In the AS 2885 risk matrix the five frequency levels are:
- Frequent – expected to occur once per year or more
- Occasional – may occur occasionally in the life of the pipeline
- Unlikely – unlikely to occur within the life of the pipeline, but possible
- Remote – not anticipated for this pipeline at this location
- Hypothetical – theoretically possible but has never occurred on a similar pipeline
I get the impression that a lot of people struggle to interpret some of those descriptions, particularly those lower on the scale. I bypass that problem by using supplementary numerical guidelines, as mentioned in this post with additional supporting information here.
However not everyone is comfortable with departing from a strictly literal interpretation of the standard (notwithstanding the inherent contradiction in literal interpretation of something as ambiguous and subjective as the frequency descriptions). The main problem is with the Hypothetical description which includes the words “… has never occurred on a similar pipeline”. Many people seem to interpret that as “has never occurred” without further qualification, so if a similar type of failure occurred on a pipeline somewhere in the world they feel unable to adopt the Hypothetical frequency. However the bit about “a similar pipeline” is critical.
A “similar pipeline” is not just one of similar diameter and pressure rating but one which has similar characteristics in terms of its protection against the threat in question. In some cases even diameter and pressure rating might be irrelevant. For the commonly encountered external interference threats the relevant similarities are include particularly the physical protection and procedural protection and perhaps also the installation environment (population density, level of third party activity, etc).
The other consideration is that is it crucial to carefully identify the exact failure consequences for which one is estimating the frequency. A hit on the pipe does not equate to a full bore rupture and multiple fatalities. There is perhaps no type of external interference for which it can honestly be said that it has never occurred to a pipeline somewhere. So it might be correct to never accept the Hypothetical frequency rating for a strike on the pipe. But a strike is just a strike – in the great majority of cases it will result in a gouge or dent with no effect on safety or supply.
To get to the extreme worst case of full bore rupture and multiple fatalities you need:
- Initial strike on the pipe, AND
- Impact sufficient to penetrate the pipe, AND
- Resulting hole large enough to exceed critical defect length and rupture, AND
- Ignition of the escaping fluid, AND
- Sufficient people present and unable to escape or shelter
Each “AND” has a conditional probability that is quite small, of the order of 10% [1]. By the time you combine all those probabilities the likelihood of multiple fatalities is less than 1000th of the likelihood of the initial strike. So to take the example of, say, damage by a power pole auger for a pipeline in a suburban street, it may be quite reasonable to adopt a frequency of Unlikely for a strike, but completely unreasonable to then apply that frequency to the case where it results in multiple fatalities.
The number of catastrophic pipeline failures that have genuinely resulted in multiple fatalities is very small – San Bruno, Ghislenghien, Carlsbad are the only transmission pipeline disasters I can find from the last 20 years, and only Ghislengien was an external interference failure (San Bruno was a construction defect, Carlsbad was corrosion).
Don’t feel inhibited about adopted the Hypothetical frequency rating.
[1] My statement about the conditional probabilities being of the order 10% is supported by evidence mainly from historical incident data but the details are a bit complex to include here.
Pipelines OZ 
This also brings up a subject which Peter and I were discussing yesterday – how do you determine the break point between ‘a few’ fatalities (MAJOR severity rating) and ‘multiple’ fatalities (CATASTROPHIC severity rating). My definition is that if the fatalities are confined to the crew operating the machinery which causes the incident the severity would be MAJOR regardless of the size of the crew, whilst an incident which results in the death of non-involved third parties would be CATASTROPHIC: this means that in particular circumstances two or three deaths would be CATASTROPHIC whilst in different circumstances the same number would only be MAJOR. A personal interpretation and I would very much like to hear other people’s views on this matter.
And we also need to consider not just the death toll, but the contribution the pipeline makes to that toll. An example of Hypothetical that I have come across before is a 747 (or to be more up to date, an A380) crashing onto the pipeline. There will definitely be multiple casualties, but they would occur anywhere the plane crashed: we only need consider the extent to which the pipeline rupture added to that death toll.
A subject which will be debated as long as we carry out SMS workshops.
Chris,
I suspect you are reading more into the standard than it says or was intended. Is there any good reason for distinguishing between fatalities to workers or the general public? They are all human beings and their families certainly wouldn’t distinguish.
To more directly answer the question of “few” versus “multiple” I have always felt that “few” meant a mere handful – maybe five at very most, probably less. Maybe it’s just me but in my mind I think of “few” as just defined and “several” as being maybe 6-8 (that’s not relevant to AS 2885, except that it expands on my own interpretation of these descriptive terms). Anyway, there is no way one can estimate the number of fatalities with this degree of precision – it’s either a few or lots.
There is no question that we should only count the contribution of the pipeline to the death toll. My only quibble with your Hypothetical example is that I always use that same case to illustrate a threat that is non-credible (unless the pipeline is under the flight path very close to an airport!). “Non-credible” is defined in 1.6.33 of AS 2885.1.
Hi Peter,
It’s good to discuss this issue. I personally think that we need numerical guidelines to assist interpretation of the frequency descriptions, and adopt a similar scale to you when carrying out risk assessments. Using the scale for guidance provides a tangible framework in the risk discussion to plot how we move from risks arising from uncontrolled threat to when they are controlled. The process that you have described of breaking down each step in the chain of events and applying a risk reduction factor for each step is for me the only effective way of articulating (and then documenting) the reasons for concluding that the frequency and of the nominated consequence falls in any given frequency band. In a workshop environment, it helps to keep the discussion focused and structured, which can otherwise be difficult if you are relying purely on the definitions.
Cheers
Richard
Richard,
I agree wholeheartedly that we should use approximate numerical guidelines – as you know I’ve been doing that in my own work for many years. At the time the 1997 and 2007 versions of the standard were drafted there wasn’t much information available on Australian failure rates. That is changing as there is more data accumulated in the incident database and more analysis of it, so it is becoming useful.
I’m pretty wary about using the historical failure rates as the sole means of estimating frequency for a bunch of reasons including some that I mentioned in a recent post. However data on average incident rates is valuable as a sanity check on whether frequency judgements are in the right ball park.