PIPELINE M AINTENANCE PLANNING BASED ON Q UANTITATIVE RISK ANALYSIS. M. J. Stephens, M. Sc., P. Eng. M. A. Nessim, Ph. D., P. Eng.

Transcription

1 International Pipeline Conference Volume 1 ASME 1996 IPC PIPELINE M AINTENANCE PLANNING BASED ON Q UANTITATIVE RISK ANALYSIS M. J. Stephens, M. Sc., P. Eng. M. A. Nessim, Ph. D., P. Eng. Centre For Engineering Research Inc. Edmonton, Alberta Canada A B S TR A C T The integrity of aging pipeline systems is a major concern for operating companies. Because maintenance budgets are limited by economic constraints, operators must decide on how to best allocate the available maintenance resources. Optimal resource allocation involves the identification of high risk segments, and the determination of integrity maintenance activities for those segments that will lead to the highest reduction in overall operating risk. To identify high risk segments it is necessary to quantify the probability of line failure and to evaluate the consequences associated with different types of failure. To identify optim al maintenance activities for high risk segments it is also necessary to quantify the reductions in failure probabilities associated with various candidate integrity maintenance activities. Under the sponsorship of a number of pipeline companies and Government Agencies, C-FER has initiated a Joint Industry Program (JIP), to develop quantitative risk-based models and software tools for estimating the current level of operating risk and the risk reduction potential associated with distinct segments of pipe within a pipeline system. The key steps in the methodology are system prioritization and maintenance optimization. At the prioritization stage, segmentspecific attributes are processed to provide an estimate of the failure rate for individual segments, and an estimate of the potential consequences of line failure. The failure rates are then combined with the loss potential into a measure of risk, and used to rank segments according to the calculated level of operating risk. At the maintenance optimization stage, a formal decision analysis approach is employed to identify the best maintenance strategy for high risk segments based on a comparison of the costs and risk reductions associated with each available option. KEY WORDS Integrity Maintenance, Pipelines, Prioritization, Analysis, Risk Analysis, Influence Diagrams. Decision 1.0 IN T R O D U C T IO N The leak integrity of aging pipeline systems is a key issue for pipeline companies the world over. With limited maintenance resources, it is essential that the available funds be spent where they are most effective in reducing the risks posed by pipeline failures to life, the environment and financial assets. The uncertainties associated with the condition of buried lines has led to an increasing recognition of risk analysis as a basis for making decisions on integrity maintenance where Risk is defined as the probability of line failure multiplied by a measure of the adverse consequences associated with failure. A quantitative estimate of operating risk is an ideal measure of the adequacy of current maintenance activities. Furthermore, for a pipeline that requires improvements in maintenance, the estimated effect of a particular maintenance strategy on the risk is an excellent measure of its effectiveness. The essence of risk-based optimization of integrity maintenance activities is to use these measures as a basis for making decisions on how a pipeline system should be maintained. This paper describes a comprehensive methodology for riskbased integrity maintenance optimization of onshore and offshore natural gas, crude oil and petroleum product pipelines. The methodology has been developed and is currently being implemented in a software package called PIRAMID (Eipeline Risk Analysis for Maintenance and Inspection Decisions) under a jo in t industry program sponsored by a number of transm ission companies and government agencies based in Canada and the United States (see acknowledgment section). Copyright 1996 by ASME

2 2.0 FRAMEWORK FOR RISK-BASED M AINTENANCE OPTIM IZATION The main functions of a comprehensive integrity maintenance program are firstly, to prioritize different pipeline segments with respect to the need for integrity maintenance and secondly, to make decisions on the optimal integrity maintenance actions for each high priority segment. An overall risk-based framework, within which these functions can be achieved is illustrated in Fig. 1. It consists of the following steps: 1.System definition. Divide the pipeline system into appropriate segments that can be treated as individual units with respect to integrity maintenance. Each segment should be as uniform as possible with respect to the attributes that affect pipe integrity {e.g., age, material properties, coating type and environmental conditions). The segments should correspond to portions of the line for which the integrity maintenance actions being considered can be implemented {e.g., if pigging is considered then a segment must have pig traps at both ends). Once the segments are defined, the data required for a risk assessment of each segment must be collected. 2.System prioritization. Based on a risk assessment of each segment, identify segments with unacceptable levels of risk and target them for enhanced integrity maintenance. Targeted segments can be prioritized for action, based on the operating risk associated with each segment. 3.Maintenance optimization. For high priority segments, determine the optimal integrity maintenance action. Possible choices include the inspection or damage prevention method to be used, the frequency of maintenance events, and the damage repair threshold. The best choice can be defined as the one that achieves an optimal balance between risk reduction and cost. 4.Refinement of system prioritization. Refine segment priority rankings based on the information produced at the maintenance optimization stage, which includes the optimal maintenance choice, the resulting reduction in risk, and the associated cost, for each targeted segment. This information allows a refined priority ranking that, in addition to the risk level (see item 2), considers the value for money produced by the integrity program. 5.Maintenance implementation. Implement maintenance actions according to the final order of priorities. By selecting the most cost effective integrity option for each targeted segment, and by implementing these options in the order of decreasing value for money, maximum benefits can be derived from the pipeline maintenance budget. 3.0 APPLICATION OF QUANTITATIVE RISK A N A LY S IS Risk-based methods used in the pipeline industry can be classified into two broad categories, namely subjective index methods, and quantitative risk methods. System Definition Divide pipeline system into segments System Prioritization \ Conduct risk assessment for each segment and rank segments accor ding to the risk level Maintenance Optimization Determine optimal integrity maintenance strategy for each targeted segment Refinement of System Prioritization q Repeat lor all segments Figure 1 Framework for Risk-based Optimization of Pipeline Integrity Maintenance Activities Index methods assign subjective scores to a pipeline with respect to different factors that influence the probability and consequences of failure, then combine the scores, using simple subjective formulas, into an index representing the level of risk. The risk index is then used as a basis for ranking pipeline segments and making decisions on integrity maintenance. Index methods are conceptually simple, easy to implement, and provide a logical framework for exercising subjective judgment in the decision-making process. However, the resulting risk indices rank different pipeline segments with respect to each other, without any indication of how the risks associated with these segments compare to tolerable risk levels. Therefore, the results cannot be used to determine which pipeline segments require enhanced maintenance in the first place. In addition, the risk rankings of two segments is sensitive to the assumed relative contributions of different factors affecting the risk and since these factors are defined subjectively, there is a high potential for error. Finally, integrity maintenance decisions based on these subjective methods may be difficult to defend or justify to regulators and the public. Quantitative risk methods are based on a more objective approach that utilizes data and models to calculate risk. Properly applied, these methods can produce outcomes that are much more specific, accurate and easily defensible. Deterrents to the

3 application of quantitative risk methods include the relatively large level of effort required to implement them, the need for specialized expertise, the requirement for detailed modeling of pipe behaviour and product releases, and the need for substantial amounts of data regarding the condition of the pipeline and its route. These obstacles are being removed as more advanced pipeline models are developed and more sophisticated inspection technologies produce the data required to apply them. In addition, advancements in computer technology make it feasible to develop efficient and userfriendly software tools to assist pipeline engineers in carrying out quantitative risk assessments effectively and without extensive prior expertise in risk analysis. The foregoing indicates that the use of quantitative risk analysis as a basis for integrity maintenance decision making is both feasible and timely. Figure 2 illustrates the steps involved in executing the type of quantitative risk analysis necessary to implement the integrity maintenance framework described in Section 2.0. The first step is to identify the relevant failure modes for the pipeline (e.g., corrosion, crack-like defects, mechanical damage and ground movement). The probability of failure is then calculated as the sum of the probabilities for each relevant failure mode. The next step is to evaluate the financial, life safety, and environmental consequences of failure, and to combine the three consequence measures into a single measure of the total loss potential. The overall risk level can then be estimated as the product of the probability and consequences of failure. At this stage, system prioritization can be undertaken as discussed in Section 2.0. For each segment targeted for further analysis at the prioritization stage, the possible integrity maintenance options must be identified. These are related to the failure causes that contribute most significantly to the failure probability. For example, for external metal loss corrosion, maintenance options may include close interval surveys and in-line inspection. For mechanical damage, right-of-way surveys and first call systems may be considered. The reduction in failure probability resulting from each candidate maintenance action should then be estimated as a measure of the associated benefits. In each case, the total risk can be re-calculated as the product of the failure consequences and the new failure probability. Repeating this for all candidate integrity maintenance actions provides the necessary information to compare different options and optimize the maintenance strategy for each targeted segment. 4.0 KEY COMPONENTS OF THE PRESENT PROGRAM The joint industry program described in this paper is implementing the methodology described in Section 3.0 in a software system called PIRAMID (Pipeline Risk Analysis for Maintenance and Inspection Decisions). As indicated, the two key components in the methodology are system prioritization and maintenance optimization. These two components are discussed in the following sections. Quantify Financial Consequences Identify Hazards Calculate Failure Probability Quantify Safety Consequences I I Quantify Total Consequences.. Estimate Total Risk Identify Integrity Options Estimate Effect of Maintenance Strategy on the Failure Probability Re-calculate Risk Select Optimal Integrity Maintenance Strategy Technology Available Quantify Envro. Consequences Enhancements Required New Development Needed System Prioritization, Segment Maintenance Optimization/ Figure 2 State-of-the-art Assessment of the Technical Components of Risk-based Integrity M aintenance Optim ization 4.1 System Prioritization The system prioritization stage is intended to identify segments within a pipeline system that may present an unacceptable level of operating risk. To this end pipeline characteristics (or attributes) are evaluated to produce a line-specific estimate of the failure rate for each segment within the system as a function of failure cause (e.g., metal loss corrosion, mechanical damage, ground movement, crack-like defects, etc.), and an estimate is made of the potential consequences of segment failure in terms of three distinct consequence components (i.e., life safety, environmental damage, and economic impact). Cause-specific failure rates are then combined with a global measure of the loss potential associated with the different consequence components to produce a single measure of operating risk for all failure causes associated with each segment. Segments are then ranked according to the estimated level of risk, the intention being to identify (or target) potentially

4 high risk segments for subsequent detailed decision analysis at the maintenance optimization stage Probability Estimation The annual probability of failure of each segment within the operating system is calculated for each significant failure cause from baseline historical failure rate estimates which are adjusted to reflect the impact of line-specific attribute sets. Baseline failure rates for a given pipeline type (i.e., gas, high vapour pressure liquid, or low vapour pressure liquid) are obtained from statistical analysis of historical pipeline incident data which yields estimates of the annual number of failure incidents per unit line length. The baseline failure rates are then converted to line-specific estimates using failure rate modification factors that depend on the attributes of the line segment in question. The failure rate modification factors are calculated from the values of selected segment attributes using algorithms developed from statistical analysis of pipeline incident data and/or analytical models supplemented where necessary by expert judgement. The resulting line-specific failure rates are then converted to failure probability estimates by multiplying each failure rate by the length of the corresponding line segment. The pipeline attributes that are used to calculate the baseline failure rate modification factors are shown in Table 1. The table also shows the specific attribute sub-sets associated with the failure rate modification factor algorithm for each significant failure cause. The algorithms associated with each failure cause are developed from statistical analysis of historical pipeline incident data where the data permits the evaluation of the impact of specific attributes on the failure rate. Where historical incident data does not permit the development of algorithms on a statistical basis, because the attributes of interest are not reflected in the incident data structure or because insufficient data exists to establish a relationship, analytical models are employed as the basis for algorithm development. The analytical approach to algorithm development is based on fault tree analysis (McCormick 1981) and/or structural reliability theory (see Section 4.2.2). Finally, information deficiencies associated with both statistical and analytical models are addressed using subjective inputs developed from expert opinion. Note that the attribute set employed for probability estimation at the prioritization stage is not comprehensive; the pipeline literature suggests that line-specific failure rates are influenced by attributes not included in the set given in Table 1 (e.g., attributes that reflect the inspection and maintenance history of the line are not included). A a restricted attribute set has purposely been employed at the prioritization stage primarily to limit the information requirements associated with the system prioritization activity. In addition, it is noted that the impact of additional factors on the failure rate is addressed at the subsequent maintenance optimization stage where a more detailed estimate of operating risk is calculated as part of the formal decision analysis process conducted for the segments targeted by the initial risk ranking at the prioritization stage Consequence Evaluation The consequences of failure associated with a given segment are estimated using analytical models. The approach assumes that the consequences of pipeline failure are fully represented by three parameters: the total cost as a measure of the economic loss, the number of fatalities as a measure of risk to life, and the residual spill volume (after initial clean-up) as a measure of the long term environmental impact. The consequence assessment approach involves modeling the release of product from the pipeline; determination of the likely hazard types and their relative likelihood of occurrence; estimation of the hazard intensity at different locations; and calculation of the number of fatalities, the residual spill volume, and the total cost. The consequence modeling approach adopted for system prioritization is summarized in Fig. 3. The specific pipeline attribute set that is used to estimate the consequences of line failure are shown in Table 1. Figure 3 Key Components of Consequence Evaluation Model for System Prioritization The hazard types considered in the model include both the immediate hazards associated with line failure (e.g., jet/pool fires, vapour cloud fires or explosions, and toxic or asphyxiating clouds) as well as the long term environmental hazards associated with persistent liquid spills. The relative likelihood of occurrence of each hazard type is determined based on product type, line failure mode (i.e., leak vs. rupture) and adjacent land use type (as it affects the likelihood of product ignition). Hazard intensity models are structured to take into account the effects of pipeline geometry and operating characteristics (e.g., line diameter and operating pressure), the mode of line failure, and the weather conditions at the time of failure (e.g., wind speed and atmospheric stability).

5 Pipeline Segment Attributes External Corrosion Internai Corrosion Probability Estimation Mechanical Damage Pipe Diameter ' Pipe Wall ThïcKnëss......y......y......y... Ground Movement X... X... Pipe Body Yield Strength...y X... Pipe Body Séairri Weld Type Pipe Joint Type... X... SCC Material Defects X...X......X... Consequence Evaluation Life Environment Finacial Safety Cost X...y... X x... X......y... Line Age...y......y X... Line Elevation... y......x......y... Operating Pressure... X......y......X......x... Operating Pressuré Rangé...X......X... Cumulative Number of Pressuré Cycles...X... Operating Temperature... y......x......y......x......y... Product Flow Rate X X... x... Line Volume fraction of line capacity)... y X......y... Billing Abatement Threshold...y X x... Product T ransportation Distance... y... X...y... Block Valve Spacing... y X x... Time to Block Valve Spacing...y......X x... Detectable Reléase Volume y... ' X...y... Time to Leak Detection... y......x......y... Time tó Léak Stoppage (from time of detection)... y......x... X Depth of Cover...y... Adjacent Land U sé...y......y......x......y y Right-of-way Accessibility Right-of-way Condition... y... Right-of-wàÿ Patrol Frequency...x... Notification & Response System (i.e. onecall) Crossing Type 7 Special Terrain Features... y X x... Nëàr FiëldTëfrain Characteristics...X......X... General Soil Corrosivity...y... SCC Potential of Soli envirohméht... X... External Pipe Coating Typé...y......X... External Pipe Coating Condition...y......X... Cathodic Protection Level X Presence of Coating Shielding... X... Presence of Electrical interference or...y......x... Casing Short Product Corrosivity Ground Movement Potential...X... Pipe Damage Potential of Ground...X... Movement Surface water within Sdo m Drinking Water within 5 km X Other Water within 5 km Land Use within 5 km Sensitive Environment within 10 km Sensitive Groundwater within 10 km Table 1 Pipeline Segment Attributes considered in Risk Ranking

6 Fatality estimation, based on the hazard characterization models, reflects the population density associated with a given land use and takes into account the effect of shelter and/or escape on survivability. Estimation of residual spill volume takes into account the product clean-up potential associated with the spill site and incorporates a factor that adjusts the volume measure to reflects both the environmental damage potential of the spilled product as well as the damage sensitivity of the environment in the vicinity of the spill site. The total cost estimate includes: the direct costs associated with line failure including the cost of lost product, line repair, and service interruption; and the costs that are dependent on the type of release hazard including the cost of property damage, spill clean-up, and fatality compensation. The three distinct consequence measures calculated using the models are combined into a single measure of the total loss potential associated with line failure by converting fatality estimates and residual spill volume estimates into equivalent costs. This conversion is carried out based on the so-called willingness to pay concept which involves making an estimate of the amount of money that society would be willing to pay to avoid a particular adverse outcome. Using this approach, the cost equivalent of a human fatality can estimated by determining the amount of money that society would be willing to pay to avoid the loss of a statistical life (Acton 1976). Similarly an estimate can be made of the amount of money that society would be willing to pay to avoid the long-term environmental damage associated with the spill of a reference volume of a specific product at a specific reference location (Desvousges et al. 1989) Risk Ranking Multiplication of the segment-specific failure probability estimate for a given failure cause by the associated combined loss estimate (a financial cost estimate including the cost equivalent of human fatalities and residual spill volume) produces an estimate of operating risk defined as the expected annual loss associated with a given segment of pipeline for the failure cause in question. Summation of the risk estimates for all failure causes associated with a given segment gives an estimate of the total expected annual loss associated with segment operation. Dividing these segment risk estimates by the corresponding segment length yields normalized risk estimates that allow comparison of calculated risks between segments of different lengths.- These cause-specific and combined-cause risk estimates form the basis for a quantitative ranking of all segments identified within a given pipeline system. The form of the output generated at the system prioritization stage is illustrated in Fig M aintenance O ptim ization The maintenance optimization stage is intended to refine the risk estimate and to assess available integrity maintenance alternatives to determine the optimal set of inspection and maintenance activities for segments and specific failure causes targeted at the prioritization stage. At this stage targeted segments are subjected to formal decision analysis. In the analysis the current extent of line damage or damage potential is estimated and candidate maintenance strategies are evaluated to obtain an estimate of their likely effect on the existing or potential extent of line damage, the intent of which is to permit calculation of the current level of risk and the degree of risk reduction associated with each maintenance strategy. The risk reduction potential and cost of implementation associated with each candidate maintenance strategy is then evaluated using a value function based on utility theory or constrained cost optimization to reveal the optimum maintenance strategy for the segment and failure cause in question. System N orthern S ector / February 1996 Designation: Risk Ranking Segment Name Failure Cause Expected Cost ($/km*yr) 1 Loop 13 E xternal C orrosion 9, Loop 23 S tress C orrosion C racking 8,500 3 Loop 23 E xternal C orrosion 8,000 4 Loop 8 G rou n d M o ve m e n t 6,800 5 Loop 6 E xternal C orrosion 6,800 6 Loop 13 M echanical Dam age 2,500 7 Loop 23 M echanical Dam age 2,000 8 Loop 1 E xternal C orrosion 1,450 9 Loop 3 E xternal C orrosion 1, Loop 8 E xternal C orrosion 1,100 0 Figure 4 Format of Output Generated by System P rio ritizatio n Decision Analysis Approach Selecting an optimal integrity maintenance action is a problem of optimization under uncertainty. The most comprehensive approach for solving such problems is decision theory {e.g., Keeney and Raiffa 1976), which provides a systematic and consistent method to evaluate alternatives and make optimal choices. The specific decision analysis implementation used in this work is based on influence diagrams. Figure 5 shows a simplified decision influence diagram for the integrity maintenance optimization problem. The diagram consists of a network of nodes and directed arcs. The nodes represent the parameters affecting the decision problem and the arcs represent the relationships between these parameters. A decision parameter is represented by a square node and an uncertain parameter is represented by a circular node. In Fig. 5, the decision node is represented by the set of choices for integrity maintenance action.

7 / \ V Decision node: Indicates a choice to be made Example: Run a high or low resolution pig Random variable node: Indicates uncertain parameter or event Example: How will the pipeline perform in the next year? (safe, leak or rupture) Value node: Indicates the criterion used to evaluate consequences Arrow: Indicates probabilistic dependence Example: The final consequences depend on the costs associated with the maintenance action taken and the performance of the pipeline Failure Probability Estimation - The Pipe Performance Node The pipe performance node in Fig. 5 represents the uncertainty regarding whether or not the pipeline will have a failure incident in a given period of time, and regarding the type of failure (i.e., small leak, large leak or rupture) if an incident occurs. Expansion of this node in the influence diagram is a means of estimating the failure probabilities, considering the impact of the integrity maintenance actions being contemplated. Distinction is made between: 1) inspection and maintenance strategies directed at preventing potential damage (e.g., mechanical damage); and 2) inspection and maintenance strategies directed at finding and repairing existing damage (e.g., corrosion pits, cracklike defects and excessive longitudinal strain due to ground movement). Influence diagrams that expand the performance node for the two cases are shown in Figs. 6 and 7. The nodes used in these diagrams represent generic descriptions of the parameters that would be needed to solve a particular problem. For example, if the maintenance is directed toward the prevention of corrosion failures, the node representing existing damage extent in Fig. 7 will contain a number of parameters representing the number, depth and length of corrosion flaws. the Optimal Decision is the one giving the highest expected value Figure 5 Basic Framework for Integrity Maintenance Decision Making Using Influence Diagram s Pipe performance represents whether or not the pipeline will fail, and this is an uncertain parameter. The arrow emanating from the decision node into the pipe performance node indicates that the latter is probabilistically dependent on the former. Similarly, the final consequences (expressed in terms of cost or number of fatalities) are uncertain and dependent on both the choice made and the resulting pipe performance. The last node in a decision influence diagram is called the value node which is represented by the rounded square. This node defines the objective or value function that is used as a basis for optimization. If the value function is defined such that it gives a higher expected value for preferable choices, the optimal choice can be identified as the one that maximizes the expected value. The expected value associated with each choice can be calculated using an efficient algorithm developed by Shachter (1986). Development of the maintenance optimization approach adopted herein involves the characterization and expansion of the pipe performance, consequences, and value nodes shown in Fig. 3. In doing so, realistic influence diagrams are created that can be solved to make optimal decisions on different aspects of an integrity maintenance program. These three aspects are discussed in the following sections. Figure 6 Conceptual Influence Diagram for Decision Analysis of Integrity Maintenance Strategies Directed Towards Reduction of Damage P o ten tia l Actions that reduce damage potential (Fig. 6) are assumed to be represented by a single decision (e.g., to increase patrol frequency or implement a first call system). For actions that manage existing damage (Fig. 7), a series of decisions are considered: 1) the choice of inspection method; 2) the choice of a defect repair criterion; and 3) the time to next inspection. In this case the diagram shows the sequence in which the choices are made and the parameters that have an influence on the down-stream choices. The influence diagrams show that the segment performance is dependent on the damage extent (or damage potential) remaining after inspection and maintenance actions are taken, which in turn depends on the initial extent of damage (or damage potential), as well as on the choice of inspection and maintenance action.

8 a means of estimating the various consequence components taking into account the impact of the physical and operating characteristics of the pipeline, and the probabilistic nature of parameters such as the failure location, and the weather conditions at the time of failure. Figure 7 Conceptual Influence Diagram for Decision Analysis of Integrity Maintenance Strategies Directed Towards Reduction of Damage E x te n t Figure 7 illustrates the analytical approach adopted for calculating the probability of pipeline failure. This approach, based on structural reliability theory (e.g., Madsen et al. 1986), utilizes a deterministic failure prediction model and a probabilistic analysis that accounts for the effect on failure probability of uncertain quantities such as pipeline damage extent, pipeline operating conditions, and line pipe mechanical properties. The analytical approach is further illustrated in Fig. 8 for the problem of metal loss corrosion. For this failure mechanism the probability of line failure can be calculated using a model of the remaining strength of corroded pipe (e.g., based on ASME standard B31G) and probability distributions of the operating pressure, yield strength, corrosion feature length and depth, corrosion growth rate, and model error. The analytical approach to probability estimation requires detailed analyses of pipe behaviour, however it has the advantage of being based on data that are much more easily obtainable than the incident data that would be required to link the failure rate statistically to pipeline attributes. For example, operating pressure and steel material property data are usually well documented. Information on corrosion feature geometry can be obtained from in-line inspection or dig data. This type of data is collected routinely during inspection and therefore the available databases will continue to grow as more inspections are carried out Consequence Evaluation - The Consequences Node The consequences node in Fig. 5 represents the uncertainty associated with the consequences of pipeline operation which include the financial costs associated with integrity maintenance activities and the consequence components associated with pipeline failure. Expansion of this node in the influence diagram is Figure B Illustration of Analytical Approach to Estimating Pipe Performance A consequence oriented expansion of the simplified decision influence diagram is shown in Fig. 9 which identifies the individual parameters that are assumed to affect the consequences of line failure. The figure also serves to illustrate the level of modeling detail associated with consequence evaluation that is employedat the maintenance optimization stage. As for prioritization, the modeling approach assumes that the consequences of pipeline failure are fully represented by the total financial cost, the number of fatalities, and the residual spill volume. The consequence assessment approach is as described for prioritization (see Section 4.1.2) except that the total financial cost estimate is expanded to include an estimate of the direct cost associated with the choice of integrity maintenance action (i.e.,

9 Figure 9 Consequence Analysis Influence Diagram Based on Individual Parameters maintenance cost) and the three distinct consequence measures are not combined into an equivalent total financial cost Criteria for Evaluating Choices - The Value Node The value node in Fig. 5 is a function of the total cost c, the number of fatalities n, and the residual spill volume v. This function is defined in such a way as to ensure that preferred combinations of the three parameters (c, n, and v) have a higher value associated with them. Two distinct approaches for defining value are incorporated in the methodology: 1. Utility theory. This is a formalized approach to developing a value function that results in the selection of an optimal compromise between life safety, environmental impact and economic considerations. The theory can be used to define a utility function u = u(c, n, v) which ranks different combinations of c, n and v according to their perceived total impact. The optimal decision is the one that maximizes the expected utility (see Fig. 10a). Utility functions can be formulated to take into account such aspects as aversion to risk (e.g., the negative impact of one incident causing 100 fatalities is perceived to be more severe than the impact of 100 separate incidents, each causing one fatality), tradeoffs between life and economic losses, and soft parameters such as public outrage. Developing a utility function involves defining explicit tradeoff values between cost and losses in life (i.e., defining the economic value of a human life), and between cost and environmental damage. 2. Constrained cost optimization. This approach assumes that life safety and environmental impact are treated as constraints that are set by regulators or defined on the basis of precedent. Within these constraints, the solution that produces the least expected total cost is considered optimal (see Fig. 10b). In this approach it is also possible to introduce an available maintenance budget as a constraint on the optim ization process. The advantage of this approach is that tradeoffs between cost on the one hand and life safety or environmental impact on the other hand are not necessary because risk management with respect to life or the environment is demonstrated by meeting recognized tolerable risk levels. However, if the expenditures required to meet the life safety constraint are in conflict with the maintenance budget constraint, the approach gives no guidance regarding a reasonable compromise.

10 Figure 10 Choices a) Using the Expected Utility Approach I I Constraint Met I I Constraint Not Met Maximum. Allowable Optimal Risk Individual Risk (per year) b) Using the Constrained Cost Optimization Approach Illustration of the Proposed Decision Evaluation Criteria It should be recognized that for pipelines in unpopulated areas that are not environmentally sensitive, cost is the major consideration. In these cases, both of the utility and constrained cost optimization approaches reduce to a simple cost minimization criterion. For pipeline segments where life safety and/or environmental damage issues are significant, either the utility optimization approach or the constrained cost optimization approach can be used. The most suitable choice depends on the relevant regulatory regime and the level of comfort of the decision-maker with explicit consideration of tradeoffs between costs, safety and the environment; 5.0 SUM MARY A quantitative risk analysis methodology for integrity maintenance planning is described in the paper. The methodology can be used to prioritize pipeline segments for maintenance and to select optimal maintenance actions for each targeted segment. It is applicable to both onshore and offshore pipelines transm itting natural gas or hydrocarbon liquids, including both High and Low Vapour Pressure products. The key stages in the methodology include system prioritization and maintenance optimization. At the prioritization stage, segment-specific attributes are processed to provide an estimate of the failure rate for individual segments, and an estimate of the potential consequences of line failure. The failure rates are then combined with the loss potential into a measure of risk, and used to rank segments according to the calculated level of operating risk. At the maintenance optimization stage, a formal decision analysis approach is employed to identify the best maintenance strategy for high risk segments based on a comparison of the costs and risk reductions associated with each available option. The methodology is being developed and incorporated into a software package (PIRAMID) under a joint industry project. Several software modules are now available for onshore pipelines, including a system prioritization module and a corrosion maintenance optimization module which links to a generic consequence oriented decision analysis module. Future releases will include maintenance optimization modules for other significant failure causes including mechanical damage, crack-like defects and ground movement. Corresponding PIRAMID modules for offshore pipeline systems are also under development with the prioritization and consequence oriented decision analysis modules already available. ACKNOW LEDGMENTS The work described in this paper was sponsored by Foothills Pipe Lines Ltd., the Gas Research Institute, Interprovincial Pipe Line Inc., the National Energy Board of Canada, NOVA Corporation and the US Minerals Management Service. The authors are grateful for permission to publish this information. 7.0 R EFERENCES Acton, J. P Measuring the Monetary Value of Lifesaving Programs. Law and Contemporary Problems, Vol. 40, No. 4. Desvousges, W. H., Dunford, R. W. and Domanico, J. L Measuring Natural Resource Damages: An Economic Appraisal. API publication No. 4490, American Petroleum Institute, Washington, D.C. Keeney. R. L. and Raiffa H Decisions with Multiple Objectives: Preferences and Value Tradeoffs. John Wiley and Sons, New York. Kulkami, R. B., Conroy, J. E., Wilke, T. L., Wemer, D. P., and Krauss, W. E Inspection and Maintenance Priorities for Gas Transmission. Gas Industries, Vol. 37, No. 10,

11 Madsen, H. O., Krenk, S. and Lind, N. C Method of Structural Safety. Prentice-Hall Inc., Englewood Cliffs, New lersey. McCormick, N. J Reliability and Risk analysis. \cademic Press Inc., N.Y. Shachter, R. D Evaluating Influence Diagrams. Dperations Research, Vol. 34, No. 6, November - December.