Pipeline risk assessment tutorials
In this section three case studies will be used to illustrate the methodology to calculate the probability of failure (PoF) for Incorrect Operation (IO), Internal Corrosion (IC) and External Corrosion (EC)
Content
Probability of failure for Incorrect Operation (IO) 2
Probability of damage (PoD) and probability of failure (PoF) 5
Risk control/mitigation scenarios 6
Objective
To identify and quantify the benefits of training operational staff to reduce errors associated to Incorrect Operation to support decision making to train, replace or relocate personnel responsible for pipeline operation. In addition, the analyst will appreciate the importance of having updated and certified procedures on site to ease operation and maintenance activities
Probability of failure for Incorrect Operation (IO)
The risk associated with this threat is independent of time and involves the human factor (Identification of potential threats). In the industry in general 80% of unwanted events are caused by human errors. Pipeline operator’s efficiency depends on experience, training, and availability of updated and written procedures, among others. This tutorial will allow to appreciate the influence of specific mitigation actions in exposure levels in a pipeline caused by IO through the analysis of some scenarios aimed to operational staff
First, it is important to identify the risk drivers and nature for a threat of failure related to Incorrect Operation (IO event tree). Secondly where in the pipeline there is direct human intervention that may trigger any malfunctioning or errors (Pipeline deployment)
An important thing in this exercise is to be aware that the human factor is complex to evaluate in terms of risk to determine a probability of failure figure that expresses whether the operator needs to reinforce some aspects of the operational staff. In fact, simulating different coverage in operators training does not provide a significant exposure reduction to IO. However, combining training coverage with available and updated procedures there is bigger reduction to exposure for incorrect operation
Risk assessment sequence
Based on available information, values must be assigned to the different exposure variables. For those variables where information is not available values will be assumed. In this case the concept of “effective zero” is introduced to establish a lower limit to use in the calculations. This concept contributes to defining the level of conservatism and uncertainty in the assessment. For this tutorial, a P50 approach is considered
A simple format helps to obtain the initial information of the pipeline case (Data sheet):
Case study description
It is a pipeline constructed in 1979 that has 8” diameter and a nominal wall thickness of 0.188” in its first segment and 0.260” in its second segment. The pipeline was constructed with a steel specification of API 5L X52. The total pipeline length is 70.036 kilometers. The pipeline runs in a ROW with high activity of sabotage and vandalism, however, there is few attacks on the pipeline related with this threat
Exposure
Refers to the level of vulnerability of a pipeline segment to the attack from a potential threat. No mitigation measures are provided to obtain a pure value of exposure to active mechanisms of failure
- The first level of the assessment is defined by the input variables where specific attributes are chosen in terms of information available, SME contribution or default values
Make sure all assumed or non-documented information is easily identified and trackable to consider further reassessment. To select operational values do not think in the worst condition which is probably quite improbable to occur. Bear in mind when a conservative condition is selected the associated risk condition will result over estimated
- Second level is for all variables interactions according to the risk methodology (algorithm)
- Finally, the third level takes the results from variables interaction to calculate the exposure to failure for incorrect operation
For this exercise 3 of 9 variables did not have information validated through documented evidence (Uncertain), so they were assumed for the assessment
Mitigation
The calculation sequence to estimate mitigation effectiveness follows the same logic as shown above for the exposure component. Mitigation values are assigned to each variable of this group considering:
- Personnel: it is regarded as an AND Gate since training and position rotation may happen and both affect in different ways the effectiveness of mitigation (could result low or high based on the combination)
- Procedures are also an AND Gate since they require two variables combining: updated and available
- Health is an OR Gate because variables involved contribute independently to reduce the exposure to incorrect operation failures
- System is an OR Gate since any variable represents a mitigation measure that independently may contribute to mitigate incorrect operation exposure
- Quality and maintenance are also a OR Gate for their independent contribution as a mitigation measure. Although these variables contribute individually, they consider several attributes that are aimed to a common purpose
The mitigation combines AND & OR Gates which means any of them may have less representative contribution. In other words, mitigation related to personnel is the main source of mitigation and procedures are complementary. This means that having several mitigation measures are ineffective with inadequate staff or obsolete procedures, plus health, quality and system issues having influence in the actual mitigation value
The mitigation obtained provides a value of probability of damage (PoD), where the pipeline resistance is not included in the risk equation
Some important aspects to consider when selecting and assigning a mitigation value to reduce IO exposure:
The effectiveness of each mitigation measure should be assessed individually and combined with other measures to reinforce the effectiveness to reduce exposure. All mitigation measures must be selected accordingly to the potential mechanisms and threats of failure identified for a specific pipeline. For instance, applying ILI to detect metal loss and repairing critical defects provide a good reduction in exposure to external and internal corrosion impact (W. K. Muhlbauer Enhanced Pipeline Risk Assessment – Rev. 4)
Mitigation measures should consider:
- Acting independently or combined with others to reduce exposure to mechanisms or threats interacting
- Failure potential reduction expected – risk reduction worth
- Mitigation purpose: avoid, contain, restrain, isolate, etc
If mitigation is very efficient the PoD value is expected to low since exposure levels may be reduced to a minimum
Resistance
- This component refers mainly to the pipeline material condition and completes the risk equation to reduce any of the threat’s exposure. As mentioned above the resistance provides a distinction between damage and failure potential
- It is related to pipeline strength available then wall thickness becomes the important factor of resistance
- Resistance includes fabrication and construction issues, such as welds, appurtenances, metallurgy, etc. All these features provide a resistance condition for the pipeline that may deteriorate or degrade with time
- Inspections and repairs are essential part of pipeline resistance either to restore original conditions or to maintain operation restrained by calculated resistance
- Pipeline age also contributes to level of resistance, but does not mean than an old pipeline is more exposed than a new pipeline to threats to their integrity
Probability of damage (PoD) and probability of failure (PoF)
As is well known a pipeline may be exposed to a threat of failure with a high probability of occurrence, however, the failure would not necessarily happen when the damage occurs. The probability of damage depends on the layers of protection available
Risk analysis
Now the risk assessment has been completed and the potential threats for this pipeline have been identified. Next step consists in identifying which threats could lead to a mechanism of failure and where the pipeline has the biggest vulnerability in terms of probability of failure values. In this case of study some scenarios will be analyzed to determine risk reduction worth for incorrect operation potential
The following part of the exercise aims in the human factor mainly, so risk reduction worth is low since it depends on personnel training and improving operational procedures
The mitigation scenarios are four where different levels of coverage are considered to compare risk reduction vs original risk (monetized) to select the best option to implement in the risk management plan
Risk control/mitigation scenarios
Based on the scenarios considered the risk assessment sensibility is obtained by comparing the results with the effectiveness of the original mitigation condition, as follows:
- Scenario 1. Exposure level to incorrect operation is expected to be 25%
- Scenario 2. Exposure level to incorrect operation is expected to be 50%
- Scenario 3. Exposure level to incorrect operation is expected to be 75%
- Scenario 4. Exposure level to incorrect operation is expected to be 100%
All values of mitigation are compared to the original mitigation value of 59.5%, with the following results:
| Mitigation variables | Original mitigation (%) | Mitigation expected (%) | |||
| 1 | 2 | 3 | 4 | ||
| C_IO_PERSONNEL= (IO_TRAINING)*(IO_PERSONNEL_TURN_OVER) | 59.5% | 25 | 50 | 75 | 100 |
| IO_TRAINNING | 85% | 50 | 70.7 | 86.6 | 100 |
| IO_PERSONNEL_TURN_OVER | 70% | 50 | 70.7 | 86.6 | 100 |
| C_IO_PROCEDURES= (IO_PROCEDURE_AVAILABILITY)* (IO_PROCEDURE_UP_TO_DATE) | 76% | 25 | 50 | 75 | 100 |
| IO_PROCEDURE_AVAILABILITY | 95% | 50 | 70.71 | 86.6 | 100 |
| IO_PROCEDURE_UP_TO_DATE | 80% | 50 | 70.71 | 86.6 | 100 |
Check Risk analysis results!!