Proceedings of the 2012 9th International Pipeline Conference IPC2012 September 24-28, 2012, Calgary, Alberta, Canada

IPC2012-90039
SUPPORTING GUIDELINES FOR REVIEWING RELIABILITY-BASED ASSESSMENTS OF ONSHORE NON-SOUR NATURAL GAS TRANSMISSION PIPELINES
Marcus McCallum Andrew Francis & Associates Ltd, Ripley, Derbyshire United Kingdom Rafael G. Mora National Energy Board (NEB) Calgary, Alberta Canada

Graham Emmerson National Energy Board (NEB) Calgary, Alberta Canada

Thushanthi Senadheera National Energy Board (NEB) Calgary, Alberta Canada

Andrew Francis, Andrew Francis & Associates Ltd, Ripley, Derbyshire United Kingdom

ABSTRACT In Canada, a great deal of effort has been invested into the use of reliability-based techniques for the design and assessment of non-sour natural gas transmission pipelines. This led to the inclusion of Annex O in the Canadian onshore pipeline code CSA Z662 in 2007, which gives detailed descriptions of all of the key components of reliability-based approaches. However, the annex does not and is not intended to provide recipes for using the reliability-based techniques for particular fields of application such as evaluating the acceptability of changes to location class, service or increasing maximum operating pressure. Consequently, the onus is on the reliability/integrity engineer to tailor the approach to the particular field of application and the specifics of the pipeline. This means that even working in accordance with the code, the approach and optimizing techniques adopted by one engineer may be very different to that adopted by another. This presents a challenge for those reviewing reliability based plans, designs and alternatives for approval. The National Energy Board (NEB) engaged Andrew Francis & Associates Ltd (AFAA) to assist them with constructing a set of supporting guidelines to assess the comprehensiveness and safety of reliability based submissions. Unlike customary design reviews, the guidelines are geared towards provoking a reviewer into asking delving questions rather than into going

through a box-checking questionnaire. Indeed, asking the case-specific and clarification questions is regarded as a crucial step towards determining the adequacy and effectiveness of the measures proposed in the content and conclusions of a particular filing. Simply questioning whether Annex O has been followed is not encouraged and, even when safety criteria appear to have been met (i.e. box-checking), a reviewer is prompted to challenge the reasonableness of assumptions and ask whether safety levels are providing the lowest practicable risk to the Canadian public. One line of inquiring might be: are sufficient data available; are the data reliable; are the data relevant to the case under consideration; or have the data been analyzed using a valid method applicable to the case. Other typical questions would be have the consequences been properly assessed and are the mitigative and preventative measures providing the lowest practicable risk compared to pressure reduction and pipe replacement. The purpose of this paper is to present an overview of the assessment guidelines and the approach and key considerations for conducting efficient, consistent and fair reviews of reliability based assessments of hazardous material pipelines. In doing so, the paper also identifies some of the pitfalls that engineers conducting reliability based integrity assessments should seek to avoid.

Copyright 2012 by ASME

It is important to note that NEB have not formally adopted the guidelines and accordingly the content of this paper must be regarded as an expression of the views of the authors and not necessarily those of NEB.

deviate from guidance, provided that a rigorous demonstration of the safety is given. In view of this, Andrew Francis & Associates Ltd were commissioned to produce supporting guidelines to assist a Safety Regulator in conducting their assessment as to whether the content of a filing is sound and that the conclusions are safe. The guidelines were developed in two stages. Firstly, a Foundational Knowledge Document (FKD) was produced followed by the production of guidelines that give clear and succinct pointers to key issues. The FKD not only describes the key stages that are involved but also draws attention to some common (and less common) pitfalls that may be encountered. The guidelines make frequent reference to the FKD so that relevant detail can be quickly found, if required. The purpose of this paper is to present a brief overview of the assessment guidelines by way of providing an example of an approach and key considerations for conducting efficient, consistent and fair reviews of reliability based assessments of natural gas pipelines. In doing so, the paper also identifies some of the pitfalls that engineers conducting reliability based integrity assessments should seek to avoid. The paper begins by providing a basic overview of the structure of the guidelines and how they are being used and this is followed by a more detailed description of some of the key features.

INTRODUCTION Buried pipelines that are used for the purpose of transporting carbon fuels such as oil and natural gas have existed in Canada and North America for over 60 years. It is indeed fair to say that pipeline technology was developed in this part of the world and pipeline design codes used around the world have, to an extent, been founded on the North American experience. It perhaps follows, owing to the early entrance of Canada and the United States into the pipeline industry, that these two nations are now facing new challenges associated with the operation of ageing assets. These challenges are compounded further due to increases in population density around pipelines. Given the regional and temporal changes in environmental stresses, infrastructure and population growth patterns, regulatory requirements and construction techniques, existing pipeline integrity and hazard models may not be relevant to all facilities. The net effect is that the guidance given in design codes cannot address all operating scenarios. In view of the above, techniques are now being sought which address the problems associated with increases in pipeline age, increases in population density and the increased demand for carbon fuels, regardless of location or unique operating context. Accordingly, reliability and risked based techniques are now being developed and used as adaptive alternative approaches to those given in prescriptive design codes. In Canada, the design code CSAZ662 [1], has been extended through the inclusion of Annex O [1], to provide detailed information as to how reliability based techniques can be effectively and safety applied. The guidance given, not only allows the safety of existing and ageing assets to be assessed, but also allows optimization of a given strategic parameter (e.g. total cost, wall thickness, maintenance cycle) to be achieved at the design stage. In Canada, operators of hazardous product transmission pipelines are required to seek regulatory approval for the construction of new facilities as well as substantial modifications and changes in the service of existing facilities. The reason for this is that each project presents a unique set of hazards and consequences. It follows that there is no single way of undertaking a reliability-based design or assessment. Indeed, the assessor following Annex O is given the freedom to bring ingenuity into the design based on skill, available data and improvements in modern technology. Even though Annex O provides thorough guidance on the approach, the assessor is not necessarily required to follow each step to the letter and can

STRUCTURE OF THE GUIDELINES The purpose of the guidelines is not to present guidance on how to perform a reliability-base assessment (such guidance can be found in texts elsewhere; not least, in Annex O) but rather to give guidance to the assessor that will allow him/her to expedite an assessment of a filed submission in a manner that will be fair, consistent and transparently allow sufficient confidence (or otherwise) to be gained in the conclusions of the study. The document is compartmented into a number of sections each of which contained a series of questions that provoke the assessor to consider factors that are often not immediately obvious but which may have a significant impact on the applicability of the reliability assessment to the pipeline under consideration. The basic structure comprises: Guidance on a preliminary assessment to determine the level of detail that should be considered by the reviewer Guidance on checking the compliance with the requirements of Annex O Guidance on undertaking a detailed review if required

Copyright 2012 by ASME

The purpose of the preliminary assessment is to allow the reviewer to quickly form a view as to whether the study contains the information he/she would expect and whether a detailed review is required or whether it will be possible to accept the filing based on sound engineering judgment. The level of information required and need to conduct a detailed review would vary widely depending on the interests of the reviewer and as such, the criteria for doing the preliminary assessment would be reviewer specific. For example a Regulator may be primarily concerned with the consequences of the filing, a client with the justification for the recommended mitigation and an independent third party with the amount of information included to support assumptions. A section on Annex O has also been included because, although there is no mandate that Annex O has to be used, it is likely that many submissions will make use of that document. While it should not be necessary for an applicant to provide records of the complete analysis, the company should demonstrate that they have followed the steps of Annex O, or a comparable method, using data relevant to the pipeline segment studied and have not relied on generic models without appropriate justification. Of particular importance is the justification of why the reliability targets selected by the company are applicable to the pipeline and are appropriate to satisfy the reviewers goals. As Annex O is a non mandatory part of the standard and each client or Regulator will have a different risk tolerance, it is not sufficient to merely adopt the minimum reliability targets suggested by the standard without including a rationale for doing so. The guidance for undertaking a detailed review forms the bulk of the document and is broken down into relevant sections. In each section there is a succinct description of the subject matter in which the key issues are highlighted. For more detailed descriptions of each topic, the reviewer is referred to the FKD. Finally, each section includes a list of challenging questions that the reviewer is prompted to consider.

The detailed guidelines are contained in chapters that focus on a number of key issues for the reviewer, which include: Identification and screening of failure causes Limit state functions Deterioration Mechanisms Uncertainty Analysis Reliability Calculation Methods Consequence Assessment Acceptance Criteria Verification and Validation

In each chapter, the salient features of the key issues are briefly discussed and cross reference is made with the FKD where considerable detail is given. Following the brief discussion, a series of questions are presented to which the reviewer is provoked to seek answers in the filing. The guidelines and particularly the FKD are extensive documents and it would not do justice to a description of any particular section of either document if an attempt were made to include something from every section. While the guidelines were tailored to the unique needs of the NEB, a sample of the content from a number of key sections is provided in order to illustrate the key considerations for someone reviewing reliability based pipeline engineering studies. IDENTIFICATION OF FAILURE CAUSES The identification of failure causes is a key issue and a task that should not be underestimated. Some of the pitfalls include: identifying those failure causes, from a basic list, that the assessor can model and dismissing those that he/she cant basing the assessment on only operational pressure and failing to acknowledge the effect of other loads and fault conditions considering only straight sections of pipe Based on the above it is not uncommon to see assessments that provide detailed descriptions of the modeling of some failure causes but with very little attention, if any, being given to others. This can create a distorted picture of the true situation. The identification of failure causes needs to undertaken, in the first instance, without paying any regard to what can and cant be modeled and evidence of the record of a formal process used to identify failure causes is therefore sought by the reviewer. The reviewer is therefore provoked to look for evidence of:

DETAILED ASSESSMENT The central focus of the guidelines is on the detailed assessment. For the purpose of this paper, a brief description of the format of the guidelines is given and the discussion focuses on the content and application of the approach contained within the guidance notes.

Layout and format

Copyright 2012 by ASME

Consultation of Industry Standards (Annex O and ASME B31.8S [2] contain lists of potential causes) A Failure Mode and Effect Analysis (FMEA) Safety Reviews A Hazard and Operability Analysis (HAZOP) A Hazard Identification Study (HAZID)

Limit state functions for non-planar defects Failure can be caused by the presence of non-planar defects and these are most commonly associated with internal and external corrosion damage. Corrosion affects almost all pipelines to some degree and it is therefore not surprising that this failure cause has received extensive attention and there are now several models that can be used to determine the conditions required for corrosion failure. All of these models take a similar format, with differences existing at secondary levels through peculiarities in the definitions of various parameters and differences in empirically determined constants. The reviewer is therefore prompted to question why a particular model was used, and if only one was used, and seek confirmation that validity limits are not exceeded. More delving questions include: What are the fracture toughness levels of the pipe material and how has this been established? (The fracture toughness is an important parameter. If no data are available to quantify it then the assumption should be made that it is low in which case the validity limits of corrosion limit state functions may be violated and a more conservative approach, perhaps treating the defect as planar, should be adopted) Is there any historical evidence of corrosion at welds? (Welds can potentially contain other defects which could have a compounding effect on the likelihood of failure and this may require consideration. Even if no further action is required it is encouraging to see evidence that this matter has been considered) Is there any historical evidence of corrosion at bends? (Significant additional stresses may be present at bends which should be considered, especially if the operating loads are to be increased. Again evidence of consideration is sought)

Delving deeper into the content of the above studies, questions would include: Did the operator provide a list of the fields of experience (and names) of personnel involved in the review? (If yes, then as a minimum this shows that a formal process is likely to have been adopted) Did the operator provide data / historical records / facts to support dismissal of various failure causes? (The use Engineering judgment is not discounted but hard evidence might be preferred or essential in some circumstances) Did the operator take account of the actual features of a particular pipeline segment the pipeline? (Changes in environment can have a significant impact on likelihood and nature of failure causes) Did the operator consider failure of features and fittings? (Depending on the location the presence of a bend or a tee could be significant)

It is not anticipated that answers to each of the above questions and others will be contained in every filing and the omission of some answers is not necessarily cause for rejecting the validity of the study but may trigger the reviewer to require further information depending on how much an error could influence the conclusions of the reliability based assessment. LIMIT STATE FUNCTIONS Limit state functions are mathematical recipes from which the conditions required for a failure to occur, due to a particular failure cause, can be determined. Over the years recognized and accepted limit state functions have steadily increased in both number and sophistication and can be found in a number of standards and procedures. These include: CSA Z662 Annex O [1], ASME B31G [2], BS7910 [3], API 579[4] and RSTRENG2 [5], to name but some of them. Reference to one or more of the above documents, or to a document of similar standing, would therefore be expected in any filing that makes use of reliability based design. This is an extensive topic and only a brief sample is included here.

Limit state functions for Mechanical Damage Mechanical damage is acknowledged to be the most likely cause of pipeline failure in many parts of the world and at least one limit state function is included in a number of the standards given above. Particularly relevant questions are:

Copyright 2012 by ASME

Has there been any historical evidence of mechanical damage on the subject pipeline? (This may have a bearing on the event frequency) If mechanical damage has occurred was it thoroughly investigated and was there any evidence of cracking? (The dimensions of the damage may be compared with the predicted range and if cracking is present some justification of how this is being dealt with should be provided)

standard way of undertaking this task and the reviewer is likely to be faced with a wide variation of approaches. At the most basic level the reliability engineer has the option of representing any given parameter by either a single value or a by a statistical distribution. Use of a single value If a single value has been used to represent a particular parameter, the central concern will be the justification for this and the reviewer will look for assurance that the chosen value is conservative. The following questions might be asked: Is the limit state very sensitive to the parameter? (If it can be shown that the limit state function is relatively insensitive to a given parameter then it will just be necessary to ensure that the number used is reasonably representative of the actual value, and that there is some evidence of erring on the side of caution.) Is there little variation in the spread of possible values (low coefficient of variation)?( If there is little spread in the range of values, as is often the case for parameters such as diameter, then use of a nominal value will generally suffice.) Is the value based on case specific data or has a generic value been used? (Sometimes no data may have been supplied and a generic value may have been used. For instance the material may have been stated as X65 in which case it might be appropriate to conservatively represent the yield strength by the SMYS value. However, in sensitive situations there might be a requirement for a lower grade to be assumed if no hard evidence can be supplied that the material truly is X65).

Planar Defects Crack-like defects can arise as a result of the construction process or be introduced through mechanisms such as stress corrosion cracking. Ground movement, overburden loads, heave and thaw settlement can give rise to weld fracture of pre-existing cracklike construction defects that survived the original hydrostatic pressure test and which were introduced due to poor workmanship. There are a number of procedures for constructing limit state functions for addressing failures due to these types of defects and these are contained in references [3] and [4], for instance. The following type of questions may be asked: Have all the loadings been considered? (The concern is that the loading may have been limited to those associated with just pressure. In some situations such a pressure restriction would be adequate but in others it may not. In general there may be a requirement to take account of the effects of Thermal Loads, Soil Loads, Traffic Loads and construction loads) Have the stresses been categorized correctly as Primary Stresses or Secondary Stresses? (The concern is that sometimes primary loads may be treated as secondary loads; this can have a significant impact on the results) If fracture toughness values have been estimated from Charpy Energy data, has a reliable and applicable correlation between Charpy Energy and Fracture Toughness been used? (The concern is that proximity to brittle fracture has not been adequately addressed.).

The basic essence of the questioning is to ensure that if a single value is used then it is a suitably conservative estimate of the true value. It must be borne in mind that less hard evidence will demand more the conservatism. Use of Statistical Distributions Whilst it may always be feasible, and indeed appropriate, to represent some variables by single values, there will always be a requirement to represent others using statistical distributions. Obviously, if all variables were represented as single values the assessment would be deterministic. The corollary of this is that

DATA ANALYSIS Once the failure causes and associated limit state functions have been identified, the task of assigning values to each of the relevant parameters commences. There is no

Copyright 2012 by ASME

a reliability based assessment must include a statistical (probabilistic) treatment of at least one variable and hence this is the aspect that best differentiates a reliability based assessment from a deterministic one. One of the benefits of the reliability based approach is that it allows the engineer some freedom to deviate from the prescriptive approach and to introduce some ingenuity. However, there is also a requirement for more in-depth data analysis and this must be undertaken using recognized techniques. In view of the above the reviewer is likely to focus much of their attention on this part of the assessment. The level of scrutiny will depend on a number of factors including the quantity and quality of information provided and the relative importance of the outcome of study; in particular the safety implications. In some cases a study may be sufficiently well documented, and complete, such that little effort will be required of the reviewer and he/she may just opt to perform nothing more than simple sense checks. For a study that is less well documented or relies on generic or published data, it may be necessary to perform a full independent check of the calculations or require additional analysis and information to be filed prior to accepting the submission. Also, even in situations that are well documented the reviewer might choose to analyze the data using a different method to the one that has been filed to ensure full independence of the assessment, particularly if there is a significant safety issue.

In some situations data will have been obtained from direct measurements, on the subject pipeline, using established, and well documented, measurement and survey techniques. In these situations it is fair to say that the data will be representative and of a high quality. The sufficiency of the data can be established using standard statistical analysis techniques. In other situations data may be obtained from measurements on pipelines that are deemed to be similar to one under consideration. (The use of generic data falls into this category). In this situation it is not straight forward to say with certainty that the data are indeed representative of the actual pipeline material. Also if the measurement or survey technique has not been sufficiently well documented then the accuracy or quality of the data could be dubious. In these situations the statistical analyses may require greater scrutiny. In general, for any given application, differing amounts of data of differing quality will be available for different parameters. This essentially means that a range of approaches will be required on any single project. Questions include: How did the operator select the type of distribution? How did the operator fit data to the distribution? How did the operator ensure that the goodness of fit was acceptable? Has the operator commented on how representative the data are of the pipeline under consideration? Has the operator investigated the sensitivity of the results to the changes in the type of distribution? For sparse data, has the author determined how well the estimated parameters are likely to represent the true values of the population parameters? Have confidence limits been estimated? Where data are sparse has the Operator used a recognised approach, such as Hypothesis Testing or a Bayesian updating to select or construct a distribution?

Data types Quantifying uncertainty is central to any reliability-based assessment and this is done through the selection and/or construction of Probability Density Functions (PDFs). Generic data, case-specific data or a combination of the two may be used for this purpose. Answers should be sought to four key questions, namely, How representative, of the pipeline under consideration, is the pipeline, and/or material, from which the data were obtained? How representative are the measurements (or indications) of the property that is being measured Is the quantity of data sufficient? How representative are the chosen distributions of the actual distributions? statistical

This is a very important part of the study and if the analysis is not performed correctly one which can lead to serious errors and unsafe conclusions. VERIFICATION, VALIDATION AND PERFORMANCE INDICATORS

Copyright 2012 by ASME

A review of a reliability assessment should place an emphasis on the need for attention to detail at all stages of analysis in order to acquire confidence that the computed results are indeed truly representative of the physical system they are representing. The validation and verification process needs to be applied to all aspects of the modelling process to ensure that the computations have been executed correctly and the results are valid. This is illustrated through the following example on the significance of agreement or disagreement between computed and actual failure rates. Comparison of Predicted Observed Failure Rates Failure Rates with

working well. However, it is also important to note that this outcome does not provide assurance that it is. If three failures occurred then, at approximately the 95% confidence level, we could assert that the model is underpredicting. If four or five failures occurred we would say with a very high level of confidence that the model is under-predicting. A simple course of action to address under-prediction might be to introduce a multiplication factor. However, such an approach is strongly advised against here. By taking such an approach the reason for the weakness of the model will remain a mystery. In such situations evidence would be sought of a more detailed investigation with a mind to understanding the reason for the discrepancy. This would invariably mean investigating other performance indicators.

It would be easy to regard agreement between observed and predicted failure rates as confirmation that the models are working correctly and hence that the approach can be considered to be validated and verified. However, such a view should be treated with a high level of caution. Firstly, failures do not occur very often. For instance, the model may be predicting one failure for every 100,000 mile years of operation. If one failure were to occur, within such an exposure period, then a conclusion might be drawn that the model is working very well. Suppose that no failures were observed, the conclusion might be that one failure is to be expected in the near future or perhaps the conclusion would be that the model is over predicting failure rates. On the other hand suppose 5 failures had occurred, it might then be concluded that the model is under-predicting failure rates and there might be a temptation to include a multiplication factor of 5 to bring the predictions into line with reality. It is important to note that we are usually predicting an average or expected failure rate. Assuming that the number of failures that will occur in the exposure period ( TL ) can be expressed using a Poisson distribution, then the probability of N failures is given by ( fTL) N p( N ) = exp( fTL) N! Based on this, if TL = 100,000 mile-years and f = 10 5 per mile per year then the expected number of failures, in the exposure period, would be one. However, the probability that exactly one failure will occur is only 0.368. (Coincidently, this is exactly the same as the probability of there being no failures.) The probabilities of there being 2, 3, 4 or 5 failures are 0.184, 0.061, 0.015 and 0.003, respectively. The implication of the above is that if zero, one, or two failures occurred we have no reason to believe that the model is not

CONCLUSIONS This paper has given an outline of a process for reviewing reliability based design assessments. The paper makes frequent reference to a Guidance document and a Foundational Knowledge Document (FKD) produced for use by a Regulatory body. The guidelines and FKD are quite extensive an only a brief insight into the content has been given here. The guidelines provide a systematic approach to working through an assessment in order to expedite a decision as to whether the conclusions are safe. Finally, whilst the guidelines included in this paper provide a good framework for conducting a review, it is important to note that the process for conducting a review of reliability based engineering assessment will be highly dependent on the reviewers mandate, objectives and risk tolerance. REFERENCES [1] [2] CSA Z662, Oil and Gas Pipeline Systems ASME B31G Manual for determining the remaining strength of corroded pipelines. A supplement to ASME B31.8 BS 7910, Guide on Methods for Assessing the Acceptability of Flaws in Metallic Structures, British Standards Institution, 2005.

[3]

Copyright 2012 by ASME

[4]

API 579, Recommended Practice for Fitness-forService and Continued Operation of Equipment P.H. Vieth and J.F. Kiefner, RSTRENG2 users manual, Final report on PR-218-9205 to Corrosion Supervisory Committee, Pipeline Research Committee, American Gas Association, Kiefner & Associates, Inc., Ohio, 1993.

[5]

Copyright 2012 by ASME