offshore systems, such as floating wind turbines [33]. Nevertheless, in the subsea processing literature, the surrogate-based structural strand and the BN-based functional strand have evolved essentially independently of each other.

This study examines the feasibility of combining the aforementioned approaches. Straub and Der Kiureghian showed that structural reliability methods can be embedded within enhanced Bayesian networks [34,35], and that the integration of heterogeneous failure modes on a common probabilistic basis is recognized as one of the persistent challenges of reliability engineering [36] and a prerequisite for credible digital twins of subsea assets [37]. Yet, to the author’s knowledge, no published study couples a physics-based, time-variant structural reliability of a subsea separator, represented by a trained surrogate model, into a system-level BN. Existing SSS assessments treat the separator as a purely functional item with a constant failure rate [17], so the influence of external-pressure collapse, its degradation due to corrosion, and its interaction with system-level RIF uncertainty remain unquantified.

This paper develops and demonstrates a component-to-system, multi-scale reliability framework for deep-water subsea separation systems (SSS). The main contributions are fourfold. First, a GPR surrogate of the separator collapse pressure is trained on a 474-sample collapse dataset spanning six design variables and is verified against the analytical capacity model from which that dataset is generated; the reliability model adds the internal operating pressure and a capacity-model uncertainty factor, so that eight random variables enter the limit state. Second, the surrogate model is combined with FORM and MCS analyses to produce intact and corroded structural failure probabilities, converted to annual failure rates. Third, the structural failure rate is combined with the RIF-adjusted functional failure rates of the five SSS equipment items in a Bayesian network (BN). The BN provides time-dependent system reliability, failure attribution, and diagnostic posteriors. The integrated model is then validated against the author’s previous assessment of the same system [17]. Fourth, a sensitivity study translates the results into fabrication (ovality), inspection and monitoring priorities for the assumed design and degradation scenarios. The remainder of the paper is organized as follows: Section 2 presents the framework and its component- and system-level models; Section 3 reports the numerical results; Section 4 is devoted to verification and consistency checks; Section 5 discusses sensitivities, engineering implications and limitations; and Section 6 concludes.

2. Multi-Scale Reliability Framework

2.1. Framework Overview

The proposed framework, summarized in Figure 1, works on two coupled levels. The component level quantifies the time-variant structural reliability of the separator pressure capacity: a design of experiments over the geometric, material and imperfection variables is evaluated with the elastic–plastic collapse model described in Section 2.3.1, which represents the nonlinear finite element response of the separator shell. A GPR surrogate is trained on the resulting dataset, and the surrogate replaces the expensive numerical model inside FORM and MCS reliability analyses. Corrosion-induced wall thinning renders the resulting failure probability P_f,d(τ) an explicit function of service time τ. The five-equipment system is represented using a Bayesian network, with equipment failure rates derived from OREDA functional failure data and adjusted to account for subsea risk-influencing factors [17]. The interface between the levels is the separator node: its functional failure probability is combined with the structural failure probability from the component level, so that system reliability, failure attribution and diagnostic posteriors reflect both failure classes on a common probabilistic basis. All symbols are defined where they first appear.

2.2. Subsea Separation System and Functional Reliability Model

Figure 2 shows the layout and process flow of a typical subsea separation and transfer system: the well stream is separated on the seabed, the separated water is cleaned and reinjected, and the hydrocarbon stream is boosted to the host facility. The case study system is the subsea separation system analyzed in [17], comprising five equipment items in functional series: a vertical gravity separator, a hydrocyclone, a coalescer, a water-injection (WI) pump and a multiphase (MP) pump. Produced fluids enter the separator, where the primary gas–oil–water separation takes place. The separated water is further treated by the hydrocyclone and coalescer before being reinjected by the water-injection (WI) pump, while the hydrocarbon stream is pressurized by the multiphase (MP) pump. Since the failure of any component disrupts the overall separation process, the system is modelled as a series configuration from a functional availability perspective [15,17].

Table 1. Mean functional failure rates of the subsea separation system equipment, adapted from [17].

Equipment	λ (per 106 h)	λ (per Year)	Dominant Failure Modes
Separator	17.56	0.1538	Level control, internals, leakage
Hydrocyclone	6.70	0.0587	Erosion, blockage
Coalescer	15.60	0.1367	Element fouling, electrical
Water-injection pump	11.25	0.0986	Seals, bearings, motor
Multiphase pump	14.17	0.1241	Seals, thrust, drive

lists the mean functional failure rates of the five items, obtained in [17] by adjusting OREDA topside rates [5] through the Rahimi–Rausand influencing-factor procedure [7]; subsea conditions increase the rates by roughly 15–20% relative to topside service.

The uncertainty in the RIF assessment is represented by a system-state node (S) with two equally likely states: favourable and severe. These states increase or decrease the functional failure rates of all equipment by 15%, i.e., λj(S) = λj(1 ± 0.15), with each state having a probability of 0.5. Equal prior probabilities are assigned because no information is available on the relative likelihood of the two states; this is the maximum-entropy choice for a binary variable, it keeps the prior mean failure rate at the Table 1 value, and Section 3.4 shows how observed failures update it. This simplified two-state approach captures the ±15% variation in failure rates and the corresponding reliability change (about 32%) reported in [17], while keeping the model simple and easy to interpret. The suitability of this simplification is evaluated in Section 4.3. Given the system state, equipment lifetimes are assumed to be independent and follow an exponential distribution, consistent with the constant failure-rate assumption used in OREDA data [5,7]. The nine RIFs identified in [17] are retained in the upper layer of Figure 3 to show the origin of the rate envelope, but they are not evaluated as individual nodes: their combined effect is contracted into S, so that the network implemented in this study is the two-layer structure enclosed by the dashed boundary of Figure 3. The resulting Bayesian network, including the separator’s structural reliability model described in Section 2.5, is shown in Figure 3.

2.3. Component Level: Structural Reliability of the Separator Vessel

2.3.1. Collapse Model and Collapse Dataset

The separator is idealized as an X65-class cylindrical steel shell of outer diameter D, wall thickness t and cylindrical length L, installed at a water depth of d = 3000 m. With a seawater density of 1025 kg/m³ the external design pressure is P_ext = ρ_sw g d = 30.17 MPa. The governing ultimate limit state of the shell is collapse under net external pressure, controlled by the interaction of elastic instability, plastic yielding and the initial out-of-roundness of the fabricated shell [21,23]. The model therefore represents the unstiffened cylindrical shell course between end restraints, which is the region that governs collapse; end closures, nozzles, supports, internals and ring stiffeners are outside its scope, and their influence is discussed as a limitation in Section 5. For an infinitely long cylinder the elastic collapse pressure with circumferential mode number two is given by Equation (1) [19], while for a finite cylinder of effective length L between stiffening ends the classical Windenburg–Trilling expression, Equation (2), applies [20]:

$$P_{el}^{\infty }={\displaystyle \frac{2E}{1-{\nu }^2}}{\left({\displaystyle \frac{t}{D}}\right)}^3$$

(1)

$$P_{el}^{WT}={\displaystyle \frac{2.42 E {\left(\frac{t}{D}\right)}^{\frac{5}{2}}}{{\left(1-{\nu }^2\right)}^{\frac{3}{4} }\left[\frac{L}{D}-0.45 {\left(\frac{t}{D}\right)}^{\frac{1}{2}}\right]}}$$

(2)

where E is the Young’s modulus and ν = 0.3 the Poisson’s ratio. The governing elastic pressure P_el is the larger of the two expressions, Equation (3), and the plastic collapse pressure P_p follows from the yield stress f_y, Equation (4):

$$P_{el}= max\left(P_{el}^{\infty }, P_{el}^{WT}\right)$$

(3)

$$P_p=2 f_y\left({\displaystyle \frac{t}{D}}\right)$$

(4)

The characteristic collapse pressure P_c then solves the DNV-type interaction equation, Equation (5), which reduces to the elastic solution for thin, imperfection-free shells and to the plastic solution for thick shells [21,22]:

$$\left(P_c- P_{el}\right)\left(P_c^2- P_p^2\right)={\displaystyle \frac{P_c{P}_{el}{P}_p{f}_{0}D}{t}}$$

(5)

The initial ovality is defined as f₀ = (D_max − D_min)/(D_max + D_min), where D_max and D_min are the maximum and minimum measured outer diameters of a cross-section.

A design of experiments with 474 Latin hypercube samples was generated over the six input variables within the ranges of

Table 2. Input variable ranges of the 474-sample collapse dataset and resulting collapse pressure statistics.

Variable	Symbol	Range	Units	Sampling
Outer diameter	D	1600–2400	mm	LHS
Wall thickness	t	70–130	mm	LHS
Cylindrical length	L	8000–14,000	mm	LHS
Young’s modulus	E	195–215	GPa	LHS
Yield stress	fy	380–560	MPa	LHS
Initial ovality	f0	0.002–0.015	–	LHS
Collapse pressure	Pc	12.0–80.3 (mean 37.96)	MPa	Response

, chosen to bracket credible deep-water separator designs. The collapse response of each sample was obtained from the elastic–plastic interaction model of Equations (1)–(5), multiplied by a lognormal discrepancy factor of unit median and 1.5% coefficient of variation representing the mesh- and solver-induced scatter typically observed between code-type formulations and detailed nonlinear finite element analyses of externally pressurized shells [21,26]. The dataset used to train the surrogate is therefore physics-consistent but synthetic: it is not the product of an independent finite element campaign, which limits what the surrogate accuracy in Section 3.1 can demonstrate. The consequences of this choice are stated explicitly in Section 4.1 and Section 5.

Figure 4 summarizes the dataset: the collapse pressure spans 12–80 MPa, is most strongly organized by the slenderness ratio D/t and shows the expected knock-down with increasing ovality. Whether the surrogate is used in interpolation has to be judged in the input space rather than from the range of the response. For the reliability model of

Table 3. Random variables of the separator structural reliability model.

Variable	Description	Distribution	Mean	COV
D	Outer diameter (mm)	Normal	2000	0.5%
t	Wall thickness (mm)	Normal	105	2%
L	Cylindrical length (mm)	Normal	10,000	1%
E	Young’s modulus (MPa)	Normal	207,000	2.5%
fy	Yield stress (MPa)	Lognormal	486	6%
f0	Initial ovality	Lognormal	0.005	40%
Pint	Internal pressure (MPa)	Lognormal	2.0	25%
Xm	Model uncertainty	Lognormal	1.00	6%

the mean wall thickness falls from 105 mm to 95 mm at year 25 of the severe corrosion scenario and the corresponding D/t ratio rises from 19.0 to 21.1, so thickness, diameter, length, stiffness and yield stress remain inside the sampled ranges for every corrosion year.

DNV-ST-F101 [22] requires that the ovality used in a collapse assessment is not taken lower than 0.5%. This is a lower bound on the value adopted in design rather than an upper limit on fabrication, the corresponding fabrication tolerance for this class of component being of the order of 1.5%. The mean of Table 3 is therefore set at the code design minimum, and the 40% coefficient of variation represents fabrication variability about it, with the upper tail approaching the fabrication tolerance. The design of experiments spans 0.2–1.5% so that the surrogate remains valid over the whole of this distribution and over the tighter-fabrication case of f₀ = 0.35% examined in the sensitivity study of Section 5. Thus the ovality is the exception: with a lognormal distribution of mean 0.005 and 40% coefficient of variation, 1.4% of the Monte Carlo samples fall below the sampled lower bound of 0.002, 0.12% exceed the upper bound of 0.015, and the FORM design point reported in Section 3.2 lies about 7% beyond that upper bound. The surrogate is therefore mildly extrapolated in the upper ovality tail; Section 4.2 bounds the effect by repeating the reliability analysis with the analytical capacity model in place of the surrogate, and an extension of the design of experiments in f₀ is recommended before the model is used for design.

2.3.2. Gaussian Process Regression Surrogate

A GPR surrogate maps the six-dimensional input vector x to the collapse pressure. Conditioning a zero-mean Gaussian process prior on the n = 474 training observations y yields the posterior mean and variance of Equations (6) and (7) [29]:

$$\widehat{\mu }({\mathbf{x}}_{\ast }) = {\mathbf{k}}_{\ast }^T {\left(\mathbf{K} + \sigma {}_n{}^2\mathbf{I}\right)}^{-1} \mathbf{y}$$

(6)

$${\widehat{\sigma }}^2\left({\mathbf{x}}_{\ast }\right)=k\left({\mathbf{x}}_{\ast }, {\mathbf{x}}_{\ast }\right)-{\mathbf{k}}_{\ast }^T {\left(\mathbf{K}+\sigma {}_n{}^2\mathbf{I}\right)}^{-1}{\mathbf{k}}_{\ast }$$

(7)

where K is the covariance matrix of the training inputs, x∗ is the input point at which a prediction is made, and k∗ is the vector of covariances between x∗ and the n training inputs, with elements k(x∗, xᵢ) and σ_n² a noise (nugget) variance that absorbs the 1.5% scatter injected into the training responses (Section 2.3.1). The anisotropic Matérn 5/2 kernel of Equation (8) is adopted, providing twice-differentiable sample paths appropriate for a smooth mechanical response while remaining robust to mild non-stationarity [29,30]:

$$k\left(\mathbf{x}, {\mathbf{x}}^{\prime }\right)= {\sigma }_f^2\left(1 +{\displaystyle \frac{ \sqrt{5}r}{\mathcal{l}}}+{\displaystyle \frac{5 r^2}{3 {\mathcal{l}}^2}}\right)exp\left({\displaystyle \frac{-\sqrt{5}r}{\mathcal{l}}}\right)$$

(8)

where k(x, x′) is the covariance function between two input points, σ_f² the signal variance, ℓ the characteristic length scale and r = ‖x − x′‖ the distance between the two points. Inputs are standardized, hyperparameters (signal variance, per-dimension length scales and nugget) are estimated by maximizing the log marginal likelihood with ten restarts, and the model is implemented in scikit-learn [38]. An 80/20 train–test split assesses out-of-sample accuracy and ten-fold cross-validation on the full dataset assesses stability; results are reported in Section 3.1. Only the posterior mean, Equation (6), enters the reliability analyses, while the posterior variance, Equation (7), is used to verify that predictions at the FORM design points carry negligible epistemic surrogate uncertainty.

2.3.3. Random Variables and Reliability Assessments

Table 3 presents the probabilistic models for the variables used. The GPR surrogate has six inputs, D, t, L, E, f_y and f₀, whereas the reliability model adds the internal operating pressure P_int and the capacity-model uncertainty factor X_m, so that eight random variables enter the limit state. Geometric variables follow normal distributions with small coefficients of variation, while the yield stress, the ovality, the internal operating pressure P_int and the model uncertainty factor X_m of the collapse prediction are lognormal, the latter set in Section 3.1 from the surrogate residuals together with the strength-model uncertainties were reported for pressure boundaries in [25,26]. The nominal wall thickness of 105 mm matches the design wall thickness, including the corrosion allowance.

The ultimate limit state, Equation (9), compares the model-corrected collapse capacity with the net external pressure, in which the external hydrostatic pressure at depth d follows Equation (10); failure corresponds to g(X) ≤ 0; and the failure probability is the integral of Equation (11) [39]:

$$g\left(\mathbf{X}\right)= {\mathrm{X}}_m{P}_c\left(D, t, L, E, f_y, f_0\right)- \left(P_{ext}- P_{int}\right)$$

(9)

$$P_{ext}={\rho }_{sw}g d$$

(10)

$$P_f={\int }_{g\left(\mathbf{X}\right)\le 0}{f}_{\mathbf{X}}\left(\mathbf{x}\right)d\mathbf{x}$$

(11)

where f_X(x) is the joint probability density function of the random vector X. Two solution methods, crude Monte Carlo simulation and FORM, are used and cross-checked. Crude MCS estimates $\widehat{P}$_f by the indicator average of Equation (12), whose coefficient of variation quantifies the sampling error [39]; up to 2 × 10⁶ surrogate evaluations are used, which the GPR renders trivial. I[·] is the indicator function, equal to one when its argument is satisfied and zero otherwise, N is the number of samples and X^j the j-th realization of X.

FORM transforms the variables to standard normal space, locates the most probable failure point u∗ with the damped Hasofer–Lind–Rackwitz–Fiessler algorithm and returns the reliability index β of Equation (13) [40,41,42]. G(u) is the limit-state function expressed in the standard normal space to which X is transformed, u the corresponding vector of standard normal variables, and Φ(·) the standard normal cumulative distribution function.

The unit normal α at the design point provides the variable importance factor α_i² of Equation (14). Where α_i the i-th component of α, so that α_i² is the relative contribution of variable i to the variance of the linearized limit state and Σαi² = 1.

$${\widehat{P}}_f={\displaystyle \frac{1}{N}}\sum _{j=1}^{N}I\left[g\left({\mathbf{X}}^j\right)\le 0\right], {\delta }_{{\widehat{P}}_f}=\sqrt{{\displaystyle \frac{1-{\widehat{P}}_f}{N {\widehat{P}}_f}}}$$

(12)

$$\beta =mi{n}_{G\left(\mathbf{u}\right)=0}\left|\right|\mathbf{u}\left|\right|, P_f\approx \mathsf{\Phi }\left(-\beta \right)$$

(13)

$$\mathit{\alpha }=-{\displaystyle \frac{{\nabla }_{\mathbf{u}}G\left({\mathbf{u}}^{\ast }\right)}{\left|{|\nabla }_{\mathbf{u}}G\left({\mathbf{u}}^{\ast }\right)\right||}}$$

(14)

2.4. Time-Variant Degradation and Structural Failure Rate

Corrosion of the separator vessel is modelled as uniform wall reduction at rate r_c after the protection-breakdown time τ_c in Equation (15), the standard first-order description of general corrosion of submerged steel [24,25,43]. Three scenarios are analyzed: r_c = 0 (intact cathodic protection), 0.2 mm/yr (moderate) and 0.4 mm/yr (severe), with τ_c = 0 as a conservative baseline:

$$t\left(\tau \right)= t_0- r_c\cdot max\left(0, \tau - {\tau }_c\right)$$

(15)

where t₀ is the as-built nominal wall thickness of Table 3. At each service year, the reliability analysis of Section 2.3.3 is repeated with the reduced mean wall thickness, giving P_f,d(τ) as an annual, demand-conditioned failure probability. Collapse is only possible when the net external pressure approaches its extreme, which occurs during depressurization events (shut-ins, blowdowns) when P_int drops towards ambient values; with an expected demand frequency ν_d = 2 events per year, the annual structural failure rate follows Equation (16) and the cumulative structural failure probability over a horizon T follows Equation (17):

$${\lambda }_{struct}\left(\tau \right)= {\nu }_d{P}_{f,d}\left(\tau \right)$$

(16)

$$F_{struct}\left(T\right)=1-\mathrm{e}\mathrm{x}\mathrm{p}\left(-{\int }_0^T{\lambda }_{struct}\left(\tau \right)d\tau \right)\approx 1-exp\left(-\sum _{\tau =0}^T{\nu }_d{P}_{f,d}\left(\tau \right)\right)$$

(17)

The sum runs over the T + 1 annual epochs at which the reliability analysis is performed—τ = 0, 1, …, T—with the failure rate held at its start-of-year value throughout each year. Retaining both the initial and the final epoch makes the discrete sum an upper approximation of the integral: it exceeds a trapezoidal evaluation of the same trajectory by ¹/₂[λ_struct(0) + λ_struct(T)], which is about 4% for the intact vessel and up to 10% at the end of the severe corrosion scenario, where the late-life terms dominate. The discretization is therefore conservative with respect to the underlying integral.

2.5. System Integration

The separator node of the BN receives both failure classes. Treating functional failure and structural collapse as independent competing modes within a year, the separator annual failure probability is the series combination of Equation (18):

$$P_{sep}\left(\tau \right)= 1 - \left[1 - P_{func}\left(\tau \right)\right]\left[1 - P_{struct}\left(\tau \right)\right]$$

(18)

System reliability at time t marginalizes the series survival over the RIF state (Equation (19)), in which F_struct(t) enters the separator survival term, e indexes the five equipment items, s the two RIF states, P(s) = 0.5 the prior probability of each state, and Fsys(T) is the event that the system has failed within the horizon T. Λ(e,s)(T) is the cumulative hazard of item e over that horizon in state s, ${\mathsf{\Lambda }}_{\left(e,s\right)}\left(T\right)={\int }_0^T{\lambda }_{\left(e,s\right)}\left(\tau \right)\hspace{0.17em}d\tau$ = λ_(e,s)T for the constant functional rates of Table 1; for the separator the structural contribution of Equation (17) is added to this term.

Equation (20) gives, by Bayes’ rule, the posterior probability of the severe RIF state given an observed system failure, illustrating the diagnostic use of the network [9,34]. Where E_e denotes the event that item e, or the structural failure class, is the origin of an observed system failure, and e′ runs over the same set.

$$P\left(F_{sys}\left(T\right)\right)=\sum _{s}P\left(s\right)\left[1-\prod _{e}exp\left(-{\mathsf{\Lambda }}_{\left(e,s\right)}\left(T\right)\right)\right]$$

(19)

$$\begin{gathered} P\left(E_e \right|F_{sys})={\sum }_{s}P\left(s\right) {\displaystyle \frac{\left({\lambda }_{e,s}\right)}{({\sum }_{e^{\prime }}{\lambda }_{e^{\prime },s})}}, \\ P\left(S=severe \right|F_{sys} (T))={\displaystyle \frac{P\left(severe\right) [1-{\prod }_e\exp \left(-\mathsf{\Lambda }\left(e, severe\right)\left(T\right)\right) ]}{{\sum }_{s}P\left(s\right) [1-{\prod }_{e}exp(-\mathsf{\Lambda }(e, s\left)\right(T\left)\right) ]}} \end{gathered}$$

(20)

Failure attribution, defined as the probability that a system failure is caused by a specific equipment item or failure class, is calculated from the ratio of the individual failure rate to the total system failure rate while accounting for uncertainty in S. Once the collapse dataset is available, the complete analysis workflow, surrogate training, FORM and MCS analysis, corrosion degradation assessment and Bayesian network evaluation is completed in less than two minutes on a workstation. The comparison concerns this evaluation stage only: generation of the collapse dataset is a one-off cost that dominates the total effort and would be substantially larger for a nonlinear finite element campaign. The advantage of the surrogate at the evaluation stage is nevertheless decisive, since a sampling-based reliability analysis of the same resolution would otherwise require the order of 10⁶ nonlinear collapse analyses for each corrosion scenario and service year.

3. Results

3.1. Surrogate Performance

Table 4. Predictive performance of the GPR collapse surrogate.

Metric	Value	Basis
Coefficient of determination R2 (training)	0.9988	379 samples
Coefficient of determination R2 (test)	0.9960	95 samples
RMSE (test)	0.81 MPa (2.1%)	95 samples
Mean absolute error (test)	0.56 MPa	95 samples
Ten-fold cross-validation R2	0.9972 ± 0.0008	474 samples
Ten-fold cross-validation RMSE	0.67 MPa	474 samples
Mean absolute deviation vs. analytical model	0.81%	474 samples

summarizes the accuracy of the GPR surrogate and Figure 5 shows the corresponding parity and residual plots. On the held-out test set of 95 samples, the surrogate model achieved an R² of 0.9960, an RMSE of 0.81 MPa (2.1% of the mean collapse pressure), and a mean absolute error (MAE) of 0.56 MPa. Ten-fold cross-validation on the full dataset produced an R² of 0.9972 ± 0.0008, demonstrating that the model maintains consistently high accuracy across different data partitions. Test residuals are centred, homoscedastic across the 12–80 MPa response range and essentially contained within a ±3% band (Figure 5b), so no region of the design space is systematically misrepresented. The mean absolute deviation of the surrogate from the noise-free analytical collapse solution is 0.81%, i.e., about half of the 1.5% scatter injected into the training data, indicating that the GPR filters the injected noise rather than reproducing it. The lognormal model uncertainty factor X_m of Table 3 (unit mean, 6% COV) is not calibrated from these residuals alone: it is set to cover the residual surrogate error together with the discrepancy between code-type capacity formulations and detailed nonlinear analysis, and its magnitude is consistent with the strength-model uncertainties reported for pressure boundaries in [25,26].

3.2. Component-Level Reliability of the Corrosion-Free (Intact) Separator

For the intact separator at 3000 m, FORM on the GPR limit state converges to a reliability index β = 4.552, corresponding to a per-demand failure probability P_f,d = 2.65 × 10⁻⁶. Replacing the surrogate by the analytical collapse model changes the index to β = 4.530 (P_f,d = 2.96 × 10⁻⁶), a deviation of 0.5% in β, so the surrogate is reliability-equivalent to the underlying physics model at the design point. A crude MCS with 2 × 10⁶ surrogate evaluations yields P_f,d = 3.0 × 10⁻⁶ with a sampling COV of 41%; the FORM estimate lies well inside its confidence band. Because such rare-event verification is statistically weak, a dedicated verification point with the mean wall thickness reduced by 8 mm was analyzed, raising the failure probability into a range where MCS is accurate; these results are reported in Section 4.2.

Figure 6b shows the FORM importance factors. The initial ovality dominates with α_i² = 50.6%, followed by the model uncertainty X_m (26.6%), the yield stress (12.4%), and the wall thickness (8.1%); the internal pressure, diameter, Young’s modulus, and length are collectively below 2.5%. Physically, at D/t ≈ 19 the shell collapses in the interactive elastic–plastic regime of Equation (5), where capacity is most sensitive to the imperfection knock-down. Hence the prominence of f₀, while the pronounced role of X_m reflects the explicit inclusion of capacity-model uncertainty in the limit state. At the design point the wall thickness is reduced by only 2.6% and the ovality is at 3.2 times its mean, confirming that collapse is imperfection-driven rather than thickness-driven for the intact vessel. The design-point ovality of about 0.016 lies marginally outside the range sampled in Table 2, as noted in Section 2.3.1; the agreement between the surrogate and the analytical capacity model at this point, reported in Section 4.2, indicates that the associated extrapolation error is small relative to the model uncertainty carried by X_m.

With the expected demand frequency ν_d = 2 depressurization events per year, Equation (16) converts the per-demand probability into an annual structural failure rate λ_struct = 5.30 × 10⁻⁶ per year. This satisfies the DNV high-safety-class target failure rate of 10⁻⁵ per year for ultimate limit states [22] and amounts to only 0.0034% of the separator functional failure rate of 0.1538 per year (Table 1): for an intact, code-compliant shell, functional failures dominate the separator node by more than four orders of magnitude.

3.3. Time-Variant Reliability Under Corrosion

Figure 7 and

Table 5. Time-variant reliability index and annual structural failure rate (×10⁻⁵ yr⁻¹) for the three corrosion scenarios (ν_d = 2 yr⁻¹).

Year	β, Intact	β, 0.2 mm/yr	β, 0.4 mm/yr	Rate, Intact	Rate, 0.2 mm/yr	Rate, 0.4 mm/yr
0	4.552	4.552	4.552	0.53	0.53	0.53
5	4.552	4.417	4.280	0.53	1.00	1.87
10	4.552	4.280	4.002	0.53	1.87	6.29
15	4.552	4.141	3.717	0.53	3.45	20.2
20	4.552	4.002	3.422	0.53	6.29	62.0
25	4.552	3.860	3.115	0.53	11.3	184

present the corrosion degradation results. Uniform thinning at 0.2 mm/yr reduces the reliability index almost linearly from 4.552 to 3.860 over 25 years, while 0.4 mm/yr reduces it to β = 3.115, with the annual failure rate rising by factors of 21 and 350, respectively. Measured against the DNV target rates [22], the high-safety-class level of 10⁻⁵ per year is crossed at year 5 for the moderate rate and already at year 3 for the severe rate, whereas the medium-safety-class level of 10⁻⁴ per year is reached at years 24 and 12, respectively; the intact vessel remains below the high-class target indefinitely. The cumulative structural collapse probability over 25 years (Equation (17)) amounts to 1.38 × 10⁻⁴ (intact), 9.62 × 10⁻⁴ (0.2 mm/yr) and 9.24 × 10⁻³ (0.4 mm/yr). Two MCS spot checks with the GPR surrogate at year 25 confirm the FORM trajectory: P_f,d = 1.135 × 10⁻³ (COV 4.7%) against the FORM value of 9.2 × 10⁻⁴ for the severe rate, and 6.87 × 10⁻⁵ (COV 9.9%) against 5.7 × 10⁻⁵ for the moderate rate, a 16–19% FORM underestimate attributable to limit-state curvature that is examined in Section 4.2.

3.4. System-Level Reliability and Diagnostics

At the system tier, marginalizing Equation (19) over the two RIF states yields a year-one system failure probability of 0.4334, i.e., a survival probability of 0.567 (Figure 8a), against 0.4195 reported by the author’s earlier BN assessment of the same system [17]—a 3.3% difference discussed in Section 4.3. The reliability trajectory is governed almost entirely by the functional rates: adding the structural branch changes the year-one failure probability by less than 10⁻⁵ even for the severe corrosion scenario, because the structural rate remains three to four orders of magnitude below the aggregate functional rate of 0.572 per year. The value of the integration therefore lies not in shifting the headline reliability but in enabling consistent attribution and diagnostics across failure classes.

Table 6. Bayesian network failure attribution of the subsea separation system.

Failure Source	Attribution, Year 1 (%)	Attribution, Year 25, 0.4 mm/yr (%)
Separator (functional)	26.90	26.81
Coalescer (functional)	23.90	23.82
MP pump (functional)	21.71	21.64
WI pump (functional)	17.23	17.18
Hydrocyclone (functional)	10.26	10.23
Separator (structural collapse)	<0.001	0.328

gives the failure attribution. In year one the separator is the most likely functional origin of a system failure (26.9%), followed by the coalescer (23.9%), the MP pump (21.7%), the WI pump (17.2%) and the hydrocyclone (10.3%), while the probability that a system failure is a structural collapse is below 0.001%. Under severe corrosion, the structural contribution increases by more than two orders of magnitude, reaching 0.33% at year 25. Although this value is low in terms of failure frequency, it belongs to a failure class whose consequences differ in kind from functional failures, as discussed in Section 5. Diagnostic inference using Equation (20) shows that observing a system failure during the first year increases the probability of the severe RIF state from the initial value of 0.50 to 0.556. This demonstrates how observed operational failures can update the understanding of environmental conditions and maintenance-related factors.

4. Verification and Consistency Checks

4.1. Surrogate Verification

The surrogate was assessed at three levels. First, internal validation using the 80/20 holdout test and ten-fold cross-validation (Table 4) confirmed its predictive performance on unseen samples, achieving R² ≥ 0.996 with very low dispersion (R² dispersion < 0.001). Second, predictions were compared across all 474 designs with the noise-free analytical collapse solution of Equations (1)–(5): the mean absolute deviation of 0.81% is roughly half of the 1.5% noise deliberately injected into the training responses, which confirms that the GPR recovers the underlying response rather than the sampling scatter. It must be emphasized that this second check is a verification and not an independent validation. Because the training data are generated from Equations (1)–(5), the comparison establishes only that the surrogate recovers its own data-generating function; it carries no information about how well that function represents the collapse of a real separator shell. Independent validation requires either nonlinear finite element analyses performed outside the data-generating model or experimental collapse pressures, and is the necessary next step before the framework is used for design. The surrogate error reported here should accordingly be read as the numerical error introduced by replacing the capacity model with its emulator, while the physical adequacy of the capacity model itself is carried by the model uncertainty factor X_m. Third; the posterior standard deviation of Equation (7) estimated at the FORM design points remains below 0.4% of the predicted capacity, so surrogate epistemic uncertainty is negligible relative to the 6% model uncertainty already carried by X_m.

4.2. Comparison of the Reliability Methods

FORM and MCS were compared on three probability levels. For the intact vessel (P_f,d ≈ 3 × 10⁻⁶) the FORM estimate lies inside the 95% confidence band of a 2 × 10⁶-sample MCS. At the verification point, where the mean wall thickness is reduced by 8 mm, the FORM analysis gives a reliability index of β = 3.422 using the surrogate model and β = 3.421 using the analytical model. The difference is only 0.04%, confirming that the surrogate reproduces the capacity model at the critical design condition. Because the analytical model is defined over the whole input space, this agreement also bounds the error introduced by the mild ovality extrapolation identified in Section 2.3.1. The corresponding failure probability is P_f,d = 3.10 × 10⁻⁴, compared with the MCS results of 3.68 × 10⁻⁴ (COV = 4.3% using the surrogate model) and 3.90 × 10⁻⁴ (COV = 8.0% using the analytical model). The confidence intervals of the MCS results overlap, indicating good agreement between the surrogate and analytical approaches (Figure 6a). At year 25 of the two corrosion scenarios the FORM-to-MCS ratio is 0.81–0.83. FORM thus underestimates the failure probability by 16–19% at the higher probability levels, a known consequence of limit-state curvature at the design point [39,42]; the discrepancy is stable, small on the logarithmic scale on which target rates are formulated, and conservative bias could be restored where needed by a second-order correction or by importance sampling. All system-level quantities in Section 3.4 are insensitive to this factor because the structural branch contributes marginally to the system rate.

4.3. Consistency with the Published System Assessment

The integrated model was compared with the author’s earlier published Bayesian assessment of the same five-equipment SSS [17]. Using the Table 1 rates, the two-state RIF marginalization reproduces a year-one system failure probability of 0.4334 versus the published 0.4195, i.e., agreement within 3.3%. The residual difference has two identified sources: the contraction of the full nine-RIF network into a single two-state node, which preserves the ±15% rate envelope but not the complete shape of the rate distribution, and the interpolation of the published reliability curve at the one-year point. An analytical cross-check confirms the BN implementation itself: the closed-form two-state mixture 0.5[exp(−0.85Σλ) + exp(−1.15Σλ)] with Σλ = 0.5719 yr⁻¹ gives 0.4335, identical to the network evaluation to four decimals. The structural branch alters the comparison by less than 10⁻⁵ and therefore does not confound it. Together with the component-level checks of Section 4.1 and Section 4.2, the framework is verified end to end: the surrogate against the capacity model it emulates, the reliability method against sampling, and the system integration against a previously published assessment. This last comparison is a consistency check against the author’s own earlier work [17] and not an independent validation: it establishes that the contracted two-state network reproduces the published system-level result, not that the underlying failure-rate model is correct.

5. Discussion

A one-at-a-time sensitivity analysis was performed to identify the key engineering parameters affecting system reliability. Figure 9 and

Table 7. One-at-a-time sensitivity of the year-20 annual structural failure rate (baseline 6.29 × 10⁻⁵ yr⁻¹, r_c = 0.2 mm/yr).

Perturbation	Δ Rate (×10−5 yr−1)	Resulting Rate (×10−5 yr−1)
f0 mean 0.5% → 0.75%	+119.6	125.9
rc 0.2 → 0.4 mm/yr	+55.8	62.0
Xm COV 6% → 8%	+21.7	28.0
t COV 2% → 3%	+8.6	14.9
νd 2 → 4 yr−1	+6.3	12.6
f0 mean 0.5% → 0.35%	−6.0	0.32
rc 0.2 → 0.1 mm/yr	−4.4	1.87
νd 2 → 1 yr−1	−3.1	3.15
Corrosion onset delayed 5 yr	−2.8	3.45

present the changes in the annual structural failure rate at year 20, using the baseline value of 6.29 × 10⁻⁵ yr⁻¹ for the moderate corrosion scenario. The analysis considers variations in fabrication, degradation, and operational parameters to evaluate their individual influence on failure probability. Changing the mean initial ovality from 0.5% to 0.75% is by far the most detrimental change, raising the rate twenty-fold to 1.26 × 10⁻³ yr⁻¹, while tightening it to 0.35% suppresses the rate to 3.2 × 10⁻⁶ yr⁻¹, below even the intact baseline of Table 5. Doubling the corrosion rate is the second-ranked driver, followed by the width of the capacity-model uncertainty; the demand frequency scales the rate linearly, and delaying the corrosion onset by five years (an effective coating) is equivalent to shifting the whole degradation trajectory accordingly. Two internal consistencies corroborate the tornado sensitivity (Figure 9) results: halving the corrosion rate at year 20 reproduces exactly the year-10 rate of the baseline scenario, and the five-year onset delay reproduces the year-15 rate, as the thinning model of Equation (15) requires.

Three important implications can be drawn for integrity management. First, ovality is the most important factor controlling structural reliability. The high influence of initial ovality, shown by both the FORM importance factor (α_i² = 50.6%) and the tornado ranking, indicates that ensuring accurate manufacturing tolerances can improve reliability more effectively than later operational measures. Therefore, dimensional inspection of the as-built shell, to confirm that the measured out-of-roundness does not exceed the value assumed in design, is essential.

Second, the DNV target-rate crossings presented in Section 3.3 illustrate how an inspection strategy can be derived from reliability limits. For the corrosion scenarios assumed here, a baseline ultrasonic wall-thickness inspection within the first three to five years would be sufficient to distinguish the moderate from the severe scenario while the system is still within the high-safety-class reliability limit, and requalification would be indicated before year 12 for the severe scenario and before approximately year 24 for the moderate one. These years follow directly from the deterministic corrosion rates of 0.2 and 0.4 mm/yr, from the assumed protection-breakdown time and from the assumed demand frequency; they are illustrative results for the assumed cases rather than general inspection recommendations, and they would move with any change in those assumptions or in the target safety class.

Because subsea inspection campaigns are costly, their timing should be linked to predicted reliability-limit crossings rather than based on fixed inspection intervals. This provides a more effective risk-based inspection strategy [44,45]. Third, since the frequency has a direct linear effect on structural reliability, the number of depressurization events can serve as a simple and measurable reliability indicator. Operational practices that avoid unnecessary full depressurization (zero internal pressure) events can reduce the structural failure rate by half without additional capital investment.

The system-level results should be interpreted carefully. From a frequency perspective, structural failure is a very small contributor: it accounts for less than 0.001% of failure attribution for an intact shell and increases to only 0.33% after 25 years under severe corrosion. Therefore, availability improvement efforts should focus primarily on functional failure modes, following the priority ranking in Table 6, with attention first given to the separator internals and coalescer.

This ranking is expressed in failure frequency alone. The framework quantifies probabilities and frequencies of failure and contains no consequence model, so the quantities reported in this paper are reliability measures rather than risk measures. The distinction matters because the consequences of the two failure classes differ in kind: functional failures generally result in recoverable module intervention and temporary production loss, whereas collapse of the separator shell at 3000 m water depth is a loss-of-containment event with potential equipment replacement and environmental consequences. Converting the present results into risk would require an explicit consequence assessment, for example a frequency–consequence matrix or an expected-loss model. Such an assessment would be expected to weigh the structural branch more heavily than its frequency contribution alone suggests, but that expectation is not quantified here and no risk-based conclusion is drawn from it.

The main advantage of the proposed multi-scale framework is its ability to represent both functional and structural failure mechanisms within a single probabilistic model, instead of treating them separately through independent structural reliability and reliability–availability–maintainability (RAM) analyses. Furthermore, the diagnostic results presented in Section 3.4 provide an operational benefit: early-life system failures contain valuable information about the underlying RIF conditions and should trigger a reassessment of the assumed environmental and maintenance states [9].

The limitations of this study should be considered when interpreting the results, and are listed individually below.

(i)

The training data are generated by the physics-based interaction model of Equations (1)–(5) with calibrated noise rather than by an independent nonlinear finite element campaign. This is sufficient to demonstrate the framework and to quantify the cost saved by the surrogate step, but it means that the accuracy figures of Section 3.1 measure emulation error rather than physical accuracy. Geometry-specific finite element results and, ultimately, experimental collapse data should be incorporated before the method is used for design decisions; such an improvement would change only the input data, while the surrogate, reliability and system-integration steps would remain unchanged.

(ii)

The capacity model represents an unstiffened cylindrical shell course under uniform external pressure. A practical separator additionally contains end closures, nozzles, supports, internal weirs and plates and, in some designs, ring stiffeners. These features change the effective length between restraints, introduce local stress concentrations and can shift the governing buckling mode, and their net effect on the collapse pressure may be favourable through added restraint or unfavourable through local imperfection and residual stress. The present results therefore apply to the governing shell course, and a component-specific finite element model would be needed to confirm that this is the critical location for a given design.

(iii)

The surrogate is trained over the ranges of Table 2. Thickness, diameter, length, stiffness and yield stress remain inside those ranges for every corrosion year considered, but the upper tail of the ovality distribution and the FORM design point lie slightly outside the sampled interval, so the model is mildly extrapolated there. The comparison with the analytical capacity model in Section 4.2 indicates that the resulting error is small, but an extended design of experiments in f₀ is recommended for design application.

(iv)

Only the separator carries a structural failure branch. The hydrocyclone, the coalescer and the two pumps enter the network through functional failure rates alone, although they are also pressure-containing or pressure-exposed items with their own ultimate limit states. The framework extends to them without modification, but each would require its own capacity model and design of experiments, which was outside the scope of this study.

(v)

The system model is simplified in three respects: the series representation and the conditional independence assumption exclude redundancy and common-cause failures beyond the shared RIF state, and the two-state node S captures the published uncertainty range but not the full nine-factor RIF network of [17].

(vi)

Functional failure rates are assumed constant in time, whereas the structural failure rate varies with ageing. This difference follows the OREDA data basis [5]; incorporating time-dependent functional degradation models would improve predictions for late-life operation.

(vii)

Corrosion is simplified as uniform wall thinning of an initially defect-free shell. More realistic corrosion patterns, such as localized pitting or grooving, would require defect-specific capacity models [24,26] combined with inspection-based reliability updating.

(viii)

The demand frequency ν_d is an operational assumption rather than a measured quantity; its influence is linear and is quantified in Table 7.

(ix)

FORM underestimates the failure probability relative to MCS by 16–19% at the higher probability levels, as discussed in Section 4.2. This is relevant mainly for component-level predictions close to the end of service life and does not affect the system-level results.

(x)

Epistemic and aleatory uncertainties are not separated, particularly for f₀ and X_m. A nested uncertainty framework would allow reducible uncertainty to be distinguished from inherent variability and would give a more informative uncertainty representation [46].

6. Conclusions

A component-to-system multi-scale reliability framework has been developed for a deep-water subsea separation system operating at 3000 m water depth. A Gaussian process regression surrogate of the collapse pressure of the vertical gravity separator shell, trained on a 474-sample design of experiments, was embedded in FORM and Monte Carlo reliability analyses and coupled, through a time-variant structural failure rate, to a Bayesian network of the five-equipment separation train. The following conclusions are drawn.

The surrogate reproduces the capacity model it emulates with R² = 0.996 and a relative RMSE of 2.1% on held-out samples, and its posterior standard deviation at the FORM design points remains below 0.4% of the predicted capacity. Replacing the analytical capacity model by the surrogate changes the reliability index by 0.5% for the intact vessel and by 0.04% at the verification point, so the surrogate is reliability-equivalent to the capacity model at a negligible fraction of its evaluation cost. This equivalence is numerical: the physical adequacy of the capacity model itself is not established by the present dataset and remains to be demonstrated against independent finite element and experimental results.

For the intact, code-compliant shell the reliability index is β = 4.55, corresponding to an annual structural failure rate of 5.3 × 10⁻⁶ per year. This satisfies the DNV high-safety-class target for ultimate limit states and amounts to 0.0034% of the functional failure rate of the separator, so structural collapse is negligible in frequency terms for a new vessel.

Uniform corrosion changes this picture progressively. At 0.2 and 0.4 mm/yr the reliability index falls to 3.86 and 3.12 after 25 years and the annual structural failure rate increases by factors of 21 and 350, respectively, crossing the medium-safety-class target of 10⁻⁴ per year at years 24 and 12. The cumulative structural collapse probability over 25 years reaches 9.2 × 10⁻³ for the severe scenario, and the structural share of system-level failure attribution rises from below 0.001% to 0.33%.

At system level the year-one failure probability of 0.4334 agrees within 3.3% with the previously published assessment of the same system, confirming that the contracted two-state RIF network reproduces that earlier result. Adding the structural branch changes the system failure probability by less than 10⁻⁵, so the value of the integration lies in consistent attribution and diagnostics across failure classes rather than in the headline reliability figure. Diagnostic inference illustrates this: an observed first-year system failure raises the posterior probability of the severe RIF state from 0.50 to 0.556.

The sensitivity study identifies fabrication quality as the controlling factor for structural reliability. The initial ovality carries a FORM importance factor of 50.6%, and relaxing its mean from 0.5% to 0.75% raises the year-20 annual failure rate twenty-fold, whereas doubling the corrosion rate raises it by a factor of ten. Dimensional control of the as-built shell is therefore a more effective reliability measure than any of the operational parameters examined.

Two developments are required before the framework is applied to design. First, the collapse dataset should be regenerated from independent nonlinear finite element analyses of the specific vessel geometry, including end closures, nozzles and internals, and validated against experimental collapse data. Second, an explicit consequence model is needed if the frequency results reported here are to be interpreted as risk. Extending the structural branch to the remaining pressure-containing items and replacing the deterministic corrosion scenarios by inspection-updated degradation models are natural further steps.