Pipeline failure frequency calculation using PIPIN

Zoe Chaplin, Risk Assessment Specialist, Health and Safety Laboratory, Harpur Hill, Buxton, SK17 9JN

The Health and Safety Executive (HSE) uses the PIPIN (PIPeline INtegrity) model to predict failure
frequencies of major accident hazard (MAH) pipelines. PIPIN contains two approaches to determine
failure frequencies: an approach based on operational experience data, which generates failure
frequencies for four principle failure modes (mechanical failures, ground movement and other
events, corrosion and third party activity); and a predictive model that uses structural reliability
techniques to predict the failure frequency due to third party activity (TPA) only.

The failure frequencies generated by PIPIN are used as part of a risk assessment process to generate
land use planning (LUP) zones around pipelines. HSE use the LUP zones to provide guidance to
local planning authorities on proposed developments near a pipeline; potential modifications to an
existing pipeline; and proposed new pipelines.

PIPIN was developed in the 1990s and several improvements to the modelling have been identified
since that time. These include improving the solution method and the underlying science, as well as
updating the historical data used in the model. HSE asked the Health and Safety Laboratory (HSL)
to investigate areas for improvement and, where appropriate, implement changes to the PIPIN
model.

This paper describes work carried out by HSL to develop a new version of PIPIN for HSE to use in
their MAH pipeline assessments. This includes:
 developing a Monte Carlo solution method to replace the FORM/SORM (First/Second
Order Reliability Method) used to solve the fracture mechanics equations;
 investigating recommendations made in a peer review of PIPIN and implementing the
changes that improved the science used in the model; and
 applying up-to-date data from UKOPA (UK Onshore Pipeline Operators’ Association) and
CONCAWE (CONservation of Clean Air and Water in Europe) in both the TPA predictive
model and the operational experience model.
HSL tested the new model by calculating the failure frequencies of 584 natural gas pipelines, which
represent a subset of the UK natural gas network. A comparison was made between the results
obtained from the original model, with the outputs from implementing each of the changes
individually, and with the results obtained from the final version incorporating all of the changes.
The tests indicated that the use of the new model reduced predicted failure frequencies on average.
Generally, this leads to a decrease in the size of the calculated LUP zones.

The improvements made to PIPIN ensure that HSE’s MAH pipeline failure frequency model is more
robust and uses the latest science and data. The new model has been disseminated to Industry.

Keywords: HSE, PIPIN, pipeline integrity, failure frequency, failure rates, structural reliability, third
party activity, LUP zones, Monte Carlo.

Introduction
The Health and Safety Executive (HSE) use a computer code PIPIN (PIPeline INtegrity, Linkens 1997, Linkens
1998) to determine failure frequencies (also referred to as failure rates) of Major Accident Hazard (MAH)
pipelines. PIPIN calculates the failure frequencies for four categories of pipeline failure (pinhole, small hole, large
hole and rupture), which are used in other tools, such as MISHAP (Model for the estimation of Individual and
Societal risk from HAzards of Pipelines, HSE 2000, HSE 2002, Chaplin 2014a). MISHAP is used to calculate the
levels of risk around pipelines, which are used by HSE to set land use planning (LUP) zones. The industry
equivalent guidance is contained in PD 8010 Part 3 (BSI 2009) and TD/2 (IGEM 2013). PIPIN uses two
approaches to determine failure frequencies: an approach based on operational experience data, which generates
failure frequencies for four principle failure modes (mechanical failures, ground movement/other, corrosion and
third party activity); and a predictive model that uses structural reliability techniques to predict the failure
frequency due to third party activity (TPA) only.

The original version of PIPIN used a FORM/SORM (First/Second Order Reliability Method, Thoft-Christensen
1982, Shetty 1996, Shetty 1997) approach to solve the fracture mechanics equations in the predictive model. In a
significant number of cases, the method failed to find a solution. HSE therefore tasked the Health and Safety
Laboratory (HSL) with modifying the model to use a more robust solution technique. As the original source code
was not available, the entire model had to be rewritten. The initial aim was to only change the solution method
being used, without changing the science behind the model or the data that feeds into it. This was to ensure that the
new model replicated the results from the existing model as closely as possible. Once this had been completed, the
science and data within the model were reviewed and updated.

This paper gives an overview of the fracture mechanics within PIPIN and describes the various stages in the
updating of the model, the changes seen to the predicted failure frequencies for a test set of 584 pipelines, and the
effect that these changes have on the final LUP zones (Chaplin, 2014b).
Model description
It has been observed that there are two primary mechanisms by which a pipeline may be breached as a result of
external impact damage. In either case, if the breach is unstable, a rupture may result.

The first mechanism is by a surface gouge, which can be created, for example, as a result of contact by excavating
machinery. This can lead to a rounded profile gouge. A statistical distribution has been fit to data on the length and
depth of such gouges found in practice. If the gouge depth is greater than the wall thickness then the pipeline is
assumed to have been punctured. Figure 1 illustrates a gouge.

Figure 1 Diagram illustrating a gouge (Linkens 1998)

The second mechanism is by a dent-gouge. This occurs if the impact energy is high enough to lead to significant
tensile bending stresses at the root of the gouge, resulting in a dent, which increases the probability of a breach of
the pipeline wall. Figure 2 illustrates a dent-gouge.
 Figure 2 Diagram illustrating a dent-gouge (Linkens 1998)

PIPIN has three main fracture mechanics models:

 A gouge model that models the plastic collapse of the pipeline using either gouge data or, with a slight
modification, dent-gouge data;

 A dent-gouge model that models failure by fracture; and

 A rupture model that models the likelihood of a leak leading to a rupture resulting from either of the
above failures.

Two of the fracture mechanics models above are run twice with different sets of data. This gives a total of five
fracture mechanics submodels within PIPIN.

In the case of the gouge model, the gouge is assumed to be smooth which leads to no stress singularity and no
micro-cracking, hence the failure can be modelled as plastic collapse. It is also assumed that the gouge is aligned
with the longitudinal axes of the pipeline. Figure 1 illustrates a gouge, where “d” is the gouge depth and “c” is the
gouge half-length.

If the pipeline suffers a dent then this gives rise to through-wall bending in the region of the dent leading to an
increase in tensile stresses on the outer surface of the pipeline. This will significantly increase the probability that
the pipeline will fail and, in particular, can lead to micro-cracks opening at the base of the gouge. Figure 2
illustrates a dent-gouge in a pipeline where “d” is the gouge depth, “c” is the gouge half-length and “dentd” is the
dent depth.

In all cases the results are compared with the R6 Rev. 3 fracture assessment procedure (CEGB 1976) to determine
whether the pipeline fails. This is a curve such that, if a point lies above it then the pipeline has failed, whilst if it
lies on or beneath the curve, then the external impact will not have led to a failure.

The rupture model calculates the conditional probability of a rupture given a through wall crack, caused by either a
gouge or dent-gouge. Ruptures are dominated by the average stress through the wall thickness, which is assumed
to be virtually the same for both gouges and dent-gouges. It is also assumed that surface gouges or dents are likely
to extend through the wall before spreading significantly along the pipeline length. A penetrating defect, therefore,
precedes a long-running rupture and this has been modelled as a straight-fronted rectangular crack whose length is
the same as the associated gouge.
Each of the fracture mechanics models requires a number of inputs, both in terms of the pipeline characteristics
(e.g. diameter, wall thickness, operating pressure etc.) and also for the damage data (i.e. gouge length, gouge
depth, dent-gouge length, dent-gouge depth and impact force). All of these parameters are described using
statistical distributions (a combination of normal and lognormal distributions for the pipeline characteristics, and
Weibull distributions for the damage data). Using statistical distributions allows for the fact that the actual values
for the damage data and the pipeline characteristics, may vary slightly from those input (due to inaccuracies in
recording methods etc.). In addition, the original version of the model incorporates modelling uncertainties, which
are factors applied to some of the fracture mechanics equations. These are also described by normal or lognormal
distributions.

The failure probabilities calculated using each of the fracture mechanics models are combined with incident
frequencies (the likelihood that the pipeline will be struck), and a probability of a hole being within a specified
diameter range, to produce overall failure frequencies for a pipeline for each hole size, i.e. the frequency that the
pipeline is hit is multiplied by the probability that it will fail if it is hit by an object, and the probability that a hole
within a specified diameter range will be formed.

HSE currently require pipeline failure frequencies for the following hole sizes:

 pinhole:  25 mm diameter;

 small hole: > 25 to  75 mm diameter;

 large hole: > 75 to  110 mm diameter

 rupture: > 110 mm diameter

A rupture is assumed to occur as a result of an unstable leak or as a result of a stable leak that leads to a hole size
greater than 110 mm in diameter. In both cases, this can be initiated by either a gouge or a dent-gouge.

Modifying the solution method

The original version of PIPIN used the FORM solution method, which failed to converge to an answer in a
significant number of cases. Alternative methods considered by HSL include SORM, direct numerical integration
or Monte Carlo (MC) simulation. The SORM solution method only produces an approximate solution to the
problem and it is likely there would still be issues over its convergence. Direct numerical integration is highly
complex, especially given the number of variables involved. The use of a Monte Carlo simulation keeps the
problem relatively simple whilst still allowing for a high degree of accuracy. Although Monte Carlo simulation can
be computationally time consuming, this approach was the one chosen as it is more intuitive than direct numerical
integration. Modern computer power means that run times have decreased significantly since PIPIN was originally
developed, making the Monte Carlo solution a more viable alternative to the FORM solution adopted at that time.

The Monte Carlo approach implemented involves randomly sampling each of the input variables in the fracture
mechanics equations (e.g. pipeline parameters and damage distributions) to determine whether a failure occurs for
a particular set of values. A random number generator is used to generate the input variables for the rest of the
model. The values randomly sampled are input to the fracture mechanics equations to ascertain whether this
particular combination of parameters would cause a failure point. The stated distributions for each of the variables
are consistent with those used in the original version of PIPIN (Linkens 1997).

By repeating this process a large number of times the probability of failure from each of the five failure models can
be calculated. The probability of failure is simply the number of cases where failure occurred divided by the
number of iterations required for that failure model. The process is repeated until the failure probabilities have
converged, i.e. do not change significantly with further iterations. Initially the failure probability changes
significantly as more failure points are identified. As more iterations are performed then these changes become
smaller. A convergence criterion is specified to determine at what point the calculations can terminate (i.e.
specifies the tolerance to which the individual failure model can be said to have converged on an answer). The
final calculated failure probabilities from each of the five models are combined with the incident frequencies and
the probability of a hole in a specified diameter range to calculate a failure frequency by hole size.

Results using the Monte Carlo solution method were obtained for a set of 584 pipelines, representative of pipelines
within the UK natural gas transmission system. Figure 3 illustrates the results for the rupture frequency on a linear
scale for the 584 pipelines, and compares the Monte Carlo (MC) model to the FORM PIPIN model. Figure 4
displays the same information but on a log-log scale. If points lie on the solid line in the figures then it indicates
that the two models have produced the same result. If the points lie above the line then the failure frequencies from
the Monte Carlo model are lower than the FORM PIPIN model. If points are below the line, the failure frequencies
from the Monte Carlo model are higher than the FORM PIPIN model.
 6.00E-07

5.00E-07
PIPIN failure frequency (m-1 yr-1)

4.00E-07

3.00E-07

2.00E-07

1.00E-07

0.00E+00
0.00E+00 1.00E-07 2.00E-07 3.00E-07 4.00E-07 5.00E-07 6.00E-07

MC failure frequency (m-1 yr-1)

Figure 3 Comparison of PIPIN and Monte Carlo (MC) model for rupture frequencies

1.00E-06

1.00E-07
PIPIN failure frequency (m-1 yr-1)

1.00E-08

1.00E-09

1.00E-10
1.00E-10 1.00E-09 1.00E-08 1.00E-07 1.00E-06
MC failure frequency (m-1 yr-1)

Figure 4 Comparison of PIPIN and Monte Carlo (MC) model for rupture frequencies on a log-log scale

From the figures it can be seen that there is close agreement between the two models for most of the cases
examined. There are approximately 15 cases where there was not close agreement between the two models. In
most cases, the Monte Carlo method produces failure frequencies that are slightly lower than those obtained using
the FORM version of PIPIN. Of the outlying points, ten were at diameters of 114.3 mm or less and with a
maximum operating pressure of less than 44 bar. This represented all the low diameter, low pressure pipelines
tested. Most of the remainder were at a diameter of 168.3 mm and again with low pressure. However, at this
diameter and with lower pressure, there were many more cases that showed close agreement between the two
models.

The FORM/SORM method has a number of approximations inherent within it which can lead to some
inaccuracies. It has been seen from the literature that there can be a factor of 2 or more difference between FORM
and Monte Carlo solution methods (Mitchell 1997) which may account for the differences seen in some of the
above results.

The overall conclusion was that the Monte Carlo model reproduced the results from the original version of PIPIN
to an acceptable degree of accuracy.

As HSE use the failure frequencies from PIPIN in their Quantitative Risk Assessment calculations to set the
distance to Land Use Planning zones around pipelines, repeatability is a requirement of the failure frequency
calculations. That is, for the same set of inputs, the code will always give the same answer. Due to the use of
random sampling in the Monte Carlo simulation this can lead to slight differences in the outputs generated for
repeated calculations using the same set of inputs. One method investigated to ensure repeatability was the use of a
more stringent convergence criterion. However, the number of iterations required to guarantee repeatability led to
a significant increase in run times for the code. The solution adopted to ensure repeatability was to run the Monte
Carlo simulation for each set of inputs 10 times and to calculate the mean failure frequency using the results from
those 10 runs. This was found to provide the same outputs for multiple runs of the same set of inputs without
increasing the run times of the code to an unacceptable level. This revised model was named MCPIPIN and
became the version used within HSE. The non-operational version that performs only 1 run of the Monte Carlo
version of the model will be referred to as the MC model throughout this paper to distinguish it from MCPIPIN.

Science updates
The revised version of PIPIN using the Monte Carlo solution method (the MC model) underwent an independent
review (Francis 2009) to determine whether the science in the model was fit for purpose. This identified several
key areas to be investigated further and potential changes that could be made to improve the validity of the model.
These were:

 Within the original code, a number of modelling uncertainties were applied to various equations to
represent the level of uncertainty involved in trying to model whether a failure will occur when a
pipeline is damaged. The independent review considered that this was a case of adding uncertainty onto
uncertainty and that these modelling uncertainties should be removed.

 A simplified equation for the limiting hoop stress was used when a dent and gouge were formed through
plastic collapse compared to when just a gouge was formed through plastic collapse. The same
mechanism is involved in both cases so the use of a simplified equation was considered unnecessary; it
was suggested in the review that the same equation should be used in both cases.

 The Charpy energy-fracture toughness correlation reflects a material’s ability to resist fracture and
relates the energy imparted when a material is struck, to its toughness. The correlation is used as it is not
possible to directly measure the fracture toughness. It was suggested by the review that the equation
incorporated within PIPIN could be unrepresentative and potentially over-predicts the toughness. The
independent review considered that a published relationship, such as that in BS 7910 (BSI 2007) could
be used in preference.

 The rupture calculation was considered to be inaccurate. A revision was suggested that ensured no
double counting occurred when the gouge or dent-gouge length was greater than a 110 mm equivalent
diameter hole.

 The micro-crack correlation was originally calculated by comparing results with those from the industry
standard failure frequency model, rather than using existing data. It was also noted that, if the dent depth
is zero then there should be no possibility of a micro-crack but this does not hold true with the existing
correlation. The combination of these factors led to the conclusion that the micro-crack correlation
should be revisited and the original, published, test data should be used.

Each of the suggested modifications was considered, both in terms of their validity, and their impact on the failure
frequencies for the test set of 584 pipelines (Chaplin 2014c). In each case, the Monte Carlo version of the model
was used, both for the test cases and for the comparison. A summary of the observations made is given below.

Modelling uncertainties

The modelling uncertainties were normal or lognormal distributions that were applied to a number of the fracture
mechanics equations to try and account for the level of uncertainty in the input parameters. It was agreed that these
uncertainties were unnecessary and were actually adding uncertainty to the model. Removing them also improved
the performance of the code as this reduced the number of distributions being sampled in the model from 19 to 11.
The effect of removing the modelling uncertainties on the results from the test set of 584 pipelines was to slightly
increase the failure frequencies for all hole sizes on average. The largest difference was for ruptures, which saw a
9% increase on average, with a maximum difference of 16%.

Limiting hoop stress

The modification to the dent-gouge model to ensure that the same version of the limiting hoop stress equation as
that in the gouge model is used was considered a reasonable suggestion. There was a negligible effect on the
results for all hole sizes, and across all the pipelines, on average. A maximum increase of 12% and a maximum
decrease of 10% to the failure frequencies across all the hole sizes modelled was observed for some of the
pipelines.

Charpy energy – fracture toughness correlation

In the FORM version of PIPIN, the Charpy energy-fracture toughness correlation is from Kiefner (Kiefner 1973).
This correlation is also referred to in the literature as the NG-18 equations. The independent review of PIPIN
suggested that this correlation overpredicted the fracture toughness of the model and that an alternative
relationship, such as that from BS 7910 (BSI 2007) should be used. As BS 7910 is a recognised and widely used
standard, it appears to be a reasonable choice for a comparison with what is used in the model. Discussions were
held with experts in the field of fracture mechanics and with industry over the use of these different methods. The
documentation for the correlation by Kiefner was reviewed, along with the results from PDAM (Pipeline Defect
Assessment Manual, Cosham 2002), a joint industry project in which HSE were involved. The PDAM project
compared several correlations including that described in BS 7910 and the one by Kiefner. All of these sources
indicated that the correlations quoted in BS 7910 and in other industry standards are overly conservative and not
truly representative when it comes to predicting failures in pipelines. The review of the available documentation
and the discussions with experts in this field indicated that the correlation described in Kiefner (the NG-18
equations) is a more realistic representation for the prediction of failures in pipelines. The decision was made to
continue to use the Kiefner correlation in the PIPIN model.

Although the modification to the Charpy energy-fracture toughness correlation was ultimately discounted, the
effects of using the correlation from BS 7910 were assessed. It was found that the largest impact was on the
rupture failure frequencies, which increased, on average, by a factor of approximately 6.5 when using the BS 7910
correlation when compared to the results obtained from using the Kiefner correlation.

Rupture calculation

The original equation to apportion the failure frequencies from each of the five models within PIPIN to a rupture,
assumed statistical independence between the probabilities calculated by the five models. The review concluded
that this was unlikely to be true and that an alternative form of the equation should be used, as some double-
counting was occurring when the gouge or dent-gouge length was greater than a 110 mm equivalent diameter hole.
The modification entailed including calculations for the critical crack length, which had not been considered
previously.

The arguments for the use of the alternative calculation were considered reasonable. The effect of the change in the
model was to decrease the rupture failure frequencies by 13% on average, across the 584 pipelines tested.

Micro-cracks

Micro-cracks are assumed to be present in the regions of local tensile stresses and they can contribute to the failure
of the pipeline wall. In the FORM version of PIPIN, a correlation was derived to calculate the micro-crack based
on the dent depth and the pressure hoop stress. This correlation was derived by using 29 runs from the British Gas
model, which had been tuned to a subset of the test data. The FORM version of PIPIN was tuned to give the same
values of Kr, the fracture ratio due to the applied primary and secondary stresses, as the British Gas model. In other
words, PIPIN was not explicitly tuned to test data but was instead tuned to a small sample of results from another
model that had been tuned to the test data. A further issue identified with this solution was that the fracture
mechanics calculations in the British Gas model did not contain a micro-crack correlation and so the science
between the two models was different. Tuning PIPIN to this model is unlikely to be as representative of real life
behaviour as tuning to the full set of test data.

The independent science review observed that the test data originally generated by British Gas was publicly
available (Jones 1982) and recommended that PIPIN should be retuned to the full set of 132 test points from this
data. This recommendation was considered reasonable and a revised micro-crack correlation was derived using
these data. The effects on the results obtained on the test set of 584 pipelines were assessed. It was found that the
failure frequencies for all of the hole sizes were more than doubled on average when using the version of PIPIN
tuned to the full set of test data. The standard deviation of the changes observed in the results obtained indicates
that the variation in results is considerable. Some of the test set showed a significant increase in the calculated
failure frequencies whilst others saw a decrease in the calculated failure frequencies. Despite the large increase in
failure frequencies, it was decided that the new micro-crack correlation should be incorporated into the model due
to the increased transparency in the way it was generated and due to it being directly based on experimental data
rather than another model.

Summary of results from all the science changes

The effect of applying all the recommended modifications, with the exception of the Charpy energy-fracture
toughness correlation, was to more than double the failure frequencies on average. Given that the observed
differences were relatively minor for all the changes other than the micro-crack correlation, the magnitude of the
differences is not surprising.

Data updates
There are two types of data used within PIPIN. The first set of data define the damage distributions used within the
fracture mechanics models i.e. the gouge length and depth, the dent-gouge length and depth and the impact force.
Strike rates are also input, which determine the frequency with which a pipeline will be struck by a third party. The
second type of data is used to derive failure frequencies for the other failure mechanisms i.e. mechanical, corrosion
and ground movement/other. Both sets of data required updating as they were based on information that was out of
date at the time.

Damage data

The damage data consists of five statistical distributions that define the gouge length, gouge depth, dent-gouge
length, dent-gouge depth and the impact force, together with strike rates that define the frequency with which a
pipeline will be hit. These are all based on historical data. Before updating, the damage data parameters were all
represented by Weibull distributions.

UKOPA (UK Onshore Pipeline Operators’ Association) provided HSL with details of all recorded faults due to
third party activity on the pipeline network between 1967 and 2009. Each fault or failure is categorised as to
whether it is a dent, a gouge, or a crack. Some dents have one or more gouges associated with them, and hence
these gouges can be classified as dent-gouges. The depth and length of the dent or gouge are recorded and hence it
is possible to generate a list of all gouges or dent-gouges that have occurred on the network since 1967. The impact
force is calculated using an equation based on the dent depth. The full details of the analysis performed on the data
can be found in Chaplin (2014d).

Statistical distributions were fit to each set of damage data and test statistics were derived to provide an indication
of how well the distribution fit the data. When looking at the test statistics, it was found that neither the Weibull
nor the lognormal fit the gouge length or gouge depth particularly well. However, a visual inspection of the curves
generated by the data and the distributions suggested that the use of both the Weibull and the lognormal
distributions were reasonable for these cases. The lognormal distribution was found to fit the dent-gouge length
data, the dent-gouge depth and the impact force, whilst the Weibull distribution fit the dent-gouge length and the
impact force.

Given the predominance of Weibull distributions in engineering and the historical use of them within PIPIN, it was
decided that a Weibull distribution should be used for consistency for cases where there was no obvious better fit
using a lognormal distribution. The lognormal distribution did provide a significantly better fit to the data for the
impact force and hence it was decided that it should be used in preference to the Weibull distribution in this case. It
was also decided to use the lognormal distribution for the dent-gouge length where the Weibull distribution did not
fit the data particularly well.

In summary, the Weibull distribution was recommended for the gouge length and depth and the dent-gouge depth,
whilst the lognormal distribution was recommended for the dent-gouge length and the impact force.

Strike rates

The strike rates, or incident frequencies determine the frequency with which a pipeline will be struck. These are
multiplied by the failure probabilities calculated by the fracture mechanics models, together with a probability of a
hole in a specified diameter range, to generate an overall failure frequency, i.e. the frequency that the pipeline is hit
is multiplied by the probability that it will fail if it is hit by an object, and the probability that a hole within a
specified diameter range will be formed.

Two different values are used for the strike rates in PIPIN; the first refers to gouge incidents and the second to
dent-gouge incidents. As in the case of the damage distributions, the strike rates are based on historical data. To
calculate the strike rates, population data, in the form of the number of km years that the pipelines have been
operational, and the number of faults that have occurred, are required. This information was made available by
UKOPA and was combined with the UKOPA fault data to recalculate the values used in PIPIN. Both the gouge
and dent-gouge strike rates used in PIPIN were reduced following the updated data analysis.

Operational data

As well as calculating failure frequencies due to third party activity, PIPIN also generates frequencies for
mechanical, corrosion and ground movement/other mechanisms. These frequencies are derived from historical
datasets and are substance specific. In the original version of PIPIN, a combination of UKOPA, CONCAWE
(CONservation of Clean Air and Water in Europe) and EGIG (European Gas pipeline Incident Group) data was
used. The most recently available data was reviewed in order to provide up-to-date failure frequencies. The failure
frequencies to be used for each substance and each failure mechanism can be found in Chaplin (2014e).

Results
The version of the code developed that contained the Monte Carlo solution method (the MC model) was used as
the base case to determine the effects of implementing the data changes. A version of the MC model was
developed that included the data changes but none of the science changes. The test set of 584 pipelines were run
using this revised model and compared to the results obtained from the base case MC model. Summary statistics
were derived to show the mean change caused by using the revised data across all of the pipelines modelled. The
summary statistics derived include the minimum and maximum differences observed and the standard deviation of
the results obtained. Table 1 displays the results from the predictive model i.e. for TPA only and Table 2 reports
the total results when all the failure mechanisms are included. The statistics have been calculated by dividing the
failure frequencies using the revised model by those from the MC model. A value of less than 1 in the tables
represents a reduction in the failure frequency using the new model when compared to results obtained from the
MC model, a value of 1 means there is no change in the calculated failure frequencies, and a value greater than 1
shows that the new model produces larger failure frequencies than those obtained using the MC model.
Table 1 Summary statistics of the comparison of the model with the data changes applied with the MC model
– TPA only

Hole size
Statistical measure
Pin Small Large Rupture
Mean 0.69 0.34 0.32 0.34
Minimum 0.03 0.02 0.02 0.04
Maximum 1.59 0.76 0.79 0.77
Standard deviation 0.23 0.10 0.10 0.09

Table 2 Summary statistics of the comparison of the model with the data changes applied with the MC model
– total frequencies

Hole size
Statistical measure
Pin Small Large Rupture
Mean 0.52 0.31 0.24 0.50
Minimum 0.16 0.25 0.15 0.27
Maximum 2.50 0.45 0.39 1.21
Standard deviation 0.37 0.03 0.05 0.20

From the tables it can be seen that the TPA failure frequencies are reduced for all pipelines and all hole sizes, with
the exception of pinholes. For pinholes, a reduction was seen in the failure frequencies on average, but some
pipelines saw an increase in failure frequency of up to approximately 60%. The average reduction seen for the
other hole sizes was between 65 and 70%.

When the total failure frequencies are considered (i.e. the combination of TPA, mechanical, ground
movement/other and corrosion failure frequencies), reductions are seen for all pipelines for small and large hole
failure frequencies. For both pinholes and ruptures, the failure frequencies are reduced on average by
approximately 50%, but some pipelines see an increase in the calculated failure frequency.

A second set of tests on the 584 pipelines were performed on a version of the model where the science and data
changes were applied to the operational version of the MC model i.e. MCPIPIN. This revised version is called
PIPINV3 and 10 runs are performed for each pipeline to minimise the differences that can occur through the use of
a Monte Carlo solution method. As before, the results obtained from the new model (PIPINV3) were compared to
the results obtained from MCPIPIN, which had no science or data changes implemented. The results are shown in
Table 3 for TPA only and in Table 4 for the total failure frequencies where all failure mechanisms are considered.
As before, the results are obtained by dividing the results from PIPINV3 by those from MCPIPIN. A number less
than 1 shows a reduction in failure frequency calculated when using PIPINV3 compared to using MCPIPIN, a
number greater than 1 shows that the failure frequency increases with the use of PIPINV3, and a value of 1 shows
that there is no change in the results calculated using PIPINV3.

Table 3 Summary statistics of the comparison of PIPINV3 with MCPIPIN – TPA only
Hole size
Statistical measure
Pin Small Large Rupture
Mean 1.46 0.70 0.66 0.60
Minimum 0.05 0.03 0.03 0.04
Maximum 2.06 0.99 0.99 0.91
Standard deviation 0.43 0.20 0.17 0.15

Table 4 Summary statistics of the comparison of PIPINV3 with MCPIPIN – total frequencies

Hole size
Statistical measure
Pin Small Large Rupture
Mean 0.67 0.50 0.44 0.73
Minimum 0.12 0.26 0.18 0.27
Maximum 2.58 0.81 0.76 1.20
Standard deviation 0.46 0.16 0.17 0.14

From the tables it can be seen that the results are similar to those reported when just the data changes are
considered, with the exception of the pinholes, which see an increase in failure frequency on average for TPA
only. This indicates that the data changes dominate the differences except for pinholes. In summary, reductions are
seen in the TPA failure frequencies for all pipelines and for all hole sizes, except pinholes, although the reductions
are not as large as when just the data changes have been applied. If the total failure frequencies are considered, the
failure frequencies are reduced on average for all hole sizes modelled.

To assess the impact on HSE’s LUP zones by moving to PIPINV3 for the failure frequencies, the test set of 584
pipelines were run through HSE’s pipeline risk assessment model, MISHAP (HSE 2000, HSE 2002, Chaplin
2014a) using the failure frequencies from PIPINV3 and the original version of PIPIN i.e. the FORM model with
no changes applied. Generally, the use of the PIPINV3 model led to reductions in the size of the calculated LUP
zones for pipelines when compared to using the failure frequencies from the FORM version of PIPIN.

Conclusions
In conclusion, HSE’s pipeline failure frequency model has been rewritten to incorporate a Monte Carlo solution
method to provide a more robust model. The science within the model has been independently reviewed and
modified accordingly. The data that feeds into the model has been updated, both for the predictive model and the
operational failure frequencies model. The overall effect of all the changes is to reduce the failure frequencies in
the majority of cases, and for most hole sizes. This has an impact on HSE’s LUP zones, leading to an observed
reduction in the size of the zones obtained for most of the pipelines modelled.

The development of PIPINV3 has been fully documented, making the model transparent to anyone with an interest
in pipeline failure frequencies.

References
BSI, 2007, Guide to methods for assessing the acceptability of flaws in metallic structures, BS 7910:2005, British
Standards Institute.

BSI, 2009, Pipeline systems – Part 3: Steel pipelines on land – Guide to the application of pipeline risk assessment
to proposed developments in the vicinity of major accident hazard pipelines containing flammables – Supplement
to PD 8010-1:2004, PD 8010-3:2009+A1:2013, British Standards Institute.

CEGB, 1976, Assessment of the integrity of structures containing defects, Report R/H/R6.
Chaplin, Z., 2014a, Rewriting MISHAP: The development of MISHAP12, HSE Research Report RR1040, HSE
Books.

Chaplin, Z., 2014b, Rewriting the PIPIN code to use a Monte Carlo solution approach, HSE Research Report
RR1036, HSE Books.

Chaplin, Z., 2014c, Science updates to HSE’s PIPeline INtegrity model (PIPIN), HSE Research Report RR1037,
HSE Books.

Chaplin, Z., 2014d, Data updates to HSE’s PIPeline INtegrity model (PIPIN). HSE Research Report RR1038, HSE
Books.

Chaplin, Z., 2014e, Update of pipeline failure rates for land use planning assessments, HSE Research Report
RR1035, HSE Books.

Cosham, A. and Hopkins, P., 2002, The pipeline defect assessment manual, Proceedings of IPC 2002:
International Pipeline Conference, October 2002; Calgary, Alberta, Canada. IPC02-27067.

Francis, A., 2009, Technical review of PIPIN, Andrew Francis and Associates, AFAA-R0145-09, Revision 02.

HSE, 2000, Report on a study of international pipeline accidents, HSE Contract Research Report 294/2000, HSE
Books.

HSE, 2002, Report on a second study of pipeline accidents using the Health and Safety Executive’s risk
assessment programs MISHAP and PIPERS, HSE Research Report 036, HSE Books.

IGEM, 2013, Assessing the risks from high pressure Natural Gas pipelines, IGEM/TD/2 Edition 2, Institution of
Gas Engineers and Managers.

Jones, D. G., 1982, The significance of mechanical damage in pipelines, 3R International, 21, pt. 7: 347-354.

Kiefner, J. F., Maxey, W. A., Eiber, R. J. and Duffy, A. R., 1973, Failure stress levels of flaws in pressurised
cylinders, ASTM special technical publication, 536: 461-481.

Linkens, D., 1997, Gas pipeline failure frequency predictions – probabilistic fracture models, WSA Report No.
AM5076/RSU8000/R1.

Linkens, D., Shetty, N. K. and Bilo, M., 1998, A probabilistic approach to fracture assessment of onshore gas-
transmission pipelines, Pipes and Pipelines International, 43 (4): pp5-16.

Mitchell, B. H., 1997, Use of the FORM/SORM (most likely failure point) method for uncertainty analysis,
Contract Research Report 142/1997, HSE Books.

Shetty, N. K., Gierlinski, J. T., Liew, S. K. and Mitchell, B. H., 1996, Reliability of an offshore platform under
pool and jet fires, 15th Int. Conf. On Offshore Mechanics and Arctic Engineering, Florence, 1996.

Shetty, N. K., Gierlinski, J. T., Smith, J. K. and Stahl, B., 1997, Structural system reliability considerations in
fatigue inspection planning, Int. Conf. On Behaviour of Offshore Structures, BOSS-97, Delft, 1997.

Thoft-Christensen, P. and Baker, M. J., 1982, Structural reliability theory and its applications, Springer-Verlag
1982.

© Crown copyright (2014)

This publication and the work it describes were funded by the Health and Safety Executive (HSE). Its
contents, including any opinions and/or conclusions expressed, are those of the authors alone and do
not necessarily reflect HSE policy.