Pipelines: design, operation and integrity

A pipeline is a pressure vessel tens or hundreds of kilometres long, mostly buried, crossing land the operator does not own and running past farms, towns, rivers and roads. It is designed, built and tested once, and then it has to keep its integrity for decades while the steel ages, the coating weathers, the ground moves and people dig nearby. Most of the time it is invisible, watched by instruments and a control room far away. This lesson explains how pipelines are designed for pressure, how they are protected from corrosion, how they are inspected and monitored, and how integrity management programs find and fix threats before they become failures. Lesson 10 covers the right-of-way and the public, and Lesson 11 covers pigging and maintenance.

Pipe, pressure and design factors

Line pipe is made from steel graded by its specified minimum yield strength (SMYS), the stress at which the steel begins to deform permanently. Common grades range from about 241 MPa (35,000 psi) for older or small pipe to 483 MPa (70,000 psi) and above for modern transmission pipe. The pressure a pipe can hold depends on its yield strength, wall thickness and diameter, and the classic relationship is Barlow's formula, which gives the hoop stress in the pipe wall:

where \(P\) is the internal pressure, \(D\) is the outside diameter and \(t\) is the wall thickness. Rearranged, it gives the pressure that would stress the wall to a given level. Designers never allow the hoop stress to reach the yield strength. Instead, the codes multiply the yield-based pressure by design factors that depend on where the pipe runs: the more people nearby, the lower the allowed stress.

CSA Z662 calls these areas class locations, from Class 1 in remote areas with few buildings to Class 4 in areas with multistorey buildings and dense population. The design pressure is calculated with a design factor of 0.8, multiplied by a location factor that falls as the class location rises and is lower again for sour gas service, together with joint and temperature factors. The program below applies typical location factors for non-sour and sour gas service to an invented line; the actual factors depend on the edition of CSA Z662 and the service, so this is illustrative only.

# Design pressure by class location using Barlow's formula (illustrative CSA Z662-style factors).
D = 323.9          # mm outside diameter (NPS 12)
t = 7.1            # mm wall thickness
smys = 359         # MPa (Grade 359)
F = 0.8            # design factor
loc = {"Class 1": (1.0, 0.9), "Class 2": (0.9, 0.75), "Class 3": (0.7, 0.625), "Class 4": (0.55, 0.5)}
# (non-sour gas location factor, sour gas location factor) - typical values, check the current code

base = 2 * smys * t / D * 1000          # kPa at 100 % SMYS
print(f"Pressure at 100 % SMYS: {base:,.0f} kPa")
for name, (L_sweet, L_sour) in loc.items():
    print(f"{name}: sweet gas {base*F*L_sweet:7,.0f} kPa   sour gas {base*F*L_sour:7,.0f} kPa")

Pressure at 100 % SMYS: 15,739 kPa
Class 1: sweet gas  12,591 kPa   sour gas  11,332 kPa
Class 2: sweet gas  11,332 kPa   sour gas   9,443 kPa
Class 3: sweet gas   8,814 kPa   sour gas   7,869 kPa
Class 4: sweet gas   6,925 kPa   sour gas   6,296 kPa

The same pipe is allowed a much lower pressure where more people live nearby, because a failure there would harm more people. When a town grows towards a pipeline and the class location changes, the operator must reassess the line, which may mean lowering the operating pressure, testing it to a higher pressure or replacing pipe.

Maximum operating pressure and pressure testing

Every pipeline segment has a maximum operating pressure (MOP), the highest pressure at which it may be operated, set from its design pressure, its pressure test and the rating of its fittings and components, and recorded with the regulator. Before a new pipeline enters service, it is pressure tested above its MOP, usually with water, to prove that it has no defects large enough to fail. Pressure tests are hazardous in their own right: a test section holds a large amount of stored energy, and test failures can throw pipe and soil. Test areas are cleared and controlled, and tests with gas or air, which store far more energy, are used only under strict conditions.

Records matter. The 2010 San Bruno, California, explosion, discussed in Lesson 12, involved a pipe segment whose records did not match what was in the ground, and it led to stricter requirements for verifying pressure ratings.

Coatings and cathodic protection

Buried steel corrodes when moisture and salts in the soil create electrochemical cells on its surface. Pipelines are protected in two layers. A coating, such as fusion-bonded epoxy or a multilayer polyethylene system on modern pipe and tape or coal tar on older lines, separates the steel from the soil. Because no coating is perfect, cathodic protection supplies a small direct current that makes the whole pipe the cathode of a deliberate electrochemical cell, so that any coating defect is protected. Current comes from sacrificial anodes, such as magnesium or zinc, buried next to the pipe, or from rectifiers that drive current from the power grid through buried anode beds.

Cathodic protection is checked by measuring the pipe's potential against a reference electrode at test posts along the line. A commonly used criterion is a pipe-to-soil potential of −850 mV or more negative relative to a copper-copper sulphate reference electrode, with the current applied, although standards recognize other criteria too. Technicians take readings during annual surveys and close-interval surveys walk the line taking readings every few metres to find poorly protected spots. Interference from other pipelines, power lines and transit systems can disturb protection and must be managed. For field workers, rectifiers are electrical equipment with their own hazards, and test posts and anode beds should not be damaged during nearby work.

Inspecting pipelines

Most pipelines cannot be seen, so they are inspected from the inside and the outside. The main tools are:

Many small gathering lines were not built to allow in-line inspection: they have tight bends, changes in diameter or valves that a tool cannot pass. These lines rely on other methods, such as direct assessment, pressure testing and corrosion monitoring, and some operators replace them with piggable designs or non-metallic pipe that does not corrode.

Integrity management

CSA Z662 and the regulators require operators to run integrity management programs that identify every threat to each pipeline, assess the risk, inspect and mitigate, and review the results. The main threat categories are external corrosion, internal corrosion, stress corrosion cracking, manufacturing and construction defects, equipment failure, third-party damage, geotechnical hazards such as slope movement and river scour, weather and incorrect operations. The program decides which lines to inspect, how often and with what tools, and which defects must be repaired, typically using engineering assessment of how close each defect is to failure at the operating pressure.

Control rooms, SCADA and leak detection

Large pipelines are operated from control rooms using supervisory control and data acquisition (SCADA) systems that show pressures, flows, temperatures and valve positions along the line and let controllers start and stop pumps and compressors and open and close valves remotely. Controllers must recognize abnormal conditions quickly. Control room management rules in both countries address alarm management, shift lengths and fatigue, handover, training and the controller's authority to shut down a line when in doubt.

Leak detection uses several methods together. Computational pipeline monitoring compares flows in and out and models the pipeline's behaviour to spot imbalances. Pressure monitoring looks for sudden drops or unexpected trends. Patrols, aerial surveys, fibre optic sensing along the line and reports from the public find leaks that instruments miss. The program below shows the idea behind a simple mass balance: it compares invented hourly metered volumes in and out of a liquid line and flags a sustained imbalance that is larger than normal measurement noise.

# Simple mass-balance leak detection on invented hourly data (teaching example).
import random
random.seed(7)
hours = 36
inflow = [400 + random.gauss(0, 3) for _ in range(hours)]      # m3/h
leak_start, leak_rate = 20, 9.0                                  # leak begins at hour 20
outflow = [q - (leak_rate if h >= leak_start else 0) + random.gauss(0, 3)
           for h, q in enumerate(inflow)]

window, threshold = 4, 5.0      # rolling hours and average imbalance that triggers an alarm
for h in range(window, hours):
    imbalance = sum(inflow[i] - outflow[i] for i in range(h - window, h)) / window
    if imbalance > threshold:
        print(f"Hour {h}: average imbalance {imbalance:.1f} m3/h over {window} h -> leak alarm")
        print(f"Detected {h - leak_start} h after the leak began; about "
              f"{leak_rate * (h - leak_start):.0f} m3 lost before the alarm")
        break
else:
    print("No alarm")

Hour 24: average imbalance 8.5 m3/h over 4 h -> leak alarm
Detected 4 h after the leak began; about 36 m3 lost before the alarm

The alarm comes a few hours after the leak begins, because the system must tell a real imbalance from normal noise. A larger leak is caught sooner; a small leak below the threshold may never trigger an alarm and must be found by other methods. At Marshall, Michigan, in 2010, the control room received alarms after a rupture but misread them as a column separation and restarted the line twice; the leak continued for about 17 hours before a utility worker reported oil. Leak detection works only when controllers trust it and act on it, which is why control room procedures give controllers the authority and the expectation to shut down when they cannot explain an abnormal condition.

What pipeline field workers do

Pipeline technicians and operators carry out much of the integrity program in the field: patrolling rights-of-way, reading cathodic protection, running pigs, operating block valves, supervising crossings and excavations, responding to leak reports and assisting with digs to examine defects. Their observations, such as an exposed pipe at a creek, a new building near the line, ground cracks on a slope or dead vegetation that may indicate a gas leak, feed the integrity program. Field workers are also the first responders when the control room sees an abnormal condition and needs eyes on a valve site or a suspected leak, which brings in the emergency response practices in HSE-330 and Lesson 12.