Asset Criticality Framework

Transcription

1 Asset Risk Management Asset Criticality Framework October 2018

2 1 Contents 1. Introduction Overview of criticality Criticality bands The Asset Criticality Framework Criticality event Monetised consequence Probability of consequence Limitations on the scope of the Criticality Framework Dimensions of criticality Service performance Public safety Workplace safety Environmental Direct cost Total criticality Further development of the Criticality Framework Asset data quality Asset coverage... 12

3 2 1. Introduction Asset criticality describes the consequence of asset failure. Criticality plays a key role in our understanding and management of asset risk within the grid. Our Criticality Framework applies to our physical grid assets, and provides the structured approach of calculating the consequence associated with a major failure of an asset. It is aligned with our corporate risk policy and so provides a clear line of sight from the corporate level down to investment decisions. This document provides a high-level description of the Criticality Framework. It has been written for a reader who has a base level understanding of transmission networks, power system modelling, and risk modelling. The risk associated with owning and maintaining an asset is derived using the likelihood and the resulting potential credible consequence of the failure. We derive the likelihood of a degradation-related asset failure in accordance with our Asset Health Framework. 1 1 Refer to Asset Risk Management Asset Health Framework document dated October 2018.

4 3 2. Overview of criticality Asset criticality has been developed to prioritise major investment decisions. It is a measure of the impact or consequence of a major failure of an asset under normal operating conditions. The major failure criteria are defined and detailed in our Asset Health Framework. In summary, the screening for major failure must meet the following three conditions: major work or impact is the replacement or major refurbishment required from a lengthy period of an asset being out of service, failure urgency relates the timing of operational decisions and depends on the asset class. This is broadly consistent with international definitions used by CIGRE/ITOMS, 2 and primary cause is either the equipment failure or, for some assets, the environmental cause such as wind. Environmental causes are dependent on whether the conditions are within the design envelope of the asset, i.e. we exclude extreme weather events beyond return periods for which we design the grid. The impact of a major failure is measured across five dimensions to capture the full extent of the criticality of the asset. These dimensions are Service Performance, Public Safety, Workplace Safety, Environmental, and Direct Cost. Criticality does not consider extended failure events such as High Impact Low Probability (HILP) and cascade failures, with the exception of underbuilt conductors. Criticality is based on current network configurations and does not consider future system changes. Asset Criticality is designed to complement asset management and investment prioritisation processes, within the Asset Planning Decision Framework. 3 Current practice for many asset classes is that asset criticality is used to understand the risk profiles of different investment scenarios and to assist with prioritising solutions, including testing different price-quality scenarios to evaluate impacts on risk versus investment. Only a few asset classes undergo detailed risk-based approaches for option analysis. However, as we improve maturity in data quality, decision making and modelling, other asset classes, where prudent and practical to do so, are likely to adapt riskbased approaches. 2 CIGRE and ITOMS are international benchmarking organisations. 3 Our Decision Framework is the process we undertake to determine our investment decisions.

5 4 2.1 Criticality bands Asset criticality is reported in our Asset Class Strategies, Portfolio Management Plans, and Asset Management Plan. Consistent with the corporate risk matrix, we report criticality by band as shown in Table 1 below. An example of how criticality is represented graphically is shown in Figure 1 below. Criticality Band Criticality Consequence Greater than and equal to Less than C1 Insignificant $0 $300,000 C2 Negligible $300,000 $1,000,000 C3 Minor $1,000,000 $3,000,000 C4 Moderate $3,000,000 $10,000,000 C5 Major $10,000,000 $30,000,000 C6 Severe $30,000,000 $100,000,000 C7 Critical $100,000,000 $300,000,000 C8 Catastrophic $300,000,000 N/A Not Applicable Criticality Value not able to be calculated Table 1: Criticality branding Figure 1: Reporting of criticality with banding

6 5 3. The Asset Criticality Framework The Criticality Framework presents a structured approach to measuring the impact or consequence of an asset failure. It is designed to provide a transparent, repeatable and consistent assessment of the current asset class across five dimensions of criticality: service performance public safety workplace safety environment direct cost. All criticality dimensions are expressed in dollar terms, providing a standardised unit of comparison between asset classes. The dimensions of criticality are designed to be additive, meaning that they can be used independently or added together depending on the drivers. The value of asset criticality is calculated using a probabilistic approach. This approach recognises the uncertain mechanics of asset failure and the resulting consequences. We model many permutations of different scenarios and use the probability of those scenarios to determine an average credible consequence. The criticality calculation process assumes that all practical controls that exist are in place when the asset fails. This means that if personnel are at a substation site, they are wearing their full Personal Protective Equipment, all safety procedures and processes are followed during equipment operation, etc. Our Asset Bow Ties are used to identify existing controls in place for a specific asset to prevent the occurrence of a criticality event. Figure 2 below outlines the general process used to calculate the criticality value of an asset. Figure 2: Graphical representation of criticality calculation process

7 6 Each step in the calculation is described in more detail below. 3.1 Criticality event A criticality event is an asset failure that results in one or more consequences defined in our corporate risk matrix, outlined in Figure 3 below. Criticality events are determined by a Failure Mode and Effect Analysis (FMEA), which defines the functional failures of an asset and details the causes and effects of the failure modes that lead to the functional failure. Not all functional failures result in a criticality event. Only those that are credible, or likely to happen, and relevant to each criticality dimension are analysed. 3.2 Monetised consequence The monetised consequence measures how significant the outcome of a criticality event is. This ranges from insignificant to catastrophic, as per the consequence categories of the corporate risk matrix shown in Figure 3. The consequence of failure has a strong dependence on the type of asset that is being analysed and the criticality dimension that is being considered. For example, an overhead line running through a high-density urban environment has very high public safety consequence if it fails, but is not necessarily so highly rated for some of the other dimensions. In contrast, a transformer failure resulting in an oil spill has high environmental consequence but no public safety consequence. 3.3 Probability of consequence Probability of consequence represents the likelihood of the specific criticality event occurring when the asset fails. Probability of consequence is calculated using industry data as well as our outage and failure data, where available. For a criticality event such as a transformer bushing explosion, the probability of consequence is the percentage of all transformer major failures that result in a bushing explosion multiplied by the probability of personnel presence in the vicinity of the transformer at the time of failure. Insignificant Negligible Minor Moderate Major Severe Critical Catastrophic $100,000 $300,000 $1,000,000 $3,000,000 $10,000,000 $30,000,000 $100,000,000 $300,000,000 Direct Cost 0.03min 0.1min 0.3min 1min 3min 10min 30min 100min Security First Aid Injury or Pain & Discomfort Medical Treatment Injury (MTI) Lost Time Injury (LTI) Serious harm or serious injury or illness Fatality or permanent disabling injury or illness Multiple fatalities or permanent disabling injuries or illness Multiple fatalities at numerous sites Workplace Safety First Aid Injury or Pain & Discomfort Medical Treatment Injury (MTI) Lost Time Injury (LTI) Serious harm or serious injury or illness Fatality or permanent disabling injury or illness Multiple fatalities or permanent disabling injuries or illness Widespread fatalities or multiple fatalities at numerous sites Public Safety Short term damage to small area of limited significance Pollution beyond TP s property but contained Pollution beyond TP s property impacting area of significant environmental value Medium to long term major but recoverable environmental damage Long-term serious environmental damage and/or degradation, difficult restoration Major widespread environmental release or Major environment effects Long-term serious environmental damage and/or degradation, difficult restoration Irreversible widespread environmental damage and/or degradation Environment Non-compliance or minor breach of regulation or other contract/ obligation Breach of regulation or other contract/ obligation with penalty Major breach of regulation or other contract/ obligation with penalty Breach of regulation with penalty or financial implications Investigation by Office Holder or Agency Investigation by Crown/ Shareholder/ Minister Public Inquiry or los of core function such as System Operator Loss of license to operate Compliance Sustained adverse local media coverage Adverse national media coverage Sustained adverse national media coverage Short term international adverse media coverage Sustained international adverse media coverage Minister consistently upholds major complaints from stakeholders Reputation Figure 3: Corporate risk matrix

8 7 3.4 Limitations on the scope of the Criticality Framework Criticality only covers credible major events that occur during normal operating conditions. It does not consider the following. External failure categories. Criticality does not cover scenarios associated with asset failures originating from external influences such as extreme events, third party acts, or human error. Multiple failures at the same time (simultaneous failures). Concurrent failures are rare and do not significantly influence the criticality of an individual asset. High Impact Low Probability (HILP) events that result in major failures across a group of assets, such as an entire site or multiple sites, are also outside the scope. Cascading failures. Cascade failures are not considered. The exception to this is where a line drops onto an underbuilt circuit, the potential for which is included in the analysis. Minor failures. Minor failures that are easily repairable or corrected are not analysed and all consequence is based on the estimated effects of a major failure. Changes in Asset Management and/or Operational Context. Criticality does not forecast or consider the future states, system configurations, resilience, or reliability. It is based on the current network topology only. Reputation. For the majority of assets, the reputational cost of a major asset failure is included within the value used for the five dimensions of criticality we consider. Where this is not the case and reputation is material, it is considered within the business case explicitly. Compliance. Only a very small portion of asset failures would result in a compliance breach. In addition, compliance incidents are typically variable and are difficult to map back to specific assets. Therefore, compliance is not incorporated as part of the criticality framework. Where it is a significant consideration, compliance is considered and managed through other means external to the criticality scope.

9 8 4. Dimensions of criticality The five dimensions of criticality are further explained below. 4.1 Service performance Service performance criticality calculates the amount of energy in MW at a point of supply (POS) that is at risk because of an asset failure. It is measured in $/h. Combining the restoration time of the failed asset with the energy loss gives a value for the Service Performance Criticality. Analysis of AC asset criticality involves 277,140 contingencies (permutations) for the South Island for one load block (3,325,680 for 12 load blocks). For the North Island it involves 1,070,916 contingencies for one load block (12,850,992 for 12 load blocks). These are the key inputs and assumptions in the design of the Service Performance Criticality for AC assets. The branch(es) taken out by the asset failure are identified and the resulting lost load or generation at each POS. It also considers the impact of a branch outage combined with any other single branch outage on the relevant network and the resultant lost load at any of the POSs. The South Island and North Island network are treated separately. The generation and load used in the calculation consist of 4 load block periods per season (i.e. 12 per year). The power system model provides loads lost across all POSs, and VoLL is applied to these loads to monetise the consequence. The VoLL value utilised in the calculation for each POS was extrapolated from our VoLL survey in A probability is not applied to the asset failure (as this is derived from the Asset Health Index), but it is applied to the unavailability of the other branches that typically provide redundancy, i.e. the event that results in the N-2, which could be due to any type of outage (planned or unplanned). The unavailability used depends on the branch type, and is based on the 10-year averages of the different branch types. Consequence is calculated for a select 12 periods, and weightings for each contingency to estimate the expected (mean) consequence of failure of all contingencies in the historical year being studied. The monetised rate ($/h) values are combined with high-level restoration time to provide ready-to-use monetised ($) consequence of failure for service performance. High-level restoration time was developed for generator assets, N-security assets and N-1 (or better) security assets. We have used the average historical restoration times from 18 years of interruption data to determine the average for high-level restoration times. However, for line crossings and multiple circuit structures we use an estimate of realistic repair time or time to install temporary assets, whichever is the lesser.

10 9 Key inputs and assumptions in the design of the HVDC Service Performance Criticality follow. An unplanned asset failure (or combination of asset failures) can reduce the HVDC s maximum capacity and risk subtractor, with a varying impact on the stability of the system and the electricity market. Asset failures have been mapped to four distinct HVDC scenarios that represent a reduction in the HVDC s capability. l Monopole outage: 500 MW north, 500 MW south, 0 MW risk subtractor l Bipole outage: 0 MW north, 0 MW south, 0 MW risk subtractor l Reactive support and filters (350 RS): 1200 MW north, 850 MW south, 350 MW risk subtractor l Reactive support and filters (140 RS): 1200 MW north, 850 MW south, 140 MW risk subtractor The average cost from each of these scenarios is determined using SDDP (Stochastic Dual Dynamic Programming). Each scenario is simulated at two different times of the year, and for three different outage lengths. In addition, it is assumed an unplanned bipole outage (Scenario 2) will result in Automatic Under Frequency Load Shedding. The cost of this is added to the consequence of failure for this scenario. 4.2 Public safety Public safety criticality is used to calculate the impact of asset failure that results in injury to members of the public. The key inputs and assumptions in the design of the Public Safety Criticality follow. These Public Safety Events are modelled. l Conductor drop onto a member of public l Conductor drop onto a road or railway l Conductor drop onto a building l Conductor suspended causing electrical hazard l Structure collapse onto member of public The consequence of a major asset failure is the most credible outcome of an event. We do not consider the worst-case scenario from an event but rather the one that is most likely to occur. We consider the probability of public presence near the asset when it has a major failure. This varies depending on the land use and number of buildings. We consider the probability of a conductor drop causing an accident and that the accident leads to an injury. The probabilities used have been developed using information from Geographic Information Systems (GIS), NZTA statistics, and engineering judgement/industry data.

11 Workplace safety Workplace safety criticality is used to assess the potential consequence an asset failure has for personnel that may be near the asset while it is in service. It excludes potential harm caused during maintenance activities. These are the key inputs and assumptions in the design of the workplace safety criticality. The workplace safety events modelled are explosion/fire and falling objects. Only assets that have porcelain bushings are considered for the risk associated with explosion projectiles, as these assets are deemed to carry the greatest consequence. For circuit breakers, the fire/explosion risk from an uncontrolled arc is modelled and varies for the type of circuit breaker. Probability of people being at the site and within the exposed corridor is used in the assessment. Falling objects relate to assets that are installed at a height that have the potential to fail in a way that can cause components or the entire asset to potentially drop on top of personnel who are directly underneath the asset. Data is sourced from industry studies, subject-matter expert judgement based on experience, and from a substation occupation assessment. 4.4 Environmental Environmental criticality considers the most likely environmental consequence, and the resulting financial impact from asset failure. This includes oil in circuit breakers and transformer, SF 6 gas, and other materials that all have the potential to escape into the environment when an asset fails. These are the key inputs and assumptions in the design of the environmental criticality. Four predominant environmental events have been identified. l Oil leaks l Equipment fire l SF 6 gas leaks l Bush/rural fire Probabilities for leaks and equipment fires depend on the type of equipment. The probability is mostly sourced from industry reliability data and risk studies of technical and human factors. Probability of bush/rural fire considers the number of supported spans by the asset, the likelihood of earth fault igniting a fire, and the probability of ignition leading to a sustained fire. We assume that sustained fires will only occur on high, very high, extreme fire-risk days. Information for bush/rural fires is sourced from a report on ignition tests and information on the number of high, very high, extreme fire-risk days based on geographical location in New Zealand.

12 Direct cost The direct cost criticality considers the likely total cost of repairing failed assets and, where applicable, the cost to replace the asset to bring it up to the latest standard. Potential damage to private property is also covered by direct cost. These are the key inputs and assumptions in the design of the direct cost criticality. Restore power this typically involves a temporary rearrangement of the network to isolate and bypass the failed asset, installing a spare, or performing a band-aid fix of the failed asset to restore power. This has been estimated and represents the average material and labour cost required to restore power. Planned asset replacement based on an estimate of the financial cost of replacing an asset in line with current standards. Repair damage to property for line assets located in developed areas. The cost to repair private property is considered and estimated depending on the scenario and land use below. 4.6 Total criticality The total criticality is calculated by summing the results of the criticality analysis for each component. Our analysis has shown that Service Performance, Public Safety and Direct Cost Criticality are typically (but not always) a few orders of magnitude larger than Workplace Safety and Environmental Criticality. If one of Service Performance, Public Safety and Direct Cost Criticality cannot be determined, we do not report a total criticality. However, if Workplace Safety and/or Environmental Criticality are missing, we still compute a Total Criticality by considering them equal to zero.

13 12 5. Further development of the Criticality Framework We plan to continue the development of our Criticality Framework. The key areas for continued improvement are data quality and asset coverage. These are discussed below. 5.1 Asset data quality Good data structure and quality allows for a robust and straightforward calculation of asset criticality. Throughout the design and build process of criticality dimensions, several data quality improvement opportunities have been identified. Future criticality improvements will prioritise and deliver data quality improvements where valuable and prudent to do so. 5.2 Asset coverage Not all asset types have been covered by the Criticality Framework at this time. Some asset types lack the specific asset failure data required for criticality calculation, while others are currently deemed to have insignificant impact. Further development of modelling and better understanding of asset-specific failure modes and their likelihood will broaden the range of assets covered. Current asset coverage is shown in Table 2 below. Asset Group Asset Class Coverage Lines Conductors (km) 99% Tower Foundations Other 99% Tower Foundations Grillage 100% Tower Protective Coating 99% Insulators 98% Pole Structures 94% Stations Instrument Transformers 85% Outdoor Circuit Breakers 93% Power Cable 81% Indoor Switch Gear 89% Power Transformers 86% Disconnector & Earth Switch 63% Secondary Systems Battery Banks 0% Capacitor Banks 93% Protection Relays 0% Table 2: Criticality coverage by asset class

14 TRANSPOWER.CO.NZ TRANSPOWER NEW ZEALAND LTD THE NATIONAL GRID