Criteria for Risk

Comparative Criteria

Especially where quantitative acceptable risk criteria are not available, comparative risks are used to help judge acceptability. See examples and related discussions of risk comparisons and voluntary versus involuntary risks in PRMM.

Also relevant is the implied level of acceptable risk based on pipeline industry standards and regulations. As a comparison metric, these implied values can be used to suggest acceptability of risk. This is discussed in the next section of this chapter.

Changes in risk level also use comparisons—sometimes to emphasize a bias or position for or against some endeavor that generates the risk. For example, a change in risk from 5e-8 probability of fatality per year to 10e-8 probability of fatality per year can be described as either:

A doubling of risk.

OR

A minor, insignificant increase in risk.

Both may be technically correct but send dramatically different messages to an audience. Similar examples to suggest noteworthy or, alternatively, insignificant im­provements in safety by the employment of new mitigation measures are common in debates over acceptable risk levels.

Numerical criteria

A numerical risk criterion is sometimes used at a decision point for risk management. Examples of specific criteria, usually used by regulatory agencies and expressed in terms of acceptable annual chances of fatality, are sometimes used as actionable limits—“a risk above this line requires action; below the line is ‘safe enough’.” For those wishing safety levels beyond regulatory minimum compliance levels that use such numerical criteria, it might be a starting point from which detailed risk management can begin. Note that a numerical criteria for acceptable pipeline risk is often based on length, consistent with the definition of individual risk discussed earlier. This is logical since a long pipeline, while possibly exposing many receptors, does not increase the exposure to a given receptor due to its length. A criteria that does not consider this would make a criteria impossible to meet for a very long pipeline. If criteria is based on unit length, then it must consider a very small unit length, e.g. inch, cm, mm, failure potentials. Otherwise, small but critical features can be masked by nearby very safe segments. Imagine an ILI-detected anomaly, only one mm in length but very deep, with failure imminent. If this is an isolated pit, the neighboring joints of pipe might be defect free for many meters and readily meet acceptable risk criteria. A per-km risk criteria could show acceptable risks despite the defect, due to its length contribution being so small, if an inappropriate risk aggregation strategy was used. A full and proper aggregation would ensure that the one mm feature results in an unacceptable per-km risk rate.

Data-based criteria

Rather than an overall criteria for ‘actionable’ levels of risk, the analysis of values from a specific risk assessment can lead to the establishment of action triggers. This includes reactions to outliers and continuous-improvement approaches, both of which react to results from specific assessments. A prudent philosophy to risk management may lie in continuous improvement but will also need to be supplemented by predetermined strategies that are at least loose­ly based on acceptability criteria. The operator can always be seeking risk reduction opportunities at all locations. However, for consistency and defensibility, the degree and speed with which risk reductions occur should be driven by pre-established trig­ger points (criteria), to ensure a predominantly ‘continuous improvement’ strategy is indeed reducing risks.

ALARP

 

The concept of “as low as reasonably practical” (ALARP) is an example of such a linking and is widely recognized among risk assessment and risk management practi­tioners. The ALARP principle generally requires facility owners to adopt all safety mea­sures up to the point where the cost of the safety measure is “grossly disproportionate” to the risk reduction. Even though quantitative criteria are used, the application of ALARP has a qual­itative aspect to it. There are references that seek to quantify aspects such as ‘grossly disproportionate’ that are embedded in the ALARP definition.

Example:

Consider a catastrophic pipeline accident involving the death of two individuals and the loss of the pipeline with an estimated event frequency of 10e-5 per mile-year. The threshold for disproportionate cost, using a disproportionality factor, is illustrated as follows:

The values and units in this example are:

• • • 10e-5 accidents of this type per mile per year
    • 58 miles length of pipeline
    • $10M cost of fatality
    • 2 person fatality per accident
    • 6 is disproportionality factor, based on some guidance documents suggesting factors between 2 and 10
    • $1.5M additional cost per accident for other losses

(10e-5 × 58) accidents/year × ($10,000,000 × 2 + $1,500,000)/accident × 6 = $75,000/year = maximum reasonable expenditure to bring risk down to nearly $0/yr.

In this example, $21.5M is the cost of an accident of this type; $12,500 is the annual risk from an accident of this type; and the $75,000/year value is a theoretical maximum amount to be spent to reduce the chance of that accident. This is heavily influenced by the disproportionality factor.

This threshold concept for disproportionate cost can be thought of in the following way: If it is pos­sible to take some action that will reduce the risk of the accident by 1$/yr at a cost of less than $6/year then, before the risk can be declared ALARP, that action must be taken. It may be possible to reduce the risk for much less but the owner/operator should be willing to spend up to $6/yr to avoid each $1/yr of risk.

Alternatively, it may not be possible to significantly reduce the risk without spending vast amounts of money—in excess of the disproportionality-factor-adjusted maximum of $75K/year to remove almost all of the risk.

Once every action that is not disproportionate in cost/benefit is taken, the risk would be determined to be ALARP and additional spending to reduce it is not warranted.