Proceedings of the 2012 9th International Pipeline Conference IPC2012 September 24-28, 2012, Calgary, Alberta, Canada

IPC2012-90065
A UNIFORM RISK METHODOLOGY FOR TRANSMISSION PIPELINES TRANSPORTING CHEMICALS
Margreet B. Spoelstra National Institute for Public Health and the Environment Centre for External Safety P.O. Box 1 3720 BA, Bithoven The Netherlands Gerald M.H. Laheij National Institute for Public Health and the Environment Centre for External Safety P.O. Box 1 3720 BA, Bithoven The Netherlands

ABSTRACT In 2011 the Dutch Ministry of Infrastructure and the Environment (I&M) introduced new legislation for pipelines transporting dangerous substances. This legislation applies to pipelines transporting natural gas and to pipelines transporting oil products1 and deals amongst other things with the consequences of (new) pipelines on spatial planning. Risk methodologies have been revised in order to reflect new understandings in risk scenarios, failure frequencies and consequences. In the Netherlands operators and responsible authorities are now required to use these methodologies in risk calculations. A risk methodology for pipelines transporting chemicals (substances other than natural gas or oil products) has currently been developed. These pipelines have a total length of about 3,000 kilometer and 18 different chemicals such as ethylene, hydrogen, chlorine and carbon dioxide are involved. This paper describes the risk methodology for underground pipelines transporting chemicals, including modeling aspects and failure frequencies. The application of measures to reduce the risk and some case analysis results are presented as well. Key words: transmission pipeline, chemicals, risk methodology, modeling, measures. INTRODUCTION When working with hazardous substances, an important question to be answered is which safety approach is to be used for establishments or transport routes where activities involving hazardous substances are taking place. Policy makers can
1

Pipelines transporting oil products are pipelines transporting flammable substances like crude oil and petroleum products. In the Netherlands these pipelines are categorized in subclasses, depending on their flashpoint.

choose to use a consequence orientated approach in which the consequences of the release of a hazardous substance are calculated and whereby the maximum calculated effect distance is applied as the minimum distance to be maintained. Such an approach is not very practical in the Netherlands as this puts a significant claim on the available land use. Instead, a risk based approach is preferred where consequences as well as the frequency of these consequences are taken into account. In this risk based approach individual and societal risk are considered. Individual risk calculations result in individual risk contours that represent the annual likelihood that a person dies as a direct result of an accident involving hazardous substances. In assessing the tolerance for the individual risk, vulnerable and less vulnerable locations are considered. Vulnerable locations are locations where people are present for a rather long time during a day or where people are not capable of rescuing themselves. Examples of vulnerable locations are dwellings, schools and hospitals. Less vulnerable locations are locations where people stay for a relatively short period of time or where people are able to rescue themselves. Examples are small offices, shops and sports grounds. For vulnerable locations the individual risk of 10-6 per year is set as a limit value, whereas it is used as a guideline for less vulnerable locations [1]. Risk calculations also provide information about the societal risk, which is the annual likelihood that a group of persons of a certain size will die due to an accident involving hazardous substances. The societal risk is a measure of the social disruption caused by such an accident and is presented as an FN-curve, where the number of fatalities N is plotted against its cumulative frequency. In the Netherlands the responsible authorities have to justify the societal risk. The justification process includes the magnitude of the societal risk, the extent to which people can rescue themselves, the ability of the fire brigade to respond to the accident and a description of

Copyright 2012 by ASME

alternatives and possible measures to reduce the societal risk [2]. oth the methodologies and the software to be used for the calculation of the risk are prescribed [1]. Risk calculations can be performed using a variety of software programs, but the disadvantage is that results often cannot be compared. To avoid this and to make risk calculations as consistent as possible, the Dutch government has prescribed the software tool SAFETI-NL for performing risk calculations of hazardous substances (high pressure natural gas pipelines excluded) [3].SAFETI-NL is the Dutch version of PHAST RISK [4] and in this version certain parameters are prescribed while other parameters are fixed and suppressed so users cannot change them. The way risk calculations should be performed in the Netherlands is described in several risk methodologies of which the manuals for chemical establishments [5] and for underground pipelines [6] are the most important ones. In the last decade the National Institute for Public Health and the Environment (RIVM) has developed methodologies for calculating the individual and societal risk for pipelines transporting high pressure natural gas and pipelines transporting oil products. This paper describes the risk methodology for underground pipelines transporting chemicals. The methodology itself is not yet incorporated into legislation or in the Reference Manual for pipelines [6], but it will be as soon as the

results of a consequence analysis have been studied and approved. A consequence analysis gives insight into the number of potential areas where the limits for individual and/or societal risk are exceeded and gives insight to the required costs to mitigate them. The components of the methodology have been developed in cooperation with several Dutch pipeline operators and comprised sub processes such as collecting data, performing calculations and discussions with the parties involved. BACKGROUND In the Netherlands about 18,000 km of underground pipelines transport hazardous materials. 70% of these pipelines contain high pressure natural gas, 13% contain (highly) flammable liquids and 17% contain chemicals. The risk methodology developed for pipelines transporting chemicals comprises 18 chemicals which differ in hazardous properties and/or physical state. Table 1 presents the chemicals involved. The methodology should preferably be applicable to all the 18 hazardous substances. In order to come to a well endorsed and supported risk method, the methods for pipelines transporting high pressure natural gas and flammable liquids have been attuned as much as possible.

TABLE 1 SURVEY OF THE 18 CHEMICALS THAT ARE TRANSPORTED IN THE NETHERLANDS BY UNDERGROUND PIPELINES. Property Liquid Isoprene Propylene dioxide Flammable Ethylene n-Butane n-Butene Propylene Vinyl chloride Ammonia Toxic Flammable and toxic Asphyxiating Enhanced ignition Formaldehyde (46%) Ethylene oxide Chlorine Carbon monoxide Hydrogen chloride Synthesis gas (H2 and CO) Carbon dioxide Nitrogen Oxygen Physical state Liquefied gas Hydrogen Gas

Risk is a function of the frequency of a loss of containment (LOC) and the consequences of that LOC. The most important aspects in risk calculations of underground pipelines transporting chemicals are given and described in this paper. Some details about the background and development is described in reference [7]. Several parameters are derived from the Reference Manuals [5, 6] or from its predecessor the Purple Book [8]. Both give requirements for quantitative risk assessments.

The risk methodology for pipelines transporting chemicals is only applicable to the substances specified in Table 1. If other substances are considered, it may be necessary to adjust the modeling. The risk methodology is only applicable for pipelines for which the operator maintains a well functioning safety management system [1].

Copyright 2012 by ASME

SCENARIOS The following scenarios are considered in the Dutch risk methodology for pipelines transporting chemicals:

horizontal component, but as the release angle is not known, it is not taken into account. Release duration and exposure time: For a pipeline transporting a flammable substance the release rate is averaged over the first 20 seconds. For toxic substances, a time dependent release rate may be assumed where at least five segments are defined. With each segment an equal amount of substance is released. The maximum release duration to be used is 1800 s [6]. This also applies to the maximum duration of the pool evaporation. It is assumed that after 1800 s intervention is successful. The possibility of evacuation within 1800 s is not considered. The time of exposure to heat radiation is up to 20 s. For toxic substances, the exposure time is limited to 1800 s. If it can be proven that the release duration of a pipeline transporting chemicals is less than 30 minutes due to existing security devices, a shorter release duration may be used in the calculations. The detection time of the rupture, the response time of an operator and the closing time of valves (including backflow from the blocked pipeline) should be considered. Failure frequencies: In the establishment of the risk methodology for pipelines transporting chemicals Dutch operators provided historical data from 1975 to 2009. From this the failure frequency for rupture was derived. In this frequency the influence of a statutory one-call system is taken into account [9]. In the derivation of the frequency the 95th percentile of the one-sided confidence interval of the mean frequency is taken. This confidence interval is calculated assuming the number of incidents is Poisson distributed.
TABLE 3 FAILURE FREQUENCIES FOR PIPELINES TRANSPORTING CHEMICALS. Scenario 1. Rupture 2. Leak Failure frequency (km-1 year-1) 3.7 10-5 1.1 10-4

TABLE 2 PRESCRIBED SCENARIOS FOR PIPELINES TRANSPORTING CHEMICALS. Scenario 1. Full bore rupture of the pipe 2. Leak with a diameter of 10% of the diameter with a maximum of 20 mm

It was considered to use different hole sizes instead of one hole size. However, this approach was not followed as the distribution of failure frequencies for leakages from series of hole sizes was not known2. MODELING ASPECTS Many modeling aspects have been set in the risk methodology. The most important ones are described and explained in this section. The values for some parameters described here are used in the Netherlands for more than 30 years. Unfortunately, the origin and derivation of these values cannot be determined anymore, but are believed to be reasonable in all cases. Leak: With flammable compounds leak often does not contribute to risk, but in some cases the absence of the scenario leak results in the absence of the individual risk contour of 10-6 per year. For that reason and to be as uniform as possible, leak is considered for all pipelines transporting chemicals. Release location for source term calculations: In the calculations, failure in terms of rupture or leak occurs halfway along the length of a pipeline with a length of 50 km (or shorter when appropriate). By doing so a two sided release is modeled. The release scenarios of rupture and leak are calculated only once and the results are then applied along the total route. Hereby a suitable spacing is used to create smooth risk contours. This assumed location of the failure is known not to be the most conservative assumption in all cases, but is a reasonable approximation for pipelines in flat ground as is typical of the Netherlands. It would not be applicable in hilly areas. A second reason to use one release location is to keep calculations as simple and robust as possible. Release direction: For underground pipelines the release direction is always vertical. The rationale for this is the idea that released material can only come aboveground by means of a vertical movement. It is acknowledged that the release direction can also have a

The historical data was not used to obtain the failure frequency for leak as it is believed that the statistics delivered is incomplete. For that reason the ratio rupture:leak from the Purple Book was used, being 1:3 [8]. Note that for substances that are both flammable and toxic, flammable effects are only calculated in case of direct ignition. Toxic effects are assumed to occur with a probability of 1-Pdirect. Events: For the chemical substances involved the events that are modeled are outlined in Table 4. The content of these tables is closely related to the ignition probabilities that are described in the next paragraph. Overpressure effects are not considered, because the effects of overpressure are smaller than the effects of heat radiation.

It has to be mentioned that whenever information is absent or not known, it is common practice in the Netherlands to use a conservative approach to be on the safe side.

Copyright 2012 by ASME

TABLE 4 EVENTS CONSIDERED IN THE RISK METHODOLOGY WHEN A PIPELINE FAILS. Physical state Flammable Gas Liquified gas Liquid Toxic Gas Liquified gas Liquid Flammable and toxic Gas Liquid * N.A. = Not Applicable. Rupture Leak Rupture Leak Jet fire Jet fire Pool fire + flash fire N.A. Toxic cloud Toxic cloud Toxic cloud Toxic cloud Toxic cloud Toxic cloud Toxic cloud Toxic cloud Rupture Leak Rupture Leak Rupture Leak N.A N.A N.A N.A N.A N.A N.A N.A N.A N.A N.A N.A Toxic cloud Toxic cloud Toxic cloud Toxic cloud Toxic cloud Toxic cloud Rupture Leak Rupture Leak Rupture Leak Jet fire Jet fire Jet fire Jet fire Pool fire + flash fire N.A. N.A* N.A. Jet fire Jet fire Pool fire N.A. N.A N.A. No effect No effect N.A N.A. Scenario Direct ignition Delayed ignition No ignition

Ignition probabilities: In Table 5 the ignition probabilities to be used are summarized and correspond with the Purple Book values. Direct ignition Pdirect is defined as the probability that the release ignites immediately, at the release point, before the cloud has begun to disperse and to reach ignition sources away from the release point. If the release does not ignite immediately, then the cloud will disperse away from the release location, and may reach additional sources of ignition, remote from the release location. Only one flammable gas is transported by pipelines, namely hydrogen. Given the very low ignition energy of hydrogen it is assumed that with failure of a hydrogen pipeline the release will be so turbulent that hydrogen will always ignite and that this results in a direct ignition of the release [10].
TABLE 5 IGNITION PROBABILITIES FOR RUPTURE AND LEAK OF PIPELINES TRANSPORTING CHEMICALS. Direct ignition Hydrogen - rupture and leak Liquefied gases - rupture - leak Liquids - rupture and leak 0.065 0.0935 0.3 0.14 0 0 1 0 Delayed ignition

For liquefied gases the risk methodology for pipelines transporting chemicals assumes no delayed ignition because our calculations have shown that the LFL of the released liquefied gas does not encounter ignition sources at 1 meter height that can lead to delayed ignition. Note that this is only valid for vertical releases. For liquids the ignition probabilities as handled in the risk methodology for pipelines transporting oil products is used [11]. Modeling the release of gases: The release of gas from a rupture of an underground pipeline is accompanied by the formation of a crater. A large quantity of air is sucked into the crater and is mixed with the released gas causing a significant reduction of the discharge velocity. The amount of air entrainment as well as the extent to which the discharge velocity is reduced, depends on the pressure and diameter of the pipeline. The methodology contains tables from which the appropriate amount of air entrainment and discharge velocity can be chosen. This way of modeling is only necessary for hydrogen as this is the only flammable gas. For toxic and inert gases calculations have shown that the effects of air entrainment due to the presence of a crater are negligible. Modeling the release of liquefied gases: As with gases the release of a liquefied gas from a ruptured underground pipeline is accompanied by the formation of a crater and a vertical release of gas. The extent of air entrainment in the crater upon release of liquefied gas, is not known.

Copyright 2012 by ASME

When the liquefied gas flashes, it expands greatly and it is expected that due to this expanding movement the supply of additional air into the crater is diminished. For that reason, air entrainment is not taken into account. Modeling the release of liquids: When modeling the release of liquids, several aspects need to be considered and are outlined below. Released amount - In case of rupture of a pipeline transporting a liquid, a fountain of liquid will arise. The amount of liquid that comes aboveground is believed to equal the sum of the amount that is released within the closure time of the pump (V1) and the amount of liquid that is released as a result of the sudden relaxation of the pressurized liquid (line pack, V2). The formation of a crater is not considered with liquids [11]. (Note that the Netherlands is a flat country and any drain down of liquid is not considered).

Consequences: Many consequence aspects have been set in the risk methodology. They include for instance averaging times, probabilities of lethality, distribution of population and the height for which consequences are calculated. Details of these aspects are described in reference 6. Dose-effect relationships for toxic substances: Probit relationships are used to determine dose-effect relationships. The probit relationship for toxic substances is given in Equation 4. The minimum value for the probability of dying Plethal is 0.01.

Pr = a + b ln
with Pr a, b, n C t = = = =

( C dt )
n

(4)

V1 = pump t with
V1 pump t = = =

(1)

probit associated with the probability of dying (-) toxicity constants of a substance (-) concentration at time t (mg/m3) exposure time (minutes).

released amount of liquid within the closure time of the pump (m3); pump rate (m3/s); closing time pump or valves (s).

For the toxic substances involved the probit relationships are listed in Table 6.
TABLE 6 TOXICITY CONSTANTS FOR THE TOXIC CHEMICALS INVOLVED. Toxic substance a (mg/m3) 6.35 6.8 -6.02 7.4 -37.3 -65.7 -104.6 b 0.5 1 0.541 1 3.69 1 1 n 2.75 1 3.7 1 1 5.2 9

V2 =
with V2 D L P Ce

D L P Ce
2

(2)

Chlorine Ethylene oxide Formaldehyde

= = = = =

discharge due to relaxation of the pressurized liquid (m3); inner diameter of the pipeline (m); total pipe length (m); pressure of the pipeline (N/m2); compressibility (= 0.88 10-9 m2/N).

Carbon monoxide Hydrogen chloride Inert gases Carbon dioxide

Modeling - Two consecutive scenarios are used to model rupture of pipeline transporting a flammable liquid. The first scenario is related to direct ignition and models the flash fire and the additional pool fire. The release rate (kg/s) is calculated as ((V1 + V2) density)/closure time pump. The discharge velocity (m/s) equals (V1 + V2)/(closure time pump surface pipeline). The second scenario is related to delayed ignition and models only a pool fire. The content of the pool equals V1 + V2. Based on a pool depth of 0,05 m, the pool area can be calculated and used in the Pool Fire model [6]. Flammable and toxic liquid - The flammable effects are only calculated in case of direct ignition and the same modeling as for purely flammable liquids is applied. The toxic effects are calculated when direct ignition does not occur, thus having a probability of 1-Pdirect.

So far it has not been found possible to derive an appropriate probit function for CO2 [12]. For the time being the constants as given in this table are used.

Substance specific modeling: Hydrogen: Hydrogen flames dont soot resulting in less heat transfer compared to flames of hydrocarbons. Pure hydrogen flames will therefore give smaller consequences than natural gas flames. Because the generic models used in SAFETI-NL are based on natural gas flames, an overestimation of the effects would be expected. However, there is proof that with large hydrogen flames the heat transfer is comparable with substances such as propane and methane due to the presence of water in the jet. The presence of water provides a considerable heat, eliminating the need to adapt the modeling [13]. Ethylene: Ethylene is a substance with a critical temperature of 9.19C. Ethylene is modeled at a temperature of 9C so that it behaves as a liquid.

Copyright 2012 by ASME

Oxygen: For oxygen no risk approach is used. In general the risks associated with transport of oxygen in underground pipes are negligible. Only when large amounts are released, it makes sense to consider the release of oxygen in risk analysis as large amounts of oxygen may increase the ignition probability of flammable substances. As an effective probit relationship cannot be derived for oxygen, the effect of oxygen is taken into account by describing the following effect levels: Plethal = 0.1 for [O2] > 40 vol%; Plethal = 0.01 for 30 < [O2] 40 vol%; Plethal = 0 for 20 < [O2] 30 vol% An oxygen concentration of 40 vol% in air corresponds with an additional quantity of oxygen of 24.1 vol% (241.000 ppm) from the dispersion calculation; 30 vol% oxygen in air corresponds with 11.4 vol% (114.000 ppm) from the dispersion calculation [5]. Formaldehyde: For formaldehyde a special modeling is required as it concerns an aqueous solution. Based on the pool area the pool vaporization rate needs to be derived, using formulas 3.141, 3.13, 3.24 en 3.25 from the Yellow Book [14]. It has to be mentioned that the proposed probit of formaldehyde is subject to discussion as it is believed to be severely conservative. MEASURES When the methodology for pipelines transporting chemicals is officially implemented, it is possible that at several locations an exceedance of the limits for the individual or societal risk will be observed. Therefore, along with the methodology measures should be available to address these situations. The majority of the measures reduces the risk through a reduction of (part of) the failure frequency. The extent to which failure frequencies can be reduced, is determined by the relative contribution of the different failure causes [15] (Table 7) and by the quantification of the relevant measures [6] (Table 8).
TABLE 7 CONTRIBUTION OF SEVERAL FAILURE MODES OF UNDERGROUND PIPELINES TRANSPORTING CHEMICALS.

example the use of concrete slabs or warning tapes and agreements with landowners about land utilization. For all measures preconditions are defined and all preconditions should be met before the subsequent reduction factor can be used [6]. Measures that influence failure causes other than external interference are still to be developed.
TABLE 8 - EFFECT OF ADDITIONAL MEASURES ON THE PROBABILITY OF A PIPELINE FAILURE DUE TO EXTERNAL INTERFERENCE. Measure Extra depth of cover Warning tape Concrete slab Concrete slab + warning tape Stringent supervision of digging activities Agreements about land utilization Reduction factor See Eq. (3) 1.67 5 30 3 1.6 100

The probability that an underground pipeline is hit, is a function of the depth of cover of the pipeline [16]:
rd = e2.4 d0 (2.4 d)

(3)

with rd d d0 = reduction factor; = real depth of cover (m); = average depth of cover (= 0.97 m).

The failure frequency for (a part of) the pipeline can be determined using Eq. 4:
ffred = e2.4(d d0 ) L ff

(4)

with ffred = reduced rupture frequency for given pipe length (km-1 year-1); d = real depth of cover for given pipe length (m); d0 = average depth of cover (= 0.97 m); L = pipe length (m); ff = standard rupture frequency (km-1 year-1). RESULTS Using the risk methodology as described above individual risk calculations can be performed. From the 18 chemicals involved ethylene and chlorine were chosen as examples to illustrate the results. The calculations are fictitious and were performed with and without concrete slabs as an additional preventative measure. Taking rupture as an example, the reduced failure frequency due to the presence of concrete slabs can be determined using Eq. (5). Note that for pipelines transporting chemicals the introduction of concrete slabs can only reduce the part of the failure frequency that is associated with by external interference, i.e. 50% (Table 7).

Failure causes External Interfence Corrosion Process Mechanical

Rupture (%) 50 12.5 12.5 25

Leak(%) 40 10 5 45

As can be seen from Table 7, the major cause of failure is failure due to digging activities (external interference). The measures that have been proposed so far are intended to prevent a pipeline from being hit during digging activities or prevent or control digging activities in the vicinity of a pipeline. Proposed measures for reducing the risk of pipelines are for

Copyright 2012 by ASME

ffred =

CEI ff + Cothers ff rd

(5)

TABLE 9 - RESULTS FOR TWO PIPELINES TRANSPORTING CHEMICALS. Ethylene Chlorine 20 3 6

with ffred CEI ff rd Cothers

ffred =

= reduced rupture frequency (km year ); = contribution External Interference; = standard rupture frequency (km-1 year-1) = reduction factor concrete slabs; = contribution other failure causes.
0.50 3.7 10 5
5

-1

-1

Pressure (bar) Diameter (inch) Length (km)

98 10 25

Without concrete slabs

5

+ 0.50 3.7 10 5

(6)

1% lethality (m) 100% lethality (m) IR 10- year-1 (m) IR 10 year (m)
-8 -1

135-150 5-65 20 135

520-2400 0-240 560

= 2.22 10

km 1 year 1 .

Following the same procedure, the reduced failure frequency for leak would be 7,55 10-5 year-1. The results are presented in Table 9 and Figure 1- Figure 6. For the ethylene pipeline, the individual risk level has reduced slightly, but this reduction is sufficient in order to let the limit of 10-6 per year disappear.

With concrete slabs IR 10- year-1 (m) IR 10 year (m)

-8 -1

130

55-95 1550

FIGURE 1 INDIVIDUAL RISK CONTOURS OF AN ETHYLENE PIPELINE WITHOUT CONCRETE SLABS.

FIGURE 2 RISK TRANSECT OF THE ETHYLENE PIPELINE OF FIGURE 1. THE THICK BLACK LINE REPRESENTS THE INDIVIDUAL RISK LEVEL OF 10-6 YEAR-1.

Copyright 2012 by ASME

FIGURE 3 - INDIVIDUAL RISK CONTOURS OF AN ETHYLENE PIPELINE IN THE PRESENCE OF CONCRETE SLABS.

Figure 4 - RISK TRANSECT OF THE ETHYLENE PIPELINE OF FIGURE 3. THE THICK BLACK LINE REPRESENTS THE INDIVIDUAL RISK LEVEL OF 10-6 YEAR-1.

FIGURE 5 - INDIVIDUAL RISK CONTOURS OF A CHLORINE PIPELINE WITHOUT CONCRETE SLABS.

Copyright 2012 by ASME

FIGURE 6 - INDIVIDUAL RISK CONTOURS OF A CHLORINE PIPELINE IN THE PRESENCE OF CONCRETE SLABS.

CONCLUSIONS A risk methodology for pipelines transporting chemicals has been developed in close cooperation with several Dutch pipeline operators. The setup has been made as uniform as possible in order to obtain robust results. The methodology will be REFERENCES
The consulted date for the web pages given in the References, is February 9, 2012.

mandatory in the Netherlands and incorporates failure frequencies and prescribed consequence modelling assumptions.

[1] Ministry of Infrastructure and Environment (I&M), 2011, Decree on External Safety of Pipelines (Bevb) and the corresponding Regulation on External Safety of Pipelines (Revb). [2] Ministry of Infrastructure and Environment (I&M), 2011, Handreiking Verantwoordingsplicht Groepsrisico. [3] www.rivm.nl/Onderwerpen/Onderwerpen/E/ Externe_Veiligheid/Rekenmodellen/ (in Dutch). [4] Det Norske Veritas (DNV),2009, the Dutch version of Software for the Assessment of Flammable, Explosive and Toxic Impact (SAFETI-NL), version 6.54. [5] RIVM, 2009, Reference Manual Bevi Risk Assessments, version 3.2. Available for download at http://www.rivm.nl/Bibliotheek/Professioneel_Praktisch/Richt lijnen/Milieu_Leefomgeving/Handleiding_Risicoberekeningen_ Bevi. [6] RIVM, 2010, Reference Manual Bevb Risk Assessments, version 1.0.

http://www.rivm.nl/Onderwerpen/Onderwerpen/E/Externe_Ve iligheid/Buisleidingen (in Dutch). English version available on request. [7] Spoelstra, M.B. and Laheij, G.M.H., 2011, Towards a Method to Calculate Risks of Undeground Pipelines Transporting Hazardous Substances, Proc. HAZARDS XXII on Process Safety and Environmental Protection, Liverpool (39), pp. 254-260. [8] Committee for the Prevention of Disasters (CPR), 1999, Guidelines for quantitative risk assessment a.k.a. Purple Book or Dutch Standard PGS 3. Available for download at www.publicatiereeksgevaarlijkestoffen.nl/ [9] Laheij, G.M. et al, 2008, Influence of a statutory onecall system on the risk of natural gas pipelines, Proc. 9th International Probabilistic Safety Assessment and Management Conference (PSAM9), Hong Kong (0420). [10] Hysafe, 2007, An ignition probability model methodology for hydrogen risk analysis, Deliverable No 71, Contract No SES6-CT-2004-502630 Available for download at www.hysafe.org/deliverable [11] Van Vliet, A.A.C. and Laheij. G.M.H., 2009, Quantitative risk analysis for underground oil transmission pipelines, Proc. European Safety and Reliability (ESREL), Prague (151).

Copyright 2012 by ASME

[12] RIVM, 2009, Evaluation of the acute toxicity of CO2. Available for download at www.rivm.nl/milieuportaal/images/20091002_Evaluation_tox icity_CO2.pdf [13] Acton, M.R., Allason, D., Creitz, L.W. and Lowesmith, B.J., 2010, Large Scale Experiments to Study Hydrogen Pipeline Fires, Proc. 8th International Pipeline Conference, Calgary, Paper no. IPC2010-31391 pp. 593-602. [14] Committee for the Prevention of Disasters (CPR), 1999, Methods for the Calculation of Physical Effects a.k.a. Yellow Book or Dutch Standard PGS 2. Available for download at www.publicatiereeksgevaarlijkestoffen.nl/ [15] RIVM, to be published in Dutch, Inventory of the relative contribution of causes of failure for pipelines transporting chemicals based on accident databases. [16] Gielisse, M., Drge, M.T. and Kuik, G.R., 2008, Risicoanalyse aardgastransportleidingen, Gasunie report DEI 2008.R. 0939 (in Dutch).

10

Copyright 2012 by ASME