RISK MANAGEMENT AT TRANSPORTADORA DE GAS DEL NORTE

Transcription

1 RISK MANAGEMENT AT TRANSPORTADORA DE GAS DEL NORTE Gary M. Houston, Chief Operating Officer, Transportadora de Gas del Norte S.A. Jean Paul Gourlia, Directeur Sécurité Environnement, Gaz Electricité, TotalFinaElf S.A. INTRODUCTION TGN or Transportadora de Gas del Norte was formed when the Argentine state-owned natural gas company, Gas del Estado, was privatized in Today, TGN is owned by a consortium of private companies, including Totalfinaelf and Techint of Argentina, and operates approximately 7000 km of large diameter, high-pressure pipelines, in Argentina and neighbouring countries, with over 330,000 horsepower of installed compression. To put the system in a more familiar context, if TGN were located in Europe, the system would stretch from Scotland and Ireland in the North to Rome and Southern Spain in the south. The facilities vary from the very latest in pipe, coating, turbo compressors and control systems, to 40 yearold pipe and compressor plant that have been poorly maintained for much of their life due to insufficient funding or planning of maintenance. THE RISK CONTROL PROGRAM IN CONTEXT As a result of a continued commitment to safety and public service, TGN has developed a number of programs to manage the technical risks of its business. The Company is in the process of adopting an integrated management system that contemplates a number of programs including Safety Management, Maintenance Management, System Operation, Project and Change Management. Each of these programs is a vital part of the integrated operation of the transportation system and in its way helps to reduce technical risk. The Risk Control Program is also part of the integrated whole but differs significantly from these other programs in that it represents a direct and quantifiable oversight by the leadership team in areas that pose a significant and credible technical risk. The program requires that the leadership team devote time and effort to personally ensure that the technical risks of the business are adequately managed. For the purposes of this program, we have defined a risk to be any potential event that could: have a significant financial impact, cause a serious injury or death to an employee or member of the public, cause an important disruption in the transportation of gas, or result in public embarrassment or loss of confidence. As a first step in developing the risk control program, the leadership team identified a number of events that could be classified as risk events and further ranked these events in terms of the potential implications for personal injury, service impacts, damage to corporate image, and financial costs. Although the ranking system is a bit crude, it serves to illustrate the obvious: a gas rupture or major fire in a compressor station is the most severe event that could happen in TGN followed closely by a rupture in either a gas pipeline or a meter station. For each of these risk events, the team identified potential causes and with the help of the responsible areas, the specific programs that have been put in place to proactively identify areas of concern, and either eliminate or mitigate the risk. Based on data available (US Department of Transportation, 1998), we know that the vast majority of pipeline failures are due to five main factors: Third Party Damage (33%) Corrosion and Stress Corrosion Cracking (20%) Design, Construction and Material Quality Failure (18%) Forces of Nature River Crossings and Geotechnical Forces (11%)

2 Operating Error (7%) Based on these industry data and TGN s own experience, the leadership team identified eight activities as key modules in its Risk Control Program. Twice per year the leadership team meets to review the status of each of these programs to ensure: that the program is being implemented according to plan, that data and results are well documented, that a secure method is in place for implementing recommendations according to priority, and that the program effectively controls the risk in question. In addition to these reviews, the leadership team also reviews any incidents or accidents reported that are identified as having potentially serious consequences. Through these reviews, any gaps in the programs can be identified and corrected. MODULE 1: OPERATIONAL CONTROL The TGN system is designed to international safety standards and therefore incorporates devices in its system to positively control pressure below the maximum allowable of each component, and to detect and control other dangerous situations in compressor stations such as detection of gas, smoke or fire, or abnormal operating conditions for the major equipment. These systems are redundant and independent of the central control system. They are subject to regular maintenance and calibration based on written procedures and audited annually to ensure compliance and effectiveness. In addition to this first line of defence, TGN has developed a sophisticated control center that is capable of monitoring all compressor stations, 90% of all metering stations and a significant number of pipeline valves. With this data, a controller located in Buenos Aires can effectively monitor the pressures, flows and other key operating parameters of the entire system. TGN maintains 3 operators during the daytime when there is more activity and two during the night. These controllers are aided by a system of digital alarms that vary from a notification of a change of state, a warning that an operating parameter is approaching a pre-set limit, and up to an audible alarm that demands immediate reaction by the operator. The operators have access to field personnel who are available 24 hours per day to physically investigate and remedy any problem. A second role for the operator is to control the human activity around the system. Each field employee is required to contact Gas Control prior to entering a site or performing a task on the operating system. The controller in turn logs each communication in a data base. Upon completing the work or exiting the site, the field employee must also notify Gas Control at which time he is logged out. This system is auditable against recorded communications and the maintenance work order system. The system of notifications has two major benefits. First, the controller has an overview of the system and the activity being performed on it that the field employee does not. Therefore, he is in a position to coordinate activities that may interfere with each other. In the extreme case of an emergency, the operator can immediately warn employees of any dangerous situation or redirect a nearby employee to the site if necessary. The second benefit of this notification policy is that each significant activity is being checked for reasonability by the controller. Although he does not have the benefit of the field employee s hands-on experience, he is able to quickly determine which activities are routine and innocent and which are unusual or suspicious, and to question their validity. At another level, any activity that requires a special operating condition, or that a part of the system is taken out of service, must be planned in advance with active participation and coordination of Gas Control. Each such intervention will be the subject of an outage plan that details the persons involved and responsible, the sequence of activities, identified risks and the appropriate preventative measures. The approved outage plan is then used as a working document for the mandatory pre-job meeting in the field and the active coordination of the work by Gas Control. Once again, the process allows for independent analysis of the work procedure by not only the controller but also the appropriate supervisors.

3 Finally, the gas control center plays an important role during any emergency or urgent operating situation. In addition to his access to system information and the location of field employees, the Gas Controller has access to procedures, operations manuals, contingency plans, and telephone lists for employees, contractors and emergency services. With this information at his fingertips, the Gas Controller is able to play a pivotal role in these urgent situations to ensure a fast and effective response. This system is wonderful if it works as it is intended. The role of the leadership team under the risk control program is to demand evidence that the key elements are functioning appropriately: Is there a process to control alarm settings? Are procedures written and regularly updated? Are the gas controllers trained and certified? Is there clear and consistent communication between gas control and the field? Are outage plans thoroughly reviewed and appropriately approved? Are contingency plans regularly tested and updated? Is there evidence of incidents or accidents where the system didn t work correctly? At TGN, the answers to all of these questions are not yet satisfactory, but the questions are being asked and the responsible areas are in the process of making the necessary improvements. MODULE 2: CORROSION AND DEFECT MANAGEMENT As mentioned earlier in the presentation, parts of the TGN pipeline network are more than 40 years old and were not always well protected and maintained. As a result, there are significant and extensive corrosion problems. In the worst part of the system, the North Pipeline, TGN has registered nearly half a million corrosion defects of varying depths and has suffered 2 pipeline ruptures directly caused by corrosion. In addition, TGN has suffered two pipeline ruptures as a result of improperly installed repair sleeves which subsequently failed. Consequently, not only the corrosion but also those repair sites are considered to be areas of risk. To manage this situation, TGN uses extensively magnetic flux inline inspection technology to accurately map the corrosion defects. This technology has been available since the 1960 s but saw important improvements in the 1980 s when more sensitive instrument design and digital data storage was introduced, and most recently in the past 10 years with more sophisticated computer analysis of the raw data. In 2001, TGN experimented with a transverse flux tool that overcomes a weakness of the normal configuration for detecting long narrow defects oriented parallel to the pipe axis. Although this technology has been improved enormously, it can only detect metal loss, dents, gouges and previous repairs. Other defects such as cracks or defects hidden under existing repair sleeves are not visible to magnetic flux instruments and must be managed with other techniques which are discussed in the next section on Stress Corrosion Cracking. TGN has established defect repair criteria which are based on the two possible failure modes: leaks and ruptures. To prevent leaks, TGN has adopted the practice of repairing any metal loss that is greater than 70% of the pipe wall thickness. To prevent pipeline ruptures, TGN uses a factor of safety of between 25% and 50%, depending on the presence of human activity, and based on calculated pipeline remaining strength. In addition, the company is systematically reducing the number of welded repair sleeves in combination with other upgrade projects. To calculate the rupture pressure of a damaged pipe section, TGN uses a method called RSTRENG, short for remaining strength, which was developed by the Batelle Institute in the United States. This formula is based on a precise knowledge of the defect geometry which is more accurate than earlier, less sophisticated calculations that assume a rectangular or parabolic defect shape. As part of the corrosion management program, one must understand the reliability and accuracy of the instruments and the interpretation algorithms used by the service provider. TGN has incorporated in its contracts a requirement for precision, and performs a manual inspection of a percentage of the corrosion sites identified. Based on manual measurements and in some cases destructive testing, TGN has been able to verify that the process for detection and elimination of defects is conservative.

4 A final ingredient for managing these defects is a comprehensive data base. With five hundred thousand defects, hundreds of pipeline repairs, different pipe coatings, cathodic protection data and information about the environment, it has become indispensable to use a geographic data base to effectively manage and use the information. With this data base, areas of high risk can be identified based on probability of failure and potential consequences. The model is also capable of using corrosion growth rates to predict future repair programs and thereby assist in repair planning into the future. The result of these efforts, and what has been an extensive repair program to put the system in order, is that pipeline failures due to corrosion have fallen from a peak of 11 per thousand kilometres in 1997 to zero this year. TGN Pipeline Failures 12,0 11,0 10,0 Failures Per 1000 km 9,0 8,0 7,0 6,0 5,0 4,0 3,0 2,0 1,0 0, Year Total Reported Leaks and Failures Corrosion Only Failures Figure 1: TGN Pipeline Failure History The next evolution is to make the program more efficient. For sections that have already been inspected using high resolution tools, the probability of a failure in some future year is a function of the precision of the inspection performed and the probable growth rate of the corrosion defect. Obviously, if these factors were known with absolute accuracy, the date and hour of failure could be exactly calculated. As both variables are not exactly known, they are represented by normal curves and the probability of a failure in the future is the combination of these two unknowns for all defects in the section. In this regard, the importance of understanding the precision of the internal inspection has become a very important factor. TGN has also implemented a program of corrosion coupons for accurately measuring the rate of corrosion in various parts of its system. With these inputs, TGN can more intelligently choose its future management strategy which may be to re-inspect the pipeline using magnetic flux tools, or it may be more economical to delay this inspection by physically repairing the worst defects at the appropriate time to reduce the overall probability of failure.

5 MODULE 3: STRESS CORROSION CRACKING MANAGEMENT Stress Corrosion Cracking is not a new phenomenon in the pipeline industry, but at TGN, has appeared only relatively recently. Based on anecdotal evidence it is likely that historically, there had been others but there are no formal reports available from Gas Del Estado. Stress Corrosion Cracking has little to do with what most people know as corrosion and less with absolute stress levels. In fact, in most cases, SCC cannot occur where conditions are appropriate for normal oxidation. It appears as microscopic cracks in the metal structure that are invisible to the naked eye in all but the very final stages. In this photograph, the cracks have been made visible with a magnetic particle technique. The most common high PH SCC mechanism takes many years to develop and requires a very specific combination of environment, stress and material qualities. Fortunately, it has been determined that the necessary combination of stress and pipe temperature is rarely found more than 30 km downstream from a compressor discharge and normally takes more than 20 years to develop. A necessary condition for SCC is that the coating is not bonded to the pipe which allows the entry of water. The high temperature of a compressor discharge contributes in that coatings such as coal tar enamel and polyethylene tape quickly degrade at high temperature. If water is present on a seasonal basis, and contains carbonate or bicarbonate salts, the temperature tends to evaporate the water and concentrate the salts to create the ideal conditions for SCC. Once established, a black film is formed on the pipe which works with pressure fluctuations to crack the steel structure molecule by molecule. Coating becomes disbonded possibly due to high gas temp. In wet periods, water and carbonate/bicarbonate salts accumulate next to the pipe. In dry periods, the pipe temperature evaporates the water leaving the salt deposits After various cycles, the salt concentration and PH reach a level necessary for SCC Figure 2: How Conditions for SCC Develop As mentioned earlier, cracks caused by SCC are not visible for normal magnetic flux inspection instruments. Other instruments are presently available on the market but depend on ultrasonic technology and require that the pipeline be partially filled with water. This is not generally feasible and is very expensive for an operating pipeline. Consequently, we have to use other techniques to find SCC. The most common method used in the industry is external magnetic particle inspection. The pipeline data base is used to identify areas that have all of the required characteristics of soil type, seasonal water, adequate cathodic protection, and distance to a compressor station. The selected sites are excavated and existing coating is removed if it is not bonded to the pipe. The steel is cleaned with rice to avoid erasing any cracks and a magnetic particle inspection is performed giving priority to the

6 under side of the pipe where SCC is most often located. The experience with this technique is that it is effective in identifying SCC in the inspected area but that it is very expensive to excavate and inspect more than 50 metres at a time. Consequently, there is a certain element of chance that the excavation will be located where the SCC is in fact growing. After the rupture caused by SCC this year, TGN chose to conduct a hydro-test of the affected section to determine the extent of the problem. Other colonies of cracks were encountered leading the company to conclude that there could be an extensive SCC problem on this pipeline. Therefore, two other hydro-tests were planned in 2002/2003 to determine if SCC is present in other parts of the system. In addition, a recoating program in selected areas is planned as a means of ensuring that SCC will not occur where there is a possible high consequence. The future of the SCC management program will depend heavily on the results from the planned hydro-tests and NDT inspections. In the short term, each section with a probability of SCC is being inspected and selected high-consequence areas are to be recoated to eliminate the possibility of failures. In the long term, internal inspection costs and techniques will probably improve to make a predictive approach more cost effective and feasible. MODULE 4: WATER CROSSING AND GEOLOGICAL RISK MANAGEMENT The TGN system faces a number of challenges in the North of Argentina due to weak soils and dramatic and rapid flooding from adjacent mountain areas. The result is a series of rivers that meander significantly and that have frequently changed course to cause damage to the pipeline. In other parts of the system, there are rivers that are several kilometres wide used as navigable channels. Still others are located in steep mountain valleys and are subject to annual sessions of dense flow where mud and rock are transported at high velocity causing severe erosion. Finally, TGN is managing approximately 2000 kilometres of pipeline that pass through the Andes Mountains to Chile and which are exposed to landslides, earthquakes and other geotechnical phenomenon. In total, TGN has suffered four ruptures due to geological and hydrological factors and has had several other close encounters. As every pipeline engineer knows, the best and least expensive mitigation of hydrological and geological risk is to design the route and the installation correctly in the first place. Unfortunately, some problems are inherited and others are not foreseen at the design stage, and become the subject of mitigative measures. For much of its history, TGN was very reactive in its management of these risks, often not recognizing the seriousness of a situation until an emergency action became necessary. More recently, the company has strengthened its own technical group and made extensive use of expert consultants to systematically identify the areas of possible concern and to tailor monitoring activities to the specific problem. Monitoring begins with regular on site visits to perform a visual evaluation which are timed to correspond to the rainy season. Use of simple but effect technology such as GPS positioning, pipe depth detectors and digital photography allows the evaluator to augment his verbal analysis with very useful information for subsequent office review. Where there are indications of incipient problems, a further inspection by experienced engineers is warranted. In mountainous terrain, slope monitors and control surveys are used to monitor potential ground movement. Use of in-line inspection with geo-positioning tools and callipers to detect buckling and dents has also helped to identify problems. MODULE 5: THIRD PARTY DAMAGE PREVENTION Damage due to activities of third parties is one of the most common causes of pipeline failures in a well managed system. In many countries, there is a first call system and culture, as well as supporting laws to promote communication with the pipeline company prior to any activity close to the right of way. Since these do not exist in Argentina, TGN has developed its own in-house program with three clear objectives: To prevent damage to pipelines that will cost the company money,

7 To prevent injury to members of the public and potential interruption of transportation services, and To discourage or prevent construction of buildings within 30 m of the pipeline which could lead to future problems and a higher risk situation. A key element to the program is to educate the people that are in the best position to prevent damages: landowners, contractors, and public utilities. A data base of these contacts is in place and TGN has developed a standard set of materials to help them understand the danger. A very systematic record of all correspondence and training is kept to ensure that all parties are contacted and to demonstrate that the company has been diligent. TGN also manages a surveillance program based on risk. In other words, in areas where there is a higher risk due to population density or level of construction activity, the frequency of inspections has been increased. Recently, TGN incorporated a type of electronic reporting system complete with digital photos so that each inspector can be fore-armed with a copy of the report from the previous inspection as a reference. Once again, a comprehensive and systematic reporting system helps to make the process more effective and demonstrates diligence. Finally, using the data base which identifies high consequence areas, the Company has implemented special designs using a risk based approach. In these cases, marker tape or concrete slabs are installed to reduce or eliminate the possibility for third party damage in areas where the consequences and probability of an event are very high. In new construction, extra depth of cover and thicker pipe are also considered as appropriate to reduce risk. In the three years that this program has been in effect, there has been a remarkable reduction in the number of accidents and near misses on the system. Based on the high cost of these accidents and the relatively minor investment to implement the program, it is one of the most effective risk mitigation efforts. Third Party Incidents at TGN Accidents Near Miss Figure 3: Third Party Incidents At TGN MODULE 6: HAZOP DESIGN REVIEW The leadership team of TGN has determined that a rupture or fire at a compressor or meter station would be potentially more costly than a similar event in the pipeline proper due to the frequent presence of employees and the difficulty in quickly replacing and repairing damage to compression equipment. The presence of factors such as vibration, high temperature and rapidly changing operating variables also adds a factor of complexity inside the stations. On the positive side of the equation, the stations are equipped with systems to detect fire, gas, smoke or pressures and temperature outside of normal operating ranges and are designed to be quickly isolated in case of a serious event.

8 TGN is in the process of reviewing each of its compressor stations using a HAZOP process. HAZOP is a tool that is widely used in industry for reviewing designs prior to construction to detect process control hazards. In TGN s case, the tool is being used to review the station process design as it currently exists. An important step then is to revise the necessary station plans and technical documentation to ensure that they are correct and up to date. This in itself is an important benefit of the program. A crossfunctional team of design, maintenance and operational personnel is formed to perform the HAZOP study using a format and software that has been designed especially for TGN. The second important benefit of the program then is the interchange of experiences between design engineers and operations and maintenance staff which are converted into personal and institutional learning through the HAZOP process. As of the writing of this paper, TGN has completed studies of 9 of its 18 compressor stations and has encountered and eliminated a number of hazards. Typical of these is the possibility to neutralize a safety device, such as a relief valve, by means of an isolation valve that is not appropriately locked open. In another case, through a series of non-related modifications over several years, a necessary postlubrication pump for a gas turbine would not have functioned in the event of an emergency station shut down and venting. This could have severely damaged the turbine resulting in costly and time-consuming repairs. It is important to mention that the study includes not only the detection of potential problems but also the recommendations of the team for remedial action including the person responsible and the timing of the implementation. These recommendations are reviewed and approved by the Manager of the Compression Department and then are monitored regularly to ensure timely implementation. The HAZOP report cannot be closed until all recommendations are implemented. The role of the leadership team is to ensure that the HAZOP program and the implementation of recommendations are completed. MODULE 7: INTEGRITY INSPECTIONS While the HAZOP Program is focused on the process control aspects of the compressor plants, the Integrity Inspection Program ensures that pressure bearing components are fit to contain the maximum operating pressures. The inspections are designed to detect erosion, corrosion and external factors that could with time degrade the pressure containing components. At TGN, it was necessary to also use this process to verify that the original design, material quality, and construction quality were appropriate for the intended service. Integrity inspections of Compressor and Meter Stations are required to be done once every five years to check for erosion of susceptible elements such as elbows, separators and caps. Normally, this would entail an ultrasonic inspection of a limited number of points that are suspected to exhibit erosion due to elevated gas velocity. TGN has completed integrity inspections of its key sites over the past five years adopting a much more rigorous process to detect and evaluate any risk factor that may lead to the failure of a pressure bearing component. The inspections have included the following activities: Visual inspection of the piping to identify supports or foundations that have shifted, areas of high vibration, areas of pipe tension and welds or installations that appear suspect. Ultrasonic measurement of remaining wall thickness of every significant segment of piping in the plant. This typically would amount to more than 500 measurements per Compressor Station. Inspection of suspect welds using ultrasonic, x-ray or die penetrant depending on the configuration and potential problem. Re-inspection of components with significant erosion and the application of API RP579 to assess fitness for purpose. TGN has performed one complete cycle of this intensive program and today has documented analysis of fitness for purpose of its plant piping. In the course of these inspections, over 200 components were identified to have wall thicknesses inferior to the design specifications. Of these, a small number

9 were directly replaced where severity required such action or where the cost of replacement was insignificant. TGN is tracking with annual or bi-annual measurements approximately 190 components where a reduction of wall thickness was noted but where a more detailed fitness for purpose analysis did not require an immediate replacement. As with the HAZOP program, one of the most critical aspects of this program is that the results and corresponding corrective actions are auditable. To ensure that this is the case, TGN is storing all of the technical data related to this program in its maintenance data base. Each year, inspections and reinspections are programmed and tracked to ensure compliance with TGN s internal requirements and the applicable regulatory norm. The leadership team, as part of its responsibility under the Risk Control Program is responsible for reviewing the status MODULE 8: SAFETY AND TECHNICAL AUDITS The third and final module to control risk in Compressor and Metering Stations is Safety and Technical Audits. These audits are carried out using a very detailed audit protocol that is continuously being expanded and improved. The audits are intended to ensure that maintenance and safety programs are being properly implemented and are effective to detect unsafe conditions and practices related to maintenance and safety systems. The protocols are available to field staff to allow for self audit by the regional maintenance groups. An annual audit is to be performed by a team of experts from outside the area. A key aspect of the program is to reduce the time required between the audit and the audit report. In addition, TGN wanted to easily compare performance between areas and from year to year. For these reasons, the protocol is worded in a comply/no comply format to allow for rapid reporting and statistical analysis as well as qualitative analysis of results. It is hoped that with this approach, the labour involved in these important process verifications can be considerably reduced while increasing their value by incorporating comparative analysis. Figure 4: Technical Audit Summary Report

10 CONCLUSION Transportadora de Gas del Norte S.A. operates a pipeline system that is challenging because of its geographic diversity stretching from mountain top to bustling urban areas, because of its complexity and because of the physical condition of the older parts of the system. To manage the diverse technical risk associated with this system, the leadership team has developed a Risk Control Program that incorporates 8 specific modules to control operating risk, pipeline risk, and risk in compressor and meter stations.

11 The common foundation that ties these programs together is based on: Auditable and measurable processes. Direct and personal involvement of the leadership team. Analysis based on risk which is a combination of probability and possible consequence. Adoption of technology best suited to the situation including ample use of data management technology to manage information. Today, TGN has a very sound risk management system based on these modules that address the most important problems faced by the company. Since 1997, reportable leaks and ruptures in the system due to all causes have dropped from 11 per thousand kilometres of pipe to less than one. More importantly, the leadership is confident that the integrity of the system going forward is not only meeting and exceeding international standards but will also prove effective in eliminating very costly accidents.