Proceedings of the 2012 9th International Pipeline Conference IPC2012 September 24-28, 2012, Calgary, Alberta, Canada

IPC2012-90192

DETERMINATION OF SIGNIFICANT RISK THRESHOLD OF UPSTREAM PIPELINES

Hong Lu Visser Consulting Ltd 290, 6815 - 8th Street NE, Calgary, Alberta, T2E 7H7, Canada Email: hlu@vcl.ab.ca

ABSTRACT The pipeline risk assessment has been part of the integrity management in the industry in todays environment of increasing regulatory and public oversight. One of the widely used risk assessment method is the score index method. This method has been used for more than two decades and is widely accepted in the pipeline industry. The input data is relatively easy to acquire. The method provides details of mitigation options and relative risk values. However, this method does not provide the simple decision making process. In risk management, it is always the question to choose the most cost effective mitigation option to use limited resources. On the basis of score index risk assessment method, a method to correlate the probability of failure score with actual failure probability, and leak impact factor score with actual failure consequence in monetary units has been developed. This method applies the monetarily calibrated consequence factor to the probability of failure to obtain a normalized and calibrated risk in monetary unit. By comparing the cost of an estimated mitigation program, the decision can be made. Recent regulations in Canada require that risk assessment must have a method to determine the significant risk threshold. Even though some industrial standards have some recommended methods or benchmark data for failure probability, there is no published method to determine the threshold of high risk. Some pipeline companies have the inhouse personnel to develop an advanced method to meet regulation requirement. However, many pipeline companies need to have a practical and economical method to determine the significant risk threshold to meet regulation requirement, and to effectively allocate resources. This paper develops a method to determine the significant risk threshold that can be

used as a decision-making criterion in pipeline risk management. This process is practical for industrial application, especially for upstream companies where operators have limited resources for advanced risk assessment. A case study is presented using this method based on upstream pipelines. INTRODUCTION Regulations of pipeline integrity management and risk assessment become more and more stringent. The Canadian pipeline standard CSA Z662 introduces optional detailed pipeline integrity management content in 2007 and 2011 revision [1,2]. Alberta and British Columbia (BC) provincial regulators have adopted it as a mandatory requirement [3, 4, 5]. This legislation requires that pipeline risk assessment must be implemented as part of the pipeline integrity management to ensure that the pipelines are operating at an acceptable risk level. Hundreds of upstream pipeline operators are now facing the challenge to meet the requirements of pipeline integrity management and risk assessment. Once it is identified that the risk-based decision-making is needed, the operators are immediately facing the challenge of large amounts of risk analysis work. This work frequently has to be done with minimal resources and lack of input data. This is often due to the corporations data management system and resource allocation. In answering this challenge, a risk assessment process has to be developed that meets the needs of upstream clients based on a well-developed risk assessment method. This risk assessment can be then used as a screening process to identify areas requiring further or more detailed study to support the integrity management program. The process can also be used as a cost effective tool to support pipeline mitigation decision-making.

Copyright 2012 by ASME

A modified index score pipeline risk assessment was developed [6], concentrated on upstream pipeline systems. It describes a rudimentary method that can be used to rank and prioritize the pipeline risk. With conventional pipeline risk assessment methods, pipeline operators often have these questions: Now I know which pipelines have higher risk. How high a risk is too high? How much risk is a significant risk that has to be reduced? Quite different from transmission pipelines, upstream pipelines are often comprised of small diameter, low pressure, and short length pipelines, and are often unpiggable. While some pipeline companies have resources to develop advanced models to determine the risk threshold, many pipeline companies either do not have resource for such a time consuming development, or do not have in-house staff to do it. In addition, the pipeline integrity management regulation in western Canada requires that a method to decide the pipeline risk threshold [5] has to be in place for the pipeline operation. There are no published methods in the industry to determine the pipeline risk threshold so that hundred of pipeline companies are facing the challenge of risk threshold. Each pipeline system is quite unique and different from others based on product, specifications, environment, available budget, social impact, etc. Therefore, one threshold in one pipeline system may not fit another pipeline system. On the basis of the modified index score pipeline risk assessment method [6], in this paper, a practical and straightforward method to determine the pipeline risk threshold is developed to assist the pipeline operating companies for decision-making and regulation requirement. This method has been used in a few upstream pipeline systems successfully. One case study based on this method is provided in this paper RISK CATEGORIES CSA Z662 provides a simple matrix risk assessment method, shown in Figure 1. In this method, risk estimation involves combining the results of frequency and consequence analysis to produce a measure of the risk. The appropriate method depends on the objectives of the risk assessment. The risk matrix method is a very effective method for ranking pipeline risk. The frequency and consequence estimates are expressed separately and combinations are presented in a two dimensional matrix of discrete risk categories. The highest risk ranking is toward the upper right-hand corner. The assessment of failure frequency and consequence is based on experts opinion and operating experience. This method basically works as a risk screening tool. The weakness is that it does not

provide details of the options for the risk mitigation strategy [1]. The API 581 [7] and ASME provide matrix risk assessment methods similar to CSA Z662. The CSA Z662 simple matrix of risk assessment method classifies risk into categories of low, intermediate, and significant, but it does not provide the method to determine the risk threshold. Each pipeline operating company has to develop their own decisionmaking method.

Figure 1. CSA Z662 Example of Risk Matrix Application [1] MODIFIED METHOD INDEX SCORE RISK ASSESSMENT

Index Score Method The index score risk assessment method has been used in the pipeline industry for many years [8, 9]. In this method, the pipeline risk is evaluated in two components: the probability of failure (POF) and the consequence of failure. This method is intended to be comprehensive - considering all critical aspects of risk. General agreement among risk professionals can be used as a surrogate when hard data is absent. The POF portion consists of four subcomponents based on Muhlbauers risk assessment model [8]: third party damage factors, corrosion factors, design factors, and incorrect operation factors. Each subcomponent consists of many input conditions. In the POF portion of this model, scores are assigned to each risk factor or variable, and importance factor weightings are assigned to logical groupings of these variables. The individual

Copyright 2012 by ASME

scores for each segment/pipeline are combined for an overall failure probability score (FPS) of the pipeline. The second part of the risk model is the consequence or impact portion of the risk assessment. The consequence portion of the assessment methodology is expressed as the leak impact factor. Leak impact factor (LIF) considers product hazards (acute hazards, chronic hazards), leak volume, dispersion, and receptors such as nearby population density, and environmental sensitivities, and high value areas. The LIF is a calculated score. LIF=PHRSD (1)

11012 is used to determine the significant risk threshold combined with failure consequence, the result will be very low. Using an effective zero of 1x1012 will risk adopting an under conservative risk threshold based on the risk assessment method in this paper. During the period of 1990 to 2005, there were 12,848 pipeline incidents reported to the ERCB (not including test failures) [10]. Of these, 657 were hits with no release, leaving 12,191 cases resulting in a pipeline release. Of all releases, 93.8% were leaks, and the other 6.2% were ruptures. Albertas pipeline inventory continues to experience steady growth. As of year-end 2005, Alberta totaled 377,248 km of pipeline. Taking into consideration the growth of the length of the pipelines over the years from 1990 to 2005 in Alberta, the average rate of incident in Alberta is approximately 0.003/kmyear. For the upstream gathering pipeline system, the failure frequency, 1106 failure /kmyear might be proposed as the lower end of the exposure scale, which correlates to FPS 400. In an actual pipeline risk assessment, operating experience has to be used to calibrate the effective zero and the correlation between the leak impact factor and the modified leak impact factor. When the pipeline does not have any safety and integrity measures hypothetically, FPS equals to 0 and the real world failure probability will equal to 100%. Assuming logarithmic relation [7] between the scores and real world failure probability, the relation of FPS and failure probability (FP) can be described as FP=exp(0.0345FPS) (2)

where PH is product hazard, R is receptor, S is spill volume, D is spread range or dispersion. The predominant risk factors in each pipeline segment can be identified to assist in the decision making of the risk reduction. Modification of Failure Probability While more advanced risk calculation methods have been used in the industry, upstream pipeline operators often do not have the resources to collect advanced data and conduct advanced risk assessment. The score index method is used [6] to calculate the failure probability score (FPS) to meet the needs of the upstream pipelines. It has been recognized in the industry [7] that logarithmic scale better characterize the nature of failure probabilities. It is necessary to convert the failure probability scores into absolute terms to reflect the real world effect. The full scale of the failure probability scores is between 0 and 400 [8]. Based on the score index risk assessment method, lower FPS score means higher risk. The value 0 and 400 are two theoretical values. Value 0 represents a condition of pipeline that has no safety and integrity controls at all, in which case the pipeline fails immediately. Value 400 represents a condition of pipeline that has all safety and integrity controls, and the pipeline almost never fails. The new generation model [9] introduces the concept of effective zero. To convert the FPS to logarithms scale, a lower limit of effective zero is necessary to make the mathematical relationships perform properly. An effective zero is a way of assigning a value to an event with a very small probability of occurring. This can be used as the effective zero value in risk assessment equations. The effective zero is subject to change when a risk model is calibrated to produce results in absolute terms such as failures per mileyear. In the new generation model [9], it is proposed that 11012 might be used as the effective zero. However, if

Where FP is failure probability in the real world and is per kmyear. FPS is failure probability score from the index score risk model, sum of all the POF scores for each pipeline segment. This formula is illustrated in Figure 2. Modification of Consequence of Failure The LIF is well developed based on relevant theory and industry experience. However, for a decision-making tool, the consequence of failure needs to be converted to the actual consequence measure in dollars or other cost units. Of course, some aspects of consequence cannot be described by dollars, such as social impact, environment, safety and injury. The person conducting the analysis can use the corporations operating practices or historical data to convert the LIF to the consequence in dollar value, which is assumed to be the modified LIF (MLIF). In such a conversion, all the consequence aspects should be included. The more data that is used, the more reliable the conversion will be. A lower limit of effective zero and a calibration point are needed to establish the conversion to make the mathematical relationships perform properly. Consider an incident with the minimum leak impact, hypothetically, LIF=0. It is assumed that

Copyright 2012 by ASME

the mitigation expense is 1000$, which is the minimum cost for any incident. For a very severe accident, such as conditions of class 2 location, large diameter pipeline, high pressure, and sour gas, approximately LIF=100. It is assumed that the cost of such a severe accident is approximately $100M, which is 10 times of the cost per injury specified in API 581 [7]. Assuming the failure consequence follows logarithms scale, the following relation is obtained, shown in Figure 3. MLIF = 10LIF0.05+3
1.E+00 1.E-01 1.E-02 Failure Probability 1.E-03 1.E-04 1.E-05 1.E-06 0 100 200 300 400 Failure Probability Score
Average failure probability 1999 - 2005 ERCB data

total risk is decreased to TR. The rate of return (RR) of the mitigation can be calculated: RR= (TRTRCOST)/COST Where COST is the cost of the mitigation program.
1.E+08

(5)

(3)
1.E+07 Modified Leak Impact Factor, $

1.E+06

1.E+05

1.E+04

1.E+03 0 20 40 60 Leak Impact Factor Score 80 100

Figure 3. Correlation between the Leak Impact Factor Score and the Modified Leak Impact Factor With the above formula, the expected risk reduction can be compared with other risk reduction cases. The pipeline risk can be ranked based on the rate of return to assist the risk management decision-making. The optimal mitigation measure can be determined. The advantage of this method is that it truly determines the most effective mitigation options in a simple and measurable approach. It does not involve the advanced mathematical calculations, but uses operating experience to calibrate the correlations. It also determines whether the cost of the mitigation action fits the companys economic strategy in terms of rate of return. It translates the risk, failure probability and consequence of the pipeline into a term that can be easily understood by management and other staff. Determination of the Significant Risk Threshold The BC Oil and Gas Commission (OGC) pipeline integrity management protocol requires that the risk threshold must be determined for the decision making. Nowadays in the industry, there is no universal method to decide the risk threshold of a pipeline. In an actual operation, the threshold risk, or in other words, the significant risk, is determined on the following conditions: A condition of significant risk decided by regulatory requirement;

Figure 2. Correlation between the Failure Probability Score and Failure Probability In the actual practice of pipeline risk assessment, the method and the scoring rules need to be customized to best fit the unique characteristics of a corporations pipeline system and the budget requirements. While conducting a pipeline risk assessment using this method, the correlation between LIF and MLIF should be calibrated by the corporate experience data or industrial relevant data. The more data that is used for calibration, the more accurate and reliable the correlation will be. With the above discussion, the expected total risk (TR) can be described in dollar unit: TR=FPMLIF RISK MANAGEMENT METHOD Pipeline Risk Ranking When a mitigation action is completed, or when the effectiveness of a mitigation action is evaluated, the failure probability is reduced to FP, MLIF is reduced to MLIF, the (4)

Copyright 2012 by ASME

A condition of significant risk decided by industry standards; A condition of significant risk decided by the companys operating experience; A condition of significant risk decided by the threshold risk calculation, such as described in this paper.

Based on a few upstream pipeline companies operating experience, it is considered that a risk level of 1000$/kmyear would be suitable in the risk management. The risk threshold level of 1000$/kmyear is shown in Figure 4. Determination of the Moderate Risk From the operation point of view, the pipeline can be classified into a few categories to assist the risk management decision-making. A simple approach is to classify the risk into three categories: Significant risk (the risk greater than the risk threshold); Moderate risk; and Low risk. The moderate risk level can be determined using the same method, depending on the companys operating experience, regulation requirements, and industry standards. It can be one or two orders of magnitude less than the significant risk threshold. A risk level of 10$/km-year is proposed for the threshold of moderate risk based on the operating experience, shown in Figure 4. If the risk of a pipeline is between 10 and 1000$/km-year, the risk is considered moderate.
1.E+00

It is assumed that the pipeline condition meets all applicable regulatory requirements, industry standard requirement, and companys internal standard, so that only the threshold risk calculation is discussed in this paper. From the financial point of view, the risk threshold is the maximum expected reactive cost to maintain the pipeline operation and integrity in the current conditions if no further mitigation or monitoring actions are implemented. If the expected risk is greater than the risk threshold, the company will take some actions to reduce the actual risk to a value less than the risk threshold. As calculated in the above section, based on the statistical data in Alberta from 1990 to 2005, the average incident probability in Alberta is approximately 0.003/km-year. In order to estimate the benchmark of failure probability, a correction factor of 3 is applied to the average incident probability of 0.003/km-year, by which the incident probability of 0.001/kmyear is obtained. It is well recognized that any event of fatality or injury is unacceptable. The API 581 proposes that the cost per injury is set at $10,000,000 [7]. Of course the fatality, injury and social impact cannot be measured by dollar value; however, it can be used as a simple benchmark of the risk level. In order to estimate the benchmark of failure consequence, a correction factor of 10 is applied to the injury cost, by which the injury cost of 1M$ is obtained. On this basis, the significant risk threshold is obtained, 0.001/kmyear 1M$ = 1000$/kmyear. The relation of failure probability and consequence is generally set as log-log scale so that the significant risk threshold is an iso-risk linear line, shown in Figure 4. For a condition of very high consequence in the iso-risk threshold line, for example $100M, the equivalent failure probability is 105, which is one order of magnitude higher than the effective zero. Another typical point of the risk threshold line in Figure 4 is the point when failure probability is 1. In this situation, if no mitigation is implemented, the expected risk of the pipeline, in other words, the repair or maintenance cost, would be 1000$. This is the maximum cost expected for the repair or maintenance. However, if the operation takes proactive actions, the repair or maintenance cost can be reduced.

Failure Probability, per km.year

1.E-01 Significant 1.E-02

1.E-03

Moderate

1.E-04

Low

1.E-05 1.E+03 1.E+04 1.E+05 1.E+06 1.E+07 1.E+08 Failure Consequence, $

Figure 4. Illustration of Risk Categories Discussion As a simple rudimentary decision-making tool for the upstream pipeline system, it should be the best balance of accuracy, effectiveness, feasibility and usability. This method takes the advantages and strengths from the index score models, risk matrix models and quantitative models; and provides a simple and easy application process for the upstream pipeline system.

Copyright 2012 by ASME

To make the final mitigation and monitoring decision, the total risk level, rate of return of mitigation program, companys operating experience and relevant regulatory and code requirements should be considered. Significant pipeline risk needs to be mitigated to a level less than the significant risk threshold. Moderate pipeline risk needs to be monitored. Low pipeline risk does not require further actions except the regulation and industry standard requirements. CASE STUDY A number of 141 upstream pipelines transporting natural gas or sour gas have been assessed using the modified risk assessment method. The pipelines are made of steel pipes. Ideally the risk assessment should be based on sections along a pipeline. However for the upstream pipelines, it would be more effective to assess the pipelines based on pipeline license and segment number to best balance the limited data and the assessment method. The worst case scenario of each pipeline has been used in the scoring process. The risk is examined in two components: the Probability of Failure (POF) and Leak Impact Factor (LIF). The POF is divided into four sub-categories. These sub-categories correspond to possible failure modes, which are third party damage, corrosion, design, and incorrect operations. Many factors or variables are combined in each sub-category. The third party damage score variables have pipeline depth of cover, crossing, activity level, etc. The corrosion score variables have internal corrosion program, cathodic protection program, coating program, etc. The design factor score variables have pipeline design specification, external load, etc. The incorrect operation score variables have hazard identification, operation pressure, documents and procedures, etc. The leak impact factor score variables have product hazard, dispersion amplifiers or reducers, etc. The method of assigning scores for all the variables is fully described in Pipeline Risk Management Manual [8]. Step 1: Data collection has been conducted including the pipe design and construction data, operation and maintenance data, and interview with the operation and management personnel. Step 2: After the data collection, a score of each POF variable is assigned to each pipeline segment based on the collected data. The FPS is the sum of the scores of all the 4 POF sub-categories for each pipeline segment. The variables of LIF are also examined and a score is assigned to each pipeline segment based on the collected data and the method in the same reference. Step 3: FP is calculated based on formula (2), MLIF is calculated based on formula (1 and 3), TR is calculated based on formula (4), and RR is calculated based on formula (5).

Step 4: The threshold risk and moderate risk are reviewed and determined to ensure that they are compatible with the pipeline system conditions. Step 5: If the risk of any pipelines is greater than the risk threshold, mitigation options are recommended. If the risk of any pipelines is less than the risk threshold, but greater than the moderate risk level, risk monitoring options are recommended. On this basis, the mitigation options are prioritized based on the calculated rate of return. On the above basis, the risk of 1 pipeline is located in the significant risk zone, the risk of 5 pipelines is located in the moderate risk zone, and remaining pipelines are located in low risk zone, shown in Figure 5. The pipeline with significant risk is a 4 diameter sour gas pipeline. The assessment result is consistent with the field operating experience. This pipeline has been a main concern for the operation, even though it has the best risk mitigation and monitoring program among all the pipelines. The pipeline operators need to know whether the risk of this pipeline is acceptable, and if not, what are the best solutions to reduce the risk. Due to the relatively greater diameter and pressure than the other pipelines, the leak volume is greater based on the score calculation model. Eventually, the leak impact factor dominates the risk assessment result of this pipeline. Consequently, the most cost effective approach to mitigate the risk of this pipeline is to reduce the leak volume, which can be done by improved emergency response, pipeline patrols, etc.
1.E+00

High 1.E-01 Failure Probability, /(km.yr)

1.E-02

Moderate

1.E-03

1.E-04 Low 1.E-05 1.E+03 1.E+04 1.E+05 1.E+06 1.E+07 1.E+08 Consequence, $

Figure 5. Risk Assessment Result of Upstream Gas Pipelines

Copyright 2012 by ASME

CONCLUSION A modified risk assessment model is developed and can be used for upstream pipeline systems for decision-making or as a risk-screening tool where mitigation resources are often limited. This method takes the advantages and strengths from risk matrix model, score index risk model and quantitative models; and provides a simple and easy application process for the upstream pipeline system. This method determines the most effective mitigation options in a measurable approach. It translates the risk, failure probability and consequence of the pipeline into to a term that can be easily understood by management and other staff. The operator can decide if the cost of the mitigation action fits the companys economic strategy in terms of rate of return. Significant risk threshold and moderate risk are determined to assist the decision-making in risk management. In this model, significant risk needs to be mitigated, moderate risk needs to be monitored, and low risk does not require further actions. The risk assessment method and significant risk threshold have been used for upstream pipeline system. The model and result have been verified by the field operation. ACKNOWLEDGEMENTS The author would like to thank Brian Hoschka for the valuable discussion. REFERENCES [1] Oil and Gas Pipeline Systems, Z662-07, Canadian Standards Association, 2007. [2] Oil and Gas Pipeline Systems, Z662-11, Canadian Standards Association, 2011. [3] Adoption of CSA Z662-03, Annex N, as Mandatory, Directive 041, Energy Resources Conservation Board (ERCB), Alberta, Canada, July 20, 2006. [4] Adoption of CAN/CSA Z662-03 Oil and Gas Pipeline System Annex N Guideline for Integrity Management Programs, Information Letter # OGC 06-12, BC Oil & Gas Commission, August, 2006. [5] Self Assessment Protocol Integrity Management Programs for Pipeline Systems, BC Oil and Gas Commission, Jan 4, 2011. [6] H. Lu, A Decision Making Method of Pipeline Risk Assessment, IPC 2010-31193, Proceedings of 8th International Pipeline Conference, September 27 - October 1, 2010, Calgary, Alberta, Canada. [7] Risk-Based Inspection Base Resource Document, API Publication 581, First Edition, American Petroleum Institute, May 2009. [8] W. Kent Muhlbauer, Pipeline Risk Management Manual Ideas, Techniques, and Resources (3rd Edition), Dec 18 2003.

[9] W. Kent Muhlbauer, Derek Johnson, Elaine Hendren, Steve Gosse, A New Generation of Pipeline Risk Algorithms, IPC2006-10178, 2006, ASME. [10] Pipeline Performance in Alberta, 1990-2005, Report 2007A, Alberta Energy and Utilities Board, April 2007.

Copyright 2012 by ASME