Pipeline failure frequency calculation using PIPIN
Zoe Chaplin, Risk Assessment Specialist, Health and Safety Laboratory, Harpur Hill, Buxton, SK17 9JN
The Health and Safety Executive (HSE) uses the PIPIN (PIPeline INtegrity) model to predict failure frequencies of major accident hazard (MAH) pipelines. PIPIN contains two approaches to determine failure frequencies: an approach based on operational experience data, which generates failure frequencies for four principle failure modes (mechanical failures, ground movement and other events, corrosion and third party activity); and a predictive model that uses structural reliability techniques to predict the failure frequency due to third party activity (TPA) only.
The failure frequencies generated by PIPIN are used as part of a risk assessment process to generate land use planning (LUP) zones around pipelines. HSE use the LUP zones to provide guidance to local planning authorities on proposed developments near a pipeline; potential modifications to an existing pipeline; and proposed new pipelines.
PIPIN was developed in the 1990s and several improvements to the modelling have been identified since that time. These include improving the solution method and the underlying science, as well as updating the historical data used in the model. HSE asked the Health and Safety Laboratory (HSL) to investigate areas for improvement and, where appropriate, implement changes to the PIPIN model.
This paper describes work carried out by HSL to develop a new version of PIPIN for HSE to use in their MAH pipeline assessments. This includes:
· developing a Monte Carlo solution method to replace the FORM/SORM (First/Second Order Reliability Method) used to solve the fracture mechanics equations;
· investigating recommendations made in a peer review of PIPIN and implementing the changes that improved the science used in the model; and
· applying up-to-date data from UKOPA (UK Onshore Pipeline Operators’ Association) and CONCAWE (CONservation of Clean Air and Water in Europe) in both the TPA predictive model and the operational experience model.
HSL tested the new model by calculating the failure frequencies of 584 natural gas pipelines, which represent a subset of the UK natural gas network. A comparison was made between the results obtained from the original model, with the outputs from implementing each of the changes individually, and with the results obtained from the final version incorporating all of the changes. The tests indicated that the use of the new model reduced predicted failure frequencies on average. Generally, this leads to a decrease in the size of the calculated LUP zones.
The improvements made to PIPIN ensure that HSE’s MAH pipeline failure frequency model is more robust and uses the latest science and data. The new model has been disseminated to Industry.
Keywords: HSE, PIPIN, pipeline integrity, failure frequency, failure rates, structural reliability, third party activity, LUP zones, Monte Carlo.
Introduction
The Health and Safety Executive (HSE) use a computer code PIPIN (PIPeline INtegrity, Linkens 1997, Linkens 1998) to determine failure frequencies (also referred to as failure rates) of Major Accident Hazard (MAH) pipelines. PIPIN calculates the failure frequencies for four categories of pipeline failure (pinhole, small hole, large hole and rupture), which are used in other tools, such as MISHAP (Model for the estimation of Individual and Societal risk from HAzards of Pipelines, HSE 2000, HSE 2002, Chaplin 2014a). MISHAP is used to calculate the levels of risk around pipelines, which are used by HSE to set land use planning (LUP) zones. The industry equivalent guidance is contained in PD 8010 Part 3 (BSI 2009) and TD/2 (IGEM 2013). PIPIN uses two approaches to determine failure frequencies: an approach based on operational experience data, which generates failure frequencies for four principle failure modes (mechanical failures, ground movement/other, corrosion and third party activity); and a predictive model that uses structural reliability techniques to predict the failure frequency due to third party activity (TPA) only.
The original version of PIPIN used a FORM/SORM (First/Second Order Reliability Method, Thoft-Christensen 1982, Shetty 1996, Shetty 1997) approach to solve the fracture mechanics equations in the predictive model. In a significant number of cases, the method failed to find a solution. HSE therefore tasked the Health and Safety Laboratory (HSL) with modifying the model to use a more robust solution technique. As the original source code was not available, the entire model had to be rewritten. The initial aim was to only change the solution method being used, without changing the science behind the model or the data that feeds into it. This was to ensure that the new model replicated the results from the existing model as closely as possible. Once this had been completed, the science and data within the model were reviewed and updated.
This paper gives an overview of the fracture mechanics within PIPIN and describes the various stages in the updating of the model, the changes seen to the predicted failure frequencies for a test set of 584 pipelines, and the effect that these changes have on the final LUP zones (Chaplin, 2014b).
Model description
It has been observed that there are two primary mechanisms by which a pipeline may be breached as a result of external impact damage. In either case, if the breach is unstable, a rupture may result.
The first mechanism is by a surface gouge, which can be created, for example, as a result of contact by excavating machinery. This can lead to a rounded profile gouge. A statistical distribution has been fit to data on the length and depth of such gouges found in practice. If the gouge depth is greater than the wall thickness then the pipeline is assumed to have been punctured. Figure 1 illustrates a gouge.
Figure 1 Diagram illustrating a gouge (Linkens 1998)
The second mechanism is by a dent-gouge. This occurs if the impact energy is high enough to lead to significant tensile bending stresses at the root of the gouge, resulting in a dent, which increases the probability of a breach of the pipeline wall. Figure 2 illustrates a dent-gouge.
Figure 2 Diagram illustrating a dent-gouge (Linkens 1998)
PIPIN has three main fracture mechanics models:
· A gouge model that models the plastic collapse of the pipeline using either gouge data or, with a slight modification, dent-gouge data;
· A dent-gouge model that models failure by fracture; and
· A rupture model that models the likelihood of a leak leading to a rupture resulting from either of the above failures.
Two of the fracture mechanics models above are run twice with different sets of data. This gives a total of five fracture mechanics submodels within PIPIN.
In the case of the gouge model, the gouge is assumed to be smooth which leads to no stress singularity and no micro-cracking, hence the failure can be modelled as plastic collapse. It is also assumed that the gouge is aligned with the longitudinal axes of the pipeline. Figure 1 illustrates a gouge, where “d” is the gouge depth and “c” is the gouge half-length.
If the pipeline suffers a dent then this gives rise to through-wall bending in the region of the dent leading to an increase in tensile stresses on the outer surface of the pipeline. This will significantly increase the probability that the pipeline will fail and, in particular, can lead to micro-cracks opening at the base of the gouge. Figure 2 illustrates a dent-gouge in a pipeline where “d” is the gouge depth, “c” is the gouge half-length and “dentd” is the dent depth.
In all cases the results are compared with the R6 Rev. 3 fracture assessment procedure (CEGB 1976) to determine whether the pipeline fails. This is a curve such that, if a point lies above it then the pipeline has failed, whilst if it lies on or beneath the curve, then the external impact will not have led to a failure.
The rupture model calculates the conditional probability of a rupture given a through wall crack, caused by either a gouge or dent-gouge. Ruptures are dominated by the average stress through the wall thickness, which is assumed to be virtually the same for both gouges and dent-gouges. It is also assumed that surface gouges or dents are likely to extend through the wall before spreading significantly along the pipeline length. A penetrating defect, therefore, precedes a long-running rupture and this has been modelled as a straight-fronted rectangular crack whose length is the same as the associated gouge.
Each of the fracture mechanics models requires a number of inputs, both in terms of the pipeline characteristics (e.g. diameter, wall thickness, operating pressure etc.) and also for the damage data (i.e. gouge length, gouge depth, dent-gouge length, dent-gouge depth and impact force). All of these parameters are described using statistical distributions (a combination of normal and lognormal distributions for the pipeline characteristics, and Weibull distributions for the damage data). Using statistical distributions allows for the fact that the actual values for the damage data and the pipeline characteristics, may vary slightly from those input (due to inaccuracies in recording methods etc.). In addition, the original version of the model incorporates modelling uncertainties, which are factors applied to some of the fracture mechanics equations. These are also described by normal or lognormal distributions.
The failure probabilities calculated using each of the fracture mechanics models are combined with incident frequencies (the likelihood that the pipeline will be struck), and a probability of a hole being within a specified diameter range, to produce overall failure frequencies for a pipeline for each hole size, i.e. the frequency that the pipeline is hit is multiplied by the probability that it will fail if it is hit by an object, and the probability that a hole within a specified diameter range will be formed.
HSE currently require pipeline failure frequencies for the following hole sizes:
· pinhole: £ 25 mm diameter;
· small hole: > 25 to £ 75 mm diameter;
· large hole: > 75 to £ 110 mm diameter
· rupture: > 110 mm diameter
A rupture is assumed to occur as a result of an unstable leak or as a result of a stable leak that leads to a hole size greater than 110 mm in diameter. In both cases, this can be initiated by either a gouge or a dent-gouge.
Modifying the solution method
The original version of PIPIN used the FORM solution method, which failed to converge to an answer in a significant number of cases. Alternative methods considered by HSL include SORM, direct numerical integration or Monte Carlo (MC) simulation. The SORM solution method only produces an approximate solution to the problem and it is likely there would still be issues over its convergence. Direct numerical integration is highly complex, especially given the number of variables involved. The use of a Monte Carlo simulation keeps the problem relatively simple whilst still allowing for a high degree of accuracy. Although Monte Carlo simulation can be computationally time consuming, this approach was the one chosen as it is more intuitive than direct numerical integration. Modern computer power means that run times have decreased significantly since PIPIN was originally developed, making the Monte Carlo solution a more viable alternative to the FORM solution adopted at that time.
The Monte Carlo approach implemented involves randomly sampling each of the input variables in the fracture mechanics equations (e.g. pipeline parameters and damage distributions) to determine whether a failure occurs for a particular set of values. A random number generator is used to generate the input variables for the rest of the model. The values randomly sampled are input to the fracture mechanics equations to ascertain whether this particular combination of parameters would cause a failure point. The stated distributions for each of the variables are consistent with those used in the original version of PIPIN (Linkens 1997).
By repeating this process a large number of times the probability of failure from each of the five failure models can be calculated. The probability of failure is simply the number of cases where failure occurred divided by the number of iterations required for that failure model. The process is repeated until the failure probabilities have converged, i.e. do not change significantly with further iterations. Initially the failure probability changes significantly as more failure points are identified. As more iterations are performed then these changes become smaller. A convergence criterion is specified to determine at what point the calculations can terminate (i.e. specifies the tolerance to which the individual failure model can be said to have converged on an answer). The final calculated failure probabilities from each of the five models are combined with the incident frequencies and the probability of a hole in a specified diameter range to calculate a failure frequency by hole size.
Results using the Monte Carlo solution method were obtained for a set of 584 pipelines, representative of pipelines within the UK natural gas transmission system. Figure 3 illustrates the results for the rupture frequency on a linear scale for the 584 pipelines, and compares the Monte Carlo (MC) model to the FORM PIPIN model. Figure 4 displays the same information but on a log-log scale. If points lie on the solid line in the figures then it indicates that the two models have produced the same result. If the points lie above the line then the failure frequencies from the Monte Carlo model are lower than the FORM PIPIN model. If points are below the line, the failure frequencies from the Monte Carlo model are higher than the FORM PIPIN model.
Figure 3 Comparison of PIPIN and Monte Carlo (MC) model for rupture frequencies
Figure 4 Comparison of PIPIN and Monte Carlo (MC) model for rupture frequencies on a log-log scale
From the figures it can be seen that there is close agreement between the two models for most of the cases examined. There are approximately 15 cases where there was not close agreement between the two models. In most cases, the Monte Carlo method produces failure frequencies that are slightly lower than those obtained using the FORM version of PIPIN. Of the outlying points, ten were at diameters of 114.3 mm or less and with a maximum operating pressure of less than 44 bar. This represented all the low diameter, low pressure pipelines tested. Most of the remainder were at a diameter of 168.3 mm and again with low pressure. However, at this diameter and with lower pressure, there were many more cases that showed close agreement between the two models.