A corrosion risk assessment model for underground piping

The Pressure Systems Manager at NASA Ames Research Center (ARC) has embarked on a project to collect data and develop risk assessment models to support risk-informed decision making regarding future inspections of underground pipes at ARC.


INTRODUCTION
There is about a mile and a half of underground piping at ARC for the 3000 psig high-pressure air distribution system.
The underground carbon steel pipes at ARC generally are not directly exposed to the soil. They have either one or two layers of a protective pipe wrap. In addition, sand is backfilled into the trench so that the wrapped underground pipes do not directly see dirt.
For unprotected pipe, its structural integrity is affected by corrosion. The corrosion rate is dependent on pipe material type and chemical properties of the surrounding soil. At ARC, the high-pressure air flowing through the pipe is dry and hence does not corrode the pipe walls. Instead, the corrosion is external -corrosive soils create pits on the outside surface of the pipe resulting in a reduction in pipe wall thickness from the outside.
Unwrapped or poorly wrapped pipes had failed in five to ten years. These were replaced with wrapped pipes that have been underground for about 20 years. Older piping is intuitively more at risk than newer piping. At ARC, much of the piping is significantly over-designed which provides excess margin against corrosion, but not forever. In some of the older piping, the quantities and bills of material are not currently quantified and the quality of corrosion protection is also unknown. The underground piping is generally not inspected because it cannot be inspected without excavation. Failure of any underground pressurized pipe is a potentially significant hazard to personnel and critical facilities.
The objective of this paper is a bottoms-up development of an underground air distribution piping corrosion risk assessment model that can be used to develop future riskbased inspection strategies at ARC. Figure 1 shows the overall underground piping risk model developed as a generic model that can be applied at different locations. It includes: • Corrosion Model of the pipe-segment if it were exposed (i.e., without pipe wrap) to the local environmental conditions. • Pipe Wrap Protection Model that models the protective factor of the pipe wrap; • Mission Operations Model that describes the operating condition profile over a period of an average year; • Pipe Stress Model that analyzes the pipe stress at a pipe segment and calculates the factor of safety over the pipe segment; In Figure 1, these four models are represented by blue rectangles. All four of these models are described in more detail in following sections as applicable at ARC.

OVERVIEW OF THE MODEL
A failed pipe wrap and resulting corrosion leads to a change in the underground pipe wall state. This is shown in Figure 1 as a yellow circle, indicating that this state is not known very well. The pipe wall state is a major input into the pipe stress model. Another input is the pipe type and the location -this is potentially well known and hence, indicated by a green parallelogram. A major part of the project at ARC is collecting and organizing this data to enable the model analyses.
The four models, in general, can be run sequentially to obtain a factor of safety. In this paper, because of the specific conditions at ARC, they are combined into a single model that provides the factor of safety as an output.
A Monte Carlo simulation is performed over all four models (or, a combined model) with various input parameters from their statistical distributions to assess failure probability distribution of the piping system. Failure consequence in this model is a function of the pipe location relative to where a pipe break could cause damage. The risk model is a standalone calculation of the failure probability with the failure consequence.
The pipe wrap history is also part of the data collection. The failure modes in the pipe wrap model are incompletely understood, and the history data being gathered will help improve our understanding in the future.
Historical failures and operations of underground piping are available from industry and are also being collected in a more useful form at ARC. Up until this point in time, no preventive maintenance related data has been collected at ARC regarding the underground pipes. It is expected that in the future, the Pressure Safety Manager will identify (hopefully, using this or another risk model) underground piping inspection locations as a function of the pipe wrap history, pipe type, location, failure risk, and other relevant data. The inspection data will yield observations of fault and no-fault areas of underground piping. This data is expected in the future and is indicated in yellow to show that it is currently unknown. The historical failure data and the inspection results can be used in this modeling approach to update the parameters of the corrosion and pipe wrap models. Future data may also enable an update of the pipe wrap model, not just its parameters.
The overall model shows the complete feedback loop of data and model as a part of the proposed risk assessment strategy.
This proposed model does not pertain to failures caused by design, fabrication, or manufacturing defects.

CORROSION MODEL
protective pipe wrap. However, if the pipe wrap fails and the pipes were directly exposed to the soil environment, they will corrode at some rate by complex electrochemical processes. Numerous factors influence corrosion in soil including soil type, moisture content, position of the water table, soil resistivity, soluble ion content, soil pH, oxidation-reduction (redox) potential and rates of microbes in soil corrosion [1].
The high pressure air is dried to a level of -80° F dew point before it enters the ARC high pressure piping system, so internal corrosion is not considered a relevant failure mechanism.
A number of models have been proposed in the literature for the corrosion rate [2-6]. This paper uses a two-parameter model originally proposed by Romanoff based on an extensive data collection by the National Bureau of Standards [2]: Underground pipes at ARC are generally not directly n exposed to the soil and have either one or two layers of a w = kT (1) where, w is the loss of wall thickness (in) or deepest pit at time T, k is a multiplying constant, T is the exposure time (years), and n is the exponential constant. This model is an empirical one that fits the data rather than one obtained from "corrosion science." The prior distribution of the parameters k and n are taken from other studies using non-ARC data [7,8]. Corrosion model parameter k is assumed lognormal with mean 0.015 and standard deviation 0.037, and parameter n is lognormal with mean 1.0 and standard deviation 0.14, respectively.
The parameters k and n may be dependent on the location (e.g., ARC versus elsewhere in the country) and the pipe material. For this paper with limited data from ARC, a compact model is chosen with a single parameter k and a single parameter n that are assumed to be applicable. This is the a priori model. With additional data, it may be necessary to expand the parameter space. With limited failure data, it is not currently conceived that the model will change, but with enough NASA and industry data, even model change is possible.

PIPE WRAP PROTECTION MODEL
The ARC underground pipe wrap is specified in the construction specifications. There is uncertainty whether the specifications has been consistent over the years. Mostly, the pipe tape wrap system is composed of a bare steel primer, an inner wrap of polyethylene tape with adhesive, and a protective outer wrap of polyethylene tape with adhesive stabilized or color coded for ultraviolet protection. The field fitting and joint wrap system is composed of a double wrap of highly conformable polyethylene tape with adhesive for fittings, and heat shrunk radiation cross-linked polyolefin sleeve with mastic sealant for weld joints. The field irregular surface mastic coating system is composed of coal tar mastic coating applied by brush over bare steel.
A number of pipe wrap and coating failure modes have been described in the literature [9][10][11][12]. However, our literature search did not reveal any model that would capture the pipe wrap defects/failure. Instead, this paper uses the results obtained by Ductile Iron Pipe Research Association (DIPRA) [8] to derive a model that fits the needs of the study. DIPRA tests showed a reduction in the pitting rate for polyethylene encased pipes. These tests were performed in corrosive soils and used a measurement criterion based on the single deepest pit in the pipe surface. The results of these tests specifically showed a reduction in pitting rate by a factor of 33.
This paper assumes that a protective factor model would describe the reduction in pitting rate due to pipe wrap. The model is: where, S i = 0 or 1. Subscript i indicates the installation project team; subscript j indicates a section of the underground pipe; f ij is the protective factor of the pipe wrap at (i,j); S i is 1 if the pipe length was not wrapped before being buried and 0 is the piping was wrapped. If the pipe was not wrapped then that section of the pipe has a protective factor of 1. Otherwise, the protective factor model, R j T y , shown in the second half the equation applies. The model assumes, as is the case at ARC, that all buried wrapped pipe were Holiday tested to be defect free. The protection factor includes a scale parameter R j that reflects the growth rate of additional coating defects with time, and y is the exponent for the growth rate over time.
Data collection efforts regarding the installer project team, including contractor and NASA project management, will help quantify Si. Documentation showing proof that the pipe was wrapped will make it 0, while if the documentation is not conclusive then it will be 1 (i.e., unwrapped) with some probability p.
The parameter R has the subscript j that indicates whether the section of the pipe was regular double wrapped, a section where it was difficult to double wrap, or a section that had irregular surface resulting in a different type of coating protection. These three different sections are expected to see different protection factors.
The prior distribution of p is assumed to be uniform (0,1) team -it is equally likely to be any probability between 0 and 1. The prior distribution of Rj is assumed to be lognormal with mean 0.03 and standard deviation 0.03 and y is assumed to be Uniform (0.9, 1.1) based on [8,7].

MISSION OPERATIONS MODEL
The mission operations profile for underground piping consists of the internal pressure, temperature and moisture content of the pressure system. The variations in the external conditions are part of the corrosion model. The maximum operating conditions are well known and cyclic usage is low at ARC. Hence, all known underground pipe sections will have large theoretical fatigue life and so the pressure, temperature usage profiles are considered to be not relevant in determining failure history. The air in the piping systems has very low humidity and so the moisture content history is also considered not relevant to failure history or failure prediction.
The pressure seen in any pipe section is typically a sawtooth profile during the periods of operation. Separate assessments indicate that fatigue is not a limiting factor for underground pipe life expectancy. So, the pressure model in this study assumes that any pipe section sees either zero pressure when it is not in operation or a constant maximum pressure, which is 3000 psig. For failure prediction, the pressure model is Pj for each section j of the underground pipe. The temperature and moisture content is not part of the pipe stress model (see next section).

PIPE STRESS MODEL
Underground pipe loads fall into two main categories: external (traffic load, earth load, frost load, expansive soil load, and temperature induced expansion/contraction load) and internal (working pressure, surge pressure, and thermally induced pressure change) [14]. The working internal pressure load is at least an order of magnitude larger than the other loads for underground pipes at ARC. Hence, the focus of this study is on these internal loads.
Pipe stress analysis is performed at ARC on Caesar II, which is a commercial, off-the-shelf software and an industry standard. The pipe stress code is normally ASME B31.3. For nominal design for sustained loads (e.g., weight, pressure), there is a 3:1 Factor of Safety on ultimate strength for wall thickness. Stress due to occasional loads (e.g., seismic) and stress due to thermal displacement ranges have less total Factor of Safety, but are generally not relevant to this underground piping at ARC.
The most sensitive elements for pipe stress for ARC systems are: • Regions with high stress intensification factors (SIFs), such as Branch Connections, can have SIFs ranging from 1.1 to 10. Castings and welds can also have SIFs greater than 1, but these are not part of the High-Pressure Air Distribution System design. • End connections to equipment that typically have very low nozzle load limits. • In-line equipment such as valves which have welded or mechanical joints. • Welded attachments for pipe supports and other nonpressurized appurtenances (e.g., thermowells), that concentrate pressure and reaction stress, as well have material discontinuity effects (e.g., due to lugs) that can lead to cracking. With knowledge gained from the high-fidelity models of the High-Pressure Air Distribution System, it became apparent that a simpler stress model could be utilized for underground piping. The underground piping is continuously supported by the soil, is essentially at constant temperature, does not have in-line equipment, nor does it have end connections underground. So, stress intensification only occurs at branch connections.
The pipe stress (σ j,l) at section j, location l is then a combination of the hoop stress and the SIF. For thin wall straight pipe under internal pressure, neglecting manufacturing tolerances and allowances: σ j,l = I l P j d j /2t j (3) where, I l is the stress intensification factor at location l; P j , dj, and t j are the internal pressure (when pressurized), inside pipe diameter, and pipe wall thickness at section j, respectively.

FACTOR OF SAFETY AND MONTE CARLO MODEL
as aleatory and epistemic. The aleatory uncertainty is the uncertainty intrinsic in the physical parameters. The epistemic uncertainty relates to the model uncertainty (lack of knowledge). Sensitivity study results show that the epistemic uncertainty is the dominant contributor to the calculated unreliability of the underground piping system.

FUTURE WORK
Currently, sensitivity analyses have been performed using this model for a number of candidate locations of the underground piping system at ARC. This is part of a larger project that includes a data collection effort and eventually applying the results of the risk assessment for risk-based inspection strategies of the underground pipes. Data Collection: A simultaneous, data collection effort is taking place for existing ground based pressure systems. This data will support the risk modeling and analytical effort. It is a labor intensive activity since the data is being obtained from heterogeneous sources that needs fact checking. This data will be put in the Pressure Systems database for subsequent analyses.

Failure Consequence:
This paper does not address failure consequence and risk. This is an area for future activity as the data collection effort is completed. Current thought is that the failure consequence would be a function of the pipe location relative to where a pipe break could cause damage. So a failure analysis of the underground pipe section j at its geographic location needs to be performed to determine the failure consequence.

Risk-Based Inspection:
The ultimate goal of the project is to provide a framework for risk-informed decision making regarding future inspections of underground pipes at ARC, and ultimately throughout NASA. If the data supported it, there could be cost savings from less frequent inspections and system life extension or designing meaningful mitigation strategies for different failure modes.