Page 143 - Pipeline Risk Management Manual Ideas, Techniques, and Resources

6H 20 Incorrect Operations Index
A2. MOP potential (0-12 pts) fairly rapidly due to incompressible fluid or rapid intro-
duction of relatively high volumes of compressible fluids.
The possibility of exceeding the pressure for which the system Overpressure is prevented only by procedure or single-level
was designed is an element of the risk picture. Obviously, a sys- safety device.
tem where it is not physically possible to exceed the design B. Unlikely 5 pts
pressure is inherently safer than one where the possibility Definition: Where overpressure can occur through a combina-
exists. This often occurs when a pipeline system is operated at tion of procedural errors or omissions, and failure of safety
levels well below its original design intent. This is a relatively devices (at least two levels of safety). For example, a pump
common occurrence as pipeline systems change service or running in a “deadheaded” condition by the accidental
ownership or as throughputs turn out to be less than intended. closing of a valve, and two levels of safety system (a primary
The ease with which design limits might be exceeded is safety and one redundant level of safety) failing, would over-
assessed here. The first things required for this assessment are pressure the pipeline.
knowledge of the source pressure bump, compressor, connect- C. Extremely Unlikely 10 pts
ing pipelines, tank, well, etc.) and knowledge of the system Definition: Where overpressure is theoretically possible
strength. Then the evaluator must determine the ease with (sufficient source pressure), but only through an extremely
which an overpressure event could occur. Would it take only the unlikely chain of events including errors, omissions, and
inadvertent closure of one valve to rapidly build a pressure that safety device failures at more than two levels of redundancy.
is too high? Or would it take many hours and many missed For example, a large diameter gas line would experience
opportunities before pressure levels were raised to a dangerous overpressure if a mainline valve were closed and communi-
level? cations (SCADA) failed and downstream vendors did not
Structural failure can be defined (in a simplified way) as the communicate problems and local safety shutdowns failed,
point at which the material changes shape under stress and does and the situation went undetected for a matter of hours.
not return to its original form when the stress is removed. When Obviously, this is an unlikely scenario.
this “inelastic” limit is reached, the material has been struc- D. Impossible 12 pts
turally altered from its original form and its remaining strength Definition: Where the pressure source cannot, under any
might have changed as a result. The structure’s ability to resist conceivable chain of events, overpressure the pipeline.
inelastic deformation is one important measure of its strength.
The most readily available measure of a pipeline’s strength In studying the point schedule for ease of reaching MOP, the
will normally be the documented maximum operating pressure “routine” description implies that MOP can be reached rather
or MOP. The MOP is the theoretical maximum internal pres- easily. The only preventive measure may be procedural, where
sure to which the pipeline can be subjected, reduced by appro- the operator is relied on to operate 100% error free, or a simple
priate safety factors. The safety factors allow for uncertainties safety device that is designed to close a valve, shut down a pres-
in material properties and construction. MOP is determined sure source, or relieve pressure from the pipeline.
from stress calculations, with internal pressure normally caus- If perfect operator performance and one safety device are
ing the largest stresses in the wall of the pipe. Material stress relied on, the pipeline owner is accepting a high level of risk of
limits are theoretical values, confirmed (or at least evidenced) reaching MOP. Error-free work techniques are not realistic and
by testing, that predict the point at which the material will fail industry experience shows that reliance on a single safety shut-
when subjected to hgh stress. down device, either mechanical or electronic, allows for some
External forces also add stress to the pipe. These external periods of no overpressure protection. Few points should be
stresses can be caused by the weight of the soil over a buried awarded to such situations.
line, the weight of the pipe itself when it is unsupported, tem- Note that the evaluator is making no value judgments at this
perature changes, etc. In general, any external influence that stage as to whether or not reaching MOP poses a serious threat
tries to change the shape of the pipe will cause a stress. Some of to life or property. Such judgments will be made when the “con-
these stresses are additive to the stresses caused by internal sequence” factor is evaluated.
pressure. As such, they must be allowed for in the MOP calcula- The “unlikely” description, category B, implies a pressure
tions. Hence, care must be taken to ensure that the pipeline source that can overpressure the segment and protection via
will never be subjected to any combination of internal pressures redundant levels of safety devices. These may be any combina-
and external forces that will cause the pipe material to be tion of relief valves; rupture disks; mechanical, electrical, or
overstressed. pneumatic shutdown switches; or computer safeties (program-
Note that MOP limits include safety factors. If pipeline seg- mable logic controllers, supervisory control and data acquisi-
ments with different safety factors are being compared, a differ- tion systems, or any kind of logic devices that may trigger an
ent measure of pipe strength might be more appropriate. overpressure prevention action). The requirement is that at least
Appendix C discusses pipe strength calculations. two independently operated devices be available to prevent
To define the ease of reaching MOP (whichever definition overpressure of the pipeline. This allows for the accidental
of MOP is used) a point schedule can be designed to cover failure of at least one safety device, with backup provided by
the possibilities. Consider this example point-assignment another.
schedule: Operator procedures must also be in place to ensure the
pipeline is always operated at a pressure level below the MOP.
A. Routine 0 pts In this sense, any safety device can be thought of as a backup to
Definition: Where routine, normal operations could allow proper operating procedures. The point value of category B
the system to reach MOP. Overpressure would occur should reflect the chances, relative to the other categories, of a