A Risk Assessment Model For Pipeline Facility Operations

Recent efforts to develop a consistent understanding of the risks associated with operating a cross countrypipeline system have focused primarily on the pipe itself. The typical risk-analysis model frequently does not address the risks associated with operating non-pipe components such as valves, tanks, pumps and compression units. This article outlines a detailed logical approach that can be used to evaluate the relative safety, environmental and cost risk associated with operating diverse types of equipment within a pipelinefacility. The methodology enables an "apples to apples" comparison of diverse pipeline components and systems from a risk standpoint and provides the detail (granulation) necessary to identify opportunities to reduce operational risk.

The Problem

Federal safety standards in 49 CFR Part 192 (gas) and 195 (liquid) require operators to develop and follow apipeline Integrity Management Plan (IMP), including a risk-assessment process. Initial pipeline risk models focused on pipe while other components received less attention from operators and regulators. As shown in Figure 1, significant portions of pipeline facility assets have not been included in IMP risk modeling. Note that while Figure 1 graphically depicts a typical liquid pipeline system, gas pipeline systems share many common components and threats.

The intent, and ultimate benefit, of the risk-assessment process is to focus resources on the asset or component with highest operational risk. Pipe failure statistics suggest that operators can attribute reduction in line pipe failures to integrity management programs and risk analysis. Similar improvements have not been observed for non-pipe components.

Given that the next evolution within the pipeline industry will be an effort to reduce the number of failures of non-pipe components, the question becomes: What process or model can be utilized to efficiently and effectively evaluate the relative risk associated with the operation of all significant pipeline assets?

Facility Risk Model Requirements

What constitutes a good facility risk model?

Simplicity. Experience has taught many in this industry that maintaining a simple approach serves to improve the quality of input data and ultimately the quality of outputs.

Qualitative And Quantitative Risk. Qualitative methods use engineering judgment and experience as the basis to analyze probability and consequence. Quantitative methods identify the combination of events that lead to an undesired outcome. Analysis predicts frequency of occurrence and consequence. A good model includes elements of both.

Relative Risk. Most current line pipe risk models calculate a numeric value representing the perceived relativerisk attributed to operation of individual segments of pipe relative to other segments of pipe. The objective is to identify the highest risk components. The model must be able to compare dissimilar components and identify assets with highest operational risk.

Multi-level Analysis. The model must support the company's need to combine assets into user defined groups for comparative analysis.

Current Line Pipe Focused Models

When developing a facility-risk model, it is appropriate to first look at current models that focus only on line pipe. Pipe-only models can be described as two-dimensional since they look at "threats" and "consequences" for only one type of component: line pipe.

The following equation is commonly used to produce a two-dimensional (threat X consequence) risk score:

Risk = (ΣRI*Wf)Threat*(ΣRI*Wf)Consequence

Where:

RI = Risk Indicator Score and

Wf = Weighting Factor.

Models often, in contradiction to the "keep it simple" concept, apply factors to factors applied to factors, applied to baseline threat or consequence scores, ad nauseam. The utilization of complex factoring typically serves to complicate an analysis mat ultimately remains a two-dimensional problem.

Threats and consequences can be organized into sub-categories that are largely prescribed in federal safety standards. Probability and consequence of failure can be expressed numerically using a series of questions whose answers directly relate to low- or high-risk scores (Risk Indicators - RI).

Pipe-segment length often varies from a few feet to several miles. Any point along a segment assumes the riskprofile derived from worst case responses to risk indicators considering the entire segment. A worst case approach eliminates any need for a length or quantity factor and the pipe segment can be defined as a unit of pipe with a unique risk profile that applies to every point along the segment or unit.

By example, two pipeline segments of different length crossing the same river with the same risk scoring should draw attention to the elevated threat and consequence, the river crossings. Application of length or quantity factors serves to inappropriately focus attention on the longer pipe segment.

Facility Risk Evaluation Logic

How must a true facility risk model that dovetails with current pipe models be structured? Addressing this question requires that we break the answer into parts corresponding to portions of the two dimensional model.

Consequence of a pipeline leak, either gas or liquid, is the result of the size of the release, where the product can go and what can happen when it gets there. Consequence-related risk indicators focus on these questions and lead us to take action that mitigates or eliminates the consequence (i.e. lower RIs).

When analyzing consequence resulting from a leak or failure at a site involving non-pipe components, the same questions apply. What is the size of the release? Where can the product go? What happens when it gets there? It therefore follows that consequential questions for a full-blown facility model are similar, if not the same, as the risk indicators for a line pipe only model. Continuity demands that corresponding scoring remain the same as well.

It is true that consequential pipeline facility failures occur in line pipe segments. It is also true that significant failures can be attributed to components such as flanges, valves, tanks, pump and compression units. Threats to these components, by contrast, can be different from those attributed to pipe. Using the vernacular discussed earlier, modeling of a multi-component facility demands a three-dimensional model to accurately identify highrisk components. That conclusion is illustrated in Figure 3.

A pipe-only model is based upon the implicit assumption that pipe failure results when the pipe wall is penetrated, either mechanically or chemically (corrosion). More complex components are subject to other failure modes that affect (typically increase) the threat risk attributable to the asset. Logically, the risk equation can - therefore - be restated:

Risk=E^sub f^*(ΣRI*W^sub f^)^sub Threat^*(ΣRI*W^sub f^)^sub Consequence^

Where:

E^sub f^ = Component failure rate as compared to baseline.

E^sub f^ varies as a function of the component being operated or evaluated. As a starting point we can establish "pipe" as our baseline component to which the threat risk for other component types can be compared; therefore, E^sub f^ for pipe is defined as 1.0.

The wisdom of this decision is confirmed when it is recognized that most existing pipeline risk modeling remains valid. Once fully developed, future facility risk models can often be compared to the results from existing "pipe only" models, as demonstrated by the example E^sub f^ development exercise shown near here.

Component Threat Correction Factors

Wim pipe established as our baseline and E^sub f^ for pipe defined as 1 .0, operating experience becomes useful in defining E^sub f^ for other pipeline components.

A simple flange connection can fail by penetrating the flange wall, just like pipe. Obviously, the current pipe-oriented corrosion and wall thickness-related questions (RI's) can be used to address this failure mode. Since flanges are typically heavy steel, the risk associated with penetration of the flange wall should be low as compared to line pipe.

As described earlier, a flange can experience other defect-related failures. Gaskets fail and bolts can be improperly tightened. Given additional threats of failure, one can logically conclude that E^sub f^ for a flange connection is larger (increased risk) than E^sub f^ for pipe.

New defect-related questions (RIs) must be developed for flanged connections. Those questions focus on gaskets and bolts, and combine with corrosion, nature and third-party risk indicators to produce the (ΣRI*W^sub f^) threat piece of the risk equation.

In the same vein, a flanged valve has two flange connections plus stem seals, body flange seals and small diameter-screwed fittings (body bleed, external relief, etc.) that can leak or break off. It follows that E^sub f^ for a flanged valve is larger than E^sub f^ for a flanged connection.

Using similar logic, a storage tank may possibly have a larger E^sub f^ than does a pump which is probably more subject to failure than a valve. The hierarchy is intuitive and can be supported by statistical application of operational experience. An example of a typical calculation is provided below.

When developing E^sub f^, failure statistics should be applied on a proportioned basis: failures per valve, pump, unit of pipe, etc. Size of the component (2- or 20-inch) relates directly to size of release and is dealt with on the consequence side of the risk equation. The following example demonstrates a logical progression to E^sub f^.

Example: (All of the numbers in this example are imaginary.) Assume that an operating company maintains riskdata for a 2,148-segment line pipe system. These data represent 2,148 equivalent units of varied diameter and length line pipe. Previously, we concluded that length (quantity) is not relevant from a threat standpoint. Leak records indicate the 2,148 units of pipe have experienced 122 consequential pipe failures in the past 10 years.

To compare other components to a common base (line pipe) we must understand the common factor (μ) that relates Et to all components including pipe (i.e. from a numeric standpoint, what do all components share in common with pipe?).

We know:

E^sub fpipe^ = 1

therefore,

1 = μ * 122 leaks/2,148 pipe segments

μ = 17.61 equivalent units / leak

where μ = constant common to all components with line pipe defined as baseline.

Our imaginary pipeline also operates 207 pump units (equivalent units) and we have experienced 14 pump unit consequential failures in the same 10-year period; therefore,

E^sub fpump^ =17.61*14/207 -1.19

Our conclusion is, on average, a pump unit experiences some kind of failure with adverse consequences 1.19 times more often than does a typical pipe segment as defined in our pipeline risk model.

Operational experience and intuitive thought should confirm the calculation. In any case, hard data and quantitative analysis have been logically used to support the model and the conclusions it produces.

Concerns that E^sub f^ may serve to inflate the risk attributed to some components are legitimate until failure rates for some components are demonstrated to actually be elevated over other components. A close look at the process used to develop E^sub f^ makes it difficult to ignore the logic and places the burden on the individual user to fully understand and consistently apply leak/failure statistics when developing E^sub f^.

Weighting Factors

Components within a station are probably less exposed to damage by third parties and may see more failures due to operator error. Subsequently, a more accurate analysis can be developed when independent threatweighting factors (W^sub f^) are developed for assets located inside of stations and assets located outside of stations. This may also be true from a consequence standpoint.

Facility Risk Model

Figure 4 is an example of a risk evaluation of XYZ Company's Line 2, an imaginary propane pipeline system that includes a pump station (Station B) at MP 22.3. Note that a complete evaluation of the pump station is not included with this example. Record number 0001 represents one of 2,148 pipe and pipeline facility records evaluated in this case. Record 0001 is a typical 2.7-mile cross country pipeline segment in the 62.8-mile system. This figure demonstrates the risk scoring for record 0001, which is the product of and compatible withrisk indicator scoring and weighting factors commonly used for pipe-focused models.

Scoring for the pump, valve and tank records are the products of question sets structured specifically for those respective components.

In this case, components have been evaluated and included in the risk analysis. As with line pipe, it is not mandatory to establish a record for every valve, pump or tank. Instead, a representative component (i.e. pump) can be established that incorporates the worst-case scoring for the combination of every pump within a facility. When using a worst-case combination of answers, for a representative component, mitigation of risk is accomplished by addressing (clearing) the worst case threat or consequence.

Note that, although not mandatory, a more detailed analysis (modeling every significant component) can be a manageable effort and serves to more specifically identify the high-risk asset.

Sumber : Decker, Larry C, PE. "A Risk Assessment Model For Pipeline Facility Operations". 26 Januari 2014. http://search.proquest.com/docview/197492159?accountid=31562