WITH constant improvements in technology and processes, operators are becoming better and better at minimising pipeline leaks.
While reducing leaks is crucial to efficient pipeline management, infrequent, high-rate and high-volume product releases – or ruptures – can represent the most significant threat to the environment and the public.
To account for the impact of pipeline ruptures, new industry best practices being developed by American Petroleum Institute (API) and Association of Oil Pipelines (AOPL) emphasise the importance of implementing a separate program designed specifically to detect and manage ruptures, in addition to extant systems and processes that manage smaller-volume leaks.
The most effective rupture recognition and response programs are comprehensive and leverage multiple strategies.
Operators should consider implementing a distinct rupture alarm program, along with an employee culture as well as specific policies and procedures that duly reflect the potential consequences of rupture events.
Establishing a separate rupture detection system
Leak detection and prevention systems have advanced dramatically over the past several years in their sophistication and sensitivity, giving pipeline operators more options and better ability to maintain pipeline integrity.
However, some high-profile rupture events have occurred that were not properly identified as ruptures at the outset, decreasing the efficacy and timeliness of the response.
Analyses of these events have identified opportunities for enhancement in the areas of leak recognition, pipeline shutdown and isolation, and leak notification to emergency response and regulatory agencies.
This is why API and other industry leaders have spent the past few years re-focusing pipeline operators on standards and practices specific to rupture detection and mitigation.
When this kind of incident occurs it should be easily identifiable and trigger an immediate and aggressive response.
As part of this effort, a recent initiative sponsored by API and AOPL urges operators to consider creating an entirely distinct rupture detection program.
In many cases, highly effective rupture detection systems can be built by integrating relatively simple algorithms into existing Supervisory Control and Data Acquisition (SCADA) systems – no expensive SCADA upgrades or infrastructure investment required.
A separate rupture program serves to reinforce a pipeline’s existing leak detection system, with the essential goal of never failing to detect and act on a likely pipeline rupture.
The success of a rupture detection system hinges on a near perfect track record of certainty, as frequent false positives will make controllers less likely to take indications of a rupture seriously.
Modern alarm management techniques such as intelligent alarm suppression, dynamic thresholds (triggered by operational changes), and evaluating a pattern of alarms to discern leak signatures from operational noise, can be used to minimise false positives.
Large-scale rupture events can involve significant costs, both financially and in reputation. A separate rupture alarm program begins to mitigate this risk, but only serves as the essential foundation for a comprehensive strategy to manage pipeline integrity.
Cultivating a “shut down” culture
Developing a system that efficiently manages pipeline ruptures involves more than the technology used to identify them. Culture is critically important, and pipeline operators are uniquely positioned to cultivate a culture among pipeline stakeholders that works to minimise the adverse effects of releases.
Specifically, in an overview of RP 1175, American Petroleum Institute (API) recommends that operators consider proliferating a “healthy sense of vulnerability” among employees and the accompanying operating philosophy of “when in doubt, shut down.”
What seems like only a marginal cultural change can have wide-ranging effects, as all stakeholders – from management to analysts to field operators – develop a sense of urgency and gravity in dealing with possible rupture events.
Coordination and collaboration among stakeholders also is key to rupture detection and response culture. All employees should be empowered to call for a shutdown in the event of a rupture.
Once an employee indicates that a rupture has occurred, command response should be concentrated in the control centre, where the primary responsibility lies to recognise the rupture, isolate it, shut it down and initiate the planned response.
To ensure pipeline ruptures are handled as quickly and efficiently as possible, controllers should not have to secure additional authorisation to shut down a pipeline.
Unfortunately, tragedy often provides the best cautionary tale. The 2003 Space Shuttle Columbia disaster highlights the profound effect an organisation’s culture can have on its operations.
A federal investigation listed numerous cultural traits and organisational practices that drastically increased the risk of disaster, including “reliance on past success as a substitute for sound engineering practices, organisational barriers that prevented effective communication of critical safety information and stifled professional differences of opinion… and an informal chain of command and decision-making processes that operated outside the organisation’s rules.”
The pipeline industry has to be extra vigilant to avoid many of these cultural traits and organisational practices, which could create the conditions for mishandling leak recognition and responses. To minimise this risk, pipeline operators must cultivate a culture that is conducive to effective and timely rupture management.
Policies and Procedures
Certain policies and procedures can institutionalise and reinforce a culture that prioritises the effective management of pipeline releases or ruptures.
Management should clearly define the roles and responsibilities of the different stakeholders in regards to rupture recognition and response.
A written document should be created that stipulates the indications of a pipeline rupture, and the procedures, tools and actions to be followed and executed in the wake of a confirmed event.
Once defined, management should train all stakeholders in their responsibilities and ensure that they fulfill them in their entirety.
Management also should consider creating a team training program specifically for rupture detection and response.
If tailored to the respective roles of the recognition and response team, the extensive “team training” program can help reinforce the shutdown culture and ensure that employees are prepared in the event of a rupture, helping to minimise possible adverse consequences.
Among a list of many, API recommends that operators consider the following concepts when devising a training program:
• Emphasising simplicity (since rupture events tend to be unmistakable)
• Analysing past events – both real and false alarms – to inform training and drills
• Ensuring the controller understands the alarms and indicators on the SCADA humanmachine interface
• Retraining at a predetermined frequency or as new experiences require
• Utilising training metrics to ensure the effectiveness of the program
• Emphasising collaboration and communication
Testing the new system
The success of a rupture detection system hinges on its reliability. If pipeline ruptures are to be managed consistently and effectively, the rupture alarm system must be trusted 100 per cent before it is relied on for real-time monitoring.
Take the example of an equivalent situation from the retail industry. In 2013, over the American Thanksgiving holiday – the biggest annual US shopping period – cyber hackers stole more than 40 million credit card numbers and other critical information from shoppers at a national retail chain, amounting to the largest retail hack in US history.
This retailer had just implemented one of the most sophisticated cyber security systems in the industry.
The system worked as it was supposed to – notifying technicians several times that malware had been implanted on its servers. But the warnings were repeatedly ignored, instead observed as faults in the new system.
In the aftermath of the breach, a US Senate report detailed numerous key points where the company failed to stop the attack, enabling hackers to steal credit card information for two weeks with impunity until federal investigators stepped in.
In a hearing at the Senate Commerce, Science and Transportation Committee, Senator Richard Blumenthal articulated the central point well: “The best technology in the world is useless without good management.”
To build confidence in rupture detection systems, operators should subject them to comprehensive and thorough tests. API suggests withdrawing product from the pipeline to mimic an actual event, or running programs that manipulate certain SCADA metrics to assess the algorithm’s ability to recognise a rupture event.
With each simulation, the pipeline operator’s detection and response system improves, as the algorithm settings can be tweaked and employees get increasingly skilled at recognising ruptures and following the procedures in place to manage them.
At the end of the day, full confidence in a specific alarm system for pipeline ruptures should reinforce the cultural support for response – when a rupture alarm goes off every controller on duty has the confidence to spring into action without question or hesitation.
Conversations about managing the risk of high-rate product releases often revolve around the technology used to detect them.
But the technology’s effectiveness may be nearly useless if it is not tested, if employees do not receive the proper training for their roles in the event of a pipeline rupture, or if they fail to take necessary action when prompted.
Technology, policies, procedures and culture must all align to prioritise the recognition of, and response to, pipeline ruptures if adverse consequences are to be minimised.
In light of a few recent, high-profile pipeline ruptures that have damaged the reputation and finances of oil and gas firms, as well as the environment, the importance of this cannot be understated.