Page 145 - Pipeline Risk Management Manual Ideas, Techniques, and Resources

6/122 Incorrect Operations Index
the other party. In such cases, allowances must be made for remote observation provides some additional backupthe
the other party’s procedures and operating discipline. monitoring personnel can at least notify field personnel to take
Uncertainty may be reduced when there is direct inspection action.
or witnessing of the calibration and maintenance of the other Points can be given for such systems when such observation
party’s safety equipment, but this does not replace direct is reliable 95 to 100% of the time. An example would be a pres-
control ofthe equipment. sure that is monitored and alarmed (visible andor audible sig-
There is some redundancy between this variable and the pre- nal to observer) in a control room that is manned 24 hours a day
viously assessed MOPpotential since safety systems are noted and that has a communication reliability rate of more than 95%.
there also. A point schedule should be designed to accommo- On notification of an abnormal condition, the observer can dis-
date all situations on the pipeline system. [Note: The evaluator patch personnel to correct the situation.
must decide if she will be considering the pipeline system as a
whole (ignoring section breaks) for this item. A safety system E. Remote, observation and control This is the same situa-
will often be physically located outside of the pipeline seg- tion as the previous one with the added feature of remote con-
ments it is protecting (see Example 6.3 later).] An example trol capabilities. On notification of rising pressure levels, the
schedule follows: observer is able to remotely take action to prevent overpressure.
This may mean stopping a pump or compressor and opening or
A. No safety devices present 0 pts closing valves. Remote control capability can significantly
B. On site, one level only 3 pts impact the risk picture only if communications are reliable-
C. On site, two or more levels 6 pts 95% or better for both receiving of the pressure signal and
D. Remote, observation only 1 Pt transmission of the control signal. Remote control generally
E. Remote, observation and control 3 pts takes the form of opening or closing valves and stopping pumps
F. Non-owned active witnessing -2 pts or compressors. This condition receives more points because
G. Non-owned no involvement -3 pts more immediate corrective action is made possible by the addi-
H. Safety systems not needed IO pts tion of the remote control capabilities.
In this example schedule, more than one safety system “con- R Non-owned, active witnessing Here, overpressure pre-
dition” may exist at the same time. The evaluator defines the vention devices exist, but are not owned, maintained or con-
safety system and the overpressure scenarios. He then assigns trolled by the owner of the equipment that is being protected.
points for every condition that exists. Safety systems that are The pipeline owner takes steps to ensure that the safety
not thought to adequately address the overpressure scenarios device(s) is properly calibrated and maintained by witnessing
should not be included in the evaluation. Note that some condi- such activities. Review of calibration or inspection reports
tions cause points to be subtracted. without actually witnessing the activities may, in the evalua-
tor’s judgment, also earn points. Points awarded here should
A. No safety devices present In this case, reaching MOP is reflect the uncertainties arising from not having direct control
possible, and no safety devices are present to prevent overpres- of the devices. By assigning negative points here, identical
sure. Inadequate or improperly designed devices would safety systems under different ownerships would have differ-
also fall into this category. A relief valve that cannot relieve ent point values. This reflects a difference in the risk picture
enough to offset the pressure source is an example of an inef- caused by the different levels of operator control and involve-
fective device. Lack of thermal overpressure protection where ment.
the need exists is another example of a situation that should
receive 0 pts. G. Non-owned. no involvement Here again, the overpressure
devices are not owned operated, or maintained by the owner of
B. On site, one level For this condition a single device, the equipment that is being protected. The equipment owner is
located at the site, offers protection from overpressure. The site relying on another party for her overpressure protection. Unlike
can be the pipeline or the pressure source. A pressure switch the previous category, here the pipeline owner is taking no
that closes a valve to isolate the pipeline segment is an example. active role in ensuring that the safety devices are indeed kept in
A properly sized relief valve on the pipeline itself is another a state of readiness. As such, points are subtracted-the safety
example. system effectiveness has been reduced by the added uncer-
tainty.
C. On site, two or more levels Here, more than one safety
device is installed at the site. Each device must be independent H. Safety systems not needed In the previous item, MOP
of all others and be powered by a power source different from potential, the most points were awarded for the situation in
the others. This means that each device provides an independ- which it is impossible for the pipeline to reach MOP. Under this
ent level of safety. More points should be awarded for this situa- scenario, the highest level ofpoints is also awarded for this vari-
tion because redundancy of safety devices obviously reduces able because no safety systems are needed.
risk.
For all safety systems, the evaluator should examine the sta-
D. Remote, observation on!v In this case, the pressure is tus of the devices under a loss of power scenario. Some valves
monitored from a remote location. Remote control is not and switches are designed to “fail c1osed”on loss oftheir power
possible and automatic overpressure protection is not present. supplies (electric or pneumatic, usually). Others are designed
While not a replacement for an automatic safety system, such to “fail open,” and a third class remains in its last position: “fail