Summary: Every number on a penstock drawing is a pressure, and every one of them points the same way. The wall is sized by hoop stress, tested at a multiple of the design pressure, and inspected for leaks that come outwards. The load that collapses penstocks arrives from the other side, arrives when the pipe is empty, and is worth about one atmosphere. The reason it wins is that the resistance to internal pressure grows with the thickness to diameter ratio and the resistance to external pressure grows with its cube, so a wall can be fifty times stronger one way than the other. Worked through, that produces a crossover head of about 1.25 metres for every megapascal of allowable stress, a figure that turns out to be independent of the pipe diameter and therefore the same for a two metre pipe and a five metre one.

 

1. The Quantity a Penstock Exists to Hold

A penstock is the pressure conduit that carries water from an intake to a turbine, and it is the only structure in this series whose output is measured in megawatts. That framing is misleading in a useful way. The energy comes from the head and the discharge, but the pipe contributes neither of them. Its structural purpose is narrower: to hold a pressure difference without changing shape. Every number on a penstock drawing is written in that currency.

The contrast with a gravity conduit is worth stating, because it decides which dimension the designer spends time on. A culvert is designed by its slope, because the water has nothing but its own weight to move it and a few millimetres of fall per metre decides whether the pipe clears itself. A measuring weir is designed by its crest, because the crest is the zero of the head scale. A penstock is designed by its wall, because the reservoir does the pushing and the pipe can go wherever a surveyor can find a route.

That is close to literally true. The friction slope inside a penstock is a small fraction of the slope of the ground it crosses, and the table below puts the two side by side for four installations of increasing size.

Installation	Velocity	Friction slope	Slope of the ground	Friction as a share of it
2.5 metre pipe, 45 cubic metres per second	9.17 metres per second	2.06 percent	38.9 percent	5.3 percent
3.0 metre pipe, 60 cubic metres per second	8.49 metres per second	1.47 percent	50.0 percent	2.9 percent
3.5 metre pipe, 70 cubic metres per second	7.28 metres per second	0.93 percent	50.0 percent	1.9 percent
4.5 metre pipe, 110 cubic metres per second	6.92 metres per second	0.65 percent	42.9 percent	1.5 percent

The table is worth reading twice. In every one of those cases the pipe is losing roughly one twentieth of the head it falls through, and in the largest case roughly one fiftieth. A penstock laid at its own friction slope would be almost flat. So the alignment is chosen by the ground, the access road, the property boundary and the cost of the supports, and the hydraulics only veto the route after it has been chosen for other reasons.

There is a reason the profile can be treated this way, and it is worth stating because it explains why no tolerance is ever derived for it. The static head available at the turbine is a difference between two levels, the reservoir surface and the tailwater. A difference has exactly two arguments. Everything the pipe does between them changes the losses and nothing else, so the route between the endpoints is free in the only currency the energy equation reads.

The energy equation makes the same point in a different form. The power delivered is the density of water times gravity times the discharge times the head times an efficiency, and the head in that expression is the difference of levels minus the friction loss. Since the friction loss is a few percent of the difference, as the table shows, a route that doubles the friction slope changes the output by a few percent. A route that adds a kilometre of pipe costs a great deal more steel than it costs energy.

Two consequences follow and they pull in opposite directions. The generous one is that a penstock has no capacity objection to a change of profile, which is why the route can follow the cheapest ground and the supports can sit where the rock is. The constraining one is that a dimension no calculation reads is a dimension no calculation protects.

2. The Only Rule That Reads the Profile

There is exactly one published rule that treats the profile as a design deliverable, and it is not a stress check. It is a valve placement rule, and it appears in the same short paragraph as the instruction for drains.

Guidance for small hydro installations published by the US Department of Energy states it plainly. At any point on the penstock where a high point exists, that is, where the pipe has an upward slope, an air release valve should be installed. Similarly, a drain must be installed at any low point.

The inspection side of the same subject says it from the other end. Standpipes and vent pipes are usually located at high points along the penstock profile and immediately downstream from gates, and they should provide an unrestricted air inlet or air release to the penstock. Then comes the sentence that makes this article necessary: malfunctioning of these air valves could result in penstock rupture.

Notice what the rule actually needs. It needs a local maximum, which is a statement about slope, not about elevation. An air valve belongs at the point where the slope of the pipe passes through zero. That is a geometric condition, and a geometric condition is the only kind of condition an angle sensor can see at all.

The consequence of a misplaced valve is easy to state and hard to see. If the true high point sits above the valve, the pocket forms above the valve and the valve sits below it, full of water and shut. An air release valve is built to pass air and to seal against water, so a valve under a pocket does the one thing it is designed to do and nothing else. The air stays where it is, and the record shows a valve that is working.

But the rule arrives with no tolerance attached. Nowhere in it does anyone say how far the high point may move before the valve stops being at the high point. The pipe is described by a configuration, not by a limit, and a configuration is what a drawing records and an inspection compares against. Nothing in the published chain converts that configuration into a number that could be watched between inspections.

The drain half of the same rule carries an inspection consequence, and it is the only part of this chain that has one. Penstock dewatering drains are typically at low points, and they must discharge water away from the pipe so that dewatering does not undermine the foundation. So the rule that reads the profile also creates a maintenance obligation at the exact point where the foundation is most likely to be disturbed.

3. Two Strengths in One Wall

A penstock wall is asked to hold pressure from the inside and to resist pressure from the outside, and the two are not the same problem with a sign changed. They are different failure mechanisms, and they scale differently with the only dimension that can be varied.

From the inside, the wall works as a membrane. The hoop stress is the pressure times the diameter divided by twice the thickness, so the pressure the wall can carry is twice the allowable stress multiplied by the thickness to diameter ratio. The relationship is linear, and it is the one every penstock calculation performs.

From the outside, the wall works as a shell, and a shell under uniform external pressure does not fail by stretching. It fails by buckling, at a pressure proportional to the cube of the same ratio. The standard thin shell expression for a long unstiffened cylinder is two times the modulus of elasticity, divided by one minus the square of the Poisson ratio, multiplied by the cube of the thickness to diameter ratio.

Two exponents, one wall. The table below puts the two capacities side by side at a single allowable stress, so that the only thing varying down the rows is the geometry.

Diameter to thickness ratio	Thickness to diameter ratio	Pressure held from inside	Pressure resisted from outside	Ratio of the two	Outward capacity in atmospheres
80	0.01250	8.88 megapascals	859 kilopascals	10.3	8.47
100	0.01000	7.10 megapascals	440 kilopascals	16.2	4.34
125	0.00800	5.68 megapascals	225 kilopascals	25.2	2.22
163	0.00613	4.36 megapascals	101 kilopascals	42.9	1.00
200	0.00500	3.55 megapascals	55 kilopascals	64.6	0.54
250	0.00400	2.84 megapascals	28 kilopascals	101.0	0.28
400	0.00250	1.77 megapascals	7 kilopascals	258.4	0.07

The last two columns are the argument. At a ratio of one in eighty the wall is ten times stronger inward than outward. At one in four hundred it is two hundred and fifty eight times stronger inward. Nothing about the steel changed between those rows. Only the ratio changed, and the two capacities moved apart by a factor of twenty five.

This is why a single sentence cannot describe a penstock wall, and why the phrase strong enough has to be followed by a direction. It also explains a family of design habits that otherwise look arbitrary. Minimum plate thickness rules, stiffener rings and the ring girders at each support are not there because the hoop calculation was wrong. They are there because the hoop calculation does not describe the other direction at all.

The support is where the two mechanisms meet, and it is worth naming the hardware. A saddle carries the lower part of the circumference in contact with concrete. A ring girder carries the pipe on a steel ring with the reaction taken at two points. Stiffener rings are welded around the circumference to stop the shell from ovalising where the load enters. Each of those is a local structure with its own stress concentration, and each is chosen by the erection and support calculation rather than by the pressure calculation. That seam is what this article is about.

4. The Head at Which One Atmosphere Wins

The number that matters is the ratio at which the outward capacity falls to a single atmosphere. Set the ideal shell expression equal to 101,325 pascals and the answer is a thickness to diameter ratio of 0.006131, which is a diameter to thickness ratio of 163.

That number is more robust than most design constants. Changing the modulus of elasticity across the range used for structural steel, from 180 to 210 gigapascals, moves it only from 158 to 166. A spread of five percent across the whole family of steels means the result is not an artefact of a chosen material property, which is unusual for a figure derived from an elastic formula.

It becomes a design figure only after a margin is applied, and the margin is a decision rather than a calculation. The table states the ratio that each factor implies, with no further interpretation attached.

Factor applied to one atmosphere	Diameter to thickness ratio required	Thickness to diameter ratio required
1.0	163	0.00613
1.5	142	0.00702
2.0	129	0.00773
2.5	120	0.00832

One caveat has to be attached, and it points the wrong way for the designer. The ideal shell expression assumes a perfect cylinder. Real shells carry out of roundness from rolling, misalignment at the longitudinal seam, residual stress from welding, and the local stiffness of every manhole, nozzle and piezometer boss. All of those reduce the buckling pressure and none of them appears in the formula. So 163 is the optimistic end of a range, and a real pipe passes the same test at a lower ratio than the algebra suggests.

It is fair to ask why a formula with a known optimistic bias is used at all. The answer is that the bias is nearly constant and the scaling is not. An imperfection factor of one half moves the conclusion by a factor of 1.26 in the ratio, because the cube root of two is 1.26. It does not change the fact that the capacity varies with the cube of the ratio, and it is the cube that produces every number in this article. A designer who applies a margin to a formula with the right exponent is doing something defensible. A designer who applies no margin to a formula with the wrong exponent is not.

Put the two together and the title of this article stops being a figure of speech. At a diameter to thickness ratio of 142, which is the ratio a factor of 1.5 on one atmosphere implies, the ideal expression gives the wall an outward capacity of 1.50 atmospheres and a hoop capacity of 49.2 atmospheres. The same wall holds about fifty times as much pressure from inside as from outside. Now apply the imperfection factor to the outward side, because the outward side is the one the imperfection governs, and 1.50 becomes 0.75. The wall built for fifty is broken by one.

Which means the honest reading is this. Above a diameter to thickness ratio somewhere below 163, one atmosphere is enough to collapse an unstiffened steel shell, and the calculation normally performed on a penstock does not ask the question. It computes the hoop stress, compares it with an allowable, and stops.

5. Why the Exposure Sits at the Top of the Pipe

A penstock is not a constant thickness pipe. The wall is thick at the bottom where the static head is greatest and thin at the top where it is smallest, and on a long installation the thickness is stepped along the length so that each plate carries a similar stress. The ratio of diameter to thickness is therefore not a property of the pipe. It is a function of position, and it is largest where the wall is thinnest.

Size a wall on hoop stress alone, at an allowable of half the yield strength of the steel, and then ask what that wall leaves for the vacuum case. The table does the arithmetic for seven points along the taper.

Static head at that point	Pressure	Thickness to diameter ratio required by hoop stress	Diameter to thickness ratio	Capacity against one atmosphere	Outcome
50 metres	0.49 megapascals	0.00138	724	0.01	Collapses
100 metres	0.98 megapascals	0.00276	362	0.09	Collapses
150 metres	1.47 megapascals	0.00415	241	0.31	Collapses
200 metres	1.96 megapascals	0.00553	181	0.73	Collapses
250 metres	2.45 megapascals	0.00691	145	1.43	Survives
300 metres	2.94 megapascals	0.00829	121	2.47	Survives
500 metres	4.91 megapascals	0.01382	72	11.44	Survives

The crossover sits between 200 and 250 metres. Below that head, the wall that hoop stress asked for cannot hold one atmosphere on its own. Above it, the wall is thick enough for the vacuum case as a byproduct of being thick enough for the pressure.

The algebra behind that figure is short enough to write out, and it produces the most transferable result in the article. The thickness to diameter ratio required by hoop stress is the pressure divided by twice the allowable. The pressure is the density of water times gravity times the head. Substituting into the shell expression and setting the result equal to one atmosphere gives a head of twice the allowable stress divided by the specific weight of water, multiplied by the cube root of one atmosphere divided by the coefficient in the shell expression.

That cube root is 0.006131, and the diameter has cancelled out of the expression entirely. What is left is a rule with the dimensions of a length per unit of stress: 1.25 metres of head for every megapascal of allowable stress. A two metre pipe and a five metre pipe have the same crossover head, because both of them need the same ratio of thickness to diameter and both of them are sized against the same pressure.

The consequence is a specific claim about where a penstock is exposed, and it is not where an inspector would look first. For any penstock, the portion lying shallower than that head has a wall that one atmosphere can buckle. That portion is the top of the pipe, which is at once the part carrying the lowest pressure, the part built from the thinnest plate, and, by the rule in the second section, the part where the air valves are.

The other end of the same taper deserves a sentence, because it is the case that actually bites. A large diameter pipe at low head is the geometry with the worst ratio in the whole installation. A six metre penstock at 40 metres of head needs a thickness to diameter ratio of 0.0011 for hoop stress, which is a diameter to thickness ratio near 900, and the shell expression gives that wall a capacity against one atmosphere of well under one percent of one atmosphere. Minimum plate thickness rules help a little and nowhere near enough. That geometry is held up by stiffeners, not by plate.

6. The Load Arrives When the Pipe Is Empty

The vacuum case is not a design condition in the ordinary sense, because it does not occur at maximum load. It occurs at zero load. Dewatering sets the internal pressure to nothing and leaves the outside at one atmosphere, and it is the only routine operation on a penstock that reverses the sign of the pressure difference across the wall.

The inspection guidance names the mechanism without hedging. A clogged vent line, or a closed valve on the vent line, at the upstream end of the penstock, can produce excessive negative internal pressure when the pipe is dewatered, and that may collapse or buckle the penstock.

It names a second mechanism that is less obvious. If the grout curtain at the upstream end is not completely effective, or if the penstock leaks, water pressure can build up behind a tunnel liner or a buried penstock, and it can become high enough to buckle the pipe after dewatering. The recommendation in that case is to dewater slowly, so the external pressure has time to fall before the difference across the wall becomes critical.

Neither of those authors is the reservoir. One is a valve that should be open and is not. The other is groundwater that nobody measured. Both are ordinary states of a plant that is otherwise working as intended, and both are invisible in a stress calculation, which is why neither of them appears in the design report.

The maintenance literature adds the ways in which a valve stops being open, and all of them are ordinary. Standpipes and vent pipes should be inspected for ice blockage in cold climates. Air and vacuum valve assemblies should be checked for obstruction, for restriction, for leakage and for correct operation, and where heaters are fitted they should be working. Mineral deposits and debris accomplish the same thing more slowly. None of those is a design error, and none of them appears in a calculation.

The hardware question is a sizing question, and the published answer is a table that maps the flow the pipe carries to the diameter of the valve.

Air valve diameter	Penstock flow it covers, cubic feet per second	The same in litres per second	Flow per inch of valve
1 inch	4	113	4.0
2 inch	8	227	4.0
3 inch	15	425	5.0

It is worth being precise about what that rule does. It sizes the air valve from the flow the penstock carries in service, which is the quantity the designer already has. It does not size the valve from the rate at which the penstock empties, which is the quantity that decides whether the vacuum forms faster than the air can arrive. The two rates are related, but they are not the same rate, and only one of them appears on the equipment schedule.

There is one more piece of hardware in the chain and it deserves naming, because it is the most likely point of failure. Air and vacuum relief valves are normally equipped with a shutoff valve so that they can be isolated and serviced. That is the right arrangement for maintenance, and it creates a state in which a correctly specified, correctly installed, perfectly functioning air valve is not connected to the penstock at all.

The volume involved is worth holding in mind while that is read. A 3.5 metre penstock 800 metres long holds 7,697 cubic metres of water, and every one of those cubic metres has to be replaced by air before the pipe is empty. The replacement has to happen through a connection that was sized against the flow the pipe normally carries.

So the chain has a gap in it that is structural rather than accidental. The valve is chosen by the flow, placed at the high point by the rule in the second section, and thereafter maintained by opening it and listening. Nothing in that chain produces a number for the pressure difference the wall can survive when the valve is not open.

7. The Case That Already Happened

The argument becomes concrete in a case that is old, well documented, and taught in the hydraulic transients literature, which is a useful place for it to be, because the numbers line up with the formula rather than with intuition.

Oigawa, on the Oi river, was a 72 megawatt station commissioned in 1936, with three Francis units and three penstocks 250 metres long and 2.75 metres in diameter, downstream of a surge tank.

A sequence of wrong manoeuvres and equipment malfunctions ruptured an eight metre length of one penstock by overpressure. The rupture sent a negative pressure wave along the pipe, and the vacuum that followed collapsed 53 metres of it.

The plate in the collapsed length ran from 8.9 to 14.0 millimetres, which is a diameter to thickness ratio of 309 down to 196. The table converts each of those into what the ideal shell expression says it could resist.

Plate thickness in the collapsed length	Diameter to thickness ratio	Capacity against one atmosphere	Verdict
8.9 millimetres	309	0.15	Fails
11.9 millimetres	231	0.35	Fails
14.0 millimetres	196	0.57	Fails

Every thickness in that range had an outward capacity below one atmosphere, and the thickest part of the section that failed had 0.57 of an atmosphere of resistance. The atmosphere did not need any help from the pressure wave. It only needed the wave to remove the water that had been holding the wall out.

Two more numbers come out of the same case. The collapsed length was 53 metres against a diameter of 2.75, so the length to diameter ratio was 19.3. The critical ratio for that geometry, the point above which a cylinder behaves as a long shell rather than a short one, is about 16.5. The collapse ran well past it, which means the shell behaved as a long cylinder, and the stiffeners fitted to the thinner part of that length were spaced too far apart to change the mode.

That is the design variable that never appears in a vacuum calculation: stiffener spacing. It is chosen for handling, for the ring girder at each support and for erection. It is also the number that decides whether the shell buckles as a long cylinder or a short one, which decides which exponent applies. A spacing chosen for reasons of fabrication sets a failure mode chosen by nobody.

What the case fixes is the shape of the answer rather than a number. It shows that the failure did not require a large pressure wave. It required a wave that emptied a length of pipe, after which the atmosphere did the work over a distance set by how far apart the stiffeners were. A designer reading it today would take away one question: at the thinnest point of the taper, what is the spacing between stiffeners, and is it shorter than the critical length for that ratio.

8. The Test That Loads the Other Direction

A penstock is pressure tested before it enters service, at a multiple of its design pressure. The common figures are 1.25 and 1.5. The test is a real test: the pipe is filled and vented, brought up slowly, held, and inspected for leakage and for permanent deformation.

It tests exactly the direction the pipe is designed for. The wall is in hoop tension, the pressure is above the working value, and the acceptance criterion is that nothing leaks and nothing yields. A pass certifies the membrane, and the membrane is the mechanism that every calculation on the project has already worked through.

It cannot test the other direction, and not because the test is badly run. During the test there is water inside at pressure and atmosphere outside, which is the service condition with a margin on it. To test the vacuum case a project would have to empty the pipe and hold a partial vacuum inside it, and no commissioning schedule does that, for the good reason that the test itself would be the accident.

There is an irony in the test worth one paragraph. Filling a penstock for a hydrostatic test requires the air to leave, and the acceptance criteria assume that it has. Trapped air gives a compressible cushion, an unstable gauge reading and a slow decay that can be mistaken for a leak. So the test depends on the same air path that the vacuum case depends on, and a commissioning team that vents properly is exercising it. What that proves is that the path was open on the day of the test. It says nothing about the state of the path five years later.

Three asymmetries follow. The test happens once and the vacuum case recurs, because every unit taken out for maintenance is emptied. The test measures a pressure and the vacuum case is decided by a valve position, one a number and the other a state. And the test carries an acceptance criterion written into a procedure, while the vacuum case carries none, because the condition is not in the design basis to begin with.

None of that makes the hydrostatic test wrong. It makes it a test of one load path on a structure that has two, and the second path has no acceptance criterion at all.

9. What an Angle Channel Can and Cannot Certify

At this point the question a monitoring article has to answer is what an angle sensor contributes, and on a penstock the honest answer is narrower than a product page would like.

It does not watch the shell. There is nothing angular about a wall thinning, a stuck air valve, a vacuum event in progress, or a stiffener spacing that is too wide. A tiltmeter placed anywhere on a penstock is blind to all four, and an article that claimed otherwise would be describing a different instrument.

What it can watch is the foundation, and the foundation is where the published inspection guidance already points. Concrete saddles should be checked for any sign of settlement. Anchor and thrust blocks should be examined for settlement, movement, and any cracking or spalling of the concrete.

The saddle is the better of the two, because it has a geometry that a rotation changes. It supports the lower 120 degree arc of the pipe, and the stress concentration sits at the tip of the saddle, where the shell stops being supported. That is the origin of the horn stress the same guidance names. A saddle that rotates does not simply lower the pipe; it moves the point at which contact ends, and localised buckling or distortion can appear at the upper contact points.

The anchor block is the other end of the same problem, and its published criteria are not angles at all. It is checked against sliding, where the sum of the horizontal forces must stay below the friction coefficient times the sum of the vertical forces, and against overturning, where the resultant must stay inside the middle third of the base. It is designed not to move, and the forces it holds are large. At 400 metres of head on a 3.5 metre pipe, a bend of 60 degrees produces 37.8 meganewtons, which is about 3,850 tonnes.

What a block produces when it does move is a length, and that length has a budget. An expansion joint between two anchors has a travel set by the thermal movement of the pipe between them: 30 metres of steel at a swing of 40 kelvin wants about 14 millimetres. A block that creeps a few millimetres spends part of that budget, and joint misalignment is one of the causes the inspection guidance lists for the leakage that is the main problem with these joints.

So the defensible scope for an angle channel on a penstock is the supports and the blocks, continuously, between inspections, and the claim it supports is about the ground under them rather than about the steel above them.

Practically, that means the mounting points are decided by the support schedule rather than by the pipe. On a saddle supported installation the useful positions are the saddles themselves, because a rotation there is the mechanism the guidance warns about. On a ring girder installation the useful positions are the girders. On the blocks, the useful position is the block and not the pipe, because the block is the element that is designed not to move and is therefore the element whose movement means something.

One boundary deserves stating plainly, because the numbers in this article make it easy to overstate. A tilt channel cannot see a vacuum event. The event lasts seconds and it leaves the pipe either round or not round, with nothing in between for a low frequency instrument to observe. What the channel can do is record the movement that made the ground under a saddle or below a block give way, which is upstream of the event rather than inside it. That is a defensible thing for an instrument to do, and it is a smaller thing than monitoring the penstock.

 

Frequently Asked Questions

1. Can a tilt sensor detect a penstock vacuum collapse? No. The collapse is a shell event that lasts seconds and is decided by whether a valve is open. The channels for it are pressure, air valve condition and internal inspection. A tilt sensor belongs to the foundation, where it can record settlement under a saddle or below an anchor block, and to the profile, where it can record what the pipe looks like after the event.
2. How thin can a penstock wall be before one atmosphere matters? Set the ideal shell expression equal to one atmosphere and the answer is a diameter to thickness ratio of 163 with no margin, 142 with a factor of 1.5 and 129 with a factor of 2. Real shells buckle below the ideal value because of out of roundness and weld misalignment, so treat those figures as upper bounds. Stiffeners at a spacing shorter than the critical length change the mode and raise all three.
3. Why is the upper part of a penstock more exposed than the lower part? Because the wall is tapered with the head. Below a head of about 222 metres, a wall sized on hoop stress at half the yield strength leaves less than one atmosphere of buckling resistance. That head scales with the allowable stress rather than with the diameter, so it moves with the grade of steel and not with the size of the pipe.

4. Does passing the hydrostatic test mean the pipe is safe when it is emptied? No. The test loads the wall in the direction the reservoir loads it, with pressure inside and atmosphere outside, and that is the direction every calculation has already checked. It cannot reproduce a case in which the inside pressure is gone and only the outside one remains, because during the test the pipe is full. It also happens once, while the vacuum case happens every time the unit is dewatered.

---