FAILURE ANALYSIS OF CORRODED OIL AND GAS PIPES

USING FUZZY LOGIC

Maneesh Singh1,2 and Tore Markeset1

1.
University of Stavanger, N-4036 Stavanger, Norway
2.
AGR EmiTeam AS, Luramyrveien 25B, N-4313 Sandnes, Norway

ABSTRACT

The probability of failure (PoF) of corroded pipes under internal pressure is a commonly evaluated
parameter during the development of a maintenance programme for oil and gas pipes. It has traditionally
been carried out using probabilistic analysis wherein the input variables – pipe wall thickness, corrosion
pit length and corrosion pit depth, etc. – are described by probability density functions. This paper
presents the possibilistic approach as an alternative to the probabilistic approach. The possibilistic
approach gives the possibility and necessity measures of the likelihood of failure. These measures are,
respectively, more and less conservative than the probability of failure. Additionally, this paper discusses
a fuzzy logic based variation of the ASME B31G model for calculating the integrity of corroded pipes.

KEYWORDS
Corrosion, failure, integrity, maintenance, necessity, pipe, possibility, probability, risk-based inspection,
RBI, strength, technical integrity.

1 INTRODUCTION

During their operational lifetime, the pipes and pipelines carrying oil and gas are prone to corrosion. With
time, the corrosion can weaken the pipe, and if left unattended, the corroded pipes may develop leaks and
bursts. Hence, the repair and replacement of the corroded sections is an important maintenance issue of an
effective pipe technical integrity management programme. While developing a maintenance programme,
the plant operators try to maximize the availability of pipes at an acceptable cost but without
compromising on the health, safety, environmental and legislative requirements.
In order to develop the maintenance programme, the plant operators need to know (a) the current
condition of the pipe; (b) the rate of corrosion; and (c) the strength of the corroded pipe. A number of
intrusive and non-intrusive methods have been developed to inspect the condition of pipes and take the
necessary measurements. Unfortunately, the collected data is always inflicted with uncertainties, which
may arise due to various reasons like the random nature of the variables, the imperfect nature of the
instrument and the operating conditions.
The corrosion of pipelines can take place due to a number of factors like the presence of CO2, humidity,
H2S, microbes, chlorides and sulphates. Determination of the rate of corrosion for any of these factors is a
challenging task due to the complex nature of the corrosion phenomena. One of the most common forms
of corrosion is CO2 corrosion in carbon steel pipes. In order to predict the rate of CO2 corrosion, a semi-
empirical model has been presented in the NORSOK STANDARD M-506.
1
To aid the operators in determining the strength of a corroded pipe two of the most commonly used
models are the ASME B31G and the DNV RP-F101. These models are applicable when general wall
thinning is taking place and the defects are characterized by smooth contours without any region of high
stress concentration (ANSI/ASME, 1991; DNV, 2004).
Unfortunately, the calculations for predicting the rate of corrosion and the strength of corroded pipes are
always encumbered with uncertainties. The uncertainties arise due to the imperfections in the collected
data and the structure of the model. Some of the imperfections arising due to the randomness and
uncertainties of the data can be effectively handled by employing structural reliability analysis which is
based on the probabilistic approach. While the probabilistic approach works well when the distribution
functions of the variables are known, it may face problems when the data is sparse and the model is
imprecise. On the other hand, an alternative framework called fuzzy logic can handle vague and imprecise
information (Ayyub and Klir, 2006; Ross, 2004). Thus fuzzy logic may offer an alternative approach to
handling imperfections in the collected data and used models.
This paper examines three different approaches for evaluating the integrity of corroded pipes. The three
different approaches are (a) the Monte Carlo method; (b) the possibilistic or fuzzy approach when the safe
limit is a fixed value; and (c) the possibilistic approach when the safe limit is a fuzzy variable.

2 CALCULATION OF RELIABILITY

In the structural reliability analysis, the limit state function ( z ) is calculated using (Melchers, 2001):
z = dS − dP Where (1)
d S = Maximum allowed corrosion depth, mm
d P = Predicted corrosion depth, mm
It is expected that with time the corrosion depth increases; and finally, the failure event (Fi ) occurs when
the predicted corrosion depth exceeds the maximum allowed corrosion depth (d P ≥ d S ) . Thus, to calculate
the limit state function, two values are needed: (a) the predicted extent of corrosion (d P ) ; and (b) the
maximum allowed extent of corrosion (d S ) .
The predicted extent of corrosion (d P ) can be obtained from any suitable corrosion model like NORSOK
M-506 and the maximum allowed corrosion depth (d S ) can be obtained using the models like those
recommended in the ASME B31G and the DNV RP-F101. Having decided upon the correlations for d S
and d P an appropriate approach for calculating z is selected. This paper discusses the following cases:
1. d P is a random variable and d S is a crisp number.
2. d P is a fuzzy variable and d S is a crisp number.
3. d P is a fuzzy variable and d S is a fuzzy variable.

3 CALCULATION OF THE MAXIMUM ALLOWED EXTENT OF CORROSION

3.1 Calculation using the ASME B31G and the DNV RP-F101

Under the internal pressure of the pipe, the thin walled area of the defect tends to deform elastically and
plastically in the circumferential and thickness direction. The resistance to deformation under the
influence of internal pressure is dependent upon the length of the defect. This is because the defective
wall area gets support from the non-defective full-thickness wall area that surrounds the defect from the
four sides – two longitudinal sides and two circumferential sides. As the defect length increases, the
support provided by the thicker wall to the defective area decreases. This reduction in the support
provided by the thicker wall initially falls rapidly and then rather slowly so that in a pipeline having a
longitudinal defect of infinite length there is no support provided by the thicker adjacent wall (Freire et
al., 2006).

2
The ASME B31G considers the longitudinal corrosion defects, not accompanied by any cracking or sharp
edges, to be of two types – “short defect” and “long defect” (Figure 1a). These are defined according to:
Short Defect :L ≤ 20Dt Where: (2)
Long Defect :L > 20Dt L = Longitudinal extent of the corroded area, mm
D = Nominal outside diameter of the pipe, mm
t = Nominal wall thickness of the pipe, mm
The standard assumes that the short defect gets support from the adjacent thick walls and the long defect
behaves like an infinitely long defect which does not get any support. As a result of this assumption the
pressure strength of the pipeline initially falls continuously with an increase in the length of the defect.
When the length of the defect reaches 20Dt there is a sudden fall in the predicted burst pressure and
beyond that length there is no further fall in the predicted burst pressure (Freire et al., 2006).
On the other hand, the DNV RP-F101 has been developed using a detailed finite-element analysis. It does
not assume that beyond a certain length the defect behaves like an infinitely long defect. As a result, the
predicted burst pressure for the pipeline using the calculations based on the DNV RP-F101 does not show
the sudden change in the predicted values (DNV, 2004).
Figure 2a illustrates the predicted burst pressure for a Grade X60 (Specified Minimum Yield Strength =
414 MPa, Minimum Ultimate Tensile Strength = 517 MPa) 12¾ inch pipe having a wall thickness of 9.5
mm calculated using the ASME B31G and the DNV RP-F101. For the same pipe, Figure 3 shows the
maximum allowed corrosion depth calculated using the ASME B31G and the DNV RP-F101 for different
longitudinal extent of corrosion when the burst pressure is fixed at 20 MPa. These figures show that the
ASME B31G gives a more conservative estimate as compared to the DNV RP-F101. It is up to the user to
decide which one of the two models would be considered more appropriate for the task in hand.

3.2 Modification of the ASME B31G Using Fuzzy Logic

The assumption made by the ASME B31G regarding the sudden transition from “short defect” to “long
defect” results in an abrupt change in the prediction of burst pressure (Figure 2a). This abruptness can be
corrected by assuming that the transition from the short defect to the long defect is gradual.
In the fuzzy variation of the ASME B31G (called Fuzzy B31G in this paper), the concept has been
modified so that the sharp distinction between the long and short defects, as recommended by the ASME
B31G (Figure 2) have been disregarded. Instead it has been assumed that the “short” and “long” are
fuzzy concepts and are only a matter of degree, as shown in Figure 1b. The limits of the short and long
defects shown in the figure have been arbitrarily decided for the sake of illustration of the principle. Any
other more suitable limits can be selected.
According to the ASME B31G, the two parameters affecting the burst pressure of a corroded pipe are (a)
the factor M; and (b) the ratio  A  . These can be calculated according to the Eq. (3).

 Ao 
 1− A   Where: (3)
  A  
P = 1.1P ′  o P = Max. allowable operating pressure for corroded pipe, MPa

 1 −  A  M −1  P ' = Max. allowable operating pressure for uncorroded pipe, MPa
  Ao  
L = Longitudinal extent of the corroded area, mm
d = Depth of the corroded area, mm
D = Nominal outside diameter of the pipe, mm
t = Nominal wall thickness of the pipe, mm
(
For Short Defect L ≤ 20Dt ) (
For Long defect L > 20Dt ) For Fuzzy Model
1 1
1 1 1 1 ≥ ≥0
= = =0 2 M
M 2
M ∞  L 
 L  1 +  0.893 
1 +  0.893  A d   Dt 
 Dt  = 
Ao  t  2d  A d 
A 2d   ≤ ≤ 
=   3  t  Ao  t 
Ao 3  t 

3
FIGURE 1. Membership of short defect (L ≤ 20 Dt ) and long defect (L > 20 Dt ) according to (a) the
ASME B31G; and (b) the fuzzy logic variation of the ASME B31G (Fuzzy B31G).

FIGURE 2. Predicted burst pressure for a pipe according to (a) the ASME B31G and the DNV RP-
F101; and (b) the Fuzzy B31G and the DNV RP-F101. (Pipe specifications: Grade X60 12¾ inch pipe
having a wall thickness of 9.5 mm).

FIGURE 3. Maximum allowable corrosion depth FIGURE 4. Measured and predicted burst pressure
according the ASME B31G, the DNV RP-F101 using different models. (Data taken from Freire et
and the Fuzzy B31G (Burst Pressure = 20 MPa; al., 2006.)
Pipe specifications: Grade X60 12¾ inch having a
wall thickness of 9.5 mm).

4
In the Fuzzy B31G, the value of these parameters is defined by the membership of the “short” and “long”
defect. This manipulation allows for a smooth transition between the two types of defects.
Figure 2b illustrates the predicted burst pressure for a pipe calculated using the Fuzzy B31G and the
DNV RP-F101. The figure shows a relatively closer match between the Fuzzy B31G and the DNV RP-
F101 compared to that between the ASME B31G and the DNV RP-F101.
Using either of the three models – the ASME B31G, the fuzzy logic variation of ASME B31G or the
DNV RP-F101 – it is possible to determine the limit state of the corroded pipelines. It has been observed
that the ASME B31G gives a conservative estimate of the burst pressure; whereas the DNV RP-F101
gives a closer estimation (Freire et al., 2006). As compared to the ASME B31G, the Fuzzy B31G gives a
closer match with the actual burst pressure (Figure 4). The purpose of this exercise is to demonstrate
through an example how the fuzzy logic can be used to improve upon an existing model.

4 CALCULATION OF THE PREDICTED RATE OF CORROSION

To help the maintenance engineer predict the rate of CO2 corrosion in carbon steel pipes, a number of
semi-empirical models have been developed. Most of these models are based on the pioneering work
done by de Waard et al. (de Waard and Lotz, 1993). Based on the research, they have given correlations
for calculating the rate of corrosion based on pH, shear stress and temperature. Their work has been
extended further by a number of researchers (Singh and Markeset, 2007). NORSOK STANDARD M-506
proposes a semi-empirical model based on this work. In this paper the calculation for the predicted rate of
corrosion is based on the model given in the NORSOK M-506.

5 CONSIDERATION OF UNCERTAINTY IN VARIABLES

5.1 Probability Density Function of the Rate of Corrosion

In an actual plant the operation parameters vary to some degree, and can be considered to be random
variables. As a result, it is not possible to calculate the rate of corrosion in a deterministic way. The
probabilistic approach combines a CO2 corrosion model with the probability density distribution of the
available data regarding the structural and operation parameters to predict the probability of failure. Thus
it can take into account variations in the operating conditions, like gas-liquid flow rates, density,
viscosity, temperature, CO2 content or pressure. Hence, unlike deterministic modelling which gives a
crisp value for the rate of corrosion, this method gives the probability distribution for the rate of
corrosion.
As an example, a probabilistic calculation for a pipeline has been carried out based on the NORSOK M-
506. The data was chosen arbitrarily and the effect of corrosion inhibitor has not been taken into account.
The calculation has been carried out using the First Order Reliability Method (FORM) using PROBAN
(DNV) (Tvedt, 2006). Table 1 shows the data used for the calculation. This data includes the type of
distribution, the mean value and the coefficient of variation (COV - ratio of standard deviation and mean).
The calculation shows that for this particular example the rate of corrosion has a mean of 0.69 mm/year
and a COV of 0.53.

5.2 Possibility Distribution of the Rate of Corrosion

Fuzzy logic is a mathematical way of handling vagueness in the real world. Instead of probability density
functions, it uses membership functions of the input variables. While developing the membership
functions, a number of factors are taken into account, like the extreme values between which the values
oscillate, the expert opinion of the maintenance engineers, etc. The membership functions of the variables
can be adapted to a number of shapes, like sigmoidal, Gaussian, bell, etc., but the shape should be
justified by the available information (Ayyub and Klir, 2006; Ross, 2004).

5
 Var. Description Units Distrib. Mean Value COV
pH Normal 6 0.1
o
T Temperature C Normal 60 0.1
P Total system pressure bar Normal 20 0.1
PCO2 CO2 partial pressure bar Normal 0.1 0.1
QG Volumetric flow rate of gas m3/d Normal 200000 0.1
QL Volumetric flow rate of liquid m3/d Normal 17500 0.1
µO Viscosity of oil Ns/m2 Normal 0.0011 0.1
2
µG Viscosity of gas Ns/m Normal 0.00003 0.1
ρO Density of oil kg/m3 Normal 850 0.1
ρW Density of water kg/m3 Normal 1024 0.01
φ Water cut % Normal 10 0.5
Z Compressibility of gas Normal 0.9 0
Pipe = 12 3/4 inch Schedule 60
D Inner diameter of pipe m Normal 0.305 0.1
k Pipe roughness m Lognormal 5x10-5 1

CR Corrosion Rate mm/y Normal 0.69 0.53

TABLE 1. Variables with corresponding probability distributions used in the example.

xc = xm
x n = x m + 2.58σ for confidence level = 0.99
ε = 0.12
x ε = x m + 1.54σ

FIGURE 5. (a) Probability distribution; (b) Transformed optimal possibility distribution; and (c)
Transformed pseudo-triangular possibility distribution (Mauris et al., 2001).

In this work the aim is to compare the performance of three different methodologies for predicting the
integrity of the pipes. Hence, the input variables ( d S and d P ) need to be kept similar in all the
calculations. For this purpose the probability density function of the rate of corrosion has been
transformed into the possibility distribution function. A probability density function p ( x ) can be
transformed to a number of possibility distributions. Out of all the possibility distributions the one which
is maximally specific, i.e. the possibility distribution that most closely preserves the amount of
information of the probability distribution, is the optimal possibility distribution function.
The optimal possibility distribution is difficult to develop and work with. To overcome this problem a
simplified possibility distribution function, called truncated pseudo-triangular distribution (t.p.d.)
function, has been proposed. Figure 5 shows the general shape of the truncated pseudo-triangular
distribution function. A truncated pseudo-triangular distribution function can be characterized by four
values - ε , x c , x n , and x ε . For a normal distribution these parameters can be calculated using the
correlations given in Figure 5 (Mauris et al., 2001).

6
6 CALCULATION OF THE PROBABILITY / POSSIBILITY OF FAILURE

6.1 Corrosion Pit Depth is a Random Variable and Safe Limit is a Fixed Value

In the first case, the probability of failure is calculated in the traditional method using Monte Carlo
simulation. The calculation requires the extent of corrosion (d P ) and the maximum allowed corrosion
depth (d S ) . The probability density function of the extent of corrosion (d P ) is obtained by multiplying the
rate of corrosion (Mean = 0.69 mm/year, COV = 0.53) with time. The maximum allowed corrosion depth
(d S ) for Grade X60 12¾ inch pipe having a wall thickness of 9.5 mm, calculated according to the ASME
B31G and the DNV RP-F101, is taken from Figure 3. The calculations are carried out ten thousand times
and the number of failure events divided by the number of Monte Carlo simulations gives the
approximate probability of failure.
If in the ith Monte Carlo simulation the maximum allowed corrosion depth (d S ) is less than the predicted
corrosion depth (d P ) then the failure takes place (Fi = 1) , otherwise the operation is safe (Fi = 0) . The
probability of failure is then calculated according to:
N Where (4)
∑ F i
Pf = Probability of failure
Pf ≈ i =1

N Fi = Failure event in i th Monte Carlo test

N = Total number of Monte Carlo tests
Figures 6a and 7 show the results of the calculations. The figures show that setting the limit state based
on the ASME B31G gives a higher probability of failure as compared to the calculations carried out using
the limit start given by the DNV RP-F101.

6.2 Corrosion Pit Depth is a Fuzzy Variable and Safe Limit is a Fixed Value

The possibility theory use two different measures – possibility measure and necessity measure – for
calculating the limit state function (Eq. 1). The possibility and necessity measures describing the truth of
the proposition (d S ≤ d P ) are given by (Guyonnet et al., 1999):

Π (d S ≤ d P ) = 1 − Inf max[µ P (d ),1 − µS (d )] Where: (5)

d
Π = Possibility measure
N (d S ≤ d P ) = 1 − Sup min[µ P (d ),µS (d )]
d N = Necessity measure
µ S (d ) = Membership function of d S for any value of d
µ P (d ) = Membership function of d P for any value of d
min = Minimization operator
max = Maxmization operator
Inf = Smallest value
Sup = Largest value
The possibility distribution function of the predicted extent of corrosion (d P ) is obtained by the
methodology described in Section 5.2. The maximum allowed corrosion depth (d S ) calculated according
to the ASME B31G and the DNV RP-F101 is taken from Figure 3. The membership function of allowed
corrosion depth (d S ) can be expressed as:
1 d ≤ dS (6)
µ S (d ) = 
0 d > dS
The concept is illustrated in Figure 8. As time progresses (T1 < T2 < T3 < T4 ) the depth of corrosion
increases, with that the possibility and necessity of failure also increase.
The results of the calculations are shown in Figures 6b, 6c and 7. As the figures illustrate, the possibility
measure is less conservative than the necessity measure. The probability measure lies in between the two.

7
FIGURE 6. Likelihood of failure of a corroded 12 3/4 inch Grade 60 API 5L pipe. (a) Probability of
failure calculated using Monte Carlo simulation and the possibilistic approach. (b) Possibility of failure
calculated using the fuzzy logic approach. (c) Necessity of failure calculated using the fuzzy logic
approach.

FIGURE 7. Likelihood of failure of a corroded 12 3/4 inch Grade 60 API 5L pipe when the length of
corrosion is 500 mm. (a) Calculated using the ASME B31G. (b) Calculated using the DNV RP-F101.

Time T1 : Possibility = 0; Necessity = 0.

Time T2 : Possibility = β; Necessity = 0.
Time T3 : Possibility = 1; Necessity = (1-δ).
Time T4 : Possibility = 1; Necessity = 1.

FIGURE 8. The conceptual illustration of possibility and necessity measures.

6.3 Corrosion Pit Depth is a Fuzzy Variable and Safe Limit is a Fuzzy Variable

Under the same conditions, the DNV RP-F101 and the ASME B31G predict different limit states (Figure
9a). If the extent of corrosion lies in between the two limits it is difficult for an operator is decide whether
the pipe would fail or not. To handle such a situation the safe limit can be considered to be a fuzzy
variable. In this work it has been assumed that if the predicted corrosion depth is less than the maximum

8
allowed corrosion depth calculated according to the ASME B31G then the operation is totally safe and if
the predicted corrosion depth is more than the maximum allowed corrosion depth calculated according to
the DNV RP-F101, then the operation is totally unsafe. In between these limits is a fuzzy zone. If the
predicted corrosion depth lies in this fuzzy zone then the operation may be considered to be unsafe to a
varying degree of membership.
The membership for the degree of safety can be defined in a number of ways. In this work the
membership has been defined by linear function (Figure 9b).
1 (totally safe ) x<a (7)
 b − x
µ L (x ) =  a≤x≤b
b − a
0 (totally unsafe) x>b
Using the same concept as described in Section 6.2 and illustrated in Figure 9c, the possibility and
necessity measures are calculated. Figure 10 shows the results of these calculations. As is to be expected,
the possibility and necessity of failure for this analysis lies between the limits set by the ASME B31G and
the DNV RP-F101.

FIGURE 9. (a) Maximum allowable corrosion depth according to the ASME B31G and the DNV RP-
F101 (Burst Pressure = 20 MPa; Pipe specifications: Grade X60 12¾ inch having a wall thickness of 9.5
mm). (b) Membership for the degree of safety defined by the ASME B31G, the DNV RP-F101 and the
linear function. (c) The conceptual illustration of possibility and necessity of failure when the safe limit is
a fuzzy variable.

FIGURE 10. Likelihood of failure of a corroded pipe when the degree of corrosion and the safe limit are
fuzzy variables. (a) Effect of time and corrosion length on the likelihood of failure. (b)-(c) Effect of time
on possibility and necessity of failure when the transverse length of the corrosion pit is 500 mm. (Burst
Pressure = 20 MPa; Pipe specifications: Grade X60 12¾ inch having a wall thickness of 9.5 mm)

9
7 CONCLUSIONS

The calculations of the integrity of corroded oil and gas pipes are fraught with imperfections arising due
to (a) lack of precise and certain data; and (b) use of imperfect models. The structural reliability analysis
is a common way of dealing with the uncertainties arising due to the used data. This paper presents an
alternative approach based on fuzzy logic for handling the uncertainties arising during the calculation of
the burst pressure of corroded pipes. The possibilistic approach offers two different measures – possibility
and necessity – for deciding the likelihood of failure. Compared to the probability, the possibility and
necessity measures are respectively more and less conservative in their estimation of the likelihood of
failure. Thus possibility measure may be a useful tool for implementing the philosophy of zero-tolerance
of accidents where not only the probability but also any possibility of failure has to be eliminated. On the
other hand, the necessity measure may be used when the pipe can be used until failure. The suitability of
each of these techniques should be decided by the maintenance engineer objectively, taking into
consideration the requirements of the maintenance strategy.

ACKNOWLEDGEMENT

The authors are grateful to Ole Jørgen Melleby and Ole Tom Vårdal, AGR EmiTeam (www.agr.no), for
their guidance and support.

REFERENCES

1. Ahammed, M. (1997), “Prediction of remaining strength of corroded pressurised pipelines”,

International Journal of Pressure Vessels and Piping, Vol. 71, pp. 213-217.
2. ANSI/ASME (1991), ASME B31G-1991: Manual for determining the remaining strength of
corroded pipelines, The American Society of Mechanical Engineers.
3. Ayyub, B.M. and Klir, G.J. (2006), Uncertainty Modeling and Analysis in Engineering and
Sciences, Chapman & Hall/CRC Press, Boca Raton.
4. de Waard, C. and Lotz, U. (1993), “Prediction of CO2 corrosion of carbon steel”, Proceedings of
the CORROSION '93, NACE International, Paper No. 69.
5. Det Norske Veritas (DNV) (2004), Corroded Pipelines, Recommended Practice DNV-RP-F101,
DNV, Høvik, Norway.
6. Freire, J.L.F., Vieira, R.D., Castro, J.T.P. and Benjamin, A.C. (2006), “Burst tests of pipeline with
extensive longitudinal metal loss”, Experimental Techniques, Vol. 30, No. 6, pp. 60-65.
7. Guyonnet, D., Come, B., Perrochet, P. and Parriaux, A. (1999), “Comparing two methods for
addressing uncertainties in risk assessments”, Journal of Environmental Engineering, Vol. 125,
No. 7, pp. 660-666.
8. Mauris, G., Lasserre, V. and Foulloy, L. (2001), “A fuzzy approach for the expression of
uncertainty in measurement”, Measurement, Vol. 29, pp. 165-177.
9. Melchers, R.E. (2001), Structural Reliability Analysis and Prediction, John Wiley & Sons.
10. NORSOK Standard M-506 (2005), CO2 corrosion rate calculation model, Standards Norway,
Lysaker, Norway.
11. Ross, T.J. (2004), Fuzzy Logic with Engineering Applications, 2nd edition, John Wiley & Sons
Ltd.
12. Singh, M. and Markeset, T. (2007), “Risk analysis of oil and gas pipelines subjected to CO2
corrosion”, Proc. ESREL 2007, Safety and Reliability Conference, Stavanger, Norway, 25-27
June, 2007, pp. 1991-1999.
13. Tvedt, L. (2006), “Proban - probabilistic analysis”, Structural Safety, Vol. 28, pp. 150-163.

10