ISO 16708:2006

INTERNATIONAL ISO
STANDARD 16708
First edition
2006-04-01
Petroleum and natural gas industries —
Pipeline transportation systems —
Reliability-based limit state methods
Industries du pétrole et du gaz naturel — Systèmes de transport par
conduites — Méthodes aux états-limites basées sur la fiabilité

Reference number
©
ISO 2006
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but
shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In
downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat
accepts no liability in this area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation
parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In
the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below.

©  ISO 2006
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO 2006 – All rights reserved

Contents Page
Foreword. iv
Introduction . v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions. 1
4 Symbols and abbreviated terms . 5
4.1 Symbols . 5
4.2 Abbreviated terms . 6
5 Principles for design and operation . 7
6 Reliability based limit state methods. 9
6.1 General. 9
6.2 Design and operational data basis — Data gathering . 9
6.3 Safety requirements — target. 9
6.4 Failure mode analysis . 10
6.5 Uncertainty analysis. 10
6.6 Reliability analysis. 11
6.7 Safety and risk assessment. 11
7 Design and operational requirements . 12
7.1 General. 12
7.2 Design and construction. 12
7.3 Operation and maintenance . 12
7.4 Re-qualification . 13
7.5 Hazards . 13
8 Acceptance criteria and safety classes. 13
8.1 Safety requirements . 13
8.2 Classification of limit states . 14
8.3 Categorization of fluids. 14
8.4 Pipeline location and consequence categorization . 15
8.5 Safety classes . 16
9 Target safety levels and risk levels. 17
10 Failure modes. 17
10.1 General. 17
10.2 Internal pressure induced failure modes .17
10.3 External pressure induced failure modes . 18
10.4 Failure due to external load effects . 18
10.5 Failure due to third-party activity. 19
10.6 Corrosive environment induced failure modes . 19
10.7 Failure due to combined loads. 19
11 Pipeline operational management . 20
11.1 General. 20
11.2 Operational management procedures. 20
Annex A (informative) Uncertainty and reliability analysis — Method description. 23
Annex B (informative) Statistical database — Uncertainty values. 43
Annex C (informative) Target safety levels — Recommendations. 49
Bibliography . 56

Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies
(ISO member bodies). The work of preparing International Standards is normally carried out through ISO
technical committees. Each member body interested in a subject for which a technical committee has been
established has the right to be represented on that committee. International organizations, governmental and
non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the
International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of technical committees is to prepare International Standards. Draft International Standards
adopted by the technical committees are circulated to the member bodies for voting. Publication as an
International Standard requires approval by at least 75 % of the member bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO shall not be held responsible for identifying any or all such patent rights.
ISO 16708 was prepared by Technical Committee ISO/TC 67, Materials, equipment and offshore structures
for petroleum, petrochemical and natural gas industries, Subcommittee SC 2, Pipeline transportation systems.
iv © ISO 2006 – All rights reserved

Introduction
The International Standard ISO 13623 allows the use of innovative techniques and procedures such as
reliability-based limit state methods providing the minimum requirements of ISO 13623 are satisfied.
This International Standard provides the supplement to ISO 13623 in giving recommendations and specifying
the framework and principles for the application of the probabilistic approach, i.e. “reliability-based limit state
methods”.
Pipeline integrity management during design and operation are performed by the following two limit state
approaches:
⎯ a deterministic approach, with the use of safety or usage factors applied to characteristic loads and
resistances; and
⎯ a probabilistic approach, based on structural reliability analysis applied to the relevant limit states, e.g.
reliability-based limit state methods.
Both approaches satisfy the safety requirements; implicitly by the deterministic approach (via earlier-calibrated
safety factors) and explicitly by the probabilistic approach (a direct check on the actual safety level) as
illustrated in Figure 1.
Significant differences exist among member countries in the areas of public safety and protection of the
environment. Within the safety framework of this International Standard, such differences are allowed for and
individual member countries can apply their national requirements for public safety and the protection of the
environment to the use of this International Standard.

INTERNATIONAL STANDARD ISO 16708:2006(E)

Petroleum and natural gas industries — Pipeline transportation
systems — Reliability-based limit state methods
1 Scope
This International Standard specifies the functional requirements and principles for design, operation and re-
qualification of pipelines in the petroleum and natural gas industries using reliability-based limit state methods
as permitted by ISO 13623. Reliability-based limit state methods provide a systematic way to predict pipeline
safety in design and operation.
This International Standard supplements ISO 13623 and can be used in cases where ISO 13623 does not
provide specific guidance and where limit states methods can be applied, such as, but not limited to,
⎯ qualification of new concepts, e.g. when new technology is applied or for design scenarios where industry
experience is limited,
⎯ re-qualification of the pipeline due to a changed design basis, such as service-life extension, which can
include reduced uncertainties due to improved integrity monitoring and operational experience,
⎯ collapse under external pressure in deep water,
⎯ extreme loads, such as seismic loads (e.g. at a fault crossing), ice loads (e.g. by impact from ice keels),
⎯ situations where strain-based criteria can be appropriate.
This document applies to rigid metallic pipelines on-land and offshore used in the petroleum and natural gas
industries.
2 Normative references
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
ISO 13623:2000, Petroleum and natural gas industries — Pipeline transportation systems
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
3.1
basic variable
load or resistance variable entering the limit state function including the variable accounting for model
uncertainty in the limit state function itself
3.2
characteristic load
nominal value of a load to be used in determination of load effects
NOTE Characteristic load is normally based upon a defined fractile in the upper end of the distribution function of the
load.
3.3
characteristic resistance
nominal value of a strength parameter to be used in determination of capacities
NOTE Characteristic resistance is normally based on a defined fractile in the lower end of the distribution function of
the resistance.
3.4
characteristic value
nominal value to characterize the magnitude of a stochastic variable
NOTE Characteristic value is normally defined as a fractile of the probability distribution of the variable.
3.5
commissioning
activities associated with the initial filling of a pipeline with the fluid to be transported
[ISO 13623]
3.6
construction
phase comprising installation, pressure testing and commissioning
3.7
design life
period of time selected for the purpose of verifying that a replaceable or permanent component is suitable for
the anticipated period of service
[ISO 13623]
3.8
design point
most probable outcome of the basic variables when failure occurs
NOTE The design point is the point on the limit-state surface with the highest probability density.
3.9
design value
value to be used in the deterministic design procedure, i.e., characteristic value multiplied by the safety factor
3.10
failure
loss of ability of a component or a system to perform its required function
3.11
fluid category
categorization of the transported fluid according to hazard potential
3.12
importance factor
dimensionless number between zero and one describing the contribution of a random variable to the overall
uncertainty
3.13
inspection
processes for determining the status of items of the pipeline system or installation and comparing it with the
applicable requirements
EXAMPLE Inspection can be by measuring, examination, testing, gauging or other methods.
2 © ISO 2006 – All rights reserved

3.14
limit state
state beyond which the pipeline no longer satisfies the design requirements
NOTE Categories of limit states for pipelines include serviceability limit state (SLS) and ultimate limit state (ULS).
3.15
limit-state design
structural design where specific limit states relevant for the actual case are explicitly addressed
NOTE A limit-state design check can be made both using the deterministic approach or using the probabilistic
approach where uncertainties are modelled.
3.16
limit state function
function of the basic variables, which has negative values when the structure fails and positive values when
the structure is safe
3.17
load
any action causing deformation, displacement, motion, etc. of the pipeline
3.18
load combination
set of loads acting simultaneously
3.19
load effect
effect of a single load or load combination on the pipeline
EXAMPLE Load effects include stress, strain, deformation, displacement.
3.20
location class
geographic area classified according to criteria based on population density and human activity
[ISO 13623]
3.21
maintenance
all activities designed to retain the pipeline in a state in which it can perform its required functions
[ISO 13623]
NOTE These activities include inspections, surveys, testing, servicing, replacement, remedial works and repairs.
3.22
maximum allowable incidental pressure
MAIP
maximum allowable internal pressure due to incidental operation of the pipeline or pipeline section
3.23
maximum allowable operating pressure
MAOP
maximum allowable pressure at which a pipeline, or parts thereof, is allowed to be operated
[ISO 13623]
3.24
mean value
first order statistical moment of the probability distribution function of the considered variable
3.25
mill test pressure
test pressure applied to pipe joints and pipe components upon completion of manufacture and fabrication at
the mill
3.26
model uncertainty
uncertainty in the predictions of a selected calculation model that remains when the exact values of all input
parameters are known
EXAMPLES Load model, strength model, function model for the pipeline.
3.27
nominal wall thickness
specified wall thickness of a pipe, which is equal to the minimum design wall thickness plus the negative
manufacturing tolerance and the corrosion allowance
3.28
normal operation
conditions that arise from the intended use and application of the pipeline, including associated condition and
integrity monitoring, maintenance and repair
NOTE Normal operations includes steady flow conditions over the full range of design flow rates, as well as possible
packing and shut-in conditions.
3.29
ovality
deviation of the pipeline perimeter from a circle, having the form of an elliptical cross-section
3.30
pipeline
those facilities through which fluids are conveyed, including pipe, pig traps, components and appurtenances,
up to and including the isolating valves
[ISO 13623]
3.31
offshore pipeline
pipeline laid in maritime waters and estuaries seaward of the ordinary high water mark
[ISO 13623]
3.32
on-land pipeline
pipeline laid on or in land, including lines laid under inland water courses
[ISO 13623]
3.33
reliability
ability of a component or a system to perform its required function without failure during a specified time
interval
NOTE Reliability equals 1 minus the failure rate, P .
f
4 © ISO 2006 – All rights reserved

3.34
risk
combination of the probability of an event and the consequences of the event
[ISO 17776]
NOTE Individual risk is related to the risk of a single person injury/death and societal risk is the risk of human safety
in the entire society affected by the pipeline.
3.35
safety class
concept to classify the criticality of pipelines
3.36
safety factor
γ
factor by which the characteristic value of a variable is multiplied to give the design value
3.37
specified minimum tensile strength
SMTS
minimum ultimate tensile strength required by the specification or standard under which the material is
purchased
3.38
specified minimum yield strength
SMYS
minimum yield strength required by the specification or standard under which the material is purchased
[ISO 13623]
3.39
system reliability
reliability of a system of more than one element, or the reliability of an element which has more than one
relevant failure mode
3.40
target safety level
maximum acceptable failure probability level for a particular pipeline and limit state condition
4 Symbols and abbreviated terms
4.1 Symbols
C consequences of a given failure
f
P probability of a failure, i.e. the actual failure rate calculated
f
P target safety level, equal to the target probability of failure
f, target
R resistance or the capability of a structure or part of a structure to resist load effects
S load effect on a structure or part of a structure
γ safety factor
g(x) limit state function
D pipe diameter
L gouge length of impacts
d gouge depth of impacts
d dent depth of impacts
d
f frequency of occurrence of impacts
imp
f ovality
σ yield strength
y
σ ultimate tensile strength
u
t time
f (x) joint distribution
x
I(x) indicator function
H(x) event margin
C vector of serviceability constraints
∆K stress intensity factor range
p random pressure variable
λ scale parameter
S characteristic load effect
C
S environmental load effects
C,E
S functional load effects
C,F
R characteristic value of component resistance, based on characteristic values of material properties
C
f characteristic values of material properties, for example yield strength
C
γ partial load effect factors
i
η resistance or strength usage factors
R
γ partial material factors
m
∆α additive partial geometrical quantities
4.2 Abbreviated terms
ALS accidental limit state
CTOD crack tip opening displacement
FLS fatigue limit state
LRFD load and resistance factor design
6 © ISO 2006 – All rights reserved

MAIP maximum allowable incidental pressure
MAOP maximum allowable operating pressure
QRA quantitative risk analysis
SLS serviceability limit state
SMTS specified minimum tensile strength
SMYS specified minimum yield strength
SRA structural reliability analysis
ULS ultimate limit state
5 Principles for design and operation
Pipeline design and operational principles can be implemented using different methods with varying levels of
detail as indicated in Figure 1. In order of decreasing level of detail, these methods are quantitative risk
analysis (QRA) and structural-reliability analysis (SRA), both of which are probabilistic, and the deterministic
limit-state design methods [partial safety-factor design and load and resistance-factor design (LRFD)], which
are collectively termed LRFD in this document.
The LRFD formats apply partial safety factors to the characteristic load and resistance properties,
representing more traditional design for pipelines. This is the format applied in ISO 13623 by the use of the
hoop stress design factor and the equivalent stress design factor, i.e. one partial factor only. This approach is
classified as deterministic, as no quantitative information about the safety margin is given. The partial safety
factors in the LRFD format have to be calibrated by the use of reliability-based methods prior to the publication
to satisfy its design requirements and provide a satisfactory safety margin. The routine use of the LRFD
formats do not, therefore, require the partial safety factors to be determined. In LRFD approaches (see left
side of Figure 1), the load and resistance are defined by their characteristic values and partial safety factors
are applied separately (as required) to the characteristic values of load, resistance and material properties.
Application of the probabilistic approach (SRA and QRA) involves the steps on the right hand side of Figure 1.
The limit-state definition is generally the same as for the LRFD. In this approach, load effects and resistance
are represented by probability functions, given in terms of distribution type, mean value and standard
deviation. This approach is classified as probabilistic, as quantitative information about the safety margin in
terms of reliability or the complementary failure probability is given. The most comprehensive probabilistic
method is QRA, as it takes into consideration the consequences of failure.
The format and requirements for the reliability-based limit state method are described in Clause 6.
Figure 1 — Pipeline design and assessment approaches
8 © ISO 2006 – All rights reserved

6 Reliability-based limit state methods
6.1 General
Use of the reliability-based limit state approach shall include
⎯ determining the design and operational data basis: data gathering, see 6.2,
⎯ determining the safety requirements: targets, see 6.3,
⎯ failure mode analysis; see 6.4,
⎯ uncertainty analysis including estimation of probability functions; see 6.5,
⎯ reliability analysis, see 6.6, and
⎯ safety and risk assessment, see 6.7.
6.2 Design and operational data basis — Data gathering
Data gathering is collecting and defining all relevant information related to the pipeline to be considered and
shall include the following information:
a) design basis and operational information including
⎯ pipe system characteristics, e.g. pipe diameter, pipeline length, product composition, operating
conditions (pressure, temperature), design life and interface facilities,
⎯ definition of loads and load effects and associated hazards,
⎯ definition of linepipe properties (resistance) and relevant pipeline capacities, and
⎯ inspection and monitoring philosophy for operation, e.g. integrity management plan;
b) Hazard identification and classification of failure conditions including
⎯ determination of limit state conditions which constitute structural non-compliance for the pipeline as
judged against the safety requirements and constraints, e.g. partial or total loss of supply, any loss of
fluid, loss of operability or serviceability without loss of fluid, and
⎯ determination how the pipeline can become structurally non-compliant, in terms of loadings,
resistance, and degradation; i.e. hazard identification.
Determination of operational requirements and classification of failure conditions shall be performed in
accordance with Clauses 7 and 8.
6.3 Safety requirements — target
The objective of this step is to define the relevant safety requirements for the hazards/failure modes.
a) The target safety level shall be defined for all pipeline sections according to the location and
consequence categorization in Clause 8;
b) Target safety levels shall be determined for all phases of the pipeline design life; e.g. construction, normal
operation, and any temporary conditions.
Target safety levels shall be based upon public safety, environmental and business issues, taking account of
safety and serviceability principles dictated by society, the local regulator, the specific company involved, and
the performance requirements for the pipeline under consideration.
These targets should be clearly communicated to all relevant stakeholders.
Target safety levels shall be defined in accordance with Clauses 8 and 9. If no risk and/or safety levels are
predefined, equivalent target probabilities of failure, P , may be taken from Annex C based on the current
f,target
state of technology and design practice.
6.4 Failure mode analysis
The objective of this step is to identify all relevant failure modes (i.e. significant hazards with a probability of
occurrence larger than the target safety level for the appropriate condition). The steps involved are
a) the gathering of data to assess the severity of all hazards identified,
b) the assessment of each hazard against the target safety requirement to determine whether each hazard
is possible but incredible (e.g. a plane crash on a particular pipeline), or both possible and credible (e.g.
corrosion),
This analysis may be undertaken in a semi-qualitative manner, e.g. a return period of a particular hazard
−5
estimated as being below 10 /km/year, being smaller than the target performance requirement, implies that
the hazard is insignificant, and therefore a probabilistic assessment is not necessary and the hazard can be
excluded from the further analysis.
Failure conditions shall be considered according to the classification given in 8.2. Justification shall be given
for the classification of any hazard determined to be as “possible but incredible”, such documentation can, for
example, be frequencies of occurrence. The significant (possible and credible) failure conditions shall be
included in the uncertainty and reliability analysis.
6.5 Uncertainty analysis
In the uncertainty analysis, the significant failure conditions shall be considered, including
a) establishment of all measures that are (or can be) implemented to mitigate against the hazard,
b) determination of the appropriate method of assessment and identification of the most relevant limit state
function, e.g. rupture, leak, etc.,
c) collection of data that is required to quantify the variables in the limit state function,
d) assessment of the uncertainty associated with the data and limit state function (model uncertainty), and
e) selection of appropriate values for all variable parameters.
Uncertainty analysis and probabilistic modelling can be performed according to procedures given in Annex A
and, if no other case-specific information is available, uncertainty measures can be found in Annex B. The
uncertainty modelling should include all variables entering the limit state equation. The most relevant
statistical properties are the mean value and the standard deviation in addition to information about the
distribution function. Any correlation between parameters is important and shall be evaluated.
EXAMPLE For external corrosion of the pipeline, the mitigation measures can be a combination of any of the
following: corrosion allowance, anti-corrosion coating, cathodic protection system, inspection and repair policy. It is noted
that there are several ways of implementing an inspection, monitoring and repair policy.
10 © ISO 2006 – All rights reserved

6.6 Reliability analysis
The reliability analysis is to calculate the failure probability (P ) for each significant limit state identified. The
f
steps to be included are as follows.
a) Probabilistic modelling of the limit state function, i.e. analytical formulation of the failure criteria. For a
given limit state, a probabilistic design models the load, S, and resistance, R. The corresponding limit
state function may be expressed in the form:
gxR=−S (1)
()
b) Selection of the most appropriate probabilistic calculation method for the problem and level of accuracy,
possible methods include first order second moment (FOSM), “reliability” methods (FORM/SORM), Monte
Carlo, or direct integration.
c) Perform probabilistic calculations, i.e. calculate the failure probability for each relevant limit state. The
reliability analysis may then be performed when the statistical properties of the limit state functions are
defined (load effect and resistance properties). When the distribution functions for R and S are established
through uncertainty analysis, the failure probability is calculated by
Pf= R,S ddRS (2)
( )
f RS,
∫
gx u0
()
The reliability analysis can be performed in accordance with the guidance given in Annex A or other relevant
calculation procedures.
A calculated probability of failure is not a physical property of the pipeline itself, but gives a notional value. The
calculated probability of failure depends on the method and procedure applied, including uncertainties in data
and methods. It is, however, the intent of this document to standardize the methods and procedures used for
the reliability-based approach and thus to bring this into a comparable level within the industry.
6.7 Safety and risk assessment
This step is to check that the pipeline meets the safety requirements (criteria). The reliability shall be
compared with the requirements by ensuring that:
PPu (3)
f f,target
where
P is the calculated probability of failure from the reliability analysis;
f
P is the target safety level that should not be exceeded for a design and/or operation to be
f,target
accepted.
If the requirements are not met, the pipeline details should be modified and the assessment repeated (new
iteration in Figure 1).
When applying Equation (3), the correct comparisons shall be undertaken; i.e. individual or system failure
modes; for the correct time and spatial units; for the correct phase in the design life, e.g. operational or
temporary.
The physical design parameters (e.g. wall thickness) selected to mitigate against failure shall satisfy all
performance requirements.
The safety check shall be performed in accordance with Clauses 8 and 9.
Similar safety principles apply to both offshore and on-land pipelines, but differences in failure consequences
and safety regimes result in different required target safety levels, P .
f,target
For both offshore and on-land pipeline applications, it is appropriate to control the failure probability (P ) as a
f
function of the consequences, as established by the safety class designation (see Clause 8) to obtain a
uniform risk level. For on-land pipelines, the acceptable probability of failure is also a function of the pipeline
pressure and diameter to account for the impact of these parameters on the failure consequences. A uniform
risk level is generally the objective for any application.
Equation (3) is equivalent to Equation (4) when risk is calculated as the product of probability of failure and
consequences of that failure:
calculated risk u allowable risk (4)
The target safety levels, P , given in Annex C have been derived from risk assessments and these values
f,target
may be applied if no additional explicit risk assessment is performed.
Further technical details and requirements of the various items to be considered in the reliability-based
approach are described in Clauses 7 to 10 and in Annex A.
7 Design and operational requirements
7.1 General
The safety against potential failure modes shall be checked for all conditions during construction and
operation (including re-qualification) throughout the lifetime of the pipeline.
7.2 Design and construction
The pipeline shall be designed and constructed to satisfy the following performance requirements:
a) to perform adequately under all anticipated load effects (serviceability limit state requirement);
b) to withstand anticipated load effects during its construction and operation (ultimate limit state
requirements);
c) to avoid failure under repeated load effects during construction and operation (ultimate limit state —
fatigue requirements);
d) to avoid failure due to accidents during construction and operation (ultimate limit state — accidental
requirements).
7.3 Operation and maintenance
The pipeline shall be operated and maintained such that the safety and the integrity is kept within the target
safety level.
An integrity management programme shall be implemented by the operator to satisfy the safety requirements
given in this document. Maintenance includes the requirements of inspections, inspections on special
occasions (e.g., after an accident or severe environmental events), the upgrading of protection systems and
repair of components.
The integrity of the pipeline may be achieved by either a maintenance programme and/or designing to avoid
deterioration that can affect the integrity of the pipeline in those areas where the pipeline cannot or is not
maintained.
The rate of deterioration may be estimated based on numerical calculations, experimental investigations,
experiences from other pipelines or a combination of these.
12 © ISO 2006 – All rights reserved

7.4 Re-qualification
Re-qualification of the pipeline integrity shall be performed when
⎯ the design life is to be extended,
⎯ the pipeline has been found to have deteriorated or have been seriously damaged,
⎯ the pipeline needs to be up-rated,
⎯ the operational conditions change,
⎯ the original design criteria or design basis are no longer valid.
A revised safety assessment in accordance with this document shall be conducted for those aspects of the
design not in compliance with the original design requirements.
The re-qualification can require a deviation from the design basis or modifications to the pipeline or the
operational conditions to achieve compliance with this document.
7.5 Hazards
Hazards that alone or in combination with loads in normal operation could violate the pipeline integrity shall be
considered as part of the ultimate limit state — accidental condition ALS.
a) Possible hazards to the pipeline include
⎯ effects due to extreme environmental loads,
⎯ impact from third-party activities, and
⎯ operational malfunction.
b) Measures taken to mitigate such hazards include
⎯ avoiding the structural effects of the hazards by either eliminating the source or by bypassing and
overcoming them,
⎯ minimizing the consequences, and
⎯ designing for hazards.
8 Acceptance criteria and safety classes
8.1 Safety requirements
A target safety level, P shall be defined as the maximum acceptable failure probability level for a
f,target
particular pipeline. Target safety levels are required for developing design criteria for the application of
reliability methods. These criteria shall be satisfied during operation and maintained through the integrity
management programme.
The evaluation of the target safety levels for pipelines should primarily be based on the inherent safety level
achieved by using a currently accepted design practice (e.g. code of practice or standard), using uncertainty
measures representative of the time when the relevant design practice was prepared. The nature of a failure
and the consequence potential in terms of effect on human health and safety, damage to the environment,
economic losses, and the cost and effort required to reduce such hazard potential should be taken into
account.
The target safety level shall be determined from consideration of
⎯ the type of limit state, see 8.2,
⎯ the fluids being transported, see 8.3,
⎯ the location of the pipeline and potential consequences, see 8.4.
The fluid categorization, location and potential consequences are combined into a safety class, see 8.5. The
risk related to the pipeline operation is defined as
risk = probability of failure (P ) × consequence of failure (C) (5)
f f
The target safety level can be varied with the consequence of failure to provide a relatively constant risk level;
see Clause 9 and Annex C.
NOTE The main objective is to achieve an acceptable reliability for the pipeline from both a safety and economic
point of view. It is important to integrate these considerations into the analysis while being in compliance with any
requirements from regulators and authorities.
8.2 Classification of limit states
The structural performance of the pipeline shall be described by a set of limit states or failure functions
covering the significant failure modes. Each limit state divides the structure performance into two conditions;
the safe and the failed condition. Structural design means to satisfy the design requirements for each limit
state condition. The following two main categories of limit states shall be considered in the design of pipelines.
⎯ Serviceability limit state (SLS), beyond which the pipeline does not meet its functional requirements, e.g.
ovality, ratcheting, accumulated plastic strain, excessive deformations or displacements, damage to or
loss of coating.
⎯ Ultimate limit state (ULS), beyond which the pipeline can experience loss of structural integrity, e.g.
bursting, rupture, local or global buckling, unstable fracture and plastic collapse. The fatigue limit state
(FLS) is a ULS condition covering fatigue due to accumulated cyclic loading and the accidental limit state
(ALS) is a ULS condition for extreme load effects for low probability events, e.g. dropped objects, trawl
gear hooking, earthquake.
Specification of various load effects to be considered for design and operation of pipelines and the associated
limit states are given in Clause 10.
NOTE FLS and ALS are both considered as ultimate failure conditions and belong to the ULS category. However,
they are often treated separately to account for the specific failure characteristics. FLS is an accumulated process while
ALS is a random instantaneous process. The assessment of ALS takes into account the probability of the accidental event.
8.3 Categorization of fluids
The fluids to be transported shall be placed in one of the following five categories (see Table 1) depending on
the hazard potential in respect of public safety (in accordance with ISO 13623).
14 © ISO 2006 – All rights reserved

Table 1 — Categorization of fluids
Fluid category Description
A Typically non-flammable water-based fluids
C Non-flammable fluids that are non-toxic gases at ambient temperature and atmospheric pressure
conditions
Typical examples are nitrogen, carbon dioxide, argon and air
B Flammable and/or toxic fluids that are liquids at ambient temperature and at atmospheric pressure
conditions
Typical examples are oil and petroleum products. Methanol is an example of a flammable and toxic
fluid
D Non-toxic, single-phase natural gas
E Flammable and/or toxic fluids that are gases at ambient temperature and atmospheric pressure
conditions and are conveyed as gases and/or liquids
Typical examples are hydrogen, natural gas (not otherwise covered in category D), ethane, ethylene,
liquefied petroleum gas (such as propane and butane), natural gas liquids, ammonia, and chlorine
Gases or liquids not specifically included by name should be classified in the category containing fluids most
closely similar in hazard potential to those quoted. If the category is not clear, the more hazardous shall be
assumed.
8.4 Pipeline location and consequence categorization
The potential consequence of a pipeline failure (C ) shall be evaluated for the various elements described in
f
Table 2.
Table 2 — Considerations in assessing potential consequences
Element Considerations
Public safety Population density and potential for human exposure, potential for ignition and fire,
product toxicity
Environmental impact Land use, product type, production flow rate, volume of release, topography, beach
impact, high-consequence areas and ultra-sensitive areas
Business loss Cost of repair, loss throughput, production loss, impact to remaining life of asset
Corporate reputation Compilation of all consequence factors, extent of punitive actions by the regulatory
agencies and media exposure
The significance of the considerations depend on the pipeline (section) location and are different for offshore
and on-land pipelines. Public safety shall generally be given the highest attention, with economical
consideration being primarily a matter of concern for the company itself.
Offshore-pipeline consequence evaluation shall consider the proximity to platforms, near-shore or landfall,
environmentally sensitive areas and any specific cost considerations, in that order.
For onshore pipelines, consideration shall be given to the population density, pipeline fluids, diameter and
pressure, environmental impact and cost. A location categoriza
...