Proceedings of the 2012 9th International Pipeline Conference IPC2012 September 24-28, 2012, Calgary, Alberta, Canada

IPC2012-90045
BENCHMARKING PIPELINE RISK ASSESSMENT PROCESSES

Peter Tuft Peter Tuft & Associates West Pymble, NSW, Australia

Nader Yoosef-Ghodsi C-FER Technologies Edmonton, AB, Canada

John Bertram Capability by Design Granville, NSW, Australia

ABSTRACT The Australian pipeline design code AS 2885 is largely a riskbased standard, and its safety management study process is admirably suited to the needs of the Australian industry. However it is a unique process that has been developed in Australia and is not used anywhere else in the world. Successfully benchmarking it against other risk assessment methodologies would put the basis of the Australian approach on a footing that would be more difficult to challenge should a major pipeline disaster result in a public enquiry. And if the comparison reveals shortcomings in the AS 2885 process then there will be a sound basis for addressing those shortcomings to improve the process. The APIA Research and Standards Committee and the Energy Pipelines CRC commissioned studies to compare the AS 2885 SMS process against two alternative methods: Reliability-based analysis Quantitative risk assessment based on historical failure rates

INTRODUCTION Risk assessment is not an absolute science. Although it requires a firm technical basis, the methods and criteria used are also strongly determined by social, cultural and historical influences. Hence we see different approaches adopted in different parts of the world. Methods used range from highly analytical and quantitative through to more qualitative, almost subjective approaches. This paper makes no attempt to analyse how the various risk assessment methods used around the world came to be adopted in each location, but just recognises that each method is valid within its own technical and regulatory culture. However the differences present a potential problem in comparing the results from different methods of assessment. How can one compare the outcomes from quantitative and qualitative analyses? The question is relevant to validation of the risk assessment method embodied in the Australian Standard for hydrocarbon pipelines, AS 2885 [1]. AS 2885 takes a qualitative approach that has been widely used in Australia for nearly 15 years now and which appears to work well in the sense that it produces reasonably consistent results across a diversity of pipelines and situations and passes a common sense test. However until this study it had never been benchmarked against other risk assessment methods and hence was potentially vulnerable to criticism that it may underestimate risk, or alternatively that it overestimates risk and hence incurs unnecessary risk mitigation costs. Two other methods were selected for comparison: Reliability-based analysis (RBA) has been developed largely by C-FER and is included as an option in the Canadian code CSA Z662 [2]; it is a numerical technique that has been developed from first principles specifically for pipelines. Quantitative risk assessment (QRA) based on historical failure rates is widely used for assessing hazardous Copyright 2012 by ASME

Each study looked at the same four pipeline segments spanning a variety of urban locations in which the consequences of a major pipeline failure would be very serious. Each of the four segments had previously been through the AS 2885 safety management study process and found to present a level of risk that was borderline tolerable. The objective of the studies was to determine whether the alternative risk assessment methods also found a level of risk that was similarly borderline tolerable. This paper will present the results of the comparison studies, showing that all three methods produce broadly similar outcomes for risks that are close to the borderline between tolerable and intolerable. This is a welcome endorsement of the AS 2885 SMS process and reinforces its validity as a method for assessing and managing pipeline safety.

installations such as chemical plants and is used for pipelines in some jurisdictions. Neither of these methods are used routinely for Australian pipelines. In fact this study appears to be the first application of RBA in Australia. Some state jurisdictions in Australia favour QRA prior to approval of new pipelines, perhaps seeing it at an extension of its use for single-site hazardous industries, but the pipeline industry considers it not the most appropriate method for a variety of reasons. Even where QRA is required by a regulator or planning authority it does not supplant the safety management study mandated by AS 2885 which among other things has a tight focus on potential causes of failure and their mitigation. Despite the lack of adoption of RBA and QRA for pipelines in Australia we recognise that they are used elsewhere. RBA was selected for comparison because it is soundly based on first principles and has been developed specifically for pipelines. QRA was selected because it is sometimes used in Australia and more widely used in other jurisdictions.

motivations behind this study. Hence other than choosing suitable test cases (as described below) there was no attempt to set up the analyses so they would be suitable for comparison. Making the comparisons became somewhat more difficult as a result but it remains possible. Characterising the outcome of risk assessment as a yes/no decision is of course a considerable simplification. There may be a great deal of complexity in establishing both the estimated risk level and the criterion against which it is compared, and both may have considerable uncertainty (explicit or otherwise). Nevertheless any complexity or uncertainty does not change the principle that the objective of risk assessment is a dichotomous decision about whether or not to accept the risk.

TEST CASES The pipeline segments used in these studies were selected because they had already been through the AS 2885 SMS process as part of the owners obligation to review the SMS at regular intervals. Each pipeline segment is 500 m long. The pipeline segments are not identified anywhere in the documentation associated with this study because the pipeline owner requested that they remain confidential. All four segments were in urban locations where the consequences of a failure could potentially be catastrophic two in location class T1 (suburban - conventional Australian detached houses) and two in location class T2 (high density shopping centres and multi-storey residential and office buildings). One T1-T2 pair was from a pipeline that was originally designed for rural conditions, the other pair was from a pipeline that had been conservatively designed for an urban environment. More detailed descriptions of the segments are in Annex A. The four cases were designated as follows:
Table 1 Test Cases

NOMENCLATURE ALARP ILI QRA RBA SMS as low as reasonably practicable in-line inspection quantitative risk assessment reliability based analysis safety management study, as per AS 2885

BASIS FOR COMPARISON The ultimate objective of pipeline risk assessment is to provide the basis for a decision on whether the risk is tolerable to society. That decision is essentially binary - either the risk is tolerable or it is not [3]. Any risk assessment method eventually ends with this decision on tolerability of the risk, and that provides the key to comparison of very different methods. In this study four test cases were selected from previous AS 2885 safety management studies for real pipelines. In each case the risk levels resulting from the AS 2885 risk assessment were only borderline tolerable (although some were closer to the borderline than others). The same pipeline segments were then analysed by the two quantitative methods. The objective was to make a comparison on the basis of whether or not the quantitative methods also yielded a risk level that was borderline tolerable. If the results were otherwise (eg. one method showing a borderline risk, another showing a clearly intolerable risk) then there would be cause for concern about one or perhaps both methods. The intention was for each method to be used exactly as it would be on a real project, without any influence from the
1

Location Class Urban design (A) Rural design (B)

T1 (suburban) T1A T1B

T2 (high density) T2A T2B

For the purpose of this study the most important differences between the A and B pipelines are wall thickness and diameter. The pipeline designed for rural conditions (B) is not much more than half the thickness of the line designed for urban conditions (A). That substantially increases its vulnerability to mechanical damage, with penetration more likely and full bore rupture possible in extreme cases. In contrast, Pipeline A meets the AS 2885 No Rupture criterion1. Lower wall thickness in

No rupture design is a requirement of AS 2885 (Clause 4.7.2) for new pipelines in high consequence areas but some older pipelines also comply.

Copyright 2012 by ASME

Pipeline B also provides less margin for metal loss due to corrosion. Pipeline A is over twice the diameter of Pipeline B and hence has potential to affect a larger area in the event of a full bore rupture. While this is relevant to the quantitative methods it is less relevant to the SMS because of the No Rupture characteristic of Pipeline A. In most other respects the A and B pipelines are broadly similar. Pipeline B has a somewhat higher operating pressure but both lines operate at a roughly similar same hoop stress of 40-50% SMYS.

failure can be ruled out, are subject to risk evaluation. The result is that under AS 2885 risk evaluation is applied to relatively few but quite specific threats. The risk evaluation method is qualitative, based on a conventional risk matrix. Grades are assigned to the estimated frequency and severity of an event and the resulting risk rank is read from the matrix. Severity ratings range from Trivial (minimal impact) to Catastrophic (multiple fatalities). Frequency ratings range from Frequent (expected to occur several times) to Hypothetical (theoretically possible but has never occurred on a similar pipeline). Failure severity is assessed on dimensions including not only safety but also supply disruption and environmental effects. Supply is a significant issue because the Australian pipeline system has little redundancy and single failure may have serious economic and social effects across a large city or much of a state (and has done so on two occasions although neither incident involved failure of an onshore pipeline). The risk matrix contains five risk ranks: Negligible, Low, Intermediate, High and Extreme. The latter two are unacceptable and must be reduce to Intermediate or lower. The Intermediate rank is the borderline tolerable case. Risks that earn this rank can be accepted only if they are shown to be As Low As Reasonably Practicable (ALARP). (There are further requirements for formally demonstrating that ALARP is achieved but the details are not relevant here.) The Intermediate risk rank is the key to the comparison with other risk methods in this study because it represents the threats that are only borderline tolerable. Threats that earn an Intermediate risk rank in an SMS should also be close to whatever risk acceptance criterion is adopted in alternative risk evaluation methods. SMS Outcomes Pipeline A. Both the suburban (T1) and high density (T2) segments of Pipeline A were confronted by similar threats. The selection of threats was deliberately conservative and hence some were only marginally relevant (eg. penetration as a result of heavy digging by a machine of a size most unlikely to be used in this fully developed suburban environment). All of the third party damage threats earned a Low risk rank, so are not of much interest here. (The risk was low because this pipe is thick and cannot be ruptured by any threat that is credible in the area.) The worst mechanical damage failure would be a hole of around 40 mm, resulting in a few fatalities at worst (most likely to be the operators of the machine causing the damage as they are very close to the failure). The corrosion risks were Intermediate because they had a higher likelihood despite lower severity. This brief description glosses over some detailed deliberation of different corrosion causes (cased crossings, disbonded coating) and the existing mitigations (cathodic protection, coating defect surveys, in-line inspection). It is worth noting that the consequences of a corrosion failure were mainly the societal and economic effects of supply disruption rather than safety. 3 Copyright 2012 by ASME

AS 2885 SAFETY MANAGEMENT STUDY SMS Method The AS 2885 risk assessment method is part of the broader safety management study mandated by the Standard. The SMS is a process for identifying threats to a pipeline, eliminating them where possible by applying protective measures, and assessing the risk of residual threats that cannot be eliminated. It is applicable at all stages of a pipeline life cycle from conceptual design through to decommissioning. The process is specified in full in AS 2885 and described in some detail in Tuft [4]. While the SMS puts a great deal of emphasis on eliminating threats this paper focusses mainly on the final phase of the process: the evaluation of risks that cannot be eliminated. However that final evaluation phase cannot be properly described without some background on the preceding steps. Because the SMS process is based (tacitly) on a cause and control model of risk management it begins with identification of threats - anything whatsoever that could cause pipeline damage or failure. There is usually a great deal of emphasis on third party damage but all other causes or contributors to failure are valid subjects for consideration, including all aspects of the pipeline management system. A fine-grained analysis of potential threats is required. It is not sufficient to just identify third party damage, but to look at the types of third party activities and equipment used in the vicinity of the pipeline and then consider the protection against each individual activity. For example, in the urban areas within this study typical third party threats might include excavation by backhoe for maintenance of buried utilities, installation of new utilities by both conventional trenching and horizontal drilling, road maintenance or reconstruction, installation of power poles, replacement of power poles after damage by a vehicle accident, etc. For each identified threat the measures in place to prevent it culminating in failure are reviewed and a judgement is made as to whether that threat is adequately controlled and can be eliminated as a cause of failure. For a pipeline that is well designed and well managed the great majority of threats can usually be eliminated. Those specific threats remaining, for which the SMS workshop participants are not confident that

In summary, Pipeline A had a risk level at the low end of the Intermediate range as a result of corrosion threats. Third party damage presents a lower risk. Pipeline B. The SMS workshops for Pipeline B were done at a different time by a different group of people, using an approach which differed slightly in detail. Nevertheless the SMS took a similarly conservative approach to identification of threats. Again, essentially the same threats apply to both the T1 and T2 segments. Seven relevant threats were identified, four Intermediate and three Low. All involved external interference. Corrosion was considered by the workshops to be adequately managed through cathodic protection and regular in-line inspection and was not subject to risk evaluation. (Interestingly, had it been evaluated it would probably have emerged at the low end of the Intermediate range for the same reason as the Pipeline A corrosion risk.) In summary, Pipeline B presents a risk level that is Intermediate for external interference reasons and possibly also for corrosion reasons. It differs from Pipeline A in that the external interference risk is significantly higher.

therefore, the probability of failure is equal to the probability that the load will exceed the resistance.
Resistance distribution

Load distribution

Load or Resistance Mean load Mean resistance

Overlap leading to failure probability

Figure 1 Calculation of Probability of Failure from Load and Resistance distributions

RELIABILITY-BASED ANALYSIS RBA Overview The reliability of an engineered system can be defined as the probability that it will not fail within a prescribed period of time. For a linear system such as a pipeline, which could contain multiple damage features or potential damage locations distributed along its length, it is more appropriate to define the reliability as the probability that a given length of line will not fail within a prescribed time period (typically one year). In this case, the relevant probability is the total probability of failure associated with all existing damage features, and all potential damage locations, contained within the length of line under consideration. The key to reliability assessment based on this approach is the selection of appropriate evaluation lengths and the establishment of defendable reliability thresholds (or reliability targets), above which continued pipeline operation is deemed acceptable. The choice of an appropriate evaluation length depends on the way in which the pipeline could interact with the surrounding environment in the event of failure. In general, this interaction potential depends on the product type being transported (as it affects the type of hazard that develops at the time of failure) and the physical and operational characteristics of the pipeline (as they influence the rate and/or amount of product release in the event of failure). The reliability analysis is based on structural response models as conceptually illustrated in Figure 1. It acknowledges that there are uncertainties associated with both the load effect and the corresponding pipe resistance. The load and resistance are therefore characterised by probability distributions that assign probabilities to the range of possible load and resistance values. Failure will occur if the applied load exceeds the resistance;

The pipe resistance is usually calculated from a structural response model that uses as input the pipe geometry and material properties. For a given pipeline segment, there are uncertainties associated with the values of these input parameters. In addition, there is some degree of uncertainty associated with the response models used to calculate the pipe resistance because every model involves some assumptions and idealisations. It is due to these parameter and model uncertainties that the pipe resistance is uncertain, and probabilistic analysis methods can be used to calculate the probability distribution of the pipe resistance from the response model and the probability distributions of the input parameters and model uncertainties. The estimation of the probability of failure requires calculation of the probability distribution of the pipe resistance and combining it with the probability distribution of the load. The approach employed in this study involved simulation-based methods and software as developed by C-FER under joint industry sponsorship [5, 6]. RBA Approach The reliably-based analysis and risk acceptance criteria were based on the Reliability Based Design and Assessment (RBDA) method incorporated in Annex O of the Canadian pipeline standard CSA Z662-07. The basis for Annex O is a set of guidelines and supporting documents developed by C-FER under Pipeline Research Council International, Inc. (PRCI) sponsorship [7, 8], which describe a reliability-based process that is intended to deliver a design and/or an integrity management program that affords an adequate level of safety to people living or working in proximity to a given pipeline. The Annex O methodology was used to calculate the probability of failure for each of the pipeline segments considered in this study. The calculated failure probabilities were compared to the maximum allowable failure probability values based on the reliability targets specified in Annex O. The failure probability for all significant integrity threats (i.e. 4 Copyright 2012 by ASME

corrosion and equipment impact) was calculated using the structural reliability approach. The basis for the corrosion assessment was inline inspection (ILI) data. In conducting the assessments, the primary focus was on the as-built and as-inspected condition of each of the four line segments over a time period extending from the time of the last ILI to the anticipated time of the next inspection. Pipeline A is currently scheduled for re-inspection every 15 years. Pipeline B is currently scheduled for re-inspection at a maximum interval of 10 years, with the next inspection being in 8 years. The ILI tool used to inspect Pipeline B was identified as having a relatively low feature sizing accuracy. To quantify the detrimental impact of a low accuracy inspection tool on pipeline reliability (and to illustrate the benefits of inspection using higher accuracy tools), hypothetical inspection scenarios were considered wherein Segments T1B and T2B were assumed to have been inspected using a more accurate ILI tool with a performance similar to that used in the previous inspection of Pipeline A. In calculating the probability of failure due to equipment impact, each pipeline segment was analysed assuming an excavation activity rate of either 0.01 or 0.02 events per km-yr. This range of activity rates was back-calculated from historical incident data specific to Australian pipelines [9]. This data was used in conjunction with a proprietary fault tree model that relates excavation activity rates to expected impact frequencies as a function of a range of possible damage prevention measures. For the purpose of this paper results are reported only for the higher (conservative) equipment impact rate. The failure modes consist of a) small leak due to corrosion (corrosion leak) and b) burst due to either corrosion or equipment damage. Further, the analysis recognised that a burst failure could be either a large leak or a full-bore rupture, and it combined the two failure modes by applying a correction factor to the probability of a large leak to reflect the less serious consequences relative to a rupture. All mechanical damage results were then reported under the heading burst. The RBA method does not recognise the no rupture design of Pipeline A, but it happens that the predicted failure rates for rupture are very low. RBA Results The RBA considered the probabilities of failure due to corrosion or equipment damage and presents the outcomes as graphs of failure rate versus time. These figures show a qualitative difference between corrosion and equipment damage: the probability of a corrosion failure increases steadily over time as corrosion proceeds, but the probability of a failure due to mechanical damage is constant over time (assuming that there is no change in the threat environment around the pipeline). For the purpose of this comparison study the results of the leak and burst analyses are expressed somewhat differently:

Leak (corrosion) - In all cases the probability of corrosion failure is initially very low but becomes unacceptable after some time period beyond the last in-line inspection. This duration until the target failure rate is exceeded gives an indication of how tolerable the corrosion risk may be. Burst (corrosion plus mechanical damage) - The tolerability of the risk can be assessed more simply through a direct comparison of the predicted and target failure rates.

The target failure rates varied depending on the failure mode and the pipeline situation. In all cases the target for small corrosion leaks was 1% per km-yr. (This is much higher than current corrosion failure rates in Australia which are so low as to be almost immeasurable.) The target failure rates for burst failure varied with population density and were much lower at around 10 -6 per km-yr, reflecting the more serious consequences of a large leak or rupture. The table below summarises the outcomes of the RBA, as interpreted from the graphical output of the analysis. The total burst failure rate is the sum of burst failure rates due to mechanical damage (constant) and corrosion (increasing with time). The total burst failure rate is calculated for the year when the next ILI is scheduled so as to account for the maximum contribution of corrosion threat over the period to the next ILI (a conservative approach).
Table 2 RBA Outcome Summary Segment Years until corrosion target exceeded Target rate for burst, 10-6/km-yr Failure rate for burst, 10-6/km-yr Ratio of burst failure rate to target rate T1A 25 0.45 0.085 0.2 T2A 17 0.05 0.13 2.6 T1B 5 13 26 2 T2B 5 8 20 2.5

For the line segments that failed to meet the reliability requirements of Annex O, the shortcomings are attributed to an unacceptably high probability of failure due to equipment impact (Segments T2A and T2B) and/or the very high degree of uncertainty inherent in the feature detection capability and sizing accuracy of the ILI tool used for corrosion inspection (Segments T1B and T2B). Where the failure rate exceeds the target rate the risk is above the level tolerable under the RBA principles. However ratios of around 2 between target and failure rate are not particularly significant in an analysis where the outcomes can span across orders of magnitude. These results show that the under reliability-based analysis the four pipeline segments present a level of risk that is above but close to the borderline of tolerability for burst and possibly for corrosion leak. 5 Copyright 2012 by ASME

QUANTITATIVE RISK ASSESSMENT QRA Method The QRA study [10] undertook an assessment of both individual risk and societal risk. The assessment took into account specific pipeline design features such as design pressure, diameter, as well as the pipeline safeguards such as wall thickness and depth of cover. A review of data sources, alternate methodologies and criteria was also undertaken as part of the QRA study. As with all QRA methodologies, the results depend greatly on the data selected for the assessment. Generally a conservative approach is taken to take into account the uncertainty of the data sources. The assessment approach was based on the New South Wales Department of Planning (NSW DoP) guidelines for hazard analysis [11, 12], however a review of alternative approaches and criteria was undertaken (e.g. WorkSafe Victoria, UK Health and Safety Executive). The NSW DoP criterion requires the individual risk of fatality at residential areas to not exceed a level of 1 x 10-6 per year (i.e. one fatality would be expected to occur in a million years). The NSW DoP also have societal risk criteria defined on a plot of number of fatalities against frequency of that number of fatalities. The criteria define three zones where risk is considered negligible, tolerable if ALARP and intolerable. The consequence of pipeline hazards was assessed by calculating the release rates for a number of release scenarios (e.g. corrosion, third party impact, rupture) and modelling the heat radiation impact of ignited releases. The likelihood of the release occurring was derived from publicly available data sources for pipeline incidents. The pipelines studied have distinct characteristics that have an impact on the QRA results. Pipeline A has a larger diameter, which will result in a higher release rate for the worst case scenario (pipeline rupture), resulting in higher risk levels at far distances from the release. Pipeline B has a higher MAOP which will result in higher release rates for the same hole sizes (except for the pipeline rupture case as Pipeline B has a smaller diameter than Pipeline A). Pipeline A has a larger wall thickness than Pipeline B, reducing the likelihood of releases resulting from third party impact. Pipeline Incident Frequencies While Australian frequency data would be most relevant the Australian incident data set is not large enough for useful statistical analysis other than a summary of overall incident rates with limited breakdown by location class. A review of data sources for pipeline incident frequencies was undertaken, both from available sources for Australian and overseas pipelines. A detailed comparison between data sources was not undertaken as this has been reported previously [9]. The review showed that the reported frequency of pipeline incidents in Europe, for instance, was significantly higher than that for Australian pipelines. The reasons for this discrepancy

were not apparent and may be an interesting topic for future investigation but that is outside the scope of this study. The data published by the European Gas Pipeline Incident Data Group (EGIG) includes a statistical breakdown by a number of factors, including cause, hole size, wall thickness, depth of cover, etc [13]. This allows a more detailed assessment of incident frequency, taking into account the design features and safeguards for the individual pipeline being studied. The EGIG data was used for the current QRA study for this reason. Because the EGIG incident frequency is up to 15 times greater than the Australian frequency this gives a conservative result, but that is generally consistent with the conservative approach required for QRA. QRA Results For individual risk, all cases meet the 1 x 10-6 criterion at a distance of 7 - 18 m from the pipeline as shown in Figure 2. For all pipeline segments the nearest houses or other buildings are generally (but not always) just outside this distance. Hence it is reasonable to conclude that the risk level is borderline. The societal risk levels for these pipeline segments fall generally within the NSW DoP Tolerable if ALARP zone as shown in Figure 3, so are definitely only borderline tolerable. However the neat fit within the ALARP zone is to some extent illusory since the analysis also included comparison against societal criteria from other jurisdictions and for some of those the results are not such a neat fit to the borderline zone. Nevertheless all are broadly in the borderline tolerable region. For both individual and societal risk Pipeline B presents a slightly higher risk at shorter distances, reflecting its thinner wall, but at greater distances Pipeline A presents the highest risk because its substantially larger diameter results in a larger area affected by a full bore rupture (and hence more people affected in the case of societal risk). Overall, the risk level calculated by QRA for all four pipeline segments is borderline tolerable.

COMPARISON OF OUTCOMES It is to be expected that the outcomes from the three very different analysis methods are to some extent incommensurable, not just because the results are expressed in different terms but because they did not all examine the same failure scenarios, and to some extent used different measures of failure consequences. Possible failure scenarios include a relatively small corrosion leak (considered by all three methods), large leak due to a mechanical damage puncture (not addressed by RBA) and full bore rupture (not addressed by SMS for Pipeline A). The overall results are summarised in the following table:

Copyright 2012 by ASME

Table 3 Comparison Summary

Analysis Method Pipeline Corrosion leak Puncture Rupture

QRA individual risk include consideration of population density. The discrepancies in the corrosion risks also deserve comment. As noted above, the SMS risk was borderline but only on supply grounds and would have been tolerable on safety grounds. The QRA individual risk is also borderline, given the conservative approach of the methodology and criteria in general and particularly the high failure data as just discussed. Subject to these interpretations the corrosion risk results would be more consistently either tolerable or at the low end of the borderline range. Perhaps the greatest difference between the various risk analysis methods is not in the level of risk predicted but in the usefulness of that result for guiding the reduction of risk. RBA, as used in this study, had particular value in illustrating the way in which corrosion risk increased over time and hence providing guidance on when in-line inspection should be done so that unacceptable corrosion defects could be identified and repaired. RBA is also able to quantify the risk reduction offered by both physical and procedural protection measures. QRA also has some ability to consider the effects of additional physical protection (eg. concrete slabbing) but it seems unlikely that the historical data would be available to allow for effective analysis of most procedural measures such as patrolling. Traditionally QRA has perhaps been used most commonly for single-site hazardous industries where risk to third parties can be mitigated by defining buffers zones around the site. That is not an option available to pipelines, and the QRA results themselves provide little or no guidance on other measures that could be adopted to reduce risk. In contrast, because an SMS starts with a fine-grained analysis of threats, those threats that result in the highest risks then present themselves as obvious targets for risk reduction measures. Those measures may be by physical or procedural, and may be applied to the pipeline as a whole, a limited portion of it, or specific locations as required by the nature and location of the high-risk threats. Even more importantly, the nature of the SMS workshop, involving a range of stakeholders, means that many risk reduction measures are identified and adopted before any risk evaluation is done. For low-risk pipelines it is possible to complete an SMS with no actual risk analysis and yet still identify a substantial number of improvements to the safety of the pipeline. (To be strictly correct, Clause 2.3.6 of AS 2885.1 requires evaluation of the risk of all controls failing, even if there is no other risk evaluation, so every properly-conducted SMS will include at least one risk analysis.) SMS, QRA and RBA serve somewhat different purposes. QRA serves to satisfy authorities (and therefore the public) that the overall level of risk from a pipeline is tolerable. RBA has potential in Australia for optimising corrosion management strategies, and possibly other risk management in particularly challenging locations. Both QRA and RBA may also have scope as methods for ranking alternative risk reduction strategies, where the absolute level of risk is less important than 7 Copyright 2012 by ASME

SMS

A B

Borderline Borderline Tolerable (~20 y) note Tolerable (5 y) note Borderline Borderline Borderline (low) Borderline (low)

Tolerable Borderline n/a n/a Borderline (low) Borderline (low) Borderline Borderline

n/a Borderline Borderline Borderline Tolerable Tolerable Borderline Borderline (low)

RBA

A B

QRA individual

A B

QRA societal

A B

Note: RBA found that the risk of corrosion leak is generally tolerable now, but will become intolerable at various times in the future without in-line inspection and possibly repair.

DISCUSSION It is evident from the table that most results are borderline tolerable. While there are of course some discrepancies between different analysis methods there are no gross inconsistencies. It is particularly interesting to note that the differences between analysis methods are greater than the differences between the two pipelines, notwithstanding that at face value Pipeline B appears to be substantially more vulnerable than Pipeline A. The implication is that all risk analysis results should be regarded as at best indicative and an aid to decision-making, rather than as providing some absolute measure of risk level. The QRA results are known to be conservative (by around an order of magnitude) because the EGIG data on which they are based shows incident rates about 15 times greater than suggested by Australian data as discussed previously. The fact that the QRA and SMS results here are reasonably well aligned suggests that the SMS approach may in fact be substantially more conservative than QRA would be if it could be based on Australian incident data. A significant discrepancy is that the while RBA and QRA give finite likelihood to full bore rupture the SMS considered rupture essentially non-credible for Pipeline B as noted previously. For failure by full bore rupture it is notable that all methods that considered it yield a borderline result except QRA individual risk which is tolerable. However all methods except

selection of the risk reduction measures that will be most effective. However SMS remains the preferred risk management tool of the Australian pipeline industry because of its focus on threat identification and wide-ranging mitigation of the identified threats, with analysis of risk almost a secondary requirement that is applicable only to threats that cannot be fully controlled.

[3] Hopkins, A., 2011, Risk-management and rule-compliance: Decision-making in hazardous industries, Safety Science, 49(2), pp 110-120 [4] Tuft, P., 2008, The Australian Approach to Pipeline Safety Management, IPC2008-64622, 7th International Pipeline Conference, Calgary. [5] Stephens, M. J., Nessim, M. A., 1996, Pipeline Maintenance Planning Based on Quantitative Risk Analysis, Proceedings of the International Pipeline Conference, Calgary. [6] Nessim, M. A., Stephens, M. J. and Kariyawasam, S. N., 1998, Optimization of Pipeline Maintenance Activities for Time-Dependent Failure Causes PIRAMID Technical Reference Manual No. 6.0, Confidential to C-FERs Pipeline Program Participants, C-FER Report 97032, May. [7] Nessim, M. A. and Zhou, W., 2005, Target Reliability Levels for the Design and Assessment of Onshore Natural Gas Pipelines, GRI Report No. GRI-04/0230. [8] Nessim, M. A. and Zhou, W., 2005, Guidelines for Reliability Based Design and Assessment of Onshore Natural Gas Pipelines, GRI Report No. GRI-04/0229, C-FER Report No. L080, July. [9] Tuft, P. and Bonar, C, 2009: The Australian Experience with the Pipeline Incident Database, presented at the 2009 Australian Pipeline Industry Association Conference. [10] Sherpa Consulting Pty Ltd, 2011: Gas Pipeline Quantitative Risk Assessment Study, Summary Report, Energy Pipelines Cooperative Research Centre (EPCRC), Report No. J20445-001, Revision 0. [11] NSW Department of Planning, 2011: Hazardous Industry Planning Advisory Paper No. 4, Risk Criteria for Land Use Planning. [12] NSW Department of Planning, 2011: Hazardous Industry Planning Advisory Paper No. 6, Guidelines for Hazard Analysis. [13] European Gas Pipeline Incident Data Group, 2008: 7th EGIG Report 1970-2007, Gas Pipeline Incidents, 7th EGIG Report of the European Gas Pipeline Incident Data Group.

CONCLUSIONS The comparison of risk analysis methods shows that for pipeline scenarios that are only borderline tolerable all three methods produce broadly the same result, within the large uncertainties inherent in any risk evaluation. The AS 2885 safety management study process is confirmed as consistent with reliability-based analysis and quantitative risk assessment. The Australian pipeline industry can continue to use the SMS process with confidence that it estimates risk at least as reliably as alternative computationally-based methods, and with the additional benefit of a strong focus on identification of risk reduction measures regardless of whether or not a formal risk analysis is necessary.

ACKNOWLEDGMENTS This work was funded by the Energy Pipelines Cooperative Research Centre, supported through the Australian Governments Cooperative Research Centres Program. The support of the Research & Standards Committee of the Australian Pipeline Industries Association is gratefully acknowledged. REFERENCES [1] Standards Australia, 2007, AS 2885.1-2007, Pipelines gas and liquid petroleum, Part 1: Design and construction. [2] Canadian Standards Association (CSA), 2007, CSAZ662 (2007), Oil and Gas Pipeline Systems

Copyright 2012 by ASME

Figure 2 QRA Individual Risk Results

Figure 3 QRA Societal Risk Results

Copyright 2012 by ASME

ANNEX A TEST CASE DESCRIPTIONS

Pipeline A Designed for urban conditions DN 750 MAOP <3000 kPa, hoop stress ~40% SMYS Cover 1200 mm (or slabbed if less) Wall thickness ~10 mm Large excavator may be able to penetrate with a single sharp tooth Critical defect length 280 mm, meets AS 2885 No rupture criterion 240 m distance to 12.6 kW/m2 radiation contour Coal tar enamel coating Pipeline B Designed for rural conditions, later subject to urban encroachment DN 300 MAOP ~4500 kPa, hoop stress ~50% SMYS Cover 1200 mm Wall thickness ~5 mm Could be penetrated by sharp tooth on a large backhoe; large excavator could penetrate with both points of tiger tooth Critical defect length 120 mm, very large excavator could cause rupture 120 m distance to 12.6 kW/m2 radiation contour Dual layer PE tape coating

Both pipelines are ~40 years old; both undergo in-line inspection every few years, revealing some defects but no critical corrosion Segment T1A Suburban area, detached houses on lots of around 600 m2; little multiple occupancy and no sensitive land uses Beside multi-lane highway Approx. 160 houses within 12.6 kW/m2 radiation contour Segment T2A Inner city, some high rise buildings and some large areas of public open space, also roads that may be very congested Within and beside multi-lane inner city roads Population hard to estimate, probably many hundreds if not thousands within 12.6 kW/m2 Segment T1B Suburban area, detached houses on lots of around 600 m2; little multiple occupancy and no sensitive land uses Beside suburban street Approx. 45 houses within 12.6 kW/m2 radiation contour Segment T2B Suburban shopping centre and three storey apartments (including retirement living) on one side, suburban area on other side In landscaped median strip of secondary road Population hard to estimate, probably at least 200 people within 12.6 kW/m2 contour

10

Copyright 2012 by ASME