5

Rupture Mitigation Valve Cost and Decision Criteria for Existing Pipelines

This chapter presents operator-provided estimates of costs for rupture mitigation valves (RMVs) on existing pipelines in high consequence areas (HCAs) and populated (Class 3 and 4) locations. The discussion then turns to how operators make choices about installing RMVs on existing pipelines, first by discussing the programs several operators have instituted to prioritize RMV deployments and then by reviewing federal requirements for operators to consider RMVs specifically as a mitigation measure and within the broader context of their obligations for risk assessment and risk reduction for integrity management (IM).

The first part of the chapter suggests that pipeline operators are choosing to install automatic and remote-control shutoff valves on some existing pipelines for operational and/or safety reasons, despite evidence and claims of costliness for some site-specific circumstances. The second part of the chapter considers the adequacy of the direction and guidance provided by the Pipeline and Hazardous Materials Safety Administration (PHMSA) to operators when making such risk management choices in the public interest for their pipelines in HCAs. The discussion surfaces shortcomings in this direction and guidance, particularly for conducting IM-required risk analyses and for examining benefits and costs to inform risk reduction choices.

COST FACTORS AND COST RANGES FOR RUPTURE MITIGATION VALVE INSTALLATIONS

During information-gathering sessions, the committee queried representatives of pipeline operators and their trade associations about the costs

associated with (a) retrofitting a manual valve with an actuator to facilitate automatic or remote operation, (b) replacing an existing valve with an RMV, and (c) adding a new valve location with an RMV. In addition, the committee consulted PHMSA’s regulatory impact analysis (RIA) conducted for the April 2022 rule requiring RMVs for newly constructed and entirely replaced segments of pipelines.¹ The rulemaking’s regulatory impact documents contain information on RMV installation costs, albeit for newly constructed and entirely replaced segments of pipelines.

The information gleaned from these sources indicates that RMV installation costs are likely to vary widely and be highly site-specific. Estimates provided to the study committee and to PHMSA by the American Gas Association (AGA), Association of Oil Pipe Lines, and a number of individual pipeline operators suggest that the cost of installing an RMV at a given site can vary widely, from as low as $30,000 to more than $10 million (see Table 5-1). For example, if the only requirement is the addition of an automatic or remote-control actuator to an existing valve, the installation cost is more likely to be on the lower end of the cost range but still be affected by the availability of power and communications. Alternatively, if an operator needs to retrofit an older pipeline and place a valve in a location that did not previously have a valve and space is constricted, this could entail significant capital expenditures for construction, new power and communication systems, and site access and preparation. The outlay required to install a new valve can also vary depending on the diameter and operating pressure of the pipeline, as larger- diameter and higher-pressure pipelines can be more expensive to retrofit with a new valve. If the valve must be located in an environmentally sensitive area, such as a wetlands, the costs can escalate further. Cost-driving factors that would need to be considered for all types of installation (i.e., whether retrofit, valve replacement, or valve addition) include prevailing wages for installers and technicians; costs for procuring materials and equipment (e.g., valve, actuators, and controls); costs associated with accessing power and communications; and costs arising from acquiring land rights, obtaining environmental permits, and making site improvements, including site restoration. According to AGA, the cost of installing power and communication systems and managing permitting, land, and environmental factors could add up to outlays on the order of $250,000.²

As a check on these figures, installation cost data summarized by PHMSA for its RIA for the 2022 rule requiring RMVs on newly constructed

___________________

¹ PHMSA. 2022. Regulatory Impact Analysis: Amendments to Parts 192 and 195 to Require Valve Installation and Minimum Rupture Detection Standards Proposed Rule. https://downloads.regulations.gov/PHMSA-2013-0255-0046/attachment_1.pdf.

² Presented by Andrew Lu from the American Gas Association, April 26, 2022.

TABLE 5-1 Pipeline Industry Cost Estimate Ranges for RMV Installations

^a Unless otherwise noted, as in footnotes b–f, all source information came from PHMSA’s March 2022 Regulatory Impact Analysis.

^b Andrew Lu, American Gas Association, April 26, 2022.

^c Timothy Lajiness and Tyler Shanteau, DTE Energy, April 26, 2022.

^d Sue King and Mike O’Shea, Xcel Energy, October 27, 2022.

^e John Stoody, Association of Oil Pipe Lines, April 26, 2022.

^f Matthew Young, ExxonMobil, October 27, 2022.

SOURCES: American Gas Association; DTE Energy; Xcel Energy; Association of Oil Pipe Lines; ExxonMobil; PHMSA. 2022. Regulatory Impact Analysis: Amendments to Parts 192 and 195 to Require Valve Installation and Minimum Rupture Detection Standards Proposed Rule, pp. 26–27. https://downloads.regulations.gov/PHMSA-2013-0255-0046/attachment_1.pdf.

pipelines were consulted.³ Although the cost estimates in the RIA did not account for the complexities associated with adding an RMV to an existing pipeline, many of the same cost factors were identified, leading to similarly wide cost ranges.

Operator-Reported Reasons for Installing Rupture Mitigation Valves

The results of the study committee’s pipeline operator survey, reviewed in Chapter 2, suggest that more than one-third of valves on existing hazardous

___________________

³ PHMSA. 2022. Regulatory Impact Analysis: Amendments to Parts 192 and 195 to Require Valve Installation and Minimum Rupture Detection Standards Proposed Rule, pp. 26–27, Table 5-3. https://downloads.regulations.gov/PHMSA-2013-0255-0046/attachment_1.pdf.

liquid and gas transmission pipelines are RMVs.⁴ Some operators have made determinations that favor the use of these valves for operational and/or safety purposes. The committee, therefore, asked the pipeline operators who have installed RMVs to explain their reasons for doing so. Indeed, many reported that they have instituted programs for the identification of candidate sites for RMV installations and their prioritization.

In the case of gas transmission pipelines, a commonality of these operator installation programs is the prioritization of high-population locations. Pacific Gas and Electric (PG&E), for instance, reported that its program, which was instituted in response to mandates stemming from the 2010 San Bruno rupture, prioritizes pipelines with diameters greater than 12.75 inches located in Class 3 and 4 locations with a target post-rupture gas evacuation time of 30 minutes or less.⁵ PG&E reported that between 2015 and 2022, it installed about 200 RMVs, bringing the total number of RMVs to about 400 across the company’s entire transmission pipeline system.⁶ Like PG&E, Xcel Energy prioritizes Class 3 and 4 locations. The priorities are informed by a ranking system that accounts for pipeline diameter and volume, specific risks associated with the setting, results from IM assessments, the potential for third-party damage, and the time required for personnel to access the valve location. From January 2011 to October 2022, Xcel Energy installed 373 RMVs across about 150 sites. The installations included a mix of manual valve retrofits (by adding actuators and controls) and full valve replacements.⁷

The gas transmission pipeline operator DTE Energy reported that its risk assessments resulted in the identification of nearly 200 candidate sites for RMVs.⁸ The original plan was to upgrade 15 to 20 valves per year over a 10-year period through 2020; however, following the satisfactory results from the closing of an RMV during an incident in 2016, the company accelerated the installation process to complete the planned installations about 2 years early. The 2016 incident involved a motor vehicle that crashed through a fence and struck an aboveground valve station. While the control center lost communication with the damaged station and its remote-control valves, controllers received low-pressure alarms from nearby stations, including one located approximately 20 miles upstream from the crash site.

___________________

⁴ When remote-control valves are installed for operational purposes mainly, one might question whether they should be referred to as RMVs. Such distinctions are not made here as the term RMV is used generally in reference to automatic and remote-control valves under the assumption that such valves may be used during normal, abnormal, and emergency conditions.

⁵ In these scenarios, the gas evacuation time is the duration from valve closure to the time when pipeline pressure has reached equilibrium.

⁶ Presented by Dirk Ayala from PG&E, April 26, 2022.

⁷ Presented by Sue King and Mike O’Shea from Xcel Energy, October 27, 2022.

⁸ Presented by Timothy Lajiness and Tyler Shanteau, DTE Energy, April 26, 2022.

By closing the remote-control valve at this upstream location, control room personnel were able to slow the gas flow to the incident site within 5 minutes of initial indications of a failure, minimizing the consequences.

It merits noting, however, that some of the consulted pipeline operators maintained that RMV installation decisions are best made within the broader context of their IM risk assessment and management planning, which includes consideration of all risk reduction options. The hazardous liquid pipeline operator ExxonMobil, for instance, explained that it had previously instituted a program focused on prioritizing RMV installations but has since reoriented these efforts to consider the wider array of risk management options available, from enhanced surveillance, inspection, and maintenance to pipeline replacement, in addition to installing RMVs in some locations.

RUPTURE MITIGATION VALVE ASSESSMENTS IN INTEGRITY MANAGEMENT REQUIREMENTS

Operator programs and protocols for assessing RMVs warrant consideration within the context of PHMSA’s IM regulatory requirements. In the sections that follow, consideration is given first to provisions in IM requirements that call specifically for assessments of RMVs.⁹ In the IM regulations that apply to hazardous liquid and gas transmission pipelines in HCAs, the installation of RMVs (specifically remote-control valves and emergency flow restricting devices [EFRDs]) is called out as a risk reduction measure that should be considered by an operator (see Box 5-1). The installations are not directly required, which comports with each IM rule’s emphasis on giving operators latitude to make risk-based and situation-specific choices about the use of preventive and mitigative measures that exceed the minimum federal requirements.

Accordingly, the discussion concludes with a review of the requirements and guidance in the IM rules for risk assessments that are supposed to inform choices about when and where to install RMVs.

It merits noting that the aperture for risk assessment is much wider for PHMSA when it makes determinations about the desirability of a broad-based regulatory intervention, as it did when requiring RMVs for all newly constructed and entirely replaced segments of pipelines.

PHMSA, like most federal agencies, is required by law and executive orders to conduct RIAs during rulemaking, and as part of these assessments the agency must make benefit-cost calculations about the desirability of a requirement that considers the net benefits of the regulatory intervention

___________________

⁹ 49 CFR 192.935(a) (Gas Transmission Pipelines) and 49 CFR 195.452(i)(1) (Hazardous Liquid Pipelines).

when applied generally. There are reasons that a safety regulator may decide that a general (e.g., industrywide) intervention is preferable to allowing individual operators to make choices even when the intervention is not cost-beneficial across all specific sites. These reasons can include the ease of enforcing a requirement that applies to all operators and a finding that the intervention would be cost-beneficial a large majority of the time.

Integrity Management Obligations Specific to Rupture Mitigation Valves

The IM rules for hazardous liquid pipelines in HCAs¹⁰ reference RMVs (or specifically EFRDs that include automatic and remote-control shutoff valves and check valves) among a number of preventive and mitigative measures that an operator should consider for risk reduction, such as enhanced monitoring of cathodic protection, shorter inspection intervals, and additional training of personnel.¹¹ Box 5-1 presents the regulatory direction that is given to a hazardous liquid pipeline operator for evaluating an RMV installation. The regulation states that when an operator evaluates RMVs (i.e., EFRDs) and determines that these devices are “needed,” the operator must install them. To make this determination, the regulation states that the operator must at least consider the following factors: the swiftness of leak detection and pipeline shutdown capabilities, the type of commodity carried, the rate of potential leakage, the volume that can be released, topography or pipeline profile, the potential for ignition, proximity to power sources, location of nearest response personnel, specific terrain between the pipeline segment and the HCA, and benefits expected by reducing the spill size. The regulatory direction and accompanying guidance, however, do not stipulate the evaluation criteria that an operator must use to establish “need.” The direction and guidance, for instance, do not establish what constitutes an insufficiently “swift” pipeline shutdown capability.

The IM regulatory text that applies to gas transmission pipeline operators and their evaluations of remote-control valves (i.e., RMVs) is also provided in Box 5-1. It states that an operator must consider these devices when conducting required risk analyses. The requirements stipulate that if an operator determines, based on a risk analysis, that an RMV (or alternative equivalent technology) would be “an efficient means” of adding protection to an HCA, then the operator must install the device. Here again, what constitutes an “efficient means” is not defined, although the operator

___________________

¹⁰ 49 CFR Part 195.452(i).

¹¹ The requirement to identify and implement additional preventive and mitigative measures for HCAs does not stipulate that an operator must consider RMVs.

is expected to consider many of the same factors listed for hazardous liquid pipeline operators, including the timing of pipeline shutdown capabilities.

The lack of specific regulatory direction and guidance on how an operator should establish whether an RMV installation is a “needed” or “efficient” means of adding protection may stem from PHMSA’s adherence to the “nonapplication clause” in the U.S. Code. As discussed in Chapter 1, that clause states that a “design, installation, construction, initial inspection, or initial testing standard does not apply to a pipeline facility existing when the standard is adopted.”¹² PHMSA has maintained, as recently as 2020, that it can only issue advisory bulletins and not new standards that are

___________________

¹² Title 49 USC § 60104(b).

retroactive to existing pipeline facilities because of this statutory language.¹³ As reported in Chapter 1, the National Transportation Safety Board (NTSB) believes PHMSA does indeed have the authority to require the use of RMVs on existing pipelines; however, NTSB nevertheless requested that Congress make this authority explicit by exempting RMV installations from the nonapplication clause.

PHMSA enforcement guidance for inspections of hazardous liquid pipeline IM programs emphasizes that operators must conduct RMV evaluations, albeit without direction on how factors such as the swiftness of the

___________________

¹³ Official correspondence from Howard R. Elliott, PHMSA administrator, to the National Transportation Safety Board (NTSB) regarding NTSB Recommendation P-19-014, January 22, 2020.

pipeline’s shutdown capability should be judged. The guidance stipulates the following:

In accordance with this guidance, inspectors are instructed to review an operator’s IM documents to see whether an operator has conducted the requisite RMV (EFRD) evaluation; if not, the inspector should cite the operator for being out of compliance with the requirements of 49 CFR Part 195.452(i)(4). A review of PHMSA enforcement cases opened during 2018–2022 reveals 1,108 cases that involved the IM programs of hazardous liquid and gas transmission pipeline operators (see Table 5-2).¹⁵ Of these cases, 66 involved reviews of operator risk analyses and HCA identifications. Because PHMSA does not publish data on the total number of IM program inspections conducted per year, it was not possible to calculate IM compliance violation rates based on these 1,108 cases.¹⁶ A review of the documentation from these cases, however, revealed that 66 cases involved issues arising from reviews of operator risk analyses and/or HCA identifications.

A closer review of these 66 cases reveals that 14 involved a failure of the operator to conduct an RMV (EFRD) analysis or to install an RMV in accordance with the results of an analysis. The inadequacies cited in the 14 cases and their disposition are summarized below. Of the 14 cases, 9 involved operators not performing the required EFRD analysis or not updating the analysis as warranted. In three cases, the operators did not have EFRD analysis documents available for inspection. In two cases, the inspectors cited the operator for having an inadequate EFRD analysis. Summaries of the 14 cases are as follows:

___________________

¹⁴ PHMSA. 2015. Hazardous Liquid Integrity Management Enforcement Guidance Sections 195.450 and 452. https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/docs/Hazardous_Liquid_IM_Enforcement_Guidance_12_7_2015.pdf. For enforcement guidance regarding 49 CFR 195.452(i)(4), see p. 123.

¹⁵ See https://primis.phmsa.dot.gov/comm/reports/enforce/CasesOpen_opid_0.html?nocache=2365#_TP_1_tab_2.

¹⁶ In a personal communication with PHMSA program staff (April 20, 2023), project staff were notified that information on IM inspection totals could be sought through a Freedom of Information Act request.

TABLE 5-2 PHMSA IM Enforcement Cases for Hazardous Liquid and Gas Transmission Pipelines, 2018–2022

NOTES: The enforcement actions identified are only those related to provisions the operator must take for identifying a pipeline segment in an HCA (or that could affect an HCA) and the evaluations an operator must perform on additional measures to prevent and mitigate the consequences of a failure, including an evaluation of the need to install an RMV (i.e., EFRDs, remote-control valves).

SOURCE: PHMSA. Pipeline Safety Enforcement Program, Summary of Enforcement Activity-Nationwide. https://primis.phmsa.dot.gov/comm/reports/enforce/Enforcement.html?nocache=6308.

1. Inadequate process for performing a risk analysis to identify preventive and mitigative measures, and the EFRD evaluation does not consider all required factors. The operator amended the IM program procedures to address the findings (CPF 5-2018-6002).
2. EFRD evaluation had not been completed. PHMSA determined that the operator’s revisions addressed inadequacies and that no further action was necessary (CPF 3-2019-5018).
3. Failure to provide records that show that an evaluation for the need or lack of need for additional EFRDs had been carried out. The operator later located and provided the required evaluation documents (CPF 4-2019-5016).
4. Failure to conduct an EFRD evaluation in accordance with the operator’s IM program manual. PHMSA assessed a penalty of

$46,600 and required the operator to complete the evaluation per its IM program manual and submit it (CPF 4-2019-5024).

5. Failure to conduct a periodic evaluation of pipeline segments to identify the need for additional prevention and mitigation measures. PHMSA had required the operator to install an EFRD as identified in the operator’s EFRD analysis report conducted the year before (CPF 4-2020-5001).
6. Failure to provide documents to support the analyses, determinations, and decisions used for an evaluation of EFRDs. The required documents were later provided (CPF 5-2020-5001W).
7. Failure to identify preventive and mitigative measures to determine if EFRDs were needed. Following a hearing, PHMSA required the operator to carry out an EFRD evaluation and to submit the results (CPF 4-2020-5006).
8. Failure to reevaluate EFRD analysis for 13 years while operating conditions on the pipeline system changed. PHMSA required the operator to revise procedures and conduct a new EFRD evaluation (CPF 4-2020-5017).
9. Failure to determine the need for additional preventive and mitigative measures. Operator provided an action plan to revise the procedures and complete the EFRD evaluation (CPF 4-2021-016 NOPV).
10. Failure to establish a process for documenting the determination of whether EFRDs should be installed. Operator responded that it would amend its IM program to address the finding (CPF 4-2021-028 NOA).
11. Inadequate procedures for determining preventive and mitigative measures. The operator simply referred to a 1995 study by a research institute that states it is statistically unlikely that an EFRD will mitigate the consequences of a pipeline failure. The operator was required to perform an EFRD evaluation, which PHMSA later determined addressed the inadequacies (CPF 4-2021-020 NOA).
12. EFRD evaluation documentation was missing. Operators responded that an EFRD study had been conducted but records could not be located. The records were found and submitted to PHMSA, which determined that no additional enforcement actions were needed (CPF 3-2022-005-WL).
13. Failure to conduct an EFRD evaluation. PHMSA required the operator to conduct the evaluation (CPF-4-2022-062-NOPV).
14. Failure to perform an evaluation to determine whether EFRDs are needed. PHMSA required the EFRD evaluation to be submitted within 90 days (CPF 4-2022-041-NOPV).

It merits noting that one of the cited hazardous liquid pipeline operators (see CPF 4-2020-5006) petitioned PHMSA to withdraw the finding that it had not conducted an EFRD evaluation. The operator maintained that the regulations do not clearly stipulate that such an analysis is always required. The operator pointed to language in 49 CFR 195.452(i)(1), which states that an operator “must take measures to prevent and mitigate the consequences of a pipeline failure that could affect a high consequence area. These measures include conducting a risk analysis of the pipeline segment to identify additional actions to enhance public safety or environmental protection. Such actions may include [italic added], but are not limited to … installing EFRDs on the pipeline segment.” The operator claimed that because its general risk analysis did not identify a need for additional safety measures it was not obligated to perform a subsequent EFRD analysis. PHMSA’s Office of Pipeline Safety denied the petition on the grounds that the requirement for an EFRD evaluation is not contingent on the results of the general risk analysis.¹⁷

The 14 cases indicate that inspectors are indeed examining operator IM program documents for evidence of EFRD evaluations. However, the cases do not provide insight into whether inspectors are routinely examining the quality of the EFRD evaluations, as only two cases were brought for inadequate evaluations. While a review of the initial findings in safety inspector reports, as opposed to later-stage PHMSA enforcement actions, could potentially provide insight into whether the evaluations are being thoroughly reviewed by inspectors, such detailed records were not available to the study committee.

The Rupture Mitigation Valve Isolation-Time Performance Standard Applicable to New Pipelines

As discussed in Chapter 3, PHMSA’s April 2022 valve installation and rupture detection rule, which applies to newly constructed and entirely replaced segments of pipelines only, requires the installation of RMVs (or alternative equivalent technology). The rule establishes a requirement that as soon as practicable, but within 30 minutes of rupture identification, an operator must fully close any RMVs or alternative equivalent technologies to minimize the volume of product released and mitigate the consequences of a rupture. If an operator wants to use a manual valve, it must demonstrate that the manual closure of the valve can meet this 30-minute rupture isolation time and that installing an RMV is economically, technically, or operationally infeasible. PHMSA references “prohibitive” costs as an

___________________

¹⁷ In the matter of Enlink Midstream, LLC, CPF No. 4-2020-5006, Decision on Petition for Reconsideration, January 4, 2021.

example of economic infeasibility. The rulemaking notice also provides examples of installations that could be technically or operationally infeasible, such as when power or communications cannot be brought to a remote site. In all cases, the operator would need to obtain PHMSA’s preapproval of an infeasibility determination. In its notice, PHMSA points to the unanimous endorsement of this 30-minute performance standard by the Gas Pipeline and Liquid Pipeline Advisory Committees, which found that this time limit would be “technically feasible, cost-effective, and practicable” in most cases.¹⁸

Risk Models to Inform Decisions on Rupture Mitigation Valves and Other Risk Reduction Strategies

Although the regulatory requirements for RMV evaluations that apply to existing pipelines do not contain an evaluation metric similar to the 30-min-ute standard for new pipelines, the IM rules obligate operators to conduct risk assessments that evaluate a suite of preventive and mitigative measures, as discussed in Chapter 3. When such IM risk assessments are conducted in a deliberate and systematic manner, it is reasonable to expect that RMVs will be among the suite of measures examined, irrespective of the follow-on requirement to evaluate RMVs. For example, along with examining other risk reduction options, an IM risk assessment might model optimal valve locations to reduce the potential release volume or impacts, test the impacts of upgrading an existing manual valve to an RMV, and assess how that might mitigate or reduce the severity of consequences of a pipeline rupture.

The regulations provide guidance for the implementation of an IM program that describes how to assess risk, including references to American Society of Mechanical Engineers (ASME) guidance.¹⁹ The guidance is clear that an operator’s risk assessment process should identify the site-specific events and conditions (i.e., threats) that could lead to a pipeline failure, provide an understanding of the likelihood and consequences of an event, and provide the nature and location of the most significant risks to the pipeline. In performing these assessments, operators are expected to use risk models as a central part of their risk assessments. Indeed, PHMSA inspections of IM programs are supposed to include reviews of operator risk assessment processes and the risk models that are used.

The referenced guidance for implementing pipeline IM programs points to the following four basic approaches for risk modeling in increasing order of sophistication and capacity to inform decision making: qualitative, relative assessment/index, quantitative system, and probabilistic (see Box 5-2).

___________________

¹⁸ 87 Fed. Register, 20955, April 8, 2022.

¹⁹ Appendix C to Part 195 and incorporation by reference to the ASME standard B31.8S.

The model that is selected can depend on the operator’s capabilities, data requirements, and pipeline characteristics and circumstances. For instance, the guidance suggests that an operator of a pipeline with little inherent risk because the facility is new and located in a sparsely populated area and with no geologic threats may elect to use a qualitative or indexing model (see Box 5-2). In contrast, a pipeline in a higher population area and installed with legacy construction practices may require a more sophisticated quantitative model to inform risk reduction choices.

Key parts of a risk model involve an assessment of the likelihood of an unwanted event occurring coupled with an assessment of the consequences of the event if it does occur. The former requires the identification of threats, including interactive threats, and assessments of their likelihood. The latter involves evaluations of the severity and losses associated with an unwanted event by considering factors such as the commodity’s hazard characteristics, potential release rate and volume, likely dispersion, and likely receptors (e.g., populations, the environment, or buildings). Quantitative risk assessments will identify a range of scenarios leading to product releases of various magnitudes and severities. The scenarios can range from minor leaks to rare ruptures that involve extensive environmental damage, property loss, and injuries and fatalities. A credible risk assessment will identify risks that are so large that they are intolerable and should be eliminated even at great cost. For most risks that are not at such intolerably high levels, mitigation through different interventions will require the use of risk models to predict each intervention’s expected risk reduction benefits.

Risk modeling requires a range of analytic tools and methods to support the full consideration of the potential consequences of a pipeline failure. For example, computational models are available and used by operators of hazardous liquid pipelines to predict the volume of product that could be released into an environmentally sensitive area and its potential spill paths. For natural gas transmission pipelines, similar models are available that predict vapor dispersion and the impact zones of thermal radiation from a jet fire. As another example, operators may use a geographic information system to map a pipeline in relation to the topographies, populations, structures, and environmentally sensitive areas that it traverses to present different risk factors.

In modeling the likelihood and potential consequences of failure scenarios, operators should then be able to use the models to evaluate a range of preventive and mitigative strategies, including the use of RMVs. However, after its investigations of major pipeline incidents, including the 2010 San Bruno gas transmission pipeline rupture, NTSB has raised concerns about operators not having sufficient guidance for selecting and implementing risk modeling tools and methods that can adequately inform prevention and mitigation choices. PHMSA also has expressed concern that findings from its investigations and inspections have revealed risk assessment approaches that lack sophistication and are too reliant on qualitative methods that produce only relative risk judgments (i.e., high, medium, low).²⁰

In response to these concerns, PHMSA formed a Risk Modeling Working Group composed of risk analysts from national laboratories and

___________________

²⁰ PHMSA. 2020. Pipeline Risk Modeling: Overview of Methods and Tools for Improved Implementation, p. 19. https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/2020-03/Pipeline-Risk-Modeling-Technical-Information-Document-02-01-2020-Final.pdf.

representatives of pipeline regulatory agencies, operators, and industry organizations.²¹ The group gathered information on state-of-the-art risk modeling methods and tools and their potential application in IM programs. In its 2020 report, the group concluded that quantitative and probabilistic risk models provide greater capabilities to inform risk reduction decisions than qualitative methods.²² The report emphasized that the selected model must allow for the estimation of potential risk reductions from implementing different measures by comparing baseline risks (without the measure) with risks after alternative measures are introduced. The report stressed that for a risk model to support such analyses adequately, its evaluation of consequences should be capable of reflecting changes to scenarios produced by different actions such as in pipeline operations, dispersion pathways, and the type and location of receptors. Furthermore, it was noted that the model should be able to produce consistent output for making comparisons, such as by producing standard risk units and uniformly denominated measures of consequences (probability of failure, expected loss, etc.).

In its report, the Risk Modeling Working Group acknowledged the challenges that can arise in obtaining the data needed for developing values for input variables in quantitative risk models, including data from pipeline system records (i.e., from routine operating, maintenance, surveillance, and inspection activities). The report notes that improving the scope and quality of input data can be an ongoing, long-term process. The report concludes, however, that an operator’s choice of a risk modeling method should not depend primarily on the quality and completeness of available data because steps can be taken to add and improve the quality of data over time.²³

Establishing the Benefits and Costs of Risk Reduction Measures

The Risk Modeling Working Group also pointed out that another advantage of quantitative risk models is that their standardized output can be used to identify the benefits and costs of alternative risk reduction measures. The large costs that can ensue from a pipeline rupture with a prolonged release of hazardous material and the wide range of RMV installation cost estimates provided by pipeline operators (as summarized in Table 5-1) suggest that commonly accepted methods for establishing the

___________________

²¹ PHMSA. 2016. Risk Modeling Work Group Mission Statement. https://www.phmsa.dot.gov/pipeline/risk-modeling-work-group/risk-modeling-work-group-mission-statement-word-doc.

²² PHMSA. 2020. Pipeline Risk Modeling: Overview of Methods and Tools for Improved Implementation. https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/2020-03/Pipeline-Risk-Modeling-Technical-Information-Document-02-01-2020-Final.pdf.

²³ PHMSA. 2020. Pipeline Risk Modeling: Overview of Methods and Tools for Improved Implementation, p. 74. https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/2020-03/Pipeline-Risk-Modeling-Technical-Information-Document-02-01-2020-Final.pdf.

benefits (e.g., harms avoided) and costs of risk reduction measures could be helpful to operators in making decisions about whether and where to install RMVs, especially when doing so requires significant capital outlays. However, PHMSA has offered little guidance for such decision making.²⁴ In its report, the Risk Modeling Working Group noted issues that can arise in the absence of such guidance—for instance, by observing that operators may be reluctant to express harms avoided, such as lives saved, in monetary terms, potentially leading to an understatement of the prospective benefits of some risk reduction measures.

As discussed above, because pipeline operators have elected to install RMVs voluntarily for both safety and operational reasons, they have concluded that the expected benefits justify the installation costs in these cases. Operators can be expected to make such choices when they compare the investment required against the avoidance of expected financial losses caused by damage to their facilities and the need to compensate shippers for lost product and third parties for damages. The investment may also yield benefits by avoiding cleanup costs and the loss of profits from the pipeline being out of service. In these cases, the installation costs can be ascertained with a high degree of accuracy, while the reduction in losses is an expectation. This is because ruptures occur with a probability in any given year at a given location, and RMVs may not be fully effective in reducing the magnitude of the damages caused by the rupture depending on the circumstances. Of course, in making the decision to install an RMV, the operator may also factor in the operational benefits of the device, which can be estimated more readily than the expected future safety benefits.

It is important to recognize that an operator’s determination of where and when to install RMVs may result in fewer RMVs on pipelines than is socially desirable for at least four reasons:

1. While releases impose private costs on operators (e.g., damage to equipment, repairs, loss of operating revenues), many of the consequences are externalities imposed on third parties such as landowners and those living close to the rupture site. Operators may be required to compensate these parties under tort law or by

___________________

²⁴ The following 2020 report sponsored by PHMSA offers a methodology for pipeline operators to use in conducting benefit-cost analyses for external leak detection systems: PHMSA. 2020. Cost-benefit Analysis of Deploying or Retrofitting External-based Leak Detection Sensors (dot.gov). https://primis.phmsa.dot.gov/matrix/FilGet.rdm?fil=14719. As a general resource for benefit-cost analysis, see the following: U.S. Department of Transportation. Benefit-Cost Analysis Guidance for Discretionary Grant Programs. https://www.transportation.gov/mission/office-secretary/office-policy/transportation-policy/benefit-cost-analysis-guidance.

statute;²⁵ however, several hurdles make it unlikely that operators will bear all the external costs. Only some injured victims will sue or file an administrative claim. Victims may not be aware of their legal rights, may not be able to obtain legal representation, or may not know how to file a claim on their own. Laws often limit liability to certain types of conduct and injuries. Finally, victims may win civil suits but still be insufficiently compensated for the losses and inconvenience they have suffered.

2. With some limited exceptions, operators are not held responsible for the full environmental cost of releases. The traditional common law mechanism for compensation—tort law—is anthropocentric. The law recognizes harm to the environment if it negatively affects the legal interests of individuals, organizations, or government entities. Natural resources themselves do not have standing to sue, nor can concerned individuals or organizations sue on their behalf. A few environmental statutes impose strict liability on operators for environmental harm, but these statutes only apply to certain spills.²⁶ Thus, in the absence of statutory liability, there are externalities borne by the environment.
3. Even if all the costs of a release could be internalized, society may take the view that the harm is unacceptable because the risk of harm could have been reduced through an RMV. That is, the public considers after-the-fact compensation to be an inadequate substitute for a precautionary measure that reduces risk. Society may also take the view that the public should not be exposed to more than a certain level of risk from pipeline operations. Beyond this level, the risk of an incident may be regarded as intolerable, even if there are legal remedies available.
4. Operators may take insufficient precautions to mitigate the consequences of ruptures because they are myopic in comparing the certain costs of investing in valves today with uncertain changes in the magnitude of ruptures that occur in a probabilistic fashion at random points in the future. Installing an RMV at a particular location now might mitigate a rupture that occurs next year, maybe in 12 years’ time, or maybe not until the next century. Some operators

___________________

²⁵ Under the federal Oil Pollution Act, the operator of a pipeline is responsible for certain damages to property, economic losses, and loss of subsistence natural resource use from a release of oil or oil products if there is a discharge into navigable waters or the adjoining shorelines or there is a substantial threat of such discharge (33 USC § 2702). There are also state laws that impose liability for oil spills, such as the California Lempert-Keene-Seastrand Oil Spill Prevention and Response Act. See California Government Code § 8670.56.5.

²⁶ These are the Oil Pollution Act and the Comprehensive Environmental Response, Compensation, and Liability Act (popularly known as the Superfund Law).

may be inexperienced in determining future financial risks and may additionally underplay future consequences (and regret it when faced with financial claims following an incident). Others may be aware of these future losses but downplay them because they have more short-term financial goals such as surviving a business downturn. Operators who, knowingly or unknowingly, downplay the future private benefits of RMVs underinvest in them.

For these reasons, the benefits and costs of preventive and mitigative measures need to be calculated in a rigorous, consistent, and transparent manner for the public’s interest to be served. This means that the costs incurred by and the benefit conferred on all parties should be considered, including those that are not normally measured in purely monetary terms such as mortality and injury risks and environmental damage. There is an extensive body of economic literature on valuing environmental costs and the value that should be placed on averting a statistical death, non-fatal physical injuries, and adverse health consequences that go beyond purely financial considerations such as lost wages and medical and funeral expenses. Past ruptures can be used as a guide to a portion of the likely environmental costs per unit of product released. Information is available on cleanup costs and settlement of lawsuits with affected residents and landowners.

Careful calculations of benefits and costs should also take timing into account. Most of the costs of RMV installation are borne in the present, with a smaller proportion represented by recurrent maintenance and testing, whereas the benefits of rupture mitigation at any location occur with a probability and at uncertain times in the future. Estimating the expected benefits in a given year from a risk mitigation measure, such as an RMV, may require multiplying the magnitude of the benefit from the measure if a rupture occurs by the probability that a rupture occurs in a given year at a particular location. The present value of the streams of expected benefits and costs over time can be calculated using discount rates.

Examples of benefits and costs for RMVs are shown in Table 5-3. Note that the calculation is of marginal benefits and costs. RMVs mitigate the magnitude of ruptures and not their probability. The appropriate benefit to consider is the reduction in the magnitude of consequences of a rupture if an RMV is present. The appropriate costs to consider are the additional costs incurred in installing and maintaining RMVs.

It is the study committee’s understanding that pipeline operators do not generally document the methods they use to assess the benefits and costs of alternative risk reduction measures, and that such methods are not subject to an inspector’s review. Thus, even as operators are required to document their risk modeling methods and results, they are not obligated to explain how these results are translated into decisions that have cost and benefit implications.

TABLE 5-3 Examples of Marginal Benefits and Marginal Costs of RMVs

^a Fines for non-compliance are typically regarded as neither a cost nor a benefit as they are monetary transfers from operators to the government. Administrative expenses associated with the penalties are, however, a cost.

SUMMARY POINTS

Operators Can Have Multiple Reasons for Installing Rupture Mitigation Valves

The incident and survey data indicate that gas transmission and hazardous liquid pipeline operators have made decisions to install RMVs under varied circumstances for operational and safety reasons. Some pipeline operators have established programs specifically to determine where RMVs are warranted, while others evaluate the applicability of the devices within the context of the overall planning and implementation of their IM programs and operational needs.

Operators Report Wide Variability in Rupture Mitigation Valve Installation Costs

The installation costs of RMVs can vary widely and be highly site-specific, from about $30,000 to more than $1 million per site. If the only requirement is the addition of an automatic or remote-control actuator to an existing valve, the installation cost is more likely to be on the lower end of the cost range but still be affected by factors such as pipe diameter and access to power and communications. Alternatively, if an operator needs to retrofit an older pipeline and place a valve in a location that did not previously have one, this installation could entail significant capital expenditures

for construction; new power and communication systems; state and local permitting; and site access, improvement, and restoration.

Integrity Management Rules Require Risk Modeling, But Methods Vary

The IM rules obligate operators to develop and implement risk management strategies that are informed by risk assessments. A credible risk assessment will identify all risks, including those that are so large that they are intolerable and should be eliminated even at great cost. For most risks that are not at such intolerably high levels, mitigation through different interventions will require the use of models to predict each intervention’s expected risk reduction effects.

Recognizing the importance of high-quality risk modeling by pipeline operators, PHMSA has increased its guidance on modeling risk and has emphasized the importance of using quantitative rather than qualitative methods. However, the extent to which operators employ such quantitative methods remains unclear, as does the adequacy of the guidance provided to operators and inspectors pertaining to risk modeling.

While rigorous, high-quality risk modeling is essential for predicting the risk reduction benefits of different preventive and mitigative measures, risk modeling alone cannot provide a standard for deciding when to implement a measure that will have costs to the operator. The IM regulations direct operators to consider risk reduction factors but do not specify how (or if) operators should consider the costs of each measure in relation to the benefits. The absence of consistent regulatory direction and guidance on how to make and justify decisions about the use of different preventive and mitigative measures raises questions about how operators are now establishing the need for RMVs and, more generally, about how they are prioritizing and making choices about all potential risk reduction measures they could employ.

Integrity Management Rules Require RMV Evaluations But Give Limited Direction

While such assessments would be expected to consider RMVs as an intervention option, PHMSA regulations also stipulate that an operator should specifically evaluate RMVs after the initial risk assessment is performed. The regulatory direction for conducting this supplemental RMV evaluation, however, is limited to specifying the factors an operator should consider during the evaluation. The regulations do not provide guidance or direction on the criteria to be used for assessing the factors, such as for assessing whether the pipeline’s shutdown capabilities are sufficiently swift.