ABSTRACTThere is an increasing demand for operators of transmission

pipelines to maximise the throughput of their pipeline systems.This can be achieved relatively easily with new pipelines, byusing limit state design, new materials, novel fabricationtechniques etc.. Operators are also looking to maximise thethroughput of existing transmission pipelines. Obviously, theyare not able to make use of new materials etc., but limit statedesign concepts can be applied to show that a pipeline can besafely uprated to a higher design pressure.

The limit state of an engineering structure or component i sdefined as the mathematical relationship between the parametersassociated with a particular failure mode at the onset of failure.To assess the impact on pipeline integrity and safety, a limitstate approach incorporating probabilistic analysis has beendeveloped. The approach addresses all credible failure modesand takes account of uncertainties in the relevant parameters foreach mode.

The probabilistic approach takes the limit state approach astep further by describing the parameters as statisticaldistributions rather than single values. This allows failureprobabilities to be computed which are a more meaningfulmeasure of safety and allow areas of over conservatism (or underconservatism) to be identified. It is important to note that theapproach is only as good as the limit states used and the dataused to construct the distributions. Clearly uncertainties in bothof these can exist and the absolute values of the computedprobabilities must be viewed with caution. However, the strengthof the approach lies in the relative values of the computedprobabilities and previous 'safe' operation. If a system has asignificant operational history with few or no failures and it canbe shown that there is little change in the theoretical failureprobability associated with a change in operating conditions, i tcan be inferred that few or no failures will occur in practice.

The paper describes the above approach in detail andoutlines a study carried out to determine the effect on pipelineintegrity of uprating three pipelines from a current maximumoperating pressure of 70 bar to an uprated pressure of 85 bar,exceeding the current design criteria. By application of the limitstate approach incorporating probabilistic analysis, it is shownthat there would be an insignificant change in failure probabilityas a result of uprating to 85 bar, and hence that the integrity ofthe pipelines is unimpaired by uprating.

1. INTRODUCTIONReliability based limit state design can be used in the

pipeline industry to justify increases in pipeline design factorsabove those currently permitted in existing pipeline designcodes. Accordingly, limit state design methods have beenincorporated into the 1996 Edition of the DNV Design Rules forOffshore Pipelines (DNV, 1996), and have been proposed for theCanadian Oil & Gas Pipeline Standard, CSA Z662 (Zimmerman etal., 1996). The same methods can be applied to the uprating ofexisting pipelines.

The design, construction and operation of pipelines in theUK is regulated by the Pipelines Safety Regulations 1996(HMSO, 1996). The most commonly recognised pipeline designcodes for the design of gas transmission pipelines in the UK arethe Institute of Gas Engineers Recommendations IGE/TD/1 (IGE,1993) and its British Standards Institute equivalent, BS8010(BSI, 1992). These documents recommend that the hoop stress,based on minimum wall thickness, should not exceed 72%SMYS. Indeed, experience has shown that pipelines can beoperated in a safe manner if the design factor does not exceed avalue of 0.72 (EGIG, 1994). Values lower than 0.72 are used inmore densely populated areas in recognition of the potentiallymore severe consequences if a failure did occur.

The Pipelines Safety Regulations adopt a goal settingphilosophy. In principle, if a pipeline with a design stress inexcess of 72% SMYS can be shown to be ‘fit for purpose’, in

THE USE OF RELIABILITY BASED LIMIT STATE METHODSIN UPRATING HIGH PRESSURE PIPELINES

Andrew Francis,Richard Espiner & Alan Edwards

BG TechnologyGas Research & Technology Centre

LoughboroughLE11 3GR

United KingdomTel. +44 1509 282719Fax. +44 1509 283080

email andrew.francis@bgtech.co.uk

Gary Senior

TranscoNorgas House

KillingworthNewcastle upon Tyne

NE99 1GBUnited Kingdom

Tel. +44 191 216 3034Fax. +44 191 216 3517

email gary.senior@bgtransco.co.uk

terms of safety and integrity, then this will satisfy the goals ofthe regulations.

The underlying procedure for using reliability based limitstate design to uprate an in-service pipeline was reported byFrancis et al (1997). More recently a means of extending theapproach to identify the impact of failure mitigating activitiessuch as inspection and surveillance on pipeline reliability for agiven design factor has been reported (Francis et al, 1998). It hasbeen demonstrated how the approach may used as the basis forrevision to design codes in order to allow operation at designfactors higher than those currently permitted.

In Francis et al (1997) it was shown how justification foruprating a pipeline could be provided based on a comparisonbetween the failure probabilities at current and upratedpressures. Whilst the approach could be seen to be appropriatefor the example considered, no general criterion for an acceptableincrease in failure probability was given. This paper extends thescope of Francis et al (1998) by describing a statisticalprocedure for assessing the significance of an increase in failureprobability. The methodology is illustrated by a simpleexample.

2. DETERMINISTIC DESIGNThe objective of the guidelines given in pipeline design

codes such as IGE/TD/1 (IGE, 1993) is to ensure that highpressure gas transmission pipelines are designed, constructedand operated safely. The fundamental principle adopted is toensure that the risk to society of the harmful events is 'As LowAs Reasonably Practicable' (ALARP). Action is taken to controlthe likelihood of an ignited release of gas occurring and thenumber of people who would be affected should such an eventoccur.

This control is primarily achieved by specifying allowabledesign factors and building proximity distances (BPDs). Thedesign factor is the ratio of the operational hoop stress tospecified minimum yield stress (SMYS) and is the primarymeans of controlling the likelihood of failure. The BPD is ameasure of the allowable distance of occupied buildings fromthe pipeline and is the primary means of controlling the numberof persons who would be harmed in the unlikely event of anignited release of gas. Whenever possible, high pressure gaspipelines are routed to avoid populated areas. However, since theultimate objective of the pipelines is to deliver gas to populatedareas it is inevitable that the pipelines will pass through somepopulated areas. This has led to the definition of two types ofpopulated area in IGE/TD/1; these being rural (less than 2.5persons per hectare) and suburban (2.5 persons per hectare orgreater). The maximum allowable design factor in rural areas i s0.72, while in suburban areas the maximum allowable designfactor is reduced to 0.3. Other design codes specify other valuesand demarcations but the principle remains the same.

The choice of a design factor of 0.72 has its origins in the1951 Edition of the B31.1 Code. The hoop stress was limited to80% of the mill test stress based on 'engineering judgement'. Themill test hoop stress was 90% SMYS. This gives a design stressof 72% SMYS (Duffy et al, 1968).

There have been 500,000 kilometre years of operation ofhigh pressure gas transmission pipelines in the UK without a

single ignited release of gas. This fact provides considerableevidence that the current design practice has contributed to thesafe operation of high pressure natural gas transmissionpipelines. It is important to note that the specification ofallowable design factors is only a contribution to safe operationsince further mitigating activities have a role to play, such as apre-service hydrostatic pressure test, inspection andmaintenance policies, protection against corrosion and aerialsurveillance. Indeed, there are pipelines operated at a designfactor of 0.8 in the USA which have better safety records thanpipelines operated at a design factor of 0.72 and this observationhas been attributed to both high hydrostatic test levels andaggressive inspection and maintenance strategies(U.S. Department of Transportation, 1987).

Thus although the factors which contribute to safe operationare known, the relative contributions of each factor are largelyunknown. The strength of the limit state based probabilisticapproach is that the relative contributions can be identified.Indeed, a method for identifying the impact of mitigatingactivities such as inspection and surveillance on pipelinereliability for a given design factor is reported in Francis et al(1998).

In the following sections the limit state based probabilisticapproach is described in detail and a criterion is derived forassessing the acceptability of a pipeline operated at a pressurecorresponding to a design factor in excess of the maximumallowable value specified in the design codes.

3. RELIABILITY BASED LIMIT STATE DESIGN

3.1 Limit StatesThe limit state is a mathematical relationship between theparameters associated with a particular failure mechanism attheonset of failure. This relationship can be expressedmathematically in the form

F(x1, x2, ..., xn) = 0 (1)

where F denotes the limit state and xi, i = 1 to n, denote the nparameters associated with a particular mechanism. The aboveequation denotes conditions at the onset of failure and defines ahyper-surface in n-dimensional space.

In a deterministic study involving a limit state functioncontaining n parameters it is conventional to assign singlevalues for (n-1) of the parameters and use the limit state tocompute the value of the remaining parameter. This allows afailure space to be constructed bounded by a surface whichrepresents a theoretical boundary between safe and unsafeoperation for each failure mode. The complete set of conditionsat which the system will be in a failed state can be described bythe inequality

F(x1, x2, ..., xn) m0 (2)

which defines the failure space denoted by the hyper-volumeV(x1, x2,..., xn).

By combining the limit state approach with a probabilisticanalysis it is possible to evaluate the contribution of eachcombination of parameters which represent a point in the failurespace and hence determine the failure probability associatedwith each failure mode. The general approach is described below.The determination of the failure space for particular failuremodes from the associated limit states is described in detail inSection 4.

3.2 Probabilistic MethodologyThe probabilistic approach described herein extends the

limit state approach by describing the parameters as statisticaldistributions rather than single values. This allows failureprobabilities to be computed which are a more meaningfulmeasure of safety and allow areas of over-conservatism (orunder-conservatism) to be identified.

The probability of failure, pf, is equal to the integral of thejoint probability density function p(x1, x2,..., xn) over the failurespace, viz.

pf = °Vp(x1, x2, ...xn)dV (3)

In practice the parameters are often found to be independent inwhich case the joint probability density function can be replacedby the product of the probability density functions of eachparameter.

It is important to note that the approach presented in thispaper is only as good as the limit states used and the data usedto construct the distributions. Clearly uncertainties in the limitstates and the data can exist and the absolute values of thecomputed probabilities must be viewed with caution. However,

the strength of the approach lies in the relative values of thecomputed probabilities and previous 'safe' operation. It i simportant to note that, if a system has a significant operationalhistory with few or no failures and it can be shown that there i slittle change in the theoretical failure probability associatedwith a change in operating conditions it can be inferred that fewor no failures will occur in practice. A mathematical criterionwhich makes use of both the operational history and thecomputed failure probabilities is presented in section 6.

4. LIMIT STATES AND FAILURE SPACESIn order to obtain the required variation in the probability

of failure, pf, with the operating pressure, pop, it is necessary toidentify all of the credible failure modes associated with thesituation under consideration. These will depend on severalfactors including the environment, type and number ofprotective measures, construction methods and operatingconditions. It is not possible to cover all situations here and sothe application of the approach is illustrated by reference to aselection of common causes of failure. These are not intended tobe exhaustive and the reader is reminded that all potential failuremodes must be considered in a real situation.

The failure modes considered herein are those associatedwith external corrosion defects and defects introduced byexternal interference. Limit states for each of these modes aregiven and the failure space is expressed in terms of the relevantparameters for each mode. The limit states defining the boundarybetween leaks and ruptures are given where appropriate. Themitigating effects of factors such as the pre-service hydrotestand inspection records are discussed.

4.1 External Metal Loss CorrosionExternal corrosion is a common cause of failure in buried,

onshore pipelines and therefore must be considered as a crediblefailure mode. Susceptibility to external corrosion is influencedby factors such as the local environment, coating type andefficiency of the cathodic protection system. On-line inspectionprovides the data necessary to determine defect distributions.For pipelines conveying dry natural gas, internal corrosion i snot a credible failure mode.

It is assumed here that a corrosion defect can be idealised asa rectangular slot. The defects are assumed to be blunt and hencefailure is governed by plastic collapse. Based on thesesimplifying assumptions and scatter in test data, conservativeestimates of the conditions at failure are used and hence theseexpressions are not strictly limit states. Extensive work (Batte etal, 1997) based on non-linear finite element analyses and bursttests is being conducted in order to remove these conservatismsand hence establish actual limit states for corrosion defects.

4.1.1 Limit StatesTwo limit states are required to address failure associated

with the presence of corrosion defects. The first of these relatesthe critical depth of a part wall defect to the relevant parameterswhilst the other relates the critical length of a through-walldefect to the relevant parameters. The latter is required in order toestablish whether a failure will result in a leak or a rupture.

Failure of corrosion defects is assumed to be dominated byplastic collapse. The plastic collapse criterion developed byBattelle (Keifner et al, 1969) for part wall defects in linepipe,

acw = 1 − r h

1.15r y / 1 −r h

1.15r y Ma−1

(4)

is thus used to predict the critical defect sizes, ac. In the aboveequation w denotes the pipe wall thickness, σy the material yieldstress and σh the operating hoop stress. The Folias factor, Ma, i sbest approximated by the expression (Miller, 1987)

Ma = 1 + 0.26 L2Rw

12

(5)

where L is the axial length of the defect and R is the pipe radius.

A conservative limit state for the determination of thecritical length of through wall corrosion defect has beendeveloped by Shannon (1974)

r hr y = 1.15Ma

−1 + 0.15 (6)

which can be rearranged to give

113.015.126.0

221

−

−

=

−

y

hc

RwLσ

σ(7)

4.1.2 Failure SpaceA four dimensional failure space is considered here. The four

dimensions are used to take account of uncertainties in yieldstrength, σy, wall thickness, w, defect depth, a, and defect length,L. All other quantities are assumed to be deterministic. In thiscase the four-dimensional failure space U(σy, w, a, L) is expressedin the form

∞<<∞<<∞<< LwLw ycy ),(,0,0 σσ

waLwa yc <<),,(σ

for a rupture and

),(0,0,0 wLLw ycy σσ <<∞<<∞<<

waLwa yc <<),,(σ

for a leak.

Knowledge of the most recent inspection for a particularpipeline and the defect repair criterion may be utilised to reducethe failure space by eliminating regions where it is known thatdefects do not exist. Techniques such as Bayesian Statistics maybe used to 'update' the defect distributions based on theinspection records and the accuracy and reliability of theinspection tool. However, the detail associated with theseapproaches is omitted for clarity.

The effect of the pre-service hydrostatic test can in principlebe used to reduce the failure space. However, assuming that nocorrosion is present at the start of life the effect of thehydrostatic test is only to remove certain combinations of w andσy. This can be shown to have a negligible effect on theprobability of failure due to corrosion. Failure due to corrosionis most sensitive to growth rate and hence defect dimensions.

Hence the effect of the hydrostatic test on failure due tocorrosion is not considered in this study.

4.2 External InterferenceThe use of excavating equipment in the vicinity of pipelines

can lead to the introduction of defects into the pipe. The mostgeneral type of damage associated with this type of event is adent containing a gouge. The occurrence of this type of defectcan lead immediately to a leak or a rupture. Other forms ofexternal interference can result in direct puncture of the pipe wallor removal of small diameter fittings. These are neglected in thispaper in the interests of clarity.

4.2.1 Limit StatesFailure criteria for gouged dents were developed by BG

(Hopkins et al, 1988) based on ring test data and an elastic-plastic fracture mechanics analysis. The fracture mechanicsanalysis was based on the assumption that the gouge behaved ina similar manner to a crack.

The effect of the dent is to introduce a through wall bendingstress. The bending stress is self-equilibriating through the walland it is implicitly assumed that this stress does not contributeto plastic collapse. Thus a dent which does not contain a defectis not considered as a credible source of failure. This i sconfirmed by BG test data and operating experience.

Limit states for part wall and through wall defects arerequired.

The failure criterion for part wall defects developed by BGcan be expressed in terms of two parameters Kr and Sr where, inaccordance with the PD6493 defect assessment procedure (BSI,1991), Kr is a measure of how close the pipe is to failure bybrittle fracture and Sr is a measure of how close the pipe is tofailure by plastic collapse.

In this case the parameter Kr is defined by

[ ]IC

bbmmr K

aaYaYK πσσ )()( += (8)

where a is the gouge depth, KIC is the fracture toughness, and Ymand Yb are normalised stress intensity factors for an edge crack ina plate subject to pure membrane and pure bending stressrespectively found in standard texts, for instance Rooke &Cartwright (1976).

The membrane stress σm and bending stress σb are given by

r m = r h(1 − 1.8 D2R ) (9)

and

r b = 10.2r h Rw D2R (10)

respectively, where R is the pipe radius, D is the dent depth andσh is the operating hoop stress.

The parameter Sr is given by

Sr =r m 1− a

Maw

1.15r y (1− aw ) (11)

Failure is assumed to occur if the inequality

Kr mKrcrit (12)

is satisfied where Krcrit is a critical value of Kr which is related to

Sr through the failure assessment diagram (FAD). The particularfailure assessment diagram used here is given in PD6493 (BSI,1991) and can be expressed in the form

Krcrit = Sr 8o2 ln sec(

o2 Sr )

− 12 , Sr < 1.

and (13)

Krcrit = 0 , Sr m1

The appropriate limit state in this case is thus given by

Kr = Krcrit(Sr) (14)

which with the aid of Eqs. (8, 11 & 13) establishes a relationshipbetween all of the relevant parameters at failure of a part walldefect. The numerical solution of this relationship can be used todetermine the critical depth of a part wall defect.The Battelle criterion for through wall defects is used todetermine the critical gouge length, Lc.

4.2.2 Failure SpaceA six dimensional failure space is considered here. The six

dimensions are used to take account of uncertainties in yieldstrength, σy, fracture toughness, KIC (estimated using acorrelation between Charpy Energy and KIC), wall thickness, w,gouge depth, a, gouge length, L and dent depth, D. All otherquantities are assumed to be deterministic. In this case the six-dimensional failure space U(σy, KIC, w, a, L, D) is expressed in theform

0 < r y < º , 0 < KIC < º , 0 < w < º , 0 < D < º ,Lc(r y ,w) < L < º , ac(r y ,w,L) < a < w

for a rupture and

0 < r y < º , 0 < KIC < º , 0 < w < º , 0 < D < º ,0 < L < Lc (r y ,w), ac (r y ,w, L) < a < º

for a leak. Again the hydrostatic test could be used to removecertain combinations of w and σy from the failure space but thisis not included here due to negligible impact on failureprobability due to external interference. Failure due to externalinterference is most sensitive to the dent and gouge dimensions.

5. FAILURE PROBABILITIESThe approach outlined in section 3.2 is used to determine

the failure probabilities associated with each of the two failuremodes.

5.1 Corrosion Defects

Corrosion is a time dependent failure mechanism. Thereforethe defect size parameters a and L are functions of time, t andprobability density functions are required for w, σy, a(t) and L(t).

In accordance with the failure space given in section 4.1.2the probability, prupture, of a rupture occurring at a given defectwithin time interval (0,t) is given by

prupture = °0

º°0

º°Lc

º°ac

wp(r y)p(w)p(L, t)p(a, t) da dL dw dr y

and the probability of a leak by

pleak = °0

º°0

º°0

Lc °ac

wp(r y)p(w)p(L, t)p(a, t) da dL dw dr y

The probabilities of rupture and leak per kilometre ofpipeline in the time interval considered are found bymultiplying the above probabilities by the estimated number ofcorrosion defects per kilometre. This depends upon a number offactors and can be estimated using operational data.

5.2 External InterferenceFor this failure mode, probability density distributions are

required for a, L, D, w, KIC and σy. With reference to the failurespace given in section 4.2.2 the expressions for prupture and pleak ata single dent/gouge defect become

Prupture = °0

º°0

º°0

º°0

º°Lc

º°a c

wp(r y )p(KIC )p(w)p(D)p(L)p(a)da dL dD dw dKIC dr y

(17)and

Pleak = °0

º°0

º°0

º°0

º°0

Lc °a c

wp(r y )p(KIC )p(w)p(D)p(L)p(a) da dL dD dw dKIC dr y

(18)respectively. The rupture and leak probabilities per kilometreyear of pipeline are found by multiplying the aboveprobabilities by the rate at which dent/gouge defects areintroduced into the pipeline. This figure is found fromoperational experience and depends on land use type, depth ofcover, mechanical protection and surveillance. The externalinterference failure probability is independent of time.

6. ACCEPTANCE CRITERIONThe analysis described above provides a means of evaluating thefailure probability. In this section a means of establishingacceptance criteria for uprated pipelines in terms of failureprobabilities is outlined. It is assumed here that little or nochange is expected in the local population density in thevicinity of the pipeline. This means that explicit risk criteria areunnecessary and hence that the criteria can be specified directlyin terms of failure probabilities. Should future development ofland lead to increases in population density then a riskassessment based on the failure probabilities may be considerednecessary. However, the explicit consideration of risk is beyondthe scope of this paper.

An absolute failure probability level equivalent to thedesign factor cannot readily be defined due to the difference inthe nature of a failure probability and a design factor. The designfactor is based on nominal values and can therefore bedetermined precisely. Failure probabilities intrinsically expressuncertainty and are therefore only as good as the models anddata on which they are based. Thus whilst it is appropriate tocompare design factors against absolute levels, this approach i snot appropriate for failure probabilities. It has been shown(Francis, et al, 1998) that a direct relationship between designfactor and failure probability does not exist except whenconsidering simple idealised failure modes.

In view of the above discussion a fitness for purpose basedapproach is sought to establish probabilistic based criteria. Tothis end it is useful to discuss the current design factor basedcriterion in more detail. The current approach specifies a singleupper limit on design factor. The initial justification for this wasbased on a combination of the hydro-test level and a 'safetymargin' as discussed earlier in this paper. However, perhaps moreimportantly, considerable confidence in the design factor basedcriterion is derived from many hundreds of thousands ofkilometre years of safe operation. Indeed it is extensive safeoperation which forms the basis for many design codes. It i stherefore sensible to make use of previous safe operation in thederivation of a probabilistic based acceptance criterion.

The criteria proposed below are thus based on theassumption that significant safe operation of pipelines to beuprated already exists. (There have been 500,000km years of safetransmission pipeline operating experience in the UK). Thecriteria are based on the assumption that if significant safeoperating experience exists at a given operating pressure (i.e. thefailure rate was considered to be acceptable) then it follows thatoperation at a higher pressure must also be regarded asacceptable if it can be shown that increase in the failure rate willbe insignificant. The meanings of the terms significant andinsignificant in the above context are discussed in section 6.2.

6.1 Fixed failure probabilityThe methodology described above can be used to determine

the failure probability associated with the operation of a givenpipeline at a given pressure. If significant safe operation (seebelow) of this pipeline has been demonstrated then it can beinferred that the calculated failure probability is acceptable.

In the absence of an increase in failure-mitigating activitiessuch as inspection and surveillance, an increase in operatingpressure will lead to an increase in failure probability. However,if the application of the above methodology shows that anincrease in mitigating activities leads to a reduction in failureprobability at the increased pressure then, in accordance with thepreceding paragraph, operation at the increased pressure can beregarded as acceptable.

Thus a simple criterion is that the failure probability at thei n creased pressure should be no greater than that at the currentpre s sure for which significant safe operation has beendemonstrated.

However, it may not always be possible or practicable orindeed necessary to introduce further mitigation to ensure thatthe above criterion is satisfied. A criterion which addresses thissituation is determined below.

6.2 Insignificant increase in failure probabilityA statistical methodology is outlined here for assessing the

significance of the increase in failure probability due to theincrease in operating pressure.

It is assumed here that increasing the operating pressure ofa pipeline will increase the calculated or predicted failureprobability. To assess the significance of this increase we needto determine whether or not it will be theoretically possible toobserve conclusive evidence of a difference in the actual failurerate. If no such difference in the actual failure rate can beobserved then it must be concluded that there is no significantdifference between the levels of safety prior to and afterincreasing the pressure. Clearly the possibility of observing adifference between the two situations will depend on the twofailure probabilities and the operating exposure time (inkilometre years). A criterion based on these quantities is derivedbelow by considering a simple example.

An idealised situation is considered in which two pipelines(A and B) are identical in every sense except the operatingpressure. It is known that one of the pipelines is being operatedat a higher pressure than the other but it is not known which one.However, it is known that whichever pipeline is operated at thelower pressure has a calculated failure probability per kilometreper year of pf and the other has a failure probability per kilometreper year of λpf where λ>1. The pipelines are each operated for atime period T and m failures are observed on pipeline A and n(>m) failures are observed on pipeline B.

The increase in the calculated failure probability, λ, can beregarded as significant if the observations (m and n) aresufficient to be able to state, with some specified level ofconfidence, that pipeline B (the one with the greater number offailures) is operating at the higher pressure. If such a statementcannot be made with sufficient confidence then the increase incalculated failure probability associated with operation at thehigher pressure must be regarded as insignificant.

It is thus necessary to determine the probability, p(B|m&n),that pipeline B is operating at the higher pressure given that mfailures occurred on A and n failures occurred on B. InvokingBayes' theorem we can write,

p(B|m&n) = p(m&n|B)p(B)p(m&n|A)p(A)+p(m&n|B)p(B) (19)

where p(m&n|A) is the probability of m failures occurring on Aand n failures occurring on B given that A is operating at thehigher pressure, p(m&n|B) is the probability of m failuresoccurring on A and n failures occurring on B given that B i soperating at the higher pressure and p(A) and p(B) are theprobabilities that A and B, respectively, are operating at thehigher pressure given no additional information. Noting thatp(A) = p(B) = 1/2, the above reduces to

p(B|m&n) = p(m&n|B)p(m&n|A)+p(m&n|B) (20)

Making use of the facts that the number of failures occurring willbelong to a Poisson distribution and that A and B areindependent pipelines we deduce

p(B|m&n) =1m! (pLT)

me −pLT 1n! (kpLT)ne −kpLT

1m! (kpLT)me −kpLT

1n! (pLT) ne −pLT +

1m! (pLT)me −pLT

1n! (kpLT) ne −kpLT (21)

where L is the pipeline length. The above reduces to the simpleexpression

p(B|m&n) = 11 + ( 1k )n−m (22)

This expression forms the basis of the criterion which may beused to assess the significance of λ. Based on the observedfailures, m on A and n on B, it is necessary to demonstrate withspecified confidence that pipeline B is operating at the higherpressure. Thus at the 5% significance level, the criterion takesthe form

p(B|m&n) = 11 + ( 1k )n−m

> 0.95 (23)

which on rearranging becomes

k > 19 1n−m (24)

If λ satisfies the above inequality then we are at least 95%certain that pipeline B is operating at the higher pressure. If thisis the case then it can be stated that operating at the higherpressure leads to an observable difference in the failure rate.

The implications of the above criterion are discussed here.Because the probability of failure, pf, is small for transmissionpipelines, the values of n and m will strongly depend on the timeavailable to make the observations.

Within a typical pipeline life of a few tens of years we canconservatively assume that perhaps one failure will occur on theuprated pipeline (m = 0, n = 1). In this case we obtain

k > 19 (25)

This means that the failure probability would have toincrease by a factor of greater than 19 before we would beconfident of seeing an observable difference in failure rate. Theabove expression gives the conditions required in order to beconfident of a difference. Clearly our objective in uprating is tobe confident that there will be no observable difference. Wewould thus choose to operate with a value of λ which i scomfortably below the critical value, λ<4 say, which correspondsto a confidence level of 0.8; this is widely regarded asinsignificant.

7. RESULTS AND DISCUSSIONThis methodology has recently been applied by BG plc to a

case study in order to demonstrate the acceptability of uprating500 km of high pressure pipeline to a stress level outside thedesign code (Francis et al 1997). The results of the study wereassessed by a consideration of the previous operating experienceand the calculated failure probabilities. The calculated failureprobabilities are shown graphically in Fig. 1 for a range ofoperating pressures including the current and proposed upratedpressures, 70 and 85 bar respectively.

It can be seen from Fig. 1 that there is relatively littledifference between the calculated failure probabilities at thesetwo pressures; a 'significant' increase in failure probability doesnot start to occur until the pressure increases beyond 90 - 95 bar.It was therefore argued that since the pipeline is currently

operating in a safe manner then it must also be safe at the upratedpressure. The approach adopted was considered to provide asound basis on which an informed decision on the fitness-for-purpose of the uprated pipeline could be made. However, thesignificance of the increase in failure probability was notformally quantified; a degree of engineering judgement was stillrequired.

70 80 90 100 110 1200

0.002

0.004

0.006

0.008

0.01

Pressure (bar)

Failu

re P

roba

bilit

y

Figure 1 - Increase in Failure Probability with Pressure

The argument is taken a step further below by assessing theresults of the study against the more rigorous criterion whichwas derived in section 6.2.

Values of λ are presented in Table 1 for a range of operatingpressures.

p (bar) λ70 175 1.0880 1.1985 1.5790 2.0295 3.24100 6.15

TABLE 1 - Values of λ at Different Operating Pressures

It can be seen that λ<4 for operating pressures up to 95 bar.Therefore based on the above it can be deduced that uprating to95 bar will lead to an insignificant increase in failure probabilityat the 80% confidence level.

At 85 bar the value of λ is 1.57 which corresponds to aconfidence level of 61%. This is sufficiently close to 50%(absolutely no difference in the failure rate of the two pipelines)to be regarded as highly insignificant. Based on this result andextensive experience of safe operation at 70 bar it is deducedthat operation at 85 bar must be regarded as safe and that theengineering judgement applied in earlier considerations of theincrease in failure probability was conservative.

8. CONCLUSIONSThis paper has demonstrated how reliability based limit

state design methods can be used to demonstrate the

acceptability of uprating an in-service pipeline to a stress leveloutside the applicable design code.

The approach is based on a combination of the relativevalues of the computed failure probabilities and experience ofprevious safe operation. Basically, if a system has a significantoperational history with few or no failures and it can be shownthat there is little change in the theoretical failure probabilityassociated with a change in operating conditions, it can beinferred that few or no failures will occur in operation at theincreased pressure.

A rigorous criterion based on specified confidence levelshas been derived in order to assess the significance of theincrease in failure probability due to operation at a higherpressure.

The methodology and criterion have been applied to a casestudy considering the increase in pressure of 500 km of pipelinefrom 70 bar to 85 bar. The results indicate that the increase infailure probability due to the increase in pressure is highlyinsignificant and confirm that the engineering judgementapplied in an earlier consideration of the change in failureprobability between 70 bar and 85 bar was conservative. Thusbased on extensive experience of safe operation at 70 bar, it i sconcluded that operation at 85 bar must be regarded as safe.

9. REFERENCESBatte, A.D., Fu, B., Kirkwood, M.G. & Vu, D., 1997, "New

Methods for Determining the Remaining Strength of CorrodedPipelines", 16th International Conference on OffshoreMechanics and Arctic Engineering, Yokohama

British Standards Institute, 1991, "Guidance on Methods forAssessing the Acceptability of Flaws in Fusion WeldedStructures", PD6493

British Standards Institute, 1992, "Code of Practice forPipelines", BS8010

DNV, 1996, "Rules for Submarine Pipeline Systems"Duffy, A.R., McClure, G.M., Maxey, W.A. & Atterbury, T.J.,

1968, "Study of the Feasibility of Basing Natural Gas PipelineOperating Pressure on Hydrostatic Test Pressure", AGA Cat No.L30050

EGIG, 1994, "Report of the European Gas Pipeline IncidentData Group (EGIG)", 19th World Gas Conference, Milan

Francis, A., Espiner, R., Edwards, A., Cosham, A. & Lamb, M.,1997, "Uprating an In-service Pipeline Using Reliability-basedLimit State Methods", Conference on Risk-based and Limit StateDesign and Operation of Pipelines, Aberdeen, UK

Francis, A., Edwards, A.M. & Espiner, R.J., 1998,"Reliability-based Approach to the Operation of GasTransmission Pipelines at Design Factors Greater Than 0.72", tobe presented at OMAE'98, 17th International Conference onOffshore Mechanics and Arctic Engineering, Lisbon, 5th -9thJuly

HMSO, 1996, "The Pipelines Safety Regulations", S.I. 1996No. 825

Hopkins, P., Jones, D.G. & Clyne, A., 1988, "Significance ofDents and Defects in Transmission Pipelines", Paper C376/049,Conference on Pipeline Engineering & Operations, IMechELondon Institution of Gas Engineers, 1993,"Recommendations on Transmission & Distribution Practice:Steel Pipelines for High Pressure Gas Transmission", IGE/TD/1Ed. 3

Kiefner, J.F., 1969, "Fracture Initiation"; AGA 4thSymposium on Linepipe Research

Miller, A.G., 1987, "Review of Limit Loads of StructuresContaining Defects", CEGB Report TPRD/B/0093/N82

Rooke, D.P. & Cartwright, D.J., 1976, "Compendium ofStress Intensity Factors", HMSO

Shannon, R.W.E., 1974, "The Failure Behaviour of LinepipeDefects", Int. J. Pres. Ves. & Piping, Vol. 2

U.S. Department of Transportation, 1987, "A SafetyEvaluation of Gas Pipelines Operating Above 72 Percent ofSMYS", Office of Pipeline Safety report

Zimmerman, T., Chen, Q. & Pandey, M.D., 1996, "TargetReliability Levels for Pipeline Limit States Design", Int. PipelineConference, vol. 1

10. ACKNOWLEDGEMENTSThe authors wish to thank a number of their colleagues for

useful comments on this paper and BG plc for giving permissionto publish the paper.