Appendix C to Part 195 - Guidance for Implementation of an Integrity Management Program
49:184.108.40.206.220.127.116.11.23 : Appendix C
Appendix C to Part 195 - Guidance for Implementation of an
Integrity Management Program
This Appendix gives guidance to help an operator implement the
requirements of the integrity management program rule in §§ 195.450
and 195.452. Guidance is provided on:
(1) Information an operator may use to identify a high
consequence area and factors an operator can use to consider the
potential impacts of a release on an area;
(2) Risk factors an operator can use to determine an integrity
(3) Safety risk indicator tables for leak history, volume or
line size, age of pipeline, and product transported, an operator
may use to determine if a pipeline segment falls into a high,
medium or low risk category;
(4) Types of internal inspection tools an operator could use to
find pipeline anomalies;
(5) Measures an operator could use to measure an integrity
management program's performance; and
(6) Types of records an operator will have to maintain.
(7) Types of conditions that an integrity assessment may
identify that an operator should include in its required schedule
for evaluation and remediation.
I. Identifying a high consequence area and factors for
considering a pipeline segment's potential impact on a high
A. The rule defines a High Consequence Area as a high population
area, an other populated area, an unusually sensitive area, or a
commercially navigable waterway. The Office of Pipeline Safety
(OPS) will map these areas on the National Pipeline Mapping System
(NPMS). An operator, member of the public or other government
agency may view and download the data from the NPMS home page
http://www.npms.phmsa.gov/. OPS will maintain the NPMS and
update it periodically. However, it is an operator's responsibility
to ensure that it has identified all high consequence areas that
could be affected by a pipeline segment. An operator is also
responsible for periodically evaluating its pipeline segments to
look for population or environmental changes that may have occurred
around the pipeline and to keep its program current with this
information. (Refer to § 195.452(d)(3).)
(1) Digital Data on populated areas available on U.S. Census
(2) Geographic Database on the commercial navigable waterways
(3) The Bureau of Transportation Statistics database that
includes commercially navigable waterways and non-commercially
navigable waterways. The database can be downloaded from the BTS
website at http://www.bts.gov/gis/ntatlas/networks.html.
B. The rule requires an operator to include a process in its
program for identifying which pipeline segments could affect a high
consequence area and to take measures to prevent and mitigate the
consequences of a pipeline failure that could affect a high
consequence area. (See §§ 195.452 (f) and (i).) Thus, an operator
will need to consider how each pipeline segment could affect a high
consequence area. The primary source for the listed risk factors is
a US DOT study on instrumented Internal Inspection devices
(November 1992). Other sources include the National Transportation
Safety Board, the Environmental Protection Agency and the Technical
Hazardous Liquid Pipeline Safety Standards Committee. The following
list provides guidance to an operator on both the mandatory and
(1) Terrain surrounding the pipeline. An operator should
consider the contour of the land profile and if it could allow the
liquid from a release to enter a high consequence area. An operator
can get this information from topographical maps such as U.S.
Geological Survey quadrangle maps.
(2) Drainage systems such as small streams and other smaller
waterways that could serve as a conduit to a high consequence
(3) Crossing of farm tile fields. An operator should consider
the possibility of a spillage in the field following the drain tile
into a waterway.
(4) Crossing of roadways with ditches along the side. The
ditches could carry a spillage to a waterway.
(5) The nature and characteristics of the product the pipeline
is transporting (refined products, crude oils, highly volatile
liquids, etc.) Highly volatile liquids becomes gaseous when exposed
to the atmosphere. A spillage could create a vapor cloud that could
settle into the lower elevation of the ground profile.
(6) Physical support of the pipeline segment such as by a cable
suspension bridge. An operator should look for stress indicators on
the pipeline (strained supports, inadequate support at towers),
atmospheric corrosion, vandalism, and other obvious signs of
(7) Operating conditions of the pipeline (pressure, flow rate,
etc.). Exposure of the pipeline to an operating pressure exceeding
the established maximum operating pressure.
(8) The hydraulic gradient of the pipeline.
(9) The diameter of the pipeline, the potential release volume,
and the distance between the isolation points.
(10) Potential physical pathways between the pipeline and the
high consequence area.
(11) Response capability (time to respond, nature of
(12) Potential natural forces inherent in the area (flood zones,
earthquakes, subsidence areas, etc.)
II. Risk factors for establishing frequency of assessment.
A. By assigning weights or values to the risk factors, and using
the risk indicator tables, an operator can determine the priority
for assessing pipeline segments, beginning with those segments that
are of highest risk, that have not previously been assessed. This
list provides some guidance on some of the risk factors to consider
(see § 195.452(e)). An operator should also develop factors
specific to each pipeline segment it is assessing, including:
(1) Populated areas, unusually sensitive environmental areas,
National Fish Hatcheries, commercially navigable waters, areas
where people congregate.
(2) Results from previous testing/inspection. (See §
(3) Leak History. (See leak history risk table.)
(4) Known corrosion or condition of pipeline. (See §
(5) Cathodic protection history.
(6) Type and quality of pipe coating (disbonded coating results
(7) Age of pipe (older pipe shows more corrosion - may be
uncoated or have an ineffective coating) and type of pipe seam.
(See Age of Pipe risk table.)
(8) Product transported (highly volatile, highly flammable and
toxic liquids present a greater threat for both people and the
environment) (see Product transported risk table.)
(9) Pipe wall thickness (thicker walls give a better safety
(10) Size of pipe (higher volume release if the pipe
(11) Location related to potential ground movement (e.g.,
seismic faults, rock quarries, and coal mines); climatic
(permafrost causes settlement - Alaska); geologic (landslides or
(12) Security of throughput (effects on customers if there is
failure requiring shutdown).
(13) Time since the last internal inspection/pressure
(14) With respect to previously discovered defects/anomalies,
the type, growth rate, and size.
(15) Operating stress levels in the pipeline.
(16) Location of the pipeline segment as it relates to the
ability of the operator to detect and respond to a leak. (e.g.,
pipelines deep underground, or in locations that make leak
detection difficult without specific sectional monitoring and/or
significantly impede access for spill response or any other
(17) Physical support of the segment such as by a cable
(18) Non-standard or other than recognized industry practice on
pipeline installation (e.g., horizontal directional drilling).
B. Example: This example illustrates a hypothetical model
used to establish an integrity assessment schedule for a
hypothetical pipeline segment. After we determine the risk factors
applicable to the pipeline segment, we then assign values or
numbers to each factor, such as, high (5), moderate (3), or low
(1). We can determine an overall risk classification (A, B, C) for
the segment using the risk tables and a sliding scale (values 5 to
1) for risk factors for which tables are not provided. We would
classify a segment as C if it fell above 2/3 of maximum value
(highest overall risk value for any one segment when compared with
other segments of a pipeline), a segment as B if it fell between
1/3 to 2/3 of maximum value, and the remaining segments as A.
i. For the baseline assessment schedule, we would plan to assess
50% of all pipeline segments covered by the rule, beginning with
the highest risk segments, within the first 3 1/2 years and the
remaining segments within the seven-year period. For the continuing
integrity assessments, we would plan to assess the C segments
within the first two (2) years of the schedule, the segments
classified as moderate risk no later than year three or four and
the remaining lowest risk segments no later than year five (5).
ii. For our hypothetical pipeline segment, we have chosen the
following risk factors and obtained risk factor values from the
appropriate table. The values assigned to the risk factors are for
Age of pipeline:
assume 30 years old (refer to “Age of
Pipeline” risk table) - Risk Value = 5 Pressure tested:
tested once during construction - Risk Value = 5 Coated:
(yes/no) - yes Coating Condition:
Recent excavation of
suspected areas showed holidays in coating (potential corrosion
risk) - Risk Value = 5 Cathodically Protected:
yes - Risk Value = 1 Date cathodic protection installed:
five years after pipeline was constructed (Cathodic protection
installed within one year of the pipeline's construction is
generally considered low risk.) - Risk Value = 3 Close interval
(yes/no) - no - Risk Value = 5 Internal Inspection
(yes/no) - yes. Date of pig run?
In last five
years - Risk Value = 1 Anomalies found:
(yes/no) - yes, but
do not pose an immediate safety risk or environmental hazard - Risk
Value = 3 Leak History:
yes, one spill in last 10 years.
(refer to “Leak History” risk table) - Risk Value = 2 Product
Diesel fuel. Product low risk. (refer to “Product”
risk table) - Risk Value = 1 Pipe size:
16 inches. Size
presents moderate risk (refer to “Line Size” risk table) - Risk
Value = 3
iii. Overall risk value for this hypothetical segment of pipe is
34. Assume we have two other pipeline segments for which we conduct
similar risk rankings. The second pipeline segment has an overall
risk value of 20, and the third segment, 11. For the baseline
assessment we would establish a schedule where we assess the first
segment (highest risk segment) within two years, the second segment
within five years and the third segment within seven years.
Similarly, for the continuing integrity assessment, we could
establish an assessment schedule where we assess the highest risk
segment no later than the second year, the second segment no later
than the third year, and the third segment no later than the fifth
III. Safety risk indicator tables for leak history, volume or
line size, age of pipeline, and product transported.
(Time-dependent defects) 1
||>3 Spills in last 10
||<3 Spills in last 10
Line size or Volume transported
||10′ - 16′ nominal
||≤8′ nominal diameter
|Age Pipeline condition
||(Highly volatile and
||(Propane, butane, Natural Gas
Liquid (NGL), ammonia).
||(Benzene, high Hydrogen
Sulfide content crude oils).
||Flammable - flashpoint
||(Gasoline, JP4, low flashpoint
||Non-flammable - flashpoint 100
||(Diesel, fuel oil, kerosene,
JP5, most crude oils).
IV. Types of internal inspection tools to use.
An operator should consider at least two types of internal
inspection tools for the integrity assessment from the following
list. The type of tool or tools an operator selects will depend on
the results from previous internal inspection runs, information
analysis and risk factors specific to the pipeline segment:
(1) Geometry Internal inspection tools for detecting changes to
ovality, e.g., bends, dents, buckles or wrinkles, due to
construction flaws or soil movement, or other outside force
(2) Metal Loss Tools (Ultrasonic and Magnetic Flux Leakage) for
determining pipe wall anomalies, e.g., wall loss due to
(3) Crack Detection Tools for detecting cracks and crack-like
features, e.g., stress corrosion cracking (SCC), fatigue cracks,
narrow axial corrosion, toe cracks, hook cracks, etc.
V. Methods to measure performance.
A. General. (1) This guidance is to help an operator
establish measures to evaluate the effectiveness of its integrity
management program. The performance measures required will depend
on the details of each integrity management program and will be
based on an understanding and analysis of the failure mechanisms or
threats to integrity of each pipeline segment.
(2) An operator should select a set of measurements to judge how
well its program is performing. An operator's objectives for its
program are to ensure public safety, prevent or minimize leaks and
spills and prevent property and environmental damage. A typical
integrity management program will be an ongoing program and it may
contain many elements. Therefore, several performance measure are
likely to be needed to measure the effectiveness of an ongoing
B. Performance measures. These measures show how a
program to control risk on pipeline segments that could affect a
high consequence area is progressing under the integrity management
requirements. Performance measures generally fall into three
(1) Selected Activity Measures - Measures that monitor the
surveillance and preventive activities the operator has
implemented. These measure indicate how well an operator is
implementing the various elements of its integrity management
(2) Deterioration Measures - Operation and maintenance trends
that indicate when the integrity of the system is weakening despite
preventive measures. This category of performance measure may
indicate that the system condition is deteriorating despite well
executed preventive activities.
(3) Failure Measures - Leak History, incident response, product
loss, etc. These measures will indicate progress towards fewer
spills and less damage.
C. Internal vs. External Comparisons. These comparisons
show how a pipeline segment that could affect a high consequence
area is progressing in comparison to the operator's other pipeline
segments that are not covered by the integrity management
requirements and how that pipeline segment compares to other
operators' pipeline segments.
(1) Internal - Comparing data from the pipeline segment that
could affect the high consequence area with data from pipeline
segments in other areas of the system may indicate the effects from
the attention given to the high consequence area.
(2) External - Comparing data external to the pipeline segment
(e.g., OPS incident data) may provide measures on the frequency and
size of leaks in relation to other companies.
D. Examples. Some examples of performance measures an
operator could use include -
(1) A performance measurement goal to reduce the total volume
from unintended releases by -% (percent to be determined by
operator) with an ultimate goal of zero.
(2) A performance measurement goal to reduce the total number of
unintended releases (based on a threshold of 5 gallons) by __-%
(percent to be determined by operator) with an ultimate goal of
(3) A performance measurement goal to document the percentage of
integrity management activities completed during the calendar
(4) A performance measurement goal to track and evaluate the
effectiveness of the operator's community outreach activities.
(5) A narrative description of pipeline system integrity,
including a summary of performance improvements, both qualitative
and quantitative, to an operator's integrity management program
(6) A performance measure based on internal audits of the
operator's pipeline system per 49 CFR Part 195.
(7) A performance measure based on external audits of the
operator's pipeline system per 49 CFR Part 195.
(8) A performance measure based on operational events (for
example: relief occurrences, unplanned valve closure, SCADA
outages, etc.) that have the potential to adversely affect pipeline
(9) A performance measure to demonstrate that the operator's
integrity management program reduces risk over time with a focus on
high risk items.
(10) A performance measure to demonstrate that the operator's
integrity management program for pipeline stations and terminals
reduces risk over time with a focus on high risk items.
VI. Examples of types of records an operator must maintain.
The rule requires an operator to maintain certain records. (See
§ 195.452(l)). This section provides examples of some records that
an operator would have to maintain for inspection to comply with
the requirement. This is not an exhaustive list.
(1) a process for identifying which pipelines could affect a
high consequence area and a document identifying all pipeline
segments that could affect a high consequence area;
(2) a plan for baseline assessment of the line pipe that
includes each required plan element;
(3) modifications to the baseline plan and reasons for the
(4) use of and support for an alternative practice;
(5) a framework addressing each required element of the
integrity management program, updates and changes to the initial
framework and eventual program;
(6) a process for identifying a new high consequence area and
incorporating it into the baseline plan, particularly, a process
for identifying population changes around a pipeline segment;
(7) an explanation of methods selected to assess the integrity
of line pipe;
(8) a process for review of integrity assessment results and
data analysis by a person qualified to evaluate the results and
(9) the process and risk factors for determining the baseline
(10) results of the baseline integrity assessment;
(11) the process used for continual evaluation, and risk factors
used for determining the frequency of evaluation;
(12) process for integrating and analyzing information about the
integrity of a pipeline, information and data used for the
(13) results of the information analyses and periodic
(14) the process and risk factors for establishing continual
(15) justification to support any variance from the required
(16) integrity assessment results and anomalies found, process
for evaluating and remediating anomalies, criteria for remedial
actions and actions taken to evaluate and remediate the
(17) other remedial actions planned or taken;
(18) schedule for evaluation and remediation of anomalies,
justification to support deviation from required remediation
(19) risk analysis used to identify additional preventive or
mitigative measures, records of preventive and mitigative actions
planned or taken;
(20) criteria for determining EFRD installation;
(21) criteria for evaluating and modifying leak detection
(22) methods used to measure the program's effectiveness.
VII. Conditions that may impair a pipeline's integrity.
Section 195.452(h) requires an operator to evaluate and
remediate all pipeline integrity issues raised by the integrity
assessment or information analysis. An operator must develop a
schedule that prioritizes conditions discovered on the pipeline for
evaluation and remediation. The following are some examples of
conditions that an operator should schedule for evaluation and
A. Any change since the previous assessment.
B. Mechanical damage that is located on the top side of the
C. An anomaly abrupt in nature.
D. An anomaly longitudinal in orientation.
E. An anomaly over a large area.
F. An anomaly located in or near a casing, a crossing of another
pipeline, or an area with suspect cathodic protection.
[Amdt. 195-70, 65 FR 75409, Dec. 1, 2000, as amended by Amdt.
195-74, 67 FR 1661, Jan. 14, 2002; Amdt. 195-94, 75 FR 48608, Aug.