ASMEB31 8S Risk Modeling Summary

Portal detail 1ASMEB31 8S Risk Modeling Summary asmeb31-8s-risk-modeling-summaryrmwg0816.pdf (383.39 KB) The ASME B31.8 Committee is open to improvements and new suggestions. We anticipate that the work of this PHMSA group can be incorporated as new code language and/or referenced as helpful guidance. Effective Date: Wednesday, September 5, 2018#

Attachment 1, passage 1Keith@Leewis.US 713.376.9499 Risk Modeling Technical Guidance Document Outline The American Society of Mechanical Engineers (ASME) Code for Pressure Piping (B31) is a Consensus National Standard and includes the ASME B31.8 “Gas Transmission and Distribution Systems” and ASME B31.8S “Managing System Integrity of Gas Pipelines” Code documents. These documents are managed by a Section Committee of approximately 50 subject matter experts from wide and varied backgrounds to work in effort and spirit to achieve continuous improvement in pipeline safety. This Committee is governed by procedures from ANSI and ASME. The current versions of B31.8 and B31.8S are 2014. Summary: The ASME B31.8 Committee is open to improvements and new suggestions. We anticipate that the work of this PHMSA group can be incorporated as new code language and/or referenced as helpful guidance. Background: The ASME B31.8S Code is a supplement to the ASME B31.8 Code and was first published in 2001. B31.8S has been updated five times since its inception with the next edition scheduled for the fall of 2016. ASME B31.8 has been in existence since 1955 and was the basis for the original 49 CFR Part 192 regulations. The ASME B31.8 and B31.8S codes have offered a variety of risk assessment approaches to ensure the safety of gas pipelines by continually adding and updating design, construction, operational prevention, mitigation, and assessment language and guidance. The Section Committee has adopted prescriptive and performance approaches to pipeline safety and also has evaluated and drafted life cycle and reliability based methodologies. The Section Committee continuously re-evaluates and improves these approaches by incorporating Operator and Regulatory experience needs in the continuous improvement of these standards. The methods presented in the Codes have been used to address each of the more than 20 different individual integrity threats, collected as nine prescriptive threats, found inside the three classifications of time independent (random), time dependent and resident threats. The choice of assessment tool depends on each facility design plus environmental knowledge and other experiences. No one risk assessment approach fits all threat situations. A combination of approaches is needed to evaluate the likelihood of each threat and assess how they all contribute to the likelihood and consequences within a comprehensive risk assessment process. The use of ASME B31.8S, as is evident from its title and scope statements, has never been limited to particular segments of pipelines. PHMSA realized that the development of integrity technology and system knowledge required a phased approach. This resulted in an initial risk management focus on the high consequence areas (HCA) which PHMSA defined and has proposed to extend. The recent NPRM proposes to add a medium consequence area (MCA) definition, extending these mandatory risk assessment activities to more pipeline mileage. The current ASME B31.8S risk assessment language has proven to be quite effective: Page 1 of 4#

Attachment 1, passage 2Keith@Leewis.US 713.376.9499 5.5 Risk Assessment Approaches (a) In order to organize integrity assessments for pipeline segments of concern, a risk priority shall be established. This risk value is composed of a number reflecting the overall likelihood of failure and a number reflecting the consequences. The risk analysis can be fairly simple with values ranging from 1 to 3 (to reflect high, medium, and low likelihood and consequences) or can be more complex and involve a larger range to provide greater differentiation between pipeline segments. Multiplying the relative likelihood and consequence numbers together provides the operator with a relative risk for the segment and a relative priority for its assessment. (b) An operator shall utilize one or more of the following risk assessment approaches consistent with the objectives of the integrity management program. These approaches are listed in a hierarchy of increasing complexity, sophistication, and data requirements. These risk assessment approaches are subject matter experts, relative assessments, scenario assessments, and probabilistic assessments. The following paragraphs describe risk assessment methods for the four listed approaches: (1) Subject Matter Experts (SMEs). SMEs from the operating company or consultants, combined with information obtained from technical literature, can be used to provide a relative numeric value describing the likelihood of failure for each threat and the resulting consequences. The SMEs are utilized by the operator to analyze each pipeline segment, assign relative likelihood and consequence values, and calculate the relative risk. (2) Relative Assessment Models. This type of assessment builds on pipeline-specific experience and more extensive data, and includes the development of risk models addressing the known threats that have historically impacted pipeline operations. Such relative or data-based methods use models that identify and quantitatively weigh the major threats and consequences relevant to past pipeline operations. These approaches are considered relative risk models, since the risk results are compared with results generated from the same model. They provide a risk ranking for the integrity management decision process. These models utilize algorithms weighing the major threats and consequences, and provide sufficient data to meaningfully assess them. Relative assessment models are more complex and require more specific pipeline system data than subject matter expert-based risk assessment approaches. The relative risk assessment approach, the model, and the results obtained shall be documented in the integrity management program. (3) Scenario-Based Models. This risk assessment approach creates models that generate a description of an event or series of events leading to a level of risk, and includes both the likelihood and consequences from such events. This method usually includes construction of event trees, decision trees, and fault trees. From these constructs, risk values are determined. (4) Probabilistic Models. This approach is the most complex and demanding with respect to data requirements. The risk output is provided in a format that is compared to acceptable risk probabilities established by the operator, rather than using a comparative basis. It is the operator’s responsibility to apply the level of integrity/risk analysis methods that meets the needs of the operator’s integrity management program. More than one type of model may be used throughout an operator’s system. A thorough understanding of the strengths and limitations of each risk assessment method is necessary before a long-term strategy is adopted. (c) All risk assessment approaches described above have the following common components: (1) They identify potential events or conditions that could threaten system integrity. (2) They evaluate likelihood of failure and consequences. (3) They permit risk ranking and identification of specific threats that primarily influence or drive the risk. (4) They lead to the identification of integrity assessment and/or mitigation options. (5) They provide for a data feedback loop mechanism. (6) They provide structure and continuous updating for risk reassessments. Some risk assessment approaches consider the likelihood and consequences of damage, but they do not consider whether failure occurs as a leak or rupture. Ruptures have more potential for damage than leaks. Consequently, when a risk assessment approach does not consider whether a failure may occur as a leak or rupture, a worst-case assumption of rupture shall be made. The B31.8 committee recognizes that the job of risk assessment is to organize an extremely large body of pipeline design, inspection, maintenance and observational knowledge. This organizational risk based methodology helps operators make the proper prevention and mitigation decisions to ensure the safety and reliability of their pipelines. Please recognize that Subject Matter Experts (mainly internal and sometimes external) are to be used in all four different model methods as a validation check to ensure the trending and relative magnitudes are reasonable, without obvious bias, are comparable, and sufficiently documented. Today most quantitative risk assessment and probabilistic models are suitable for few threats. The algorithms are data intensive and if incorrectly developed and populated, will skew the prevention and mitigation Page 2 of 4#

Attachment 1, passage 3Keith@Leewis.US 713.376.9499 activity prioritization predictions. Low frequency-high consequence historical incidents remain as outliers, giving little helpful information as to their actual distribution. As the underlying science develops and related data collection expands, these quantitative risk assessments and probabilistic models may develop into useful predictors of the likelihood of resident and time independent threats. In general, the selection of a risk assessment method is driven by the knowledge and organization of inspections and addition information that have been collected during pipeline operations. The appropriate historical, location, and performance details are used to indicate hot spots as they contribute by threat and consequence in the risk assessment. These risk assessments are then used to make the operational decisions that prioritize and implement a wide range of optional prevention and mitigation strategies and thus ensure the safety and reliability of the operator’s pipeline system over time. Estimating missing data always skews the outcome however this approach is required until the actual information can be gathered and verified. Time dependent threats may use a probabilistic model. For a probabilistic example, smart pig In-Line Inspection (ILI) tools show the location and geometry details of each volumetric external corrosion and internal corrosion anomaly. Using this information and the statistical distribution of the wall loss geometry allows individual Engineering Critical Assessment (ECA) such as API 579 / ASME FFS-1 Fitness for Service evaluations with the prediction of a failure pressure at that location today. The rate of deterioration allows the operator to predict an estimated safe response time interval before that individual anomaly will fail at a threshold percent of the maximum allowable operating pressure (suggest 110% MAOP). In the absence of the deterioration statistics, ASME B31.8 S Table 5.6.1-1 and Figure 7.2.1-1 provide conservative response intervals. These methods continue to be refined for external and internal corrosion. Stress Corrosion Cracking (SCC) and fatigue evaluation methods currently lag because the crack assessment tools previously lacked the detailed size quantification technology. Improvements to the tools will soon provide the same level of detailed crack anomaly geometry resolution and characterization to improve the prediction of crack response intervals. The use of ILI to detect, identify, size, and predict a failure pressure of previously damaged pipe has made great strides. ILI geometry tools provide pipe ovality and dent profiles and these deformation details are used to measure the strain and with deterioration distributions can better estimate response intervals. Some operators must use Direct Assessment and/or Pressure testing to conduct their integrity assessments and in many cases the information is organized by Subject Matter Experts into relative ranking systems such as the methodologies published by Kent Muhlbauer. Time independent threats do not have the same information detail. An incorrect operation (which includes human error) may require the use of a survey or audit of the standard practice to ensure the procedure is always followed and provide a relative ranking of effectiveness. Risk ranking guidance to develop these standard practices for human performance tracking and effective audit approaches are provided in facilities risk focused standards such as ASME PCC-3 Inspection and Planning Using Risk- Page 3 of 4#

Attachment 1, passage 4Keith@Leewis.US 713.376.9499 Based Methods, API 570 Piping Inspection Code: In-service Inspection, Repair, and Alteration of Piping Systems, API 580 Risk-Based Inspection and API 581 Risk Based Inspection Technology. Weather and Outside Force may use a scenario based methods triggered by a pre-determined flooding threshold and historical performance to estimate the chance of leak or rupture. These geo-hazards and hydro-hazards may also have a scenario based trigger set by relative location on the earth’s surface related to known historical problems and monitoring criteria. Third party damage has always been characterized by prevention efforts through communications and by active monitoring and mitigation during excavation. Previously damaged pipe found by ILI or excavation can use ECA methods to predict a failure pressure and estimate a response interval. Resident threats such as mill and construction threats depend on historical performance in a relative model that requires manufacture performance (company, location and date) and qualification testing (pressure tests, company and individual qualifications). Prequalified imperfections remain dormant unless acted upon by corrosion or some other deterioration mechanism to become threats. Equipment threats are more uncertain unless individual performance has been tracked and shared industry wide. Assessment of equipment threats generally uses SME-based approaches. The ASME B31.8S code is comprehensive and contains detailed guidance for both prescriptive and performance based approaches. This code has been proven effective and guidelines are found in: 5.6 Risk Analysis 5.6.1 Risk Analysis for Prescriptive Integrity Management Programs 5.6.2 Risk Analysis for Performance-Based Integrity Management Programs 5.7 Characteristics of an Effective Risk Assessment Approach 5.8 Risk Estimates Using Assessment Methods 5.9 Data Collection for Risk Assessment 5.10 Prioritization for Prescriptive-Based and Performance-Based Integrity Management Programs 5.11 Integrity Assessment and Mitigation 5.12 Validation The ASME B31.8 Section Committee is committed to provide guidance that improves the integrity of pipelines, including the effectiveness and performance of risk management. ASME B31.8 meetings are open and agenda slots for technical presentations and discussion led by non-members and interested parties are encouraged. Related Committee Progress Life Cycle Based Design: The B31.8 Ad Hoc 80% Alternate Life Cycle Model work group (under J. Zurcher) has produced a draft paper. Dr. Leewis is working on a related B31.8 Committee Action Item (#14-1233 Revision - Question the Validity of Class 1, Division 1 at 80%). Reliability Based Design and Assessment (RBDA): ASME Standards Technology LLC (ST-LLC) has published a draft report (STP-PT-048 Criteria for Design and Assessment for ASME B31.8 Code). This ASME report provides guidance on how to use the (yet to be incorporated) draft RBDA possibly as a new appendix to ASME B31.8. Page 4 of 4#