lable at ScienceDirect

Journal of Loss Prevention in the Process Industries 32 (2014) 5e17

Contents lists avai

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier .com/locate/ j lp

Quantitative risk assessment of the Italian gas distribution network

Chiara Vianello, Giuseppe Maschio*

Dipartimento di Ingegneria Industriale, University of Padova, Via F. Marzolo, 35131 Padova, Italy

a r t i c l e i n f o

Article history:Received 23 December 2013Received in revised form11 June 2014Accepted 12 July 2014Available online 25 July 2014

Keywords:Natural gasSafetyRisk analysisHazmatLand-use planning

* Corresponding author. Tel.: þ39 0498275835; faxE-mail address: giuseppe.maschio@unipd.it (G. Ma

http://dx.doi.org/10.1016/j.jlp.2014.07.0040950-4230/© 2014 Published by Elsevier Ltd.

a b s t r a c t

European Critical Infrastructures include physical resources, services, information technology facilities,networks and infrastructure assets, which, if disrupted or destroyed would have a serious impact on thehealth, safety, security, economic or social well-being of the Member States.

The gas distribution network is a critical infrastructure and its failure can cause damage to structuresand injury to people.

The aim of this paper is to analyze and then assess the risk of the Italian high pressure natural gasdistribution network.

The paper describes an application of a methodology for quantitative risk assessment.Failure frequencies considered in risk calculation were found in the European Gas pipeline Incident

data Group (EGIG) database, whereas consequences were computed as a function of pipe diameter andoperating pressure for each section of the network. The results of this quantitative risk assessment is thedetermination of local and social risks for the Italian North East Area.

© 2014 Published by Elsevier Ltd.

1. Introduction

European Critical Infrastructures include those physical re-sources, services, information technology facilities, networks andinfrastructure assets, which, if disrupted or destroyed would have aserious impact on the health, safety, security, economic or socialwell-being of the Member States.

The gas distribution network is a critical infrastructure and itsfailure can cause damage to structures and injury to people.

The quantity of natural gas transported in the European Unionand in the industrialized Countries is progressively increasing. Asthe volumes of gas transported from one site to another isincreasing, also the awareness of the risk posed by these activitieshas grown within the operators and the population potentiallyexposed (Erkut & Alp 2007; HSE 1991, p. 68; Kara & Verter, 2004).

Therefore, the problem of the safety and security of the naturalgas distribution infrastructure must be adequately investigated.

Despite the low number of accidents that occurred in thetransportation of natural gas (CCPS 1995, p. 382; TNO, 1999), someserious incidents have confirmed that the transportation of haz-ardous materials has the potential to pose a high risk to thepopulation.

Two particularly relevant pipeline incidents occurred in 2004:the explosion of a major underground high pressure natural gas

: þ39 0498275461.schio).

pipeline in Ghislenghien industrial park, near Ath, about 50 km (30miles) south-west of Brussels, Belgium (HInt Dossier, 2005) and apipeline rupture (ammonia) near Kingman, Kansas (http://www.ntsb.gov/investigations/fulltext/PAB0702.htm).

Other incidents involved road and rail transportation of fuels,such as in Viareggio (Italy) (Landucci et al., 2011) and Lac M�egantic(Canada, 2014).

The safety aspects of pipelines conveying dangerous substancesare not covered in specific EU regulations. It must be highlightedthat the Seveso III Directive (DIRECTIVE 2012/18/EU) aims to pre-vent major accidents at industrial facilities, whereas transport bypipeline is not included. Pipeline safety is else not included in otherEU regulations such as the Pressure Equipment Directive (PED).

Already during the discussion on the Seveso II Directive, theEuropean Parliament was keen to have pipelines included and theCommission was asked to look into the subject. At that time, theconclusion that emerged from the studies pointed out certain gapsin national legislation. These considerations, coupled with histori-cal data, have led researchers of many countries to explore andevaluate transfers of hazardous materials by different transportmodes (road, rail, waterway, pipeline, sea and air) with quantitativerisk analysis (QRA) methodologies.

In fact, the same kind of accidental scenarios, in terms of fre-quency and severity, may occur both in fixed plants and in trans-portation systems. Additionally transport accidentsmay occur closeto, and sometimes within, densely populated areas (Fabiano, Curr�o,Palazzi, & Pastorino, 2002).

Table 1Properties of natural gas.

Properties Value for NG

Relative molar mass 17e20Relative density NG, 15 �C 0.72e0.81Relative density LNG, 15 �C 424.2Boiling point, �C �162Vapour flammability limits, volume % 5e15Flammability limits 0.7e2.1Lower heating/calorific value, MJ/kg 38e50Autoignition temperature, �C 540e560Octane number 120e130Methane number 69e99Stoichiometric lower heating value, MJ/kg 2.75

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e176

The development of tools both for the risk assessment and theperformance evaluation of preventive and protective measures inthe transportation of hazardous materials is thus an issue of pri-mary concern. The results of several comprehensive quantitativerisk assessments in areas where a high concentration of siteshandling and storing hazardous substances is present, confirm thesignificant contribution of transportation hazards on the definitionof the overall risk profile (Bubbico, Maschio, Mazzarotta, Milazzo,&Parisi, 2006; Egidi, Foraboschi, Spadoni, & Amendola, 1995;Milazzo, Lisi, Maschio, Antonioni, & Spadoni, 2010). In particularfor the transport of substances via pipeline, these data areconfirmed through accidental historical analysis (Brito &Dealmeida, 2009; CONCAWE, 2011; Dziubinski, Fratczak, &Markowski, 2006; EGIG, 2011; Montiel, Vílchez, Arnaldos, &Casal, 1996; OGP, 2010).

Risk-based optimization of the design of on-shore pipelineshutdown systems is described in Medina, Arnaldos, Casal,Bonvicini, & Cozzani (2012).

Several of such studies pointed out that the risk due to trans-portation activities is comparable or evenmore critical than the riskdue to fixed installations. Several of such studies pointed out thatthe risk due to transportation activities is comparable or evenmorecritical than the risk due to fixed installations. For this reason, somecomprehensive methodological approaches for transportation riskanalysis were proposed (Center for Chemical Process Safety, 1995,p. 382; Han&Weng, 2010; Health and Safety Executive,1991, p. 68;TNO, 1999).

A natural gas pipeline is designed to allow gas transport fromlocations situated at large distances. The characteristic size of a gastransmission pipeline can range up to several hundred centimetresin diameter and several thousand kilometres in length. The pipelinemay cross both rural and heavily population areas. Failure of thepipeline can lead to various outcomes, some of which can pose asignificant threat to people and buildings in the immediate prox-imity of the failure location.

This paper presents the risk assessment of the Italian gas dis-tribution network, specifically focuses on the methodologies andresults of a quantitative risk analysis.

Section 2 describes the properties of natural gas and the char-acteristics of transportation by pipeline.

Section 3 describes the adopted risk analysis methodologies andthey are been implementation to this case study.

In Section 4 a quantitative risk analysis (QRA) of the Italian NGdistribution network is carried out.

In particular, the study aims to show the results of local risk andsocietal risk for the case study, and then the obtained results arecompared with acceptability criteria.

2. Natural gas transport by pipeline

2.1. Natural gas

The natural gas distribution network is considered conventionalin that its presence and use of this substance takes place from 19thcentury.

Currently natural gas is transported in gaseous phase by pipe-lines or in the liquid state by tankers (LNG).

Natural gas exists in nature under pressure in rock reservoirs inthe Earth's crust, either dissolved in heavier hydrocarbons andwater or by itself. Natural gas is colourless, odourless, tasteless,shapeless, and lighter than air.

The main component principal constituent of natural gas ismethane, about 70e90%. Other components are light paraffinichydrocarbons such as ethane, propane, and the butanes. Manynatural gases contain nitrogen as well as carbon dioxide and

hydrogen sulfide (Saeid Mokhatab, Poe,& James, 2006). Natural gasis treated to remove carbon dioxide, nitrogen and hydrogen sul-phide, which is a toxic and corrosive gas.

During last decades, in the natural gas supply chain, thecontribution of liquefied gas (LNG) has increased. To produce LNG,natural gas is piped from the wellhead to a liquefaction plant at acoastal location and then it is cooled at very low temperatures(approximately �160 �C).

The LNG is then loaded into specialized LNG tankers and ship-ped. Upon reaching its destination, the LNG is offloaded at areceiving terminal and re-gasified to be delivered into the localpipeline and storage network. Within this network, the transportedgas becomes completely integrated with the locally produced orpipeline-imported natural gas supplies.

The properties of Natural Gas are shown in Table 1.Since LNG and NG are the same substance, they have the same

properties and the only difference is their relative density.Mixed with air, methane is flammable in a concentration range

from 5% to 15%. Below 5%, the amount of natural gas is not sufficientto support combustion, while above 15% there is not enough oxy-gen. At a temperature of 15 �C and atmospheric pressure, 1 cubicmetre of methane generates over 33.5MJ. Under these conditions,1cubic metre of natural gas has an energy content equal to 1.2 kg ofcoal and 0.83 kg of oil.

2.2. The Italian national gas pipeline network

The transport of natural gas in Italy is an integrated servicewhich involves the transport of the gas delivered to Snam Rete GasS.p.A. at the entry points of the National Network (connected withthe Import lines from Russia, Northern Europe and North Africa,with the re-gasification plants and the production and storagecentres located in Italy) up to the redelivery points of the RegionalNetwork, (connected to local distribution utilities and large in-dustrial and power plants) where the gas is redelivered to the usersof the service.

The natural gas injected into the National Network originatesfrom imports and, to a lesser extent, the national production. Theimport gas is injected into the National Network via eight entrypoints where the network joins up with the import pipelines(Tarvisio, Gorizia, Passo Gries, Mazara del Vallo, Gela) and the twoLNG regasification terminals (Panigaglia, Cavarzere). Domesticallyproduced gas is introduced into the Network through 51 entrypoints from the production fields or their collection/treatmentplants; natural gas storage fields are also connected to the trans-mission network.

Legislative Decree no. 164 of 23 May 2000 (the so-called LettaDecree) divided the Italian pipelines network into a National GasPipeline Network (of approximately 8800 km) and a RegionalTransmission Network (of more than 22,600 km). The National Gas

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e17 7

Pipeline Network, managed by Snam Rete Gas consists mainly ofpipes, which usually have a large diameter (DN 900e1400 mm),used to transport quantities of gas from the entry points (importsand main domestic production) to the interconnection points withthe Regional Transmission Network and storage facilities. The maincharacteristics of the national network are summarized in Table 2.

The national gas pipeline network is shown in Fig. 1.In the figure, the solid lines represent the national distribution

network, the dashed lines indicate the pipelines under construc-tion. The network also includes interregional pipelines used toreach key consumer areas.

The regional transportation network, consisting of the otherparts of its pipelines, allows the transportation of natural gas inspecific areas to supply industrial consumers, power plants andurban distribution networks.

3. Quantitative risk assessment

Quantitative risk assessment (QRA) is a formalized specialistmethod for calculating individual, environmental, employee andpublic risk levels for comparison with regulatory risk criteria. QRAcan be defined as the formal and systematic approach of identifyingpotentially hazardous events, estimating the likelihood and con-sequences of those events, and expressing the results as risk topeople, the environment or the infrastructures. A general classifi-cation of methodologies used for risk assessment is described byDziubi�nski et al., 2006.

The risk analysis for gaseous substances transported by pipeline(INTeg-Risk, 2012) can be summarized as follows:

� description of the system;� risk identification;� estimation of failure frequency;� estimation of consequences.

In the following paragraphs, the quantitative risk assessment isapplied to the case study of a gas pipeline network.

3.1. Risk identification: event tree analysis

The first step of QRA is the risk identification. One of the mostfrequently used methods in this stage is the historical analysis ofaccidents (Markowski, 2000; Sklavounos & Rigas, 2006). The his-torical analysis of accidents was performed using a conformancetest of the technical documentation with legal requirements (API,2008; http://www.asme.org, n.d.) and ‘‘scoring’’ methodology forrelative risk assessment (Borysiewicz & Potempski, 2001;Muhlbauer, 1996).

Event Tree Analysis (ETA) used in this work is a formal techniqueand one of the standard approaches used when performing in-dustrial incidents investigation as well as pipeline risk assessment(Borysiewicz and Potempski, 2001; Muhlbauer, 1996). ETA is a logicsequence that graphically portrays the combination of events andcircumstances in an accident sequence. It is an inductive method,which begins with an initial undesirable event andworks towards a

Table 2Operating conditions and diameters of natural gas pipeline network.

Pipeline system Pressure (bar) Diameter (cm)

Nominal Operating

National Network 70 50 90e140Regional Network 25 20 25e20Local distribution 5 4 8e15

result (outcome); each branch of the Event Tree represents aseparate accident sequence (CCPS, 1995, Vianello and Maschio,2011). Fig. 2 shows a simplified event tree for a release from anatural gas pipeline, as proposed by Mathurkar and Gupta (2006).

More detailed event trees are described in literature (Shahriaret al., 2012). Generally the possibility to get a fire or a vapour ex-plosion depends on the level of congestion/confinement in thesurroundings of the release. Additionally, it is expected that a jetfire can develop following a VCE. However, the most of the pipe-lines are typically located in areas with low density of congestion,thus the case can be treated in a simplifiedway for the evaluation ofthe risk area.

Immediate ignition of a release can result in a jet fire or fireball,and, in this case, thermal radiation can affect people and buildingsin the vicinity of the release.

Delayed ignition can occur when the released gas finds anignition source after being dispersed in the atmosphere for severalminutes. Asmethane is lighter than air, delayed ignition is expectedto produce a flash fire 90% of the time, and a vapour cloud explosion(VCE) only 10% of the time.

3.2. Estimation of failure frequency

An important step for risk assessment, in particular to calculatethe local risk, is the failure frequency of the equipment.

The commonly used techniques are based on generic dataavailable in literature (HSE & Contract Research Report 210, 1999),specific studies (Jo & Ahn, 2005; Jo & Crowl, 2008; Sklavounos &Rigas, 2006; Slater, Cox, Comer, & Pyman, 1979), reliabilitymodels using fault and event tree analysis (Metropolo & Brown,2004; Yuhua & Datao, 2005) and technique based on inspectionactivity (API, 2008).

The data used in this study were derived from the 8th EGIGreports (EGIG, 2011) and the OGP reports (OGP, 2010), that containinformation on pipelines and incidents.

Table 3 shows the single causes of failure that may lead to therupture of a pipeline and the relative probabilities of occurrence.

The calculation of the safety indicators, namely the primaryfailure frequency, refers to two notions: the total system exposureand the number of incidents.

The primary failure frequency is the result of the number ofincidents within a period divided by the corresponding totalexposure.

Table 4 shows the primary failure frequency of different periodsas reported in the 8th EGIG report (2011).

Over the years, the frequencies of occurrence have been reducedfollowing the introduction of stringent measures for riskprevention.

As proposed by Mathurkar and Gupta (2006) the catastrophicrupture accounts for 13% of the cases and the remaining 87% ofcases occur through the release from crack or hole in pipelines.

Ruptures with ignition can cause severe social damages. This isespecially the case of pipelines with large diameters. In this case gasreleases are more likely to ignite than releases from small diameterpipeline. It can be noticed that higher pressure are typically used inlarger pipelines.

In the risk estimation of the network, it is considered that thefull bore rupture has an ignition probability of 33%, generally thecomplete rupture of a pipeline is considered when the hole is largerthan 460 mm. For release from a hole, an ignition probability equalto 10% (EGIG, 2011) is assumed .

With data of ignition probability and likelihood from the eventtree reported in Fig. 2, it is possible to calculate the frequency ofeach scenario, taking into account the frequency of breakage of thelast period reported in Table 4 (2006e2010). The frequency of

Fig. 1. Italian National gas pipeline e Import points : 1 Tarvisio, 2 Gorizia, 3 Passo Gries, 4 Mazzara del Vallo, 5 Gela; LNG regasification terminals : 6 Panigaglia, 7 Cavarzere.

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e178

prior periods were not chosen because in recent years olderpipelines have been replaced with new pipeline of differentmaterial.

In Table 5, for each event considered in the event tree, the valuesof frequency for each scenario are reported.

Considering the aforementioned frequencies of occurrence andcalculating the probability of harm or death, it is possible to esti-mate the local risk as a function of the distance from the releasepoint.

Fig. 2. Natural gas pipeline event tree.

3.3. Estimation of consequences: modelling releases from buriedpipeline

Release modelling e also called discharge or source termmodelling e is mainly used to determine the rate at which a fluid isreleased to the environment due to a loss of containment, togetherwith the associated physical properties (e.g. temperature,momentum).

According to the Decree of 17 April 2008 (Ministero dellosviluppo economico, 2008), in Italy the pipelines must be buriedto a depth normally not less than 0.90 m. For high-pressure pipe-lines an average depth of 1.5 m is assumed. This condition must be

Table 3Primary failure frequency per causes in different periods.

Cause/Period Primary failure frequency per 1000 km year

1970e2010 2006e2010

External interference 0.170 0.057Corrosion 0.057 0.040Construction defect 0.059 0.031Hot tap made by error 0.017 0.011Ground movement 0.026 0.015

Fig. 3. Simplified scheme of release directions for a leak from buried pipeline, usingfour quadrants.

Table 6Damage thresholds.

Physical Thermal radiation/ Probability

Table 4Primary failure frequency of different period.

Period Number ofincident

Total systemexposure [km*years]

Failurefrequency[km*years]

1970e2010 1172 3.15$106 3.7$10�4

2001e2010 207 1.24$106 1.67$10�4

2006e2010 106 0.65$106 1.61$10�4

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e17 9

taken into account in modelling release from pipelines (OGP, 2010).In the OPG report, a detailed description of the release modelling ispresented. In this paper the results of the modelling of the OPGreport were adopted after verifying their reliability using PHAST.

The modelling of releases from underground pipelines has beencarried out for:

� Full bore rupture;� Large medium hole;� Small hole.

In the case of full bore rupture and large hole, the consequentreleases have sufficient force to throw out the overburden, ashappened in several incidents investigated by the National Trans-port Safety major cause of accidents in the pipeline network is dueto external interference of third party activity, such as excavation,and then the ground above the pipe is removed from this activity.

For small losses horizontal or downward, the force exerted bythe flow is unlikely to throw out the cover layer, then the flow willbe released slowly to the surface. Therefore in the risk assessmentsmall losses were not considered.

For full bore rupture, the consequences can be modelled as:

1. Initial high flow rate: consider immediate ignition as a fireball,using mass released given the time as the fireball mass.

2. Ensuing lower flow rate(s): model dispersion and delayedignition with low momentum (velocity) as the flows from bothsides of the broken pipe are likely to interact.

The approach to modelling the release from medium or largehole considers a simplified schematization of the pipeline, Fig. 3,based on the division into quadrants of release directions.

The consequences can be modelled as follows:

1 Vertical release: Model as vertical release (upwards) withoutmodification of normal discharge modelling output, i.e. fulldischarge velocity.

2, 3 Horizontal release: Model at angle of 45� upwards with ve-locity of 70 m/s.

4 Downward release: Model as vertical release (upwards) withlow (e.g. 5 m/s) velocity to reflect loss of momentum onimpact with ground beneath.

Considering the pipe divided into four quadrants, the proba-bility that a release originates has originated from each quadrant is

Table 5Frequency of top events.

Consequence Probabilityof event [%]

Frequency [event/km*year]

Releasefrom hole

Catastrophicrupture

Fireball e Jet fire 30.00% 2.87$10�6 1.42$10�6

VCE 5.60% 5.36$10�7 2.64$10�7

Flash Fire 50.40% 4.82$10�6 2.38$10�6

No hazard 14.00% 1.34$10�6 6.61$10�7

equal to 25%. Thus for the vertical release (zone 1) the probability is25%, the horizontal release (zone 2 and 3) is 50% and the downwardrelease is 25%. These probabilities will be used to calculate the localrisk.

The consequences of the release can bemodelled by consideringthree different kind of release: horizontal, vertical and downward.The downward release has not been considered since its rate is verylow and therefore the calculated contribution of the consequencesdo not affect the calculation of the local risk.

Other assumptions were used in the consequence calculationand were discussed in a previous paper of Vianello and Maschio(2011).

In this work, the software used for the consequence simulationis PHAST version 6.4 (DNV software).

The scenarios which follow the top event and are obtained fromthe event tree, are:

� Jet fire� VCE� Flash Fire.

For each event, Table 6 shows the damage thresholds and theprobabilities of fatalities in relation to vulnerability models pro-posed by Jo and Ahn (2005).

The vulnerability models for fire and explosion scenarios arepublished by TNO (1999), where the dose concept and the Probitfunctions are used.

Results were inserted in ArcMap (ArcGIS) through the conver-sion in a database format. These tables were related to thegeographical information about the network and, through the tool“Buffer Wizard”, it was possible to create the damage zones cor-responding to the distance calculated with PHAST for each sectionof pipeline.

4. Case study: quantitative area risk assessment

In this section, the analysis is focused on the Italian North EastArea (Fig. 4). This is a strategic area in the system of Italian NG supply

phenomena overpressure level of fatalities [%]

Explosion 0.3 bar 1000.16 bar 10.07 bar 0

Jet fire 38.5 kW/m2 9919.5 kW/m2 5012.5 kW/m2 6.59.8 kW/m2 15 kW/m2 0

Flash Fire LFL 100½ LFL 0

Fig. 4. Italian Northern Eastern Area pipeline network.

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e1710

because of the presence of two import points (Tarvisio and Gorizia)and of one re-gasification terminal (Porto Viro e Adriatic LNG).

In this area the national grid passes close to towns and terri-tories with different population densities and it is thereforepossible to study different scenarios related to the leakage ofpipeline network transporting natural gas.

In addition the Region Friuli-Venezia Giulia is an area subjectedto earthquakes.

The network, located in the Northern Eastern part of Italy, is alsovulnerable to other risks of disruption because of the occurrence ofa lack of gas supply due to social and political problems, such as theUkraineeRussia crisis occurred in past years (Vianello & Maschio,2011) and returned to these days of great actuality. For thisreason an LNG terminal was located in this area.

For the risk assessment of the national network, the seasonalaverage weather conditions of each region were considered. Thedata were found in the report prepared by ISPRA (2008).

In this study the annual average temperature and annualaverage humidity of the Northern Eastern Italian regions weretaken into account.

The roughness of the terrainwas assumed constant and equal to180 mm, which corresponds to rural land with poor edification.

For the release of natural gas, wind direction and speed do notaffect the calculation of consequences, characterized manly by ef-fects of thermal radiation and explosion. However, in case adispersion occurs, these parameters would be important for thecalculation and the development of a cloud.

Therefore the simulations were conducted with a mean windspeed of 1.5 m/s and Pasquill stability class F.

The results, reported in the following sections, refer to a portionof the Italian network, Fig. 5, crossed from several parts of pipelineshaving different size.

4.1. Analysis of the consequences of release

The following figures highlight that for each section the con-sequences results are different because the release calculation is a

function of diameter, pressure, length of each pipeline (Figs. 6and 7).

Vertical release consequences, related to thermal radiation ofthe jet fire, are lower than those of horizontal releases since thedirection of the jet is different. For vertical jet fires, there are noconsequences for a higher thermal strength up to 12.5 kWm�2

(Figs. 8 and 9).The model used for the calculation of the explosions is the Baker

e Strehlow model which takes account of the confinement and ofthe underground pipeline. The volume is then calculated with thefollowing formula:

V ¼ p*L*��

dpipe�2�þ ddept

�

where L is the length of the pipe, dpipe is the internal diameter of thepipe and ddepth is the average depth of 1.5 m.

Vapour Cloud Explosions generated by vertical releases produceconsequences comparable to those of horizontal releases, becausethe explosive mass spilled from the pipeline is equivalent (Figs. 10and 11).

The consequences of the flash fires from vertical releases aresimilar to those of horizontal releases.

From the analysis of the results of the simulations, the conse-quences of the explosions are lower compared to those of flash firesbecause the area involved by this scenario is lower than in the caseof the flash fire.

In conclusions the flash fire represents the most severe acci-dental scenario produced by a release of natural gas.

4.2. Risk evaluation

The risk assessment includes the identification and evaluationof the likely accidental scenarios (releases, fire and explosionevents, their probabilities and consequences) for each fixedinstallation and each type of transport.

The quantitative area risk evaluation is necessary to identify themeasures of local (LR), individual risk (IR) and the F/N curvesrelevant to the societal risk, that are used as indicators of the area

Fig. 5. Case study: portion of the Italian network.

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e17 11

risk resulting from the merging of point risk sources (plants) andlinear risk sources (different ways of transportation). The followingsection describes the methodology to determinate the local risk,societal risk and the results obtained. In this study only the linearsources are accounted for.

Fig. 6. Jet fire from ho

4.2.1. Local riskLocal risk is defined as the likelihood per year that a personwho

is continuously and without protection at that location, is fatallyinjured as a consequence of an event at the transportation routeleading to the release of a dangerous material.

rizontal release.

Fig. 7. Jet fire from vertical release.

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e1712

The outdoor LR in a generic point P of a territory is the sum ofthe risks into it generated by each source present in the area. It iscalculated through two steps:

� LR assessment induced by a single branch and a specific type ofsubstances carried;

� Extension of the evaluation to all branches and all types ofsubstances transported.

Fig. 8. Vapour cloud explosion

The procedure for determining the local risk is described in thePurple Book by TNO (TNO, 1999).

By identifying the areas indicated in Table 7 for the release fromthe hole and release from full bore rupture and then the type ofevent, the local risk was calculated by using the equation.

LRx ¼Xn

i¼1

fi$Pi (1)

from horizontal release.

Fig. 9. Vapour Cloud Explosion from vertical release.

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e17 13

Where x is distance from pipeline (zone 1,2…), fi is the frequency ofthe event and Pi is the probability of fatalities or damages.

Fig. 12 shows the results of the total local risk for a section of thenetwork due to the release from hole.

The previous figure highlights that the values for LR are differentfor each section, since the consequences of releases depend on thediameter, length, pressure and pumped flow.

Higher values of LR, ranging from 5 � 10�6 to 1 � 10�6, areassociated to the tract of pipeline of larger diameter and higheroperative pressures (Pipe 55, 57, 126, 128).

Fig. 10. Flash fire from

In European Countries the value of the individual risk consid-ered to be acceptable in regulating industrial risk is different foreach Country (Hill & Catmur, 1994).

In the Netherlands, local risk of 10�6 per year is consideredthe limit value for vulnerable buildings (houses, hospitals,schools etc.), while for less vulnerable buildings like offices,recreation activities and stores, the local risk level of 10�6 is thelimit value.

In UK, the HSE quotes 1�10�6 per year as the risk of fatality thatis regarded broadly as acceptable, and 1 � 10�5 per year as that

horizontal release.

Fig. 11. Flash fire from vertical release.

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e1714

representing the boundary between tolerable and unacceptable forthe public.

The distance from the pipeline, at which the individual risk is1 � 10�5 per year, is directly proportional to the square root of theoperating pressure. This is because the fatal length is approximatelyproportional to the square root of the effective release rate which isproportional to the operating pressure.

The results proposed here refers to the total LR. When consid-ering the single causes that may cause the rupture of a pipeline, thelocal risk is lower. Fig. 13 shows an example of LR based on thecause of failure. The percentage of single causes were taken fromthe works of EGIG (2011) and Brito and Dealmeida (2009).

The calculated values of local risk are between tolerable andunacceptable for the public.

It is evident that the external interference, such as excavationwork, represents the initiation cause that mainly contribute to thevalues of the local risk. For this reason it is necessary an improve-ment in the identification of the path of the pipelines and theadoption of accurate preventive measures in case of excavation inareas crossed by pipes.

4.2.2. Societal riskThe societal risk takes into account the population distributed

around the area involved in the consequences of an accident.

Table 7Distance from release.

Zone Release from hole [m]

Zone 1 50Zone 2 100Zone 3 200Zone 4 300Zone 5 450Zone 6 600Zone 7 800Zone 8 1000Zone 9 1200Zone 10 1400Zone 11 1600

Societal risk refers to the cumulative probability per kilometreof pipeline that a group of at least N persons is fatally injured as adirect consequence of their presence within the impact area of thepipeline during a failure. In contrast to the local risk, which as-sumes a hypothetical person which is present all the time, the so-cietal risk takes into account the actual presence of persons.

The acceptability of the societal risk depends not only on theprobability but also on the number of fatalities.

Also the acceptability criterion for societal risk is not stan-dardized among the EU countries. The acceptable level of societalrisk has been set down generally as the cumulative frequencymultiplied by the square of the number of fatalities lower than acertain value.

Various governments have established “tolerable risk” limitsbased on these analysis methods. Many corporations have alsoadopted these methods for internal evaluation of the relative risk ofprojects, plants and businesses, presumably setting their owncriteria. FeN and individual risk analyses have also been applied topipelines, generally with F calculated on a per-length-of-pipelinebasis. Such an analysis is useful for comparing the risk.

Furthermore, the criteria vary between different countries. In theNetherlands, the societal risk criterion of F$N2 > 10�2 is an orien-tation value, where F is the frequency and N the number of fatalities.

Hence, societal risk exceeding the criterion may be allowed if allrisk mitigation measures are applied which are not unreasonablewith respect to costs or other aspects, i.e., the “as low as reasonablyachievable” principle.

The criteria for “tolerable risk” adopted by the Dutch govern-ment in 1996 sets a guide value for hazmat transport goods. Ac-cording to these criteria, the societal risk line is one order ofmagnitude higher in frequency and is applied to a kilometre of thetransport route (Boot, 2013; Schork, Lutostansky, & Auvil, 2012).

In UK, the HSE quotes a guide value for the societal risk ofF$N > 10�2 as the value of societal risk that is regarded asacceptable.

As previously described the distribution network may passthrough populated areas and thus can cause injury to thepopulation.

Fig. 12. Local risk for release from hole.

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e17 15

The calculation of societal risk were performed for the regions ofVeneto, Friuli e Venezia Giulia and Trentino e Alto Adige, as therewere available data of population density of these regions fromprevious work. The population density data was derived fromCENSIS 2001 (ISTAT, 2001).

It is possible to calculate the societal risk for each consequenceor the total damage on population. Fig. 14 shows the results of onesegment of network. In this figure two lines, representing theacceptability criteria in use in NL and UK, were added to the guidevalue for hazmat transport goods (Boot, 2013).

Fig. 13. Local risk based

With reference to the NL guide value, the results of societal riskfor each scenario, excluded that due to VCE, are above of upperlimits of acceptability, meaning that the societal risk is notacceptable. Instead, referring to the UK guide value the societal riskis almost in the acceptability area.

Fig. 15 shows other results of societal risk for different pipeline.The figure highlights that the results are different because thedistribution of population density changes along the route of dis-tribution network. In fact, the network crosses different typology ofterritory, town or countryside.

on failure causes.

Fig. 14. Societal risk of a pipeline in function of consequences type .

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e1716

In addition, in this case the societal risk, for every tract ofpipeline, is above the upper limits of acceptability with reference tothe NL guide value. Instead, referring to the UK guide value thesocietal risk is acceptable.

Taking into account the characteristics of the average populationdensity of the investigated area, the criterion of UK can beconsidered the most suitable for this area. Therefore, the societalrisk may be considered acceptable.

Finally, among the accidental scenarios that most contribute tothe societal risk the formation of flash fires should be considered,while a significant contribution is given of course by the charac-teristics of vulnerability of the territory crossed by the pipeline.

5. Conclusions

In conclusions, the consequences that can occur during thetransport of natural gas are due to fire and explosions.

The failure frequencies considered in the calculation of localrisk, were found in the EGIG report for distribution network. Theconsequences, due to releases frompipeline are function of the pipediameter pressure and flow of each section of the network.

It is evident that the external interference, such as excavationwork, represents the initial cause that mainly contributes to thefinal values of the local risk.

The flash fire and the VCE produce themost significant impact interms of consequences both from a release caused by a hole or a fullbore rupture of pipelines. Additionally the highest contribution tothe societal risk should be considered the occurrence of flash fires.

Fig. 15. Societal risk of the pipeline tracts considered in the case study.

Consequently, the flash fire scenario should be considered themost severe and as the limiter for safety distance determination fornatural gas pipelines. The thermal effect of a flash fire, as well as thedistance that the fuel gas travels from the source to its lowerflammable limit position, strongly depend on atmosphericconditions.

The determination of local risk highlights that the highestcalculated values, ranging from 5$10�6 to 1$10�6, are betweentolerable and unacceptable for the public, but the reduction of thefrequencies of external interferences can reduce the values of localrisk under the acceptability values. For this reason it is necessary animprovement of the identification of the path of the pipelines andthe adoption of accurate preventive measures in case of excavationin areas crossed by pipes.

In the distribution network, the analysis of the societal risk hasshown that there are pipelines that pass close to zones with me-dium population density and thus a release could give negativeeffects on the population. The results of the quantitative area riskassessment demonstrate that in some cases the societal riskexceeded the NL guide values for acceptability, whereas referring tothe UK guide value the societal risk is acceptable.

In conclusions, the high-pressure distribution network is adefined infrastructure that cannot be changed by the structuralpoint of view, for example by shifting pipeline sections. Thereforemitigation and prevention actions that may be adopted are: moreinformation about where the pipelines are located in case of out-door interventions (excavations), and communication amongdifferent institutions or facilities.

With current acceptable criteria for local risk, the minimumproximity of the pipeline for residential buildings is approximatelyproportional to the square root of the operating pressure of thepipeline. The value decreases with the pipeline length due theresistance of gas flowing through the pipeline.

Safety distances in the proximity of pipelines may be plotted indiagrams against independent variables. These diagrams could beused in loss prevention applications as well as in safer land-useplanning.

In addition, the following risk mitigation measures are sug-gested to mitigate the risk in more critical areas :

� Marker tape canwarn an excavator driver that there is a pipelineunder the ground.

� Protective concrete slabs reduce the possibility of externalinterference by warning an excavator driver that there issomething below the concrete slab.

� Burying the pipeline deeper at 2.0 m reduces the chance that anexcavator hits the pipeline.

� Installation of additional automatic block valves to isolate apipeline section if a leakage occurs and limits the amount ofreleased NG.

The proposed methodology for risk assessment may be usefulfor risk management during the planning and building stages of anew pipeline, and in very critical conditions the modification of aburied pipeline could also be suggested.

An analysis was conducted on the entire national network andsimilar results are observed in other areas that have populationdensities similar to those analyzed. Thus the same conclusions maybe extended to these areas.

References

API. (2008). API 581 risk based inspection technology.Boot, H. (2013). The use of risk criteria in comparing transportation alternatives.

Chemical Engineering Transactions, 31, 199e204.

C. Vianello, G. Maschio / Journal of Loss Prevention in the Process Industries 32 (2014) 5e17 17

Borysiewicz, M., & Potempski, S. (2001). Methods of hazard identification and pri-oritisation of risk for people resulting due to major transportation accidents.Raport IAE-77/A. �Swierk, Poland.

Brito, a, & Dealmeida, a (2009). Multi-attribute risk assessment for risk ranking ofnatural gas pipelines. Reliability Engineering System Safety, 94(2), 187e198.http://dx.doi.org/10.1016/j.ress.2008.02.014.

Bubbico, R., Maschio, G., Mazzarotta, B., Milazzo, M. F., & Parisi, E. (2006). Riskmanagement of road and rail transport of hazardous materials in Sicily. Journalof Loss Prevention in the Process Industries, 19(1), 32e38. Retrieved from http://www.sciencedirect.com/science/article/pii/S0950423005000574.

Center for Chemical Process Safety. (1995). Guidelines for chemical transportationrisk analysis (Center for Chemical Process Safety “Guidelines” series). Wiley-AIChE. Retrieved from http://www.amazon.com/Guidelines-Chemical-Transportation-Analysis-Process/dp/0816906262.

CONCAWE. (2011). Oil pipelines Management Group's Special Task Force on oil pipelinespillages (OP/STF-1). Brussels.

DIRECTIVE 2012/18/EU. (n.d.).Dziubinski, M., Fratczak, M., & Markowski, A. S. (2006). Aspects of risk analysis

associated with major failures of fuel pipelines. Journal of Loss Prevention in theProcess Industries, 19(5), 399e408. http://dx.doi.org/10.1016/j.jlp.2005.10.007.

Egidi, D., Foraboschi, F. P., Spadoni, G., & Amendola, A. (1995). The ARIPAR project:analysis of the major accident risks connected with industrial and trans-portation activities in the Ravenna area. Reliability Engineering & System Safety,49(1), 75e89. http://dx.doi.org/10.1016/0951-8320(95)00026-X.

EGIG. (2011). Gas pipeline incident.Erkut, E., & Alp, O. (2007). Integrated routing and scheduling of hazmat trucks with

stops en route. Transportation Science, 41(1), 107e122. http://dx.doi.org/10.1287/trsc.1060.0176.

Fabiano, B., Curr�o, F., Palazzi, E., & Pastorino, R. (2002). A framework for riskassessment and decision-making strategies in dangerous good transportation.Journal of Hazardous Materials, 93(1), 1e15. http://dx.doi.org/10.1016/S0304-3894(02)00034-1.

Han, Z. Y., & Weng, W. G. (2010). An integrated quantitative risk analysis method fornatural gas pipeline network. Journal of Loss Prevention in the Process Industries,23(3), 428e436. http://dx.doi.org/10.1016/j.jlp.2010.02.003.

Health and Safety Executive. (1991). Major hazard aspects of the transport ofdangerous substances. HSE Books. Retrieved from http://www.amazon.co.uk/Hazard-Aspects-Transport-Dangerous-Substances/dp/0118856995.

Hill, R. T., & Catmur, J. R. (1994). Risks from hazardous pipelines in the UnitedKingdom. Health and Safety Executive Contract Research Report No. 82.Retrieved March 04, 2014, from http://workboostwales.net/research/crr_pdf/1994/crr94082.pdf.

HInt Dossier. (2005). Gas pipeline explosion at Ghislenghien, Belgium.HSE & Contract Research Report 210. (1999). Assessing the risk from gasoline pipe-

lines in the United Kingdom based on a review of historical experience.http://www.asme.org. (n.d.).INTeg-Risk. (2012). Course VD-R35 TRA e Transportation risk assessment.Jo, Y.-D., & Ahn, B. J. (2005). A method of quantitative risk assessment for trans-

mission pipeline carrying natural gas. Journal of Hazardous Materials, 123(1e3),1e12. http://dx.doi.org/10.1016/j.jhazmat.2005.01.034.

Jo, Y., & Crowl, D. (2008). Individual risk analysis of high-pressure natural gaspipelines. Journal of Loss Prevention in the Process Industries, 21(6), 589e595.http://dx.doi.org/10.1016/j.jlp.2008.04.006.

Kara, B. Y., & Verter, V. (2004). Designing a road network for hazardous materialstransportation. Transportation Science, 38(2), 188e196. http://dx.doi.org/10.1287/trsc.1030.0065.

Landucci, G., Tugnoli, A., Busini, V., Derudi, M., Rota, R., & Cozzani, V. (2011). Theviareggio LPG accident: lessons learnt. Journal of Loss Prevention in the ProcessIndustries, 24(4), 466e476. http://dx.doi.org/10.1016/j.jlp.2011.04.001.

Markowski, A. S. (2000). Loss prevention in industry, Part IIIdManagement of processsafety. Technical University of Lodz.

Mathurkar, H. N., & Gupta, A. (2006). A. Cross-country pipeline safety assessment.India.

Medina, H., Arnaldos, J., Casal, J., Bonvicini, S., & Cozzani, V. (2012). Risk-basedoptimization of the design of on-shore pipeline shutdown systems. Journal ofLoss Prevention in the Process Industries, 25(3), 489e493. http://dx.doi.org/10.1016/j.jlp.2011.12.005.

Metropolo, P. L., & Brown, A. E. (2004). Natural gas pipeline accident consequenceanalysis. Process Safety Progress, 23, 307e310. Retrieved from http://journals.ohiolink.edu/ejc/article.cgi?issn¼10668527&issue¼v23i0004&article¼307_ngpaca.

Milazzo, M. F., Lisi, R., Maschio, G., Antonioni, G., & Spadoni, G. (2010). A study ofland transport of dangerous substances in Eastern Sicily. Journal of Loss Pre-vention in the Process Industries, 23(3), 393e403. Retrieved from http://www.sciencedirect.com/science/article/pii/S0950423010000197.

Ministero dello sviluppo economico. (2008). DECRETO 17 aprile 2008. Retrievedfrom http://gazzette.comune.jesi.an.it/2008/145/2.htm.

Montiel, H., Vílchez, J. A., Arnaldos, J., & Casal, J. (1996). Historical analysis of ac-cidents in the transportation of natural gas. Journal of Hazardous Materials,51(1e3), 77e92. http://dx.doi.org/10.1016/S0304-3894(96)01819-5.

Muhlbauer, W. K. (1996). Pipeline risk management manual (2nd ed.). (p. 438). GulfProfessional Publishing. Retrieved from http://www.amazon.com/Pipeline-Management-Manual-Second-Edition/dp/0884156680.

OGP. (2010). Risk assessment data directory. Report No. 434-7.Saeid Mokhatab, Poe, W. A., & Speight, J. G. (2006). Handbook of Natural Gas Trans-

mission and Processing. Gulf Professional Publication. ISBN: 978-0-7506-7776-9.Schork, J. M., Lutostansky, E. M., & Auvil, S. R. (2012). Societal risk criteria and

pipelines. Pipeline and Gas Journal. Retrieved March 04, 2014, from http://www.pipelineandgasjournal.com/societal-risk-criteria-and-pipelines.

Sklavounos, S., & Rigas, F. (2006). Estimation of safety distances in the vicinity offuel gas pipelines. Journal of Loss Prevention in the Process Industries, 19(1),24e31. http://dx.doi.org/10.1016/j.jlp.2005.05.002.

Slater, D. H., Cox, R. A., Comer, P. J., & Pyman, M. (1979). Safety issues in the siting ofLNG terminals. Gastech '79 LNG/LPG Conf. Pap.; (United States), 4(1). Retrievedfrom http://www.osti.gov/energycitations/product.biblio.jsp?osti_id¼6215157.

TNO. (1999). Purple book e Guidelines for quantitative risk assessment (CPR18E, Ed.).CPR18E.

Vianello, C., & Maschio, G. (2011). Risk analysis of natural gas pipeline: case study ofa generic pipeline. Chemical Engineering Transactions, 24, 1309e1314. Retrievedfrom http://www.scopus.com/inward/record.url?eid¼2-s2.0-79955489903&partnerID¼40&md5¼41b601333906f79591e0379ef7461808.

Yuhua, D., & Datao, Y. (2005). Estimation of failure probability of oil and gastransmission pipelines by fuzzy fault tree analysis. Journal of Loss Prevention inthe Process Industries, 18(2), 83e88. http://dx.doi.org/10.1016/j.jlp.2004.12.003.

Web references

Lac Megantic, Canada 2014: http://www.theglobeandmail.com/news/national/railway-behind-lac-megantic-derailment-was-cited-for-brake-violations/article16848316/.

National Transport Safety Board, https://www.ntsb.gov/investigations/reports.html.