Page 50 - Pipeline Risk Management Manual Ideas, Techniques, and Resources

Designing a risk assessment model 2/29
Risk factors
Attributes andpreventions
Tvpes of information
Because the ultimate goal of the risk assessment is to provide a
Central to the design ofa risk model are the risk factors or vari- means of risk management, it is sometimes useful to make a
ables (these terms are used interchangeably in this text) that distinction between two types of risk variables. As noted earlier,
will be included in the assessment. A complete list of risk fac- there is a difference between a hazard and a risk. We can usually
tors, those items that add to or subtract from the amount of do little to change the hazard, but we can take actions to affect
risk, can be readily identified for any pipeline system. There is the risk. Following this reasoning, the evaluator can categorize
widespread agreement on failure mechanisms and underlying each index risk variable as either an attribute or a prevention.
factors influencing those mechanisms. The attributes correspond loosely to the characteristics of the
Setting up a risk assessment model involves trade-offs hazard, while the preventions reflect the risk mitigation meas-
between the number of factors to be considered and the ease of ures. Attributes reflect the pipeline’s environment-character-
use of the model. Including all possible factors in a decision istics that are difficult or impossible to change. They are
support system, however, can create a somewhat unwieldy sys- characteristics over which the operator usually has little or no
tem. So, the important variables are widely recognized, but the control. Preventions are actions taken in response to that envi-
number to be considered in the model (and the depth of that ronment. Both impact the risk, but a distinction may be useful,
consideration) is amatter of choice for the model developers. especially in risk management analyses.
In this book, lists ofpossible risk indicators are offered based Examples of aspects that are not routinely changed, and are
on their ability to provide useful risk signals. Each item’s spe- therefore considered attributes, include
cific ability to contribute without adding unnecessary com-
plexities will be a function of a user’s specific system, needs, Soil characteristics
and ability to obtain the required data. The variables and the Type of atmosphere
rationale for their possible inclusion are described in the Product characteristics
following chapters. The presence and nature ofnearby buried utilities
It is usually the case that some data impact several different
aspects of risk. For example, pipe wall thickness is a factor in The other category, preventions, includes actions that the
almost all potential failure modes: It determines time to failure pipeline designer or operator can reasonably take to offset risks.
for a given corrosion rate, partly determines ability to sur- Examples ofpreventions include
vive external forces, and so on. Population density is a conse-
quence variable as well as a third-party damage indicator (as a Pipeline patrol frequency
possible measure of potential activity). Inspection results yield Operator training programs
evidence regarding current pipe integrity as well as possibly Right-of-way (ROW) maintenance programs
active failure mechanisms. A single detected defect can yield
much information. It could change our beliefs about coating The above examples of each category are pretty clear-cut. The
condition, CP effectiveness, pipe strength, overall operating evaluator should expect to encounter some gray areas of dis-
safety margin, and maybe even provides new information about tinction between an attribute and a prevention. For instance.
soil corrosivity, interference currents, third-party activity, and consider the proximity of population centers to the pipeline.
so on. All of this arises from a single piece of data (evidence). In many risk assessments, this impacts the potential for
Many companies now avoid the use of casings. But casings third-party damage to the pipeline. This is obviously not an
were put in place for a reason. The presence of a casing is a mit- unchangeable characteristic because rerouting of the line is
igation measure for external force damage potential, but is usually an option. But in an economic sense. this characteristic
often seen to increase corrosion potential. The risk model may be unchangeable due to unrecoverable expenses that may
should capture both of the risk implications from the presence be incurred to change the pipeline’s location. Another example
of a casing. Numerous other examples can be shown. would be the pipeline depth of cover. To change this character-
A great deal of information is usually available in a pipeline istic would mean a reburial or the addition of more cover.
operation. Information that can routinely be used to update the Neither of these is an uncommon action, but the practicality of
risk assessment includes such options must be weighed by the evaluator as he classifies a
risk component as an attribute or a prevention. Figure 2.3 illus-
All survey results such as pipe-to-soil voltage readings, leak trates how some of the risk assessment variables are thought to
surveys, patrols, depth of cover, population density, etc. appear on a scale with preventions at one extreme and attributes
Documentation of all repairs at the other.
Documentation of all excavations The distinction between attributes and preventions is espe-
0 Operational data including pressures and flow rates cially useful in risk management policy making. Company
Results of integrity assessments standards can be developed to require certain risk-reducing
Maintenance reports actions to be taken in response to certain harsh environments.
Updated consequence information For example, more patrols might be required in highly popu-
Updated receptor information-new housing, high occu- lated areas or more corrosion-prevention verifications might be
pancy buildings. changes in population density or environ- required under certain soil conditions. Such a procedure would
mental sensitivities, etc. provide for assigning a level of preventions based on the level
0 Results of root cause analyses and incident investigations of attributes. The standards can be predefined and programmed
Availability and capabilities of new technologies into a database program to adjust automatically the standards to