# Managing Low Probability – High Consequence Pipeline Risk

*W. Bryce, P.Eng., K. Oliphant, Ph.D., P.Eng. – JANA Corporation ^{1}*

Understanding the potential consequences of pipeline incidents is a critical component of pipeline risk management. By their very nature, these consequences are probabilistic – for any given potential incident, there is a range of the potential severity of the consequences that can arise. In this paper, the form of the distribution of consequences arising from pipeline incidents is examined and it is seen, in a variety of industries (gas distribution pipelines, gas transmission pipelines, hazardous liquid pipelines and gas gathering pipelines), to follow a power law or Pareto type distribution. This behavior has specific implications for both modeling and managing pipeline risk, particularly for the assessment and management of low probability-high consequence events. Further, the paper explores the characterization of standard risk and the low probability-high consequence by risk quadrants and discusses approaches to manage each. Specifically for non-standard risk, an approach to using these measures to reduce the risk by building event trees to the consequence lines is presented. These event trees would be supported by mechanistic-probability modeling which would enable the capture of uncertainty and the expression of its multiplicative nature as the process flows along the event tree. In the end, an understanding of what is known and with what level of confidence and what is not known with any confidence and what risks are associated with each can be developed. Once this is completed, it will become clearer as to where the true risks lie in the pipeline in terms of low-frequency high-consequence events and what actions can be taken to begin to mitigate or eliminate them. In this way, the linear Power Law curve will be ‘bent’ and a significant reduction in the likelihood of a high consequence event will be achieved. This, coupled with the activities in Quadrants I and II, will result in a sustainable risk profile for the pipeline over the long term.

**Key words:** Pipeline Risk Management, Pipeline Incident Consequences, Power Law, Event Trees, Risk Quadrant

### Assessing Risk for Pipelines – Estimating Consequences

In managing a pipeline asset through its various life cycle stages, risk assessments are typically conducted to guide the decision making process. In this capacity, risk is typically defined as^{2}:

Risk = Probability of Event x Consequence of Event

That is, the risk is a function of the probability of an event occurring times the consequence of that event. Risk, therefore, increases when there is either one or both of an increasing probability of an event occurring or an increasing consequence of that event.

When we are assessing risk for a pipeline, it is the future risk^{3} that we are interested in; that is, what is the risk at some future point in time? – Tomorrow? Next year? Five years from now? Based on an assessment of these risks we can then make informed asset management decisions such as: Should a pipe segment be replaced? If so, how much of it should be replaced? What should be replaced first? How can we optimize our leak survey or in-line inspection program? Estimating these risks necessitates estimating the future probability of both events and consequences. In this paper, it is the projection of future consequences that is first considered. Secondly, a conceptual approach to dealing with the results of these projections is presented. That is, how can we project what the potential consequences of a pipeline leak could be and how can this information be managed?

### A Broad Range of Possible Consequences

There is a broad range of potential consequences for a pipeline incident. From the PHMSA^{4} database for gas transmission pipeline incidents, the property damage for reported incidents ranges from a few thousand dollars to over $350 million. Similarly, for gas distribution pipelines, reported property damage due to pipeline incidents ranges from a few thousand dollars to greater than $42 million. While there are deterministic factors at play, such as pipe size, operating pressure and pipe location (e.g. HCAs^{5}), there are also more random factors at play. For a gas distribution pipeline of the same size and operating pressure, for example, we can see leaks that result in very little consequence (e.g. those that are found by leak survey and repaired prior to a significant event), leaks of moderate consequence (e.g. those where gas accumulation and ignition occurs with limited property damage), right through to significant incidents (e.g. major property damage with injuries and/or fatalities). Each of these consequences will have an associated probability. Some will be more likely than others – it is much more likely that a leak will be found and repaired than result in a significant incident, for example.

For a given future incident, therefore, there is a probability distribution of potential consequences that will be specific to the local environment surrounding that incident. In order to understand the risk associated with that incident, we need to understand this probability distribution. Likewise, for a pipeline system with multiple possible future leaks, there will be an overall probability distribution of potential consequences. It is the overall distribution that gives us insight into the true system risk.

The first question is, then, what do these potential consequence distributions look like and how do we estimate them?

### Pareto Consequence Distributions in Pipeline Incidents – Power Law Behavior

In our work examining and modeling pipeline consequences, we observed that pipeline consequences appear to follow a very specific distribution. Pipeline consequences, along with many phenomena^{6} such as fire damage, earthquakes, floods and power blackouts, follow Power Law or Pareto-type distributions where a small number of incidents account for the majority of the overall damage and, hence, risk. This type of behavior is often referred to as the 80/20 rule (or Pareto’s Law), where, for example, 80% of the damage comes from 20% of the incidents. While the specific ratios vary for different phenomena (95% of damage from 5% of incidents, 90% of damage from 10% of incidents, etc.), the concept is the same – a small number of events accounts for the majority of risk. This type of behavior gives rise to the low probability-high consequence events that can often dominate the risk picture.

**Figure 1** shows the Power Law relationship for the frequency versus property damage for PHMSA reported gas distribution incidents in the US from 1992 to 2011, based on publicly available data from the PHMSA website^{7}. The number of incidents resulting in different levels of property damage is shown for reported incidents with greater than $100,000 damage. The log^{8} of the frequency or number of events is plotted versus the log of the property damage that occurred for a total of 1095 reported incidents (the incident data for all causes) in a log-log plot. A strong Power Law relationship is observed with a 0.96 R^{2} (96% of the data is described by the model). The same type of relationship is observed when the data is analyzed for individual utilities, by failure mode (e.g. third party damage, corrosion incidents, etc.). What this figure shows is that the majority of incident damage arises from a small number of incidents, as is typical for Power Law behavior.

**Figure 1: Power Law Relationship for PHMSA Reported Gas Distribution Incidents**

Notes: Data plotted for reported pipeline incidents >$100 k damage for 1992-2011 PHMSA incident statistics^{8}

**Figure 2** provides the same plot for the PHMSA reported data for Gas Transmission incidents based on the data from 2002 to 2011. Again, strong Power Law behavior is observed, with an R2 of 0.97 (97% of the data is described by the model).

**Figure 2: Power Law Relationship for PHMSA Reported Gas Transmission Incidents**

Notes: Data plotted for reported pipeline incidents >$100 k damage for 2002-2011 PHMSA incident statistics^{8}

**Figure 3** provides the same plot for the PHMSA reported data for Hazardous Liquid Pipeline incidents based on data from 2002 to 2011. Yet again, strong Power Law behavior is observed, with an R^{2} of 0.97 (97% of the data is described by the model). **Figure 4** provides the data for gas gathering pipelines, with an R^{2} of 0.95.

**Figure 3: Power Law Relationship for PHMSA Reported Hazardous Liquid Pipeline Incidents**

Notes: Data plotted for reported pipeline incidents >$100 k damage for 2002-2011 PHMSA incident statistics^{8}

**Figure 4: Power Law Relationship for PHMSA Reported Gas Gathering Pipeline Incidents**

Notes: Data plotted for reported pipeline incidents >$100 k damage for 2002-2011 PHMSA incident statistics^{8}

For four different pipeline industries: gas distribution, gas transmission, hazardous liquids and gas gathering, the same Power Law nature is observed for the distribution of incident size (measured in terms of PHMSA reported property damage) versus incident frequency. Similar Power Law behavior is observed for the distributions of number of injuries or fatalities versus frequency. In another paper9, Jana explores how the power law behavior arises in pipeline incident consequences. This paper addresses another key question: if these distributions are predictive in terms of cost and frequency, how can we use these measures to mitigate the measured risk? In other words, how do we change these curves?

### The Consequences of Power Law Behavior

There are two key considerations for risk management that come from this type of Power Law behavior. The first is that the low probability-high consequence events dominate the risk picture. These low probability-high consequence events are becoming more and more a focus in the pipeline industry. Power Law modeling provides a means of being able to better assess these low probability-high consequence events and, hence, manage them. As we have seen from the analysis of the PHMSA data for gas distribution pipelines^{9}, the top 1% of incidents account for 20% of the reported property damage. Similar statistics are observed for other pipeline categories. By understanding the nature and causes of the industry-wide incidents in the top damage categories and how they relate to the smaller incidents, measures to thwart these larger incidents can be put in place. An example of this general approach at work can be seen in the Israeli counter-terrorism efforts – the size of terrorist attacks is another area that follows Power Law behavior - where the implementation of specific strategies has sharply reduced the low probability-high consequence incidents relative to the smaller incidents^{10}.

The second is that past behavior in these types of systems is not necessarily a good indicator of future risk. That is, a history of only low consequence events is not an indication that only low consequence events will continue to occur. In fact, Power Law behavior implies that, with a significant number of low consequence events, there will be some associated number of higher consequence events that will eventually occur. This has been repeatedly observed in the pipeline industry where the same type of failure mode (e.g. corrosion, third party damage, etc.) that has previously resulted in only moderate incidents, results in an incident that causes significant damage, injuries or fatalities. Mapping the Power Law behavior of smaller incidents in terms of frequency and severity can actually be used to develop this specific relationship and allow prediction of the likelihood of the low probability-high consequence events. This can be used to allow pipeline operators to develop a more complete and accurate picture of the risks in their systems and, consequently, ensure that the proper asset management decisions are being made to contain risk.

### How to Manage the Information Presented via the Power Law

In his influential and ground-breaking book, The Black Swan^{11}, Nassim Taleb presents in detail the relationship between cost and frequency in Pareto-based environments. In his book, he presents an approach to managing this information that can be quite useful for pipelines. A key point in this approach is to define what we can predict and mitigate and what we cannot. Also, we must learn to know the difference. This is best represented by his conceptualizations of the world into four quadrants as presented in Table 1.

**Table 1: Taleb’s Four Quadrants**

### The First 3 Quadrants

The first 3 quadrants represent areas where we have developed sound technical approaches to manage our pipeline risk or, by chance (and our definition), the non-linearities either cancel out or do not influence the consequence. So, by design and chance, we are in some reasonable control of the risk in these three quadrants. This is explained in that, since risk is the probability multiplied by the consequence, we either have areas of zero-to-low consequence or areas of predictable probability; or both.

Having said that, we must still pursue a disciplined and effective approach to managing the (relatively) known areas of our pipelines. Jana does not support the use of the ubiquitous Index Model. Indeed, this approach has, for over 20 years, brought a discipline to the discussion of risk modeling that has greatly improved risk management. However, as it has become used more generally and applied with less expertise, it has become a ‘plug and play’ approach to risk modeling. This has removed its main benefit to the user – that of the discipline of analysis, the thinking associated with its use. As an Index Risk Model is based on best estimates (not to use the word ‘guess’) AND it does not bring in any real uncertainty into the analysis, the result can be very misleading if it is created and, worse, used by people who do not understand the thinking behind it and, thus, its limitations. In a way, Index Risk Modeling has become a victim of its own success. There are not enough experts to develop the models and to apply them over time and keep the results in a useful context. As such, the models become perceived to be a genuine reflection of expected pipeline performance with NO uncertainty attached to this view. This is a recipe for disaster.

The first 3 quadrants can be managed very differently than that. New but validated Mechanistic- Probability (MP) Modeling^{12} has been developed for pipelines. It was adapted from reliability modeling developed by the US Air Force and the Nuclear industry. It is driven by the idea that each component of a pipeline will fail, over time, in a particular way (given the environment in which it is installed). It is possible to understand that failure mechanism (hence the word: mechanistic), develop an empirical model to mathematically describe that performance and then do it for all the components of a pipeline. Convolute (a statistical word for ‘put together’) all these models and the result is one BIG equation that describes the future performance of the pipeline. As the predictions are based on the underlying mechanisms and simply empirical modelling, there is much greater confidence in extrapolating into the future. Best of all, there are confidence limits so that you know what you know and you know what you don’t really know.

So in the first 3 quadrants a pipeline owner can apply a highly predictive modeling technology to learn about the future performance of their pipeline. In Quadrants 1 and 2, it is truly possible to be able to know how the pipeline will perform. In Quadrant 3, the consequences of these events do not affect the pipeline performance.

### The Fourth Quadrant

To eliminate the academia from this discussion, the key for us, as practitioners, is to understand what risk lies in which quadrant. Once that is done we can apply established technical approaches to Quadrants I and II (Quadrant III, by definition, does not affect the events that negatively affect pipeline performance). When we land in Quadrant IV, what we must do is 1.) Accept that we cannot predict what will happen, or when; 2.) Reject all narratives and projections that try to tell us what will happen and when; and 3.) Work towards mitigating the consequence of such an occurrence.

The fourth quadrant, then, as defined by Taleb, is about the areas in our domain (in our case, pipelines) where our knowledge is limited AND that limitation has the capability to result in an event of high consequence. Also, while we may know the probability of an event occurring, due to the complexity of the system, we will not be able to predict it in terms of where and when. This need not imply that we need to be a victim of the situation. We can take action to change our risk position.

As discussed previously, terrorism follows a Power Curve relationship, just like pipelines do. Israeli anti-terrorism effort demonstrates the effect of actions in affecting the curve to reduce the low frequency, big consequence events. The Israeli approach to combatting terrorism is to concentrate mostly on the rare, big events and (to some degree) let the smaller ones go.

### Bent curve at low frequency

When faced with a complex system that results in low frequency- high consequence (LFHC) events, there are two things that can be done to positively affect a situation, or a combination of these two.

The first thing to do is to move the curve to the left, as shown in **Figure 5**.

**Figure 5: Shifting the Log-Log Power Law Curve to the Left**

This could be a result of reducing, on a pipeline, to total number of small leaks which may reduce, proportionally, the number of mid-sized leaks and larger leaks. The Power Law predicts this relationship – unless there is a fundamental change in the underlying systems, the same relationship between frequency and magnitude is expected to be seen. It is possible, therefore, to be able to predict the impact of overall incident reduction as well as the impact of reducing high consequence tail, the second approach.

A second approach to addressing this situation is to largely ignore low level leaks (except as required by regulation) and focus exclusively on large risks. The effect of this approach can be seen in **Figure 6**.

**Figure 6: Bend the Power Law Curve at the Low-Frequency High-Consequence Area**

The Israelis tend to blend both methods, with a heavy emphasis on the reduction of the larger risks.

For pipelines, this can be accomplished by understanding the position vis-à-vis the Power Law curve, developing the curve that represents this situation and then building event trees from the curve back to the pipeline, as shown in **Figure 7**.

**Figure 7: Connecting Pipeline Event Trees to the Power Law**

This is begun by collecting detail on every relevant pipeline “event” that has occurred on analogous pipelines and building fault trees to connect this to the pipeline in question. Then other possible and improbable events and interactions that could happen are brainstormed. There are excellent disciplined approaches to developing these event trees. These processes must be disciplined and creative to ensure that all possible outcomes are postulated and then managed in the analysis. Therefore, it is best to open it up to different people with different education and life experience so as to add as much creativity and to avoid group think and technical pre-conceptions from usurping the process. Generally, this process is best moderated by knowledgeable outsiders to ensure that internal perceptions are not simply reinforced through the process.

These event trees would be supported by mechanistic-probability modeling which would enable the capture of uncertainty and the expression of its multiplicative nature as the process flows along the event tree. In the end, an understanding of what is known and with what level of confidence and what is not known with any confidence and what risks are associated with each can be developed. Once this is completed, it will become clearer as to where the true risks lie in the pipeline in terms of low- frequency high-consequence events and what actions can be taken to begin to mitigate or eliminate them. In this way, the linear Power Law curve will be ‘bent’ and a significant reduction in the likelihood of a high consequence event will be achieved. This, coupled with the activities in Quadrants I and II, will result in a sustainable risk profile for the pipeline over the long term.

### Conclusions

The consequences of pipeline incidents are seen to follow Power Law or Pareto distributions. That is, there is a direct relationship between the frequency of incidents and their size, and the distribution of incidents has a form that leads to the low probability-high consequence events dominating the risk picture. This behavior is observed in a wide range of pipeline systems including gas distribution, gas transmission, hazardous liquid and gas gathering.

Power Law modeling provides the capability to better assess the risk and, hence, manage that risk in pipeline systems by applying a disciplined approach to mitigating the risk of low probability – high consequence events.

^{1} www.JANAtechnology.com

^{2 }W. Kent Muhlbauer, *Pipeline Risk Management Manual*, 3rd Ed., Elsevier, 2004.

^{3} For risk we are always talking about the future; something that has already occurred is not a risk, it is an event.

^{4} *Pipeline and Hazardous Materials Safety Administration*

^{5} High Consequence Areas

^{6} A. Clauset et al, *Power Law Distributions in Empirical Data*

^{7} http://primis.phmsa.dot.gov/comm/reports/safety/PSI.html

^{8} The log or natural logarithm of a number is the exponent to which the base 10 must be raised to produce that number. For example, the log of 1000 is 3, because 1000 is 10 to the power 3: 1000 = 10 × 10 × 10 = 10^{3}. When data is plotted on a log scale, each increment is an order of magnitude higher than the previous – 1, 2, 3 on a log scale corresponds to 10, 100, 1000 on a linear scale. A relationship that is exponential in nature will plot as a straight line on a log-log plot.

^{9} K. Oliphant, Ph.D. et al, *Characterizing and Modeling the Consequences of Pipeline Incidents*, Jana, Aurora, ON Canada

^{10} Nate Silver,* The Signal and the Noise – Why So Many Predictions Fail but Some Don’t,* 2012

^{11} Taleb, Nassim Nicholas (2007), *The Black Swan: The Impact of the Highly Improbable*, Random House, ISBN 978-1400063512

^{12} K. Oliphant, Ph.D. et al, *A Risk Based Approach to Prioritizing Aldyl Piping Replacements in Gas Distribution Systems*, Jana, Aurora, ON Canada, accepted for presentation at Plastics Pipes XVII, September 2014

## Mechanistic Probabilistic Modeling

You can call it MP Modeling. We call it the better approach to modeling risk for your pipeline integrity.

## Gas Transmission

- Intelligent and scalable risk management
- Exceed regulations with best-in-class compliance
- Prioritize tasks in your asset management

## Gas Distribution

- Ensure continuity of service through prevention
- Achieve optimal compliance more efficiently
- Resolve issues and meet strategic goals