Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
ASME B31.8S-2018 — Managing System Integrity of Gas Pipelines
🛡️ ASME B31.8S-2018, “Managing System Integrity of Gas Pipelines,” is a supplement within the ASME B31 Code for Pressure Piping. It is not a design code but a process code: it tells a pipeline operator how to build a systematic, auditable, continuously improving Integrity Management Program (IMP) that keeps a gas pipeline operating incident-free throughout its service life. The scope covers onshore pipeline systems constructed with ferrous materials that transport gas, yet the risk-management principles it embodies apply to virtually any pipeline system, including liquid lines and plant piping networks.
💡 B31.8S and B31.8 complement each other: B31.8 sets the technical conditions for design, materials, construction, and operation, while B31.8S sets the management process for identifying threats, assessing risk, scheduling assessments, responding to anomalies, and proving effectiveness. Together they close the loop on pipeline safety.
1. Positioning, Scope, and Key Concepts 📌
The Code applies to onshore gas pipelines built from ferrous materials. It states explicitly that the principles of integrity management are applicable to all pipeline systems, and that its purpose is to provide the operator (as defined in Chapter 13) with the information needed to develop and implement an effective integrity management program based on proven industry practices. The processes described apply to the entire pipeline, not just selected segments.
The Code offers two complementary implementation paths:
- Prescriptive path: following the threat process charts of Nonmandatory Appendix A explicitly provides all the inspection, prevention, detection, and mitigation activities needed to constitute a satisfactory integrity management program. This is the “do it by the book” route.
- Performance-based (risk-based) path: the operator determines assessment methods, frequencies, and resource allocation from its own data and risk models, but must demonstrate effectiveness through performance measures. This route offers more flexibility but demands higher-quality data and engineering judgment.
The Code is deliberately nonmandatory — it supplements B31.8, and only becomes mandatory when pipeline regulators incorporate it into regulation. This “voluntary standard, enforceable by reference” model is the technical foundation on which North American integrity-management regulation (e.g., 49 CFR 192, Subpart O) was built.
⚠️ A common misconception is to treat B31.8S as an inspection code. It does not prescribe NDT process parameters; it prescribes the management logic — why to inspect, what to assess, how often, what to do with the results, and how to prove the program works. The inspection techniques themselves reference API, NACE/AMPP, and ASNT standards.
2. Elements of an Integrity Management Program 🧩
Chapter 2 presents the overall architecture of an integrity management program, developed in the chapters that follow. In essence, the Code is “one cycle plus five plan documents.” The cycle runs from data collection, through risk assessment, integrity assessment, response and mitigation, back to performance feedback and plan revision. The five plans turn the cycle into executable, verifiable management documents.
| Chapter | Element | Core Content | Output |
|---|---|---|---|
| 3 | Consequences | Define the Potential Impact Area; evaluate consequences for employees, the public, customers, and the environment | Impact-area mapping |
| 4 | Data gathering, review, and integration | Data elements for the prescriptive program and typical data sources | Pipeline database |
| 5 | Risk assessment | Identify threats, evaluate likelihood and consequences, rank high-risk segments | Risk ranking table |
| 6 | Integrity assessment | Select methods (ILI, pressure test, direct assessment) and set reassessment intervals | Assessment plan |
| 7 | Responses and mitigation | Acceptable prevention and repair methods and response timing | Repair/mitigation records |
| 8 | Integrity Management Plan | Compile the above into segment-by-segment implementation documents | The IMP itself |
| 9 | Performance plan | Performance measures, metrics, and overall measures to verify effectiveness | KPI reports |
| 10–12 | Communications, management of change, quality control | Internal/external communication, change review, QC of data and operations | Three supporting plans |
A particularly useful device is the worked example in Section 8.3.4 (Tables 8.3.4-1 through 8.3.4-3) for a hypothetical pipeline segment: segment data, integrity assessment plan, and mitigation plan are laid out as three linked tables so that every imperative for that segment is traceable. Pipeline operators preparing their own IMPs often adopt this one-segment-one-table format directly.
3. The Nine Threats and Risk Assessment 🔍
One of B31.8S’s most influential contributions is classifying the causes of gas pipeline failures into nine threats, grouped by their time-dependent behavior. This taxonomy has become the common language of pipeline integrity management worldwide and is the organizing principle of the Appendix A process charts.
| Threat Group | Threats | Time Behavior | Primary Detection Means |
|---|---|---|---|
| Corrosion | External corrosion | Time-dependent | CP surveys, coating surveys, excavation, direct assessment |
| Corrosion | Internal corrosion | Time-dependent | ILI, corrosion coupons, gas-quality and liquid analysis |
| Corrosion | Stress corrosion cracking (SCC) | Time-dependent | Near-neutral-pH and high-pH SCC DA, hydrotest, ILI |
| Manufacturing | Pipe seam and pipe defects | Stable | Mill records, hydrotest, ILI |
| Construction | Girth welds, fabrication welds, wrinkle bends/buckles, stripped threads | Stable | Construction records, ILI, excavation verification |
| Equipment | Gaskets and O-rings, control/relief devices, seal/pump packing | Stable | Station inspections, leak surveys, maintenance records |
| Third party | Third-party damage, vandalism, pre-existing damage | Time-independent | Patrolling, one-call, excavation verification, public awareness |
| Incorrect operations | Operator error, mis-operation, improper maintenance | Time-independent | Procedure audits, training records, SCADA analysis |
| Weather/outside force | Earth movement, floods, cold weather, lightning | Time-independent | Geohazard surveys, weather records, post-event patrols |
Risk is defined as the product of likelihood and consequence. Likelihood considers threat exposure, the effectiveness of prevention measures, and historical failure records; consequence is expressed through the Potential Impact Area (Fig. 3.2.4-1) — the zone around a possible leak point, based on pressure, pipe diameter, product, and surrounding population and buildings, within which a rupture could inflict harm. Risk ranking decides where resources go: high-risk segments are assessed first, while low-risk segments may qualify for longer intervals.
🚨 The nine threats are not a “pick one” checklist. Every threat must be evaluated in turn. If a threat has never occurred on a particular pipeline, the plan must still document why its risk is considered acceptable and cite the supporting data. An omitted threat evaluation is a program deficiency and a likely nonconformance in a regulatory audit.
4. Integrity Assessment Methods and Reassessment Intervals 📏
Chapter 6 covers the technical means of integrity assessment. The Code does not recommend a single “best” method; it requires the operator to choose based on threat type, inspectability, service conditions, and risk, and to justify the choice.
| Method | Applicable Threats | Strengths | Limitations |
|---|---|---|---|
| In-line inspection (ILI) | Corrosion, geometry, cracking (by tool type) | Full-segment coverage, locates and quantifies, repeatable comparisons | Requires pigging capability; cost; crack sensitivity depends on tool |
| Hydrostatic pressure test | Corrosion, cracks, weld defects | Directly proves pressure capability; can purge some cracks | Shutdown, water supply, drying; may introduce new damage |
| Direct assessment (DA) | External (ECDA), internal (ICDA), SCC (SCCDA) | Works on unpiggable lines; staged verification | Sampling-based; results depend on indirect inspection coverage and excavation counts |
| Pressure/leak monitoring and patrol | Equipment, operations, third-party threats | Low cost, near-real time | Cannot find internal pipe defects |
The reassessment intervals are among the most operational provisions. For time-dependent threats (internal corrosion, external corrosion, SCC), the prescriptive program sets intervals by location class: generally no more than 5 years for segments in Class 3 and Class 4 locations and no more than 10 years for Class 1 and Class 2 locations; a risk-based approach can argue for longer or shorter intervals using risk models and performance data. The clock runs from completion of the previous integrity assessment. Any intervening repair, rerouting, pressure increase, or location-class change requires re-evaluation and may shorten the interval.
💡 The reassessment interval is not a synonym for “inspection cycle.” It is the maximum time window between confirmations of pipeline integrity. Even after a full ILI run, if a defect growth analysis shows a corrosion pit will reach critical size within three years, the true reassessment interval for that segment must be compressed to three years or less.
5. Responses, Repair, and Mitigation 🛠️
Chapter 7 requires graded responses to assessment findings and lists acceptable threat-prevention and repair methods (Table 7.1-1). Responses fall into two classes:
- Immediate response: when a defect could cause imminent failure (e.g., metal loss beyond the limit, active cracking, significant deformation), the line must be depressurized, shut down, or repaired within the specified time — never deferred to the next routine plan.
- Scheduled response: for defects with a predictable growth rate, compute the safe operating window from “defect size – growth rate – critical size” and schedule the repair within that window.
- Preventive mitigation: cathodic protection optimization, coating repair, inhibitor injection, pigging and dehydration, intensified patrolling, additional markers, third-party excavation controls, and geohazard stabilization — all intended to stop a threat from maturing.
The Code also provides scheduled response timing for time-dependent threats (Fig. 7.2.1-1), linking the assessment, review, repair, and verification steps to the reassessment interval so that “repair promptly” becomes a calendar of auditable milestones.
⚠️ Repair methods must match the defect type. Grinding, Type A and Type B sleeves, composite repair, pipe replacement, and pressure reduction each have applicability limits — using composite repair on active cracks or on large-area metal loss is usually ineffective or even harmful.
6. Performance, Communication, and Management of Change 📊
Chapter 9 defines a three-tier measurement system: performance measures, performance metrics, and overall performance measures. The design intent is to balance process indicators (ILI coverage, excavation verification counts, repair timeliness, training completion) with outcome indicators (incident rate per mile, number of leaks, unplanned shutdowns, public complaints). A healthy program tracks both, because process indicators lead the outcome indicators.
Chapter 10 requires a communications plan covering how integrity information flows to employees, contractors, emergency responders, local government, and the public. Chapter 11 (Management of Change) requires a risk review before any change to the pipeline itself, operating parameters, organization, regulatory requirements, or data systems — preventing unexamined modifications from eroding existing safety margins. Chapter 12 (Quality Control) covers quality assurance for data collection, assessment operations, defect evaluation, and repair work.
7. Engineering Practice Essentials 🧭
- 📋 Start with data: Most integrity management failures stem not from insufficient inspection technology but from missing baseline data — pipe grade, wall thickness, seam type, coating type, previous repair locations. Build a unified segment data model before building a risk model.
- 🎯 Segment, don’t average: Group segments by location class, population density, pipe batch, construction era, and coating type, so that local high risk is not diluted by line-wide averages.
- 🔄 Use both paths: Start with the prescriptive flowcharts of Appendix A to stand the system up quickly, then migrate to the risk-based path after two or three assessment cycles, using performance data to justify interval adjustments.
- 🧾 Keep an auditable trail: Every judgment — whether a threat applies, whether risk is acceptable, why an interval was chosen — should have written justification. This is decisive in regulatory audits and incident investigations.
- 🤝 Feed back to B31.8 conformance: Systemic findings (for instance, seam weld defects across a pipe batch) should feed back into design, procurement, and construction requirements, creating organizational learning.
8. Frequently Asked Questions ❓
❓ Q: Is B31.8S mandatory? Must my company comply?
A: The Code itself is nonmandatory and supplements B31.8. It becomes mandatory where regulators adopt it into law (as in 49 CFR 192 integrity management provisions in the U.S.). Owners, insurers, and financiers also frequently require compliance by contract.
A: The Code itself is nonmandatory and supplements B31.8. It becomes mandatory where regulators adopt it into law (as in 49 CFR 192 integrity management provisions in the U.S.). Owners, insurers, and financiers also frequently require compliance by contract.
❓ Q: How do we satisfy the assessment requirements on pipelines that cannot be pigged?
A: Use direct assessment: pre-assessment, indirect inspection, direct examination, and post-assessment, following Appendix B’s process. Choose ECDA for external corrosion, ICDA for internal corrosion, and SCCDA for stress corrosion cracking. Hydrostatic testing is another option. The key is demonstrating the selected method is effective for the target threat.
A: Use direct assessment: pre-assessment, indirect inspection, direct examination, and post-assessment, following Appendix B’s process. Choose ECDA for external corrosion, ICDA for internal corrosion, and SCCDA for stress corrosion cracking. Hydrostatic testing is another option. The key is demonstrating the selected method is effective for the target threat.
❓ Q: Where do the 5-year and 10-year intervals come from, and can they be extended?
A: The interval relates to the pipeline’s location class, which reflects consequence severity. On a risk-based path, intervals may be extended if inspection data, defect growth models, and performance records show the risk remains acceptable; conversely they must be shortened when active defects are found or operating conditions change.
A: The interval relates to the pipeline’s location class, which reflects consequence severity. On a risk-based path, intervals may be extended if inspection data, defect growth models, and performance records show the risk remains acceptable; conversely they must be shortened when active defects are found or operating conditions change.
❓ Q: How is integrity management different from routine patrolling and maintenance?
A: Routine patrol and maintenance are operational activities; integrity management is a risk-based, data-driven, performance-verified management system. The former answers “what was done today”; the latter answers “why it is done, whether it is enough, and how its effectiveness is proved.” B31.8S’s value is integrating both into an auditable closed loop.
A: Routine patrol and maintenance are operational activities; integrity management is a risk-based, data-driven, performance-verified management system. The former answers “what was done today”; the latter answers “why it is done, whether it is enough, and how its effectiveness is proved.” B31.8S’s value is integrating both into an auditable closed loop.
