BS-8010 part 3

download BS-8010 part 3

of 64

description

bs

Transcript of BS-8010 part 3

  • raising standards worldwide

    NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAW

    BSI British Standards

    WB9423_BSI_StandardColCov_noK_AW:BSI FRONT COVERS 5/9/08 12:55 Page 1

    PUBLISHED DOCUMENT

    Code of practice for pipelines Part 3: Steel pipelines on land Guide to the application of pipeline risk assessment to proposed developments in the vicinity of major accident hazard pipelines containing flammables Supplement to PD 80101:2004

    PD 8010-3:2009

    This publication is not to be regarded as a British Standard. See Foreword for further information.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009 PuBliSheD DocumenT

    Publishing and copyright information

    The BSi copyright notice displayed in this document indicates when the document was last issued.

    BSi 2008

    iSBn 978 0 580 61732 4

    icS 23.040.10, 75.200

    The following BSi references relate to the work on this standard: committee reference PSe/17/2 Draft for comment 07/30138021 Dc

    Publication history

    First published December 2008

    Amendments issued since publication

    Date Text affected

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 i

    PD 8010-3:2009

    ContentsForeword iiiintroduction 11 Scope 32 normative references 33 Abbreviations 34 Risk assessment of buried pipelines overview 45 Failure of hazardous gas or liquid pipelines 56 individual risk assessment 137 Societal risk assessment 158 Factors affecting risk levels 19

    AnnexesAnnex A (informative) Summary of hSe methodology for provision of advice on planning developments in the vicinity of major accident hazard pipelines in the uK 28Annex B (informative) Failure frequencies for uK pipelines 33Annex c (informative) example of a site-specific risk assessment 47

    Bibliography 53

    List of figuresFigure 1 overview of PD 8010-3 2Figure 2 event tree for the failure of a hazardous pipeline 6Figure 3 Risk calculation flowchart for flammable substances 8Figure 4 calculation of pipeline length affecting an individual in the vicinity of a pipeline 14Figure 5 Framework for the tolerability of individual risk 15Figure 6 Societal risk FN criterion line applicable to 1 km of pipeline 17Figure 7 Site-specific pipeline interaction distance 18Figure 8 Reduction in external interference total failure frequency due to design factor 22Figure 9 Reduction in external interference total failure frequency due to wall thickness 23Figure 10 Reduction in external interference total failure frequency due to depth of cover 24Figure 11 indicative reduction in external interference total failure frequency due to surveillance frequency (dependent on frequency and duration of unauthorized excavations) 24Figure A.1 Planning application process and need for site-specific risk assessment 30Figure B.1 Generic predicted pipeline failure frequencies for third-party interference 35Figure B.2 FFReQ predictions of total external interference failure frequency for uKoPA pipe cases 39Figure B.3 FFReQ predictions of external interference rupture frequency for uKoPA pipe cases 40Figure B.4 FFReQ predictions for external interference rupture and leak frequencies for specific diameter and wall thickness cases (per 1 000 kmy) 41Figure c.1 Proposed development 47Figure c.2 Risk for outside exposure 50Figure c.3 Societal risk FN curves and PD 8010-3 FN criterion line proposed development before and after slabbing 50

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    ii BSI 2008

    PuBliSheD DocumenT

    List of tablesTable 1 Range of applicability of reduction factor for design factor, Rdf, and reduction factor due to wall thickness, Rwt 23Table 2 Failure frequency reduction factors, Rp, for pipeline protection 25Table A.1 Typical (1 106) and (0.3 106) risk distances for ethylene, spiked crude and natural gas liquids (nGls) 31Table B.1 Failure rates for uK pipelines based on uKoPA data 33Table B.2 Failure frequency due to external interference vs. diameter 34Table B.3 Failure frequency due to external interference vs. wall thickness 34Table B.4 comparison of external interference failure frequency estimates for example 1 with FFReQ predictions 36Table B.5 comparison of external interference failure frequency estimates for example 2 with FFReQ predictions 37Table B.6 comparison of external interference failure frequency estimates for example 3 with FFReQ predictions 37Table B.7 uKoPA pipe cases 38Table B.8 FFReQ predictions for total external interference failure frequency for pipe cases defined in Table B.7 (per 1 000 kmy) 39Table B.9 FFReQ predictions for external interference rupture frequency for pipe cases defined in Table B.7 (per 1 000 kmy) 40Table B.10 FFReQ predictions for external interference rupture and leak frequencies for pipe cases defined in Table B.7 (per 1 000 kmy) 41Table B.11 comparison of external interference failure frequency estimates for example 5 with FFReQ predictions 43Table B.12 critical defect lengths and equivalent hole diameters for uKoPA pipeline cases operating at a design factor of 0.72 44Table B.13 Failure frequency due to external corrosion 44Table B.14 material and construction failure frequency vs. wall thickness 45Table B.15 Pipeline rupture failure frequency due to due to ground movement caused by natural landsliding 46

    Summary of pagesThis document comprises a front cover, an inside front cover, pages i to iv, pages 1 to 56, an inside back cover and a back cover.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 iii

    PD 8010-3:2009

    Foreword

    Publishing information

    This part of PD 8010 was published by BSi and came into effect on 1 January 2009. it was prepared by Subcommittee PSe/17/2, Pipeline transportation systems, under the authority of Technical committee PSe/17, Materials and equipment for petroleum. A list of organizations represented on this committee can be obtained on request to its secretary.

    Relationship with other publications

    PD 8010-3 is a new part of the PD 8010 series, and should be read in conjunction with PD 8010-1. The series comprises:

    Part 1: Steel pipelines on land;

    Part 2: Subsea pipelines;

    Part 3: Steel pipelines on land Guide to the application of pipeline risk assessment to proposed developments in the vicinity of major accident hazard pipelines containing flammables Supplement to PD 80101:2004.

    Information about this document

    This part of PD 8010 includes worked examples and benchmark solutions that can be used as a basis for specific studies.

    Use of this document

    As a code of practice, this part of PD 8010 takes the form of guidance and recommendations. it should not be quoted as if it were a specification and particular care should be taken to ensure that claims of compliance are not misleading.

    Any user claiming compliance with this part of PD 8010 is expected to be able to justify any course of action that deviates from its recommendations.

    As with any risk assessment, judgement has to be employed by the risk assessor at all stages of the assessment. This part of PD 8010 is intended to support the application of expert judgement. The final responsibility for the risk assessment lies with the assessor, and it is essential that the assessor is able to justify every key assumption made in the assessment and that these assumptions are documented as part of the assessment.

    Presentational conventions

    The provisions in this Published Document are presented in roman (i.e. upright) type. its recommendations are expressed in sentences in which the principal auxiliary verb is should.

    Commentary, explanation and general informative material is presented in smaller italic type, and does not constitute a normative element.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    iv BSI 2008

    PuBliSheD DocumenT

    Contractual and legal considerations

    This publication does not purport to include all the necessary provisions of a contract. users are responsible for its correct application.

    Compliance with a Published Document cannot confer immunity from legal obligations.

    Attention is particularly drawn to the Pipelines Safety Regulations 1996 [1] and to the requirements for risk assessments in uK health and safety legislation, in particular:

    the health and Safety at Work etc Act 1974 [2];

    the management of health & Safety at Work Regulations 1992, amended 1999 [3].

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 1

    PD 8010-3:2009

    IntroductionPD 8010-1:2004, clause 5 and Annex F provide guidance on the route selection and location of new pipelines in populated areas in terms of the acceptable proximity to significant inhabited areas. clause 5 classifies locations adjacent to pipelines into location classes 1, 2 and 3 according to population density and/or nature of the immediate surrounding area.

    The general approach to the risk assessment process follows the stages outlined in PD 8010-1:2004, Annex e. The present part of PD 8010 includes recommendations for:

    determining failure frequencies;

    consequence modelling;

    standard assumptions to be applied in the risk assessment methodology for land use planning zones;

    conducting site-specific risk assessments;

    risk reduction factors to be applied for mitigation methods;

    benchmark results for individual and societal risk levels.

    This part of PD 8010 provides guidance for the risk assessment of developments in the vicinity of major hazard pipelines containing flammable substances notified under the Pipelines Safety Regulations 1996 [1]. it does not cover toxic substances which are also notified under these Regulations. The guidance is specific to the calculation of safety risks posed to developments in the vicinity of uK major accident hazard pipelines, but the principles of the risk calculation are generally applicable. The use of such risk assessments to determine the acceptability of developments in accordance with land use planning applied in Great Britain is discussed in Annex A. The guidance does not cover environmental risks.

    An overview of the document content is given in Figure 1.

    The guidance in this part of PD 8010 is provided for the benefit of pipeline operators, local planning authorities, developers and any person involved in the risk assessment of developments in the vicinity of existing major accident hazard pipelines. it is based on the established best practice methodology for pipeline risk assessment, and is intended to be applied by competent risk assessment practitioners.

    For significant developments or infringements the pipeline operator might wish to carry out risk assessment using societal risk analysis for comparison with suitable risk criteria to allow the operator to assess whether the risks remain within acceptable limits. clause 7 describes the application of societal risk, and includes a recommended FN criterion line.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    2 BSI 2008

    PuBliSheD DocumenT

    Figure 1 Overview of PD 8010-3

    Scope

    Safety risks caused

    by flammable

    substances only

    Clause 1

    Consequences:

    Prediction

    Probability of

    ignition

    Thermal radiation

    and effects

    Failure of a gas or liquid

    pipeline

    Event tree

    Prediction of failure

    frequency

    5.3

    5.4

    5.5

    Calculation of

    risk and risk

    criteria

    Individual

    Societal

    Factors affecting risk levels

    Failure frequency

    Failure frequency reduction

    factors

    Implementation of risk mitigation

    measures

    Supporting annexes:

    Summary of HSE methodology for the

    provision of land use planning advice in the

    vicinity of UK MAHPs

    Failure frequencies for UK pipelines

    Example of a site-specific risk assessment

    Clause 6

    Clause 7

    Annex A

    Annex B

    Annex C

    Clause 8

    8.1

    8.2, Annex B

    8.3

    5.1

    5.2, 8.2

    Annex B

    Risk assessment of buried

    pipelines

    Clause 4

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 3

    PD 8010-3:2009

    1 ScopeThis part of PD 8010 provides a recommended framework for carrying out an assessment of the acute safety risks associated with a major accident hazard pipeline (mAhP) containing flammable substances. it provides guidance on the selection of pipeline failure frequencies and the modelling of failure consequences for the prediction of individual and societal risks.

    The principles of this part of PD 8010 are based on best practice for the quantified risk analysis of new pipelines and existing pipelines. it is not intended to replace or duplicate existing risk analysis methodology, but is intended to support the application of the methodology and provide recommendations for its use.

    This part of PD 8010 is applicable to buried pipelines on land that can be used to carry category D and category e substances that are hazardous by nature, being flammable and therefore liable to cause harm to persons. The guidance does not cover environmental risks.

    2 Normative referencesThe following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

    PD 8010-1:2004, Code of practice for pipelines Part 1: Steel pipelines on land

    iGe/TD/1 edition 4:2001, Steel pipelines for high pressure gas transmission1)

    3 AbbreviationsFor the purposes of this part of PD 8010, the following abbreviations apply.

    AlARP as low as reasonably practicable

    FFReQ methodology recommended by uKoPA for prediction of pipeline failure frequencies due to external interference

    hSe health and Safety executive

    lFG liquefied flammable gases, including liquefied petroleum gases (lPG), liquefied natural gas (lnG), and natural gas liquids (nGl)

    mAhP major accident hazard pipeline

    mAoP maximum allowable operating pressure

    mDoB minimum distance to occupied building

    PoF probability of failure

    SmYS specified minimum yield strength

    1) institution of Gas engineers and managers (formerly institution of Gas engineers) (iGe) standards are available from the institution of Gas engineers and managers, charnwood Wing, holywell Park, Ashby Road, loughborough, leicestershire le11 3Gh.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    4 BSI 2008

    PuBliSheD DocumenT

    Tdu thermal dose units

    TS tensile strength

    uKoPA united Kingdom onshore Pipeline operators Association

    Vce vapour cloud explosion

    4 Risk assessment of buried pipelines OverviewThe failure of a pipeline containing a flammable substance (which can be a gas, a liquid, a dense-phase supercritical fluid or a two- or three-phase fluid) has the potential to cause serious damage to the surrounding population, property and the environment. Failure can occur due to a range of potential causes, including accidental damage, corrosion, fatigue and ground movement. The acute safety consequences of such a failure are primarily due to the thermal radiation from an ignited release, whether directly (from the main release) or indirectly (from secondary fires).

    Quantified risk assessment applied to a pipeline involves the numerical estimation of risk by calculation resulting from the frequencies and consequences of a complete and representative set of credible accident scenarios.

    in general terms, a quantified risk assessment of a hazardous gas or liquid pipeline consists of the following stages:

    gathering data (pipeline and its location, meteorological a) conditions, physical properties of the substance, population) (5.1);

    prediction of the frequency of the failures to be considered in the b) assessment (5.2);

    prediction of the consequences for the various failure scenarios c) (5.3), including:

    calculation of release flow rate;

    estimation of dispersion of flammable vapours;

    determination of ignition probability;

    calculation of the thermal radiation emitted by fire in an ignited release;

    quantification of the effects of thermal radiation on the surrounding population;

    calculation of risks and assessment against criteria:d)

    estimation of individual risk (clause 6);

    estimation of societal risk (clause 7);

    identification of site-specific risk reduction measures (clause e) 8).

    Pipeline failure frequency is usually expressed in failures per kilometre year or per 1 000 kilometre years (kmy). Failure frequency should be predicted using verified failure models and predictive methodologies [4, 5, 6, 7], or otherwise derived from historical incidents that have occurred in large populations of existing pipelines that are representative of the population under consideration, as recorded in recognized, published pipeline data. Various factors may then be taken

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 5

    PD 8010-3:2009

    into account for the specific pipeline design and operating conditions to obtain the failure rate to be applied.

    NOTE Predictive models can be generated for all damage types and failure modes depending on the data available. In the UK, thirdparty interference is the dominant mode, and predictive models based on operational data are available [4, 5, 6, 7]. In general, failure frequency due to other damage types is derived using historical data [8, 9, 10].

    The consequences of pipeline failures should be predicted using verified mathematical models, the results validated using experimental data at various scales up to full or comparison with recognized solutions, as well as comparison of model predictions with the recorded consequences of real incidents. The results of a consequence analysis should take into account all feasible events, in terms of the effect distance (radius) over which people are likely to become casualties. This should take into account people both outdoors and indoors.

    Pipelines present an extended source of hazard, and can pose a risk to developments at different locations along their route. Where a length of pipeline over which a location-specific accident scenario could affect the population is associated with a specific development, the full length over which a pipeline failure could affect the population or part of the population should be taken into account in the risk assessment. This length is known as the interaction distance (see clause 6 and clause 7).

    5 Failure of hazardous gas or liquid pipelines

    5.1 GeneralFailure of a hazardous gas or liquid pipeline has the potential to cause damage to the surrounding population, property and the environment. Failure can occur due to a range of potential causes, including accidental damage, corrosion, fatigue and ground movement. The consequences of failure are primarily due to the thermal radiation that is produced if the release ignites. This can be caused directly, or indirectly by igniting secondary fires. illustrative event trees for the failure of a hazardous pipeline are shown in Figure 2.

    NOTE 1 For detailed explanation of some of the consequence models which have been applied by HSE to derive existing Land Use Planning zones, see [11] to [14].

    Failure of a high pressure pipeline can occur as a leak or rupture. leaks are defined as fluid loss through a stable defect; ruptures are defined as fluid loss through an unstable defect which extends during failure, so the release area is normally equivalent to two open ends. The escaping fluid can ignite, resulting in a fireball, crater fire or jet fire which generates thermal radiation. Typical event trees for the failure of gas and liquid pipelines are shown in Figure 2.

    NOTE 2 Spray fire is equivalent to a jet fire from a liquid line. Fireballs are technically not possible but vapour cloud explosions (VCEs) can occur where the liquid in the pipeline produces heavierthanair vapour.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    6 BSI 2008

    PuBliSheD DocumenT

    Figure 2 Event tree for the failure of a hazardous pipeline

    Y

    Y

    YN

    N

    N

    Y

    Y

    YN

    N

    N

    Pipe failure

    Rupture

    Puncture

    Immediateignition

    Delayedlocalignition

    Delayedremoteignition

    Fireball + spray + pool fire

    Pool fireVCE or flash fire

    Running firesVCE or flash fireGround/water pollution

    A)

    C)

    Spray + pool fire

    Pool fire

    Running fire

    Ground/water pollution

    A)

    C)

    B)

    C)

    C)

    B)

    a) event tree for a liquid pipeline failure

    Y

    Y

    Y

    N

    N

    Y

    YN

    N

    N

    Y

    Y

    YN

    N

    N

    Y

    Y

    NN

    Y

    Y

    NN

    Immediateignition

    Releaseobstructed

    Delayedlocalignition

    Delayedremoteignition

    D)

    D), F)

    F)

    Rupture

    Puncture

    Pipe failure

    Fireball +crater fire

    Fireball +jet fires

    Flash fire +crater fire

    Crater fire

    No ignition

    No ignition

    No ignition

    Impacted jet(crater) fire

    Jet fire

    Jet fire

    D)Impacted jet(crater) fire

    Jet fires

    Flash fires + jet fires

    No ignition

    B), E)

    B), E)

    b) event tree for a gas pipeline failure

    A) Ground/water pollution is also likely to occur.B) if the vapour cloud could engulf any confined or

    congested region, the possibility of a Vce should be considered.

    c) extent/distance will depend on ground permeability.

    D) There will be a limited flash fire which is not normally considered separately.

    e) only credible for heavier than air gases.F) it is also possible for the release from one pipe end is

    obstructed and the other unobstructed.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 7

    PD 8010-3:2009

    For the assessment of a rupture release of a gaseous fluid, it is normally assumed that the ends of the failed pipe remain aligned in the crater and the jets of fluid interact. it is possible, e.g. at a location close to a bend or for a small diameter pipeline, for one or both pipe ends to become misaligned and produce one or two jets which are directed out of the crater and are unobstructed. Such releases can produce directional effects, making their assessment more complex. Where such a location or pipe is being assessed, the standard case would normally be assessed, then the sensitivity of the location to directional releases reviewed. A more detailed assessment might then be required which would go beyond the standard methodology described in this part of PD 8010.

    NOTE 3 For large diameter pipelines (i.e. >300 mm) this is a standard assumption.

    if immediate ignition of a fluid release occurs, a fireball can be produced which lasts for up to 30 s and is followed by a crater fire. if ignition is delayed by 30 s or more, it is assumed that only a crater fire (jet obstructed) or a jet fire (jet unobstructed) will occur.

    For gases or vapours that are heavier than air, or form cold heavier-than-air gas clouds when released, the possibility of a flash fire or Vce should be taken into account. The extent of such gas clouds depends on prevailing weather conditions at the time of release, the location of possible sources of ignition, and areas of congestion or confinement. The modelling of the consequences and effects of Vces are not discussed in detail in this part of PD 8010.

    NOTE 4 In the case of natural gas, this scenario is not usually considered, as the release has a large momentum flux at the source and this normally has a significant vertical component. For the duration of the release relevant to the risk analysis, the transition to a low momentum (passive) release does not occur until the released natural gas has dispersed (is diluted) below the lower flammability limit.

    The stages of pipeline risk assessment are represented in Figure 3.

    in general terms, a quantified risk assessment of a hazardous gas or liquid pipeline consists of four stages:

    input of data (pipeline and its location, meteorological a) conditions, physical properties of the substance, population);

    prediction of failure mode and frequency;b)

    prediction of consequences:c)

    calculation of release flow rate;

    determination of ignition probability;

    calculation of thermal radiation emitted by fire in an ignited release;

    quantification of the effects of thermal radiation on the surrounding population;

    calculation of risks.d)

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    8 BSI 2008

    PuBliSheD DocumenT

    Figure 3 Risk calculation flowchart for flammable substances

    Input data

    Failure frequency

    Consequences

    Risk calculations

    Individual risk

    Societal risk

    Pipe geometry, material properties, operational parametersLocation details (area category, depth of cover, protection etc)Population details Fluid propertiesMeteorological conditions

    Determine failure rate data for leaks and ruptures due to:

    Calculate failure frequency

    External interference Corrosion

    Material & construction defects

    Ground movement

    Other++++

    Determine consequences based on:

    Release rate Dispersion

    Ignition Type of fire

    Thermal radiation

    +++

    Effects of thermal radiation

    The first stage of the risk assessment process is to gather the required data to characterize the pipeline, its contents and the surrounding environment. These data are used at various stages of the analysis. The data should be obtained from engineering records, operating data, the pipeline operating limits in the pipeline notification and an examination of the pipeline surroundings. The principal input data required for a pipeline quantified risk analysis are:

    pipeline geometry outside diameter, wall thickness;

    pipeline material properties e.g. grade (SmYS, TS), toughness (or charpy impact value), and any other data required to apply a fracture mechanics model or to calculate the design factor;

    pipeline operational parameters maximum allowable operating pressure, temperature, pipeline shutdown period;

    location details, including:

    length and route of the pipeline to be assessed;

    topographical information in any region of interest (e.g. ground slope direction, location of drainage channels and ditches);

    location classification (class 1, class 2);

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 9

    PD 8010-3:2009

    depth of cover;

    additional protection measures for the pipeline (e.g. concrete slabbing);

    details of any above- and below-ground pipeline marking;

    development and building categories in the vicinity and their distance from the pipeline;

    population and occupancy levels within the consequence range of the pipeline;

    road/rail crossing details, including traffic density;

    river crossings;

    physical properties of the material being transported, including:

    information to characterize the pressure, volume and temperature behaviour of the fluid throughout the range of conditions relevant to the analysis (e.g. from thermodynamic charts, tables or rigorous equations of state);

    information to characterize any phase change within the fluid, e.g. from vapour to liquid (or vice versa), or to bound the dense phase region;

    information about the density and viscosity of the fluid as a function of pressure, temperature;

    atmospheric conditions, for example:

    details about ambient temperatures and pressures at the location of interest;

    atmospheric humidity;

    information about wind speeds and directions.

    Any site-specific variations in the data should be assessed, and justifications for any additional assumptions to be applied locally should be documented. in the case of depth of cover, site-specific depths should be taken into account. Where additional pipeline protection such as slabbing is to be taken into account, the design and installation should be assessed to ensure that additional loading is not imposed upon the pipeline, and direct contact should be maintained between the pipe coating and the surrounding soil.

    5.2 Prediction of failure frequencyFailure of a pipeline can occur due to a number of different causes such as:

    external interference;

    corrosion [internal and external, including stress corrosion cracking (Scc) and alternating current (Ac)/direct current (Dc) induced corrosion];

    material or construction defects;

    ground movement;

    other causes, such as fatigue, operational errors etc.

    The failure modes that should be assessed include leaks of various sizes (punctures) and line breaks (ruptures). A key parameter in setting the boundary between a leak of a stable size and a rupture is the critical defect length.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    10 BSI 2008

    PuBliSheD DocumenT

    The critical defect length is the axial length of a through-wall defect which becomes unstable at the specific pipeline conditions, and above which a defect will continue to propagate along the pipeline until the defect size becomes equivalent to a rupture. This is primarily dependent on the pipeline diameter, wall thickness, material properties, fluid properties (in particular the compressibility) and operating pressure. The critical defect length is significant for external interference, where long, narrow crack-like defects can occur. in such cases, the crack opening area through which the fluid release occurs is transposed into an equivalent hole size which can be used for release calculations. Typical critical hole sizes for high pressure gas pipelines are given in Annex B.

    NOTE 1 Critical defect length and equivalent hole diameter applies to external interference where axial, cracklike defects can occur; the equivalent hole sizes which relate to such defects do not apply to rounded punctures, or stable holes due to corrosion or material and construction defects.

    leak sizes can range from pinholes up to a hole size equivalent to the critical defect size for the pipeline for external interference failures. A rupture release is typically represented by a full bore, double-ended break. The release is typically assumed to make a crater into which product is released from both ends of pipe.

    Typical failure frequencies for uK mAhPs are given in Annex B. Where other data sources are used, these should be documented.

    NOTE 2 In most cases the risk will be dominated by the rupture scenario.

    NOTE 3 The maximum possible hole size in high pressure gas pipelines is limited according to the critical defect size.

    in a risk assessment, the likelihood of each failure scenario is evaluated and expressed in terms of failure frequency and pipeline unit length.

    5.3 Prediction of consequencesin the context of pipelines carrying flammable substances, for releases that ignite causing immediate hazards to people and property, consequence models are needed to predict the transient gas or liquid release rate, the ignition probabilities, the characteristics of the resulting fire (i.e. fireball, crater, jet, flash, spray or pool fire), the radiation field produced and the effects of the radiation on people and buildings nearby. The following aspects should be taken into account:

    outflow as a function of time (influenced by failure location, upstream and downstream boundary conditions, and by any response to the failure); pipeline rupture outflow requires complex calculations involving pressure reduction in the pipeline or two-phase flow for flashing liquids [15, 16]. outflow from holes is calculated using conventional sharp-edged orifice equations for gas or liquid using a suitable discharge coefficient [13];

    thermal radiation from the initial and reducing flow into the fireball if the release is ignited immediately;

    thermal radiation from jet and crater fires. Jet fires that are unobstructed can have considerable jet momentum, resulting in a lift-off distance before the flame occurs, and therefore thermal radiation effects which can be greater in the middle and far field distance, depending on the release direction and degree

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 11

    PD 8010-3:2009

    of wind tilt. crater fires can be modelled as large cylindrical flames starting at ground level having thermal radiation effects progressively reducing through near, middle and far distance;

    extent of the area covered by a flammable gas cloud causing a possible flash fire downwind of the release, and possible ignition points in downwind areas;

    spillage rate and duration of release from a liquid pipeline affecting the local area and possibly causing a spray or pool fire.

    other consequences that are generally found to have a negligible effect on risk compared to fire effects include:

    release of pressure energy from the initial fractured section;

    pressure generated from combustion during the initial phase if the release is ignited immediately;

    missiles generated from overlying soil or from pipe fragments;

    Additional aspects to be taken into account for pressurized liquid releases include:

    spray fires;

    immediate and delayed ignition pool fires;

    release of flammable liquids into water courses and the potential for running fires.

    The consequence model should also take into account:

    wind speed, because this affects the crater fire and jet fire tilt and extent of the flash fire and hence the resulting radiation effects downwind;

    NOTE Weather category, as well as wind speed, also affects gas dispersion for flash fire prediction. In the UK, the conventional assumption is that nighttime weather is modelled as Pasquill Category F and windspeed 2 m/s, and daytime as Category D and windspeed 5 m/s.

    wind direction required for a site-specific risk assessment where wind direction will affect the populated area non-symmetrically around the location of the fire;

    humidity this affects the proportion of thermal radiation absorbed by the atmosphere;

    the type of ground environment, including topography where appropriate, into which a liquid is released.

    There is considerable evidence from actual events and research work that immediate ignition events involving sudden large releases of flammable gases can cause a fireball to occur. Typical fireball burn times are 10 s to 30 s depending on pipeline diameter and pressure. large releases of liquefied flammable gases, and flammable liquids containing lFGs such as spiked crude oil, can also cause a fireball to occur.

    When modelling either crater fires or unobstructed jet fires following a rupture, the transient nature of the release should be modelled. This calculation requires an estimate of the initial and steady state release rates and an estimate of the inventory of the pipeline network which is discharging to the release point. For generic calculations, the typical assumption made is that the break occurs half-way between compressor or pump stations (or pressure regulating station), with pressure being maintained from the upstream compressor, pump or

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    12 BSI 2008

    PuBliSheD DocumenT

    pressure reduction station and no reverse flow (with depressurization) occurring at the downstream check valve or regulator.

    When modelling jet fires from punctures, the release can be considered to be steady state. The consequence model usually assumes a vertical wind-blown jet flame. more elaborate models are possible with different angles of flame. The consequences predicted by such models are increased directionally, but the conditional probability is reduced.

    Flash fires occur when a plume of unignited heavier-than-air gas or vapour drifts downwind before finding a source of ignition. The ignition causes the fire to flash back to the source of release and then to cause a jet, crater or pool fire. A vapour cloud can drift further in night-time conditions (category F2) than daytime (category D5). The probability of flash fires is considered low, being dependent on the release source and the distribution of ignition sources in the vicinity of a pipeline.

    For non-flashing liquid releases from pipelines, the release rate is often dictated by the pumping rate at the point of release, depending on hole size. Small to medium holes can cause sprays and the hazard distance from spray fires can be significant. large holes (>50 mm) in high pressure pipelines are likely to release the full pumping rate, so the consequences of large holes are similar to pipeline rupture. The amount released from a liquid pipeline is a function of the time taken to stop pumping, depressurization of the pipeline, and drain-down of adjacent sections of the pipeline.

    Spray releases occur when a flammable liquid is released at high velocity through a punctured pipeline.

    5.4 Probability of ignitionThe risks from a pipeline containing a flammable fluid depend critically on whether a release is ignited, and whether ignition occurs immediately or is delayed.

    it is usually assumed that immediate ignition occurs within 30 s, and delayed ignition occurs after 30 s. Generic values for ignition probability can be obtained from data from historical incidents and these are product-specific. The various ignition possibilities such as immediate, delayed and obstructed or unobstructed, are drawn out logically on an event tree (see Figure 2) to obtain overall probabilities.

    extensive references [12, 14,] are available for deriving probability of ignition for various situations (class 1, class 2, urban, roads, railways etc.). Probabilities used by hSe are discussed in Annex A.

    5.5 Thermal radiation and effectsFatal injury effects are assumed for cases where people in the open air or in buildings are located within the flame envelope. outside the flame envelope, the effects are dependent on direct thermal radiation from the flame to the exposed person or building. Thermal radiation is calculated from the energy of the burning material. There are two main methods of calculation in use: the view factor method, which assumes a surface emissive power from the flame, and the point source method, which assumes that all the energy is emitted from one (or several) point sources within the flame. The energy from the fireball pulse is usually calculated using the view factor method.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 13

    PD 8010-3:2009

    The thermal radiation effect at distances from the failure, calculated as the radiation dose, is summed through the complete fire event to determine the effect on people and property in terms of the piloted ignition distance for buildings, the escape distance for people out of doors, and the distance for which escape to safe shelter is possible. The thermal radiation effect from crater fires and jet fires is generally calculated by assuming that all persons outdoors, and indoors within the piloted ignition distance, try to escape. The cumulative thermal dose is then calculated, and the distance from the fire at which escape is possible without exceeding a threshold dose. The thermal dose unit (tdu), is defined as:

    tdu = W 4/3t

    where:

    t is time, in seconds (s);

    W is the intensity of thermal radiation, in kilowatts per square metre (kW/m2).

    NOTE 1 W is not independent of time for a transient release, and is normally summed over exposure until safe shelter, the dose limit or a cutoff thermal radiation level of, for example, 1 kW/m2 is reached.

    experimental and other data indicate that thermal radiation dose levels can have differing effects on a population depending on individual tolerance to such effects. The variation of effects has been estimated from burn data for human beings which suggests that the radiation level causing a significant likelihood of fatal injury in an average population is 1 800 tdu. This level of thermal dose is often used in risk assessments.

    NOTE 2 Due to the uncertainties in the effects of thermal radiation, a value of 1% lethality, equivalent to 1 000 tdu to 1 050 tdu as a threshold of dangerous dose or worse, is sometimes associated with such predictions (see Annex A).

    in order to assess safe escape distance, a number of factors should be taken into account, including escape speed for people outside running away from the fire, location and types of buildings, populations indoors and outdoors, daytime or night-time, etc.

    The progression of a fire through the different stages of the event can be complex. The prediction of the thermal radiation effects is required to be summed through the event. This can prove difficult to achieve in a continuous way, hence the event might need to be subdivided into its stages and the effects summed later.

    6 Individual risk assessmentindividual risk is a measure of the frequency at which an individual at a specified distance from the pipeline is expected to sustain a specified level of harm from the realization of specific hazards.

    individual risk contours for pipelines of given geometry, material properties and operating conditions form lines parallel to the pipeline axis. The distance from the pipeline at which a particular level of risk occurs depends upon the pipeline diameter, operating pressure, frequency of failure and failure mode.

    The risks from the various failure scenarios should be collated and the individual risk profile at various distances plotted on a graph. From

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    14 BSI 2008

    PuBliSheD DocumenT

    this plot it is possible to identify the risk of a specified effect (e.g. fatality or dangerous dose) to an individual at a given distance from the pipeline. Shown in cross-section perpendicular to the pipeline, the risk levels are known as the risk transect.

    For a simple model where windspeed conditions are zero, the consequences are circular, the interaction distance (see clause 4) is calculated as shown in Figure 4. The interaction distance shown can be multiplied by the pipeline failure frequency, the probability of ignition and the probability of effect to obtain the risk at any distance from the point of release.

    Figure 4 Calculation of pipeline length affecting an individual in the vicinity of a pipeline

    1

    2

    3

    4

    1

    2

    4

    a) interaction distance = 2 radius of circle = length of pipeline that could affect observer

    RD

    R

    4

    b) interaction distance = 2 R D2 2

    Key

    location of observer, at distance 1 D from the pipeline

    circular effect distance/consequence distance, radius 2 R

    Pipeline3

    interaction distance for observer at location 14

    criteria for individual risk levels have been determined by the hSe in the uK. The framework for the tolerability of risk which gives individual risk values for the defined regions, published by hSe [17], is shown in Figure 5.

    hSe sets land use planning zones for major hazard sites, including high-pressure pipelines transporting defined hazardous substances based on individual risk levels. land use planning zones applied to major accident hazard pipelines in the uK defined by hSe are discussed in Annex A.Li

    cens

    ed C

    opy:

    x x

    , Mot

    t Mac

    dona

    ld, 1

    0/06

    /201

    0 06

    :22,

    Unc

    ontro

    lled

    Copy

    , (c) B

    SI

  • PuBliSheD DocumenT

    BSI 2008 15

    PD 8010-3:2009

    Figure 5 Framework for the tolerability of individual risk

    Incr

    easi

    ng in

    divi

    dual

    ris

    ks a

    nd s

    ocie

    tal c

    once

    rns

    Unacceptableregion

    Tolerable if ALARPregion

    Broadly acceptableregion

    1 x 10 (Worker)

    1 x 10 (Public)

    1 x 10 (All)

    -3

    -4

    -6

    7 Societal risk assessmentSocietal risk is the relationship between the frequency of the realization of a hazard and the resultant number of casualties. Societal risk can be generic, in which a constant distributed population in the vicinity of a pipeline is assumed, or site-specific, in which the details of particular developments, building layouts and population distributions are taken into account. Site-specific assessments are needed for housing developments, industrial premises, workplaces such as call centres, commercial and leisure developments, and any developments involving sensitive populations.

    Developments such as schools, hospitals and old peoples homes are classed as sensitive developments because of the increased vulnerability of the population groups involved to harm from thermal radiation hazards and the increased difficulty in achieving an effective response (e.g. rapid evacuation) to mitigate the consequences of an event such as a pipeline fire.

    The hazards associated with pipelines tend to be high consequence low frequency events, and therefore it is more appropriate that societal risk is used to assess the acceptability of pipeline risk. The calculation is carried out by assessing the frequency and consequences of all of the various accident scenarios which could occur along a specified length of pipeline.

    Societal risk is of particular significance to pipeline operators because the location of pipelines might be close to populated areas, so the impact of multiple fatality accidents on people and society in general should be taken into account. The original routing of the pipeline is expected to have taken into account the population along the

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    16 BSI 2008

    PuBliSheD DocumenT

    route, but infill and incremental developments might increase the population in some sections of the route. Societal risk assessment allows these developments to be assessed against the original routing criteria where a location class 1 area has a population density of up to 2.5 persons per hectare. When the societal risk has increased significantly, the pipeline operator might then need to consider justifiable mitigation measures to reduce the risk.

    The criterion for societal risk is expressed graphically as an FN criterion line, showing the cumulative frequency F (usually per year) of accidents causing N or more casualties. For application to pipelines, it is necessary to specify a length over which the frequency and consequences of all accident scenarios are collated.

    Developing criteria for tolerability for hazards giving risk to societal concerns is not straightforward. Reference [17] describes the derivation of a societal risk limit from a study of canvey island and subsequently endorsed by the hScs Advisory committee on Dangerous Substances in the context of major hazards transport. From this, hSe proposed that the risk of an accident causing the death of 50 people or more in a single event should be regarded as intolerable if the frequency is estimated to be more than one in five thousand per annum [17]. Subsequently hSes hazardous installations Directorate have proposed [18] criteria for major hazard sites in the context of the control of major Accident hazards Regulations 1999 [19] (comAh), based on the following which enables criteria for case societal risk to be defined for the FN diagram.

    The unacceptable region is taken as the region above the line of slope 1 through the defined point on the logF v. logN plot; and the broadly acceptable region is taken as the region below a line two orders of magnitude below, and parallel to, the 1 slope line (see Figure 6). The tolerable if AlARP region lies between these two lines.

    A typical medium-sized comAh site might typically have a perimeter exposing risk to the public outside the site of 2 km, so the equivalent length of pipeline exposing the same risk to the public is 1 km. Therefore the same FN risk curves could be applied to 1 km of pipeline.

    in the absence of product-specific risk curves, it is therefore suggested that the FN criterion line given in Figure 6 should be used to assess societal risk due to mAhPs. This allows the assessment of the residual risk from a specific pipeline to be compared with the risk from the average class 1 pipeline population density (i.e. up to 2.5 persons per hectare) adjacent to each 1 km length of pipeline, where the population is assumed to be located in a strip centred on the pipeline from the mDoB, extending out to the hazard distance of the worst case event from the pipeline.

    in effect the FN criterion line represents the upper limit of the cumulative frequency of multiple fatality accidents in any 1 km section of a pipeline route assumed to be acceptable as implied by conformity to PD 8010-1. in the assessment of societal risk, the methodology applied should be consistent with the risk limit in terms of the length of pipeline considered. The FN criterion line shown here is applicable to assessments carried out using 1 800 tdu, equivalent to a significant likelihood of causing fatality.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 17

    PD 8010-3:2009

    NOTE 1 The areas below the FN criterion line in Figure 6 represent broadly acceptable risk levels and therefore relevant good practice in both location classes 1 and 2.2)

    NOTE 2 In some cases, a productspecific criterion line might be available for assessing societal risk tolerability. An example of this is the FN envelope presented in IGE/TD/1:2001, Figure 20 for natural gas, which is based on the application of previous editions of IGE/TD/1. This envelope curve represents the boundary for a series of curves applying to numerous different pipeline cases which are acceptable in accordance with IGE/TD/1.

    Figure 6 Societal risk FN criterion line applicable to 1 km of pipeline

    1.E-02

    1.E-03

    100 1 0001 10

    1.E-04

    1.E-05

    1.E-06

    1.E-07

    1.E-08

    1.E-09

    1.E-10

    A

    B

    Number of casualties

    Freq

    uenc

    y (p

    er y

    ear)

    of N

    or

    mor

    e ca

    sual

    ties

    Key

    Broadly acceptableA

    Tolerable if AlARPB

    Population density tends to vary along a pipeline route, with clusters of population at some locations. Assessment of the societal risk in accordance with the FN criterion line might still allow such variations to be classified as an acceptable situation not requiring any upgrading of the pipeline to reduce the risk.

    The methodology for assessing risk scenarios, failure cases, failure frequencies and consequences is similar to that used to obtain individual risk levels.

    To carry out a site-specific societal risk assessment, the maximum distance over which the worst case event could affect the population in the vicinity should be determined, e.g. the site length combined with the maximum hazard range within which the population is to be assessed (see Figure 7). This is defined as the site interaction distance.

    2) operators can apply this approach as part of demonstration of ongoing compliance with the recommendations given in PD 8010-1 for population density, location classification and/or demonstration of AlARP.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    18 BSI 2008

    PuBliSheD DocumenT

    The accident scenarios which are relevant for the pipeline section within the site interaction distance should be listed, and the actual population density within the area defined by the pipeline section and the interaction distance (see Figure 7) determined. The frequency, f, and effect area for each accident scenario should then be assessed along the site interaction distance, and the number of people, N, who would be affected, is determined for each scenario at each specific location. This provides a number of fN pairs, which are then ordered with respect to increasing number of casualties, N, and the cumulative frequency, F, of N or more people being affected is determined, giving a site-specific FN curve.

    Figure 7 Site-specific pipeline interaction distance

    2

    1

    3

    Key

    maximum hazard range within which population is to be assessed1

    Pipeline2

    Site interaction distance3

    existing buildings

    new buildings

    NOTE 3 The shape and dimensions of the sitespecific hazard range is dependent upon the characteristics of the released fluid, the presence of directional effects and, for heavierthanair gases and liquids, the topography.

    The site-specific FN curve should be compared with the FN criterion line in Figure 6. As the Fn criterion line relates to a 1 km length of pipeline, the site-specific FN curve is obtained by factoring risk values by a factor equal to 1 km divided by the site interaction distance.

    The FN criterion line given in Figure 6 represents broadly acceptable risk levels for pipeline operation. if the calculated site-specific FN curve falls below the FN criterion line, the risk levels to the adjacent population are considered broadly acceptable. if the site-specific FN curve is close to or above the FN criterion line, then further mitigation might be required to reduce risks to acceptable/negligible levels if this is economically justifiable in terms of the requirement to demonstrate that the risks are AlARP. Alternatively, the proposed development might be deemed unacceptable in that the societal risk levels are too high.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 19

    PD 8010-3:2009

    if the specified area of interest includes another pipeline, the risk from this pipeline should be included in the assessment if it is considered that:

    the pipelines could interact such that a failure on one pipeline would lead to the failure of the other pipeline;

    the development site under consideration is within the interaction distances of more than one major accident pipeline in the specified area.

    if pipeline interaction is considered likely then expert opinion should be obtained on how to model the combined failure frequencies and product outflow. The pipelines should be individually assessed and the risk from each summed to obtain overall individual risk transects and societal risk FN curves.

    When assessing multiple pipelines, FN data should be obtained for each pipeline assessed. When calculating the overall risk it is necessary to combine the individual FN pairs from each assessment. This data should then be factored by a value equal to 1 km divided by the sum of the interaction lengths for each pipeline considered, and compared to the FN criterion line.

    8 Factors affecting risk levels

    8.1 Individual factors influencing pipeline failure frequencyAll the key damage mechanisms should be taken into account when carrying out a risk assessment. Typical causes classified in databases include:

    external interference;a)

    corrosion, either internal or external;b)

    mechanical failure, including material or weld defects created c) when the pipe was manufactured or constructed;

    ground movement, either natural (e.g. landslide) or artificial d) (excavation, mining);

    operational, due to overpressure, fatigue or operation outside e) design limits.

    Assessment of pipeline failure databases shows that external interference and ground movement dominate pipeline rupture rates, and these have the greatest effect on risk from pipelines. The failure rates due to other damage mechanisms can be managed and controlled by competent pipeline operators through testing, inspection, maintenance and operational controls in accordance with PD 8010-1:2004, clause 13.

    The failure rate for external interference is influenced by a number of parameters, including the pipeline wall thickness, design factor and material properties, as well as the location class, the pipeline depth of cover and the local installation of pipeline protection such as slabbing. The failure rate for natural ground movement and for artificial ground movement depends upon the susceptibility to landsliding or

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    20 BSI 2008

    PuBliSheD DocumenT

    subsidence at the specific location. in some cases other causes might need to be considered in specific locations, such as the quality of girth welds, the potential for stress corrosion cracking (Scc) or alternating current (Ac)/direct current (Dc) induced corrosion.

    The failure frequency associated with each damage mechanism should be determined using published operational data sources [8, 9, 10], or predictive models validated using such data. Typical failure frequencies for uK mAhPs based on uKoPA data are given in Annex B.

    The risk analysis requires the principal input data described in 5.1. Any site-specific variations should be assessed, and justifications for any additional assumptions to be applied locally should be documented. in the case of depth of cover, site-specific depths should be taken into account. Where additional pipeline protection such as slabbing is to be taken into account, the design and installation should be assessed to ensure that additional loading is not imposed upon the pipeline, and that cathodic protection is maintained. The determination of failure rate data requires several parameters to be taken into account, including:

    pipeline diameter;

    pipe wall thickness;

    design factor;

    depth of cover;

    steel type and properties;

    location class (1 or 2).

    in determining the external interference failure frequency, it is recommended that the damage incidence rate for location class 2 areas should be assumed to be higher than for class 1 areas. Typically, the factor applied is approximately four times that for location class 1 areas, i.e. the failure frequency in a class 2 area is four times that in a class 1 area. Data relating to class 1 and 2 incident rates for uK mAhPs is provided by uKoPA [9].

    The failure rates obtained from database records or predictive models should be justified for application to a site-specific case. Generic failure data might not be applicable to specific cases. information is given in Annex B.

    8.2 Factors for reduction of the external interference failure frequency for use in site-specific risk assessmentsNOTE 1 An example of a sitespecific risk assessment is given in Annex C. Examples of typical benchmark solutions are given in Annex B.

    The primary residual risk for existing pipelines is that due to external interference. Risk mitigation measures are identified and agreed as necessary by the statutory authority or relevant stakeholder. These should be installed prior to the completion and use of any new development within the pipeline consultation zone. Risk mitigation measures fall into two categories: physical and procedural. Procedural measures rely upon management systems and can be subject to change over time, and therefore might only be applicable for short-term risk control.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 21

    PD 8010-3:2009

    Physical measures include:

    wall thickness and design factor;

    slabbing;

    depth of cover.

    Procedural measures include:

    additional surveillance;

    additional liaison visits;

    additional high visibility pipeline marker posts.

    A site-specific risk assessment should take into account relevant details of the pipeline, and should document justification of any assumptions applied following assessment of these details.

    The pipeline failure frequency due to external interference is obtained as follows:

    F = (PoF I) / oe

    where:

    F is the pipeline failure frequency;

    I is the number of external interference events causing damage in a given pipeline population;

    oe is the operational exposure of the pipeline population, in kilometre years (kmy);

    i/oe is the damage incidence rate.

    NOTE 2 The number of external interference events causing damage , and the operational exposure, relate to the population that the pipeline is part of, not just the pipeline itself. Pipeline failure frequencies derived from published operational data sources are given in Annex B.

    When predicting site-specific pipeline failure frequencies for external interference, the parameters listed above should be taken into account. A number of factors which describe the specific effects of wall thickness, design factor, depth of cover, surveillance frequency and damage prevention measures (slabbing and marker tapes) are described in the present subclause. These factors can be used to assess the effect of individual measures on a known or existing unadjusted pipeline failure frequency for a particular pipeline, or to obtain a failure frequency prediction for a given pipeline. Appropriate factors can be applied cumulatively to the base failure frequency for the particular pipe diameter as shown in Annex B.

    The influence of specific parameters on the predicted pipeline failure frequencies is given as reduction factors as follows:

    R df reduction factor for design factor, given in Figure 8 and Table 1;

    R wt reduction factor for wall thickness, given in Figure 9 and Table 1;

    R dc reduction factor for depth of cover, given in Figure 10;

    R s reduction factor for surveillance frequency, given in Figure 11;

    R p reduction factor for protection measures, given in Table 2.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    22 BSI 2008

    PuBliSheD DocumenT

    Figure 8 Reduction in external interference total failure frequency due to design factor

    0.00.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8

    0.2

    0.4

    0.6

    0.8

    1.0

    = e 0.97 (f -0.72)

    Design factor

    Red

    uctio

    n fa

    ctor

    NOTE Figure 8 relates to a pipe wall thickness of 5 mm, and can be used to assess the influence of design factor on failure frequencies due to external interference for pipelines with wall thickness equal to or greater than 5 mm.

    Figures 8 and 9 show simple reduction factors for design factor and wall thickness which can be used in estimating the failure frequency due to external interference. These two reduction factors have been derived from the results of comprehensive parametric studies [20, 21, 22] carried out using models which describe the failure of a pipeline due to gouge and dent-gouge damage [23, 24, 25], and damage statistics for such damage derived from the uKoPA pipeline database [9]. The reduction factors take the form of a factor for the design factor and a factor for wall thickness, which are applied either to a predicted pipeline PoF or to a failure frequency predicted for a specific pipeline using a specific damage incidence rate. The range of pipeline parameters over which the reduction factors are applicable is given in Table 1.

    The reduction factors given in Figures 8 and 9 are based on a conservative interpretation of the parametric study results. They may be applied separately to modify existing risk assessment results (i.e. to modify existing risk assessment results taking into account local changes in wall thickness), or may be used more comprehensively to estimate the failure frequency in screening risk assessments, using both reduction factors in conjunction with the generic failure frequency curve in Annex B as an alternative to using more complex structural reliability based methods. Further details are given in Annex B.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 23

    PD 8010-3:2009

    Figure 9 Reduction in external interference total failure frequency due to wall thickness

    0.04 6 8 10 12 14 16 18 20

    0.2

    0.4

    0.6

    0.8

    1.0

    f = 0.72

    f = 0.5

    f = 0.3

    e -0.24 (t-5)

    e -0.31 (t-5)

    e -0.39 (t-5)=

    Wall thickness (mm)

    Red

    uctio

    n fa

    ctor

    NOTE Figure 9 relates to design factors of 0.72, 0.5 and 0.3 and can be used to assess the influence of wall thickness on failure frequency due to external interference for pipelines with design factor less than or equal to these values.

    Table 1 Range of applicability of reduction factor for design factor, Rdf, and reduction factor due to wall thickness, Rwt

    Parameter Range of applicability of Rdf and RwtDesign factor G0.72

    Wall thickness H5.0 mm

    material grade GX65

    Diameter 219.1 mm to 914.4 mm

    charpy energy H24 J (average)

    Figure 10 shows a simple reduction factor for depth of cover which can be used to assess the reduction in damage incidence rate in the estimation of the failure frequency due to external interference. This reduction factor has been derived from the results of published studies [26]. use of this reduction factor places a requirement on the pipeline operator to carry out and document periodic checks to confirm that the depth of cover is being maintained (see 8.3.4).Li

    cens

    ed C

    opy:

    x x

    , Mot

    t Mac

    dona

    ld, 1

    0/06

    /201

    0 06

    :22,

    Unc

    ontro

    lled

    Copy

    , (c) B

    SI

  • PD 8010-3:2009

    24 BSI 2008

    PuBliSheD DocumenT

    Figure 10 Reduction in external interference total failure frequency due to depth of cover

    1.6

    1.4

    1.2

    1.0

    0.8

    0.6

    0.4

    0.2

    00 0.5 1.0 1.5 2.0 2.5 3.0 3.5

    Depth of cover (m)

    Red

    uctio

    n fa

    ctor

    Figure 11 shows a simple reduction factor for a surveillance interval which can be used to assess the reduction in damage incidence rate in the estimation of the failure frequency due to external interference. This reduction factor has been derived from the results of studies carried out by uKoPA relating infringement incidence data to damage incidence data [27].

    Figure 11 Indicative reduction in external interference total failure frequency due to surveillance frequency (dependent on frequency and duration of unauthorized excavations)

    1.4

    1.2

    1.0

    0.8

    0.6

    0.4

    0.2

    00 5 10 15 20 25 30

    Surveillance interval (days)

    Ris

    k re

    duct

    ion

    fact

    or

    Table 2 gives reduction factors that apply to pipeline protection measures, which can be used to assess the reduction in damage incidence rate in the estimation of the failure frequency due to external interference. These factors are based on expert studies [28].

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 25

    PD 8010-3:2009

    Table 2 Failure frequency reduction factors, Rp, for pipeline protection

    Measure Reduction factor Rpinstallation of concrete slab protection 0.16

    installation of concrete slab protection plus visible warning

    0.05

    NOTE 1 Concrete slabbing with high visibility marker tapes has been shown to achieve significant risk reduction factors below 0.1 [28].

    NOTE 2 In order to use the reduction factor, the physical barrier mitigation measures should apply to the whole pipeline interaction length for every failure that has to be considered.

    The reduction factors given in Figure 8 and Figure 9 affect the pipeline tolerance to defects and therefore the PoF, whereas the reduction factors given in Figure 10, Figure 11 and Table 2 affect the damage incident rate, I/OE.

    For site-specific risk assessments, the main factors affecting failure frequency should be given careful consideration and the appropriate reduction factor applied as follows:

    probability of failure, a) RPoF, determined using the recommended reduction factors given in this subclause for:

    R df (reduction factor for design factor);

    R wt (reduction factor for wall thickness);

    NOTE 3 Rdf and Rwt have been derived from a parametric study in which Rdf is derived for a constant wall thickness of 5 mm, and Rwt is derived for a constant design factor of 0.72. These reduction factors can be applied together within the limits of applicability given in Table 1, e.g. when used in conjunction with the base pipeline failure frequencies given in Annex B.

    the factor reduction on number of incidents (or incident rate), b) RiR, determined using the recommended reduction factors given in this subclause for:

    R dc (reduction factor for depth of cover);

    R p [reduction factor for protection (slabbing and marking)].

    Factors for risk control measures along the pipeline route to reduce the number of incidents may be applied as follows for other mitigation measures, using reduction factors assessed by the risk analyst for specific situations:

    R s (reduction factor for surveillance frequency);

    R lv (reduction factor for additional liaison visits);

    R mp (reduction factor for additional high visibility marker posts).

    NOTE 4 With respect to control of risk to developments in the vicinity of pipelines, the application of Rs , Rlv might only be applicable for short term/temporary developments only (e.g. fairs, festivals, temporary construction sites etc.). No recommendations are made here for values of Rlv and Rmp. Assessment should be carried out for specific cases.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    26 BSI 2008

    PuBliSheD DocumenT

    8.3 Implementation of risk mitigation measures

    8.3.1 General

    The implementation of risk mitigation measures should be carried out in accordance with PD 8010-1 and the recommendations given in 8.3.2 to 8.3.5.

    8.3.2 Relaying the pipeline in increased wall thickness

    The pipeline should be designed in accordance with PD 8010-1:2004, clauses 5, 6 and 8, constructed in accordance with PD 8010-1:2004, clause 10, and tested in accordance with PD 8010-1:2004, clause 11. Particular care is required where the consolidation of the pipeline trench bed is disturbed allowing settlement. Settlement at the tie-in points with the existing pipeline should be avoided. The function and integrity of pipeline corrosion protection across the new section and at the points of connection with the existing pipeline should be confirmed to be adequate and fit for purpose in accordance with PD 8010-1:2004, clause 9.

    The rationale for the design of the new pipeline section should be specified and justified in relation to the need for risk reduction, e.g.:

    design factor specified as 0.3 to reduce pipeline PoF at operating conditions;

    selection of the wall thickness to achieve an acceptable pipeline PoF;

    selection of wall thickness in relation to risks to new planned development;

    selection of design factor and wall thickness based on AlARP calculations.

    8.3.3 Laying slabbing over the pipeline

    installation of slabbing to provide impact protection to the pipeline should be carried out in accordance with PD 8010-1:2004, 6.9.7 and in accordance with details specified in iGe/TD/1. The structural loads imposed on the pipeline by the slabbing should be taken into account. The installation of concrete slabbing over the pipeline can restrict access to the pipeline in the event of coating deterioration or corrosion damage. it is therefore recommended that a coating survey is carried out prior to the installation of slabbing, that the results of previous in-line inspection are assessed to determine whether there are any indications of corrosion in the length of pipeline to be slabbed that might need assessment and/or repair prior to slabbing, and that the functionality and integrity of the cathodic protection system is confirmed before and after installation of the slabbing.

    8.3.4 Taking account of increased depth of cover increased depth of cover at the location under consideration may be taken into account where this exceeds the recommendations given in PD 8010-1:2004, 6.8.3. A full survey of the actual depth of cover over the full interaction distance at the location under consideration should be carried out in order to record the depth of cover. A justification of the permanence of the depth of cover should

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 27

    PD 8010-3:2009

    be prepared, including the reason for the increased depth of cover, the type of soil, the susceptibility to land sliding and the current and future land use. The depth of cover should be rechecked at specified locations during pipeline route inspections carried out in accordance with PD 8010-1:2004, 13.3.2 to detect factors that could affect the safety and operation of the pipeline. Such checks should be carried out at intervals not exceeding 4 years.

    8.3.5 Installing additional pipeline markers

    PD 8010-1:2004, 10.14 recommends that pipeline markers be installed at field boundaries, at all crossings and, where practicable, at changes in pipeline direction. in addition, high visibility pipeline markers, providing further information on contacts and emergency telephone numbers, can be installed as an additional risk mitigation measure. (See PD 8010-1:2004, 13.3.2 and E.9.)

    8.3.6 Increasing surveillance frequency

    PD 8010-1:2004, 13.3.2 recommends that pipeline route inspections should be carried out. Where route inspections are carried out at two-weekly intervals, increasing the surveillance frequency will increase the likelihood of detection of activities that could damage the pipeline. The surveillance frequency may be increased using walking or vantage point surveys at specific locations as a risk mitigation measure.

    Full details of any additional mitigation measures installed or implemented should be recorded in the pipeline records systems or included in the major accident prevention document (mAPD) for the pipeline.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    28 BSI 2008

    PuBliSheD DocumenT

    Annex A (informative) Summary of HSE methodology for provision of advice on planning developments in the vicinity of major accident hazard pipelines in the UK

    A.1 Land use planning zonesThe health and Safety executive (hSe) sets land use planning zones for major hazard sites, including high-pressure pipelines transporting defined hazardous substances, so that it can provide advice to the local planning authorities on the risks posed by major hazards to people in the surrounding area.

    land use planning zones are used by hSe for mAhPs as defined by Regulation 18 and Schedule 2 of the Pipeline Safety Regulations 1996 [1], and to pipelines that were notified under the notification of installations handling hazardous Substances Regulations 1982 [29] before the enactment of the Pipeline Safety Regulations 1996.

    land use planning zones define three areas:

    inner zone, which is immediately adjacent to the pipeline;

    middle zone, which applies to significant development;

    outer zone, which applies to vulnerable or very large populations.

    The zone boundaries are determined by hSe using a process for calculating individual risk levels, based on information provided to hSe by the pipeline operator. hSe then notifies the inner, middle and outer zone distances to local planning authorities. The outer zone distance is also called the consultation zone, within which the risk implications of proposed developments that significantly increase the population density have to be considered by the local authority.

    local planning authorities in Great Britain are responsible for land use planning decisions under the Town and country Planning Act 1990 [30], and hSe is a statutory consultee with responsibility to provide advice with respect to public safety for any developments planned within or which straddle the consultation zone. Detailed guidance defining the hSe advice (advise against or do not advise against) for various types of development is contained in a comprehensive document available from the hSe website entitled Planning advice for developments near hazardous installations (PADHI+) [31].

    A developer or local planning authority might wish to seek further information to see whether the risk at the specific development location is different from the generalized land use planning zone notified by hSe, or whether additional risk reduction measures (risk mitigation) can be applied at that location, to allow the planned development to proceed. land use planning zones notified to local planning authorities by hSe are based on pipeline details provided in the operators pipeline notification, and do not cover local variations. Where local pipeline details differ from the notified conditions, including whether the pipeline has additional protection [e.g. thicker walled pipe or slabbing3)]

    3) The risk reduction factors given in 8.2 are not currently used in the hSe methodology. Risk reduction factors associated with slabbing are currently under review by hSe.

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PuBliSheD DocumenT

    BSI 2008 29

    PD 8010-3:2009

    near the proposed development), a detailed risk assessment is carried out by hSe to assess any change to zone boundaries.

    At the time when the pipeline operator becomes aware of the possibility of a development near a pipeline, especially if it involves an increase in population within 1 mDoB, they need to assess the population increase against the original routing parameters. in some cases they might decide to initiate a full societal risk assessment to define acceptability or otherwise of the development against the FN risk curve presented in Figure 6, before deciding whether to object to the proposed development.

    in these cases, there is a need to reassess the impact of site-specific details on the risk levels within the interaction zone using an established risk assessment methodology. The guidance in this part of PD 8010 is provided for use by pipeline operators, local planning authorities, developers and any person involved in the risk assessment of developments in the vicinity of existing mAhPs. it is based on the established best practice methodology for pipeline risk assessment.

    it is recommended that the methodology be used for the prediction of site-specific risk levels for consideration in the reassessment of land use planning developments, so that specific local conditions can be taken into account. The process is shown in Figure A.1.

    hSe has adopted a risk-based approach for calculating the distances to the zone boundaries from the pipeline, defining the levels of risk at each boundary as follows:

    boundary between inner and middle zone based on the a) greater of:

    an individual risk of (1 101) 5) per year of dangerous dose or worse to the average householder; or

    the pipeline mDoB;2)

    NOTE 1 Because of the low levels of risk, some MAHPs will not have an inner zone based on an individual risk level of (1 105) per year. However, an inner zone equivalent to the MDOB has been applied by HSE to MAHPs. This distance is calculated using the equation and substance factors given in PD 80101:2004, 5.5.3.

    NOTE 2 In the past, HSE has used a consequencebased approach for calculating this distance.

    boundary between middle zone and outer zone an individual b) risk of (1 106) per year of dangerous dose or worse to the average householder;

    boundary between outer zone and no restrictions the lesser of:c)

    an individual risk of (0.3 101) 6) per year of dangerous dose or worse to the average householder;

    notified outer zone distance.2)

    NOTE 3 In cases where the calculation of risks indicates risk levels are lower than (1 106) per year and therefore there is no middle zone, the inner and middle zones are made equal to the MDOB. Similarly, where risk calculations show levels lower than (0.3 106) per year, all three zones, inner, middle and outer, are made equal to the MDOB (PD 80101:2004, 5.5.3).

    NOTE 4 The location of very large sensitive developments (e.g. very large hospitals, schools, old peoples homes) is restricted to the outer zone (see also Clause 7).

    Lice

    nsed

    Cop

    y: x

    x, M

    ott M

    acdo

    nald

    , 10/

    06/2

    010

    06:2

    2, U

    ncon

    trolle

    d Co

    py, (c

    ) BSI

  • PD 8010-3:2009

    30 BSI 2008

    PuBliSheD DocumenT

    Figure A.1 Planning application process and need for site-specific risk assessment

    Application for Planning Permission submitted to Local Planning Authority

    PADHI + assessment applied byLocal Planning Authority

    Pipeline design differentfrom notified details

    HSE reassess risks which mayrevise LUP zone distances

    HSE reassess risks which maychange advice

    Risk reduction / mitigationmeasures proposed and

    evaluated

    Cost effective riskreduction may not be

    possible. Results of riskassessment can be givento LPA for consideration

    Pipeline detailsas notified

    Planningdecisionresult?

    AdviseAgainst

    Do notAdviseAgainstNOTE 1

    Planningdecisionresult?

    AdviseAgainst

    Do notAdviseAgainstNOTE 1

    Planningdecisionresult?

    AdviseAgainst

    Do notAdviseAgainstNOTE 1

    HSE Advise Against lettermay prompt developer torequest further informationfrom the pipeline operator onthe pipeline design in the vicinity of the development

    No safety or riskissues for LPA toconsider with thisPlanning Application

    Developer may requestPipeline Operator toconsider further riskreduction / mitigation

    measures in vicinity ofproposed development

    NOTE 2

    Improvementsagreed and

    implementationplanned

    NOTE 1 In all cases where the PADHI+ decision is do not advise against, the pipeline operator needs to consider the impact of increased population within the consultation zone and the effect on the original routing decisions made for the pipeline, especially if the development is within 1 MDOB. If significant population increase is likely to occur if the planning development goes ahead, the pipeline operator might need to carry out a societal risk assessment to allow comparison with the societal risk criteria in Figure 6. If