Onshore Pipeline Quantified Risk Assessment

ALLSEAS ENGINEERING BV

SHELL E&P IRELAND LIMITED CORRIB FIELD DEVELOPMENT PROJECT (PHASE II)

CONTRACT NO. 101.24.14

DOCUMENT TITLE: ONSHORE PIPELINE QUANTIFIED RISK ASSESSMENT

ALLSEAS DOCUMENT NUMBER : 368821/D835-01 JPKENNY DOCUMENT NUMBER : 05-2102-02-F-3-835

Rev .

Date

Revision Details

Originator

Interdisc. Check

Allseas Approved

F

22/04/2005

Re-Approved for Design

JPK

RRij

JavB

Client Approved

Internal Revision Control Revision

Date

Revision Details

Revised by

0

22/06/01

Draft Issue for Comments

JPK

1

20/08/01

Issued for Comment

JPK

2

30/10/01

Issued for Approval

JPK

3

11/02/02

Approved for Design

JPK

4

02/07/02

Re-Approved for Design

JPK

5

22/04/05

Major revision following peer review

JPK

External Revision Control Rev.

Date

Revision Details

Revised by

A

04/07/01

For Client Review

GD

B

23/08/01

For Client Review/Comments

GD

C

06/11/01

For Client Approval

GD

D

15/02/02

Approved for Design

GD

E

04/07/02

Re-Approved for Design

GD

F

22/04/05

Re- Approved for Design

JavB

© Copyright Allseas This document is the property of Allseas and may contain confidential and proprietary information. It may not be used for any purpose other than that for which it is supplied. This document may not be wholly or partly disclosed, copied, duplicated or in any way made use of without prior written approval of Allseas.

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment TABLE OF CONTENTS 1

INTRODUCTION................................................................................................................... 4 1.1 1.2 1.3 1.4

General ..................................................................................................................... 4 Scope........................................................................................................................ 4 Purpose .................................................................................................................... 4 Abbreviations ........................................................................................................... 5

2

SUMMARY........................................................................................................................... 6

3

ONSHORE PIPELINE DES CRIPTION ................................................................................... 9 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14

4

MET HODOLOGY................................................................................................................ 12 4.1 4.2 4.3

5

General ................................................................................................................... 12 Hazard Identification............................................................................................... 12 Risk Assessment .................................................................................................... 12 4.3.1 Qualitative and Quantitative Assessment................................................... 12 4.3.2 Consequence Analysis............................................................................... 12

DATA AND ASSUMPTIONS ............................................................................................... 14 5.1 5.2

5.3

5.4

5.5

6

General ..................................................................................................................... 9 Routing ..................................................................................................................... 9 Operational Parameters............................................................................................ 9 Well Fluids Analysis............................................................................................... 10 Design Life .............................................................................................................. 10 Materials................................................................................................................. 10 Diameter and Wall Thickness ................................................................................. 10 Depth of Cover........................................................................................................ 10 Crossings ............................................................................................................... 10 Corrosion Allowance .............................................................................................. 11 Coatings ................................................................................................................. 11 Inhibitors ................................................................................................................ 11 Cathodic Protection ................................................................................................ 11 Pigging ................................................................................................................... 11

General ................................................................................................................... 14 Population Density ................................................................................................. 14 5.2.1 Area Classification...................................................................................... 14 5.2.2 Buildings Locations.................................................................................... 14 Release Frequencies .............................................................................................. 14 5.3.1 Historical Data ............................................................................................ 14 5.3.2 Probabilistic Models................................................................................... 15 Consequence Assessment ..................................................................................... 15 5.4.1 Release Modelling....................................................................................... 15 5.4.2 Ignition........................................................................................................ 16 Tolerability of Risk .................................................................................................. 18 5.5.1 Representations of Risk ............................................................................. 18 5.5.2 International Risk Criteria ........................................................................... 19 5.5.3 Tolerability of risk ....................................................................................... 23

RISK ASSESSMENT .......................................................................................................... 24 6.1

Failure Modes......................................................................................................... 24 6.1.1 General ....................................................................................................... 24 6.1.2 Pressure Considerations ............................................................................ 24 6.1.3 Pressure Cycling ........................................................................................ 24 6.1.4 Pipeline / Umbilical Separation ................................................................... 25 6.1.5 Third Party Interference .............................................................................. 26 6.1.6 Estuary / River Crossings........................................................................... 28

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 2 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

6.2 6.3

6.4

7

DISCUSSION, CONCLUSIONS AND RECOMMENDATIONS ............................................... 43 7.1 7.2

7.3 7.4 7.5 8

6.1.7 Internal Erosion .......................................................................................... 28 6.1.8 Ground Movement ...................................................................................... 28 6.1.9 External Corrosion...................................................................................... 29 6.1.10 Internal Corrosion....................................................................................... 30 6.1.11 Inherent Defects and Construction Defects................................................ 32 Failure Frequencies................................................................................................ 34 Failure Consequences............................................................................................ 34 6.3.1 Release Rates............................................................................................. 34 6.3.2 Fire Modelling............................................................................................. 35 6.3.3 Dispersion modelling.................................................................................. 37 6.3.4 Event trees.................................................................................................. 39 Estimated Risk........................................................................................................ 40 6.4.1 Risk Transects............................................................................................ 40 6.4.2 Individual Risk at the Nearest Building....................................................... 42

Conclusions............................................................................................................ 43 Risk Reduction Measures....................................................................................... 43 7.2.1 Fittings........................................................................................................ 43 7.2.2 External Interference .................................................................................. 43 7.2.3 Ground Movement ...................................................................................... 44 7.2.4 Demonstration of ALARP............................................................................ 44 Design at road crossings........................................................................................ 45 Recommendations.................................................................................................. 46 Implied Assumptions.............................................................................................. 47

REFERENCES (MAIN TEXT) .............................................................................................. 48

APPENDICES APPENDIX A

PROBABILISTIC MODELS FOR RELEASE FREQUENCY DUE TO EXTERNAL INTERFERENCE

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 3 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 1

INTRODUCTION

1.1

General JP Kenny Ltd. (JPK) have been contracted by Allseas Construction Contractors S.A. to prepare the detailed design of the pipeline system for the Corrib Field development Project. The Corrib Field, being developed by Shell E & P Ireland Ltd (SEPIL), (formerly Enterprise Energy Ireland Ltd), is a Triassic gas field located in 350 m of water some 60 to 65 km off the County Mayo coastline. Corrib will be developed as a long-range subsea tieback to an onshore facility. The gas will then be treated to meet the defined gas specification before onward transportation to the Bord Gais Eireann (BGE) grid via a new cross-country pipeline. The subsea facilities will consist of a manifold with cluster wells, together with a number of satellite wells. The pipeline comprises flexible flowlines from the satellite wells to the manifold, and an export line to shore. This 83km 20-inch subsea pipeline from the manifold makes a landfall at Broadhaven Bay in County Mayo, and then a further 9 km onshore pipeline leads to the terminal. An electro-hydraulic umbilical system will run parallel to the pipeline and a water outfall pipeline will also run from the terminal to a diffuser some distance offshore.

1.2

Scope This document presents the Quantified Risk Assessment (QRA) for the onshore section of the gas pipeline. Revision 05 (JPK) has had extensive textual changes from rev 04 to update it in accordance with the peer review. For clarity, no revision markers are included. The QRA has assessed the risks associated with the operation of the onshore section of the pipeline only, i.e. the section of the pipeline between the mean low water mark and the first isolation valve upstream of the pig receiver in the Bellanaboy Bridge terminal. Risks associated with the operation of the pig receiver have been assessed in the terminal QRA. Hazards resulting from failure of the umbilical and the water outfall pipeline have been examined and are excluded from the analysis (although failure of the umbilical and water outfall caused by pipeline loss of containment are addressed later in the QRA).

1.3

Purpose The purpose of this assessment is to predict the individual risk and potential loss of life to members of the public who might be affected by the operation of the onshore section of the Corrib gas pipeline. The QRA makes recommendations for risk reduction where appropriate, and demonstrates that the residual risks associated with the operation of the onshore pipeline have been reduced to levels which can be considered tolerable when compared with international standards. The methodology used in this assessment is generally in accordance with the Project Risk Assessment Procedure [Ref. 1] in order to be compatible with risk assessment work to be carried out by other Contractors (e.g. the terminal contractors) and will allow the results to be incorporated into an overall Project Safety Assessment. All references and assumptions are stated. All mathematical models and formulae used are documented.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 4 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 1.4

Abbreviations ALARP

As Low As Reasonably Practicable

BGE

Bord Gais Eireann

CP

Cathodic Protection

DOE

Department of Environment

E&P

Exploration and Production

EGIG

European Gas pipeline Incident data Group

EPA

Environmental Protection Agency

ESDV

Emergency Shut Down Valve

FAR

Fatal Accident Rate

FBE

Fusion Bonded Epoxy

HAZID

Hazard Identification

HSE

(UK) Health and Safety Executive

ID

Internal Diameter

IR

Individual Risk

LFL

Lower Flammable Limit

MIACC

Major Industrial Accidents Council of Canada

NDT

Non Destructive Testing

PARLOC

Pipeline and Riser Loss of Containment

QRA

Quantified or Quantitative Risk Assessment

SEP

Surface Emissive Power

SEPIL

Shell Exploration & Production Ireland Ltd

SMYS

Specified Minimum Yield Strength

SRB

Sulphate Reducing Bacteria

TDU

Thermal Dose Unit

UKOPA

United Kingdom Onshore Pipeline (Operators) Association

WHSIP

Well Head Shut In Pressure

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 5 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 2

SUMMARY The prediction of risks to the public resulting from the operation of the onshore section of the Corrib gas pipeline indicates that the risks would be tolerable when compared with international criteria and legislation on risk, for both the initial normal operating pressure of 120 barg as well as the maximum pressure of 345 barg. For the purposes of this assessment, a fatality is conservatively assumed to result for any person receiving a "dangerous" thermal dose or worse (where "dangerous" is actually defined as a 1% risk of fatality). The risk levels have been predicted using data and assumptions which are considered to be conservative (i.e. to over-estimate rather than under-estimate the risk level where judgement was required). Figure 2-1 and Figure 2-2 show the predicted levels of Individual Risk (IR) with increasing distance from the pipeline for the normal (Fig 2-1) and maximum (Fig 2-2) operating pressure. -7 The risk is highest immediately above the pipeline. Here the risks are 2.6*10 /yr (1 in 4 -7 million per year) for the normal operating pressure of 120 bar and 5.7*10 /yr (1 in 2 million per year) for the maximum pressure of 345 bar. The difference in risk level is a result of consequences of failure spreading over a larger distance, not an increase in failure probability. See section 6.4.1 for further explanation of the effect of different pressure.

Frequency per year

1.E-06

1.E-07

1.E-08

1.E-09 0

50

100 150 Lateral distance (m)

200

250

Figure 2-1: Risk Transects for 120 bar operating pressure

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 6 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

Frequency per year

1.E-06

1.E-07

1.E-08

1.E-09 0

100

200

300

400

Lateral distance (m) Figure 2-2: Risk transects for pipeline at 345 bar (design pressure)

A pipeline isolation valve (Beach Valve) located at the landfall is included in the design to allow shutting off the onshore section of the pipeline from the much longer offshore section. However as casualties are more likely to occur during the early stages of an ignited release the effect of isolation by the Beach Valve on the overall risk levels is negligible. Closing the valve in the event of a leak reduces considerably the total duration of the release event (and the total quantity of gas released), but this does not affect the predicted risk levels. The current design of the Beach Valve has incorporated all of the recommendations made in the earlier revisions of this QRA. The valve has been designed as an all-welded assembly, with no flanged connections or small bore valves or fittings in order to minimise the potential for leaks at the valve itself. A fully-welded connection will be used on the pipeline side of the ESDV at the inlet to the terminal to minimise leak paths at this location. Pipeline hazards have been included in the assessment of Terminal workers risks performed in the Terminal QRA. The following recommendations have been made as a result of the risk assessment process. These have been added to the overall project hazard register to ensure that they are addressed and implemented as required. •

Plastic warning tapes should be installed in the ground above the pipeline, and pipeline markers should be installed at field boundaries, to deter external interference (Section 6.1.5.3);

•

The first intelligent pigging run should be performed within 3 years of pipeline start-up. The timing of subsequent inspections should be based on the results of this initial run (Section 6.1.9 & 6.1.10.2);

•

Periodic analysis of the well fluids should be undertaken to determine H2S concentration throughout the field life (Section 6.1.10.1);

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 7 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment •

Corrosion Inhibitor should be continuously injected, and operational safeguards should be implemented to guarantee high system availability, in order to prevent excessive internal corrosion (Section 6.1.10.2);

•

An appropriate corrosion monitoring system should be implemented in order to identify excessive internal corrosion (Section 6.1.10.2);

•

Consideration should be given to the means employed for leak detection and the ability to detect small leaks (Section 6.3.1.1).

•

A design factor of 0.72, complete with concrete protection slabs, will be used for the road crossings (section 7.3)

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 8 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 3

ONSHORE PIPELINE DES CRIPTION

3.1

General Generally, the onshore section of the pipeline will be designed, constructed, tested and commissioned in accordance with BS 8010 [Ref. 2] and the Onshore Design Basis [Ref. 6]. The basis for selection of the onshore design code is described in the Design Code Comparison [Ref. 3]. The following sections provide an outline of the design features of the onshore section of the pipeline, in order to provide a background to the discussion of failure modes contained in Section 6.1. BS 8010 has now officially been withdrawn and effectively replaced by PD 8010 Pt 1. It is normal practice in long running project that the original design code and revision continues to be used in its entirety. PD 8010 maintains the same requirements for this project as BS 8010.

3.2

Routing The pipeline comes ashore at the Dooncarton landfall in Broadhaven Bay. From the landfall it travels 0.65km across a small headland until it reaches the Sruwaddacon Bay estuary. From Ross Port the route heads in a predominantly south-easterly direction along the north side of Sruwaddacon Bay. The majority of the land in this area is improved or semi-improved pasture with occasional areas of peat. After a further 5km the route crosses the Glenamoy River and then heads in a more easterly direction through a densely forested area underlain with blanket bog until the proposed terminal site, near Bellanaboy Bridge, is reached. The total length of the onshore section of the pipeline is approximately 9 km. The following considerations have been taken into account when finalising the route of the onshore pipeline section: •

Increasing separation distances from buildings, developed areas and planned future developments as far as reasonably practicable;

•

Minimising road, rail and water crossings and crossings of existing utilities and services as far as reasonably practicable.

Note that location class is determined, in accordance with BS 8010, in the Population Density Analysis [Ref. 4]. Special consideration is given in the design to the stabilisation of the pipeline in areas of bog and marshland, where these cannot be avoided. Design proposals and construction methods have been checked against geological / geotechnical data for suitability. A specific study has been performed to consider the effect of a peat slip or land slide and the analysis shows that the pipeline as designed can withstand such events without rupture or leakage. [Ref 5] 3.3

Operational Parameters The following information has been taken from the Design Basis [Ref. 6]. Design Flow Rate:

350 mmscfd

Maximum Flow Rate:

350 mmscfd

Design Pressure:

345 barg

Operating Pressure Range (onshore section):

50 - 140 barg

Normal Operating Pressure (onshore section, at start of field life):

120 barg

Wellhead Shut In Pressure (WHSIP) (at start of field life):

345 bara

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 9 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

3.4

Wellhead flowing pressure (at start of field life):

272 bara

Maximum Design Temperature:

50°C

Minimum Design Temperature:

-10° C

Well Fluids Analysis The Corrib field contains a wat er saturated sweet gas with an expected condensate yield of less than 0.5bbls/mmscf [Ref. 6]. For the purposes of the consequence modelling the following well fluids properties have been assumed, based on well 18/25-1 [Ref. 6]. Table 3-1 – Well Fluids Properties and Composition Relative Density (Air=1) Average MW (g/mole) Composition (mol %) Methane Ethane Nitrogen Carbon Dioxide Hydrogen Sulphide

3.5

18/ 25-1 0.587 17.0 94.0 3.0 2.7 0.3 nil

Design Life The pipeline and all its attachments have a design life of 30 years.

3.6

Materials The pipeline will be constructed from Carbon Steel to DNV OS-F101 SAWL 485 (equivalent to API 5L Grade X 70).

3.7

Diameter and Wall Thickness The pipeline has a nominal external diameter of 20” (508 mm). Design of pipe wall thickness is in accordance with BS 8010 [Ref. 2]. This has resulted in a nominal wall thickness of 27.1mm, including corrosion and manufacturing allowances.

3.8

Depth of Cover Generally, the pipeline will be buried with a minimum depth of cover of 1.2m over the entire route. This minimum cover is increased at crossings. Where this depth of cover is not achieved (e.g. at ditch crossings), additional protection is provided over the pipeline.

3.9

Crossings The route taken by the onshore section of the pipeline includes the following crossings: • • •

6 Track Crossings; 3 Road Crossings (including the Terminal Boundary Road); 3 River Crossings;

•

33 Ditch Crossings.

Road crossings have been designed in accordance with BS 8010 [Ref. 2]. Special consideration will be made where pipe in soft ground crosses roads to ensure that stresses

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 10 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment cannot be exerted on the pipe due to ground settlement over the life of the pipeline. Concrete coated pipe is used at river and estuary crossings. Track, road and ditch crossings incorporate a concrete barrier above the pipeline to protect from third party interference, e.g. during ditch clearing activities. Buried utilities, drains, etc. are to be crossed in accordance with the individual owner's requirements but will follow the convention of crossing beneath existing services with protection between them unless indicated otherwise. 3.10

Corrosion Allowance A corrosion allowance of 1.0mm has been included in the wall thickness calculation of the onshore pipeline section. (section 3.7)

3.11

Coatings The pipeline is provided with a 2.5 mm thick external polypropylene (3LPP) anti-corrosion coating on all pipeline sections that are not concrete coated. Concrete coated sections (used at river and estuary crossings) have asphalt enamel under the concrete coating.

3.12

Inhibitors Throughout the life of the pipeline, a mixture of methanol, corrosion inhibitor and scale inhibitor will be injected at the subsea wells in order to prevent internal corrosion, hydrate formation and scale deposition in the pipeline.

3.13

Cathodic Protection In addition to the coating system described above, the onshore section of the pipeline will be fitted with an impressed current cathodic protection system to prevent external corrosion. The cathodic protection system has been designed in accordance with the requirements of BS7361 and will comprise a transformer rectifier unit, anode groundbed and test facilities for system monitoring. The precise location and configuration of the anode groundbed has been determined following completion of the soil resistivity survey [ref 19]. Test facilities to enable monitoring of the level of cathodic protection afforded to the pipeline will be installed at strategic locations (selected during the resistivity survey), taking due note of any particular corrosion hazards identified during the survey work. The interaction of the onshore and offshore CP systems was addressed in the design of the onshore system to ensure that no undesirable effects occur that could result in underprotection of either pipeline section. This is described in the Corrosion Protection Design Report (Ref. 19). No electrical isolation joint is required between the onshore and offshore pipeline sections. The onshore pipeline is electrically isolated from the Terminal pipework.

3.14

Pigging The onshore section of the pipeline has been designed to permit intelligent pigging, and meets the requirements for the operation of all forms of pigs.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 11 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 4

METHODOLOGY

4.1

General The risk assessment of the onshore section of the pipeline has generally been conducted in accordance with the Project Risk Assessment Procedure [Ref.1] and the following methodology.

4.2

Hazard Identification A Hazard Identification (HAZID) exercise has been carried out using a comprehensive generic HAZID checklist developed specifically for onshore pipelines. This activity was conducted to provide the starting point for the onshore pipeline QRA by identifying those hazards to be included in the assessment. The HAZID checklist included hazards applicable to pipelines carrying any product, constructed from any material, having any diameter and wall thickness, crossing all types of terrain and exposed to all possible environmental hazards. It therefore included some hazards that were not judged to be significant as potential causes of failure for the onshore section of the Corrib pipeline, and others that will be adequately controlled by the design and construction practices. However, all hazards were discussed and assessed in the Hazard Review report (Ref. 15) as part of the process. Hazards that were judged to present a significant risk were carried forward for more detailed assessment (using qualitative and quantitative methods as appropriate) in the development of this document. Assessment of these hazards and ways in which the risks could be managed led to recommendations which have subsequently been incorporated into the pipeline design in order to ensure that the risks were reduced to a tolerable, or As Low As Reasonably Practicable (ALARP), level.

4.3

Risk Assessment

4.3.1

Qualitative and Quantitative Assessment Qualitative and quantitative risk assessments have been conducted, as appropriate to the particular risk. Qualitative discussions have been used to reduce the number of failure modes requiring quantitative assessment. Quantitative risk assessment comprised hazard consequences and hazard frequency assessments. The QRA has quantified the residual risk, resulting from the operation of the onshore section of the pipeline, in terms of risk to members of the public. The results of the assessment have been discussed and recommendations have been made to reduce risks to levels that are as low as reasonably practicable.

4.3.2

Consequence Analysis This part of the analysis involves the following: •

Allocation of a release type (vapour, two phase etc) or hazard type (dispersion, fire, flash fire etc).

•

Determination of release rate for each scenario. Standard release rate equations with a coefficient of discharge of 0.8 (typical for gas) were used. For releases through large holes a pipeline model was used to determine the reducing release rate with time.

•

Association of each scenario with the type(s) of hazardous event that could occur should there be ignition (i.e. jet fire, flash fire etc).

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 12 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment •

Determination of the consequences. Dispersion distances and distances to thermal radiation levels have been determined using Shell FRED (Fires, Release, Explosion, Dispersion) Version 4. This is a suite of consequence models based on Shell’s involvement over a more than 20 year period in Safety Research and Development. The models are all validated by large-scale experiments, and published in reputable scientific literature.

In the determination of the hazardous envelope(s) associated with each scenario, consequence end points need to be defined for each hazard type. Although at present there are no published Irish standards for the determination of land use planning advice, it is understood that statutory criteria are being developed for such advice based on risk. In order to establish a common basis for sites that present a combination of hazards, the authority will consider the risks associated with a ‘dangerous dose’. A ‘dangerous dose’ is one which will: •

Cause severe distress to almost everyone;

•

Require a substantial fraction to be given medical attention, with some suffering irreversible effects;

•

Cause fatalities in highly susceptible members of the population (the most vulnerable 1%).

For the radiation hazards posed by the proposed pipeline a dangerous dose for radiation to 2 1.3333 people (referred to as Thermal Dose Units or TDUs) of 1000(kW/m ) s is commonly used. 2 For an exposure duration of 75 seconds a thermal flux of 7kW/m is approximately 1000TDU 2 2 and a thermal flux of 4kW/m is approximately 500TDU. In this report 6kW/m has been used to represent 1000TDU. The potential impact of the pipeline on the trees and buildings has been considered using the 2 2 thermal radiation frequency contours for 12kW/m for long duration fires and 20kW/m for 2 2 short duration fires. The critical heat flux for piloted wood ignition is 13.1kW/m , and 20kW/m would be capable of igniting trees if the exposure duration was more than five minutes, (Cohen and Butler [Ref 7]). For short duration fires, the distance to the spontaneous ignition of wood has been used (Bilo and Kinsman[ Ref 8]) Other hazards more commonly associated with petrochemical activities like toxic effects and explosions have not been considered. Toxic effects are not considered credible scenarios on the basis of the composition of the Corrib gas. An explosion event is not considered to represent a credible scenario (by comparison to the fire events that have been modelled) as there are no areas along the route of the onshore pipeline section in which gas may accumulate, or where there would be sufficient confinement and congestion to allow significant explosion overpressures to be generated. Explosion modelling has not, therefore, been conducted.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 13 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 5

DATA AND ASSUMPTIONS

5.1

General The quality of the predictions of the QRA depends on the quality and relevance of the data sources and assumptions used. It is therefore important that appropriate sources of historical data are used, that the data is correctly applied and that realistic, yet conservative, assumptions are made based on best practice and experience available from other similar risk assessments. The data sources and assumptions used are described in the following sections.

5.2

Population Density

5.2.1

Area Classification The area classification based on population density has been made in accordance with BS 8010 [Ref. 2] and is reported in the Population Density Analysis [Ref. 9]. The estimated population density, calculated for a corridor 850m either side of the pipeline, using aerial photographs (taken during 2000), is 0.65 people / hectare, which results in an area class 1 location. The upper limit for an area to be classified as area Class 1 is 2.5 people / hectare. Ordnance survey maps (undated) are also available. A comparison of the maps with the photographs show that in the intervening period some buildings have become redundant and new buildings have been constructed. However it appears that the overall population density has not changed significantly. It is also unlikely that the population density of the area will increase significantly in the near to medium future. In order to change from a Class 1 to a Class 2 location (i.e. more than 2.5 people / hectare), the population would have to increase by approx 200% in the immediate vicinity of the pipeline route. For risk assessment purposes, the population density will be conservatively taken as 0.75 people / hectare to allow for modest growth in population density over the life of the pipeline.

5.2.2

Buildings Locations The location of buildings along the pipeline route have been investigated using the alignment sheets (which combine the aerial photographs, vector maps and the proposed pipeline route) in order to identify the closest building/s and the area with the greatest “density” of buildings. The greatest density of buildings exists along the road to the north of the onshore section of the pipeline, where it runs along the northern edge of Sruwaddacon Bay [Ref. 10]. The closest building to the pipeline route is located approximately 70m from the proposed route centre-line.

5.3

Release Frequencies

5.3.1

Historical Data Historical data for releases from valves and flanges has been taken from the E&P Forum (now called International Association of Oil and Gas Producers) Risk Assessment Data Directory [Ref. 11 ] and the UK Health and Safety Executive Offshore Hydrocarbon Releases Statistics, 1999 [Ref. 12].

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 14 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment Data from the UK Onshore Pipeline Operators' Association (UKOPA) [Ref.17 ] has been used for specific onshore pipeline hazards such as external interference and external corrosion and has also been used for materials defects data. The UKOPA database represents a source of pipeline fault data which is specific to the UK and based on incidents occurring during over half a million pipeline operating years (of which over 90% is natural gas pipelines) between 1962 and 1998. The UKOPA data is considered to be more relevant to the onshore section of the Corrib Pipeline than US or European data. However, as the gas pipelines in the UKOPA database were transporting sales specification natural gas (i.e. dry gas) the PARLOC 96 data for offshore pipelines [Ref. 13] has also been consulted for in relation to failures due to internal corrosion and material defects to determine which are the most appropriate frequencies to use in this assessment Although there are later versions of this data now available, the results in them are similar, if not a reduced incident frequency, therefore the original data has been retained in this revision of the QRA and adds a slight further conservatism to the failure frequency data. 5.3.2

Probabilistic Models The UKOPA data shows that external interference to buried onshore pipelines (from mechanical excavators, etc.) is a major contributor to the overall failure frequency. Two probabilistic limit state models are available to determine the risk of puncture or rupture due to this type of external interference, i.e.: •

puncture due to penetration of the pipe by an excavator bucket tooth;

•

a gouge and/or dent in the pipe wall resulting in a leak or rupture.

These models have been developed based on published reference works, and are described in Appendix A. For other failure modes, for which probabilistic models are not readily applicable, estimates of failure frequencies have relied on historical data. 5.4

Consequence Asse ssment

5.4.1

Release Modelling

5.4.1.1

Hole Sizes The modelling of releases from large pipelines generally only uses two hole sizes to represent leaks and ruptures. Intermediate hole sizes are not considered as large cracks or punctures in the walls of pipelines (particularly high pressure gas pipelines) tend to propagate rapidly into full-bore ruptures. Leaks have been modelled as having an equivalent hole diameter of 25 mm. This is equivalent to pipe punctures or cracks. Ruptures have been modelled as having an equivalent hole diameter equal to the pipe internal diameter. When modelling pipeline ruptures, the release rate from both sides of the ruptured pipeline were addressed.

5.4.1.2

Release Conditions •

All releases were calculated at the normal operating pressure of 120 barg and the design pressure of 345 barg.

•

For the 25 mm diameter leak event a rate independent of time was assumed

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 15 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment •

For the rupture event the average release rate over the first 60 seconds was used for the calculation of dispersion and radiation distances. o

All releases were assumed to occur at the ambient temperature of 10 C. 5.4.1.3

Release Orientation and Inventory Leaks Three different release orientations were used in the gas dispersion modelling of the leaks: These are vertical, horizontal and buried. The vertical and horizontal releases were modelled as jets discharging into the air and were not obstructed (for the horizontal release this means that the sides of the crater were ignored). The buried release was modelled as directly downwards into the ground underneath the pipeline such that the gas loses all momentum and then disperses out of the crater in the downwind direction (this ignores any upward momentum that the gas would obtain by being pushed upwards out of the crater by the gas escaping from the release). To this extent, all release modelling is considered to be based on conservative assumptions. For the leak failure modes, the release orientation is considered to be evenly distributed around the pipeline circumference, but the releases need to be assigned as either vertical, horizontal or buried in order to match one of the gas dispersion and fire models. It has been decided that 50% of the releases should be assigned as buried releases as these will impinge significantly on the crater sides, causing the jet to lose (some or all of its) momentum. The remaining releases are divided evenly between “vertical” and “horizontal”. The event tree accounts for all three release directions used in the dispersion modelling. The proportions assigned to each release direction in the first column of the event tree are the proportions of un-ignited releases in this direction (i.e. 25% vertical, 25% horizontal and 50% buried) for the other failure modes. Ruptures The directional component of a full bore rupture will be horizontal in the direction along the pipeline both for dispersing high momentum gas jets and ignited jet fires. Inventory The design of the gas production system includes automatic ESD valves at the subsea wells and at the entrance to the terminal facilities. The length of pipeline between these two points is approximately 93km, giving a maximum total pipeline inventory (at the initial wellhead shut in pressure) of approximately 3900 tonnes. For small leaks in the onshore pipeline section, it has been assumed that these may not be easily detected (due to the relatively low release rate) and may therefore persist for some time before detection and closure of the ESD valves.

5.4.1.4

Meteorological Data Wind statistics (strength and direction) used for the modelling have been provided by Met Eireann (Belmullet). Information about the wind speed stability combinations is not available, so it has been assumed that these could be represented by F2 (Pasquill stability F-stable, wind speed 2m/s) and D5 (Pasquill stability D-neutral, wind speed 5m/s). It has further been assumed that D5 occurs for 85% of the time and F2 for the remainder. This in line with common QRA practice.

5.4.2

Ignition Ignition probabilities have been derived from a number of published data sources. Historical data is available from hundreds of pipeline release incidents occurring during millions of km.yrs of pipeline operation and represents the best available estimates of ignition probability.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 16 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment The ignition frequencies used in this revision of the QRA (updated from previous revisions of the document) are based on data published by EGIG in 2001) and are compared to other data sources in the table below: Table 5.1 Historical Ignition probability Data Source EGIG 2001

UKOPA 2000 [14]

Release Size Pinhole-crack (< 2cm) Hole (2cm < Dleak < Dpipe) Rupture (> 16”) All sizes All sizes

Ignition Probability 0.032 0.021 0.25 0.04 0.047

The historical databases contain release frequencies for a large number of pipelines with a range of wall thickness. This includes thin-walled pipelines, which are more susceptible to puncture by external interference than the thick-walled Corrib pipeline. As release events caused by external interference have a higher probability of ignition (as a potential source of ignition is usually present) it is considered that the ignition probabilities derived from these databases represent conservative estimates for the Corrib onshore pipeline. The historical databases also include much data for pipelines in urban and suburban areas where the ignition probability due to the number of ignition sources available in such locations would be expected to be much higher than in a rural location such as the Corrib onshore route. Again, this means that the data presented in the databases is conservative for the Corrib onshore pipeline. It has nevertheless been decided to use the historical ignition frequencies as a guide for the ignition probabilities selected in this study. In general, the following ignition probabilities have been adopted, and the values used in the event trees have been based on these values.

Table 5.2 – Selected Ignition Probability values Release Size Rupture (> 16”) Pinhole-crack (< 2cm)

Ignition Probability 0.25 0.032

In order to account for “early” and “late” ignition the available historical data for onshore pipeline releases was reviewed to ascertain whether any distinction was made with regard to the timing of ignition in pipeline release events. The data search did not, however, yield any information that could be used to determine the time delay between the onset of an accidental release and the moment of ignition of the gas. This is probably to be expected because, while evidence of a gas cloud ignition is all too apparent, there are not usually any signs that allow accident investigators to determine how long after the initial release the ignition occurred. While it is possible that this information may be available in a (very) few cases, it is not normally recorded in historical accident databases. The overall ignition figure in the EGIG data does not distinguish between “early” and “late” ignitions, but does include ALL ignitions (EGIG Report, 2001, Section 2.2 states that “Ignition yes/no” was recorded for ALL pipeline release incidents, but nothing more specific than this). Vertical leaks will have a very small flammable area at ground level and therefore a very small probability of early ignition. A probability of 0.002 is assumed (10% of the frequency attributed to horizontal and buried releases). Late ignition of vertical releases is considered as not feasible and therefore give a probability of zero. Given that the effect of vertical jet fires from leaks is much less than that for horizontal or buried leaks, this is a conservative assumption as the overall ignition frequency remains the same but is spread over the other orientations.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 17 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment For ruptures from external impact, most likely caused by motorised diggers, an early ignition probability of 0.9 has been assumed. In the absence of historical data, it was decided that the proportion of “early” and “late” ignitions was to be evenly distributed in the development of the event tree. The area affected 2 by the late ignited clouds is, in most cases, smaller than the area enveloped by the 6kW/m contour /1000TDU. Therefore this assumption will not affect the result as in the study late ignited dispersing clouds will flash back to torch fires which is the same outcome from early ignited dispersing clouds. 5.5

Tolerability of Risk Tolerability of risk is normally determined by the authorities which authorise developments of this nature. A discussion on the various risk acceptance criteria found, applicable to pipelines is presented in the following paragraphs. The most stringent criteria found, applicable to -6 pipelines, would tolerate a risk contour value below 10 per year (1 in a million chance per year of a fatality).

5.5.1

Representations of Risk Quantitative representations of risk are commonly used to describe the risk level to the workforce and/or members of the public affected by industrial activities. These risk representations are normally calculated as the potential risk of loss of life, and the resulting risk levels can then be compared with known fatality statistics. For pipelines, in general only Risk Contours are used. F/N curves (see 5.5.1.3) are not usually used as the risk, when depicted in this way, would become dependent on the length of the pipeline section considered and the location of individuals, all of which change greatly along the length of the pipeline – which makes this figure meaningless. Risk Transects (see also 6.4.1) show the effect of distance on risk frequency at 90 degrees to any point along the pipeline and are developed from a section or intersection through Risk Contours.

5.5.1.1

Risk Contours The Risk Contour is an iso-risk line on the map at which a hypothetical individual staying at one point on this line unprotected and for 24 hours per day would be subjected to a defined probability of loss of life due to exposure to hazards induced by the industrial activity. This risk indicator is most frequently used to quantify the risk to the public around an industrial activity (in this case the gas pipeline) and is expressed as a risk of fatality on a per year basis. Each point along the risk contour is specific to a certain point on the ground, and represents the sum of any risk scenarios which can affect that point. It is sometimes called the Location Risk. Another way to look at the definition above, is to say that a hypothetical individual is at the location and exposed whenever any of the risk scenarios manifests itself. Although the hypothetical individual is exposed when the scenario occurs, it is normal to take account of human reaction. For example if the individual is in the heat radiation field of a big flame, then an exposure time is assumed from the time of the event until after the individual can reasonably be assumed to have taken cover or moved far enough away from the flame not to be at further risk. It is possible to take account of the protection offered by buildings, so that the risk contour level inside a building is lower than outside. However this is not normal practice when calculating Risk Contours for land-use planning purposes and has not been undertaken for this analysis.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 18 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 5.5.1.2

Individual Risk The Individual Risk (IR) level is more specifically defined as the Individual Risk Per Annum (IRPA), which is the calculated annual risk loading to a specific individual or group of individuals. Clearly this depends on the amount of time in a year that the individual spends in different risk areas. The individual risk calculation takes account of the fact that people move from one place to another. When calculating individual risk from major accident scenarios, it is normal to take account of protection by buildings. 8

Sometimes the individual risk is calculated on the basis of 10 exposed hours. This is called the Fatal Accident Rate (FAR). 5.5.1.3

Societal Risk Curves Societal Risk is used in Quantified Risk Assessment (QRA) studies and is depicted on a cumulative graph called an F/N curve. The horizontal axis is the number of potential fatalities, N. The vertical axis is the frequency per year that N or more potential fatalities could occur, F. This risk indicator is used by authorities as a measure for the social disruption in case of large accidents. It is normal to take account of protection by buildings, and people’s response. For large toxic release models, alarm and evacuation can be included. The resulting curve is then the residual risk should the emergency plans not be effective. Because it is a cumulative curve, the curve always drops away with increasing N. Normally -9 the F/N curve has a lower frequency cut-off at one in a billion (1 x10 /yr). Regulators often split the graph into different regions, so that different actions have to be undertaken depending on where the F/N curve falls. Sometimes a maximum limit is placed on N (number of fatalities) possible for any event. This type of curve is normal for plant type hazardous installations where a large group of people could be affected and their location is well established (housing estates, schools etc) relative to the event location (the plant). For pipelines however, because there is no single location for an event and the population affected varies along the pipeline route, this curve is not normally generated unless a large group of people can be effected over a reasonable distance. For the Corrib pipeline, the population is distributed over a long length, part has no population close to it at all and therefore the calculation for this curve is not really possible and does not provide a true picture of the societal risk presented by the pipeline.

5.5.2 5.5.2.1

International Risk Criteria United Kingdom In the UK the “Control of Major Accident Hazards” (COMAH) regulations are in line with the latest EU “Seveso-2” Directive. The regulations do not formally require a quantitative risk assessment, but the guidance notes make clear that in some circumstances quantification will help or could be asked for by the UK regulator - the Health and Safety Executive (HSE) - and this is often done in practice. To advise planning authorities on developments around industrial installations, the UK HSE has been developing risk acceptance criteria over the years. A comprehensive treatment of the subject of tolerability of risk was given in a report titled “Reducing Risks Protecting People” [Ref 14 ] . The report repeated the concept and criteria as argued by the Royal Society in 1983. It accepted the concept of tolerable Individual Risk as being the dividing line between what is just tolerable and intolerable and set the upper tolerable limit for workforce -3 -4 fatalities at 10 /yr ( 1 in a thousand) for workers and 10 /yr ( 1 in 10 thousand) for members

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 19 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment of the public. A level at which risks might be broadly acceptable but not altogether negligible -6 was set at 10 /yr (1 in a million). The region in between would be controlled by the ALARP concept. ALARP can be demonstrated in a variety of ways, depending on the severity of the worst case scenario. These are expressed in HSE guidance to Inspectors Consultation Draft September 2002. When a QRA is carried out, then the F/N regions are defined as in the Figure 5.1. 1E-02 Unacceptable Frequency per year

1E-03 1E-04 1E-05

ALARP

1E-06 1E-07

Broadly acceptable

1E-08 1E-09 1

10

100

1000

10000

Number of fatalities

Figure 5-1 United Kingdom Societal Risk Guidelines (risk to workforce and public) Unlike the Netherlands (see below), the potential workforce fatalities are included in the F/N curve.

5.5.2.2

Canada: Major Industrial Accidents Council of Canada (MIACC). The MIACC recommend individual risk levels for use in respect to hazardous substances risk from all sources, i.e. there is no need to distinguish between risk from a fixed facility at which hazardous substances may be found, or a pipeline or a transportation corridor. The acceptability levels are equally applicable. With these considerations in mind, the guidelines for acceptable levels of risk are as follows Table 5.3 Land use and Industrial Risk according to MIACC Location (based on risk level) From risk source to 1 in 10,000 -4 (10 ) risk contour: 1 in 10,000 to 1 in 100,000 -4 -5 (10 to 10 ) risk contours:

1 in 100,000 to 1 in 1,000,000 -5 -6 (10 to 10 ) risk contours Beyond the 1 in 1,000,000 -6 (10 ) risk contour

Possible land uses no other land uses except the source facility, pipeline or corridor uses involving continuous access and the presence of limited numbers of people but easy evacuation, e.g. open space (parks, golf courses, conservation areas, trails, excluding recreation facilities such as arenas), warehouses, manufacturing plants uses involving continuous access but easy evacuation, e.g., commercial uses, low-density residential areas, offices all other land uses without restriction including institutional uses, high-density residential areas, etc

It is important to emphasize that these guidelines do not prohibit all activities or structures within the various risk contours, but rather restrict land use within each zone. As is the case

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 20 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment for many other land use questions (e.g. flood plains), the contours are used to define special restrictions on land uses. This aspect of the guidelines is particularly important since, as discussed in a subsequent section, land use controls around industrial sites have important legal and economic implications. The guidelines are thought to be realistic in terms of existing practices of risk management and levels of risk. They are also compatible with criteria that have been selected and implemented in other industries and other countries. In a practical sense, these criteria can only achieve authority if they represent a consensus view of Canadian society. They must not impose unrealistic requirements on industry and should reflect the contemporary standards of the society to which they are applied. 5.5.2.3

Malaysia The criteria used by the Department of Environment (DOE) for existing facilities are outlined below for residential and industrial areas: -6

•

Residential

1 x 10 fatalities / person / year

•

Industrial

1 x 10 fatalities / person / year

-5

In words, the acceptability criteria are as follows: the risk of death to persons in a residential area must not exceed 1 chance in a million per person per year and the risk of death to persons in a nearby industrial area must not exceed 1 chance in 100,000 per person per year. If the quantified individual risk compares favourably with the acceptability criteria, then it is deemed acceptable. If not, the components of the overall risk are re-examined to determine where risk mitigation measures can be implemented cost effectively. Risk evaluation must also be conducted taking into account the fact that hazard analysis and consequence assessment only gives an estimation of risks from a facility. In many cases the expertise and the knowledge required to model various failure scenarios do not exist prior to the accident occurring. For instance, although dispersion models are used in the modelling of the release of large masses of dense gases (in the 100s of tonnes), there has never been a large scale experimental release to justify the models used. Only the gross behaviour of the vapour cloud, i.e. density intrusion-gravity spreading and passive dispersion, can be modelled. Obstacles and terrain effects cannot be incorporated in present day models, however they can have substantial effects on the dispersion of the cloud. Therefore, as a safety factor, a standard quantitative risk assessment technique is always to err on the conservative side in assumption making. 5.5.2.4

Australia The Western Australia (WA) Department of Planning has adopted risk criteria for hazardous installations. They are based on risk contours and can be summarised as follows: -6

•

A risk level in residential zones of one in a million per year (1 x 10 /yr) or less, is so small as to be acceptable to the WA EPA (Environmental Protection Agency);

•

A risk level in “sensitive developments”, such as hospitals, schools, child care facilities and aged care housing developments, of between one half and one in a –7 -6 million per year (5 x 10 and 1 x 10 /yr) is so small as to be acceptable to the WA EPA;

•

Risk levels from industrial facilities should not exceed a target of fifty in a million per year (1 in 20,000) at the site boundary for each individual industry, and the cumulative risk level imposed upon an industry should not exceed a target of one hundred in a million per year (1 in 10,000);

•

A risk for any non-industrial activity, located in buffer zones between industrial and residential zones, of ten in a million per year or lower is so small as to be acceptable to the WA EPA;

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 21 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment •

5.5.2.5

A risk level for commercial developments, including offices, retail centres and showrooms located in buffer zones between industrial facilities and residential zones, of five in a million per year or less, is so small as to be acceptable to the WA EPA.

The Netherlands The policy statement approved by the Dutch Parliament states the following criteria for -6 existing facilities. The risk is unacceptable if the 10 /yr risk contours affect residential areas or -5 the F/N curve is above 10 fatalities with a frequency of 10 /yr with a slope of -2. This is illustrated in Figure 5-2: 1E-02

Frequency per year

1E-03 advised limit

1E-04 1E-05 1E-06 1E-07

ALARP

1E-08 1E-09 1

10

100

1000

10000

Number of fatalities

Figure 5-2 : Netherlands Societal Risk Guidelines (risk to public only) Below the criteria, the ALARP, “As Low As Reasonably Practicable”, principle should be used. All Dutch installations should meet the criteria for new facilities by the year 2005. For the Societal Risk it should be emphasised that the exposure or “presence” factor of population used for calculating the F/N curve during the day is 0.7 and 1 during night. Also the assumption is made that being indoors gives protection where the fraction of people being indoors is 0.93 during daytime and 0.99 during night time.

5.5.2.6

Hong Kong Government Criteria The Hong Kong government has published “ Interim Risk Guidelines for Potential Hazardous Installations”. The guideline covers new installations and expansion of existing installations and also controls the development of land around installations. It should be pointed out that although these are described as “guidelines” they are very strictly applied in practice. They are seen as necessary because of the special circumstances of Hong Kong, where there is a dense population in close proximity to industrial facilities, and are mainly used for land-use planning decisions. The guidelines set forth two criteria; -5

•

A risk contour of 10 /yr for fatality as an upper limit of tolerability.

•

The maximum F/N curve exceeds the line through the point of 10 fatalities at a -4 frequency of 10 /yr with a slope of -1. No event at any frequency should take place which causes more than 1000 deaths.

The societal risk zones are illustrated in Figure 5-3:

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 22 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

1E-03

Frequency per year

Intolerable 1E-04 1E-05 ALARP 1E-06 1E-07 Tolerable 1E-08 1E-09 1

10

100

1000

10000

Number of fatalities

Figure 5-3: Hong Kong Societal Risk Guidelines (risk to public only) The Hong Kong regulators scrutinise each risk assessment closely and insist on the use of consistent methodology from case to case.

5.5.3

Tolerability of risk Although there are differences between the legislation adopted in the various countries it is also clear that there is consensus on the tolerability of risk. The majority of the countries -5 would accept risk levels for the public around 10 /yr whilst the more stringent countries would -6 set the tolerability level at 10 /yr.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 23 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 6

RISK ASSESSMENT

6.1

Failure Modes

6.1.1

General The completed HAZID checklist is included in the HAZID Report [Ref. 15]. Many of the hazards were considered, based on the experience and judgement of the assembled team, to present an insignificant risk of pipeline failure. These risks were therefore considered to be tolerable and are not discussed beyond the HAZID Report. It should, however, be noted that some recommendations for future project phases (Construction, Operation) are made and that these should be added to the Overall Project Hazard Register, as applicable. Those hazards which were considered to present a significant risk are further assessed in the following sections. As a result of further assessment the hazards are either assigned a quantitative failure rate (i.e. a frequency of loss of pipeline containment), or are judged to make a negligible contribution to the overall pipeline failure frequency. In this context a negligible contribution would be equivalent to a pipeline loss of containment frequency equal -8 to or less than 1 x 10 per km.yr.

6.1.2

Pressure Considerations Increasing pressure above normal operating of the onshore pipeline section may occur as a result of blockage, or during shut-in when the pipeline may reach the initial well-head shut-in pressure of 345 barg. The only feasible scenario for blockage of the pipeline is due to hydrate formation. Methanol will be injected into the well fluids at the subsea wells in order to suppress hydrate formation. In the event that methanol injection failed or was unavailable for any period of time, hydrates could form in the pipeline. However, the typical hydrate dissociation temperatures are such that hydrate formation would be expected to occur in the offshore pipeline section and therefore the section of pipeline which would be exposed to high pressures from the wells is the offshore section. Shut-in at the terminal due to process upset or terminal ESD will lead to higher pressures in the onshore pipeline unless wellhead valves are closed. However, the entire pipeline is designed to withstand the well-head shut-in pressure (WHSIP) existing at the start of field life and failure of the (defect free) pipeline due to pressure higher than normal pressure is not, therefore, considered to be a credible failure mode. The WHSIP decreases over the field life, thus further reducing the risk of failure due to internal overpressure. Prior to start-up the pipeline will be tested to pressures which exceed the design pressure of 345 barg by over 20%. Thus the risks of defects existing in the pipeline that could cause failure at the WHSIP is considered to be very low.

6.1.3

Pressure Cycling A pressure cycle is defined by the range of the pressure variation, and the frequency of the cycle. The range of a variation is defined as the difference between the peak value and lowest value of the pressure variation and the frequency is defined as the period of time which elapses between the identical point in two subsequent cycles (e.g. two subsequent peaks). The pressure cycling constraints for a pipeline are governed by the material fatigue limits and are dependent on both the range and the frequency of the pressure variations. These factors are related and vary inversely with one another, i.e. a high cycling frequency would have a lower permissible range than a lower cycling frequency. Generally the diurnal range of pressure cycling for the onshore section of the pipeline is small as the pipeline is not feeding end-users directly but is "buffered" from the effects of the

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 24 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment varying end-user demands by the Terminal process and the export pipeline downstream of the terminal. It is assumed that the Terminal will initially operate at a steady state flow of 350 mmscfd and a steady pressure regime. Any variation in flow would be managed by variation of the choke valve settings at the subsea production manifold in the field, with the aim to achieve a set arrival pressure at the Terminal. The range of pressure cycling is therefore considered to be low. Pressure and stress fatigue limits are considered to be negligible, and pressure cycling is not considered to represent a credible cause of pipeline failure. Pipeline fatigue is addressed in the Mechanical Design Report [Ref. 16] 6.1.4

Pipeline / Umbilical Separation The scope of this assessment does not include hazards resulting from releases from the umbilical, except to the extent of assessing whether a fire resulting from the ignition of a methanol leak from the umbilical may result in a release from the gas pipeline. The distance between the pipeline and the umbilical of minimum 1m in the onshore sections is considered to be sufficient to allow access for potential future maintenance of one or the other without undue risk of damage to the neighbouring line, and the risk of failure to one caused by the other is considered to be low. The most hazardous fluid transported in the umbilical is the methanol used for hydrate inhibition. This is transported in separate lines at a maximum operating pressure in the onshore section of 345 bar. The onshore sections of the umbilical are housed in conduits. These provide some additional protection, but are not designed for pressure containment. The separation distance of the umbilical and the pipeline will be a minimum of 1.0 m except at river crossings. 3

The normal flow rate within any of the five methanol lines within the umbilical is only 1m /hr. Therefore a leak at any significant rate would be very likely to be detected. In the event of ignition, the methanol would burn as a pool fire at ground level. In pool fire combustion the vapour burns above the pool (where it can mix with air) and the heat radiated back from the combustion provides the energy to evaporate more liquid to fuel the fire. The temperature of the liquid in the pool remains around the boiling point of the liquid, which for methanol (at o atmospheric pressure) is approximately 65 C. The heating effect on a pipeline buried beneath the pool would not, therefore, be sufficient to present a risk of pipeline failure. It is concluded, therefore, that the presence of the umbilical does not present a credible risk of pipeline failure due to umbilical loss of containment. For the converse, high pressure releases from the gas pipeline will generate significant forces and create large craters in the ground around the release. Such releases could, therefore, cause failure of the umbilical even if the pipeline release does not ignite. In the event of an ignited pipeline release, any exposed umbilical sections would be expected to fail due to the high thermal radiation. The additional hazardous consequences of umbilical failure in the proximity of a large pipeline gas release, are not considered to be significant, i.e. the consequences of the release of small quantities of methanol are small in comparison to the hazards presented by the pipeline release itself. The case of whether the umbilical failure in the event of a gas pipeline failure will increase the probability of a fire due to the presence of electrical cables in the umbilical has been addressed. A gas release will only ignite if the correct conditions are present. In the event of breakage of the cables in the umbilical as a result of a large gas pipeline failure, the area immediately around the release is too rich in gas for ignition to occur. It is considered that the ignition probability chosen for this assessment (see section 5.4.2) is appropriate and conservative for this location and arrangement.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 25 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment The presence of electrical cables in close proximity to the pipeline has been considered in the design of the Cathodic Protection system and found not to cause any effects on the operation of the pipeline and its Cathodic Protection system. All subsea christmas tree and manifold valves are of fail-closed design and will act automatically to shut off the inventory of the gas reservoir in the event of loss of hydraulic power or electrical control signals (both channels) through the umbilical.

6.1.5 6.1.5.1

Third Party Interference Historical Failure Rate The UKOPA pipeline fault database [Ref. 17] indicates a failure rate (leading to product loss) -5 -5 due to external interference for the period 1962–1998 of 5.98x10 per km year (1.00x10 per km.year for the period 1994-1998). The UKOPA data encompasses failures in a wide variety of steel pipelines (over 90% of which were gas pipelines) with a range of wall thickness values. The UKOPA data also shows that most incidences of external interference have occurred in rural areas, with semi-rural & suburban areas the next most frequent.

Table 6-1– Product Loss Incidents resulting from External Interference related to Area Classification Area Classification Rural Suburban & Semi-rural Urban Total

Exposures km.yr 443,447 46,060 516 1 490,023

Incidents 24 7 0 31

Note 1. It is noted that the total exposure in this table is less than other UKOPA tables. The reason for this was not explained in the UKOPA data. It is assumed that h t is is because the data for location of the pipelines was incomplete.

The UKOPA data also shows that the maximum wall thickness for a loss of product incident resulting from external interference was 12.7mm (whereas the Corrib pipeline wall thickness is 27.1 mm). The distribution of failures resulting from external interference for each wall thickness category is shown in Table 6-2. Table 6-2 – Product Loss Incidents resulting from External Interference related to Wall Thickness Class Wall Thickness mm 15 Total

Exposures km.yr 42,222 250,030 192,558 34,006 518,816

Incidents 10 17 4 0 31

The trend shown above is to be expected. However, the absence of a failure in the > 15mm category may be partly due to the low exposure time for this category and it is worth noting that the exposure time of pipelines with wall thickness in excess of 15mm is relatively low by comparison to the 10 - 15mm wall thickness category

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 26 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 6.1.5.2

Failure Rate Estimated from Limit State Model For the area in question, the risk of third party (or external) interference from construction activities, ditch digging, boring, etc. is considered to be low. British Gas Technology [Ref. 18] -3 indicated a frequency of external interference of 1.86 x 10 per km year as applying to typical 36-inch diameter national transmission system pipelines. Note that this is the risk of some form of external interference actually making contact with the pipeline – but not the risk of failure of the pipeline. The onshore section of the Corrib pipeline passes through a fairly remote rural area which has a low possibility for major construction operations and few public utilities close to the pipeline. However, there are peat cutting activities and associated drainage works and there -3 may be some tillage activity. The external interference frequency of 1.86 x 10 per km-year is therefore conservatively assumed for this location. Protection from normal farming activities is provided by the pipeline minimum depth of cover [Ref 2]. However, the pipeline may be exposed to risk where the minimum cover is not achieved (construction defect) or where it has become eroded due to removal of overburden (due to flooding, land erosion, or washout from the trench due to drainage patterns). The risk presented by farming activities is assumed to be included in the above frequency for external interference. The probability of failure (leaks and ruptures) resulting from third party interference is assessed using the limit state models defined in Appendix A. These models were developed to estimate the probability of failure in the event of external interference by excavation equipment. It is assumed that the methodology used is also applicable to farming equipment such as ploughs, and chain type excavators that might be used to create land drains. The risk of product loss (from leaks and ruptures) is given by the product of the external interference frequency and the failure probability, as shown in Table 6-3. A pipeline internal pressure of 345 bar is assumed in the limit state model as, even though this condition would only exist infrequently, if at all, any unreported damage could lead to failure during shut-in conditions caused by damage to the pipeline (dent, gouge etc) not reported or detected and did not cause a leak at the normal operating pressure. Table 6-3 – Risk of Product Loss due to External Interference (assuming WHSIP) Release Type

Frequency of External Interference / km.yr

Leak (25mm)

1.86 x 10

Rupture (Full Bore)

1.86 x 10

Probability of Failure mode / interference event (from model)

-3

2.55 x 10

-3

6.09 x 10

Total

6.1.5.3

Risk of Product Loss / km.yr

-4

4.74 x 10

-7

-5

1.13 x 10

-7

5.88 x 10

-7

Selection of Representative Failure Rate The Corrib pipeline has a high wall thickness (27.1 mm), normally referred to as “thick wall”, and consequently the failure rate would be expected to be considerably lower than that presented in the UKOPA data, as this generally reports failures associated with much thinner walled pipe (the maximum wall thickness for any loss of product incident resulting from external interference was 12.7mm). The impact energy required to puncture thick-walled pipe is considerable, and this is reflected in the results obtained from the limit state model The failure rate due to external interference for the onshore pipeline section will, therefore, be assumed to be as presented in Table 6-3.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 27 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment A (small) additional risk reduction can also be achieved by the installation of brightly coloured plastic warning tapes in the ground above the pipeline. These may warn the excavator operator of the presence of the pipeline, thereby averting damage. The level of risk reduction is small, but as the cost of installation is also low, the installation of warning tapes has been included in the design in accordance with the ALARP principle.

6.1.6

Estuary / River Crossings There is no significant river traffic in the water over the pipeline crossings. The river channel is not dredged. River erosion, which may expose the pipe at river crossings cannot be discounted and the crossings will therefore be inspected regularly following construction and during operation. Concrete coated pipe will be used at the river crossings. Primarily this is for stability purposes, but it will also provide a significant degree of protection from impact. Failure of the onshore section of the pipeline due to impacts from small boats or their anchors at river crossings is not, therefore, considered credible.

6.1.7

Internal Erosion The well fluids are not expected to contain sand. However it is possible that in later field life, the increasing water content of the fluids from some wells may carry small quantities of sand through the pipeline. The flow velocity in the line is lower than the critical velocities required for erosion to occur. Failure due to internal erosion is therefore not considered to be a credible failure mode for the onshore section of the pipeline.

6.1.8

Ground Movement The pipeline is routed through an area of peat bog located on the north and south sides of the river. Environmental events such as extreme flooding or drought may result in changes in the ground level in this area, as may human activities resulting in drainage, a change of land use or increased peat cutting. Where the ground level in the peat bog changes significantly the pipeline could be stressed at the point where it crosses from the soft ground to the rocky areas, or where it crosses roads. In these areas the options for the construction of the onshore section of the pipeline will be investigated - refer to the Mechanical Design Report [Ref 16 ]. The design takes account of the geo-technical information available and addresses options such as the use of stone piers to support the pipeline. If implemented, the separation of the supports will be designed to account for spanning of the pipeline between supports in the event of ground settlement. Alternatively, the peat will be excavated down to base rock or alluvial gravels on which the pipeline will sit without the possibility of further movement.

The UKOPA pipeline fault database [Ref. 17] includes a failure rate for ground movement of -6 9.6 x 10 per km.yr. Approximately 20% of these failures resulted in full bore ruptures. It is considered unlikely though that the full bore ruptures involved large diameter thick walled pipe such as is used for the onshore section of the Corrib pipeline. A further study [ref 5] has been performed to investigate the integrity risk to the pipeline in the event of various widths of land slide or land slip in peat areas due to natural conditions or as a result of the construction works. This has shown that whilst the pipeline does move and bend under such an event, it remains intact and does not leak or rupture due to the inbuilt strength of the thick walled pipe.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 28 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment However, as the onshore section passes through a significant area of peat, it will be conservatively assumed in the risk assessment that this failure rate applies, but 90% will be apportioned to leaks and 10% to ruptures. 6.1.9

External Corrosion The onshore pipeline section will be protected against corrosion by means of a three layer polypropylene (3LPP) coating, except at river crossings where asphalt coating is used under concrete. In case of damage to the corrosion coating, there will also be an impressed current cathodic protection (CP) system [Ref. 19]. A CP resistivity survey of the soils along the onshore pipeline route has been undertaken. The possibility of contaminants (industrial or farming chemicals, sulphate reducing bacteria (SRB’s), etc.) being present that could be harmful to the pipeline coating has also been considered in the CP design. It is considered unlikely that any chemicals are present in this area in concentrations that would affect the coating as it is not characterised by intensive commercial farming activity or previous industrial history. If any SRB’s are present the pipeline CP and coating systems have been designed to take these into account [Ref. 19]. Provided that the CP system maintains the correct protective potentials at all times and at all locations, no external corrosion will take place even in the event of damage to the corrosion coating. It will be possible to check whether protective potentials are being maintained through regular CP surveys. Two possible scenarios for external corrosion can be envisaged. Firstly, the CP system would not be effective if the pipeline were to be above ground, hence corrosion in these areas would be possible. However, the pipeline in the area covered by this assessment will be buried (with only the short section inside the Terminal above ground) and thus this scenario is discounted. The second scenario involves the corrosion of buried pipe under disbonded coatings, as disbondment causes cathodic protection shielding. The high quality coating should not become disbonded, and this is considered to represent a low risk of failure, The pipeline is designed to allow intelligent pigging (online inspection vehicle) to check for various modes of damage and deterioration including external corrosion. Intelligent pigging should identify corrosion occurring as a result of disbonded coatings, ineffective CP, etc. It is recommended that the first intelligent pigging run is performed within 3 years of pipeline startup, and that subsequent inspections are based on the results of this initial run. The detailed requirements for intelligent pigging has been considered in the Corrosion Monitoring Report [Ref. 20]. The data in the UKOPA pipeline fault database [Ref.17] is considered to be the most representative for external corrosion of an onshore pipeline. This indicates an average failure -5 rate (during the period 1962-1998) due to external corrosion of 5.01x10 per km-year. The database also includes further analysis of the historical data that shows that the majority of the failures occurred in older pipelines (see Table 6-4).

Table 6-4 – Product Loss Incidents resulting from External Corrosion related to year of construction [Ref.17] Construction Year Pre-1964 1964 – 1973 1974 – 1983 1984 – 1993 1994 – 1998 Total

Exposures Km.yr 68,546 330,066 94,187 25,530 488 518, 816

Incidents 16 10 0 0 0 26

The higher failure rate in older pipelines may be attributable to the advances in coatings technology, cathodic protection systems and pipe materials quality, etc, which only newer

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 29 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment pipelines will have benefited from. This assumption is supported by Table 6-5, which shows that the failure rate for pipelines provided with modern coatings (e.g. polypropylene, similar in performance to polythene) is lower than for pipelines provided with other coating types (e.g. coal tar). Table 6-5 – Product Loss Incidents resulting from External Corrosion related to Coating Type [Ref.17] External Coating Bitumen Coal Tar Polyethylene FBE Other / not known Total

Exposures Km.yr 20,063 417,077 31,302 27,525 22,861 518,828

Incidents 2 18 1 0 5 26

Table 6-6 shows that the majority of external corrosion failure incidents in the UKOPA data involved relatively thin-walled pipelines. Table 6-6 – Product Loss Incidents resulting from External Corrosion related to Wall Thickness Class [Ref.17] Wall Thickness 15 Total

Exposures Km.yr 42,222 250,030 192,558 34,006 518,816

Incidents 15 11 0 0 26

Based on the above discussion and historical data, it is considered that the frequency of failure of the Corrib onshore pipeline section (a modern thick-walled, polypropylene coated pipe with an impressed current cathodic protection system) due to external corrosion would be negligible.

6.1.10 Internal Corrosion

6.1.10.1 Sulphide Corrosion, Sulphide Stress Cracking and Hydrogen Induced Cracking Hydrogen sulphide (H2S) in the presence of free water may cause general weight loss or localised corrosion of carbon steel. Sulphide stress cracking can occur at low partial pressures of H2S and may result in sudden and unpredictable catastrophic failure of the pipeline. At higher partial pressures of H2S (and high temperature) sulphide corrosion can occur resulting in general weight loss. This is caused by a reaction with the pipeline steel to form sulphide precipitate and scale. The reaction may be exacerbated by the presence of CO2 and O2. Hydrogen induced pressure cracking may result from the presence of H2S and water over extended periods of time, however this presents only a negligible risk for high quality steel pipelines, unless the gas is defined as sour.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 30 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment Any of the above corrosion scenarios could eventually result in leak or rupture. However they all depend on the presence of H2S. The well fluids analysis in Section 3.4 shows that H2S is not expected to be present. The well fluids are water saturated and may contain small quantities of free water however and so the above corrosion mechanisms could occur in the event that the quantity of H2S increased during later field life. Corrosion would be controlled by the corrosion inhibitor injected at the subsea wells, however it is still recommended that periodic analysis of the well fluids is undertaken to verify the continued absence of H2S throughout the field life. Given that this analysis is undertaken, and H2S is not present, loss of containment due to internal corrosion by these mechanisms is not considered to be a credible failure mode. 6.1.10.2 Carbonic Acid Corrosion In the presence of free water, CO2 will dissolve to form carbonic acid. This can result in general corrosion or pitting at defects. The expected corrosion rates for carbon steel in the presence of carbon dioxide and free water have been investigated in the Corrosion Allowance Evaluation [Ref. 21]. The study used the methodology published by DeWaard, Milliams et al [Refs. 22, 23 and 24] and confirmed the corrosion allowance (with corrosion inhibition) as 1.0mm for the onshore pipeline section. Generally, the corrosion rates are much higher in parts of the offshore pipeline where the operating temperature is higher. In the pipeline near the subsea wells the predicted total corrosion can be several times higher than in the onshore pipeline section. Any failure due to internal corrosion is therefore considered more likely to occur offshore (near the subsea wells). The adopted philosophy for protection against internal corrosion is dependent on effective corrosion inhibition by the injection of a cocktail of methanol and corrosion inhibitor (CI) at the subsea wells. It is anticipated [Ref. 21] that the pipeline system would be able to tolerate failure of the Corrosion Inhibition system for periods of up to 4 – 6 weeks without internal corrosion increasing at a greater rate than predicted (i.e. a greater rate than is acceptable with a corrosion allowance of 1.0mm for the 30 yr life). Repair of the system within this time period would be expected. Despite the ability of the system to tolerate prolonged unavailability of the corrosion inhibition system, it is recommended that Corrosion Inhibitor (CI) is continuously injected, and operational safeguards are implemented to guarantee high system availability, in order to prevent excessive internal corrosion. It is also recommended that an appropriate corrosion monitoring system is implemented in order to identify excessive internal corrosion. Continuous injection of CI will provide protection against changes in well fluid composition (e.g. increased water cut) throughout all stages of field life. Corrosion monitoring may include corrosion probes, coupons or other forms of monitoring at a fixed location, or the use of intelligent pigging. It should be noted that the corrosion rate over the length of a pipeline system cannot be inferred from measurements of corrosion rate at fixed points (e.g. at the subsea wells and at the onshore Terminal), as measured by fixed corrosion monitoring methods. It is therefore recommended that an intelligent pigging run is performed within 3 years of pipeline start-up in order to provide correlation between the actual and predicted corrosion rate and inhibitor effectiveness. The requirement and schedule for future on-line inspection of the whole pipeline system is determined based on those findings. Assuming effective corrosion inhibition (including verification by monitoring), and with the provided corrosion allowance, the frequency of pipeline failure due to internal corrosion is considered to be negligible.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 31 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 6.1.10.3 Mercury Corrosion It is predicted that the well fluids contain trace quantities of mercury. Mercury forms an amalgam with most metals. Where an amalgam is formed a corrosion cell can be established resulting in gradual material loss. This process requires the presence of free water as an electrolyte [Ref. 25]. This mechanism appears to have a more pronounced effect with alloy steels than carbon steel. The concentration of mercury required to cause corrosion and the precise effect of the conditions of temperature and pressure on the corrosion rate do not appear to be well documented. The use of a corrosion inhibitor will, however, control this corrosion mechanism and failure of a thick walled pipe with a corrosion allowance is not considered to be credible. 6.1.11 Inherent Defects and Construction Defects Defects from pipe manufacture will be present in the pipe material and the seam weld. Defects will be present in the girth welds made on site. These defects are generally termed inherent defects and are always present. Quality control applied during the manufacture and construction process aims to limit the size of the inherent defects below the critical sizes at which they might cause failure of the pipeline. Usually pipe lengths or seam welds with defects which exceed the critical size criteria would be discovered during inspection and testing at the pipe mill and rejected or repaired. All site welds are inspected during the construction process. However, there remains a small risk that some defects which exceed the critical size criteria could remain, or that the pipeline may sustain damage due to impacts or over-stressing during construction. Such defects should however be revealed during the system hydro-testing. The hydrostatic test is based on 90% of the pipeline material SMYS at the highest point in the system, in accordance with BS 8010 [Ref. 2]. This results in a minimum hydrostatic test pressure of 431.25 bar. This is 86 bar above the design pressure of the pipeline, and approximately 280 bar above the expected normal operating pressure. Any defects which remain hidden, or those that were initially within acceptable criteria, may grow during the pipeline life due to fatigue, until eventually they cause pipeline failure. This is, however, considered to be unlikely for the onshore section of the Corrib pipeline as: •

the hydrostatic test should ensure that there is a substantial margin between initial defect sizes and the sizes that would be critical;

•

the range of pressure cycling to which the onshore pipeline will be subjected is not considered significant (with respect to the design pressure) such as it could cause fatigue growth of defects;

•

defect growth due to fatigue would require time, and the well-head shut-in pressure declines during the field life.

The UKOPA pipeline fault database [Ref.17] indicates the following historical failure rates due to pipe material and welding defects. Table 6-7 - Number and Frequency of Product Loss Incidents for Pipe Material and Welding Defects. Product Loss Cause

Girth weld Defect Pipe Defect Seam Weld Defect Total

No. of Incidents (1962-1998) 33 12 3 48

Frequency per km.yr (1962-1998) -5 6.36x10 -5 2.31x10 -6 5.80x10 -5 9.25x10

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

No. of Incidents (1994-1998) 0 0 1 1

Frequency per km.yr (1994-1998) 0 0 -5 1.00x10 -5 1.00x10

Page 32 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment Generally, the trend for fewer failures in recent years could be attributed to improvements in quality control during pipe manufacture and installation. It is considered that, although very low (due to the reasons discussed above), the potential failure of the onshore section due to inherent / construction defects cannot be discounted. A failure rate of 50% of the UKOPA failure rate from 1962 to 1998 will therefore be assumed for the purposes of this assessment, -5 i.e. 4.625 x 10 per km.year. In the UKOPA data, all such failures were shown to result in small leaks only.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 33 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

6.2

Failure Frequencies As a result of the qualitative discussions in Section 6.1 many of the potential failure modes are considered to be not credible, or to make a negligible contribution to the overall failure frequency for the onshore section of the Corrib pipeline. Those failure modes which are considered credible, and for which failure frequencies have been calculated or taken from reference data, are summarised in Table 6-8. Table 6-8 – Pipeline failure frequencies The failure modes considered are ranked below in reverse order of their risk contribution. Failure Mode

Leak Frequency

Rupture Frequency

(per km.yr)

(per km.yr)

Total Release Frequency (per km.yr)

1.13 x 10

-6

9.6 x 10

9.6 x 10

-5

0

4.62x10

-5

1.07 x 10

Third Party Interference

4.74 x 10

Ground Movement

8.64 x 10

Inherent Defects and Construction Defects

4.62 x 10

Total

5.53 x 10

6.3

Failure Consequences

6.3.1

Release Rates

6.3.1.1

-7

-7

-7

-6

5.88 x 10

-7

-6

-5

5.64 x 10

-5

Leak An equivalent hole size of 25mm has been selected to represent small leaks such as could result from small inherent defects, weld failures or punctures due to mechanical impact. At the maximum initial wellhead shut-in pressure of 345 barg this hole size produces an initial leak rate of 27.1 kg/s. The initial leak rate for the normal operating pressure of120 bar is 10.5 kg/s.

6.3.1.2

Rupture When estimating the release rates from ruptures it must be noted that the total release rate includes the release from both sides of the ruptured pipeline. The initial release rates from full bore ruptures are extremely high, but decrease rapidly. For modelling purposes the average of the first minute is used for the calculation of fires and dispersion. The following Figure 6.1 shows the release rate vs. time. The release rate decreases as time progresses and is dependant on the location of the leak. For the modelling the worst case has been assumed which is a location near the beach valve as at this location gas flows from both the onshore section and the offshore section resulting in the largest sustained release rates from both sides of the ruptured pipeline.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 34 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment Table 6.9 – Mass release vs time for rupture events Time interval

Average release rate kg/s

seconds

120 bar

345 bar

0-60 60-120 120-180 180-240 240-300 300-600 600-1200 1200-1800

1443 739 440 311 255 213 188 163

4239 2251 1348 936 746 600 530 473

7000

6000 120 bar 345 bar

Release rate kg/s

5000

4000

3000

2000

1000

0 0

1000

2000

3000

4000

Time seconds

Figure 6-1: Mass Released as a function of time 6.3.2

Fire Modelling 2

Radiation levels to 4, 6,12 and 20 kW/m for the following fire events are presented here. •

Horizontal jet fires resulting from leaks and ruptures at 120 barg and 345 barg (figures 6.2 & 6.3);

•

Low momentum fires resulting from buried leaks at 120 barg and 345 barg (figure 6.4);

•

Vertical jet fires resulting from leaks at 120 barg and 345 barg (figure 6.5);

All views show the plan view (from above) with the heat radiation contours at ground level (shown in metres).

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 35 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

H 25mm 120 bar

H 25mm 345 bar

50 4 kW/m²

80

4 kW/m²

6 kW/m²

6 kW/m²

12 kW/m²

40

12 kW/m²

20 kW/m²

20 kW/m²

60 30

40 20

20 10

0

0 -40

-20

0

20

40

-60

-40

-20

-10

0

20

40

60

-20

Figure 6-2: 25 mm Leak Horizontal Jet Fire Radiation Levels

Full bore 120 bar Full bore 345 bar

400

700

4 kW/m²

4 kW/m²

6 kW/m² 600

12 kW/m² 300

6 kW/m² 12 kW/m²

20 kW/m²

20 kW/m²

500

400

200 300

200

100

100

0

0 -300

-200

-100

0

100

200

300

-600

-400

-200

0

200

400

600

-100

-100

-200

Figure 6-3: Full bore Horizontal Jet Fire Radiation Levels

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 36 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

B 25mm 120 bar

B 25mm 345 bar

100

80

4 kW/m²

180

6 kW/m²

160

6 kW/m²

140

12 kW/m²

4 kW/m²

12 kW/m² 20 kW/m²

20 kW/m²

120

60

100 80

40

60

20

40 20

0 -100

-50

0

50

100

0 -150

-100

-50

-20

0

50

100

150

-20 -40 -60

-40

-80

-60

-100

Figure 6-4: 25 mm Leak Radiation Levels for Buried Releases

V 25mm 120 bar

V 25mm 345 bar

30

50 4 kW/m²

4 kW/m²

40

6 kW/m²

6 kW/m²

20

30

20

10

10 0 -30

-20

-10

0

10

20

30

0 -40

-10

-20

0

20

40

-10 -20

-20

-30

-30

-40

Figure 6-5: 25 mm Leak Radiation Levels for Vertical Releases 6.3.3

Dispersion modelling Dispersion distances to the Lower Flammable Limit for the following releases are given; •

Horizontal plumes resulting from leaks and ruptures at 120 barg and 345 barg (Figure 6.6)

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 37 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment •

Horizontal plumes for low momentum buried leaks at 120 barg. (Figure 6.7)

Dispersion distances for the two assumed sets of meteorological conditions (D5 & F2) are given. These distances are the maximum distances and for ruptures this distance will reduce quickly as the release rate falls after 60 seconds.

60

800

700 50

600

Downwind distance m

Downwind distance m

40

30

20

500

400

300

H Full bore 120 bar F2

10

H Full bore 120 bar D5

H 25 mm 120 bar F2

100 H Full bore 345 bar D 5

H 25 mm 120 bar D5

H Full bore 345 bar F2

H 25 mm 345 bar D5 0 -8

200

-6H 25 mm -4 345 bar -2 F2

0

2

4

6

0

8

-60

Lateral distance m

-40

-20

0

20

40

60

Lateral distance m

Figure 6-6: Dimensions of Dispersing Clouds with Momentum (25mm leaks and full bore ruptures)

70

60

Downwind distance m

50

40

30

20

B 25 mm 120 bar F2 B 25 mm 120 bar D5 B 25 mm 345 bar F2 B 25 mm 345 bar D5 -6

-4

-2

10

0 0

2

4

6

Lateral distance m

Figure 6-7: Dimension of dispersing clouds without momentum for buried releases (25 mm leaks)

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 38 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

6.3.4

Event trees Two event trees, one for a leak scenario and one for a rupture scenario have been developed based on the probability scenarios developed in sections 5 and 6 and are shown below. The summation of the ignition frequencies matches those in section 5.4.2.

Gas Pipeline Leak Event Tree Release Frequency km/yr

Release Orientation

Early Ignition

Late Ignition

Outcome

0.002 Yes 0.25 Vertical 0.998

0 Yes

No

Leak

ID

Vertical Jet Fire

2.77E-08

LVJF

D5

Flash Fire followed by jet fire D5

0.00E+00

LVFFJF

0.85 F2

Flash Fire followed by jet fire F2

0.00E+00

LVFFJF

No Ignition

1.38E-05

LNI

Horizontal Jet Fire

3.18E-07

LHJF

D5

Flash Fire followed by jet fire D5

2.64E-07

LHFFJFD5

0.85 F2

Flash Fire followed by jet fire F2

4.66E-08

LHFFJFF2

No Ignition

1.32E-05

LNI

Low Momentum Fire (Crater)

6.36E-07

LBLMF

Flash Fire followed by jet fire D5

5.28E-07

LBFFLMFD5

Flash Fire followed by jet fire F2

9.32E-08

LBFFLMFF2

No Ignition

2.64E-05

LNI

0.15 1 No

0.023 Yes

5.53E-05

Frequency

0.25 Horizontal 0.977

0.023 Yes

No

0.15 0.977 No

0.023 Yes 0.5 Buried 0.977 No

0.023 Yes 0.977 No

D5 0.85 F2 0.15

Checksum 0.023 Proportion of Ignited Events

Early

Late

Total Ignited Events

1.78%

1.43%

3.21%

5.53E-05

EGIG

3.20%

.

Figure 6.8 – Gas pipeline Leak event tree Table 6.10 – Outcome frequencies of leak events The various outcomes and their frequencies are tabled below ID LVJF LVFFJF LHJF LHFFJFD5 LHFFJFF2 LBLMF LBFFLMFD5 LBFFLMFF2 LNI

Scenario Leak Vertical Jet Fire Leak Vertical Flash Fire followed by Jet Fire Leak Horizontal Jet Fire Leak Horizontal Flash Fire followed by Jet Fire D5 Leak Horizontal Flash Fire followed by Jet Fire F2 Leak buried Low Momentum Fire Leak Buried Flash Fire followed by Low Momentum Flame D5 Leak Buried Flash Fire followed by Low Momentum Flame F2 Leak No Ignition

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Freq km/year 2.77E-08 0.00E+00 3.18E-07 2.64E-07 4.66E-08 6.36E-07 5.28E-07 9.32E-08 5.34E-05

Page 39 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

Gas PipelineRupture Event Tree Release Frequency km/yr

Failure Mode

Late Early Meteo External Ignition conditions Ignition 0.900 Yes

0.105 External Impact 0.100 No 1.07E-06 Rupture

0.10 Yes

D5 0.85 F2 0.15

0.90 No 0.100 Yes 0.895 Other 0.900 No

0.10 Yes 0.90 No

D5 0.85 F2 0.15

Outcome

Frequency

ID

Jet fire

1.01E-07

FBJF

Flash Fire. burning back to jet fire

9.58E-10

FBFFJTD5

Flash Fire. burning back to jet fire

1.69E-10

FBFFJTF2

No ignition

1.01E-08

FBNI

Jet fire

9.60E-08

FB-JF

Flash Fire. burning back to jet fire

7.35E-08

FBFFJTD5

Flash Fire. burning back to jet fire

1.30E-08

FBFFJTF2

No ignition

7.78E-07

FBNI

Check sum:

1.07E-06

Total Ignited Events 18.40%

0.1

6.94%

25.34%

EGIG

25%

Table 6.11 – Outcome frequencies of rupture events ID FBJF FBFFJTD5 FBFFJTF2 FBNI

Scenario Full bore Jet fire Full bore Flash Fire followed by Jet Fire D5 Full bore Flash Fire followed by Jet Fire F2 Full bore No Ignition

6.4

Estimated Risk

6.4.1

Risk Transects

Freq km/year 1.97E-07 7.44E-08 1.31E-08 7.88E-07

The risk will be highest at a point located immediately above the pipeline. The Risk Transects show the effect on IR of increasing distance from the pipeline for the 120 bar operating pressure. The risk for a given location decreases with increasing distance from the pipeline. This is due to the decreasing “effective length” of the pipeline which (if a leak or rupture -7 occurred in that length) could affect that location. The highest value is 2.6*10 /yr. This value would be tolerable in any of the countries that use risk in their legislation and would not require additional risk reduction measures. The IR is calculated by summing together all the different scenarios and the effect of those scenarios, all of which have different distances for a hazardous effect. This generates the data for the IR transect. The IR transect for a pipeline is derived by calculating the individual risk as a function of distance from the pipeline centre-line. The IR is a maximum directly above the pipeline, and decreases to zero as the distance from the pipeline increases. The risk at any given location is a function of: • •

The distance from the pipeline (measured at a right angle); The risk of a release from the pipeline (usually measured as the frequency of a release per year per kilometre of pipeline);

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 40 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment •

The distance from the release at which an observer at a given location would be affected by the release (sometimes called the “range of hazardous effect”).

In the simplest case (where the effect of a pipeline release is experienced equally at all points around the release, e.g. ignoring directionality and predominant wind effects) an observer standing on the pipeline can be affected by a release from the pipeline if it occurs anywhere within the “range of hazardous effect” distance in either direction along the pipeline. Thus the length of the pipeline that could affect the observer if a release occurs is twice the “range of hazardous effect” distance. This is called the “effective length”, and will decrease as the observer moves away from the pipeline. “Effective length” is used in the risk calculation to estimate the frequency of releases that could affect a given point, since pipeline release frequency is expressed as “releases per km per year” and so must be multiplied by the “effective length” to obtain a frequency as “releases per year”. When pipeline internal pressure is higher the “range of hazardous effect” is greater and (since this increases effective length) then, in the unlikely event of a release, risk levels near the pipeline increase for a higher pressure since a given location could be affected by a greater length of pipeline. The actual likelihood of a release does not increase at higher pressure, because the pipeline is designed to contain the higher pressures. Figure 6.10 shows the risk transect for the pipeline at the operating pressure.

Frequency per year

1.E-06

1.E-07

1.E-08

1.E-09 0

50

100 150 Lateral distance (m)

200

250

Figure 6-10: Risk transect for 120 bar operating pressure

This risk increases if the pipeline pressure is assumed to be the design pressure of 345 barg -7 as shown in Figure 6-. The maximum risk, immediately above the line, increase to 5.7*10 /yr in this case but is still well below the tolerable risk level as used by any of the countries that use risk from Major Hazards in their guidelines/legislation.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 41 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment The expectation is that the design pressure will not be reached during the life time of the development. The high reliability of the terminal, the well shut -in procedures and depleting wellhead pressure over time all combine to ensure that the occasions on which the pipeline pressure will increase above the normal operating pressure (120 barg) will be rare.

Frequency per year

1.E-06

1.E-07

1.E-08

1.E-09 0

100

200

300

400

Lateral distance (m) Figure 6-11: Risk Transects for the design pressure of 345 bar.

6.4.2

Individual Risk at the Nearest Building The building closest to the pipeline is located approximately 70m away [Ref. 10], measured from the corner of the building to the nearest point on the pipeline. In estimating the individual risk at this location, it was assumed that a person would be at the building location for 100% of the time (i.e. no reduction for time spent at another location,). The Individual risk (IR) does not make any allowance for the person being inside the building, or using it for shelter from any event, as would normally be the case, therefore the risk factor at the nearest building is conservative. -7

The IR at this location and this distance from the pipeline (70m) is 1 x 10 /yr (1 in 10 million -7 per year) for a 120 barg operating pressure and 4 x10 /yr ( 1 in 2.5 million per year) for the -6 worst case 345 barg. Both are well below a risk of 1 x 10 /yr, the more stringent risk acceptance criteria used worldwide for risk from major hazards. The dispersion analysis for leaks (Figures 6.6 & 6.7) show that for a leak in any direction, at any pressure and under any wind conditions does not create a flammable cloud around any building located near the pipeline even if this building is directly down wind of any leak. This confirms the assumption noted in section 4.3.2 that explosion events are not a credible scenario and therefore does not affect the IR at the nearest building.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 42 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 7

DISCUSSION, CONCLUSIONS AND RECOMMENDATIONS

7.1

Conclusions The assessment of risks to the public resulting from the operation of the onshore section of the Corrib pipeline indicates that the risks would be tolerable in all countries worldwide that use risk in their legislation/guidance. The principal hazards to be addressed in the design were identified [Ref 15] and these have subsequently been addressed in the relevant design reports. Collectively the design reports produced during the Detail Design phase provide a demonstration that the risk of realisation of the pipeline hazards has been reduced to as low as reasonably practicable. The following sections discuss potential risk reducing methods in relation to the main hazards identified.

7.2

Risk Reduction Measures

7.2.1

Fittings The design of the Beach Valve has incorporated the earlier recommendations regarding elimination of flanges and reduction of small bore connections, and will be fully welded and contain minimal connections or leak paths

7.2.2

External Interference The most significant risk reduction measure which reduces the effect of external interference is the high wall thickness which provides mechanical strength to resist excavator bucket teeth and other such implements. This is accepted in all recognised stress based design codes which decreases design factor and increase wall thickness in areas deemed to be of higher risk potential or higher consequential damage. The design of the Corrib pipeline, with its design pressure, has led to a very thick pipeline when compared to other gas pipelines of a similar size installed in Ireland, the UK and continental Europe (normally 8 to 12 mm thick versus 27.1mm for Corrib). The wall thickness of the Corrib pipeline is such that there is no additional risk reduction in areas where design factors would normally have been lower, e.g. road crossings. This is recognised in many design codes where, once the wall thickness reaches 19 mm, there is no requirement to alter the design factor at crossings or other sensitive locations. The Corrib pipeline therefore will not gain from any increased wall thickness and may actually suffer due to increased weight and consequential subsidence effects and difficulty in construction. The reduction in internal diameter to 384mm from 453mm, resulting from an increase in wall thickness when the design factor is increased from 0.72 to 0.3, may interfere with the running of intelligent inspection pigs, which is not a desirable outcome.

Increasing the depth of cover provided for a pipeline can reduce the likelihood of external interference damage by reducing the proportion of excavation activities reaching a depth which could interfere with the pipeline [Ref. 26]. A report by British Gas has analysed the effect of increasing the depth of cover by studying damage data for the UK Gas Transmission System. The method used relates the frequency of damage at any depth of cover to the pipeline length and exposure at that depth, so that comparisons can be made for various depths. The report concludes that the risk of damage is reduced by a factor of 10 by increasing the depth of cover from 1.1m to 2.2m. British Gas also conducted a series of experiments involving a range of excavating machines and various forms of protection [Ref. 26] which concluded that some credit could be taken in

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 43 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment risk assessment work for protective measures such as plastic warning tapes, concrete barriers and a combination of the two. However, as external interference is not a major risk contributor for the Corrib pipeline the beneficial effect of increased depth of cover or additional protective measures is not considered significant. For road and ditch crossings, where the risk of excavator activity and other similar activity can be considered to be higher than for other sections of the pipeline route, the use of 150mm thick re-inforced concrete slabs, which extend a minimum of 1000mm beyond the road, track or ditch edge complete with warning tape and marker posts, have been specified on the basis of the ALARP principle. However, no credit for this has been taken in the risk assessment in line with the overall conservative approach used. It is recommended that the use of plastic warning tapes (in the ground above the pipeline) and pipeline markers (at field boundaries) should be adopted along the entire route due to the very low cost of their installation. These measures may provide a small reduction in the risk of external interference (e.g. during peat cutting activities), and therefore be consistent with the ALARP principle. Both of these recommendations have been accepted and implemented in the design. 7.2.3

Ground Movement For the purposes of this assessment a significant proportion of the total pipeline failure rate has been attributed to ground movement, due to the terrain crossed by the onshore section of the pipeline. The detailed design has assessed ground movement issues and pipe settlement, and addresses means by which the risk of pipeline failure due to ground movement can be reduced in the Onshore Sealine Mechanical Design Report [Ref 18]. The bearing capacity of the soil (peat) along the areas of peat bog along pipeline route has been examined. Construction plans will involve the use of pillars or islands of stone (supported on the bed-rock below the peat) at set distances to provide support to the pipeline, or alternatively the peat will be excavated to a suitable rock or sand / gravel layer. Road crossings and points where other loads can be placed on the pipeline have been addressed in the design. Field tests have demonstrated that the undisturbed peat strata has the load capacity to resist sinking of the pipeline, even when full of hydrotest water, with settlement limited to the initial two to three days. These tests included the use of 20" pipe, weighted to be identical to the Corrib pipeline, when full of water. For most of its life, the weight will be less than that, thus reducing the propensity for settlement. The Corrib pipeline, unlike many other gas pipelines, will always be negatively buoyant, due to its weight, even in saturated peat soils. JPK has studied the effects of a peat slide or land slip across various lengths of the pipeline [ref 5] from 200 m to 25 m and the results of this analysis show that the pipe may move downhill with the slide, especially for the larger slides, but that it does not exceed the yield stress, nor does it buckle, hence the pipeline would not fail in service. This is primarily due to the thick wall of the pipeline. The failure rate used in this assessment may, therefore, be over-conservative. However, as the overall risk estimates indicate a tolerable level of risk, this will not be revised.

7.2.4

Demonstration of ALARP The Corrib pipeline has been designed in accordance with the ALARP principle in relation to the risks to the public. The pipeline has the following safety features: •

Design pressure of 345 barg versus normal operating pressure of 120 barg

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 44 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment •

Pipeline design pressure is equal to well shut-in pressure at start of production and therefore cannot be exceeded under any circumstances.

•

Shut in pressure declines rapidly after initial 3 year operation

•

Pipeline routing has ensured separation distance to occupied houses is the maximum practicable

•

Pipeline is all welded and all construction welds will be examined by NDT methods

•

Pipeline has been designed to a conventional, well proven design code

•

Nominal wall thickness of 27.1mm

•

Depth of cover, minimum of 1.2 m

•

Pipe joints have been subject to automatic seam weld inspection and manufactured to modern techniques to minimise the possibility of material defects.

Risk reduction measures which have been incorporated into the design include: •

Use of warning tape and marker posts throughout the pipeline route

•

Use of concrete slabs at ditch and road crossings with warning tape & marker posts

•

Use of all welded connections at Beach Valve and removal of small bore valves and fittings

•

Separation of gas pipeline from umbilical to avoid potential effects from maintenance activities or damage from one to another

Other measures considered Use of lower design factor and hence thicker pipeline has been considered, especially in areas such as road crossings or where proximity to occupied buildings is less than elsewhere. However, examination of the historical data and logic behind the increase in wall thickness shows that it is designed to resist third party damage. For the Corrib pipeline, external interference resulting in a leak or rupture of the pipeline represents a small proportion of the estimated overall release frequency. The use of lower design factors and hence thicker wall pipeline cannot be justified in this instance due to the increased cost of materials, construction and additional risk from handling very heavy pipe. A similar argument is applicable in terms of additional impact resistance such as concrete covers, sleeves and other mechanical protection to the pipeline. For these items there would be a quantifiable reduction in risk, but it is extremely low and therefore the additional cost is not reasonable compared to the reduction in risk. Other measures to reduce the risk from third party activity, or to locate any leakage from the pipeline include enhanced inspection of the pipeline route from the air or countryside and regular maintenance activities. These activities will be carried out, but as there is no reliable data on which to quantify any reduction in risk generated from increased levels of surveillance or inspection, no credit is taken for this in the QRA. 7.3

Design at road crossings BS 8010, [ref 2], section 2.6.1.4 calls for a design factor of 0.3 for category D substances (Methane), unless this can be justified to a statutory authority that it may be raised to a maximum of 0.72 by a risk analysis.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 45 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment Section 7.2 above highlights the possible effects of decreasing the design factor and increasing the wall thickness of the pipe. The HAZID and QRA have considered all feasible means of damage to the pipeline and examination of the particular roads that are crossed by the Corrib pipeline have not identified other reasonable actions. Both roads are minor roads used mainly by the local population, with very few, if any, large commercial vehicles using them. They are (in the area of the crossings) both reasonably flat, straight, and reasonably well maintained similar to many others in the area. There is no identifiable risk that vehicles could leave the road at that particular point with sufficient energy to cause damage to the pipeline. The road crossing design includes for a concrete slab which extends at least 1000 mm further than the road and in practice will be further as the roads incorporate ditches which also have slab protection. Use of a 0.3 design factor increases the wall thickness and for many other pipelines there is a significant decrease in risk due to this factor at the road crossing area. For the Corrib pipeline, with a wall thickness of 27.1 mm based on a design factor of 0.72, this decrease in risk does not occur as there is no historical or theoretical evidence to show that wall thickness increases above 19.1 mm provide any further resistance to mechanical impact. Given that a design factor of 0.3 would result in a wall thickness of some 62mm, the additional weight of pipe, difficulty in welding such a thick pipe in the field, and potential problems of excessive settlement lead to the conclusion that this additional wall thickness is not justified as a risk reduction measure and would, if anything, act to increase the overall risk. The recommendation of this report is that a design factor of 0.72, complete with additional impact protection from re-inforced concrete slabs, is justified for road crossings for the Corrib pipeline. 7.4

Recommendations The following recommendations are made as a result of the risk assessment process. Crossreference is made to the section in which each recommendation is first made. These have been added to the overall project hazard register to ensure that they are addressed and implemented as required. •

Pipeline hazards should be included in the assessment of Terminal workers risks to be performed in the Terminal QRA;

•

Plastic warning tapes should be installed in the ground above the pipeline, and pipeline markers should be installed at field boundaries, to deter external interference (Section 6.1.5.3);

•

Periodic analysis of the well fluids should be undertaken to verify the continued absence of H2S throughout the field life (Section 6.1.10.1);

•

Corrosion Inhibitor should be continuously injected, and operational safeguards should be implemented to guarantee high system availability, in order to prevent excessive internal corrosion (Section 6.1.10.2);

•

An appropriate corrosion monitoring system should be implemented in order to identify excessive internal corrosion (Section 6.1.10.2);

•

An intelligent pigging run should be performed within 3 years of pipeline start-up, and the requirement for future on-line inspection of the whole pipeline system should be determined based on the results (Section 6.1.9 & 6.1.10.2);

•

Consideration should be given to the means employed for leak detection and the ability to detect small leaks (Section 6.3.1.1);

•

A design factor of 0.72, complete with concrete protection slabs, should be used for the roads crossings (Section 7.3).

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 46 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 7.5

Implied Assumptions The following is a list of “implied” assumptions that have been used in the qualitative assessment of risks. In the event that any of these assumptions are not realised in the actual design or operation of the pipeline, the potential effects on the validity of this assessment would have to be reviewed. •

It is assumed that the Terminal will operate initially on a steady state flow of 350 mmscfd and a steady pressure regime. Changes to the basis of design during operation will be subject to a change control procedure which will review the effect of those changes including the QRA.

•

The distance between the pipeline and the umbilical should be sufficient to allow access for potential future maintenance of one or the other without undue risk of damage to the neighbouring line. The proximity of the pipeline and umbilical at a minimum of 1m (other than river crossings) has been chosen such that the perceived risk to one from the other is acceptable.

•

It will be possible to check whether protective CP potentials are being maintained through regular CP surveys.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 47 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 8

REFERENCES (MAIN TEXT) 1

Corrib Project Risk Assessment Procedure, EEI Doc. No. COR-15-P R-014-0

2

BS8010 Part II, Design, Construction and Installation of Pipelines On-Land, Section 2.8 Pipelines in Steel for Oil and Gas (1992). (Now replaced by PD 8010 Pt 1)

3

Design Code Comparison, JPK Document No. 05-2102-02-P-3-801.

4

Population Density Analysis, JPK Document No. 05-2102-02-P-3-860.

5

Landslip Analysis, JPK Document No. 05-2377-01-P-3-002

6

Onshore Design Basis, JPK Document No. 05-2102-02-P-3-800.

7

Cohen JD and Butler BW. Modeling Potential Structure Ignitions from Flame Radiation Exposure with Implications for Wildland /Urban Interface Fire Management. 13th Fire and Forest Meteorology Conference, Lorne Australia, 1996.

8

Bilo M and Kinsman P. Thermal radiation criteria used in pipeline risk assessment. Pipes and Pipelines International November-December 1997

9

Population Density Analysis, JPK Document No. 05-2102-02-P-3-860.

10

Corrib Export Pipeline. Alignment Sheet 2 of 6. JPK Document No. 05-2102-02-P -0-805.

11

E&P Forum Risk Assessment Data Directory, October 1996.

12 Offshore Hydrocarbon Releases Statistics, 1999, Offshore Technology Report – OTO 1999 079. 13

PARLOC 96: The Update of Loss of Containment Data for Offshore Pipelines, AME 1998.

14

UK Health and Safety Executive: R2P2 Reducing Risks, Protecting People, 2001

15

HAZID for Onshore Section. JPK Document no 05-2102-02-F-3-836

16

Onshore Sealine Mechanical Design Report JPK Document No. 052102-02-M-3-815

17 The UKOPA Pipeline Fault Database, Pipe and Pipelines International Volume 46, No.2, MarchApril 2001 18

Example of the Application of Limit State, Reliability and Risk Based Design to the Uprating of an Onshore Pipeline, A M Edwards, R J Espiner and A Francis, BG Technology, Report No. R3125, Issue No.1, 6 August 1999, Commercial in confidence to Joint Industry Project Sponsors

19

Cathodic Protection Design Report. JPK Document No, 05-2102-02-K -3-820

20

Corrosion Monitoring Report, JPK Document No. 05-2102-01-P-3-501.

21

Corrosion Allowance Evaluation, JPK Doc. No. 05-2102-01-P -3-135.

22

De Waard, Lotz and Milliams, “Predictive Model for CO2 Corrosion Engineering in Wet, Natural Gas Pipelines”, Paper 577, NACE Annual Conference, 1991.

23

De Waard and Lotz, “Prediction of CO2 Corrosion of Carbon Steel”, Paper 69, NACE Annual Conference, 1993.

24

DeWaard, Lotz and Degstad, “Influence of Liquid Flow Velocity on CO2 Corrosion: A SemiEmpirical Model”, Paper 128, NACE Annual Conference, 1995.

25

Mercury Corrosion in Liquefied Natural Gas Plants, James E Leeper, Energy Processing / Canada – January/February 1981.

26

I Corder, The Application of Risk Techniques to the Design and Operation of Pipelines, British Gas, 1995

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 48 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

APPENDIX A PROBABILISTIC MODELS FOR RELEASE FREQUENCY DUE TO EXTERNAL INTERFERENCE

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 49 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment A1

Limit State Models For External Interference

A 1.1

General External interference to buried onshore pipelines is most usually caused by mechanical excavators. In general, the following types of damage may result: •

puncture due to penetration of the pipe by an excavator bucket tooth;

•

a gouge and/or dent in the pipe wall;

Limit state models are described below for the analysis of both the above damage scenarios. A1.2

Puncture Model The probability of puncture by an excavator bucket tooth is assessed as follows. The force applied to the pipeline is assumed to be related to the mass of the excavator by an empirical equation developed by Spiekhout [Ref. 27]: F = 5.625 M

(1)

where M is the total mass of the excavator in tonnes and F is the force applied to the pipeline in kN. The force that the pipeline can resist is calculated using the following limit state function given by Driver and Zimmerman [Ref. 28]

R  r = 1.17 − 0.0058 ⋅  ⋅ ( Lt + wt ) ⋅ w ⋅ σ u w 

(2)

where r = puncture resistance of pipe; R = pipeline radius; w = pipeline wall thickness; Lt = length of excavator tooth; wt = width of excavator tooth; σu = ultimate tensile strength of pipe steel. Equation (2) has been calibrated against tests in a recent joint industry project [Ref. 29]. It was shown that modelling uncertainty can be taken into account by modifying equation (2) as follows:

R  r = 1.17 − 0.0058 ⋅  ⋅ ( Lt + wt ) ⋅ w ⋅ σ u + C w 

(3)

where C is an additive error term to be described by an appropriate probability distribution. The limit state function for puncture is then F-r = 0

(4)

To apply the puncture limit state equation, the following variables require to be described by probability distributions: •

Excavator mass

•

Modelling uncertainty C

•

Ultimate tensile strength

•

Bucket tooth length and width

•

Pipe radius and wall thickness

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 50 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

A1.3

Gouge / Dent Model Reference 30 indicates that 18% of damage events in Transco transmission pipelines involved dents containing gouges while 82% were plain gouges. Gouges situated in dents, or plain gouges, are assessed using a fracture mechanics approach assuming that the gouge behaves as a crack. Using the level 2 assessment methodology of PD6493 [Ref. 31], a failure assessment diagram (FAD) can be developed in terms of the fracture parameters Kr and Sr. Kr is a measure of how close the pipe is to failure by brittle fracture and Sr is a measure of how close the pipe is to failure by plastic collapse. These parameters are defined as follows:

Kr =

Sr =

{σ mYm (a ) + σ bYb (a )}

πa

(5)

K1c

σn σf

 a   σ m 1 − M a w   =  a 1.15σ y 1 −   w

where a

(6)

=

gouge depth;

=

membrane stress

=

D  σ h  1 − 1 .8 ; 2R  

=

bending stress

=

10.2σ h

R

=

pipe radius;

D

=

dent depth;

σh

=

hoop stress;

σm

=

membrane stress;

Ma

=

Folias factor

=

  2 2 1 + 0.26 L      Rw   

L

=

defect axial length;

w

=

pipe wall thickness;

Ym

=

normalised stress intensity factor (pure membrane stress)

σm

σb

(7)

R D ; w 2R

(8)

1

;

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

(9)

Page 51 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 2

3

4

=

a a a a 1.12 − 0.23  + 10.6  − 21.7  + 30.4  ; w w  w  w

=

normalised stress intensity factor (pure bending stress)

=

a  a a a 1.12 − 1.39  + 7.32  − 13.1  + 14.0  ; w  w w  w

=

pipe material fracture toughness

=

1000 E   A (Cv − 17.6 )  

A

=

cross-sectional area of Charpy specimen;

E

=

Young’s modulus of pipe steel;

Cv

=

Charpy energy.

Yb

2

K1c

The limiting value for Kr is

3

4

(11)

0 .5

;

(12)

K rcrit and failure occurs when the following condition is reached

K r ≥ K rcrit

(13)

A failure assessment diagram (FAD) can be constructed by plotting Figure 5.1).

K rcrit

(10)

 8  π  = S r  2 ln sec S r    2  π

−

K rcrit against Sr (see

1 2

K rcrit = 0

for Sr < 1

(14)

for Sr ≥ 1

(15)

The failure of a gouge within a dent (i.e. K r ≥ K r ) leads to the creation of a through wall defect. The resulting through wall defect will result in a failure by either a leak or a rupture, depending on the length of the gouge. If the length of the through wall defect is greater than a critical length Lc given by equation (16) [Ref. 32] then a rupture will occur. If the length is less than this critical length, the through-wall defect will be stable and the failure will lead to a leak. crit

Lc =

 σ h    1.15σ y 

   

−2

 Rw   − 1   0.4  

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

(16)

Page 52 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment 1.2

1

FAIL

Krcrit

0.8

0.6

SAFE

0.4

0.2

0 0

0.2

0.4

0.6

0.8

1

1.2

Sr

Figure A1 - PD6493 Level 2 Failure Assessment Diagram (FAD)

Dent depth cannot be based on historical damage statistics because it is a function of pipeline geometry, steel properties and operating pressure. The dent depth is therefore derived from the estimated impact force using the equation given by Corder and Chatain [Ref. 33] as follows:

   D =   0.49   where D F w pop R σy

   F  1   1.4 pop R  w +  (80σ y w)4    1.15σ y    = = = = = =

2. 38

(17)

dent depth impact force wall thickness internal pressure mean radius yield stress

The impact force is estimated using the correlation with excavator mass that was described in the sub-section relating to punctures.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 53 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment For the dent/gouge limit state function, the following variables need to be described by means of probability distributions : •

Wall thickness

•

Yield stress

•

Charpy energy

•

Gouge depth

•

Gouge length

•

Excavator mass

•

Internal pressure

In addition allowance has to be made for modelling uncertainty. This is done by multiplying

K rcrit by a factor representing the modelling uncertainty, and this factor is itself described by a probability distribution developed from test data. A1.4

Solution of the Limit State Models For the limit states considered in this report, the reliability calculations have been performed using the Monte Carlo simulation technique. The method involves sampling at random from the probability distributions representing the parameters in the limit state function in a large number of numerical experiments. Each sample is used to check the limit state function. If the limit state function is violated, the pipeline has ‘failed’. The numerical experiment is repeated many times, each with a randomly chosen set of variables. If N iterations are undertaken and n is the number of failures, the failure probability per damage event is given by:

Pf =

n N

(18)

The accuracy of the Monte Carlo simulation depends on the number of iterations in the simulation. The method is rigorous and any desired accuracy can be obtained by performing enough iterations. Note that Pf is the failure probability per damage event. This must then be multiplied by the probability of the damage event occurring to obtain the overall failure probability (e.g. per kmyear). For the external interference limit state, the probability of a puncture, or of a dent/gouge that results in a leak or a rupture, is evaluated as follows:

Pp =

np P N i

(19)

Pl =

nl Pi N

(20)

Pr =

nr Pi N

(21)

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 54 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

A1.5

where Pp

=

probability of a puncture (per km-year);

Pl

=

probability of a gouge/dent resulting in a leak (per km-year);

Pr

=

probability of a gouge/dent resulting in a rupture (per km-year);

np

=

number of iterations resulting in F>r;

nl

=

number of iterations resulting in

K r ≥ K rcrit and L < Lc ;

nr

=

number of iterations resulting in

K r ≥ K rcrit and L ≥ Lc ;

N

=

total number of iterations;

Pi

=

probability of an external interference incident (per km-year).

Distributions used in the Reliability Calculations Table A1 summarises the probabilistic description of the parameters in the reliability calculations. The steel properties are typical for modern pipeline steels and have been based on mill certificates from previous projects. The gouge lengths and depths are those that have been reported by British Gas Technology as experienced in damage events to the national gas transmission system. The data indicate that the depth and the length are uncorrelated and independent of the pipeline properties. In Ref. 18, British Gas Technology indicated a frequency of external interference events of -3 1.86 x 10 per km year as applying to typical 36-inch diameter national transmission system pipelines. This has been conservatively assumed for the study location. The distribution of excavator weights given in Figure A2 is from North American data [Ref. 34]. This distribution was considered slightly over-conservative for the area in which the pipeline is located as heavy excavating equipment is unlikely to be used. In the model used, therefore, the distribution was “truncated” to impose a maximum limit of 40 tonnes. This is still considered to be a conservative assumption for the project area.

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 55 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment Table A1 - Parameter distributions assumed in the models Variable

Distribution Type

Mean

COV

Operating pressure

Constant

Design pressure

0

Pipe radius

Constant

Nominal value

0

Wall thickness

Normal

Nominal (t nom )

Pipe yield stress

Lognormal

1.08 SMYS

0.04

Typical

Pipe ultimate tensile strength

Normal

1.06 SMTS

0.03

Typical

Pipe Charpy energy

Lognormal

130 J

0.40

Typical

Excavator tooth length

Normal

62.5 mm

0.14

Ref. 28

Excavator tooth width

Normal

4.5 mm

0.167

Ref. 28

Additive puncture model error

Normal

0.883 kN

Gouge depth

Weibull

Shape parameter = 0.73

+/- 1.0mm

30.24

Reference

Varies little Fab. Tol.

Ref. 29 Ref. 18

Scale parameter = 0.98 mm Gouge length

Offset logistic

Shape parameter = 0.043

Ref. 18

Scale parameter = 24.84 mm Offset parameter = 30.13 mm Excavator mass

Histogram

See Figure B2

Dent/gouge multiplicative model error

Lognormal

1.0

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Ref. 34 0.30

J P Kenny assessment using published test data

Page 56 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

Figure A2 - Distribution of excavator weight according to Ref. 34 (US)

A2

References (Appendix A)

27 Spiekhout, J, 1995. A New Design Philosophy for Gas Transmission Pipelines – Designing for Gouge Resistance and Puncture Resistance 28 Driver R G and Zimmerman T J E. A Limit State Approach to the Design of Pipelines for Mechanical Damage. Proceedings of the 17th International Offshore and Arctic Engineering Conference, OMAE 98-1017, Lisbon, Portugal, July 1998 29 Joint Industry Project to Develop Guidance for Limit State, Reliability and Risk Based Design and Assessment of Onshore Pipelines, C-FER 2000 30 Example of the Application of Limit State, Reliability and Risk Based Design to the Uprating of an Onshore Pipeline, A M Edwards, R J Espiner and A Francis, BG Technology, Report No. R3125, Issue No.1, 6 August 1999, Commercial in confidence to Joint Industry Project Sponsors 31 BSI, PD 6493 : 1991 – Guidance on Methods for Assessing the Acceptability of Flaws in Fusion Welded Structures 32 R J Espiner, British Gas Technology, private communication 33 Corder I and Chatain P, EPRG Recommendations for the Assessment of the Resistance of Pipelines to External Damage, 1995 34 Reliability Based Planning of Inspection and Maintenance of Pipeline Integrity, Final Report PR-244-9517, C-FER, published by American Gas Association, 1997

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 57 of 58

CORRIB FIELD DEVELOPMENT PROJECT Onshore Pipeline Quantified Risk Assessment

This page intentionally left blank

g:\052377 - enterprisecorrib additional work\ctr 140 - qra update\02-f-3-835- rev 05 - qra.doc

Page 58 of 58