Page 57 - Pipeline Risk Management Manual Ideas, Techniques, and Resources

2/36 Risk Assessment Process
done by making comparisons with similar sections owned by main root cause was actually soil movements that will damage
the company or with industry-wide leak rates, as well as by any coating, eventually leading to a repeat leak (discounting the
benchmarking against specific other companies or by a combi- role of other corrosion preventions; see Chapter 3). In this case,
nation of these. the leak penalty in the risk assessment should have been
Note that an event history is only useful in predicting hture removed only after addressing the soil issue, not simply the
events to the extent that conditions remain unchanged. When coating repair.
corrective actions are applied, the event probability changes. This example illustrates that the investigators stopped the
Any adjustment for leak frequency should therefore be reana- analysis too early by not determining the causes of the
lyzed periodically. damaged coating. The root is often a system of causes that
should be defined in the analysis step. The very basic under-
Visual inspections standing of cause and effect is that every effect has causes
(plural). There is rarely only one root cause. The focus of
A visual inspection of an internal or external pipe surface may any investigation or risk assessment is ultimately on effec-
be triggered by an ILI anomaly investigation, a leak, a pressure tive solutions that prevent recurrence. These effective solu-
test, or routine maintenance. If a visual inspection detects tions are found by being very diligent in the analysis step (the
pipe damage, then the respective failure mode score for causes).
that segment of pipe should reflect the new evidence. Points A typical indication of an incomplete analysis is missing evi-
can be reassigned only after a root cause analysis has been dence. Each cause-and-effect relationship should be validated
done and demonstrates that the damage mechanism has been with evidence. If we do not have evidence, then the cause-
permanently removed. and-effect relationship cannot be validated. Evidence must be
For risk assessment purposes, a visual inspection is often added to all causes in the analysis step.
assumed to reflect conditions for some length ofpipe beyondthe In the previous example, the investigators were missing the
portions actually viewed. A conservative zone some distance additional causes and its evidence to causally explain why the
either side of the damage location can be assumed. This should coating was damaged. If the investigators had evidence of coat-
reflect the degree of belief and be conservative. For instance, if ing damage, then the next question should have been “Why was
poor coating condition is observed in one site, then poor coating the coating damaged?” A thorough analysis addresses the sys-
condition should be assumed for as far as those conditions tem of causes. If investigators cannot explain why the coating
(coating type and age, soil conditions, etc.) might extend. was damaged then they have not completed the investigation.
As noted earlier, penalties from visual inspections are Simply repairing the coating is not going to be an effective
removed through root cause analysis and removal of the root solution.
cause. Historical records of leaks and visual inspections should Technically, there is no end to a cause-and-effect chain-
included in the risk assessment even if they do not completely there is no end to the “Why?” questions. Common terminology
document the inspection, leak cause, or repair as is often the includes mot cause, direct cause, indirect cause, main cause,
case. Because root cause analyses for events long ago are prob- primaty cause, contributing cause, proximate cause, physical
lematic, and their value in a current condition assessment is cause, and so on. It is also true that between any cause-and-
arguable, the weighting of these events is often reduced, effect relationship there are more causes that can be added-we
perhaps in proportion to the event’s age. can always ask more “Why?” questions between any cause and
effect. This allows an analysis to dig into whatever level of
Root cause analyses detail is necessary.
The critical point here is that the risk evaluator should not
Pipeline damage is very strong evidence of failure mechanisms discount strong direct evidence of damage potential unless
at work. This should be captured in the risk assessment. there is also compelling evidence that the damage-causing
However, once the cause of the damage has been removed, if it mechanisms have been permanently removed.
can be, then the risk assessment should reflect the now safer
condition. Determining and removing the cause of a failure
mechanism is not always easy. Before the evidence provided by V. Lessons learned in establishing a risk
actual damage is discounted, the evaluator should ensure that assessment program
the true underlying cause has been identified and addressed.
There are no rules for determining when a thorough and com- As the primary ingredient in a risk management system, a risk
plete investigation has been performed. To help the evaluator assessment process or model must first be established. This is
make such a judgment, the following concepts regarding root no small undertaking and, as with any undertaking, is best
cause analyses are offered [32]. accomplished with the benefit of experience. The following
A root cause analysis is a specialized type of incident inves- paragraphs offer some insights gained through development of
tigation process that is designed to find the lowest level many pipeline risk management programs for many varied cir-
contributing causes to the incident. More conventional investi- cumstances. Of course, each situation is unique and any rules of
gations often fail to arrive at this lowest level. thumb are necessarily general and subject to many exceptions
For example, assume that a leak investigation reveals that a to the rules. To some degree, they also reflect a personal prefer-
failed coating contributed to a leak. The coating is subsequently ence, but nonetheless are offered here as food for thought for
repaired and the previously assigned leak penalty is removed those embarking on such programs. These insights include
from the risk assessment results. But then, a few years later, some key points repeated from the first two chapters of this
another leak appears at the same location. It turns out that the book.