Proceedings of the 2012 9th International Pipeline Conference IPC2012 September 24-28, 2012, Calgary, Alberta, Canada

IPC2012-90450
SAFETY LEVELS ASSOCIATED WITH THE ULTIMATE LIMIT STATE RELIABILITY TARGETS IN ANNEX O OF CSA Z662
Maher Nessim C-FER Technologies Edmonton, Alberta, Canada Mark Stephens C-FER Technologies Edmonton, Alberta, Canada Riski Adianto C-FER Technologies Edmonton, Alberta, Canada

ABSTRACT In 2005, guidelines for the application of reliability-based design and assessment (RBDA) to natural gas pipelines were developed under PRCI sponsorship. The methodology underlying these guidelines has since been adopted as a non-mandatory Annex in the CSA Z662 standard (Annex O). Because the methodology is based on the concept of consistent risk, it is more restrictive than current design standards for some pipelines and less restrictive for other pipelines. Specifically, the RBDA reliability targets for ultimate limit states (ULS) are lower than the reliability levels achieved by current design standards for large diameter, high pressure pipelines in Classes 2 to 4 (referred to in this paper as high consequence pipelines) and for all pipelines in Class 1. This has naturally led to questions among users and reviewers of RBDA regarding the adequacy of the ULS reliability targets for these pipelines. For high consequence pipelines, the safety levels associated with the ULS reliability targets are compared to risk tolerance criteria from three published European standards. The comparison demonstrates that the targets are generally more conservative than all three standards. For Class 1 pipelines, the average failure probability for pipelines designed to the RBDA methodology is compared to the average failure probabilities for pipelines designed to ASME B31.8 and Clause 4 of CSA Z662. This shows that there is no significant difference in overall failure probability because the wall thickness for most Class 1 pipelines with low ULS targets are governed by other criteria, such as minimum permitted wall thickness and maximum diameter-to-thickness ratio for standard line pipe. Recognizing the potential difficulties with reliability targets that do not govern any designs, a possible modification to align the targets with the actual reliability levels is proposed.

INTRODUCTION In 2005, guidelines for the application of reliability-based design and assessment (RBDA) to natural gas pipelines were developed in a series of projects sponsored by PRCI. The methodology underlying these guidelines has since been adopted as the non-mandatory Annex O in the CSA Z662 standard [1] and is described in detail in Nessim and Zhou [2,3]. A key component of the RBDA approach is the reliability targets, which are used as minimum acceptance criteria for proposed design and/or operational solutions. The standard defines three limit state categories, namely ultimate limit states (ULS), leakage limit states (LLS) and serviceability limit states (SLS). A unique set of reliability targets that reflect the severity of the failure consequences is defined for each limit state category. The ULS targets were calibrated to ensure that a uniform safety benchmark is met for all pipelines, where safety is expressed as the absence of fatality risk to the population around the pipeline. The benchmark is defined in terms of the average risk level corresponding to a representative network of new pipelines that are designed to ASME B31.8 and maintained according to current best practices. Details of this approach are described in Nessim and Zhou [3] and Nessim et al. [4]. In contrast to the uniform risk underlying the reliability targets used in the RBDA approach, the risk levels resulting from application of the hoop stress design factor used in conventional design standards (including ASME B31.8 [5] and CSA Z662 [1]) have been shown to vary in a wide range (approximately six orders of magnitude) for different combinations of diameter, pressure, grade and location class [4]. Because the targets are based on the average risk associated with the standard for all pipeline designs, they are more restrictive than current standards for some pipelines and less restrictive for other pipelines. Specifically, the RBDA targets are lower than the reliability levels achieved by current design standards for pipelines larger in diameter than 610 mm

Copyright 2012 by ASME

(NPS 24) in Classes 2, 3 and 4 (referred to here as high consequence pipelines) and for all pipelines in Class 1. Conversely, the targets are higher than the reliability levels achieved by current design standards for small and medium diameter pipelines in Classes 2, 3 and 4. The reason for these differences is that the risk level associated with a given pipeline is not directly determined by the hoop stress factor used as the primary safety control parameter in current standards. Instead, risk is more strongly correlated to the following parameters: 1. Pipe wall thickness, which is the most important factor in determining the probability of failure with respect to dominant failure threats, including corrosion and equipment impact. Population density, which determines the number of people exposed to risk from a potential failure.

OVERVIEW OF THE ULS RELIABILITY TARGETS The ULS reliability targets are plotted in Figure 1 and can be calculated using the following relationships (reproduced from CSA Z662 Annex O):
1 1 1 pT RT 1 1 1650 (PD3 )0.66 197 ( PD3 )0.66 49700 PD
3

0 PD3 1.16 107 1.16 107 PD3 7.1 109 PD3 7.1 109

(1)

4.05 1010 ( PD3 )1.6

2.

Risk calculations that take these factors into consideration [4] show that current design standards result in below average risk levels for pipelines with larger diameters and higher pressures in the same safety class because those pipelines have thicker walls at a given hoop stress factor. Conversely, current design standards lead to above average risk levels for smaller diameter pipelines in Classes 2, 3 and 4 because they have thinner walls at a given design factor. Class 1 pipelines have below average risk levels under current design standards because of the associated low population density. The above-mentioned deviations from the well established standardized design approach have led to questions regarding the validity and appropriateness of the ULS reliability targets as they were scrutinized in the context of standard development and early application. The relative explanation given in the previous paragraph has, in the experience of the authors, been generally accepted as valid and consistent with recent experience. However, it was also clear that further validation and refinement of the safety levels implied by the ULS targets is required to achieve the necessary level of confidence in the approach. The objective of this paper is to describe recent work carried out to further validate and refine the ULS reliability targets incorporated in CSA Z662 and facilitate their acceptance within the industry. Attention is focused on cases where the targets are lower than the reliability achieved by current design standards. Specifically, the paper answers the following two questions: Are the ULS reliability targets safe enough for large diameter pipelines in areas with high population densities (referred to in the paper as high consequence pipelines)? Do the ULS targets imply an increase in the overall failure probability for Class 1 pipelines?

where pT is the probability of failure associated with the reliability targets RT (per km-yr), is the population density (people per hectare), P is the pressure (MPa) and D is the diameter (mm). Since ULS failure consequences can be expressed as a function of PD3 (see the following section), the targets are also defined as a function of this parameter in order to achieve a uniform risk level as discussed in the previous section.
1 - 1E-09 1 - 1E-08

Target Reliability (per km-yr)

1 - 1E-07 1 - 1E-06 1 - 1E-05 1 - 1E-04 1 - 1E-03 1 - 1E-02 1 - 1E-01 1 - 1E+00 1.E+06

1.E+07

1.E+08

1.E+09

1.E+10

1.E+11

1.E+12

1.E+13

PD3(people/ha-MPa-mm3)

Figure 1 Reliability Targets for Natural Gas Pipelines from Annex O of CSA Z662

SAFETY LEVELS FOR HIGH CONSEQUENCE PIPELINES Assessment Approach As mentioned in the introduction, high consequence pipelines are defined as pipelines with diameters 610 mm (NPS 24) and operating pressures 6.9 MPa in location Classes 2, 3 or 4. This range of design parameters is consistent with cases for which the RBDA targets tend to be less conservative than the conventional design approach. The steel grades considered appropriate for these pressure and diameter combinations are between 359 and 550 MPa. Based on these

Copyright 2012 by ASME

parameter ranges, all combinations of the design parameters shown in Table 1 were used as a basis for an assessment of the safety implications for high consequence pipelines designed to meet the reliability targets. Each test case was designed to meet the associated reliability target. The risk level associated with the design was then calculated and compared to risk criteria published in recognized international standards, guidance documents and regulations that pertain directly to pipelines [6,7,8].
Table 3 Design Cases Used in the Assessment of High Consequence Pipelines
Parameter Pipe Diameter, mm (NPS) Maximum Operating Pressure, MPa (psi) Steel Grade, MPa (API grade) Location Class Values 610 (24), 762 (30), 914 (36), 1,067 (42), 1,219 (48) 6.9 (1,000), 9.65 (1,400), 12.4 (1,800), 15.2 (2,200) 359 (X52), 414 (X60), 483 (X70), 550 (X80) 2, 3, 4

Societal Risk Implications Using the same consequence modelling approach employed in the original target development [3], the number of fatalities, N, expected to result from rupture of a gas pipeline can be calculated from PD3 as follows (in which all units are the same as for Equation 1):

N 3.97 10 10 PD3

(2)

For a particular design case, the parameter PD3 can be used to calculate the probability of rupture consistent with the reliability target, and then to calculate the expected number of fatalities, N, given rupture. The results of this calculation, for each of the design cases, are shown in Figure 2. Consistent with the data used in developing the original targets, the population densities (people/ha) used in developing Figure 2 are 3.3 for Class 2, 18 for Class 3 and 100 for Class 4.

A typical pipeline F-N curve shows the relationship between the frequency of failures causing N or more fatalities (per km-yr) and the expected number of fatalities given failure. Each data point (i.e. design case) plotted in Figure 2 represents the annual frequency of occurrence, F, of an event (i.e. rupture) that causes N expected fatalities. With the approximating assumption that the consequences of failure for a given pipeline are expressed as a single value representing the expected number of fatalities, each point fully represents the underlying pipeline on an F-N curve. Since each of these points is calculated on the basis of just meeting the RBDA target, the locus of corresponding points for all pipeline cases represents the boundary of acceptable designs on an F-N plot, allowing the results to be compared to the requirements contained in other recognized standards, regulations and guidance documents that prescribe societal risk criteria for pipelines in terms of an F-N curve. The design cases are plotted in Figure 3, together with the societal risk acceptance criteria obtained from IGEM/TD/1 [6], PD 8010-3 [7] and the Dutch government regulations for pipelines [8]. It is noted that all three acceptance criteria in the figure represent broadly acceptable risk levels, so that cases that do not meet the criteria may still be justifiable under the corresponding standard based on other criteria such as the ALARP (as low as reasonably practicable) concept. Figure 3 shows that the societal risk levels associated with all of the high consequence design cases are significantly below the thresholds that define the limit for broadly acceptable societal risk according to both PD 8010 and the Dutch pipeline regulations. The societal risk level associated with the vast majority of design cases is also shown to be comparable to or less than the broadly acceptable societal risk threshold defined in IGEM/TD/1. In addition, the few cases that exceed the IGEM criterion do so only marginally, and they represent 1,067-mm and 1,219-mm diameter (NPS 42 and NPS 48) pipelines operating at high pressures in Class 4 areas, which are highly unlikely to exist.

Copyright 2012 by ASME

Class 2 1.E 02

Class 3

Class 4

Probability of Rupture (per km yr)

1.E 03 1.E 04 1.E 05 1.E 06 1.E 07 1.E 08 1.E 09 1.E 10

1 10 100 Number of Fatalities, N 1,000 10,000

Figure 2 Expected Number of Fatalities versus Rupture Probability Corresponding to the RBDA ULS Reliability Targets

RBDA Targets 1.E 02

IGE/TD/1

PD 8010 3

Dutch Regulations

Probability of Failure Causing N or More Fatalities (per km yr)

1.E 03 1.E 04 1.E 05 1.E 06 1.E 07 1.E 08 1.E 09 1.E 10 1 10 100 1,000 Number of Fatalities, N

Figure 3 Comparison of Societal Risk Levels Corresponding to the RBDA Targets with Established Criteria

Individual Risk Implications Individual risk is defined as the annual probability of fatality due to a pipeline failure for a person living or working in the proximity of the pipeline. Using the same consequence modelling approach employed in developing the original targets [3], it can be shown that the individual risk, IR, is given by the following (in which all units are the same as in Equation 1):
IR 7.72 10
8

p D2 P

(3)

where p is the probability of failure.

For each design case, the rupture probability consistent with the reliability targets can be calculated from Equation 1. Equation 3 can then be used with that probability to calculate the individual risk. The results of this calculation are shown in Figure 4 for the same cases plotted in Figure 3. Figure 4 also shows the threshold that defines the limit for broadly acceptable individual risk according to PD 8010, IGEM/TD/1 and the Dutch pipeline regulations. It shows that the individual risk levels associated with all of the high consequence design cases are below the broadly acceptable risk threshold. It also shows that for very high consequence pipelines, the individual risk level is below 110-8 per yr, a level that is widely perceived to be negligible.

Copyright 2012 by ASME

Class 2 1.E 02 1.E 03

Class 3

Class 4

Individual Risk (per yr)

1.E 04 1.E 05 1.E 06 1.E 07 1.E 08 1.E 09 1.E 10 1.E+09 1.E+10 1.E+11 PD3 (people/ha MPa mm3) 1.E+12 1.E+13

1 x 10 6 per yr

Figure 4 Individual Risk Levels for High Consequence Design Cases

FAILURE RATES FOR CLASS 1 PIPELINES Assessment Approach The pipeline parameters used in this assessment are based on all combinations of the parameters in Table 2. The test cases were designed to meet the requirements of RBDA as well as ASME B31.8 and CSA Z662. The failure probabilities associated with all three designs were then compared.
Table 2 Design Cases Used in the Assessment of Class 1 Pipelines
Parameter Pipe Diameter, mm (NPS) Maximum Operating Pressure, MPa (psi) Steel Grade, MPa (API grade) Values 219 (8), 406 (16), 610 (24), 762 (30), 1,067 (42) 4.14 (600), 6.9 (1,000), 9.65 (1,400) 241 (B), 359 (X52), 414 (X60), 483 (X70)

CSA. Meet the design factor requirements specified in Clause 4.3.5 of CSA Z662. In addition, the minimum wall thickness criteria in Table 4 and a maximum D/t of 108 were applied for all three design methods. These criteria were defined on the basis of direct input from pipeline operators [3]. It is recognized that different minimum wall thickness criteria are given in CSA Z662 and API 5L (which is likely to be used in conjunction with an ASME design) and that both of these sets of criteria are somewhat different from the ones in Table 4. However, the criteria shown in Table 4 were used for all three design methods to ensure a fair comparison between the associated structural design provisions.
Table 4 Minimum Wall Thickness Criteria Used in Designing the Test Cases
Diameter (mm) 323.8 355.6 406.4 457.5 508.0 Minimum Wall Thickness (mm) 4.37 4.78 5.56 5.99 6.35

The test cases were designed as conventional cross-country pipelines (i.e. no special features such as slopes or crossings). The criteria used in the design for the three methods are as follows: RBDA. Meet the ULS reliability targets considering equipment impact and burst due to corrosion, as well as the SLS reliability target (fixed value of 1 10-1 per km-yr as defined in Annex O of CSA Z662), considering plastic deformations under the hydrostatic test pressure. The methodology and inputs used to develop these designs are the same as those used in developing the RBDA targets [2,3]. ASME. Meet the design factor requirements specified in Section 841.1.1 of ASME B31.8.

Once designed, the same models and assumptions used in the RBDA calibration studies [2,3] were used to calculate the failure probabilities corresponding to the RBDA, ASME and CSA designs for each test case. The failure probabilities were calculated for a 50-year life, assuming an inspection interval of 10 years, with repairs based on a minimum failure-to-operating pressure ratio of 1.39 per Table 3 of ASME B31.8S [5]. An additional repair criterion of 50% minimum remaining wall was also used.

Copyright 2012 by ASME

Failure Probability Implications The maximum lifetime failure probabilities are plotted in Figure 5 along with the ULS targets. Consistent with the data used in original target calibration studies, a Class 1 population density of 0.04 people/ha was used for all cases. The figure shows that the three methods result in the same failure probability for many cases, especially in the low range of PD3. This indicates that the wall thickness for these cases is the same for all design methods because the design is governed
1 1.E 09 1 1.E 08 1 1.E 07

by minimum wall thickness requirements, not by the design factor or reliability targets. The figure also shows the trend lines associated with the reliability for each of the three design methods (plotted in the same colour as the points it represents). The trend lines show that all three methods are very similar in the low range of PD3. It also shows that CSA Z622 and RBDA result in slightly less conservative designs for the high range of PD3.

Target ASME

RBDA CSA

Reliability (per km yr)

1 1.E 06 1 1.E 05 1 1.E 04 1 1.E 03 1 1.E 02 1 1.E 01 1 1.E+00 1.00E+06 Possible Range of Target Floor

1.00E+07

1.00E+08

1.00E+09

PD3 (People / ha MPa mm3)

Figure 5 Failure Probabilities for Individual Design Cases

The average failure probability for all test cases associated with each design method was calculated as the weighted sum of the 50-year average failure probabilities for the individual design cases. The weighting factor for each case was taken as the corresponding relative length within a database representing 90,000 km of gas pipelines [3,4]. Therefore, the results are indicative of the long-term failure rate associated with each design method. The results are shown in Table 5, together with the failure probabilities implied by the ULS reliability targets. The table confirms that the failure probabilities for RBDA are only slightly higher than those for ASME and CSA and that the failure probabilities associated with all three design methods are significantly lower than those implied by the ULS targets. This demonstrates that the low end of the ULS targets (i.e. high end of the failure probability corresponding to the targets) is a theoretical limit only. Although this limit is sufficient to meet the safety requirements defined in the calibration studies, the design of pipelines that fall in the corresponding range of diameters and pressures (i.e. small diameter, low pressure) will be governed by other considerations and will have lower failure probabilities than those implied by the targets.

Table 5 Average Failure Probabilities Resulting from Different Design Approaches

Method ULS Reliability Target RBDA Designs ASME B31.8 Designs CSA Z662 Designs Average Failure Probability (/km-yr) 3.30 10 1.31 10 1.16 10 1.24 10
-3 -4 -4 -4

Since RBDA is a life cycle methodology, it is recognized that low ULS targets could permit less stringent in-service maintenance for corrosion and other deterioration mechanisms. Previous work [9] has shown this not to be the case for corrosion as maintenance actions required to meet the targets for small diameter pipelines are generally governed by the LLS targets. Overall, the analysis indicates that the low reliability targets in the low range of PD3 for Class 1 pipelines have little impact on design and assessment decisions. However, these targets can, when considered on their own, give the impression of inadequate reliability. Considering this, it is desirable to increase the ULS reliability targets in that range to align them more closely with actual reliability levels that result

Copyright 2012 by ASME

from including all applicable RBDA criteria. Although this will not change the outcomes of RBDA, it can eliminate a source of possible confusion and make the ULS targets more consistent with reality. A simple way to implement such an adjustment is to impose a fixed lower limit on the reliability target. Given that the lowest calculated reliability levels (see Figure 5) are around 1 10-3 per km-yr, a target floor of between 1 2 10-3 and 1 5 10-4 per km-yr may be considered reasonable. It should be noted, however, that this range is presented as an example only, and it should not be seen a firm recommendation. A firm recommendation can only be made in conjunction with a more complete assessment of all other RBDA criteria to ensure that overall consistency is maintained. CONCLUDING REMARKS 1. Safety of high consequence pipelines. The societal risk levels implicit in the ULS reliability targets are significantly below the thresholds that define the limit for broadly acceptable societal risk according to both PD 8010-3 and the Dutch pipeline regulations, and they are also comparable to or less than the broadly acceptable societal risk threshold defined in IGEM/TD/1. Further, the individual risk levels associated with high consequence pipelines are below the broadly acceptable individual risk threshold that is common to PD 8010-3, IGEM/TD/1 and the Dutch pipeline regulations. These results, combined with the fact that the ULS targets are less restrictive than current standards for high consequence pipelines, demonstrate that current standards are overly conservative for these pipelines. Given these findings, the ULS reliability targets, as currently defined, are considered appropriate for high consequence pipelines. 2. Failure probability for Class 1 pipelines. The overall failure probabilities for Class 1 pipelines designed to RBDA are only slightly higher than those designed to the hoop stress provisions of ASME and CSA, despite the fact that ULS targets are significantly less restrictive than the reliability levels achieved by designing to ASME and CSA. This is due to the fact that many small diameter, low pressure Class 1 pipelines are governed by minimum wall thickness requirements and SLS considerations and will therefore have lower failure probabilities than implied by the ULS targets or by the design factors in ASME and CSA. It is suggested that increasing the ULS reliability target for these pipelines would result in closer alignment with actual reliability levels, and although this would not change the outcomes of RBDA, it eliminates possible confusion about the level of safety achieved. A preliminary target floor in the range of 1 5 10-4 to 1 2 10-3 per km-yr is suggested. A more firm recommendation on this value requires additional work to

ensure consistency with all aspects of the RBDA targets and approach. ACKNOWLEDGMENTS The authors wish to acknowledge Alan Murray, Rafael Mora and Robert Appleby for their role in pointing out the issues addressed in this paper and for their input to the work carried out to address them. REFERENCES [1] Canadian Standards Association (CSA). 2011. Oil and Gas Pipeline Systems. CSA Standard Z662-11, Mississauga, ON, Canada, June. [2] Nessim, M. and Zhou, W. 2005. Guidelines for Reliability Based Design and Assessment of Onshore Natural Gas Pipelines. Confidential to Gas Research Institute, GRI Contract No. 8565, C-FER Report L080, July. [3] Nessim, M. and Zhou, W. 2005. Target Reliability Levels for the Design and Assessment of Onshore Natural Gas Pipelines. Confidential to Gas Research Institute, GRI Contract No. 8565, C-FER Report L148, July. [4] Nessim, M., Zhou, W., Zhou, J. and Rothwell, B. 2009. Target Reliability Levels for Design and Assessment of Onshore Natural Gas Pipelines. Journal of Pressure Vessel Technology, Vol. 131, No. 6, Paper No. 061701, December. [5] American Society of Mechanical Engineers (ASME). 2010. Gas Transmission and Distribution Piping Systems. ASME Code for Pressure Piping, B31, ASME B31.8-2010, June. [6] Institution of Gas Engineers & Managers (IGEM). 2008. Steel Pipelines and Associated Installations for High Pressure Gas Transmission. IGEM/TD/1 Edition 5, Communication No. 1735, December. [7] British Standards Institute (BSI). 2008. Code of Practice for Pipelines: Steel Pipelines on Land. Standard No. PD 8010-3:2009, December [8] Overheid.nl. 2011. Dutch Government Websites (Available at: http://wetten.overheid.nl). March. [9] Stephens, M., Nessim, M. and van Roodselaar, A. 2010. Reliability-based Corrosion Management The Impact of Maintenance and Implications for the Time to Next Inspection. Proceedings of the 8th International Pipeline Conference, Paper No. IPC2010-31399, Calgary, AB, Canada, September 27-October 1.

Copyright 2012 by ASME