Consequence of Failure

 

“There are in nature neither rewards nor punishments — there are consequences.”

Robert G. Ingersoll, The Christian Religion An Enquiry

“Logical consequences are the scarecrows of fools and the beacons of wise men.”

Thomas Henry Huxley

Introduction

Risk assessment measures the frequency and/or impacts of some consequence created by some failure. The definition of failure determines the measurement units for consequence.

Once we understand what can go wrong and how likely it is for something to go wrong, the next logical question is ‘how bad can this event be?’ More specifically: What can be harmed by this pipeline failure? And how badly are ‘receptors’ likely to be harmed? and other various forms of the question “What are the consequences?” are answered by estimating damages that may occur. When failure is defined as loss of integrity, then the complex and variable interaction between the product transported and the pipeline’s environment must be evaluated in terms of damage potential. For example, topography, soil types, vegetation cover, populations nearby, weather conditions etc., are often variable and unpredictable. When they interact with the countless possible leak/rupture scenarios, the problem becomes reasonably solvable only by making assumptions and approximations. Consequences associated with broader definitions of ‘failure’ add even more complexity since they add to the leak/rupture scenarios.

In a risk assessment, potential consequence estimates are combined with the PoF estimates to arrive at final risk estimates. With failure defined as a leak/rupture (loss of integrity), this full risk assessment approach requires estimates, all along each pipeline, of the following:

1. 1. 1. Probabilities of various spill sizes and dispersion scenarios.
      2. Consequences associated with each spill at each possible location
      3. Estimates of hazard zone distances associated with each spill size
      4. Characterization of receptors at various distances from the release
      5. Counts or valuations associated with potential damages to the various receptors.

When estimates from these are combined, the results will represent probability and magnitude of consequences. While this task list is short, producing estimates for each item can be very challenging. Initial chapters of this book focused on the failure potential and this chapter addresses the consequence estimation step.

As with PoF, the designer of the CoF assessment model must strike a balance between complexity and utility—using enough information to capture all meaningful nuances (and satisfy data requirements of all regulatory oversight) but not insisting upon information that adds little value to the analysis. By identifying more critical variables and taking advantage of some modeling conveniences, a methodology structure is offered here as a possible assessment approach that is both manageable and robust enough to be a complete decision-support tool. Initial applications can be completed quickly, although some accuracy will usually be sacrificed with ‘short cut’ approaches. More robust and more defensible iterations can be subsequently completed by eliminating the short cuts and assumptions initially employed. In other words, the assessment can improve over time, with no change in methodology required.

The recommendations here parallel the robust consequence assessments seen in many QRA’s and improve upon assessments typically associated with older scoring or indexing risk assessments. The main enhancements are:

1. 1. 1. Use of hazard zones and their associated probabilities of occurring, as a key ingredient in the assessment.
      2. Characterization of receptors and their potential damage rates within hazard zones.
      3. Recognition of the range of consequence scenarios, including their respective probabilities of occurrence, rather than basing the assessment solely on a point estimate like ‘worst case’.

Terminology

To quantify consequence, a choice of some measurable level of harm or damage is first required. Fatalities or monetized values are common measures. Alternatively, one could choose a generic incident count, for example ‘leak’, ‘failure’, etc, or some general effect such as thermal radiation level or overpressure level which in turn implies a certain possible range of damages. This is discussed in and .

Most pipeline risk assessments will examine the potential for unintended release of the pipeline’s contents, even if an expanded definition of ‘failure’ also brings in other scenarios. In discussion of these events, the terms leak, release, spill, and others are used interchangeably and apply to both liquid and gaseous release events.

Facility Types

The same risk assessment methodology can be used for any pipeline component on any type of pipeline system. Each component can create its own hazard area, even if that area is due solely to a short-distance event such as rapid depressurization. There will generally be more leak/rupture sources in a more complex facility, but also more control, safety, and consequence minimization aspects. Unlike PoF, a larger or more complex facility does not necessarily add to consequence potential. The maximum or average or most likely consequence scenario is usually the most meaningful comparison between facilities (collections of components) so a small, simple facility may have the higher consequence potential. Secondary or sympathetic reactions—one component’s failure results in a nearby component’s damage or failure—are, however, logically more likely in more complex and larger facilities, adding to those consequence scenarios.

Segmentation/Aggregation

CoF variables are used to generate dynamic segments, just as with the PoF variables. This creates changing CoF values whenever any aspect of CoF changes, from the more obvious changes such as population density, to the less obvious, such as vapor confinement potential. CoF values are typically generated per potential spill/release location. Aggregating risk or failure probabilities for a collection of components, such as ‘trap to trap’ or all components of a compressor station or tank farm, has many applications. Aggregating consequence values is not generally useful although the maximums and the average or most likely per-incident consequences will be.

A Guiding Equation

The focus here will initially be on integrity—failure as leak/rupture. This is also the initial focus for most pipeline risk assessments: ‘failure’ as ‘loss of integrity’, ie an unintentional release of pipeline contents and the possible associated consequences to public health, property, and the environment. Consequences associated with expanded definitions of ‘failure’ are discussed in the assessment of service interruption.

A leak impact emerges from an analysis of the nature of the product released—its potential hazard(s)—the size of the release, the release dispersion, and the receptor sensitivities.

An interesting high-level view of the leak impact analysis is a simple mathematical formula. The product of four variables essentially determines the magnitude of the impact:

RI = PH × RQ × D × R

Where

RI = Release impact

PH = product hazard (toxicity, flammability, etc)

RQ = release quantity (quantity of the liquid or vapor release)

D = dispersion (spread or range of the release)

R = receptors (all things that could be damaged by contact with the release).

While not a unitized and directly employable equation to fully quantify consequences in a modern risk assessment, this is a useful underlying equation to guide the analyses. Since each variable is multiplied by all others, each can independently and radically impact the final consequence. This represents real-world situations. For instance, as noted in PRMM, this equation shows that if any one of the four components is zero, then the consequence (and the risk) is zero. Therefore, if the product is absolutely nonhazardous (including depressurization effects), there is no consequence, and no risk. If the leak volume or dispersion is zero, either because there is no leak or because some type of secondary containment is used, then again there is no risk. Similarly, if there are no receptors (human or environmental or property values) to be endangered from a leak, then there is no risk. Likewise, as each aspect gets higher, the consequence and overall risks will usually also increase.

To reduce consequence potential, any single component can be reduced. While some exceptions can be identified (see later discussions), any directional changes—higher or lower—in any of these four variables will generally forecast the change in consequence potential.

As in the modeling of PoF, this reductionist approach to CoF modeling —breaking the issue to be assessed into its key components—is critical to understanding and managing risk.

A consequence assessment sequence will normally follow these steps for each scenario (or representative set of scenarios):

1. 1. 1. Identify release scenarios
      2. Determine damage states of interest
      3. Calculate hazard distances associated with damage states of interest
      4. Estimate hazard areas based on hazard distances,source (burning pools, vapor cloud centroid, etc.), and location-specific characteristics
      5. Characterize receptor vulnerabilities within the hazard areas

Limited modeling resources often requires some short cuts to this process—leading to the use of screening simplifications and detailed analyses at only critical points. Such simplifications and the use of conservative assumptions for modeling convenience are common.

Measuring Consequence

As earlier noted, a unit of measurement for consequence must be chosen. Common choices include:

• • • Release events, where any unintentional release of product is the consequence and any leak scenario is an event to be counted (or predicted)
    • Leaks/ruptures that specifically involve loss of integrity
    • Leak size, sometimes categorized by volume of releases so that only leaks of a certain size produce consequence and larger leaks produce greater consequences
    • Incidents, with pre-determined definitions, sometimes categorized by type, example: major, significant, minor
    • Fatalities
    • Injuries
    • Costs

Some of these units are based on direct indications of damage, others use implied damages. To say the consequence being measured is ‘leak’ implies that damage occurs from the leak, even if only loss of product. Categorizations of events goes a step farther in linking incidents to damages. For instance, in the US, PHMSA tracks ‘reportable incidents’, as a measure of consequence, with a further discrimination into ‘serious’ and ‘significant’. The definitions of ‘reportable’, as of this writing, include aspects such as:

• • • Involves death or personal injury requiring hospitalization; or
    • Involves fire or explosion; or
    • Is 5 barrels or more; or
    • Has property damage greater than $50,000; or
    • Results in pollution of a body of water; or
    • In the judgment of the operator was significant even though it did not meet these criteria.

Consequences are driven by damages to receptors. Quantifying potential damages on a common scale can be challenging. Using a measure such as cost—the monetized loss associated with the damages—forces some difficult judgments to be made among various receptor damages. For example, not only must a value be assigned to a statistical human life, but also to various injury types, environmental damage, damage to or extinction of a threatened and endangered species, historical sites, pristine areas, irreparable contamination of a recreational or drinking water source, and any other potential consequence. Some of these valuations involve socio-political and moral/ethical considerations that vary greatly among different cultures, decision-makers, and even over time. Monetizing all potential loss is obviously controversial. However, the ability to express risk in monetary terms is a great advantage in many applications. It is a universally understood ‘common denominator’ of all loss potential and its use as a measure of risk is quite compelling.

Valuations assigned to certain receptors are discussed in subsequent sections.

Scenarios

A release of pipeline contents can impact a very specific area, determined by a host of pipeline and site characteristics. The size of that impacted area is the subject of this portion of the consequence assessment discussion.

The range of hazard scenarios from loss of integrity of any operating pipeline includes the following:

• • Mechanical effects—debris, erosion, washouts, projectiles, etc. and even boat instability offshore, from actions of escaping product.
  • Toxicity/asphyxiation—contact toxicity or exclusion of air.
  • Contamination pollution—acute and chronic damage to property, flora, fauna, drinking waters, etc. can cause soil, groundwater, surface water, and environmental damages due to spilled product
  • Fire/ignition scenarios:

1. 1. 1. Flame jets—an ignited stream of material leaving a pressurized container creating a long flame .direct flame impingement and/or radiant heat damages are commonly associated with this scenario.
      2. Vapor cloud fire, flash fire; fireball —a cloud of released flammable material encounters an ignition source and causes the entire cloud to combust as air and fuel are drawn together. Where a gaseous fluid is released from a high-pressure vessel engulfed in flames, a special type event is possible. This scenario potentially supports the creation of a large fireball that can arise from boiling liquid expanding vapor explosion (BLEVE) episodes. A BLEVE fireball, while not thought to be a potential event for subsurface pipeline facilities, is normally caused by episodes in which an aboveground vessel, usually engulfed in flames, violently explodes, creating a large fireball (but not blast effects) with the generation of intense radiant heat.
      3. Vapor cloud explosion—occurs when an ignited flammable vapor cloud combusts in a way that leads to detonation and the generation of blast waves. This scenario potentially occurs as a vapor cloud combusts in such a rapid manner that a blast wave is generated. The transition from normal burning in a cloud to a rapid, explosive event is not fully understood. Deflagration—a steady burning of the flammable material– is the more common event, with flamefront speeds through the cloud not supporting detonation. Under certain conditions, however, the flamefront can accelerate, reaching speeds that support detonation. Confinement is a key determinant of the transition from burning to explosion. A confined vapor cloud explosion is more common than unconfined, but note that even in an atmospheric release, the mixing dynamics of the material in the air, as well as physical barriers such as trees, buildings, terrain, etc., can create partial confinement conditions. An explosive event can generate pressure wave effects as well as associated missiles and high-velocity debris. The damage potentials from vapor cloud explosions have been dramatically demonstrated, but are very difficult to accurately model.
      4. Liquid pool fires—an ignited pool of liquid flammable material burns and creates radiant heat hazards.

Naturally, not all of these hazards accompany all pipeline releases. The product being transported is the single largest determinant of hazard type. A water pipeline will often have only the hazard of “mechanical effects.” A gasoline pipeline, on the other hand, may carry several of the above hazards.

There is a range of possible outcomes—consequences—associated with these release scenarios. This range can be seen as a distribution of possible consequences; from a minor nuisance leak to a catastrophic event. Even at a single location along a pipeline, the potential scenarios can vary widely. At least a set of representative scenarios must be analyzed in order to understand the possibilities.

Table below shows some common pipeline products and how the consequences can be modeled. Each of the modeling types are discussed in this chapter.

Common pipeline products and modeling of consequences

Product	Dominant hazard models
Pressurized, flammable gas (methane, etc.)	Jet fire; thermal radiation, mechanical effects
Toxic gas (chlorine, H2S, etc.)	Vapor cloud dispersion modeling
Highly volatile liquids (propane, butane, ethylene, etc.)	Vapor cloud dispersion modeling; jet fire; overpressure (blast) event, mechanical effects
Flammable liquid (gasoline, etc.)	Pool fire; contamination, mechanical effects
Relatively nonflammable liquid (diesel, fuel oil, etc.)	Contamination, mechanical effects
Water	Mechanical effects

Additional scenarios are certainly possible. Consider an offshore gas pipeline. A rupture or even leak could threaten a nearby platform or ship’s stability as large quantities of escaping gas reach the water surface. With ignition, the scenario is akin to onshore scenarios but perhaps more consequential due to population density and reduced escape potential for the offshore populations (for example, ships, boats, platforms, etc.)

Example Scenario for Toxicity and Thermal Effects

The following is an excerpt from a risk assessment conducted on a sour gas (H₂S in natural gas) production well and pipeline network. This excerpt covers only the general description of potential scenarios and an initial basis for frequency estimations (prior to the full risk assessment).

Accidental releases of sour natural gas from the well/ pipeline network could create potentially life-threatening hazards to persons near the location of the release. Due to the presence of hydrogen sulfide in the natural gas, the vapor cloud created by a release of gas to the atmosphere would be toxic as well as flammable. Persons inhaling air containing toxic hydrogen sulfide vapor could be fatally injured if the combination of hydrogen sulfide concentration and time of exposure exceeds the lethality threshold. If the cloud is ignited, persons in or very near the flammable vapor cloud could be fatally injured by the heat energy released by the fire.

An initial frequency of occurrence of a potential pipeline accident was estimated from historical pipeline failure rate data gathered by the U.S. Department of Transportation. Event trees were then used to estimate the percentage of releases of various sizes that would create a toxic or fire hazard. For example, it was estimated that 50 percent of moderate-sized releases of sour natural gas from the pipeline do not ignite but do create a toxic cloud; 10 percent ignite immediately on release and create a torch fire; and 40 percent ignite after some delay, thus creating a toxic cloud followed by a torch fire.

The frequency of sour gas well blowouts was derived from sour gas well historical data. The largest documented database covers wells in the Province of Alberta, Canada. According to the data, an uncontrolled sour gas well blowout occurs with a frequency of 3.55E–06 blowouts per well per year. This failure rate is for wells equipped with subsurface safety valves.

Computerized consequence models were used to calculate the extent of potentially lethal hazard zones for toxic vapor clouds and/or gas fires created by each potential accident identified. Calculations were repeated for numerous combinations of wind speed and atmospheric stability conditions in order to account for the effects of local weather data.

For each pipeline section or well site, one particular accident will create the largest potentially lethal hazard zone for that section. As an example, one accident is a full rupture of the pipeline without ignition of the flammable cloud, thus resulting in a possible toxic exposure downwind of the release. Under worst case atmospheric conditions, the toxic hazard zone extends 2,600 feet from the point of release. Under the worst case conditions, it takes about 11 minutes for the cloud to reach its maximum extent. The hazard “footprint” associated with this event is illustrated in two ways. One method presents the footprint as a “hazard corridor” that extends 2,600 feet on both sides of the pipeline for the entire length. This presentation is misleading since everyone within this corridor cannot be simultaneously exposed to potentially lethal hazards from any single accident. A more realistic illustration of the maximum potential hazard zone along the pipeline is the hazard footprint that would be expected IF a full rupture of the pipeline were to occur, AND the wind is blowing perpendicular to the pipeline at a low speed, AND “worst case” atmospheric conditions exist, AND the vapor cloud does not ignite. The probability of the simultaneous occurrence of these conditions is about 1.87E–07 occurrences/pipeline mile-year, or approximately once in 5,330,000 years for a particular mile of pipeline.

The highest risk along this section of the pipeline network is to persons located immediately above the pipeline. The maximum risk posed by this portion of pipeline is about 5.0E–6 chances of fatality per year. This is for an individual located directly above the pipeline 24 hours per day for 365 days. In other words, an individual in this area of the pipeline network would have one chance in 200,000 of being fatally injured by some release from the pipeline for an entire year, if this individual remained directly above the pipeline for an entire year. An individual in this same area, but located 50 meters from the pipeline, would have about one chance in one million of being fatally injured by a release from the pipeline, if the individual were present at that location for the entire year.

This example excerpt illustrates the types of conclusions often sought by pipeline risk assessments. The risk posed to the population within the appropriate “hazard corridor” for the pipeline/well network can also be presented in the form of graphical tools such as FN curves.

Normal Distribution

Distributions Showing Probability of Consequence

As is evident from the previous example, elements of scenario probability must be considered in CoF evaluations. This is a probability aspect beyond those already included in estimating failure event likelihoods.

The variables that are needed to assess consequence potential include specifics of and interactions among receptors, product, spill, and dispersion. Since there are an infinite number of combinations of receptors interacting with an infinite number of spill scenarios, the range of possibilities is literally infinite. So, all consequence estimations will include some simplifications and assumptions in order to make the solution process manageable. Lower level models tend to model only worst case scenarios. Point estimates of the more severe potential consequences are often used as a surrogate for the full distribution of scenario possibilities, downplaying the normally very low probability of such scenarios actually occurring. In reality, the vast majority of possible failure and consequence scenarios do not nearly approach the magnitude of the worst case. The worst case scenario certainly must be understood, and using it, no matter how improbable, as the entire basis of the estimate, may be useful for certain types of risk assessments, but does not convey full understanding of risk.

Higher level models will characterize the range of possibilities, perhaps even producing a distribution to represent all possible CoF scenarios. The full range of possibilities is best viewed as a frequency or probability distribution—distribution graphs show the range of possibilities. Unfortunately, distributions can be cumbersome to work with, especially since these distributions must be understood at all potential spill locations along a pipeline. Since there are innumerable potential spill points along a typical pipeline, this is an impractical approach.

The underlying distributions are more readily assimilated into decision-making when they are approximated by point estimates that capture the range of potential scenarios. If done properly, this simulation of real probability distributions will bound all plausible scenarios and provide better understanding of all events within those bounds. The most useful analysis acknowledges the high-consequence-extremely-improbable scenarios; the low-consequence-higher-probability scenarios, and all variations between. It does this without overstating the influence of either end of the range of possibilities. The use of probabilities ensures that the influences of certain scenarios are not over- or under-impacting the results. All scenarios are considered with appropriate ‘weight’ for more objective decision support.

Hazard zones

A modern pipeline risk assessment uses hazard zones in the estimation of consequence potential from leak/rupture^[1]. A hazard zone is a geographical area in which certain spill/leak effects are expected. They are often based on the “stress” such as a thermal radiation level or blast overpressure level created by the leak/rupture. Hazard zones will vary in size depending on the scenario (product type, hole size, pressure, etc.) and the environmental conditions (wind, temperature, topography, soil infiltration, etc.).

The simple formula presented earlier is our guideline for conceptualizing hazard zones.

RI = PH × RQ × D × R

All components are combined to determine consequence and also hazard areas, even though the last term, receptors, initially appears to be independent from hazard areas. Let’s examine that premise. Higher intensity from the product hazard, greater release volume, greater dispersion of released product, or increased receptor counts or sensitivities are each able to independently increase consequence potential. If the hazard zone is based on a threshold intensity, then only three of the four factors is needed. The presence of receptors only impacts a hazard zone if the threshold is contingent upon some damage level to a receptor, For example, when a receptor is harmed by a lower airborne concentration of a product, the hazard distance is usually longer. However, receptor damage potential is the reason we define a hazard area, so receptors are never completely de-coupled from hazard area estimates.

The probability of a given hazard area occurring is a function of the probability of the associated scenario occurring. The scenario probability is dependent upon the probabilities of failure, leak size, product dispersion, ignition, and others. The potential consequences from each scenario are dependent upon the receptors exposed.

A hazard area requires the definition of a hazard extent—at what distance will harm be realized. The effects that define the boundary of a hazard area can be expressed as a level of damage to a receptor—number of fatalities or injuries; fatality rate; dollar damages to property; remediation costs to sensitive environment, etc—or as an effect—overpressure level; thermal radiation; direct flame impingement, etc. These are linked, as is discussed in a following section on hazard zone boundaries. Hazard areas are formed by both acute and chronic releases or by their components within a single release event (see discussion of product hazard). An example of a damage threshold is a thermal radiation (heat flux) level that causes injury or fatality in a certain percentage of humans exposed for a specified period of time. Another example is the overpressure level that causes human injury or specific damage levels to certain kinds of structures.

It is the interaction between the product hazard and the receptor that creates the hazard zone. Recall that a receptor is anything that might be harmed by contact with the release or the effects of the release. Receptors within the defined hazard area must be characterized. All exposure pathways to potential receptors should be considered. Population densities, both permanent and transient (vehicle traffic, time-of-day, day-of-week, and seasonal considerations, etc.); environmental sensitivities; property types; land use; and groundwater are some of the receptors typically characterized. The receptor’s vulnerability will often be a function of exposure time, which is a function of the receptor’s mobility—that is, its ability to escape the area.

Receptors falling within the hazard zones are considered to be vulnerable to damage from a pipeline release. In the case of a gas release, receptors that lie between the release point and the lower flammable concentration boundary of the cloud may be considered to be susceptible to direct contact with a flame. Receptors that lie between the release point and the explosive damage boundary may additionally be at risk from direct overpressure effects. Receptors within the hazard zone would also be at risk from thermal radiation effects—but not direct contact with a flame—from a jet fire as well as from any secondary fires resulting from the ignition event. In the case of liquid spills, migration of spilled product, thermal radiation from a potential pool fire, and potential contamination could define the hazard zone.

This analysis is efficiently applied to any component in any type of pipeline system. Variations in components’ pressure, volume, flowrate, failure mechanism likelihood, etc are expected and appropriately included in the assessment of hazard zone potential.

Conservatism

Because an infinite number of release scenarios—and subsequent hazard zones—are possible, some simplifying assumptions are required. A very unlikely combination of events is often chosen to represent maximum hazard zone distances. The assumptions underlying such event combinations produce very conservative (highly unlikely) scenarios that typically overestimate the actual hazard zone distances. This is done intentionally in order to ensure that hazard zones encompass the vast majority of possible pipeline release scenarios. A further benefit of such conservatism is the increased ability of such estimations to weather close scrutiny and criticism from outside reviewers.

As an example of a conservative hazard zone estimation, the calculations might be based on the distance at which a full pipeline rupture, at maximum operating pressure with subsequent ignition, and with unfavorable weather conditions (ie, promoting increased consequence), could expose receptors to significant thermal damages, plus the additional distance at which blast (overpressure) injuries could occur in the event of a subsequent vapor cloud explosion. The resulting hazard zone would then represent the distances at which damages could occur, but would exceed the actual distances that the vast majority of pipeline release scenarios would impact.

More specifically, the calculations could be first based on conservative assumptions generating distances to the LFL boundary, but then doubling this distance to account for inconsistent mixing, and adding the overpressure distance for a scenario where the ignition and epicenter of the blast occur at the farthest point.

Conservatism in a risk assessment is useful for a number of reasons, as discussed in an early chapter. However, conservatism may also be excessive, leading to inefficient and costly repercussions—in the case of land-use decisions, for example. To supplement the worst case, but normally very rare, release consequence scenario analyses, the more likely scenarios should also be understood. Just as with PoF, a PXX approach to selecting levels of conservatism for CoF estimation are appropriate.

Hazard Zones

Hazard Area Boundary

The boundaries of a hazard area must be defined. A boundary can be defined in two general ways: by the intensity of the damaging phenomena or by the effect on the receptor. Each requires the definition of threshold.

Thresholds

The intensity of an exposure—heat flux level in the case of thermal events, overpressure level in the case of explosions, concentration or dose in the case of toxicity—can be viewed as a threshold. Similarly, the resulting damage state from intensity of exposure can also be viewed as a threshold. As used here, a threshold is a decision point, a point of interest, a point above which some certain impact is expected or some action will be taken. It is important to recognize that a hazard zone requires an associated threshold—thresholds define hazard boundaries which in turn set hazard zones. A threshold can either directly define the hazard zone—distance to a certain effect—or it can imply a damage state on which the hazard zone is based—10% mortality, if people are present. Speaking of a hazard zone without knowing what threshold is expected at that distance, is not meaningful. The hazard zone’s boundary definition must be stated.

Intensity Boundary

The most common intensity measures for pipeline failures are concentration levels (contamination, toxicity), thermal radiation (fires), and overpressures levels (blasts). These values are measured/estimated at various distances from a defined source and then used to generate the corresponding hazard areas. The distances are themselves a function of many factors including release rate, release volume, flammability limits, threshold levels of thermal/overpressure effects, product characteristics, and weather conditions.

For example, under a certain set of assumptions, an ignited rupture of a natural gas pipeline might generate a vertical torch fire producing 3 kW/hr/m2 thermal radiation at a distance of 235 ft from the fire (at the rupture location). Perhaps this thermal radiation level is identified as the extent of a certain type of hazard area. Under an assumption of circular effect, the 235 ft becomes a radius generating a hazard area of about 173,500 square feet.

Secondary effects may also define a hazard zone boundary. This includes fires ignited and/or spreading by autoignition from heat flux; delayed explosions such as BLEVE’s; soot and ash fallout; pollution; additional hazard effects caused by sympathetic failures/ignitions of nearby equipment, etc.

Receptor Impact Boundary

In an alternative approach to threshold definition, the hazard zone boundary can be linked to the specific type of damage, eg 1% fatality rate; third degree burns likely; auto-ignition point for wooden structures, glass shattering, etc. A hazard zone might also be based on potential liquid contamination thresholds that render water sources unfit for consumption or cause defined levels of damage to other sensitive environments.

Defining the hazard zone by the type of harm normally uses the previous intensity estimate. Beginning with that value, an additional step is taken by equating an intensity to the amount of damage a certain receptor will experience when exposed for a certain amount of time. Using the example above, 3 kW-hr/m² can cause various levels of harm to human populations exposed for several minutes. So, depending on the level chosen, the previous 173,500 square foot hazard zone can be called, for example, the “second degree burn” hazard zone or the “0.5% mortality rate” hazard zone.

PIR Hazard Area Thresholds

As an example of the creation and use of a threshold, consider the equation for natural gas “potential impact radius” (PIR) described in ref [GRI-189]. This has been adopted by US regulations and is a mandatory consideration for determining HCA’s for US natural gas transmission pipelines. Since countless gas pipeline release scenarios are possible and various types of damage can occur, some choices were made in determining this hazard distance. In ref [83], some of the implicit assumptions used to estimate the PIR include the following:

• • • Full, guillotine rupture, leak is fed by both open ends of pipe;
    • No vapor cloud explosion potential;
    • Trench fire (horizontal jet fire) is dominant effect;
    • Rapid ignition of escaping gas;
    • Effective release rate as a multiple of the peak initial release rate; and
    • Heat intensity of 5000 BTU/(hr-ft²) as the appropriate threshold.

The chosen heat intensity level corresponds to a level below which wooden structures would probably not burn and sheltered persons are not injured. Unsheltered persons would be exposed to a 1% chance of fatality as they seek shelter or distance from the heat.

According to this reference, a level of 5,000 BTU/(hr-ft²) “…establishes the sustained heat intensity level above which the effects on people and property are consistent with the definition of a high consequence area. Note that in the context of this study, an HCA is defined as the area within which the extent of property damage and the chance of serious or fatal injury would be expected to be significant in the event of a rupture failure” [GRI-189]. These assumptions and choices have been deemed appropriate for US gas pipelines by US legislators and regulators.

This illustrates the use of threshold intensities—5,000 BTU/(ft²-hr)—to establish a damage state based threshold—1% chance of fatality. The threshold intensity is relevant in terms of its expected damage potential and can be used to set geographical boundaries around any pipeline component. Damage requires the presence of receptors. The 1% fatality rate in the above example occurs IF the assumed population is present and exposed as assumed. So, following the setting of the geographical boundaries of the hazard area, receptor counts and characterizations can be made.

GRI-00/0189: A Model for Sizing High Consequence Areas Associated with Natural Gas Pipelines Topical Report, Prepared by: Mark J. Stephens of C-FER Technologies; Edmonton, Alberta T6N 1H2, Canada. C-FER Report 99068. Prepared for: Gas Research Institute, Contract No. 8174

As an example of a similar application, but with expanded consideration of other mortality rates and receptor characteristics, consider the following, excerpted from a risk assessment study:

The principal hazard range criterion for people exposed to thermal radiation has been taken as the distance from the fire from which there is a Significant Likelihood of Death (SLOD), equivalent to 1800 thermal dose units (tdu) [kW/m²]4/3s or 12.8 kW/m² (3800 Btu/ft²h) exposure for 1 minute. This dose is considered by the UK Health and Safety Executive (HSE) to be equivalent to 50% lethality for normal populations. In calculating the ‘escape distance’, a lower threshold of 1 kW/m2 (320 Btu/ft²h) was used, to which it is assumed that a person can be exposed to an indefinite period of time without injury. It was further assumed that people who are not inside buildings are able to escape the effects of the fire at a speed of 2.5 m/s (8.2 ft/s). (For “sensitive” populations such as schools, hospitals etc., a more onerous 1% lethality criterion is used with reduced escape speed of 0.7m/s (2.3 ft/s)). The reduced escape speed of 0.7 m/s (2.3 ft/s) is also used for adults at a location where a sensitive population is present as they are assumed to assist the sensitive population to escape.

Here we see additional thresholds used and justified, plus a focus on escape potential. Shielding by clothing, buildings, structures, and specific population demographics are a few of many aspects that could be added as yet additional focus areas. In other similar applications, the PIR is scaled to produce property damage rates. and list some PIR formulae for hazard zones based on torch fires and overpressure (explosion) scenarios, respectively. In both listings, r is the distance (in ft for the first table, and miles for the second) from the ignition point where ‘significant’ damages likely occur; d is the pipe diameter in inches; and p is the pressure in psig.

Similar PIR hazard zone boundary equations are available as shown in refs [1040] and [1041] Baker studies TTO13 & TTO14

Combined Boundaries

The distinction between the types of thresholds can become blurred as a modeler will often associate a heat-, overpressure-, or toxicity-based intensity threshold with a level of damage to a receptor, and then use the threshold definitions interchangeably. For instance, a heat intensity of X units will result in an estimated Y% mortality of exposed, unshielded populations. When chosen as a threshold, the X units of heat intensity may be referred to as the “1% mortality” threshold. However, preserving the “X units of heat intensity” definition is important since the alternate definition implies that receptors are always present and have certain characteristics regarding shielding clothing, mobility, etc. Losing the original exposure intensity of interest may result in modeling confusion as probabilities of thresholds are integrated with varying receptor characteristics.

Most hazard zone estimates and receptor characterizations are closely intertwined. The former usually embed some assumptions about potential receptors as well as a choice of a damage level for the receptor of interest. The level of damage chosen—1% fatality rate, for instance—sets the effect of interest—thermal radiation level, for instance—which in turn determines the distance to the edge of the hazard zone. All are based on numerous assumptions. Atmospheric conditions, orientation of flame, mobility of populations, shielding, are but a few of the required assumptions for the mortality criteria exampled.

A hazard zone that is to be expressed as a distance from a point on a pipeline is most easily based on some threshold intensity effect, independent of possible receptors. It could alternatively be based directly upon some damage level such as 90% chance of at least one fatality or 50% chance of more than $100K in property damage or any of countless other damage states. However, this would make the distance dependent upon the nearby receptors rather than upon the pipeline alone. Granted, the thresholds are themselves based upon some possible damage state, but keeping that basis indirect allows the threshold to be a function solely of pipeline properties. This makes modeling easier.

More detailed assessments will use multiple thresholds for each type of impact. For instance, thermal effect thresholds corresponding to third degree burns, first degree burns, and autoignition of wood could be used to set three different hazard distances. Overpressure (blast) levels corresponding to window breakage only, heavy structural damage to wood frame buildings, ear drum rupture, and serious internal injuries could be used to establish yet more. In the case of toxicity, multiple exposure-effect levels (dose) might also be of interest, as noted in the discussion of probits.

Summary of Potential Impact Radius Formulae [1040]

Summary of PIR Formulae [1041]

Product hazard

One of the primary factors in determining the consequences from a release is the characteristics of the product being transported in the pipeline. It is the product that determines the nature of the hazard.

In studying the impact of a leak, it is useful to make a distinction between acute and chronic hazards. Acute, as used here, means sudden onset, or demanding urgent attention, or of short duration. Hazards such as fire, explosion, or contact toxicity are considered to be acute hazards. They are immediate threats caused by a release.

Chronic means marked by a long duration. A time variable is therefore implied. Hazards such as groundwater contamination, carcinogenicity, and other long-term health effects are considered to be chronic hazards. Many releases to the environment are chronic hazards because they can cause long-term damages perhaps worsening with the passage of time.

The primary difference between acute and chronic hazards is the time element. An immediate hazard, created instantly upon initiation of an event, growing to its worst case level within a few minutes and then improving, is an acute hazard. The hazard that potentially manifests slowly or grows worse with the passage of time is a chronic hazard.

A natural gas release poses mostly an acute hazard. The largest possible gas cloud normally forms immediately (unless confinement occurs), creating a fire/explosion hazard, and then begins to shrink as pipeline pressure decreases. If the cloud does not find an ignition source, the hazard is reduced as the release quickly dissipates and the vapor cloud shrinks. If the natural gas vapors can accumulate inside a building, the hazard may become more severe as time passes—it then becomes a chronic hazard.

The spill of crude oil is more chronic in nature because the potential for ignition and accompanying thermal effects is more remote, but environmental damages are likely, slowing killing plants and and contaminating ever increasing areas.

A gasoline spill contains both chronic and acute hazard characteristics. It is easily ignited, leading to acute thermal damage scenarios, and it is also has the potential to cause short- and long-term environmental damages.

Many products will have some acute hazard characteristics and some chronic hazard characteristics. A product’s hazard nature depends on several key aspects such as ignitability, how readily it disperses (the persistence), and its energy content. Some product hazards are almost purely acute in nature, such as natural gas. Others, such as brine, may pose little immediate (acute) threat, but cause environmental harm as a chronic hazard.

A normally chronic hazard can take on acute consequences. For instance, a leaking hydrocarbon liquid can accumulate in buildings, beneath pavement, etc. and have its flammable vapors confined, concentrated, and ignited—ie, the scenario has worsened with the passage of time.

Many hydrocarbons have both an acute and chronic component to their hazard zone potential. A gasoline and a fuel oil spill of the same quantity may have equivalent contamination potential but the gasoline potentially produces more thermal effects due to its propensity to readily ignite. Determining the release behavior of the type of product transported is a first step in characterizing scenarios. The release categories of liquid, gas, and HVL are useful here.

Gas

Hazardous vapor releases from products or constituents typically transported in pipelines include

• • • Natural gas (95%+ methane)
    • Ethane
    • O₂
    • Hydrogen H₂
    • Ammonia
    • CO₂
    • Cl₂
    • H₂S
    • hydrocarbons

Liquids

• • • water, potable, non-potable
    • brine
    • hydrocarbons

Hazardous liquid pipelines typically transport hydrocarbons of various types:

a. Crude oil
b. Refined products
c. Highly volatile liquids

Refined products are liquids such as:

a. Gasoline
b. Diesel
c. Fuel oil
d. Jet fuel
e. Kerosene

Refined products are liquids inside the pipeline and usually remain liquids when released from the pipeline.

Styrene, toluene, benzene

HVL’s

Highly volatile fluids are in a liquid state inside the pipeline and gaseous state when outside the pipeline at ambient conditions. Common Highly volatile liquids include:

• • • • a. Liquefied petroleum gas (LPG)
      • b. Natural gas liquid (NGL)
      • c. Anhydrous ammonia
      • d. Ethane
      • e. Propane
      • f. Butane
      • g. ISO-butane
      • h. Ethylene
      • i. Propylene
      • j. Butylene
      • k. Mixtures

LPG is a term used mostly for mixtures of ethane, propane, and/or butane, behaving as an HVL—liquid while pressurized, gaseous when released at ambient conditions.

NGL is a term used mostly for mixtures of ethane, propane, butanes and higher order saturated hydrocarbons that mostly remain in liquid state when released at ambient conditions. [1011]

Acute hazards

A very serious threat from a pipeline is the potential loss of life directly caused by a release of the pipeline contents. This is usually considered to be an acute, immediate hazard. Both gaseous and liquid products pipelines should be assessed in terms of their potential flammability, reactivity (including pressurization, mechanical effects), and toxicity impacts on receptors. This assessment should conclude with a list of acute damages that would potentially be experienced by the receptors of interest. Ultimately, probability-weighted distances will be associated with each damage state of interest.

Toxic, thermal, and mechanical (erosion, debris, and projectiles from violent depressurization or deinventorying) are typical acute hazards. Each of these hazards has a potential to cause varying levels of damage at various distances from the leak/rupture. These damage level-distance combinations are the bases of hazard areas—geographical areas within which certain damage levels could occur.

Damage distances for releases of acutely toxic pipeline contents are most often linked to airborne concentrations causing certain health consequences. Thermal events—fire and explosion– are normally of prime interest for the hydrocarbon products typically moved by pipelines. The intensity of a thermal event is related to the energy content of the product which is a function of product characteristics like specific heat, heat of combustion Hc (BTU/lb) and boiling point. The boiling point is a readily available property that correlates reasonably well with specific heat ratios and hence burning velocity. This allows relative consequence comparisons since burning velocity is related to fire size, duration, and radiant heat levels (emissive power), for both pool fires and torches. The likelihood of an ignition source is a function of the nearby environment including density of flame sources, likelihood of spark generation, and the type of product.

In the case of water systems, the main product hazard will be related to the more mechanical effects of escaping water. This includes flood, erosion, undermining of structures, and so on. The potential for people to drown as a result of escaping water is another consideration. Oxygen and nitrogen pipelines may similarly only create mechanical hazards. Mechanical impacts will also be important for large storage tanks. Catastrophic failure of a liquid-full, large atmospheric storage tank can cause much damage, even without ignition.

PRMM suggested the use of NFPA ratings for relative assessment of acute hazards. From this acute leak impact consequences model, we could rank the immediate hazard from fire and explosion for the flammable products transported by pipeline and from direct contact for the toxic materials. While the scoring (assignment of points) methodology is no longer appropriate for most of today’s risk assessment applications, this analyses provides insight into product behavior upon release.

The acute damage states—the types of receptor harm—potentially created by the pipeline will be used to initially determine the boundary of the hazard area at each potential release point along the pipeline. When the release scenario has a chronic component, a similar exercise of determining potential chronic damage states will also be used in establishing hazard areas.

Thermal effects

The possibility of thermal effects—flame and explosion scenarios–from a flammable product released from a pipeline is an important part of most hazard scenarios for hydrocarbon pipelines. Ignition followed by product burning is usually thought to increase consequences, but can also theoretically reduce them. A scenario where immediate ignition causes no damage to receptors but eliminates a contamination potential (preventing groundwater contamination or shoreline damage from an offshore spill, for example) is such a case.

In this section, thermal effects caused by ignited pipeline releases are examined. Terminology, as used in these discussions, is as follows:

• • Auto-ignition temperature: A fixed temperature above which material may not require an external ignition source for combustion.
  • Flash point: Lowest temperature at which liquid gives enough vapor to form a flammable mixture.
  • Fire point: Lowest temperature at which liquid generates enough vapor to maintain a continuous flame.
  • Flammability limit: Range of vapor concentration which, when coming in contact with an ignition source, would cause combustion. There are two limits LFL and UFL.
  • Explosions: a rapid release of energy causing development of pressure or shock wave.
  • Shock wave: An abrupt pressure wave (energy front) generated due to sudden release of energy.
  • Blast wave: A shock wave in open air generally followed by strong wind, the combined shock and wind is called blast wave.
  • Overpressure: The pressure on an object as a result of an impacting shock wave.
  • Deflagration: An rapid combustion in which the flame front moves at a speed less than the speed of the sound in the medium.
  • Detonation: An explosion in which the reaction front (energy front) exceeds the speed of the sound in the medium.
  • Confined vapor cloud explosion: An explosion in vessel or building. It may be caused due to release of high pressure or chemical energy.
  • Vapor cloud explosion: An explosion caused by the instantaneous burning of vapor cloud formed in air due to release of flammable chemical.
  • Boiling liquid expanding vapor explosion: Explosion caused due to instantaneous release of large amount of vapor through narrow opening under pressurized conditions.

Direct measurement of thermal acute hazards

Acute hazards general involve fire and explosion effects when contact toxicity is not an issue. In fire scenarios, possible damages extend beyond the actual flame impingement area,. Heat intensity is normally measured as thermal radiation (or heat flux or radiant heat) and is expressed in units of Btu/ft²-hr or kW/m². Certain doses—intensity and duration of exposure—of thermal radiation can cause fatality, injury, and/or property damage, depending on the vulnerability of the receptor.

Explosion intensity is normally characterized by the blast wave, measured as overpressure and expressed in pressure units of psig or kPa.

The level of harm to receptors potentially caused by any form of thermal hazard depends on the distance, shielding, and time of exposure of the receptors.

Ignition probabilities

Ignition is a prerequisite for a thermal event. The consequences of ignition range from a jet or pool fire to a large fireball and detonation.

Ignition probability is, of course, very situation specific. Countless sourcing and timing of ignition scenarios are possible. Ignition can occur at either the source or a location some distance away—a delayed ignition. The source of ignition may be from numerous nearby sources or related to the loss of containment event itself, such as sparks generated by involved excavation machinery or by the release of energy, including static electricity arcing (created from high dry gas velocities), contact sparking from flying debris (e.g., metal to metal, rock to rock, rock to metal), or electric shorts (e.g., movement of overhead power lines).

Common sources of ignition include:

• Vehicles or equipment operating nearby
• Grinding and welding
• Residential pilot lights or other open flames
• External lighting or decorative fixtures (gas or electric).
• Cigarettes
• Engines
• Open flames of any kind

One source cites the following ignition source of major fires.

Source	%	Source	%
Electric	23%	Hot surfaces	7%
Smoking	18%	Flames	7%
Friction	10%	Sparks	5%
Overheated material	8%	Other	22%

These may be relevant to certain scenarios of pipeline leaks/ruptures.

A release that covers a larger area logically has an increased chance of encountering a source of ignition. Ignition can only occur within a susceptible air/fuel mixture, typically found at the edge^[2] of a vapor cloud or close to the surface of a pool of flammable liquid. See more discussion of this under Vapor Cloud Ignition.

A buoyant gas such as hydrogen or natural gas will rise rapidly on release and limits the formation of a flammable gas cloud in open space. With the assumption that most ignition sources are at or near ground level, this reduces the probability of remote ignition for these lighter gases. vapor release orientations other than vertical, accumulation and/or containment, and increasing gas density generally increase the probability of ignition. Higher vapor generation from spilled liquids also lead higher ignition probabilities. The role of gas density in vapor cloud formation supports the presumption that a heavier gas leads to a more cohesive cloud (less dispersion) leading to a higher ignition probability. Confinement of a vapor cloud (caused by topography, proximity to structures, entry into enclosed spaces, etc) also leads to less dispersion and greater opportunity for accumulations within the flammability range, also implying higher ignition probabilities.

Estimates of ignition probabilities can be generated from company experience, pipeline failure databases, or obtained via literature searches. One well-regarded source shows ignition probabilities of natural gas transmission pipelines to be related to pipe diameter by the formula:

0.0125 x diameter

The following empirical formula is recommended for use in quantitative risk assessments for gas pipelines in Australia [67]:

Ignition probability = 0.0156(release rate in kg/s)^0.642

PRMM discusses several ignition probabilities from various studies, including the use of 12% as the ignition probability of NGL (natural gas liquids, referring to highly volatile liquids such as propane) based on U.S. data. [43]

A conclusion that the overall ignition probability for natural gas pipeline accidents is about 3.2% [95]. nominal natural gas leak ignition probabilities ranging from 3.1 to 7.2% depending on accumulation potential and proximity to structures (confinement), the ignition probabilities for natural gas ruptures ranging from about 4 to 15%

For buried gasoline pipeline leaks/ruptures, ignition probabilities ranging from <1% (rural leak) to >6% (urban rupture) are commonly reported.

Thermal radiation damage levels

Flames from an ignited release of a gas or liquid will normally occur at all points of the spill footprint where the fuel-oxygen mixture promotes combustion. Due to mixing and entrainment of oxygen, this is generally the entire footprint area. Flames are therefore expected initially at a distance equal to the physical extent of the product release—the edge of the cloud or pool.

Adding to this ‘direct flame impingement’ distance, is the potentially harmful thermal radiation distances arising from the burning. Thermal radiation at any point away from the flame is related to the emissivity and transmissivity.

A US regulatory agency published a guidebook on acceptable separation distances of government housing from explosive and flammable hazards. The guidebook presents a method for calculating a level ground separation distance from pool fires, based on simplified radiation heat flux modeling. Some useful information from this guidebook includes that agency’s use of certain thresholds and underlying assumptions:^[3]

Ref [83] recommends the use of 5000Btu/hr-ft² as a heat intensity threshold for defining a “high consequence area.” It is chosen because it corresponds to a level below which:

• • • Property, as represented by a typical wooden structure would not be expected to burn,
    • People located indoors at the time of failure would likely be afforded indefinite protection, and
    • People located outdoors at the time of failure would be exposed to a finite but low chance of fatality.

Note that these thermal radiation intensity levels only imply damage states. Actual damages are dependent on the quantity and types of receptors that are potentially exposed to these levels. A preliminary assessment of structures has been performed, identifying the types of buildings and distances from the pipeline. This information is not yet included in these calculations but will be used in emergency planning.

Jet fire

Direct flame impingement or thermal radiation from a sustained jet or torch fire, is a primary hazard to people, property, and other receptors in the immediate vicinity of a gas pipeline failure.

This scenario is often used as the most likely event in the unlikely case of ignition.

Paradoxically, a long-running brittle pipe failure may produce less thermal consequences under certain circumstances. If the long rupture causes the release to behave more like two or more release points rather than a single, guillotine type release, the differences in fuel source proximities may produce less concentrated thermal damages.

Vapor cloud ignition

A vapor cloud, formed from a pipeline leak or rupture, will be flammable within a specific fuel-to-air ratio range, the vapor cloud will be flammable.

Although ignition is normally not the most probable event there is often a reasonable probability of ignition due to the typically large number of possible ignition sources. Upon ignition, a flame entrains surrounding air and fuel and propagates through the cloud. A fireball and possibly a detonation can occur, generating thermal radiation and shock waves.

Pipeline Release Thermodynamics

Detonation

In rare cases, a vapor cloud ignition can lead to an explosion. This is possible in either a gas pipeline release or liquid pipeline release. In the latter, sufficient vapor generation must occur. In both cases, confinement of the vapor increases the chance of explosion. An explosion involves a detonation and the generation of blast waves.

An vapor cloud explosion occurs when a cloud is ignited and the flame front travels through the cloud quickly enough to generate a shock wave—detonation. This deflagration to detonation transition is possible only under certain conditions. It rarely occurs when the weight of airborne vapor is less than 1000 pounds [83] or when there is no confinement of the vapors.

Expected damages from various levels of overpressure are shown in PRMM

The possibility of vapor cloud explosions is enhanced by any type of confinement, including not only enclosed areas, but also partial enclosures created by topography, trees, buildings, or even weather phenomena. While a confined cloud is more likely to explode, confinement is difficult to accurately model for an open-terrain release. In an atmospheric release trees, buildings, topography, and weather can all add to confinement effects.

Mechanical Effects

The energy contained in pressurized pipeline components can cause damages even when no thermal (ignition) event is involved. This includes debris and pipeline fragments that could become projectiles in the event of a violent pipeline failure. Other mechanical effects associated with violent releases of compressed fluids and gases include product impingements, shock waves, and erosion. Violent depressurization or deinventorying, including tank collapse and pressurized vessel rupture, are typical generators.

Large fragments of ruptured pipelines have not only been unearthed by the force of a rupture, but have subsequently been propelled hundreds of feet from the rupture site. Directional jets and rapid deinventorying can cause erosion, undermining support of nearby structures. Public safety is threatened, as with thermal effects. Environmental and property damages are also potentially involved, but generally in more localized effects compared to thermal events, ie, damage from a single projectile impact, rather than a wide burn radius.

A compressed gas will normally have much more potential energy and hence the greater chance to do debris-related damage, compared to an incompressible fluid. The increased hazard area due solely to the mechanical effects is thought to be usually more limited for a buried pipeline and more extensive for above-ground components.

Acute Hazard Minimization

Few mitigative actions are able to reliably and substantially reduce acute hazards as a pipeline leak/rupture event is unfolding. To be effective, a mitigative action must change the characteristics of the emerging hazard zone itself. Secondary containments, fire suppression, quenching a vapor release instantly or otherwise preventing the formation of a hazardous cloud are examples of hazard zone reductions. Subsequent effects associated with acute releases—secondary fires, for instance—can often be reduced. See also the discussions of leak detection, emergency response, secondary containment, and other general CoF reduction opportunities.

Chronic hazard

Another potentially serious leak consequence is the contamination of the environment due to the release of the pipeline contents.

Chronic damage states are often efficiently estimated by concentration levels and associated restoration costs–damage compensations, clean-up/remediation, etc. Concentrations of interest are readily obtained in published materials on mammalian and aquatic toxicities, environmental persistence, and other considerations. Facilitating the practical use of these concentration-to-level-of-harm linkages are environmental regulations which have integrated the available dose-response information and made determinations regarding unacceptable concentration levels under various circumstances. The use of ‘reportable quantities’ (RQ) in US regulations demonstrates the establishment of unacceptable spill amounts regulatory references. RQ’s, as supplemented by the addition of hydrocarbons (PPRM), can improve understanding of chronic harm potential.

By-products of a release, and potentially a subsequent thermal event, may include aerosol sprays, soot and ash fallout, or other pollution. Damage payments associated with these are not uncommon. These effects can be considered in either the hazard zone determination or otherwise as a cost of potential consequence scenarios.

The input ultimately sought by the risk assessment will be the actionable contamination extents of the pipeline release and the associated costs of clean-up and remediations for various contamination levels. The contamination extents form the basis of the hazard area or add to the previously estimated acute hazard areas. The hazard area is then used with the clean-up/remediation costs to estimate the consequence potential of the pipeline release.

Contamination potential

Estimations of contamination effects are complex, involving many difficult to estimate factors. It is generally not required that all of these parameters be individually linked to levels of harm for purposes of a risk assessment. Such considerations have normally already been synthesized into regulatory definitions of unacceptable concentrations—contamination levels—and mandated amounts of remediations when contamination occurs. It is useful, however, to understand the complexities underlying determinations of ‘what constitutes unacceptable levels of contamination’.

The following excerpt from ref [1029] illustrates one approach:

For many substances, the effect of concentration is magnified and, for concentration C and exposure time t, the relevant dose A is given by:

A = Cⁿt

Note that the exponent n is not necessarily an integer.

In its regulatory work the UK HSE uses two values of A:

• • • SLOT (Specified Level Of Toxicity) Dangerous Toxic Load: the dose that results in highly susceptible people being killed and a substantial portion of the exposed population requiring medical attention and severe distress to the remainder exposed. It represents the dose that will result in the onset of fatality for an exposed population (commonly referred to as LD1 or LD1-5) (ppm^n-min)
    • SLOD (Significant Likelihood Of Death): is defined as the dose to typically result in 50% fatality (LD50) of an exposed population and is the value typically used for group risk of death calculation onshore. (ppm^n-min)

Values of the SLOT and SLOD for selected materials are shown below. As can be seen in the final column, values of “n” for these materials range from 1 to 4.

SLOT & SLOD Values for Selected Materials

Substance	SLOT	SLOD	“n”
Ammonia	3.78 × 108	1.09 × 109	2
Carbon monoxide	40125	57000	1
Chlorine	1.08 × 105	4.84 × 105	2
Hydrogen sulphide	2.0 × 1012	1.5 × 1013	4
Sulphur dioxide	4.66 × 106	7.45 × 107	2
Hydrogen fluoride	12000	41000	1
Oxides of nitrogen	96000	6.24 × 105	2

Carbon Dioxide

HSE does not  consider CO2 to be a hazardous substance, but nonetheless includes it in their documentation with an ‘n’ value of 8.  Using some common PPM levels of interest and adding a ‘liklihood’ estimate, yields the following results for a CO2 pipeline release.

ppm	%CO2	minutes tolerable	ppm8-min	fatality potential	liklihood of dose	fat2		SLOT DTL (ppm^n-min)	SLOD DTL (ppm^n-min)
15000	1.5%	240	6.15E+35	0.00004%	0.2	8.20E-08	https://www.hse.gov.uk/chemicals/haztox.htm
40000	4.0%	10	6.55E+37	0.004%	0.5	2.18E-05		1% mortality	50% mortality	n=8 for CO2
80000	8.0%	10	1.67E+40	1.118%	0.9	0.010		1.5E+40	1.5E+41
		5.85E+06	4064	days to 1% mortality, 15k ppm				limit of injuries
		2,289	38	hrs to 1% mortality, 40k ppm
			8.9	min to 1% mortality, 80k ppm
			89.4	min to 50% mortality, 80k ppm

Note: these values are based on concentration in ppm, time in minutes.

Related to this is the use of probit equations to better model dose-response behaviors of exposed populations. This is discussed in a later section.

Leak volume

Rupture vs Leak

A normal supposition in risk assessment is that larger spill quantities create larger consequences. This will generally be true, but a robust risk assessment will also capture the unusual scenarios where this is not the case. For instance, a smaller total volume and/or small leak rate, contaminating a difficult-to-radiate receptor such as a subterranean aquifer, or accumulating in the basement of a multi-family dwelling, could be far more consequential than many large volume release scenarios.

The most costly small leaks occur below detection levels for long periods of time. Larger leak rates tend to occur under catastrophic failures such as external force (equipment impact, earthquake, etc.), avalanche crack failures, and with shocks to brittle materials, such as graphitized cast iron pipes.

Spill size

A spill or release size in any scenario is a function of many factors such as the failure mechanism, operating conditions, product characteristics, and leak rate. Smaller leak rates can occur due to corrosion (pinholes) or in mechanical connections. The most damaging leaks may be small leaks persisting below detection levels for long periods of time. Larger leak rates tend to occur under catastrophic failures such as external force (for example, equipment impact, ground movement) and avalanche crack failures. Up to the maximum component volume being instantaneously released, almost any size leak is possible.

Potential spill volume is estimated from potential leak rates and leak times.

Hole size

As a worst-case scenario, as well as a means to easily incorporate the intuitive belief that large diameter can mean higher consequence, pipe failures can be modeled as having opening (hole) areas equal to the cross-sectional area of the pipe—a guillotine rupture. This provides a consistent way to compare the maximum hazard zones from equipment of varying sizes and operating pressures. However, a rupture is a very rare event and can lead to over-conservatism and associated misunderstandings of true risk. It will also not recognize the differences that influence hole size and therefore will not ‘reward’ those components less susceptible to large hole size and ‘punish’ those that are more susceptible.

Including, in the assessment, the various potential hole sizes adds more robustness and realism to the analysis. The leak size probabilities—derived from hole size and other factors—can offset a consequence potential that would otherwise be modeled as being higher. For example, a smaller diameter line that is more prone to rupture can exceed the consequence potential of a larger line that is vulnerable only to small leaks. So, the larger line may actually carry less consequence potential.

The hole size is related to the failure mode, which in turn is a function of pipe material, stress conditions, and the failure mechanism. Failure modes can be categorized in different ways, such as: pinhole, large holes, ruptures; tearing, cracking, etc. Interrelationships among many factors determine the likely type of pipeline leak/rupture (hole size) for any failure scenario.

One intent of including hole size in estimating consequence potential is to identify components more likely to fail in a catastrophic fashion. Material toughness, including the implications of joints which may have greatly reduced toughness equivalents, is a key determinant of catastrophic failure potential in some scenarios. Where pipe material toughness is constant, changing pipe stress levels or initiating mechanisms will discriminate components more susceptible.

As an extreme example of catastrophic failure mode, an avalanche failure is characterized by rapid crack propagation, sometimes for thousands of feet along a pipeline, which completely opens the pipe, sometimes violently launching fragments into the air. (See discussion under Cracking). A crack will move at the speed of sound through a material. If the crack speed is higher than the depressurization wave—where pressure is the driving force creating the failure stress—then cracking continues. When the depressurization wave passes the cracking location, the driving force is lost and cracking halts.

Product compressibility and the level of pressurization play a role in crack length. Less compressible products can have relatively fast depressurization speeds. In other words, on initiation of the leak, the pipeline depressures quickly with an incompressible fluid. This means that usually insufficient energy is remaining at the failure point to support continued crack propagation.

A compressed gas, due to the higher energy potential of the compressible fluid, can promote significantly larger crack growth and, consequently, leak size. This is because the stored energy in a compressed fluid is relatively slow to release, allowing continued pressure on a crack that is opening.

Material toughness and thickness can each reduce crack speed. Crack arrestors take advantage of this. A crack arrestor is designed to slow the crack propagation sufficiently to allow the depressurization wave to pass. Once past the crack area, the reduced pressure can no longer drive crack growth. A more ductile or thicker material (stress levels are reduced as wall thickness increases), sometimes used intermittently along a pipeline, can act as a crack arrestor.

Given this model of crack growth, main contributing factors to an avalanche failure include low material toughness (a more brittle material that allows crack formation and growth), high stress level in the pipe wall (especially when at the base of a crack), and an energy source that can sustain rapid crack growth (usually a gas compressed under high pressure).

A hole size probability distribution can be generalized from research and/or an examination of past releases. This provides insight into what hole sizes have more often been associated with what types of failure mechanisms and pipeline characteristics—ie, incident frequencies typically show corrosion causing smaller holes and mechanical damage causing larger.

While useful as a calibration tool for populations of components, care should be taken to ensure that a statistical analysis does not introduce an inappropriate bias into assessing the spill size for a specific scenario. The subject pipeline being assessed may behave in ways drastically different from the population underlying the summary statistics.

Component Materials

Material types and their various failure modes are important aspects of a risk analysis and contribute to the PoF (exposure, mitigation, resistance) and CoF assessments. While especially important in addressing the widely different materials often encountered in an older distribution systems, for example, it is also useful in addressing more subtle differences in pipelines of basically the same material but operated under different conditions. For example, a higher strength steel pipeline may have slightly less ductility than Grade B steel and, when combined with factors such as changing stress levels and crack initiators, this raises the likelihood of an avalanche-type line break.

An important difference lies in materials that are inherently prone to more consequential failure modes. A large leak area is often created by the action of a crack in the pipe wall. A crack is more likely to activate in a higher stress environment and is more able to propagate in a brittle material; that is, a brittle pipe material is more likely to fail in a fashion that creates a large leak area—equal to or greater than the pipe cross-sectional area.

Stresses

Material stress levels in a component are a main determinant in the probability of a larger hole size. Stress is often expressed as a fraction of SMYS. For many years, 30% SMYS has been used as a discrimination point between leak and rupture. This level changes as defect size increases, with large defects susceptible to generating large failure areas at low stress levels. This is not a hard rule however. While rare, ruptures at lower stress levels have also been documented.

Initiating mechanisms

The role of initiating mechanisms in failure potential is discussed in . Their role in influencing hole size is briefly noted here.

Shorter defects under less stress tend to fail as leaks. As defects get longer and stresses increase, rupture becomes more likely. Weld seam anomalies, which can be relatively long, often fail as ruptures.

Damage type is another consideration a failure mechanism such as corrosion is often characterized by a slow removal of metal and is often modeled as producing smaller leak sites, whereas cracking and third-party damage initiators often have a relatively higher chance of leading to large opening.

Release models

Having determined the failure hole sizes to be used in the risk assessment, release scenarios can now be modeled. Several hazard area mechanisms—the underlying processes that create the dispersion or hazard zone area—have been identified. The hazard area for a gas release is established through either a jet fire or a vapor cloud. The hazard zone for a liquid release arises from either a pool fire or a contamination scenario. HVL hazard zones can arise from a combination of these mechanisms.

As noted, some leak/rupture scenarios are more sensitive to release rate, while others are more sensitive to total volume released. The rate of release is the dominant mechanism for most short-term thermal damage potential scenarios, whereas the volume of release is the dominant mechanism for many contamination-potential scenarios. Based on the expected potential hazards, consequences from gas releases are more often leak rate dependent. In a liquid spill, hazards are pool fire and contamination potential, so the spill volume is the critical determinant. Differences between and among these types of scenarios determines the potential consequences.

Potential leak rate and volume is dependent upon factors such as product characteristics, pressure, flowrate, hole size, system hydraulics, and the reliability and reaction times of safety equipment and pipeline personnel.

Leaks of gaseous products are driven primarily by hole size, pressure, and gas density.

Liquid leaks are more influenced by hole size, flowrate, and gravity effects. Because the release of a relatively small volume of an incompressible liquid can depressure the pipeline quickly, the longer term driving force to feed the leak may be pumping equipment or gravity and siphoning effects. A leak in a low-lying area may be fed for some time by the draining of the rest of the pipeline, so the evaluator should find the worst case leak location for the section being assessed. The leak rate should include product flow from pumping equipment. Reliability of pump shutdown following a pipeline failure is considered elsewhere.

There are more opportunities for consequence mitigation in V2 dominated scenarios, as is discussed in a later section. While actually consequence mitigation measures, leak detection and component isolation are inextricably linked to spill volumes are therefore covered here and again under mitigation. But first, an examination of hole size as a key determinant of leak rate.

Flow halt time and drain volume are often the determining factors for liquid releases and orifice flow to atmosphere (sonic velocity) determines vapor release rates. In simplest terms, low spots on large-diameter, high–flow-rate pipelines can be the sites of largest potential spills and larger diameter, higher pressure gas pipeline mains can generally cause greater releases.

Leak rates (V2) are typically determined via well established orifice flow equations. Leak volume (V1) determinations use these leak rates (V2), plus time to halt flow and deinventorying volumes.

Dispersion

Dispersion is often the initial determining factor of a hazard zone. As noted, however, hazard area can extend beyond the physical movement of leaked product when thermal and explosion effects are included. Toxic and asphyxiate characteristics of some clouds will be pertinent to most risk assessments. Flammability is the more common hazard associated with pipelined gases and HVL’s.

In most modern risk assessments, some type of release and dispersion modeling will need to be performed to understand distances at which possible intensities occur. This can be as simple as the application of an equation with only two variables, such as that for PIR of natural gas pipelines (only diameter and pressure are needed) or as rigorous as a vapor cloud dispersion or particle trace analysis requiring dozens of inputs at each potential spill location.

Software solutions range from simple calculations to assist first responders, up to extremely sophisticated and expensive models.

Hazardous vapor releases

The flammable and toxic limits of interest generally define the gas cloud boundaries. Upon ignition of a flammable cloud, the thermal effects may initially extend beyond the cloud boundaries—a fireball—and then retreat back to the source as the cloud is consumed, finally becoming a jet fire.

An accepted approach to modeling jet fire releases simplifies the calculation complexities associated with estimating release quantities by using pressure and diameter as proxies for the release quantities. Using a fixed damage threshold, it has been demonstrated that the extent of the threat from a burning release of gas can be modeled to be proportional to pressure and diameter [83]. Therefore, pressure and diameter are suitable variables for assessing at least one critical aspect of the potential consequences from a gas release.

Because the immediate hazards from vapor releases are mostly influenced by leak rate, leak detection will not normally play a large role in risk reduction. One notable exception is a scenario where leak detection could minimize vapor accumulation in a confined space.

Vapor cloud size

The release of a gaseous pipeline product creates a vapor cloud. The extent and cohesiveness of a vapor cloud are critical parameters in determining possible threats from that cloud. A vapor cloud that envelopes more near-ground surface area has a greater area of opportunity to find an ignition source or to harm living creatures. This should be reflected in the risk assessment. The cloud boundary is typically defined by some concentration of the vapor mixed with air.

A flammable limit is often chosen as a cloud boundary threshold for hydrocarbon gases. The use of the lower flammability limit—the minimum concentration of gas that will support combustion—is the most common cloud boundary. It conservatively represents the maximum distance from the leak site where ignition could occur. Sometimes 1/2 of the LFL is used to allow for uneven mixing and the effects of random cloud movements. This lower concentration creates a larger cloud.

In the case of a toxic gas, the cloud boundary must be defined in terms of toxic concentrations. These might exceed thermal hazard distances. For instance, unignited sour gas (hydrogen sulfide, H₂S) releases have been estimated to cause potential hazard zones 4 to 17 times greater than from an ignited release [95].

Sophisticated dispersion studies have revealed a few simplifying truths that can be used to better understand cloud size. In general, the rate of vapor generation rather than the total volume of released vapor is a more important determinant of the cloud size. Due to a cloud reaching an equilibrius with the atmosphere, release duration—total release volume—is not as critical in estimating maximum cloud size as is release rate. Released product balances the product dispersing at the cloud boundaries, resulting in a relatively stable cloud size. The release rate will normally diminish quickly as the pipeline rapidly depressures under a pipeline rupture scenario, which is normally the more interesting cloud-generating event.

Cloud stability and hence, size are significantly influenced by meteorological conditions. Conditions that favor mixing and more rapid dispersion minimize cloud size while more stable atmospheric conditions support a more stable and larger cloud. Meteorological conditions are often categorized into stability classes for purposes of dispersion modeling. Each stability class represents some fraction of possible weather type days for a specific location in any year. Under very favorable conditions, unignited cloud drift may lead to extended hazard zone distances.

Liquid spill dispersion

Physical extent of spill

The physical extent of a liquid spill is highly variable and on the spill rate and duration including drain effects, the type of product spilled, and the characteristics of the spill site. The first two of these are known or readily estimable at all locations along a pipeline. The third, spill site characteristics, will usually be the information most challenging to obtain and integrate into the risk assessment.

Pipeline pressure is not a main determinant in liquid spill volume since the product is assumed to be relatively incompressible. Except for a scenario involving spray of liquids, the potential damage area is not thought to be very dependent on pressure in any other regard.

Some form of at least rudimentary site-specific analyses will be required to properly assess liquid spill characteristics. A range of options in analysis rigor is available, GIS based models that generate spill footprints along a pipeline are commonly used tools given the increased availability of powerful computing environments and information (for example, soils, topography, surface resistance, groundwater depth, etc) in electronic databases. Such models vary in complexity, with the more robust taking into account all of the spill-determining characteristics noted previously.

Spills onto Soil

References detailed in PRMM can then be used to assess the soil permeability for liquid spills into soil. This implies that more or faster liquid movements into the soil increase the range of the spill. Of course, greater soil penetration will decrease surface flows and vice versa. Either surface or subsurface flow might be the main determinant of contamination area, depending on site-specific conditions. When groundwater contamination is the greater perceived threat, the risk assessment should show greater consequences with increasing soil permeability.

The soil permeability is normally used with an accompanying assumption that larger volumes, spilled in a higher permeability soil, lead to proportionally greater consequence areas. A low-penetration soil promotes a wider spill-surface area and hence places additional laterally-located receptors at risk. A spill of a more acutely hazardous product might generate less consequence if accompanied by greater soil penetration and reduced lateral spread and/or ignition probability.

1.  

Soil permeability

Description	Permeability (cm/sec)
Impervious barrier	0
Clay, compact till, unfractured rock	<10−7
Silt, silty clay, loess, clay loams, sandstone	10−5–10−7
Fine sand, silty sand, moderately fractured rock	10-3–10−5
Gravel, sand, highly fractured rock	>10-3

Ultimately, an assessment of the spilled substance’s hazards and persistence (considering biodegradation, hydrolysis, and photolysis) will be needed in evaluating the consequences of a liquid spill.

Subsurface water contact is also an important aspect of liquid spills.

One source [1014] notes a simple equation for determining spill pool diameter. The US HUD guidelines [1012] and the SFPE Handbook [1013] discuss methods of estimating the diameter of an unconfined spill fire.

A simple method of obtaining a spill diameter is:

D 10sqrt V

Where D is in meters and V is in cubic meters 1

This equation asserts that the liquid will continue to spread until it is about 1 cm in depth.

In using any simplified approach, assumptions must be made regarding rate of penetration into the soil, evaporation, and other considerations.

Spills on Water

Spills into water should take into account the miscibility of the substance with water and the water movement. A spill of immiscible material into stagnant water would be the equivalent of a spill on flat terrain with impermeable soil. A highly miscible material spilled into a flowing stream results in widespread dispersion.

For the more persistent liquid spills, including oil, mixing and transport phenomena should be considered.

For subsea gas releases, a common assumption is that the diameter of the plume at the sea surface is 20% of the water depth at the release point, regardless of the gas flow rate. This diameter together with the gas flow rate can then be used as input to a plume model.

1. Oil Release Into Water

Highly volatile liquid releases

HVL releases involve characteristics of both gas and liquid releases. Since multiphase fluids are involved. Material released under flashing conditions is a complex nonlinear, non-equilibrium process that is difficult to model.

As with liquids, the initial release rate will usually be the highest rate of the event, and then rapidly decrease. Inside the pipe, the depressurization wave from a rupture moves from the rupture site and pressures inside the pipeline quickly drop to the product’s vapor pressure. At vapor pressure, the pipeline contents will vaporize (boil), generating quantities of vapor that emerge from the leak.

Outside the pipe, flashing liquids will initially emerge and a gas cloud will be formed, including immediately flashing material, the vapor generation from a liquid pool, and the evaporation of airborne droplets from any aerosol phase release components.

After the immediate depressurization from the leak event, the scenario will unfold as a dense gas release. Release characteristics are then similar in many respects to pure vapor release scenario.

Distance From Leak Site

A hazard area may originate some distance from the point of pipeline failure. Envision a sloped topography where the spilled liquid will accumulate some distance from the leak site or the accumulation of natural gas into a basement, following migration through the soil from the source of a minor leak.

In the case of delayed or no ignition, the product will usually have migrated some distance prior to ignition (unless the ignition source moves into the leak source area). This moves the origination point for the thermal effects. The cloud centroid or liquid pool center then become the point from which the thermal hazard zone extends. The thermal effect can also move back towards the leak site as the ‘trail’ of combustible spilled product is consumed. This creates a hazard zone along the ‘trail’.

A receptor can be very close to a leak site and not suffer any damages, depending on variables such as wind strength and direction, topography, or the presence of barriers, while areas farther away are damaged. Scenarios envisioned include a liquid spill where a ditch or sewer catches and moves the spilled product away from the leak; or an HVL ‘puff’ release where the cloud, fully decoupled from any other vapors escaping from the pipeline, drifts some distance before finding an ignition source. These scenarios are challenging to model and require location-specific analyses. Including the migration possibility without the decoupling-from-the-source possibility produces larger (more conservative) hazard zones.

Making a distinction between the path and the event centroid is useful. Centroid is used to refer to the center from which thermal or overpressure effects are emerging. In the absence of some type of dispersion modeling, the path is often set to zero distance, making the centroid coincident with the spill site (on top of the pipe). This is a convenient way to model, but will miss-characterize damage potential when, for instance, scenarios like those described above occur.

For general consequence assessment, the recommendation is to simply add the migration distances to the hazard zone distances. While this inflates the hazard zone distances for many scenarios, it also captures the scenarios where the hazard zone is actually enlarged by the migration path of material that can combust or contaminate.

In the case of liquid spills, the distance estimate should consider topography, surface flow resistance, permeability, and other factors making these scenarios more location-specific and difficult to model. Where the topography is relatively consistent, some ‘rules’ can be developed to facilitate assessment, adjusting estimates only when certain changes are encountered. For example, a hazard area can be based on a predominant topography—say, ‘prairie’ or ‘level pasture’—and, where the pipeline crosses a ditch or stream of certain characteristics, a different set of assumptions creates a different hazard zone.

In the case of HVL’s and gas releases, the hazard zone should also consider meteorology. This is generally stable over long stretches of pipeline, but conceivably can cause modeling complications in scenarios where weather patterns change over short distances. Examples include canyons, intermittent forest cover, buildings, coastal regions, and perhaps even shielded (from wind) versus unshielded locations where ‘confinement’ increases the ignition and/or explosion potential of a vapor cloud.

1. Spill Migration with Subsequent Ignition

Accumulation and Confinement

As noted previously, confinement and accumulation of release flammable products generally increases the potential for both ignition and explosion. In an urban environment, the confinement/accumulation potential is greater because product can migrate for long distances under pavement, route through adjacent conduits (sewer, water lines, etc.), permeable soils, or find other pathways to enter buildings intended for human occupancy.

Similar scenarios may also emerge in rural areas, involving gas or HVL transmission pipelines.

Gas cloud confinement potential in both urban and rural areas was previously noted and can dramatically increase damage potential when detonation events are triggered.

Hazard Zone Estimation

We again turn to our simple, summary equation of consequence estimation:

Release Impact (RI) = product hazard (PH) x Release Quantity (RQ) x dispersion (D)
x receptors (R)

Hazard zones based on threshold intensities such as heat, overpressure, and toxicity/contamination are a function of the first three factors, which can be grouped into just two general sets of release conditions:

• Pipeline / product characteristics
• Dispersion potential
• Topography effects if liquid release
• Meteorology effects if gaseous release

Product characteristics are grouped with pipeline characteristics since the operating conditions—pressure, temperature, flowrate—will influence how the product behaves when released.

As previously noted, thresholds based on a receptor effect or damage state, such as fatality, injury, property damage, environmental harm, require the above plus another:

• Receptor proximities and characteristics

A countless number of hazard distances can be created from possible failure scenarios of most hydrocarbon pipelines. The range of scenarios used to evaluate hazard zones is narrower when the receptor characterizations are separated from the threshold definitions. For instance, initially avoiding the complexity of approximating population density, shielding, mobility, and potential exposure times reduces the number of permutations required to estimate a hazard zone. Hazard zone estimation can therefore efficiently begin using only the factors that establish threshold intensity distances. These are primarily the pipeline and product characteristics and dispersion potential. Then, receptor characterizations can be later added to the analysis.

One modeling objective is to establish hazard zone distances in a way that the same distance can apply to large stretches of pipeline. This allows for efficient and consistent characterization of receptors within hazard zones.

Three aspects of hazard zones should be considered in building a simplifying model: distance from event; the threshold of interest; and probability of the threshold appearing at a certain distance. The goal is to model a manageable number of scenarios while ensuring that the chosen scenarios represent the full range of possibilities.

Hazard zones should represent reasonable assumptions and capture the logical premise that damage severity—thresholds—will normally decrease as distance from the event increases. When establishing threshold zones, the modeler should keep in mind that actual intensities of thermal events—normally the events of most interest—are in fact usually proportional to the square of the distance. Therefore, potential damages will normally drop very dramatically with increasing distance. See transmissivity / emissivity discussions. Contamination potential can often be assumed to decrease with increasing distance since dilution, absorption, evaporation, etc. have more opportunity to reduce contaminant levels after the spill has moved some distance overland. The rate of drop in damage potential with increasing distance might be receptor- or threshold-dependent.

As a further simplifying opportunity, expressing a hazard zone threshold as a fraction of the theoretical maximum hazard distance might improve modeling efficiency. The underlying assumption is that a certain percentage of the maximum hazard zone produces a certain threshold. For instance, the first 10% of the maximum hazard zone may be assumed to produce a high probability of fatalities and 100% property destruction; between 10% and 60% of maximum hazard zone produces no fatalities—injuries only, and 50% property destruction; etc.

The probability of the hazard distance and the probability of various damages states are both captured in the probability number assigned to the distance. So, a hazard zone distance of 1000 ft with a 1% probability embodies the belief that there is only a 1% chance of a threshold extending this far, and, if it does reach this distance, damages will only be 1% of what they would be immediately adjacent to the centroid.

In this suggested approach, some liberties with measurement units are taken. Probabilities of occurrence are combined with possible distances to thresholds and expressed as distance. Probabilities can be represent either the chance of a hazard zone occurring or the probability of a certain damage state, given the manifestation of the hazard zone. Mathematically, the two are treated as identical. Given the high levels of uncertainty and variability in possibilities, such liberties and simultaneous representations are not unreasonable.

It may be assumed that contamination areas are encompassed by the thermal effects or, alternatively, a separate contamination assessment can be performed.

Mechanical effects hazard zones can be estimated via analyses of underlying phenomena such as product release forces, impingement forces, projectile trajectories, and submerged gas releases (ship instability due to offshore gas pipeline rupture).

Hazard zone calculations

With an understanding of the potential hazards generated by a product plus the dispersion characteristics of product release scenarios, hazard zones can now be estimated in order to characterize the receptors that might be vulnerable to a pipeline release. The hazard zone, as previously defined, is the physical area in which receptor damage is possible.

As noted earlier, thermal, toxic, and mechanical hazards are potentially produced from unintended releases of products typically transported in pipelines. Thermal effects are the dominant threat in many hydrocarbon releases. Thermal radiation is generated from flames jets (or torch fires), fireballs, or pools of burning liquids. Overpressure events are potentially generated if a flammable vapor cloud is detonated.

Each of these scenarios has its own probability of occurrence and generates its own hazard distance. In some consequence assessments, each will need to be individually analyzed and included.

Most damage state or hazard zone calculations result in an estimated threat distance from a source, such as the center of a burning liquid pool or a vapor cloud centroid. It is important to recognize that the source of a thermal event might not be at the pipeline failure location. The source can actually be some distance from the leak site and this must be considered when assessing potential receptor impacts. Note also that a receptor can be very close to a leak site and not suffer any damages, depending on variables such as wind direction, topography, or the presence of barriers.

Air Dispersion

Vapor dispersion estimates will govern scenarios of toxic gas releases as well as fireballs and flashfires that predominantly involve gases, and vapor cloud explosions. These phenomena were discussed in the previous section. While there are few, if any, short cut estimation solutions for vapor cloud modeling, there are widely available models for first responders, air pollution, and hazard area calculations.

Jet fire modeling

The potential consequences from a pipeline release will depend on the failure mode (uch as leak versus rupture), discharge configuration (such as vertical versus inclined jet, obstructed versus unobstructed), and the time to ignite (such as immediate versus delayed). For natural gas pipelines, the possibility of a significant flash fire or vapor cloud explosion resulting from delayed remote ignition is low due to the buoyant nature of gas, which prevents the formation of a persistent flammable vapor cloud near ignition sources.

Ref [83] “Model of Sizing High Consequence Areas (HCAs) Associated with Natural Gas Pipelines” is commonly used to determine the point of ‘significant’ potential pipeline natural gas jet fire impacts on surrounding people and property. The Gas Research Institute (GRI) funded the development of this model for U.S. gas transmission lines in 2000, in association with the U.S. Office of Pipeline Safety (OPS), to help define and size HCAs as part of new integrity management regulations. This model uses a conservative and simple equation that calculates the size of the affected worst case failure release area based on the pipeline’s diameter and operating pressure. Evaluating the potential consequences from a natural gas release is often based on the hazard zone generated by a jet fire from such a release.

A jet fire is a common result of an ignited release from a flammable gas pipeline. With some reasonable assumptions, the associated hazard zone can be modeled with some readily available data and efficiently applied to long stretches of pipeline. The most well known model, GRI PIR, was highlighted in a previous discussion of hazard zone thresholds. That model illustrated the identification and use of intensity levels and damage levels (ie, human mortality) in a hazard zone determination. That same model is also relevant as a tool for efficiently establishing hazard zones for releases that behave under the assumptions used in the model development.

The GRI model first seeks to characterize the heat intensity associated with ignited gas releases from high-pressure natural gas pipelines. Escaping gas is assumed to feed a fire that ignites shortly after pipe failure. The affected ground area can be estimated by quantifying the radiant heat intensity associated with a sustained jet fire.

A relationship is proposed and described in PRMM that uses a simple equation to calculate the potential size of ’significant’ damage from a natural gas pipeline failure based on the pipeline’s diameter and operating pressure.

1. From ref [83]

Other models are available, but this GRI model has gained a level of acceptance worldwide and is unrivaled in its ease of application. A related set of equations, by the same authors, can be used to calculate distances for other damage states, ie, other than the 1% mortality used here. Alternative threshold values for thermal radiation intensity can also be used in the above equations to calculate hazard areas for other types of damage such as property damage, secondary fires, injuries, etc. This is important since a robust risk assessment will seek to characterize all consequence potential, not just the worst case scenario. This requires estimation of various levels of harm to various receptor types.

Similar equations are available for other gases but not all gases nor all scenarios. When a model is needed to evaluate risks from a variety of flammable gases, then additional variables are needed to distinguish among potential hazard zones. Density might be appropriate when the consequences are thought to be more sensitive to release rate. MW or heat of combustion might be more appropriate for consequences more sensitive to thermal radiation. If a gas to be included is thought to have the potential for an unconfined vapor cloud explosion, then the model should also include overpressure (explosion) effects as discussed for HVL scenarios.

The previous thermal radiation relationship [83] along with a supposition that dispersion, thermal radiation, and vapor cloud explosive potential are proportional to MW could lead to a modified equation to capture differences among gases for which there is no deterministic equation.

Even when a simple model such as this appears to be pertinent to the scenario being assessed, caution is in order. To reduce the complex real-world phenomena into such a simple equation involving only two inputs, requires numerous assumptions. Some of these assumptions may not be appropriate for scenarios being evaluated.

Pool fire modeling

For damage potential from pool fires, the pool diameter and the flammable material’s heat of combustion are the most critical factors in most calculation procedures. Factors such as release rate, topography, and soil permeability are needed to estimate pool size. To broadcast a pool size estimate along long distances of pipeline, a pool depth can be assumed and the radius calculated according to the volume of leaked product at each spill point. This will not take into account location specific characteristics and should not be considered a robust approach.

Once the pool size has been estimated, thermal radiation damage distances can be added. Models such as the one shown earlier in the product hazard discussion, work well to show distances beyond the pool edges where damages can be expected.

One source predicts distance to a certain thermal radiation intensity with an equation based on factors for estimating the distance to a heat radiation level that could cause second degree burns from a 40-second exposure. This heat radiation level was calculated to be 5,000 watts per square meter. The equation for estimating the distance from pool fires of flammable liquids with boiling points above ambient temperature is:

Where:

X = distance to the 5 kilowatt per square meter endpoint (m)

HC = heat of combustion of the flammable liquid (joules/kg)

HV = heat of vaporization of the flammable liquid (joules/kg)

A = pool area (m2)

CP = liquid heat capacity (joules/kg-ºK)

TB = boiling temperature of the liquid (ºK)

TA = ambient temperature (ºK)

EPA’s RMP Off-Site Consequence Analysis Guidance (May 24, 1996)

One source presents maximum separation distances from a fire beyond which the thermal radiation flux impinging on a structure or person is less than the acceptable separation distance (ASD) threshold values regardless of the fire size. lists these maximum values for the different fuels considered. The values are obtained by extrapolating the ASD from a simplified chart solution for extremely large fire diameters. These maximum ASD values can be used as “screening” values because distances greater than the “Screen ASD” meet the criteria for thermal radiation flux regardless of fire size.

Liquid	Mass Burning Rate,m”	Heat of Combustion	HRR Per Unit Area, q”f	Screen ASD
Struct.	People
kg/m2/s	kJ/kg	kW/m2	m	m
Acetic Acid	0.033	13,100	400	10	90
Acetone	0.041	25,800	1,100	10	250
Acrylonitrile	0.052	31,900	1,700	15	390
Amyl Acetate	0.102	32,400	3,300	30	750
Amyl Alcohol	0.069	34,500	2,400	20	550
Benzene	0.048	44,700	2,100	20	480
Butyl Acetate	0.100	37,700	3,800	35	860
Butyl Alcohol	0.054	35,900	1,900	15	430
m-Cresol	0.082	32,600	2,700	25	620
Crude Oil	0.045	42,600	1,900	15	430
Cumene	0.132	41,200	5,400	50	1220
Cyclohexane	0.122	43,500	5,300	45	1200
No. 2 Diesel Fuel	0.035	39,700	1,400	12	320
Ethyl Acetate	0.064	23,400	1,500	15	340
Ethyl Acrylate	0.089	25,700	2,300	20	530
Ethyl Alcohol	0.015	26,800	400	10	90
Ethyl Benzene	0.121	40,900	4,900	40	1100
Ethyl Ether	0.094	33,800	3,200	30	730
Gasoline	0.055	43,700	2,400	20	550
Hexane	0.074	44,700	3,300	30	750
Heptane	0.101	44,600	4,500	40	1000
Isobutyl Alcohol	0.054	35,900	1,900	15	430
Isopropyl Acetate	0.073	27,200	2,000	20	460
Isopropyl Alcohol	0.046	30,500	1,400	15	320
JP-4	0.051	43,500	2,200	20	500
JP-5	0.054	43,000	2,300	20	530
Kerosene	0.039	43,200	1,700	15	400
Methyl Alcohol	0.017	20,000	340	10	80
Methyl Ethyl Ketone	0.072	31,500	2,300	20	530
Pentane	0.126	45,000	5,700	50	1300
Toluene	0.112	40,500	4,500	40	1000
Vinyl Acetate	0.136	22,700	3,100	25	700
Xylene	0.090	40,800	3,700	30	850

[pool fire U802.pdf] NISTIR 6546 Thermal Radiation from Large Pool Fires, Kevin B. McGrattan, Howard R. Baum, Anthony Hamins; Fire Safety Engineering Division
[Building and Fire Research Laboratory, November 2000, National Institute of Standards and Technology, U.S. Department of Commerce]

While these distances are conservative and fixed to pre-determined threshold effects, they are useful, perhaps particularly so in examining the relative differences in safe distances for various types of hazardous liquids.

Highly volatile liquids

HVL releases are complex, nonlinear processes, as previously discussed. Hazards associated with the release of an HVL include several flammability scenarios, explosion potential, and the more rare scenario of spilled material displacing air and asphyxiating creatures in the oxygen-free space created. The flammability scenarios of concern include the following (previously described):

• • • Flame jets
    • Vapor cloud fire, flashfire, fireball
    • Liquid pool fires
    • Vapor cloud explosion

Because precise modeling is so difficult, many assumptions are often employed. Use of conservative assumptions helps to avoid unpleasant surprises and to ensure acceptability of the calculations, should they come under outside scrutiny. A conservative hazard zone distance adopted for an HVL pipeline release, for example, should be based upon a compilation of calculation results generally corresponding to the distance at which a full pipeline rupture, at maximum operating pressure, with subsequent ignition, could expose receptors to significant thermal damages, plus the additional distance at which blast (overpressure) injuries could occur in the event of a subsequent vapor cloud explosion. Some sources of conservatism that can be introduced into HVL hazard zone calculations include:

• • • Overestimation of probable pipe hole size (can use full-bore rupture as an unlikely, but worst case release)
    • Overestimation of probable pipeline pressure at release (assume maximum pressures)
    • Stable atmospheric weather conditions at time of release
    • Ground-level release event.
    • Maximum cloud size occurring prior to ignition
    • Extremely rare unconfined vapor cloud explosion scenario with overpressure limits set at minimal damage levels
    • Overpressure effects distance added to ignition distance (assume explosion epicenter is at farthest point from release).

These conservative parameters would ensure that actual damage areas are well within the hazard zones for the vast majority of pipeline release scenarios. Additional parameters that could be adjusted in terms of conservatism include mass of cloud involved in explosion event, overpressure damage thresholds, effects of mixing on LFL distance, weather parameters that might promote more cohesive cloud conditions and/or cloud drift, release scenarios that do not rapidly depressurize the pipeline, possibility for sympathetic failures of adjacent pipelines or plant facilities, ground-level versus atmospheric events, and the potential for a high-velocity jet release of vapor and liquid in a downwind direction.

Available models and modeling services for HVL releases are numerous. They range from public domain (free) software designed for first responders, to extremely sophisticated models run only by specialists.

An example calculation, based on equations from the EPA’s RMP Off-Site Consequence Analysis Guidance (May 24, 1996) is as follows:

For vapor cloud explosion, the total quantity of flammable substance is assumed to form a vapor cloud. The entire cloud is assumed to be within the flammability limits, and the cloud is assumed to explode. Ten percent of the flammable vapor in the cloud is assumed to participate in the explosion. The distance to the one pound per square inch overpressure level is determined using equation C-1.

Where:

X = distance to overpressure of 1 psi (meters)

Wf = weight of flammable substance (kg)

HCf = heat of combustion of flammable substance (joules/kg)

HCTNT = heat of combustion of trinitrotoluene (4.68 E+06 joules/kg)

Secondary Fire Effects

One Canadian study concludes that there are on average about two pipeline-related fires in Canada each year, compared to 70,000 other fires and 9,000 forest fires. Their conclusion is that gas pipelines generally pose little threat to the environment based on the low incident of fires initiated by gas pipelines [95]. This conclusion is consistent with the generally accepted low risk of environmental harm from most gas releases.

Nonetheless, when thermal effects from ignition of any released pipeline product do occur, secondary fires are commonly seen. Post incident aerial photos clearly show this.

There will normally be much uncertainty in estimating the potential spread of a fire, given the multitude of variables impacting the spread, including heat flux, emissivity, transmissivity, types of combustibles, wind, humidity, recent rainfall, emergency response, and others.

Thermal radiation threshold levels for non-piloted ignition of wood products and aerial photographs from incidents in similar environments can be used to inform the selection of a distance for secondary fires to be added to the hazard zone.

Hazard zone examples

A hazard zone for a pipeline could be based on generalized distances from specific receptors representing “distances of concern”, based on receptor vulnerability or other damage distances from a pipeline release. Some examples are noted here.

One high profile assessment uses a default 1250-ft radius around an 18-in. gasoline pipeline as a hazard zone, but allows for farther distances where modeling around specific receptors has shown that the topography supports a larger potential spill-impact radius.

In cases of HVL pipeline modeling, conservative (near worst case) distances of 1000 to 2500ft are commonly used, depending on pipeline diameter, pressure, and product characteristics. HVL releases cases are very sensitive to weather conditions and carry the potential for unconfined vapor cloud explosions, each of which can greatly extend impact zones to more than a mile.

Regulatory set back distances also provide insight into hazard zones determined by others. A draft Michigan regulatory document suggests setback distances for buried high-pressure gas pipelines based on the HUD guideline thermal radiation criteria. The proposed setback distances are tabulated for pipeline diameters (from 4 to 26in.) and pressures (from 400 to 1800 psig in 100-psig increments). It is not known if these distances will be codified into regulations. In some cases, the larger distances might cause repercussions regarding alternative land uses for existing pipelines. Land use regulations can have significant social, political, and economic ramifications. (See also the discussion on land-use issues in a following section for thoughts on setback distances that are logically related to hazard zones.)

The U.S. Coast Guard (USCG) provides guidance on the safe distance for people and wooden buildings from the edge of a burning spill in their Hazard Assessment Handbook, Commandant Instruction Manual M 16465.13. Safe distances range widely depending on the size of the burning area, which is assumed to be on open water. For people, the distances vary from 150 to 10,100ft, whereas for buildings the distances vary from 32 to 1900ft for the same size spill. The spill radii for these distances range between 10 and 2000ft [1025].

A summary of setback distances was published in a consultant report and is shown in Table 14.36 of PRMM.

Any time default hazard zone distances replace situation-specific calculations, the defaults should be validated by actual calculations to ensure that they encompass most, if not all, possible release scenarios for the pipeline systems being evaluated.

Using a Fixed Hazard Zone Distance

Based on sound analyses, hazard zones for groups of similar pipelines—same product, diameter, pressure range, etc—could be set at some consistent nominal distance. A fixed hazard zone distance sacrifices some resolution since the distance must be based on a set of parameters that will not be exactly correct for every portion along a long pipeline.

Fixed hazard buffers may be more appropriate for vapor releases—gas and HVL—since those releases are often less sensitive to minor changes in location-specific characteristics. In contrast, a liquid spill is often heavily influenced by minor location-specific changes such as drainage ditches, storm sewers, surface flow resistance and permeability, topography, etc. therefore, the use of a fixed buffer could carry an acceptable loss of accuracy in assessing a gas or HVL pipeline, but will often not suffice when assessing liquid pipeline risks.

Depending on the desired level of conservatism, the selected hazard zone will often represent the distances at which damages could occur, but are thought to exceed the actual distances that the vast majority of pipeline release scenarios would impact. For many practical applications of a risk assessment, such conservatism will be warranted.

Characterizing Hazard Zone Potential Using Scenarios

Since an infinite range of hazard distances (areas, zones) are possible, a methodology to efficiently characterize this range without undue loss of accuracy is desired. A good choice is to select a sufficient number of scenarios to represent all possible scenarios and their relative frequency of occurrence. Using a dozen or less scenarios to represent the thousands that are possible, will often generate sufficient resolution for the risk assessment. The selected scenarios should certainly represent both the most common and slight variations on the most common, as well as the worst case.

Estimate hazard distances (threshold distances) for representative pairings of leak size and ignition scenarios. For example, using hole size as a surrogate for leak size, holes sizes of “rupture”, “leak”, and “pinhole” could be paired with ignition scenarios of “immediate”, “delayed”, and “no ignition”, resulting in 9 combinations, as is shown in the following example. Hole size probabilities could be linked directly to failure mechanism, material toughness, and other pertinent factors.

As another example, , which coincidentally also uses nine scenarios to represent all possible scenarios, is offered. This table is created in a different way from the previous. Here, various combinations of hole size (up to full rupture of the 16” pipe being modeled) and pressure (up to maximum operating pressure) are selected. They encompass the full range of larger sized releases, ignoring smaller, <0.5” diameter holes.

1.  

Establishing Hazard Zone Distances and Probabilities

	Threshold Distances (ft)	Maximum Distance (ft)
Product	Hole Size	Probability of Hole	Ignition Scenario	Probability of ignition scenario	Distance from source (ft)	Thermal impact	Overpress impact	Contamination Impact	Probability of Maximum Distance
propane	rupture	8%	immediate	60%	0	400	0	0	400	4.8%
delayed	20%	300	400	800	0	1500	1.6%
no ignition	20%	300	0	0	0	300	1.6%
medium	12%	immediate	15%	0	300	0	0	300	1.8%
delayed	15%	100	300	200	0	600	1.8%
no ignition	70%	100	0	0	0	100	8.4%
small	80%	immediate	10%	0	50	0	0	50	8.0%
delayed	10%	30	50	0	0	80	8.0%
no ignition	80%	30	0	0	0	30	64.0%
	100%		100.0%

Each pairing is assigned conservative probabilities of the hole size and pressure occurring, as well as ignition subsequently happening; hole probability x pressure probability x ignition probability = scenario probability. This is thought to fairly represent the range of plausible large hazard zone generating scenarios.

When multiple hazardous liquid and vapor releases are to be assessed, some comparisons can be useful. Equivalences are challenging, though, given the different types of hazards and potential damages (thermal versus overpressure versus contamination damages, for example). For instance, 10,000 square feet of contaminated soil or groundwater is a different damage state than a 10,000-square-foot burn radius. When consequences are to be monetized, equivalences will emerge—the costs of the incidents is the common denominator to make comparisons meaningful.

For instance, using some very specific assumptions, some human fatality and serious injury distances involving multiple products, diameters, pressures, and flow rates were calculated to generate Table 7.11 in PRMM.

Consequence Mitigation Measures

Consequence reduction measures are opportunities to reduce the potential losses from an event already in progress. The pipeline operator’s ability to seize these opportunities should be included in the risk assessment.

The simple formula of consequence factors is again a useful summary of the CoF ingredients and shows, in a more structured way, the opportunities to reduce potential consequences.

Release Impact (RI) = product hazard (PH) x Release Quantity (RQ) x dispersion (D) x receptors (R)

Reduction to any factor or combination of factors will reduce consequence potential. Reductions to some will not often be practical—changing product or permanently moving receptors, for instance. In the interest of completeness, however, such options should be acknowledged. Other options are usually viable—reduce spill volumes and/or dispersion of released product.

Discounting business consequences, consequence-reducing actions must do at least one of two things:

1. Limit the damage area.
2. Limit damages to receptors within the damage area.

Given a release, associated damage/hazard areas are reduced by limiting the amount of product spilled by isolating the pipeline quickly or changing some transport parameter (pressure, flowrate, type of product, etc), by preventing ignition, and/or by limiting the extent of the spill. If a reduction measure can reduce the size of the hazard zone, then fewer receptors may be exposed and consequences will be lower.

Additionally, the potential damage rate within the hazard zone can be limited by protecting or removing vulnerable receptors. Additional actions to limit receptor damages include prompt medical attention, quick containment, avoidance of secondary damages, and rapid cleanup of the spill.

Chronic hazards have a time factor implied: events tend to worsen with the passage of time. Actions that can influence what occurs during the time period of the spill will impact the consequences. Therefore, there are more opportunities to reduce hazard areas associated with chronic events. If a small release is detected before a spill plume can become larger or migrate to additional sensitive receptors, the hazard zone may be reduced by flow halting, secondary containment, and others. In chronic hazard scenarios, emergency response actions such as evacuation, blockades, and rapid pipeline shutoff are effective in reducing the hazard area.

Most acute events offer less intervention opportunities since the largest hazard zones tend to occur immediately after release and then improve over time. The more probable leak scenarios involving acute hazards show that the consequences would not increase over time because the driving force (pressure) is being reduced immediately after the leak event begins and dispersion of spilled product occurs rapidly. This means that reaction times swift enough to impact the immediate degree of hazard are not very likely. The emphasis here is on ‘immediate’ so as not to downplay the importance of emergency response. Emergency response can indeed influence the final outcome of an acute event in terms of loss of life, injuries, property damage, and other potential losses.

In many scenarios, reaction to a liquid spill plays a larger role in consequence minimization than does reaction to a gas release.

Additional opportunities, less common for pipelines, include fire suppression systems higher-volume containment does not always warrant more risk mitigation than smaller containments. The larger containment component or facility has a greater potential leak volume due to its larger stored volume, but either can produce a smaller, but consequential leak.

Mitigation of CoF vs PoF

The first determination for the risk implications of a mitigation measure is whether it plays a role mostly in terms of failure avoidance or consequence minimization. For example, it can be argued that leak detection should be assessed only in the consequence analyses because it acts as a consequence-limiting activity—the leak has already occurred and early detection can reduce the potential consequences of the leak. However, leak detection can also play a role in leak size—sometimes allowing intervention before a larger leak manifests. Depending on the definition of ‘failure’, this scenario may reduce failure probability in addition to consequence potential.

Distribution systems are a good example of this nuance. Distribution systems tend to have a higher incidence of leaks compared to transmission systems. This is due to differences in the age, materials, construction techniques, and operating environment between the two types of pipelines. Leakage in these low pressure systems is more routine and leak detection and repair is a normal aspect of operations. Some leaks are not actionable except for perhaps inclusion on a ‘monitoring’ list. Before some threshold leak rate (or leak circumstance) is reached, the leak is not a ‘failure’. Furthermore, leaks often provide early warning of deteriorating system integrity. The number of leak locations is often used as a forecaster of ‘failures’, with failure being a leak of actionable size.

Therefore, there may be overlap where a mitigation measure such as leak detection plays a role in both PoF and CoF estimations. This is not an obstacle for the risk assessment approach recommended here—any and all measures reducing either can be readily included in the assessment. When a measure such as leak detection is thought to play a significant role in failure rates—by some definition of ‘failure’–it is readily incorporated into the exposure, mitigation, and resistance modeling of PoF. It will often be best modeled as an inspection, playing a similar role as other inspections such as ILI. It first provides some indications of resistance—where damage has already occurred. It then provides inferential evidence of both exposure—failure rates may be higher when the leak suggest system deterioration—and mitigation—the leak, having occurred despite mitigation, informs the assessment of mitigation effectiveness.

Sympathetic Failures

Note that CoF mitigation plays a measurable role in PoF reduction through avoidance of secondary damages. That is, reducing the hazard area from event 1 prevents event 2, 3, 4, etc. where subsequent events are avoided by fire suppression systems, depressurizations, secondary containment, blast walls, etc. Especially in complex facilities, each component’s PoF will include its neighbor’s PoF scenarios that can generate sufficient forces, including thermal effects, to cause sympathetic failures.

Measuring CoF Mitigation

Much discussion on consequence mitigation is offered in the following sections. Note however, that the assessment of such capabilities is straightforward. This is done by measuring (quantifying) and including in the risk assessment, the ability to reliably minimize the area of exposure or exposure time.

In other words, the assessor accounts for the abilities of the mitigation measures to reduce the hazard zone itself or to minimize damages to receptors within the hazard zone. Specifically, this involves the quantification of one or more of the following aspects:

• • • Reduction in spill volume
    • Reduction is release dispersion
    • Fewer receptors harmed
    • Less harm to exposed receptors.

Especially for the first two, the quantification can be based on robust calculations. For example, the role of extra valves in reducing draining-by-gravity volumes can be calculated and the leak detection/reaction capabilities can be assessed at all points along the pipeline as a function of instrumentation, ability to stop flows, and abilities to mobilize and execute loss-minimizing reactions. In other cases, only assumptions and judgments may be available. Realistically, the assessor will sometimes have to simply estimate a percentage reduction, based on the perceived effectiveness and reliability of the mitigation. For example, if emergency response is thought to reduce receptor damages that would otherwise occur, the quantification may be the result of examinations of scenarios to estimate amount of receptor protections afforded by actions such as evacuation, rapid boom deployment, removal of ignition sources, etc. these actions will be very much location- and incident-specific, making general estimates especially uncertain.

Even if the quantification is imprecise, the estimation exercise is important. The quantification puts a value on the emergency response, leak detection, secondary containment, etc, thereby providing the ‘benefit’ portion of cost/benefit analyses for these measures. Different mitigation measures will have different benefits (and costs) at various potential spill locations along a pipeline. The cost/benefit all along a pipeline guides decision-makers in risk management. Even when imprecise, the quantifications demonstrate a defensible, process-based approach to understanding and therefore managing risk.

Reduction measures are valued in the same way as mitigation measures in PoF. Two questions are asked and answered in performing the valuation—‘how effective can the measure be if it is done as well as can be imagined’? and then, ‘how well is it being done in the situation being assessed?’ in measuring the effectiveness, ‘probability of success’ will need to be considered, since many measures. The reduction may be expressed as a reduced damage state—a fraction of the damage that would otherwise occur.

As with PoF measurements, it is most efficient to compartmentalize events (exposures) from mitigations. This means that the hazard zone associated with the unmitigated event should first be estimated. Then, that theoretical hazard zone may be reduced by mitigation measures. For instance, the spill footprint is first estimated as if no temporary spill containment measurements occur. Then, the reductions in area due to emergency response, secondary containment, etc are estimated. (An exception is leak detection and isolation time capabilities which are, for practical reasons, normally a part of the initial spill size determination rather than an imagined scenario of infinite leak rate and duration.)

Similarly, the receptor damages should be first estimated as if no protections were in place. Then, reductions to the theoretical receptor damages may be afforded by protections. Shielding and reduction in exposure time (perhaps by enhanced escape opportunities through early warning and/or rapid evacuation) are examples of protection opportunities for human receptors.

If the hazard zone is created directly from a threshold intensity—thermal radiation or overpressure level, for example—then receptor protection can be evaluated separately and used to reduce the modeled hazard zone that would otherwise occur.

Note the partial overlap in emergency response actions. This is due to the fact that, in some cases, the same action may reduce the hazard area while in other cases, the hazard area is unaffected but the receptor damage potential within the area is reduced. The distinction is somewhat esoteric since loss limiting actions mostly reduce the receptor exposure duration and the hazard area boundary already implicitly includes duration of exposure (thermal or toxic) considerations.

The following consequence-reducing opportunities are common:

• • • Hazard Area Limiting Actions
    • Secondary containment
    • Suppression systems
    • Detection (leak, fire, concentrations, etc.)
    • Emergency response (temporary secondary containment, shielding, removal of ignition sources, intentional ignition, dilution, suppression, etc.)
    • Loss limiting actions
    • Detection
    • Emergency Response (evacuations, removal of ignition sources, intentional ignition, other exposure duration reductions)

Spill volume/dispersion limiting actions

Reductions in spill size are made by reducing the product containment volume in the case of volume-dependent spills, and by reducing the source rate (e.g., pressure, density, hole, time-to-detect) in the case of rate-dependent spills. Smaller volumes that can potentially be released, for example, smaller vessel, or smaller leak rates, for example, lower pressure, smaller holes, reduce spill sizes. Note that improvements in leak detection also effectively reduce the source, in the leak-rate dependent case.

Secondary containment and emergency response, especially leak detection/reaction, are considered to be risk mitigation measures that minimize potential consequences by minimizing product leak volumes and/or dispersion. The effectiveness of each varies depending on the type of system being evaluated.

This opportunity for consequence reduction includes leak detection/reaction and is often the most realistic way for the operator to reduce the consequences of a pipeline failure. Some common approaches to limiting spill volumes are discussed below.

Pipeline Isolation Protocols

The ability to quickly isolate leaks and reduce volume to a leak location are logically important consequence minimizations. Sequencing of pipeline isolation can be important to spill size estimations. To minimize release volumes in the event of a leak, the pressure at the leak location must be minimized as quickly as possible. This is accomplished by halting all sources of pressure and allowing the leak location to depressure as rapidly as possible. Providing an alternative flow path—other than through the integrity breach—assists in the depressurization. In many leak scenarios, therefore, maintaining an alternate flow path away from the leak minimizes consequences.

Elevation profiles and hole size also play an important role in isolation protocols for liquid pipelines. Leaks in low spots or in the rare scenario where the pipe is completely separated may be worsened by attempts to maintain an open flow path away from the leak.

It may therefore be difficult to quickly ascertain the optimal action to take. While larger and more rapid changes in monitored points such as flow and pressure are associated with large leak events, the guillotine rupture type of event—where all flow paths should be quickly closed—is largely indistinguishable—from a remote control center or even from the leak site itself—from a larger leak where maintaining the alternative flow path is beneficial.

A downstream flow meter (or manual observation) accurately indicating that no flow is passing the leak site would be the most compelling evidence that full isolation is appropriate.

Isolation must also consider surge potential. In certain circumstances, damages could be caused to other parts of the pipeline while trying to minimize the consequences of a leak in progress. This is readily avoided by commonly used surge prevention equipment. See full discussion of surge potential as a contributor to pipeline PoF in .

Valving

This is especially true for incompressible fluids transported in pipelines.

Two key components of a release volume from a liquid line are (1) the continued pumping that occurs before the line can be shut down and (2) the liquid that drains from the pipe after the line has been shut down. The former is only minimally impacted by additional isolation capability—perhaps only helping to stop momentum effects from pumping if a valve is rapidly closed (but potentially generating threatening pressure waves). The main role of additional isolation capabilities, therefore, seems to be in reducing drain volumes. Because a pipeline is a closed system, hydraulic head and/or a displacement gas is needed to affect line drainage. Hilly terrain can create natural check valves that limit hydraulic head and gas displacement of pipeline liquids.

Faster response scenarios may include valves that automatically isolate a leaking pipeline section based on continuously monitored parameters that indicate a leak. However, in real applications, the value of such valves and the practicality of such automation is often uncertain. The use of valves as spill limiting equipment are discussed below:

A. Automatic and/or remotely operated valves. Automatic valves are often triggered on low pressure, high pressure, high flow, rate of change of pressure or flow, or more complex combinations of these. This includes automatic shutoffs of pumps, wells, and other pressure sources. Regular maintenance is required to ensure proper operation. Experience warns that this type of equipment is often plagued by false trips from transient conditions, nearby electrical storms, and other system or environment causes. Such valve actuations may create additional stresses such as surge pressures in addition to unnecessary supply interruptions. Avoidance of false triggers is sometimes accomplished by setting relatively insensitive response trigger points, thereby reducing the automation reaction time and the benefits sought.

Check valves are another form of automatic valves and play an important spill-reducing role in some systems. A check valve might be especially useful for liquid lines with elevation changes. Strategically placed check valves may reduce the draining or siphoning to a spill at a lower elevation.

B. Valve spacing. Closer valve spacing logically provides a benefit in reducing the spill amount in many scenarios. Spacing benefits must be coupled with the most probable reaction time in closing those valves since valves may be near to a leak sites but lack a quick activation time (for example, manual valves that are difficult to access or slow to operate). Many countries’ regulations require valves be placed within certain distances, sometimes related to receptors such as population densities (US natural gas transmission pipeline valve maximum permissible spacings are a function of population density) or water bodies (US hazardous liquid pipelines). Regulations also commonly require situation-specific analyses to determine when additional valves or improvements in valve swiftness of operation is warranted. Regulations using ALARP have such considerations implicitly required.

Concerns with the use of additional block valves include costs and increased system vulnerabilities from malfunctioning components and/or accidental closures, especially where automatic or remote capabilities are included. For unidirectional pipelines, check valves (preventing backflow) can provide some consequence minimization benefits. Check valves respond almost immediately to reverse flow and are not subject to most of the incremental risks associated with block valves since they have less chance of accidental closure due to human error or, in the case of automatic/remote valves, failure due to system malfunctions. Their failure rate (failure as unwanted closure or failure to close when needed) can be considered against benefits provided.

Studies of possible benefits of shorter distances between valves of any type produce mixed conclusions. Evaluations of previous accidents can provide insight into possible benefits of closer valve spacing in reducing consequences of specific scenarios. By one study of 336 liquid pipeline accidents, such valves could, at best, have provided a 37% reduction in damage [76]. Offsetting potential benefits is the often substantial costs of additional valves and the increased potential for equipment malfunction, which may increase certain risks (surge potential, customer interruption, etc.). Rusin and Savvides-Gellerson [76] calculate that the costs (installation and ongoing maintenance) of additional valves would far outweigh the possible benefits, and also imply that such valves may actually introduce new hazards.

More recent work presents findings that also might be useful to the risk assessor. A 2012 study [1015] focusing on full ruptures with subsequent ignition (of transmission pipeline carrying natural gas and using propane as the worst-case hazardous liquid scenario) plus a spill scenario of unignited crude oil, concluded the following:

Natural Gas

• • “… block valves have no influence on the volume of natural gas released during the detection phase…”
  • “Fire damage to buildings and personal property located in Class 1, Class 2, Class 3, and Class 4 HCAs resulting from natural gas combustion immediately following guillotine-type breaks in natural gas pipelines is considered potentially severe for all areas within 1.5 to 1.7 times the PIR.”
  • “Without fire fighter intervention, the swiftness of block valve closure has no effect on mitigating potential fire damage to buildings and personal property in Class 1, Class 2, Class 3, and Class 4 HCAs resulting from natural gas pipeline releases.”
  • “Block valve closure swiftness also has no effect on reducing building and personal property damage costs.”
  • “The benefit in terms of cost avoidance is based on the ability of fire fighters to mitigate fire damage to buildings and personal property located within a distance of approximately 1.5 times the PIR by conducting fire fighting activities as soon as possible upon arrival at the scene.”
  • “The study results further show that for natural gas release scenarios, block valve closure within 8 minutes after the break can result in a potential cost avoidance of at least $2,000,000 for 12-in nominal diameter natural gas pipelines and $8,000,000 for 42-in nominal diameter natural gas pipelines depending on the configuration of buildings within the Class 3 HCA.”
  • “Delaying block valve closure by an additional 5 minutes can reduce the cost avoidance by approximately 50%.”

Hazardous Liquids^[4] with Ignition

• • “The effectiveness of block valve closure swiftness on limiting the spill volume of a release is influenced by the location of the block valves relative to the location of the break, the pipeline elevation profile between adjacent block valves, and the time required to close the block valves after the break is detected and the pumps are shut down.”
  • “Fire damage to buildings and personal property in a HCA resulting from liquid propane combustion immediately following guillotine-type breaks in hazardous liquid pipelines is considered potentially severe for a radius up to 2.6 times the equilibrium diameter.”^[5] “These conclusions are based on computed heat flux versus time data for liquid propane pipelines with nominal diameters ranging from 8 to 30 in. and operating pressures ranging from 400 psig to 1,480 psig.”
  • “The benefit in terms of cost avoidance for damage to buildings and personal property attributed to block valve closure swiftness increases as the duration of the block valve shutdown phase decreases. Risk analysis results for a hypothetical 30-in. nominal diameter hazardous liquid pipeline release of liquid propane show that the estimated avoided cost of moderate building and property damage resulting from block valve closure in 13 rather than 70 minutes is over $300,000,000.”

Hazardous Liquids without Ignition

• • “The swiftness of block valve closure has a significant effect on mitigating potential socioeconomic and environmental damage to the human and natural environments resulting from hazardous liquid pipeline releases because damage costs increase as the spill size increases. The benefit in terms of cost avoidance for damage to the human and natural environments attributed to block valve closure swiftness increases as the duration of the block valve shutdown phase decreases.”
  • “The damage cost for crude oil released in the Enbridge Line 6B pipeline rupture in Marshall, Michigan in 2010 was approximately $38,000 per barrel. “
  • “It is also important that inadvertent block valve closure does not occur. It is undesirable to disrupt service to critical customers, and also sudden block valve closure that occurs inadvertently may cause a pressure surge that could damage equipment.”

Note that cost and benefit conclusions are incomplete here since benefits expressed on a per incident basis do not provide the complete story. The frequency of incidents is also needed before meaningful conclusions can be drawn. While the conclusions and analyses in this study are interesting, they have used many assumptions that may not be appropriate in many applications. The emphasized point that location-specific characteristics can readily invalidate the underlying assumptions, points to the need to consider more than these conclusions in a risk assessment.

Sensing devices.

Part of response time is the first opportunity to take action. This opportunity depends on the sensitivity of the leak detection. All leak detection will have an element of uncertainty, from the possibility of crank phone calls to the false alarms generated by instrumentation failures or instrument reactions to pipeline transients. This uncertainty must also be included in reaction times.

Reaction times

If a human intervention is required to initiate the proper response, this intervention must be assessed in terms of timeliness and appropriateness. A control room operator must often diagnose the leak based on instrument readings transmitted to him. How quickly he can make this diagnosis depends on his training, his experience, and the level of instrumentation that is supporting his diagnosis. Probable reaction times can be judged from mock emergency drill records when available. If the control room can remotely operate equipment to reduce the spill size, the reaction time is improved. Travel time by first responders must otherwise be factored in. If the pipeline operator has provided enough training and communications to public emergency response personnel so that they may operate pipeline equipment, response time may be improved, but possibly at the expense of increased human error potential. Public emergency response personnel are probably not able to devote much training time to a rare event such as a pipeline failure. If the reaction is automatic (computer-generated valve closure, for instance) a sensitivity is necessarily built in to eliminate false alarms.

Secondary containment

Hazard area is reduced when secondary containment is present. The greater the leak or receptor isolation offered by secondary containment, the footprint within which damages can occur. Secondary containment benefit is usually proportional to the size of the effective area it protects.

Opportunities to contain or limit the spread of a release can be considered here. These opportunities include:

• • • Natural barriers or accumulation points
    • Casing pipe, pipe-in-pipe designs
    • Tunnels
    • Lined trench
    • Berms or levees
    • Containment systems
    • Impervious/ Semipervious liner
    • Immediate fill indication
    • Overflow alarms
    • Double-walled tanks
    • Reducing Receptor Contact Times
    • Fire suppression system Deluge system foam systems, water curtains
    • Depressurization systems (for example, flares) dump/blowdowns.

Limited secondary containments such as pump seal vessels and sumps are designed to capture specific leaks. As such they provide risk reduction for a limited range of scenarios.

Many secondary containment opportunities apply only to liquid releases and are found at stations. The presence of secondary containment can be considered as an opportunity to reduce (or eliminate) the “area of opportunity” for consequences to occur—fewer exposed receptors.

Secondary containment can be evaluated in terms of its ability to:

• • • Contain the majority of all foreseeable spills scenarios.
    • Contain 100% of a potential spill plus firewater, debris, or other volume reducers that might compete for containment space—largest tank contents plus 30 minutes of maximum firewater flow is sometimes used [26].
    • Contain spilled volumes safely—not exposing additional equipment to hazards.
    • Contain spills until removal can be effected—no leaks.

Note that ease of cleanup of the containment area is a secondary consideration (business risk).

Within station limits, the drainage of spills away from other equipment is important. A slope of at least 2% (1% on hard surfaces) to a safe impoundment area of sufficient volume is seen as adequate. [26]

Some secondary containment designs provide a great deal of additional risk reduction benefits, beyond their role in preventing dispersion of releases. Pipe-in-pipe designs and installations in tunnels often support continuous and improved leak detection, improved inspectability, reduced threats from external forces and corrosion, etc, all in addition to the important secondary containment benefits. They are not, however, free from practical challenges including very high initial costs and additional maintenance requirements.

Where man-made secondary containment exists, or it is recognized that special natural containment exists, the evaluator can adjust the hazard area accordingly.

Leak detection

Leak detection capabilities

Including leak detection and emergency response considerations impacts the volumes released and adds an important level of resolution to any risk analysis. Their inclusion also provides a way to assign values to this largely-discretionary risk reduction measures. By quantifying the avoided potential losses (expected loss valuations), the costs of new systems or enhancements to existing systems can be justified.

It is especially important to consider leak detection capabilities for scenarios involving toxic or environmentally persistent products. In those cases, a full line rupture might not be the worst case scenario. Slow leaks gone undetected for long periods can be more damaging than massive leaks that are quickly detected and addressed.

The ability to detect smaller leaks is important since the smaller leaks tend to be more prevalent and can also be very consequential. The negative impact of smaller leaks often far exceed the scale predicted by a simple proportion to leak rate. For example, a 1gal/day leak detected after 100 days is often far worse than a 100gal/day leak rate detected in 1 day, even though the same amount of product is spilled in either case. Unknown and complex interactions between small spills, subsurface transport, and groundwater contamination, as well as the increased ground transport opportunity, account for increased chronic hazard in many scenarios.

Leak detection and vapor dispersion

Leak detection plays a relatively minor role in minimizing consequence in most scenarios of gas pipelines large leaks or ruptures. Therefore, many large gas release scenarios will not be significantly impacted by any assumptions relative to leak detection capabilities. This is especially true when defined damage states use short exposure times to thermal radiation, as is often warranted.

Gas pipeline release hazards depend on release rates which in turn are governed by pressure and hole size. In the case of larger releases, the pressure diminishes quickly—more quickly than would be affected by any actions that could be taken by a control center. In the case of smaller leaks, pressures decline more slowly but ignition probability is much lower and hazard areas are much smaller. In general, there are few opportunities to evacuate a pressurized gas pipeline more rapidly than occurs through the leak process itself, when the leak rate is significant. A notable exception to this case is that of possible gas accumulation in confined spaces. This is a common hazard associated with urban gas distribution systems.

Another exception would be a scenario involving the ignition of a small leak that causes immediate localized damages and then more widespread damages as more combustible surroundings are ignited over time as the fire spreads. In that scenario, leak detection might be more useful in minimizing potential impacts to the public.

Leak detection and liquid dispersion

Leak detection capabilities play a larger role in liquid spills compared to gas releases. Long after a leak has occurred, liquid products can be detected because they have more opportunities for accumulation and are usually more persistent in the environment. A small, difficult-to-detect leak that is allowed to continue for a long period of time can cause widespread contamination damages, especially to aquifers. Therefore, the ability to quickly locate and identify even small leaks is critical for some liquid pipelines.

A leak detection capability curve can be used to establish the largest potential volume release.

Leak Detection and CoF

Leak detection can be seen as a critical part of emergency response. It provides early notification and allows more rapid response. Leak detection is considered a spill reducing opportunity aspect of emergency response.

The role of leak detection is evaluated in the determination of spill size and dispersion.

As discussed previously, leak size is partially dependent on failure mode. Small leak rates tend to occur due to corrosion (pinholes) or some other failure modes. The more damaging of these small leaks occur below detection levels and continue for long periods of time. Larger leak rates tend to occur under catastrophic failure conditions such as external force (e.g., third party, ground movement) and avalanche crack failures.

Larger leaks can be detected more quickly and located more precisely. Smaller leaks may not be found at all by some methods due to the sensitivity limitations. The trade-offs involved between sensitivity and leak size can be expressed in terms of probability of detection over time.

Computational pipeline monitoring (CPM) is a part of most modern transmission pipeline operations and includes leak detection capabilities ranging from rudimentary to extremely sophisticated. The specific method of CPM leak detection chosen depends on a variety of factors including the type of product, flow rates, pressures, the amount of instrumentation available, the instrumentation characteristics, the communications network, the topography, the soil type, and economics. Especially when sophisticated modeling is involved, there is often a trade-off between the sensitivity and the number of false alarms, especially in “noisy” systems with high levels of transients.

As is the case with other aspects of post-incident response, leak detection is thought to normally play a minor role, in reducing the hazard, reducing the probability of the hazard, or reducing the acute consequences. Leak detection can, however, play a larger role in reducing the chronic consequences of a release. As such, its importance in risk management for chronic consequence scenarios is more significant.

This is not to say that leak detection benefits that mitigate acute risks are not possible. One can imagine a scenario in which a smaller leak, rapidly detected and corrected, averted the creation of a larger, more dangerous leak. This would theoretically reduce the acute consequences by preventing the potentially larger leak. We can also imagine the case where rapid leak detection coupled with the fortunate happenstance of pipeline personnel being close by might cause reaction time to be swift enough to reduce the extent of the hazard. This would also impact the acute consequences. These scenarios are obviously limited and it is conservative to assume that leak detection has limited ability to reduce the acute impacts from a pipeline break. Increasing use of leak detection methodology is to be expected as modeling techniques become more refined and instrumentation becomes more accurate. As this happens, leak detection may play an increasingly important role, leak volume and leak rate are both critical determinants of dispersion and hence of hazard zone size. Leak rate is important under the assumption that larger rates cause more spread of hazardous product and higher thermal impacts (more acute impacts), and lower rates impact detectability (more chronic impacts). Leak volume is more important in chronic scenarios such as environmental cleanup. The rate of leakage multiplied by the time the leak continues is often the best estimate of total leak volume. Some potential consequences are more volume sensitive than leak-rate dependent. Spills from catastrophic failures or those occurring at pipeline low points are more volume dependent than leak-rate dependent. Such events are better assessed by leak volumes because the entire volume of a pipeline segment will often be involved, regardless of response actions.

Detection methodologies

Common methods of Pipeline leak detection are shown in PRMM. Each method has its strengths and weaknesses and an associated spectrum of capabilities.

Regular leakage surveys are routinely performed on hydrocarbon pipelines, (especially gas) systems in many countries. Hand-carried or vehicle-mounted sensing equipment is available to detect trace amounts of leaking gas in the atmosphere near the ground level. Such overline leak detection by instrumentation (sniffers), vehicle-based systems, or even by trained animals—usually dogs (which reportedly have detection thresholds far below instrument capabilities)–is an available technique. The effectiveness of leak surveys depends partly on environmental actors such as wind, temperature, and the presence of other interfering fumes in the area. Therefore, specific survey conditions and the technology used will make many evaluations situation specific. Pipeline patrolling and surveying can generally be made more capable of detection by adjusting observer training (the observer seeks visual indications of a leak such as dying vegetation, bubbles in water, or sheens on the water or ground surface), speed of survey or patrol, equipment carried (may include detection based on flame ionization detectors (FID), thermal conductivity, infrared sensors, laser-based detection systems, etc.), altitude/speed of air patrol, training of ground personnel, and allowing for specific topography, ROW conditions, product characteristics, weather—both current and, for instance, recent rainfall, etc. Although the capabilities of direct observation techniques are inconsistent, experience shows them to still play a viable role in leak detection, computer-based leak detection methods require instrumentation and computational analysis. A common type of pipeline leak detection employs SCADA-based capabilities of monitoring of pressures, flows, temperatures, equipment status, etc. plus balancing flows in and out of segments. SCADA and control center procedures might call for a leak detection investigation when (1) abnormally low pressures or an abnormal rate of change of pressure is detected; and (2) a flow balance analysis, in which flows into a pipeline section are compared with flows out of the section and discrepancies are detected. SCADA-based alarms can be set to alert the operator of such unusual pressure levels, differences between flow rates, abnormal temperatures, or equipment status (such as unexplained pump/compressor stops).

SCADA-based capabilities are commonly enhanced by computational techniques that use SCADA data in conjunction with mathematical algorithms to analyze pipeline flows and pressures on a real-time basis. Some use only relatively simple mass-balance calculations, perhaps with corrections for linefill. More robust versions add conservation of momentum calculations, conservation of energy calculations, with considerations for fluid properties, instrument performance, using a host of sophisticated equations to characterize flows, including transient flow analyses. The nature of the operations will impact leak detection capabilities, with more less steady flows and more compressible fluids reducing the capabilities.

The more instruments (and the more optimized the instrument locations) that are accurately transmitting data into the SCADA-based leak detection model, the higher the accuracy of the model and the confidence level of leak indications. Ideally, the model would receive data on flows, temperatures, pressures, densities, viscosities, etc., along the entire pipeline length. By tuning the computer model to simulate mathematically all flowing conditions along the entire pipeline and then continuously comparing this simulation to actual data, the model tries to distinguish between instrument errors, normal transients, and leaks. Depending on the system characteristics, relatively small leaks can often be accurately located in a timely fashion. How small a leak and how swift a detection is specific to the situation, given the large numbers of variables to consider. Refs [3] and [4] discuss these leak detection systems and methodologies for evaluating their capabilities.

Another computer-based method is designed to detect pressure waves. A leak will cause a negative pressure wave at the leak site. This wave will travel in both directions from the leak at high speed through the pipeline product (much faster in liquids than in gases). By simply detecting this wave, leak size and location can be estimated. A technique called pressure point analysis (PPA) detects this wave and also statistically analyzes all changes at a single pressure or flow monitoring point. By statistically analyzing all of these data, the technique can reportedly, with a higher degree of confidence, distinguish between leaks and many normal transients as well as identify instrument drift and reading errors. Ultrasonic leak detectors—in which instrumentation is used to detect the sonic energy from an escaping product are used in permanent and pig-based applications.

Another method of leak detection involves various methods of continuous direct detection of leaks immediately adjacent to a pipeline. One variation of this method is the installation of a secondary conduit along the entire pipeline length. This secondary conduit is designed to sense leaks originating from the pipeline. The secondary conduit may take the form of a small-diameter perforated tube, installed parallel to the pipeline, which allows vapor samples to be drawn into a sensor that can detect the product leaks. Variations on this type of system can detect temperature changes or react specifically to certain hydrocarbons, based on electrical conductivity or other characteristics. Floating hydrocarbon sensors used at river crossings and other offshore locations fall into this method. Use of hydrocarbon sensors, ‘fire eyes’, and other above-ground, atmospheric-based sensing systems are also included here.

Additional leak detection methods include the following:

• • Subsurface detector survey—in which atmospheric sampling points are found (or created) near the pipe. Such sampling points include manways, sewers, vaults, other conduits, and holes excavated over the pipeline. This technique may be required when conditions do not allow an adequate surface survey (perhaps high wind or surface coverage by pavement or ice). A sampling pattern is usually designed to optimize this technique.
  • Pressure loss test—in which an isolated section of pipeline is closely monitored for loss of pressure, indicating a leak.
  • Bubble leakage—used on exposed piping, the bubble leakage test in one in which a bubble-forming solution can be applied and observed for evidence of gas leakage.

In a pipe-in-pipe design, where an exterior pipe totally encloses the product pipeline, the annular space can be continuously monitored for leaks. This emergency response improvement supplements the secondary containment benefits. Furthermore, PoF benefits include enhanced protection from external forces and corrosive environments. Therefore, both Pof and CoF reductions are achieved by such designs. Pipelines in tunnels offer similar advantages, often with the additional benefit of improved inspectability. These systems are much more expensive than conventional designs, can cause a host of logistical problems, and are usually not employed except on short lines. Their impact on risk reduction can be dramatic, however. See discussion under Secondary Containment.

Offshore, a small amount of spilled hydrocarbon is not always easy to visually spot, especially from moving aircraft. A variety of sensing devices have been or are being investigated to facilitate spill detection. Detection methods proposed or in use include infrared, passive microwave, active microwave, laser-thermal propagation, laser acoustic sensors [78], and sonar-based technologies. Some of these technologies offer the opportunity for continuous monitoring with automatic notifications, thereby improving response times.

Gas odorization

As a special leak detection and early warning system for most natural gas and LPG distribution systems, gas odorization warrants further discussion. Methane has very little odor detectable to humans. Natural gas is mostly methane and will therefore be odorless unless an artificial odorant is introduced. It is common practice to inject an odorant so that gas will be detected at levels far below the lower flammable limit of the gas in air mixture—often one-fifth of the flammable limit. This means that accumulations of 5 times the detection level are required before fire or explosion is possible. This allows early warning of a gas pipe leak and reduces the potential for human injury.

A 1937 incident in New London, TX is often cited as the beginnings of the widespread use of odorization (even though it had been used in Germany as early as 1880). In this incident, a school house filled with undetectable natural gas, ignited, exploded, and resulted in 239 fatalities. In the US, odorization is always required in distribution systems and sometimes for transmission pipelines also [1008].

With the increased opportunity for leaked products to accumulate beneath pavement, in buildings, and in other dangerous locations and with the higher population densities seen in hydrocarbon distribution systems, special risk reduction provisions are warranted. One of the primary means of leak detection for gas distribution is the use of an odorant in the gas to allow people to smell the presence of the gas before flammable concentrations are reached.

Odorization system design

Aspects of optimum system design include selection of the proper odorant chemical, the proper dosage to ensure early detection, the proper equipment to inject the chemical, the proper injection location(s), and the ability to vary injection rates to compensate for varied gas flows. Ideally, the odorant will be persistent enough to maintain required concentrations in the gas even after leakage through soil, water, and other anticipated leak paths. The optimum design will consider gas flow rates and the potential for odor fade to ensure that gas at any point in the piping is properly odorized. Fade can occur through absorption of the odorant in some pipe materials, for example, new steels, especially for larger diameter, longer lengths. When new piping is placed in service, “over-odorizing” for a period of time is sometimes done to ensure adequate odorization. When gas flows change, odorant injection levels must be changed appropriately. Testing should verify odorization at the new flow rates. Odorant removal (de-odorization) possibilities should be minimized, even as gas permeates through soil or water. Odor desensitization and disguise by other environmental odors also impact the odorization program’s ability for early alert.

System operation/maintenance

Odorant injection equipment is best inspected and maintained according to well-defined, thorough procedures. Trained personnel should oversee system operation and maintenance. Inspections should be designed to ensure that proper detection levels are seen at all points on the piping network. Provisions are needed to quickly detect and correct any odorization equipment malfunctions.

Performance

Evidence should confirm that odorant concentration is effective (provides early warning to potentially hazardous concentrations) at all points on the system. Odorant levels are often confirmed by tests using human subjects who have not been desensitized to the odor. Gas odorization can be a more powerful leak detection mechanism than many other techniques discussed. While it can be argued that many leak survey methods detect gas leaks at very low levels, proper gas odorization has the undeniable benefits of alerting the right people (those in most danger) at the right time.

Odorization Assessment

The role that a given gas odorization effort plays as a consequence reducer depends on the reliability of the system and the fraction of incidents whose consequence are reduced and by what amount.

High-reliability odorization—99%+ reliability, a segment without effective odorization is extremely rare, occurring perhaps once every 0.001 mile-years. The likelihood of an unodorized segment coinciding with a leak location would therefore be very improbable. Qualitative descriptors associated with a high reliability system would typically include the following:

• • • A modern or well-maintained, well-designed system exists. There is no evidence of system failures or inadequacies of any kind. Extra steps (above regulatory minimums) are taken to ensure system functionality. Also falling into this category is a consistent, naturally occurring odor in a product stream that allows early detection of a hazardous vapor, if the odor is indeed a reliable, omnipresent factor.
    • Reduced reliability may be associated with scenarios such as:
    • Where an odorization system exists and is minimally maintained (by minimum regulatory standards, perhaps) but the evaluator does not feel that enough extra steps have been taken to make this a high-reliability system, the assessment may show reduced reliability.
    • Questionable odorization system may be associated with scenarios such as:
    • A system exists; however, the evaluator has concerns over its reliability or effectiveness. Inadequate record keeping, inadequate maintenance, lack of knowledge among system operators, and inadequate inspections would all indicate this condition. A history of odorization system failures would be even stronger evidence.
    • Absence of odorization means the assessed distribution system is carrying higher potential consequences, compared to otherwise equivalent systems.

A formal event tree or fault tree analysis can be used to estimate the fraction of leaks whose consequence scenarios may be reduced by odorization. Experience has shown that the fraction is fairly high. It may be difficult to, even in an imagineering exercise, separate this factor since it has been a part of most distribution system transportation for so long. Scenarios of un-odorized gas would rely on naturally occurring odors as well as sound and sight indications of nearby leaks. Such indications would not be universally recognized and may even invite investigation, putting persons at increased risk.

Given the location- and situation-specific benefits derived from odorization, as well as the ample margin between detection levels and flammability levels, human injury/fatality reduction estimates of over 90% or even 99% compared to un-odorized systems would not seem unreasonable. Such values suggest that in only one in ten to one in one hundred incidents would exposed populations not be alerted to the danger and subsequently be able to reduce their chance of harm.

Facilities

Hydrocarbon stations often have several levels of monitoring systems (e.g., relief device, tank overfill, tank bottom, seal piping, and sump float sensors/alarms), operations systems (e.g., SCADA, flow-balancing algorithms), secondary containment (e.g., seal leak piping, collection sumps, equipment pad drains, tank berms, stormwater controls), and emergency response actions. Therefore, small liquid station equipment-related leaks are designed to be detected and remedied before they can progress into large leaks. If redundant safety systems fail, larger spills can often be detected quickly and contained within station berms. Where a leaking liquid can accumulate under or be rinsed from station facilities, stormwater (prior to discharge) or groundwater can be gathered and sampled for hydrocarbon contamination, enabling the detection of very small leaks.

Gaseous product pipeline stations often control compressor or pressure relief discharges by venting the gas through a vent stack within the station. In the case of high-pressure/volume releases, large-diameter flare stacks (with a piloted ignition flame) combust vented gases into the atmosphere. Gas facilities are normally leak checked periodically and remotely monitored for equipment or piping leaks.

Evaluation of leak detection capabilities

The most suitable method of leak detection depends on a variety of factors including the type of product, flow rates, pressures, the amount of instrumentation available, the instrumentation characteristics, the communications network, the topography, the soil type, and economics. Some systems are designed or calibrated for certain leak rates or spill volumes, with reduced sensitivities for leaks outside of their optimum ranges. Multiple systems, offering redundancy and/or capabilities to detect wider ranges of leak rates, are common. As previously mentioned, when highly sophisticated instruments are employed, a trade-off often takes place between the sensitivity and the number of false alarms, especially in “noisy” systems with high levels of transients.

The operator’s use of established procedures to positively locate a leak can be included in this evaluation. Follow-up actions including the use of leak rates to assess system integrity and the criteria and procedures for leak repair should also be considered.

In assessing the potential benefits—consequence mitigation in the form of spill volume reduction—from leak detection, some conclusions from a detailed study are relevant.

1. 1. 1. The pipeline controller/control room identified a release occurred around 17% of the time.
      2. Air patrols, operator ground crew and contractors were more likely to identify a release than the pipeline controller/control room.
      3. An emergency responder or a member of the public was more likely to identify a release than air patrols, operator ground crew and contractors.
      4. A CPM LDS was the leak identifier in 17 (20%) out of 86 releases where a CPM system was functional at the time of the release.
      5. SCADA was the leak identifier in 43 (28%) out of 152 releases where a SCADA was functional at the time of the release.
      6. For hazardous liquid pipelines, SCADA or CPM systems by themselves did not appear to respond more often than personnel on the ROW or members of the public passing by the release incident.
      7. It appeared that procedures may have allowed alarms to be ignored by controllers in several of the larger volume releases or to re-start pumps or open a valve, thus aggravating the size of the release.
      8. Large distances between block valves may also have been a contributory factor in the size of the release. (Kiefner)

[1011]

The evaluator should assess the nature of leak detection abilities in the pipeline section he is evaluating. The assessment should include:

• • What size leak can be reliably detected
  • How long before a leak is positively detected
  • How accurately can the leak location be determined.

A leak detection capability can be defined as the relationship between leak rate and time to detect. This relationship encompasses both volume-dependent and leak-rate-dependent scenarios. The former is the dominant consideration as product containment size increases (larger diameter pipe at higher pressures), but the latter becomes dominant as smaller leaks continue for long periods.

As shown in , this relationship can be displayed as a curve with axes of “Time to Detect Leak” versus “Leak Size.” The area under such a curve represents the worst case spill volume, prior to detection. The shape of this curve is logically asymptotic to each axis because some leak rate level is never detectable and an instant release of large volumes approaches an infinite leak rate.

Many leak detection systems perform best for only a certain range of leak sizes and therefore require independent evaluation. Overlapping leak detection capabilities are usually present in a pipeline, often with reliance on equipment and instruments located in stations. In assessing station leak detection capabilities, all opportunities to detect can be considered producing curves for each type of leak detection as well as for the combined capabilities at the station. A leak detection capability curve can be developed by estimating, for each pipeline component, the leak detection capabilities of each available method for a variety of leak rates. A listing of leak rates is first created. For each leak rate, each detection system’s time to detect is estimated. When a detection system reacts at a certain spill volume, then various leak rate-duration pairings will result in that system being triggered. For instance, if a detection system responds when 10 gallons of leak volume is present (perhaps a hydrocarbon sensor in a sump), then that system reacts when a 1 gallon/hr leak persists for 10 hrs, or a 0.5 gallon/min leak persists for 20 minutes, etc.

In assessing leak detection capabilities, all opportunities to detect should be considered. Therefore, all leak detection systems available should be evaluated in terms of their respective abilities to detect various leak rates. A matrix can be used for this.

Refs [3] and [4] discuss SCADA-based leak detection systems and offer methodologies for evaluating their capabilities. Other techniques will likely have to be estimated based on time between observations and the time for visual, olfactory, or auditory indications to appear. The latter will be situation dependent and include considerations for spill migration and evidence (soil penetration, dead vegetation, sheen on water, etc.). The total leak time will involve detection, reaction, and isolation time.

As a further evaluation step, an additional column can be added to the matrix for estimates of reaction time for each detection system. This assumes that there are differences in reactions, depending on the source of the leak indication. Reaction time includes estimates of how long it would take to isolate and contain the leak, after detection. This recognizes that some leak detection/reaction opportunities, such as 24–7 staffing of a station, provide for more immediate reactions compared to patrol or off-site SCADA monitoring. A series of SCADA alarms will perhaps generate more immediate reaction than a passerby report that is lacking in details and/or credibility. The former scenario has an additional advantage in reaction, since steps involving telephone or radio communications may not be part of the reaction sequence. Such considerations can be factored into assessments that place values on various leak detection methodologies.

In Germany, the Technical Rule for Pipeline Systems (TRFL) covers:

• • • Pipelines transporting flammable liquids.
    • Pipelines transporting liquids that may contaminate water, and
    • Most pipelines transporting gas.

It requires these pipelines to implement an LDS, and this system must at a minimum contain these subsystems:

• • Two independent LDS for continually operating leak detection during steady state operation. One of these systems or an additional one must also be able to detect leaks during transient operation, e.g. during start-up of the pipeline.

These two LDS must be based upon different physical principles.

• • • One LDS for leak detection during shut-in periods.
    • One LDS for small, creeping leaks.
    • One LDS for fast leak localization.

Most other international regulation is far less specific in demanding these engineering principles. It is very rare in the U.S. for an operator to implement more than one monolithic leak detection system.

Facility Staffing

Staffing, as a means of leak detection, is seen to supplement and partially overlap any other means of leak detection that might be present. As such, the staffing level leak detection can be combined with other types of leak detection. The benefit is normally more of a redundancy rather than an increased sensitivity. This recognizes the benefit of a secondary system that is as good or almost as good as the first line of defense, with diminishing benefit as the secondary system is less effective.

An simple approach to evaluating the staffing level as it adds leak detection capability is to consider the maximum interval in which the station is unmanned, ie, the time that staffing as leak detection is unavailable:

Leak detection capability = maximum interval unobserved

This is basing the capability on the worst case detectability. As an opportunity to detect and react to a leak, the staffing level of a facility can be more fully evaluated by considering the following relationship:

Opportunity to detect = [(inspection hours) + (happenstance detection)]

Where

Inspection hour = an inspection that occurs within each hour

Happenstance detection = % of manned time per week.

In this relationship, it is assumed that station personnel would have a certain % chance of detecting any size leak while they were on site. This is of course a simplification since some leaks would not be detectable and others (larger in size) would be 100% detectable by sound, sight, or odor. Additional factors that are ignored in the interest of simplicity include training, thoroughness of inspection, and product characteristics that assist in detectability.

The maximum unobserved interval method is simple, but it appears worthwhile to also consider the slightly more complicated “opportunity” method, since the “max interval” method ignores the benefit of actions taken while a station is manned, that is, while performing formal inspections of station equipment—rounds. The “opportunity” method shows benefits that more closely agree with the belief that more directed attention during episodes of occupancy (performing inspection rounds) are valuable.

Various ‘staffing of stations’ scenarios can be evaluated in terms of their leak detection contributions and those contributions can be a part of the overall risk assessment. A drawback of an incomplete “opportunity” scheme would be the inability to show preference of a 1 hr per day / 5 days per week staffing protocol over a 5 hours / 1 day per week protocol, even though most would intuitively believe the former to be more effective. A 7–24 staffing arrangement, with formal inspection rounds, logically has leak detection capabilities far superior to than a weekly station visit.

Added to the detection time is the reaction time, which is generally defined as the amount of additional time that will probably elapse between the strong leak indication and the isolation of the leaking facility (including drain downtime). Here, consideration can be given to automatic operations, remote operations, proximity of shutdown devices, etc. Benefits of remote and automatic operations as well as staffing levels should be captured in the risk assessment.

Emergency response

Emergency response, as used here, focuses on on-site actions taken during the unfolding of a pipeline release. Leak detection, leak isolation, and automatic/semi-automatic equipment available to reduce hazard areas are included in the assessment elsewhere, as previously discussed.

Emergency response effectiveness in reducing hazard zones and damage rates can be assessed by first recognizing the two different ways that such actions impact consequence scenarios. The first is reducing hazard areas—normally by spill volume reductions—and the second is limiting losses within the hazard zone.

Reducing Damage Potential

As noted previously, the area of opportunity can sometimes be limited by protecting or removing vulnerable receptors, by removing possible ignition sources, or by limiting the extent of the spilled product.

A. Evacuation. Under the right conditions, emergency response personnel may be able to safely evacuate receptors (usually people) from the hazard area. To do this, they must be trained in pipeline emergencies. This includes having pipeline maps, knowledge of the product characteristics, communications equipment, and the proper equipment for entering to the danger area (breathing apparatus, fire-retardant clothing, hazardous material clothing, etc.). Obviously, entering a dangerous area in an attempt to evacuate people is a situation-specific action. The evaluator should look for evidence that emergency responders are properly trained and equipped to exercise any reasonable options after the situation has been assessed. Again, the criteria must include the time factor. Damage rates within hazard zones can be assessed to be lower for scenarios where evacuation plays a significant role.

B. Blockades. Another limiting action in this category is to limit the possible ignition sources and the entry of additional receptors. Preventing vehicles from entering the danger zone has the double benefit of reducing human exposure and reducing ignition potential.

C. Containment. Especially in the case of restricting the movement of hazardous materials into sewers, buildings, groundwater, etc, quick containment can reduce the consequences of the spill. To reduce the spreading potential during emergency response, equipment such as booms, absorbents, vacuum trucks, dispersion or neutralizing agents, and others are available. Some of these act as temporary secondary containment. Permanent forms of secondary containment were previously discussed.

D. Shielding. Protecting receptors by the use of thermal or blast walls is an option in some cases. These structures are sometimes used in production facilities, protecting control rooms and other areas of normal human occupancy. They are less common, but nonetheless an available option, for limiting consequences beyond a facilities borders.

E. Pre-emptive actions. Some operators allow responders (company personnel only) to ignite releases in instances where such action would limit damages that may occur by later ignition. Using a flare gun to ignite a vapor cloud, is an example of such a procedure. Such procedures also add an amount of risk. The potential for unintended consequences is relatively high, given the uncertainties and high energy release potentials associated with unconfined vapor cloud explosions and vapor fires. With a limited ability to fully diagnose an unfolding scenario, such actions should be very carefully considered.

Loss limiting actions

Prompt and proper medical care of persons affected by releases can reduce losses. Again, product knowledge, proper equipment, proper training, and quick action on the part of the responders are necessary factors.

Other items that play a role in achieving the consequence-limiting benefits include the following:

• • • Emergency drills
    • Emergency plans
    • Communications equipment
    • Proper maintenance of emergency equipment
    • Updated phone numbers readily available
    • Extensive training including product characteristics
    • Regular contacts and training information provided to fire departments, police, sheriff, highway patrol, hospitals, emergency response teams, government officials.

These can be thought of as characteristics that help to increase the chances of correct and timely responses to pipeline leaks. Perhaps the first item, emergency drills, is the single most important characteristic. It requires the use of many other list items and demonstrates the overall degree of preparedness of the response efforts.

Equipment that may need to be readily available includes:

• • • Hazardous waste personnel suites
    • Breathing apparatus
    • Containers to store picked up product
    • Vacuum trucks
    • Booms
    • Absorbent materials
    • Surface-washing agents
    • Dispersing agents
    • Freshwater or a neutralizing agent to rinse contaminants
    • Wildlife treatment facilities.

The evaluator/operator should look for evidence that such equipment is properly inventoried, stored, and maintained. Expertise is assessed by the thoroughness of response plans (each product should be addressed), the level of training of response personnel, and the results of the emergency drills. Note that environmental cleanup is often contracted to companies with specialized capabilities.

Receptors

A receptor is anything that could “receive” damage from a pipeline leak/rupture. It includes all biological life forms, structures, land areas, etc. Some possible receptor types include: people (human fatality; human injury); property; environment; and even service, when ‘service interruption’ is part of the definition of failure.

The damage potential of various receptors should be based on the vulnerability and consequence potential of each receptor-spill pairing. This includes direct damages and secondary effects such as public outrage.

Understanding the damage threshold leads to a hazard area estimation and the ability to characterize receptor vulnerability within that hazard area. In the earlier discussion of hazard area determination, it was shown that receptor damage potential sets the boundaries for the hazard area. However, the suggestion was made to initially ignore receptors after their role in thresholds was acknowledged, in producing the hazard areas around the pipeline components. The areas are efficiently produces using only the threshold intensity values. Damage threshold levels for thermal radiation and overpressure intensity effects were discussed earlier in this chapter.

After the hazard areas have been ‘drawn’, then the counting, valuations, and potential damage rates of receptors can be efficiently included in the assessment.

Receptor vulnerabilities

Receptor sensitivities are an aspect that should be considered in the consequence assessment. Receptor damage is dependent upon the nature of the scenario—acute versus chronic—as well as the intensity. Longer duration, higher intensity events generally cause the most damage; low intensity, short duration usually cause the least, and many possibilities exist between the extremes. Included with chronic impacts—consequences that tend to worsen over time—is secondary effects. This includes fires ignited and/or spreading by autoignition from heat flux; explosions such as BLEVE’s; soot and ash fallout; pollution; etc. damages from more persistent pipeline releases also include contamination scenarios.

Valuations and sensitivities require certain information, even if only simplified assumptions. For each receptor, such as population, environment, drinking water, waterways, etc., key information needed for valuations includes:

• • • Receptor characterization (type of people, type of buildings, water flowrates, etc.)
    • Receptor density (count per area unit)
    • Receptor vulnerabilities (susceptibility to harm at various exposure intensities and durations)
    • Shielding, distance, and mobility (ability to escape) of receptors

An “estimate of risk expressed in an absolute terms” requires identification of a hazard zone, a characterization of receptors within that zone, and an estimate of the extent of damages to those receptors. The levels of damage possible and their associated likelihood of occurrence require an understanding of receptor sensitivity to the effect. A dose–response type assessment, as is often seen in medical or epidemiological studies, may be necessary for certain receptors and certain threats. Focusing on possible acute damages to humans, property, and the environment, some simplifying assumptions can be made, as discussed below.

As noted, a robust consequence assessment sequence will generally follow these steps:

1. 1. 1. Determine damage states of interest (see discussions this chapter)
      2. Calculate hazard distances associated with damage states of interest
      3. Estimate hazard areas based on hazard distances and source (burning pools, vapor cloud centroid, etc.) location
      4. Characterize receptor vulnerabilities (damage potential) within the hazard areas

This process is rather essential to absolute risk calculations. Having addressed the first three in earlier sections of this chapter, we now turn our attention to the fourth.

An important benefit of the more complex GIS spill footprint analysis (over the older, buffer zone) approaches is the ability to better characterize the receptors that are potentially exposed to a spill—those that are actually “in harm’s way.” In many cases, receptors may be relatively close to, but upslope of, the pipeline and hence at much less risk in a liquid spill scenario. Focusing on the locations that are more at risk is obviously an advantage in risk management.

The probability of various damage levels to various receptors requires an understanding of very location-specific factors such as escape potential, shielding and sheltering options, wind direction, and many others. General assumptions are used in many risk analyses including several detailed in PRMM. Listings such as this provide insight into those authors’ beliefs about receptor damage potential.

Population

Most pipeline release consequence assessments focus on threats to humans, especially threats to the general public. Risks specific to pipeline operators and pipeline company personnel can be included, often as a separate classification in order to discriminate between voluntary and involuntary risks.

Potential injury and fatality counts relies on an understanding of the population within the potential hazard zone must be characterized. Hazard intensities and durations, coupled with population densities, characteristics, and protections at any point in time, yield injury and fatality potentials. Characterization of a population vulnerability includes estimating:

• • • Permanent vs Transitory/occasional population density
    • Special population (restricted mobility)
    • Barriers, shielding, and escape capabilities.

Even within a hazard zone, there are differences in level of harm. In addition to thermal effects being very sensitive to receptor proximities, the potential for ingesting, inhaling, and having dermal contact with contaminants may be higher at some locations if less dilution has occurred and there is less opportunity for detection and remediation before the normal pathways are contaminated. Recall that common pathways for contact with humans is through direct contact (with skin, eyes, etc), or via an ingestion/inhalation pathway: air, drinking water, vegetation, fish, or others.

Especially for acute hazard zones scenarios, a detailed analyses of human health effects is often unnecessary when the pipeline’s products are common and epidemiological effects are well known. However, more advanced assessment techniques are available, as is illustrated in the discussion of probit equations. These may be needed to determine cleanup and remediation requirements for more chronic hazard zone scenarios.

In either a simple or advanced assessment, understanding the potential for injury or fatality from thermal effects requires consideration of the time and intensity of exposure. This is discussed in PRMM and methods for quantifying these effects are available. Shielding and ability to evacuate are critical assumptions in such calculations.

Population Density

Most risk assessments use the simple and logical premise that risk increases as nearby population density increases. Population density estimates are often already available along a pipeline. Many operators, by choice or regulatory mandate, use published population density scales such as the class locations 1, 2, 3, and 4 (used in US regulations (CFR49 Part 192) These are for rural to urban areas, respectively.

Sometimes landuse data along a pipeline is available and can be used for characterizing population densities categories such as urban, rural, light residential, heavy commercial (shopping center, business complex, etc.), and many others appear in various landuse categorizations. These can be converted into population densities.

The population density, as measured by class location or other categorization, or when based on large geographical areas is an inexact method of estimating the number of people likely to be impacted by a pipeline failure. A thorough analysis will make more accurate counts and characterizations of buildings, roadways, assembly areas, and other indicators of population. It will also necessarily require estimates of people density (instead of building density), people’s away-from-home patterns, nearby road traffic, evacuation opportunities, time of day, day of week, and a host of other factors. Several methods can be devised to incorporate at least some of these considerations. An example methodology, from an Australian standard ref [67], illustrates this. According to this ref [67], average population densities per hectare can be determined for a particular land use by applying the following formula:

Population per hectare = [10,000/(area per person)] x (% area utilized) x (% presence)

This reference describes the process of population density estimation as follows:

• Indoor population densities have been based on the number of square meters required per person according to the local building code. Residential dwellings are not covered in this building code, but have been assigned a value of 100 m2 per person, on the basis of a typical suburban density of 30 persons per hectare and one-third actual dwelling area. For nonresidential use, available floor space has been set at 75% of the actual area, to allow for spaces set aside for elevators, corridors, etc.
• For rural and semirural areas, the outdoors population is generally expected to be greatest on major roads (excluding commercial areas). If an appropriate value for vehicular populations can be determined, then this can be conservatively applied to all outdoor areas. Assuming that a major rural road is 10 m wide, 1 hectare covers a total length of 1km. For rural areas, an average car speed of 100km/hr and an average rate of 1 car per minute has been assumed. Based on this and an average of 1.2 persons per car, an outdoor population density of 1 person per hectare has been determined. Using 60km/hr and a 30-second average separation, a population density of 4 people per hectare is applied to semirural areas.

Other typical population densities from another source [43] are shown in:

Population density by location class

Class	Average population density (people per hectare)
1	0.04
2	3.3
3	18
4	100

Assessments of occupancies based on time-of-day, day-of-week, and/or season, traffic volumes on roadways, and populations associated with offshore locations or activities (for example, platforms, shipping lanes, anchoring areas, fishing areas, coastal proximity, etc.) will strengthen the risk analyses. Identification of individuals with reduced escape capabilities, such as restricted mobility populations (nursing homes, rehabilitation centers, etc.) and difficult-to-evacuate populations, may be warranted.

Especially for early phase risk assessments, rule sets can be developed to assign exposures. For instance, in the offshore environments, water depths and/or shore proximity can be used to set initial estimates of populations associated with fishing and recreational activities. Shipping lane proximity can influence estimates of transient populations moving near a facility.

Probit

PROBIT is a method to take into account the total damage received by the receptor. For consequences requiring an understanding of the dosage influences, this represents an improvement over a fixed limit approach since time of exposure is included in the analysis. A higher intensity of exposure can be safely absorbed if the exposure time is less, so a measure of ‘dose’ is more representative of actual damages. Probit equations are based on experimental dose-response data. According to probit equations, all combinations of concentration and time that result in an equal dose also result in equal values for the probit and therefore produce equal expected fatality rates for the exposed population. When using a probit equation, the value of the probit (P r) that corresponds to a specific dose must be compared to a statistical table to determine the expected fatality rate.

An example of the use of probits in common pipeline failure consequence effects (thermal and overpressure) is excerpted below:

The physiological effects of fire on humans depend on the rate at which heat is transferred from the fire to the person, and the time the person is exposed to the fire. Even short-term exposure to high heat flux levels may be fatal. This situation could occur to persons wearing ordinary clothes who are inside a flammable vapor cloud (defined by the lower flammable limit) when it is ignited. In risk analysis studies, it is common practice to make the simplifying assumption that all persons inside a flammable cloud at the time of ignition are killed and those outside the flammable zone are not.

In the event of a torch fire or pool fire, the radiation levels necessary to cause injury to the public must be defined as a function of exposure time. The following probit equation for thermal radiation was developed for the U.S. Coast Guard [1045]:

	Pr = -36.378 + 2.56 ln [t ( I 4/3)]
Where:	t	= exposure time, seconds
	I	= effective radiation intensity, W/m2

The physiological effects of explosion overpressures depend on the peak overpressure that reaches the person. Direct exposure to high overpressure levels may be fatal. If the person is far enough from the edge of the exploding cloud, the overpressure is incapable of directly causing fatal injuries, but may indirectly result in a fatality. For example, a blast wave may collapse a structure which falls on a person. The fatality is a result of the explosion even though the overpressure that caused the structure to collapse would not directly result in a fatality if the person were in an open area.

In the event of a vapor cloud explosion, the overpressure levels necessary to cause injury to the public are typically defined as a function of peak overpressure, without regard to exposure time. Persons who are exposed to explosion overpressures have no time to react or take shelter; thus, time does not enter into the relationship. An example probit relationship based on peak overpressure is as follows:

	Pr = 1.47 + 1.37 ln (p)
Where:	p	= peak overpressure, psig

The following explosion/lethality relationships have been used.

	p = 1 psig	1% mortality
	p = 5 psig	50% mortality
	p = 7 psig	95% mortality

Generalized damage states

Historical data on fatal accidents involving natural gas gathering and transmission pipelines have been compiled by the U.S. Department of Transportation (DOT). During a recent 14.5 year period for which summary data are available, the maximum number of fatalities due to any single accident was six, and two accidents actually caused six fatalities.

Numerous studies and publications are available dealing with the potential extent of injury from exposures to various toxic, thermal, and mechanical effects. These lead to more general assumptions that can be used to set overall damage states. Under a set of assumptions, one study concluded a full rupture of a natural gas transmission pipeline produces a 1% mortality rate at distances corresponding to

r = 0.685 x SQRT(p x d)²

Where

r = radius from pipe release point for given radiant heat intensity (feet)

p = maximum pipeline pressure (psi)

d = pipeline diameter (inches).

This study [83] used an approximate exposure time of 30 seconds and several other assumptions to set a suggested damage threshold at a thermal radiation (from ignited natural gas release) level 5,000 Btu/ft2-hr. Distances suggested by this equation have become the hazard zone at which the designation of HCA is applied in US regulations for natural gas transmission pipelines.  See also discussion under PIR.

In a related study, other mortality rates are linked to distances dependent on pressure and diameter.

Two hazard areas are defined that correspond to the lower and upper heat intensity thresholds associated with fatal injury. The lower and upper thresholds adopted are 12.6 and 31.6 kw/m2 for outdoor exposure, and 15.8 and 31.6 kw/m2 for indoor exposure. The probability of fatality is assumed to be 100% within the area bounded by the upper threshold and 0% outside of the area bounded by the lower threshold. Between these two thresholds, the probability of fatality is assumed to be 50% for outdoor exposure and 25% for indoor exposure. [333]

Another study of thermal radiation impacts from ignited pools of gasoline assumes the following:

• • There is a 100% chance of fatality in pools of diameter greater than 5m.
  • The fatality rate falls linearly to 0% at a thermal radiation level of 10kW/m² [59].

Due to the sensitive nature of fatality rate potential, extra caution in producing such estimates is warranted. A risk model with a conservative bias intended to support technical decision-making can have its output mis-used and can generate misunderstanding and unnecessary alarm. This potential is exacerbated when an emotionally-charged measure such as fatality possibility is being used as a measure of CoF. Given the conceptual difficulties in population-based estimates versus estimates for individual segment risks, the potential for misunderstanding is increased.

Value of statistical life and injury

Establishing a value of human life—a “statistical life,” not an identified individual—is an emotional and controversial thing, as discussed in PRMM. Despite some on-going resistance, such valuations are becoming commonplace. Not only do they provide logical and necessary inputs to decision-makers, they are already ubiquitous, in the sense that any company’s decision-making can be dissected to reveal a de facto valuation on human life, even if one is not explicitly stated.

Valuations in the US currently range from about $5 million up to about $15 million per statistical fatality avoided [1044]. To select a single estimate without researching the rationale behind the many valuations used for many different purposes, values used by government agencies in determining cost/benefit of proposed regulations can be used. This perhaps has the added benefit of de-personalizing the choice in value—it is not generated by the asset owner but rather by an unbiased agency representing the public interest.

A 2013 memorandum [1045] published by the US DoT provides guidance on values of statistical life (VSL), suggesting a value of $9.1 million be used and annually adjusted proportionally with changes in real income (estimated to increase by factor of 1.07 percent per year, for use in estimating future). Based on the methodology adopted in the 2013 guidance, price and real income changes since 2012 yield a current VSL estimate of $13.2 million for analyses using a base year of 2023. 

For future years, the formula for calculating future values of VSL is therefore:

VSL_2012+N = VSL₂₀₁₂ x 1.0107^N

where VSL_2012+N is the VSL value N years after 2012

and VSL₂₀₁₂ is the VSL value in 2012 (i.e., $9.1 million).

Among its objectives in publishing this guidance, this ref [1044] states:

Prevention of an expected fatality is assigned a single, nationwide value in each year, regardless of the age, income, or other distinct characteristics of the affected population, the mode of travel, or the nature of the risk. When Departmental actions have distinct impacts on infants, disabled passengers, or the elderly, no adjustment to VSL should be made, but analysts should call the attention of decision-makers to the special character of the beneficiaries.

This same ref [1044] offers guidance on economic valuations for injuries:

• • • Nonfatal injuries are far more common than fatalities and vary widely in severity, as well as probability.
    • Each type of accidental injury is rated (in terms of severity and duration) on a scale of quality-adjusted life years (QALYs), in comparison with the alternative of perfect health. These scores are grouped, according to the Abbreviated Injury Scale (AIS), yielding coefficients that can be applied to VSL to assign each injury class a value corresponding to a fraction of a fatality.

The fractions shown should be multiplied by the current VSL to obtain the values of preventing injuries of the types affected by the government action being analyzed.

Relative Disutility Factors by Injury Severity Level (AIS)
For Use with 3% or 7% Discount Rate

AIS Level	Severity	Fraction of VSL
AIS 1	Minor	0.003
AIS 2	Moderate	0.047
AIS 3	Serious	0.105
AIS 4	Severe	0.266
AIS 5	Critical	0.593
AIS 6	Unsurvivable	1.000

Another reference states that, based on a willingness-to-pay study of road accidents, costs of serious and slight injuries are approximately 10% and 0.8% of the cost of a life, respectively.

The use of valuations for human suffering and fatality is a source of discomfort for some. Realistically, however, such valuations have always been implicitly employed, though often not documented. Failure to document does not prevent a company’s VSL beliefs from being known. A company’s implied VSL valuations, used in their decision-making, can be derived by their choices in design, operations, and maintenance practices, coupled with their incident history or some other representative history.

Historical Losses

It is useful to examine historical rates of population effects. In the US, the following rates have been observed, based on reporting of ‘significant’ and ‘serious’ pipeline incidents. For an approximate time period of 1992 to 2012, the following costs per incident were reported.

1.  

Examples of human fatality/injury rates

	Hazardous Liq		Gas Transmission		Gas Distribution
	fat/incid	inj/incid	$ prop/incid	fat/incid	inj/incid	$ prop/incid	fat/incid	inj/incid	$ prop/incid
max	0.026	0.179	2,704,031	0.197	0.545	3,649,280	0.427	2.027	2,952,663
avg	0.008	0.040	478,195	0.028	0.125	698,084	0.115	0.436	327,653
min	0.000	0.000	112,248	0.000	0.008	171,443	0.040	0.214	112,894

The maximum and minimum values are the highest annual per-incident rates in the time period. These values suggest the range of possibilities, at least for annual counts. Note that these are related to a certain type of incident, ie, ‘significant’ or ‘serious’. Rates for all incidents would logically be much lower.

Property-related Losses

Property damage potential can be assessed through an examination of the following variables: population, property type (commercial, residential, industrial, etc.), property value, landscape value, roadway vulnerability, and highway vulnerability, and other considerations. Damage rates can be correlated to the threshold intensity effects tabulated in a previous section. Valuations are readily obtained from numerous published data on market values and construction/reconstruction costs for a region. Examples follow.

Damage Rates

One study used the PIR based on thermal intensities from natural gas jet fires (see previous discussion) to represent potential damage rates. With an observation that each combination of heat flux and duration associated with particular levels of damage falls at a specific normalized multiple of the PIR, the following damage distances emerge, expressed as a multiple of the PIR distance: ~1.6*PIR for severe damage, ~0.75*PIR for moderate damage, and ~0.5*PIR for minor damage.

Using these categories and various assumptions, a US government study [1015] assigned the following valuations:

• Severe indicates that a house is not safe to occupy and most likely needs to be demolished or completely renovated prior to occupancy. Valuations are set at 100% loss of $180K per building/house.
• Moderate indicates that a house has substantial damage and repairs are necessary prior to occupancy. Valuations for such damages are set at 50% of replacement value.
• Minor indicates that a house has the least amount of damage and could be legally occupied while repairs are made. Valuations for such damages are set at 20% of replacement value. [1015]

Costs

In the same study, density of dwellings was set at 12/acre or 6/building. For buildings with 4 or more stories, under a set of assumptions including a density of 0.5/acre, costs to repair minor damage from thermal effects of a pipeline release were set at $500K and moderate to severe damage set at $1,000K. Outside recreational facilities had valuations set at $250K for minor and $500K for moderate to severe damages. Parked vehicles, with an assumed densities ranging from 24 to 100 per acre, had damage valuations set at 0%, 30%, and 100%–corresponding to minor, moderate, severe, thermal radiation levels respectively—of a vehicle $17K retail value. Personal possessions that may be destroyed inside a building had damage valuations set at 5%, 15%, and 25% of building valuation–corresponding to minor, moderate, severe, thermal radiation levels respectively—yielding valuations of $9K, $27K, and $45K. [1015]

In another study, a sampling of ‘above average incidents’ costs is found in ref [1011]. Some of the oil spills listed in that reference are shown below.

Where incidents are ‘reportable’ per US regulations and costs are “Estimated cost of public and non-Operator private property damage paid/reimbursed by the Operator”. Some of these incidents involved fatalities and injuries, but most represent property damage costs.

An examination of one set of US reportable incident data shows average property damage costs of about $700K per incident for natural gas transmission pipelines; $330K for natural gas distribution pipelines, and from $480K per incident for hazardous liquid pipelines. (See ) Note that these types of pipeline operations have different criteria for ‘reportable’. The hazardous liquid statistic involves many more incidents, normally very minor (for example, small leaks in facilities), accounting for the non-intuitive higher property damage costs for natural gas releases for which only relatively major incidents are reported. Note also that these ‘per incident’ costs are based on a subset of all incidents—costs per ‘any’ incident would logically be much lower.

Some key aspects of property damage potential will track population density. Therefore, property loss can also be estimated based on population density, in the absence of more definitive data.

Sample incident costs

	gal/mcf	cost	$/gal or MCF
Crude Oil	843,444	725,000,000	$860
Crude Oil	158,928	4,194,715	$ 26
HVL (LPG/NGL)	137,886	1,811,756	$ 13
HVL (LPP/NGL)	130,368	524,275	$ 4
Gasoline	81,900	15,000,005	$ 183
Crude Oil	63,378	135,000,000	$ 2,130
Crude Oil	43,260	989,000	$ 23
Refined Products	38,640	13,184,000	$ 341
Refined Products	34,356	7,657,195	$ 223
Crude Oil	33,600	441,000	$ 13
Refined Products	29,988	831,750	$ 28
Natural Gas	83,487	734,698	$ 9
Natural Gas	79,000	1,883,770	$ 24
Natural Gas	61,700	2,310,000	$ 37
Natural Gas	50,555	6,700,000	$ 133
Natural Gas	47,600	375,363,000	$ 7,886
Natural Gas	41,176	406,699	$ 10
Natural Gas	34,455	117,000	$ 3
Natural Gas	14,980	116,000	$ 8

Environmental issues

Environmental damages are often very situation dependent given the wide array of possible biota that can be present and exposed for varying times under various scenarios. Environmental risk factors will overlap public safety risk factors to a large extent. See PRMM for a background discussion of environmental risk assessment.

Environmental sensitivity

Every potential spill site has some degree of sensitivity to a pipeline release. The environmental effects of a leak are partially recognized in the product hazard assessment. Liquid spills are generally more apt to be associated with chronic hazards. The modeling of liquid dispersions is a very complex undertaking as previously described.

In a risk assessment, there is usually an increased focus on more environmentally sensitive areas, with the implication that these locations carry a potential for greater or more lasting harm than most other locations. Areas more prone to damage and/or more difficult to re-mediate can be highlighted in the risk assessment. A strict definition of environmentally sensitive areas might not be absolutely necessary. A working definition by which most would recognize a sensitive area might suffice. Such a working definition would need to address rare plant and animal habitats, fragile ecosystems, impacts on biodiversity, and situations where conditions are predominantly in a natural state, undisturbed by man. To more fully distinguish sensitive areas, the definition should also address the ability of such areas to absorb or recover from contamination episodes.

The chronic aspect of a spill assesses the hazard potential of the product via characteristics such as aquatic toxicity, mammalian toxicity, chronic toxicity, potential carcinogenicity, and environmental persistence (volatility, hydrolysis, biodegradation, photolysis).

One method to quantify spill costs, specifically for oil spills, is available in ref [1030], with some excerpts below:

To provide the EPA Oil Program Center with a simple, but sound methodology to estimate oil spill costs and damages, taking into account spill-specific factors for cost-benefit analyses and resource planning, the EPA Basic Oil Spill Cost Estimation Model (BOSCEM) was developed. EPA BOSCEM was developed as a custom modification to a proprietary cost modeling program, ERC BOSCEM, created by extensive analyses of oil spill response, socioeconomic, and environmental damage cost data from historical oil spill case studies and oil spill trajectory and impact analyses. In addition, elements of habitat equivalency analysis as applied in Natural Resource Damage Assessment (NRDA) and other environmental damage estimation methods, such as Washington State’s Damage Compensation Schedule and Florida’s Pollutant Discharge Natural Resource Damage Assessment Compensation Schedule were incorporated into the environmental damage estimation portion of ERC BOSCEM. Formulae, criteria, and cost modifier factors for estimating socioeconomic damages, including impacts to local and regional tourism, commercial fishing, lost-use of recreational facilities and parks, marinas, private property, and waterway and port closure, were derived from historical case studies of damage settlements and costs, as well as methods employed in other studies

Input of spill criteria:

1. 1. 1. Specify amount of oil spilled (in gallons);
      2. Specify basic oil type category;
      3. Specify primary response methodology and effectiveness;
      4. Specify medium type of spill location;
      5. Specify socioeconomic and cultural value of spill location;
      6. Specify freshwater vulnerability category of spill location;
      7. Specify habitat and wildlife sensitivity category of spill location.

Each oil spill is a unique event involving the spillage or discharge of a particular type of oil or combination of oils that may cause damage to the local and/or regional environment, wildlife, habitats, etc., as well as to third parties. No modeling method can ever exactly determine or predict costs of an oil spill. Yet, there are patterns that emerge with respect to damages upon detailed analyses of oil spill case studies. For example, heavier oils are more persistent and present greater challenges – and thus costs – in oil removal operations than lighter oils, such as diesel fuel. Heavier oils, being more visible and persistent, have greater impacts on tourist beaches and private property. At the same time, lighter oils with their greater toxicity and solubility are more likely to cause impacts to groundwater and invertebrate populations. Greater effectiveness in oil removal tends to reduce environmental damages and socioeconomic impacts. Other factors, such as spill location, can also have significant impacts on spill costs and damages. A diesel fuel spill in an industrial area will likely have less impact and require a less expensive cleanup than one that occurs in or near a sensitive wetland. EPA BOSCEM incorporates these types of factors into a simple methodology for estimating the costs of “types of spills” that may be analyzed in a cost benefit analysis or for assessing which types of spills (oil type, location, etc.) that are causing the greatest impacts. The model allows for cost and damage estimation of different oil spill response methodologies, including different degrees of mechanical containment and recovery, as well as alternative response tools of dispersants and in situ burning that may have greater future applications in freshwater and inland settings. Response effectiveness can also be specified allowing for analysis of potential benefits of research and development into response improvements. [1030]

Methods such as this can be readily modified for other liquid spills. Insights from the ranges of adjustment factors—for example, what is the range of impacts from a socioeconomic perspective? or What habitat considerations are important?—can also be used to inform modeling of all releases, including gases and HVL’s.

High-value areas

Beyond considerations of population, property, and sensitive environment, some areas near to a pipeline can be identified as “high-value” areas, independent of the typical population- or environmental sensitivity considerations. As used here, the term high-value area (HVA) is defined as a location whose harm in the event of a pipeline failure generate exceptional consequences. Examples are discussed in PRMM and include irreplaceable archaeological or cultural sites; science centers with rare specimens or equipment; and many others.

Higher receptor valuations, higher remediation costs, higher damage rates, and other inputs into the risk assessment can be used to reflect higher value areas.

Additional examples of the many areas or facilities that could warrant special attention as receptors—perhaps HVA’s—include:

• • • School
    • Church
    • Hospital
    • Limited mobility health centers
    • Historic site
    • Cemetery
    • Busy harbor
    • Airport
    • University
    • Industrial center
    • Interstate highway / highway interchange
    • Recreational area/parks
    • Special agriculture
    • Water treatment/source.

Combinations of receptors

The extremes of receptor damage potential will be intuitively obvious—the most environmentally sensitive area and the highest population class and the highest value areas co-located and all potentially seriously damaged by the same section would be the highest consequence section.

Non-extreme combinations of receptors are not always so obvious. There will normally be several types of receptors at a potential spill site, each with different vulnerabilities to a threat such as thermal radiation or contamination. The analysis difficulty can be addressed by assigning different damage rates to different receptors experiencing different hazard zone effects. Each damage rate corresponds to a certain receptor-damage state. Separate consequences values are generated for, as an example, fatalities, injuries, groundwater contamination, property damage values, etc, at several distances from the hazard origin.

11.8.7 Service Interruptions

While service interruption consequences are addressed as a different type of ‘failure’ and also as indirect costs, there is often an enormous direct cost of service interruption, even in risk assessment focus is purely on leak/rupture. The direct consequences of the interruption of a high volume delivery include loss of revenue, loss of product, and perhaps immediate contractual non-performance costs, even before indirect costs are considered. Examples include:

• • • high volume offshore gas pipelines as critical feeds to numerous and/or essential consumers
    • deliveries or receipts tied to production (for example, processing plants, gathering systems, power generation, etc) whose re-start costs are enormous after relatively short interruption periods.

See related discussions under .

Offshore CoF

As with onshore spills, the type of product spilled, the distance to sensitive areas, and the ability to reduce spill damages will govern the consequence potential for offshore lines. Spills offshore can be assessed as they are in the onshore risk assessment model. This involves assessment of product hazard, spill size, dispersion potential, and vulnerable receptors within the hazard zone.

Offshore incidents are frequently more expensive due to increased costs of accessibility, repair, and return to service.

Receptors

Population density will not often be the dominant consequence for offshore pipeline failures. regulations in the US consider offshore pipelines to be in rural areas. Exceptions should be captured in the risk assessment, including proximity to recreational areas (beaches, fishing areas, etc.), harbors and docks, popular anchoring areas, ferry boat routes, commercial shipping lanes, commercial fishing and crabbing areas, etc.

Emergency response

Emergency response in offshore environments is usually more problematic than onshore due to the potential for liquid contaminant spread coupled with the remote, difficult-to-access locations of many offshore installations. The degree of dispersion of offshore liquid spills is a function of wind and current actions and product characteristics such as miscibility and environmental persistence. Conditions may change during a long event, further hampering response effectiveness.

Repair and Return-to-Service Costs

Repair and remediation costs can be a significant part of the cost of failure. The role of ancillary costs such as acquisition of necessary regulatory permits and permissions should not be underestimated. One source details an anomaly repair scenario where “This relatively common repair job, which could have been performed both safely and in an environmentally sound manner for under $90,000 within a few days, ended up costing in excess of $450,000 and requiring well over one-and-one-half years of preparation and planning time.” [1005]

An assessment of repair costs can include the return-to-service costs associated with damaged system components. Damages to other nearby facilities are generally considered in receptor damages.

Factors impacting repair time and costs include:

• • • Type of repair
    • Accessibility
    • Need for and availability of special equipment and/or materials
    • Need for and availability of special parts
    • Component size (pipe sleeve cost, replacement pipe size, handling costs, etc)
    • Need for and availability of special welders, welding materials, procedures, or qualifications.
    • Need for and complexity in obtaining regulatory permits and/or landowner cooperation.

The ease-of-repair aspect, and hence costs, could be measured as a function of the variables such as:

• • • Topography/accessibility—Arctic, offshore, wetlands, unstable terrain, urban congestion, steep slopes, pavements, and numerous other environments are also associated with increased costs.
    • Component size—damages to larger sized equipment often lead to more expensive repairs.
    • Nearby facilities—stabilization, evacuation, and post-excavation repair of nearby facilities such as other utilities, buildings, roadways, and other structural features may add to repair costs.

Post Incident Investigations

Depending on type of damage causing the outage, extensive inspection along the entire pipeline might be warranted before it is prudent to return it to service. Costs of return to service inspection are appropriately included in a risk assessment. In some cases, the return-to-service inspection would be an accelerated schedule for already-planned inspection. In other cases, unplanned, widespread inspection would be prompted by an incident.

The PoF assessment can help to identify the extent of such post incident inspections. The number different locations contributing to similar PoF values is available in the risk assessment. Since the operator can often unilaterally choose how many locations to repair/reinforce/upgrade prior to resumption of service, the extent of damages is not a direct part of a failure consequence but would factor into risk management decisions. If an inspection is a mandatory requirement from a regulator, and would not otherwise have been performed by the owner, then it could be considered a cost of the failure.

These types of consequences vary based on failure type. This includes an assumption that incidents caused by time-dependent failure mechanisms such as corrosion prompt more extensive and expensive return-to-service actions compared to time-independent failures such as from vehicle impact. Incidents that lead to new or increased focus on failure mechanisms (for example, freeze, surge, or currently unknown mechanism) may also warrant treatment more costly return to service incidents.

Other return-to-service costs such as purging of pipeline and re-setting of instrumentation and equipment can similarly be included. Seasonal differences in accessibility and response efficiencies can also be recognized here.

Post-incident reaction, as a part of the return-to-service process, is a function of:

• • • Failure type—some will warrant more response than others
    • Number of locations with ‘similar’ PoF values for failure type
    • Number of locations with ‘similar’ PoF values for any failure type
    • Extent of locations with ‘similar’ PoF values.

This mirrors the process by which an SME would gage the return-to-service efforts. If an incident is not unexpected—familiar failure mechanism that is reasonably foreseen by risk assessment—then it is extensive investigation may not be needed and resumption of operation may be easier. Similarly, when integrity knowledge is more complete—through recent and robust integrity verification, including DA-type assessments—then less post-incident integrity verification may be warranted. For example, a failure on uninspected system ABC may not prompt any actions on recently inspected system XYZ, even when the two are otherwise very similar. The calculated PoF values consider age and quality of integrity verification information, so using them directly to forecast post-incident reaction is consistent with the SME approach.

The level of surprise is also a factor. Lower PoF values will carry higher incident-reaction consequences. While this might at first appear counter intuitive, it is actually consistent with the SME decision-process. A failure at a low PoF location is a surprise. It challenges previously held beliefs about where and what types of potential failures warrant higher attention. This should prompt more investigation than a failure that is less surprising. The larger the surprise, the larger the reaction.

Regardless of how unexpected the event, it will usually suggest that more inspection on other, similar segments is prudent. A failure at any PoF often prompts an investigation of all pipe lengths with similar or worse PoF values (unless the failure is somehow uniquely possible only to the failed location). Lower PoF segments would prompt inspection of more length of pipe compared to higher PoF. Increased inspection will often generate the need for increased repairs, again adding to costs.

Outage periods which are extended by an incident-specific regulatory mandate following an incident are perhaps better captured in the indirect cost assessment.

Indirect costs

The consequence assessment is enhanced by recognizing that the direct costs of a pipeline failure are often not the only costs. In a certain public perception climate and with certain types of failures, total consequence of failure can be much higher than direct damages suggest. The factors impacting the level of indirect costs are numerous and frequently immeasurable and sometimes even inestimable with any degree of confidence. Even after an incident has occurred, obtaining an accurate assessment of indirect damages is often impossible. Implications regarding stock price, credit worthiness, lost opportunities, harm to current and future business negotiations, etc all make accurate assessments practically impossible.

Despite their challenges in quantification, some estimation is often warranted. Potential costs associated with a spill that may be considered indirect include:

• • • Fines and penalties
    • Litigation
    • Increased regulatory oversight
    • Direct customer impacts
    • Damage to corporate reputation
    • decrease in stock value
    • increased costs of financial dealings
    • decrease in negotiating position
    • Loss of company focus
    • diversion of resources
    • management testimony
    • hearings prep, action.

Given the difficulties in quantifying many of these indirect costs, use of a multiplying factor applied to estimates of direct cost is an appropriate approach. In this approach, the indirect costs are seen to be proportional to direct costs and therefore captured as an escalation factor.

Estimating Potential Damage to Corporate Reputation

Indirect consequences such as harm to corporate reputation, are often thought to closely parallel the risks to public and environment. Many of the same factors that suggest damage to corporate reputation would also precipitate other indirect costs. For instance, the potential for fines, litigation, and increased regulatory oversight following an incident would realistically be influenced by factors such as recent incident history and public perception climate—the same factors influencing corporate reputation.

A more robust analysis could include specific research into company’s current or historical reputation. Financial ratings, stock analyst reports, consumer surveys, and similar assessments might provide a partial basis for such an evaluation. The extent of pipeline operations compared to the company’s full suite of activities may be important.

Some investigation into the role of pipeline operations in a publicly traded company’s overall business can be obtained taken from recent annual report. In a large hydrocarbon energy company, the financial activities related to exploration and production (E&P) may be a large part of the total business of a company. This fact is often relevant to the type of indirect damages predicted from an incident in that part of the business.

Example

Possible indirect consequence algorithms to assess this aspect of overall consequence are illustrated in the following example.

First, an estimate of the current condition is made. It is recognized that this ‘current’ conditions is highly variable—often a function of recent focus of news media. In this example, the corporate reputation for a large oil and gas company is currently judged as follows:

Pre-existing Reputation (scale can be viewed as “% mistrust” with 0% being neutral and -100% is most negative)

• • • Public perception of a company: % mistrust currently = 0%
    • no damaging stories recently; generally neutral or favorable public impression of company
    • Public perception of oil/gas industry: 50%
    • Currently lower due to recent news headlines of legal actions in the industry; price of gasoline versus corporate profits is another relatively fresh issue that would probably be referenced by media; other pipeline incidents would likely be referenced in news stories.
    • Public perception of large corporations: 20%
    • Headlining corporate dishonesty episodes are fresh and likely to be referenced by media.
    • Public perception of region: 80%
    • nearby spill episodes still fresh

Total for Pre-existing reputation: 1-(1-0.5)x(1-0.2)x(1-0.8) = 92%. This is an OR gate combination, reflecting the fact that any single issue can overshadow the rest, as can an accumulation of lesser issues; for example, averaging is not appropriate, nor is choosing a maximum.

Pipeline headlines: (% worst case where 100% = ‘incident on same pipeline within last year’)

• • • Years since a media-covered incident similar to current:
    • Anywhere: NA
    • US: NA
    • Neighbor/affiliate; pipeline incident in same region:

0.95 x (10-1yr old)/10 = 85.5% (a 95% similar incident occurred one year ago.)

• • • Company: 0
    • same region: see above
    • same asset class: 0
    • same pipeline: 0

Total for Pipeline Headlines: 85.5% (others are insignificant)

Failure type (% perception where 100% is a failure type carrying stigma of ‘negligence’):

• • • Corrosion (all forms): 100% (predictable, familiar failure mechanisms)
    • Vehicle impact (company vehicle): 70%
    • WIV: 50% (poorly understood mechanism)
    • Geohazard meteorite strike: 0% (sympathy effect)
    • Geohazard other: 50%
    • Operational (slug, freeze, etc): 80%
    • Sabotage: 0% (sympathy effect)

Offsets: (% of best possible offsets)

• • • response reasonably fast and thorough, 50%
    • Good content of early messages 80%
    • minimal damage to environment;
    • rapid public apology;
    • rapid-immediate investigation and preliminary corrective actions;
    • Follow-up actions are timely and well communicated 60%
    • Media management is above average 70%

Corporate response effectiveness: 17% based on multiplying the above sub-factors

Competing news stories: arbitrary assumption of 20% (20% of damage that would otherwise occur is offset by coincident events deflecting media focus away from incident)

Total Offsets: 1-(1-0.17) x (1-0.2) = 33%

Scale = ([pre-exist rep] OR [pipeline headlines] OR [failure type])
AND [offsets]

[1-(1-0.92) x (1-0.855) x (1-[failure type])] x (1-0.33) = ~66% of scale

Scale limit currently set at 5: indirect costs can increase overall consequences by 5 times as a worst case. This magnitude reflects indirect costs that include damage to corporate reputation, litigation, fines/penalties, increased regulatory oversight and others.

Based on these variables and others, the indirect costs from damage to corporate reputation are judged to increase the direct costs by a factor of about 0.66 x 5 = 3.3. In the current climate, the failure mechanism is having only a slight impact on the indirect costs since other indicators are relatively high. The multiple reflects any type failure occurring in a climate already marked by suspicion or mistrust of regional operations, pipelines, oil and gas industry, and large businesses.

Since the multiplier is usually a constant, all failure scenarios of the same type and magnitude are equally affected. More discrimination is seen when corporate reactions or news worthiness are more variable (perhaps geographically sensitive) and in comparing various failure types.

Customer Impacts

See discussion in Chapter 12 .

Process of Estimating Consequences

The key steps for the consequence assessment proposed here are:

1. 1. 1. Choose thresholds that determine hazard zone boundaries.
      2. Identify consequence reduction measures.
      3. Estimate hazard zone areas.
      4. Characterize receptors within the hazard zone(s).
      5. Include indirect consequence costs, if desired.
      6. Calculate potential consequence per failure.

These ingredients are developed sequentially in the assessment process, with the ‘per incident’ expected loss values being the consequence measures that are combined with PoF estimates to obtain final risk estimates—in final units such as ‘loss per year’.

Example of Overall Expected Loss Calculation

An example of the overall consequence estimation process is laid out in the following tables and discussion. Values shown are to illustrate the process only—they will not be realistic values for most pipelines and should not be used as a basis for any other estimates.

shows how the hazard zone distances are estimated for this example. For the nine scenarios shown, maximum threshold distances range from 30’ to 1500’. A distance of 1500’ is considered to be the maximum impact distance for this location on the examined pipeline.

The analysis begins with estimates of hole size probabilities. Depending on the PoF analysis, the entry point can be either the relative hole size distribution or an ‘absolute’ hole size distribution. The former is illustrated here—the hole size distribution representing 100% of all possible failures; the relative chance of a certain size hole, given that some hole is present. The latter implies that several hole sizes have a specific probability of occurrence already estimated in the PoF assessment—there is a calculated probability of rupture, and a calculated probability of a pinhole, and so forth.

1.  

Example Hazard Zone Distances and Probabilities

	Threshold Distances (ft)
Product	Hole Size	Probability of Hole	Ignition Scenario	Probability of ignition scenario	Distance from source (ft)	Thermal impact	Overpress impact	Contamination Impact	Maximum Distance (ft)	Probability of Maximum Distance
propane	rupture	8%	immediate	60%	0	400	0	0	400	4.8%
delayed	20%	300	400	800	0	1500	1.6%
no ignition	20%	300	0	0	0	300	1.6%
medium	12%	immediate	15%	0	300	0	0	300	1.8%
delayed	15%	100	300	200	0	600	1.8%
no ignition	70%	100	0	0	0	100	8.4%
small	80%	immediate	10%	0	50	0	0	50	8.0%
delayed	10%	30	50	0	0	80	8.0%
no ignition	80%	30	0	0	0	30	64.0%
	100%		100.0%

These probabilities simulate a distribution of all possible hole sizes with their associated probabilities of occurrence. Such a distribution would be influenced by pipe material, stress level, and failure mechanism, as well as other considerations. In the table above, three relative hole size occurrence percentages are shown. They sum to 100%. Each will be multiplied by the PoF of all possible leak sizes—a very small number for most pipelines—to get absolute probabilities of occurrence. For instance, if the overall failure probability (all holes sizes) was estimated to be 1E-6 per mile-year, then the probability of a rupture is estimated to be 8% of that value or 0.08 x 1E-6 = 8E-8 = 0.000008% chance of rupture for each mile for each year. This also suggests 8E-8 ruptures per mile per year as an estimated frequency of occurrence.

Next, three ignition scenarios are modeled: ‘immediate’, ‘delayed’, and ‘no’ ignition. The probability of each scenario is estimated for each hole size scenario. In this sense, hole size is being used as a surrogate for leak size. Larger holes imply larger leaks and greater ignition potential. The three holes sizes and the three ignition possibilities will produce nine scenarios, thought to sufficiently represent the possibilities in this example.

The distance from source column represents the possible migration distance of spilled product from the leak source. It is based on dispersion modeling—vapor cloud drift—in the case of gaseous releases and overland flow modeling in the case of liquids. This distance is additive to thermal effects distances and contamination distances. The leaked product might travel some distance, ignite, and produce thermal damages from the ignition site, sometimes far from the leak site. In the contamination damage scenario, envision a pool of spilled liquid that accumulates some distance from the leak location and only then begins a more aggressive subsoil migration, causing a groundwater contamination plume spreading from the pool. Since propane—a highly volatile liquid—is the product in this example, no contamination impacts are foreseen.

Several thresholds are selected for production of hazard distance estimates. Shown are one thermal effects threshold, one overpressure threshold, and one contamination threshold. These must be defined in terms of some intensity level or some probable damage state before distances could be assigned. The evaluator will probably want to include multiple thermal and contamination thresholds to ensure that the full range of possibilities is portrayed. The distance for each threshold is estimated from appropriate models for the product released. A gaseous release might base the threshold on flame jet thermal radiation (as in ref [3], for example); an HVL release threshold might be based on overpressure distance as well as fireball or jet thermal radiation; and a liquid release is often based on pool fire thermal radiation or contamination level. In this example, the longest distance occurs with a delayed ignition scenario, allowing the vapor cloud to migrate before ignition initiates a thermal event, including overpressure, if the release is sufficiently large.

shows the resulting nine hazard zone distances.

1. Visualizing Hazard Zone Distances

The probability of each scenario is calculated as the product of the hole size probability times the ignition scenario probability. These values can be multiplied by the overall PoF, to arrive at an absolute probability of each scenario. In the example tables, though, scenario probabilities assume that the pipeline failure has already occurred. Therefore, scenario probabilities sum to be 100%.

A simple plotting of distances such as shown below can be helpful. This grouping into zones is a modeling convenience that avoids having to perform receptor characterizations at too many distances.

1. Visualizing Ranges of Thresholds and Grouping into Zones

In this example, the evaluator has grouped the threshold distances into three zones. This was done by setting some logical breakpoints. PIR is estimated to be 1500 ft and zones are defined as:

“less than 100 ft”;

“from 100 ft to 50% of PIR (or 750 ft)”; and

“from 50% PIR to 100% PIR (or 750 ft to 1500 ft)”.

The number of zones is up to the modeler. All events within a zone are treated as the same. This implies no differences in potential damages at the closest and farthest point of the zone. So, wider zones require more “averaging” of possibly widely-differing potentialities within the zone. More categories will result in more resolution but also more efforts in subsequent steps.

In this example, the modeler chose to use three zones. He also chose to make zones not equivalent in size—basing his groupings a non-linear reduction in impact intensity with increasing distance. Non-uniform zone sizes might also better represent the relative frequency of events. Perhaps scenarios leading to larger threshold distances are so rare, that a larger zone captures an equivalent number of scenarios as the smaller zones. Each grouping or zone will have a probability comprised of the probabilities of all the individual scenarios that can produce a threshold distance that falls in the zone.

Each zone represents a collection of numerous potential damage thresholds. There are no sharp demarcations between possible zones. For instance, 20% of the possible scenarios might produce hazard zones from 0 to 200 ft and 10% of the scenarios could produce distances of from 50 ft to 400 ft. These overlapping distances do not necessarily suggest break points for zones so any choice of break point is a compromise. A cumulative probability chart and graphical presentation of the various thresholds associated with various scenarios will help the modeler to establish zones and associated probabilities.

As is illustrated in , there are some scenarios in the farthest zone that produce no impacts in the closest zone. For instance, a scenario where leaked product moves completely out of the closer zones (via sewer or puff cloud drifting, for example) before finding an ignition point. At the ignition point, the thermal effects are far from the release point and the receptors closer to the pipeline.

Each zone is assigned receptor damage rates based on the damages that would likely Each zone is assigned receptor damage rates based on the damages that would likely occur. For example, where very high heat radiation thresholds occur, higher fatality rates and higher property damage rates would be expected. The estimated damage rates are discussed in the next section.

Damage percentages are assumed to be 0% at distances beyond the PIR. The percentages will be used to calculate expected losses. They should be relatively conservative, reflect the modelers’ experience and beliefs, and should be fully documented.

Again, this grouping of hazard distances is for modeling convenience. It is often easier to make the necessary receptor characterizations within a few zones rather than for each possible threshold distance. The trade-off is some measure of accuracy since compromises are made in setting the zones. All event scenarios occurring within a zone are treated equally, even though some occur at either extreme of the zone.

Step 4

Next, receptors are characterized within each hazard zone as is shown in . At three distances from the pipeline (maximum hazard distance divided into 3 zones), all receptors are characterized in terms of their number and types within each zone. In many cases, a circular hazard area is a fair representation. However, given certain topographies and/or meteorological phenomena, ellipses or other shapes might be more representative of true hazard areas.

The types of damages to each receptor that may occur in each zone should be considered. Characterization can be in terms of percentage of maximum damage or percentage chance of the maximum damage. For instance, in a zone close to the ignition point and following a very high consequence event, the damage state to humans might be 2% fatality and 100% injury. A more distant zone might be characterized as a damage state to humans of 0.1% fatality and 20% chance of injury. In the case of non-absolute damage states such as injuries or property damage, the percentage can be thought of as either x% chance of any damage, or a 100% chance of a damage that is x% of the maximum possible damage. Both conceptualizations are supported since the mathematical approach would be the same for each.

Recall that, as a modeling convenience, the probability of a certain hazard zone occurring is considered to also capture the diminished damage potential at the increasing distance.

Receptors at farther hazard zones produce lower expected losses since their probabilities of damage are lower. They are lower for two reasons: lower chance of that hazard distance happening, and lower intensities resulting in less damage to the receptor at farther distances.

Damage State Estimates for Each Zone

Hazard Zone	injury rate	fatality rate	environment damage rate	service interruption rate
<100’	80%	8%	50%	100%
100’-50% PIR	50%	5%	30%	90%
50% -100% PIR	20%	2%	10%	80%

1. Multi-hazard zone analysis

Characterization of the receptors within each hazard zone includes count and type. Receptors can be efficiently quantified in terms of ‘units’ where each unit represents an individual or area (ft², m²) of that type of receptor. The number of people impacts the injury and fatality potential. The area of environmental sensitivity impacts the clean up costs. The number of buildings impacts the property damage potential. The unitization can follow any logical means of quantification.

When consequences are monetized and risk expressed as EL, a unit is assigned a value, reflecting the cost of replacement, remediation, and other compensation. Environmental damages can be quantified in “environmental units”, where the evaluator sets some equivalences among possible scenarios. For instance, an acre of ‘old growth forest’ may be set as 1 environmental unit, while a T&E species is set at 10 and an uncleanable aquifer at 15. In the absence of more definitive data, these are value judgments best established by knowledgeable environmental specialists along with company managers.

The receptor characterization will be determined by the scope of the assessment, with more robust assessments requiring more detailed characterization. For instance, some models will make distinctions among human populations—age, mobility, etc—for some thresholds. Consideration of shielding is another possible variable. Shielding of almost any kind is an effective reduction to radiant heat, minimizing damages or allowing more escape time. It can be incorporated into the receptor characterization or used as a stand-alone variable—a factor to reduce potential damages.

Steps 3 and 4 will have produced characterizations of possible receptor damages in each zone. Ideally, the risk evaluator will now have the ability to answer, at least generally, questions such as:

• • • How many people are typically in each zone?
    • What is the potential rate of injuries, fatalities in each zone?
    • What is the potential rate or % of other damages in each zone?
    • How much property damage is likely in each zone?
    • How much and what type environmental damage is possible in each zone?

He will also have gained the ability to answer these questions in somewhat quantitative terms, although many assumptions and uncertainties are usually embedded in such quantifications.

Three types of receptor-damages are recognized in this example: fatalities, injuries, and environmental damages. Other common receptors/damages include service interruption costs and property damages. Not shown in this table but used in the calculations, is a benefit from shielding. The evaluator estimates that, in this area, shielding from buildings, trees, etc; the amount of clothing normally worn; and the emissivity (heat movement through the atmosphere), a reduction factor of 30% should be applied to the injury and fatality rates. This assumption could also have been embedded in the overall damage rate estimates, but in this example, the modeler keeps this variable separate so that it can be a distinguishing factor when shielding conditions change. More detailed receptor characterizations are of course possible and supported by this approach. For instance, the population might be divided into groups based on increased susceptibility to injury or death, such as: “limited mobility”; “unshielded”; “weakened immune systems”; etc. Similarly, the environmental units could be categorized into many different subgroups. As with many aspects of modeling, the evaluator must make decisions involving tradeoffs between robustness and simplicity.

As another modeling convenience, receptors are measured in terms of units. A higher quantity or sensitivity of receptor type is captured in terms of more units. A dollar value is assigned to a unit of each type. In this example, an injury is valued at $100K, a fatality at $3.5M, and an environmental unit at $50K. Such valuations should be carefully set and fully documented.

repeats some information from and then shows how the scenarios are further developed using & and the valuations discussed.

Occurrence probabilities and valuations combine to arrive at expected losses for each receptor in each scenario. For instance, in the case of the first scenario, the human injury cost is estimated as the product of (scenario probability, over some time period) x (# of people) x (injury rate in zone “100’ to 50% PIR”) x (30% shielding benefit factor) x (cost of injury) = 4.8% x 5 x 50% x 30% x $100,000 = $3,600 per scenario. If the scenario frequency is estimated to be once every 10 years, then the expected human injury loss is $360 per year at this location.

Characterization of Receptors Within Each Zone at a Particular Pipeline Location

Hazard Zone	No. of people	No. of Environ Units	No. of Service Interruption Units
<100’	1	0.5	1
100’-50% PIR	5	1	5
50% -100% PIR	10	1	10

Each scenario has an associated probability of occurrence, produces a certain hazard zone, and contains certain numbers and types of receptors with associated dollar values. Multiplying these values together and then summing the results for each hazard zone produces the expected loss for the pipeline segment.

The composite consequences per failure at this location on the pipeline is estimated to be ~$166K, as shown in . This is the expected loss from all pipeline failure scenarios. The annual expected loss is obtained by multiplying this value by the annual failure rate. If that value is 10^-3 failures per mile-year and this “location” on the pipeline represents one mile, then the expected loss is ($166K per failure per year) x (10^-3 failures per mile-year) = $55 per year. Therefore, over long periods of time, the cost of pipeline failures for this one mile of pipe is expected to average about $55 per year, as is shown in .

Estimating Expected Loss from Hazard Zone Characteristics

Hole Size	Ignition Scenario	Maximum Distance (ft)	Probability of Maximum Distance	Hazard Zone Group	# people	Human injury costs	Human fatality costs	# environ units	Environ Damage Costs	Probability weighted dollars per failure
rupture	immediate	400	4.8%	100’-50% PIR	5	$ 3,600	$ 12,600	1	$ 720	$ 16,920
delayed	1500	1.6%	50% -100% PIR	10	$ 960	$ 3,360	1	$ 80	$ 4,400
no ignition	300	1.6%	100’-50% PIR	5	$ 1,200	$ 4,200	1	$ 240	$ 5,640
medium	immediate	300	1.8%	100’-50% PIR	5	$ 1,350	$ 4,725	1	$ 270	$ 6,345
delayed	600	1.8%	100’-50% PIR	5	$ 1,350	$ 4,725	1	$ 270	$ 6,345
no ignition	100	8.4%	100’-50% PIR	5	$ 6,300	$ 22,050	1	$ 1,260	$ 29,610
small	immediate	50	8.0%	<100’	1	$ 1,920	$ 6,720	0.5	$ 1,000	$ 9,640
delayed	80	8.0%	<100’	1	$ 1,920	$ 6,720	0.5	$ 1,000	$ 9,640
no ignition	30	64.0%	<100’	1	$15,360	$ 53,760	0.5	$ 8,000	$ 77,120
	100.0%	Total expected loss per failure at this location	$165,660

Table Notes:

Not shown is a Shielding factor: estimated as a percentage, this adjusts the damage estimate by considering protective benefits of all shielding opportunities including clothing, buildings, etc. in each hazard group and for each receptor type. In this example, 30% shielding factor is used.

Final Expected Loss Values

Expected Loss
Failure Rate (failures per mile-year)	Probability of Hazard Zone1,2	Probability weighted dollars2,3	Probability weighted dollars per mile-year
0.001	4.80%	$16,920	$0.81
1.60%	$4,400	$0.07
1.60%	$5,640	$0.09
1.80%	$6,345	$0.11
1.80%	$6,345	$0.11
8.40%	$29,610	$2.49
8.00%	$9,640	$0.77
8.00%	$9,640	$0.77
64.00%	$77,120	$49.36
	100.00%	$165,660	$54.59

Table Notes:

¹after a failure has occurred

²from

³(damage rate) x (value of receptors in hazard zone)

The expected loss values can be viewed as part of the cost of operations. They can be used in decision-making regarding appropriate spending levels. The expected loss for this segment can be combined with all other segments’ expected losses to arrive at an expected loss for an entire pipeline or pipeline system. So, while $55 per year appears very low, a 500 mile pipeline with the same estimates as this segment, suggests an expected loss from failures of over $27,000 per year.

This example illustrates the representation of risk as a frequency distribution of all possible damage scenarios, including their respective probabilities and consequence costs. The distribution is characterized by a representative number of point estimates produced by this evaluation. The point estimates show the range of risks and can themselves be compiled into a single estimate for the entire range of possibilities.

When risk aversion—disproportionate costs for higher consequences—is also considered, the overall expected loss value should not be used in isolation. The very rare, but very consequential scenarios, are obscured when all scenarios are compiled into a single point estimate. The more consequential events might warrant further consideration.

1. 1. 1. A risk assessment not focused on leak/rupture may not require hazard area estimations. ↑

      2. Of course, the ‘edge’ is defined by some chosen criteria and tends to grow from the point of origin ↑

      3. U.S. Department of Housing and Urban Development (HUD) published a guidebook in 1987 titled Siting of HUD-Assisted Projects Near Hazardous Facilities: Acceptable Separation Distances from Explosive and Flammable Hazards. The guidebook was developed specifically for implementing the technical requirements of 24 CFR Part 51, Subpart C, of the Code of Federal Regulations. The guidebook presents a method for calculating a level ground separation distance (ASD) from pool fires that is based on simplified radiation heat flux modeling. The ASD is determined using nomographs relating the area of the fire to the following levels of thermal radiation flux ↑

      4. As defined in US regulations ↑

      5. pool diameters, the study produced ‘equilibrium diameters’ of around 300 ft for 8” pipelines and 1,900 ft for 30” pipelines. The report does not discuss how such pools can be formed by propane under atmospheric conditions (ie, the expected HVL behavior is not explained) ↑