1.1 Reliability vs. Quality.

Quality and Reliability are two major concerns in the engineering industry, especially for manufacturing and civil engineering. Quality relates to a product or structure's initial performance when new, while reliability relates to performance over its lifetime. Over the years many industrial standards and evaluation systems have been built relating to quality, such as Six Sigma, ISO 9000, the Malcolm Baldrige National Quality Award and the Deming Prize. The American Society for Quality (ASQ) has garnered well over 150,000 members and continues to grow in strength. By comparison reliability is fairly neglected; the Institute for Reliability Engineering languishes is near obscurity. However, for the end customer reliability is equally, if not more important than quality because of future maintenance costs and the consequences of potential failures in today's large, complex systems.

In this paper we focus on reliability. We propose new and more systematic methodologies to discover destructive energies and apply the methods to the pipe in a subsea pipeline for demonstration purposes. In addition to incorporating prior experience in a design to avoid known failure mechanisms, reliability can be improved by exploring for unknown weak links and interactions resulting from the multiple, simultaneous stresses that a pipeline may experience during its operational life. The pipe should survive the compound impact from both external environment and internal stresses throughout its designed lifetime, say, for 20 years or more.

1.2 Monumental economic loss of due to lack reliability.

Keki Bhote in his book, World Class Reliability states, “Many companies take a cavalier attitude in dismissing their costs associated with reliability. They express their satisfaction if warranty costs are within a few percent of their sales dollars. They may justify such costs by including them in their budgets. Tragically, most companies do not recognize that their own warranty cost is only the tip of the iceberg” [1]. The total cost of reliability failures includes not only direct repair costs but also the costs of supplier retrofits, lawsuits, and third party costs to their customer's customers, to society, to governments and environmental damage. These costs are virtually never included in an economic analysis.

James R. Chiles in his book, Inviting Disaster; Lessons from the Edge of Technology, cites numerous examples where simply design changes could have avoided many high visibility catastrophic failures [2]. To wit, the 1979 partial meltdown of a Three Mile Island nuclear power plant reactor, the 1980 capsizing of the Alexander Keilland floating platform to house offshore oil workers, the 1982 sinking of the Ocean Ranger offshore floating drill rig, the 1986 explosion of the Chernobyl nuclear power station, the 1986 mid-air breakup of the Space Shuttle Challenger, the 1988 explosion and fire on the Piper Alpha offshore drilling rig, the 1999 loss of the Mars Polar Lander, the 2000 crash of the Air France Concord departing Charles de Gaulle Airport, and many others. Since the publication of his book, the litany of such disasters continues with such high profile events as the 2010 Deepwater Horizon oil spill in the Gulf of Mexico and the 2011 meltdown of the Fukushima nuclear power plant following an earthquake. Many of these disasters could have been avoided with adequate stress testing to find the weak links and designing them out, or in some cases, simply not ignoring known weak links.

2.1 Logic-based approaches for risk factor identification.

Many logic-based approaches have been applied to reliability risk analysis. Fault Tree Analysis, FTA, has been used for identifying and ranking risk factors based on their assigned probabilities [3]. Bayesian Belief Networks build a network used to demonstrate the logic relationship between factors through a probability distribution calculation [4]. Failure Mode and Effects Analysis, FMEA, is used to evaluate the effect of potential failures of designed functions [5]. Cause and defect Diagrams, also called Fishbone Diagrams, are used to identify potential factors which would cause the system to fail [6], etc. All these methods are based on knowledge and experience; factors are often identified through brainstorming. They are useful early in the design phase to prevent incorporating failure modes which have previously been discovered or which are suspected. However, their weakness lies in the fact that unknown factors and interactions are missed – the very factors that are often responsible for so-called “rare events” or “Black Swans” [7].

2.2 Mathematical modeling.

Reliability testing often includes mathematical modeling. These models are typically expressed graphically or with mathematical functions. Researchers design experiments to simulate the relationship between the input parameters/factors and the major output functions. In order to increase fidelity of the model, complexity is incrementally added following analysis and inference, or from other data. But it is impossible to predict with certainty whether a given mathematical model is adequate or not [8].

Other fundamental weaknesses of the mathematical approach are: 1) Large sample sizes required to test the model. For example, based on the binomial proportion confidence interval, doubling the number of failure modes will triple the sample size [9]. 2) Much time is consumed for direct testing to a significant portion of life. 3) High confidence levels are difficult to achieve (50% is meaningless, 70% is not a whole lot better, 90–95% is desirable) because the quantities, costs and test times become astronomical as confidence level requirements increase.

Having noted the deficiencies of mathematical modeling, we hasten to point out that such models are invaluable for functional design before life testing begins. In this situation designers are trying to select and apply the physical laws of nature necessary to make the system function as intended. However, in the case of reliability it is more important for designers to prevent unexpected behavior of the system. This is a much broader challenge and requires a different experimental strategy, such as accelerated life testing.

2.3 Accelerated lifetime tests.

Accelerated life testing (ALT) attempts to bring out unexpected weak links and interactions in a design. These are failure modes that were not or could not be predicted by prior modeling, design and prototyping. Various ALT methods are in use, such as HALT (Highly Accelerated Life Testing) and HASS (High Accelerated Stress Screen) [10] which apply two basic stresses, temperature and vibration typically, in parallel or sequentially, along with other special stresses associated with the system's operation. Another example is HAET (High Accelerated Environmental Testing), in which a stimulation mechanism is introduced in order to quantify the factors/failure modes at “end of life”.

However, there are certain shortcomings of most ALT methods, which may include: 1) Environmental stresses are often assumed to be single-factor effects, not combined and not interacting. 2) Over-stress levels could be insufficient to detect the most important failure modes. 3) Incremental stress step size could be too small to yield results within a suitable time period or too large and skip over important failure modes. 4) Excessive stresses may introduce artificial failures which would never occur in the field. 5) A large number of test units are needed for each failure mode. 6) Converting time-to-failure to a calculated lifetime is risky because overstressing is likely to behave in an unpredictable, non-linear way, depending on the overstress levels applied.

Our preferred approach is to use Multiple Environment Over Stress Testing (MEOST) primarily because it avoids shortcomings 1–5, and does not attempt to predict lifetime as #6 above. Rather it focuses on assuring that full life can be reached at full stress without experiencing unexpected failure modes from weak links and interactions. The method is briefly described below, and we develop new methods to assure more systematic discovery of the energies that should be fed into an MEOST experiment.

2.4 Function Models in reliability.

Function models are often used to explain in graphical form how a system is supposed to work in terms of how its subsystems link and operate together to achieve the overall goal(s). Commonly used function models are: Function Tree, which builds the function structure by decomposing the major function(s) into individual sub-functions based on the logic relationship between them [11]; Function Analysis System Technique (FAST), a similar method introduced by the Society of American Value Engineer in 1965 [12]; Structured Analysis and Design Technique (SADT) employs a diagrammatic notation designed specifically to help people describe and understand systems [13].

Such models are excellent from the perspective of developing the required system functionality and, given good design, components and assembly, the initial system quality should be good. However, from a reliability perspective there is an important aspect which needs to be added: energy or energy combinations which cause failure. In particular we are concerned with (a) external/environmental energies, (b) energies employed in the system which lead to stresses on the system, and (c) energy losses which occur as energy is transferred among system sub-functions. The second law of thermodynamics assures us that some energy will be lost during transformation; part of that lost energy may go into destructive behavior.

2.1 MEOST Methodology.

The MEOST method of accelerated life testing simply applies multiple energies in increasing stepwise fashion to reveal weak links in a system's strength related to Infant Mortality or Wear Out (but not to Useful Life excessive energy spikes). Once these weak links are discovered they can be designed out by investigating their root cause and strengthening the system against that combination of energies. In one of the first applications of MEOST a subcontractor of NASA applied it to the Apollo Lunar Excursion Module, the LEM [15]. The specification included operability up to 95% relative humidity. However, over stress tests were run up to 100% humidity, a dripping wet environment, and the electronics were improved to withstand this stress. This safety margin prevented electrical failure in the LEM during Apollo 13 when the crew had to retreat there during the return trip from the moon; cold temperature caused moisture from the astronaut's breath to condense on the electronics, an unexpected stress. These days, MEOST is becoming popular, especially in the electronics and automotive industries. There are even companies which specialize in running MEOST as a service, such as Intertek.com.

Briefly as seen in Fig. 2, the MEOST plan is to operate the system within its operating limits for a period of time while exposing it to all energy types simultaneously. Time should be compressed between cycles so that the system experiences the largest possible fraction of stress cycles expected over its design life. For example, if oil flow in a pipeline is expected to change once a week for 20 years, this is about 1,000 cycles. By cycling flow once every 15 minutes the entire life relative to this stress can be simulated in a little over 10 days. This strategy is time acceleration. Flow rate would go from max to standstill and back, but at normal rates of change (no energy spikes). The “Black Dot” represents 97.5% of the combined maximum stresses (operating plus environmental) applied throughout the design life.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Figure 2. MEOST Operating plan graphic.

Testing first proceeds inside the “Black Dot Operating Rectangle” which is defined as 97.5% maximum combined stresses over the design life, and then beyond the rectangle by overstressing in time-steps. Individual failure modes are identified by root cause analysis and plotted on a Weibull plot to determine if their 90% confidence limit will intersect the Operating Rectangle before the design life is reached at max stress.

https://doi.org/10.1371/journal.pone.0103937.g002

However, time acceleration may not be able to cycle all the stresses expected to occur over the system life. So after a period of time we move beyond the Black Dot to overstressing, trying to bring out remaining weak links. Using the same cycling profiles all stresses are applied at proportionally higher levels and proportionally faster rates of change. Overstressing is applied in small incremental steps so as not to skip over failure modes. Whenever a part fails, the failure mode is carefully inspected to determine root cause, and the time-to-failure is recorded. After multiple parts have failed with the same failure mode, these are plotted on a Weibull plot and the 90% confidence limit is determined for that failure mode [16]. If the 90% confidence limit intersects the Operating Rectangle before the full Design Life at 97.5% combined stresses, the failure mode has to be fixed. If not, the system is safe at the 90% confidence level against that failure mode over the course of its designed stress and life.

MEOST testing is typically 1–2 orders of magnitude faster than normal stressing in bringing out latent failure modes. However during overstressing, failures may be 2–3 times worse than normal and occasionally they may be catastrophic. If possible, energy limitations should be included to avoid destroying all the evidence of the initiating feature so that root cause can be determined and system strength improved accordingly.

2.2 Planning an MEOST Experiment.

Like all experimental methodologies, good preparation is essential for the best results. Energies and life time goals should be specified. Minor failures should be eliminated before testing – there is no point in using a powerful method to discover simple things that should have been avoided beforehand. Stress levels and cyclical profiles should be identified for normal operating limits. There are also the design limits, the Maximum Practical Over Stress Levels (MPOSL) [17], and beyond that the destruct stresses. Design limits include the safety margin beyond the maximum operating limits. MPOSL could be taken, for example, as 170% of the operating limits, but less than the destruct limits. Also needed are the step sizes for each overstress, the dwell time at each stress step and the time sequencing of stresses to simulate real life. Finally, a test setup capable of applying simultaneous stresses up to the MPOSLs should be designed and built, and it should be able to handle the required test sample size (typically 10–20 parts).

A typical sequence of test steps is described by Bhote [17]. We have modified these for civil engineering applications as follows:

Step 1: Apply each energy separately to its design limit (operating limit plus safety margin). Fix any failures.

Step 2: Apply the combined energies up to 97.5% of the operating limits (Black Dot stresses) in the way these are expected to occur during life, but accelerated in time as much as possible without violating anticipated maximum rates of change.

Step 3: Apply the combined stresses in 2–4 steps increasing from the operating limits up to the design limits.

Step 4: Apply each stress separately to its MPOSL.

Step 5: Apply the combined stresses in 4–5 steps increasing from the design limits to the MPOSL limits.

During initial testing one may find more than one failure mode among the failed samples. Testing may continue without fixing these failure modes up until a specific failure mode is found to dominate the test sample population. Then all failure modes discovered up to that point should be eliminated and testing restarted from the beginning with improved samples to find the next weakest link(s). Testing stops when the Weibull plot for the weakest uncorrected failure mode does not intersect the Operating Rectangle with 90% confidence out to the design life (Black Dot in Fig. 2).

Follow-up testing may continue after field installation, if practical, by bringing back parts that have been in use for 6 months or more and subjecting them to MEOST. The reason for recommending this step is that a failure mode could be discovered due to some operating or environmental condition which was not included in the original MEOST plan. For example, when the company Hamilton Standard switched from manufacturing wood propeller blades for airplanes to making them of aluminum, some blades were brought back from selected customers in the field after six months of use. In exchange, those customers received new blades for free. The returned blades were tested and found to be corroded from the inside, something not visible from the outside. It was an undiscovered wear out failure mode. Competitors who did not do such field buy-backs subsequently had propeller blades fail in flight, and went out of business due to lawsuits. Reliability testing, including buy-backs, was a lot cheaper in the long run.

Chiles in his book Inviting Disaster says, “I like to think of thorough testing as a badge of confidence: confidence that the machine can take abuse, and if it breaks, the designers will be able to find a solution. It is good business, reassuring users that there is no place they can go that the manufacturer hasn't already been.” [18]

1.1 Expansion Tree Design principles.

The design principles for Expansion Trees, modified for application to discovering energies and forces, are as follows:

Principle #1: No bias/prejudgment. Expert knowledge leads one to simply list known or suspected energies. Reliability is about trying to discover what is unknown, so a more systematic approach is needed.

Principle #2: Nodes at each level should be mutually exclusive, in other words, independent of each other. Overlapping content obscures judgment of completeness.

Principle #3: Nodes at each level should be collectively exhaustive, in other words they should add up to 100% of the possibilities from the node immediately above.

Principle #4: To make principles #2 and 3 more rigorous a “basis” of split should be stated at each level against which to judge independence and completeness.

Principle #5: Decompose each node until an energy is reached which can be included in the MEOST experiment, such as temperature, pH or a pressure.

Principle #6: Split levels should be as symmetric as possible to provide level independence. This rule should be regarded as a guideline to organizing the vertical development of a tree.

These six principles assure maximum node coverage with a low probability of leakage (i.e., missed energies). Following them regulates the thought process on how to group things in a more consistent and logical way.

1.2 Energy Expansion Tree for a subsea pipeline system.

Following the above principles, we develop the Expansion Tree for energies related to the piping in a subsea pipeline as shown in Fig. 3. The nomenclature, “Energy Expansion Tree” (EET) is chosen because this logic tree is concerned solely with energy, regardless of the reliability regime. Three general categories are identified which cover all the energy sources related to a subsea pipeline: (a) “External energy sources” outside the system (the environment), (b) “Operational energy” for energies employed in and used by the system itself, and (c) “Internal-External Differences” resulting from the 2nd law of thermodynamics which gives rise to equilibration forces whenever two regions of space have different energy levels. The external and internal-external difference branches are split into sublevels using the “basis of split” shown in the leftmost column according to expansion tree principles, while the internal (operational) branch is derived below from a newly proposed energy function model. The reason different approaches are needed is that external to the system the environment is unstructured, while the system itself is designed with very specific laws of physics in mind in order to achieve the system primary functions. The later can be enumerated by design; the former cannot.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Figure 3. Energy Expansion Tree as applied to piping in a subsea pipeline.

Boxes with bold font represent the energies to be fed into MEOST. Boxes with various shaded backgrounds and borders are used to distinguish the corresponding branch development underneath it. Numbers to the right of bolded boxes are used for linking the energies into the subsequent MEOST table.

https://doi.org/10.1371/journal.pone.0103937.g003

In this example the tree is applied specifically to a subsea pipeline system to be built in the China South Sea. Environmental energies are therefore limited to tropical water conditions. Thus for example, “floating ice” is not considered, but would be a significant potential energy source if the pipeline were to be built in the North Sea. Below are some examples of how the decomposition proceeds.

Mechanical impact from things that touch the pipe could be in the form of solids, liquids (hydraulic) or gas. Solid impact would come from soil/rock shifting and would occur as impulse forces, although these may not retrace to back to zero. Hydraulic impact could be static or dynamic, and following the “collectively exhaustive” rule, dynamic hydraulic forces would arise from “Seawater vortex”, “Ocean waves (oscillation)” and “Seawater current”. Note that traditionally one might think to describe hydraulic energies in terms of their causes, such as “Tsunami” or “Hurricane”, but these are energy sources, not energy types. The initial objective is only to think of energy types. Later, when developing energy amplitudes and profiles, one would consider sources.

Under “Electrochemical”, we look for things that touch the pipeline because electrochemical energies come from electron exchange. There are only two possibilities, “Sea water” and “Sea soil”. Most research indicates that five factors determine the electrochemical condition of ocean water: “pH”, “Oxygen Redox Potential (ORP)”, “Oxygen concentration”, “Salinity” and “Temperature”. These factors are interrelated and X Tang and J Wang provide a detailed analysis of their interactions [20]. pH is primarily driven by H₂CO₃ in the sea water [21]. Following Palmer et al [22], under “Sea soil” we include “Soil resistivity”, “Oxygen Redox Potential (ORP)” and “Soil salinity”.

Splitting “Manmade” is potentially more challenging because there are many ways humans could introduce stresses to the pipeline, whether accidentally or on purpose. We begin by thinking about general types of energies. Under “Mechanical” a logical split based on speed of impact is made. Sudden “bumping” up to the design limit could occur, such as “Fishing nets”, “Anchoring” and other ocean activity. “Gradual impact” might include a snagged fishing net whose force would behave asymptotically if a net got stuck while being pulled up. In any case, these examples suggest both sudden and gradual mechanical forces should be fed into the MEOST experiment, with amplitudes to be determined more by design specs than limitless overstresses. Sensible Maximum Practical Over Stress Limits (MPOSL) should be selected above the design criteria. Destruct limits beyond that would result from failure modes which are intentionally excluded, such as solder melting on a printed circuit board. These are more appropriately considered under Useful Life failures.

The third general category, “External-internal differences” is normally prepared after completion of the Energy Function Model (see below). This is an example of an entire set of forces which might be overlooked without constructing an EET following the design principles and thinking about the basic laws of nature.

In this branch, density, pressure and velocity are identified as mechanical differences between internal and external regions of space (inside vs. outside the pipe). Oil density vs. seawater gives rise to buoyancy forces. Velocity differences from oil movement result in gyroscopic and Coriolis forces. While these two forces are small compared to other mechanical forces, here it is important that we identify and consider all possible forces. It is one thing to objectively ignore forces because they are small, but something altogether different to miss forces entirely. Finally, thermal differences give rise to thermal gradients as the oil in the pipeline is heated vs. external seawater.

Enumerating energy types is the first step in developing an effective MEOST experiment. To our knowledge, this is the first time in the oil pipeline industry that a systematic approach has been applied to discovering environmental energies, with the intention of looking for weak reliability links in systems under multiple stress conditions. Next we look for energies and forces that arise with the system itself.

1.3 Energy Function Model.

To understand energy sources in the “Operational energy” branch, we begin by constructing a standard Function Flow Model (FFM) for the subsea pipeline system. The objective of this model is to understand how the system works. Like all function models, the horizontal direction shows HOW a function is achieved (reading left to right), or inversely WHY the function is needed (right to left). The vertical or WHEN direction shows the consequences of functions, which often lead to additional design considerations or even new subsystems. Horizontal logic is either “or” or “and”, and control knobs are added to manage both functionality and its consequences.

In the high level Function Model for a subsea pipeline seen in Fig. 4, there are three primary functions: “Transport Oil”, “Contain oil” and “Guide oil flow” (a path). These decompose from left to right. Each function (the verb in the box) is driven by the function immediately to its right, until the lowest order function is reached.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Figure 4. High-level Function Flow Model (FFM) for a subsea pipeline system.

The function model shows three primary functions required to deliver oil inland. Each box states a function (a verb) and boxes to its right explain HOW that function is achieved. Vertical linkages (the WHEN direction) show consequences of functions.

https://doi.org/10.1371/journal.pone.0103937.g004

From this model we see that energies in the system are primarily stored and used in the form of pressure, heat and velocity (kinetic energy and momentum). Under Transport oil the system operates by applying pressure to push the oil through the pipeline and it applies heat to make the oil less viscous and easier to push. Under “Contain oil” we see that pipes are used. Pipes will corrode and a cathode protection subsystem is employed to mitigate that. Pipes also have weight, which doesn't matter from a functional perspective, but later, from an energy perspective it does because weight contributes to mechanical stresses. These are clearly linked to the pipe support structure seen under “Guide oil flow”. Under normal circumstances these stresses are static, however if environmental conditions change they may become dynamic, at least momentarily.

The next step is to identify energy losses and other forces which result from the existence of the pipeline. These can be regarded as side-effects, so we add them in the WHEN direction. They are important from a reliability perspective because they produce stresses and wear. Thus we build the integrated Energy Function Model (EFM) shown in Fig. 5.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Figure 5. Energy Function Model (EFM) for piping in a subsea pipeline system.

The Function Flow Model of Fig. 4 expanded to include system energies. Cells with Bold font are direct energy side effects associated with the designed functions or other cells immediate above/below. Bolded cells are fed forward into the MEOST experiment using the energy codes to the right of each bolded box.

https://doi.org/10.1371/journal.pone.0103937.g005

In the figure, we see that while transporting oil in a pipe, heat gets lost. In the initial design this led to taking corrective action to maintain heat (a secondary function), such as adding electrical heating and wrapping the pipe to insulate it. Transporting oil requires pressure to move it and when moving, oil has considerable momentum (mass times velocity). “Increase flow” and “Decrease flow” cover these aspects of pumping and momentum changes. Specifically, three negative mechanical energies from increasing flow are, “Pumping vibration”, “Abrasion from oil, debris” and “Pumping pressure spike”. Pump vibration energy is transmitted either through the pipe itself or the oil inside. Under “Decrease flow” a valve closing too quickly (or any sudden blockage) would create a pressure spike (hammer effect) on one side of the valve or blockage and a pressure drop (vacuum spike) on the other side. These forces may be enormous due to the large moving mass in the first case and the external water pressure at depth in the second case. “Decrease flow” creates other side effects as well, namely “Lose heat”, which leads to the well-known problems of “Deposit wax” and “Form hydrates” [23].

In a similar way, the functions “Contain oil” and “Guide oil flow” are developed to assist in defining what energies should be applied in the simulated testing. For example under “Guide oil flow”, “Centrifugal forces” as oil flows around bends result in tension to the adjoining straight pipe sections and sideway forces on the pipe wall at the bends. Contact with the soil may result in X-Y linear forces, twisting torques or buckling forces as the soil shifts over time.

The Energy Function Model completes the second major branch, “Operational energy”, of the EET in Fig. 3, and thus the energy identification stage. To summarize, the EET and EFM are developed only to discover the types of energies and forces that should be applied in a MEOST fixture. They do not describe time-lines and operating profiles, which are also necessary for actual simulation. Nor are they meant to suggest corrective actions or remediation to compensate for negative energies in the design, although if found, corrective actions are certainly warranted, possibly in terms of adding new subsystems.

Note that each subsystem, such as the cathode protection (CP) subsystem or the support structure subsystem, has its own set of primary functions to be protected, energies-to-destroy and strengths-to-resist. These must be evaluated and treated with separate MEOST experiments to find their weak link failure modes. Where subsystems interact, energies should be included in the subsystem being studied. In the current example the CP subsystem creates electric fields and the supports create galvanic forces.

The list of energies from a systematic discovery process such as we have employed may be rather extensive. But an MEOST experiment cannot be done with 100 separate energies. Typical they only include dozen or so. Therefore the next step is to consolidate energies in such a way that their overall effect still represents real life as much as possible.