Pipelines: design, operation and integrity

A pipeline is a pressure vessel tens or hundreds of kilometers long, mostly buried, crossing land the operator does not own and running past farms, towns, rivers and roads. It is designed, built and tested once, and then it has to keep its integrity for decades while the steel ages, the coating weathers, the ground moves and people dig nearby. Most of the time it is invisible, watched by instruments and a control room far away. This lesson explains how pipelines are designed for pressure, how they are protected from corrosion, how they are inspected and monitored, and how integrity management programs find and fix threats before they become failures. Lesson 10 covers the right-of-way and the public, and Lesson 11 covers pigging and maintenance.

Pipe, pressure and design factors

Line pipe is made from steel graded by its specified minimum yield strength (SMYS), the stress at which the steel begins to deform permanently. Common grades range from about 241 MPa (35,000 psi) for older or small pipe to 483 MPa (70,000 psi) and above for modern transmission pipe. The pressure a pipe can hold depends on its yield strength, wall thickness and diameter, and the classic relationship is Barlow's formula, which gives the hoop stress in the pipe wall:

where \(P\) is the internal pressure, \(D\) is the outside diameter and \(t\) is the wall thickness. Rearranged, it gives the pressure that would stress the wall to a given level. Designers never allow the hoop stress to reach the yield strength. Instead, the codes multiply the yield-based pressure by design factors that depend on where the pipe runs: the more people nearby, the lower the allowed stress.

PHMSA's 49 CFR Part 192 calls these areas class locations, from Class 1 in rural areas with 10 or fewer buildings intended for human occupancy within a sliding mile-long section to Class 4 where multistorey buildings are prevalent. Each class has a design factor: 0.72 for Class 1, 0.60 for Class 2, 0.50 for Class 3 and 0.40 for Class 4, which multiplies the yield-based pressure together with joint and temperature factors. The program below applies these factors to an invented line. It is a teaching calculation; real design pressures come from the operator's engineering records.

# Design pressure by class location using Barlow's formula (49 CFR 192 design factors).
D = 12.75          # in outside diameter (NPS 12)
t = 0.281          # in wall thickness
smys = 52_000      # psi (Grade X52)
factors = {"Class 1": 0.72, "Class 2": 0.60, "Class 3": 0.50, "Class 4": 0.40}
E, T = 1.0, 1.0    # longitudinal joint and temperature factors

base = 2 * smys * t / D                 # psig at 100 % SMYS
print(f"Pressure at 100 % SMYS: {base:,.0f} psig")
for name, F in factors.items():
    print(f"{name}: design pressure {base*F*E*T:6,.0f} psig")

Pressure at 100 % SMYS: 2,292 psig
Class 1: design pressure  1,650 psig
Class 2: design pressure  1,375 psig
Class 3: design pressure  1,146 psig
Class 4: design pressure    917 psig

The same pipe is allowed a much lower pressure where more people live nearby, because a failure there would harm more people. When a town grows toward a pipeline and the class location changes, the operator must reassess the line, which may mean lowering the operating pressure, testing it to a higher pressure or replacing pipe.

Maximum operating pressure and pressure testing

Every pipeline segment has a maximum allowable operating pressure (MAOP), the highest pressure at which it may be operated, set from its design pressure, its pressure test and the rating of its components, and supported by traceable, verifiable and complete records. Before a new pipeline enters service, it is pressure tested above its MAOP, usually with water, to prove that it has no defects large enough to fail. Pressure tests are hazardous in their own right: a test section holds a large amount of stored energy, and test failures can throw pipe and soil. Test areas are cleared and controlled, and tests with gas or air, which store far more energy, are used only under strict conditions.

Records matter. The 2010 San Bruno, California, explosion, discussed in Lesson 12, involved a pipe segment whose records did not match what was in the ground, and it led to stricter requirements for verifying pressure ratings.

Coatings and cathodic protection

Buried steel corrodes when moisture and salts in the soil create electrochemical cells on its surface. Pipelines are protected in two layers. A coating, such as fusion-bonded epoxy or a multilayer polyethylene system on modern pipe and tape or coal tar on older lines, separates the steel from the soil. Because no coating is perfect, cathodic protection supplies a small direct current that makes the whole pipe the cathode of a deliberate electrochemical cell, so that any coating defect is protected. Current comes from sacrificial anodes, such as magnesium or zinc, buried next to the pipe, or from rectifiers that drive current from the power grid through buried anode beds.

Cathodic protection is checked by measuring the pipe's potential against a reference electrode at test posts along the line. A commonly used criterion is a pipe-to-soil potential of −850 mV or more negative relative to a copper-copper sulfate reference electrode, with the current applied, although standards recognize other criteria too. Technicians take readings during annual surveys and close-interval surveys walk the line taking readings every few meters to find poorly protected spots. Interference from other pipelines, power lines and transit systems can disturb protection and must be managed. For field workers, rectifiers are electrical equipment with their own hazards, and test posts and anode beds should not be damaged during nearby work.

Inspecting pipelines

Most pipelines cannot be seen, so they are inspected from the inside and the outside. The main tools are:

Many small gathering lines were not built to allow in-line inspection: they have tight bends, changes in diameter or valves that a tool cannot pass. These lines rely on other methods, such as direct assessment, pressure testing and corrosion monitoring, and some operators replace them with piggable designs or non-metallic pipe that does not corrode.

Integrity management

PHMSA requires integrity management programs for gas transmission and hazardous liquid lines in high consequence areas, places where a failure would affect populated areas, drinking water sources or sensitive environments, and later rules extended some requirements beyond those areas. Programs identify every threat, such as external and internal corrosion, stress corrosion cracking, manufacturing and construction defects, equipment failure, third-party damage, geotechnical hazards and incorrect operations, assess the risk, inspect, repair defects on set timelines and review results. Many operators also follow API RP 1173 pipeline safety management systems.

Control rooms, SCADA and leak detection

Large pipelines are operated from control rooms using supervisory control and data acquisition (SCADA) systems that show pressures, flows, temperatures and valve positions along the line and let controllers start and stop pumps and compressors and open and close valves remotely. Controllers must recognize abnormal conditions quickly. Control room management rules in both countries address alarm management, shift lengths and fatigue, handover, training and the controller's authority to shut down a line when in doubt.

Leak detection uses several methods together. Computational pipeline monitoring compares flows in and out and models the pipeline's behavior to spot imbalances. Pressure monitoring looks for sudden drops or unexpected trends. Patrols, aerial surveys, fiber optic sensing along the line and reports from the public find leaks that instruments miss. The program below shows the idea behind a simple mass balance: it compares invented hourly metered volumes in and out of a liquid line and flags a sustained imbalance that is larger than normal measurement noise.

# Simple mass-balance leak detection on invented hourly data (teaching example).
import random
random.seed(7)
hours = 36
inflow = [400 + random.gauss(0, 3) for _ in range(hours)]      # m3/h
leak_start, leak_rate = 20, 9.0                                  # leak begins at hour 20
outflow = [q - (leak_rate if h >= leak_start else 0) + random.gauss(0, 3)
           for h, q in enumerate(inflow)]

window, threshold = 4, 5.0      # rolling hours and average imbalance that triggers an alarm
for h in range(window, hours):
    imbalance = sum(inflow[i] - outflow[i] for i in range(h - window, h)) / window
    if imbalance > threshold:
        print(f"Hour {h}: average imbalance {imbalance:.1f} m3/h over {window} h -> leak alarm")
        print(f"Detected {h - leak_start} h after the leak began; about "
              f"{leak_rate * (h - leak_start):.0f} m3 lost before the alarm")
        break
else:
    print("No alarm")

Hour 24: average imbalance 8.5 m3/h over 4 h -> leak alarm
Detected 4 h after the leak began; about 36 m3 lost before the alarm

The alarm comes a few hours after the leak begins, because the system must tell a real imbalance from normal noise. A larger leak is caught sooner; a small leak below the threshold may never trigger an alarm and must be found by other methods. At Marshall, Michigan, in 2010, the control room received alarms after a rupture but misread them as a column separation and restarted the line twice; the leak continued for about 17 hours before a utility worker reported oil. Leak detection works only when controllers trust it and act on it, which is why control room procedures give controllers the authority and the expectation to shut down when they cannot explain an abnormal condition.

What pipeline field workers do

Pipeline technicians and operators carry out much of the integrity program in the field: patrolling rights-of-way, reading cathodic protection, running pigs, operating block valves, supervising crossings and excavations, responding to leak reports and assisting with digs to examine defects. Their observations, such as an exposed pipe at a creek, a new building near the line, ground cracks on a slope or dead vegetation that may indicate a gas leak, feed the integrity program. Field workers are also the first responders when the control room sees an abnormal condition and needs eyes on a valve site or a suspected leak, which brings in the emergency response practices in HSE-330 and Lesson 12.