The Application of Risk Assessment to Routing Issues for .../media/Documents/Subject Groups/Safety_Lo… · THE APPLICATION OF RISK ASSESSMENT TO ROUTING ISSUES FOR GAS TRANSMISSION

IChemE SYMPOSIUM SERIES NO. 153 # 2007 IChemE

THE APPLICATION OF RISK ASSESSMENT TO ROUTING ISSUES FOR GASTRANSMISSION PIPELINES

M. R. Acton, P. J. Baldwin and K. Dimitriadis

Advantica Ltd, Ashby Road, Loughborough, Leics. LE11 3GR, U.K.;

e-mail: [email protected]

Background

With increasing demand for gas, and structural changes taking place in the gas industry in many

countries, there is often a need to reinforce and extend the existing gas transmission pipeline infra-

structure. However, particularly in densely populated countries, it can be difficult to identify routes

for new high pressure pipelines, which are sufficiently remote from centres of population and trans-

port networks to guarantee that no interaction would occur in the unlikely event of a pipeline failure.

Although the pipeline industry in general has a very good safety record, incidents have occasionally

occurred, and there can be fierce resistance to new pipeline developments on safety grounds from

those living in the vicinity of a proposed route. Quantified risk assessment (QRA) techniques for

gas transmission pipelines have been developed and refined over a number of years, and, coupled

with existing guidelines for the acceptability of risk, provide an objective means of informing

decisions on pipeline safety issues. This paper describes the PIPESAFE package for gas transmission

pipeline risk assessment (developed on behalf of an international collaboration) and the practical

application of the package to support decisions on pipeline routing, illustrated by case studies.

Methods

The logical structure of the PIPESAFE package provides a framework to assess risks for different

pipeline routing options, taking account of site-specific factors and allowing a full probabilistic treat-

ment of those factors that are unknown in advance of an incident (such as crater geometry, pipeline

orientation following failure, wind speed and direction, time of ignition) to be undertaken. However,

it is generally impractical to undertake a full probabilistic and site-specific assessment for every pipe-

line section. Therefore, a screening approach is adopted, to focus quickly on those locations where

risk levels are likely to be an issue. Those locations are then analysed in more detail, with increasing

sophistication in the risk calculations.

The paper provides an overview of the risk methodology adopted in PIPESAFE, including the indi-

vidual mathematical models and how they are applied, and the assumptions made in assessing risks

from pipelines. The paper also describes the overall process applied in assessing pipeline routes, from

initial identification of the credible causes of failure and practical risk mitigation options available,

through screening of the pipeline route to identify key locations for more detailed assessment, the cri-

teria used to determine when detailed assessment is appropriate and the methodology used in detailed

assessments, and comparison of the results with risk criteria.

Summary

Quantified risk assessment (QRA) techniques have been found to be valuable tools to support

decisions on pipeline routing, complementing the application of relevant design codes and providing

a framework to inform decisions on what can be emotional safety issues. The paper describes the

application of the PIPESAFE package to pipeline routing, illustrated by case studies, demonstrating

when a quick and cautious assessment is sufficient, and where a full and detailed site specific assess-

ment is required.

KEYWORDS: hazard, risk, fire, QRA, transmission, pipeline, routing

INTRODUCTIONWith increasing demand for gas, and structural changestaking place in the gas industry in many countries, there isoften a need to reinforce and extend the existing gas trans-mission pipeline infrastructure. However, particularly indensely populated countries, it can be difficult to identifyroutes for new high pressure pipelines, which are sufficientlyremote from centres of population and transport networks to

1

guarantee that no interaction would occur in the unlikelyevent of a pipeline failure. Although the pipeline industryin general has a very good safety record, incidents haveoccasionally occurred, and there can be fierce resistance tonew pipeline developments on safety grounds from thoseliving in the vicinity of a proposed route. Quantified riskassessment (QRA) techniques for gas transmission pipelineshave been developed and refined over a number of years,


and, coupled with existing guidelines for the acceptability ofrisk, provide an objective means of informing decisions onpipeline safety issues. This paper describes the PIPESAFEpackage for gas transmission pipeline risk assessment(developed on behalf of an international collaboration)and the practical application of the package to supportdecisions on pipeline routing, illustrated by case studies.

For a high pressure gas transmission pipeline, afailure may take the form of a puncture or a completerupture of the pipeline. If the escaping gas is ignited, thismay give rise to a large fire. Figure 1 shows a simplifiedevent tree for the failure of an underground high pressuretransmission pipeline carrying a typical natural gas (i.e. pre-dominantly methane and lighter-than-air). A number of highpressure pipeline failure incidents have occurred around theworld. These highlight the potential for damage that suchfailures can cause to the surrounding population, propertyand the environment. Experience shows that pipeline fail-ures can occur due to a range of potential causes, includingaccidental damage, corrosion, fatigue and ground move-ment. Regarding the consequences of failure, it is primarilythe thermal radiation from the fire produced if the releaseignites that presents the major threat to people and property.The extent of possible damage is greatest for ruptures, whichtypically dominate the risks.

The PIPESAFE package is a flexible software tool forundertaking fully quantified risk assessments of buried pipe-lines, transporting natural gas at high pressures, whichallows the user to carry out hazard analysis, generic riskanalysis or detailed site-specific analysis. In general terms,a quantified risk assessment of a pipeline consists of fourstages:

1. Evaluation of Failure Frequency2. Probability of Ignition3. Determination of Consequences4. Calculation of Risk

Ignition?

YES

NO(puncture)

YES

NO

NO

YES

PIPELINEFAILURE

Rupture?

Figure 1. Event tree

2

The risk to the population can be expressed either asIndividual Risk (IR), that is the frequency at which an indi-vidual at a specified location is predicted to become acasualty; or societal risk, defined as the relationshipbetween the frequency of an incident and the number ofcasualties that may result. This latter risk is usuallyexpressed in the form of a graph of the frequency, F, withwhich N or more casualties are produced, plotted againstN (an “FN curve”). Both types of risk are calculated fromthe consequences of each of the possible scenarios that areconsidered in a particular assessment and the predicted fre-quency of occurrence of each.

PHYSICAL PHENOMENADue to the high pressure at which transmission pipelines areoperated, a failure leads to a turbulent gas release into theatmosphere. For buried pipelines, the overlying soil willbe ejected, forming a crater of a size and shape that influ-ences the behaviour of the released gas. Depending on thealignment of the pipe ends in the case of a rupture, the gaswill escape to the atmosphere in the form of a single jet,or, infrequently as multiple jets, the geometry and spatialposition of which are influenced by the atmospheric con-ditions. Following a rupture, the pipeline will depressuriserapidly. Initially, gas flow rates from each side will bebalanced. However, at later stages the flows decay withtime independently on each side, at rates determined bythe pipeline system, typically becoming increasingly unba-lanced in the course of the event.

As for any turbulent flow, the outcome is largely depen-dent on the momentum and buoyancy forces that act on therelease. The source momentum from a high-pressure pipelinerelease may be reduced or re-directed as a result of interactionwith the crater walls or base, but it will always be significantclose to the release point. The buoyancy forces acting on an

Impacted?

Immediateignition?

YES

NO

YES

NO

IMPACTED JET FIRE

FREE JET FIRE

CRATER FIRE

FIREBALL AND CRATER FIRE

for a pipeline failure

Figure 2. Fireball produced following immediate ignition in a

pipeline rupture release experiment


unignited release arise as a result of the natural gas beinglighter than the surrounding air. In contrast to the momentumforces, they are usually not significant close to the release.However, buoyancy is a body force that continues to act onthe release. As more air is entrained into the emerging flow,the momentum forces become relatively less important andthe buoyancy effects become more significant, combiningwith the influence of atmospheric conditions to determinethe geometry and spatial position of the release.

Ignition can occur at any time during the release. Ifignition occurs immediately on, or shortly after, a rupture,a transient fireball could occur (Figure 2). The fireball,which is the result of combustion of the mushroom-shapedcap that is fed from below by the established part of thefire, lasts, typically, for up to thirty seconds (depending onthe pipeline size and initial pressure), and then burns outleaving a quasi-steady state fire. If ignition occurs afterthe initial highly transient phase, it is possible that aquasi-steady fire only will result. In all ignited releases,the buoyancy forces are enhanced, as the hot combustionproducts are considerably lighter than air, increasing the ten-dency for the release to rise upwards.

For pipeline ruptures, the levels of thermal radiation,incident on the area surrounding the ignited release, varywith the time after rupture and with distance from therelease point. They depend on the shape, nature and extentof the fire (determined by the source and atmospheric con-ditions), and the atmospheric transmissivity between thefire and the receiver (determined by the humidity). The inci-dent thermal radiation from an ignited pipeline release canaffect both people and the surrounding property. Peoplecan be killed or seriously injured as a result of receivinglarge thermal radiation doses, and buildings can be ignitedby thermal radiation directly from the fire or from secondaryfires (e.g. from burning vegetation). The time variation ofthe radiation field is an important aspect of the behaviourof an ignited rupture release. The damage that a pipelinerupture could produce would be significantly overestimatedif based on the initial outflow rate alone.

In summary, the physical aspects that must be con-sidered in assessing the potential consequences of a pipelinefailure are:

. Outflow as a function of time (influenced by failurelocation and upstream and downstream boundary con-ditions)

. The likelihood of ignition and time of ignition followinga failure

. The thermal radiation produced by a fire in the initialhighly transient phase of flow establishment if therelease is ignited immediately

. Thermal radiation from the quasi-steady phase of anignited release, during which the fire size and associatedthermal radiation levels decrease gradually in response tothe decaying release rates, influenced by the shape of thecrater that is formed following the release, the alignmentof the pipe ends following a rupture (or the location of thehole for a puncture), and the atmospheric conditions.

3

PIPESAFE METHODOLOGYPIPESAFE is a knowledge-based, integrated risk assess-ment package for gas transmission pipelines comprising alinked series of mathematical models of the above phenom-ena, designed to take the time-dependent nature of the eventinto account (Acton, 1998 and Acton, 2002). Risk assess-ments can be carried out following different sets of rules(methodologies), depending on company practices and/orthe regulatory environment in which the pipeline is oper-ated. Irrespective of the adopted methodology, a PIPESAFErisk assessment can be considered as having the followingmain elements:

. Input of general data (pipeline and its location, meteor-ological conditions, physical properties of gas)

. Determination of failure mode and frequency

. Prediction of release consequencesW Calculation of release flow rateW Determination of ignition probabilityW Calculation of thermal radiation emitted by fire in

an ignited releaseW Quantification of the effects of thermal radiation

on the surrounding population. Calculation of risks

The above list defines the logical order in whichPIPESAFE carries out the operations required for a riskassessment (illustrated schematically in Figure 3).

Steel transmission pipelines can fail due to variouscauses including material or construction defects, fatigue,

InputParameters

Failure cause?

Failure mode?

Calculation ofFailure Frequency

Outflow Dispersion IgnitionThermalradiation

Radiationeffects

Consequence calculations

Rupture or Puncture?

FatigueExternalinterference

Groundmovement Corrosion

Causes

Risk Calculations

Risk Transect

FN curve (PLL, EV)

Societal

Individual

Figure 3. PIPESAFE risk calculation flowchart


and corrosion or ground movement. However, on mostmodern pipeline systems, the corrosion protection measures,pipeline design and construction methods, and inspectionprocedures do much to eliminate the possibility of failuredue to these causes. Consequently, external interferencedamage is generally considered as the most significantcause of pipeline failure. The failure mode (i.e. rupture orpuncture) is determined by the length, depth and type ofdefect, and is primarily dependent on the pipe diameter,wall thickness, material properties and the operatingpressure. In a risk assessment, the likelihood of each rel-evant failure mode can be evaluated by summingthe contribution from each of the credible failure causes;this is normally expressed as a failure frequency per yearand pipeline unit length. Failure frequencies can bederived directly from historical data, from databases suchas those published by EGIG (European Gas pipeline Inci-dent data Group, covering gas transmission pipelinesmainly in Western Europe) and UKOPA (UK Onshore Pipe-line operators’ Association, covering major hazard pipelinesin the UK). However, because failures of high pressure gaspipelines are extremely rare events, the available historicaldata is limited for statistical purposes. PIPESAFE includesa suite of structural reliability analysis (SRA) models topredict the frequency of pipeline failure, which combine his-torical data (for example hit rates and damage distributions)with a fracture mechanics treatment to predict failure fre-quencies for pipeline-specific parameters such as diameter,pressure, wall thickness and material properties.

The consequences of a gas release depend criticallyon whether ignition occurs and, for an ignited release, onthe time of ignition. The direct prediction of whether a

4

particular release will ignite or not in specific circumstancesis difficult, and therefore generic values for ignition prob-ability are usually obtained by analysing historical incidentdata. PIPESAFE provides default values of ignition prob-ability, related to the pipeline diameter and pressure,which have been derived from historical experience of trans-mission pipeline operation. Data were analysed and a trendidentified for rupture incidents where ignition probabilityincreases linearly with (pd2), where p is the pipeline operat-ing pressure (bar, gauge pressure) and d is the pipeline diam-eter (m). The relationship incorporated in PIPESAFE is usedup to a (pd2) value of 48.2 bar m2; above this value a limitingignition probability of 0.8 is used.

Many of the phenomena described in Section 2 arescale dependent. This arises as the governing forces, momen-tum and buoyancy, change at different rates with the size of arelease. Hence, which of the forces dominates may differ atdifferent scales. Thus, it is not easy to infer how a release atone scale will behave simply from observations at a differentscale. However, this is not to say that small-scale studieshave no place or value in the development of a mathematicalmodel. It is usual in the process of developing a mathemat-ical model for major accident hazards to split the compli-cated problem into its constituent steps. For example,predicting the radiation from a jet fire can be tackled byfirstly determining the jet trajectory and temperature fieldwithin the combusting jet and then by predicting thethermal radiation from that temperature field. The tempera-ture field can be predicted from a separate combustion sub-model, if the amount of air entering the jet can be predicted.This in turn relies on predicting how much air is entrainedinto a jet flow as a result of its relative motion through the

1.00E-12

1.00E-11

1.00E-10

1.00E-09

1.00E-08

1.00E-07

1.00E-06

1.00E-05

1.00E-04

1

Number of Casualties (N)

Fre

qu

ency

of

N o

r M

ore

Cas

ual

ties

per

Yea

r (F

)

10010

Figure 4. Example FN curve


surrounding medium. This process continues until eventuallya number of discrete, manageable modelling challenges areposed. Each of these may then be amenable to study atsmall scale, as perhaps only one force dominates. In theexample above of the jet fire, the entrainment of air into ajet due to its source momentum can be studied at laboratoryscale and appropriate models formulated. As the abovedescription indicates, it is vital that when the constituentsub-models are combined to produce the working modelfor the full-scale situation, it is tested against full orlarge-scale data. This data is used to check that there areno unexpected interactions or governing processes thathave been overlooked in the model formulation.

In developing the models within the PIPESAFEpackage, the above approach has been adopted. Sub-modelshave been formulated, generally based on reduced scale exper-iments and the composite model has been tested and checkedagainst large-scale data. This has included testing the modelagainst two full-scale experiments that were carried out ona specially instrumented section of 36-inch diameterpipeline operating at a pressure of 60 bar (Acton, 2000).

APPLICATION TO PIPELINE DESIGN AND

ROUTINGThe PIPESAFE package has a wide range of applicationsbecause of the flexibility it provides in the extent of anyanalysis. At the simplest level a generic assessment maybe performed, based on the known pipeline parameters, topredict consequences in terms of hazard ranges. Forexample, a PIPESAFE consequence assessment can beused to support initial pipeline route evaluation by compar-ing calculated hazard ranges with the separation distancebetween the pipeline and the surrounding population, pro-viding a form of screening that can be used to identifysites where there is the possibility for impact on people.The facility to perform a more detailed analysis is alsoavailable, whereby the response of people to the thermal

5

radiation hazard is modelled and consequences are com-bined with predictions in order to predict risk levels.

Gas transmission pipelines in the UK are generallyrouted in accordance with guidance published by the Insti-tute of Gas Engineers and Managers (IGEM) in IGE/TD/1 Edition 4, which specifies minimum proximity distancesbased on pipeline size and pressure. However, IR levelscan also be used to determine minimum separation distancesof buildings to proposed new transmission pipelines. ThePIPESAFE package can be used to calculate the distancefrom a pipeline to a specified IR contour and therefore todemonstrate that populations in the region of pipelines arenot subject to intolerable IR levels when compared toaccepted risk criteria.

A societal risk assessment can be performed withdifferent levels of detail. An approximate approach is toperform a generic societal risk calculation in which thedetails of the population surrounding the pipeline are speci-fied by a number density. This can be a useful approach for asimple assessment of possible alternative route options;however, a site-specific assessment, in which the locationof the pipeline and populations can be defined and multipleresidency values can be used, is a more accurate way ofmodelling realistic situations. In both assessment types,the package has the ability to use different casualty criteriarepresenting the chance that a person would exceed a certainthreshold thermal dosage.

Following a site-specific societal risk assessment gen-erates both an FN curve and an Expectation Value (EV). TheEV is essentially the statistically expected average numberof casualties that result per year for a given length of pipe-line. It is then possible to use PIPESAFE and the results of arisk assessment to perform a Cost Benefit Analysis (CBA).This involves investigating the effects of various riskreduction measures (e.g., relaying the pipeline in increasedwall thickness, laying slabbing over the pipeline, increasingsurveillance frequency, etc.) in terms of safety benefits andcomparing these with the associated costs to determine if the


risk levels are As Low As Reasonably Practicable(ALARP). ALARP is demonstrated where there is grossdisproportion between the cost of a mitigation measureand the benefit it provides.

The use of PIPESAFE to support decisions on differ-ent aspects of pipeline design and routing issues forproposed new pipeline developments is illustrated in thefollowing three case studies:

CASE STUDY 1 – PIPELINE ROUTE SELECTIONA pipeline company had identified a requirement for a newlarge diameter pipeline in Western Europe, in an area of exist-ing infrastructure including high pressure gas pipelines, andsignificant population. Two possible route options had beenidentified; the first option was shorter, but closer to populationand existing pipelines, whilst the second option was substan-tially longer. The objectives of the study were to assess thelevel of risk using PIPESAFE for both routes for comparisonwith criteria for risk acceptability, and to allow the risk levelsfor the two alternative route options to be compared.

A threat analysis was undertaken to consider therange of possible threats to the integrity of the proposedpipeline. Based on the output from the threat analysis,failure frequency values were derived including values forthe threat from escalation from a failure of a nearby parallelpipeline. Consequence analysis was undertaken using themodels in PIPESAFE. Risk calculations were performedto predict Individual Risk at selected locations near to thepipeline route, and Societal Risk for the two routes,expressed as an F-N curve, based on the available infor-mation for the residential population density, numbers ofworkers at industrial facilities, and major roads. Theresults provided a valuable input to support an informeddecision on the available route options.

CASE STUDY 2 – ASSURANCEPIPESAFE was used to provide risk assessment support fora major transmission pipeline project in Asia. The con-ditions along the route of the new pipeline are extreme,and in particular it was proposed to pass through areas ofunusually high population density, with the potential forlarge numbers of casualties in the unlikely event of afailure of the pipeline. The study addressed this issue byassessing the level of risk associated with those sectionsof the proposed pipeline route that will pass throughdensely populated areas, and by providing support duringthe design review stages to evaluate mitigation options tominimise the future risk to people living in the vicinity.

A three-stage approach was adopted:

Phase 1 – Preliminary Assessment: Advantica first visitedthe client’s offices in Asia and undertook an informationgathering exercise with the company’s personnel and toidentify the credible threats to the integrity of the pipeline.Following this, a first phase of work was carried out toassess the overall risks of the pipeline.Phase 2 – Identification of High Risk Areas: The results ofPhase 1 were employed to perform a screening analysis of

6

the pipeline route. This identified a number of locationswhere the societal risk levels were expected to be generallyhigher than would be typical for the particular pipelinelocation, due to the relatively high populations.Phase 3 – Detailed Risk Assessment and Identification ofRisk Reduction Measures: Field visits were carried out alongthe proposed pipeline route at the selected locations togather detailed information on building locations and popu-lation densities. This information was then used to carry outdetailed risk assessments at specific locations. The calculatedlevels of risk were compared with international criteria, toidentify areas where the level of risk would not be acceptable.The effects of physical protective measures to reduce riskswere also identified and assessed, in order to establishwhether the use of such measures was justified.

The results of the study provided information todemonstrate that the proposed pipeline route and designmet international standards for the acceptability of risk, inorder to reassure potential investors that pipeline safety ismanaged in an appropriate manner. The results alsohelped to minimise the future risk both of casualties andof loss of supply, using the most cost-effective methods,and to Identify opportunities for cost savings in pipelineconstruction and operation without compromising safety.

CASE STUDY 3 – INDEPENDENT SAFETY REVIEWAdvantica were awarded a contract by the Irish Governmentto undertake an independent safety review of the proposedCorrib gas pipeline in County Mayo, Ireland. The Corribgas pipeline is being constructed by Shell E&P Ireland tobring gas onshore from the Corrib gas field off the westcoast of Ireland to a terminal 9 km inland. The proposedpipeline has encountered strong local opposition, andaroused national interest and controversy. Key concernsexpressed by members of the public regarding the safetyof the pipeline included the very high design pressure(345 bar, much higher than conventional onshore gas trans-mission pipelines), and the proximity of the pipeline tohousing and the consequences of a pipeline failure.

A small team visited the site to gain first hand infor-mation and participated in two days of oral hearings inMayo to ensure that issues of concern within the scope ofthe review were addressed in the report. The scope of thereview included a critical examination of the relevant docu-mentation relating to the design, construction and operationof the onshore, upstream section of the Corrib gas pipelineand associated facilities and assessing whether the pipelinewill be designed, constructed, installed and operated toappropriate standards, codes of practice, regulations andoperating procedures.

As part of this review, a detailed assessment was carriedout using PIPESAFE to assess the level of individual andsocietal risk associated with the proposed pipeline route.The assessment included an analysis of the effect on risklevels of limiting the pressure in the onshore section of thepipeline. One of the key conclusions of the review was thatlimiting the pressure in the onshore section to pressures no


greater than 144 bar (equivalent to a design factor of 0.3, con-sistent with the design of pipelines passing through moredensely populated suburban areas) was believed to be bothpractical and an effective measure to reduce risk. In view ofthe societal concerns, the level of uncertainty in the risk analy-sis, the extent of extrapolation of onshore pipeline designcodes beyond their normal range of application and mindfulthat the results of risk analysis are only one factor in thedecision-making process, the review recommended that thepressure in the onshore pipeline should be limited to nogreater than 144 bar, with a design factor not exceeding 0.3,and the pipeline design revised accordingly.

The draft safety review was presented to the commu-nity in Mayo, and published on the same day. The finalreport, addressing comments received, was published bythe Minister for Communications, Marine and NaturalResources, Mr Noel Dempsey, TD, in May 2006.

REFERENCESActon, M.R. and Andrews, R., 2006, Independent Safety

Review of the Onshore Section of the Proposed Corrib Gas

7

Pipeline, Advantica Report R8391 available from

www.dcmnr.ie/TAG.

Acton, M.R., Baldwin, P.J., Baldwin, T.R., and Jager, E.E.R.,

1998, The Development of the PIPESAFE

Risk Assessment Package for Gas Transmission Pipelines,

Proceedings of the International Pipeline Conference,

ASME International, Calgary.

Acton, M.R., Baldwin, T.R., and Jager, E.E.R., 2002, Recent

Developments in the Design and Application of the PIPE-

SAFE Risk Assessment Package for Gas Transmission Pipe-

lines, Proceedings of the International Pipeline Conference,

ASME International, Calgary.

Acton, M.R., Hankinson, G., Ashworth, B.P., Sanai, M., and

Colton, J.D., 2000, A Full Scale Experimental Study of

Fires following the Rupture of Natural Gas Transmission

Pipelines, Proceedings of the International Pipeline Confer-

ence, ASME International, Calgary.

IGE/TD/1, 2001, Recommendations on Transmission and Dis-

tribution Practice: Steel Pipelines for High Pressure Gas

Transmission, Edition 4.

Reducing Risks, Protecting People: HSE’s decision making

process, 2001, HSE Books.