Page 533 - Corrosion Engineering Principles and Practice

498 C h a p t e r 1 2 C o r r o s i o n a s a R i s k 499

expected to be used only by industries where the consequences of
failure might be very severe.
The strengths of fault tree analysis are [10]

• It is a widely used and well-accepted technique.
• It is suitable to quantify many of the hazards that arise from a
combination of adverse circumstances.
• It is often the only technique that can generate credible
likelihoods for novel, complex systems.
• It is suitable for technical faults and human errors.
• It provides a clear and logical form of presentation.

Its weaknesses are

• The diagrammatic format discourages analysts from stating
explicitly the assumptions and conditional probabilities for
each gate. This can be overcome by careful backup text
documentation.
• FTA can become complicated very early in an analysis,
therefore turning out to be time-consuming and difficult to
follow for large systems.
• Analysts may overlook failure modes and fail to recognize
common cause failures (i.e., a single fault affecting two or
more safeguards) unless they have a high level of expertise
and work jointly with the operator.
• All events are assumed to be independent.
• FTA may easily lose its clarity when applied to systems that
do not fall into simple failed or working states (e.g., human
error, adverse weather and so forth).

Figure 12.10 illustrates how a major gas transmission pipeline
company adopted FTA for the risk assessment of SCC corrosion on its
18,000-km gas pipeline network [13;14]. The rupture risk FTA was
normally performed for the review and analytical examination of
systems or equipment to emphasize the lower-level fault occurrences.
These results also served to schedule maintenance operations,
conduct surveys, and plan research and development efforts.
Each element of the branch in Fig. 12.10 contains numerical
probability information related to technical and historical data for
each segment of the complete pipeline network. In some cases, it was
simpler to assume some probability values for an entire system. The
probabilities of operating at maximum permitted pressure and the
presence of electrolyte were both set at value unity in Fig. 12.10,
therefore forcing the focus on worst case scenarios. Other more
verifiable variables can be fully developed as is shown in Fig. 12.12