Page 55 - Pipeline Risk Management Manual Ideas, Techniques, and Resources

2/34 Risk Assessment Process
Exaniple Direct evidence adjustments
Corrosion threat = (environment) x [(coating) + (cathodic
protection)] Risk evaluation is done primarily through the use of variables
that provide indirect evidence of failure potential. This includes
Option 3 avoids the need to create codes for interactions of vari- knowledge of pipe characteristics, measurements of environ-
ables. For example, a scoring rule such as “cathodic protection mental conditions, and results of surveys. From these, we infer
is not needed = 10 pts” would not be needed in this scheme. It the potential presence of active failure mechanisms or failure
would be needed in other scoring schemes to account for a case potential. However, active failure mechanisms are directly
where risk is low not through mitigation but through absence of detected by in-line inspection (ILI), pressure testing, and/or
threat. visual inspections, including those that might be prompted by a
The scoring should also attempt to define the interplay leak. Pressure testing is included here as a direct means because
of certain variables. For example, if one variable can be it will either verify that failure mechanisms, even if present,
done so well as to make certain others irrelevant, then the have not compromised structural integrity or it will prompt a
scoring protocol should allow for this. For example, ifpatrol visual inspection.
(perhaps with a nominal weight 20% of the third-party If direct evidence appears to be in conflict with risk assess-
damage potential) can be done so well that we do not care ment results (based on indirect evidence), then one of three
about any other activity or condition, then other pertinent scenarios is true:
variables (such as public education. activity level, and depth
of‘cover) could be scored as NA (the best possible numerical 1. The risk assessment model is wrong; an important variable
score) and the entire index is then based solely on patrol. In has been omitted or undervalued or some interaction of
theory, this could be the case for a continuous security pres- variables has not been properly modeled.
ence in some situations. A scoring regime that uses multipli- 2. The data used in the risk assessment are wrong; actual
cation rather than addition is better suited to capturing this conditions are not as thought.
nuance. 3. There actually is no conflict; the direct evidence is being
The variables shown in Chapters 3 through 6 use a variation interpreted incorrectly or it represents an unlikely, but sta-
of option 2. All variables start at a value of 0, highest risk. Then tistically possible event that the risk assessment had dis-
safety points are awarded for knowledge of less threatening counted due to its very low probability.
conditions and/or the presence of mitigations.
Any of the options can be effective as long as a point assign- It is prudent to perform an investigation to determine which
ment manual is available to ensure proper and consistent scoring. scenario is the case. The first two each have significant implica-
tions regarding the utility of the risk management process.
Variable calculations The last is a possible learning opportunity.
Any conclusions based on previously gathered indirect
Some risk assessment models in use today combine risk vari- evidence should be adjusted or overridden when appropriate,
ables using only simple summations. Other mathematical rela- by direct evidence. This reflects common practice, espe-
tionships might be used to create variables before they are cially for time-dependent mechanisms such as corrosion-
added to the model. The designer has the choice of where in best efforts produce an assessment of corrosion potential,
the process certain variables are created. For instance, if D/t but that assessment is periodically validated by direct obser-
(pipe diameter divided by wall thickness) is often thought to be vation.
related to crack potential or strength or some other risk issue. A The recommendation is that, whenever direct evidence of
variable called D/t can be created during data collection and its failure mechanisms is obtained, assessments should assume
value added to other risk variables. This eliminates the need to that these mechanisms are active. This assumption should
divide D by t in the actual model. Alternatively, data for diame- remain in place until an investigation, preferably a root cause
ter and wall thickness could be made directly available to the analysis (discussed later in this chapter). demonstrates that the
risk model’s algorithm which would calculate the variable D/t causes underlying the failure mechanisms are known and have
as part of the risk scoring. been addressed. For example, an observation of external cor-
Given the increased robustness of computer environments, rosion damage should not be assumed to reflect old, already-
the ability to efficiently model more complex relationships is mitigated corrosion. Rather, it should be assumed to represent
leading to risk assessment models that take advantage of active external corrosion unless the investigation concludes
this ability. Conditional statements “If X then Y,” including otherwise.
comparative relationships [“if bop density) > 2 then (design Direct or confirmatory evidence includes leaks, breaks,
factor) = 0.6, ELSE (design factor) = 0.72”] are becoming anomalies detected by ILI, damages detected by visual inspec-
more prevalent. tion, and any other information that provides a direct indication
The use of these more complex algorithms to describe of pipe integrity, if only at a very specific point. The use of ILI
aspects of risk tend to mirror human reasoning and decision- results in a risk assessment is discussed in Chapter 5.
making patterns. They are not unlike very sophisticated The evidence should be captured in at least two areas of the
efforts to create expert systems and other artificial intelli- assessment: pipe strength and failure potential. If reductions
gence applications based on many simple rules that are not severe enough to warrant repairs, then the wall loss or
represent our understanding. Examples of more complex strength reduction should be considered in the pipe strength
algorithms are shown in the following chapters and in evaluation (see Chapter 5). If repairs are questionable (use of
Appendix E. nonstandard materials or practices), then the repair itself