The Use of QRA To Inform the Design

of a High-Pressure Onshore Pipeline

Stacy Nelson, Total E&P UK, Margaret Caulfield, Vectra Group, and Andrew Cosham, Atkins Boreas
Summary
The management of onshore-pipeline safety in the United King-
dom is governed by the Pipelines Safety Regulations, 1996. This
requires pipeline operators to design, build, and operate pipelines
to ensure that they are safe, so far as is reasonably practicable. This
is achieved, in part, by applying good practice and designing the
pipeline to recognized onshore-pipeline design codes. Where the
proposed design falls outside code guidance, a quantitative risk
assessment (QRA) provides an effective means of demonstrating a
safe design.
This paper describes a study that was carried out to define the
design requirements for the onshore section of a multiphase
pipeline. The proposed pipeline will have a design pressure of
380 barg. However, onshore design codes PD 8010-1 (2004) and
IGE/TD/1 (Steel Pipelines 2001) do not provide guidance on the
design of pipelines with pressures exceeding 100 barg. Experience
from other projects indicates that it is important to consider the
implications of such high design pressures early in a project.
The QRA considered a number of different design options. The
safety risks of the proposed pipeline options were compared with
those from a typical 100-barg-gas-transmission pipeline of the
same diameter. This means that the risk of the proposed pipeline
can be compared in a relative manner, to an acceptable design, and
in an absolute manner to limits on individual and societal risk.
The results of QRAs of the different design options are sum-
marized and discussed. The effects of mitigation measures, such as
reducing the pipeline-design factor (the ratio of the hoop stress to
the specified minimum yield strength), increasing the wall thick-
ness, and incorporating a pressure-limiting system at the landfall,
are illustrated.
It is shown that the proposed design is feasible. The individual
and societal risks for the proposed design were lower than that of a
typical 100-barg-gas-transmission pipeline. The individual risk was
in the broadly accepted region of risk, as defined by the UK Health
and Safety Executive (HSE), and the societal risk was below the
acceptance criterion given in IGE/TD/1 (Steel Pipelines 2001).
Introduction
In the United Kingdom, the management of pipeline safety is
governed by the Pipelines Safety Regulations, 1996. These regu-
lations consist of goal setting and encompass a risk-based ap-
proach to safety. They require pipeline operators to design, build,
and operate pipelines to ensure that they are safe, so far as is
reasonably practicable (Chatfield 2005). The safety of the pipeline
is achieved in part by applying recognized onshore-pipeline design
codes. However, in some cases, there is a need to demonstrate the
safety of the pipeline by quantifying the risks associated with the
pipeline installation and ensuring that the risks in the vicinity of
the pipeline are as low as reasonably practicable.
This paper describes a case study that was conducted at the
early stages of a development project to identify the risks associ-
ated with a high-pressure onshore pipeline. The development in-
volved a gas field located approximately 125 km northwest of the
Shetland Islands, UK. The produced gas, wet natural gas of ap-
proximately 86% methane, was assumed to be transported to a
gas-processing plant on the Shetland Islands by two new 16-in.
import pipelines. The pipelines were assumed to have a design
pressure of 380 barg, equal to the wellhead shut-in pressure from
the gas field. However, the normal operating pressure was ex-
pected to be 63 barg. Two main import routes were investigated by
the project. One route involved a mainly offshore route, with a
short onshore section where it came into the gas plant. The other
route, which is the subject of this paper, included a 19-km section
of onshore pipeline.
The UK has approximately 7,000 km of high-pressure onshore
gas-transmission pipelines operating in the range of 70 to 85 barg.
There are several precedents for short onshore gas pipelines with
design pressures greater than 100 barg [e.g., the Central Area
Transmission System (CATS) pipeline, the Interconnector Pipe-
line from Belgium to the UK, and the BBL Pipeline from The
Netherlands to the UK]. (The definition of the boundary between
onshore and subsea pipelines in PD 8010-1 means that all subsea
pipelines that go to an onshore terminal have a short onshore
section.) However, the proposed pipeline is atypical because of the
high pressure (up to 380 barg) and the relatively long onshore
sections (up to 19 km) that will traverse through areas that are not
within, or adjacent to, a gas-processing terminal.
In view of the potentially sensitive nature of such a high-
pressure pipelinethe history of the Corrib development (Corrib
Gas Development 2005) is instructive in this regardit was con-
sidered important to investigate the implications of the proposed
onshore pipeline in the early stages of the project. The results of
this study would inform the decision on which potential routes to
take forward to detailed design. Consequently, a QRA was con-
ducted of various options for the proposed onshore pipeline. It is
normally unusual to conduct this level of risk analysis at such an
early stage of a project.
The main aspects of the case study are described in the paper:
Identification of the main requirements of the pipeline-
design codes
Definition of the proposed pipeline-design cases
Description of the methodology used for conducting the QRA
Discussion of the results obtained for the individual and so-
cietal risk
Onshore-Pipeline Design Codes. In securing compliance with the
regulations, the UK HSE expects duty holders to apply relevant
good practice in design, and safe management principles through-
out operation. Within the UK, the main pipeline codes recognized
by the HSE as being good practice are
IGE/TD/1 Edition 4: 2001, Steel Pipelines for High Pressure
Gas Transmission (Steel Pipelines 2001)
PD 8010-1: 2004, Code of Practice for PipelinesPart 1:
Steel Pipelines on Land (PD 8010-1 2004)
BS EN 1594: 2000, Gas Supply SystemsPipelines for
Maximum Operating Pressure Over 16 barFunctional Require-
ments (BS EN 14161 2003).
The PD 8010-1 and IGE/TD/1 pipeline codes were identified as
being most relevant for application to the proposed pipeline. These
codes specify a system of location class, limits on the hoop stress
(design factor), and minimum distances from normally occupied
buildings to control the risk imposed by the pipeline on the sur-
rounding population.
IGE/TD/1 is applicable to the design of onshore pipelines for
the transmission of dry natural gas (predominantly methane) at a
Copyright 2008 Society of Petroleum Engineers
This paper (SPE 111672) was accepted for presentation at the Eighth SPE International
Conference on Health, Safety & Environment in Oil and Gas Exploration and Production
held in Abu Dhabi, UAE, 24 April 2006. Original manuscript received for review 16 No-
vember 2007. Paper peer approved 28 January 2008.
1 September 2008 SPE Projects, Facilities & Construction
maximum operating pressure not exceeding 100 barg. IGE/TD/1
may be applied to other gases, provided that the characteristics and
consequential effects are taken into account (e.g., internal corro-
sion for wet gas and fracture propagation for rich gas).
PD 8010-1 is applicable to the design of onshore pipelines for
the transmission of oil, gas, and other substances that are hazard-
ous by the nature of being explosive, flammable, toxic, reactive, or
liable to cause harm to persons or the environment. The scope of
PD 8010-1 does not quote a maximum pressure, but reference is
made to the 100-barg limit in IGE/TD/1. Because PD 8010-1 is
applicable to a wide range of different fluids (not just natural gas),
it classifies fluids to be transported in pipelines with respect to
their potential hazard to public safety (e.g., Category Dnontoxic,
single-phase natural gas; and Category Eflammable and/or
toxic fluids that are gases at ambient temperature, and at atmo-
spheric pressure conditions, and are conveyed as gases or liquids).
The closest classification relevant to the proposed (wet) gas de-
velopment is Category E. Location classification, population
density, and proximity requirements are specified for Category-D
and -E fluids.
ASME B31.8, a gas-pipeline design code used in the USA and
internationally, also specifies a system of location class and limits
on the hoop stress, but it does not specify a minimum distance to
occupied buildings (ASME B31.8-2003 2003). A supplement to
the design code, ASME B31.8S, introduces the concept of a po-
tential impact area, which is similar to the proximity distances in
PD 8010-1 and IGE/TD/1, but is not a minimum distance (ASME
B31.8S 2004).
QRA. Risk is influenced by two main factors: (1) the probability
of failure and (2) the resulting consequences. The magnitude of the
risk is dependent on how likely the event is to happen and how
severe the consequences would be if that event were to happen. A
risk may be high if one of these factors is high; however, although
the consequence of an event may be severe, the resulting risk may
be low because of the low probability of that event occurring.
The pipeline-design codes aim to reduce the failure probability
by stipulating requirements for the mechanical design such as the
design factor, wall thickness, and depth of burial. Failure conse-
quences are managed by prescribing the separation distance for the
pipeline on the basis of the location and population density.
The use of QRA provides a means of demonstrating that the
risk associated with the pipeline design is acceptable, so far as is
reasonably practicable. In a QRA, both the probability of pipeline
failure and the consequences of failure are quantified. The risk to
the surrounding population is then expressed numerically as an
individual risk, in the form of a risk transect, and as a societal risk,
commonly in the form of a frequency/consequence (FN) curve.
Both individual and societal risks need to be considered when
demonstrating that the risk of the proposed onshore pipeline is
acceptable or is as low as reasonably practicable (ALARP).
The QRA was an integral part of the pipeline-design process.
The main drivers for the use of this approach were
The pipeline is atypical, and there is no specific guidance in
the design codes for pressures in excess of 100 barg.
The risk-assessment methodology serves as a useful tool to
compare different pipeline-design options and provides a frame-
work for deciding on the most appropriate design solution.
There are a number of risk-mitigation measures that could be
applied to the onshore pipeline to reduce the risk to the population
further such as modification to the route or a lower design factor.
These also have been considered as part of the case study.
A number of assumptions and simplifications were made for
the purposes of this QRA because it was conducted in the early
stages of project development. These assumptions and simpli-
fications would need to be revised in the detailed-design stage of
the project.
Pipeline-Code Requirements
It was acknowledged in the early days of the pipeline industry that
the most significant factor contributing to the damage of pipelines
was external interference. The original intent of pipeline-design
codes was, therefore, to route the pipeline away from the popula-
tion to reduce the probability of damage from activities in the
vicinity of the pipeline. The requirements of the PD 8010-1 and
IGE/TD/1 codes for pipelines conveying Category D and E fluids
are in terms of the pipeline design factor; population density, or
number of persons per unit area in the vicinity of the pipeline and
proximity to occupied buildings.
Design Factor. PD 8010-1 and IGE/TD/1 both define the maxi-
mum permitted design factor, with respect to hoop stress, on the
basis of the location or area through which the pipeline is routed.
PD 8010-1 refers to the location class, while IGE/TD/1 refers to
the area type. The classification depends on the population density
along the route of the pipeline and is similar for both pipeline
codes. The area classification and corresponding design factor are
presented in Table 1.
The design factor is limited to 0.3 in suburban areas because, at
this stress level, it is very unlikely that a pipeline will fail as a
rupture. The maximum permitted design factor is increased to
0.5 in IGE/TD/1, if the wall thickness is at least 19.05 mm, be-
cause it has been shown that it is unlikely that significant damage
could be introduced into a pipeline of this thickness.
Population Density. The population density is defined in terms of
the number of persons per hectare. The population density for each
area type in IGE/TD/1 and PD 8010-1 is defined in Table 1. The
population density is the average number of persons per unit area,
within a 1.6-km strip, centered on the pipeline. PD 8010-1 states
that if individual-risk contours are available, then the width of this
strip should be based on the 0.3-chance-per-million (cpm) indi-
vidual-risk contour. In the absence of individual-risk contours, PD
8010-1 uses a building-proximity distance (BPD) in a manner
similar to IGE/TD/1. Here, the population density is defined as the
average number of persons per unit area along a 1.6-km strip,
centered on the pipeline, with a width equal to eight times the BPD
for a Type-R-area pipeline; see Fig. 1.
2 September 2008 SPE Projects, Facilities & Construction
Proximity to Occupied Buildings. The design codes require that
there be a minimum distance between the pipeline and occupied
buildings. PD 8010-1 states that if individual-risk contours are
available, then the distance between the pipeline and occupied
buildings should not be less than the distance to the 10-cpm indi-
vidual-risk contour. In the absence of individual-risk contours, PD
8010-1 uses the BPD to define the requirements. The BPD speci-
fies the minimum distance from the pipeline to normally occupied
buildings (i.e., there should be no normally occupied buildings
within 1 BPD of the pipeline); see Fig. 1.
Proximity distances are different for different fluids, to reflect
their potential to cause a hazard. For pipelines transporting Cat-
egory-D fluids, PD 8010-1 refers to the BPD in IGE/TD/1. This
gives BPDs for pipelines in rural areas and suburban areas. The
BPDs for suburban areas are smaller than those for rural areas,
even though the population density around the pipeline is higher,
because the maximum permitted design factor in suburban areas is
lower, so the probability of failure is lower. For Category-E fluids,
PD 8010-1 defines the equivalent of a BPD with an equation that
includes pressure, diameter, and a substance factor. The substance
factor is related to the hazard potential of the fluid.
The BPD depends on the maximum operating pressure and the
diameter of the pipeline; the BPDs for a single 16-in.-diameter
natural-gas pipeline in a rural area are shown by Line F in Fig. 2.
The BPDs are based on considerations of risk and can be related to
the thermal radiation from an ignited full-bore release. The scope
of IGE/TD/1 is limited to a maximum operating pressure not ex-
ceeding 100 barg because BPDs have not been calculated for
higher pressures.
Pipeline-Design Definition
The development of the case study for the pipeline design first
involved an initial definition of the onshore-pipeline routes. This is
an iterative process because the pipeline-design parameters (e.g.,
pressure and design factor) have implications for the route, and
vice versa. To summarize,
The diameter and design pressure of the proposed pipe-
line were used to estimate the minimum BPD required by the
design code.
Potential routes were identified by looking at maps and
undertaking a site survey, with regard to the BPD and the popu-
lation density.
A QRA was conducted to determine if the proposed routes
for the pipelines impose an acceptable risk on the surround-
ing populations.
Fig. 1Definition of the area for determining the population density along the route of a pipeline.
Fig. 2Minimum proximity distance from normally occupied buildings of pipelines in Type-R areas (Steel Pipelines 2001).
3 September 2008 SPE Projects, Facilities & Construction
The BPD for the proposed pipeline was determined by use of
the equation given in PD 8010-1 (2004). The proposed pipeline is
a multiphase pipeline, although the fluid is mostly methane. There-
fore, conservatively, the substance factor for natural-gas liquids
was used. The proposed pipeline would consist of two 16-in. pipe-
lines laid in a common trench (to minimize construction impact).
Therefore, the proximity distances were calculated for a single
pipeline and for the equivalent of two adjacent pipelines. The
estimated minimum proximity distances for a single pipeline are
given in Fig. 3. The distances follow a trend similar to that of the
radius of the potential impact area, as defined in ASME B31.8S
(2004), and are conservative with respect to extrapolating the
curves in IGE/TD/1.
The publics perception of risk is as influential as engineering
calculations and the results of a QRA. It was, therefore, considered
prudent, where practically possible, to find a route that used the
proximity distances defined in PD 8010-1 because these were
believed to be conservative.
Pipeline-Route Options. Two route options were considered for
the onshore import pipeline. Both onshore routes have the landfall
at Sand Wick, on the west coast of the Shetland Islands, with
approximately 19 km of onshore pipeline to the Sullom Voe Ter-
minal (SVT). The first route option is by way of Urafirth (Route
A). The second option is routed further north by way of Upper
Urafirth (Route B). The routes are shown as the black lines in Fig. 4.
Fig. 3Estimated minimum proximity distance from normally occupied buildings for the proposed pipeline.
Fig 4Map showing part of the onshore section of the import pipeline, Sand Wick to SVT by way of Urafirth.
4 September 2008 SPE Projects, Facilities & Construction
Note that the red lines signify roads. The red circles on the maps
represent clusters of dwellings, and the numbers shown against
each of the circles are the number of dwellings when there is more
than one.
For each route, the most-populated 1-mile section along the
pipeline was identified for input to the risk assessment. The worst-
case 1-mile onshore section of Route A lies along the section of
the pipeline indicated by the bold blue line in Fig. 4. The worst-
case 1-mile onshore section of Route B was also found to lie along
this section of the pipeline and is indicated by the bold green line
in Fig. 4.
Pipeline-Design Cases. The definition of the pipeline-design cases
was based on the requirements of the PD 8010-1 pipeline code,
with reference to IGE/TD/1. The pipeline route is mainly through
rural areas; therefore, the design factors were chosen on the basis
of that area classification. It was assumed in the study that the
depth of cover of the pipelines would be at least 1.1 m, in accor-
dance with IGE/TD/1. The options considered in the case study are
given in Table 2.
The design of the pipeline includes a corrosion allowance of
3 mm (the design factors in Table 2 do not include the corrosion
allowance). For the risk assessment, the corrosion allowance was
included to reflect the true pipeline proposed for the study. This
corrosion allowance will be valid at the start of the lifetime of the
pipeline, but as the pipeline ages, there may be internal corrosion,
which reduces the wall thickness. To consider the effect of the re-
duced wall thickness on the failure frequency, a sensitivity study was
undertaken, and the impact on failure frequency and subsequent
risk was investigated. This is discussed in QRA Methodology.
The gas-transportation system in the UK consists of national
and local transmission systems. The national transmission system
has pipelines with diameters of 18 to 48 in. that operate at pres-
sures typically from 70 to 85 barg. These large-diameter pipelines
typically operate at a design factor of 0.72. The approach to the
risk assessment was to compare the risk of each of the proposed
pipeline-design cases with a typical pipeline of the same diameter
that is unambiguously within the design code. The MAOP of the
reference pipeline was chosen at 100 barg because this was the
highest pressure covered by IGE/TD/1. This then means that the
risk of the proposed pipeline can be compared in a relative manner
to an acceptable design, and in an absolute manner to limits on
individual and societal risk.
The installation of a pressure-limiting system at the landfall
was considered as part of the design for inclusion in the risk
assessment. The onshore pipeline would be designed to withstand
the full wellhead shut-in pressure of 380 barg. The pressure-
limiting system would provide additional protection by preventing
the downstream onshore pipeline from being exposed to pressures
higher than a predetermined value. Two set pressures were con-
sidered for the risk assessment: 233 barg (Case 3) and 140 barg
(Case 4). The reduction in onshore pressures for these cases re-
sulted in a decrease in the design factor because the wall thickness
was maintained the same as it was for the 380-barg-design case.
QRA Methodology
The methodology employed for the QRA involved a number of
discrete steps that are illustrated in Fig. 5. The first step in the
QRA process requires the identification of the complete set of
applicable hazards and hazardous events for subsequent analysis. It
is then necessary to perform the following assessments for these
identified hazards:
Determine the frequency of occurrence of the initiating event.
Develop potential scenarios showing the possible outcomes
of each initiating event.
Analyze consequences (e.g., release rates, vapor-dispersion
distances, fire effects) for each of the hazardous events.
Assess impact in terms of the effects of these consequences
on people and occupied buildings.
Summarize risk, combining the outputs of the above steps to
procure estimates of individual- and societal-risk levels.
Compare the assessed risk levels against established risk cri-
teria, and where necessary, demonstrate ALARP.
Consider additional risk-reduction measures where neces-
sary, as indicated in the feedback loop.
The application of these steps to the onshore-pipeline assess-
ment is described in the subsequent five sections. To summarize,
the QRA considered the risk by thermal radiation from the imme-
diate ignition of ruptures caused by external interference.
Hazard Identification. A hazard-identification study was carried
out as part of the development project to identify all possible
hazards and hazardous events for the onshore pipeline. The dom-
inant type of hazard for the pipeline is the occurrence of loss of
containment, resulting in a release of a pressurized hydrocarbon
fluid. Natural gas is flammable, and ignition of a release would
lead to fire hazards, which could impact buildings and personnel
within the hazard zone because of thermal radiation.
In theory, dispersing gas could enter buildings along the route,
leading to gas buildup to flammable concentrations and possible
explosion hazards should an ignition source be present. The gas
conveyed by the pipeline is nontoxic, and as such, the risk asso-
ciated with the release of a toxic vapor has been dismissed.
Frequency Analysis. The probability of failure of a pipeline is
determined by considering all credible failure modes or threats to
the integrity of the pipeline. These failure modes could include
External interference (mechanical damage)
Corrosion
Fatigue
Weld defects
Pipe-body (manufacturing) defects
Ground movement
Natural events (e.g., earthquakes)
Human error
The main causes of pipeline failures in the UK and Europe
are external interference and corrosion (Browne and Hicks 2005;
6
th
EGIG-Report 2005). External interference is more likely to
cause a rupture than corrosion (Browne and Hicks 2005; Pipeline
Performance in Alberta 1998). Therefore, for the purposes of the
QRA, it was assumed that other failure modes would not contrib-
ute significantly to the overall risk, and that only failures caused by
external interference need to be considered. This assumption
would need to be revisited in the detailed-design stage.
Ruptures are rare events and difficult to use in a predictive
manner. However, where damage data have been recorded, the
failure frequency can be calculated using a combination of histori-
cal data with statistical techniques or detailed structural-reliability
5 September 2008 SPE Projects, Facilities & Construction
analyses. An analysis of the United Kingdom Onshore Pipeline
Operators Association (UKOPA) failure data was used as the
basis for obtaining the failure frequency of the proposed import
pipeline (Mather et al. 2001; Browne and Hicks 2005). This analy-
sis subdivides the data to a greater level of detail than is normally
published and uses statistical techniques to fill in gaps for pipeline
geometries for which failure has not, to date, been reported.
Factors were then applied to take account of wall thickness,
depth of cover, and location type. These factors were obtained
from the analysis of the UKOPA failure data and by use of a
predictive method that combines historical data with defect failure
models (Corder and Fearnehough 1987). A comparison with fail-
ure frequencies derived by use of structural-reliability analysis
showed that the frequencies derived from a statistical analysis of
the historical data were reasonable; see Fig. 6. The latter were used
in the QRA.
Fig. 5QRA methodology.
Fig. 6Estimated failure frequency of the proposed pipeline. (Pipe diameter given in inches, wall thickness given in millimetres.)
6 September 2008 SPE Projects, Facilities & Construction
The proposed pipeline comprises two 16-in. pipelines. There-
fore, the calculated failure frequency has been doubled.
Consequence Analysis. The consequence analysis involves the
identification of the potential types of release, determination of the
release rates for each scenario, and an assessment of the type of
hazardous event that might occur subsequent to the release.
Gas Releases. Releases from leaks can occur only up to some
critical size before they propagate to produce a full-line rupture.
The analysis methodology calculated equivalent circular-hole
sizes for critical-length leaks. Smaller-leak and pinhole failures
would result in a steady-state jet fire. Because of the depth of
cover, it is considered that any leak or pinhole failure will result in
a vertical release.
Following a major failure such as a rupture, the pipeline will
depressurize as gas is released. The release will initially form a
toroidal, or mushroom-shaped, cloud rising at the head of a tran-
sient jet, which quickly disappears, to leave the jet fed from the
continuing release from the two pipe ends. The pressure in the
pipes will fall, rapidly at first, until a steady-state condition is
reached where gas continues to be supplied, or it falls to zero
where the gas supply is stopped. The time at which steady-state-
flow conditions are reached will depend on the position of the
isolation valves and, thus, the lengths of pipe involved.
The transient gas outflow from the pipeline was calculated with
a consequence-assessment package over the range of cases to be
considered in the risk assessment. The import pipeline was taken
to be 121 km in length, with the position of the rupture at 100 km
from one end.
Crater Formation. If an underground pipeline fails as a rup-
ture, a crater will be formed as a result of soil being ejected as
debris while the stored pressure in the pipeline is released. It is
possible that some items of debris could be ejected as missiles and
travel for considerable distances. The effect of these would, how-
ever, be localized.
The shape of the crater, which acts as the source for the sub-
sequent release, is a function of the pipeline diameter, depth of
cover, operating pressure, soil type, failure length, and alignment
of the pipe ends. The standard assumption for a modern high-
toughness pipeline is that the failure will be arrested within ap-
proximately two pipe lengths. It is also assumed that the pipe ends
at the point of failure will remain anchored in the ground and
remain aligned. The crater shape for the normal range of depth of
cover will then approximate to a semi-ellipse with steep, or even
incurved, sides at the ground surface. The jets issuing from the two
pipe ends will interact within the crater and exit the crater as a
vertical jet that can then be affected by the wind.
Gas Dispersion. The gas released from the crater will form a
high-velocity momentum-driven jet initially directed vertically
into the atmosphere, where it will be influenced by the wind. The
effective diameter of the source of this vertical jet has been taken
as 10 pipeline diameters, which is consistent with data from
incidents and crater-formation models (Hopkins et al. 1993). The
dispersion of this release was simulated with the consequence-
assessment package. All the simulations indicated that the disper-
sion is momentum-dominated in such a way that the gas will
mix with the surrounding atmosphere and disperse to the lower
flammable limit as a jet. The simulations also indicate that the
flammable envelope does not extend significantly downwind at
ground level. Therefore, it is considered extremely unlikely that
gas would enter, or be present in the vicinity of, buildings at
hazardous concentrations.
Ignition. The hazards from a pipeline failure are dominated by
those associated with a locally ignited release. Ignition of a release
from a pipeline rupture can result from a range of sources, both
close to and remote from the release, and could occur immediately
or following a delay. Because of the nature of the release, with an
initial highly transient phase followed by a slowly decaying (quasi
steady-state) release, the longer ignition is delayed, the fewer the
consequences. If ignition occurs immediately, the gas released
during the initial transient (mushroom-cloud) phase will burn as a
fireball rising rapidly into the air and burning out within approxi-
mately 30 seconds after the failure (Acton et al. 1998). If ignition
is delayed, the fireball will not be seen. For the purposes of this
study, ignition is assumed to be immediate because this is the
more-pessimistic option.
An ignition probability of 0.5 was assumed for rupture releases,
and a value of 0.1 was assumed for leaks. These values are higher
than the European-gas-pipeline-incident-data-group (EGIG) inci-
dent data, which suggest 0.3 for ruptures and 0.02 for leaks (6
th
EGIG Report 2005). The ignition probability is, however, likely to
increase with increasing pressure, and it is considered that the
values chosen are appropriate for the proposed import-pipeline
pressure and diameter.
Impact AssessmentThermal-Radiation Effects. The assess-
ment of the impact of a fire is based on two hazard distances
derived from a prediction of the thermal-radiation hazards of an
ignited release:
The building-burning distancethe distance to which build-
ings could be ignited, assuming that this will occur as a result of
piloted ignition
The escape-to-shelter distancethe distance at which
people out of doors could reach shelter beyond the building-
burning distance
Ignition of combustible material on buildings or structures can
also be caused by intense thermal radiation, although this again is
dependent on the thermal-radiation flux level and the time of ex-
posure. The threshold for buildings exposed to thermal radiation is
taken as the thermal-radiation dose, at which secondary fires may
be started by piloted ignition of combustible materials (this incor-
porates a minimum threshold of 12 kW/m
2
) (Acton et al. 1998).
To evaluate the escape-to-shelter distance, it has been assumed
that an individual outdoors will be a casualty if he/she receives a
total thermal dose of 1,060 thermal dose units (tdu), representative
of a 1% lethality rate (Hymes et al. 1996). The duration of expo-
sure for an individual outdoors was 30 seconds, which was con-
sidered to be a reasonable time for a person to reach shelter or
escape from the incident. For the immediate-ignition cases, the
thermal dose was calculated as a combination of the dose received
during the fireball, plus the dose received by the jet fire, up to a
total exposure time of 30 seconds. The worst-case assumption of
immediate ignition was made for each scenario.
The hazard distances computed from the simulation of a rup-
ture in the proposed pipeline are given in Table 3. Table 4 gives
7 September 2008 SPE Projects, Facilities & Construction
the hazard distance for a leak for the case with the largest flow rate.
These are the hazard distances for the failure of a single pipeline.
The proposed pipeline layout comprises two 16-in. pipelines. In
the QRA, it has been assumed that the failure of one pipeline will
not cause the failure of the adjacent pipeline.
On the basis of an average escape velocity for an able-bodied
person of approximately 2.5 m/s, it is clear that, within 30 seconds,
such an individual will be able to escape beyond the distances
quoted in Table 4. An additional analysis was performed for the
leak corresponding to the maximum escape distance for credible
puncture fires, to determine the dose received by an individual
escaping from the release at 2.5 m/s. This analysis indicated that
the individual would receive only 339 tdu, escaping to a radiation
level of 4 kW/m
2
(i.e., significantly less than the 1,060 tdu used for
the 1% lethality level). Therefore, it can be seen that at the escape
velocity, the thermal dose received by an able-bodied person
would not be sufficient to contribute to the risk from the pipeline
(i.e., those exposed would be able to escape before becoming
casualties). Therefore, it is also the case that for buildings located
within the building-burning distance, their occupants would be
able to escape to safety before becoming casualties. There are no
buildings within the burning distances given in Table 4.
The impact assessment indicates that leaks do not contribute
significantly to the risk at the populated locations, and hence, the
risk assessment has been restricted to ruptures.
Calculation of Individual and Societal Risk. Individual Risk.
Individual risk is defined as the risk of becoming a casualty to an
individual who is present at a given location (either indoors or
outdoors, or a combination of the two) for 365 days/yr. The indi-
vidual risk will be a function of the distance of the location from
the pipeline and the proportion of time that the occupant spends
indoors/outdoors at the location. It has been assumed that a house
occupant is present 100% of the time with 10% of the time out-
doors, the standard used in the UK (Reducing Risks 2001).
The variation of individual risk at locations in the vicinity of
the pipeline is determined primarily by the length of pipeline that
could potentially impact that location following a failure, usually
referred to as the interaction length. Fig. 7 illustrates the concept
of the interaction length for building occupants based on the build-
ing-burning distance. Where occupants are outdoors, the inter-
action length would be based on the escape distance.
The pipeline-failure frequency at each step is combined with
the interaction length and ignition probability to produce the in-
dividual risk per year at a particular distance from the pipeline.
Individual-risk transects can be generated by considering various
distances from the pipeline.
Societal Risk. Societal risk is defined as the relationship be-
tween the frequency of an incident and the number of casualties
that may result. The societal risk can be related to a section of
pipeline through particular population clusters, as in the case ex-
amined in this paper, or it can be representative of the pipeline as
a whole. Where a range of numbers of casualties, N, with their
associated frequencies, F, can be calculated, the risks typically are
shown in the form of an FN curve where the frequency, F, of N or
more casualties is plotted against N.
Values of F and N are determined by stepping along each pipeline
section of interest and recording the number and classification of
buildings that are located within the building-burning and escape-to-
shelter distances for each step, as illustrated in Fig. 8.
For each step, the number and classification of buildings within
the building-burning and escape-to-shelter distances determines N,
using specific rule sets and assumptions regarding the occupancy
for each building classification. The corresponding frequency, F,
for each failure is given by the product of the step length, the
rupture frequency per unit length, and the ignition probability. To
determine the corresponding values of F and N or more casualties
and to plot the FN curve, these values of F have to be summed up,
starting with the frequency for the maximum predicted number of
casualties, up to and including the frequency for the minimum
predicted number of casualties.
Risk-Assessment Results and Discussion
Individual Risk. The individual risk was calculated with the
methodology described in the Calculation of Individual and
Societal Risk section for the standard case. This represents
an upper limit. It should be noted that these individual-risk
calculations are applicable to the pipelines, regardless of the pro-
posed route because the individual-risk values are calculated for a
hypothetical individual located at a given distance from the re-
spective pipeline.
The variation of the individual risk with distance from the
pipeline for each case is shown in Fig. 9. For all of the pipeline
cases, the individual-risk levels varied very little close to the pipe-
line because of the geometry governing the reduction in the inter-
action length with distance from the pipeline. Beyond the building-
burning distance, this value quickly fell to zero. Fig. 9 also dem-
onstrates that close to the pipeline, the risks associated with the
proposed import-pipeline design (Cases 24) were less than that
for the 100-barg-pipeline reference case (Case 1). This is attributed
Fig. 7Building-interaction length.
8 September 2008 SPE Projects, Facilities & Construction
to the greater wall thickness and, therefore, to the lower design
factors of the import pipelines and the subsequent effect on de-
creasing pipeline-failure frequency. Farther away from the pipe-
line, the risk levels for the reference case become lower in all but
one of the proposed design cases because of the lower pressure
associated with the reference case.
The individual-risk-acceptability criteria were based on the
UKs HSE document, Reducing Risks, Protecting People (2001).
The individual risk is said to be broadly acceptable if it lies below
a level of 110
6
per year, and on the basis of individual risk
alone, no further risk-reduction measures would need to be con-
sidered as long as current relevant standards are met. If the indi-
vidual risk lies between 110
6
and 110
4
per year, then the risk
is said to lie in the ALARP region. Further risk-reduction measures
need to be considered, and the risk-reduction benefits of the mea-
sures need to be compared to their cost. If the individual risk is
greater than 110
4
per year, then the risk is said to be unaccept-
able, and risk-reduction measures must be undertaken. The indi-
vidual-risk values associated with the reference case fall within
the ALARP region. However, the individual-risk values obtained
for the proposed pipeline cases all lie in the broadly acceptable
region of risk.
Societal Risk. In assessing the major hazards posed by onshore
pipelines, the societal risk is normally of more concern than the
individual-risk assessment. However, it is more difficult to define
an acceptance criterion for societal risk. An approach to societal-
risk criteria for pipelines has been proposed in IGE/TD/1 based on
a unit length of pipeline. This is consistent with the risk-control
requirements in the design code that determines the location
classes on the basis of the population density over a defined length
of pipeline (e.g., 1 mile).
Fig. 8Site-interaction length.
Fig. 9Individual-risk transects for import-pipeline cases.
9 September 2008 SPE Projects, Facilities & Construction
The criterion envelope included in Edition 4 of IGE/TD/1 is
based on societal-risk calculations for a wide range of pipelines
designed to IGE/TD/1 standards, using the risk-assessment meth-
odology developed by National Grid (Acton et al. 1998; Hopkins
et al. 1993). The QRA described here has been conducted using a
methodology similar to that adopted by the National Grid. There-
fore, the criterion envelope in IGE/TD/1 can be used to assess the
results of the QRA.
The societal risk calculation considered only the worst-case
1-mile length of the pipeline for each of the proposed import routes
as indicated previously in Fig. 4. The FN curves for each of the
cases along Route A (Urafirth) are shown in Fig. 10. The FN
curves for pipeline cases along Route B (Upper Urafirth) are
shown in Fig. 11. For all the design cases considered, the FN
curves lie within the IGE/TD/1 acceptable-risk-criterion curve and
can be classified as broadly acceptable.
For Route A, the societal risk FN values associated with the
proposed import-pipeline-design cases were less than that for the
100-barg-pipeline reference case for casualty values up to N12.
Above this N value, the F value of the reference curves dramati-
cally falls; however, FN curves continue for the design cases.
It is, however, noted that above the reference FN-curve limit,
values of the design cases have frequencies only up to 210
7
for
the highest design pressure of 380 barg. Reducing the pressure
reduces the risk.
For Route B, there were no buildings within the building-
burning or escape distances for the reference case. For Case 4,
the proposed design-case option having the onshore pressure lim-
ited to 140 barg, it was not possible to generate an FN curve
because the numbers of casualties and associated frequencies were
very small.
Pressure-Limiting System. The installation of a pressure-limiting
system at the landfall was considered as part of the design and
included in the risk-assessment process. Two set pressures were
considered as part of the risk assessment233 barg (Case 3) and
Fig. 10Societal risk FN curve for import-pipeline cases for Route A (Urafirth).
Fig. 11Societal risk FN Curve for import-pipeline cases for Route B (Upper Urafirth).
10 September 2008 SPE Projects, Facilities & Construction
140 barg (Case 4). There is a finite probability of the system failing
to operate on demand (i.e., when called on to isolate the source of
pressure excursion, all or part of the system may not function to
achieve the required action). Such a failure would lead to a high
pressure in the onshore pipeline downstream of the isolation valves
up to the maximum wellhead shut-in pressure of 380 barg. How-
ever, since the onshore pipeline is designed to withstand the well-
head shut-in pressure, it is not anticipated that pipeline failure will
occur because of increased pressure alone. The worst-case conse-
quence associated with the pipeline failure would be a rupture of
the pipeline as assessed in Case 2.
The integrity of the pressure-limiting system is determined by
its safety-integrity level (SIL). A SIL-3 system, for example,
would have a probability of failure on demand of 10
4
and
<10
3
. The probability of a pipeline failing as a result of failure of
the pressure-limiting system is dependent on a number of factors:
The probability of an overpressure per year
The probability of the failure on demand of the pressure-
limiting system
The probability of there being a defect in the pipeline that
will fail when the pressure increases
The probability of failure of the pressure-limiting system has
not been considered in the QRA. If it were to be included, then
the risks associated with Cases 3 and 4 would be slightly higher
than quoted.
Corrosion-Allowance Sensitivity. The pipeline wall thickness in-
cludes a corrosion allowance, and this will be valid at the start of
the lifetime of the pipeline. However, as the pipeline ages, there
may be internal corrosion that reduces the wall thickness. A re-
duction in the wall thickness implies an increase in the failure
frequency. This was considered in a sensitivity study for Cases 2,
3, and 4. The sensitivity study concluded that the risks remain
broadly acceptable (i.e., below an individual risk of 110
6
per
year and less than the FN criteria).
Uncertainties Because of High Pressure. There are uncertainties
in both the consequences and the risks calculated for pipelines
operating at pressures up to 380 barg. These uncertainties will tend
to increase with increasing pipeline pressure. The main reason for
the uncertainty is that the underlying consequence models have not
been validated at such high pressures. Few large-scale fire experi-
ments have been performed at pressures greater than 100 barg.
There is also uncertainty regarding the behavior of mixtures of
hydrocarbons on release at such high pressures. The consequence
models may perform satisfactorily for releases of pure methane at
pressures outside the validated range, but this may not be the case
for mixtures containing heavier hydrocarbons.
These uncertainties support the adoption of a cautious approach to
the design of the proposed pipeline. This will make it easier to dem-
onstrate that the design is safe, so far as is reasonably practicable.
Conclusions
A QRA of the onshore section of a proposed high-pressure pipe-
line has been conducted in the early stages of a development
project. A number of design options were considered: different
routes, design factors, and onshore-pipeline pressures. Individual
and societal risks were calculated for each option.
The QRA provided the project with a robust framework for
assessing the pipeline-design options and deciding on the most
appropriate design solution early in the development of the project.
By comparing the risks with those of a typical onshore pipeline,
the project was better able to demonstrate that the risk to the
onshore population was broadly acceptable and below that of a
typical onshore pipeline.
Acknowledgments
The authors would like to thank Total E&P UK Ltd. and its project
partners for their permission to publish this paper. The authors
would also like to acknowledge colleagues at Total E&P UK Ltd.,
Vectra Group Ltd., and Atkins Boreas who have contributed
their ideas and technical expertise to the paper, specifically: Dean
Henderson, Steve Hall, Tim Turner, Will Sutton, and Harry
Hopkins of HH Risk.
References
6
th
EGIG-Report 19702004, Gas Pipeline Incidents 19702004. 2005.
Annual report, Document No. EGIG 05.R.0002, European Gas Pipeline
Incident Data Group, The Netherlands (December 2005).
Acton, M.R., Baldwin, P.J., Baldwin, T.R. and Jager, E.E.R. 1998. The
Development of the PIPESAFE Risk Assessment Package for Gas
Transmission Pipelines. Presented at the International Pipeline Confer-
ence (IPC 98), Calgary, 711 June.
ASME B31.8-2003, Gas Transmission and Distribution Piping Systems.
2003. New York: ASME.
ASME B31.8S 2004, Managing System Integrity of Gas Pipelines. 2005.
New York: ASME.
Browne, D. and Hicks, R. 2005. Pipeline Product Loss Incidents (1962
2004), 4
th
Report of the UKOPA Fault Database Management Group.
Advantica Report R 8099, FDMG, Derbyshire, UK.
BS EN 14161: 2003, Petroleum and Natural Gas Industries. Pipeline
Transportation Systems. 2003. London: British Standards Institution
(BSI).
Chatfield, S. 2005. Decision-making on assessment of high pressure gas
transmission pipelines. Health & Safety Executive, http://www.hse.
gov.uk/gas/supply/gsmrassess/symposium.pdf.
Corder, I. and Fearnehough, G.D. 1987. Prediction of Pipeline Failure
Frequencies. Paper ERS E576 presented at the Second International
Conference on Pipes, Pipelines, and Pipeline Systems, Utrecht, The
Netherlands, June.
Corrib Gas DevelopmentOnshore Pipeline Project. 2005. Quantified
Risk Assessment (QRA) documents. Dublin, Ireland: Department of
Communications, Energy and Natural Resources, http://www.dcenr.
gov.ie/Press+Releases/Corrib+Gas+Development.htm. Released 24
May 2005.
Hopkins, H.F., Lewis, S.E., and Ramage, A.D. 1993. The development and
application of the British Gas TRANSPIRE Pipeline Risk Assessment
Package. Presented at the IGEM Midlands Section Meeting, Lough-
borough, UK, 19 October.
Hymes, I., Boydell, W., and Prescott, B. 1996. Thermal Radiation 2: The
Physiological and Pathological Effects. Warwickshire, UK: Major
Hazards Monograph Series, Institute of Chemical Engineers.
Mather, J., Blackmore, C., Petrie, A., and Treves, C. 2001. An assessment
of measures in use for gas pipelines to mitigate against damage caused
by third party activity. CRR 372/2001, Health and Safety Executive,
London.
PD 8010-1: 2004, Code of Practice for Pipelines. Steel Pipelines on Land.
2004. London: British Standards Institution.
Pipeline Performance in Alberta 19801997. 1998. Report 98-G, Alberta
Energy and Utilities Board, Calgary, Alberta.
Reducing Risks, Protecting People: HSEs Decision-Making Process.
2001. London: HSE Books.
Steel Pipelines for High Pressure Gas Transmission. 2001. Recommenda-
tions on Transmission and Distribution Practice, IGE/TD/1 Edition 4
Communication 1670, Institute of Gas Engineers and Managers,
Loughborough, Leicestershire, UK.
SI Metric Conversion Factors
bar 1.0* E+05 Pa
in. 2.54* E+00 cm
mile 1.609 344* E+00 km
*Conversion factor is exact.
Stacy Nelson is a safety engineer with Total E&P UK Ltd. and
provides safety engineering expertise to the operations and
project functions within the company. She is a member of the
Institute of Chemical Engineers and the Safety and Reliability
Society. Nelson graduated from the University of the West In-
dies, Trinidad & Tobago, with a BS in chemical and process
engineering. She later attended the University of Aberdeen,
UK, where she completed an MS in safety engineering, reliabil-
11 September 2008 SPE Projects, Facilities & Construction
ity and risk management. This was followed by a PhD in inves-
tigating the safety and integrity issues relating to sand erosion
of process pipe work. Over the last nine years, Nelson has
worked with the oil and gas industry, focusing on the manage-
ment of major accident hazards for both onshore and offshore
gas processing facilities. Margaret Caulfield is currently the se-
nior consultant at Vectra Group Ltd. She earned a BS in math-
ematics and an MP in mechanical and process engineering
at the University of Strathclyde. Caulfield has almost 20 years
experience working in hazards in the oil and gas industry. She
has previously worked for Advantica (formerly British Gas Re-
search and Technology), primarily working on fire and gas
dispersion hazards and the associated risks. She also has ex-
tensive experience of pipeline risk assessment, safety case
preparation, and safety management systems. Her current
areas of work include quantified risk assessments and safety
cases of onshore and offshore oil and gas facilities. Andrew
Cosham is a principal consultant at Atkins Boreas, based in the
UK. He has more than 14 years of experience in the oil and gas
industry, involved in fracture mechanics, pipeline and pres-
sure vessel integrity, and defect assessment. Cosham previ-
ously worked at Andrew Palmer and Associates and British
Gas. He holds a PhD from the University of Cambridge for his
research on the effect of prestrain on the toughness of line
pipe steel and an ME in mechanical engineering from the Uni-
versity of Bristol.
12 September 2008 SPE Projects, Facilities & Construction