Fig. 1 Distribution of causes of 16,489 pipeline failures from 1990 to 2012 in Alberta, Canada. Internal corrosion, material failure, and external corrosion are three most common failure causes.

of the probability and consequence analysis for a probabilistic risk analysis (PRA). Risk-based inspection and risk-based mainte- nance (RBM) planning are utilized to optimize pipeline inspection and maintenance for risk control [30].

This paper is divided into five sections. Section 2 summarizes the literature in the areas of pipeline integrity, flow simulation, electrochemical corrosion, MIC, and risk assessment. Section 3 describes the proposed framework for the risk-based integrity assessment of unpiggable pipelines. Section 4 presents the results of a small case study to illustrate the proposed methodology and its advantages. The last section presents the conclusions.

​

2 Literature Review

2.1 Pipeline IntegrityManagement. Pipeline integrity pro- grams aim to ensure the safety of operating pipelines. API Stand- ard 1160 [20] and ASME Standard B31.8S [5] are used to implement PIPs for hazardous liquid transmission pipelines and for gas transmission pipelines, respectively. Figure 2 shows the major steps for the implementation of a pipeline system integrity management program according to Annex N of CSA Standard Z662 [17], which provides a guideline for the implementation of a PIP for oil and gas pipelinesystems.

DA is a recommended method in API, ASME, and CSA stand- ards to assess the integrity of pipelines [5,17,20]. The Interna- tional Association of Corrosion Engineers (NACE) has published several standard practices for different applications of internal corrosion direct assessment such as NACE SP-0116 multiphase internal corrosion direct assessment [22]. Internal corrosion direct assessment is a method for evaluating the integrity of unpiggable pipelines subject to internal corrosion. Multiphase internal corro- sion direct assessment is applicable to multiphase fluids, which are normally found in gathering pipelines of oil and gas production fields. It follows the same protocol as the other DA recommenda- tions [31] and consists of the following steps: pre-assessment, indirect inspection, detailed examination, and postassessment [22,29,31].

A study developed by the DOT in 2002 compares the costs of

preparing and inspecting all U.S. transmission pipelines (approxi- mately 700,000 km) using either PT, DA, or ILI [12]. The results show that DA is the most economical alternative when consider- ing both the cost of preparing a pipeline and the cost of inspecting a pipeline [12]. According to this report, 85% of the liquid trans- mission pipelines and only 30% of the natural gas transmission pipelines were piggable in the U.S. [12]. Another publication reports that almost 40% of the world’s oil and gas pipelines are unpiggable [32].

Unpiggable pipelines are pipelines that do not allow the passage of an ILI tool from beginning to end and have restrictive

conditions that can include: lack of facilities for launching and receiving the tools; design restrictions (such as changes in diame- ter, plug valves, and bends); and operational restrictions (low or high pressure and flow, aggressive media for ILI tools). In some cases, multiple conditions are present at the same time [32]. Tem- porary or permanent receivers can be installed on unpiggable pipelines to enable ILIs; however, this option requires modifica- tion to existing pipelines and may not always be an option. The integrity of unpiggable pipelines is necessary for the safe opera- tion of a pipeline system; therefore, alternative techniques such as DA are used considering that only a few sections of the pipeline are inspected [32].

​

2.2 Electrochemical Corrosion Models. Corrosion is an electrochemical process that deteriorates a material in an environ- ment [33,34]. A corrosion process requires four elements: anode, cathode, metallic conductor, and electrolyte. During corrosion of an internal pipeline surface, the anode, cathode, and metallic con- ductor are within the pipeline steel and the water is the electrolyte (Fig. 3).

At the anode, the oxidation reaction produces electrons and metallic ions, Fe Fe2þ 2e–, while the reduction reaction at the cathode consumes the electrons produced by the anode. The main reduction reaction in an oxygen-free environment is the evolution of hydrogen, Hþ 2e– H2 [34]. Water is not corrosive, but if it contains dissolved gases including CO2 and H2S, hydro- gen ions are produced and these demand electrons at the cathodic site and this accelerates the corrosion process [34]. The corrosion process is divided into two stages: the first is activation polariza- tion where the hydrogen ions are available at the metal electrolyte interface, and the second is concentration polarization where the rate controlling process is the diffusion of hydrogen ions from the electrolyte to the interface [33,34].

Internal corrosion is most severe in upstream production and gathering pipelines due to the large quantities of water and solids

that can accelerate the corrosion process. Since the first internal corrosion model by de Waard and Milliams in 1975, a variety of corrosion growth models have been developed [35,36]. These models are broadly classified as mechanistic models [35,37–40] and empirical models [35,39,41]. Most of the existing models pre- dict general corrosion but internal corrosion failures of pipelines mainly occur due to localized corrosion [7,36,37].

Microbiologically influenced corrosion is responsible for approximately one third of all pipeline failures [13,42]. Estima- tions of localized internal corrosion should consider the influence of MIC [43,44]. The main challenge in modeling MIC in pipelines is the inability to predict where the biofilms will initiate and grow [45]. The presence of solids can accelerate under deposit corro- sion due to MIC as chemical treatments are unable to penetrate the deposition layers and biofilms.

​

2.3 Flow Modeling. Flow simulations are used to calculate various properties of multiphase fluids (i.e., oil, gas, and water) within a pipeline [37]. These properties may include temperature and pressure profiles, flow regimes, velocities of the liquid and gas phases, water wetting, liquid holdup, and solids deposition [22,35–39,46].

The movement of the electrolyte facilitates the transport of hydrogen ions from the bulk fluid to the cathodic sites accelerat- ing the corrosion process [34]. As can be observed in Fig. 4, an increase in the flow velocity from V1 to V3 facilitates the corrosion process by reducing the mass transfer boundary layer from d1 to d3 [34]. Increased fluid velocity also accelerates the dissolution of protective surface layers promoting localized corrosion [33,34]. On the other hand, lower velocities promote solids deposition and biofilms formation, which are the precursors for under deposit cor- rosion and MIC [33,34].

Electrochemical corrosion models [36,37] use the fluid proper- ties obtained from flow simulations to estimate general internal

Fig. 3 Electrochemical corrosion cell in a pipeline. Anode, cathode, and metallic path are in the pipeline steel while the electrolyte is the water. Corrosion will not occur if water is not present [34].

consequence analysis [47]. There are several methods for the probability analysis including PRA [48]. Consequence analysis allows the estimation of the severity of the adverse effects to peo- ple, property, and the environment [3,6,8,17]. The risk evaluation uses the results of the risk analysis to assess the risk significance and to define possible options when the risk is above acceptable limits. Risk significance is defined as the “importance of the level of risk to those who can be affected by the outcome of a hazardous event” [17]. Finally, the risk control is implemented through deci- sion making and can be optimized with RBI and RBM planning

3 Framework for Risk-Based Integrity Assessment of Unpiggable Pipelines 3.1 Overview. The objective is to develop a framework to assess the risk and integrity of unpiggable pipelines subject to internal corrosion. The assessed risk is evaluated by comparison with a risk acceptance criteria (RAC) to obtain a representative measure of the safety of the pipeline. Safety is required to avoid undesirable consequences of pipeline failures to humans, environment, property, and the economy [17]. If the risk is significant, risk control is utilized

consequence analysis [47]. There are several methods for the probability analysis including PRA [48]. Consequence analysis allows the estimation of the severity of the adverse effects to peo- ple, property, and the environment [3,6,8,17]. The risk evaluation uses the results of the risk analysis to assess the risk significance and to define possible options when the risk is above acceptable limits. Risk significance is defined as the “importance of the level of risk to those who can be affected by the outcome of a hazardous event” [17]. Finally, the risk control is implemented through deci- sion making and can be optimized with RBI and RBM planning

to identify available options to reduce the risk including risk-based inspection, risk-based maintenance, and risk-based monitoring plans. An overview of the proposed frame- work for the risk-based integrity assessment of unpiggable pipe- lines is presented in Fig. 6 alongside the risk management process from CSA Z662 [17].

The probabilistic approach of the framework allows for the inclusion of the spatiotemporal uncertainties from flow and corro- sion analysis for the prediction of the size of internal corrosion features. In addition, spatiotemporal errors in both the flow and corrosion analysis models and in the inspection tools (nondestruc- tive inspection (NDI)) used for model validation are also consid- ered by the framework. Finally, the framework includes the spatiotemporal uncertainty of the corrosion growth process, and this is used to predict the size of internal corrosion features into the future [49,50]. Details of the proposed framework are pre- sented below.

Fig. 5 Overview of the risk management process for oil and gas pipelines according to CSA Z662 [17]. The process includes the risk assessment where the risk is quantified and evaluated in terms of acceptability and the risk control to reduce the risk in accordance to public and regulatory requirements.

3.2 Objective Definition. The purpose of the objective definition in the framework is to define: risk measures, RAC, and optimization methods [18,51]. Pipeline risk units depend on prob- ability of failure (PF) measures and consequence types (human, environmental, and economic). Risk-based design practices present PF in units of failures per unit of length and time, and this is referred to as the failure rate (e.g., failures=km year ) [17,52]. Human consequences are expressed in number of fatalities per failure, environmental consequences in volume of fluids spilled per failure, and economical consequences in monetary units per failure [18]. In the framework, all consequence types are monetarized to facilitate the optimization, i.e., human, environmental, and economic consequences are presented in monetary units per failure [51]. Therefore, in the proposed framework, pipeline risk is presented as monetary unit per distance and time (e.g., $=km year ). Generally, a specific RAC is assigned for different consequence classes (human, environmental, and economical), but in the framework, all consequence classes are expressed in monetary terms and therefore a unique RAC is considered [51]. Annex O of CSA Z662 and Annex C of ISO 16708 provide guidance to define reliability targets for human consequences; however, environmental and economic consequences are not included [17,52]. In the framework, data from historic failures are used to select a RAC that considers the three consequence types. Optimization in the framework facilitates the selection of risk control strategies that minimize the total expected costs, which are the sum of inspection, maintenance, and failure costs [51]. The RAC is also adjusted based on the results from the optimization process [51]. One controversial aspect of the optimization is

Fig. 7 Flow analysis to estimate variables that are required by the corrosion analysis to calculate the size of corrosion features [36,37] and by the consequence analysis to calculate the amount of fluids discharged for a leak or burst. The analysis is discretized in space and time to reduce the errors in the corrosion and consequence analysis.

and the multiphase flow model is used to identify the flow regime. Based on the flow regime, different momentum balance equations are selected to estimate the pressure loss for each section [36,37,54,55]. The heat transfer model combines operational and physical data about the fluids, materials, and environment to estimate the temperature change in the section [36,37,56]. The solids deposition model uses the inlet data and variables from the multi- phase flow and heat transfer models to estimate the solids velocity [57]. Once the flow analysis is completed for all sections and times the pressure, temperature, liquid hold-up, solids deposition, and wall shear stresses are obtained.

3.4.2 Corrosion Analysis. The objective of the corrosion analysis is to obtain the distribution of the size of localized corrosion features as a function of time and space. The input variables include the pressure, temperature, liquid hold-up, solids deposition, and wall shear stresses. In addition, the composition of the oil, gas, water, solids, and MIC is also utilized as an input. Figure 8 summarizes the corrosion analysis, which includes three mechanistic models (mass transfer, scale, and electrochemical [36,37]), two semi-empirical models (MIC [43], and localized corrosion [59]), and two numerical models (probabilistic corrosion, and extreme value analysis). Pressure and temperature in the mass transfer model allow for estimation of the pH and mass transfer rates of hydrogen ions from the corrosive species H2S or CO2 [37,36]. The scale model is used to predict scale thickness and porosity [36,37], which, combined with the pH and mass transfer rates, allow for the estimation of the average size of general corrosion features in the electrochemical general corrosion model [36,37]. To transform

Fig. 8 Corrosion analysis to estimate the distribution of the size of localized corrosion features. The probabilistic corrosion model is utilized to include the temporal uncertainty of the corrosion process in the estimation of the size of general corrosion features. The population effect is also considered as part of the extreme value analysis [58].

the average size of the general corrosion features into a probability distribution, a probabilistic corrosion model is developed by the framework. This model allows inclusion of the temporal uncertainty in the estimation of the size of general corrosion features. The distribution of the size of general corrosion features is also estimated at future times using a stochastic process such as the gamma process that is commonly used to represent the growth of corrosion features in pipelines [50,60]. The MIC model [43] and the localized corrosion model [59] are utilized to obtain the multiplication factor, which is employed in the extreme value analysis to transform the distribution of the size of general corrosion into the distribution of the size of localized corrosion.

3.5 Probability Analysis. The purpose of the probability analysis is to calculate the probability of failure PF due to a leak or burst generated by internal corrosion as a function of time and space. Figure 9 presents an overview of the probability analysis, which includes failure modes analysis and structural reliability analysis (SRA). Pipelines have two failure modes—leak and burst [21]. In the framework, the PF for leak and burst are estimated using limit state functions (LSFs) in a SRA [51]. The LSF for leak is defined as the difference between the distributions of the actual wall thickness of the pipeline and the size of localized corrosion features [18]. For burst, the LSF is described as the difference between the distributions of the MAOP and the failure pressure [18]. The SRA is used in the framework to calculate the PF for leak and burst and is implemented using several methods including the first-order reliability method [48,51]. One limitation of the framework for the estimation of the PF by burst is that the corrosion analysis is not able to predict the other dimensions that are required for the calculation of failure pressure (i.e., width and length). A possible simplification for the implementation is the use of a multiplication factor to transform the PF