Nuances of Exposure, Mitigation, Resistance
In most instances, the categorization of each piece of information into one of these three is obvious—most variables are clearly telling us more about either the exposure, the mitigation, or the resistance. To some, the surrogate terms of ‘attack’, ‘defense’, and ‘survivability’ add clarity. Focusing on PoF only, here are some examples to help solidify the categorization:
The obvious
Variables can inform multiple aspects of a risk assessment, but usually, one category is more directly influenced by the variable. Soil corrosivity, excavator activity, vehicle traffic, seismic activity, flood potential, surge potential, landslides, are examples of phenomena that obviously inform exposure estimates. They tell us about the frequency and severity of ‘attack’.
Coatings, depth of cover, training, procedures, maintenance pigging, are examples that, to most, are clearly defenses against damage. They are best modeled as mitigation measures. When the same mitigation measure protects against multiple exposures, it is valid to include their benefits in all relevant threats. For instance, depth of cover protects against impacts, excavations, and some types of geohazards.
Metal loss, cracks, lack of toughness, SMYS, wall thickness are examples of variables that inform resistance estimates.
The less obvious
Casings: a casing (see full discussion later) sometimes causes confusion when one focuses on corrosion problems potentially caused by their presence and loses sight of the original intent. Casings are usually installed as mitigation to external forces. They also serve other purposes such as consequence reduction, but they are mostly intended to protect a carrier pipe. Their role in a risk assessment should show their benefit in preventing excavation damages, traffic loads, and others. However, a casing’s role as a corrosion issue should also be acknowledged. A casing changes the external corrosivity exposure (electrolyte in the annular space and possible electrical connections) and the ability to apply CP. Both should appear in the risk assessment. So, the presence of a casing is captured as a mitigation against external forces, an influencing factor for external corrosion exposure and mitigation (shielding of CP), and perhaps also in CoF.
ILI: some may initially think protection occurs with the activity of performing an ILI. Actually, as with other inspections and tests, neither the exposure nor the mitigation nor the resistance has changed because of the ILI. What has changed is the evidence—knowledge of resistance has increased, often dramatically, and uncertainty regarding exposure and mitigation is different because of the ILI. For instance, at every identified location of external metal loss on a buried pipeline, we know that both coating and CP have failed, so mitigation is reduced, perhaps to zero, pending repairs. We usually do not know when mitigation failed, so might not be able to directly modify exposure (mpy rate of corrosion) estimates without more information. So, the role of ILI is first in resistance estimates and secondarily in exposure and mitigation estimates. Of course, action prompted by the ILI will often change exposure and mitigation.
Laminations, wrinkle bends, and arc burns are resistance issues. They are not ‘attacking’ the pipe, nor do they contribute to or impair mitigation. They represent potential weaknesses, sometimes only under the influence of exacerbating factors such as certain loadings (for example, causing stress concentrations) or environment (for example, sources of H2 that aggravate laminations and facilitate blistering or HIC). They are best modeled as potential losses of strength—ie, as resistance issues.
Additional Gray Areas
When information can logically be categorized in more than one place, the choice is usually a matter of preference and does not weaken the assessment. Choices of the role of the information usually leads to the same mathematical result. So, the choice is often not critical to the PoF estimate. Some examples of such choices are discussed below.
Note that while several ‘gray area’ examples are discussed here, the vast majority of information is very easily and intuitively categorized into its appropriate place in the risk assessment. The reader should not leave this section believing that any more than a very few scenarios have some ambiguity regarding modeling choices.
What Constitutes ‘Exposure’? Normalizing Exposure and Resistance
Since PoF measures ‘failure’, the definition of exposure is linked to that of failure. An exposure must be able to cause a ‘failure’ if it is truly an exposure. If failure is defined, for instance, as ‘permanent deformation’, then exposures that could cause that to a pipe component, are counted. If failure is defined as ‘loss of integrity’, events causing immediate leaks/ruptures are obviously needed, but so are damage-only events. In fact, most assessments will appropriately include all events that can at least cause damage. Even when immediate failure from the event is not possible, the damage may contribute to a subsequent failure and is therefore of interest to the measurement of PoF.
Should excavation by hand shovel be considered an exposure for a steel pipeline? Yes, if any structural damage at all is possible—even a scratch. This scratch may directly reduce resistance to some future failure mechanism, although it is often an immeasurably small reduction. The scratch can also theoretically occur exactly at some point of pre-existing weakness, resulting in immediate failure.
Excavation by a plastic shovel probably cannot cause even minor scratch damage to a steel pipeline and need not be counted as an exposure. However, the indirect role of a ‘hand shovel contact’ event must be considered. Both the metal and plastic shovel should be counted as causes of damage to corrosion coating systems. Since coating is a mitigation measure, damage to a coating reduces mitigation effectiveness. This is different from an exposure. If concrete coating or rock shielding is present, it provides mitigation against coating damage.
Vandalism can be considered a type of sabotage. However, defacing (for example, spray painting) or minor theft of materials are actions that are readily resisted by most pipeline components. If the sabotage exposure count includes vandalism events, then resistance estimates must consider the fraction of exposure events that are vandalism spray-paint-type events and therefore 100% resisted by the component.
Exposure and resistance estimates for risk assessments of failure = ‘service interruption’ similarly revolve around the definition of failure. Just as with leak/rupture assessments, a probability of damage also emerges from the service interruption assessment. See full discussion in .
This nuance—what constitutes an ‘exposure’—revolves around failure definition and also the choice of baseline resistance, which warrants further discussion.
Continuous Exposure
Unlike the discreet events measured in other time-independent failure mechanisms, some aspects of failure potential involve continuous exposure—ie, there is a constant force present that can fail the component, rather than an intermittent threatening force. A common example is a component connected to a pressure source that can create pressure in excess of the component’s capability to withstand. This is not an uncommon scenario for pipelines since they are routinely connected to wells, pumps, compressors, foreign pipelines, and other pressure sources that, at times, can be too high for the connected components. The potentially damaging pressure source does not cause damage because control and safety systems protect downstream components.
Even desirable or normal loads can be viewed as continuous exposures. Any amount of internal pressure becomes a damage potential as resistance decreases; any span can be too long for a pipe with no resistance to gravity forces (weight). Pressure as a constant exposure is generally only mitigated when excessive, since some pressure is a desirable part of operability. Intended pressure does not lead to failure only because resistance prevents it. Gravity as a constant exposure is mitigated by having uniform support and, if mitigation fails, is resisted by the bending and shear capacities of the ‘structure’.
Measuring this type of exposure appropriately in a risk assessment model requires the correct coupling of the continuous exposure with a corresponding mitigation effectiveness. A high-demand or continuous exposure requires mitigation with very high reliability. The modeling issue with continuous exposure is the choice of time units in which to express the rate of exposure. How do you express ‘continuous’? In units of events per year? Or per day? Or even per minute? Since ‘continuous’ means an infinite number of occurrences per unit time, it is difficult to capture numerically.
For purposes of modeling, any unit can be chosen, so long as the mitigation is calibrated to the same unit. The continuous exposure can be counted as one event per day, once per hour, once per minute, once per second, or even less. Any of these is appropriate as long as the corresponding mitigation—for example, the regulator or relief valve effectiveness—is measured in the same per day, per hour, per minute, etc units of reliability. For instance, choosing units of one event per second to represent continuous exposure from a high pressure connecting pipeline requires that the pressure regulating valve’s reliability be expressed in the same units—ie, failure rate for each second in service. If one exposure event per day is chosen to represent continuous, then the regulator’s reliability must also be expressed in the context of how many days between failures of such regulators to prevent overpressure.
In some estimates, the use of ‘probability of failure on demand’ estimate for a safety or control device will automatically make the exposure and mitigation units of measure equivalent. However, in the above example, the regulator’s ‘demand’ is continuous—its function is being continuously demanded—requiring attention to the units of each. Therefore, the regulator’s mitigation effectiveness—its reliability—must be expressed in similar units—failures per day, per hour, per minute, per second, or even smaller. Then, when exposure is multiplied by (1 – mitigation), the resulting PoD is appropriate.
Spans
An interesting nuance arises in a risk assessment involving spans. A span makes the component susceptible to the effects of gravity. While the exposure of ‘gravity’ has always been present, its role goes unnoticed in a fully supported pipeline segment. If an event can result in loss of support, but not failure, how is it to be modeled? Has the span created an exposure—ie, a new attack? Or is it causing the loss of some resistance to an attack (gravity) that has always been there?
This warrants some discussion. The frequencies of exposures should include all events that can damage the theoretical component. Technically, only events that cause excessive stress cause damage. So, only spans of a certain length, given pipe and contents weight, buoyancy, lateral forces, vibration potential, other stresses, etc, are events that potentially result in damage. Rigid pipe and mechanical couplers generally have less resistance to spans compared to flexible, welded systems.
The full solution is to discriminate among events that cause varying amounts of span length to the component. This involves an initial measurement of the PoF of the supported pipe in terms of continuous exposure to gravity which is fully mitigated by the uniform support, with resistance available but uninvolved so long as the mitigation is in place. PoF from gravity effects would logically be nearly 0% as long as the support remains. If any portion of the length becomes unsupported, then the mitigation against the force of gravity is zero and damage is theoretically possible at that location. Realistically, only spans of a certain minimum length can result in damage for most pipeline components. Minor spans will typically have no effect on either damage or failure potential. A few inches of span rarely causes damage to any component.
As span length increases, damages become possible and then eventually failure occurs. Assigning probability estimates to each possible span length will be challenging in many real-world applications. Furthermore, determining minimum span lengths for various damage and failure scenarios involves structural calculations that are redundant to the resistance estimations.
Therefore, a modeling choice emerges. An exposure count may include all span-producing events or only those events generating potentially damaging span lengths. The former results in an over-estimation of damage producing events, since even the insignificant spans are counted. The latter requires a pre-determination of damaging span lengths. This is not a trivial exercise since the following considerations are important: material characteristics, dimensions, contents, internal pressure, lateral forces, etc.
A simplification may be appropriate for some risk assessments. From a modeling perspective, it may be simpler to count any span-producing event as an exposure rather than pre-determine what span length is critical for each set of conditions. With a conservative assumption that any span length can cause damage, the inaccuracy that is generated is the production of a PoD that is conservatively overstated. Components that are unharmed by loss of support will show low PoF after resistance estimates are applied. However, they may show inappropriate PoD levels due to the over-counting of exposures (ie, including exposure events that can’t cause damage). Perhaps this is tolerable in exchange for modeling convenience.
As an example of this simplification: consider a soil erosion event creating a one foot span as compared to a continuously supported 12″ steel pipeline. If the erosion event is counted as an exposure (an ‘attack’) with a frequency of 0.1/year and no mitigation is provided, the model reports a 0.1 frequency of damaging events, even though damage is realistically not occurring with only a one foot span. The PoF will not be impacted by this inaccuracy in the intermediate PoD estimate. In the absence of severe weakness, the resistance prevents failure virtually 100% of the time. The resistance of the 12″ steel pipe shows that essentially none of the 0.1 spans per year will result in failure.
Longer span lengths would generally require more resistance. Since some resistance is now being used to resist gravity, some load carrying capacity may no longer be available to resist other loads. So, a third modeling approach may state a definition of exposure as only events that can produce at least, say a 20 ft span (or whatever the calculation determines is a potentially damaging span, under a set of assumed component characteristics). A related solution is to create categories of span-producing events based on the length of span potentially produced. Each is assigned an exposure frequency. Some will exceed the point where damage is possible and some will be insignificant, from a structural damage perspective. A version of this approach is to begin with an exposure frequency that captures all span-creating events and then assign fractions to create categories of longer-span events. For example, 0.3 span-creating events per mile-year are expected; 55% of those will produce spans less than 3 ft in width; 40% produce spans greater than 3 ft but less than 10 ft; and 5% produce spans greater than 10 ft in width.
Mitigation vs Resistance
Some methods of protection from mechanical damage present a rare case where mitigation and resistance become a bit blurred. A concrete coating or casing reduces the frequency of contact with the pipe steel. That is a reduction in PoD and therefore can be thought of as a mitigation. This requires that the protection be viewed as independent from the component—it is something added to the component as a protective measure. That is clear for slabs and even casings, but a coating, even concrete coating, is often viewed as part of the component, especially when used as a buoyancy control. In that case, contacting the coating counts as contacting the component. This is also influenced by the definition of ‘damage’ implicit in the PoD. Does damage to a concrete coating constitute damage to the component? This is a matter of perspective and definition. The loss of a buoyancy control feature is analogous to the challenge of modeling spans, as previously discussed.
For consistency, the sample assessments offered here consider slabs, casings, and concrete coatings to be distinct from the component and therefore best treated as mitigation measures. Under this view, the component is not damaged when only the protection is damaged. Alternative views may be more appropriate for certain risk assessment situations.
Mitigation-by-others
Because mitigations can originate at facilities not under the control of the pipeline operator, there may be both foreign (owner of the origination point of the exposure) mitigations and operator (of the segment being assessed) mitigations. For instance, the highway department and law enforcement agencies will mitigate some of the threat of vehicle impact to nearby pipelines via barriers, speed limits, road configuration, etc. An operator of nearby facilities will mitigate the potential for rupture or explosion of their facilities, reducing the exposure to the assessed component.
From the perspective of the pipeline operator, the protective measures employed by others reduce the exposure to the pipeline. These actions taken by others are additive to the protective measures installed and maintained by the pipeline operator. Since these mitigations-by-others effectively change the rate of pipeline exposures, and since it will often be difficult to assess and track changes in mitigations of non-owned facilities, it is usually more efficient to include foreign mitigations in the exposure rate estimate assigned to the non-owned facility. Otherwise, the risk assessment tends to expand into an assessment of non-owned systems. The mitigations done by others are often still important to understand and perhaps quantify, but keeping them separate from mitigations applied by the assessed component owner is a modeling convenience.
Other examples include natural mitigation measures and indirect actions taken by others. Consider traffic impact potential where trees, berms, ditches, fences, etc are de facto barriers (mitigations) to vehicle impacts. Treatment of these features as mitigation-by-others, and including their role as exposure-reducers, is the simplest approach. However, should the trees be removed or die, the ground leveled, or the fence be removed, having the rates of ‘vehicle leaves roadway’ separate from the benefits of the features would be useful.
Similarly, when water depth is sufficient to preclude anchoring, dredging, fishing, and other third-party activities as possible damage sources, damage probability to offshore components is reduced. Just as with other natural barriers, the water depth can be treated as a mitigation in the risk assessment. The fact that the water depth may also preclude certain other activities can be factored into the exposure estimate without triggering an inappropriate ‘double-counting’ effect in the risk assessment.
A general rule of thumb may be to include all features and actions not under the control of the component owner as influences to exposure rates. Actions and features that are controlled by the component operator are treated as mitigation measures. That is, if foreign, then exposure, otherwise mitigation. An exception may be cases where it is desirable to develop an argument, via cost/benefit analyses, for a change in mitigation activities, even if performed by others.
Resistance Baseline
There is an interesting interplay between exposure and resistance since both are sensitive to the exact definition of ‘failure’. Exposure measurement implicitly involves a theoretical baseline for resistance since an exposure is defined as an event that causes ‘failure’ and resistance is a measure of invulnerability to ‘failure’. So, the definition of ‘failure’ is a component of resistance, just as it is for exposure. This is again best illustrated by examples. If failure = ‘permanent deformation’, then resistance measures the invulnerability to permanent deformation, given the presence of a force (an exposure) that can cause permanent deformation if there is insufficient resistance. If failure = ‘leak/rupture’, then resistance measures the invulnerability to leak/rupture, given the presence of a force (an exposure) that can cause leak/rupture if there is insufficient resistance.
If resistance is to be measured in simple terms of percentage or fraction of mitigated exposure events that do not result in failure, there is a need to define a starting point or baseline. That baseline must be consistent with the definition of the exposure event. If the baseline is to be ‘zero resistance’ then exposure involves imagining that there is no resistance at all. A thin-walled aluminum can or cardboard tube, egg-shell vessel, etc, crushable between two fingers—is the right mental image for almost complete lack of resistance. So, the image of an unprotected beverage can or cardboard tube sitting atop the ground, is the correct image to estimate exposure event frequencies when a ‘zero resistance’ baseline is chosen. If such a can may be broken /crushed/deformed by the event, then it should be counted as an exposure.
There are obviously many more exposure events that could break an aluminum beverage can compared to a steel pipeline. So exposure counts are dramatically increased when zero resistance is assumed. As a matter of fact, the number of potentially damaging events always increases when the threshold for damage is lowered.
If the risk assessment designer feels that zero resistance results in excessive exposure counts, he can define the resistance baseline as something other than zero. For instance, he may set the resistance baseline as the fraction of exposures above ‘normal’, which do not result in failure. Then resistance is the amount of ‘extra’ stress carrying capacity once ‘normal’ loads have been accommodated. This can theoretically lead to negative values. Perhaps failure has not yet occurred in a weakened component only because the upper limits of ‘normal’ have not recently occurred. If there is not only no ‘extra’ resistance, but not even ‘sufficient’ resistance, then a negative value is warranted.
This is a modeling choice. A changing resistance baseline—potentially different for each component under varying ‘normal’ loads—may be confusing to some. On the other hand, the imagineering of a no-resistance component and the associated need to count many seemingly minor exposures might be more troublesome for others.
Exposure Influenced by Resistance
When a resistance baseline other than ‘zero resistance’ is used, exposure varies, as was suggested in the previous section. Exposure rates are sensitive to changing resistance. When material characteristics degrade or are changed, a greater number of exposure scenarios can cause failure. Examples of such material changes include:
- creation of a HAZ,
- extreme temperatures effects reducing material stress-carrying capabilities,
- UV degradation,
- Hydrogen embrittlement.
Other examples of changing resistance include metal loss by corrosion, crack progression through a component wall, unanticipated or intermittent external loadings such as debris impingement in flowing water or gravity effects when support is lost, and others.
The most robust assessment can provide for a continuous updating of exposure estimates based on changing resistance. That is, if a resistance baseline other than zero has been chosen, then the count of exposures—events that can cause failure—will increase as resistance decreases.
Similarly, when modeling time-dependent failure mechanisms like cracking, the TTF shortens when either the modeled rate of cracking increases or the effective wall thickness is reduced. If material degradation or change (for example, creation of a HAZ) causes the material toughness/brittleness to change, is that better modeled as increased crack propagation rate (ie, more exposure)? or rather as reduced effective wall thickness (ie, less resistance)? Fortunately, the suggested mathematics ensures the same result regardless of chosen approach. While either will work in the proposed PoF model, it may be more intuitive to model this as a change in effective wall thickness. That way, this potential change in a material’s property is readily seen alongside any other potential change in component strength.
As another example of the modeling choices for exposure-resistance interaction, consider the role of an expansion loop in a pipeline. If the expansion loop is present to reduce thermal stresses and fatigue, most would agree that resistance has been improved rather than exposure reduced or mitigation improved. After all, the changes in temperature still occur and the pipe is not protected from those resulting forces. Only the pipe’s reaction, its ability to absorb the forces without damage, have changed. However, a counter could be that each temperature cycle is now no longer imparting the same stresses and, hence, exposure estimates should be reduced. Again, either choice yields the same PoF under the suggested modeling approach.
Aspects such as inclusion of suspect weaknesses will always be necessary in the risk assessment. Other aspects will be discretionary. The risk assessor can decide, in the context of desired PXX and trade-offs between complexity and robustness, the optimum way to handle resistance and resistance-exposure issues such as:
- Yield vs ultimate stress levels.
- Inclusion of intermittent loadings.
- The extent of simultaneous consideration of changing resistance with loadings potentially causing exceedance of stress-carrying capability. See discussions of unanticipated spans and loss of buoyancy control features in .