Process Safety and Environmental Protection 149 (2021) 258–268

Contents lists available at ScienceDirect

Process Safety and Environmental Protection

j ou r na l h o m e p a g e : w w w . e l s e v i e r . c om /l o c a t e / ps e p

Critical aspects of natural gas pipelines risk assessments. A case-study

application on buried layout
Tomaso Vairo a,∗ , Marco Pontiggia b , Bruno Fabiano a
a
DICCA - Civil, Chemical and Environmental Engineering Dept., Genoa University, via Opera Pia 15, 16145, Genoa, Italy
b
RINA Consulting S.p.A. via Gran S. Bernardo Palazzo R, 20089, Rozzano, Italy

a r t i c l e i n f o a b s t r a c t

Article history: The safety aspects of pipelines conveying hazardous materials are included neither under the umbrella
Received 17 July 2020 of Seveso Directives aiming at preventing major accidents at industrial facilities, nor in other EU legis-
Received in revised form 6 October 2020 lations, such as the Pressure Equipment Directive (PED). Starting from evidence that in the last decades
Accepted 24 October 2020
the international natural gas market has been growing at a very high rate and continues to exhibit an
Available online 1 November 2020
increasing trend, in this paper we focus on consequences deriving from accidents on high pressure buried
Natural Gas Pipelines (NGP) and related probabilities of the various outcomes. A survey on historical acci-
Keywords:
dents occurred on NG pipelines in the USA, Canada and EU allowed the attainment of significant statistics
Flash fire
High-pressure pipeline concerning the main factors responsible for the accident evolution, namely failure mode, immediate and
Ignition probability root cause, evolving scenario, degree of confinement produced by the surroundings and ignition timing.
Jet fire In this paper, we focus on a refined Event Tree framework, to overcome the limitations of the amply
Local and remote ignition applied over-conservative IP UKOOA approach. In order to evidence the capability of the approach, the
Natural gas use of refined PET is exemplified by means of a real case-study of a high pressure buried NG pipeline,
contrasting the actual results with those obtained by conventional methods, in terms of evolving scenario
probability and damage. Conclusions are drawn about the effective application of the framework within
risk assessment and the uncertainties and sensitivities in the pipeline accident modelling.
© 2020 Institution of Chemical Engineers. Published by Elsevier B.V. All rights reserved.

1. Introduction ure is higher than the standard acceptable probability according to

the criterion set down in the Netherlands as 10−6 (Taylor, 1994):
Even though hazardous material transportation by pipelines is normalization to 1km is here referred as the hazard distance asso-
statistically recognized as the safest transportation mean, in terms ciated with the pipeline ranges from <20m for a small distribution
of injury and fatality rates on the basis of evidence from pipeline pipeline at lower pressure, up to >1km for a larger pipeline at higher
incident reports since 1970, when compared with road and rail pressure (Vianello and Maschio, 2011). Analogously, in estimating
transportation modes (USDOT, 2013), notable high profile acci- CO2 pipeline failure, Duncan and Wang (2014) argued that previous
dents involving gas pipelines still happen. The evidence of recurring estimates of individual risk associated with natural gas pipelines
releases of hazardous materials in the environment and their fol- being used in quantitative risk analyses, ranged from 1.2 × 10−4 to
lowing escalation in fires, explosions and toxic dispersions implies 1.6 × 10−4 per km year. In China, it was reported an overall failure
that measures need to be enforced in order to adequately quan- rate of 3.0 [event 1,000 km-1 year-1 ] based on the experiences of
tify and thereby mitigate the risks. In relative terms, the problem natural gas and oil pipeline (Zhou et al., 2016). It is noteworthy not-
of pipeline risk assessment does not come with hazard analysis, or ing that, pipeline failure statistics from different sources e,g., ECIG
the estimation of failure frequency, but with the calculation of the (2014), Concawe (2018), provide data regarding the probability of
consequences (Palazzi et al., 2014). The failure rates of pipelines different release sizes and a percentage breakdown of the failure
in the last decade of the XX century was evaluated on the basis of causes, while, for example, failure frequencies are not so accurately
European data to be in the range 2.1 × 10−4 to 7.7 × 10−4 [event categorized for other process equipment (e.g. OREDA, 2015). Natu-
km−1 year−1 ], respectively for small and large diameter. This fig- ral gas (NG) assessed world resources are estimated (IGU, 2019) at
nearly 800 TCM (Trillion Cubic Meters), around 45 % of which are
unconventional gas (tight gas, shale gas, CBM), deposits of which
∗ Corresponding author.
are geographically more widespread than conventional resources.
E-mail address: [email protected] (T. Vairo).
High-pressure natural gas transmission pipelines and installations

https://doi.org/10.1016/j.psep.2020.10.050
0957-5820/© 2020 Institution of Chemical Engineers. Published by Elsevier B.V. All rights reserved.
T. Vairo et al. Process Safety and Environmental Protection 149 (2021) 258–268

present potential major hazards with different evolving scenarios, a better quantitative description of the ignition taxonomy consid-
in the unlikely event of a loss of containment (LOC) connected to a ering on a statistical basis, immediate, delayed local and remote
broad range of natural or anthropogenic causes. The potential rel- ignition probability. The remainder of this paper is as follows: in
evant impact of major incidents in onshore transmission pipelines, Section 2 we summarize pipeline accident statistics form different
already pointed put by Hill and Catmur in 1994 and statistically sources, in order to consider the uncertainty in consequence assess-
evidenced by comparison with data collected from several public ments (Milazzo et al., 2015); in Section 3 we discuss pipeline risk
accident sources (Papadakis, 1999), attracted worldwide scientific assessment and the structure of a bow-tie graphically evidencing
interest in developing approaches to risk assessment and manage- the relationships between possible threats (or causes of damage),
ment. In this regard, in the late Nineties, the European Commission outcomes and barriers that can be used both in prevention or miti-
has carried out a thorough review and assessment on whether gation. Section 4 considers the development of a brand-new event
pipelines conveying dangerous substances need a level of con- tree (PET) by making a cross-over between IP-UKOOA original event
trol similar to chemical installations (Papadakis, 2000). In those tree and the event tree obtained from an HSE report upon proper
years, several fundamental studies were carried out on the topic of consideration of actual ignition probability. In Section 5, PET appli-
quantitative risk assessment (QRA) of gas transportation pipeline, cation is exemplified by contrasting the results of the approach on
as reviewed by Muhlbauer, 2004. Relevant studies included both a high pressure buried NG pipeline, with those obtained by con-
probability evaluation by innovative tools (e.g. Cagno et al., 2000; ventional methods, in terms of evolving scenario probability and
Yuhua and Datao, 2005), the definition of the source term for conse- damage, presenting a possible future lines of development as well.
quence assessment (e.g. Yuhu et al., 2003) and the overall pipeline Final conclusions are drawn in Section 6.
risk evaluation in terms of in terms of cost of repair, supply inter-
ruption, material loss and damage to humans and buildings (Park 2. Pipeline accident statistics
et al., 2004).
Generally speaking, threats to pipeline safety can be categorized A review of relevant past accidents can provide statistical evi-
as follows (Kishawy and Gabbar, 2010): material and construction dence on the extent to which pipelines present a hazard potential
defects, such as a defective longitudinal pipe seam, pipe body or comparable to that of Seveso installations and the extent to which
joint welds; mechanical damage from construction, maintenance the pipeline hazard is adequately controlled. The occurrence of the
or third-party excavation; incorrect operation; corrosion, creep, failure of a pipeline can be due to a number of different causes
and cracking mechanisms; device failures and malfunctions; NaT- such as external interferences, corrosion, material or construction
ech events e.g. earthquakes, landslips, or telluric currents, winds, defects, hot tap made by error; ground movement; other causes,
rough seas, or cold/hot temperatures. such as fatigue, operational and maintenance errors. Sulphur com-
Sklavonous and Rigas (2006) reported that the accident rates of pounds, often present as by products in many industrial processes
natural gas pipeline remained at the same level, in spite of increased (Chiarioni et al., 2006), may severely endanger the mechano-
safety measures and advanced safety management systems. They chemical properties of materials and alloys used in pipelines, thus
faced the issue of safety distances from NG pipelines, by applying triggering failures. Over the last 20 years, the interest of integrity
an approach based on Event Tree Analysis, suitable to be adopted managers has been focused in failures and damage mainly related
in safer land use planning. The need of improving Fault Tree Anal- to the following conditions: S S Stress Corrosion Cracking (SCC);
ysis in gas transmission systems represented a challenging topic Electrical Resistance Welding (ERW) and old repairs; lack of mate-
faced by Yuhua and Datao (2005) with a method relying on an rials identification; lack of data on operating conditions; increase
earlier fuzzy approach developed by Khan and Abbasi (2001) and in population around pre-existing pipelines. Pipeline ageing is a
combining expert elicitation with fuzzy set theories to evaluate the common item in Europe and resulted in notable accidents, with
probability of the events. A multi-attribute decision model accounts potentially high environmental impact in case of proximity with
the possible human, environmental and financial impact and rank- sensitive areas (Vairo et al., 2017a). Some of the main gas distribu-
ing sections of gas pipelines into a risk hierarchy was proposed by tion pipelines are more than 50 years old: integrity issues of these
Brito and de Almeida (2009). aged pipelines are related not only to material problems such as
Taking into account NG hazards and difficulties in prompt leak low toughness and in-service damage, but also to the way demo-
detection, Lu et al. (2015) proposed a risk matrix connected to a graphic expansion has affected conditions in metropolitan areas
bow-tie model to evaluate the risk of pipeline conveying natu- (Vairo et al., 2017b). As commented by Otegui (2014) the usually
ral gas. More recently, a cloud inference approach was proposed uncontrolled increase in dwelling around (and sometimes along)
to implement the transition between quantitative description and the right of way has influenced integrity requirements for operators
qualitative concept and solve the uncertainties in the risk assess- of gas pipelines in various ways, i.e.
ment process of NG pipelines (Yanbao Guo et al., 2016). In order to
meet the rapidly growing demand for natural gas, pipeline network • by a reduced acceptable risk of blowouts and other failures,
construction is developing at a high speed (Dorao and Fernandino, representing a serious burden for integrity teams, especially in
2011). Additionally, the peculiar context of NG pipelines represents suburban areas where most of the pipelines are un-piggable;
an emerging research topic, given the increasing trend of under- • by increased consequences of failures in gas treating and com-
ground storage into depleted natural gas production sites, where pression plants, due to enhanced production requirements and
the exploration phase is exhausted. This technology is seen as a space constraints;
strategic option in Countries with negative NG commercial foreign • by an increased risk of third party damage;
exchange, allowing to cover and guarantee gas distribution during • by changes in soil conditions.
high rate demand: e.g. Italy where currently there are 12 under-
ground NG geological sites located in Abruzzo, Emilia Romagna, Dealing with expected frequency based on historical statisti-
Lombardia and Veneto. In this study, which takes inspiration from cal analysis, different values can be calculated, as exemplified by
a recent work of the same authors (Pontiggia et al., 2019), we take a Hill, 1992 who obtained over the time span 1983–1991, figures of
closer look at the evaluation of the possible consequences deriving 5.8 × 10−4 and 7.4 × 10−4 [ev/km/y] referred to the overall pipeline
from accidents on high pressure buried Natural Gas pipelines and accidents and respectively based on data by CONCAWE (European
the related probabilities of the different outcomes. On these bases, Oil Company Organization for Environment, Health and Safety) and
a newly developed Pipeline Event Tree (PET) is proposed to allow US-DOT. Crude oil and oil products are the main fluids extensively

259
T. Vairo et al. Process Safety and Environmental Protection 149 (2021) 258–268

Fig. 1. Immediate causes of pipeline failure (ECIG, 2018).

conveyed in European networks and as detailed in the following, • 54 % cases were characterized by immediate ignition and the
different fire scenarios may result from the failure of a flammable other 38.5 % by delayed ignition. In one case ignition timing is
material pipeline, whereas only for liquid releases it is considered unknown.
pool fire scenario (Palazzi et al., 2017). Leak sizes range from pin- • 38.5 % cases of failure were caused by corrosion generally local-
holes up to hole sizes which represent critical or unstable defects for ized in the bottom part of the pipe, 31 % of cases characterized by
particular pipeline parameters. Unstable defects result in ruptures. third-part damage, 23 % of cases by the failure of girth weld and
A rupture release is a full-bore, double-ended break or equiva- one case of hydrogen stress cracking.
lent from which gas is released into a crater from both sections • a vertical jet fire has occurred in all the cases, only in one case a
of pipe. In relative terms, the problem of HazMat pipeline risk grounded jet fire or trench fire has been reported. In two cases
assessment does not come with hazard analysis, but with the cal- the jet shape was unknown.
culation of the consequences (Palazzi et al., 2014). Interestingly, • fireball has occurred in 31 % of the cases but for two of them it
considering the time span 1968–2009, Siler-Evans et al. (2014) was considered only as probable.
argued that in the United States hazardous liquid pipelines resulted • a flash fire has occurred only in one case (Fig. 1).
much safer with a sharp accident reduction, while gas distribu-
tion pipeline incidents remained fairly constant, even though the
It stands to reason that pipeline system suffers as well possi-
resulting severity decreased. In most cases, the rupture scenario
ble security issues, regarded following Aven (2014) as intentional
will dominate the risk from Natural Gas pipelines. In the peculiar
situations and events (terrorist attacks, burglary, etc.) in contrast
case of buried pipelines, wave propagation and permanent ground
to safety, which covers the accident type of situations and events.
displacement (PGD) are usually considered as the most severe haz-
Different from unintentional events, intentional attacks on energy
ards connected to seismic and landslide events, resulting in high
supply systems may result in more severe consequences affect-
severity damages (O’Rourke et al., 2005). Commonly, failure fre-
ing the sustainability and reliability of supply chain. In Nigeria, a
quency data are quoted for the sum of all hole sizes, and these
total of 15,718 deliberate attacks on oil pipelines occurred during
should be classified into specific hole sizes to permit the devel-
the time span 1993–2008. More recently, the Abqaiq oil plant was
opment of the risk assessment. In order to determine the range of
attacked by drones on September 14, 2019, leading to a 50 % reduc-
the LOC sizes to be considered in the consequence assessment, the
tion in Abqaiq’s oil production and a nearly 15 % increase in the
hole size which gives an equivalent outflow to the critical length
crude oil price. Focusing on oil and gas pipelines, two main cate-
of an axial defect for specific pipeline parameters should be deter-
gories of security threats can be sorted i.e., theft and sabotage (Chen
mined. Critical defect length and equivalent hole diameter applies
et al., 2021). Both theft and sabotage can lead to high profile con-
to external interference where axial, crack-like defects can occur;
sequences: theft has been a long-standing security concern for oil
the equivalent hole sizes which relate to such defects do not apply
and gas pipelines, while terrorist attacks threat has become a more
to rounded punctures, or stable holes due to corrosion or material
pressing priority frequent only in certain geographical areas.
and construction defects. The maximum possible hole size in high-
pressure gas pipelines is limited to the critical defect size. According
to US DOT (2010) the immediate causes of NG pipeline failures are 3. Pipeline risk assessment
connected to corrosion (28 %), construction material failure (23 %),
followed by excavation damages with a percentage of 20 %. Rel- Risk assessment approach within the context of HazMat
evant NG pipeline accidents occurred in the USA, Canada and the pipelines relies on standardized approaches originally conceived
EU, for which detailed accident reports are available from various for process plants implying the amply known steps of HazId (haz-
sources, (HSE, 2000) were analysed, with following considerations ard identification), frequency estimation, consequence estimation
on major events and immediate causes: and risk calculation (Uijt de Haag and Ale, 1999). Scientific liter-
ature addresses the most relevant questions connected to QRA in
• the full rupture was the common type of failure that occurred for this peculiar sector and those question are mainly related to fre-
all the cases. quencies, release rate, release direction (Kooi et al., 2015).

260
T. Vairo et al. Process Safety and Environmental Protection 149 (2021) 258–268

Here we anticipate that applying default values for ignition Table 1

Overall ignition probabilities from different literature references related to various
probability, such as 0.15 for immediate ignition and 0.3 for delayed
type of failures.
ignition, implies a degree of uncertainty as they do not account
for specific release conditions that may influence probability val- Source Failure Ignition probability
ues such as temperature, release material and an ignition source Townsend and Leaks 0.1
(Moosemiller, 2011). Fearnehough (1986) Rupture 0.5
The bow-tie analysis provides a readily understandable visual- Jones and Rupture 0.26
Fearnehough (1986) All sizes 0.16
ization of the relationships between the causes of accidents, the
Pinhole/cracks 0.02
escalation of such events to a range of possible outcomes, the con- Holes 0.03
trols preventing the event from occurring and, should the event EGIG (2014) Ruptures <16” 0.05
nevertheless occur, the preparedness measures in place to limit Ruptures >16” 0.35
All sizes 0.03
the consequences (Cermelli et al., 2018). The preventive and miti-
gation controls may be linked to activities, procedures, responsible
individuals and competencies, thereby demonstrating the crucial pipelines. Fig. 3 depicts the well-known IP-UKOOA event tree (IP-
connection between risk controls and a Safety Management System UKOOA, 2006), usually applied within a QRA procedure, in order
for ensuring their ongoing effectiveness. This visual representa- to evaluate the probabilities of possible outcomes and incidental
tion underlines the connections between threats, potential impacts scenarios deriving from a given pipeline release.
and preventing/mitigating elements. Starting from the main failure Leak frequency or failure frequency can be derived from differ-
causes previously discussed, the representative bow-tie is shown ent literature sources (e.g. IGEM, 2015), while the overall ignition
in Fig. 2 to provide a description of major events resulting from a probability can be calculated by using the “look-up correlations”
Natural Gas release from a buried pipeline and relevant preven- mainly depending upon the estimated release mass. Following the
tive barriers. Design and procedural weaknesses can be identified estimation of the overall ignition probability, the second branch
in the left-hand side and probabilities of the various outcomes considers the early ignition probability. The term used is “early”
from an accidental event can be determined. The right-hand side rather than “immediate” and can be applied to ignitions occurring
is to be designed according to an event tree analysis (ETA) illus- up to 60 s after the start of the release. During this “early” period
trating all possible final major hazard phenomena resulting from a substantial vapour cloud can form which, if ignited, would give
the critical event, considering whether installed safety barriers are rise to an explosion with large overpressure. Given that the split
functioning or not and additional/contributing factors. The barriers between “immediate” and “delayed” is primarily intended to dis-
related to the external interference are safety signs and the escala- tinguish between “fire only” and “explosion plus fire” in our event
tion factor related ones can be the lack of respect for this signal. For tree this will be considered as immediate ignition. Finally, the last
mechanical failures, the main barriers are connected to inspection branch takes into account the explosion and consequently the flash
program, vibrating monitoring system and the related escalation fire probabilities. As anticipated, in order to develop a refined ETA
factors can be the delay in the execution of the survey and the failure approach, the most critical step is connected to the actual esti-
or malfunction of the vibrating monitoring system. For corrosion, mation of ignition probability, as discussed in the next section.
the barriers are inspection programs and corrosion prevention and As amply known, ignition probability estimate usually relies on
monitoring system. The escalation factor related to the inspection information, like the ignition probability review carried out by the
program can be the delay in the realization of the control, and for Energy Institute (2006). However, utilizing literature data including
the prevention and monitoring system can be the inadequate set- the look-up correlations developed by the UKOOA, which are repro-
up of the anti-corrosion system. Dealing with ground movement, duced in tables by the OGP (OGP, 2010), implies several issues as
the main barriers are foundation inspection, drainage system and discussed in more detail in (Pesce et al., 2012). Table 1 summarizes
piles. The related escalation factors for inspection are the delay or the overall ignition probabilities for natural gas pipeline deriving
negligence of the survey, the failure or malfunction of the drainage from three different literature sources and divided in full-bore rup-
system, and the wrong application of standards. The main ignited ture and minor leak summarized by HSE (2015).
consequences are fireball, jet fire, trench fire and flash fire while the The values provided in Table 1 evidence significant variabil-
non-ignited consequence is the dispersion of natural gas. For all the ity, depending on a number of assumptions, namely probability is
ignited consequences the typical recovery preparedness measures based on sizes of release (larger the release and larger will be the
are low-pressure detectors, ignition source absence, emergency likelihood of ignition); unknown data sources (offshore + onshore);
depressurizing and block of equipment. The escalation factor for inclusion of immediate ignition. From the analysis of historical
low-pressure detectors can be a failure or inadequate set-point. data for rupture incidents, a trend was observed and a correla-
In the following, we focus our attention on the right-hand side tion for full rupture was proposed on overall ignition probability
of the bow-tie to highlight and discuss critical aspects of event tree as follows, without any consideration regarding failure cause and
analysis. ETA represents a fundamental step and can be used to pipeline localization (HSE, 2015):
identify all potential scenarios and sequences in a complex system
following a step-by-step inductive logic chain: PIGN = 0.0555 + 0.0137pd2 ; 0 ≤ pd2 ≤ 57 (1)
2
PIGN = 0.81; pd > 57 (2)
1 identification and definition of a relevant initiating event, which
may give rise to unwanted consequences; Where:
2 event tree construction;
3 description of the potential resulting accident sequences; • PIGN = overall probability of ignition
4 determination of the frequency of the accidental event and the • p = pipeline operating pressure [bar]
(conditional) probabilities of ET branches; • d = pipeline diameter for ruptures [m]
5 calculation of the probabilities/frequencies for the outcomes or
resulting scenarios. The influence of the differences in environmental conditions
along the pipeline is mainly due to the temperature at release,
A simple ETA approach was developed by Stephens (2000), in his which can affect the flammability limits (relevant parameter in
study aiming at sizing high consequence areas associated with NG release modelling), and to the population density. Relatively high

261
T. Vairo et al. Process Safety and Environmental Protection 149 (2021) 258–268

Fig. 2. Bow-Tie for centred on loss of containment from gas pipelines.

Fig. 3. Standard event tree developed according to IP-UKOOA methodology.

population density generally results in more excavation activities • the flammability of the vapour cloud is not uniform because of the
(Xu et al., 2019), which may consequently pose additional haz- presence of “pockets” in which the ratio fuel/oxygen is variable
ards and increase the ignition probability. Entering in more detail (some zones are richer of fuel than others);
into ignition evaluation, a distinction is usually made between • the division between local and remote delayed ignition is made
immediate and delayed ignition. The former occurs typically in to grant a better detail for the comprehension of the scenario;
case of third-party damage on rural pipelines and the friction • in case of high momentum releases, the jet fire is possible.
sparks provides the source. The term “prompt” is considered more
appropriate, representing an ignition from a close source occurring
within nearly 30-40 seconds before the formation of a large gas Immediate (or better prompt) ignition corresponds to the case in
cloud. The latter can be distinguished into (HSE, 2015): which ignition occurs near the release point, but before the forma-
tion of any vapour cloud. The immediate ignition probability taken
from literature ranges from 0.1 and 0.3, so the assumed value of
0.25 by HSE report seems acceptable.
• local: in this case there is an ignition source near the release
The evaluation can be properly refined as follows, by considering
point, but the gaseous plume does not respect the ignition two relevant parameters affecting immediate ignition, namely:
requirements, being outside the flammability range and the main
consequence is a Jet fire;
• remote: it occurs if the ignition sources close to the release point • PAI = autoignition potential related to T and AIT;
are insufficient and the gaseous plume requires a certain amount • PSD = potential for static discharge related to MIE and release
of time to disperse at concentrations below UFL; the main conse- energy for released material (assumed by definition as P1/3 ) and
quence is a Flash fire. so the immediate ignition probability will be written as:

Concerning this classification, some consideration can be done: P = PAI + PSD (3)
immediate ignition

262
T. Vairo et al. Process Safety and Environmental Protection 149 (2021) 258–268

Fig. 4. Development of the newly conceived Pipeline Even Tree (PET).

T 0.0024P 1/3 information are available, deriving an unobstructed release prob-

P = 1 − 5000e−9.5( AIT ) + (4) ability equal to 0.63 and correspondingly obstructed release
immediate ignition
MIE 2/3
probability equal to 0.37.
Where: T and AIT [◦ F], P [psig], MIE [mJ].
For these formulas, the following limits are indicated:

4. Development of a refined pipeline event tree

• TMIN = 0 ◦ F;
• if T/AIT < 0,9 then PAI = 0;
Taking into account previous considerations, in the following,
• if T/AIT > 1,2 then PAI = 1;
a brand-new pipeline event tree (PET) is presented based on crit-
• P immediate ignition maximum = 1.
ical crossover with IP-UKOOA (2006) and HSE (2015) methods, to
attain a better and more detailed description of all the possible out-
When T < AIT + 200 ◦ F than it will occur a delayed ignition with comes and the relative probabilities. As working hypothesis, toxic
Pimmediate ignition < 0.98. Such an approach allows for a more spe- effects are not considered relevant compared to flammable dam-
cific calculation of immediate ignition conditional probability when age, considering the rather low concentration of toxic compounds
compared to the IP-UKOOA, where only very general values (mainly (H2 S) also in conventional natural reservoirs.
based on risk analyst judgment) are provided. Compared with a simple approach, the PET reproduced in
Generally speaking, literature focuses mainly on the distinction Fig. 4 accounts for the meteorological aggregation which takes
between the immediate and the delayed ignition probabilities and into proper account the wind stability classes in case of delayed
far less on the differences between the delayed local and remote. ignition. Following a standard QRA approach, two atmospheric
The delayed ignition occurs in case of large cloud formation, ignited stability classes were considered for consequences and risk calcula-
by a remote source and has a default probability value of 0.3, but tions following a conservative approach, namely stable atmosphere
it requires refinement owing to the variables influencing release (Pasquill class 2, representative of night conditions) and neutral
conditions, i.e. obstructed or unobstructed release. From literature, atmosphere (Pasquill class D, representative of day conditions).
it has calculated the obstructed/unobstructed release probability For the Pasquill class F, a wind velocity of 2 m/s is used (hence,
depending on the crater angle from the top of the pipeline, being class 2F) and for the Pasquill class D 5 m/s (hence, class 5D). These
= 19◦ in case of obstructed jet angle and = 71◦ for unobstructed values are considered in the branch of delayed ignition. As amply
jet. The probability of an obstructed or unobstructed release is known, more stable conditions are associated with lower dilution
independent on the substance because its chemical-physical char- and higher concentration at ground level, due to a more difficult
acteristics do not affect neither the location of the puncture nor mixing of the pollutant within the vertical layers of the atmosphere.
the jet impingement probability. The following definitions allow More unstable classes (A, B and C) are associated to a higher dilution
explaining the difference (HSE, 2015): therefore to lower hazard distances. IP-UKOOA standard event tree
allows for a detailed description of the effect of discharged mass
• unobstructed release: it derives from the puncture close to the flow rate in the ignition probability calculation; boundary condi-
top of the pipeline and determines the formation of a narrow, tions are also resumed by means of empirical fitting coefficients
high velocity vertical-jet; (gradient and coefficient in the probability of ignition equation).
• obstructed release: gas leaving from the side or the bottom of the However, it should be evidenced that the above mentioned PET
pipeline and it is obstructed by the impact with the crater and can model was developed to allow calculation for the widest range of
affect the jet modifying its width, velocity and direction. A crater release condition while it does not include any directionality, or
with a diameter equal to 10 times the pipeline diameter can be congestion effect that can be relevant for a specific representation
formed. of buried pipeline releases.
In order to perform ET analysis, the overall ignition probability
In order to derive the obstructed/unobstructed release prob- y is derived from the “look-up” correlations adopted according to
abilities, UKOPA considers 73 real accident cases for which all the conventional IP-UKOOA scheme:

263
T. Vairo et al. Process Safety and Environmental Protection 149 (2021) 258–268

y = 10mlog 10 (x)+c (5) Table 2

Discharge flow rate, discharge time and release frequency for the given Loss of
where y is the ignition probability, x is the mass release rate (kg/s), Containments.
m is the gradient of the correlation and c is the y-axis “offset” of the Hole size Discharge flow Discharge time Release
correlation. Such a definition allows the application of the model rate [kg/s] [min] frequency
to a wider range of release cases, including full-bore, leaks and [ev/km/y]
pinhole. Release rate shall be assessed with dedicated models and ¼” 0.2 > 60 4.38 E-5
relevant level of detail can be selected by the risk analyst based on 4” 56 > 60 4.68 E-5
the specific project requirements. Full-bore 1,102 19 1.97 E-5
The second branch of the PET depicted in Fig. 4 is characterized
by the choice between an obstructed or unobstructed release, and Table 3
this part relies on HSE approach, allowing for a more specific rep- Main design and operative characteristics of the given buried Natural Gas transport
resentation of the accidental scenario development. As previously pipeline.
commented, the corresponding value depends on the actual release
Parameter Value
size because, as a matter of fact, for full ruptures the unobstructed
Temperature of natural gas 50 ◦ C (122 ◦ F)
probability is 0.63, while for obstructed release is 0.37. Instead,
Autoignition temperature of methane 600 ◦ C (1112 ◦ F)
for leaks the unobstructed probability is 0.25 and consequently, Operating pressure 44 barg (638.17 psig)
the obstructed probability is 0.75. Obviously, the likelihood of an Minimum ignition energy 0,22 mJ
obstructed or unobstructed release depends on the type of damage Pipeline length 374 km
on the pipeline; in case of external interference the unobstructed Pipeline diameter 24 in.(60.96 cm)
Volume of NG 107,989 m3
release will be more probable, while if the damage will be caused
Flow rate at the operating conditions 26 kg/s
by corrosion or ageing related events, the release will be generally
obstructed.
The third branch of the PET deals with the immediate ignition ¯
where Pimmediate is the conditional probability of immediate igni-
probability. HSE report suggests a default conditional immediate ¯ is the conditional probability of local
tion given the ignition, Plocal
ignition probability of 0.15. In applying the PET, the probability is ¯
delayed ignition given the delayed ignition (1-Pimmediate ) and Premote
properly evaluated making reference to Eqs. (1) and (2). is the conditional probability of remote delayed ignition given the
Finally, the last branch accounts for either delayed local or delayed ignition. All the conditional probabilities to be input in the
delayed remote ignition probability. HSE-UK formula used to cal- event tree can be therefore calculated defining two input values,
culate the delayed local ignition probability is based on little namely the conditional immediate ignition probability provided
experimental observation and a number of relevant parameters by the HSE-UK report and the delayed remote ignition probabil-
are to be defined based on expert judgment. On the other hand, ity (flash fire probability), as previously discussed. It is in any case
remote delayed ignition probability value is uncertain. As a general recognised that the reliability of ignition probability is still lim-
approach, remote delayed ignition probability is assumed 0 in case ited, and an update is advisable when new reliable information be
of NG releases, as during a high-pressure methane release, initially available.
the cloud will cool during expansion and so the cold dense cloud
local ignition is frequent, contrary to evidences with other liquefied
5. Applicative case-study
gases, such as LPG, for which a higher probability of delayed igni-
tion has been estimated (Bubbico et al., 2016). Subsequently, during
In order to test the capability of the approach, in this section, we
buoyant gas diffusion, the ignition for grounded remote sources
refer to a real buried Natural Gas transport pipeline comparing the
is not possible and flash fire scenario is not considered. Although
results for the various outcomes obtained by the conventional IP-
very infrequent, a flash fire has been observed at least once in the
UKOOA method. The worked example is based on following design
statistical data previously presented. In order to solve this issue,
data of a NG pipeline: operating presssure 44 barg; total length
the relationship proposed by Kletz (1977) accounting for the total
374 km; nominal diameter 24 inches; flow rate 26 kg s−1 ;total NG
released mass has been considered to assess the delayed remote
volume 107,989 m3 . We considered three LOC sizes, namely ¼ ,
ignition probability, based on the critical value of 10 ton of NG
4 inches and full-bore rupture. Table 1 summarizes the calculated
released from the pipeline, value commented also in Lees (2012).
values for the discharge flow rates, the discharge time and the
In order to respect the fact that in the proposed event tree the
release frequency for buried NG pipelines for the three considered
value of the overall ignition probability must be equal to the sum
LOCs according to the modified ETA.
of the immediate and delayed ignition probability, being the lat-
In this section, the new Event Tree, developed making a cross-
ter defined as the sum of the local and remote delayed ignition
over between IP-UKOOA and HSE data, is applied referring to a
probability, one can write:
real buried Natural Gas transport pipeline. The focus is to make
PIGN = Pimmediate + Plocal + Premote (6) a comparison with the results for the various outcomes obtained
for the same pipeline with the conventional ET method. In the given
The value of the conditional ignition probabilities can be easily
application, three holes sizes are considered, namely: ¼”, 4” and a
obtained as follows:
full-bore rupture (Table 2).
Pimmediate The main design and operative data of the considered pipeline
¯
Pimmediate = (7)
PIGN are summarized in Table 3.
Premote According to the five step-by-step logical chain of the PET out-
¯
Premote = (8)
¯
1 − Pimmediate PIGN lined in the section above, the first term considered is the failure
frequency, which is an input datum provided by the EGIG report.
¯ =1− Premote Then, the overall ignition probability is calculated according to Eq.
Plocal (9)
¯
1 − Pimmediate PIGN (3). In case of ignition, as previously described, the calculation of
The actual local delayed ignition probability can be written as: immediate ignition probability is obtained by the Eqs. (3) and (4)
with their boundary conditions, being the ratio T/AIT lower than 0.9.
¯ *(1 − Pimmediate )
Plocal = Plocal (10) The actual local and remote delayed ignition probability are calcu-

264
T. Vairo et al. Process Safety and Environmental Protection 149 (2021) 258–268

Table 4
Outcomes values obtained according to PETA for a buried Natural Gas transport pipeline.

Hole size Fireball + Jet fire 1 Jet fire 2 Flash fire + Jet fire 3 Trench Fire 1 + Fireball Trench Fire 2 Flash fire + Trench Fire 3 Dispersion

¼” 8.9E-13 1.3E-08 1.3E-11 2,7E-12 3.9E-08 3.9E-11 4.37E-05

4” 1.1E-10 2.3E-07 2.3E-10 6,2E-11 1.4E-07 1.4E-10 4.64E-05
FB 7.04E-07 9.99E-06 1.05E-06 4.13E-07 5.87E-06 6.19E-07 0

Table 5 the whole period of observation at 5.5 × 10−7 per km year. We must
Outcomes values obtained with the IP-UKOOA ETA for the buried Natural Gas trans-
point out that this paper is not focused on strategies for routing
port pipeline.
pipeline to minimize risk, for which the best indicator would be
Hole size Release Frequency Jet fire/Pool Fire Flash fire Dispersion the estimation of societal risk, i.e., the cumulative probability that a
¼” 4.38E-05 2.29E-08 5.33E-08 4.37E-05 group of at least N people is fatally injured as a direct consequence
4” 4.68E-05 1.10E-07 2.56E-07 4.64E-05 of their presence within the impact area of the pipeline during a
FB 1.97E-05 5.91E-06 1.38E-05 0 failure.
Beraing in mind this limitation of the paper, LSIR index was
lated according to Eqs. (7)–(9). The subsequent step regarding the calculated considering pipeline-related Major Accidents Events as
evaluation of distances to radiation/concentration thresholds have well as dropped object impacts. In general terms, the risk for people
been calculated by means of PHAST software modelling package from all incidents and scenarios (immediate and delayed ignition
(DNV, 2007), assuming as working hypotheses vertical release for of flammable gas releases, flash fire scenarios coming from gas dis-
unobstructed releases, down-impinging on the ground release for persions) is combined to calculate the risk value to a permanently
obstructed releases and dispersion from crater surface in case of full resident individual or asset at any given distance from the pipeline,
bore-rupture. Results for all the evolving scenarios are summarized indicated as LSIR. In particular, in order to calculate LSIR value, the
in Table 7. total frequency of occurrence of releases along a whole section of
Table 4 summarizes the data calculated for the three considered the pipeline is not adopted, as a failure at a considerable distance
cases by applying the new ETA. from a target point will not cause any adverse effect at this dis-
The scenario results obtained by applying the standard approach tance. Similarly, the frequency of release per unit length is not used
are summarized in Table 5. for the same reason. On these grounds, a simplified but realistic
From these two tables, it can be argued that the main difference model to calculate the risk to a person exposed at a target point at
between the two methods lays in the values obtained for the flash a given distance from the pipeline is calculated using the “interac-
fire outcome, because in the new ETA the probability of flash fire tion distance” concept, where the interaction distance is the length
is lower by three orders of magnitude compared to the probability of pipeline that can cause a given hazard level at a target point at
obtained with the IP-UKOOA approach (Table 6). a given distance from the pipe. People risk is therefore calculated
The following considerations can be drawn from the evidences as a function of the distance from the pipeline axis for a transect at
obtained by means of the two Event Tree Analyses: 90◦ to the pipeline, for a theoretical person resident 100 % of the
time, considering the contribution of all risk scenarios in a given
• for the ¼” leak, jet fire frequencies for both ETAs are the same and point. In order to calculate the individual risk at any point along
a transect perpendicular to the pipeline, the interaction length is
radiation distances are comparable. In the new ETA, flash fire is
split into small units (interaction length is defined as the distance
absent respect to IP-UKOOA ETA;
• for the 4” hole, jet fire frequencies have the same order of from the pipeline at which the vulnerability is equal to zero). Subse-
quently, the risk is calculated for the relevant scenario for each unit.
magnitude with comparable radiation distances, while flash fire
Calculations consider an ideal straight infinite pipeline, assuming
frequency according to the new model is three orders of magni-
as a simplifying hypothesis that border effects at the junctions of
tude lower;
• for the full-bore case, considering the sum for all the jet fire adjacent sections are negligible.
At last, the LSIR at a given distance L along the considered
cases in the newly developed PETA, jet fire frequency is of the
transect is obtained by considering all the contributions along the
same order of magnitude of conventional ETA. According to the
interaction length, as follows:
novel approach, the obstructed jet fire has the same consequences
as can be seen in the table below. The radiation distances for n
unobstructed cases result to be longer at lower thermal radiation LSIR = FFAT Lj *Nxj (11)
levels, but the maximum value of 37.5 kW/m2 is never reached. J=1
The radiation distances for obstructed flash fire are the same for
ns ns
both cases, while for the unobstructed ones are negligible. The
event frequency for flash fire is one order of magnitude lower FFAT Lj = min( Fi *V Lj ; Fi ) (12)
considering the new ETA, compared to the IP-UKOOA one. j=1 j=1

Where:
In order to evidence the actual implication of the novel
approach, we refer to the location-specific individual risk (LSIR), i.e.
• Lj is the distance between step j and target point at distance L
the frequency of occurrence of a fatality considering cautiously that
a person is permanently (24 h per day and 365 per year) positioned along the transect;
• FFAT is the frequency of fatality per pipeline unit length at dis-
at a given point.
The risk of NG pipelines in terms of average fatality rate during tance Lj by events originating in step j (event/year/km); it cannot
the period 2002-2009 of the general public including independent exceed the release frequency calculated as the sum of frequency
contractors working on the pipeline according to US DOT was esti- of all the scenarios;
• Nxj is the length of the step j;
mated at 7.2 × 10−7 per km year (Duncan and Wang, 2014). Starting
• Fi is the frequency of occurrence of scenario I (ev/year/km);
from last EGIG database (2019), collecting 1,366 pipeline accidents
• V is the vulnerability at distance Lj ;
it is possible estimating the average fatality rate of the public over

265
T. Vairo et al. Process Safety and Environmental Protection 149 (2021) 258–268

Table 6
Comparison between event frequencies calculated with the IP-UKOOA ETA and the New ETA (where U stands for Unobstructed, O for Obstructed and FB stands for Full-Bore).

Old ETA New ETA

JF frequency [ev/year] FF frequency [ev/year] JF frequency [ev/year] FF frequency [ev/year]

¼” U 1.31E-05 9.2E-06 1.31E-05 –

¼” O 3.94E-05 2.76E-05 3.94E-05 –
4” U 9.13E-05 6.39E-05 2.34E-04 2.34E-07
4” O 2.74E-04 1.92E-04 1.37E-04 1.37E-07
FB 1.97E-02 1.38E-02 – –
FBU1 – – 7.04E-04 –
FBO1 – – 4.13E-04 –
FBU2 – – 9.99E-03 –
FBO2 – – 5.87E-03 –
FBU3 – – 1.05E-03 1.05E-03
FBO3 – – 6.19E-04 6.19E-04

Table 7
Comparison between radiation distances for jet fires and LFL and LFL/2 values for flash fire according to the ETA different approaches.

JET FIRE FLASH FIRE

Radiation distance [m] Concentration distance [m]

3 5 7.5 12 37.5 LFL LFL/2

Standard ET [kW/m2 ] [kW/m2 ] [kW/m2 ] [kW/m2 ] [kW/m2 ]

¼” U 10 8 7 6 4 – –
¼” O 3 2 2 0 0 – –
4” U 87 66 53 31 0 – –
4” O 94 74 62 46 31 286 441
FB 160 132 116 93 59 586 925

PETA [kW/m2 ] [kW/m2 ] [kW/m2 ] [kW/m2 ] [kW/m2 ]

¼” U 7 5 5 4 2 – –
¼” O 3 2 2 0 0 – –
4” U 87 66 53 31 0 – –
4” O 94 74 62 46 31 286 441
FB U1 368 281 228 142 0 – –
FB O1 160 132 116 93 59 – –
FB U2 263 200 162 99 0 – –
FB O2 160 132 116 93 59 – –
FB U3 176 134 109 66 0 – –
FB O3 160 132 116 93 59 – –
FB FFU – – – – – 37 38
FB FFO – – – – – 586 926

assumptions made in the prediction of flash fire events: IP-UKOOA

approach predicts flash fire frequencies according to fixed delayed
ignition conditional probabilities, which fits best releases occurring
in industrial areas where ignition sources are frequently present at
different elevations. On the opposite, the HSE-UK approach would
have completely neglected the flash fire, thus leading to an under-
estimation of the transect risk. This study represents a first step
towards the refinement of ETA in case of buried NG pipeline and,
even if outside of the focus of this paper, we briefly examine how
pipeline safety can improve by making use of Bayesian Network-
based and other graphical models. Novel promising developments
are under investigation to identify dependent relationships among
various accident-causing factors in a qualitative and quantitative
way (Ahmadi et al., 2020): referring to buried pipelines, an effec-
Fig. 5. Location specific individual risk as a function of the distance, according to
the different ETA approaches.
tive solution for the urban context integrating iDEMATEL and ISM
approach was conceived by Li et al. (2019a). The state features
of urban buried gas pipeline network and the corresponding vul-
• ns is the number of scenarios originating in step j (jet fire, flash
nerability level assessment was recently faced on the basis of
fire).
the Support Vector Machine (SVM) and Artificial Neural Network
(ANN) methods (Li et al., 2019b). Recalling to the focus of this study,
The results are provided in terms of physical effects trend vs
Bayesian inference represents a natural extension and refinement
the distance from the release point (namely heat radiation vs dis-
of FTA and ETA frequentist approach (Vairo et al., 2019).
tance) thus allowing for the calculation of the vulnerability trend
Moving from frequencies to probability distributions allows
vs distance (Fig. 5).
incorporating local dependence between events and enabling both
The LSIR curve above shows that with the usage of the refined
predictive and inference analysis. As previously commented, the
PET a reduction of the fatality frequency by an order of magnitude
main uncertainties associated to the bow-tie analysis are on the
can be observed at distances higher than 200 m from the pipeline.
likelihood, and interdependence, of root risk events in FT and events
This effect is mainly due to the reduction in the over-conservative

266
T. Vairo et al. Process Safety and Environmental Protection 149 (2021) 258–268

Fig. 6. A conceptual illustration of a framework for the predictive dynamic risk model.

in ET, and this is due to insufficient statistical data and knowl- • minor leak (¼”): flash fire is negligible with respect to the results
edge. Consequently, such an analysis may lead to exact, but often from IP-UKOOA ETA.
unrealistic, results. As a future perspective under development, we • medium LOC (4”): flash fire frequency results three orders of
propose to apply a Bayesian hierarchical modelling technique, in magnitude lower.
order to get a better appreciation of the uncertainties in the whole • full-bore case: the radiation distances for unobstructed cases
bow-tie structure. In this way, the failure/occurrence probability result to be longer at lower thermal radiation levels, while but
will be no more defined by an exact number, but rather by a Proba- the critical value of 37.5 kW/m2 is never attained. The event
bility Density Function (PDF) As widely acknowledged, Bayesian frequency for flash fires is one order of magnitude lower.
hierarchical modelling is a statistical model written in multiple
levels (hierarchical form) that estimates the parameters of the pos- The quantitative results in terms of resulting effects of the
terior distribution using the Bayesian method. Amin et al. (2020) new PETA can be visually evidenced by the LSIR curve showing
recently outline such an approach in the process sector. The sub- a reduction of the fatality frequency by an order of magnitude, at
models combine to form the hierarchical model, and Bayes theorem distances higher than 200 m. The implications on the hazard dis-
is used to integrate them with the observed data and account for tance from the failure point are mainly due to the reduction in the
all the uncertainty that is present. The result of this integration over-conservative assumptions made in the prediction of flash fire
is the posterior distribution, also known as the updated proba- events. As anticipated, the paper represents a first attempt based
bility estimate, as additional evidence on the prior distribution is on relevant statistical data from various sources, requiring fur-
acquired (Allenby et al., 2005). Referring to the paper of Fang et al. ther sensitivity studies and possibly further validation by means
(2019), Bayesian network established from the Bow-tie diagram of small and full scale experimental facilities, to perform immedi-
can be used as a mapping algorithm, to identify critical influencing ate, delayed local and delete remote ignition runs. Additionally, the
factors. refined approach should be assessed against realistic cases includ-
A conceptual illustration of a future pipeline dynamic risk ing all demographical and orographic characteristics of possible
model, relying on the described novel combined approach inspired or actual routes, to include societal risk evaluation and possible
from the paper by Amin et al. (2020), is depicted in Fig. 6. domino effect implications.

Declaration of Competing Interest

6. Conclusion
The authors whose names are listed immediately below certify
This paper presents a critical discussion on pipeline ETAs
that they have NO affiliations with or involvement in any orga-
accounting for a comprehensive description of possible outcomes
nization or entity with any financial interest (such as honoraria;
from accidents on high-pressure buried Natural Gas pipelines. The
educational grants; participation in speakers’ bureaus; member-
structure of a bow-tie was created in order to represent graphically
ship, employment, consultancies, stock ownership, or other equity
the relationships between possible threats (or causes of damage),
interest; and expert testimony or patent-licensing arrangements),
outcomes and barriers that can be used for optimum decision mak-
or non-financial interest (such as personal or professional relation-
ing in both design and operation both in prevention and mitigation,
ships, affiliations, knowledge or beliefs) in the subject matter or
accounting for technical and cost-effectiveness constraints. We
materials discussed in this manuscript.
focused on ignition probability and the physical conditions of the
release, in order to identify the actual threats arising from a pipeline
LOC under the different situations. References
The main implication of the application of the new PETA, are
Ahmadi, O., Bagher, S., Hasan, M., Mahabadi, A., Hosseinpouri, M., 2020. Devel-
mainly connected to flash fire scenarios and can be summarized as opment of a dynamic quantitative risk assessment methodology using fuzzy
follows: DEMATEL-BN and leading indicators. Process. Saf. Environ. Prot. 142, 15–44.

267
T. Vairo et al. Process Safety and Environmental Protection 149 (2021) 258–268

Allenby, G., Rossi, P., Mc Culloch, R., 2005. Hierarchical Bayes models: a practitioners Lu, L., Liang, W., Zhang, L., Zhang, H., Lu, Z., Shan, J., 2015. A comprehensive risk
guide. J. Bayesian Appl. Market., 1–4. evaluation method for natural gas pipelines by combining a risk matrix with a
Amin, Md. t., Khan, F., Ahmed, S., Imtiaz, S., 2020. A novel data-driven methodology bow-tie model. J. Nat. Gas Sci. Eng. 25, 124–133.
for fault detection and dynamic risk assessment. Can. J. Chem. Eng., 1–20. Milazzo, M.F., Vianello, C., Maschio, G., 2015. Uncertainties in QRA: analysis of losses
Aven, T., 2014. What is safety science? Saf. Sci. 67, 15–20. of containment from piping and implications on risk prevention and mitigation.
Brito, A.J., de Almeida, A.T., 2009. Multi-attribute risk assessment for risk ranking of J. Loss Prev. Proc. Ind. 36, 98–107.
natural gas pipelines. Reliab. Eng. Syst. Saf. 94, 187–198. Moosemiller, M., 2011. Development of algorithms for predicting ignition probabil-
Bubbico, R., Carbone, F., Ramírez.-Camacho, J.G., Pastor, E., Casal, J., 2016. Conditional ities and explosion frequencies. J. Loss Prev. Process Ind. 24, 256–265.
probabilities of post-release events for hazardous materials pipelines. Process. Muhlbauer, W.K., 2004. Pipeline Risk Management Manual, third ed. Gulf Publishing
Saf. Environ. Prot. 104, 95–110. Company, Burlington.
Cagno, E., Caron, F., Mancini, M., Ruggeri, F., 2000. Using AHP indetermining the prior OREDA Handbook, 2015. Offshore and Onshore Reliability Data, 6th ed.
distributions on gas pipeline failures in a robust Bayesian approach. Reliab. Eng. O’Rourke, Gadicherla, V., Abdoun, T., 2005. Centrifuge modeling of PGD response of
Syst. Saf. 67, 275–284. buried pipe. Earthq. Eng. Eng. Vib. 4, 69–73.
Cermelli, D., Currò, F., Vairo, T., Fabiano, B., 2018. Hydrogen jet-fire: accident inves- Otegui, J.L., 2014. Challenges to the integrity of old pipelines buried in stable ground.
tigation and implementation of safety measures for the design of a downstream Eng. Fail. Anal. 42, 311–323.
oil plant. Chem. Eng. Trans. 67, 415–420, http://dx.doi.org/10.3303/CET1867070, Palazzi, E., Currò, F., Reverberi, A., Fabiano, B., 2014. Development of a theoretical
In this issue. framework for the evaluation of risk connected to accidental oxygen releases.
Chen, C., Li, C., Reniers, G., Yang, F., 2021. Safety and security of oil and gas pipeline Process. Saf. Environ. Prot. 92, 357–367.
transportation: a systematic analysis of research trends and future needs using Palazzi, E., Caviglione, C., Reverberi, A.P., Fabiano, B., 2017. A short-cut analytical
WoS. J. Clean. Prod. 279, 123583. model of hydrocarbon pool fire of different geometries, with enhanced view
Chiarioni, A., Reverberi, A.P., Fabiano, B., Dovì, V.G., 2006. An improved model of an factor evaluation. Process. Saf. Environ. Prot. 110, 89–101.
ASR pyrolysis reactor for energy recovery. Energy 2006 (31), 2460–2468. Papadakis, G., 1999. Major hazard pipelines: a comparative study of onshore trans-
Concawe, 2018. Report: European Downstream Oil Industry Safety Performance, mission accidents. J. Loss Prev. Process Ind. 12, 91–107.
Statistical Summary of Reported Incidents. Concawe, Brussels. Papadakis, G., 2000. Assessment of requirements on safety management systems in
DNV, 2007. PHAST Professional User Manual. DNV Software, Oslo, DNV. EU regulations for the control of major hazard pipelines. J. Hazard. Mater. 78,
Dorao, C.A., Fernandino, M., 2011. Simulation of transients in natural gas pipelines. 63–89.
J. Nat. Gas Sci. Eng. 3, 349–355. Park, K.-S., Lee, J.-H., Jo, Y.-D., 2004. An approach to risk management of city gas
Duncan, I.J., Wang, H., 2014. Estimating the likelihood of pipeline failure in CO2 pipeline. Process. Saf. Environ. Prot. 82, 446–452.
transmission pipelines: new insights on risks of carbon capture and storage. Int. Pesce, M., Paci, P., Garrone, S., Pastorino, R., Fabiano, B., 2012. Modelling ignition
J. Greenh. Gas Control. 21, 49–60. probabilities in the framework of quantitative risk. Assessments Chem. Eng.
EGIG, European Gas Pipeline Incident Data Group, Groningen, NL 2014. Gas Trans. 26, 141–146.
Pipeline Incidents: 9th Report of the European Gas Pipeline Incident Data Pontiggia, M., Vairo, T., Fabiano, B., 2019. Risk assessment of buried natural gas
Group.14.R.0403. pipelines. Critical aspects of event tree analysis. Chem. Eng. Trans. 77, 613–618,
EGIG, European Gas Pipeline Incident Data Group, Groningen, NL 2019. Gas Pipeline http://dx.doi.org/10.3303/CET1977103, In this issue.
Incidents: 10th Report of the European Gas Pipeline Incident Data Group VA Siler-Evans, K., Hanson, A., Sunday, C., Leonard, N., Tumminello, M., 2014. Analysis of
17.R.0395. pipeline accidents in the United States from 1968 to 2009. Int. J. Crit. Infrastruct.
Energy Institute, EI London, UK 2006. Guidance on Assigning Ignition Probabilities in Prot. 7, 257–269.
Onshore and Offshore Quantitative Risk Assessments (supersedes First Edition: - Sklavonous, S., Rigas, F., 2006. Estimation of safety distances in the vicinity of fuel
EI Research Report: Ignition Probability Review, Model Development and Look- gas pipelines. J. Loss Prev. Process Ind. 19, 24–31.
up Correlations). Stephens, M.J., 2000. A Model for Sizing High Consequence Areas Associated With
Fang, W., Wu, J., Bai, Y., Zhang, L., Reniers, G., 2019. Quantitative risk assessment of Natural Gas Pipelines, GRI Report No. GRI-00/0189.
a natural gas pipeline in an underground utility tunnel. Process. Saf. Prog. 38, Taylor, J.R., 1994. Risk Analysis for Process Plants, Pipelines and Transport. E & FN
12051. Spon, London, UK.
Hill, R.T., Catmur, J.R., 1994. Risks from Hazardous Pipelines in the United Kingdom Townsend, N.A., Fearnehough, G.D., 1986. Control of risks from UK gas. Transmission
Health and Safety Executive Contract Research Report No 82/1994. HSE, UK. pipelines. In: Proceedings 7th Symposium on Line Pipe Research, AGA, Houston,
HSE, 2000. Report on a study of international pipeline accidents. In: Mechphyic TX.
Scientific Consultants for the Health and Safety Executive, Contract Research U.S. Department of Transportation, Pipeline and Hazardous Materials Safety Admin-
Report 294/2000, Chester, U.K. istration, Office of Pipeline Safety, 2013. Building, Safe Communities: Pipeline
HSE, 2015. Review of the Event Tree Structure and Ignition Probabilities Used in Risk and Its Application to Local Development Decisions.
HSE’s Pipeline Risk Assessment Code MISHAP, RR1034 Research Report. Health Uijt de Haag, P.A.M., Ale, B.J.M., 1999. Guidelines for Quantitative Risk Assessment
and Safety Laboratory, U.K. (TNO Purple Book). Committee for the Prevention of Disasters, the Netherlands,
IGEM, Available at 2015. Assessing the Risks from High Pressure Natural Gas The Hague.
Pipelines. Institution of Gas Engineers & Managers https://standards.globalspec. Vairo, T., Del Giudice, T., Quagliati, M., Barbucci, A., Fabiano, B., 2017a. From land-
com/std/10018424/TD/2. to water-use-planning: a consequence based case-study related to cruise ship
IGU, Available at: 2019. World Lng Report 2019 International Gas Union risk. Saf. Sci. 97, 120–133.
Ed. https://www.igu.org/sites/default/files/node-news item-field file/ Vairo, T., Magrì, S., Quagliati, M., Reverberi, A.P., Fabiano, B., 2017b. An oil pipeline
IGU%20Annual%20Report%202019 23%20loresfinal.pdf. catastrophic failure: accident scenario modelling and emergency response
IP-UKOOA Research Report, 2006. Ignition Probability Review, Model Development development. Chem. Eng. Trans. 57, 373–378.
and Look-up Correlations. Energy Institute, London, UK, January. Vairo, T., Milazzo, M., Bragatto, P., Fabiano, B., 2019. A dynamic approach to fault tree
Jones, D.A., Fearnehough, G.D., 1986. Natural gas transmission by pipelines. In: 5th analysis based on bayesian beliefs networks. Chem. Eng. Trans. 77, 829–834.
International Symposium on Loss Prevention and Safety. AGA, Houston, USA. Vianello, C., Maschio, G., 2011. Risk analysis of natural gas pipeline: case study of a
Khan, F.I., Abbasi, S.A., 2001. Analytical simulation and PROFAT II:a new methodol- generic pipeline. Chem. Eng. Trans. 24, 1309–1314.
ogy and a computer automated tool for fault tree analysis in chemical process Xu, Y., Huang, Y., Ma, G., 2019. A review on effects of different factors on gas explo-
industries. J. Hazard. Mater. A75, 1–27. sions in underground structures. Undergr. Space, http://dx.doi.org/10.1016/j.
Kishawy, H.A., Gabbar, H.A., 2010. Review of pipeline integrity management prac- undsp.2019.05.002, in press.
tices. Int. J. Press. Vessel. Pip. 87, 373–380. Yanbao Guo, Y., Meng, X., Meng, T., Wang, D., Liu, S., 2016. A novel method of risk
Kletz, T.A., 11, p. 50, New York, USA 1977. Unconfined Vapour Cloud Explosions, assessment based on cloud inference for natural gas pipelines. J. Nat. Gas Sci.
AIChE Loss Prevention. Eng. 30, 421–429.
Kooi, E., Laheij, G., Uijt de Haag, P., 2015. QRA method for land-use planning around Yuhu, D., Huilin, G., Jing’en, Z., Yaorong, F., 2003. Mathematical modelling of gas
natural gas production, processing and transportation sites in the Netherlands. release through holes in pipelines. Chem. Eng. J. 92, 237–241.
In: 25Th Institution of Chemical Engineers Symposium on Hazards 2015 (HAZ- Yuhua, D., Datao, Y., 2005. Estimation of failure probability of oil and gas trans-
ARDS 25), Institution of Chemical Engineers Symposium Series 160, Edinburgh, mission pipelines by fuzzy fault tree analysis. J. Loss Prevent Process Ind. 18,
UK, pp. 84–94. 83–88.
Lees, 2012. Lees’ Loss Prevention in the Process Industries: Hazard Identification, iv Zhou, Z., Zhou, J., Fan, H., Jin, F., Xu, Y., 2016. Shock wave pressure analysis of
edition. Butterworth-Heinemann, pp. 1511, Chapter 17 Explosion. underground structure associated with buried natural-gas pipeline explosion.
Li, F., Wang, W., Dubljevic, S., Khan, F., Xu, J., Yi, J., 2019a. Analysis on accident- International Conference on Architectural Engineering and Civil Engineering
causing factors of urban buried gas pipeline network by combining DEMATEL, (AECE-16) Advances in Engineering Research (AER), 72., pp. 311–314.
ISM and BN methods. J. Loss Prev. Process Ind. 61, 49–57.
Li, F., Wang, W., Xu, J., Yi, J., Wang, Q., 2019b. Comparative study on vulnerabil-
ity assessment for urban buried gas pipeline network based on SVM and ANN
methods. Process. Saf. Environ. Prot. 122, 23–32.

268