Resistance Modeling

1. Sample of inputs and estimations

The modeling approach of exposure, mitigation, and resistance is an appropriate representation of how actual failure probability manifests and is a complete and efficient way to assess each PoF mechanism. A probability of damage is first produced by assessing the first two terms for all plausible failure mechanisms. Previous chapters have discussed and demonstrated how useful and defensible estimates of damage potential can be generated.

Then, the resistance component is added to discriminate between damage and failure. The ability of the pipeline to withstand failure mechanisms—absorb forces or damages—distinguishes between damage and failure. This resistance to failure will play a significant role in risk calculations involving both time independent failure mechanisms and time-dependent failure mechanisms.

Measuring resistance independently from exposure and mitigation also informs risk management. The simple equation for PoF shows two ways to reduce PoF—either increase mitigation—blocking the failure mechanism—or increase resistance—making the structure stronger to absorb more forces.

As the last piece of the PoF puzzle, an estimate of the component’s resistance against all failure mechanisms is sought. This includes a myriad of issues including manufacturing and construction practices, in-service damage rates, inspection frequencies and capabilities, and the impact of potential defects of varying characteristics. The need for a formal process is readily apparent upon brief contemplation of the possible combinations of strength issues. For example, it is not possible to intuit the risk prioritization among the following resistance-driven scenarios that will be familiar to many experienced pipeline professionals:

Scenarios Implying (but not directly stating) Reduced Component Strength

Potential Strength Scenario	Discussion
LF ERW with no known features, MFL ILI 2 years ago	not all LF ERW is problematic, MFL ILI gives only slight evidence of ‘no features’—no assurance
LF ERW with minor, known features, specialized ILI (crack tool) conducted last year, suspected low toughness	probability of weaknesses is higher, some assurance of integrity via ILI, but not conclusive
high count of laminations discovered in recent ILI, H2 sources, high stress level, wrinkle bends possible	multiple issues; normally benign laminations could be made injurious by the H2, plus wrinkle bends as independent issue
high count of dents found during random excavations, no ILI, moderate pressure cycling regime	concern of fatigue cracking
low stress, possible miter joints and acetylene girth welds, proposed thermal cycling	concerns of very low resistance to axial forces; stress concentrators as special vulnerabilities

These sample scenarios are rather complex and difficult to compare to one another. A formal process is required to assimilate all available information and all possible strength issues. This resistance discussion focuses on failure as leak/rupture, but resistance is also an element of the PoF assessment that uses a broader definition: failure = service interruption.

Introduction

Resistance calculations estimate structural integrity against all anticipated loads—internal, external, time-dependent, and random. This chapter provides guidance on evaluating the component’s ability to resist, without failing, all loads.

Varying levels of rigor are available to the risk assessment designer. The underlying engineering, physics, and material science concepts can be complex. However, approximations often provide sufficient accuracy and will be appropriate for many types of risk assessments. When more precision in pipe resistance estimation is desired, pairings of specific weaknesses with specific potential loadings can be analyzed using solutions up to robust finite element analyses.

Whether a more robust or more modest assessment is desired, the general process is the same. The overall strength of the pipeline segment or component and its stress levels are considered. This includes an assessment of foreseeable loads, stresses, and component strengths. Known and suspected weaknesses due to previous damage or questionable manufacturing/construction processes must also be considered.

The resistance estimation is akin to calculating a safety factor or a margin of safety, comparing what the pipeline can do (design) versus what it is currently being asked to do (operations). The margin provides protection when unanticipated loads or defects appear. This discussion focuses on steel pipe but concepts apply to any component of any material.

The evaluation process involves an evaluation of loadings and associated stresses, commonly:

• Internal pressure
• External loadings
• Special loadings

System strength (resistance to loadings) is next evaluated:

• First, in the absence of weaknesses, considering
  • material strength
  • structural strength, especially wall thickness
• Next, in consideration of known and possible weaknesses
  • From manufacture
  • From installation
  • From damages since installation.

In the interest of completeness, we must cover some basics of material science and stress-strain concepts before adopting a model to capture resistance in the risk assessment. The coverage here is only very rudimentary. The topic warrants much deeper examination, if not a full technical education in the subject area, by the owner of the risk assessment model.

Component resistance determination

As discussed herein, resistance can be efficiently measured by modeling a pressure-containing component’s effective wall thickness. Wall thickness is a very strong determinant of strength and therefore is a useful surrogate for all other strength-influencing factors. Weaknesses can be efficiently modeled in terms of equivalent reduction in wall thickness.

Increasing forces or defect severities will each reduce effective wall thickness and, hence, the ability to resist additional forces. More reductions in effective pipe wall thickness is the same as forecasting increasing failure rates under assumed loading scenarios. This takes into account the probabilities of various weaknesses coinciding with various loading scenarios.

An assumption here is that wall thickness is a critical determinant of a component’s resistance to all failure mechanisms and can be used as a reasonable surrogate for a robust strength analyses. Effective wall then is the basis for modeling resistance to loads. As wall thickness is reduced, implications for component strength include:

• Less capacity for pressure containment
• Faster TTF for degradation mechanisms
• Higher D/t leading to reduced buckling capacity
• Lowered resistance to external forces including localized (puncture) and uniform (subsea hydrostatic pressure).

A probability component is a practical necessity in this part of the assessment since the loads and resistances each involve a spectrum of possibilities—loads and resistance are difficult if not impossible to directly and continuously measure at all points along each pipeline. The risk assessment attempts to accurately represent, at each location, all the possible loading scenarios with all possible weaknesses to estimate how often the two will overlap in a way that causes a failure.

The loads are captured by estimates of exposure and mitigation at all locations. This includes both degradation and random failure mechanisms. The role of defects is similarly represented by probability distributions of severity and likelihood. Either point estimates—representing underlying distributions—can be used, or the distributions themselves can be integrated in the risk calculations.

After loads/stresses are understood, defect potential is the second key ingredient. Each potential defect has both a probability of occurrence and a adds a level of weakness, if it is present. The former can be inferred from an estimated frequency (per mile, for instance) and the latter can be expressed in % loss of wall thickness—an equivalent wall thickness reduction. The probability of occurrence—chances that the weakness is really present—is estimated and used in subsequent steps to determine the probability that the resistance weakness is coincident with the force applied. The weakness estimate resulting from the potential presence of defects is used to predict changes in failure fraction (under certain loads) based first on the severity of the defects.

Including Defect Potential in Risk Assessment

Potential defects and their impact on component resistance must be understood before a model can be developed to efficiently use this understanding in a risk assessment. A robust assessment must consider:

The spectrum of defect types, sizes, and orientations that might be present including those that might have materialized since previous inspections/assessments. Sources of defects include:

• From component manufacture
• From installation
• From operations history.

Knowledge of defects comes from an understanding of possible sources as well as:

• All inspections and integrity assessments that have been performed
• The ability of each inspection/assessment to detect various defects
• The age of each inspection/assessment.

The central question to be answered is: what has been lost, due to the presence of this defect? For instance, how many overpressure events, longitudinal stress loadings, etc. can now no longer be resisted? As a modeling simplification, a probability-weighted summation of potential weaknesses can be used to characterize a component’s possible collection of weaknesses. This is an approximation that captures the differences between components with low incidences and/or severities of weaknesses versus those with higher incidences and compounding effects of multiple types of weaknesses co-existing. It captures the frequency and severity of potential weaknesses into a single value while avoiding the intensive approach of a probability distribution of strength reduction versus frequency of occurrence for all possible combinations of pipe weaknesses. Even in a simplified form, this approach also ensures that the intersection of low-probability, high-severity weaknesses with ‘sufficient’ load scenarios to cause failures, are considered in the risk assessment.

Getting Quick Answers

Since this discussion does not purport to be a full treatment of structural analyses but rather a presentation of a risk assessment methodology, the risk assessor, already familiar with the technical underpinnings, may wish to move directly into the risk assessment methodology—how to embody structural and material science concepts into an efficient risk assessment. .

A general technical background discussion follows, for readers seeking more background in material science and structural analyses concepts. See also PRMM for more background discussion.

Background

Material Failure

We now briefly examine the materials science principles that allow estimation of loads and resistance values. Recall the need for a definition of ‘failure’ in risk assessment. As with the general risk assessment, ‘failure’ can have any of several meanings in the resistance assessment. Yield strength and ultimate strength are two characteristics typically used to define material failure.

Structural failure can be defined (one of several possible definitions) as the point at which the material changes shape under stress and does not return to its original form when the stress is removed. When this “inelastic” limit is reached, the material has been structurally altered from its original form and its remaining strength might have changed as a result. The structure’s ability to resist inelastic deformation is one important measure of its strength.

Resistance can be viewed as the ability to avoid plastic collapse which is related to the difference between applied stresses and material yield point or ultimate strength point. For most pipeline applications, the potential for leaks, unrelated to excess stress, must also be included.

A degradation mechanism active in a pressurized component will require both leak criteria and rupture criteria be considered in concert, ie, as degradation advances through the material, either the pressure-containing capacity (rupture resistance) or the fluid containment capacity (leak resistance) will be lost first. Either results in loss of integrity.

Failure mechanisms/modes include:

• External pressure
• Internal pressure
• Longitudinal bending (longitudinal buckling)
• Axial tension
• Axial compression (axial buckling)
• Lateral compression (crushing)
• Shear
• Cracking (fatigue, etc)
• And various combinations of these.

Concepts from limit state design can be useful here. A limit state is a threshold beyond which a design requirement is no longer satisfied. Typical limit states include ‘ultimate’—corresponding to a rupture or large leak—‘leakage’, and ‘serviceability’. A limit state can be stress-based or strain-based (deformation-controlled).

Changes in material properties over time should be considered. There does not appear to be any evidence that steel strength properties diminish over time. Some researchers even cite minor increases in strength parameters in aged steels. Therefore, the mechanisms resulting in diminished resistance in steel are related to damages suffered, not time-induced changes in metallurgical characteristics. Damages are accounted for as failure mechanisms such as corrosion, cracking, and external forces.

For other pipe and component materials, such as certain types of plastics, degradation mechanisms are expected and should be included in resistance determinations.

Toughness

Toughness is a material property playing an important strength role in many types of loadings, sometimes being the difference between failure and not failing and often between rupture and leak.

Material toughness influences crack failure potential. Crack initiation, activation, and propagation are all impacted. Materials that have little fracture toughness do not offer much resistance to brittle failure. Even small defects can reduce strength dramatically when toughness is low. Rapid crack propagation, perhaps brought on by corrosion and stress, is more likely in these materials, resulting in more violent ruptures.

A common method used to assess material toughness is the Charpy V-notch impact test. Toughness-equivalent considerations for non-steel components—plastics (PVC, PE, etc), cast iron, copper will be required.

The challenge of gauging the likelihood of a more catastrophic failure mode is further complicated by the fact that some materials may change over time. Given the right conditions, a ductile material can become more brittle.

Pipe materials, joining, and rehabilitation

A basic understanding of common pipe materials is important in assessing the ability to resist failure. Although transmission pipelines are overwhelmingly constructed of carbon steel, distribution lines have historically been built from a variety of materials. The material’s behavior under stress is often critical to the evaluation. A more brittle material typically has less impact resistance. Impact resistance is particularly important in reducing the severity of outside force loadings. In regions of unstable ground, materials with higher toughness and more flexible structures will better resist the stresses of earth movements. Traffic loads and pipe handling activities are other stress inducers that must be withstood by properties such as the pipe material’s fatigue (cracking) and bending (tensile) strengths. Stresses resulting from earth movements and/or temperature changes may be more significant for certain pipe materials. In certain regions, a primary ground movement is caused by the seasonal freeze/thaw cycle. One study shows that in some pipe materials, as temperature decreases, pipe breaks tend to increase exponentially [51]. Break rates for rigid pipes such as cast iron are found to be several times higher than for welded steel pipelines. Mechanical fittings add rigidity and are common points of failure when external forces are applied.

All of the pipe materials discussed here have viable applications, but not all materials will perform equally well in a given service. Although all pipelines can be inspected to some extent by direct observation and remotely controlled video cameras, larger steel pipelines benefit from maturing technologies employing electromagnetic and ultrasonic inspection devices.

Because there is no “miracle” material, the material selection step of the design process is partly a process of maximizing the desirable properties while minimizing the undesirable properties. The initial cost of the material is not an insignificant property to be considered. However, the long-term “cost of ownership” is a better view of the economics of a particular material selection. The cost of ownership would include ongoing maintenance costs and replacement costs after the design life has expired. This presents a more realistic measure with which to select a material and ultimately impacts the risk picture more directly.

The pipe designs should include appropriate consideration of all loadings and correctly model pipe behavior under load. Design calculations must always allow for the pipe response in determining allowable stresses. Pipe materials can be placed into two general response classes: flexible and rigid. This distinction is a necessary one for purposes of design calculations because in general, a rigid pipe requires more wall thickness to support a given load than a flexible pipe does. This is due to the ability of the flexible pipe to take advantage of the surrounding soil to help carry the load. A small deflection in a flexible pipe does not appreciably add to the pipe stress and allows the soil beneath and to the sides to carry some of the load. This pipe–soil structure is thus a system of high effective strength for flexible pipes [60] but less so for rigid pipes.

Materials with a lack of ductility also have reduced toughness. This makes the material more prone to fatigue and temperature-related failures and also increases the chances for brittle failures. Brittle failures can be more consequential than ductile failures since the potential exists for larger product releases and increased projectile loadings. The potential for catastrophic tank failure should be considered, including shell and seam construction and membrane stress levels for susceptibility to brittle fracture.

Especially in distribution systems, the evaluator must take into account material differences when determining resistance. When the type of material limits its ability to provide ‘extra’ resistance, the appropriate adjustment to effective wall thickness should be made.

Separation of mechanical fittings can result in large releases. Provisions for mechanical coupling equivalent weaknesses will also be needed, when evaluated systems containing such fittings.

Some common pipe materials, many found only in distribution pipeline systems, are discussed in PRMM. That is not an exhaustive list and also does not include multi-material systems. Pipe-in-pipe systems (cased pipe) and plastic-wrapped-in-steel, perhaps also with additional armoring sheaths of various types, are examples of multi-material systems. Resistance calculations may become more challenging with some designs, but are still efficiently modeled using basic principles of material science and physics.

Flexible pipe

Steel pipe manufacturing processes have evolved over many years. Processes include furnace butt-welding, continuous butt-welding, lap welding, hammer welding, low frequency electric resistance welding (ERW), flash welding, single submerged arc welding, variations on seamless pipe manufacture, high-frequency ERW, double submerged arc welding (DSAW) either straight or spiral seam. Of these, continuous butt-weld seamless, HFERW, and DSAW processes remain in widespread use today and have since early 1970 whereas the others were phased out around 1970 or before [1020]. Some of these processes, even when meeting the quality standards at the time, had a propensity to introduce weaknesses. LF ERW, lap welding, flash welding, and others have been highlighted as steel manufacturing processes that produced, in some pipe mills, pipe with increased vulnerabilities to failure mechanisms such as selective seam corrosion and cracking. This pipe is often a focus of integrity management, since these weakness features can be difficult to detect and failure modes can be dramatic.

Quality control and inspection of the manufacturing processes have also evolved over the years and impact the types and quantities of weaknesses that might have been introduced. Similarly, construction practices for steel pipelines have evolved. Earlier practices created mechanical couplings, wrinkle bends, acetylene girth welds, and other components that are today considered more susceptible to failure than their more modern counterparts. Linkages between possible weaknesses and resistance related to steel pipe manufacture and construction are examined later in this chapter.

PE failure potential is strongly influenced by stress and temperature. Slow crack propagation is a common long-term failure mechanism that should be considered in risk assessments. Field-performed heat fusions of fittings and joints are similarly susceptible. Secondary loads such as from overburden, bending, and rock impingements should also be included in the assessment.

See the related discussions in PRMM.

Defects and Weaknesses

The detection of weaknesses begins with identifying potential anomalies. The first idea that comes to mind when hearing ‘anomaly’ may involve ‘defect’. All defects are anomalies but not all anomalies are defects. An anomaly is a deviation in some property of the manufactured product. A defect is considered to be any anomaly, such as a crack, gouge, dent, or metal loss, which reduces the component’s capacity to carry a load. Some anomalies—shallow dents, smooth, shallow gouges, minor metal loss, and even some cracks—will not affect the strength or service life of a pipeline. Hence the statement ‘not all anomalies are defects’. An anomaly becomes a defect when it introduces a weakness.

As used here, ‘defects’ include flaws or damages to components from original manufacture, construction, or time-independent mechanisms (not degradations). Examples include dents, gouges, girth weld defects, lack of fusion in welded seams, and others as detailed later.

Besides defects, there are other types of location specific weaknesses, many of which arise through stress concentrators or due to components with inherently less strength than neighboring pipe, such as:

• Wrinkle bends
• Acetylene welds
• Mechanical couplings
• Substandard repairs
• Older and currently-avoided appurtenances

There are also deficiencies in material properties that are efficiently modeled as weaknesses. These deficiencies can be created from inferior or incorrect construction practice. Examples include introduction of hard spots (potential crack initiation sites) and residual stresses. Deficiencies may also be present from undetected errors in original manufacture or from unrecognized issues at the time of manufacture (for example, LF ERW).

The potential for weaknesses introduced in manufacturing and construction is discussed in later in this chapter as well as in .

Finally, weaknesses occur through degradation mechanisms. This aspect is most efficiently captured as part of the degradation mechanism assessment. As corrosion metal loss potential and cracking phenomena are assessed, a degradation rate (or rates) naturally emerges. The rate multiplied by the amount of time the rate could have been active yields a remaining wall thickness. This value is adjusted by the non-degradation potential weaknesses assessed as discussed here.

Weakness Identification/Characterization

Defect Types

As noted, some anomalies originate from manufacturing processes, such as laminations, hard spots, inclusions, and seam weaknesses associated with low-frequency ERW and electric flash welded pipe. Others such as girth weld defects, dents, and arc burns occur during installation or repair. Finally, anomalies arise during operations: dents or gouges from excavation damage or other external forces, corrosion wall losses, and cracks. Anomalies introduced during repair/replacement operations are also possible.

API 579 [1021] provides a more extensive listing of causes of types and origins of manufacturing and construction defects in structures. Such listings serve as checklists for designers of risk assessments, helping to ensure that all plausible defects are considered in the assessment.

Anomaly prioritization is often governed by industry standards if not regulations, as described in PRMM.

Probability of original defects

The types of pre-service deficiencies that can be present before equipment enters service are:

1. Material Production Flaws – Flaws which occur during production including laminations and laps in wrought products, and voids, segregation, shrinks, cracks, and bursts in cast products.
2. Welding Related Flaws – Flaws which occur as a result of the welding process including lack of penetration, lack of fusion, delayed hydrogen cracking, porosity, slag, undercut, weld cracking, and hot shortness.
3. Fabrication Related Flaws – Imperfections associated with fabrication including out-of-roundness, forming cracks, grinding cracks and marks, dents, gouges, dent-gouge combinations, and lamellar tearing.
4. Heat Treatment Related Flaws or Embrittlement – Flaws associated with heat treatment including reheat cracking, quench cracking, sensitization, and embrittlement. Similar flaws are also associated with in-service elevated temperature exposure.
5. Wrong Material of Construction – Due to either faulty materials selection, poor choice of a specification break (i.e. a location in a component where a change in material specification is designated), or due to the inadvertent substitution of a different alloy or heat treatment condition due to a lack of positive material identification, the installed component does not have the expected resistance or needed properties to the service or loading.

In most instances, one or more of these pre-service deficiencies do not lead to an immediate failure. Usually, only gross errors cause a failure, normally identified during a pre-service pressure test.

Residual stress

A well-known static surface stress may be generated from in-service conditions, such as sustained internal pressures. The acting stress may also be residual in nature, introduced during bending and welding in manufacturing, or it may arise from external soil pressure and differential settlement. At sites of surface damage, such as dents and corrosion pits, stress levels in the circumferential and axial directions are higher than on undamaged portions of the pipe surface. The same locations on the pipe that concentrate cyclic stresses, such as gouges, surface discontinuities,
and appurtenances, can concentrate static stresses. In many cases, the stress will be virtually undetectable. Furthermore, breaks in the surface film may occur at these discontinuities to make the area more prone to electrochemical corrosion.

Manufacturing/Construction Weaknesses

A list of common manufacturing and construction weaknesses found in onshore steel pipelines over many decades has been compiled in several references (including [1020, 1022, 1035]). The following information is extracted from such references:

Feature	comments on source	impact on resistance
hook crack	older ERW, both LF and HF	fatigue cracking
cold weld; pinhole	inadequate bonding in LF and DC-welded ERW	small leaks
Penetrator	inadequate bonding in flash-welded or HF ERW	small leaks
mismatched skelp edges	DSAW, ERW, flash-welds	fatigue cracking
off seam weld; incomplete penetration; incomplete fusion; centerline crack; toe crack	DSAW and/or SSAW	fatigue cracking
excessively hard HAZ	late 40’s early 50’s X-grade Youngstown pipe mill	increased crack probability, especially with H exposure
unbonded or partially bonded seam	lap-weld pipe	fatigue cracking
burned metal	crack-like voids in lap-welded pipe	loss of effective wall
Lamination	common in pre 1980 seamless pipe	blister formation if H exposure
hard spot	arc burns are one cause of hard spots	increased crack probability, especially with H exposure
defective weld		leaks; rupture when external forces applied
acetylene girth weld	pre WW II	little strain resistance; rupture when external force applied
mechanical coupling	pre WW II	low resistance to axial and lateral forces
wrinkle bends	pre WW II	cold-working reduces toughness; increased crack potential
transportation fatigue cracks	cracks produced during transportation, more common on pipe with D/t>70 produced prior to 1970 and shipped by rail	fatigue cracking
high levels of impurities and non-metallic inclusions	increased crack probability, especially with H exposure
Toughness		fatigue cracking

Lack of toughness normally arises during manufacture and should be considered in the resistance assessment. Lower toughness makes crack initiation, activation, and propagation more probable and rupture more likely. At higher stress levels, more toughness is required to arrest a running brittle fracture. Larger diameter or thinner wall pipes require proportionally higher toughness to prevent running brittle fracture. Hole size, also a function of toughness, is discussed in CoF .

Some source references cite incident statistics linked to these features, sometimes tracing back to specific steel mills and dates. This information can be very useful in assigning probabilities of defects to pipeline segments. It can also provide inferential information on strength-reduction magnitudes of certain defects. However, without a full understanding of the incidents underlying these statistics, caution in their use is recommended. Recall that these defects, normally having survived pressure tests, inspections, and on-going service loads for many years, fail only when additional loads are introduced or after degradation has occurred. Without knowledge of the degradation and/or additional loads, the knowledge provided by the statistics alone is incomplete.

Manufacturing issues

It is commonly accepted that older manufacturing and construction methods do not match today’s standards for rigor of specifications nor quality control. Nonetheless, many very old systems have successfully and admirably withstood the test of time—decades of service in sometimes challenging environments, with no reduction in strength.

All other things equal however, it is reasonable to assume superior product quality in modern manufacturing. Technological and quality-control advances have improved quality and consistency of both manufactured components and construction techniques. These improvements have varying degrees of importance in a risk assessment. In a more extreme case, depending on the method and age of manufacture, the assumption of uniform material may not be valid. If this is the case, the maximum allowable strength value should reflect the true strength of the material.

Purchasing specifications now cover strength properties such as minimum yield strength (SMYS) and toughness, all of which are certified by the manufacturer. The risk assessment should consider the probabilities that the specifications were correct, were followed, and were applicable to the pipe or component in question.

A pattern of failures connected to a particular manufacturer or process should lead the risk evaluator to question the strength of any components produced in that way. Materials from steel mills whose pipe has been known to have higher rates of weakness should be penalized in the risk assessment where appropriate.

Some weaknesses are actually an increased susceptibility to later damages such as from corrosion and cracking. Preferential corrosion (selective corrosion, seam corrosion, etc) is a possibility for several types of steel pipe. It is commonly associated with variable quality LF ERW or flash weld seams or non-heat treated HF ERW seams. Certain steel pipe manufacture dates and locations (pipe mill) can be correlated with increased occurrence rates [1035]. This information can be efficiently modeled as reduced wall thickness in the resistance estimation.

Hard spots created during pipe manufacture or construction (for example, arc burns, girth weld HAZ) can support cracking, especially in the presence of hydrogen. Hard spots can be large—covering the full circumference of the pipe over several inches of length [1020]. H₂ stress cracking (HSC) occurs at a hard spot when sources of hydrogen are present and sufficient stress exists. H₂ sources include sour service (H₂S), higher CP (cathodic protection applied for external corrosion control) levels, and in association with higher microbiological activity (swamps, MIC, etc). Susceptibility factors include sufficient hardness, hydrogen availability, and sufficient stress level.

Increasing crack susceptibility can be assumed when:

• H₂ charging of steel could have occurred
• There may be or have been temperature effects on toughness
• hard spot, arc burns could be present.

When no inspection information is available, increasing susceptibility to cracking can be modeled to occur in pipe manufactured before 1960 and/or with higher CP levels (perhaps a threshold of -1.2volts pipe-to-soil, CuCuSO₄ reference electrode) and with increasing stress and with higher potential H₂ availability. [1020]

Construction issues

Similar to the evolution of pipe manufacturing techniques, the methods for construction practices such as welding pipe joints have improved over the years. See PRMM for a relevant discussion on girth weld defects.

A wrinkle bend is a type of buckle, often an artifact of an intentional bending process used in early pipeline installations. Wrinkle bends are known locations of stress concentrations, with the severity of the effect increasing with decreasing D/t and severity of the wrinkle (height and width of wrinkle). Axial stress cycles, combined with the stress concentration effect, reduces the fatigue life of a component with a wrinkle bend. Depending on material properties, a doubling of stress due to a stress concentrator can shorten life by a factor of 16 or more. [1023]

As an artifact of a past, discontinued practice, a wrinkle bend is today considered by most to be an anomaly, sometimes requiring repair or replacement. In the risk assessment, the anomaly could be modeled as a resistance vulnerability.

Date of construction provides evidence of the existence of older features of concern, when inspection data is not available. For example, mechanical couplings were used from 1890’s until about 1940, acetylene welding was employed from about 1915 to 1940, miter bends are found in pipelines built prior to 1940, and wrinkle bends pre-1955 [1020]. Prior to the introduction and adoption of engineering standards and regulations, all repair practices may be suspect.

All such features should be considered in evaluating the strength of the system. Buried bends, girth welds, substandard repairs, and couplings are not normally highly loaded during normal service [1020] and hence, these features may enjoy long service lives. However, when abnormal loadings—including external forces and pressure or thermal cycling—occur, they will often be the points of failure.

With all this in mind, the fact of a pipeline’s long-term reliable operation can to some extent offset these concerns and be a “plus” in the overall evaluation. This is the “withstood the test of time” argument for evidence of low probability of failure. See discussion in .

Damages during operations is the final opportunity for weaknesses to be introduced. PRMM describes common mechanical damages to pipelines. The Pipeline Research Council International & Institute (PRCI) provides useful insights into these mechanical damages on pipelines [1036]:

Mechanical damage can cause changes to:

1. The shape of the pipeline’s cross section, as for example where the line sits on a rock ledge, and
2. The wall thickness or its properties, as for example where earthmoving equipment scrapes along the pipeline displacing, or cold-working, and/or tearing the wall as it passes.

Mechanical damage also can involve combinations of (1) and (2).

The consequences of mechanical damage fall into one of four categories, depending on the nature of the outside force, the pipeline’s design and operating conditions, and the line-pipe properties. These consequence categories are:

• immediate failure due to plastic collapse or cracking on the inside diameter (ID) during contact
• immediate failure due to plastic collapse or OD cracking during re-rounding in the wake of the contact
• delayed failure due to in-service cracking, and
• no threat for failure for the current service or possible upset conditions.

Other important observations are that re-rounding of dents has been shown to cause crack initiation and that damages incurred prior to pressurization are more benign than those post pressurization. Damage inflicted at zero pressure is not as severe as that inflicted under pressure, all else being equal. This occurs because the unpressurized pipe changes shape over much of its cross section and consequently avoids the localized deformation that leads to puncture or cracking. In contrast, pressure in the pipeline keeps the pipe round except where outside forces contact, which leads to localized deformation and possibly severe damage. Thus, while a severity criterion for damage done at zero pressure could prove useful, such a criterion would be nonconservative for applications involving damage done at pressure.

Although the pipeline is subjected to a pre-service pressure test, it is unlikely that existing damage would be detected, except for areas pierced as a result of the damage incident. Data in published literature indicate that very severe damage involving gouges in dents with depths greater than 15 percent of the diameter seldom leads to failure in full-scale testing after just one major pressure cycle. For this reason, line pipe damaged at zero pressure probably survives the pre-service pressure and thus may exist in operating pipelines, or possibly lead to delayed failure.

Repairs and Reinforcements

As with general construction practice, repair practice has evolved over the years. Some previously acceptable repair methods would no longer be considered by most modern operators. Examples include deposition of weld metal to fill in corrosion damages; use of metal patches or complex shaped shells installed over leaks; converting temporary clamps to permanent installations; and even the use of wooden plugs driven into holes in low pressure steel and cast iron pipelines. Repairs that, by today’s standards, are judged to be inferior, may contribute weaknesses. Their likelihood of existence must be estimated, especially when inspection cannot reliably provide identification and characterization. This is discussed in a later section.

A full encirclement sleeve serves to carry some of the stresses otherwise carried by the pipeline, thereby providing increased resistance to new loads. It also provides increased impact resistance and, especially when made from a composite material, corrosion protection equivalent or superior to a corrosion control coating system. If pressure-containing, it increases TTF from degradation mechanisms by effectively increasing the amount of material that must be degraded before leak or rupture. The sleeve also provides benefit as a crack arrestor, potentially reducing consequence potential by limiting hole size.

Composite sleeve materials are popular repair choices. The underlying concept of composite materials is very old. Straw and mud bricks and concrete (cement and aggregate) take advantage of the best properties of multiple materials to provide a stronger final product. Modern pipeline repair wraps or sleeves are layered systems of solid fibers, such as carbon or fiberglass, and a bonding resin such as urethane or epoxy, installed around a short section of pipeline containing a defect. The characteristics of the applied and cured repair wrap, such as flexibility, yield strength, UV resistance, and others, will determine the ability of these types of repairs to not only restore the component’s strength, but also provide additional resistance, perhaps beyond original capabilities. [1036, 1037]

Modeling of Repairs in Risk Assessment

Modern repairs will reduce risk, sometimes far beyond their role in offsetting weakness caused by a defect. Repairs often act as reinforcement, mitigation, and consequence reduction in addition to restoration of desired strength. These normally cover a small portion of a system, but a detailed risk assessment can recognize that risk is significantly reduced at these short locations. This is often in stark contrast to the risk immediately prior to the repair.

Repairs, especially when made with full encirclement sleeves, can be modeled as providing a general increased resistance, perhaps using a simple factor to increase effective wall thickness by some amount. Alternatively, a repair’s role in specific risk reduction can be modeled in a detailed way, quantifying its independent contributions to:

• Increased impact resistance
• Increased stress carrying capability
• Corrosion mitigation (when non-corrosive sleeve material is used)
• Increased effective wall thickness for TTF estimates
• Crack arresting is modeled as consequence hole size reduction
• Clamps and non-pressure-containing repairs often provide less resistance. Given the typically short length of repairs, detailed modeling may not be warranted and a simple factor, scaling up resistance at the repair location, will be sufficient.

Older repair techniques, no longer allowed in current industry recommended practice, may cause unintended weaknesses such as stress concentration points and brittleness at welds. Even acceptable repairs may have unintended consequences as was noted in the example of hydrogen permeation into the annular space between a repair sleeve and the carrier pipe, eventually causing buckling of the carrier pipe [1001]. In some of these cases, the repair actually causes a new exposure to be included in the risk assessment.

The evaluation of resistance will also include non-pipe components since they will typically be included in the risk assessment. These include flanges, valve bodies, fittings, filters, pumps, compressors, flow measurement devices, pressure vessels, and others. Each will be acted upon by various exposures, have mitigations to protect it, and will have varying amounts of resistance to failure.

Characterizing Potential Weaknesses

A risk assessment that examines available pipe strength should probably treat anomalies (identified defects whose severity has not yet been evaluated) as evidence of reduced strength and possible active failure mechanisms.

A complete assessment of remaining pipe strength in consideration of an anomaly requires accurate characterization of the anomaly—its dimensions and shape. In the absence of detailed remaining strength calculations, the evaluator can reduce pipe strength by a percentage based on the severity of the anomaly.

Increased crack susceptibility is a common concern for all of these features. This is efficiently modeled as reduced wall thickness and/or increased probability of crack initiation/activation/propagation, both used in the cracking PoF estimation. Some features may also impact the ability to resist other loadings including internal pressure and external forces.

Loads and Forces

Loads and forces, and their resulting stresses, obviously play a large role in failure potential. The design process first considers the loads and forces that are to be resisted.

This discussion is an examination of how the pipeline’s design characteristics impact its ability to resist forces/damages. Certain design concepts are presented to give the evaluator who is not already familiar with pipeline design methods a feel for some of the considerations. This obviously does not replace a design manual or design methodology. Used with the corresponding risk evaluation sections, this section can assist one unfamiliar with design concepts in understanding strength/resistance aspects of the pipeline being examined.

Design of any structure involves examinations of loads and forces. Load is a general term meaning a force applied to a structure. Internal pressure, gravity (or weight), and temperature-induced strains are examples of loads typically experienced by pipelines.

Loads have effects on structures—pipeline components in this case. Those effects include stresses, strains, and deformations. Resistance can be measured in terms of any of these—the ability to withstand a stress, strain, or deformation. Even a pinhole leak from an unpressurized component conceptually falls into this model. The leak will only occur with some driving force, if only gravity or a tiny amount of hydrostatic fluid head. This tiny driving force is no longer resisted if the pinhole has penetrated the entire component wall.

In general, any influence that tries to change the shape of the pipe will cause a stress. Pipe stress can originate from loads that cause or exacerbate:

• Internal pressure
• External pressure
• Longitudinal bending (longitudinal buckling)
• Axial tension
• Axial compression (axial buckling)
• Lateral compression (crushing)
• Thermal expansion/contraction
• Shear
• Cracking (fatigue, etc.)
• And various combinations of these.

Defects in component walls will heavily influence resistance. That will be considered separately from the defect-free analysis.

As a pressure containment system, internal pressure obviously plays a key role in many pipeline strength determinations. While often the dominant load, internal pressure is not the only loading on a typical component. External forces also add stress to the pipe. Loads causing external stresses include the weight of the soil over a buried line, the weight of the pipe itself when it is unsupported, temperature changes, etc. Some of these stresses are additive to the stresses caused by internal pressure. As such, they must be allowed for in the design pressure calculations. Hence, care must be taken to ensure that the pipeline will never be subjected to any combination of internal pressures and external forces that will cause the pipe material to be overstressed.

Tolerable loads are set by maximum stress-carrying capacity. The design phase includes consideration of all loadings to which the pipeline will be subjected. Pipeline loadings typically include internal pressure and physical weights such as soil and traffic over the line. A typical analysis of anticipated basic loads for a buried pipeline would include provisions for:

• static internal pressure
• dynamic internal pressures such as surge pressures
• overburden (Soil loadings, including soil movements).

Additional criteria are considered in detailed design and for special installation circumstances such as drilled crossing and spans. These criteria include provisions for:

• Bending Stresses
• Tensile Loads l Buoyancy.
• Span loadings including gravity and lateral forces
• Traffic loadings
• Strain induced loadings such as from temperature changes.

For each loading combination, all stresses and failure modes must be identified. Failure is often defined as permanent deformation of the material. After permanent deformation, the component may no longer be suitable for the service intended. Permanent deformation occurs through failure modes such as bending, buckling, crushing, rupture, bulging, and tearing. In engineering terms, these relate to stresses of shear, compression, torsion, and tension. These stresses are further defined by the directions in which they act; axial, radial, circumferential, tangential, hoop, and longitudinal are common terms used to refer to stress direction. Some of these stress direction terms are used interchangeably.

As discussed in the previous sections, pipeline component materials have different properties and different abilities to resist loads. Ductility, tensile strength, impact toughness, and a host of other material properties will determine the weakest aspect of the material. If the pipe is considered to be flexible (will deflect at least 2% without excessive stress), the failure mode will likely be different from a rigid pipe. The highest level of stress directed in the pipe material’s weakest direction will normally be the critical failure mode. The exception may be buckling, which is more dependent on the geometry of the pipe and the forces applied.

The critical failure mode for each loading will be the one that fails under the lowest stress level.

Load Types

A useful listing of load types can be found in [9988] as part of the limit state discussion. Limit states included are ‘ultimate’ (ULS), ‘leakage’ (LLS), and ‘serviceability’ (SLS). These limits may be established based on stress or strain or both. This particular reference categorizes loads based on their potential appearance in the system’s life cycle. It also assigns a time dependency to each combination of loads and limit states, as well as a cross reference to potentially interacting load cases.

When loss of integrity is the focus of the risk assessment, limit states dealing with ruptures and leaks are the focus. Some of the pertinent loads are further discussed below.

Pressure containment

The most commonly used measure of a pipeline’s strength will normally be the documented design pressure—the maximum internal pressure that can be withstood without damage (including permanent deformation). Design pressure is determined from stress calculations, with internal pressure normally causing the largest stresses in the wall of the pipe. Material stress limits are theoretical values, confirmed (or at least evidenced) by testing, that predict the point at which the material will fail when subjected to high stress.

Several key aspects of risk are directly linked to the amount of internal pressure in the line. Pressure levels may vary widely along a pipeline or at a single location over time. The pressure to which a component will be subjected is needed to calculate stress levels and other risk factors in the risk assessment. The assessment may choose any of several commonly cited pressure levels: the maximum tolerable design pressures, the maximum allowable pressure (including safety factors), the maximum working pressure, the normal operating pressures, and others. The terms maximum operating pressure (MOP), maximum allowable operating pressure (MAOP), maximum permissible pressure, and design pressure have specific definitions in some regulatory and industry guidance documents. However, they are often used interchangeably. They all imply an internal pressure level that comports with design intent and certain safety considerations—whether the latter stem from regulatory requirements, industry standards, or a company’s internal policies. In this risk assessment discussion, the term ‘design pressure’ is used for the maximum internal pressure that can be sustained by the component without permanent deformation or other harm to the material.

For purposes of this discussion, design pressure will be used to describe the pressure to which the defect-free component can be subjected without failure (such as yielding). By this definition, design pressure should exclude all safety factors that are mandated by government regulations or chosen by the designer. It should also exclude engineering safety factors that reflect the uncertainty and variability of material strengths and the simplifying assumptions of design formulas since these are technically based limitations on operating pressure. These include safety factors for temperature, joint types, and other considerations. Safety factors that usually allow for errors and omissions, deterioration of facilities, and provide extra ‘cushioning’ between actual conditions and tolerable limits. Such allowances are certainly needed, but can be confusing if they are included in the risk assessment. There is always an actual margin of safety between the maximum stress level caused by the highest pressure and the stress tolerance of the pipeline. Measuring this directly without including the confounding influences of a regulated stress level and stress tolerance, makes the assessment more intuitive and useful, especially when differing regulatory requirements make comparisons more complicated. Regulatory safety factors are therefore omitted from the design pressure calculations for risk assessment purposes.

The design or other ‘maximum allowable’ pressure is appropriate for characterizing the maximum stress levels to which all portions of the pipeline might be subjected, even if the normal operating pressures for most of the pipe are far below this level. This avoids the potential criticism that the assessment is not appropriately conservative.

Although the design pressure could be conservatively used here, this would not differentiate between the upstream sections (often higher pressures) and the downstream sections (usually lower pressures). The alternative of using normal operating pressures, provides a more realistic view of actual stress levels along the pipeline. Pipeline segments immediately downstream of pumps or compressors would routinely see higher pressures, and downstream segments might never see pressures even close to the maximum limits. One approach would be to create a hypothetical pressure profile of the entire line and, from this, identify normal maximum pressures in the section being evaluated.

This approach might be more appropriate for operational risk assessments where actual differences along the pipeline are of most interest. A challenge in using ‘normal’ pressures will be the time period implied: ie, the highest pressure seen in last year? 5 years? The average or median pressure seen in the last 12 months? Etc.

Provisions for surge (water hammer) or other temporary pressures should be independent of design pressure determination. Potential for pressure levels in excess of system tolerances should be considered separately as exposures. Surge potential is discussed in .

Pipe wall damages or suspected weaknesses—anomalies—may impact pipe strength and hence allowable pressures or safety margins. Formal reductions of maximum operating pressure resulting from pipeline anomalies are normally based on approaches described in industry standards^[1]. If a new pressure limit is determined based on calculations of remaining strength after a detected weakness, then that should be the new design pressure used in the risk assessment of the component. In this case, it may be hard to determine how much conservatism in the form of extra safety margin has been added in the treatment of some anomalies. If the assessment is able to ascertain the true pressure limit, free from any safety factor, that is the better value to use as design pressure.

The design pressure also plays a role in probability of damage estimates. For instance, in the incorrect operations assessment, there is an important distinction made between a safety-system-protected component and one that is impossible to overpressure due to the absence of adequate pressure production—where it is physically impossible to exceed the design pressure because there is no pressure source (including static head and temperature effects) that can cause an exceedance.

Note also that pressure, from the standpoint of a small leak, can mean the tiny driving force created by hydrostatic head or gravity.

The degree of pressure cycling is another factor to take into account in the evaluation since this can also contribute to failure probability as discussed in .

Load Estimations

Both continuous and intermittent loads are appropriately included in risk assessments.

Normal, continuous loads are addressed in the design phase. Normal, intermittent loads should also be addressed during design, but may not receive the same amount of rigor or they may be compromised over time by changes in system characteristics during its life cycle. Fatigue loadings are an example. Even if considered during design, changes in use over time may change the originally planned number and magnitude of pressure cycles and changes in environment may add new sources of external fatigue cycles.

Intermittent loads, especially when both abnormal and intermittent, require both a categorization of intensity or damage potential and an estimate of frequency. Frequencies may already have been partially captured in exposure estimates for the various time-independent forces—excavator hits, vehicle impacts, landslides, surge pressures, anchor strikes, etc.

Normal loads can often be estimated from design documents, as previously discussed, and can produce a baseline level of resistance.

Special External loadings

Normal external loadings listed in PRMM include the weight of the soil over a buried component, the loadings caused by moving traffic, possible soil movements (settling, faults, etc.), external pressures and buoyancy forces for submerged lines, temperature effects, lateral forces due to water flow and debris impacts, and component weight. See discussion of these in PRMM.

As a special case of ‘failure’, infiltration of a component and subsequent product contamination can occur. For example, groundwater infiltration into a distribution system. This is a form of integrity loss since, for infiltration to occur, the outside pressure exceeds the internal pressure and the components ability to resist. There would presumably also be an integrity loss when groundwater pressures are lower and the component’s internal pressure produces the driving force to create a leak.

Overburden

This is a measure of the weight of soil, objects and anything else over the pipeline. In an offshore environment, this would also include the pressure due to water depth. Uncased pipe under roadways may require additional wall thickness to handle the increased loads from vehicles. The speed and weight of the vehicles, as well as depth of cover, cover type, and other factors will be important determinants of how much stress is transferred to the buried component.

Spans

Similar to the forces of gravity on an onshore spanning component, the stresses from lateral forces of moving waters, debris accumulations, should be considered for offshore susceptible components. Spans are a unique feature in a risk assessment, as discussed in xxx .

Buckling

Pipelines under compressive forces from pressure or thermal forces, can buckle if the axial compression goes beyond a certain level. Buckling can also occur under excessive external force.

Buckling is more common concern with pipelines in deep water. Some offshore designs incorporate controlled lateral buckling as a means to dissipate pressure and thermal expansion induced forces on a long pipeline.

However, buckling as a failure mode can manifest at other, unexpected conditions, far from common external pressure sources. In one operator’s experience, hydrogen permeation through steel repair sleeves caused numerous buckles to the pipe beneath. The source of hydrogen was generated from high CP levels external to the sleeve. An annular space pressure of around 300 psig was sufficient to cause the buckling. [1001]

Accounting for unspecified external loads

Especially for preliminary or screening type risk assessments, it may be appropriate to simply use a factor to account for unknown or unquantified loads. The factor can be set according to the desired level of conservatism in the risk assessment. See also PRMM.

Design Factors & Safety Margin

Actual designs almost always provide for component strengths beyond what is required for actual loads.

Designs are based on calculations that must, for practical reasons, incorporate conservative assumptions. These assumptions deal with the variable material strengths and potential stresses over the life of the pipeline—usually involving many miles over many decades. Safety factors and conservativeness in design help to ensure long term system reliability. They are assigned by regulations, industry standards, or by choice of a design engineer or corporate mandate. The real safety margin—the difference between likely loadings and the component’s load-carrying capacity—is most important in risk assessment. The pre-assigned safety or design factors cloud the view of the actual safety margin and should be avoided in risk assessments. This drives the previous recommendation to use strength estimates free from safety factors. This is in the interest of simplicity and clarity, a risk assessment can be viewed as a means of quantifying the safety margin in a system at any point in its life, regardless of what the original safety margin intent was. The safety margin can be re-set, as discussed in the role of integrity assessments in a load-resistance model. See more in PRMM.

Discrimination between intended safety margin and actual safety margin is an important deliverable of a good risk assessment.

Stress calculations

Once loads are identified and quantified, the accompanying stresses can be examined. Of particular interest here, is the relationship between stress and component wall thickness. This establishes the risk modeling opportunity to represent resistance in terms of ‘effective’ wall thickness.

The moment capacity for metallic pipes is a frequently used measure of their strength and is a function of many parameters. The most common are:

• Diameter to wall thickness ratio
• Material stress-strain relationship
• Material imperfections
• Welds (Longitudinal as well as circumferential)
• Initial out-of-roundness
• Reduction in wall thickness due to e.g. corrosion
• Cracks (in pipe and/or welds)
• Local stress concentrations due to e.g. corrosion damage or dents
• Additional loads and their amplitude
• Temperature.

In any failure mode, pipe wall thickness and strength will be key determinants of resistance to loads. The D/t ratio is seen in many expressions of resistance to external force damage.

The strength of a thin walled container such as pipe, from both an internal pressure and an external loading standpoint, is related to the pipe’s wall thickness and diameter. In general, can contain more pressure and larger diameter and thicker walled pipes have stronger load-bearing capacities and should be more resistive to external loadings. A thinner wall thickness and smaller diameter will logically increase a pipe’s susceptibility to external force failure [48].

The D/t ratio is seen in many expressions of pipe strength. Some risk evaluators have used D/t as a variable for both resistance against external loadings and as a susceptibility-to-cracking indicator. As D/t gets larger, stress levels increase—increasing failure potential and risk [1039]:

Under pure bending load:

For low D/t, the failure will be initiated on the tensile side of the pipe due to stresses at the outer fibers exceeding the limiting longitudinal stress. For D/t higher than approximately 30-35, the hoop strength of the pipe will be so low compared to the tensile strength that the failure mode will be an inward buckling on the compressive side of the pipe.

Under external load:

For low D/t ratios, material softening will occur at these points and the points will behave as a kind of hinge at collapse. The average hoop stress at failure due to external pressure changes with the D/t ratio. For small D/t ratios, the failure is governed by yielding of the cross section, while for larger D/t ratios it is governed by elastic buckling. Elastic buckling means that the collapse occurs before the average hoop stress over the cross section has reached the yield stress. At D/t ratios in-between, the failure is a combination of yielding and elastic collapse.

Under combined loads:

In general, the ultimate strength interaction between longitudinal force and bending may be expressed by the fully plastic interaction curve for tubular cross-sections. However, if D/t is higher than 35, local buckling may occur at the compressive side, leading to a failure slightly inside the fully plastic interaction curve.

Either stress criteria or strain criteria can be used. Discussion here is on stress.

Stress Equations

Resistance estimates will ideally involve combined stress formulae such as Tresca, Von Mises, and others, plus additional consideration of certain highly localized stresses, plus degradation/damage mechanisms. Whatever stress carrying capacity is not already ‘used up’ by existing loads (internal pressure, spans, overburden, etc) is available to resist additional loads.

Pipelines are normally designed to operate at a stress well below the yield strength of the component material. The principal stresses in a pipeline are the hoop stress due to internal pressure and the longitudinal stress, which is a function of internal pressure (axial), external force, weight of the pipe between spans (bending), etc. Yielding can occur as a result of exceeding either of these stresses, or under combination loading.

Yield, as a criteria for ‘failure’, is often conservative, even for older components. Ref [1020] says vintage pipe fails at UTS which is typically about 25% higher than SMYS. With a typical maximum allowable stress (per many regulations and standards) of 72% SMYS (1.39 safety factor), this implies a total safety factor for defect-free line pipe of about 1.74.

Formulae for calculating individual stresses are well known. Barlow’s calculation is a commonly used equation for relating internal pressure to stress in a pipe. Alternative calculations may be available for pressure-stress relationships in non-pipe components or manufacturers’ information may need to be used for more complex components.

External loadings are also related to stresses via well-documented equations. Understanding effects of external forces involves complex calculations both in determining actual loadings and the pipe responses to those loadings. Longitudinal stresses and buckling due to external pressure are common considerations for pipelines.

Residual stresses play an important role in some failure mechanisms. These are stresses that remain in a component after their source load is no longer active. Manufacturing processes and mechanical ‘working’ of materials are common causes. Residual stresses can have effects on material strength similar to conventional stresses, but their presence is more difficult to calculate. Some measurement tools to quantify residual stress are available but may not be readily applicable to most pipelines.

SRA

Structural Reliability Analysis is an analysis technique designed to improve upon the traditional use of safety factors that typically rely on a high level of conservatism in dealing with uncertainty. Compounding conservatisms in the traditional approach can produce unnecessarily conservative (and expensive) designs.

When using fixed, pre-determined safety factors, neither the true margin of safety nor probability of failure is quantified. As a ‘one size fits all’ design practice, this naturally leads to costly over-protection in some areas and perhaps under-protection in others. On the other hand, it avoids the potential errors and bias that may occur when more situation-specific safety margins are calculated.

Limit state threshold identification and calculations comparing actual conditions with these thresholds normally underpin SRA.

Inspections and Integrity verifications

Pipeline integrity is ensured by two main efforts: (1) the detection and removal of any integrity-threatening anomalies and (2) the avoidance of future threats to the integrity (protecting the asset). The latter is addressed by the many risk mitigation measures commonly employed by a pipeline operator, as discussed in Chapters 5 through 9.

The former effort involves inspection^[2] and testing and is fundamental to ensuring pipeline integrity, given the uncertainty surrounding the protection efforts. The purpose of integrity assessment inspection and testing is to validate the structural integrity of the pipeline and its ability to sustain the operating pressures and other anticipated loads. Recall the load-resistance curve discussion in PRMM where, after conservatively assuming a shifting resistance distribution, an integrity assessment can re-set the clock, verifying available resistance to loads. Inspections serve as intervention opportunities. They interrupt a sequence of events that would have otherwise resulted in a failure. Their success in this depends on the timing and robustness of inspection compared to the degradation mechanisms possible active.

Conservatism in verifying pipeline integrity assumes that anomalies are present and growing. Inspection and testing at defined intervals allow for intervention so that their growth can be interrupted before they become serious threats. In theory, a defect will be largest immediately before the next verification. Uncertainty in measurements and calculations relates the estimated size of the defect, just prior to re-inspection, to probability of failure. The inspection or re-verification interval therefore establishes the maximum failure probability for each mode of failure.

Inspections and integrity verifications serve to ‘re-set the clock’, overriding conservatively assumed appearance of new weaknesses since the last verification. They also provide evidence for refinement of exposure and mitigation estimates—calibration of previous estimates.

The goal is to test and inspect the pipeline system at frequent enough intervals to ensure pipeline integrity and maintain the margin of safety. The risk assessment’s resistance estimate is improved by removal of any damages present or confirmation that no injurious defects exist. A pipeline segment that is partially replaced or repaired will show an improvement under this protocol since either the anomaly count/severity will have been reduced via repairs or defect-free components have been installed. If a root cause analysis of the detected anomalies concludes that active mechanisms are not present, then only the resistance estimate is affected. For example, the root cause analysis might use sequential inspection results to demonstrate that corrosion damage is old and corrosion has been halted. In the absence of such findings, the risk assessment’s previous estimates of exposure and mitigation may need to be modified based on the inspection results.

Inspection and integrity verifications are methods employed to find weaknesses in a component. Prior to assigning a label of ‘weakness’ or ‘defect’ to an anomalous feature of a component, its presence and characteristics as an anomaly are identified or posited. Once identified (or posited) and sized, an anomaly’s role, if any, in resistance can be determined. For metal loss from corrosion, the failure potential for purposes of probability calculations is normally determined by two criteria: (1) the depth of the anomaly and (2) a calculated remaining pressure-containing capacity of the defect configuration. Both are required to account for the two failure modes of leak versus rupture. For crack-like defects, fracture mechanics and estimates of stress cycles (frequency and magnitude) are required to fully understand resistance implications.

As noted previously, a defect is considered to be any undesirable pipe anomaly, such as a crack, gouge, dent, or metal loss, that could lead to a and not all anomalies are defects. Possible defects include seam weaknesses associated with low-frequency ERW and electric flash welded pipe, dents or gouges from past excavation damage or other external forces, external corrosion wall losses, internal corrosion wall losses, laminations, pipe body cracks, and circumferential weld defects and hard spots.

The absence of any defect of sufficient size to compromise the integrity of the pipeline is most commonly proven through pressure testing and/or ILI, the two most comprehensive integrity validation techniques used in the hydrocarbon transmission pipeline industry today. Integrity is also sometimes inferred through absence of leaks and verifications of protective systems. For instance, CP counteracts external corrosion of steel pipe and its potential effectiveness is determined through pipe-to-soil voltage surveys along the length of the pipeline, as described in . All of these measurement-based inspections and tests are occasionally supported by visual inspections of the system. Each of these components of inspection and testing of the pipeline can be—and usually should be—a part of the risk assessment.

Common methods of pipeline survey, inspection, and testing are listed in PRMM. Pipe wall inspections include non-destructive examination (NDE) techniques such as ultrasonic, magnetic particle, dye penetrant, etc., to find pipe wall flaws that are difficult or impossible to detect with the naked eye.

Offshore inspection is usually more expensive and can be less accurate due to challenging conditions. Inspections by divers or from submersible vessels will not normally generate the same level of confidence as their onshore integrity verifications due to numerous issues including reduced visibility, inability to use many of the NDE techniques, and the presence of concrete coatings often used offshore. Offshore inspection can also include side-scan sonar and ROV.

Recall the early discussion in this book regarding the use of measurements versus estimates in a risk assessment. Inspections and integrity verifications are measurements that typically override conservative estimates of component wall weakness. In a conservative risk assessment, they demonstrate that damages did not actually occur and ‘re-set the clock’.

Inspections

Similarly, formal in-ditch assessments of coating or pipe condition should be integrated into the risk assessment. The inspection information from other activities and analyses such as corrosion control surveys, effectiveness of coating and cathodic protection systems, and even leak detection surveys are relevant. Inspection results inform many aspects of the risk assessment—often providing evidence of exposure, mitigation, and resistance simultaneously. Types of inspections common to the pipeline industry are listed and discussed in PRMM. The use of inspection results is discussed here and in previous chapters.

Visual and NDE Inspections

Nondestructive examination (NDE) refers to numerous specific inspection and examination techniques. Usually done in conjunction with visual inspection, an NDE is used to find wall flaws that are hard to detect visually. NDE can involve various forms of ultrasonic wave analyses, magnetic particle, dye penetrant, etc. ILI is a type of NDE conducted remotely with subsequent visual examination sampling or confirmations. Integrity assessment can also include NDT (and ‘destructive’ testing) for assessing component strength or coating properties such as thickness, adhesion, strength, numbers of holidays, etc.

A visual and NDE inspection of an internal or external component surface may be triggered by an ILI anomaly investigation, a leak, a pressure test, or routine maintenance. For risk assessment purposes, a visual inspection can be extrapolated, ie, assumed to reflect conditions for some length of pipe beyond the portions actually viewed. A conservative zone some distance either side of the damage location can be assumed. This should reflect the degree of belief and desired level of conservatism. For instance, if poor coating condition is observed in one site, then poor coating condition should be assumed for as far as those conditions (coating type and age, soil conditions, etc.) might extend.

Integrity Verifications

As special types of inspection, the integrity verification processes of pressure testing and ILI are further discussed in following sections. See also ILI vs DA: The Risk View.

Pressure test

Pressure testing is a long-used method to ensure integrity. By stressing components to levels above what they will see during their service lives, integrity is verified and a margin of safety is established. However, the higher stress levels during the test may also cause damages—growing some defects that might otherwise not grow. This leads to some controversy in the use of pressure testing. See PRMM for further discussion.

In-line inspection (ILI)

See PRMM for a background discussion on the evolution and application of in-line inspection. ILI has been compared to medical diagnostic devices, where the doctors’ interpretation of the inspection data is at least as critical as the data itself. Ref [1024 ]notes a typical ILI vendor’s sequence of events:

• The ILI tool runs at 9 mph, capturing 1.2M measurements per second.
• Automatic data analyses algorithms identify over 1 million areas of interest in an ILI run.
• The human analyst spends 75% of his time scrutinizing every one of these, perhaps prioritizing down to 100,000 possible defects.
• Subsequent analyses utilizes knowledge of the kinds of defects that could emerge from the subject pipe’s manufacture, construction, and operational history to produce categorizations of anomalies.

These steps would also ideally consider any and all excursions from ideal inspection conditions—tool travel speed, magnetization level, sensor failures, etc.—that potentially impact the inspection results.

The operator’s direct examination of selected anomalies finalizes the process by linking the often more exact field NDE measurements with the ILI measurements to gain a sense of the accuracy of the entire inspection.

Not all pipelines can be internally inspected with conventional ILI tools. Certain geometries and/or flow conditions make ILI difficult or impossible. Even the best ILI tools have difficulty detecting certain kinds of anomalies and a combination of tools may be needed for a full assessment. ILI can be costly, too, requiring pre-cleaning, service interruptions in some cases, challenging excavations, etc. The ILI process originally involved trade-offs between more sensitive tools (and the accompanying more expensive analyses) requiring fewer excavation verifications and less expensive tools that generate less accurate results and hence require more excavation verifications. While less accurate tool types are generally no longer used, a similar trade-off may still exist in choosing the optimum level of post-ILI analyses.

ILI and pressure testing detect damage that has already occurred and therefore provide lagging indicators of damage potential. They must be done at appropriate intervals to ensure severe defects are found and remediated before they become critical. In ILI, exceptions exist when pre-cursors to failure (other than damages) can be found. Examples include laminations, hard spots, and inferior manufacture/construction features, all of which may, under certain conditions, lead to increased failure potential even though they are not the result of damages.

Anomaly categories that can be detected to varying degrees by ILI include:

• Geometric anomalies (ovality, dents, wrinkles)
• Volumetric anomalies (metal loss from gouging and general, pitting, and channeling corrosion)
• Crack-like indications (cracks, narrow axial corrosion, certain laminations.

In every case, the size and orientation of the smallest detectable anomaly is dependent on several general and inspection-run-specific factors. Tethered or self-propelled inspection devices are also available for special applications.

Evaluating the integrity assessment

Inspection and integrity verifications are powerful tools in weakness assessments. Inspection is a critical aspect of many maintenance activities and should be a key part of any risk assessment. But these should also not be relied upon as the sole driver of a PoF estimate.

For example, a practitioner of pipeline risk assessment had done this, basing his time-dependent PoF estimates solely on results of ILI. The obvious flaw in this approach is that it fails to include other valuable evidence. For instance, corrosion control was managed by a different group in this company and information between them and the ILI/risk assessors was not routinely exchanged. Results of corrosion control surveys, which tend to provide more forward-looking evidence than does ILI, were not included in the PoF determination. So, while a 3-year old ILI may have shown no metal loss and active corrosion was not suggested, last month’s overline surveys show inadequate CP and coating in corrosive soils, suggesting corrosion is imminent. As an extreme example of this error of not including all available information, an operator could stop CP, scratch the coating off, add corrosive contaminants to the soil, and an ILI-based risk assessment would not report any change in external corrosion PoF until actual metal loss was occurring and detected by a subsequent ILI.

Inspection and integrity verifications are also not the final answer in resistance determinations. Their inability to detect or correctly characterize certain defects, as well as their time-sensitive nature, requires that their results be supplemented with other information.

In the risk assessment, inspection and test results are best used as confirmations of or contraindications to previously-estimated feature frequencies rather than complete assessments of feature frequencies.

For purposes of risk assessment, the age and robustness of the integrity verifications should be included in a risk assessment. With appropriate consideration, the most recent inspection is not always providing the best information. An older but more robust inspection may still provide better information than a more recent but less robust inspection. That is why both age and accuracy must be considered. The results from the best combination of the two should override the older, less accurate results. When the inspection or test is more accurate and more recent, it overrides previous estimates more completely. When only less accurate and/or older inspection/test information is available (for example, a 20 year old pressure test), estimates based on other information may dominate in the risk assessment.

A defect or theoretical defect must be characterized in order to calculate its role in resistance and/or a time to failure when subjected to degradation. With knowledge of maximum surviving defect size after the previous integrity assessments, defect rate of appearance/growth, and defect failure size, all of the ingredients are available to establish (or evaluate) an optimum integrity verification schedule. Unfortunately, most of these parameters are difficult to estimate to a high degree of confidence and resulting re-assessment schedules will also be rather uncertain.

Age of verification

Information deterioration refers to the diminishing usefulness of past data to determine current pipe condition. See related discussions in e and . The past data should be used to characterize the current effective wall thickness only with considerations for what might have happened since the data was obtained and only until better information replaces it.

A re-inspection or integrity reassessment interval is best established on the basis of three factors: (1) the largest defect that could have survived or been undetected in the last test or inspection (2) the types and rates at which new anomalies are introduced into the component and (3) an assumed anomaly growth rate, all since the last assessment.

Robustness of integrity assessment

Integrity verifications vary in terms of their accuracy and ability to detect all types of potential integrity threats. Regardless of the inspection or integrity assessment technique, an inspection efficiency or robustness should be included. This includes the probability of detection and the accuracy of the anomaly dimension/orientation measurements. Building upon the matrix of possible defects created earlier, the robustness of inspection can now be added.

Robustness is a measure of the quality of the inspection or integrity assessment. The robustness consideration for a pressure test can simply be the pressure level above the maximum operating pressure. This establishes the largest theoretical surviving defect. Inspection-type assessment also involve a largest theoretical surviving—undetected—defect.

Evaluation of the effectiveness of NDE for identifying weaknesses such as metal loss, cracking, and dents is based on the NDE performance criteria used, number and location of inspection points (coverage), frequency of inspection point readings, variance of readings from criteria, equipment used and its PPM, equipment operator skill, weather/environment at time of inspection, component cleanliness, accessibility, time available to inspect, and others.

Further complicating this evaluation is the fact that inspections have varying sensitivities to anomaly types, sizes, orientations, and configurations. A separate set of capabilities will be required for at least several classes of anomalies.

The approach used in the more rigorous risk assessments is to characterize the ILI program—tool accuracy, data interpretation accuracy, excavation verification protocol—against all possible defect types under both ideal and as-inspected conditions. The performance of a series of inspections where results can be overlaid so trends and more minor changes detected, is even more valuable.

Much has been written on the subject of inspection capability and efficiency and industry standards are available for certain inspection techniques. A recommendation here is to consider separately, the inspection capabilities under ideal conditions and then under actual conditions on the day of inspection. This allows the risk assessment to ‘value’ separately, an improved inspection technique or an improvement to the conditions under which the inspection occurs. This can be especially important for expensive inspections such as ILI, where pipe cleanliness, configuration, flow control, and other inspection day parameters are important and also potentially costly to manage.

The two-part inspection capability assessment can be represented as follows:

PoI = probability of identifying a potentially injurious defect; probability per inspection = PoI1 x PoI2

Injurious defect = one of size, orientation, etc, (characteristic set of ‘N’) that, under at least one plausible scenario, reduces pipe resistance to one or more failure mechanisms

PoI1= based on tools and process designed to and capable of, under ideal conditions, finding defects of N or larger

PoI2= considers the amount of deviation from ideal conditions, expressed as a reduced PoI, compared to ideal.

Both require consideration of all steps in the process, especially tasks whose accuracies are susceptible to human error.

Assessing the ILI process

ILI results provide direct evidence of damages and, by inference, they also provide evidence of damage potential. ILI results provide evidence about possibly active failure mechanisms. Such evidence should be included in a risk assessment. The specific use of direct evidence in evaluating risk variables is explored in specific failure mechanism discussions.

The ILI PoI is improved through follow-up direct inspections. The capabilities of both (1) the ILI tool and data interpretation accuracies and (2) the excavation verification program should be considered. These two capabilities combine to show how much inaccuracy may be associated with a particular pipeline segment’s assessment. The largest theoretical surviving defect best characterizes the robustness of any integrity assessment.

An excursion during an inspection is a deviation from intended or specified inspection characteristic that could lead to data collection inaccuracies. Various types of excursions during a specific ILI are common. These have varying effects on detection and sizing of anomalies. Excursions include:

• Loss of carrier signals on one or more channels.
• Velocity range exceeded—accuracy is lost when the tool travels at speeds outside its design parameters.
• Reduction in magnetization— accuracy is lost when the pipe’s magnetization level falls outside its design parameters.

It is often necessary to supplement the ILI vendors’ stated tool tolerances—which are typically stated for ideal run conditions—with the run-specific effects of excursions.

Another challenge often faced by risk evaluators is the array of inspection results from different tools, which may have varying capabilities and accuracies. This may require establishing equivalences between indications from different tools at different times, perhaps involving vendor-reported tool accuracies and statistical analysis of anomaly measurements, considering all run-specific characteristics and capabilities of the post-run data interpretations.

Integrity assessment and component strength

Defects left uncorrected should reduce calculated resistance in a risk assessment, in accordance with reductions in stress-carrying capacity Where inspection occurs and no defects are detected, uncertainty has been reduced, usually with a corresponding reduction in previously (and conservatively) assumed degradation and/or damage rates. In this way, the role of the integrity assessment in risk reduction can be quantified.

Such extrapolation should, of course, carry increased uncertainty. This provides the means to quantify the benefits of the inspection actually applied versus inspection results that have been extrapolated.

ILI Summarizations

The previously described direct consideration of ILI results presumes that specific anomalies have been mapped to specific locations and that anomalies are considered individually. There is rarely a justification for anything other than this complete, anomaly-by-anomaly analysis of ILI data in a permanent risk assessment. The cost of data storage and computer processing is so low that lesser solutions are unwarranted. However, for temporary risk assessments—preliminary or very approximate—or special applications, a summarization approach may be an alternative.

If this is the case, ILI results can be used to generally characterize the current integrity condition of longer stretches. Fewer segments are created under this approach. Even though each anomaly still contributes to the characterization of a pipe segment, the avoidance of a new dynamic segment for each anomaly saves some subsequent processing and analyses time. This is intended to be an approximate and rapidly deployable solution to the more correct anomaly-by-anomaly characterization. It can be done either as a preliminary step pending full anomaly-specific investigations or as stand-alone input into some special types of risk assessment.

Under such a summarization approach, pipeline segments could be generally characterized in terms of anomaly indications that might reduce pipe strength and indicate possibly active failure mechanisms.

NOP as Pressure ‘Test’

With an assurance of leak free condition, a normal operating pressure can serve as an on-going pressure test. The fact that a component withstands a certain amount of pressure provides some evidence of resistance. Higher NOP provides evidence of higher resistance. A highest recent pressure to which the component has been exposed serves the same role. All other things equal, a component successfully containing 2,000 psig of internal pressure shows evidence of higher strength than does a component holding 200 psig. While higher pressures and stresses cause ‘penalties’ in most parts of a risk assessment, the pressure as evidence of resistance, plays the opposite role by suggesting more strength. This evidence is admittedly weak—a severe defect could exist at normal pressure. It may, however, be the only data available upon which to base an estimate of wall thickness.

This is often the default for the effective wall estimate when inspection and integrity assessments are too old or too inaccurate to provide better evidence of resistance. The wall thickness implied by leak-free operation at normal operating pressure (NOP) or a recent high pressure can be calculated by simply using a hoop stress calculation to infer a minimum wall thickness.

With assumptions therefore, a wall thickness based solely on operating leak-free at NOP, pipe_wall_NOP, can be inferred as with a pressure test: ie, using the Barlow formula for stress in the extreme fiber of a cylinder under internal pressure as follows:

pipe_wall_NOP = ([NOP]*[Diameter]/(2*[SMYS])

This simple analysis does not account for defects that are present but are small enough that they do not impact pressure containment capability at NOP. Since defects can be present but not failing due to internal pressure, a value for “max depth of defect surviving NOP” can also be assumed and included in the calculation for more conservatism. The depth of defect that can survive at any pressure is a function of the defect’s overall geometry. Since countless defect geometries are possible, assumptions are required as discussed next.

Effective pipe strength can be estimated by adjusting the NOP-based wall thickness estimate for an assumed population of possible defects. There is some precedent in using 80% to 90% of the Barlow-calculated wall thickness to allow for non-critical defects that might soon grow critical. The analysis could be made even more robust by incorporating a matrix of defect types and sizes that could be present even though the pipe has integrity at NOP. An appropriate value can be selected knowing, for example, that a pressure test at 100% SMYS on 16″, 0.312, X52 pipe could leave anomalies that range from 90% deep 0.6″ long to 20% deep, 12″ long. All combinations of geometries having deeper and/or longer dimensions would fail. Curves showing failure envelopes can be developed for any pipe.

Of course, the estimate of wall thickness based on NOP pre-supposes that the portion of pipe being evaluated is indeed not leaking and is exposed to the assumed NOP.

Inspection Used in Calibration of Risk Assessment

Inspection and integrity assessment results provide powerful evidence to be used in a risk assessment, especially for resistance estimates. They also can play a large role in assigning inputs into many exposure and mitigation variables for many failure mechanisms, as detailed in earlier chapters. The parallel paths between estimates relying only on inferred knowledge of underlying failure mechanisms versus those estimates also benefiting from inspection (estimates versus measurements), is also discussed in .

It is normally conservatively assumed that some deterioration mechanisms are active in any pipeline (even though this is certainly not the case in many systems). As time passes, these mechanisms have an opportunity to reduce the pipe integrity. A good risk assessment model will show this possibility as increased failure probability over time. An assumed deterioration rate is confirmed or revised by inspection in hydrocarbon transmission pipelines and often by the presence of leaks in other systems. An effective inspection has the effect of “resetting the clock” in terms of assumed events since it can show whether the forecasted count has indeed not occurred.

Leaks sometimes replace inspection as the early warning mechanism in some systems where minor leaks are inconsequential. Integrity is sometimes not thought to be compromised unless or until leaks are seen to be increasing over time. Only an unacceptably high and/or increasing leak rate, perhaps above permissible original installation leak rates, would be an indication of loss of integrity. As already noted, distribution system leakage is normally more tolerable with some amount of leakage acceptable even for some newly installed systems. Careful monitoring of leaks also confirms or refutes assumed deterioration. So, leak detection surveys can be credited as a type of integrity verification when results are intelligently and appropriately used to assess integrity.

Resistance Modeling

The final step in resistance assessment is to combine knowledge about loads, stresses, damages, and defects into a resistance estimate. The goal of the resistance assessment is to estimate the ability of the component to resist failure, given that loadings/forces are active.

The stress carrying capacity is the measure of resistance and is efficiently expressed as an effective wall thickness. It captures the ability to resist new loads, given the need to resist existing loads and the possible presence of any weaknesses. The effective wall thickness requires two things: 1) the best estimate of the current wall thickness and 2) the impacts of known or possible weaknesses.

In this modeling approach, interaction of failure mechanisms with resistance issues happens automatically. As more mechanisms or stronger mechanisms overlay more weaknesses or more severe weaknesses, failure potential increases.

For a risk assessment with a definition of failure as leak/rupture, the resistance estimate must respond to two general types of failure mechanisms:

• applied loads: the fraction of applied loads that are successfully resisted without loss of containment.
• degradation: the amount of material available to be degraded before loss of containment.

These are related since, at some point in the degradation process, the load carrying capacity is compromised. All failures can essentially be understood in terms of load-resistance pairings. Degradation caused failures can also be viewed as a subset of applied loads since it is ultimately the load that generates the leak/rupture. As previously noted, even a minor leak requires a load—some driving force, if only hydrostatic pressure or gravity—to precipitate loss of containment. The degradation focus is preserved for clarity here since it is a separate branch of the PoF estimation methodology.

Essential in the resistance assessment is an understanding of:

• Component characteristics, including possible defects
• Loads applied and the corresponding stresses created in the component

The full, robust solution involves structural analyses techniques for loads and defects combinations. Textbooks and college post-graduate curriculae are dedicated to the study of stresses. Fitness for service and finite element analyses are formal methodologies to apply structural theory to specific components. While these detailed analyses certainly play a role in RA, they are beyond the scope of this text. Rather, the results that would emerge from these detailed analyses are envisioned; placeholders established, and simpler values inserted. Risk assessment model slots are available for the more robust solutions when/if warranted but the simpler estimates will often suffice.

A normalized PoF considers length effects. This ‘rate’ of failure probability per mile is used to establish the failure probability for any length of pipeline or collection of components. The resistance aspect of PoF—also normalized to a length of pipe— ‘follows along’ in this calculation. Both key parts of the resistance estimate are usually ‘area of opportunity’-based and hence, length-based. A current wall thickness estimation uses per-unit-length information for corrosion and cracking—for example, active corrosion points per mile; coating holidays per square foot of coated pipe; etc. The estimation of weakness potential also uses a per-unit-length approach—for example, dents per mile.

Resistance to Degradation

For metal loss and cracking, pressure containing capacity is generally proportional to wall thickness. A reduction in wall thickness effectively reduces the TTF from these time-dependent mechanisms. In simplest terms, a wall loss can be modeled as only a reduction in time-to-leak. Adding to this some considerations for lateral wall losses leading to rupture failure improves the assessment. The role of wall loss in loads other than internal pressure, such as those causing longitudinal stresses, can also be included. The first two considerations lead to a defensible TTF for each degradation mechanism. The third is included as a weakness in all stress-carrying capacity analyses.

Resistance as a Function of Failure Fraction

Resistance for time-independent failure mechanisms is often more complicated. The key is in modeling resistance as a reduction in failure fraction. Failure fraction is the number of loadings that are not resisted compared to the total number of loadings.

Full understanding of resistance requires examination of two strength aspects:

1. Defect-free stress-carrying capability
2. Stress-carrying capability, adjusted for defect potential

Estimation of the failure fraction under an assumed set of loadings and where there are no defects or weaknesses present is the first step. This failure fraction may be close to zero—resistance = 100%—when a defect-free component easily carries all the stresses created by even the extreme ranges of all normal loadings. Both normal and abnormal loadings should be captured as in damage rate estimates for the failure mechanisms assessed.

There are countless possible combinations of loads, stresses, and weaknesses. A cumulative probability distribution shows the probability of various combinations of stress carrying capacities and loads at any point along the pipeline. This distribution is comprised of separate distributions for the loads and resistances. Ideally, a cumulative probability distributions of all possible stress carrying capacities—considering all possible weaknesses—would intersect the distribution of possible loads in order to see how many scenarios result in damage and/or loss of integrity. That would obviously be a complex undertaking for pipelines since conditions are constantly changing along their length and full inspection is not practical.

While known weaknesses can and should trigger very specific assessments of resistance, unknown, suspected, possible weaknesses must be treated differently. A superior modeling approach offers an assessment solution that can be rapidly deployed over hundreds of miles of pipeline. It should simultaneously include detailed analyses on individual anomalies when available. The more detailed analysis will also be useful for FFS, incident investigations, and other anomaly-specific applications.

For longitudinal overstress, excessive hoop stress, buckling, and other failure modes, a reduction in wall thickness has the effect of increasing failure potential under applied loads. This increases the estimates of failure counts arising from damage scenarios. Many pipe failure mode estimates use D/t as a prime factor in predicting failure potential. D/t can therefore also be a focus for resistance reduction by effective wall thickness reductions.

This modeling approach of reducing effective pipe wall thickness based on weakness potential has the effect of increasing D/t. Higher D/t changes the failure mode under some loading scenarios and reduces pipe resistance in most.

Resistance Estimation Process

The detailed assessment of resistance involves the following steps:

1. Estimate the defect-free stress carrying capacity available to resist loads
2. Identify normal loadings applied to the component
3. Identify stresses generated by the loadings—ie, general structural stresses
4. Compare to maximum tolerable stress capacity of component.
5. Adjust stress carrying capacity, based on role of known and suspected defects
6. Estimate the probability of potential defects in the component
7. Determine the effect of potential defects—ie, highly localized stresses.
8. Estimate the ability of the component to resist additional loads or failure mechanisms
9. Estimate the amount of stress carrying capacity ‘used up’ by normal loads and potential presence of defects
10. Express the remaining stress carrying capacity as effective wall thickness.
11. Characterize the spectrum of future abnormal loads that may be experienced (for example, from PoD estimates of excavator impacts, landslides, etc).
12. Estimate the fraction of future loads resisted by the stress carrying capacity implied by the effective wall thickness.

Assessing resistance in this way also ensures that interaction among all threat issues is fully included. Most of the modeled weaknesses are additive, as are most loading scenarios, and all loads and weaknesses should be included. Similarly, delayed failure potential is fully included since weaknesses remain (until repaired) and continue to interact with modeled future loadings, including external forces, pressure surges, corrosion, cracking, etc.

Later in this section is a discussion of practical modeling considerations, including how this aspect of risk assessment can be modeled in a very robust way or a very simple way, depending on the needs of the assessment.

Effective Wall Thickness Concept

With an understanding of loads, stresses, and potential weaknesses, the next step in estimating resistance is the bridge between this information and a resistance value to be applied to each component in the risk assessment. This too can be a complex step unless some simplifying assumptions are made. An effective wall thickness can be an efficient intermediate step or at least a conceptual framework for this final assignment.

Next to internal pressure capacity, a component’s wall thickness is probably the most referenced characteristic used in strength and safety margin determinations of pipeline components. Minimum required wall thicknesses are determined from material properties and the amount of stress that the component must withstand. As a pressure containment system, the importance of wall thickness is intuitive. The role of increased wall thickness in risk reduction is also intuitive and verified by experimental work. Component wall thickness, above what is needed for internal pressure and known loadings, provides a margin of safety against unanticipated loads as well as an increased survival time when corrosion or cracking mechanisms are active. Increased wall thicknesses are also known to substantially reduce the chances of failure from external forces such as from excavating equipment. Some wall thickness–internal pressure combinations provide enough strength (safety margin) that most conventional excavating equipment cannot puncture them. Of course, material type must be considered along with the component dimensions. Even among steels, the material strength, often reported as SMYS, can vary greatly.^[3]

However, experience also indicates that increased wall thickness is not a cure-all. Increased brittleness, greater difficulties in detecting material defects, and installation challenges are cited as factors that might partially offset the desired increase in damage resistance [58].

Furthermore, avoidance of immediate failure is only part of the threat reduction—nonlethal damages can still precipitate future failures through fatigue and/or corrosion mechanisms. Nonetheless, increased wall thickness provides failure protection in most failure scenarios.

Defects can also be modeled as equivalent reductions in wall thickness. An effective wall thickness—actual thickness less some amount of wall loss to account for defects—can be estimated. Effective wall thickness then is an efficient basis for modeling pipe resistance to loads. As wall thickness is reduced, implications for component strength include:

• Less capacity for pressure containment
• Faster TTF for degradation mechanisms
• Higher D/t leading to reduced buckling capacity
• Lowered resistance to external forces including localized (puncture) and uniform (subsea hydrostatic pressure).

With a modeling assumption that all potential weaknesses can be effectively treated as reductions in pipe wall thickness, an ‘effective’ or ‘equivalent’ wall thickness can be used to represent resistance. The term ‘effective’ is added to the wall thickness label to capture the idea of equivalencies. It provides a common denominator by which all stress-carrying capacity reductions can be captured in similar units. When evaluating a variety of pipe materials, distinctions in material strengths and toughness will be needed when assessing the role of component wall thickness. With respect to resisting many types of loadings, a tenth of an inch of steel offers more than does a tenth of an inch of fiberglass. When evaluating defects, some will have a more profound effect on strength than others.

As a measure of strength, or stress-carrying capacity, wall thickness is a useful surrogate for the whole suite of factors to be considered in a full strength assessment. The evaluation of stress levels in the component will focus on wall thickness, enabling a risk assessment methodology to similarly focus on ‘effective’ wall thickness as the modeled resistance. The concept of effective wall thickness is therefore efficiently used in risk assessment.

Nominal Wall Thickness

Effective wall thickness estimation begins with actual wall thickness. In the absence of recent measurements of wall thickness, the actual wall thickness may need to be derived from the originally specified or nominal wall thickness.

General stress calculations assume a uniform pipe wall, free from any defect that might reduce the material strength. It discounts possible reductions in actual or effective wall thickness caused by defects such as cracks, laminations, hard spots, gouges, etc. A specific stress calculation on a component requires consideration of such features. Finding or positing all differences between specified and actual and effective wall thickness is essential to risk assessment. Pipeline integrity assessments are designed to identify areas of weaknesses, in the form of wall thinning or in-wall defects, which might have originated from any of several causes. Other inspection may also reveal areas of actual or a high-probability of wall loss, pinhole corrosion, graphitization (in the case of cast iron), and leaks.

Most pipeline systems have incorporated some “extra” wall thickness—beyond that required for anticipated loads, and hence have extra strength. This is often because of the availability of standard manufactured pipe and appurtenance wall thicknesses. Such “off-the-shelf” purchases are normally more economical than special designs even though they may involve more material than may be required for the intended service. This extra thickness will provide some additional protection against corrosion, external damage, and most other failure mechanisms.

When actual wall thickness and wall condition measurements are not available, the nominal wall thickness can be the starting point for estimating current wall thickness. The difference between nominal or “specified” wall thickness and actual wall thickness is a key aspect of resistance determination in this risk assessment. Especially in a conservative risk assessment, the nominal value as a estimate of current, must be adjusted for all variances pertinent to the estimation of the strength provided by likely (or worst case) actual wall thickness.

Differences between nominal and effective wall thickness include:

• Allowable manufacturing tolerances—the actual wall thickness can be some percentage thicker or thinner than specified and still be within acceptable specification.
• Manufacturing defects including material inclusions, voids, and laminations.
• Installation/construction damages or errors such as during joining (welding, fusion, coupling, etc.) processes
• Damages suffered since manufacture: ie, during transportation, installation, and operation, including corrosion and cracking.

Some of these adjustments are actual reductions in thickness while others are reductions in effective strength, ie, features such as cracks, girth weld defects, hard spots, etc are not measured in terms of thinning but rather by some other loss of stress-carrying capacity.

Current Wall Thickness

As used here, the current wall thickness is not always a direct measurement of the component’s wall by UT, caliper, or other means. It also includes inferential indications of current wall thickness that often must be made in the absence of the direct measurement. Actual or current wall thickness values emerge from whichever of the following provides the strongest evidence:

• Direct measurements, with considerations for age and accuracies of all readings, as well as other uncertainties, such as if a measurement at one location is to be extrapolated to another location. These measurements include those taken by NDE examinations including direct-measurement ILI, UT, etc.
• Thickness inferred by ILI techniques designed to find changes in wall rather than measure thickness, external only indications such as visual and pit depth gauge
• Thickness inferred by pressure test
• Thickness inferred by normal or recent high pressure levels (see NOP as Pressure Test discussion)
• Specified or nominal thickness, with previously described adjustments (manufacturing tolerances and error rates, damage rates during and since installation, etc.)

All of these possible information sources will grow more uncertain over time except for wall thickness implied by a current operating pressure (which carries its own significant uncertainties).

It is not unusual to have data from several or all of these information types available at the same location but with widely varying accuracies and age. For instance, one or more ILI’s, multiple excavations, and at least a post-installation pressure test, will each offer one or more pieces of information in each category, for an operating pipeline. The risk assessment will need to efficiently filter through the disparate information to determine the best indicator of today’s thickness. This mirrors the process the SME would also have to use when faced with the same information set and the need to determine the single best estimate.

With a consistent application of conservatism in uncertainty estimates, the more optimistic value—the information suggesting the best wall thickness after adjustments for age and accuracy—will usually govern, as discussed early in this text. Refer to early discussion of measurements versus estimates—the general approach for efficiently integrating many disparate pieces of evidence into the risk assessment. See .

Effective Wall Thickness Estimation

Beginning with the best available estimate of current wall thickness, we now assess for any weaknesses that may detract from the strength implied by this wall thickness. A weakness will reduce the current, actual wall thickness into an ‘effective wall thicknesses’.

Since resistance, as it is being modeled here, is proportional to available stress-carrying capacity it is also generally proportional to material thickness. Wall thickness is often the single most important component characteristic in most loadings of components. Use of wall thickness to represent resistance is intuitive for degradation from corrosion and withstanding internal pressure, longitudinal loads, and puncture. It is less intuitive, for example, in assessing cracking.

Nonetheless, it is still efficient, as previously discussed. Cracking can be modeled as follows: defects that increase crack initiation potential and/or stress intensifications and/or lower toughness, are modeled as either reductions in pipe wall or increases in cracking rates. Technically, lower toughness does not directly cause faster cracking but rather allows smaller defects to initiate/activate a crack.

Either results in increased failure probability as the probability or severity of defects increases. General insights from structural theory can be incorporated into a risk analysis. Component wall thickness is usually proportional to structural strength—greater wall thickness leads to greater structural strength (not always linearly)—with the accompanying assumption of uniform material properties and absence of defects.

Defects modeled as reductions in effective pipe wall thickness is a simplification of the complex analysis that would require consideration for each possible anomaly under every possible loading scenario. In a robust solution, for each anomaly’s characteristics such as:

• length, width, depth;
• location in wall;
• clock position on circumference; and
• orientation relative to axes (axial, radial, circumferential)

loads would be applied, stresses calculated, and ability to survive under various scenarios assessed. The simplification is intended to represent this spectrum of scenarios with an equivalent wall thickness: defect X causes an equivalent loss of strength as does a reduction of wall thickness by Y%.

Knowledge or suspicion of potential weaknesses arises from:

• discovery via NDE
• era of manufacture including manufacture specifications used
• construction practices including construction specifications used
• experience on current component or with similar (relevant) collections of components
• defect-introduction mechanisms possibly active
• includes benefits from sleeves and other repairs

The ratio of effective pipe wall thickness to required wall thickness is another way to view the resistance concept. A ratio greater than one means that extra wall thickness (above design requirements) exists. For instance, a ratio of 1.1 means that there is 10% more pipe wall material than is required by design and 1.25 means 25% more material. If this ratio of effective wall thickness to required wall thickness is less than one, the pipe does not meet the design criteria—there is less actual wall thickness than is required by design calculations. The pipeline system has not failed either because it has not yet been exposed to the maximum design conditions, there is excess conservatism in the calculation, or some error in the calculations or associated assumptions has been made.

This ratio concept is used in some inspections. Certain NDE, especially ILI, often reports wall loss not only in terms of length, width, and depth, but also as implications in pressure containing capacity. Estimated Repair Factor (ERF) and Rupture Pressure Ratio (RPR) are common types of ratios reported by ILI. These reported ratios based on theoretical rupture pressure versus MAOP are readily converted into equivalent wall thicknesses.

Resistance and Effective Wall Thickness

All resistance estimates can use ‘effective wall thickness’ as an efficient foundation. While applied loads produce stress in different ways, wall thickness is a key strength determinant in most loading scenarios of thin-walled structures (most pipeline components are modeled as shell type structures). Degradation resistance considers potential wall loss by corrosion as well as fatigue life reduction—‘wall loss’ by cracking
^[4]. Reduced wall thickness leads to reduced load carrying capacity. So, wall thickness as a measure of load-carrying capacity, when coupled with degradation rate (mpy or mm per year), leads to an estimate of time before degradation advances to point of containment loss (or yield).

Resistance Baseline

Since resistance is to be measured as a simple percentage, a starting point or baseline is required. This involves basic definitions of exposure, as discussed in . The resistance baseline could be the remnant stress carrying capacity after normal loads are applied. Then the percentage resistance shows the fraction of additional loads that could be resisted, given that the existing loads are ‘using up’ some of the stress-carrying capacity. The resistance baseline could also be essentially zero, whereas the percentage shows the fraction of all loads resisted. The ‘aluminum can’ analogy represents this scenario.

Recall that exposure events were quantified by imagining that there is no mitigation nor resistance. An aluminum drink container—a can, crushable between two fingers—is the right mental image for lack of resistance from outside force. So, the image of a soda can lying atop the ground, is the correct image to estimate exposure event frequencies. If such a can be broken by an event, then that event should be counted as an exposure.

The resistance estimate using the ‘aluminum can’ analogy is therefore capturing the ability to withstand forces beyond those that would fail a component with virtually no ability to resist. Resistance values will therefore be very high. Most unflawed steel pipe components will have, for example, 100% resistance to pedestrian traffic.

Logic and Mathematics Proof

The use of resistance as the third component in the PoF calculation warrants more conceptual discussion. Specific equations are proposed as an efficient means of including all weakness issues into the risk assessment. These equations, as applied to a pipeline segment or other component with potentially multiple weaknesses, is discussed here.

Weakness

A weakness is any structural feature that reduces a component’s stress carrying capacity. That reduction increases failure potential by causing one or more of the following:

• Less capacity for pressure containment
• Faster TTF for degradation mechanisms
• Lowered resistance to external forces including localized (puncture) and uniform (subsea hydrostatic pressure).

The role of the weakness is intuitive, directly proportional, and well documented for the first two of these. Converting all weaknesses into equivalent wall thinning is an effective approach to show changes in resistance. The third, also efficiently modeled as equivalent wall thinning, involves more complexity, as described below.

Weakness Equals ‘Increased Failure Fraction’

A weakness, as used here in modeling time-independent failure mechanisms, actually represents a failure fraction, not necessarily a direct reduction in strength. Assigning an equivalent wall thinning to each weakness is a useful intermediate step, but its role in failure fraction must still be estimated.

Failure fraction implies a probabilistic aspect. This warrants examination. Assume, in some length of pipe, there is a 10% probability of a weakness that introduces a 60% loss of strength. Can this be modeled as a 0.1 x 0.6 = 6% weakness? Probably not. The probability-adjusted weakness estimate should not be used in direct comparison to an absolute level of strength that triggers failure. A 10% chance of 60% weakness may predict occasional failure while a 6% weakness may suggest that no failure is possible. For instance, if nothing less than a 10% weakness allows failure under a certain loading condition, then using 6% weaknesses shows that the pipe always survives even though there is a chance of a serious weakness being present. In reality, we expect that 10% of the time, an applied load will involve the weakness and the pipe will fail. 90% of the time, the weakness is not involved and the pipe survives.

However, as used in this risk assessment, the 60% weakness actually represents a 60% increase in failure potential. If the 10% probability of existence of the weakness is ‘per mile’, then after about 10 miles, we would be fairly certain of the weakness occurring at least once; 10%/mile x 10 miles = 100%. This would be taking some liberties with probability theory since, if these were probabilities, then a binomial distribution would likely be assumed and the 10 miles would only have a 63% probability; 100 miles would have 99.999% probability. But we are treating these values as failure fractions or frequencies. So, to make this more transparent, let’s say that we believe that we have nearly a 100% chance of at least one 60% weakness somewhere in the 10 miles. Under certain assumptions, that is mathematically the same as the 6% probability of a weakness per mile in the assessment equations used here. The key is that the 6% weakness is actually modeled as a 6% increase in failure potential. Each mile has a relatively low chance of failing from the weakness—6%. The aggregation of all ten miles, however, shows a high chance of a failure point—10 miles x 6%/mile = 60%. Due to the possible presence of a weakness, each mile carries a 6% increase in failure fraction and the whole ten miles carries an 60% increase. We expect a failure somewhere but do not know in which mile it will occur.

Multiple weaknesses increases the failure fraction as is discussed in a following section.

Resistance vs Failure Fraction

The recommendation to measure resistance rather than failure fraction in the top level PoF equation arises from the notion that increased resistance is intuitively a good thing. Adding more resistance, just as adding more mitigation, reduces PoF. Numerically increasing either will prevent failures. This is useful in communications of risk. Discussing a reduction in failure fraction, rather than an increase in resistance, is less convenient in the everyday conversations that will hopefully emerge in risk management, based on the assessment. But, since we are measuring failure (not survival), we use 1 – resistance = 1 – survival fraction = failure fraction.

Multiple Weaknesses

While it only takes one weakness to coincide with a sufficient load to precipitate a failure, the number of potential weaknesses logically increased the opportunity for the unfavorable load-resistance overlap. The potential density of weaknesses is captured in the probability estimate. This discriminates between components with potentially few or none and those with many weaknesses.

When there are potentially multiple weaknesses, all combinations should be considered—portions of the segment with no weakness, one weakness, two weaknesses, etc. The full analyses to include potential weaknesses in the PoF involves combining all possibilities for each portion of the segment being assessed: PoF_with weakness1 + PoF_without_weakness1 + PoF_with weakness2 + PoF_without_weakness2 + PoF_with both weaknesses1-2 + PoF_with neither weaknesses1-2 + etc for each potential weakness and weakness combination. Each pairing sums to be 1.0 or 100% since all possibilities are being considered, ie with and without the weakness or weakness combination.

This equation would be repeated for each combination of failure mechanism (PoF) and resistance (weakness or collection of weaknesses) scenario.

Examining the mathematics involved

Using the standard form for PoF estimation:

time independent: exp*(1-mit)*(1-res) = PoD*(1-res)

time-dependent: exp*(1-mit)/(res) PoF=1/TTF = 1/(res/(exp*(1-mit)))=
exp*(1-mit)/res = PoD/res

PoD is probability of damage. Once that is determined, then resistance is added to the equation to predict failure potential.

RES is %—fraction of damage events that do not immediately lead to failure (loss of integrity, in these examples). Resistance is the survival fraction.

(1-RES) is the fraction of failures after damage occurs. For example, 80% resistance means that one out of every five loadings—20% of the damage-causing events—will result in immediate failure while in four out of the five events (80% of the time), damage may occur but failure will be successfully resisted. Failure fraction is 20% and RES = resistance = survival fraction = 80%.

Implicit in the estimate of PoD is the existence of one or more ‘damage’ scenarios that could result in failure. But the frequency/probability of damages is always equal to or less than the frequency/probability of failures. We can’t have more failure scenarios than damage scenarios
^[5]. So, RES is <1.0 and approaches 0 if a high fraction of damages result in immediate failures.

Since (1 – resistance) is indeed the failure fraction for time-independent failure mechanisms, FailFrac can be used in the original PoF relationship to make this proof more transparent:

PoF = PoD x FailFrac

If a weakness exists, RES is reduced and FailFrac increases. Since we often don’t know for sure where/if weaknesses exist, a probability consideration is added. This was described and validated previously and impacts our math as follows:

Pr = probability that weakness RES exists and generates the corresponding failure fraction.

(1-RES)*Pr = FailFrac *Pr = probability of the failure fraction occurring = FailFrac given weakness

Recall that PoF = PoD*(FailFrac if weakness exists) + PoD*(FailFrac if no weakness)

Assume (FailFrac if no weakness) = 0, so the second term can be ignored in this exercise–it is addressed elsewhere.

PoF = PoD(1-RES1) Pr1+PoD(1-RES2) Pr2+PoD(1-RES3) Pr3….
PoD(1-RESn) Prn with no coincident occurrences

n = count of weakness scenarios (ie, girth weld defect, hard spot, low freq seam, wrinkle bend, etc and various combinations of these)

RESn = resistance scenario—fraction not failing if weakness exists,

at least one RES scenario must exist; the sum of all RES scenarios is <= 1.0

Prn = prob of weakness scenario n existing; sum of Prn represents all possible scenarios, ie, (Pr1 + Pr2 + … Prn) = 1.0

The above equation simplifies to:

PoF = PoD[(1-RES1)Pr1+(1-RES2)Pr2+(1-RES3)Pr3….(1-RESn)Prn]

so, PoF = PoD[(Pr1+Pr2+Pr3…Prn)-(RES1(Pr1)+RES2(Pr2)+RES3(Pr3)…RESn(Prn))]

where FailFrac = [(1-RES1)Pr1+(1-RES2)Pr2+(1-RES3)Pr3….(1-RESn)Prn]

Using our initial example with a simple one-weakness resistance scenario, a 60% weakness means 40% resistance and there is a 10% chance of the weakness and 90% chance of no weakness (resistance = 100%), so:

PoF = PoD[(1-40%)]10% + PoD[(1-100%)]90% = PoD(6% + 0%) = PoD*6%

PoF should never exceed PoD, so sum of Prn’s should equal 1.0, all scenarios. In this equation, it is necessary to include all combinations in Pr—ie, all combinations of weaknesses where more than one weakness exists. Alternatively, an OR gate can be used (discussed in next section) to aggregate possible scenarios of weaknesses, including coincidences. This is discussed next.

Using the OR gate math:

The OR gate math approach to combining probabilistic elements also supports the modeling of probabilistic failure fractions as proposed. By a similar logic as previously shown, resistance scenarios, can be combined as follows:

PoF = PoD[(1-RES1)Pr1 OR (1-RES2)Pr2 OR (1-RES3)Pr3….(1-RESn)Prn]

The OR gate method of summation does not require that the ‘no weakness’ scenarios are included. Since not all possible scenarios are included here (only the ‘with weakness’ scenarios, not the ‘without weakness’ scenarios) summations to 100% probability are not expected. Any potential resistance scenario is added to the others via the OR gate. This makes modeling much easier.

The OR gate applies for both combining multiple weaknesses in the same component and aggregating the resistance of a collection of components. The latter is of less interest since each component will have its own failure probability. Aggregating failure probabilities from a collection of components has many applications but aggregating their resistance values serves no apparent purpose other than perhaps a point of interest.

Resistance in Time-dependent Failure Mechanisms

This same justification enables the use of probabilistic pipe weaknesses PoF calculations for time-dependent failure mechanisms. This includes delayed failure potential, where a defect is introduced, does not precipitate immediate failure, but contributes to a later failure.

Resistance in time-dependent failure mechanisms is efficiently measured as effective reductions in wall thickness, as discussed in this section. This is illustrated in the following example:

Say there is a 10% probability of one or more defects per mile is present and that each defect results in 50% effective pipe wall. Some miles will have one or more defects while others will have no defects (100% effective pipe wall). Miles with no defects will have a leak-based TTF1 = wall1/mpy. Miles with one or more defects that are coincident with the degradation rate will have TTF2 = wall2/mpy = (0.5 x wall1)/mpy = 0.5TTF1. Under certain assumptions, we expect 10% of the miles to have TTF2 = 1/2TTF1 and 90% of the miles to have TTF1. If PoF is modeled to be 1/TTF, then any random mile will have a 10% chance of PoF2 and a 90% chance of PoF1. To obtain a point estimate of the potential pipe weakness in the mile, we use a probability-weighted value calculated as:

10% x 50% + 90% x 100% = 95%

So, a 90% chance of PoF1 and 10% chance of 2XPoF1 is modeled as 1.05%PoF1. The three values that arise from this reasoning are as follows:

TTFprobable = pipe wall/mpy = PoF1

TTFmodel = 95% pipe wall / mpy = 1.05% PoF1

TTFworst = 50% pipe wall/mpy = 2 X PoF1

The modeled TTF uses both the most probable and the worst case TTF, in a two-part relationship converting TTF to PoF, as is discussed in .

Modeling of Weaknesses

Recall the advice to begin with the robust solution before contemplating any shortcuts. In the case of resistance estimation, the robust solution entails analyses of every combination of load, stress, and potential defect. The first two have been discussed already, so the last remains. Here, the role of defects—weaknesses—is considered in the risk assessment.

Process

Given all the types of potential weaknesses, the varying abilities to detect each, and the role each may play in component strength, there are countless combinations to consider in an assessment. This seemingly daunting task can be made manageable via the establishment of a matrix. This takes some initial effort, but then is simple to maintain and adjust as needed. More specifically, some parts of this process require an initial set up but then only very infrequent maintenance and updates. Other parts will be location specific and sensitive to inspection results, therefore requiring sometimes frequent updating.

In outline form, the following ingredients will be needed for the matrix:

1. List of all possible defects/weaknesses: any that could appear anywhere on any pipeline component
2. Estimation of representative size/configuration of defect populations, covering at least two possibilities:
3. Noteworthy Defects: The size/configuration combination that first results in a measurable strength reduction—ie, the smallest size/configuration that noticeably reduces strength under design loads. This sets the lower threshold for what types of features should be included in the assessment. Non-injurious features can usually be disregarded.
4. Worst-case defects that could be undetected: The combination that yields the worst-case strength reduction AND is undetectable (just below detection limits) by integrity assessment or inspection methods. This establishes the largest defects that could remain undetected by an inspection or integrity assessment.
5. Inspection and integrity assessment capability evaluations. The probability of detection of each size/configuration combination using each type of anticipated integrity assessment technique.
6. Assignments of effective wall thickness reductions to each defect
7. Conversions of wall thickness reductions into increased failure fractions for time-independent failure mechanisms

The above set of estimates can be established for all possible pipeline systems to be included in the risk assessment. Having initially set this up, tested it with real-world applications, and gaining the acceptance of SME’s, it should only infrequently require maintenance.

Then, the location-specific elements are added for each segment under evaluation. That is, each length of pipe or individual component, requires a current estimate of:

• The failure fraction under an assumed set of loadings when there are no defects or weaknesses present. This failure fraction may be close to zero, when a defect-free component easily carries all the stresses created by even the extreme ranges of all normal loadings^[6]. Note that both normal and abnormal loadings should be captured as exposure estimates for the failure mechanisms assessed.
• The probability of each size/configuration existing in the subject segment prior to the integrity assessment. In the absence of better information, this may have to be a rate per mile, broadcast along many miles of apparently-similar pipeline.
• The probability of each size/configuration existing in the subject segment immediately after the integrity assessment. This uses the general inspection capability analyses generated above. But it adds the location- and application-specific nuances of each inspection—ie, the accuracy of that particular inspection, considering weather, cleanliness, ILI excursions of speed, magnetization, etc, operator skills, and others.
• The rate of re-emergence of each size/configuration. This may be zero for many anomalies such as those associated with original manufacture or construction and not possible to introduce during modern repair.

This second list will require more maintenance, given its role in measuring changing conditions at specific locations and the situation-specific nature of many inspections.

After applying this exercise, each component will have an effective wall thickness estimate. This will lead to a resistance estimate to be used in all PoF calculations

For defects whose contribution to increased failure potential is primarily through stress concentration, the defect can be treated either a decrease in effective wall thickness or an increase in crack growth rate. To keep the association between the anomaly and the effect on failure potential, the former is usually the more efficient modeling choice. Each anomaly can be treated as a reduction in effective wall thickness, resulting in reduced TTF and increased PoF, compared to anomaly-free components.

Listing of Potential Weaknesses

A general listing of potential weaknesses may be appropriate for early phase risk assessment. For instance, Table 10.3 shows a sample of general categories of potential weaknesses, where SME’s have assigned an effective wall loss reduction to each category.

Type	Sub-Type	Effective Wall Loss (%)
Dent	>6% of diameter
Dent with gouge
Dent with re-rounding
<6% of diameter
Mechanical coupling	Flange
Screwed
Dresser style
Stress concentrator	Wrinkle bend
Miter joint
Substandard appurtenance

Such generalizations require many assumptions and will not result in the most accurate assessments. More detailed listings will provide more ability to discriminate weaknesses. Dents and gouges will often need to be better characterized in terms of their dimensions and orientations in order to assess their realistic impact on resistance. Furthermore, their existence in regimes of higher stress and/or more pressure or thermal cycling will be important. Creating more extensive lists to capture more characteristics and/or combinations of effects will often be appropriate.

Type	Sub-Type	Effective Wall Loss (%)
Dent	>6% of diameter	5%
Dent with gouge	10%
Dent with re-rounding	10%
<6% of diameter	2%
Mechanical coupling	Flange	5%
Screwed	10%
Dresser style	35%
Stress concentrator	Wrinkle bend	5%
Miter joint	20%
Substandard appurtenance	10%

Considerations either beyond or more general than defects can also be included here. Characteristics such as toughness, old repair methods, and certain appurtenances are not defects but may impact resistance. Nuances such as laminations vs laminations plus source of hydrogen can also be considered in the matrix. So, rather than a focus on specific defect types, a more generalized list of locations that may harbor a resistance issue can be used instead or can supplement. For example:

Note that features caused by mechanisms such as metal loss (from corrosion) and cracking do not appear on these sample lists of weaknesses. This is due to their role as independent failure mechanisms, modeled elsewhere in the risk assessment. The assessments of corrosion and cracking yield estimates of effective wall thickness. To these estimates, the potential for additional weaknesses will be considered, further reducing the effective wall thickness in many cases. This ensures appropriate consideration of interaction of all degradation mechanisms (as well as random failure mechanisms) with all potential weaknesses.

This listing of potential weaknesses is a generalized part of the matrix that will not often change. Only with new or improved inspection or new knowledge of structural resistance will changes be needed.

Estimating Strength Reductions

The amount of strength reduction that should be attributed to each potential weakness is well understood for some weaknesses, such as corrosion metal loss, but less so for others such as stress concentrators. In other cases such as modeling for crack progression, the amount can be calculated, but only after acquiring additional costly information or making highly uncertain assumptions.

Some anomalies are only a defect under certain loadings and/or sufficient stress. A stress concentrator may lead to crack initiation, leading to increased crack susceptibility (modeled as more rapid crack propagation), but only when sufficient stress exists. Below this threshold stress level, no crack activity occurs. To handle these situations in a risk assessment, it is usually prudent to include the strength reduction effect as if the sufficient loadings were present. When this is paired with a low probability of that ‘sufficient loading’ scenario, the effect on risk is appropriately quantified.

Some strength reduction estimates can be derived from design standards. ASME B31 series standards report stress intensification factors for various pipeline components. While not directly designated for this use, an extrapolation of such factors into strength reduction values is logical. Similarly, design factors of various types often imply the amount of strength reduction accompanying design or construction features. These too may be valuable as guidance for assigning weakness values in the risk assessment. Others may be derived from published research. Of course, a finite element analysis for a specific component with specific defects or stress concentrators will be the full and most accurate guidance on resistance.

By first modeling each feature as an effective wall thickness reduction, quantitative assignments of strength reductions can then be made. In some cases, the effective wall thickness is simply inserted into stress calculations, replacing the nominal or measured wall thickness that would otherwise be used. However, the quantifications of strength reduction will also require assumptions and modeling shortcuts to make it manageable for most practical applications.

Probability of Weakness

Once weakness potential is understood, the probability of each weakness (or of each category) is estimated for each stretch of pipeline or each component. This is an input data set. Whenever the rate of occurrence changes along the pipeline, a new dynamic segment is warranted. Changes in rate of occurrence are often linked to characteristics such as:

• Era of manufacture
• Manufacturing process and plant
• Construction/installation process
• Construction challenges
• Outside force changes
• Pipe specification
• Surface type—pavement, water, agriculture, urban, etc
• Burial depth
• Inspection/test history
• Etc.

Consistent with other parts of this risk assessment, it is advantageous to have parallel branches in the model for estimates and measurements. Estimates are ‘best guesses’ of how often a weakness may appear. They may have to be deduced from era of manufacture/construction knowledge or experience with similar systems. Measurements are the results of surveys or inspections that more directly identify weaknesses. Estimates override older and less accurate measurements while newer, more accurate measurements override older, less accurate measurements and estimates. This way, the absence of a measurement (no inspection) is penalized (shows as higher risk) when conservative estimates are used.

All of these potentially impact previous frequency and severity estimates. For instance, the discovery of an old metallurgy report noting steel toughness may warrant a change in that ‘weakness’. Other examples include the ILI discovery of old fittings or appurtenances or wrinkle bends; the occurrence of aggressive MIC activity; etc.

For some pipeline segments, some potential issues will be immediately dismissible—for example, no low frequency ERW seam issues where ERW pipe does not exist. Even in these cases, the matrix serves a valuable function. It documents that 1) the potential issue is considered and 2) that it plays no role in risk at the subject location.

The rate of appearance of new defects depends firstly on the origin of the component. New defects originating from manufacturing and construction processes would not be expected unless new components had been added or existing component modified. The additions or modifications would not be expected to harbor defects of the kind associated with older practices now known to be inferior, unless errors (for example, use of improper material) or sabotage are suspected. Otherwise, only errors in the pertinent manufacture/construction processes could introduce new defects of those types.

Defects also appear in the operations and maintenance phase of the pipeline’s life cycle. New anomalies can be introduced by unintentional contacts with excavation or agricultural equipment, earth movements, and others. Anomalies can transition into defects under the influence of degradation mechanisms or new stresses.

All possible defect origination scenarios should be included in the resistance assessment. Each should be estimated for each component in the risk assessment. Since there are myriad types of anomalies that can arise, sometimes from multiple causes, and grow under countless scenarios, this is not a trivial task. But it is reflective of the real world and must at least be understood and approximated before the risk assessment can be accurate.

The defect rates of growth and appearance can often be better estimated after successive integrity evaluations. Care must be taken to separate temporary aberrations from trends. Third party construction associated with a housing subdivision under development may have led to multiple dents and gouges but, once completed, will no longer be a source.

Defect rates may also be based on previously assessed rates of underlying degradation mechanisms (corrosion or cracking, normally) and rates of time-independent damage (ie, PoD’s from impacts, excavations, geohazards, etc). Since exposures and mitigation effectivenesses for future rates have already been quantified in the risk assessment, those values can be used directly for estimating future defect rates and indirectly (ie, modified based on changes over time) for past defect rates.

To make the assessment more manageable, it may be appropriate to group some defect types and origin causes. In the following example, two estimates are made for potential weakness category; one for frequency of each weakness at the time of installation or last measurement (integrity assessment) and one for frequency of introduction, ie the rate at which the weaknesses are being created. The latter is estimated as a rate per mile-year that might have been introduced since the most recent inspection or assessment that should have detected the anomaly. A defect from a manufacturing process would have a zero rate of introduction unless replacements are being made.

A relevant integrity assessment ‘resets the clock’ to some extent, establishing the number and severity of defects existing at the time of inspection. The interest is then in the defects that escaped detection plus any new defects occurring since that inspection. If no such inspection or assessment had been done, the pipe installation date is used with a PXX plausible rate of introduction of defects—for example, 1 mile of pipeline, 20 years old = 20 mile years area of opportunity; 20 mile-years x 0.2 defects introduced per mile per year = 4 defects dispersed along the mile of pipe.

Again, note that some resistance issues are assigned a zero rate of emergence since they are associated with outdated manufacturing and construction practices that could not have occurred since the last assessment. The emergence rate also takes into account improvements in inspection and quality control during actions on the pipeline.

For instance, in this example, the assessor assigns the rate of new substandard girthwelds to be once every 5 miles (per year of new welds being produced), while the older portions are assigned a rate of once every mile. Discounting ‘per year’ implications (ignoring, for the moment, any defective girth welds introduced during repairs) and with an average girthweld spacing of every 40 ft, this implies error rates of one in every 132 welds on the older portions and one in every 660 welds for the newer.

Paired with the probability of each feature existing on a hypothetical pipeline segment yields listings such as the following example table.

Estimates are first captured as frequencies rather than probabilities, since the assessment may need to discriminate between high counts—ie, multiple features per unit length—rather than “100% probability of one or more”. In other words, a frequency of 7 per mile is different from 12 per mile, but in both cases, an associated estimate of ‘probability of one or more per mile’ will largely mask this difference. Only one occurrence is sufficient to generate the weakness. Multiple occurrences results in higher probability of a weakness being coincident with a damaging load, but does not increase the amount of weakness.

Sample Defect Rates and Rates of Introduction

Resistance Issue or location	Rate of Defects being introduced (count/mile-yr)	Current Number of Defects (count/mile)
substandard appurt	0.001	0.01
substandard repairs	0.001	0.01
Pre 1960 repair	0	0.01
Girthweld anomaly	0.2	1
lamination	0	0.01
wrinklebend	0	10
transportation fatigue crack	0	0.01
hard spot; arc burn	0.02	0.05
Acetylene weld	0	0.01
dent	0.15	0
Mechanical coupling	0	0.8
gouge	0.1	0
low toughness from manufacturing	0.008	0.2
low toughness from in-svc phenomena	0.02	0.2

Using units such as ‘per mile’ for rates of features can help in visualization by an SME. At some point in the process, the frequencies can be converted to probabilities using a reasonable distribution assumption, such as the exponential distribution.

Defect frequencies should include all available evidence including all NDE (for example ILI) indications; history on similar lines; recent research; knowledge of construction and manufacture processes, etc. The estimates are then adjusted based on evidence from subsequent integrity assessments including all NDE and press test. Adjustments should consider the strength of the evidence. Higher PoI is achieved by more robust NDE or higher pressure testing. There is reduced PoI with sub-optimal NDE technique, application, follow-up, etc or lower pressure testing.

Sample Matrix for Detectability

Defect type	defect size/configuration	Detectability by Integrity Assessment Method
ILI, type 1	ILI type 2	Pressure Test	DA
External metal loss	Category 1: depth a, length b, width c	99%	0.95	99.9%	50%
External metal loss	Category 2: depth x, length y, width z	80%	0.9	5%	50%
Crack, circumferential	Depth a, length b	60%	80%	99%	0.2
Crack, circumferential	Depth x, length y	20%	75%	2%	5%
Crack, axial	Depth a, length b	70%	50%	5%	5%
Crack, axial	Depth x, length y	70%	50%	5%
Dent	type 1	90%	80%	20%
Dent	type 2	70%	50%	5%

The modeler chooses the number of defect categories as well as the number of differentiating characteristics of the integrity assessment method. Recall the earlier discussions on detectability sensitivity to specific inspection/assessment characteristics such as conditions and level of expertise. The more robust risk assessments will include all of the inspection accuracy determinants previously discussed. This includes, for ILI, reductions in detectability/characterization of defects are assigned for losses in ILI carrier signals, magnetization, and speed excursions.

While the weakness listings and assignments of effective wall loss are relatively unchanging in a resistance assessment, the ‘probability of weakness’ is the more variable part of the analyses. It will change routinely, by changes in:

• Integrity assessment and inspection results
• Overline survey results (for example, coating holidays may indicate increased external force incident rates)
• Excavation results, confirming or refuting previous estimates of defects
• Risk assessments—changes in exposure and/or mitigation estimates (for example, new sources of dents)
• New information regarding design, manufacture, or installation

Fortunately, maintenance of this analysis structure is straightforward. Only a few inspection-specific characteristics must be added for each new inspection or integrity assessment. Then, the rate of defect introduction must be reviewed and updated as necessary. With a spreadsheet-based calculation routine, the impacts of these updates carry through the analyses and thereby provide the new estimates of resistance.

Effects of Weaknesses

Defects have varying effects on stress-carrying capacity. The equivalent stress at any location depends on component geometry, defect type and size, including damages (metal loss due to corrosion, dents, buckles, etc), support condition, all existing stresses including residual stresses, and knowledge of the original design state. A detailed finite element analysis will best determine the stress state in a component. However, some basic assumptions can be made to allow for a simplified calculation without the use of finite element modeling. The result is less accurate, but is more convenient, reasonably conservative, and of sufficient accuracy for many risk assessment applications.

For example, corrosion damages, metal losses, obviously impact a component’s stress carrying capacity including its leak resistance. Internal corrosion is typically very localized and therefore does not typically affect the stress state. In fact, most leaks due to internal corrosion result from 100% wall thickness penetration by metal loss from corrosion (for example, the leak is independent of the stress). By contrast, leaks due to external corrosion, especially corrosion under coatings in buried components and under insulation on aboveground components, typically result from ~80% wall thickness penetration by metal loss, and then the large, thin area fails in tensile overload. In contrast to internal corrosion, the stress state is often affected by the often-larger area of metal loss that results from external corrosion.

Rather than perform finite element analysis for each possible case, it is possible to estimate the worst-case longitudinal bending stress by assuming a large external corrosion metal loss network centered at the 6 o’clock position of the pipe that wraps 1/3 of the circumference and has a uniform metal loss equal to the maximum metal loss. This is a very conservative assumption, because in reality the maximum metal loss is very localized and gradually tapers off toward the edges of the damaged area. Similar worst-case assumptions can be used for how the metal loss network affects the axial stress and the hoop stress. The equivalent stress can be calculated using both the longitudinal stress (axial plus bending) in the corroded condition and the hoop stress in the corroded condition.

Assigning Wall Thickness Reductions to Defects

This step is required for time-dependent failure mechanism evaluation and is intended to simplify the understanding and processing of resistance estimates for time-independent failure mechanisms. To some, it may instead be an unnecessary additional step for time-independent forces. If so, it can be eliminated from that part of the risk assessment. We first examine the incentive to include the step for all resistance estimates.

The effective wall thickness is used directly in PoF calculations for degradation mechanisms. It also serves to establish equivalencies among the multitude of possible defect types, sizes, and configurations. The role of a 2% dent with a gouge versus an acetylene girth weld is captured in the risk assessment by assigning an amount of equivalent wall thinning to each. These equivalencies can be used in a very detailed way—actually using the effective wall thickness values in subsequent stress calculations—or in a relative way—using the effective wall thickness values to help assign the general effect on stress carrying capacity and failure fraction. If nothing else, it helps to ground an SME’s assignment of final values: ‘Mr SME, in general, if we have X % wall loss at this location, how many failures of type Y will now NOT be resisted?’ The difference between the damaged and undamaged will be the estimate of resistance. See discussion in next section.

On the other hand, this step is not always needed in time-independent failure mechanisms analyses when the risk assessment directly links weaknesses with changes in failure fraction without the intermediate steps of evaluating the details of which stresses are more impacted and to what extent. To some, a direct estimation of increased failure fraction caused by the 2% dent or the acetylene girth weld is preferable to first producing an equivalent wall thinning. In this case, the intermediate assignment of an equivalent wall thickness reduction is not necessary for the time-independent part of the risk assessment.

Note however that an effective wall thickness is always required to complete the modeling of degradation (time-dependent) failure mechanisms. This may provide incentive to prepare the estimate for all failure mechanisms in the interest of consistency.

When assigning an effective wall thickness estimate, the task need not be a complex, academia-style undertaking. In the absence of publications or specific calculations, it is not unreasonable and often within the accuracy tolerances of a risk assessment for a knowledgeable expert to assign equivalent wall thinning to various weaknesses. The question to be answered is: “what is the equivalent reduction in wall thickness caused by this defect?” In the absence of a full set of calculations, the SME is challenged to estimate that “defect X is equivalent to a Y% reduction in wall thickness”. For increased accuracy, he may discriminate among load types, when the defect has significantly differing effects on different loadings. For example, a girth weld defect generally contributes more weakness (increased wall reduction) under an external force loading such as landslide, than it does under the loading from internal pressure. So the effective thinning for external loadings is different than for internal pressure. Assigning different effective wall thinning when exposed to external forces compared to internal pressures allows this discrimination to appear in the assessment.

To account for the varying effects on resistance without a detailed assessment of every possible combination of defect and load/stress, some grouping can be done without excessive loss of accuracy. Short cuts:

• Group defect types—for example, metal loss, crack-like, geometry.
• Reduce number of size/configuration combinations included.

The range of potential weakness scenarios—the various combinations of many factors noted previously—at least somewhat justifies the use of groupings and other simplifications to make the modeling more manageable.

For example, perhaps three categories of load/stress will sufficiently model all possible combinations:

• Resistance Issue or location.
• Potential Strength Reduction (effective wall loss %).

Assigning Strength Reduction to Wall Thickness Thinning

The amount of stress carrying capacity available depends on the component’s properties and the amount already committed to normal loads. This requires analyses of all loading combinations and resulting primary and secondary stresses created.

Having estimated the equivalent wall thinning caused by potential defects, that thinning effect can be related to increased failure potential. For time-dependent failure mechanisms, the use is intuitive—thinning wall leads to shorter TTF and higher PoF. For time-independent failure mechanisms, it is less intuitive. The full solution is to insert into stress calculations the effective wall thickness, replacing the nominal or measured wall thickness that would otherwise be used. To make this step more manageable, groupings of loads or stresses can be made. The general effect of wall thinning on each grouping can be estimated.

This will then be used with load exposure estimates (PoD estimates, actually) to model changes in failure fraction.

Assigning Failure Fraction to Changes in Strength

These strength-reduction values are used with previously estimated PoD values. Each has an assumed distribution of loads—how often loads of various magnitudes are expected. Based on these distributions, the reductions in resistance are modeled to have changes in failure fraction—some loads that could be resisted if there were no weakness will now cause failure, due to the weakness.

In the absence of specific calculations, it is not unreasonable and often within the accuracy tolerances of a risk assessment for a knowledgeable expert to assign general strength reduction values to the previously generated wall thinning estimates. The question to be answered is: “what is the increase in failure fraction caused by this wall thickness reduction, when acted upon by the spectrum of loadings in the exposure estimate?”

Failure fraction is the needed measure of weakness and is equal to 1–resistance. In the absence of a full set of calculations, the SME is challenged to estimate that “a wall thinning of X% results in a Y% increase in failure fraction for the range of loadings expected at this location”.

The simpler approach is illustrated in the following example:

• Weaknesses are suspected or conservatively assumed.
• An equivalent wall thinning of 20% is estimated based on the frequency and severity of defects known or suspected.

This is assumed to have the following effects on three primary resistance types:

• 20% reduction is hoop stress carrying capacity.
• 10% reduction in longitudinal stress carrying capacity.
• 10% reduction in puncture resistance.

These values are used with previously estimated PoD values for surge and vehicle impact. Surges are resisted by hoop stress capacity and vehicle impacts are modeled to be resisted by longitudinal stress capacity and puncture resistance.

Each has an assumed distribution of loads—how often loads of various magnitudes are expected. Based on these distributions, the reductions in resistance are modeled to have changes in failure fraction—some loads that could be resisted if there were no weakness will now cause failure, due to the weakness.

1.  

Example Assignment of Resistance Changes

Load	Surge	Vehicle Impact
failure fraction if no weakness	0.1/yr	0.05/yr
failure fraction with weakness of type x	0.15/yr	0.07/yr

In this example, some important steps are not detailed here, notably: 1) setting the relationship between wall thinning and loss of stress carrying capability and 2) setting the relationship between reduced stress carrying capacity and increased failure fraction. The example shows that the 20% reduction in hoop stress capacity results in an increase of 0.15 – 0.1 = 0.05 failures/yr. This implies that 0.05 events are of such magnitude that they can no longer be resisted when the 20% hoop stress capacity is lost. Similarly, 0.02 additional failures per year are expected from vehicle impacts due to the loss of 10% in longitudinal stress carrying capacity and 10% loss in puncture resistance.

As will be discussed, these relationships can be very robust and more defensible or, at the other extreme, simply based on SME judgments in order to quickly obtain preliminary risk estimates.

Using the failure fraction with and without the weakness, allows the estimation of a cost benefit calculation of removing the weaknesses. For instance:

• Assume an incident cost at this location: $67K per failure event
• Weakness-induced increase in PoF: 0.07 failure events per year
• Increased risk due to weaknesses 0.07 x $67K = $4,690/yr
• The cost of removal of weaknesses can now be compared to this annual loss exposure. Note that removal of the weaknesses does not change the PoD, only the PoF.

Manageable Resistance Modeling

Resistance is a critical aspect of PoF estimation. It is also an inherently complex aspect of the real-world failure potential. The objective is to capture knowledge about loads, stresses, damages, and defects into a resistance estimate using a manageable process. The idea of a ‘manageable process’ will mean different things to different risk assessors. The trade-offs between modeling complexity and accuracy/defensibility will not appear the same to all. The goal of this section, therefore, is to present modeling options that are all grounded in the same underlying principles, but vary in their level of technical rigor (and, hence, complexity).

Even when available stress carrying capacity can be confidently estimated, perhaps captured in an effective wall thickness, the types of loadings often cannot. For instance, we can know the force required to puncture a certain component but must still estimate the frequencies of scenarios that can cause that amount of force (ie, equipment power, angle of contact, operator reaction, etc.)

As an example of different levels of analysis rigor, consider the common problem of accidental third party mechanical contact with buried pipelines. The simplest approach would be to assume a percentage resistance reflecting an average or worst case (depending on PXX) fraction of damages that would not result in immediate failure. The extremely simple version would use the same fraction for all type of components. This could be improved by adjusting the fraction based on the component’s material type, diameter, and wall thickness. It could be further improved by linking the fraction to component characteristics AND several groupings of loadings—for example, excavator hits versus agricultural equipment hits versus vehicle impacts. Vehicle impacts could be further categorized into land vehicles, aircraft, and offshore, including potential ship wrecks impacting a submerged pipeline. Types and speeds of the vehicles will be important also. Additional considerations could continue to be added until, at the other end of the technical robustness spectrum, the result is a FEA type analyses specific to each component, at every location, interacting with all plausible loading (impacts) scenarios.

This choice in modeling rigor should be driven by the intended use of the risk assessment. Initial, higher level risk assessment applications will often have sufficient rigor when driven by simple yet appropriate assumptions. Applications requiring the most technically defensible status will migrate towards the FEA end of the spectrum.

Both the simple and rigorous solutions utilize the same framework so nothing is lost by beginning with the simpler approach (gaining immediately useful answers) and then migrating to increasingly more detailed analyses later.

Following are some examples, illustrating the range of modeling possibilities.

Simple Resistance Approximations

Often a simpler, more approximate solution is sufficient— some loss of rigor is acknowledged and is acceptable. As an initial risk estimate, SME’s can assign equivalent wall thicknesses to abnormal loadings and defects using their judgment and experience. These, coupled with similarly estimated corresponding increases in failure fraction, provides the necessary ingredients to perform a preliminary assessment.

The SME will be able to readily distinguish between, say a feature causing a 1% effective wall reduction (negligible impact) and a 50% effective wall reduction (large impact) under a certain set of scenarios. Given the often wide range of possible loadings and other variables, the level of discrimination available solely from SME judgments may be sufficient. Far more discrimination will be available for some defects than others—metal loss is more readily and accurately linked to equivalent wall reduction than a dent with gouge.

Provisions for multiple weakness types and coincident occurrences of weaknesses can also be included, at least conceptually, by SME approximations.

The resulting approximate solutions are immediately valuable since they use all of the important factors, at least approximately, to arrive at risk conclusions. The process will correctly show that a higher incidence rate of more severe defects leads to the higher PoF values and that all combinations of quantities and severities, sometimes of multiple types of defects in close proximity, are included in the assessment. Furthermore, the simplified approach does not encumber attempts to later make the assessment more robust.

Time-Dependent

Two time-dependent failure mechanisms are normally included in a risk assessment: corrosion and cracking. As detailed in earlier chapters, each is included in assessments which produce ‘wall thickness available’ values, after considerations of degradation rates through the component’s life, inspection accuracies and timing, and remaining strength calculations for both leak and rupture criteria. As part of this resistance estimation, each ‘available wall thickness’ is adjusted for possible weaknesses. This adjustment for weakness can be called the wall-adjustment-factor and, when applied to the best estimate of current wall thickness, converts that value into the effective wall thickness. The adjustment factor should reflect the desired level of uncertainty and can be approximated in a simple way, as previously discussed, or in a more rigorous way, as shown in the following section.

The final step in PoF assessment is simple and intuitive for time-dependent failure potential, once the effective wall thickness (including adjustments for weaknesses) is available. The effective wall thickness is directly used with the future degradation rate estimates—mpy internal and external corrosion and mpy cracking—to yield a TTF or remaining life estimate. TTF is then used to generate the PoF estimate.

Time-Independent

As in the time-dependent estimation, an ‘available wall thickness’ can be^[7] adjusted for possible weaknesses in the time-independent (random) analysis. This adjustment for weakness, when applied to the best estimate of current wall thickness, converts that value into the effective wall thickness. The effective wall thickness is now used to estimate the ability to resist possible future loads. This relates to the fraction of failures that are avoided due to the strength of the component.

Multiple time independent, random force, failure mechanisms are recognized as load-producing events here. They can be grouped into exposures, for example:

• loads creating hoop stress
• loads creating longitudinal stress
• loads causing puncture
• loads causing buckling.

Each is estimated in terms of events per mile-year. To be considered an event, the load must be sufficient to break the hypothetical component imagined to have no resistance (ie, the beverage can analogy). These estimates are recognized to be point estimates of underlying probability density functions which suggest the range of loadings possible along the pipeline or over time at a single location.

As with time-dependent failure mechanisms, the adjustment factor to capture these possible weaknesses and their effects on PoF should reflect the desired level of uncertainty of the risk assessment. They can be approximated in a simple way, as previously discussed, or in a more rigorous way, as shown in the following section.

More Detailed Resistance Valuation

In seeking the most defensible and accurate estimate of resistance, the robust risk assessment will embody more resolution and more accurate modeling of resistance. As earlier noted, much of this deeper analysis involves a one-time ‘set up’ of general relationships that can be universally applied to all pipeline locations. This takes initial effort but then very little on-going maintenance. Only the location-specific data will need to be routinely refreshed for subsequent risk assessments.

Even after a more sophisticated analyses of available resistance, the future frequency of loads with sufficient force to cause failure must still be estimated. As described in previous chapters, these values can arise from a variety of estimation approaches, ranging from simple SME judgments to detailed studies of local equipment availability and planned third party excavation projects, speed and volume of various landslide events and vehicle impacts, moving waters with debris forces, and many others. Some level of uncertainty will remain, even with the most detailed analyses

The following example application illustrates the use of more analyses to better model the interactions of component characteristics and potential weaknesses with specific loadings. A guiding principle of this approach is that, in order to understand the fraction of loads that can be resisted, the load-carrying capacities under various loads must first be quantified.

Examples of Weakness Estimations

In a more robust resistance assessment, a more detailed analysis is performed. This analysis includes multiple steps to more fully model resistance.

To begin, each exposure has mitigations identified and estimated in terms of effectiveness. The pairings of exposures with corresponding mitigations yields PoD’s for each. These are used with the resistance estimations (about to be detailed) to yield the PoF’s for all time-independent failure mechanisms.

The spreadsheet lists the PoD for each threat. It then adds resistance analysis components as follows:

• Listing of weakness types or categories that are possible. Some weaknesses may not significantly impact some threats.
• Quantification of what is known from recent integrity assessments
• Measured defect rates (pressure test and ILI results adjusted for age and accuracy to desired PXX level)
• PoI and age of last pressure test
• PoI and age of last ILI
• PoI reductions due to ILI run-specific characteristics
• Rates of new damages possibly introduced since the assessment
• Quantification of what can be inferred in the absence of integrity assessment information
• Estimated defect rates (based on pipe manufacture type and age, era of construction practice, rates of new damages, etc to desired PXX level)
• Today’s best estimate of probability of weakness, considering all of the above
• Selection of representative stress types. For example, three stresses may be considered—hoop, longitudinal, and shear—neglecting the influence of axial stresses. Most buried pipelines have few significant stresses beyond those created by internal pressure, but for this example, an unsupported span is being modeled to illustrate a case where additional loads play a role. Standard hoop stress and beam stress formula are used. Yield stress is used as the limiting factor, but ultimate stress would be less conservative (more realistic).
• Baseline estimates of available resistance. This step provides the defect-free stress carrying capacity available for additional loading. This is the difference between stresses already being carried due to normal loadings and the full stress carrying capacity of the component. This answers the question: “ after resisting internal pressure, external forces, and any other stresses, how much strength remains for abnormal loads? “
• Selection of representative loading scenarios such as pressure surges, outside force by excavator or landslide, puncture by excavator, etc.
• For each loading type, a resistance is estimated. These estimates are made by first comparing the load-carrying capacity available with the loads that would result in failure. The load-carrying capacity is derived from the maximum stress carrying capacity. The conversion from stress to loads is made in order to more easily estimate the fraction of exceedances that might occur. See further discussion below. Once the available load-carrying capacity is known, the fraction of loads that will exceed this capacity can be estimated.
• Amount of strength loss, per stress type, if weakness is present.
• Probability-adjusted amount of wall loss, for each stress type. The modeler chooses how many stress types to include. Hoop stress and longitudinal would commonly be chosen; puncture, buckling, and others will be included in the more detailed analyses. These values are next used in estimations of failure fractions.
• Amount of increased failure fraction due to the strength loss caused by the presence of the weakness. An increased failure fraction is generated for each pairing of weakness with each stress type.
• These failure fractions are converted into resistance estimates, where failure fraction = (1-resistance), and used to complete the PoF assessment for each threat. Each loading scenario’s resistance can now be paired with the previously estimated PoD—exposure x (1 – mitigation). This provides a PoF for each loading produced by each threat.

Load-Resistance Estimations

The above process of obtaining ‘fractions of failures avoided’ as estimates of resistance, warrants further discussion.

Estimating the number of loads that could result in failure can arise from analyses ranging from a robust, technically complete study to simple estimate from engineering judgment. For example, once it is known that the component can withstand a maximum of, say, 544,000 kN force from an excavator, the analyst can research availability of equipment that can produce this type loading and its frequency of use in the area, to estimate the fraction. Or he can simply use his field experience and perhaps a cursory review of published equipment capabilities, to make an initial estimate. Again, different levels of analyses rigor will be warranted depending on the intended use of the risk assessment.

As another illustration, in the case of hoop stress, suppose that the pipe specification used in the Barlow calculation shows that an additional hoop stress of about 14K psi can be tolerated by a component. This is derived from a comparison of the combined existing stresses (created from normal loads) with the maximum yield stress (ultimate stress could alternatively be used). So, an additional load corresponding to a hoop stress of 14K psi can be tolerated. For a certain component configuration, suppose that this equates to an additional internal pressure of 535 psig that can be resisted. An estimate of how often the internal pressure can exceed this value—ie, how often the mitigated exposure will result in 535 psig or more additional internal pressure—yields the fraction of events that will be resisted. HAZOPS, PHA, and other techniques, coupled with physics equations for stresses, are available to quantify the frequency and magnitude of accidental overpressure events, ie, how many events > 535 psig are plausible. Potential scenarios include surges, thermal overpressure (for example, from blocked in above ground portions subjected to daytime heating), and malfunctioning control/safety systems. Again, in the absence of the full HAZOPS type study, an experienced SME can usually produce a reasonable estimate simply based on his knowledge of the system hydraulics.

Hole Size

Many of the same determinants of resistance also inform the potential hole size created with any load/stress scenario. With an assumption that most risk assessments will be measuring failure as any loss of integrity, hole size becomes an aspect of consequence potential. See discussion in .

1. Such as ASME/ ANSI B31G, Manual for Determining the Remaining Strength of Corroded Pipelines, or AGA Pipeline Research Committee Project PR–3–805, A Modified Criterion for Evaluating the Remaining Strength of Corroded Pipe ↑
2. See also discussion of inspections related to pipeline support condition, coatings, changes in immediate environment, etc. Here, ‘inspection’ refers to the identification of damages on the pipeline component itself. ↑
3. SMYS is only one aspect of material strength but is often used to generally characterize a steel. ↑
4. Cracking is modeled as effective wall loss even though there may be no actual loss of material associated with some forms of cracking ↑
5. At least not with a leak/rupture type risk assessment where damage is a prerequisite for failure. ↑
6. When the resistance baseline is the remnant stress carrying capacity after normal loads are applied. The resistance baseline could also be essentially zero, if the ‘aluminum can’ analogy is used. ↑
7. Recall the earlier observation that an estimate of effective wall thickness is not necessarily an essential step in estimating failure fraction for many time-independent phenomena. ↑