journal of pipeline engineering

March, 2009 Vol.8, No.1

ScientificSurveys Ltd, UK

ClarionTechnical Publishers, USA

Journal ofPipeline Engineering

incorporatingThe Journal of Pipeline Integrity

SAMP

LE C

OPY

Journal of Pipeline Engineering

Editorial Board - 2009

Obiechina Akpachiogu, Cost Engineering Coordinator, Addax PetroleumDevelopment Nigeria, Lagos, Nigeria

Mohd Nazmi Ali Napiah, Pipeline Engineer, Petronas Gas, Segamat, MalaysiaDr Michael Beller, NDT Systems & Services AG, Stutensee, Germany

Jorge Bonnetto, Operations Vice President, TGS, Buenos Aires, ArgentinaMauricio Chequer, Tuboscope Pipeline Services, Mexico City, Mexico

Dr Andrew Cosham, Atkins Boreas, Newcastle upon Tyne, UKProf. Rudi Denys, Universiteit Gent Laboratory Soete, Gent, Belgium

Leigh Fletcher, MIAB Technology Pty Ltd, Bright, AustraliaRoger Gomez Boland, Sub-Gerente Control, Transierra SA,

Santa Cruz de la Sierra, BoliviaDaniel Hamburger, Pipeline Maintenance Manager, El Paso Eastern Pipelines,

Birmingham, AL, USAProf. Phil Hopkins, Executive Director, Penspen Ltd, Newcastle upon Tyne, UK

Michael Istre, Engineering Supervisor, Project Consulting Services,Houston, TX, USA

Dr Shawn Kenny, Memorial University of Newfoundland Faculty of Engineeringand Applied Science, St Johns, Canada

Dr Gerhard Knauf, Mannesmann Forschungsinstitut GmbH, Duisburg, GermanyLino Moreira, General Manager Development and Technology Innovation,

Petrobras Transporte SA, Rio de Janeiro, BrazilProf. Andrew Palmer, Dept of Civil Engineering National University of Singapore,

SingaporeProf. Dimitri Pavlou, Professor of Mechanical Engineering,

Technological Institute of Halkida , Halkida, GreeceDr Julia Race, School of Marine Sciences University of Newcastle,

Newcastle upon Tyne, UKDr John Smart, John Smart & Associates, Houston, TX, USA

Jan Spiekhout, NV Nederlandse Gasunie, Groningen, NetherlandsDr Nobuhisa Suzuki, JFE R&D Corporation, Kawasaki, Japan

Prof. Sviatoslav Timashev, Russian Academy of Sciences Science& Engineering Centre, Ekaterinburg, Russia

Patrick Vieth, Senior Vice President Integrity & Materials,CC Technologies, Dublin, OH, USA

Dr Joe Zhou, Technology Leader, TransCanada PipeLines Ltd, Calgary, CanadaDr Xian-Kui Zhu, Senior Research Scientist, Battelle Pipeline Technology Center,

Columbus, OH, USA

SAMP

LE C

OPY

1st Quarter, 2009 1

The Journal ofPipeline EngineeringincorporatingThe Journal of Pipeline Integrity

Volume 8, No 1 First Quarter, 2009

Contents

Peter Tuft .................................................................................................................................................................... 5The Australian approach to pipeline safety management

Dr rika S M Nicoletti and Ricardo Dias de Souza ............................................................................................... 19A practical approach in pipeline corrosion modelling: Part 1 Long-term integrity forecasting

Dr John Beavers, Patrick Vieth, and Dr Narasi Sridhar ....................................................................................... 29Ethanol transportation: status of research, and integrity management

Dr Chris Alexander .................................................................................................................................................. 35Evaluating damage to on- and offshore pipelines using data acquired using ILI

Professor Andrew Palmer and Dr Yue Qianjin ..................................................................................................... 49Rethinking laybarge pipelaying

H S Costa-Mattos, J M L Reis, R F Sampaio, and V A Perrut ............................................................................... 53Rehabilitation of corroded steel pipelines with epoxy repair systems

Assadollah Maleknejad ............................................................................................................................................. 63Technical and commercial challenges in procurement and implementation of major international pipeline projects

As part of an American Petroleum Institute study, experimental efforts were undertaken to assess the effects ofwrinkle bends on the fatigue life of pipelines, and three 36-in x 0.281-in pipes were fitted with wrinkle bends havingnominal depths of 2%, 4%, and 6% (wrinkle depth percentage calculated by dividing wrinkle depth by the nominal

diameter of the pipe). OUR COVER PICTURE shows the pipe sample with 2% wrinkles, and details of this researchare included in the paper by Dr Alexander on pages 35-47.

SAMP

LE C

OPY

The Journal of Pipeline Engineering2

1. Disclaimer: While every effort is made to check theaccuracy of the contributions published in The Journal ofPipeline Engineering, Scientific Surveys Ltd and ClarionTechnical Publishers do not accept responsibility for theviews expressed which, although made in good faith, arethose of the authors alone.

2. Copyright and photocopying: 2009 Scientific SurveysLtd and Clarion Technical Publishers. All rights reserved.No part of this publication may be reproduced, stored ortransmitted in any form or by any means without the priorpermission in writing from the copyright holder.Authorization to photocopy items for internal and personaluse is granted by the copyright holder for libraries andother users registered with their local reproduction rightsorganization. This consent does not extend to other kindsof copying such as copying for general distribution, foradvertising and promotional purposes, for creating newcollective works, or for resale. Special requests should beaddressed to Scientific Surveys Ltd, PO Box 21, BeaconsfieldHP9 1NS, UK, email: [email protected].

3. Information for subscribers: The Journal of PipelineEngineering (incorporating the Journal of Pipeline Integrity)is published four times each year. The subscription pricefor 2009 is US$350 per year (inc. airmail postage). Membersof the Professional Institute of Pipeline Engineers cansubscribe for the special rate of US$175/year (inc. airmailpostage). Subscribers receive free on-line access to all issuesof the Journal during the period of their subscription.

4. Back issues: Single issues from current and past volumes(and recent issues of the Journal of Pipeline Integrity) areavailable for US$87.50 per copy.

5. Publisher: The Journal of Pipeline Engineering ispublished by Scientific Surveys Ltd (UK) and ClarionTechnical Publishers (USA):

Scientific Surveys Ltd, PO Box 21, BeaconsfieldHP9 1NS, UKtel: +44 (0)1494 675139fax: +44 (0)1494 670155email: [email protected]: www.j-pipe-eng.com

www.pipemag.com

Editor and publisher: John Tiratsooemail: [email protected]

Clarion Technical Publishers, 3401 Louisiana,Suite 255, Houston TX 77002, USAtel: +1 713 521 5929fax: +1 713 521 9255web: www.clarion.org

Associate publisher: BJ Loweemail: [email protected]

6. ISSN 1753 2116

THE Journal of Pipeline Engineering (incorporating the Journal of Pipeline Integrity) is an independent, international,quarterly journal, devoted to the subject of promoting the science of pipeline engineering and maintaining andimproving pipeline integrity for oil, gas, and products pipelines. The editorial content is original papers on all aspectsof the subject. Papers sent to the Journal should not be submitted elsewhere while under editorial consideration.

Authors wishing to submit papers should send them to the Editor, The Journal of Pipeline Engineering, PO Box 21,Beaconsfield, HP9 1NS, UK or to Clarion Technical Publishers, 3401 Louisiana, Suite 255, Houston, TX 77002, USA.

Instructions for authors are available on request: please contact the Editor at the address given below. All contributionswill be reviewed for technical content and general presentation.

The Journal of Pipeline Engineering aims to publish papers of quality within six months of manuscript acceptance.

Notes

v v v

www.j-pipe-eng.comwent live on 1 September 2008

SAMP

LE C

OPY

1st Quarter, 2009 3

Editorial

THE NEWLY-published report from Chatham Houseentitled Transit troubles pipelines as a source of conflict*raises a number of interesting and important issues, and isworth studying in detail, and can be downloaded from thereference below. We are pleased to have the agreement ofthe reports author, Professor Paul Stevens, to publish thereports summary; a brief biography for him appears at theend of this article, from which it will be seen that he iseminently well-placed to be a commentator in this area ofthe pipeline industry, where engineering and politics eithermeet or clash, depending on the viewpoint.

RECENT EVENTS between Russia and Ukraine at the start of 2009, and Russia and Georgia in2008, have brought transit pipelines back into the mediaspotlight. Any reading of the history of transit oil and gaspipelines suggests a tendency to produce conflict anddisagreement, often resulting in the cessation of throughput,sometimes for a short period and sometimes for longer. Itis tempting to attribute this to bad political relationsbetween neighbours. This is certainly part of the story, butalso important is the nature of the transit terms tariffsand offtake terms whereby transit countries are rewardedfor allowing transit. Put simply, the trouble with transitpipelines has a significant economic basis. The reportaddresses three questions:

Why will oil and gas transit pipelines become moreimportant to global energy markets in the future?

Why has the history of such pipelines been litteredwith conflict between the various parties?

What might be done to improve this record in thefuture and make transit pipelines less troublesome?

Chapter 1 defines transit pipelines as lines which crossanothers sovereign territory to get the oil or gas to market.Such lines have a number of relevant, commoncharacteristics which tend to generate conflict. Differentparties are involved, each with different interests andmotivations. This invites disagreement between the partiesbecause of the benefits to be shared and the fact thatmechanisms exist to: encourage one or other party to seek

a greater share. Even though this would apply to anycommercial transaction, the key difference with transitpipelines is that there is no overarching jurisdiction. Moretransit pipelines will be needed in the future, since oil andgas reserves close to market are being depleted, and there isgrowing demand for natural gas in the worlds primaryenergy mix. In recent years, there has been a noticeablefragmentation of legal jurisdictions as the Soviet Unionand former Yugoslavia both collapsed. Many of the newtransit pipeline projects being discussed are essentially theresult of gaming strategies between the various players andwill fail to materialize.

Chapter 2 starts with a brief history of the many transitpipelines which have been associated with very negativeexperiences. In the past, they included those operating inthe Middle East; more recently, attention has been focusedon those in the former Soviet Union. The chapter thendescribes lines which can be viewed either as success storiesor as having too recent a history for the outcome to bedetermined. This history helps in identifying whichcharacteristics make for good and bad transit countries.These include:

the importance of foreign direct investment in thetransit countrys development strategy;

the importance of the transit fee in the countrysmacro economy;

the dependence upon offtake from the line; the availability of alternative routes; whether the transit country is also an oil or gas

exporter in its own right.

Chapter 3 seeks explanations for poor performance interms of politics but with the main discussion focusing onthe underlying economics which generate conflict. Oneobvious source of political disputes is a history of badrelations between neighbouring countries. As for theeconomics, the key explanation is that there is no reasonable,objective basis for determining transit terms. The onlysensible reason for the existence of a transit fee is to allowthe transit country to share in the benefits of the project.This share will reflect the relative bargaining power of theparties to the negotiations. Over time this changes and thusthere are always pressures to change the transit terms. This

*Transit troubles: pipelines as a source of conflict. Prof. Paul Stevens,2009. A Chatham House Report see www.chathamhouse.org.uk.

Pipelines as a source of conflict

SAMP

LE C

OPY


trend is greatly encouraged by the existence of theobsolescing bargain, the structure of pipeline costs, andthe growing volatility of oil and gas prices.

Chapter 4 considers possible solutions to help reduceconflict and supply disruptions. These include:

a military solution; encouraging the transit country into the global

economy to make it dependent upon foreign directinvestment;

making the transit country dependent upon its owngas and oil supplies from the pipeline, although thiscan be a double-edged sword;

considering alternatives to the transit country notonly in terms of geographic routes but (for gas) theactual means of transport including, for example,the use of liquefied natural gas (LNG);

encouraging multilateral jurisdictional solutionssuch as the Energy Charter Treaty;

developing mutual dependence between the transitcountry and the producer/consumer country.

Finally, the report considers a new solution: basing thetransit terms on a progressive fiscal arrangement similarto the sort of systems which govern upstream oil agreements.The report concludes that there will be an increasing needfor and dependence upon oil and gas transit pipelines butsuch pipelines are inherently unstable because of politicaldisputes and also, of equal importance, as a result ofcommercial disputes over the transit terms. Thesecommercial disputes arise because there is no objective,reasonable or fair way of setting the transit terms. Many ofthe apparent solutions to this problem are, on closerexamination, at best ineffective, at least in currentcircumstances. More generally, history suggests that a goodexperience with transit pipelines requires certain best-practice conditions to be met. These include:

a clear definition and acceptance of the rules; projects driven by commercial considerations; credible threats to deter the obsolescing bargain; mechanisms to create a balance of interest.

However, it is difficult to turn this wish list into a practicalagenda. The only practical, realistic solution in the nearterm is to introduce progressive transit terms to existingand new agreements. However, ultimately both consumersand producers must diversify as far as is economicallypractical.

Professor Paul Stevens is Senior Research Fellow for Energy atChatham House, Emeritus Professor at Dundee University andConsulting Professor at Stanford University. He was educated asan economist and as a specialist on the Middle East at CambridgeUniversity and the School of Oriental and African Studies,London. He taught at the American University of Beirut inLebanon (197379), interspersed with two years as an oilconsultant; at the University of Surrey as lecturer and senior

lecturer in economics (197993); and as Professor of PetroleumPolicy and Economics at the Centre for Energy, Petroleum andMineral Law and Policy, University of Dundee (19932008) a chair created by BP.

US companies explore ethanolpipeline through US Midwest

TWO MAJOR US pipeline companies have announcedtheir plans to assess the feasibility of constructing anethanol pipeline through the Midwest. If built, the pipelinewould the first one totally dedicated to transporting ethanolin the US. Oklahoma-based Magellan Midstream Partnersand Pennsylvania-based Buckeye Partners have partneredto explore creating the 2720-km long pipeline to transportethanol from plants in Illinois, Iowa, Minnesota, andSouth Dakota to major cities including Pittsburgh,Philadelphia, and New York. The project is estimated tocost more than $3bn.

The American Coalition for Ethanols 2007 report listsIllinois as the second largest producer of ethanol in the US,at 317m gall/yr, and corn grown in Illinois is used toproduce 40% of the ethanol consumed in the US, accordingto the Illinois Corn Growers Association (ICGA). Nearlyone-third of all gasoline in the US already contains lowlevels of ethanol usually between 5.7% and 10%, and theICGA reports that 95% of the gasoline sold in the Chicagoarea contains 10% ethanol. However, high levels of ethanolcannot be piped through existing gasoline lines withoutdamaging them. Once ethanol has been transported throughexisting pipelines, they cant be shared with other refinedproducts. In pipelines today, you can ship differentmaterials through in batches, with plugs that separate theshipments. However, ethanol because it absorbs water,and is a corrosive agent is really difficult to use in a non-dedicated pipeline, John Urbanchuk, the director ofexpert-resources firm LECG, said.

Magellan and Buckeye may be years away from construction,simply because not much is known about transportingethanol through pipelines. Studies on the technical issuesand economic impact of creating an ethanol pipeline arecontinuing, as highlighted in Dr John Beaver et al.s paperon pages 29-34; no ethanol pipelines exist in the US,though Brazil is in the process of constructing one andHouston-based Kinder Morgan is understood to haveannounced plans to test an ethanol pipeline in Florida thisyear.

Changing the way ethanol is transported may have more ofan effect on consumer costs than adopting alternate fuelsor even falling oil prices. If you looked at something inIllinois or maybe Iowa, sending it to the East Coast byfreight is anywhere between 16 and 18 cents a gallon. If you

concluded on p61

SAMP

LE C

OPY

1st Quarter, 2009 5

The Australian pipeline industryTransmission pipelines in Australia are often long but ofrelatively-small diameter (maximum 34in, typically 12-18in).They traverse vast lengths of remote and sparsely-populatedcountry, but there are also substantial lengths in semi-ruralareas and urban outskirts, and some within urban areas.There is a growing problem of urban encroachment onpipelines originally constructed in rural locations. MostAustralian pipelines are relatively young (80% built since1975) and therefore in reasonably good condition as aresult of being designed and built to modern practices andwith modern coatings, as well as having had limited time todeteriorate.

The Australian pipeline industry is relatively small byglobal standards. The total length of high pressuretransmission pipelines is just under 30,000km, and thereare only a handful of major pipeline operating companies.Nevertheless the industry is quite large enough to bevigorous and to support a healthy population of specialistpipeline engineers. Some of the larger Australian pipelineconstruction and engineering service companies havesuccessful export businesses with projects in diverse locationsaround the world.

The Australian Pipeline Industry Association (APIA)sponsors an active research programme and has a co-operative research agreement with PRCI in North Americaand EPRG in Europe; the most recent tripartite JointTechnical Meeting was held in Canberra in 2007.Also well supported by APIA is Standards AustraliaCommittee ME38, responsible for AS 2885. This committeehas been active in developing standards for pipeline design/construction, welding, operation, and pressure testing.The committee and its working groups includerepresentatives from all sectors of the industry as well thetechnical regulators from each state, and has been responsive

Authors contact details:tel: +61 2 9983 1511email: [email protected]

This paper was presented as part of the proceedings of the 7th InternationalPipeline Conference IPC 2008 held in Calgary on 29 September 3 October, 2008, and organized by the ASMEs Pipeline SystemsDivision. It is published here by kind permission of ASME.

The Australian approach topipeline safety management

by Peter TuftPeter Tuft & Associates, West Pymble, NSW, Australia

THE AUSTRALIAN APPROACH to management of pipeline safety and risk differs from that used in mostother parts of the world: there is a strong focus on identifying causes of failure and designing againstthem using a cause/control model of risk management, and little use of quantitative risk assessment.

Oil and gas pipelines in Australia are designed, constructed, and operated in accordance with AS 2885. Sincea major revision in 1997, this has been a risk-based standard. While it does contain numerous design rules,their application is flexible and to some extent dependent on the outcomes of a mandatory safetymanagement study. Key elements of the standard include separation of wall thickness selection frompressure design factor, mandatory protection against external interference, special requirements for high-consequence areas, and a safety management study process including qualitative assessment of residualrisks.

The AS 2885 process has been shown to be workable and effective :. It results in a design which is optimizedfor safety at every point along the pipeline while not incurring costs for features that do not reduce risk.The process is oriented principally to design of new pipelines, but is equally applicable to management ofolder pipelines which are suffering degradation or subject to changed conditions such as urban encroachment.

SAMP

LE C

OPY


in meeting the needs of both groups. The industry andregulatory representatives have a very co-operative approachand opinions diverge only on peripheral issues. The APIAresearch programme includes a number of projects initiatedin response to the needs of the ME38 committee and theresearch outcomes are incorporated in new revisions ofstandards.

The considerable distances and small loads in Australiacreate economic pressure to minimize pipeline costs, whichprovides a driver for technical innovation. The unifiedapproach of the APIA and the ME38 committee providesthe means by which innovation can be relatively quicklyincorporated into standards and applied to new and existingpipelines.

Basis for AS 2885Prior to 1997, AS 2885 and its precedent standards hadbeen developed from the ASME/ANSI B31.4 and B31.8codes, although considerable differences from those codeshad evolved over time. In preparation for the 1997 revision,the code committee recognized that, despite the bestintentions, a rigid rule-based code would often producedesigns that were less than optimum in terms of safety,economics, or both. There was particular concern aboutanomalies that arose from the rule-based approach atboundaries between different location classes (reflectingpopulation density, often defined in a very arbitrary way),and also with the way that the rules handled changes inpopulation density as a result of urban growth.

AS 2885, of course, still includes many rules. However,they are more flexible than previously, and the overridingrequirement is to assess risks and ensure that they are

satisfactorily controlled by any means that are appropriaterather than by application of a narrow set of fixed rules.

A fundamental aspect of the standard is the safetymanagement study (SMS), described in more detail later inthis paper. Virtually all aspects of the design must bereviewed through the SMS. While this may appear onerous,it is the route to flexibility in the application of rules so thatthe design can be optimized for safety.

The SMS includes a qualitative risk review process, with theobjective of identifying threats which may cause failure andensuring that they are managed so that the residual risk istolerable. The intention is that safety and risk managementshould be done by the engineers responsible for the designand operation of the pipeline, rather than being outsourcedto risk specialists. Pipeline engineering and risk managementshould be integrated, and a corollary of this is thatengineering and risk management form an iterative process;the design and operating procedures affect the risk profile,and treatment of risk feeds back to the design andprocedures. Since pipeline design and operation aregenerally not complex processes, it is eminently sensiblethat this loop be contained entirely within the small teamresponsible for pipeline engineering.

Risk specialists have an occasional role in providing technicalanalysis of the consequences of a pipeline failure (forunusual cases where the standardised approach is notapplicable), and also for those few cases where quantitativerisk assessment may be required.

There is little use of quantitative risk assessment (QRA) inthe analysis of Australian pipelines. Attempts have beenmade to use statistically-based QRA, but for such methodsto produce realistic results they must be based on defensible

Fig.1. The Australian pipeline network.

SAMP

LE C

OPY

1st Quarter, 2009 7

failure rates. The Australian pipeline incident record is toosparse for meaningful data to be extracted. There are lessthan 200 recorded pipeline incidents in the APIA database,and only a small fraction of these involve loss of containment.This is far too little from which to develop average failurerates which account for the range of parameters that canaffect pipeline failure (wall thickness, depth of cover, andlocation class, to nominate just three that are most critical).Some QRA studies have been done based on UK and/orEuropean statistical failure-rate data, notwithstanding thatthat the pipeline may be in the remote outback, and theresulting predicted failure rates have been one or twoorders of magnitude higher than the overall averageAustralian failure rate (which includes the higher rate ofincidents from more populated areas).

Such misuse of QRA methods has done much to damagetheir credibility in the Australian pipeline industry, whichis unfortunate because there are applications of quantitativemethods that are valid and useful. In particular, modernreliability-based quantitative methods have considerablepotential but have not yet been adopted. AS 2885acknowledges that QRA potentially has a role in assistingthe evaluation of risk-treatment alternatives, to permitcomparison of the risk-reduction benefits of various options.Statistical QRA may also have a role in assessing the risksassociated with pipeline facilities which comprise standardprocess plant components and can therefore call on theextensive process plant failure data.

A tacit feature of the AS 2885 principles is that whilepipeline safety is the overriding priority and cannot becompromised, there is also flexibility to avoid incurringcosts that do not add any safety benefit. The optimizationof both safety and cost is a recurring theme in this paper.

External interference protectionDamage by external forces is a major contributor to pipelineincidents worldwide, but is particularly dominant inAustralia where it accounts for at least 80% of all incidents.

(This is not because the external damage rate is unusuallyhigh, but because the relatively-young age of Australianpipelines means that to date they have experienced only afew corrosion-related failures.) Also, Australian pipelinestend to be thin-walled because of the relatively-smalldiameters and high-grade steels used, and this makes themmore vulnerable to loss of containment should seriousexternal damage occur.

For these reasons AS 2885 places considerable emphasis onexternal interference protection (EIP). There are mandatoryrequirements for both physical and procedural protectivemeasures, and these must be appropriate to the level ofthreat that is identified:

A pipeline shall be designed so that multipleindependent physical controls and proceduralcontrols are implemented to prevent failure fromexternal interference by identified threats.

The purpose of physical controls is to preventfailure resulting from an identified externalinterference event by either physically preventingcontact with the pipe, or by providing adequateresistance to penetration in the pipe itself.

The purpose of procedural controls is to minimisethe likelihood of external interference activity, withpotential to damage a pipeline, occurring withoutthe knowledge of the pipeline operator, and tomaximise the likelihood of people undertakingsuch activity being aware both of the presence of thepipeline and the possible consequences of damagingit. (Clause 5.5.1)

The standard requires that all practicable controls beapplied, with a minimum of one physical measure in rurallocations and two in urban locations, and always a minimumof two procedural measures (see Table 1). There isconsiderable detail in the standard on the minimumrequirements for each type of control to be consideredeffective. The overall effectiveness of the external

0.13

0.015

0.22

0.3

0.12

0.6

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

Australia, AllIncidents

Australia,LOC

Europe GasLOC

Europe OilLOC

USA Gas LOC USA Oil LOC

Inci

dent

rate

, per

100

0 km

-yr

LOC = Loss of Containment

Australian data for 86- 03Europe data for '97-'01USA data for '98-'02

Europe & US data fromW. Guijt, O&GJ, Jan 26 '04

Fig.2. Comparison of Australian andnon-Australian data.

SAMP

LE C

OPY


interference protection design must be reviewed as part ofthe safety management study.

Penetration resistanceThe last line of defence against loss of containment causedby external damage is the resistance of the pipe itself topenetration, and for this reason AS 2885 gives considerableattention to penetration resistance as a physical protectionmeasure. Emphasis to date has been on resistance toexcavators, given both their ubiquity and the state ofknowledge, but it is recognized that other equipment such as boring rigs can also pose a significant threat.

APIA sponsored research to determine the relationshipsbetween penetration force, pipe properties (grade, wallthickness), and excavator parameters (tooth dimensions,bucket force, excavator mass). (Previous work had beendone by others, particularly in Europe, but was not directlyapplicable to typical thin-walled Australian pipelines.) Itwas found that for a given pipe and tool dimensions thereis excellent agreement between experimental and finite-element results for the force required to penetrate, but ofcourse some variability enters the relationship betweenmachine size and bucket force capability. Nevertheless the

resulting relationships are quite adequate for estimatingthe maximum size of excavator capable of penetrating anygiven pipe, and these formulae have been incorporated inAS 2885.

Because there is huge uncertainty about the actual impactconditions the equations include an empirical parameterbased on limited full-scale field trials. Adjustment of theparameter permits calculation of an upper-bound value(penetration quite likely) and lower-bound value(penetration not credible) for the size of excavator that mayresult in puncture.

AS 2885 mandates penetration resistance as a physicalprotection measure in the higher location classes. It isoptional in rural areas, but the standard expects that thepenetration resistance calculations will always be done inorder to provide reference data that can be used in the SMSfor assessing failure mode and consequences.

A key feature of the design for penetration resistance is thatit is divorced from the pressure design factor. Pipeline wallthickness has traditionally been based on a pressure designfactor of 0.72 in remote areas, with progressively-lowerdesign factors as population density increases. However fora pipeline of small diameter and low pressure rating even a

Table 1. Physical and proceduralcontrols (from AS 2885).

Fig.3. An illustration ofa situation where

penetration resistanceis the governing

influence.

slortnoclacisyhP

noitarapeS

lairuB)gnicnef.g.e(noisulcxE

dnuorg-evobanarofreirrabhsarcelcihev.g.e(reirraB)noitcesepip

noitartenepotecnatsiseR ssenkcihtllaW )tnemesacnerobalsetercnoc.g.e(reirrabnoitarteneP

slortnoclarudecorP

ssenerawaenilepiP

lacol(seitrapdrihtdnasrenwodnalhtiwnosiaiL)cte,seitilitu,tnemnrevog

margorpssenerawaytinummoC)"giDuoYerofeBlaiD"(ecivresllac-enO

dnasngisgninraw(gnikramenilepiP)epatrekramdeirub

srodirrocderahsfosresurehtohtiwstnemeergA

noitcetedecnerefretnilanretxEgnillortaP

senoznoitacifitongninnalPnoitcetednoisurtnietomeR

Allowances (corrosion etc)

Penet

ration

resi

stan

ce

"No

ruptu

re"

Oth

ers

as p

er

Cla

use

5.4

.2

Hyd

rost

atic

te

stin

g

Const

ruct

abili

ty

Req

uir

ed

WT

Manufacturing tolerance (seamless pipe only)

Inte

rnal

pre

ssure

No

min

al W

T

SAMP

LE C

OPY

1st Quarter, 2009 9

design factor as low as 0.4 will yield a wall thickness that canbe penetrated by a backhoe. Conversely, at the maximumdesign factor of 0.72 a pipeline of large diameter and highpressure rating will have a wall thickness that cannot bepenetrated by a machine of any size, so imposing a lowdesign factor adds very considerable cost without anysignificant improvement in the risk of failure due toexternal interference. By separating the design for internalpressure from the design for penetration resistance, theoverall pipeline can be optimized for both safety and cost.

Wall thicknessAS 2885 explicitly de-couples wall thickness determinationfrom the traditional location class/design factor formula. Itspecifies that the required in-service wall thickness at eachlocation along the pipeline shall be the greatest of thethicknesses required by whichever of the following factorsare applicable at that location:

pressure containment penetration resistance no rupture (discussed later) other stress and strain criteria control of fast-running fracture special construction (such as bridges) vehicle loads at road and rail crossings mitigation of stress-corrosion cracking fatigue life external pressure

The design factor for pressure containment is independentof the location classification. Failure modes other than

overpressure are addressed explicitly through considerationof the other factors influencing wall thickness. Hence inprinciple it is acceptable to operate a pipeline at 72% or80% SMYS in an urban area if the wall thickness can meetall the other requirements without any increase above thatfor pressure containment. The SMS provides a thoroughreview of these issues before a design is finalized

Figure 3 (simplified from the Standard) illustrates oneexample of how this approach is applied in a case wherepenetration resistance happens to be the governinginfluence. The intent of this approach is again the principlethat the design can be optimized for both safety and cost ateach point along the pipeline route.

Location classificationVirtually all pipeline codes use some concept of locationclassification to identify areas where the risks both to andfrom a pipeline are increased by higher population density.AS 2885 is no different, but has refined the concept in twoways and also applies it quite differently.

Firstly, location classification is based on the area thatwould be seriously affected by an ignited full-bore rupture.Location classes are determined from the land use (as aproxy for population density) within a radiation contour of4.7kW/m2 (1500BTU/hr.ft2). This is the generally-acceptedradiation level at which an unprotected person will suffersecond degree burns after 30s exposure. It will vary with thediameter and MAOP of the pipeline and, in principle,could be calculated for each pipeline on the basis of releaserate and flame radiation correlations. However for most gas

1R sgnillewddetalosiylnohtiwdnaldepolevednurolarur-larurdaorB

2R ah5-1yllacipytaerafoskcolbecnediser-elgnis-laitnediserlaruR

1T erutcurtsarfnidetaicossadnanabrubus-laitnediseR sertnecgnippohsllamssahcus

2T fosrebmunegralroyerots-itlumyltnanimoderp-ytisnedhgiH )sertnecliaterrojam.g.e(tneserpelpoep

S cte,sliaj,slatipsoh,sloohcs-evitisneS 2TottnelaviuqE

I selasrac,yrtsudnithgil-lairtsudnI cte,sdray 1TottnelaviuqE

IH royvaeh-lairtsudnIyvaeH seirtsudnisuodrazahfirettal,2Tot2RmorfseiraVetalacseyamtnedicnienilepip

CIC

-rodirroCerutcurtsarfnInommoCsahcussecivresrehtohtiwderahs

daehrevorodeirubdnatropsnartseitilitu

dnanosiailotnoitnettaralucitraPniseitraprehtohtiwstnemeerga

rodirroc

S doolfdnasgnissorcretaw-degrembuS snialp ngisedlaicepS

Table 2 (above). Primary location classes (from AS 2885).

Table 3 (below). Secondary location classes (from AS 2885).

SAMP

LE C

OPY


pipelines the calculation can be standardized to the extentthat it can be simply read from graphs provided in thestandard. (In fact for gas pipelines with the commonMAOP of 10.2MPa there is an even-simpler rule of thumb:the 4.7kW/m2 radiation contour in metres is equal to thepipe diameter in millimetres 300m for a DN 300 pipeline.)

Basing location classification on the actual worst-caseradiation damage permits the pipeline design to berealistically optimized for both safety and cost. The use ofthe full-bore rupture radiation distance still applies evenfor a no rupture design (see below), because it is thepossibility of serious impacts on surrounding people thatgives rise to the no rupture requirement in the first place.

AS 2885 defines four primary location classes, summarizedin Table 2 (using very abbreviated definitions). There is aninevitable element of subjectivity in the allocation of locationclass in borderline areas. However this matters little, giventhe nature of the SMS process outlined later and theflexible approach to achieving an adequate level of safety.

A second refinement of the location classification system isthe addition of five secondary location classes to highlightspecial features that may not be adequately identified by theprimary location classification, as shown in Table 3.

As has already been made clear, AS 2885 does not directlylink wall thickness to location class. Location class isinstead used to adjust certain requirements of the safety-management system. In particular there are higher demandsfor external interference protection in higher locationclasses, and special requirements for high-consequenceareas.

High-consequence areasAS 2885 uses the concept of high-consequence areas,although the definition and approach differ from those inthe USA. A high-consequence area is formally defined as alocation where pipeline failure can be expected to result inmultiple fatalities or significant environmental damage.In practical terms this includes (but is not necessarilylimited to) residential, high-density, sensitive, and industriallocation classes.

For a new pipeline there are two requirements that must bemet in order to limit the consequences of any failure(Clause 4.7):

No rupture The pipeline shall be designed suchthat rupture is not a credible failure mode.

Maximum discharge rate ... the maximumdischarge rate shall not exceed 10GJ/s in residential,industrial and sensitive locations, or 1GJ/s in high-density locations. (This brief extract omits otherqualifying requirements.)

For existing pipelines there are other requirements to beapplied when the location class changes as a result of urbandevelopment.

No rupture

The no-rupture requirement can be achieved by either oftwo means. Firstly, the hoop stress may be limited to lessthan 30% SMYS (the approximate level at which there isinsufficient elastic energy in the pipe for any defect topropagate); for some pipelines this may lead touneconomically-large wall thickness. Alternatively, throughthe SMS, the largest credible threat to the pipeline must beidentified, the resulting maximum defect length determined,and the linepipe selected so that the critical defect length(above which the pipe will rupture) is at least 150% of thismaximum hole size. Detailed guidance is provided for thecalculations.

For example, a pipeline of DN 450 (18in NB) and 6.8mm(0.268in) wall thickness in X70 steel operating at 10.2MPa(1480psi) has a critical defect length of 64mm (hoop stress72% SMYS). In a suburban area it is plausible to expect thatthe largest excavation machinery would not exceed 30t,and such a machine fitted with sharply-pointed penetrationteeth is capable of penetrating this pipe. The resulting holefrom the penetration tooth would be around 70mm long,which exceeds the critical defect length, and thus rupturewould be possible. Hence this pipe is not acceptable in ahigh-consequence area. If the wall thickness is increased to9.8mm, the same machine can no longer penetrate at all, sono rupture is achieved although the hoop stress is stillwell above 30% SMYS. Clearly this design process dependson the threats that apply to the particular pipeline and theconclusion from this example is not generally applicable(for example, there has been no consideration here of thethreats posed by boring machines).

Discharge rate limit

The limitations on discharge rate were derived from genericQRA studies for suburban and high-density areas. Thesestudies determined the magnitude of the largest ignited gasrelease that would fall within tolerable criteria for societalrisk.

The rate of discharge from a punctured pipeline dependsmainly on the size of hole and the operating pressure, sothese are the only parameters that the design engineer canadjust in order to comply with the limits. Even the scope foradjustment of wall thickness is quite constrained becausepenetration by excavators is largely a binary outcome agiven machine will either penetrate or it wont, and if itdoes penetrate then, to a first approximation, the hole sizeis unaffected by the wall thickness. So the options are toeither:

increase wall thickness until penetration by thelargest identified threat is not possible, or

SAMP

LE C

OPY

1st Quarter, 2009 11

reduce the maximum allowable operating pressureuntil the discharge rate from the largest crediblehole is within the specified limit.

Table 4 shows, as an indication, the hole sizes correspondingto the specified discharge rates for two illustrative operatingpressures.

Change of location class

Clearly the no-rupture and discharge-rate limitationscannot easily be applied retrospectively to existing pipelines,particularly those which are affected by urbanencroachment. However in order to maintain consistencyand integrity in the approach to pipeline safety management,the committee revising AS 2885 felt it was necessary tointroduce a requirement that goes as far as possible towardsachieving equivalent results.

These requirements for changed location class are bestsummarized by quoting almost in full:

Where land use ... changes along the route ofexisting pipelines to permit ... [high consequenceareas] in areas where these uses were previouslyprohibited, ... [it] shall be demonstrated that therisk from a loss of containment involving rupture isALARP [As Low As Reasonably Practicable].

This assessment shall include analysis of at least thealternatives of the following:

(a) MAOP reduction (to a level where ruptureis non-credible).

(b) Pipe replacement (with no rupture pipe).(c) Pipeline relocation (to a location where the

consequence is eliminated).(d) Modification of land use (to separate the

people from the pipeline).(e) Implementing physical and procedural

protection measures that are effective incontrolling threats capable of causing ruptureof the pipeline.

For the selected solution, the assessment shalldemonstrate that the cost of the risk reductionmeasures provided by alternative solutions is grossly

disproportionate to the benefit gained from thereduced risk that could result from implementingany of the alternatives. (Clause 4.7.4, emphasisadded.)

The list of alternatives to be considered indicates that theassessment of risk level and the determination of ALARPis to be taken very seriously. This is one situation whereQRA studies may be of some value in helping withcomparison of the alternatives; even if the absolute valuesof the quantitative risk predictions are questionable, theremay be much use in their comparative rankings, to beassessed alongside the cost of each alternative.

Safety managementstudy process

As noted previously, a formal safety management study is afundamental requirement for any pipeline designed to AS2885. Overall pipeline safety review is essentially a two-stepprocess:

Design review: identify every potential threat to theintegrity of the pipeline, and if possible apply controlsso that failure as a result of that threat has beenremoved for all practical purposes.

Risk assessment: rank any remaining threats thatare not fully mitigated, and ensure that the residualrisk is reduced to a tolerable level.

The intention, and general experience, is that the vastmajority of threats are eliminated by application of controlsat the design review stage and only a small number progressto risk assessment.

While the SMS process is defined in terms of pipelinedesign, it is equally applicable (and mandated) for regularreview of existing pipelines.

Threat identification

A threat is any activity or condition that can adverselyaffect the pipeline if not adequately controlled. Identifyingthreats is conceptually similar to a HAZOP, although not

aPM2.01)isp0541(

aPM7.2)isp004(

s/JG1 mm54 mm09

s/JG01 mm541 *mm082

senilepipynamroferutpurerob-llufylevitceffE*Table 4. Hole sizes corresponding to discharge rates fortwo operating pressures

SAMP

LE C

OPY


as formally structured. It helps to have very experiencedpeople involved, and it also helps to use checklists. Mostimportantly, it helps to think laterally about anything thatmight go wrong. Even threats that are believed to be alreadymitigated should be included in the documentation, partlybecause it may lead to identification of weaknesses in theexisting mitigation, and partly because it forms a soundbasis for the safety and operating plan (which is mandatedby AS 2855).

A checklist of potential threat types may include over 100items, ranging from all sorts of external interference events,through a wide range of defects in design, materials, andconstruction, through to diverse mishaps involvingcorrosion, natural events, and operations and maintenance.

It is fundamental that a threat exists at a location; sometimesthat location may be the entire pipeline and the threat isconsidered to be non-location-specific (such as corrosion,some design defects, etc). However, the great majority ofthreats are associated with activities or events that occur ata particular location along the pipeline route. This may bea single point, such as threats associated with roadmaintenance at a road crossing, or may be more extended,such as threats associated with logging activities in a forest.

Identifying external interference threats requires particularattention, including real data from the field. Field personnelinvolved in landowner liaison and pipeline patrol areinvaluable aids, to the extent that an SMS that does notinclude their input is seriously devalued. Such people canprovide details of the type and size of excavation machinerylikely to be used at every point along the route (forconsideration in the context of penetration resistance),and can often provide background information on otherthreat types as well.

Gathering this information may appear onerous, but withadequate planning and support (such as a brief land usersurvey form) good field personnel can acquire it in thecourse of their ordinary duties. An additional benefit ofgathering the real data is that the maximum equipmentused is not uncommonly found to be rather smaller than

office-based engineers may have guessed (although justsometimes the opposite occurs, which is an equally-compelling reason for gathering the data).

For a new pipeline it is also vital to consider the design forfuture land use, and hence liaison with the local governmentor other planning authority is necessary.

Threat control

Control of external interference threats has already beendiscussed. For other threats, appropriate controls must beput in place, and these may range from standard corrosion-control measures to quality-assurance procedures for design,manufacturing, and construction.

In all cases, the key question to be asked is are the controlssufficient to prevent failure as a result of the identifiedthreat? This may appear to be subjective, but there isusually a definitive answer if there is a clear understandingof the identified threat and the controls. (Of course,another threat that may require consideration is failure ofthe controls, but that can be addressed as a separate threatin its own right.) Once sufficient controls are in place, thethreat is accepted and requires no further consideration,other than ensuring that the controls are documented andimplemented.

Threats which cannot be controlled by the application ofexternal interference protection and other design measuresbecome hazardous events which required risk assessment.

Risk assessment

The risk-assessment phase involves qualitative estimationof the likelihood and consequences of failure leading to aranking of risk on a scale of extreme, high, intermediate,low, or negligible. Extreme and high risks are intolerableand must be reduced (but they are also very uncommon ifthe pipeline is well designed in the first place). Intermediaterisks are acceptable only if formally shown to be ALARP(discussed below).

RISKASSESSMENT

DESIGN REVIEWReview ControlsFailure?

LowHigh

Consequences & LikelihoodYes

Accepted Design

No

Yes

Intermediate

ALARP?No

Initial DesignIdentify Threats

Fig.4. The SMS process.

SAMP

LE C

OPY


Risks are ranked according to a standard frequency/severityrisk matrix (see Appendix 1), which includes considerableguidance on the ratings for likelihood and severity.

Severity of a failure is most commonly assessed in terms ofthermal radiation effects on people, assuming that any lossof containment will ignite. Given the basis for the locationclassification described previously it is usuallystraightforward to make this type of qualitative assessment.Consideration is also required for the effects of a failure onthe environment and continuity of supply.

As low as reasonably practicable (ALARP)

The concept of ALARP is the basis for determining whethera risk ranked intermediate can be tolerated. ALARPmeans the cost of further risk reduction measures is grosslydisproportionate to the benefit gained from the reducedrisk that would result. (definition, Clause 1.5.3). In practicalterms ALARP can be assessed by asking:

what else can we do to reduce risk? (adjust the route,for instance)

why havent we done it?

ALARP is achieved when either the answer to the firstquestion is nothing or the answer to the second isbecause the cost is grossly disproportionate.

SMS implementationThe phases of an SMS are:

initial design (for new pipelines only) data gathering, discussed under threat identification

(above) desktop design review (pre-analysis for workshop) validation workshop(s) involving all stakeholders

The workshop is mandated by AS 2885; for a major project,the workshop may take a week. A workshop on a singlemajor encroachment problem for an existing pipeline mayoccupy a full day.

The great value of a workshop is that it generates synergiesfrom the interaction of a diverse group of stakeholders,identifying both threats and solutions that would not beapparent to an individual working alone. It also providesconsensus and buy-in from all participants. The value of aworkshop is demonstrated by the observation that nomatter how well the engineering and risk team think theyhave prepared, the workshop will always produce newissues. There is a clear analogy with a HAZOP meeting.Stakeholders who should attend the workshop includedesign engineers, operations management, field personnel(land agents, patrol officers, etc.), construction management,relevant technical specialists (involved in corrosion,materials, etc., and possibly part-time), relevant outside

parties (including major landowners, developers, alsopossibly part-time), owners representatives, and thetechnical regulator or other government representatives.

The SMS process is defined in Part 1 of AS 2885 (Designand Construction) but Part 3 (Operation) mandates that itbe reviewed every five years, or more frequently if there isa change in circumstances surrounding the pipeline (suchas a proposed development nearby). This means that forpractical purposes the SMS remains live for the life of thepipeline. It is of course mandatory that all SMS deliberationsbe recorded in full, and because it is live it is desirable forthe documentation to be readily updated.

A database is the preferred means of recording the threats,controls, risk evaluation, and risk treatments. Anappropriately structured database can also record andclose-out various corrective actions that arise during theprocess. Attempts are sometimes made to use a basicspreadsheet but, except in the simplest cases, this rapidlybecomes unwieldy because of the large quantity ofinformation and explanatory comment that must berecorded.

The SMS documentation forms part of the Safety andOperating Plan that is mandated by AS 2885 Part 3, as isentirely appropriate since risk management tacitly orexplicitly underlies almost all pipeline operations andprocedures, other than those involved in scheduling andcommercial metering of the pipeline contents.

Past and future trendsIn Australia over the past 20 years there has been slow butdeliberate movement away from design by rules towardsrisk-based design by thinking. The first edition of AS2885 in 1987 recognized in principle a need to move awayfrom rules based on location class and design factor (derivedfrom US codes), but it did not achieve a practical change inthe way pipelines were designed. The 1997 revision of AS2885 was a substantial rewrite which introduced the conceptof risk assessment as an underlying principle of pipelinedesign, and was a bold move that required significantchange to the pipeline design process. While the principleswere correct, the wording in the standard did not fullydefine all the requirements necessary to implement iteffectively: conscientious players could do it well, but somejust paid lip service to the new concepts. Nevertheless, theindustry as a whole embraced the idea and graduallydeveloped a broadly-agreed set of good practices. Thesehave now been codified in the 2007 revision of AS 2885.

In AS 2885.1-2007 the principles have not changed but therequirements are specified more explicitly with the aim ofminimizing loopholes. The most substantial change is theaddition of the high-consequence area requirements asdescribed previously. This revision of the standard waspublished little more than a year ago so there has been only

SAMP

LE C

OPY


limited opportunity to assess how well the newerrequirements are being accepted and implemented by theindustry. However there was extensive public consultationand issue of drafts over a period of two years, so the industrygenerally has been improving risk-management practicesand there is no evidence to date that the changes arecausing major difficulties.

Future trends in risk management of Australian pipelinesare difficult to assess, especially since the latest version ofthe standard is still so new. The need for further changesmay only become apparent after the new standard has beenin use for a considerable time.

A key issue may be the extent to which quantitative methodsare used. As discussed previously, the Australian pipelineindustry in general does not believe that quantitative risk-analysis methods add value to routine design or riskassessment, and such methods are not currently usedexcept where mandated by local regulations. However, ascities continue to expand around pipelines built to rurallocation class standards, it is perhaps increasingly likely thatsome intractable questions of risk versus cost may benefitfrom comparative numerical risk estimates. Any trend inthis direction will be encouraged by the new AS 2885requirement that the risks due to a pipeline subject tourban encroachment must be rigorously demonstrated tobe ALARP, including comparison with alternatives such asreconstruction or relocation of the line.

In the very long term, as the Australian pipeline networkcontinues to age, quantitative methods may also findincreasing application in prioritising deteriorating pipelinesfor repair.

Reliability-based quantitative risk methods have to datebeen barely recognized in Australia. There is clearly greatpotential in such methods, but it seems likely that they willbe adopted only when driven by risk issues which aredifficult to resolve in any other way.

DiscussionImplicit in the AS 2885 approach to pipeline safety is acause/control model of pipeline incidents: they haveidentifiable causes, and those causes can be controlledthrough design and operation so that the possibility ofpipeline failure is either eliminated or reduced to a tolerablelevel. An alternative view is that incidents have randomcauses and can never be totally prevented; this underliessome QRA approaches which use statistical failure rates.

In fact, all incidents do have causes, but there is uncertaintyin the knowledge of those causes, so the cause/control andrandom views of risk management are really at oppositeends of a spectrum of knowledge. Nevertheless, AS 2885 isbiased strongly towards the identification and managementof specific factors that might lead to failure.

The cause/control model was adopted when the Australianpipeline industry became concerned that inappropriatestatistical QRA methods may have been imposed on it bysafety regulators who were comfortable with this approachin the management of hazardous industries, but who failedto appreciate its shortcomings when applied to pipelines ingeneral and, particularly, pipelines in Australia. As a pre-emptive defence against any such moves, the industrysought to establish a safety-management strategy which itconsidered to be more appropriate, and which wouldprovide genuine improvements in safety while not incurringcosts that did not achieve practical reductions in risk. Onthe whole the AS 2885 approach has been well accepted byregulators, with only limited areas where QRA is imposed(and almost invariably done badly, using inappropriatedata and methods, as noted previously).

In comparison with other pipeline codes, one feature of AS2885 that may appear distinctive is the relatively-broaddiscretion permitted, bordering on the subjective. This is adeliberate strategy, and to date there are no indications thatthere has been any abuse of the flexibility that is permitted.

In fact, to the contrary, it appears that most pipelineengineers are quite conservative people who like to haverules and who are keen to be seen to be complying with theStandard. Hence the Standard is generally being appliedconservatively. The review through the SMS workshop, thestate technical regulators and (in some states) independentdesign validation go a long way to ensuring that thepermitted discretion is properly applied.

There are some minor concerns that the requirements ofthe SMS process are not always well understood, but this islikely to fade as time passes and the industry becomesincreasingly familiar with the new requirements.

Having said all that, the new requirements for high-consequence areas have not yet been seriously tested incases where there has been very extensive urbanencroachment over pipelines built for rural conditions(minimum wall thickness, minimum cover, but now withhouses within metres of the pipeline for many kilometres).At least one such SMS review is imminent at the time ofwriting, and the outcomes will be observed with interest.

Overall, the Australian pipeline industry appears to besatisfied with the AS 2885 approach to pipeline safety andrisk management. It works well for us in allowing both thesafety and costs of pipelines to be optimized.

References1. AS 2885.1-2007 Pipelines - Gas and liquid petroleum. Part

1: Design & Construction. Standards Australia, 20072. AS 2885.3-2001 Pipelines - Gas and liquid petroleum. Part

3: Operation and maintenance. Standards Australia, 2001

SAMP

LE C

OPY


Appendix 1: AS 2885.1-2007 risk matrix (adapted).

C O N S E Q U E N C E S

sessalc

ytireves

laci

py

Tci

hp

ortsat

aC

roj

aM

ereve

Sr

oni

Mel

bigil

geN

elp

oeP

seitilatafelpitl

uM

.tluser

ro,seitilatafwe

Felpoep

lareves-efil

htiw

gni

netaerht

seiruj

ni

ssenlli

royr

ujnI

latipsoh

gniri

uqert

nemtaert

seiruj

nItsrif

gniri

uqert

nemtaert

dia

tcapmi

lami

niM

ytefas&

htlaeh

no

ylp

pu

Smret

gno

Lfo

noitpurret

niylpp

us

degnolor

Pro

noitpurret

nimret-g

nolfo

noitcirtserylpp

us

mrettro

hS

ronoitp

urretni

degnolorp

fonoitcirtserylpp

us

mrettro

hS

ronoitp

urretni

fonoitcirtser

tub

ylppus

tem

llaftrohs

rehto

morfsecr

uos

on;tcap

mio

Nfo

noitcirtserylpp

use

nilepip

tne

mn

oriv

nE

:E

TO

Nt

nacifingi

Slat

nem

norivne

yam

secne

uqesnoc

snoitacol

nir

uccoera

hcih

wlla

msylevitaler

.detalosid

na

stceffE

,daerpsediw

foytilibaiv

ros

metsysoce,detceffa

seicepsroja

mt

nena

mrepseg

nahc

etis-fforoja

M-g

nolro

tcapmi

erevesmret

rostceffe

noitacifitcertl

uciffid

)ah

1


Appendix 1 (continued): AS 2885.1-2007 risk matrix (adapted).:s

noitc

at

neme

ga

na

mksi

R

:emert

xE

.rewol

roetaide

mretnI

otdec

udersi

ssalcksir

eht

taht

erus

neot

secne

uqesnoc

eht

royc

neuqerf

eht,taer

hte

htyfido

M.yletaide

mmi

decuder

ebts

um

ksire

hte

nilepipecivres-

nina

roF

:h

giH

.rewol

roetaide

mretnI

otdec

udersi

ssalcksir

eht

taht

erus

neot

secne

uqesnoc

eht

royc

neuqerf

eht,taer

hte

htyfido

Mero

mto

nfo

elacs-emit

ani

htiw

yllacipyt,elbissopsa

noossa

decuder

ebts

um

ksire

hte

nilepipecivres-

nina

roF

.skeew

wefa

naht

:etai

demret

nI

;noita

mitseksir

eht

yfitna

uq,elbissopere

hw,d

nayfirev

otsessecorp

noitaulave

ksird

nanoitacifit

neditaer

httaepe

R,etaide

mretnI

ebot

demrif

nocsi

ssalcksir

eht

ereh

W.

noitamitse

eht

foyt

niatrecn

ud

naycar

uccae

hte

nimreted

.elbigilgeN

rowo

Lot

decuder

sissalc

ksire

hter

usne

otec

neuqes

noce

htro

ycne

uqerfe

ht,taerht

eht

yfidom

ecuder

ro,staerht

evomer

otnekat

eblla

hsnoitca

elbigilgeN

rowo

Lot

decuder

ebto

nnac

ssalcksir

eht

ereh

We

hte

nilepipecivres-

nina

roF

.P

RA

LA

otksir

eht

ecuder

otsa

ossec

neuqes

nocfo

ytirevesec

uderro

seicne

uqerfto

nfo

elacs-emit

ani

htiw

yllacipyt,elbissopsa

noossa

detelpmoc

ebts

um

PR

AL

Aro

elbigilgeN,

woL

otnoitc

uder.s

htno

mwef

ana

htero

m

:w

oL

eht

tceffadl

uochci

hw

segna

hcroti

nom

otd

naec

nerrucco

tneverp

ottaer

hte

htrof

nalpt

nemega

nam

eht

eni

mreteD

.noitacifissalc

SAMP

LE C

OPY


THIS NEW INTERNATIONAL CONFERENCE and its accompanying courses and exhibition will cover a wide range of issues concerning pipeline rehabilitation, ranging from the initial stages of evaluation of a pipelines condition to the steps required to undertake rehabilitation of the structure to ensure its continued fitness-for purpose and prolong its economic lifetime. The event is being planned to discuss the latest developments in the industry, to showcase some of the industrys latest achievements, and to provide an unmatched opportunity for both networking and learning.

ORGANIZING COMMITTEEDr Michael Beller,

BJ Lowe,

Sid Taylor

John Tiratsoo,

CALL FOR PAPERS

ORGANIZED BY

ABSTRACT SUBMISSION

SCHEDULE

SUPPORTED BY

rehabConf-a4.indd 1 3/6/2009 9:33:12 AM

SAMP

LE C

OPY


SAMP

LE C

OPY


Nomenclature

Dt1: pipeline service life under original operatingconditions [years]

Dt2: pipeline service life under posterior operatingconditions [years]

Dtc: coating degradation lag [years]

Dtf: forecasting lag [years]

Dts: pipeline service life [years]

sdi: forecast dimension standard deviation [mm]

sRi

: local depth corrosion rate standard deviation [mm]

d: maximum metal-loss depth [mm]D

f: maximum metal-loss forecast dimension [mm]

Dj: pig-reported dimension (depth, width and length)

[mm]d

j: pig-reported defect depth [mm]

Epig

: tool measurement error [mm] (at 80% confidencelevel)

Fh: service conditions linearization factor

H: defect odometer [m]l: maximum defect length [mm]lf: defect forecast length [mm]

LSEGi

: local segment length [m]N: total number of active corrosion sitesn: vicinity parameterR

i: individual defect dimension corrosion rate [mm/

year]R

Di: local defect dimension corrosion rate [mm/year]

RDij

: individual corrosion rate at a nearby defect [mm/year]

s: scoring factor for service condition changesw: maximum defect width [mm]w

f: defect forecast width [mm]

FOR OVER ONE hundred years pipelines have beenused to transport hydrocarbons from their distantlocation to refineries and onwards to consumers. Manymajor world markets nowadays depend upon thisincreasingly-ageing pipeline infrastructure to supply mostof their energy demands. It is unfortunate that ageingadversely affects a pipelines integrity, and it can suffer from

A practical approach in pipelinecorrosion modelling: Part 1 Long-term integrity forecasting

by Dr rika S M Nicoletti* and Ricardo Dias de SouzaPetrobras Transporte SA, Rio de Janeiro, RJ, Brazil

NOWADAYS, MANY MAJOR MARKETS worldwide depend upon an increasingly-ageing pipelineinfrastructure to supply most energy demands. As corrosion damage accumulation is usuallyexpected under typical pipeline service conditions, forecast metal-loss growth over time is a key elementin their integrity management; but there is little industrial guidance on this issue. The current work has beenundertaken aiming to provide a corrosion rate model by means of straightforward stochastic treatmentof metal-loss ILI data. This first part will present a model framework regarding long-term scenarios andremaining-life predictions, based on a cost-effective pecuniary threshold for the systems future remedialactions. The concept of local activity breaks new ground by merging two traditional approaches: theindividual defect and the pipeline segment corrosion growth rates. The models underlying assumptions aredetailed, together with its mathematical framework; an empirical balance has been established betweenover- and under-conservative premises, and the accuracy of the results has been considered suitable forforecasting intervals of up to 30 years. The technique provides powerful information with no need to carryout any further expensive and/or laborious analyses: the whole algorithm could be easily put into practiceusing commercial mathematical packages. In order to illustrate the models applicability, four case studieswill be presented.

*Authors contact details:tel: +55 21 3211 7264email: [email protected]

SAMP

LE C

OPY


many types of damage under typical service conditions.

Corrosion has historically been the greatest time-dependentthreat to pipeline integrity. The process itself reduces thelocal metal cross-section, affecting the remaining strengthand, consequently, reducing the pipelines containmentcapacity in the area of the damage.

Operators can quantify corrosion in their systems throughperiodic metal-loss in-line inspections (ILI). Subsequently,the systems fitness-for-purpose can be assessed at eachpoint by carrying out damage tolerance analysis using, asinput, ILI data and required service conditions [1, 2].

However, given that pig inspections show only the state ofstatic damage at the time of the inspection, integrityforecasting must take into account corrosion growthestimates. Furthermore, although the phenomenon ofcorrosion is widely known, a plethora of factors impact theprocess kinetics along a pipelines length, and the inherentrandomness generally associated with real field conditions,makes its mechanistic modelling a complex task. Thisrequires highly-skilled work, the difficulties of which areoften compounded by an inconvenient lack of historicaldata concerning many of the process control parameters.Thus, it has become common practice to adopt an empiricalapproach, mostly based on worst-case scenarios(recommended practices and/or historical data) [3, 4].However, such procedures usually give rise to highly-inaccurate forecasts, particularly when dealing with long-term scenarios.

Indeed, the US Office of Pipeline Safety estimated that theability to accurately forecast corrosion rates could saveAmerican pipeline companies more than US$ 100 millionper year through reduced maintenance costs and accidentavoidance [5].

Fortunately, ILI metal-loss mapping reflects either unknownservice condition variances and/or local electrochemicalmechanism abnormalities, providing a good background,insofar as processing past behaviour is concerned, forcorrosion-rate inferences.

The current work aims to develop a simplified methodologyto allow reasonably-accurate pipeline-integrity forecasts,chiefly by using ILI data. Two basic algorithms have beenconstructed: the first, which is presented in this paper, hasbeen directed to long-term scenarios. The second part ofthe methodology has targets short-term predictions, andwill be published in the second art of the paper [in the June,2009, issue of the Journal of Pipeline Engineering].

The main differences between the algorithms result fromtheir diverse application expectations. Short-term scenariosare usually applied in order to define reinspection intervalsand rehabilitation scopes. As operational pipeline safetyand reliability often depends on the result, conservativeapproaches have always been preferable. On the other

hand, long-term scenario predictions are typically associatedwith the systems economic viability forecasting (andestimating its remaining life); such analyses are usuallybetter served with accurate modelling.

Despite both algorithms being developed with the aim ofincorporating them into a companys proprietary defect-assessment software [6], they can also be easily implementedusing any common commercial mathematical package.Accordingly, both are presented in only their most simplisticinterpretations. The underlying assumptions of the models,and the descriptive formulations, will be described anddiscussed. Real cases studies will then be presented toillustrate the methodology anticipated results and overallperformance, before final conclusions are given.

Theoretical backgroundThe corrosion process is irreversible: once it takes place,metal-loss damage at a particular site can only either grow,or remain the same over time, the latter being a sign of siteinactivity (and possible repassivation).

As time goes by, it is expected that new active sites will arise,while some of the existing ones will cease growing.Additionally, time-dependent defect enlargements usuallyslow down over time although, as a general rule,deterministic approaches treat those processes as linear [7,8]. Valor et al. [9] suggest the following should be taken intoaccount:

the slowing down effect: 0-10% of reduction in pastcorrosion rates

the cessation of growth effect: 0-20% of the numberof sites nucleated per year

new defect nucleation: 0-65% of the number of sitesnucleated per year

Conversely, probabilistic models often use the followingdistributions in order to represent:

nucleation time exponential and Weibull [9, 10] number of sites nucleated over time: Poisson [9] growth rate: gamma, log-normal, or extreme-value

distributions [6, 10, 11]

The Bayesian approach and the Markovian process havealso been widely used in probabilistic framework modelling[12-15].

Given that metal-loss measurements reflect operationalcondition variations and the overall randomness of thecorrosion process itself, the proper treatment of ILI datacan lead to reasonable estimates of past behaviour [16-18].

In order to determine the corrosion rate, damage must bequantified at two different points in time. However, inorder to avoid the usual laborious defect-matching

SAMP

LE C

OPY


procedures [5, 19], the current model has been adapted touse a single ILI data set. Also, the model has been constructedunder the premise of a linear relationship existing with theprocesss past behaviour. Its breakthrough came with theassumption that only adjacent metal loss represents thecorrosion activity at each point, which will be describedfurther below.

The local corrosion activity principle

The authors consider it a rational assumption that allmetal-loss located in close vicinity and on the same side ofthe pipe wall (external/internal) is under similar conditionsof corrosion attack. If, regarding the variations in corrosionactivity along a pipelines length, it is expected that futureservice conditions remain similar, then future corrosiongrowth can be predicted based on the metal-loss anomalypopulation located in the defect neighbourhood.

To define the range of each defects environment, a vicinityparameter must be empirically determined, using therelationship expressed in Equn 1. Each defect will also haveits associated characteristic length, as defined by Equn 21.

2n+1 > = 7 (1)

L H HSi i n i n= + (2)

Figure 1 illustrates the principle in a pipe section from casestudy 4. All the anomalies displayed are internal metal-loss,and channelling can be clearly noted. Two anomalies havebeen arbitrarily chosen to exemplify the neighbourhoodsdelimitation mechanism: for the purpose of illustration,the lower recommended value for the vicinity parameterhas been used in the figure (n = 3). Note that only axialproximity is taken into account: n anomalies immediatelyup- or downstream are considered as belonging to eachdefects local population.

A number of additional simplistic assumptions have beenmade, and a general outline of them will be given in thefollowing paragraphs.

Process characterization: irreversible, evolving at aconstant rate, and at discrete time intervals.

Defect population: ILI reported metal-loss anomaliestrimmed, based on the empirical criterion definedin Equn 3:

DE

jt 2

1 28.(3)

where Et represents tool the measurement error and

eventually measurement bias, with a confidencelevel of 80%. The mathematical framework to bepresented is independently applied to the anomalypopulations located on the external and internalsurfaces. New defect generation, as well as the rateof cessation of defect growth, are considered to benegligible.

Nucleation time: defect populations are assumed tobe instantaneously nucleated at the first exposure tocorrosive conditions.

Defect growth: determined based on the pastbehaviour of local corrosion activity. The details ofthis premise regarding external and internal surfacecorrosion are described below.

Coating protection effectiveness: the coatingcondition is considered to be perfect at the time ofpipeline commissioning. All pipeline coatingholidays are considered to be instantaneouslygenerated after a specific coating degradation lag.The protection effectiveness is assumed to be 0% atall active sites of external corrosion, and 100% inholiday-free regions. Water and air permeationtime dependency is not taken into consideration.

Coating degradation lag: must be empirically definedbased on coating data history and engineering bestjudgment.

Cathodic protection: is assumed to remain in asteady-state condition throughout the entire servicelife of the pipeline.

Probability density functions (PDFs): defect depthdimensions and corrosion rates are described byGaussian PDFs. It is worth noting that, given thateach defects corrosion rate is represented in termsof a local average, there is a normalizing effect on theoverall depth corrosion rate data set2.

Mathematical framework

Corrosion rates PDFs

The probability density functions should be individuallydefined, taking account of the damage accumulated in eachdefect neighbourhood, according to the previously-outlinedprinciple of local corrosion activity3. If a significant changein the systems operating conditions takes place after any

1. The parameter n should be adjusted in order to obtain an averagesegment length not exceeding 1-2 km.

2. Pipeline geometry, material features, and the axial and circumferentialcorrosion rates, have only been considered deterministically, as will bethe allowable damage as a consequence.

3. Clustering criteria should preferably be applied after a futuremorphology forecast, not before.

SAMP

LE C

OPY


particular event, then a factor Fh is defined accordingly,

using Equn 4; otherwise, Fh is assumed as 14.

Ft s t

th s= +

1 2

(4)

Internal defects

Individual defect growths (radial, axial, and circumferential)are determined by means of Equn 5a. The subsequentapplication of the local corrosion activity principle leads tothe determination of the corrosion rate average for thedefect population located in the adjoined region by usingEqun 5b, while the dispersion is obtained from Equn 5c.Furthermore, the characteristic length associated with eachdefect neighbourhood (L

seg) can also be defined, as previously

discussed.

Hence, each flaw on a pipes inside surface will have onesingle PDF representing its depth corrosion growth rate,while axial and circumferential rates, as well as itsneighbourhood characteristic length, are deterministicallydefined.

RD

tii

s

= (5a)

R F

R

nLi h

jj i n

j i n

=+

=

= +

( )2 1

(5b)

LiLi j

j i n

j i n

R R

n=

( )=

= +

2

2(5c)

External defects

It is proposed that pipeline coating holidays are consideredstationary. Thus, circumferential and axial growth rates areassumed as zero at all active sites located on the pipelinesexternal surface. Equation 5d represents the depth growthrate, considering the lag in coating degradation.

Rd

t tdij

s c

= (5d)

Equations 5b and 5c must therefore also be applied inorder to characterize the defects depth corrosion rate PDF,

while Equn 2 should be used to define its neighbourhoodcharacteristic length.

Future defect morphology

The average dimensions of future defects can be calculatedfrom Equn 6a, and Equn 6b is used to determine theassociated dispersion.

D D R tf i Li f= . . (6a)

Df f Li ttE= ( ) +

22

1 28.(6b)

Damage tolerance

There are a number of metal-loss assessment criteria thatcan be used to determine damage tolerance. The mostsimplistic and widely known is ASME B31.G, which onlytakes into account axially-oriented corrosion defectssubmitted to internal pressure loading. Depending on theparticular systems damage characteristics (which can includecircumferential- or even helically-oriented defects), or theexistence of axial loads (such as those geotechnically orthermally induced), an appropriate criterion should bechosen to deterministically find out the maximum allowabledefect depth as a function of its forecast width and length,according to Equn 7.

d f l wa f f= ( , ) (7)

Probability of exceedance

The future defect depth (df) shall not exceed its allowable

depth (da) [22, 23], as represented by the limit-state function

in Equn8:

d df a < 0 (8)

In the current approach, df is characterized by a normal

distribution, while da is deterministic. This means that the

probability of a pipeline exceeding the limit-state conditionat each defect can be determined as the area on the right-hand side of the allowable depth under the d

f PDF (see

Fig.2)5.

Economic remediation rate

The economic remediation rate which provides cost-effectiveoperation must be ascertained by a pipelines own operator,considering each case individually. It is outside the scope of

4. The scoring factor for changes in service conditions (s) should bedetermined based on historical data (coupons/probes, comparison ofmultiple ILI data or computation simulations) and engineering bestjudgment [20]. 5. Most commercial packages have standard functions to perform this.

SAMP

LE C

OPY


this work to accomplish a full perspective into problem, butsome of the factors that must be taken into account in suchan analysis include:

technical and economic viability of alternativepipeline systems, or other modes of transportation

the ratio between the cost of a new pipeline and theestimated maintenance costs of the existing one

the impact of a possible delivery shortage on thelocal economy

current, and possible future, economic scenarios

Restriction on the models applicability

As the whole model is based on averaging the behaviour ofthe local corrosion process, its application is notrecommended to systems where hot-spot mechanisms (suchas stray current, under-coat corrosion, etc.) are significantfeatures.

Case studiesIn order to illustrate the models application, four casestudies have been chosen, the input data for which issummarized in Table 1. A brief introduction is given foreach, before the model results and overall performance arediscussed.

Pipeline 1: an onshore pipeline carrying dry gassince its operation began. Accumulated corrosiondamage was slight on both the external and internalpipeline surfaces.

Pipeline 2: an onshore gas pipeline that has beenused to transport both wet and sour products.Accumulated internal corrosion is severe although,on the other hand, almost no external metal-lossindications have been reported as a result of thedryness of the of region crossed by this pipeline, inthe NE of Brazil.

Pipeline 3: a trunk line responsible for transportingall of one refinerys crude oil supply. During itsoperational life, it endured production waterpumped through recurrently, together with somehigh-BSW content product. Long shut-down periodswere also a regular occurrence. Internal corrosiondamage is quite severe and channelling damage isgeneral. In order to meet an increase in demand, anincrease in flow capacity was required. The resultantnew service conditions were simulated by the worst-case hydraulic scenarios, and the maximumoperational pressure profile was defined accordingly.

Pipeline 4: an onshore line which has been used totransport naphtha and crude oil, the latter usually

1enilepiP 2enilepiP 3enilepiP 4enilepiP

)ni(retemaiD 61 41 22 61

muminiM)mm(ssenkciht 7.8 2.8 3.6 9.7

lairetamepiP 06X 56X 64/04X 53X

)mk(htgneL 481 822 89 89

)ry(efilecivreS 62 63 23 14

)mcqs/gk(POAM 001 79 *65-12 *14-13

.egnardetalumisciluardyhoiranecsesactsrow*Table 1. Constructionand operational data.

Fig.1. Local corrosion activity.

SAMP

LE C

OPY


with a high BSW content. Again, production watertransportation was a frequent occurrence togetherwith extensive shutdown periods. The whole pipelinehas bad channelling damage, as shown in Fig.1.

Results and discussion

The models output data from the four case studies aresummarized in Table 2, while Fig.3 shows the overallnormalized local corrosion activity. Figures 4 and 5 presentthe expected probability of exceedance for safe operations(at the required levels) without repair to the 200 mostcritical metal-loss areas in each case study, for the next 20and 30 years, respectively. Pipeline 2 was not analysed forexternal corrosion, due the lack of significant indicationson its external surface. In view of a desirable operational

POE threshold range of 10-4-10-5, and the economicremediation rate specified for each case, it can be concludedthat pipeline 3 could be safely operated for almost 30 years,while pipeline 4 would be cost-effectively operational forapproximately 20 years at most.

Conversely, with the exception of pipeline 1, Figs 6 and 7show that internal corrosion developing over 30 yearswould be a direct threat. Pipeline 4 is not expected tomaintain its present use for long, while the operationalreliability of pipelines 2 and 3 will not be cost-effective formore than 20 and 10 years, respectively.

As a result of applying these forecasts, the companys boardof directors has undertaken the following:

Fig.2. The probabilistic limit-statefunction.

1enilepiP 2enilepiP 3enilepiP 4enilepiP

EXTERNAL

deretlif-noitalupoP 312 - 768 222

)n(retemarapytiniciV 5 - 5 5

naissuaGsetarnoisorroclacoLsretemarapnoitubirtsid

]raey/mm[600.0-80.0 - 400.0-350.0 600.0-08.0

journal of pipeline engineering

Documents

tuboscope pipeline services

pipeline maintenance

pipeline corrosion modelling

engineering supervisor

technology innovation

technology leader

cost engineering coordinator

miab technology pty