Proceedings of the 2012 9th International Pipeline Conference IPC2012 September 24-28, 2012, Calgary, Alberta, Canada

IPC2012-90546
PROVIDING SAFETY - USING PROBABILISTIC OR DETERMINISTIC METHODS
Shahani Kariyawasam TransCanada Calgary, Alberta Canada ABSTRACT The primary objective of a good engineering design or maintenance process is to provide safety with optimized resources. Most parameters and models used in engineering have uncertainty -- some more so than others. Probabilistic assessments strive to account for these uncertainties explicitly while the deterministic methods account for uncertainties implicitly by using conservative inputs and safety factors. Deterministic methods are preferred by many due to their simplicity. However if inputs and safety factors are not defined prudently with explicit consideration for uncertainties and consequences they can lead to unsafe or unduly conservative solutions. The main objective in using reliability based methodologies is to provide consistent safety by explicitly accounting for uncertainties in a probabilistically quantified manner. Reliability methods also allow the articulation of the level of safety. This level of consistency in safety cannot be achieved in a deterministic analysis using safety factors because uncertainties are not accounted for explicitly and consequently the uncertainties lead to variable solutions. However safety factors can be calibrated using reliability methods so that more consistent safety levels can be assured when using deterministic methods. There is a relationship between the reliability level and the deterministic safety factors. This relationship between reliability levels and deterministic safety factors is examined both from a mathematical and practical perspective. Consequently it is shown that reliability based methods can be used to calibrate deterministic methods to improve the consistency of the safety level with due consideration to underlying uncertainties and consequences. This kind of calibration is used in other industries such as structural design and nuclear facilities. Providing more consistent safety enables optimization of maintenance activities which enables the safest system to be provided with available resources. Luc Huyse Chevron ETC Houston, Texas USA Currently the pipeline industry uses deterministic methods with conservative inputs that are not based on risk or safety principles. Consequently there is a large variation in the inputs and safety factors used in the industry. Some examples of these are safety factors used in response to inline inspection that vary from the reciprocal of the design factor to 1.1 for all location classes. This paper shows that the maximum safety factor achievable for a given design is defined by the original design factor and the ratio between flow stress and yield strength. It also shows the inadequacy of using safety factors that are not risk based. The paper focuses on the importance of using a sound risk based rationale for appropriate safety factors in deterministic methods. A glossary of terms is provided at the end of the introduction. INTRODUCTION Safety is paramount, particularly, in an industry that faces dire consequences of failures. Therefore nuclear, aviation, oil and gas, and similar industries have to consider the assurance of safety, which is risk and reliability, with explicit detail. With recent regulatory pressure and intensified public perception of safety the ability to demonstrate safety is even more important. Most engineers use specified and nominal values of variables and safety factors to calculate safe designs or to make safety related decisions such as which ILI features need to be excavated and mitigated. How do we demonstrate that these conservative steps lead to appropriate levels of safety? How do we define appropriate levels of safety? The rationale for adequate safety is acceptable levels of individual and societal risk levels (e.g. HSE 2001, CCPS 2009). Quantitative risk and reliability calculations have used this rationale (Stephens and Nessim 2009); however, the deterministic methods and related minimum safety factors have not had a similar rationale. This is evident in the widely varying

Copyright 2012 by ASME

or non specified levels of safety used in ILI based decisions or hydro testing levels. In existing practice pipeline operators and standards use a wide variety of minimum acceptable safety factors. Most of these factors are based on past practice or other factors such as design factors. In responding to ILI features some standards (e.g., ASME B31.8S 2010) recommend use of minimum safety factors as low as 1.1 for all location classes while other standards (e.g., CSA Z662 2011) use the reciprocal of the design factor as the minimum safety factor required resulting in 1.25 to 2.27 for Class 1 to Class 4 respectively. This paper examines the rationale behind the use of these safety factors and critiques the strengths and deficiencies from a safety perspective. The basic principles of providing safety using probabilistic and deterministic methods are applied to a pipeline industry application to demonstrate the different approaches and the rationales behind them. Effective use of quantitative risk and reliability methodologies requires quantitative data that describes the current state of the pipeline, the anticipated future state as well as the failure limit state. In maintaining oil and gas pipelines this level of quantitative data of the pipeline is available when pipelines are in-line inspected. Although reliability-based assessments are by no means restricted to corrosion management, the examples are first applied to corrosion management because In-Line Inspection (ILI) data is adequately accurate to perform reliability based assessments. Significant sensitivities that impact the calibration of deterministic methods are also discussed. GLOSSARY Risk is the expected value of loss (often expressed as damage per year, i.e. barrels spilled, expected number of annual injuries or fatalities). Risk = Likelihood (or probability) of failure x Consequence of failure Probability of failure or Likelihood is a measure of how likely the event is. Probability of failure is the probability that a component or a system will fail within a defined period of time. This is typically expressed as an annual probability. Consequence is a measure of the outcome or loss from an event Quantitative risk means that measures of likelihood or probability are estimated or assigned and measurable parameters are used for consequences (dollars, losses in life, spill volumes etc). Quantitative can be more objective than qualitative if we use data and models, within the model applicability range, or subjective if we assign probabilities subjectively based on judgment. In applying the results of quantitative risk analysis, the user should be aware of the implications resulting from the levels of subjectivity (due to assumptions and idealizations) and accuracy implicit in the

numerical estimates. Quantitative risk methods are probabilistic. However, risk is sometimes quantitatively indexed or calibrated to give quantified deterministic estimates. Deterministic methods use one representative deterministic value for each probabilistic variable and the models are biased such that the deterministic value calculated is conservative. Generally a conservative input value of each variable is chosen to represent the variable however if the user is unaware of the variability mean or non conservative values could be in use (see Figure 3) Probabilistic methods are where probabilities are estimated quantitatively using statistical data and uncertainty modeling and then mathematically combined with measurable consequences. Probabilistic risk estimates provide more objective measures of risk by combining numerical estimates of frequencies, probabilities, and consequences. As in deterministic methods the modeling assumptions will bring subjective elements in to the assessment. Reliability is the probability that a component or system will perform its required function without failure during a specified time interval (usually one year), equal to 1.0 minus probability of failure. Reliability-based assessment is a probabilistic assessment method in which the pipeline is assessed and operated to meet specified target reliability levels. A reliability based assessment is performed by quantifying all relevant input uncertainties. Rupture Pressure Ratio (RPR) = Safety factor (SF) =Burst Pressure/ MOP (The RPR value is calculated based on ILI reported anomaly sizing and reported by ILI vendors. SF is defined as the ratio of resistance to rupture at a given feature divided by load that causes the rupture) Minimum acceptable Rupture Pressure Ratio (min RPR) = minimum Safety factor (min SF) is the acceptable RPR or safety factor Safety is the absence of risk with respect to the appropriate risk acceptance level DETERMINISTIC METHODS IN PIPELINE INTEGRITY Deterministic methods adopt conservative values of both loads and resistances and also use safety factors for further conservatism. For example in a corrosion In line inspection (ILI) assessment of defects, the nominal conservative values of Specified Minimum Yield Strength (SMYS), wall thickness, outer diameter, etc are used together with a minimum safety factor. The aggregate or total level of conservatism in deterministic methods is unknown. Consequently the level of safety afforded is not quantified or easily justified. The aggregate level of safety due to the use of conservative input values and additional minimum safety factors is unknown and also not the same among all scenarios or defects being assessed.

Copyright 2012 by ASME

The practice of safety factors, which are applied to conservative values of key variables, is popular because it is simple to understand and apply. Traditionally the conservative values applied in ILI based corrosion management are defined by nominal values and specified minimum values. However, treatment of the uncertainties and biases in the burst pressure equations and measured dimensions of the defect have not been accounted for in a standardized manner. These aspects are discussed further in the next few paragraphs.
5 4.5 Actual Failure Pressure/Predicted Failure Pressure 4 3.5 3 Machined (Vessels) 2.5 2 1.5 1 0.5 0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Normalised Defect Depth, d/t Machined (Ring Expansion) Real Defects Line 1.0

conservatism in the equation and the use of a minimum safety factor. As clear metrics for the amount of conservatism in each are not articulated there is a large amount of variation in the level and form of conservatism. Exactly how the conservatism is best provided is not clearly thought out and articulated. The most commonly used equations were examined by Chauhan et al (2009) and a few of the plots for the different equations are given below in Figure 1. The plots show the ratio of the actual value of the burst pressure divided by the calculated value for the burst pressure as a function of the relative defect depth; any values greater than 1 indicate conservatism. As demonstrated some equations have a more scatter and/or more bias. Higher accuracy (lower scatter) in an equation will enable more precise or optimized decisions. Conservatism or bias (distance between the mean and the specified value) should be higher when the variability is higher. However it should be noted that when comparing two equations with different levels of variability higher conservatism does not always mean higher safety; the same level of conservatism would mean that the equation with less variability will lead to better safety because there is less probability of having unconservative predictions. From the Figure above it is clear that even though the ASME B31G and modified B31G equations have more bias or conservatism than RSTRENG they have more points below 1.0 which will lead to higher probability of over predicting burst pressure which compromises safety. Therefore conservatism does not always lead to safety and with less variability less conservatism is required for same level of safety. It also follows that less variability is more important in optimizing safety as it reduces necessary conservatism and over-conservatism for the majority of the points. If an equation is highly sensitive to certain variables as the burst pressure has been shown to be sensitive to the depth, depth growth rate, and model error (Kariyawasam and Peterson 2010), the nominal values for those variables have to be specified in the appropriate tails as failures happen in these tails. Consequently it is important to specify measured defect depth, depth growth rate, and model error in the appropriate tail. The early forms of burst pressure equations, specifically B31G (ASME B31G 2009) and RSTRENG (Vieth and Kiefner 1993) equations, were developed for use in-the-ditch. The in-the-ditch dimensions were considered adequately accurate. As a result, not much attention was paid to measurement error of the defect dimensions. However when these equations are used with ILI measured values the measurement error is significant and needs to be accounted for. In the pipeline industry sometimes the safety factors have been thought to be adequate to account for these uncertainties (Kiefner 2008) and consequently reported measured values have been used in the assessment.

ASME B31G

5 4.5 Actual Failure Pressure/Predicted Failure Pressure 4 3.5 3 2.5 2 1.5 1 0.5 0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Normalised Defect Depth, d/t Machined (Vessels) Machined (Ring Expansion) Real Defects Line 1.0

Modified ASME B31G

5 4.5 Actual Failure Pressure/Predicted Failure Pressure 4 3.5 3 Machined (Vessels) 2.5 2 1.5 1 0.5 0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Normalised Defect Depth, d/t Machined (Ring Expansion) Real Defects Line 1.0

RSTRENG

Figure 1 Actual/predicted failure pressure against defect depth/wall thickness for different Corrosion assessment burst pressure equations from Chauhan et al. (2009) There are many burst pressure equations developed and improved upon (ASME B31.G 2009, Vieth and Kiefner 1993). Most of the commonly used equations were developed for use with deterministic methods and consequently conservatism was thought to be necessary in the basic equation. As the conservatism in the final burst pressure is provided by both the

Copyright 2012 by ASME

When the conservatism in all the variables discussed above is combined in a deterministic assessment the aggregated conservatism is unknown and unjustified. If different equations are used, as explained above, the level of safety will be different this leads to inconsistent levels of safety.
P Burst_Actual / P Burst_Predicted

Corrosion Assessment Methods Comparison (Real Corrosion)

5.0 4.5 4.0 3.5 3.0 2.5 2.0 1.5 1.0 0.5 0.0 B31.G Mod. B31.G RSTRENG C-Fer 1995 C-Fer 2006

PROBABILISTIC METHODS Within the last three decades reliability based methodologies have been used for pipeline integrity maintenance on a more site specific basis. The computational intensity and the extensive data requirements have limited usage mainly to post ILI assessments, change of location class assessments, and site specific risk assessments. A failure could be either leak or rupture. Leak failure is probability of the defect growing into a through wall flaw. The probability of rupture involves all the different types of input variables mentioned above and is the more undesirable type of failure due to higher consequences. For examples and comparison purposes in this paper the probability of rupture is used to demonstrate concepts. As mentioned in the section above, many of the burst pressure equations in the industry are developed for use with deterministic methods. Brown et al. (1995) identified that burst pressure equations developed thus far had the intention of failure avoidance as opposed failure prediction (as is appropriate for deterministic methods). This led them to modify the B31G equation, described above, for use with reliability methodologies. Consequently Brown et al (1995) and Stephens and Nessim (2006) modified the burst pressure equations to reduce both the bias and scatter. Brown et al. found that the definition of the corroded area is the most significant factor influencing model prediction accuracy. An assumption of a standard shape such as the parabolic shape or 0.85 factor shape reduced accuracy when compared to using effective area RSTRENG or total area as recommended by Brown et al. This is reasonable, considering that failure is proportional to the axial area loss, and total or effective area better represents this axial area. This modified equation (named C-FER 1995 in figure below) was shown to have accuracy similar to the effective area method (RSTRENG). Stephens and Nessim (2006) modified this equation to be more appropriate for high strength steels and used ultimate tensile strength, as opposed to yield strength, in defining the flow stress (named CFER 2006 in figure below). The comparison of the accuracy of different equations is given in Figure 2 below. In deterministic methods all models and inputs are supposed to be conservative whereas in reliability methods the inputs and models strive to be as accurate as possible. The conservatism is applied at the end stage of the assessment when comparing the calculated reliability to target reliability. The target reliability should depend on the consequence levels. Therefore the target reliability will be based on individual and societal risk acceptance levels.

Corrosion Assessment Method

Figure 2 Comparison of equations for reliability methods RELATIONSHIP BETWEEN RELIABILITY BASED METHODS AND DETERMINISTIC METHODS An example from an ILI based assessment is used to demonstrate. Reliability-based methods aim to explicitly quantify the effect of uncertainties in terms of probabilities and risk. As seen in the example in Figure 3 below reliability methods attempt to characterize all inputs probabilistically (light blue distributions) with relevant uncertainties involved. Using the input distributions and assessment models, the resistance (Pburst) can be characterized by a probability distribution (as shown in light blue solid lines). The load (operating pressure) is also represented by a probability distribution (shown in dark blue solid line).
SMYS 90th percentile growth depth 1.0

etc

Yield strength

Flaw depth growth

Defect depth

Model error (Test / predicted)

MOP

Deterministic Pburst

Operating pressure

Pburst

POF overlap

1 POF>TargetReliability=>acceptable RPR=Pburst Det /MOP=SF minSF=>acceptable

Figure 3 - Example of reliability methods and how it relates to deterministic methods Each input to a deterministic assessment method (orange dashed lines) is conservatively defined as a specified or nominal value. As shown in Figure 3 most of these deterministic values are defined to be in the conservative tail of

Copyright 2012 by ASME

the actual input distribution. This means if the input is a resistance variable, such as the yield strength, the specified value is in the lower tail (underestimating the strength in most cases). If the input is a variable that adds to the load or reduces the resistance such as the measured feature size the specified value should be in the upper tail (overestimating the load or damage). By combining the deterministic inputs a deterministic burst pressure is defined (shown as orange dashed line). Similarly the maximum operating pressure (MOP) represents the operating pressure and is conservatively in the upper tail of the load. In the case of the reliability method, the acceptable safety level is defined by the probability of failure (POF) calculated as the probability of the resistance being less than the load. If the POF is below an acceptable level or conversely if the reliability (1POF) is above a target reliability level it is considered acceptable. In the deterministic approach if the deterministically calculated burst pressure divided by the MOP is considered the safety factor (SF) and if this is larger than or equal to the minimum required safety factor (min SF) it is considered acceptable. These aspects are demonstrated in Figure 3. The above example illustrates the key differences between reliability based and deterministic assessments as explained in Table 1 below. Reliability-based Assessments: explicitly consider uncertainty in inputs and models as accurately as possible meet target reliability levels for given consequences where quantified level of required safety or target reliability depends on consequences provide quantified safety level justified by an articulated premise - often based on individual and societal risk acceptance levels provide more consistent safety as case specific variability is explicitly Deterministic Assessments: generally use conservative constant inputs (e.g., SMYS), where conservative inputs should account for uncertainties in variables1. provide further conservatism with min safety factors (min SF) where min SFs should account for different consequence levels (as shown in Figure 4 below) to provide consistent risk have unknown total safety levels and are not articulated levels of safety

accounted for use complicated calculations and are data intensive Table 1-Comparison assessments of

for are simple to use and is less data intensive reliability and deterministic

In the reliability based assessment the target reliability depends on a quantified level of acceptable risk, such as individual and societal risk acceptance levels. These acceptance levels depend on consequences. As demanded by societal risk acceptance levels the acceptable risk levels reduce with higher population density and therefore the target reliability would be higher for higher consequences. Traditionally, minimum required safety factors (min SFs) have not been based on quantified risk levels but have been chosen based on other factors such as design factors (as used in CSA Z662 2011) or hydro test factors (as used in ASME B31.8S 2010). No claim is made regarding the actual reliability or safety level that is achieved. However, as seen in Figure 3, when the minimum required target reliability is achieved by Pburst and the operating pressure (determined by the overlap of the distributions), the deterministic value of Pburst and MOP are also defined (for a given set of specified or nominal input values). Therefore the SF achieved at this point is the corresponding minimum SF that achieves the same reliability. In other words, at a certain reliability level, achieved by the probability distributions of the load and resistance, the deterministic SF is also defined, for a given set of nominal or specified inputs and assessment model. This is specific to a scenario; in the case shown in Figure 3 if a different equation was to be used the POF and the SF would be different, similarly if a different corrosion feature with different length and depth was used again the POF and SF would be different. However, for a consistent set of nominal inputs the POF is related to SF. This shows that the reliability methods can be used for calibrating safety factors. This same principle has been used in structural codes (Israel et al. 1987, MacGregor1983, Jordaan and Maes 1991). Consequently reliability methods, which are based on a safety rationale, can be used to calibrate SFs and provide a rationale for optimizing minimum safety factors. This will enable reasonably consistent safety in deterministic methods across many types of scenarios. The correlations between POF and SF are further examined in the next sections. Minimum required safety factors (min SFs) should be selected such that generally sufficient safety is maintained based on the level of consequences present, as shown the Figure 4. To achieve consistent risk, higher target reliabilities are required in higher consequence locations. Therefore the minimum SF required will also be higher (when the SF are calibrated using reliability methods). This is the justification for higher minimum SF in higher consequence locations as it provides appropriate risk levels.

provide inconsistent levels of safety as case specific uncertainty is not accounted

1 However sometimes may use inputs such as reported feature dimensions which are mean or central values due to the lack of clear specification

Copyright 2012 by ASME

MOP

Detrministic Pburst

Pburst
Min SF

Low consequence
e.g., Class 1

MOP

Detrministic Pburst

Pburst
Min SF

High consequence
e.g., Class 3

Figure 4 Accounting for consequences by assuring lower POFs or higher min SFs for higher consequences. CORRELATION BETWEEN DETERMINISTIC SAFETY FACTORS AND PROBABILITIES OF FAILURE As shown in the section above, probability of failure (POF) and SF (or RPR) are related by its very definition. Consequently one would expect some correlation between POF and SF. This relationship is investigated with actual ILI results. A comparison of the POF to SF for a typical ILI run is illustrated in Figure 5. It should be noted that RPR (or SF) which is the deterministic metric for criticality is broadly inversely proportional to log(POF) as shown in the Figure 5 below. However the figure also shows that for any one value of SF there can be POF values even an order of magnitude different (note that the same input definitions and equations are used in both cases). This scatter shows that the relationship between the deterministic SF and POF is different between corrosion features even within the same pipeline. If different equations and pipelines are used this variation is even larger.

From the gradient of a typical sentencing plot (where depth vs length for critical defects are plotted) it can be concluded that the burst pressure is more sensitive to a 10%WT depth variation when the defect is long than when the defect is short. Consider now the case where two corrosion anomalies have identical RPR: a long fairly shallow anomaly and another, deeper but shorter anomaly. Because both anomalies have the same sizing uncertainty, the calculated POF indicates higher likelihood of burst failure for the longer anomaly than for the shorter one. The shallower longer defect, which could have a significantly different burst pressure if the depth was slightly different, would have a higher POF than its deeper counterpart that has the same RPR. This shows that the longer defect is more likely to fail than the deeper one even though they have the same RPR value. Depending on the level of consequence around the pipe, pipelines are designed to different design factors, or in other words to operate at different stress levels (or design factors which correspond to the %SMYS (specified minimum yield stress) at which they operate). Lower stress levels lead to higher RPR (or SF) ranges and lower probabilities of failure and these differences are reflected in the Figure 6 below. Class 1 pipe is designed with a higher design factor than Class 2, so the Class 1 pipe would have a lower SF. Consequently for corrosion features the RPR range is lower in Class 1 than in Class 2, as seen in Figure 6. Similarly Class 2 pipe is designed with a lower design factor than Class 1. Therefore the SF for perfect pipe and consequently all corrosion features are higher in Class 2 than in Class 1. This is because adverse event in higher class areas have more severe consequences and for there to be risk consistency, they need to have higher reliability targets. (In this example, as there is less pipe at 80% SMYS or 58%SMYS, the full range of RPR and POF values are not seen for these stress levels.) The minimum required SF values (according to CSA Z662 2011) are marked with relevant colors for the two location classes represented in this chart. It can be seen that the Class 1 defects have a minimum RPR at 1.25. For the Class 2 pipe the RPR ranges are higher and the minimum allowable RPR is also higher; the blue dots cloud (Class 2 locations) is generally to the right (i.e. higher RPR) than the pink one (Class 1 locations).

POF

RPR = SF

Figure 5 Correlation between Safety Factors (SFs) and Probabilities of Failure (POF) SF (commonly known as RPR) is a deterministic measure of safety at a given corrosion feature as it estimates magnitude of burst pressure (resistance to rupture) in comparison to the applied load of MOP. POF is a measure of risk for a given level of consequences. It can be seen from the figure above that one value of RPR can have many values of POF. This is because different aspect ratios of features could have the same RPR, such as a deep shorter feature and a longer shallower feature. The burst pressure can be highly sensitive to depth variations.

Copyright 2012 by ASME

Typical RPR ranges for different stress levels

1.00E-01

Canadian Pipeline in Class 1 and 2 - ILI defects 80% SMYS - class 1

Annual Prob of Failure per defect (year 1)

76% SMYS - class 1 70% SMYS - class 2 63% SMYS - class 2 58% SMYS - class 2 RPR = 1.25 RPR = 1.39

1.00E-02

using the flow stress (Sf) for a corrosion feature. In the limit, for a defect that becomes insignificantly small, that R0Sf approaches Pburst calculated using the Barlow equation with SMYS substituted by Sf. Therefore for the maintenance case the perfect pipe has a safety factor, SFO, where; SFO = R0Sf / MOP But shown in Figure 7 MOP = DF R0SMYS Consequently, (2) (1)

1.00E-03

1.00E-04

1.00E-05

1.00E-06 1 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8

RPR or SF (=Pb/MAOP)

SFO = R0Sf / (DF R0SMYS) = (1/DF) (R0Sf/ R0SMYS)

(3)

Figure 6 POF vs SF for different levels of %SMYS MAXIMUM DETERMINISTIC SAFETY FACTOR There are some physical limits to the SF that can be achieved in maintenance. One limit is the SF that is present at design which limits the maximum SF achievable. In other words, the SF can never be higher than that of perfect pipe. At design the Barlow equation is used together with a design factor (DF) and maximum operating pressure (MOP) to calculate the required resistance of the perfect pipe (R0SMYS). This condition is graphically represented in the figure below.
Nominal WT SMYS Nominal OD 1.0

This gives the maximum safety factor that can be achieved by a certain design where R0Sf/ R0SMYS generally range from 1.11 to 1.25 depending on the grade. This calculation also shows that - for perfect pipe - the SFs are higher for higher classes, as it should be in consideration of higher consequences. This is a necessary requirement to achieve risk consistency across multiple classes. For a defect that becomes insignificantly small, shown in Figure 8, the probability densities are the same as those in Figure 7 (as the actual resistance has not changed in the limit); only the deterministic definition of the limiting stress has changed from SMYS to Sf.

Yield strength

WT

OD

Model error (Test / predicted)

MOP

R0SMYS

Pburst
1/DF

POF overlap

MOP < DF R0SMYS R0SMYS /MOP > 1/ DF [= 1.39, 1.67, 2.0, 2.5 for Class 1 to 4 respectively in the USA]

Figure 7 Effect of design factor on safety - At design stage The predefined nominal values and the MOP (or MAOP) are combined to calculate R0SMYS using the Barlow equation. In the graphical representation it is seen that DF keeps the probability densities of operating pressure and Pburst apart. During maintenance (if an infinitesimally small corrosion feature is introduced) the Pburst equations such as B31G or RSTRENG use flow stress instead of SMYS as the limiting stress of the remaining ligament. Consequently the limit state can be represented by the following Figure 8 during the operations or maintenance phase, where R0Sf is the resistance Figure 8The maximum safety factor achievable for perfect pipe This maximum safety factor concept explains why in jurisdictions, where a minimum SF of 1/DF is required, such as in Canada, a class change will lead to unachievable safety

Copyright 2012 by ASME

factor levels. For instance in Canada according to CSA Z6622011 the design factors for Class 2 and 3 are 0.72 and 0.56 and consequently the minimum SFs for Class 2 and 3 are 1.39 and 1.79 respectively. If a pipe designed to Class 2 experiences a class change due to population growth around it, to Class 3, the new required minimum SF is 1.79. However as given by equation (3) above, the maximum SF that the pipe designed to Class 2 can achieve is: Maximum SF= 1.39 ROSf/ ROSMYS (3a) = 1.54 to 1.74 Therefore the Class 3 safety factor of 1.79 is not achievable with pipe designed to Class 2. Consequently, through engineering assessments, other measures are employed to increase the reliability of the pipeline. MINIMUM DETERMINISTIC SAFETY FACTOR As explained in section above the SF has a maximum value SFo that is dependent on the design factor, grade, and the flow stress definition. The SF associated with an individual corrosion feature can be anywhere between SFo and the minimum value accepted. The previous sections have shown that reliability and minimum accepted SFs are interrelated and therefore when a minimum SF is specified there is a certain range of probabilities of failure that are implicitly accepted. There is a range of POF values (and not a single POF value) because of the different equations used, feature configurations, and because a deterministic SF cannot assure a definite POF that explicitly considers all uncertainties. Excavations would be undertaken if the minimum required SF is not achieved. Therefore the minimum SF should correspond (at least in general) to an acceptable level of POF. In other words, this minimum SF value should be based on acceptable safety or risk level. It has been shown how reliability is related to these SF values and how this relationship can be used as the rationale for minimum safety factors. Therefore these minimum acceptable SFs should be calibrated using reliability methods to achieve individual and societal risk acceptance criteria. Currently used minimum SFs in pipeline industry standards have not been calibrated in this manner. This lack of rationale leads to unsafe or overly conservative SFs as shown below. DEFICIENCIES FACTORS IN EXSITING MINIMUM SAFETY

CSA Z662 2011 requires the minimum SF to be the same as 1/DF which is the most stringent set of SFs as this allows only the deterioration of a SF from SFO to 1/DF which, as shown in above and in Figure 8, is equivalent to the difference between applying the flow stress and SMYS. Consequently the original perfect pipe SF is allowed to deteriorate by a factor of 0.8 to 0.9 (1/1.25 to 1/1.11). This has no safety related rationale for deriving the minimum SF. (Work done by authors has shown the corresponding POF values to be significantly below 10-6 /km/yr even for Class 1 which is unnecessarily low as shown in Annex O of CSA Z662 2011). On the other end of the spectrum of SFs used in the pipeline industry, ASME B31.8S-2010 recommends the use of a 1.1 minimum SF for immediate response criteria for all consequence levels (i.e. applies to all classes). This is based on the safety factor used for hydro testing in location Class 1; however use of the same SF is extrapolated to all consequence levels. As discussed above, this is contrary to risk and reliability principles. The same minimum safety factor which is considered to be adequate for a hydro test, where there are no measurement errors, is not transferrable to an ILI assessment where these errors exist, unless these errors are accounted for by conservative input values. More importantly a SF (and related probabilities of failure) that is appropriate for a lower consequence area (Class 1) cannot be appropriate for higher consequence areas (Class 2 to 4). This means the current ASME B31.8S allows the safety factor of Class 1 pipe which has a maximum value of 1.51 to 1.72 (according to equation (3) ) to deteriorate to 1.1, while in Class 4 a maximum value of 2.71 to 3.09 is also allowed to deteriorate to 1.1. The practical detrimental effect of such a large reduction in safety factor is evident in the examples given in Table 2. In these examples different lengths of corrosion defects are considered to be present in all 4 classes of pipe and the defect depth for this defect to reach a RPR or SF of 1.1 is calculated. It can be seen that because more deterioration in safety factor is allowed in the higher classes much deeper defects are allowed by the higher class pipe. This is due to the lack of consideration for the higher consequences in these classes at the maintenance stage (same acceptable minimum safety factor irrespective of location class) even though they were considered at the design stage (more stringent minimum safety factor for more densely populated classes).

There is a large variation in the minimum acceptable SF in current standards. This variation is due to a lack of a consistent rationale or guidance on how to calibrate safety factors.

Copyright 2012 by ASME

Table 2 Example of corrosion features at SF=RPR=1.1 for Class 1 to 4 pipelines

SUMMARY AND CONCLUSIONS The main objective in using reliability-based methods is to provide consistent safety by accounting for uncertainties which are not explicitly considered by deterministic safety factors. Through probabilistic calculations, reliability methods also allow articulation and explicit quantification of safety. Better specification and improved risk consistency, enable the optimization of safety across then entire pipeline network. Deterministic methods adopt conservative values of both loads and resistances and combine them using SFs for further conservatism. Traditionally the SFs are not based on a risk based or safety rationale but are based on assessment of some specific cases or have been agreed upon through (evolved) consensus in the industry. Consequently the final level of conservatism in deterministic methods is often unknown. However, deterministic methods have a lot of practical appeal due to their familiarity among practicing engineers. This paper shows that for a specific scenario with given levels of uncertainty and specified deterministic input values the reliability level is mathematically related to the safety factor. At a certain reliability level, achieved by the probability distributions of the load and resistance, the deterministic safety factor is also defined for a given set of nominal or specified inputs and assessment model. It is shown that RPR (or SF) which is the deterministic metric for criticality is broadly inversely proportional to log(POF). However it is also shown that for any one value of SF there can be POF values even an order of magnitude different (even when the same input definitions and equations are used). This scatter shows that there is no unique relationship between the deterministic SF and POF for corrosion features even within the same pipeline. If different burst equations and pipelines are compared this variation is even larger. Consequently, reliability methods can be used to calibrate SFs for a set of commonly used burst models and observed variations in anomaly populations and material or pipe properties. By using reliability methods the risk acceptability rationales of individual risk and societal risk criteria can be translated to give SFs that broadly provide these acceptable risk

levels. This rationale can be used to calibrate SFs for different consequence locations. It can also be used to understand the maximum possible SFs for a given design. There is a large variation in the minimum acceptable SFs in current standards between jurisdictions. This variation is due to a lack of a consistent rationale or guidance on how to calibrate safety factors. CSA Z662 2011 requires the minimum SF to be the same as 1/DF which is the most stringent set of SFs. However there is no explicit safety rationale for this set of SFs. ASME B31.8S-2010 recommends the use of 1.1 minimum SF for immediate response criteria for all consequence levels. This has been shown to be contrary to risk based principles: a larger, relative drop in reliability is accepted in Class 4 than in Class 1 locations. Practically many operators use minimum safety factors in between those recommended in CSA Z662 2011 and ASME B31.8S-2010. The safety factors used in deterministic criteria for use with ILI-based maintenance need a consistent riskbased rationale to optimize mitigation decisions. This can be achieved by using reliability methods to calibrate the safety factors. REFERENCES ASME, 2009, ASME B31.G, Manual for Determining the Remaining Strength of Corroded Pipelines: Supplement to ASME B 31 Code for Pressure Piping, An American National Standard, The American Society of Mechanical Engineers. Brown, M., Nessim, M. and Greaves, H. 1995, Pipeline Defect Assessment: Deterministic and Probabilistic Considerations. Second International Conference on Pipeline Technology, Ostend, Belgium, September CCPS, 2007, Guidelines for Risk-Based Process Safety, Center for Chemical process Safety An AIChE Industry Technology Alliance, www.wiley.com/go/ccps , Wiley

Copyright 2012 by ASME

Chauhan, V., Brister, J., and Dafea, M., 2009, A Review of Methods for Assessing the Remaining Strength of Corroded Pipelines, US Department of Transportation, Report No. 6781, September Health and Safety Executive (HSE), 2001, Reducing Risks Protecting People HSEs decision-making process, www.hsebooks.co.uk , Norwich, UK Israel, M. S., Ellingwood, B., and Corotis, R., 1987, Reliability based Code Formulations for Reinforced Concrete Buildings, journal of Structural Engineering, Vol 113, No 10, ASCE paper no. 21911, Oct 1987 Jordaan, I., and Maes, M., 1991, Rationale for Load Specifications and Load factors in the new CSA code for fixed Offshore Structures, Canadian Journal of Civil Engineering, June 1991 Kariyawasam, S. N. and Peterson, W. B., Effective Improvements to Reliability Based Corrosion Management, Proceedings of IPC 2010, International Pipeline Conference, Paper No. 2010-31425, Calgary, September 2010

Kiefner J. F., 2008, Safety Factors for Assessing Pipeline Anomalies, INGAA white paper, P-PIC report, April 30 MacGregor, J. G., 1983, Load and Resistance Factors for Concrete Design, American Concrete Institute Journal, Jul/Aug 1983 Stephens, M. J. and Nessim, M. A., 2006, A Comprehensive Approach to Corrosion Management Based on Structural Reliability Methods, Proceedings of IPC 2006, International Pipeline Conference, Paper No. IPC2006-10458, Calgary, September Stephens, M. J. and Nessim, M. A., 2009, Guidelines for Reliability based Pipeline Integrity Methods, Final report on PR-244-05302, Pipeline Research Council International, Inc., September. Vieth, P. H. and Kiefner, J. F., 1993, RSTRENG2 Users Manual, Final Report on PR-218-9205 to Pipeline Corrosion Supervisory Committee, Pipeline Research Committee, Pipeline Research Council International, Inc., Catalog No. 51688, Kiefner &Associates, Inc., March

10

Copyright 2012 by ASME